From 46441da9c421d433025580434322f58a0eafd655 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 12:08:22 -0700
Subject: [PATCH 001/265] [rush-client-core] Reclaim provably stale daemon
 artifacts; make `daemon stop`/`restart` idempotent; add `daemon stop --force`
 (#6080)

* [rush-client-core] Reclaim provably stale daemon artifacts; make daemon stop/restart idempotent

Fixes #6061

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-client-core] Update API report and test expectation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-client-core] Address review: force stop clears leftovers after shutdown, validate records before waiting, reset hint on unresolved handoff

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-client-core] Update API report

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 apps/rush-cli-client/README.md                |  30 +-
 apps/rush-cli-client/src/daemonCommands.ts    |  79 +++++-
 .../src/test/launchClient.test.ts             |  81 +++++-
 .../daemon-recovery_2026-09-23.json           |  10 +
 .../daemon-recovery_2026-09-23.json           |  10 +
 common/reviews/api/rush-client-core.api.md    |  13 +
 libraries/rush-client-core/README.md          |  11 +-
 .../rush-client-core/src/DaemonOwnership.ts   | 258 ++++++++++++++++++
 .../rush-client-core/src/ProcessStartTime.ts  |  67 +++++
 .../src/connectOrStartDaemon.ts               |  90 ++----
 libraries/rush-client-core/src/index.ts       |   5 +
 .../src/test/ProcessStartTime.test.ts         |  31 +++
 .../src/test/connectOrStartDaemon.test.ts     | 147 +++++++++-
 13 files changed, 740 insertions(+), 92 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/daemon-recovery_2026-09-23.json
 create mode 100644 common/changes/@rushstack/rush-client-core/daemon-recovery_2026-09-23.json
 create mode 100644 libraries/rush-client-core/src/DaemonOwnership.ts
 create mode 100644 libraries/rush-client-core/src/ProcessStartTime.ts
 create mode 100644 libraries/rush-client-core/src/test/ProcessStartTime.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 483d671312..bb93cf69f5 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -257,19 +257,39 @@ attests a restart request, not completion of successor startup or success of a c
 
 `rush-client daemon stop` requires protocol >= 0.6 and waits for `shutdownAck`
 followed by EOF. It reports `state: "shutdownAccepted"` with exit code 0; this
-does not assert successful workspace disposal. An absent/unreachable daemon,
-unsupported protocol, missing acknowledgement, or timeout returns exit code 1.
-It does not auto-start anything.
+does not assert successful workspace disposal. Stop is idempotent: when nothing
+listens at the endpoint it reports `state: "notRunning"` with exit code 0. An
+unsupported protocol, missing acknowledgement, handshake failure, or timeout
+returns exit code 1. It does not auto-start anything.
+
+`rush-client daemon stop --force` stops a running daemon the same way, then waits
+(up to 15 seconds) for it to release its listener and ownership record and removes
+any remaining artifacts, such as an abandoned startup reservation, reporting them in
+`removedPaths`. When none is listening, it removes this workspace's leftover ownership record
+(`<key>.pid.json`), socket, and startup reservation (`.starting`), then reports
+`state: "reset"` and the `removedPaths` (or `state: "notRunning"` if nothing was
+left behind). It holds the start mutex, proves that no listener is bound, and
+refuses (exit 1) while the recorded owner PID still exists and cannot be shown to
+be a reused PID. It never kills a process. Automatic startup already reclaims
+the common leftovers on its own (see below); this is the documented escape hatch
+that every fail-closed startup message points to.
 
 `rush-client daemon restart` first verifies that the selected Rush version has a
 launcher and captures the original lock's PID/start timestamp, checking that it
 matches pong's positive PID and the selected endpoint, then performs acknowledged
 shutdown. It waits for original ownership release or a demonstrably dead owner
-before calling the existing locked starter. A live/reused owner fails closed at
+before calling the existing locked starter. A live owner fails closed at
 the startup deadline; no PID is killed and no live ownership record is deleted.
 A newly
 started/reused successor must pass hello/ping before reporting `state: "ready"`.
-An absent daemon must be started explicitly with `daemon start`.
+When nothing listens at the endpoint, restart starts a daemon exactly like `daemon start`.
+
+Automatic and explicit startup reclaim stale artifacts only when that is provably
+safe: while holding the start mutex with no `.starting` reservation, a socket
+without an ownership record, or an unreadable/corrupt record, is removed only after
+a connection attempt is refused (so no listener exists). On Linux, a record whose
+PID now belongs to a process that started after the record's `startedAt` (PID reuse)
+is treated as dead; other platforms fail closed and point to `daemon stop --force`.
 
 Restart is explicit even when automatic startup or CI execution routing is
 disabled, but conflicts with `--no-daemon`. The two-phase host retains ownership
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index d2c3e592b1..b6ad07750d 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -7,9 +7,14 @@ import {
   DaemonClient,
   connectOrStartDaemonAsync,
   requestDaemonShutdownAsync,
+  resetDaemonArtifactsAsync,
   type IConnectOrStartDaemonOptions
 } from '@rushstack/rush-client-core';
-import type { IDaemonLockfile } from '@rushstack/rush-daemon-transport';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  type IDaemonLockfile
+} from '@rushstack/rush-daemon-transport';
 import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
@@ -17,6 +22,8 @@ import { printDaemonLogAsync } from './daemonLogs';
 import { executeDaemonGraphCommandAsync } from './daemonGraph';
 import { writeStreamAsync } from './writeStreamAsync';
 
+const FORCE_STOP_WAIT_MS: number = 15000;
+
 export interface IDaemonCommandOptions {
   readonly argv: ReadonlyArray<string>;
   readonly environment: Readonly<NodeJS.ProcessEnv>;
@@ -38,14 +45,18 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
   if (
     (options.argv.length !== 1 &&
-      !(command === 'logs' && options.argv.length === 2 && options.argv[1] === '--follow')) ||
+      !(
+        options.argv.length === 2 &&
+        ((command === 'logs' && options.argv[1] === '--follow') ||
+          (command === 'stop' && options.argv[1] === '--force'))
+      )) ||
     (command !== 'start' &&
       command !== 'status' &&
       command !== 'stop' &&
       command !== 'restart' &&
       command !== 'logs')
   ) {
-    throw new Error('Usage: rush-client daemon start|status|stop|restart|logs [--follow]');
+    throw new Error('Usage: rush-client daemon start|status|stop [--force]|restart|logs [--follow]');
   }
   if (!options.rushJsonPath) throw new Error('Daemon management requires a repository containing rush.json.');
   const mayStart: boolean = command === 'start' || command === 'restart';
@@ -76,13 +87,52 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
   // Status observes the selected endpoint, including a compatible daemon from a different client version.
   // It never starts a process or trusts a PID file as evidence of readiness.
-  const client: DaemonClient =
+  const client: DaemonClient | undefined =
     command === 'start'
       ? await connectOrStartDaemonAsync(connectionOptions)
-      : await DaemonClient.connectAsync({ socketPath: connectionOptions.paths.socketPath });
+      : await connectExistingAsync(connectionOptions, command !== 'status');
+  if (!client) {
+    if (command === 'restart') {
+      // Nothing to shut down: restart behaves like start.
+      const started: DaemonClient = await connectOrStartDaemonAsync(connectionOptions);
+      try {
+        await writeStatusAsync({
+          state: 'ready',
+          socketPath: connectionOptions.paths.socketPath,
+          ...(await started.status)
+        });
+      } finally {
+        await started.closeAsync();
+      }
+      return;
+    }
+    const { removedPaths } =
+      options.argv[1] === '--force'
+        ? await resetDaemonArtifactsAsync(connectionOptions.paths)
+        : { removedPaths: [] };
+    await writeStatusAsync({
+      state: removedPaths.length > 0 ? 'reset' : 'notRunning',
+      socketPath: connectionOptions.paths.socketPath,
+      ...(options.argv[1] === '--force' ? { removedPaths } : {})
+    });
+    return;
+  }
   try {
     if (command === 'stop') {
       await client.shutdownAsync();
+      if (options.argv[1] === '--force') {
+        // Wait for the acknowledged daemon to release its listener and record, then clear leftovers
+        // such as an abandoned startup reservation in the same invocation.
+        const { removedPaths } = await resetDaemonArtifactsAsync(connectionOptions.paths, {
+          waitTimeoutMs: FORCE_STOP_WAIT_MS
+        });
+        await writeStatusAsync({
+          state: 'shutdownAccepted',
+          socketPath: connectionOptions.paths.socketPath,
+          removedPaths
+        });
+        return;
+      }
       await writeStatusAsync({
         state: 'shutdownAccepted',
         socketPath: connectionOptions.paths.socketPath
@@ -105,6 +155,25 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
 }
 
+/** Returns undefined when nothing listens at the endpoint and `allowAbsent` is set; other failures propagate. */
+async function connectExistingAsync(
+  options: IConnectOrStartDaemonOptions,
+  allowAbsent: boolean
+): Promise<DaemonClient | undefined> {
+  try {
+    return await DaemonClient.connectAsync({ socketPath: options.paths.socketPath });
+  } catch (error) {
+    if (
+      allowAbsent &&
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.connectionRefused
+    ) {
+      return undefined;
+    }
+    throw error;
+  }
+}
+
 async function restartDaemonAsync(
   client: DaemonClient,
   options: IConnectOrStartDaemonOptions
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index 14c8d888d9..b3ec694fca 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -248,13 +248,82 @@ describe('standalone rushx fallback', () => {
     expect((await invokeAsync(true, false, false, ['daemon', 'logs', '--follow', 'extra'])).code).toBe(1);
   });
 
-  it('does not start an absent daemon when stop or restart cannot be acknowledged', async () => {
-    for (const verb of ['stop', 'restart']) {
-      const result: IInvocationResult = await invokeAsync(true, false, false, ['daemon', verb]);
-      expect(result.code).toBe(1);
-      expect(result.stderr).toContain('Could not connect to daemon');
+  it('treats stop as idempotent and restart as start when no daemon is running', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    for (const args of [
+      ['daemon', 'stop'],
+      ['daemon', 'stop', '--force']
+    ]) {
+      const result: IInvocationResult = await invokeAsync(true, false, false, args);
+      expect(result).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(result.stdout)).toEqual({
+        state: 'notRunning',
+        socketPath: paths.socketPath,
+        ...(args[2] ? { removedPaths: [] } : {})
+      });
     }
-  });
+    try {
+      const restarted: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'restart']);
+      expect(restarted.stderr).toBe('');
+      expect(restarted.code).toBe(0);
+      expect(JSON.parse(restarted.stdout)).toMatchObject({ state: 'ready', socketPath: paths.socketPath });
+      const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop']);
+      expect(stopped.code).toBe(0);
+      expect(JSON.parse(stopped.stdout)).toMatchObject({ state: 'shutdownAccepted' });
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    }
+  }, 30000);
+
+  it('stop --force clears an abandoned startup reservation next to a running daemon', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    try {
+      expect((await invokeAsync(true, false, false, ['daemon', 'start'])).code).toBe(0);
+      fs.writeFileSync(reservation, 'abandoned');
+      const result: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+      expect(result).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(result.stdout)).toEqual({
+        state: 'shutdownAccepted',
+        socketPath: paths.socketPath,
+        removedPaths: [reservation]
+      });
+      expect(fs.existsSync(reservation)).toBe(false);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'stop --force removes stale artifacts left by a killed daemon',
+    async () => {
+      const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+      fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+      const listener: ChildProcess = spawn(
+        process.execPath,
+        [
+          '-e',
+          `require('net').createServer().listen(${JSON.stringify(paths.socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+        ],
+        { stdio: 'ignore' }
+      );
+      await once(listener, 'close');
+      fs.writeFileSync(paths.lockfilePath, 'garbage{');
+      const result: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+      expect(result).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(result.stdout)).toEqual({
+        state: 'reset',
+        socketPath: paths.socketPath,
+        removedPaths: [paths.lockfilePath, paths.socketPath]
+      });
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+      expect(fs.existsSync(paths.socketPath)).toBe(false);
+    }
+  );
 
   it.each([false, true])(
     'restarts after ownership release and stops the successor (embedded: %s)',
diff --git a/common/changes/@rushstack/rush-cli-client/daemon-recovery_2026-09-23.json b/common/changes/@rushstack/rush-cli-client/daemon-recovery_2026-09-23.json
new file mode 100644
index 0000000000..ddc56a8ade
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/daemon-recovery_2026-09-23.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Make `rush-client daemon stop` idempotent (state notRunning, exit 0), make `daemon restart` start a daemon when none is running, and add `daemon stop --force` to remove stale workspace daemon artifacts.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-client-core/daemon-recovery_2026-09-23.json b/common/changes/@rushstack/rush-client-core/daemon-recovery_2026-09-23.json
new file mode 100644
index 0000000000..4dbf5f28e0
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/daemon-recovery_2026-09-23.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Reclaim provably stale daemon artifacts (a socket without an ownership record, a corrupt record, or a Linux PID reused since the record was written) instead of permanently disabling the daemon, and add resetDaemonArtifactsAsync() as the explicit recovery path referenced by fail-closed messages.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 103df5d039..a731a4a1d2 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -81,6 +81,16 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
     readonly startupTimeoutMs?: number;
 }
 
+// @beta
+export interface IDaemonArtifactResetOptions {
+    readonly waitTimeoutMs?: number;
+}
+
+// @beta
+export interface IDaemonArtifactResetResult {
+    readonly removedPaths: ReadonlyArray<string>;
+}
+
 // @beta
 export interface IDaemonClientConnectOptions {
     // (undocumented)
@@ -131,4 +141,7 @@ export interface IDaemonStartCommand {
 // @beta
 export function requestDaemonShutdownAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<Pick<IDaemonLockfile, 'pid' | 'startedAt'>>;
 
+// @beta
+export function resetDaemonArtifactsAsync(paths: IDaemonPaths, options?: IDaemonArtifactResetOptions): Promise<IDaemonArtifactResetResult>;
+
 ```
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 6c1afe75e6..86142f10ee 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -48,7 +48,13 @@ handing the explicit command to a detached startup helper. The helper spawns wit
 a shell and retains that reservation until the daemon completes hello/ping readiness,
 independently of whether the requesting client survives. Clients still await
 hello/pong under bounded backoff. Stdout/stderr go to `<lockfilePath>.log`. No PID
-is killed; a live (possibly reused) PID with an unreachable socket fails closed.
+is killed. While holding the mutex with no startup reservation, stale leftovers are
+reclaimed only when provably safe: a socket without an ownership record, or a corrupt
+record, once a connection attempt is refused (no listener exists); and, on Linux, a
+record whose PID now belongs to a process that started after the record's `startedAt`
+(PID reuse, detected from `/proc`). Any other live PID with an unreachable socket fails
+closed, pointing to `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`),
+which removes the record, socket and reservation after the same no-listener/no-live-owner checks.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
 readiness. The explicit launcher's cwd is unchanged.
 
@@ -90,7 +96,8 @@ identifies the original ownership record by its `pid` and `startedAt`, captured
 before sending shutdown. Startup waits until that record disappears, another
 owner replaces it, or its owner is demonstrably dead. A new owner is checked by
 hello/ping; it is never blindly reclaimed. Signal 0 is only a liveness probe; no
-process is killed. A live/reused owner times out conservatively, while corrupt or
+process is killed. A live owner times out conservatively (a Linux PID provably reused
+since `startedAt` counts as dead), while corrupt or
 unreadable metadata fails closed.
 During a captured predecessor handoff, transient Windows sharing-denied reads stay
 unknown and are retried only within the existing startup deadline. They never
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
new file mode 100644
index 0000000000..a7226d0ee9
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -0,0 +1,258 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonLockfile, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from './DaemonClientError';
+import { getDaemonStartupFilePath } from './DaemonStartup';
+import { isProcessStartedAfter } from './ProcessStartTime';
+import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+
+const PROBE_TIMEOUT_MS: number = 1000;
+const RESET_RETRY_MS: number = 100;
+
+/** Printed wherever automatic recovery fails closed. */
+export const DAEMON_RESET_HINT: string =
+  'If no daemon is running for this workspace, run "rush-client daemon stop --force" to remove its stale files.';
+
+export type DaemonOwnership = Pick<IDaemonLockfile, 'pid' | 'startedAt'>;
+
+type OwnershipState =
+  | { readonly kind: 'absent' }
+  | { readonly kind: 'corrupt'; readonly raw: string }
+  | { readonly kind: 'owned'; readonly raw: string; readonly owner: DaemonOwnership };
+
+/** Options for {@link resetDaemonArtifactsAsync}. @beta */
+export interface IDaemonArtifactResetOptions {
+  /** How long to keep re-checking a bound listener, live owner, or held start mutex. Defaults to 0. */
+  readonly waitTimeoutMs?: number;
+}
+
+/** The result of {@link resetDaemonArtifactsAsync}. @beta */
+export interface IDaemonArtifactResetResult {
+  /** The stale files that were removed; empty when nothing was left behind. */
+  readonly removedPaths: ReadonlyArray<string>;
+}
+
+export function isDaemonOwnership(record: unknown): record is DaemonOwnership {
+  return (
+    typeof record === 'object' &&
+    record !== null &&
+    'pid' in record &&
+    typeof record.pid === 'number' &&
+    Number.isSafeInteger(record.pid) &&
+    record.pid > 0 &&
+    'startedAt' in record &&
+    typeof record.startedAt === 'string' &&
+    Number.isFinite(Date.parse(record.startedAt))
+  );
+}
+
+export function readDaemonOwnership(lockfilePath: string): DaemonOwnership | undefined {
+  let record: unknown;
+  try {
+    record = JSON.parse(fs.readFileSync(lockfilePath, 'utf8'));
+  } catch (error) {
+    if (hasErrorCode(error, 'ENOENT')) return undefined;
+    throw new DaemonClientError(
+      'startupFailed',
+      `Cannot safely read ${lockfilePath}; refusing automatic reclaim. ${DAEMON_RESET_HINT}`,
+      { cause: error }
+    );
+  }
+  if (!isDaemonOwnership(record)) {
+    throw new DaemonClientError(
+      'startupFailed',
+      `Invalid daemon ownership record in ${lockfilePath}; refusing automatic reclaim. ${DAEMON_RESET_HINT}`
+    );
+  }
+  return { pid: record.pid, startedAt: record.startedAt };
+}
+
+export function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (hasErrorCode(error, 'ESRCH')) return false;
+    throw error;
+  }
+}
+
+/**
+ * True unless the recorded owner is demonstrably gone: its PID does not exist, or the process now using
+ * that PID started after the record was written (PID reuse).
+ */
+export function isOwnerProcessAlive(owner: { readonly pid: number; readonly startedAt?: unknown }): boolean {
+  if (!isProcessAlive(owner.pid)) return false;
+  return !(typeof owner.startedAt === 'string' && isProcessStartedAfter(owner.pid, owner.startedAt));
+}
+
+/**
+ * Makes stale ownership reclaimable when that is provably safe. The caller must hold the start mutex and
+ * have observed no startup reservation, so no legitimate daemon can be between bind and record publication;
+ * a refused connection then proves no listener exists.
+ */
+export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promise<void> {
+  const state: OwnershipState = inspectOwnership(paths.lockfilePath);
+  if (state.kind === 'owned' && !isProcessAlive(state.owner.pid)) return;
+  if (state.kind === 'owned' && !isProcessStartedAfter(state.owner.pid, state.owner.startedAt)) {
+    throw new DaemonClientError(
+      'startupFailed',
+      `PID ${state.owner.pid} still exists but the daemon is not ready. It may be a daemon that is still shutting down, or a reused PID; refusing to kill it or remove ${paths.lockfilePath}. ${DAEMON_RESET_HINT}`
+    );
+  }
+  if (state.kind === 'absent' && (process.platform === 'win32' || !fs.existsSync(paths.socketPath))) return;
+  if (!(await isEndpointUnboundAsync(paths.socketPath))) {
+    throw new DaemonClientError(
+      'startupFailed',
+      `${describeOwnership(state, paths)}, but ${paths.socketPath} did not refuse a connection; refusing automatic reclaim. ${DAEMON_RESET_HINT}`
+    );
+  }
+  // The transport reclaim then removes the unbound socket under its own two-factor checks.
+  if (state.kind !== 'absent') removeIfUnchanged(paths.lockfilePath, state.raw);
+}
+
+/**
+ * Removes this workspace's leftover daemon files (ownership record, socket, and startup reservation)
+ * after verifying that no listener is bound and that the recorded owner, if any, is gone.
+ * @remarks Never kills a process. Fails when another client holds the start mutex, a listener is bound,
+ * or the recorded owner is alive; with `waitTimeoutMs`, those conditions are re-checked until the deadline
+ * (for example, while a daemon that just acknowledged shutdown finishes its cleanup).
+ * @beta
+ */
+export async function resetDaemonArtifactsAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonArtifactResetOptions
+): Promise<IDaemonArtifactResetResult> {
+  const deadline: number = Date.now() + (options?.waitTimeoutMs ?? 0);
+  while (true) {
+    const outcome: IDaemonArtifactResetResult | DaemonClientError = await tryResetDaemonArtifactsAsync(paths);
+    if (!(outcome instanceof DaemonClientError)) return outcome;
+    if (Date.now() >= deadline) throw outcome;
+    await delayAsync(Math.min(RESET_RETRY_MS, Math.max(1, deadline - Date.now())));
+  }
+}
+
+/** Returns a (not thrown) error for conditions that may clear on their own. */
+async function tryResetDaemonArtifactsAsync(
+  paths: IDaemonPaths
+): Promise<IDaemonArtifactResetResult | DaemonClientError> {
+  if (!fs.existsSync(path.dirname(paths.lockfilePath))) return { removedPaths: [] };
+  const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+  if (!lock) {
+    return new DaemonClientError(
+      'startupFailed',
+      `Another client is starting the daemon for ${paths.lockfilePath}; retry after it finishes.`
+    );
+  }
+  try {
+    if (!(await isEndpointUnboundAsync(paths.socketPath))) {
+      return new DaemonClientError(
+        'startupFailed',
+        `A process is still listening at ${paths.socketPath}; use "rush-client daemon stop" to stop it.`
+      );
+    }
+    const state: OwnershipState = inspectOwnership(paths.lockfilePath);
+    if (state.kind === 'owned' && isOwnerProcessAlive(state.owner)) {
+      return new DaemonClientError(
+        'startupFailed',
+        `PID ${state.owner.pid} still owns ${paths.lockfilePath}; it may be a daemon that is shutting down. Wait for it to exit (or stop that process yourself), then retry. No process was killed.`
+      );
+    }
+    const removedPaths: string[] = [];
+    if (state.kind !== 'absent' && removeIfUnchanged(paths.lockfilePath, state.raw)) {
+      removedPaths.push(paths.lockfilePath);
+    }
+    const others: string[] = [getDaemonStartupFilePath(paths)];
+    if (process.platform !== 'win32') others.push(paths.socketPath);
+    for (const filePath of others) {
+      if (tryUnlink(filePath)) removedPaths.push(filePath);
+    }
+    return { removedPaths };
+  } finally {
+    await lock.releaseAsync();
+  }
+}
+
+/** Resolves true only when a connection attempt proves that nothing listens at the endpoint. */
+export function isEndpointUnboundAsync(socketPath: string): Promise<boolean> {
+  return new Promise<boolean>((resolve) => {
+    const socket: net.Socket = net.createConnection(socketPath);
+    const settle = (unbound: boolean): void => {
+      socket.destroy();
+      resolve(unbound);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS);
+    socket.once('connect', () => settle(false));
+    socket.once('timeout', () => settle(false));
+    socket.once('error', (error) => settle(hasErrorCode(error, 'ECONNREFUSED') || hasErrorCode(error, 'ENOENT')));
+  });
+}
+
+export function hasErrorCode(error: unknown, code: string): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
+}
+
+function inspectOwnership(lockfilePath: string): OwnershipState {
+  let raw: string;
+  try {
+    raw = fs.readFileSync(lockfilePath, 'utf8');
+  } catch (error) {
+    if (hasErrorCode(error, 'ENOENT')) return { kind: 'absent' };
+    throw new DaemonClientError(
+      'startupFailed',
+      `Cannot safely read ${lockfilePath}; refusing automatic reclaim. ${DAEMON_RESET_HINT}`,
+      { cause: error }
+    );
+  }
+  let record: unknown;
+  try {
+    record = JSON.parse(raw);
+  } catch {
+    return { kind: 'corrupt', raw };
+  }
+  return isDaemonOwnership(record)
+    ? { kind: 'owned', raw, owner: { pid: record.pid, startedAt: record.startedAt } }
+    : { kind: 'corrupt', raw };
+}
+
+function describeOwnership(state: OwnershipState, paths: IDaemonPaths): string {
+  switch (state.kind) {
+    case 'absent':
+      return `Socket ${paths.socketPath} has no ownership record`;
+    case 'corrupt':
+      return `Invalid daemon ownership record in ${paths.lockfilePath}`;
+    default:
+      return `PID ${state.owner.pid} was reused by a process that started after ${paths.lockfilePath} was written`;
+  }
+}
+
+function removeIfUnchanged(filePath: string, expected: string): boolean {
+  let current: string;
+  try {
+    current = fs.readFileSync(filePath, 'utf8');
+  } catch (error) {
+    if (hasErrorCode(error, 'ENOENT')) return false;
+    throw error;
+  }
+  if (current !== expected) {
+    throw new DaemonClientError('startupFailed', `${filePath} changed during reclaim; refusing to remove it.`);
+  }
+  return tryUnlink(filePath);
+}
+
+function tryUnlink(filePath: string): boolean {
+  try {
+    fs.unlinkSync(filePath);
+    return true;
+  } catch (error) {
+    if (hasErrorCode(error, 'ENOENT')) return false;
+    throw error;
+  }
+}
diff --git a/libraries/rush-client-core/src/ProcessStartTime.ts b/libraries/rush-client-core/src/ProcessStartTime.ts
new file mode 100644
index 0000000000..a258752e5d
--- /dev/null
+++ b/libraries/rush-client-core/src/ProcessStartTime.ts
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import { performance } from 'node:perf_hooks';
+
+// USER_HZ is fixed at 100 on mainstream Linux ABIs; it is verified against this process before use.
+const USER_HZ: number = 100;
+const PROC_STAT_START_TIME_FIELD: number = 22;
+const MAX_CALIBRATION_ERROR_MS: number = 1000;
+/** A process that began this long after a record was written cannot be the record's writer. */
+const MIN_REUSE_MARGIN_MS: number = 2000;
+
+/**
+ * Returns the wall-clock start time of `pid`, or `undefined` when it cannot be determined reliably.
+ * Only Linux `/proc` is supported; other platforms always return `undefined` (unknown).
+ */
+export function tryGetProcessStartTimeMs(pid: number): number | undefined {
+  if (process.platform !== 'linux') return undefined;
+  const uptimeSeconds: number | undefined = readUptimeSeconds();
+  const selfStartSeconds: number | undefined = readStartSeconds('self');
+  if (uptimeSeconds === undefined || selfStartSeconds === undefined) return undefined;
+  const now: number = Date.now();
+  const selfStartMs: number = now - (uptimeSeconds - selfStartSeconds) * 1000;
+  // Guards against an unexpected USER_HZ, a non-standard /proc, or a wall-clock jump since this process began.
+  if (Math.abs(selfStartMs - performance.timeOrigin) > MAX_CALIBRATION_ERROR_MS) return undefined;
+  const startSeconds: number | undefined = readStartSeconds(pid);
+  return startSeconds === undefined ? undefined : now - (uptimeSeconds - startSeconds) * 1000;
+}
+
+/**
+ * True only when `pid` provably started after `recordedAt`, so it cannot be the process that wrote a record
+ * at that time (the PID was reused). Unknown start times return false.
+ */
+export function isProcessStartedAfter(pid: number, recordedAt: string): boolean {
+  const recordedMs: number = Date.parse(recordedAt);
+  if (!Number.isFinite(recordedMs)) return false;
+  const startMs: number | undefined = tryGetProcessStartTimeMs(pid);
+  return startMs !== undefined && startMs > recordedMs + MIN_REUSE_MARGIN_MS;
+}
+
+function readUptimeSeconds(): number | undefined {
+  try {
+    const uptime: number = Number.parseFloat(fs.readFileSync('/proc/uptime', 'utf8').split(' ')[0]);
+    return Number.isFinite(uptime) ? uptime : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function readStartSeconds(pid: number | 'self'): number | undefined {
+  let stat: string;
+  try {
+    stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  } catch {
+    return undefined;
+  }
+  // The command name (field 2) may contain spaces and parentheses; fields after it never do.
+  const commandEnd: number = stat.lastIndexOf(')');
+  if (commandEnd < 0) return undefined;
+  const fields: string[] = stat
+    .slice(commandEnd + 1)
+    .trim()
+    .split(' ');
+  const jiffies: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
+  return Number.isSafeInteger(jiffies) && jiffies >= 0 ? jiffies / USER_HZ : undefined;
+}
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 866bde97c4..83cc47ddee 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -21,6 +21,15 @@ import {
 import { DaemonClient, type IDaemonClientConnectOptions } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
 import { getDaemonLogFilePath } from './DaemonLogFile';
+import {
+  DAEMON_RESET_HINT,
+  hasErrorCode,
+  isDaemonOwnership,
+  isOwnerProcessAlive,
+  readDaemonOwnership,
+  reclaimAbandonedOwnershipAsync,
+  type DaemonOwnership
+} from './DaemonOwnership';
 import {
   getDaemonStartupFilePath,
   reserveDaemonStartup,
@@ -127,7 +136,7 @@ async function startDaemonAsync(
       if (Date.now() >= deadline) {
         throw startupError(
           options,
-          `has an unresolved startup handoff at ${getDaemonStartupFilePath(options.paths)}; refusing another launch`
+          `has an unresolved startup handoff at ${getDaemonStartupFilePath(options.paths)}; refusing another launch. ${DAEMON_RESET_HINT}`
         );
       }
       await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
@@ -141,7 +150,7 @@ async function startDaemonAsync(
     const handoff: DaemonClient | undefined = await waitForHandoffAsync(options, deadline);
     if (handoff) return handoff;
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before reclaim');
-    assertNoLiveOwner(options.paths);
+    await reclaimAbandonedOwnershipAsync(options.paths);
     await reclaimStaleDaemonAsync(options.paths);
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before spawn');
     options.abortSignal?.throwIfAborted();
@@ -290,8 +299,13 @@ async function waitForHandoffAsync(
   let backoffMs: number = 50;
   while (Date.now() < deadline) {
     const owner: IDaemonLockfile | undefined = readDaemonLockfile(options.paths.lockfilePath);
-    // Only wait on a fully published endpoint; malformed or ambiguous ownership still fails closed.
-    if (!owner || owner.socketPath !== options.paths.socketPath || !isProcessAlive(owner.pid))
+    // Only wait on a fully published endpoint; malformed or ambiguous ownership is resolved by reclaim.
+    if (
+      !owner ||
+      !isDaemonOwnership(owner) ||
+      owner.socketPath !== options.paths.socketPath ||
+      !isOwnerProcessAlive(owner)
+    )
       return undefined;
     await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
       signal: options.abortSignal
@@ -305,57 +319,11 @@ async function waitForHandoffAsync(
 }
 
 function assertNoLiveOwner(paths: IDaemonPaths): void {
-  const owner: Pick<IDaemonLockfile, 'pid' | 'startedAt'> | undefined = readDaemonOwnership(
-    paths.lockfilePath
-  );
-  if (!owner) {
-    if (process.platform !== 'win32' && fs.existsSync(paths.socketPath)) {
-      throw new DaemonClientError(
-        'startupFailed',
-        `Socket ${paths.socketPath} has no ownership record; refusing automatic reclaim.`
-      );
-    }
-    return;
-  }
-  if (!isProcessAlive(owner.pid)) return;
+  const owner: DaemonOwnership | undefined = readDaemonOwnership(paths.lockfilePath);
+  if (!owner || !isOwnerProcessAlive(owner)) return;
   throw new DaemonClientError(
     'startupFailed',
-    `PID ${owner.pid} still exists but the daemon is not ready. It may be a reused PID; refusing to kill it or remove ${paths.lockfilePath}.`
-  );
-}
-
-function readDaemonOwnership(lockfilePath: string): Pick<IDaemonLockfile, 'pid' | 'startedAt'> | undefined {
-  let record: unknown;
-  try {
-    record = JSON.parse(fs.readFileSync(lockfilePath, 'utf8'));
-  } catch (error) {
-    if (hasErrorCode(error, 'ENOENT')) return undefined;
-    throw new DaemonClientError(
-      'startupFailed',
-      `Cannot safely read ${lockfilePath}; refusing automatic reclaim.`,
-      { cause: error }
-    );
-  }
-  if (!isDaemonOwnership(record)) {
-    throw new DaemonClientError(
-      'startupFailed',
-      `Invalid daemon ownership record in ${lockfilePath}; refusing automatic reclaim.`
-    );
-  }
-  return { pid: record.pid, startedAt: record.startedAt };
-}
-
-function isDaemonOwnership(record: unknown): record is Pick<IDaemonLockfile, 'pid' | 'startedAt'> {
-  return (
-    typeof record === 'object' &&
-    record !== null &&
-    'pid' in record &&
-    typeof record.pid === 'number' &&
-    Number.isSafeInteger(record.pid) &&
-    record.pid > 0 &&
-    'startedAt' in record &&
-    typeof record.startedAt === 'string' &&
-    Number.isFinite(Date.parse(record.startedAt))
+    `PID ${owner.pid} still exists but the daemon is not ready. It may be a daemon that is still shutting down, or a reused PID; refusing to kill it or remove ${paths.lockfilePath}. ${DAEMON_RESET_HINT}`
   );
 }
 
@@ -408,7 +376,7 @@ async function waitForPreviousDaemonAsync(
       deadline,
       abortSignal
     );
-    if (!owner || owner.pid !== pid || owner.startedAt !== startedAt || !isProcessAlive(owner.pid)) return;
+    if (!owner || owner.pid !== pid || owner.startedAt !== startedAt || !isOwnerProcessAlive(owner)) return;
     if (Date.now() >= deadline) {
       throw new DaemonClientError(
         'timeout',
@@ -422,16 +390,6 @@ async function waitForPreviousDaemonAsync(
   }
 }
 
-function isProcessAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    if (hasErrorCode(error, 'ESRCH')) return false;
-    throw error;
-  }
-}
-
 async function spawnDetachedAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
@@ -540,7 +498,3 @@ function startupError(options: IConnectOrStartDaemonOptions, reason: string): Da
     `Daemon startup ${reason}. Inspect ${getDaemonLogFilePath(options.paths)} and retry, or use --no-daemon.`
   );
 }
-
-function hasErrorCode(error: unknown, code: string): boolean {
-  return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
-}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index b2962188b7..7597de72ab 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -15,6 +15,11 @@ export {
 } from './DaemonClient';
 export { DaemonClientError, type DaemonClientErrorCode } from './DaemonClientError';
 export { getDaemonLogFilePath } from './DaemonLogFile';
+export {
+  resetDaemonArtifactsAsync,
+  type IDaemonArtifactResetOptions,
+  type IDaemonArtifactResetResult
+} from './DaemonOwnership';
 export { executeWithDaemonRestartAsync } from './executeWithDaemonRestart';
 export {
   connectOrStartDaemonAsync,
diff --git a/libraries/rush-client-core/src/test/ProcessStartTime.test.ts b/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
new file mode 100644
index 0000000000..a7a9ff4418
--- /dev/null
+++ b/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import { performance } from 'node:perf_hooks';
+
+import { isProcessStartedAfter, tryGetProcessStartTimeMs } from '../ProcessStartTime';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+describe('process start time', () => {
+  linuxIt('estimates this process start time from /proc', () => {
+    const startMs: number | undefined = tryGetProcessStartTimeMs(process.pid);
+    expect(startMs).toEqual(expect.any(Number));
+    expect(Math.abs(startMs! - performance.timeOrigin)).toBeLessThan(1000);
+  });
+
+  linuxIt('detects a PID whose process started after a record was written', () => {
+    expect(isProcessStartedAfter(process.pid, new Date(Date.now() - 3600000).toISOString())).toBe(true);
+    expect(isProcessStartedAfter(process.pid, new Date().toISOString())).toBe(false);
+  });
+
+  it('treats unknown start times and invalid timestamps as not provably reused', async () => {
+    const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+    await once(exited, 'close');
+    expect(tryGetProcessStartTimeMs(exited.pid!)).toBeUndefined();
+    expect(isProcessStartedAfter(exited.pid!, new Date(0).toISOString())).toBe(false);
+    expect(isProcessStartedAfter(process.pid, 'not a timestamp')).toBe(false);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index dc4275cd74..fc623f9fb3 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -4,16 +4,22 @@
 import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
+import * as net from 'node:net';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { FileSystem } from '@rushstack/node-core-library';
-import type { IDaemonLockfile, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import {
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
 
 import { DaemonClient } from '../DaemonClient';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
 import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
 import { executeWithDaemonRestartAsync } from '../executeWithDaemonRestart';
 import { getDaemonStartupFilePath } from '../DaemonStartup';
@@ -98,6 +104,19 @@ describe('detached daemon startup', () => {
     };
   }
 
+  async function leaveStaleSocketAsync(): Promise<void> {
+    // A listener killed without cleanup leaves a bound-nowhere socket file behind.
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [
+        '-e',
+        `require('net').createServer().listen(${JSON.stringify(paths.socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+      ],
+      { stdio: 'ignore' }
+    );
+    await once(child, 'close');
+  }
+
   async function killStarterBeforeBindAsync(): Promise<number> {
     fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
     const starter = startClient();
@@ -156,6 +175,7 @@ describe('detached daemon startup', () => {
       code: 1,
       stderr: expect.stringContaining('unresolved startup handoff')
     });
+    expect((await result).stderr).toContain('daemon stop --force');
     expect(fs.readFileSync(startupPath, 'utf8')).toBe(contents);
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
   });
@@ -603,19 +623,134 @@ describe('detached daemon startup', () => {
     }
   );
 
-  it('never reclaims a live or reused PID', async () => {
+  it('reclaims a parseable record with an invalid timestamp without waiting out the deadline', async () => {
+    const record: string = JSON.stringify({
+      pid: process.pid,
+      protocolVersion: { major: 0, minor: 6 },
+      startedAt: 'invalid',
+      socketPath: paths.socketPath
+    });
+    fs.writeFileSync(paths.lockfilePath, record);
+    const started: number = Date.now();
+    const client = await connectOrStartDaemonAsync(options);
+    await client.closeAsync();
+    expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs! - 2000);
+    expect(readDaemonLockfile(paths.lockfilePath)?.pid).not.toBe(process.pid);
+  });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'force reset waits for a listener to release the endpoint',
+    async () => {
+      fs.writeFileSync(getDaemonStartupFilePath(paths), 'abandoned');
+      const listener: net.Server = net.createServer((socket) => socket.destroy());
+      await new Promise<void>((resolve) => listener.listen(paths.socketPath, resolve));
+      await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow('still listening');
+      const closing: NodeJS.Timeout = setTimeout(() => listener.close(), 300);
+      try {
+        expect(await resetDaemonArtifactsAsync(paths, { waitTimeoutMs: 5000 })).toEqual({
+          removedPaths: [getDaemonStartupFilePath(paths)]
+        });
+      } finally {
+        clearTimeout(closing);
+        listener.close();
+      }
+    }
+  );
+
+  it('never reclaims a live PID that may still own the record', async () => {
     const record: string = JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
     fs.writeFileSync(paths.lockfilePath, record);
-    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('may be a reused PID');
+    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('or a reused PID');
+    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('daemon stop --force');
+    expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow(`PID ${process.pid} still owns`);
     expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
   });
 
-  it('fails closed on corrupt ownership records', async () => {
+  it('reclaims a corrupt ownership record once the endpoint refuses connections', async () => {
     fs.writeFileSync(paths.lockfilePath, 'not json');
-    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('refusing automatic reclaim');
-    expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe('not json');
+    const client = await connectOrStartDaemonAsync(options);
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    expect(readDaemonLockfile(paths.lockfilePath)?.pid).toBe(
+      Number(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim())
+    );
   });
 
+  it('fails closed on a corrupt ownership record while something still listens', async () => {
+    fs.writeFileSync(paths.lockfilePath, 'not json');
+    const listener: net.Server = net.createServer((socket) => socket.destroy());
+    await new Promise<void>((resolve) => listener.listen(paths.socketPath, resolve));
+    try {
+      await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 2000 })).rejects.toThrow(
+        'did not refuse a connection'
+      );
+      await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow('still listening');
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe('not json');
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    } finally {
+      await new Promise<void>((resolve) => listener.close(() => resolve()));
+    }
+  });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'reclaims a socket without an ownership record once it refuses connections',
+    async () => {
+      await leaveStaleSocketAsync();
+      expect(fs.existsSync(paths.socketPath)).toBe(true);
+      const client = await connectOrStartDaemonAsync(options);
+      await client.closeAsync();
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    }
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'reclaims a record whose live PID started after the record was written',
+    async () => {
+      const unrelated: ChildProcess = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], {
+        stdio: 'ignore'
+      });
+      await once(unrelated, 'spawn');
+      try {
+        await leaveStaleSocketAsync();
+        fs.writeFileSync(
+          paths.lockfilePath,
+          JSON.stringify({
+            pid: unrelated.pid,
+            protocolVersion: { major: 0, minor: 6 },
+            startedAt: new Date(Date.now() - 3600000).toISOString(),
+            socketPath: paths.socketPath
+          })
+        );
+        const started: number = Date.now();
+        const client = await connectOrStartDaemonAsync(options);
+        await client.closeAsync();
+        // Not the full startup deadline spent polling the unrelated process.
+        expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs! - 2000);
+        expect(unrelated.exitCode).toBeNull();
+        expect(readDaemonLockfile(paths.lockfilePath)?.pid).not.toBe(unrelated.pid);
+      } finally {
+        const closed: Promise<unknown[]> = once(unrelated, 'close');
+        unrelated.kill('SIGKILL');
+        await closed;
+      }
+    }
+  );
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'force reset removes stale artifacts without starting a daemon',
+    async () => {
+      await leaveStaleSocketAsync();
+      fs.writeFileSync(paths.lockfilePath, 'garbage{');
+      fs.writeFileSync(getDaemonStartupFilePath(paths), 'abandoned');
+      expect(await resetDaemonArtifactsAsync(paths)).toEqual({
+        removedPaths: [paths.lockfilePath, getDaemonStartupFilePath(paths), paths.socketPath]
+      });
+      expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [] });
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    }
+  );
+
   it('starts after ownership release even while the original process remains alive', async () => {
     const client = await connectOrStartDaemonAsync({
       ...options,

From 582a57442cfd392584e91a3158f367e71c0c521e Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:13:42 -0700
Subject: [PATCH 002/265] [rush-daemon] Arbitrate environment restarts and
 bound client restart retries (#6079)

* [rush-daemon] Arbitrate environment restarts and bound client restart retries

Fixes #6057

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Report restart-drain admission errors independently of scheduler error mapping

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-client-core] Bound restart hand-offs by the admission deadline; arbitrate graph-control restarts; document bounded retries

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-client-core] Allow the admission deadline to expire before resubmitting to the last successor in the restart-always test

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 ...-restart-arbitration_2026-09-24-01-45.json |  10 +
 ...-restart-arbitration_2026-09-24-18-10.json |  10 +
 ...-restart-arbitration_2026-09-24-01-45.json |  10 +
 common/reviews/api/rush-client-core.api.md    |   2 +-
 libraries/rush-client-core/README.md          |  17 +-
 .../rush-client-core/src/DaemonClient.ts      |   6 +-
 .../src/executeWithDaemonRestart.ts           | 173 ++++++++++++------
 .../src/test/connectOrStartDaemon.test.ts     |  75 ++++++--
 .../src/test/fixtures/daemon.ts               |   8 +-
 .../src/DaemonCommandResult.ts                |   3 +-
 .../src/WorkspaceRequestAdmission.ts          |  14 ++
 .../src/WorkspaceRequestLifecycle.ts          |  20 +-
 .../src/WorkspaceRestartArbiter.ts            | 125 +++++++++++++
 .../src/test/WorkspaceRestartArbiter.test.ts  |  75 ++++++++
 .../test/WorkspaceRestartArbitration.test.ts  |  82 +++++++++
 15 files changed, 547 insertions(+), 83 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/fix-restart-arbitration_2026-09-24-01-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/fix-restart-arbitration_2026-09-24-18-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/fix-restart-arbitration_2026-09-24-01-45.json
 create mode 100644 libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/fix-restart-arbitration_2026-09-24-01-45.json b/common/changes/@rushstack/rush-client-core/fix-restart-arbitration_2026-09-24-01-45.json
new file mode 100644
index 0000000000..06c96fc736
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/fix-restart-arbitration_2026-09-24-01-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Retry daemon restarts with jittered backoff inside the admission deadline and return a `restartRetriesExhausted` fallback outcome instead of failing when successors keep restarting for other environments.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/fix-restart-arbitration_2026-09-24-18-10.json b/common/changes/@rushstack/rush-daemon-protocol/fix-restart-arbitration_2026-09-24-18-10.json
new file mode 100644
index 0000000000..a61beef311
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/fix-restart-arbitration_2026-09-24-18-10.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Document that clients may retry `retryAfterRestart` a bounded number of times within the admission deadline.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol"
+}
diff --git a/common/changes/@rushstack/rush-daemon/fix-restart-arbitration_2026-09-24-01-45.json b/common/changes/@rushstack/rush-daemon/fix-restart-arbitration_2026-09-24-01-45.json
new file mode 100644
index 0000000000..69802e647c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/fix-restart-arbitration_2026-09-24-01-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Queue a request whose environment requires a process restart until every queued or in-flight request that matches the running process has drained, so concurrent clients with different environments no longer preempt each other.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index a731a4a1d2..ed0f2f1813 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -49,7 +49,7 @@ export type DaemonClientOutcome = {
     readonly result: IDaemonCommandResult;
 } | {
     readonly kind: 'fallback';
-    readonly reason: 'unsupported' | 'controllingTerminalRequired' | 'stdinEndUnsupported';
+    readonly reason: 'unsupported' | 'controllingTerminalRequired' | 'stdinEndUnsupported' | 'restartRetriesExhausted';
     readonly message?: string;
 } | {
     readonly kind: 'rejected';
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 86142f10ee..a91c95b331 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -24,19 +24,22 @@ or admitting stdin: that is a protocol error, not permission to replay the comma
 Abort signals send `requestCancel`, then wait for the result; cancellation has a
 bounded grace period. Disconnects, protocol errors and sink failures are errors,
 never reasons to replay possibly executed work. Only pre-execution `unsupported`,
-`controllingTerminalRequired`, and `stdinEndUnsupported` outcomes permit fallback. Raw-mode changes are
+`controllingTerminalRequired`, `stdinEndUnsupported`, and `restartRetriesExhausted` outcomes permit fallback. Raw-mode changes are
 acknowledged only after applying them. Input listeners and raw state are restored
 on success, cancellation, disconnect and failure. No resize messages are sent.
 
 `executeWithDaemonRestartAsync(readyClient, connectionOptions, executionOptions)`
-adds one bounded retry for an explicit `retryAfterRestart: true` result. It captures
-the endpoint's PID/start identity before sending, requires protocol 0.10, waits for
-that ownership to be released, and reconnects through the same startup mutex.
+retries an explicit `retryAfterRestart: true` result a bounded number of times. Before
+each hand-off it captures the endpoint's PID/start identity, requires protocol 0.10,
+waits for that ownership to be released, and reconnects through the same startup mutex.
+Retries after the first use jittered backoff, and the backoff, the successor hand-off
+and the resubmitted request all share the request's admission deadline.
 The original immutable request and unread input are preserved. Output, events,
 terminal control, or stdin admission forbid retry, as do connection loss and plain
-error messages. A second restart result fails explicitly. Cancellation stops waiting
-without killing a daemon. Disabling auto-start still permits waiting for a
-host-started successor, but never lets the client spawn one.
+error messages. When the retry bound or the admission deadline is exhausted, it
+returns a `restartRetriesExhausted` fallback outcome so the caller can run in-process.
+Cancellation stops waiting without killing a daemon. Disabling auto-start still
+permits waiting for a host-started successor, but never lets the client spawn one.
 
 `connectOrStartDaemonAsync()` accepts an **explicit, version-selected** executable,
 arguments, environment and cwd. It does not discover or install a Rush version.
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 012b215cf3..911021c50c 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -67,7 +67,11 @@ export type DaemonClientOutcome =
   | { readonly kind: 'result'; readonly result: IDaemonCommandResult }
   | {
       readonly kind: 'fallback';
-      readonly reason: 'unsupported' | 'controllingTerminalRequired' | 'stdinEndUnsupported';
+      readonly reason:
+        | 'unsupported'
+        | 'controllingTerminalRequired'
+        | 'stdinEndUnsupported'
+        | 'restartRetriesExhausted';
       readonly message?: string;
     }
   | { readonly kind: 'rejected'; readonly rejection: IDaemonRequestRejectedMessage['payload'] };
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index 2299d55e27..e0d8563648 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
 import { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
@@ -10,8 +12,20 @@ import type { DaemonClient, DaemonClientOutcome, IDaemonClientExecuteOptions } f
 import { DaemonClientError } from './DaemonClientError';
 
 /**
- * Executes on a ready client, retrying once only for a typed pre-execution restart.
+ * The maximum number of successors a single request follows. Each restart serves at least one other
+ * environment first, so this bounds the wait when several environments share one workspace daemon.
+ */
+const MAX_RESTART_RETRIES: number = 6;
+const RETRY_JITTER_BASE_MS: number = 50;
+const RETRY_JITTER_MAX_MS: number = 1000;
+/** Matches the default of {@link IConnectOrStartDaemonOptions.startupTimeoutMs}. */
+const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
+
+/**
+ * Executes on a ready client, retrying only for a typed pre-execution restart.
  * Preserves the original request, callbacks and unread input; never retries connection loss.
+ * Restarts are retried with jittered backoff inside the request's admission deadline; once the
+ * retries or the deadline are exhausted, a `fallback` outcome lets the caller run in-process instead.
  * The connection options must select the request's expected daemon and startup environment.
  * @beta
  */
@@ -25,64 +39,117 @@ export async function executeWithDaemonRestartAsync(
     execution.abortSignal && connection.abortSignal
       ? AbortSignal.any([execution.abortSignal, connection.abortSignal])
       : (execution.abortSignal ?? connection.abortSignal);
+  const waitTimeoutMs: number | undefined = execution.request.admission?.waitTimeoutMs;
+  let owner: IDaemonLockfile | undefined = await attestOwnerAsync(client, connection);
+  let outcome: DaemonClientOutcome = await client.executeAsync({ ...execution, abortSignal });
+  let previous: DaemonClient | undefined;
+  try {
+    for (let retry: number = 1; outcome.kind === 'result' && outcome.result.retryAfterRestart; retry++) {
+      if (!owner) {
+        throw new DaemonClientError(
+          'startupFailed',
+          'Cannot attest the restarting daemon ownership; the request was not retried.'
+        );
+      }
+      if (abortSignal?.aborted) return abortedOutcome(execution);
+      const getRemainingMs = (): number | undefined =>
+        waitTimeoutMs === undefined ? undefined : waitTimeoutMs - (Date.now() - startedAt);
+      if (retry > MAX_RESTART_RETRIES || isExpired(getRemainingMs())) {
+        return restartExhaustedOutcome(retry - 1);
+      }
+      let successor: DaemonClient;
+      let boundedByAdmission: boolean = false;
+      try {
+        // The first retry follows the planned successor immediately; later ones back off with jitter so
+        // clients whose environments differ do not reach each new successor in lockstep.
+        if (retry > 1) {
+          await delayAsync(getRetryDelayMs(retry, getRemainingMs()), undefined, { signal: abortSignal });
+        }
+        const remainingMs: number | undefined = getRemainingMs();
+        if (isExpired(remainingMs)) return restartExhaustedOutcome(retry - 1);
+        const startupTimeoutMs: number = connection.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+        // The successor handoff shares the request's admission deadline rather than starting a fresh one.
+        boundedByAdmission = remainingMs !== undefined && remainingMs < startupTimeoutMs;
+        successor = await connectOrStartDaemonAsync({
+          ...connection,
+          startupTimeoutMs: boundedByAdmission ? Math.max(1, Math.ceil(remainingMs!)) : startupTimeoutMs,
+          previousDaemon: { pid: owner.pid, startedAt: owner.startedAt },
+          abortSignal
+        });
+      } catch (error) {
+        if (
+          abortSignal?.aborted &&
+          (error === abortSignal.reason ||
+            (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ABORT_ERR'))
+        ) {
+          return abortedOutcome(execution);
+        }
+        // A startup error after the admission deadline expired is the deadline, not a new failure mode.
+        if (boundedByAdmission && error instanceof DaemonClientError && isExpired(getRemainingMs())) {
+          return restartExhaustedOutcome(retry);
+        }
+        throw error;
+      } finally {
+        await previous?.closeAsync().catch(() => undefined);
+        previous = undefined;
+      }
+      previous = successor;
+      const remainingMs: number | undefined = getRemainingMs();
+      if (isExpired(remainingMs)) return restartExhaustedOutcome(retry);
+      owner = await attestOwnerAsync(successor, connection);
+      outcome = await successor.executeAsync({
+        ...execution,
+        abortSignal,
+        request:
+          remainingMs === undefined
+            ? execution.request
+            : captureDaemonRequest({
+                ...execution.request,
+                admission: { ...execution.request.admission, waitTimeoutMs: Math.floor(remainingMs) }
+              })
+      });
+    }
+    return outcome;
+  } finally {
+    await previous?.closeAsync().catch(() => undefined);
+  }
+}
+
+function isExpired(remainingMs: number | undefined): boolean {
+  return remainingMs !== undefined && remainingMs <= 0;
+}
+/** Returns the published ownership record only when it names the connected, restart-capable process. */
+async function attestOwnerAsync(
+  client: DaemonClient,
+  connection: IConnectOrStartDaemonOptions
+): Promise<IDaemonLockfile | undefined> {
   const owner: IDaemonLockfile | undefined = readDaemonLockfile(connection.paths.lockfilePath);
   const { pid } = await client.status;
-  const attested: boolean =
-    client.protocolVersion.minor >= DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR &&
+  return client.protocolVersion.minor >= DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR &&
     owner !== undefined &&
     owner.pid === pid &&
     owner.socketPath === connection.paths.socketPath &&
     Number.isSafeInteger(owner.pid) &&
     owner.pid > 0 &&
-    Number.isFinite(Date.parse(owner.startedAt));
-  const outcome: DaemonClientOutcome = await client.executeAsync({ ...execution, abortSignal });
-  if (outcome.kind !== 'result' || !outcome.result.retryAfterRestart) return outcome;
-  if (!attested || !owner) {
-    throw new DaemonClientError(
-      'startupFailed',
-      'Cannot attest the restarting daemon ownership; the request was not retried.'
-    );
-  }
-  if (abortSignal?.aborted) return abortedOutcome(execution);
-  let successor: DaemonClient;
-  try {
-    successor = await connectOrStartDaemonAsync({
-      ...connection,
-      previousDaemon: { pid: owner.pid, startedAt: owner.startedAt },
-      abortSignal
-    });
-  } catch (error) {
-    if (
-      abortSignal?.aborted &&
-      (error === abortSignal.reason ||
-        (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ABORT_ERR'))
-    ) {
-      return abortedOutcome(execution);
-    }
-    throw error;
-  }
-  const waitTimeoutMs: number | undefined = execution.request.admission?.waitTimeoutMs;
-  const result: DaemonClientOutcome = await successor.executeAsync({
-    ...execution,
-    abortSignal,
-    request:
-      waitTimeoutMs === undefined
-        ? execution.request
-        : captureDaemonRequest({
-            ...execution.request,
-            admission: {
-              ...execution.request.admission,
-              waitTimeoutMs: Math.max(0, waitTimeoutMs - (Date.now() - startedAt))
-            }
-          })
-  });
-  if (result.kind === 'result' && result.result.retryAfterRestart) {
-    throw new DaemonClientError(
-      'startupFailed',
-      'The successor requested another restart; the single safe retry was exhausted.'
-    );
-  }
-  return result;
+    Number.isFinite(Date.parse(owner.startedAt))
+    ? owner
+    : undefined;
+}
+
+function getRetryDelayMs(retry: number, remainingMs: number | undefined): number {
+  const ceilingMs: number = Math.min(RETRY_JITTER_MAX_MS, RETRY_JITTER_BASE_MS * 2 ** (retry - 1));
+  const delayMs: number = Math.floor(ceilingMs / 2 + (Math.random() * ceilingMs) / 2);
+  return remainingMs === undefined ? delayMs : Math.max(0, Math.min(delayMs, remainingMs - 1));
+}
+
+function restartExhaustedOutcome(restarts: number): DaemonClientOutcome {
+  return {
+    kind: 'fallback',
+    reason: 'restartRetriesExhausted',
+    message: `The daemon was still restarting for other environments after ${restarts} ${
+      restarts === 1 ? 'restart' : 'restarts'
+    }; no operation was started by the daemon`
+  };
 }
 
 function abortedOutcome(execution: IDaemonClientExecuteOptions): DaemonClientOutcome {
@@ -90,4 +157,4 @@ function abortedOutcome(execution: IDaemonClientExecuteOptions): DaemonClientOut
     kind: 'result',
     result: { requestId: execution.request.requestId, exitCode: 130, outcome: 'aborted', aborted: true }
   };
-}
+}
\ No newline at end of file
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index fc623f9fb3..e49f287909 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -400,9 +400,11 @@ describe('detached daemon startup', () => {
     expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
   });
 
-  it.each(['restart-once', 'restart-always', 'restart-held'])(
+  it.each(['restart-once', 'restart-twice', 'restart-always', 'restart-held'])(
     'retries only the typed pre-execution result for %s after ownership release',
     async (mode) => {
+      // restart-always exhausts the deadline; the others need room for loaded CI machines.
+      const waitTimeoutMs: number = mode === 'restart-always' ? 1000 : 10000;
       const connection: IConnectOrStartDaemonOptions = {
         ...options,
         startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
@@ -415,7 +417,7 @@ describe('detached daemon startup', () => {
         cwd: folder,
         environment: {},
         terminal: { isTTY: false, supportsColor: false },
-        admission: { waitTimeoutMs: 1000 }
+        admission: { waitTimeoutMs }
       });
       const pending = executeWithDaemonRestartAsync(
         client,
@@ -425,24 +427,36 @@ describe('detached daemon startup', () => {
         },
         { request }
       );
-      if (mode === 'restart-once') {
+      if (mode === 'restart-once' || mode === 'restart-twice') {
+        const restarts: number = mode === 'restart-once' ? 1 : 2;
         expect(await pending).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
         const waits = fs.readFileSync(path.join(folder, 'waits'), 'utf8').trim().split('\n').map(Number);
-        expect(waits[0]).toBe(1000);
-        expect(waits[1]).toBeLessThan(1000);
-        expect(waits[1]).toBeGreaterThanOrEqual(0);
-        expect(request.admission?.waitTimeoutMs).toBe(1000);
-      } else {
-        await expect(pending).rejects.toThrow(
-          mode === 'restart-held' ? 'previous daemon still owns' : 'single safe retry was exhausted'
+        expect(waits).toHaveLength(restarts + 1);
+        expect(waits[0]).toBe(waitTimeoutMs);
+        for (let index: number = 1; index <= restarts; index++) {
+          expect(waits[index]).toBeLessThanOrEqual(waits[index - 1]);
+          expect(waits[index]).toBeLessThan(waitTimeoutMs);
+          expect(waits[index]).toBeGreaterThanOrEqual(0);
+        }
+        expect(request.admission?.waitTimeoutMs).toBe(waitTimeoutMs);
+        expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(
+          restarts + 1
         );
+      } else if (mode === 'restart-always') {
+        // Every successor asks again: bounded retries inside the admission deadline, then a fallback.
+        expect(await pending).toMatchObject({ kind: 'fallback', reason: 'restartRetriesExhausted' });
+        const starts: number = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n').length;
+        expect(starts).toBeGreaterThanOrEqual(2);
+        expect(starts).toBeLessThanOrEqual(7);
+        // The deadline may expire after the last successor started but before the request was resubmitted.
+        const requests: number = fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n').length;
+        expect(requests).toBeGreaterThanOrEqual(starts - 1);
+        expect(requests).toBeLessThanOrEqual(starts);
+      } else {
+        await expect(pending).rejects.toThrow('previous daemon still owns');
+        expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+        expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
       }
-      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(
-        mode === 'restart-held' ? 1 : 2
-      );
-      expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(
-        mode === 'restart-held' ? 1 : 2
-      );
     },
     15000
   );
@@ -483,6 +497,35 @@ describe('detached daemon startup', () => {
     }
   );
 
+  it('bounds the successor hand-off by the admission deadline instead of a fresh startup timeout', async () => {
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startupTimeoutMs: 7000,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-held']
+      }
+    };
+    const client = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false },
+      admission: { waitTimeoutMs: 500 }
+    });
+    const startedAt: number = Date.now();
+    expect(await executeWithDaemonRestartAsync(client, connection, { request })).toMatchObject({
+      kind: 'fallback',
+      reason: 'restartRetriesExhausted'
+    });
+    expect(Date.now() - startedAt).toBeLessThan(5000);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+
   it('refuses restart retry if ownership was not attested before submitting', async () => {
     const connection: IConnectOrStartDaemonOptions = {
       ...options,
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 6c00f3b323..e03e1cc12e 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -68,9 +68,13 @@ async function mainAsync(): Promise<void> {
           if (message.payload.admission?.waitTimeoutMs !== undefined) {
             fs.appendFileSync(path.join(folder, 'waits'), `${message.payload.admission.waitTimeoutMs}\n`);
           }
+          const restartCount: number = fs.existsSync(path.join(folder, 'restarted'))
+            ? fs.readFileSync(path.join(folder, 'restarted'), 'utf8').length
+            : 0;
           const restart: boolean =
             restartMode !== undefined &&
-            (restartMode !== 'restart-once' || !fs.existsSync(path.join(folder, 'restarted')));
+            (restartMode !== 'restart-once' || restartCount < 1) &&
+            (restartMode !== 'restart-twice' || restartCount < 2);
           await connection.sendFrameAsync({
             kind: DaemonFrameType.controlJson,
             payload: encodeDaemonControlMessage({
@@ -85,7 +89,7 @@ async function mainAsync(): Promise<void> {
             })
           });
           if (restart && restartMode !== 'restart-held') {
-            fs.writeFileSync(path.join(folder, 'restarted'), '');
+            fs.appendFileSync(path.join(folder, 'restarted'), 'r');
             await stopAsync();
           }
         } else if (message.kind === 'shutdown') {
diff --git a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
index c3726e2b70..293776da32 100644
--- a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
@@ -18,7 +18,8 @@ export type DaemonCommandOutcome = 'success' | 'success-with-warning' | 'failure
 export interface IDaemonCommandResult {
   /**
    * Protocol 0.10: no execution or request IO occurred, and a successor has been selected.
-   * Retry at most once, after attested predecessor ownership release. Never infer this from an error.
+   * Retry only after attested predecessor ownership release, within the request's admission deadline and a
+   * small client-defined retry bound; then fall back instead of retrying. Never infer this from an error.
    */
   readonly retryAfterRestart?: true;
   /** Whether cancellation or disconnect was observed, even if a cleanup failure determines the outcome. */
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 0863216263..a541976266 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -18,6 +18,7 @@ import {
 } from './RequestScheduler';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
+import type { IWorkspaceRestartTicket, WorkspaceRestartArbiter } from './WorkspaceRestartArbiter';
 
 export interface IRequestAdmissionClient {
   readonly abortSignal: AbortSignal;
@@ -191,6 +192,19 @@ export class RequestAdmissionController {
     }
   }
 
+  /** Waits, within the same admission budget, until a restart would not preempt another request. */
+  public async waitForRestartDrainAsync(
+    arbiter: WorkspaceRestartArbiter,
+    ticket: IWorkspaceRestartTicket
+  ): Promise<void> {
+    // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
+    await arbiter.waitForDrainAsync(ticket, {
+      abortSignal: this.#abortController.signal,
+      noWait: this.#admission?.noWait,
+      waitTimeoutMs: this.#getRemainingWaitTimeoutMs()
+    });
+  }
+
   public dispose(): void {
     this.#client.abortSignal.removeEventListener('abort', this.#abortFromClient);
   }
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index da5ca8230a..adb9753ce6 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -49,6 +49,7 @@ import type {
   IWorkspaceProcessRestartPlan,
   IWorkspaceSuccessorLaunch
 } from './WorkspaceProcessRestart';
+import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './WorkspaceRestartArbiter';
 
 interface IExecutionState {
   began: boolean;
@@ -106,6 +107,7 @@ class RestartPendingBeforeExecution extends Error {
 export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #options: IWorkspaceRequestLifecycleOptions;
   readonly #gate: RequestScheduler = new RequestScheduler();
+  readonly #restartArbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   readonly #abortController: AbortController = new AbortController();
   readonly #observers: Set<AbortController> = new Set();
   readonly #terminal: Terminal = new Terminal(new NoOpTerminalProvider());
@@ -195,11 +197,13 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       client,
       requestId: envelope.requestId
     });
+    // Long-lived observers are cancelled by a transition, so they never delay a restart.
+    const ticket: IWorkspaceRestartTicket | undefined = observer ? undefined : this.#restartArbiter.enter();
     let generation: IPreparedGeneration | undefined;
     try {
       for (let attempt: number = 0; ; attempt++) {
         try {
-          generation = await this.#prepareAsync(envelope, client, admission);
+          generation = await this.#prepareAsync(envelope, client, admission, ticket);
           const requestEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
             admission: admission.remainingAdmission
@@ -272,6 +276,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         }
       }
     } finally {
+      if (ticket) this.#restartArbiter.leave(ticket);
       admission.dispose();
       if (observer) this.#observers.delete(observer);
     }
@@ -281,6 +286,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     envelope: IDaemonRequestEnvelope,
     client: IDaemonRequestDispatchClient,
     admission: RequestAdmissionController,
+    ticket: IWorkspaceRestartTicket | undefined,
     admittedLease?: IRequestLease
   ): Promise<IPreparedGeneration> {
     let lease: IRequestLease =
@@ -316,6 +322,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           const currentTier: WorkspaceInputChangeTier = this.#classify(current, false);
           if (currentTier === WorkspaceInputChangeTier.Restart) {
             lease.release();
+            if (ticket) {
+              // Like build requests, a graph-control restart must not preempt requests this process can serve.
+              await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket);
+              if (this.#restartPending) throw new RestartPendingBeforeExecution();
+            }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
             session = await this.#options.provider.getSessionAsync();
@@ -408,12 +419,17 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       }
 
       lease.release();
+      if (tier === WorkspaceInputChangeTier.Restart && ticket) {
+        // Serve every queued or in-flight request that matches this process before restarting for another one.
+        await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket);
+        if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      }
       if (this.#transitioning) {
         const shared: IRequestLease = await admission.acquireAsync(
           this.#gate,
           RequestExclusivityClass.SharedBuild
         );
-        return await this.#prepareAsync(envelope, client, admission, shared);
+        return await this.#prepareAsync(envelope, client, admission, ticket, shared);
       }
       this.#transitioning = ownsTransition = true;
       this.#cancelObservers();
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
new file mode 100644
index 0000000000..9fb26f6455
--- /dev/null
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -0,0 +1,125 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { RequestSchedulerError, RequestSchedulerErrorCode } from './RequestScheduler';
+
+const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
+
+/** One dispatched request tracked by a {@link WorkspaceRestartArbiter}. */
+export interface IWorkspaceRestartTicket {
+  readonly waitingForDrain: boolean;
+}
+
+interface IMutableTicket {
+  waitingForDrain: boolean;
+  left: boolean;
+}
+
+/** Options for {@link WorkspaceRestartArbiter.waitForDrainAsync}, supplied by request admission. */
+export interface IWorkspaceRestartDrainOptions {
+  readonly abortSignal: AbortSignal;
+  readonly noWait: boolean | undefined;
+  readonly waitTimeoutMs: number | undefined;
+}
+
+/**
+ * Arbitrates process restarts between requests whose environments differ from the running daemon.
+ * A request that needs a restart waits until every other request this process can serve has finished,
+ * so a mismatched environment never preempts queued or in-flight work that matches the running process.
+ */
+export class WorkspaceRestartArbiter {
+  readonly #listeners: Set<() => void> = new Set();
+  #servingCount: number = 0;
+
+  /** The number of tracked requests that are not waiting for a restart. */
+  public get servingCount(): number {
+    return this.#servingCount;
+  }
+
+  public enter(): IWorkspaceRestartTicket {
+    this.#servingCount++;
+    const ticket: IMutableTicket = { waitingForDrain: false, left: false };
+    return ticket;
+  }
+
+  public leave(ticket: IWorkspaceRestartTicket): void {
+    const state: IMutableTicket = ticket as IMutableTicket;
+    if (state.left) return;
+    state.left = true;
+    if (!state.waitingForDrain) this.#decrement();
+  }
+
+  /**
+   * Waits until no other tracked request is still being served by this process, then counts the ticket
+   * as served again so concurrent restart candidates proceed one at a time.
+   */
+  public async waitForDrainAsync(
+    ticket: IWorkspaceRestartTicket,
+    options: IWorkspaceRestartDrainOptions
+  ): Promise<void> {
+    const state: IMutableTicket = ticket as IMutableTicket;
+    if (state.left || state.waitingForDrain) throw new Error('The restart ticket is not being served.');
+    state.waitingForDrain = true;
+    this.#decrement();
+    try {
+      const deadline: number | undefined =
+        options.waitTimeoutMs === undefined ? undefined : Date.now() + options.waitTimeoutMs;
+      while (this.#servingCount > 0) {
+        if (options.noWait) {
+          throw new RequestSchedulerError(
+            RequestSchedulerErrorCode.NoWait,
+            'Another environment is still being served; the request did not wait for a restart.'
+          );
+        }
+        await this.#waitForChangeAsync(options.abortSignal, deadline);
+      }
+    } finally {
+      state.waitingForDrain = false;
+      this.#servingCount++;
+    }
+  }
+
+  #decrement(): void {
+    this.#servingCount--;
+    if (this.#servingCount === 0) {
+      for (const listener of Array.from(this.#listeners)) listener();
+    }
+  }
+
+  #waitForChangeAsync(abortSignal: AbortSignal, deadline: number | undefined): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const unsubscribe: AbortController = new AbortController();
+      const settle = (error?: RequestSchedulerError): void => {
+        this.#listeners.delete(settle);
+        unsubscribe.abort();
+        if (timer) clearTimeout(timer);
+        if (error) reject(error);
+        else resolve();
+      };
+      const settleAborted = (): void =>
+        settle(
+          new RequestSchedulerError(RequestSchedulerErrorCode.Aborted, 'The request was aborted before execution.')
+        );
+      if (abortSignal.aborted) {
+        settleAborted();
+        return;
+      }
+      this.#listeners.add(settle);
+      abortSignal.addEventListener('abort', settleAborted, { once: true, signal: unsubscribe.signal });
+      if (deadline !== undefined) {
+        timer = setTimeout(
+          () =>
+            settle(
+              new RequestSchedulerError(
+                RequestSchedulerErrorCode.WaitTimeout,
+                'The request was not admitted before the daemon could restart for its environment. ' +
+                  'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.'
+              )
+            ),
+          Math.min(MAX_TIMER_DELAY_MS, Math.max(0, deadline - Date.now()))
+        );
+      }
+    });
+  }
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
new file mode 100644
index 0000000000..8ee1001739
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
@@ -0,0 +1,75 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
+import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from '../WorkspaceRestartArbiter';
+
+const WAIT: { abortSignal: AbortSignal; noWait: undefined; waitTimeoutMs: undefined } = {
+  abortSignal: new AbortController().signal,
+  noWait: undefined,
+  waitTimeoutMs: undefined
+};
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  void promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await new Promise((resolve) => setImmediate(resolve));
+  return settled;
+}
+
+describe(WorkspaceRestartArbiter.name, () => {
+  it('proceeds immediately when no other request is being served', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    await arbiter.waitForDrainAsync(ticket, WAIT);
+    expect(arbiter.servingCount).toBe(1);
+    arbiter.leave(ticket);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('waits for served requests, including ones that arrive later, and admits candidates one at a time', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const serving: IWorkspaceRestartTicket = arbiter.enter();
+    const first: IWorkspaceRestartTicket = arbiter.enter();
+    const second: IWorkspaceRestartTicket = arbiter.enter();
+    const firstWait: Promise<void> = arbiter.waitForDrainAsync(first, WAIT);
+    const secondWait: Promise<void> = arbiter.waitForDrainAsync(second, WAIT);
+    const late: IWorkspaceRestartTicket = arbiter.enter();
+    arbiter.leave(serving);
+    expect(await isSettledAsync(firstWait)).toBe(false);
+    arbiter.leave(late);
+    await firstWait;
+    expect(await isSettledAsync(secondWait)).toBe(false);
+    arbiter.leave(first);
+    await secondWait;
+    arbiter.leave(second);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it.each([
+    ['no-wait', RequestSchedulerErrorCode.NoWait],
+    ['timeout', RequestSchedulerErrorCode.WaitTimeout],
+    ['abort', RequestSchedulerErrorCode.Aborted]
+  ])('reports %s as an admission failure and restores its accounting', async (mode, code) => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const serving: IWorkspaceRestartTicket = arbiter.enter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const abort: AbortController = new AbortController();
+    const waiting: Promise<void> = arbiter.waitForDrainAsync(ticket, {
+      abortSignal: abort.signal,
+      noWait: mode === 'no-wait' ? true : undefined,
+      waitTimeoutMs: mode === 'timeout' ? 10 : undefined
+    });
+    if (mode === 'abort') abort.abort();
+    const error: unknown = await waiting.catch((caught: unknown) => caught);
+    expect(error).toBeInstanceOf(RequestSchedulerError);
+    expect((error as RequestSchedulerError).code).toBe(code);
+    expect(arbiter.servingCount).toBe(2);
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    expect(arbiter.servingCount).toBe(0);
+  });
+});
\ No newline at end of file
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
new file mode 100644
index 0000000000..557c54ddc5
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+it('queues a mismatched-environment restart until matching queued and in-flight requests drain', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => {
+    setDaemonPolicy(created, {});
+    created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    // Project c holds its build open until the test removes the marker.
+    created.write('hold', '');
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+    );
+  });
+  const order: string[] = [];
+  const track = (name: string, exchange: Promise<ITerminalExchange>): Promise<ITerminalExchange> =>
+    exchange.then((result) => {
+      order.push(name);
+      return result;
+    });
+  try {
+    const before = await pongAsync(fixture);
+    const matching = track('matching', fixture.runAsync(['build', '--to', 'c', '--parallelism', '3']));
+    const deadline: number = Date.now() + 30_000;
+    while (!fixture.runs().includes('c') && Date.now() < deadline) await delayAsync(20);
+    expect(fixture.runs()).toContain('c');
+
+    const mismatched = track(
+      'mismatched',
+      fixture.runAsync(['build', '--to', 'b', '--parallelism', '3'], {
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+      })
+    );
+    await delayAsync(1000);
+    // Arrives after the mismatched request; it must still be served by this process.
+    const lateMatching = track('late', fixture.runAsync(['build', '--to', 'c', '--parallelism', '3']));
+    await delayAsync(1000);
+    expect(order).toEqual([]);
+    expect(fixture.host.workspaceStatus.lastReloadTier).not.toBe(WorkspaceInputChangeTier.Restart);
+
+    fs.rmSync(path.join(fixture.folder, 'hold'));
+    const [held, late, restart] = await Promise.all([matching, lateMatching, mismatched]);
+    expect(held.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    expect(held.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(late.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    expect(late.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(restart.terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, retryAfterRestart: true }
+    });
+    expect(order[order.length - 1]).toBe('mismatched');
+
+    const restarted = await fixture.host.restartCompleted;
+    expect(restarted?.pid).not.toBe(before.pid);
+    expect((await pongAsync(fixture)).pid).toBe(restarted?.pid);
+    expect(fixture.runs()).not.toContain('b');
+  } finally {
+    fs.rmSync(path.join(fixture.folder, 'hold'), { force: true });
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted;
+    } finally {
+      await stopSuccessorAsync(fixture.host.paths);
+      await fixture[Symbol.asyncDispose]();
+    }
+  }
+});
\ No newline at end of file

From 74d0cb4f27f1683bbd3e8105abbe198ecb537fb2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:16:14 -0700
Subject: [PATCH 003/265] [rush-daemon] Use directory-level async watchers on
 Linux (#6089)

* [rush-daemon] Use directory-level async watchers on Linux

Fixes #6078

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Fix test lint warnings

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Address Linux tree watcher review feedback

Forward unknown filenames, re-check exclusions after they load, re-register replaced directories, fail on non-transient walk errors, and keep the .rush/temp exclusion when rush-project.json cannot be loaded.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../linux-tree-watcher_2026-09-24.json        |  10 +
 libraries/rush-daemon/src/LinuxTreeWatcher.ts | 269 ++++++++++++++++
 .../src/WorkspaceSessionFileWatcher.ts        |  96 +++++-
 .../src/test/LinuxTreeWatcher.test.ts         | 295 ++++++++++++++++++
 .../test/WorkspaceSessionFileWatcher.test.ts  |  25 +-
 5 files changed, 678 insertions(+), 17 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/linux-tree-watcher_2026-09-24.json
 create mode 100644 libraries/rush-daemon/src/LinuxTreeWatcher.ts
 create mode 100644 libraries/rush-daemon/src/test/LinuxTreeWatcher.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/linux-tree-watcher_2026-09-24.json b/common/changes/@rushstack/rush-daemon/linux-tree-watcher_2026-09-24.json
new file mode 100644
index 0000000000..c658db784c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/linux-tree-watcher_2026-09-24.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "On Linux, observe watched projects with one non-recursive watch per directory created by an asynchronous walk instead of Node's recursive fs.watch emulation (one inotify watch per file, synchronous tree walk). Skip node_modules, .git, .rush/temp and declared output folders, follow directories created or removed later, tolerate directories that vanish during registration, and report inotify watch-limit exhaustion (ENOSPC) explicitly.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/LinuxTreeWatcher.ts b/libraries/rush-daemon/src/LinuxTreeWatcher.ts
new file mode 100644
index 0000000000..062a330daa
--- /dev/null
+++ b/libraries/rush-daemon/src/LinuxTreeWatcher.ts
@@ -0,0 +1,269 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { EventEmitter } from 'node:events';
+
+/** Watches one directory without recursion. */
+export type DirectoryWatchFunction = (
+  folderPath: string,
+  listener: fs.WatchListener<string>
+) => fs.FSWatcher;
+
+/** Options for {@link LinuxTreeWatcher}. */
+export interface ILinuxTreeWatcherOptions {
+  /** Absolute directory paths that are never observed, such as declared build output folders. */
+  readonly getExcludedFolderPathsAsync?: () => Promise<ReadonlySet<string>>;
+  /**
+   * Reports the root once the initial walk finishes, covering changes made to directories before they
+   * were registered. Callers that await {@link LinuxTreeWatcher.initialWalk} instead can leave this off.
+   */
+  readonly reportInitialWalkCompletion?: boolean;
+  /** Test hook; defaults to a non-recursive `fs.watch`. */
+  readonly watchDirectory?: DirectoryWatchFunction;
+}
+
+/** Directory names that are never observed at any depth. */
+export const PRUNED_DIRECTORY_NAMES: ReadonlySet<string> = new Set(['node_modules', '.git']);
+
+const TRANSIENT_ERROR_CODES: ReadonlySet<string | undefined> = new Set(['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM']);
+const EMPTY_SET: ReadonlySet<string> = new Set();
+
+const defaultWatchDirectory: DirectoryWatchFunction = (folderPath, listener) =>
+  fs.watch(folderPath, { encoding: 'utf8', persistent: true }, listener);
+
+/**
+ * A recursive watcher for Linux built from one non-recursive inotify watch per directory.
+ *
+ * @remarks
+ * Node's Linux emulation of `fs.watch(..., { recursive: true })` walks the tree synchronously on the event
+ * loop and registers one inotify watch per file, including `node_modules` and build outputs. A directory-level
+ * inotify watch already reports changes to the files it contains, so this watcher registers directories only,
+ * walks asynchronously, prunes `node_modules`, `.git` and caller-provided folders, follows directories that are
+ * created or removed later, and tolerates directories that disappear while they are being registered.
+ *
+ * The root is registered synchronously so a missing root fails like `fs.watch`. Each directory watch is created
+ * before the directory is listed, so a child created during the walk is reported by its parent and then walked.
+ * The object is `fs.FSWatcher`-compatible: it emits `error` and `close` and supports `ref`/`unref`.
+ */
+export class LinuxTreeWatcher extends EventEmitter {
+  readonly #root: string;
+  readonly #listener: fs.WatchListener<string>;
+  readonly #watchDirectory: DirectoryWatchFunction;
+  readonly #watchers: Map<string, fs.FSWatcher> = new Map();
+  readonly #excludedFolderPaths: Promise<ReadonlySet<string>>;
+  #resolvedExcludedFolderPaths: ReadonlySet<string> = EMPTY_SET;
+  #closed: boolean = false;
+  #failed: boolean = false;
+  #isUnref: boolean = false;
+
+  /** Resolves when the initial asynchronous walk has finished (or stopped). */
+  public readonly initialWalk: Promise<void>;
+
+  public constructor(root: string, listener: fs.WatchListener<string>, options: ILinuxTreeWatcherOptions = {}) {
+    super();
+    this.#root = path.resolve(root);
+    this.#listener = listener;
+    this.#watchDirectory = options.watchDirectory ?? defaultWatchDirectory;
+    this.#excludedFolderPaths = loadExcludedFolderPathsAsync(options.getExcludedFolderPathsAsync);
+    this.#addDirectory(this.#root, true);
+    this.initialWalk = this.#walkAsync(this.#root).then(() => {
+      if (options.reportInitialWalkCompletion) this.#reportCoverage(this.#root);
+    });
+  }
+
+  /** The directories that currently hold an inotify watch. */
+  public get watchedFolderPaths(): ReadonlySet<string> {
+    return new Set(this.#watchers.keys());
+  }
+
+  public close(): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    for (const watcher of this.#watchers.values()) watcher.close();
+    this.#watchers.clear();
+    process.nextTick(() => this.emit('close'));
+  }
+
+  public ref(): this {
+    this.#isUnref = false;
+    for (const watcher of this.#watchers.values()) watcher.ref();
+    return this;
+  }
+
+  public unref(): this {
+    this.#isUnref = true;
+    for (const watcher of this.#watchers.values()) watcher.unref();
+    return this;
+  }
+
+  #isPruned(folderPath: string): boolean {
+    return (
+      PRUNED_DIRECTORY_NAMES.has(path.basename(folderPath)) || this.#resolvedExcludedFolderPaths.has(folderPath)
+    );
+  }
+
+  /** Returns false when the directory vanished before it could be watched. */
+  #addDirectory(folderPath: string, isRoot: boolean = false): boolean {
+    if (this.#closed || this.#failed) return false;
+    if (this.#watchers.has(folderPath)) return true;
+    let watcher: fs.FSWatcher;
+    try {
+      watcher = this.#watchDirectory(folderPath, (eventType, filename) =>
+        this.#onDirectoryEvent(folderPath, eventType, filename)
+      );
+    } catch (error) {
+      if (isRoot) throw toWatchError(error, folderPath);
+      if (TRANSIENT_ERROR_CODES.has(getErrorCode(error))) return false;
+      this.#fail(error, folderPath);
+      return false;
+    }
+    watcher.on('error', (error: Error) => this.#onDirectoryError(folderPath, error));
+    if (this.#isUnref) watcher.unref();
+    this.#watchers.set(folderPath, watcher);
+    return true;
+  }
+
+  #onDirectoryEvent(folderPath: string, eventType: fs.WatchEventType, filename: string | null): void {
+    if (this.#closed) return;
+    if (!filename) {
+      // An unknown entry must stay unknown so the consumer performs a full invalidation.
+      this.#listener(eventType, null);
+      return;
+    }
+    const changedPath: string = path.join(folderPath, filename);
+    if (this.#isPruned(changedPath)) return;
+    this.#listener(eventType, path.relative(this.#root, changedPath));
+    if (eventType === 'rename') {
+      void this.#reconcileEntryAsync(changedPath);
+    }
+  }
+
+  #onDirectoryError(folderPath: string, error: Error): void {
+    if (TRANSIENT_ERROR_CODES.has(getErrorCode(error)) && folderPath !== this.#root) {
+      // The directory was removed; its parent's `rename` event already reported the change.
+      this.#removeDirectory(folderPath);
+      return;
+    }
+    this.#fail(error, folderPath);
+  }
+
+  async #reconcileEntryAsync(changedPath: string): Promise<void> {
+    // Exclusions may still be loading when the first events arrive; never register an excluded folder.
+    this.#resolvedExcludedFolderPaths = await this.#excludedFolderPaths;
+    if (this.#closed || this.#failed || this.#isPruned(changedPath)) return;
+    let isDirectory: boolean;
+    try {
+      isDirectory = (await fs.promises.lstat(changedPath)).isDirectory();
+    } catch {
+      isDirectory = false;
+    }
+    // A `rename` for a directory that still exists may be a delete-and-recreate or an atomic replacement.
+    // inotify stays attached to the old inode, so always drop existing watches and register the current one.
+    this.#removeDirectory(changedPath);
+    if (isDirectory && this.#addDirectory(changedPath)) {
+      await this.#walkAsync(changedPath);
+      // Files written into the new directory before its watch existed were not reported.
+      this.#reportCoverage(changedPath);
+    }
+  }
+
+  #reportCoverage(folderPath: string): void {
+    if (!this.#closed && !this.#failed) this.#listener('rename', path.relative(this.#root, folderPath));
+  }
+
+  #removeDirectory(folderPath: string): void {
+    const prefix: string = folderPath + path.sep;
+    for (const [key, watcher] of this.#watchers) {
+      if (key === folderPath || key.startsWith(prefix)) {
+        watcher.close();
+        this.#watchers.delete(key);
+      }
+    }
+  }
+
+  async #walkAsync(folderPath: string): Promise<void> {
+    this.#resolvedExcludedFolderPaths = await this.#excludedFolderPaths;
+    let directory: fs.Dir;
+    try {
+      directory = await fs.promises.opendir(folderPath);
+    } catch (error) {
+      this.#onWalkError(folderPath, error);
+      return;
+    }
+    const children: string[] = [];
+    try {
+      for await (const entry of directory) {
+        if (this.#closed || this.#failed) break;
+        const childPath: string = path.join(folderPath, entry.name);
+        if (entry.isDirectory() && !this.#isPruned(childPath) && this.#addDirectory(childPath)) {
+          children.push(childPath);
+        }
+      }
+    } catch (error) {
+      this.#onWalkError(folderPath, error);
+    }
+    for (const childPath of children) {
+      if (this.#closed || this.#failed) return;
+      await this.#walkAsync(childPath);
+    }
+  }
+
+  #onWalkError(folderPath: string, error: unknown): void {
+    if (folderPath !== this.#root && TRANSIENT_ERROR_CODES.has(getErrorCode(error))) {
+      // Removed or replaced while walking; the parent's `rename` event already reported the change.
+      this.#removeDirectory(folderPath);
+      return;
+    }
+    // Any other failure (for example EMFILE or EIO) leaves part of the tree unobserved.
+    this.#fail(error, folderPath);
+  }
+
+  #fail(error: unknown, folderPath: string): void {
+    if (this.#failed || this.#closed) return;
+    this.#failed = true;
+    this.emit('error', toWatchError(error, folderPath));
+  }
+}
+
+/** Creates a {@link LinuxTreeWatcher} typed as an `fs.FSWatcher`. */
+export function createLinuxTreeWatcher(
+  root: string,
+  listener: fs.WatchListener<string>,
+  options?: ILinuxTreeWatcherOptions
+): fs.FSWatcher {
+  return new LinuxTreeWatcher(root, listener, options) as unknown as fs.FSWatcher;
+}
+
+async function loadExcludedFolderPathsAsync(
+  getExcludedFolderPathsAsync: (() => Promise<ReadonlySet<string>>) | undefined
+): Promise<ReadonlySet<string>> {
+  if (!getExcludedFolderPathsAsync) return EMPTY_SET;
+  try {
+    const folders: ReadonlySet<string> = await getExcludedFolderPathsAsync();
+    return new Set(Array.from(folders, (folder: string) => path.resolve(folder)));
+  } catch {
+    // Pruning is an optimization; observing a folder that could have been skipped is always safe.
+    return EMPTY_SET;
+  }
+}
+
+function getErrorCode(error: unknown): string | undefined {
+  return (error as NodeJS.ErrnoException | undefined)?.code;
+}
+
+/** Makes inotify exhaustion (`ENOSPC`) explicit instead of surfacing a bare libuv error. */
+export function toWatchError(error: unknown, folderPath: string): Error {
+  const cause: Error = error instanceof Error ? error : new Error(String(error));
+  if (getErrorCode(error) !== 'ENOSPC') return cause;
+  const limitError: NodeJS.ErrnoException = new Error(
+    `The Linux inotify watch limit was reached while watching "${folderPath}" ` +
+      `(fs.inotify.max_user_watches). Rush daemon change detection is incomplete. ` +
+      `Increase the limit (for example "sudo sysctl fs.inotify.max_user_watches=524288") ` +
+      `or unset RUSH_DAEMON_WATCH.`,
+    { cause }
+  );
+  limitError.code = 'ENOSPC';
+  return limitError;
+}
diff --git a/libraries/rush-daemon/src/WorkspaceSessionFileWatcher.ts b/libraries/rush-daemon/src/WorkspaceSessionFileWatcher.ts
index 05cb910190..095021b7d2 100644
--- a/libraries/rush-daemon/src/WorkspaceSessionFileWatcher.ts
+++ b/libraries/rush-daemon/src/WorkspaceSessionFileWatcher.ts
@@ -4,9 +4,15 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import type { RushConfiguration } from '@microsoft/rush-lib';
+import {
+  RushProjectConfiguration,
+  type RushConfiguration,
+  type RushConfigurationProject
+} from '@microsoft/rush-lib';
+import { NoOpTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import type { IWorkspaceInvalidationWatcher } from './WorkspaceSession';
+import { createLinuxTreeWatcher, type LinuxTreeWatcher } from './LinuxTreeWatcher';
 
 /** Options for the generation-owned workspace watcher. @beta */
 export interface IWorkspaceSessionFileWatcherOptions {
@@ -20,6 +26,7 @@ export interface IWorkspaceSessionFileWatcherOptions {
 interface IWatchPath {
   readonly folderPath: string;
   readonly recursive: boolean;
+  readonly project?: RushConfigurationProject;
 }
 
 /** Creates an individual filesystem watcher. @beta */
@@ -38,9 +45,10 @@ const PATH_SEGMENT_SEPARATOR_REGEXP: RegExp = /[\\/]/;
  */
 export class WorkspaceSessionFileWatcher implements IWorkspaceInvalidationWatcher {
   readonly #onError: ((error: Error) => void) | undefined;
-  readonly #watchFactory: WorkspaceWatchFactory;
+  readonly #watchFactory: WorkspaceWatchFactory | undefined;
   readonly #permanentPaths: ReadonlyArray<IWatchPath>;
   readonly #projectFolders: ReadonlyMap<string, string>;
+  readonly #projects: ReadonlyMap<string, RushConfigurationProject>;
   readonly #initialProjectNames: ReadonlyArray<string>;
   readonly #watchers: Map<string, fs.FSWatcher> = new Map();
   readonly #closing: Map<fs.FSWatcher, Promise<void>> = new Map();
@@ -49,8 +57,11 @@ export class WorkspaceSessionFileWatcher implements IWorkspaceInvalidationWatche
 
   public constructor(options: IWorkspaceSessionFileWatcherOptions) {
     this.#onError = options.onError;
-    this.#watchFactory = options.watchFactory ?? fs.watch;
+    this.#watchFactory = options.watchFactory;
     this.#permanentPaths = getPermanentWatchPaths(options.rushConfiguration);
+    this.#projects = new Map(
+      options.rushConfiguration.projects.map((project) => [project.packageName, project])
+    );
     this.#projectFolders = new Map(
       options.rushConfiguration.projects.map((project) => [project.packageName, project.projectFolder])
     );
@@ -77,6 +88,10 @@ export class WorkspaceSessionFileWatcher implements IWorkspaceInvalidationWatche
     for (const watchPath of this.#permanentPaths) {
       this.#watchers.set(watchPath.folderPath, this.#createWatcher(watchPath));
     }
+    // Permanent config folders are small; finish registering them before initialization is acknowledged.
+    await Promise.all(
+      Array.from(this.#watchers.values(), (watcher) => (watcher as Partial<LinuxTreeWatcher>).initialWalk)
+    );
     this.watchProjects(this.#initialProjectNames);
   }
 
@@ -94,7 +109,10 @@ export class WorkspaceSessionFileWatcher implements IWorkspaceInvalidationWatche
         throw new Error(`Project watcher is still closing: ${name}`);
       }
       if (!existing) {
-        this.#watchers.set(folderPath, this.#createWatcher({ folderPath, recursive: true }));
+        this.#watchers.set(
+          folderPath,
+          this.#createWatcher({ folderPath, recursive: true, project: this.#projects.get(name) })
+        );
         // Cover the observation gap without claiming an unknown graph/configuration mutation.
         this.#onInvalidation(folderPath);
       }
@@ -167,19 +185,22 @@ export class WorkspaceSessionFileWatcher implements IWorkspaceInvalidationWatche
   }
 
   #createWatcher(watchPath: IWatchPath): fs.FSWatcher {
-    const watcher: fs.FSWatcher = this.#watchFactory(
-      watchPath.folderPath,
-      { encoding: 'utf8', recursive: watchPath.recursive },
-      (eventType: string, filename: string | null) => {
-        void eventType;
-        const changedFilename: string | undefined = filename ?? undefined;
-        if (!isIgnoredPath(changedFilename)) {
-          this.#onInvalidation?.(
-            changedFilename === undefined ? undefined : path.resolve(watchPath.folderPath, changedFilename)
-          );
-        }
+    const listener: fs.WatchListener<string> = (eventType: string, filename: string | null) => {
+      void eventType;
+      const changedFilename: string | undefined = filename ?? undefined;
+      if (!isIgnoredPath(changedFilename)) {
+        this.#onInvalidation?.(
+          changedFilename === undefined ? undefined : path.resolve(watchPath.folderPath, changedFilename)
+        );
       }
-    );
+    };
+    const watchOptions: { encoding: 'utf8'; recursive: boolean } = {
+      encoding: 'utf8',
+      recursive: watchPath.recursive
+    };
+    const watcher: fs.FSWatcher = this.#watchFactory
+      ? this.#watchFactory(watchPath.folderPath, watchOptions, listener)
+      : createDefaultWatcher(watchPath, watchOptions, listener);
     watcher.on('error', (error: Error) => {
       this.#onInvalidation?.();
       if (this.#onError) this.#onError(error);
@@ -195,6 +216,49 @@ export class WorkspaceSessionFileWatcher implements IWorkspaceInvalidationWatche
   }
 }
 
+/**
+ * Node's recursive `fs.watch` on Linux walks the tree synchronously and adds one inotify watch per file,
+ * including build outputs. On Linux, recursive observation uses per-directory watches from an async walk instead.
+ */
+function createDefaultWatcher(
+  watchPath: IWatchPath,
+  watchOptions: { encoding: 'utf8'; recursive: boolean },
+  listener: fs.WatchListener<string>
+): fs.FSWatcher {
+  if (process.platform !== 'linux' || !watchPath.recursive) {
+    return fs.watch(watchPath.folderPath, watchOptions, listener);
+  }
+  const project: RushConfigurationProject | undefined = watchPath.project;
+  return createLinuxTreeWatcher(watchPath.folderPath, listener, {
+    getExcludedFolderPathsAsync: project ? () => getProjectExcludedFolderPathsAsync(project) : undefined,
+    reportInitialWalkCompletion: project !== undefined
+  });
+}
+
+/** The project's `.rush/temp` folder plus every declared operation output folder. @internal */
+export async function getProjectExcludedFolderPathsAsync(
+  project: RushConfigurationProject
+): Promise<ReadonlySet<string>> {
+  const excluded: Set<string> = new Set([path.resolve(project.projectRushTempFolder)]);
+  const terminal: Terminal = new Terminal(new NoOpTerminalProvider());
+  let configuration: RushProjectConfiguration | undefined;
+  try {
+    configuration = await RushProjectConfiguration.tryLoadForProjectAsync(project, terminal);
+  } catch {
+    // Output-folder pruning is an optimization; an unreadable configuration only loses that part.
+    return excluded;
+  }
+  const projectFolder: string = path.resolve(project.projectFolder);
+  for (const settings of configuration?.operationSettingsByOperationName.values() ?? []) {
+    for (const outputFolderName of settings.outputFolderNames ?? []) {
+      const outputFolder: string = path.resolve(projectFolder, outputFolderName);
+      // Never prune the project folder itself or anything outside it.
+      if (outputFolder.startsWith(projectFolder + path.sep)) excluded.add(outputFolder);
+    }
+  }
+  return excluded;
+}
+
 function getPermanentWatchPaths(rushConfiguration: RushConfiguration): ReadonlyArray<IWatchPath> {
   const recursiveFolders: Set<string> = new Set([rushConfiguration.commonRushConfigFolder]);
   for (const subspace of rushConfiguration.subspaces) {
diff --git a/libraries/rush-daemon/src/test/LinuxTreeWatcher.test.ts b/libraries/rush-daemon/src/test/LinuxTreeWatcher.test.ts
new file mode 100644
index 0000000000..3d4c18874a
--- /dev/null
+++ b/libraries/rush-daemon/src/test/LinuxTreeWatcher.test.ts
@@ -0,0 +1,295 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { EventEmitter } from 'node:events';
+
+import {
+  LinuxTreeWatcher,
+  toWatchError,
+  type DirectoryWatchFunction,
+  type ILinuxTreeWatcherOptions
+} from '../LinuxTreeWatcher';
+
+class FakeDirectoryWatcher extends EventEmitter {
+  public closed: boolean = false;
+  public readonly listener: fs.WatchListener<string>;
+  public constructor(listener: fs.WatchListener<string>) {
+    super();
+    this.listener = listener;
+  }
+  public close(): void {
+    this.closed = true;
+  }
+  public ref(): this {
+    return this;
+  }
+  public unref(): this {
+    return this;
+  }
+}
+
+interface IHarness {
+  readonly root: string;
+  readonly events: string[];
+  readonly errors: Error[];
+  readonly fakes: Map<string, FakeDirectoryWatcher>;
+  readonly watcher: LinuxTreeWatcher;
+  fire(folder: string, eventType: fs.WatchEventType, filename: string): void;
+}
+
+const roots: string[] = [];
+
+function makeTree(files: string[]): string {
+  const root: string = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-tree-')));
+  roots.push(root);
+  for (const file of files) {
+    fs.mkdirSync(path.dirname(path.join(root, file)), { recursive: true });
+    fs.writeFileSync(path.join(root, file), '');
+  }
+  return root;
+}
+
+function createHarness(
+  root: string,
+  options: Omit<ILinuxTreeWatcherOptions, 'watchDirectory'> = {},
+  watchOverride?: (folder: string) => void
+): IHarness {
+  const events: string[] = [];
+  const errors: Error[] = [];
+  const fakes: Map<string, FakeDirectoryWatcher> = new Map();
+  const watchDirectory: DirectoryWatchFunction = (folder, listener) => {
+    watchOverride?.(folder);
+    const fake: FakeDirectoryWatcher = new FakeDirectoryWatcher(listener);
+    fakes.set(folder, fake);
+    return fake as unknown as fs.FSWatcher;
+  };
+  const watcher: LinuxTreeWatcher = new LinuxTreeWatcher(
+    root,
+    (eventType, filename) => events.push(`${eventType}:${filename}`),
+    { ...options, watchDirectory }
+  );
+  watcher.on('error', (error: Error) => errors.push(error));
+  return {
+    root,
+    events,
+    errors,
+    fakes,
+    watcher,
+    fire: (folder, eventType, filename) => fakes.get(path.join(root, folder))!.listener(eventType, filename)
+  };
+}
+
+function relativeWatched(harness: IHarness): string[] {
+  return [...harness.watcher.watchedFolderPaths].map((folder) => path.relative(harness.root, folder)).sort();
+}
+
+async function waitForAsync(condition: () => boolean): Promise<void> {
+  for (let attempt: number = 0; attempt < 200 && !condition(); attempt++) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+  expect(condition()).toBe(true);
+}
+
+afterAll(() => {
+  for (const root of roots) fs.rmSync(root, { recursive: true, force: true });
+});
+
+describe(LinuxTreeWatcher.name, () => {
+  it('watches directories only and prunes node_modules, .git, .rush/temp and output folders', async () => {
+    const root: string = makeTree([
+      'package.json',
+      'src/a.ts',
+      'src/nested/b.ts',
+      'lib/a.js',
+      'lib/nested/b.js',
+      'node_modules/x/index.js',
+      '.git/HEAD',
+      '.rush/temp/shrinkwrap.yaml',
+      '.rush/other.json',
+      'config/rush-project.json'
+    ]);
+    const harness: IHarness = createHarness(root, {
+      getExcludedFolderPathsAsync: async () =>
+        new Set([path.join(root, 'lib'), path.join(root, '.rush', 'temp')])
+    });
+    await harness.watcher.initialWalk;
+    expect(relativeWatched(harness)).toEqual(['', '.rush', 'config', 'src', path.join('src', 'nested')]);
+    expect(harness.errors).toEqual([]);
+    harness.watcher.close();
+  });
+
+  it('suppresses events for pruned paths and reports others relative to the root', async () => {
+    const root: string = makeTree(['src/a.ts']);
+    const harness: IHarness = createHarness(root, {
+      getExcludedFolderPathsAsync: async () => new Set([path.join(root, 'lib')])
+    });
+    await harness.watcher.initialWalk;
+    harness.fire('', 'rename', 'lib');
+    harness.fire('', 'rename', 'node_modules');
+    harness.fire('src', 'change', 'a.ts');
+    expect(harness.events).toEqual([`change:${path.join('src', 'a.ts')}`]);
+    harness.watcher.close();
+  });
+
+  it('follows directories created and removed after the initial walk', async () => {
+    const root: string = makeTree(['src/a.ts']);
+    const harness: IHarness = createHarness(root);
+    await harness.watcher.initialWalk;
+    fs.mkdirSync(path.join(root, 'src', 'added', 'deep'), { recursive: true });
+    harness.fire('src', 'rename', 'added');
+    const added: string = path.join('src', 'added');
+    await waitForAsync(() => harness.events.includes(`rename:${added}`) && harness.events.length === 2);
+    expect(relativeWatched(harness)).toEqual(['', 'src', added, path.join(added, 'deep')]);
+
+    const deepWatcher: FakeDirectoryWatcher = harness.fakes.get(path.join(root, added, 'deep'))!;
+    fs.rmSync(path.join(root, added), { recursive: true });
+    harness.fire('src', 'rename', 'added');
+    await waitForAsync(() => relativeWatched(harness).length === 2);
+    expect(deepWatcher.closed).toBe(true);
+    expect(harness.errors).toEqual([]);
+    harness.watcher.close();
+  });
+
+  it('tolerates directories that disappear during registration without reporting an error', async () => {
+    const root: string = makeTree(['a/x.ts', 'b/y.ts']);
+    const harness: IHarness = createHarness(root, {}, (folder) => {
+      if (path.basename(folder) === 'a') {
+        throw Object.assign(new Error('ENOENT: no such file or directory'), { code: 'ENOENT' });
+      }
+    });
+    await harness.watcher.initialWalk;
+    expect(relativeWatched(harness)).toEqual(['', 'b']);
+    harness.fakes.get(path.join(root, 'b'))!.emit('error', Object.assign(new Error('gone'), { code: 'ENOENT' }));
+    expect(relativeWatched(harness)).toEqual(['']);
+    expect(harness.errors).toEqual([]);
+    harness.watcher.close();
+  });
+
+  it('reports ENOSPC once with an explicit inotify limit error and stops registering', async () => {
+    const root: string = makeTree(['a/x.ts', 'b/y.ts', 'c/z.ts']);
+    const harness: IHarness = createHarness(root, {}, (folder) => {
+      if (folder !== root) {
+        throw Object.assign(new Error('ENOSPC: System limit for number of file watchers reached'), {
+          code: 'ENOSPC'
+        });
+      }
+    });
+    await harness.watcher.initialWalk;
+    expect(harness.errors).toHaveLength(1);
+    expect((harness.errors[0] as NodeJS.ErrnoException).code).toBe('ENOSPC');
+    expect(harness.errors[0].message).toContain('fs.inotify.max_user_watches');
+    harness.watcher.close();
+  });
+
+  it('throws synchronously when the root cannot be watched, like fs.watch', () => {
+    const missing: string = path.join(makeTree([]), 'missing');
+    expect(
+      () =>
+        new LinuxTreeWatcher(missing, () => {}, {
+          watchDirectory: (folder) => fs.watch(folder)
+        })
+    ).toThrow(/ENOENT/);
+  });
+
+  it('reports the root after the initial walk when requested and emits close asynchronously', async () => {
+    const root: string = makeTree(['src/a.ts']);
+    const harness: IHarness = createHarness(root, { reportInitialWalkCompletion: true });
+    await harness.watcher.initialWalk;
+    expect(harness.events).toEqual(['rename:']);
+    const closed: Promise<void> = new Promise((resolve) => harness.watcher.once('close', resolve));
+    harness.watcher.close();
+    await closed;
+    expect([...harness.fakes.values()].every((fake) => fake.closed)).toBe(true);
+    expect(harness.watcher.watchedFolderPaths.size).toBe(0);
+  });
+
+  it('forwards an unknown (null) filename unchanged so the consumer invalidates fully', async () => {
+    const root: string = makeTree(['src/a.ts']);
+    const harness: IHarness = createHarness(root);
+    await harness.watcher.initialWalk;
+    harness.fakes.get(path.join(root, 'src'))!.listener('change', null);
+    expect(harness.events).toEqual(['change:null']);
+    harness.watcher.close();
+  });
+
+  it('does not register a folder that becomes excluded after exclusions finish loading', async () => {
+    const root: string = makeTree(['src/a.ts', 'lib/a.js']);
+    let resolveExclusions!: (folders: ReadonlySet<string>) => void;
+    const exclusions: Promise<ReadonlySet<string>> = new Promise((resolve) => (resolveExclusions = resolve));
+    const harness: IHarness = createHarness(root, { getExcludedFolderPathsAsync: () => exclusions });
+    harness.fire('', 'rename', 'lib');
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    resolveExclusions(new Set([path.join(root, 'lib')]));
+    await harness.watcher.initialWalk;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    expect(relativeWatched(harness)).toEqual(['', 'src']);
+    harness.watcher.close();
+  });
+
+  it('re-registers a directory that was replaced in place', async () => {
+    const root: string = makeTree(['src/nested/a.ts']);
+    const harness: IHarness = createHarness(root);
+    await harness.watcher.initialWalk;
+    const oldSrc: FakeDirectoryWatcher = harness.fakes.get(path.join(root, 'src'))!;
+    const oldNested: FakeDirectoryWatcher = harness.fakes.get(path.join(root, 'src', 'nested'))!;
+    fs.rmSync(path.join(root, 'src'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'src', 'nested'), { recursive: true });
+    harness.fire('', 'rename', 'src');
+    await waitForAsync(() => harness.fakes.get(path.join(root, 'src', 'nested')) !== oldNested);
+    expect(oldSrc.closed).toBe(true);
+    expect(oldNested.closed).toBe(true);
+    expect(harness.fakes.get(path.join(root, 'src'))).not.toBe(oldSrc);
+    expect(relativeWatched(harness)).toEqual(['', 'src', path.join('src', 'nested')]);
+    expect(harness.errors).toEqual([]);
+    harness.watcher.close();
+  });
+
+  it('reports non-transient walk failures instead of treating them as a vanished directory', async () => {
+    const root: string = makeTree(['a/x.ts']);
+    const opendir: typeof fs.promises.opendir = fs.promises.opendir;
+    const spy: jest.SpyInstance = jest
+      .spyOn(fs.promises, 'opendir')
+      .mockImplementation(async (folder: fs.PathLike, options?: fs.OpenDirOptions) => {
+        if (path.basename(String(folder)) === 'a') {
+          throw Object.assign(new Error('EMFILE: too many open files'), { code: 'EMFILE' });
+        }
+        return await opendir(folder, options);
+      });
+    try {
+      const harness: IHarness = createHarness(root);
+      await harness.watcher.initialWalk;
+      expect(harness.errors.map((error) => (error as NodeJS.ErrnoException).code)).toEqual(['EMFILE']);
+      harness.watcher.close();
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  it('leaves non-ENOSPC errors unchanged', () => {
+    const error: Error = Object.assign(new Error('EMFILE'), { code: 'EMFILE' });
+    expect(toWatchError(error, '/x')).toBe(error);
+  });
+
+  (process.platform === 'linux' ? it : it.skip)('observes real inotify events in new directories', async () => {
+    const root: string = makeTree(['src/a.ts', 'lib/a.js']);
+    const events: string[] = [];
+    const watcher: LinuxTreeWatcher = new LinuxTreeWatcher(root, (...args) => events.push(args[1]!), {
+      getExcludedFolderPathsAsync: async () => new Set([path.join(root, 'lib')])
+    });
+    try {
+      await watcher.initialWalk;
+      expect(watcher.watchedFolderPaths.size).toBe(2);
+      fs.mkdirSync(path.join(root, 'src', 'new'));
+      await waitForAsync(() => watcher.watchedFolderPaths.size === 3);
+      fs.writeFileSync(path.join(root, 'src', 'new', 'b.ts'), 'x');
+      fs.writeFileSync(path.join(root, 'lib', 'b.js'), 'x');
+      await waitForAsync(() => events.includes(path.join('src', 'new', 'b.ts')));
+      expect(events.some((event) => event.startsWith('lib'))).toBe(false);
+    } finally {
+      watcher.close();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceSessionFileWatcher.test.ts b/libraries/rush-daemon/src/test/WorkspaceSessionFileWatcher.test.ts
index 7596e49d0d..59cf271ed5 100644
--- a/libraries/rush-daemon/src/test/WorkspaceSessionFileWatcher.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceSessionFileWatcher.test.ts
@@ -2,9 +2,12 @@
 // See LICENSE in the project root for license information.
 
 import type * as fs from 'node:fs';
+import * as path from 'node:path';
 import { EventEmitter } from 'node:events';
 
-import { WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
+import { RushProjectConfiguration } from '@microsoft/rush-lib';
+
+import { getProjectExcludedFolderPathsAsync, WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
 import { TEST_RUSH_CONFIGURATION } from './TestWorkspaceSession';
 
 class TestFsWatcher extends EventEmitter {
@@ -22,6 +25,26 @@ class TestFsWatcher extends EventEmitter {
 }
 
 describe(WorkspaceSessionFileWatcher.name, () => {
+  it('excludes the project .rush/temp folder from Linux tree observation', async () => {
+    const project = TEST_RUSH_CONFIGURATION.projects[0];
+    const excluded: ReadonlySet<string> = await getProjectExcludedFolderPathsAsync(project);
+    expect(excluded.has(path.resolve(project.projectRushTempFolder))).toBe(true);
+    expect(excluded.has(path.resolve(project.projectFolder))).toBe(false);
+  });
+
+  it('keeps the .rush/temp exclusion when rush-project.json cannot be loaded', async () => {
+    const project = TEST_RUSH_CONFIGURATION.projects[0];
+    const spy: jest.SpyInstance = jest
+      .spyOn(RushProjectConfiguration, 'tryLoadForProjectAsync')
+      .mockRejectedValue(new Error('invalid rush-project.json'));
+    try {
+      const excluded: ReadonlySet<string> = await getProjectExcludedFolderPathsAsync(project);
+      expect([...excluded]).toEqual([path.resolve(project.projectRushTempFolder)]);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
   it('watches every configured subspace config folder', async () => {
     const watchedPaths: string[] = [];
     const watcher: WorkspaceSessionFileWatcher = new WorkspaceSessionFileWatcher({

From 18fc2b67edf69f894a39a5db577ac61231b38beb Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:16:27 -0700
Subject: [PATCH 004/265] [rush-daemon-transport] Reap a dead daemon's orphaned
 operation processes on reclaim (#6088)

* [rush-daemon-transport] Reap a dead daemon's orphaned operation processes on reclaim

Fixes #6055

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon-transport] Address review: fail closed on probe errors, unknown own group, and SIGKILL survivors

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../rushd-reap-orphans_2026-09-24-03-00.json  |  11 ++
 .../src/DaemonOrphanReaper.ts                 | 100 ++++++++++++++++++
 .../src/DaemonProcessGroup.ts                 |  78 ++++++++++++++
 .../src/DaemonReclaim.ts                      |   9 +-
 .../src/test/DaemonOrphanReaper.test.ts       |  64 +++++++++++
 .../src/test/DaemonProcessGroup.test.ts       |  32 ++++++
 .../src/test/OrphanReapOnReclaim.test.ts      |  70 ++++++++++++
 .../src/test/OrphanReaperFixture.ts           |  50 +++++++++
 8 files changed, 412 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/rushd-reap-orphans_2026-09-24-03-00.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/rushd-reap-orphans_2026-09-24-03-00.json b/common/changes/@rushstack/rush-daemon-transport/rushd-reap-orphans_2026-09-24-03-00.json
new file mode 100644
index 0000000000..89a8bf208b
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/rushd-reap-orphans_2026-09-24-03-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "When reclaiming the socket of a daemon that died uncleanly (SIGKILL/OOM), terminate the operation processes still running in its process group (SIGTERM, then SIGKILL after a grace period) so a successor daemon does not re-run them concurrently.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
new file mode 100644
index 0000000000..bd4c61534b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonLockfile } from './DaemonLockfile';
+import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
+import { POSIX_PROCESS_GROUP_OPS } from './DaemonProcessGroup';
+
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+// 0 and 1 are never daemons, and kill(-0)/kill(-1) would signal our own group or every process.
+const FIRST_USER_PID: number = 2;
+const POLL_INTERVAL_MS: number = 20;
+const DEFAULT_GRACE_MS: number = 2000;
+
+/** Outcome of reaping a dead daemon's process group. */
+export type DaemonOrphanReapOutcome = 'none' | 'terminated' | 'killed';
+
+/** Options for {@link reapDeadDaemonProcessGroupAsync}; every field defaults to the real process. */
+export interface IDaemonOrphanReaperOptions {
+  readonly ops?: IDaemonProcessGroupOps;
+  readonly platform?: NodeJS.Platform;
+  readonly selfPid?: number;
+  /** How long SIGTERM'd (and then SIGKILL'd) processes get to exit. */
+  readonly graceMs?: number;
+}
+
+interface IReapContext {
+  readonly ops: IDaemonProcessGroupOps;
+  readonly deadPid: number;
+  readonly graceMs: number;
+}
+type OrphanCheck = (pid: number) => boolean;
+
+function isNeitherSelfNorOwnGroup(pid: number, selfPid: number, ops: IDaemonProcessGroupOps): boolean {
+  // Fail closed: an unknown own group might be `pid` (e.g. rush-client run by an operation).
+  const ownGroupId: number | undefined = ops.ownGroupId();
+  return pid !== selfPid && ownGroupId !== undefined && pid !== ownGroupId;
+}
+
+function orphanChecks(options: IDaemonOrphanReaperOptions, ops: IDaemonProcessGroupOps): OrphanCheck[] {
+  return [
+    () => (options.platform ?? process.platform) !== WINDOWS_PLATFORM,
+    (pid: number) => Number.isSafeInteger(pid) && pid >= FIRST_USER_PID,
+    (pid: number) => isNeitherSelfNorOwnGroup(pid, options.selfPid ?? process.pid, ops),
+    (pid: number) => !ops.isProcessAlive(pid),
+    (pid: number) => ops.groupExists(pid)
+  ];
+}
+
+async function waitForGroupExitAsync(context: IReapContext): Promise<boolean> {
+  const deadline: number = context.ops.now() + context.graceMs;
+  while (context.ops.now() < deadline) {
+    if (!context.ops.groupExists(context.deadPid)) return true;
+    await context.ops.delayAsync(POLL_INTERVAL_MS);
+  }
+  return !context.ops.groupExists(context.deadPid);
+}
+
+async function terminateGroupAsync(context: IReapContext): Promise<DaemonOrphanReapOutcome> {
+  context.ops.signalGroup(context.deadPid, 'SIGTERM');
+  if (await waitForGroupExitAsync(context)) return 'terminated';
+  context.ops.signalGroup(context.deadPid, 'SIGKILL');
+  if (await waitForGroupExitAsync(context)) return 'killed';
+  throw new Error(`Processes of dead daemon ${context.deadPid} survived SIGKILL; not reclaiming its socket.`);
+}
+
+/**
+ * Terminates operation processes left behind by a daemon that died without joining them (SIGKILL, OOM).
+ *
+ * @remarks
+ * The daemon is spawned detached, so its pid is its process group id, and phased operation children inherit
+ * that group (children spawned with their own detached group are out of scope). Sends SIGTERM, then SIGKILL
+ * after `graceMs`, and throws if the group still has not exited after a further `graceMs`.
+ * PID-reuse guard: only group `deadPid` is signaled, and only once `deadPid` is proven dead while the group
+ * still exists; POSIX never reuses a pid still in use as a process group id, so every remaining member
+ * belongs to the dead daemon. Never signals the caller's pid or group, and does nothing when the caller's
+ * group is unknown (no `/proc`). Call only under the reclaim mutex.
+ */
+export async function reapDeadDaemonProcessGroupAsync(
+  deadPid: number,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<DaemonOrphanReapOutcome> {
+  const context: IReapContext = createReapContext(deadPid, options);
+  if (!orphanChecks(options, context.ops).every((check: OrphanCheck) => check(deadPid))) return 'none';
+  const outcome: DaemonOrphanReapOutcome = await terminateGroupAsync(context);
+  context.ops.log(`Reclaimed dead daemon ${deadPid}: its orphaned operation process group was ${outcome}.`);
+  return outcome;
+}
+
+function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
+  return {
+    ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
+    deadPid,
+    graceMs: options.graceMs ?? DEFAULT_GRACE_MS
+  };
+}
+
+/** Reaps the orphaned operations of a reclaimed daemon's recorded owner, if there is one. */
+export async function reapOrphansOfDeadOwnerAsync(owner: IDaemonLockfile | undefined): Promise<void> {
+  if (owner) await reapDeadDaemonProcessGroupAsync(owner.pid);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
new file mode 100644
index 0000000000..a8eb871383
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { isDaemonProcessAlive } from './DaemonLockfile';
+
+const NO_SIGNAL: number = 0;
+const NO_SUCH_PROCESS: string = 'ESRCH';
+const PROC_SELF_STAT: string = '/proc/self/stat';
+const UTF8: BufferEncoding = 'utf8';
+const COMM_END: string = ')';
+const FIELD_SEPARATOR: string = ' ';
+// After the ")" that ends the command name come: " <state> <ppid> <pgrp> ...".
+const PGRP_FIELD_INDEX: number = 3;
+
+/** Process probing/signaling used to reap a dead daemon's process group; injectable for tests. */
+export interface IDaemonProcessGroupOps {
+  readonly isProcessAlive: (pid: number) => boolean;
+  readonly groupExists: (groupId: number) => boolean;
+  readonly signalGroup: (groupId: number, signal: NodeJS.Signals) => void;
+  /** The caller's own process group id, or `undefined` when the platform cannot report it. */
+  readonly ownGroupId: () => number | undefined;
+  readonly delayAsync: (ms: number) => Promise<void>;
+  readonly now: () => number;
+  readonly log: (message: string) => void;
+}
+
+// Only ESRCH proves the group is gone; EPERM and other failures propagate so reclaim fails closed.
+function rethrowUnlessNoSuchProcess(error: unknown): void {
+  if ((error as NodeJS.ErrnoException | undefined)?.code !== NO_SUCH_PROCESS) throw error;
+}
+
+function groupExists(groupId: number): boolean {
+  try {
+    process.kill(-groupId, NO_SIGNAL);
+    return true;
+  } catch (error) {
+    rethrowUnlessNoSuchProcess(error);
+    return false;
+  }
+}
+
+function signalGroup(groupId: number, signal: NodeJS.Signals): void {
+  try {
+    process.kill(-groupId, signal);
+  } catch (error) {
+    rethrowUnlessNoSuchProcess(error);
+  }
+}
+
+function ownGroupId(): number | undefined {
+  try {
+    const stat: string = fs.readFileSync(PROC_SELF_STAT, UTF8);
+    const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
+    return Number(fields[PGRP_FIELD_INDEX]);
+  } catch {
+    return undefined;
+  }
+}
+
+function log(message: string): void {
+  process.emitWarning(message, { code: 'RUSH_DAEMON_ORPHANS_REAPED' });
+}
+
+/** The real POSIX implementation of {@link IDaemonProcessGroupOps}. */
+export const POSIX_PROCESS_GROUP_OPS: IDaemonProcessGroupOps = {
+  isProcessAlive: isDaemonProcessAlive,
+  groupExists,
+  signalGroup,
+  ownGroupId,
+  delayAsync: async (ms: number) => {
+    await delayAsync(ms);
+  },
+  now: Date.now,
+  log
+};
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index e70d12f0f2..92f0ed9323 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -10,6 +10,7 @@ import {
   readDaemonLockfile,
   removeDaemonArtifacts
 } from './DaemonLockfile';
+import { reapOrphansOfDeadOwnerAsync } from './DaemonOrphanReaper';
 import type { IDaemonPaths } from './DaemonPaths';
 import { tryAcquireReclaimLock } from './DaemonReclaimLock';
 import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
@@ -24,7 +25,8 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * never reclaimed underneath itself. Reclaims are serialized through the
  * lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may
  * unlink the socket path, so a concurrent starter cannot delete a socket that
- * another process just bound.
+ * another process just bound. Operation processes still running in the dead
+ * daemon's process group are terminated first (see `DaemonOrphanReaper`).
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
@@ -57,13 +59,16 @@ function reclaimLockPath(paths: IDaemonPaths): string {
 }
 
 async function reclaimUnderLockAsync(paths: IDaemonPaths): Promise<void> {
-  if (isLockfilePidAlive(readDaemonLockfile(paths.lockfilePath))) {
+  const owner: ReturnType<typeof readDaemonLockfile> = readDaemonLockfile(paths.lockfilePath);
+  if (isLockfilePidAlive(owner)) {
     throwAlreadyRunning(paths, 'its lockfile PID is alive');
   }
   const probeFailed: boolean = await probeConnectionFailsAsync(paths.socketPath);
   if (!probeFailed) {
     throwAlreadyRunning(paths, 'it answers a connect probe');
   }
+  // A daemon that died uncleanly leaves its operations running; stop them before a successor re-runs them.
+  await reapOrphansOfDeadOwnerAsync(owner);
   removeDaemonArtifacts(paths.lockfilePath, paths.socketPath);
 }
 
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
new file mode 100644
index 0000000000..a775495413
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonProcessGroupAsync } from '../DaemonOrphanReaper';
+import type { IDaemonOrphanReaperOptions } from '../DaemonOrphanReaper';
+
+import { DEAD_PID, SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const INIT_PID: number = 1;
+
+it('stops at SIGTERM when the orphaned group exits within the grace period', async () => {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM' });
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, fake.options)).resolves.toBe('terminated');
+  expect(fake.signals).toEqual(['SIGTERM']);
+  expect(fake.logs).toEqual([expect.stringContaining(`dead daemon ${DEAD_PID}`)]);
+});
+
+it('escalates to SIGKILL when the group outlives the grace period', async () => {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGKILL' });
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, fake.options)).resolves.toBe('killed');
+  expect(fake.signals).toEqual(['SIGTERM', 'SIGKILL']);
+  expect(fake.logs).toEqual([expect.stringContaining('killed')]);
+});
+
+it('fails the reclaim when the group is still present after SIGKILL', async () => {
+  const fake: IFakeGroup = createFakeGroup({});
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, fake.options)).rejects.toThrow(/survived SIGKILL/);
+  expect(fake.signals).toEqual(['SIGTERM', 'SIGKILL']);
+});
+
+it('never signals a live daemon (its pid is not proven dead)', async () => {
+  const fake: IFakeGroup = createFakeGroup({ daemonAlive: true });
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, fake.options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+it('never signals when no group with the dead pid remains', async () => {
+  const fake: IFakeGroup = createFakeGroup({});
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID + INIT_PID, fake.options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(fake.logs).toEqual([]);
+});
+
+it.each([INIT_PID, SELF_PID, Number.NaN])('never signals the unsafe group id %p', async (pid: number) => {
+  const fake: IFakeGroup = createFakeGroup({ anyGroupExists: true, ownGroupId: DEAD_PID + INIT_PID });
+  await expect(reapDeadDaemonProcessGroupAsync(pid, fake.options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+it('never signals the caller own process group, or when that group is unknown', async () => {
+  const own: IFakeGroup = createFakeGroup({ ownGroupId: DEAD_PID });
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, own.options)).resolves.toBe('none');
+  const unknown: IFakeGroup = createFakeGroup({ unknownOwnGroup: true });
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, unknown.options)).resolves.toBe('none');
+  expect([...own.signals, ...unknown.signals]).toEqual([]);
+});
+
+it('never signals anything on Windows', async () => {
+  const win: IFakeGroup = createFakeGroup({});
+  const winOptions: IDaemonOrphanReaperOptions = { ...win.options, platform: 'win32' };
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, winOptions)).resolves.toBe('none');
+  expect(win.signals).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
new file mode 100644
index 0000000000..8ab89515a3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
@@ -0,0 +1,32 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+
+const GROUP_ID: number = 4242;
+
+function throwErrno(code: string): never {
+  throw Object.assign(new Error(code), { code });
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+it('treats only ESRCH as proof that a process group is gone', () => {
+  jest.spyOn(process, 'kill').mockImplementation(() => throwErrno('ESRCH'));
+  expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(false);
+  expect(() => POSIX_PROCESS_GROUP_OPS.signalGroup(GROUP_ID, 'SIGTERM')).not.toThrow();
+});
+
+it('propagates EPERM instead of assuming the group is gone', () => {
+  jest.spyOn(process, 'kill').mockImplementation(() => throwErrno('EPERM'));
+  expect(() => POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toThrow('EPERM');
+  expect(() => POSIX_PROCESS_GROUP_OPS.signalGroup(GROUP_ID, 'SIGKILL')).toThrow('EPERM');
+});
+
+it('signals the negated group id', () => {
+  const kill: jest.SpyInstance = jest.spyOn(process, 'kill').mockImplementation(() => true);
+  POSIX_PROCESS_GROUP_OPS.signalGroup(GROUP_ID, 'SIGTERM');
+  expect(kill).toHaveBeenCalledWith(-GROUP_ID, 'SIGTERM');
+});
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
new file mode 100644
index 0000000000..2e4a96a4cf
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import type { Readable } from 'node:stream';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { isDaemonProcessAlive, writeDaemonLockfile } from '../DaemonLockfile';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const FIRST_ATTEMPT: number = 0;
+const POLL_ATTEMPTS: number = 100;
+const POLL_INTERVAL_MS: number = 20;
+// A stand-in daemon: spawns one operation child and prints the child pid. Like a phased operation (spawned
+// without `detached`), the child inherits the daemon's process group.
+const FAKE_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process').spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'});" +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+
+interface IOrphanedGroup {
+  readonly daemonPid: number;
+  readonly orphanPid: number;
+}
+
+/** Spawns a detached fake daemon with one child in its group, then SIGKILLs only the daemon. */
+async function createOrphanedGroupAsync(): Promise<IOrphanedGroup> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', FAKE_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const stdout: Readable = daemon.stdout as Readable;
+  const [chunk] = (await once(stdout, 'data')) as [Buffer];
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  stdout.destroy();
+  return { daemonPid: Number(daemon.pid), orphanPid: Number(chunk.toString().trim()) };
+}
+
+async function waitUntilDeadAsync(pid: number): Promise<boolean> {
+  for (let attempt: number = FIRST_ATTEMPT; attempt < POLL_ATTEMPTS; attempt++) {
+    if (!isDaemonProcessAlive(pid)) return true;
+    await delayAsync(POLL_INTERVAL_MS);
+  }
+  return false;
+}
+
+posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaiming', async () => {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
+  expect(isDaemonProcessAlive(orphanPid)).toBe(true);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: daemonPid,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+  await reclaimStaleDaemonAsync(paths);
+  expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`dead daemon ${daemonPid}`), expect.anything());
+  warning.mockRestore();
+});
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
new file mode 100644
index 0000000000..c0e1f8bede
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
@@ -0,0 +1,50 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonOrphanReaperOptions } from '../DaemonOrphanReaper';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+
+/** The pid of the fake dead daemon, which is also its process group id. */
+export const DEAD_PID: number = 4242;
+/** The fake caller's own pid (and, by default, its process group id). */
+export const SELF_PID: number = 1000;
+const GRACE_MS: number = 100;
+const CLOCK_START: number = 0;
+
+/** A fake process table recording every signal sent and every message logged. */
+export interface IFakeGroup {
+  readonly signals: NodeJS.Signals[];
+  readonly logs: string[];
+  readonly options: IDaemonOrphanReaperOptions;
+}
+
+/** Describes the fake process table. */
+export interface IFakeGroupSpec {
+  readonly daemonAlive?: boolean;
+  /** The signal after which the group is gone; omitted means it never exits. */
+  readonly exitsOn?: NodeJS.Signals;
+  readonly ownGroupId?: number;
+  readonly unknownOwnGroup?: boolean;
+  readonly anyGroupExists?: boolean;
+}
+
+/** Creates a fake process table with a virtual clock. */
+export function createFakeGroup(spec: IFakeGroupSpec): IFakeGroup {
+  const signals: NodeJS.Signals[] = [];
+  const logs: string[] = [];
+  let clock: number = CLOCK_START;
+  const ops: IDaemonProcessGroupOps = {
+    isProcessAlive: () => spec.daemonAlive === true,
+    groupExists: (groupId: number) =>
+      (spec.anyGroupExists === true || groupId === DEAD_PID) &&
+      !signals.some((signal: NodeJS.Signals) => signal === spec.exitsOn),
+    signalGroup: (groupId: number, signal: NodeJS.Signals) => signals.push(signal),
+    ownGroupId: () => (spec.unknownOwnGroup === true ? undefined : (spec.ownGroupId ?? SELF_PID)),
+    delayAsync: async (ms: number) => {
+      clock += ms;
+    },
+    now: () => clock,
+    log: (message: string) => logs.push(message)
+  };
+  return { signals, logs, options: { ops, platform: 'linux', selfPid: SELF_PID, graceMs: GRACE_MS } };
+}

From 7aecafacdc79cfad5110694b743ebcaa06a05589 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:16:46 -0700
Subject: [PATCH 005/265] [rush-daemon] Stop --verbose / --parallelism /
 --timeline from reloading the warm graph (#6063)

* [rush-daemon] Apply --verbose/--parallelism per request instead of reloading the warm graph

Presentation and scheduling flags (--verbose, --parallelism, --timeline) are no longer part of the engine parameter identity, so they no longer force a tier-1 reload that discards all retained results. rushd applies quietMode/parallelism to the shared graph before each iteration and only coalesces requests with equal settings.

Fixes #6048

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-lib] Update API reports for per-request engine settings

Fixes #6048

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Test that differing request settings are not batched together

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../rush/flag-reload_2026-09-24.json          |  11 ++
 .../rush-daemon/flag-reload_2026-09-24.json   |  11 ++
 common/reviews/api/rush-daemon.api.md         |   4 +-
 common/reviews/api/rush-lib.api.md            |   9 ++
 .../src/DaemonRequestDispatcher.ts            |   6 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  30 ++++-
 .../src/ProductionDaemonRequestResolver.ts    |   5 +-
 .../src/test/PhasedRequestBatching.test.ts    |  40 +++++++
 .../WorkspaceRequestScopedParameters.test.ts  |  52 +++++++++
 .../rush-lib/src/api/PhasedCommandEngine.ts   |  17 +++
 ...asedCommandEngineParameterIdentity.test.ts | 110 ++++++++++++++++++
 .../cli/scriptActions/PhasedScriptAction.ts   |  31 ++++-
 libraries/rush-lib/src/index.ts               |   1 +
 13 files changed, 319 insertions(+), 8 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/flag-reload_2026-09-24.json
 create mode 100644 common/changes/@rushstack/rush-daemon/flag-reload_2026-09-24.json
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceRequestScopedParameters.test.ts
 create mode 100644 libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts

diff --git a/common/changes/@microsoft/rush/flag-reload_2026-09-24.json b/common/changes/@microsoft/rush/flag-reload_2026-09-24.json
new file mode 100644
index 0000000000..705c6b3397
--- /dev/null
+++ b/common/changes/@microsoft/rush/flag-reload_2026-09-24.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Exclude `--verbose`, `--parallelism` and `--timeline` from the daemon engine parameter identity and expose them as per-request settings, so these flags no longer force the Rush daemon to reload its warm operation graph.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/flag-reload_2026-09-24.json b/common/changes/@rushstack/rush-daemon/flag-reload_2026-09-24.json
new file mode 100644
index 0000000000..4c774a0912
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/flag-reload_2026-09-24.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Apply `--verbose` and `--parallelism` to the warm graph per iteration instead of reloading the graph, and only coalesce requests that share these settings.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 99cc2ca6a5..d823a0545e 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -27,6 +27,7 @@ import type { IDaemonWarmSetStatus } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 import type { IInputsSnapshot } from '@microsoft/rush-lib';
 import { IOperationGraph } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
 import type { ITerminal } from '@rushstack/terminal';
 import type { LockFile } from '@rushstack/node-core-library';
 import { Operation } from '@microsoft/rush-lib';
@@ -399,6 +400,7 @@ export interface IResolvedDaemonPhasedRequest {
     readonly kind: 'phased';
     // (undocumented)
     readonly request: IDaemonPhasedRequest;
+    readonly requestSettings?: IPhasedCommandEngineRequestSettings;
 }
 
 // @beta
@@ -666,7 +668,7 @@ export type MapWorkspaceInvalidationsToOperationsAsync = (options: IMapWorkspace
 // @beta
 export class PhasedRequestRouter {
     constructor(workspaceSession: IWorkspaceSession);
-    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void): Promise<IDaemonPhasedRequestResult>;
+    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings): Promise<IDaemonPhasedRequestResult>;
 }
 
 // @beta
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 2157f656c6..c553ceacb8 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -953,6 +953,14 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
     readonly rushSession: RushSession;
 }
 
+// @alpha
+export interface IPhasedCommandEngineRequestSettings {
+    // (undocumented)
+    readonly parallelism: Parallelism;
+    // (undocumented)
+    readonly quietMode: boolean;
+}
+
 // @alpha
 export interface IPhasedCommandPlugin {
     apply(hooks: PhasedCommandHooks): void;
@@ -1512,6 +1520,7 @@ export class PhasedCommandEngine {
     readonly parameterIdentity: string;
     // (undocumented)
     static parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine>;
+    get requestSettings(): IPhasedCommandEngineRequestSettings;
     selectOperationsAsync(graph: IOperationGraph): Promise<ReadonlyMap<Operation, OperationEnabledState>>;
 }
 
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index 38f8d53e7f..e78e631731 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
 import type {
   IDaemonCommandResult,
   IDaemonEventEnvelope,
@@ -32,6 +33,8 @@ export interface IResolvedDaemonPhasedRequest {
   readonly request: IDaemonPhasedRequest;
   /** Native selection has already resolved all required project/phase dependencies. */
   readonly exactSelection?: boolean;
+  /** Verbosity and parallelism for this request; applied to the shared graph before its iteration. */
+  readonly requestSettings?: IPhasedCommandEngineRequestSettings;
 }
 
 /** A resolver outcome that uses the existing isolated global executor contract. @beta */
@@ -187,7 +190,8 @@ async function dispatchWorkspaceRequestAsync(
       resolved.request,
       createPhasedClient(client),
       resolved.exactSelection,
-      onExecutionStarting
+      onExecutionStarting,
+      resolved.requestSettings
     );
   }
   const globalRouter: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(workspaceSession);
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index e6a8416e45..f9cd596123 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -4,6 +4,7 @@
 import type {
   IOperationExecutionResult,
   IOperationGraph,
+  IPhasedCommandEngineRequestSettings,
   Operation,
   _IOperationGraphEventSink
 } from '@microsoft/rush-lib';
@@ -65,6 +66,9 @@ interface IPreparedPhasedRequest {
   readonly exclusivityClass: RequestExclusivityClass;
   readonly interactiveSession: IInteractiveRequestSession | undefined;
   readonly request: IDaemonPhasedRequest;
+  /** Only requests with the same settings share one graph iteration. */
+  readonly requestSettings: IPhasedCommandEngineRequestSettings | undefined;
+  readonly requestSettingsKey: string;
   readonly selection: IResolvedSelection;
   readonly warningsAllowedByEnvironment: boolean;
 }
@@ -116,7 +120,8 @@ export class PhasedRequestRouter {
     request: IDaemonPhasedRequest,
     client: IPhasedRequestClient,
     exactSelection: boolean = false,
-    onExecutionStarting?: () => void
+    onExecutionStarting?: () => void,
+    requestSettings?: IPhasedCommandEngineRequestSettings
   ): Promise<IDaemonPhasedRequestResult> {
     validateRequestIdentity(request);
     const interactiveSession: IInteractiveRequestSession | undefined = validateInteractiveSession(
@@ -194,6 +199,8 @@ export class PhasedRequestRouter {
               exclusivityClass,
               interactiveSession,
               request,
+              requestSettings,
+              requestSettingsKey: JSON.stringify(requestSettings ?? null),
               selection,
               warningsAllowedByEnvironment,
               onExecutionStarting
@@ -342,14 +349,19 @@ class PhasedRequestBatchCoordinator {
     }
     return (
       this.#acceptingCurrentBatch &&
-      this.#currentBatch?.[0]?.exclusivityClass === RequestExclusivityClass.SharedBuild
+      this.#currentBatch?.[0]?.exclusivityClass === RequestExclusivityClass.SharedBuild &&
+      this.#currentBatch[0].requestSettingsKey === request.requestSettingsKey
     );
   }
 
   #takeCompatiblePending(batch: IBatchEntry[]): void {
+    const { requestSettingsKey } = batch[0];
     for (let index: number = 0; index < this.#pending.length; ) {
       const entry: IBatchEntry = this.#pending[index];
-      if (entry.exclusivityClass === RequestExclusivityClass.SharedBuild) {
+      if (
+        entry.exclusivityClass === RequestExclusivityClass.SharedBuild &&
+        entry.requestSettingsKey === requestSettingsKey
+      ) {
         this.#pending.splice(index, 1);
         entry.executionStarted = true;
         batch.push(entry);
@@ -399,6 +411,7 @@ class PhasedRequestBatchCoordinator {
         return;
       }
 
+      applyRequestSettings(this.#graph, participants[0].requestSettings);
       applySelections(
         this.#graph,
         participants.map((entry: IBatchEntry) => entry.selection)
@@ -885,6 +898,17 @@ function collectSelectionClosure(
   return Array.from(activeOperations);
 }
 
+/** Presentation/scheduling settings are request-scoped, so they are applied per iteration, not per graph. */
+function applyRequestSettings(
+  graph: IOperationGraph,
+  settings: IPhasedCommandEngineRequestSettings | undefined
+): void {
+  if (settings) {
+    graph.quietMode = settings.quietMode;
+    graph.parallelism = settings.parallelism;
+  }
+}
+
 function applySelections(graph: IOperationGraph, selections: ReadonlyArray<IResolvedSelection>): void {
   const enabledClosureBySelection: ReadonlyArray<ReadonlySet<Operation>> = selections.map(
     (selection: IResolvedSelection) =>
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 4bc77ac193..6c503f46ee 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -38,7 +38,9 @@ import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
  * Binds the standalone host to a real native build/rebuild graph on its first request.
  *
  * @remarks
- * A host is pinned to its first command and non-selection parameters. Incompatible parameters,
+ * A host is pinned to its first command and graph-affecting, non-selection parameters. Presentation and
+ * scheduling parameters (`--verbose`, `--parallelism`, `--timeline`) are applied per request instead.
+ * Incompatible parameters,
  * environments, or graph inputs are rejected before scheduling; no request is retried automatically.
  * The initial supported surface excludes external plugins, .env initialization, install/watch,
  * event-hook scripts, and rushx/global commands. Use the unchanged native CLI for those surfaces.
@@ -118,6 +120,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     return {
       kind: 'phased',
       exactSelection: true,
+      requestSettings: command.requestSettings,
       request: {
         admission: envelope.admission,
         commandName: envelope.commandName,
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index affc97c12c..3d67e07eb5 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -10,6 +10,7 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import { RUSHD_OPERATION_HEADER, RUSHD_OPERATION_STREAM_CLOSED } from '@rushstack/rush-daemon-protocol';
 import { OperationStatus } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
 
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import {
@@ -140,6 +141,45 @@ function eventOperationId(event: IDaemonEventEnvelope): string | undefined {
 }
 
 describe('shared phased request batching', () => {
+  it('schedules separate iterations for overlapping requests with different request settings', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const graph: ITestRoutingFixture['graph'] = fixture.graph;
+    const scheduledSettings: IPhasedCommandEngineRequestSettings[] = [];
+    const originalScheduleAsync: typeof graph.scheduleIterationAsync =
+      graph.scheduleIterationAsync.bind(graph);
+    const scheduleSpy: jest.SpyInstance = jest
+      .spyOn(graph, 'scheduleIterationAsync')
+      .mockImplementation((...args: Parameters<typeof graph.scheduleIterationAsync>) => {
+        scheduledSettings.push({ parallelism: graph.parallelism, quietMode: graph.quietMode });
+        return originalScheduleAsync(...args);
+      });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const defaultSettings: IPhasedCommandEngineRequestSettings = { parallelism: 4, quietMode: true };
+    const verboseSerialSettings: IPhasedCommandEngineRequestSettings = { parallelism: 1, quietMode: false };
+
+    const [first, second] = await Promise.all([
+      router.executeAsync(
+        createRequest('default', OPERATION_A),
+        new TestPhasedRequestClient('one'),
+        false,
+        undefined,
+        defaultSettings
+      ),
+      router.executeAsync(
+        createRequest('verbose-serial', OPERATION_B),
+        new TestPhasedRequestClient('two'),
+        false,
+        undefined,
+        verboseSerialSettings
+      )
+    ]);
+
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(scheduledSettings).toEqual([defaultSettings, verboseSerialSettings]);
+    expect(first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(second).toMatchObject({ exitCode: 0, outcome: 'success' });
+  });
+
   it('merges overlapping selections into one real graph iteration and executes shared operations once', async () => {
     const fixture: ITestRoutingFixture = createFixture();
     const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestScopedParameters.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestScopedParameters.test.ts
new file mode 100644
index 0000000000..dddefa02d3
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestScopedParameters.test.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { WorkspaceInputChangeTier, type IOperationGraph } from '@microsoft/rush-lib';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(30_000);
+
+it('applies --verbose and --parallelism per request without reloading the warm graph', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => setDaemonPolicy(created, {}));
+  try {
+    const buildAsync = async (...extra: string[]): Promise<void> => {
+      const result = await fixture.runAsync(['build', '--to', 'b', ...extra]);
+      expect(result.terminal).toMatchObject({ payload: { exitCode: 0 } });
+    };
+    await buildAsync();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    const generation: number = fixture.host.workspaceGeneration;
+    const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+    const defaultParallelism: number = graph!.parallelism;
+    const expectWarm = (): void => {
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reuse);
+      expect(fixture.runs()).toEqual(['a', 'b']);
+    };
+
+    await buildAsync();
+    expectWarm();
+    await buildAsync('--verbose');
+    expectWarm();
+    expect(graph!.quietMode).toBe(false);
+    await buildAsync();
+    expectWarm();
+    expect(graph!.quietMode).toBe(true);
+    await buildAsync('-p', '1', '--timeline');
+    expectWarm();
+    expect(graph!.parallelism).toBe(1);
+    await buildAsync();
+    expectWarm();
+    expect(graph!.parallelism).toBe(defaultParallelism);
+
+    fixture.write('a/input.txt', 'two');
+    await buildAsync('--verbose', '-p', '1');
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.runs()).toEqual(['a', 'b', 'a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 0fefc3fddf..e5246fbfa1 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -12,6 +12,7 @@ import { PhasedScriptAction } from '../cli/scriptActions/PhasedScriptAction';
 import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from '../logic/incremental/InputsSnapshot';
 import type { IOperationGraph } from '../logic/operations/IOperationGraph';
 import type { Operation, OperationEnabledState } from '../logic/operations/Operation';
+import type { Parallelism } from '../logic/operations/ParseParallelism';
 import { PhasedCommandEngineExecution } from '../logic/operations/PhasedCommandEngineExecution';
 import type { RushSession } from '../pluginFramework/RushSession';
 import type { RushConfiguration } from './RushConfiguration';
@@ -44,6 +45,17 @@ export interface IParsePhasedCommandOptions {
   readonly terminalProvider: ITerminalProvider;
 }
 
+/**
+ * Presentation and scheduling settings of one parsed command. They do not affect the operation graph or any
+ * operation hash, so they are not part of `PhasedCommandEngine.parameterIdentity`; hosts apply them to the
+ * shared graph (`IOperationGraph.quietMode` / `IOperationGraph.parallelism`) before each iteration.
+ * @alpha
+ */
+export interface IPhasedCommandEngineRequestSettings {
+  readonly quietMode: boolean;
+  readonly parallelism: Parallelism;
+}
+
 /**
  * A parsed native build/rebuild command. Parsing never runs scripts or changes cwd/process.env.
  *
@@ -164,4 +176,9 @@ export class PhasedCommandEngine {
   ): Promise<ReadonlyMap<Operation, OperationEnabledState>> {
     return await this._action.selectEngineOperationsAsync(graph);
   }
+
+  /** Presentation and scheduling settings requested by this command; not part of `parameterIdentity`. */
+  public get requestSettings(): IPhasedCommandEngineRequestSettings {
+    return this._action.getEngineRequestSettings();
+  }
 }
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
new file mode 100644
index 0000000000..6aebbe7d35
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
@@ -0,0 +1,110 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import { PhasedCommandEngine } from '../PhasedCommandEngine';
+import { RushConfiguration } from '../RushConfiguration';
+import { Rush } from '../Rush';
+import { parseParallelism } from '../../logic/operations/ParseParallelism';
+
+describe(`${PhasedCommandEngine.name} parameter identity`, () => {
+  let folder: string;
+  let rushConfiguration: RushConfiguration;
+
+  function write(name: string, value: unknown): void {
+    const filename: string = path.join(folder, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, JSON.stringify(value));
+  }
+
+  async function parseAsync(...argv: string[]): Promise<PhasedCommandEngine> {
+    return await PhasedCommandEngine.parseAsync({
+      argv,
+      cwd: folder,
+      rushConfiguration,
+      terminalProvider: new NoOpTerminalProvider()
+    });
+  }
+
+  beforeAll(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-identity-')));
+    write('rush.json', {
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: [{ packageName: 'a', projectFolder: 'a' }]
+    });
+    write('a/package.json', { name: 'a', version: '1.0.0', scripts: { '_phase:compile': 'node -v' } });
+    write('common/config/rush/command-line.json', {
+      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          summary: 'Build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        }
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'A graph-affecting custom parameter',
+          associatedCommands: ['build'],
+          associatedPhases: ['_phase:compile']
+        }
+      ]
+    });
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+  });
+
+  afterAll(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('excludes presentation and scheduling parameters from the identity', async () => {
+    const baseline: string = (await parseAsync('build')).parameterIdentity;
+    for (const argv of [
+      ['build', '--verbose'],
+      ['build', '-v'],
+      ['build', '--parallelism', '2'],
+      ['build', '-p', 'max'],
+      ['build', '--timeline'],
+      ['build', '--to', 'a'],
+      ['build', '--verbose', '-p', '1', '--timeline', '--only', 'a']
+    ]) {
+      expect((await parseAsync(...argv)).parameterIdentity).toBe(baseline);
+    }
+  });
+
+  it('includes graph-affecting parameters and the command name in the identity', async () => {
+    const baseline: string = (await parseAsync('build')).parameterIdentity;
+    expect((await parseAsync('build', '--production')).parameterIdentity).not.toBe(baseline);
+    expect((await parseAsync('build', '--production', '--verbose')).parameterIdentity).toBe(
+      (await parseAsync('build', '--production')).parameterIdentity
+    );
+    expect((await parseAsync('rebuild')).parameterIdentity).not.toBe(baseline);
+  });
+
+  it('reports the excluded settings per request', async () => {
+    expect((await parseAsync('build')).requestSettings).toEqual({
+      quietMode: true,
+      parallelism: parseParallelism(undefined)
+    });
+    expect((await parseAsync('build', '--verbose', '-p', '2')).requestSettings).toEqual({
+      quietMode: false,
+      parallelism: 2
+    });
+    expect((await parseAsync('build', '-p', '50%')).requestSettings).toEqual({
+      quietMode: true,
+      parallelism: { scalar: 0.5 }
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 2818bca1f7..89a0dbd3f7 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -32,7 +32,10 @@ import type {
   IOperationGraph,
   IOperationGraphIterationOptions
 } from '../../logic/operations/IOperationGraph';
-import type { IPhasedCommandEngine } from '../../api/PhasedCommandEngine';
+import type {
+  IPhasedCommandEngine,
+  IPhasedCommandEngineRequestSettings
+} from '../../api/PhasedCommandEngine';
 import { PhasedCommandEngineConfigurationChangedError } from '../../api/PhasedCommandEngineConfigurationChangedError';
 import { getDaemonIpcImplementationIdentityAsync } from '../../logic/operations/DaemonIpcConfiguration';
 import { SetupChecks } from '../../logic/SetupChecks';
@@ -82,6 +85,17 @@ import { _isRushSessionOperationStreamEnabled } from '../../pluginFramework/Rush
 
 const PERF_PREFIX: 'rush:phasedScriptAction' = 'rush:phasedScriptAction';
 
+/**
+ * Parameters that change neither the operation graph nor any operation hash. A long-lived engine applies
+ * them per request (see `getEngineRequestSettings`), so they are excluded from the engine parameter identity.
+ * `--timeline` only adds a presentation plugin whose output is discarded by engine hosts.
+ */
+const ENGINE_REQUEST_SCOPED_PARAMETER_NAMES: ReadonlySet<string> = new Set([
+  '--verbose',
+  '--parallelism',
+  '--timeline'
+]);
+
 /**
  * The set of overall execution statuses that mean the command did what was asked of it and should
  * exit with code 0.
@@ -370,10 +384,23 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     return JSON.stringify([
       this.actionName,
       this.parser.getParameterStringMap(),
-      Object.entries(this.getParameterStringMap()).filter(([name]) => !selectionNames.has(name))
+      Object.entries(this.getParameterStringMap()).filter(
+        ([name]) => !selectionNames.has(name) && !ENGINE_REQUEST_SCOPED_PARAMETER_NAMES.has(name)
+      )
     ]);
   }
 
+  /**
+   * Output verbosity and scheduling settings for one engine request. These are excluded from
+   * `getEngineParameterIdentity` and must be applied to the shared graph before each iteration.
+   */
+  public getEngineRequestSettings(): IPhasedCommandEngineRequestSettings {
+    return {
+      quietMode: !this.#verboseParameter.value,
+      parallelism: this.#enableParallelism ? parseParallelism(this.#parallelismParameter?.value) : 1
+    };
+  }
+
   public async selectEngineOperationsAsync(
     graph: IOperationGraph
   ): Promise<ReadonlyMap<Operation, OperationEnabledState>> {
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index ebd267247c..8af91cfeca 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -177,6 +177,7 @@ export { OperationStatus } from './logic/operations/OperationStatus';
 export {
   PhasedCommandEngine,
   type IPhasedCommandEngine,
+  type IPhasedCommandEngineRequestSettings,
   type IParsePhasedCommandOptions
 } from './api/PhasedCommandEngine';
 export { PhasedCommandEngineConfigurationChangedError } from './api/PhasedCommandEngineConfigurationChangedError';

From 570fe51e31e82dd75bc202938da95e4bb4239bce Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:16:55 -0700
Subject: [PATCH 006/265] [rush-daemon] Surface warm snapshot and daemon
 shutdown errors to the right client (#6070)

* [rush-daemon] Surface warm snapshot and daemon shutdown errors to the right client

Fixes #6059

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Update API reports

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Report the shutdown reason for requests aborted before engine initialization

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Move request-scoped reconcile diagnostics into EngineTerminalProvider

Keeps the ProductionDaemonRequestResolver change to a one-line call so it composes with other open daemon PRs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Address review: shutdown reason for queued and raw-mode requests, protocol minor 11

- Report the shutdown reason for requests aborted while waiting for admission, and prefer it on the client.
- Keep the shutdown reason when restoring raw mode fails with it.
- Begin shutdown before awaiting the acknowledgement write so the reported count matches the aborted set.
- Advertise protocol minor 11 for the shutdownAck activeRequests field.
- Keep the daemon stop note accurate for every request kind.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Report the shutdown reason from global and graph request aborts

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Format with prettier and update the protocol API report

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Update the protocol change file for minor 11

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-cli-client] Expect the cancelled request count from daemon stop --force

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 apps/rush-cli-client/src/daemonCommands.ts    | 16 +++-
 apps/rush-cli-client/src/launchClient.ts      |  6 +-
 apps/rush-cli-client/src/resultDiagnostics.ts | 25 +++++++
 .../src/test/launchClient.test.ts             |  1 +
 .../src/test/resultDiagnostics.test.ts        | 36 +++++++++
 ...ushd-error-surfacing_2026-09-24-01-50.json | 11 +++
 ...ushd-error-surfacing_2026-09-24-01-50.json | 11 +++
 ...ushd-error-surfacing_2026-09-24-01-50.json | 11 +++
 ...ushd-error-surfacing_2026-09-24-01-50.json | 11 +++
 common/reviews/api/rush-client-core.api.md    |  3 +-
 .../reviews/api/rush-daemon-protocol.api.md   |  7 +-
 common/reviews/api/rush-daemon.api.md         | 21 +++++-
 .../rush-client-core/src/DaemonClient.ts      | 10 ++-
 .../src/test/DaemonClient.test.ts             |  7 +-
 .../src/ControlMessageValidation.ts           |  3 +-
 .../src/DaemonLifecycleControl.ts             |  8 +-
 .../src/DaemonProtocolVersion.ts              |  5 +-
 .../src/ShutdownAckValidation.ts              | 17 +++++
 libraries/rush-daemon-protocol/src/index.ts   |  1 +
 .../src/test/LifecycleControl.test.ts         | 10 +++
 .../rush-daemon/src/DaemonControlSession.ts   | 24 ++++--
 .../src/DaemonGraphRequestRouter.ts           |  8 +-
 .../rush-daemon/src/DaemonShutdownError.ts    | 73 +++++++++++++++++++
 .../rush-daemon/src/EngineTerminalProvider.ts | 46 +++++++++++-
 .../src/GlobalCommandRequestRouter.ts         | 14 +++-
 .../rush-daemon/src/PhasedRequestRouter.ts    | 16 +++-
 .../src/ProductionDaemonRequestResolver.ts    |  8 +-
 libraries/rush-daemon/src/RushDaemonHost.ts   | 30 +++++---
 .../src/WorkspaceRequestLifecycle.ts          |  6 +-
 libraries/rush-daemon/src/index.ts            |  5 ++
 libraries/rush-daemon/src/serveRushDaemon.ts  | 13 +++-
 .../src/test/DaemonRequestWireGlobal.test.ts  | 46 ++++++++++++
 .../src/test/DaemonShutdown.test.ts           |  2 +-
 .../src/test/EngineTerminalProvider.test.ts   | 57 +++++++++++++++
 .../src/test/PhasedRequestInteractive.test.ts | 30 ++++++++
 .../ProductionDaemonRequestResolver.test.ts   | 64 ++++++++++++++++
 36 files changed, 620 insertions(+), 42 deletions(-)
 create mode 100644 apps/rush-cli-client/src/resultDiagnostics.ts
 create mode 100644 apps/rush-cli-client/src/test/resultDiagnostics.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/fix-rushd-error-surfacing_2026-09-24-01-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/fix-rushd-error-surfacing_2026-09-24-01-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/fix-rushd-error-surfacing_2026-09-24-01-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/fix-rushd-error-surfacing_2026-09-24-01-50.json
 create mode 100644 libraries/rush-daemon-protocol/src/ShutdownAckValidation.ts
 create mode 100644 libraries/rush-daemon/src/DaemonShutdownError.ts
 create mode 100644 libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts

diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index b6ad07750d..fd19088343 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -119,7 +119,17 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
   try {
     if (command === 'stop') {
-      await client.shutdownAsync();
+      const { activeRequests } = await client.shutdownAsync();
+      if (activeRequests) {
+        await writeStreamAsync(
+          process.stderr,
+          Buffer.from(
+            `rush-client: the daemon was running ${activeRequests} request(s); they were cancelled.\n`
+          )
+        );
+      }
+      const cancelled: { cancelledRequests?: number } =
+        activeRequests === undefined ? {} : { cancelledRequests: activeRequests };
       if (options.argv[1] === '--force') {
         // Wait for the acknowledged daemon to release its listener and record, then clear leftovers
         // such as an abandoned startup reservation in the same invocation.
@@ -129,13 +139,15 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
         await writeStatusAsync({
           state: 'shutdownAccepted',
           socketPath: connectionOptions.paths.socketPath,
+          ...cancelled,
           removedPaths
         });
         return;
       }
       await writeStatusAsync({
         state: 'shutdownAccepted',
-        socketPath: connectionOptions.paths.socketPath
+        socketPath: connectionOptions.paths.socketPath,
+        ...cancelled
       });
       return;
     }
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index af3cadb9c1..102c9b732b 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -27,6 +27,7 @@ import { formatAdmissionFailure, getConfiguredAdmission } from './ClientAdmissio
 import { ClientOperationRenderer } from './ClientOperationRenderer';
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { selectClientRoute, type IClientRoute } from './routing';
+import { getResultDiagnostic } from './resultDiagnostics';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
   getBundledRushVersion,
@@ -206,7 +207,10 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
   }
   if (outcome.kind === 'result') {
     process.exitCode = outcome.result.exitCode;
-    if (outcome.result.admissionErrorCode) {
+    const diagnostic: string | undefined = getResultDiagnostic(outcome.result);
+    if (diagnostic) {
+      await writeStreamAsync(process.stderr, Buffer.from(diagnostic));
+    } else if (outcome.result.admissionErrorCode) {
       await writeStreamAsync(
         process.stderr,
         Buffer.from(formatAdmissionFailure(outcome.result.admissionErrorCode, request.admission))
diff --git a/apps/rush-cli-client/src/resultDiagnostics.ts b/apps/rush-cli-client/src/resultDiagnostics.ts
new file mode 100644
index 0000000000..e65be24364
--- /dev/null
+++ b/apps/rush-cli-client/src/resultDiagnostics.ts
@@ -0,0 +1,25 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+
+/**
+ * Returns the stderr line that explains a failed daemon result, if any.
+ *
+ * @remarks
+ * A non-zero result's error message (for example, a daemon shutdown that aborted the request) is the only
+ * place the daemon reports failures that are not attributed to an operation, so it must not be dropped.
+ * Returns `undefined` for `no-wait` and `wait-timeout` admission failures, which `formatAdmissionFailure`
+ * explains.
+ */
+export function getResultDiagnostic(
+  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>
+): string | undefined {
+  // A request aborted while waiting for admission carries the reason (such as a daemon shutdown) in its
+  // error message; other admission failures are explained by `formatAdmissionFailure`.
+  if (result.admissionErrorCode !== undefined && result.admissionErrorCode !== 'aborted') return undefined;
+  if (result.exitCode !== 0 && result.errorMessage) {
+    return `rush-client: ${result.errorMessage}\n`;
+  }
+  return undefined;
+}
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index b3ec694fca..d454c99c4e 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -288,6 +288,7 @@ describe('standalone rushx fallback', () => {
       expect(JSON.parse(result.stdout)).toEqual({
         state: 'shutdownAccepted',
         socketPath: paths.socketPath,
+        cancelledRequests: 0,
         removedPaths: [reservation]
       });
       expect(fs.existsSync(reservation)).toBe(false);
diff --git a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
new file mode 100644
index 0000000000..46c0ad5814
--- /dev/null
+++ b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getResultDiagnostic } from '../resultDiagnostics';
+
+describe(getResultDiagnostic.name, () => {
+  it('prints the error message of a failed result', () => {
+    expect(
+      getResultDiagnostic({
+        exitCode: 1,
+        errorMessage: 'The Rush daemon was shut down (idle timeout) while this request was running.'
+      })
+    ).toBe('rush-client: The Rush daemon was shut down (idle timeout) while this request was running.\n');
+  });
+
+  it('prefers the reason of a request aborted while waiting for admission', () => {
+    expect(
+      getResultDiagnostic({ exitCode: 1, admissionErrorCode: 'aborted', errorMessage: 'daemon shut down' })
+    ).toBe('rush-client: daemon shut down\n');
+  });
+
+  it('leaves no-wait and wait-timeout admission failures to the admission formatter', () => {
+    expect(
+      getResultDiagnostic({ exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: 'x' })
+    ).toBeUndefined();
+    expect(
+      getResultDiagnostic({ exitCode: 1, admissionErrorCode: 'no-wait', errorMessage: 'x' })
+    ).toBeUndefined();
+    expect(getResultDiagnostic({ exitCode: 1, admissionErrorCode: 'aborted' })).toBeUndefined();
+  });
+
+  it('stays silent for successful results and failures without a message', () => {
+    expect(getResultDiagnostic({ exitCode: 0, errorMessage: 'ignored' })).toBeUndefined();
+    expect(getResultDiagnostic({ exitCode: 1 })).toBeUndefined();
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/fix-rushd-error-surfacing_2026-09-24-01-50.json b/common/changes/@rushstack/rush-cli-client/fix-rushd-error-surfacing_2026-09-24-01-50.json
new file mode 100644
index 0000000000..925deeffab
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/fix-rushd-error-surfacing_2026-09-24-01-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Print the error message of a failed daemon result (for example, a daemon shutdown that cancelled the build), and report cancelled requests from \"rush-client daemon stop\".",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/fix-rushd-error-surfacing_2026-09-24-01-50.json b/common/changes/@rushstack/rush-client-core/fix-rushd-error-surfacing_2026-09-24-01-50.json
new file mode 100644
index 0000000000..fad92bb8f4
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/fix-rushd-error-surfacing_2026-09-24-01-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Return the daemon shutdown acknowledgement, including its optional active request count, from DaemonClient.shutdownAsync().",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/fix-rushd-error-surfacing_2026-09-24-01-50.json b/common/changes/@rushstack/rush-daemon-protocol/fix-rushd-error-surfacing_2026-09-24-01-50.json
new file mode 100644
index 0000000000..5aebbe2a85
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/fix-rushd-error-surfacing_2026-09-24-01-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional \"activeRequests\" count to the shutdownAck control message; advertised as protocol minor 11 (`DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR`); older peers omit or ignore it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/fix-rushd-error-surfacing_2026-09-24-01-50.json b/common/changes/@rushstack/rush-daemon/fix-rushd-error-surfacing_2026-09-24-01-50.json
new file mode 100644
index 0000000000..6af207cd00
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/fix-rushd-error-surfacing_2026-09-24-01-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Report warm input-snapshot failures (with the engine diagnostics) to the failing request instead of replaying them into the next request, abort requests interrupted by a daemon shutdown with a typed DaemonShutdownError that names its initiator, and report running requests in the shutdown acknowledgement.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index ed0f2f1813..465a2ce471 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -13,6 +13,7 @@ import { IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
 import { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 import { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonRequestRejectedMessage } from '@rushstack/rush-daemon-protocol';
+import { IDaemonShutdownAckMessage } from '@rushstack/rush-daemon-protocol';
 import type { Readable } from 'node:stream';
 
 // @beta
@@ -29,7 +30,7 @@ export class DaemonClient {
     static connectAsync(options: IDaemonClientConnectOptions): Promise<DaemonClient>;
     executeAsync(options: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
     get protocolVersion(): IDaemonProtocolVersion;
-    shutdownAsync(timeoutMs?: number): Promise<void>;
+    shutdownAsync(timeoutMs?: number): Promise<IDaemonShutdownAckMessage['payload']>;
     get status(): Promise<IDaemonPongMessage['payload']>;
 }
 
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 8ca51ef110..0584bcb366 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -79,6 +79,9 @@ export const DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR: number;
 // @beta
 export const DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR: number;
 
+// @beta
+export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number;
+
 // @beta
 export const DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR: number;
 
@@ -592,7 +595,9 @@ export interface IDaemonShutdownAckMessage {
     // (undocumented)
     readonly kind: 'shutdownAck';
     // (undocumented)
-    readonly payload: Record<string, never>;
+    readonly payload: {
+        readonly activeRequests?: number;
+    };
 }
 
 // @beta
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index d823a0545e..dfb68a7841 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -67,6 +67,18 @@ export class DaemonRequiresInProcessError extends Error {
     readonly policy: IDaemonTerminalPolicyResult;
 }
 
+// @beta
+export class DaemonShutdownError extends Error {
+    constructor(options: IDaemonShutdownErrorOptions);
+    // (undocumented)
+    readonly initiator: DaemonShutdownInitiator;
+    // (undocumented)
+    readonly signal: string | undefined;
+}
+
+// @beta
+export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
+
 // @beta
 export type DispatchWorkspaceRequestAsync = (options: IDispatchWorkspaceRequestOptions) => Promise<IDaemonCommandResult | undefined>;
 
@@ -178,6 +190,13 @@ export interface IDaemonRequestResolver {
     readonly workspaceLifecycle?: IWorkspaceResolverLifecycle;
 }
 
+// @beta
+export interface IDaemonShutdownErrorOptions {
+    // (undocumented)
+    readonly initiator: DaemonShutdownInitiator;
+    readonly signal?: string;
+}
+
 // @beta
 export interface IDispatchWorkspaceRequestOptions {
     // (undocumented)
@@ -725,7 +744,7 @@ export type ResolvedDaemonRequest = IResolvedDaemonPhasedRequest | IResolvedDaem
 
 // @beta
 export class RushDaemonHost {
-    closeAsync(): Promise<void>;
+    closeAsync(reason?: DaemonShutdownError): Promise<void>;
     readonly closed: Promise<void>;
     getWorkspaceSessionAsync(): Promise<IWorkspaceSession>;
     // (undocumented)
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 911021c50c..9cdc0e5b21 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -25,7 +25,8 @@ import {
   type IDaemonPongMessage,
   type IDaemonProtocolVersion,
   type IDaemonRequestEnvelope,
-  type IDaemonRequestRejectedMessage
+  type IDaemonRequestRejectedMessage,
+  type IDaemonShutdownAckMessage
 } from '@rushstack/rush-daemon-protocol';
 import { connectDaemonAsync, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
@@ -106,6 +107,7 @@ export class DaemonClient {
   #result: IDeferred<DaemonClientOutcome> | undefined;
   #shutdown: IDeferred<void> | undefined;
   #shutdownAcknowledged: boolean = false;
+  #shutdownAck: IDaemonShutdownAckMessage['payload'] = {};
   #execution: IDaemonClientExecuteOptions | undefined;
   #finished: boolean = false;
   #inputStarted: boolean = false;
@@ -190,8 +192,10 @@ export class DaemonClient {
    * Requests shutdown on a fresh connection and waits for acknowledgement followed by EOF.
    * @remarks This confirms acceptance and connection closure, not successful workspace cleanup.
    * Requires protocol 0.6. The timeout defaults to 15000 milliseconds.
+   * @returns The acknowledgement, including the number of running requests the shutdown aborts when the
+   * daemon reports it.
    */
-  public async shutdownAsync(timeoutMs: number = 15000): Promise<void> {
+  public async shutdownAsync(timeoutMs: number = 15000): Promise<IDaemonShutdownAckMessage['payload']> {
     if (this.#used) throw new Error('Create a fresh DaemonClient for shutdown.');
     this.#used = true;
     let timer: ReturnType<typeof setTimeout> | undefined;
@@ -210,6 +214,7 @@ export class DaemonClient {
         );
       }, timeoutMs);
       await Promise.all([this.#shutdown.promise, this.#sendControlAsync({ kind: 'shutdown', payload: {} })]);
+      return this.#shutdownAck;
     } finally {
       clearTimeout(timer);
       await this.closeAsync();
@@ -379,6 +384,7 @@ export class DaemonClient {
         throw new DaemonProtocolError('malformedControlMessage', 'Unexpected shutdown acknowledgement.');
       }
       this.#shutdownAcknowledged = true;
+      this.#shutdownAck = message.payload;
       return;
     }
     const execution: IDaemonClientExecuteOptions = this.#requireExecution();
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index d5aaf43094..9a2ccc6af8 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -521,21 +521,22 @@ describe('DaemonClient', () => {
     });
     onRequest = async (message) => {
       if (message.kind === 'shutdown') {
-        await sendAsync({ kind: 'shutdownAck', payload: {} });
+        await sendAsync({ kind: 'shutdownAck', payload: { activeRequests: 2 } });
         acknowledged();
       }
     };
     const client = await DaemonClient.connectAsync({ socketPath: address });
     expect(client.protocolVersion.minor).toBeGreaterThanOrEqual(6);
     let completed: boolean = false;
-    const shutdown: Promise<void> = client.shutdownAsync().then(() => {
+    const shutdown: Promise<unknown> = client.shutdownAsync().then((payload) => {
       completed = true;
+      return payload;
     });
     await ack;
     await new Promise((resolve) => setTimeout(resolve, 20));
     expect(completed).toBe(false);
     await connection!.closeAsync();
-    await shutdown;
+    await expect(shutdown).resolves.toEqual({ activeRequests: 2 });
     expect(completed).toBe(true);
     expect(controls.filter((message) => message.kind === 'shutdown')).toHaveLength(1);
   });
diff --git a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
index 8022db1d85..2be3cf95f9 100644
--- a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
+++ b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
@@ -13,6 +13,7 @@ import {
   validateRequestResultControl,
   validateRequestStartControl
 } from './RequestControlValidation';
+import { validateShutdownAck } from './ShutdownAckValidation';
 import { validateSubscribeControl } from './SubscribeControlValidation';
 function fail(reason: string): never {
   throw new DaemonProtocolError('malformedControlMessage', reason);
@@ -67,7 +68,7 @@ const VALIDATORS_BY_KIND: Record<string, ControlValidator> = {
   requestRejected: validateRequestRejectedControl,
   requestResult: validateRequestResultControl,
   shutdown: noopValidator,
-  shutdownAck: noopValidator,
+  shutdownAck: validateShutdownAck,
   stdinReady: validateRequestCancelControl,
   stdinEnd: validateRequestCancelControl
 };
diff --git a/libraries/rush-daemon-protocol/src/DaemonLifecycleControl.ts b/libraries/rush-daemon-protocol/src/DaemonLifecycleControl.ts
index 31921111a2..a7c084ed11 100644
--- a/libraries/rush-daemon-protocol/src/DaemonLifecycleControl.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonLifecycleControl.ts
@@ -10,5 +10,11 @@ export interface IDaemonShutdownMessage {
 /** Acknowledges shutdown before the host closes connections and releases its endpoint. @beta */
 export interface IDaemonShutdownAckMessage {
   readonly kind: 'shutdownAck';
-  readonly payload: Record<string, never>;
+  readonly payload: {
+    /**
+     * Requests that were still running and will be aborted by this shutdown. Daemons older than
+     * `DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR` omit it.
+     */
+    readonly activeRequests?: number;
+  };
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
index a687dae853..b35d1d6883 100644
--- a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
@@ -25,6 +25,9 @@ export const DAEMON_INVOCATION_KIND_PROTOCOL_MINOR: number = 8;
 /** The first minor supporting native mutations and guaranteed pre-execution restart outcomes. @beta */
 export const DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR: number = 10;
 
+/** The first additive protocol minor whose shutdown acknowledgement reports the active request count. @beta */
+export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number = 11;
+
 /**
  * A rushd wire protocol version.
  *
@@ -58,7 +61,7 @@ export interface IDaemonProtocolVersion {
  */
 export const DAEMON_PROTOCOL_VERSION: IDaemonProtocolVersion = {
   major: 0,
-  minor: DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR
+  minor: DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR
 };
 
 /**
diff --git a/libraries/rush-daemon-protocol/src/ShutdownAckValidation.ts b/libraries/rush-daemon-protocol/src/ShutdownAckValidation.ts
new file mode 100644
index 0000000000..5bd6c80cbc
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/ShutdownAckValidation.ts
@@ -0,0 +1,17 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const ZERO: number = 0;
+
+/** Validates the optional active request count of a shutdown acknowledgement. @internal */
+export function validateShutdownAck(payload: Record<string, unknown>): void {
+  const value: unknown = payload.activeRequests;
+  if (value === undefined || isNonnegativeInteger(value)) return;
+  throw new DaemonProtocolError('malformedControlMessage', 'Invalid shutdownAck field "activeRequests".');
+}
+
+function isNonnegativeInteger(value: unknown): boolean {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= ZERO;
+}
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index b170c7e899..1537163377 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -29,6 +29,7 @@ export { DAEMON_INVOCATION_KIND_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR, DAEMON_PROTOCOL_VERSION } from './DaemonProtocolVersion';
+export { DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { isDaemonProtocolCompatible } from './DaemonProtocolVersion';
 export type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
diff --git a/libraries/rush-daemon-protocol/src/test/LifecycleControl.test.ts b/libraries/rush-daemon-protocol/src/test/LifecycleControl.test.ts
index 00c5363e2d..b6487b245a 100644
--- a/libraries/rush-daemon-protocol/src/test/LifecycleControl.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/LifecycleControl.test.ts
@@ -14,6 +14,8 @@ const FRACTION: number = 1.5;
 const MESSAGES: readonly DaemonControlMessage[] = [
   { kind: 'shutdown', payload: {} },
   { kind: 'shutdownAck', payload: {} },
+  { kind: 'shutdownAck', payload: { activeRequests: ZERO } },
+  { kind: 'shutdownAck', payload: { activeRequests: PID } },
   { kind: 'pong', payload: { pid: PID, residentMemoryBytes: MEMORY_BYTES, uptimeMs: UPTIME_MS } }
 ];
 
@@ -21,6 +23,14 @@ it.each(MESSAGES)('round-trips lifecycle message $kind', (message: DaemonControl
   expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
 });
 
+it.each([NEGATIVE, FRACTION, '1'])(
+  'rejects an invalid shutdown active request count %s',
+  (value: unknown) => {
+    const json: string = JSON.stringify({ kind: 'shutdownAck', payload: { activeRequests: value } });
+    expect(() => decodeDaemonControlMessage(new TextEncoder().encode(json))).toThrow('activeRequests');
+  }
+);
+
 it.each([ZERO, NEGATIVE, FRACTION, '42'])('rejects an invalid daemon PID %s', (pid: unknown) => {
   const json: string = JSON.stringify({ kind: 'pong', payload: { pid, uptimeMs: UPTIME_MS } });
   expect(() => decodeDaemonControlMessage(new TextEncoder().encode(json))).toThrow('pid');
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 5189f6ffec..51f9bff38a 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -32,6 +32,7 @@ import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection
 import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
 import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
 import type { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
+import type { DaemonShutdownError } from './DaemonShutdownError';
 import { DaemonWireRequestClient } from './DaemonWireRequestClient';
 import {
   InteractiveInputRoutingError,
@@ -49,6 +50,8 @@ export interface IDaemonControlSessionOptions {
   readonly onError: (error: Error) => void;
   readonly onRequestStarted?: () => () => void;
   readonly onShutdownRequested: () => void;
+  /** Counts requests running on every connection, reported in the shutdown acknowledgement. */
+  readonly getActiveRequestCount?: () => number;
   readonly getWorkspaceStatus?: () => IDaemonWorkspaceStatus;
 }
 
@@ -103,11 +106,15 @@ export class DaemonControlSession {
     options.onInteractiveConnection?.(this.#interactiveConnection);
   }
 
-  public closeAsync(drainRequests: boolean = false): Promise<void> {
-    this.#closePromise ??= this.#closeOnceAsync(drainRequests);
+  public closeAsync(drainRequests: boolean = false, reason?: DaemonShutdownError): Promise<void> {
+    this.#closePromise ??= this.#closeOnceAsync(drainRequests, reason);
     return this.#closePromise;
   }
 
+  public get activeRequestCount(): number {
+    return this.#requestById.size;
+  }
+
   async #handleFrameSafelyAsync(frame: IDaemonFrame): Promise<void> {
     try {
       await this.#onFrameAsync(frame);
@@ -240,8 +247,15 @@ export class DaemonControlSession {
         'Daemon shutdown requires a lifecycle-capable protocol version.'
       );
     }
-    await this.#enqueueControlAsync({ kind: 'shutdownAck', payload: {} });
+    const activeRequests: number | undefined = this.#options.getActiveRequestCount?.();
+    // Queue the acknowledgement, then begin shutdown synchronously so the reported count is the set that
+    // shutdown aborts; closing drains the send queue, so the acknowledgement is still delivered first.
+    const ackPromise: Promise<void> = this.#enqueueControlAsync({
+      kind: 'shutdownAck',
+      payload: activeRequests === undefined ? {} : { activeRequests }
+    });
     this.#options.onShutdownRequested();
+    await ackPromise;
   }
 
   #startRequest(envelope: IDaemonRequestEnvelope): void {
@@ -443,8 +457,8 @@ export class DaemonControlSession {
     }
   }
 
-  async #closeOnceAsync(drainRequests: boolean = false): Promise<void> {
-    const closeReason: Error = new Error('The daemon control session is closing.');
+  async #closeOnceAsync(drainRequests: boolean = false, reason?: DaemonShutdownError): Promise<void> {
+    const closeReason: Error = reason ?? new Error('The daemon control session is closing.');
     if (drainRequests) {
       const pending: Promise<PromiseSettledResult<void>[]> = Promise.allSettled(
         Array.from(this.#requestById.values(), (state: IRequestState) => state.completion)
diff --git a/libraries/rush-daemon/src/DaemonGraphRequestRouter.ts b/libraries/rush-daemon/src/DaemonGraphRequestRouter.ts
index 567ac94026..10b8f818f3 100644
--- a/libraries/rush-daemon/src/DaemonGraphRequestRouter.ts
+++ b/libraries/rush-daemon/src/DaemonGraphRequestRouter.ts
@@ -37,6 +37,7 @@ import {
 import type { IWorkspaceSession } from './WorkspaceSession';
 import { setPauseNextIteration } from './PhasedRequestRouter';
 import { getWorkspaceGenerationToken } from './WorkspaceGeneration';
+import { type DaemonShutdownError, getDaemonShutdownReason } from './DaemonShutdownError';
 
 const DAEMON_PACKAGE_VERSION: string = PackageJsonLookup.loadOwnPackageJson(__dirname).version;
 
@@ -86,7 +87,12 @@ export class DaemonGraphRequestRouter {
         admissionErrorCode: getRequestAdmissionErrorCode(error)
       };
     }
-    await client.writeResultAsync(result);
+    const shutdownReason: DaemonShutdownError | undefined = result.aborted
+      ? getDaemonShutdownReason(client.abortSignal)
+      : undefined;
+    await client.writeResultAsync(
+      shutdownReason ? { ...result, errorMessage: shutdownReason.message } : result
+    );
   }
 
   private async _mutateAsync(
diff --git a/libraries/rush-daemon/src/DaemonShutdownError.ts b/libraries/rush-daemon/src/DaemonShutdownError.ts
new file mode 100644
index 0000000000..f50a30252f
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownError.ts
@@ -0,0 +1,73 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * What initiated a daemon shutdown.
+ *
+ * @beta
+ */
+export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
+
+/**
+ * Options for {@link DaemonShutdownError}.
+ *
+ * @beta
+ */
+export interface IDaemonShutdownErrorOptions {
+  readonly initiator: DaemonShutdownInitiator;
+  /** The process signal name, when the initiator is `signal`. */
+  readonly signal?: string;
+}
+
+/**
+ * The typed reason used to abort requests that were still running when the daemon shut down.
+ *
+ * @remarks
+ * Its message is delivered to the affected clients as the request's error message.
+ *
+ * @beta
+ */
+export class DaemonShutdownError extends Error {
+  public readonly initiator: DaemonShutdownInitiator;
+  public readonly signal: string | undefined;
+
+  public constructor(options: IDaemonShutdownErrorOptions) {
+    super(
+      `The Rush daemon was shut down (${describeInitiator(options)}) while this request was running; ` +
+        're-run the command.'
+    );
+    this.name = 'DaemonShutdownError';
+    this.initiator = options.initiator;
+    this.signal = options.signal;
+  }
+}
+
+function describeInitiator(options: IDaemonShutdownErrorOptions): string {
+  switch (options.initiator) {
+    case 'controlClient':
+      return 'requested by "rush-client daemon stop" or "daemon restart"';
+    case 'signal':
+      return `the daemon process received ${options.signal ?? 'a termination signal'}`;
+    case 'idleTimeout':
+      return 'idle timeout';
+    case 'restart':
+      return 'the daemon restarted to apply workspace changes';
+    case 'host':
+      return 'the daemon host was closed';
+  }
+}
+
+/** Returns the shutdown reason if the signal was aborted because the daemon shut down. */
+export function getDaemonShutdownReason(signal: AbortSignal): DaemonShutdownError | undefined {
+  return signal.aborted && signal.reason instanceof DaemonShutdownError ? signal.reason : undefined;
+}
+
+/**
+ * Returns the cleanup error unless it repeats a shutdown reason that is already the primary error, for example when
+ * restoring raw mode fails because shutdown closed the connection.
+ */
+export function withoutRepeatedShutdownReason(primary: unknown, cleanupError: unknown): unknown {
+  return primary instanceof DaemonShutdownError && cleanupError instanceof DaemonShutdownError
+    ? undefined
+    : cleanupError;
+}
diff --git a/libraries/rush-daemon/src/EngineTerminalProvider.ts b/libraries/rush-daemon/src/EngineTerminalProvider.ts
index 13c8b48d5e..88345d0372 100644
--- a/libraries/rush-daemon/src/EngineTerminalProvider.ts
+++ b/libraries/rush-daemon/src/EngineTerminalProvider.ts
@@ -4,25 +4,69 @@
 import type { IOperationGraph, _IOperationGraphEventSink } from '@microsoft/rush-lib';
 import { TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
 
+import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
+
 export class EngineTerminalProvider implements ITerminalProvider {
   public readonly supportsColor: boolean = false;
   public readonly eolCharacter: string = '\n';
   readonly #messages: Array<{ text: string; severity: TerminalProviderSeverity }> = [];
   #graph: (IOperationGraph & { eventSink?: _IOperationGraphEventSink }) | undefined;
   #executing: boolean = false;
+  #hasReconciled: boolean = false;
 
   public write(text: string, severity: TerminalProviderSeverity): void {
     if (this.#executing) this.#emit(text, severity);
     else this.#messages.push({ text, severity });
   }
 
+  /**
+   * Drains buffered diagnostics into the failure description, so that they belong to the failing request
+   * and are never replayed into a later request.
+   */
   public describeError(error: unknown): string {
     return [
-      ...this.#messages.map(({ text }) => text),
+      ...this.#messages.splice(0).map(({ text }) => text),
       error instanceof Error ? error.message : String(error)
     ].join('\n');
   }
 
+  public get hasBufferedMessages(): boolean {
+    return this.#messages.length > 0;
+  }
+
+  /** Discards diagnostics buffered by an earlier request before a new request starts using this terminal. */
+  public discardBufferedMessages(): void {
+    this.#messages.length = 0;
+  }
+
+  /**
+   * Runs a warm reconcile with request-scoped diagnostics. The graph keeps the binding request's terminal, so
+   * diagnostics buffered before a later request's reconcile belong to an earlier request and are discarded; the
+   * binding request's own diagnostics are kept. A failure carries the diagnostics buffered while reconciling.
+   */
+  public async reconcileWithRequestDiagnosticsAsync<T>(reconcileAsync: () => Promise<T>): Promise<T> {
+    if (this.#hasReconciled) this.discardBufferedMessages();
+    this.#hasReconciled = true;
+    try {
+      return await reconcileAsync();
+    } catch (error) {
+      throw this.#attachBufferedDiagnostics(error);
+    }
+  }
+
+  #attachBufferedDiagnostics(error: unknown): unknown {
+    if (error instanceof WorkspaceEngineRecreationRequiredError) {
+      // The replacement engine gets a fresh terminal; the stale diagnostics must not reach a later request.
+      this.discardBufferedMessages();
+      return error;
+    }
+    if (!this.hasBufferedMessages) return error;
+    if (!(error instanceof Error)) return new Error(this.describeError(error), { cause: error });
+    // Keep the error's identity and type, which callers use for classification.
+    error.message = this.describeError(error);
+    return error;
+  }
+
   public attach(graph: IOperationGraph): void {
     if (!('eventSink' in graph))
       throw new Error('The native graph does not expose its operation event sink.');
diff --git a/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts b/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts
index 256564c846..8ce2d4a61f 100644
--- a/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts
+++ b/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts
@@ -24,6 +24,7 @@ import {
 import { type IRequestLease, RequestSchedulerError, RequestSchedulerErrorCode } from './RequestScheduler';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
+import { getDaemonShutdownReason, withoutRepeatedShutdownReason } from './DaemonShutdownError';
 
 /**
  * Executes caller-resolved global command logic.
@@ -179,7 +180,12 @@ async function executeAdmittedAsync(
     cleanupError = combineExecutionAndCleanupErrors(cleanupError, error);
   }
   aborted ||= context.requestAborted;
-  const combinedError: unknown = combineExecutionAndCleanupErrors(executionError, cleanupError);
+  const primaryError: unknown =
+    executionError ?? (aborted ? getDaemonShutdownReason(client.abortSignal) : undefined);
+  const combinedError: unknown = combineExecutionAndCleanupErrors(
+    primaryError,
+    withoutRepeatedShutdownReason(primaryError, cleanupError)
+  );
   let result: IDaemonCommandResult;
   try {
     result = createGlobalCommandResult({
@@ -259,8 +265,12 @@ async function finishAfterAdmissionErrorAsync(
     throw combineExecutionAndCleanupErrors(admissionError, cleanupError);
   }
   const aborted: boolean = admissionError.code === RequestSchedulerErrorCode.Aborted;
+  const shutdownReason: unknown = aborted ? getDaemonShutdownReason(client.abortSignal) : undefined;
   const error: unknown = aborted
-    ? cleanupError
+    ? combineExecutionAndCleanupErrors(
+        shutdownReason,
+        withoutRepeatedShutdownReason(shutdownReason, cleanupError)
+      )
     : combineExecutionAndCleanupErrors(admissionError, cleanupError);
   const result: IDaemonCommandResult = {
     ...createGlobalCommandResult({
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index f9cd596123..430751653c 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -22,6 +22,7 @@ import { PhasedRequestEventSink } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
+import { DaemonShutdownError, getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IInteractiveRequestSession } from './InteractiveRequestInputRouter';
 import { classifyRushCommand } from './RushCommandRequestPolicy';
 import {
@@ -641,7 +642,10 @@ class PhasedRequestBatchCoordinator {
       : [];
     const result: IDaemonPhasedRequestResult = createPhasedCommandResult({
       aborted,
-      error: combineErrors(executionError, cleanupErrors),
+      error: combineErrors(
+        executionError ?? getDaemonShutdownReason(entry.client.abortSignal),
+        cleanupErrors
+      ),
       graphStatus: getClientGraphStatus(aborted, operationOutcomes),
       operationOutcomes,
       requestId: entry.request.requestId,
@@ -1029,7 +1033,7 @@ async function writeAbortedResultAsync(
   const result: IDaemonPhasedRequestResult = {
     ...createPhasedCommandResult({
       aborted: true,
-      error: combineErrors(undefined, cleanupErrors),
+      error: combineErrors(getDaemonShutdownReason(client.abortSignal), cleanupErrors),
       graphStatus: OperationStatus.Aborted,
       operationOutcomes: [],
       requestId,
@@ -1131,7 +1135,13 @@ async function finishAfterAdmissionErrorAsync(
   return result;
 }
 
-function combineErrors(executionError: unknown, cleanupErrors: unknown[]): unknown {
+function combineErrors(executionError: unknown, allCleanupErrors: unknown[]): unknown {
+  // Cleanup that fails with the same daemon shutdown reason (for example, restoring raw mode after the
+  // interactive connection closed) must not hide that reason from the client.
+  const cleanupErrors: unknown[] =
+    executionError instanceof DaemonShutdownError
+      ? allCleanupErrors.filter((error: unknown) => !(error instanceof DaemonShutdownError))
+      : allCleanupErrors;
   if (executionError !== undefined && cleanupErrors.length > 0) {
     return new AggregateError(
       [executionError, ...cleanupErrors],
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 6c503f46ee..6467828ef5 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -32,6 +32,7 @@ import {
 } from './WorkspaceEngineComponentFactory';
 import type { IWorkspaceSession, IWorkspaceSessionComponents } from './WorkspaceSession';
 import { EngineTerminalProvider } from './EngineTerminalProvider';
+import { getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
 
 /**
@@ -174,7 +175,8 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     if (abortSignal.aborted)
       throw new DaemonRequestDispatchError(
         'routingFailed',
-        'The request was cancelled before engine initialization.'
+        getDaemonShutdownReason(abortSignal)?.message ??
+          'The request was cancelled before engine initialization.'
       );
     return command;
   }
@@ -224,7 +226,9 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           ...components,
           reconcileInvalidationsAsync: async () => {
             const result: IWorkspaceInvalidationReconciliation =
-              await components.reconcileInvalidationsAsync!();
+              await terminal.reconcileWithRequestDiagnosticsAsync(() =>
+                components.reconcileInvalidationsAsync!()
+              );
             if (!engine.isIncremental) engine.operationGraph.invalidateOperations(undefined, 'rebuild');
             return result;
           }
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 6aa4989ac3..17ff4a7bed 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -18,6 +18,7 @@ import { DaemonIdleTimer } from './DaemonIdleTimer';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
 import type { IDaemonRequestResolver } from './DaemonRequestDispatcher';
+import { DaemonShutdownError, type DaemonShutdownInitiator } from './DaemonShutdownError';
 import { WorkspaceSession } from './WorkspaceSession';
 import type { IWorkspaceSession, WorkspaceSessionFactory } from './WorkspaceSession';
 import { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
@@ -180,7 +181,12 @@ export class RushDaemonHost {
             },
             onError: (error: Error) => options.onError?.(error),
             onRequestStarted: () => idleTimer.acquire(),
-            onShutdownRequested: requestShutdown
+            onShutdownRequested: () => requestShutdown('controlClient'),
+            getActiveRequestCount: () => {
+              let count: number = 0;
+              for (const activeSession of sessions) count += activeSession.activeRequestCount;
+              return count;
+            }
           });
           sessions.add(session);
           if (lifecycle.closing) {
@@ -223,13 +229,13 @@ export class RushDaemonHost {
     function requestRestart(plan: IWorkspaceProcessRestartPlan): void {
       host.#requestRestart(plan);
     }
-    function requestShutdown(): void {
-      void host.closeAsync().catch((error: Error) => {
+    function requestShutdown(initiator: DaemonShutdownInitiator): void {
+      void host.closeAsync(new DaemonShutdownError({ initiator })).catch((error: Error) => {
         if (options.onError) options.onError(error);
         else process.emitWarning(error);
       });
     }
-    idleTimer.start(requestShutdown);
+    idleTimer.start(() => requestShutdown('idleTimeout'));
     return host;
   }
 
@@ -248,9 +254,13 @@ export class RushDaemonHost {
     return this.#readWorkspaceStatus();
   }
 
-  /** Closes active connections, stops listening, and removes transport artifacts. */
-  public closeAsync(): Promise<void> {
-    this.#closePromise ??= this.#closeOnceAsync().finally(() => {
+  /**
+   * Closes active connections, stops listening, and removes transport artifacts.
+   *
+   * @param reason - Delivered to requests that are still running; only the first close call's reason is used.
+   */
+  public closeAsync(reason?: DaemonShutdownError): Promise<void> {
+    this.#closePromise ??= this.#closeOnceAsync(reason).finally(() => {
       this.#notifyClosed?.();
       if (!this.#restartPromise) this.#resolveRestart?.(undefined);
     });
@@ -272,7 +282,7 @@ export class RushDaemonHost {
   }
 
   async #restartOnceAsync(plan: IWorkspaceProcessRestartPlan): Promise<IWorkspaceProcessRestartResult> {
-    await this.closeAsync();
+    await this.closeAsync(new DaemonShutdownError({ initiator: 'restart' }));
     if (plan.failure) throw plan.failure;
     if (!plan.launch) throw new Error('A successor was not selected.');
     const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
@@ -297,7 +307,7 @@ export class RushDaemonHost {
     }
   }
 
-  async #closeOnceAsync(): Promise<void> {
+  async #closeOnceAsync(reason: DaemonShutdownError | undefined): Promise<void> {
     this.#idleTimer[Symbol.dispose]();
     this.#lifecycle.closing = true;
     const errors: unknown[] = [];
@@ -305,7 +315,7 @@ export class RushDaemonHost {
     // A failed standalone host must not exit naturally and become reclaimable over unjoined children.
     const sessionSettlements: PromiseSettledResult<void>[] = await Promise.allSettled(
       Array.from(this.#sessions, (session: DaemonControlSession) =>
-        session.closeAsync(!!this.#restartPromise)
+        session.closeAsync(!!this.#restartPromise, reason ?? new DaemonShutdownError({ initiator: 'host' }))
       )
     );
     for (const settlement of sessionSettlements) {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index adb9753ce6..2ee815aad2 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -40,6 +40,7 @@ import {
   getWorkspaceRequestScheduler
 } from './WorkspaceRequestAdmission';
 import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
+import { getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
@@ -263,7 +264,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           if (error instanceof RequestSchedulerError && !state.began && !state.terminalAttempted) {
             await client.interactiveSession.finishAsync();
             await client.writeResultAsync({
-              ...preExecutionFailure(envelope.requestId, error),
+              ...preExecutionFailure(
+                envelope.requestId,
+                getDaemonShutdownReason(client.abortSignal) ?? error
+              ),
               aborted: client.abortSignal.aborted,
               admissionErrorCode: getRequestAdmissionErrorCode(error)
             });
diff --git a/libraries/rush-daemon/src/index.ts b/libraries/rush-daemon/src/index.ts
index 89039a0c43..b895226872 100644
--- a/libraries/rush-daemon/src/index.ts
+++ b/libraries/rush-daemon/src/index.ts
@@ -57,6 +57,11 @@ export {
   type IGlobalCommandRequestResult
 } from './GlobalCommandRequestRouter';
 export { RushDaemonHost, type IRushDaemonHostOptions } from './RushDaemonHost';
+export {
+  DaemonShutdownError,
+  type DaemonShutdownInitiator,
+  type IDaemonShutdownErrorOptions
+} from './DaemonShutdownError';
 export { serveRushDaemonAsync, type IRushDaemonServeOptions } from './serveRushDaemon';
 export {
   WorkspaceEngineComponentFactory,
diff --git a/libraries/rush-daemon/src/serveRushDaemon.ts b/libraries/rush-daemon/src/serveRushDaemon.ts
index 929b28bbf0..1baec925df 100644
--- a/libraries/rush-daemon/src/serveRushDaemon.ts
+++ b/libraries/rush-daemon/src/serveRushDaemon.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { DaemonShutdownError } from './DaemonShutdownError';
 import { RushDaemonHost } from './RushDaemonHost';
 import type { IRushDaemonHostOptions } from './RushDaemonHost';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from './WorkspaceProcessRestart';
@@ -41,7 +42,7 @@ export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Pr
     });
     await options.onReady?.(host);
     await waitForShutdownAsync(host, signalRegistration.signal);
-    await host.closeAsync();
+    await host.closeAsync(getShutdownReason(signalRegistration.signal));
     await host.restartCompleted;
   } finally {
     signalRegistration.dispose();
@@ -49,6 +50,13 @@ export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Pr
   }
 }
 
+function getShutdownReason(signal: AbortSignal): DaemonShutdownError | undefined {
+  if (!signal.aborted) return undefined;
+  return signal.reason instanceof DaemonShutdownError
+    ? signal.reason
+    : new DaemonShutdownError({ initiator: 'host' });
+}
+
 interface IShutdownSignalRegistration {
   readonly signal: AbortSignal;
   readonly dispose: () => void;
@@ -56,7 +64,8 @@ interface IShutdownSignalRegistration {
 
 function createProcessShutdownSignal(): IShutdownSignalRegistration {
   const controller: AbortController = new AbortController();
-  const onSignal: () => void = () => controller.abort();
+  const onSignal: (signal: NodeJS.Signals) => void = (signal: NodeJS.Signals) =>
+    controller.abort(new DaemonShutdownError({ initiator: 'signal', signal }));
   process.once('SIGINT', onSignal);
   process.once('SIGTERM', onSignal);
   return {
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
index 86d984c61b..e570988009 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
@@ -10,6 +10,7 @@ import type { DaemonControlMessage, IDaemonRequestEnvelope } from '@rushstack/ru
 
 import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
 import { MAX_REQUESTS_PER_CONNECTION } from '../DaemonConnectionLimits';
+import { DaemonShutdownError } from '../DaemonShutdownError';
 import { RushDaemonHost } from '../RushDaemonHost';
 import type { IRushDaemonHostOptions } from '../RushDaemonHost';
 import { TestWorkspaceSession } from './TestWorkspaceSession';
@@ -303,6 +304,51 @@ describe('daemon global request wire integration', () => {
     }
   });
 
+  it('tells a request queued for admission that the daemon shut down', async () => {
+    const repoRoot: string = createRepoRoot();
+    const holderStarted: IDeferred<void> = createDeferred<void>();
+    const releaseHolder: IDeferred<void> = createDeferred<void>();
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => {
+      const executorAsync: GlobalCommandExecutor = async () => {
+        if (envelope.requestId === 'holder') {
+          holderStarted.resolve();
+          await releaseHolder.promise;
+        }
+        return { exitCode: 0 };
+      };
+      return { executor: executorAsync, kind: 'global' };
+    });
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createHostOptions(repoRoot, resolver));
+    const clients: DaemonRequestWireClient[] = await Promise.all([connectAsync(host), connectAsync(host)]);
+    const shutdown: DaemonShutdownError = new DaemonShutdownError({ initiator: 'controlClient' });
+    try {
+      await clients[0].sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('holder', 'custom', repoRoot)
+      });
+      await holderStarted.promise;
+      await clients[1].sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('queued', 'custom', repoRoot)
+      });
+      expect(await clients[1].readControlAsync()).toMatchObject({
+        kind: 'queuePosition',
+        payload: { requestId: 'queued' }
+      });
+      const closePromise: Promise<void> = host.closeAsync(shutdown);
+      releaseHolder.resolve();
+      expect((await clients[1].readTerminalAsync('queued')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { aborted: true, admissionErrorCode: 'aborted', errorMessage: shutdown.message }
+      });
+      await closePromise;
+    } finally {
+      releaseHolder.resolve();
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
   it('rejects a second active request on one connection without cancelling the first', async () => {
     const repoRoot: string = createRepoRoot();
     const started: IDeferred<void> = createDeferred<void>();
diff --git a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
index 284d26a697..c2c8c91e3d 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
@@ -38,7 +38,7 @@ describe('daemon management shutdown', () => {
     await client.sendControlAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
     expect((await client.readControlAsync()).kind).toBe('helloAck');
     await client.sendControlAsync({ kind: 'shutdown', payload: {} });
-    expect(await client.readControlAsync()).toEqual({ kind: 'shutdownAck', payload: {} });
+    expect(await client.readControlAsync()).toEqual({ kind: 'shutdownAck', payload: { activeRequests: 0 } });
     await client.closed;
     await host.closed;
     expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
diff --git a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
new file mode 100644
index 0000000000..2c6fcbfdf7
--- /dev/null
+++ b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+import { EngineTerminalProvider } from '../EngineTerminalProvider';
+import { WorkspaceEngineRecreationRequiredError } from '../WorkspaceEngineComponentFactory';
+
+describe(EngineTerminalProvider.name, () => {
+  it('drains buffered diagnostics into the failure description so a later request cannot replay them', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('Permission denied', TerminalProviderSeverity.error);
+    expect(terminal.hasBufferedMessages).toBe(true);
+    expect(terminal.describeError(new Error('snapshot failed'))).toBe('Permission denied\nsnapshot failed');
+    expect(terminal.hasBufferedMessages).toBe(false);
+    expect(terminal.describeError(new Error('next request'))).toBe('next request');
+  });
+
+  it('discards diagnostics buffered by an earlier request', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('stale', TerminalProviderSeverity.warning);
+    terminal.discardBufferedMessages();
+    expect(terminal.hasBufferedMessages).toBe(false);
+    expect(terminal.describeError('failure')).toBe('failure');
+  });
+
+  it('scopes reconcile diagnostics to the request whose reconcile produced them', async () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('binding request diagnostic', TerminalProviderSeverity.warning);
+    const failure: RangeError = new RangeError('could not capture');
+    await expect(
+      terminal.reconcileWithRequestDiagnosticsAsync(async () => {
+        terminal.write('Permission denied', TerminalProviderSeverity.error);
+        throw failure;
+      })
+    ).rejects.toBe(failure);
+    expect(failure.message).toBe('binding request diagnostic\nPermission denied\ncould not capture');
+
+    terminal.write('stale', TerminalProviderSeverity.warning);
+    await expect(terminal.reconcileWithRequestDiagnosticsAsync(async () => 'ok')).resolves.toBe('ok');
+    expect(terminal.hasBufferedMessages).toBe(false);
+  });
+
+  it('drops diagnostics when the engine must be recreated', async () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    const recreate: WorkspaceEngineRecreationRequiredError = new WorkspaceEngineRecreationRequiredError();
+    const message: string = recreate.message;
+    await expect(
+      terminal.reconcileWithRequestDiagnosticsAsync(async () => {
+        terminal.write('stale', TerminalProviderSeverity.error);
+        throw recreate;
+      })
+    ).rejects.toBe(recreate);
+    expect(recreate.message).toBe(message);
+    expect(terminal.hasBufferedMessages).toBe(false);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestInteractive.test.ts b/libraries/rush-daemon/src/test/PhasedRequestInteractive.test.ts
index 7cc2ab8b51..6c915f8b5c 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestInteractive.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestInteractive.test.ts
@@ -3,9 +3,11 @@
 
 import type {
   IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
   IDaemonSetRawModeMessage
 } from '@rushstack/rush-daemon-protocol';
 
+import { DaemonShutdownError } from '../DaemonShutdownError';
 import { DaemonRequiresInProcessError } from '../DaemonTerminalPolicy';
 import { InteractiveRequestInputRouter } from '../InteractiveRequestInputRouter';
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
@@ -68,6 +70,34 @@ it('restores phased-request raw mode before publishing the command result', asyn
   expect(lifecycleOrder).toEqual(['raw:true', 'raw:false', 'result']);
 });
 
+it('keeps the daemon shutdown reason when restoring raw mode fails with it', async () => {
+  const fixture: ITestRoutingFixture = createFixture();
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const shutdown: DaemonShutdownError = new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' });
+  client.interactiveSession = new InteractiveRequestInputRouter().register({
+    acceptsStdin: true,
+    client: {
+      abortSignal: client.abortSignal,
+      writeRawModeControlAsync: (message: IDaemonSetRawModeMessage): Promise<void> =>
+        message.payload.enabled ? Promise.resolve() : Promise.reject(shutdown)
+    },
+    onFailure: (error: Error) => client.abortController.abort(error),
+    requestId: 'interactive-request'
+  });
+  client.interactiveInputSink = {
+    writeInputAsync: (): Promise<void> => Promise.resolve()
+  };
+  await client.interactiveSession.setRawModeAsync(true);
+  client.abortController.abort(shutdown);
+
+  await new PhasedRequestRouter(fixture.session)
+    .executeAsync(createRequest({ acceptsStdin: true, terminalRequirement: 'interactiveInput' }), client)
+    .catch(() => undefined);
+
+  const result: IDaemonPhasedRequestResult | undefined = client.writes.find((write) => write.result)?.result;
+  expect(result).toMatchObject({ aborted: true, errorMessage: shutdown.message });
+});
+
 it('signals requiresInProcess without scheduling a PTY-only phased request', async () => {
   const fixture: ITestRoutingFixture = createFixture();
   const client: TestPhasedRequestClient = new TestPhasedRequestClient();
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index b0d02fd298..01f38bfd80 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -34,6 +34,7 @@ import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 import { removeTestFolderAsync } from './TestProcessExit';
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 import { EngineTerminalProvider } from '../EngineTerminalProvider';
+import { DaemonShutdownError } from '../DaemonShutdownError';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import type {
   GetWorkspaceSuccessorLaunchAsync,
@@ -1436,4 +1437,67 @@ process.exit(23);
       await fixture[Symbol.asyncDispose]();
     }
   });
+
+  const canRevokeReadAccess: boolean = process.platform !== 'win32' && process.getuid?.() !== 0;
+  (canRevokeReadAccess ? it : it.skip)(
+    'reports a warm snapshot failure to the failing request and never replays it into the next request',
+    async () => {
+      const fixture: IFixture = await createFixtureAsync();
+      const inputPath: string = path.join(fixture.repoRoot, 'projects/a/input.txt');
+      try {
+        await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+        fs.writeFileSync(inputPath, 'unreadable');
+        fs.chmodSync(inputPath, 0);
+        const failed: ITerminalExchange = await runAsync(fixture, 'unreadable', ['build', '--only', 'a']);
+        expect(failed.terminal).toMatchObject({
+          kind: 'requestRejected',
+          payload: {
+            message: expect.stringMatching(
+              /Permission denied[\s\S]*Rush could not capture the next workspace inputs snapshot\./
+            )
+          }
+        });
+        fs.chmodSync(inputPath, 0o644);
+        const recovered: ITerminalExchange = await runAsync(fixture, 'recovered', ['build', '--only', 'a']);
+        expect(recovered.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        const output: string = [
+          logText(recovered),
+          ...recovered.frames
+            .filter((frame) => frame.kind === DaemonFrameType.event)
+            .map((frame) => JSON.stringify(decodeDaemonEventFrame(frame.payload)))
+        ].join('\n');
+        expect(output).not.toContain('Permission denied');
+        expect(output).not.toContain('state of the repo');
+      } finally {
+        if (fs.existsSync(inputPath)) fs.chmodSync(inputPath, 0o644);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+
+  it('aborts an in-flight build with the typed daemon shutdown reason', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const gate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
+    try {
+      const victim: Promise<ITerminalExchange> = runAsync(fixture, 'victim', ['build', '--only', 'a']);
+      await gate.entered;
+      const closing: Promise<void> = fixture.host.closeAsync(
+        new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })
+      );
+      await gate.releaseAsync();
+      expect((await victim).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage: expect.stringMatching(
+            /^The Rush daemon was shut down \(the daemon process received SIGTERM\) while this request was running; re-run the command\.$/
+          )
+        }
+      });
+      await closing;
+    } finally {
+      await gate.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
 });

From 23cb48819646c2672cc0e24bd9d19274a873da46 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:17:36 -0700
Subject: [PATCH 007/265] [rush-cli-client] Add agent output mode and honor
 useRushReporter on the daemon path (#6082)

* [rush-cli-client] Add agent output mode and honor useRushReporter on the daemon path

Fixes #6076

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-cli-client] Keep explicit reporter controls on the native path; agent mode only when no reporter is chosen

Addresses review: --reporter=ai (with or without --no-daemon, and on fallback) and RUSH_REPORTER=ai keep the native AI reporter JSON; agent mode writes nothing ahead of native reporter output.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-cli-client] Address review: ABORTED counts, per-operation failure tails, final line on rejection, admission-control command name, normalized RUSH_REPORTER, queue dedup

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 apps/rush-cli-client/README.md                |  34 ++-
 .../src/AgentProgressRenderer.ts              | 288 ++++++++++++++++++
 apps/rush-cli-client/src/launchClient.ts      |  33 +-
 apps/rush-cli-client/src/outputSelection.ts   | 143 +++++++++
 apps/rush-cli-client/src/routing.ts           |   8 +-
 apps/rush-cli-client/src/start.ts             |  35 ++-
 .../src/test/AgentProgressRenderer.test.ts    | 199 ++++++++++++
 .../src/test/outputSelection.test.ts          |  92 ++++++
 apps/rush-cli-client/src/test/routing.test.ts |  22 +-
 .../agent-reporter_2026-09-24-02-35.json      |  11 +
 10 files changed, 852 insertions(+), 13 deletions(-)
 create mode 100644 apps/rush-cli-client/src/AgentProgressRenderer.ts
 create mode 100644 apps/rush-cli-client/src/outputSelection.ts
 create mode 100644 apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
 create mode 100644 apps/rush-cli-client/src/test/outputSelection.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-reporter_2026-09-24-02-35.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index bb93cf69f5..dda32fb6ef 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -61,9 +61,37 @@ Admission controls also apply to experimental graph requests, but not
 retains native command behavior. Waiting positions are shown on interactive stderr,
 and admission failures report their typed reason and a nonzero exit code.
 
-Explicit reporter/output/log-level controls retain the native frontend reporter path.
-The current daemon client renders the legacy operation stream; it does not silently
-reinterpret requests for JSON, AI, file, or other reporter formats.
+Explicit reporter/output/log-level controls (`--reporter`, `--output`, `--log-level`,
+`RUSH_REPORTER` other than `legacy`, or `RUSH_LOG_LEVEL`) retain the native frontend
+reporter path, with or without `--no-daemon`, including `--reporter=ai`. The daemon client
+does not silently reinterpret requests for JSON, AI, file, or other reporter formats.
+
+A repository that opts into the native reporter with `"useRushReporter": true` in
+`common/config/rush/experiments.json` also stays on the native (in-process) path, so
+that its reporter output is honored rather than silently replaced by the daemon
+stream. Native reporter rendering over the daemon protocol is a follow-up.
+
+### Output modes
+
+The `rush-client` daemon path has two output modes (`rushx-client` always uses `legacy`).
+Requests that use the native reporter path (see above) always get native output, and
+agent mode writes nothing ahead of it. Otherwise, selection precedence is:
+
+1. `RUSHD_OUTPUT=agent` or `RUSHD_OUTPUT=legacy`.
+2. An active `COPILOT_CLI` agent marker selects `agent`, matching `detectAgent()` in
+   `@rushstack/reporter` (a value is inactive when empty, `0`, `false`, `no` or `off`).
+   Other agents can opt in with `RUSHD_OUTPUT=agent`.
+3. Otherwise `legacy`: the unchanged collated operation stream.
+
+Agent mode is plain text for humans and agents, not the AI reporter's JSON record format;
+use `--reporter=ai` for machine-parsed records. It writes a first status line before
+`@microsoft/rush-lib` is loaded, then at most three live rows on a TTY (append-only lines
+throttled to one per 2 seconds on a pipe), the queue position when waiting for admission,
+and always one final summary line (`rush build: SUCCESS 12/12 operations (...) in 3.1s`, or
+`up to date (no operations needed)`). On failure, it lists failed operations and a
+bounded tail (10 lines) of their stderr, or of their stdout when they wrote no stderr.
+Operation logs are otherwise not printed; use `RUSHD_OUTPUT=legacy` for full logs. When
+a request falls back to in-process Rush, agent mode stops and native output follows.
 
 Positively identified built-in `install` and `update` follow the same opt-in routing
 precedence as workspace builds and require protocol **0.10**
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
new file mode 100644
index 0000000000..08fa108796
--- /dev/null
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -0,0 +1,288 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib
+// so that the first line can be written within a few milliseconds.
+
+import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+
+const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+const TERMINAL_STATUSES: ReadonlySet<string> = new Set([
+  'SUCCESS',
+  'SUCCESS WITH WARNINGS',
+  'SKIPPED',
+  'FROM CACHE',
+  'FAILURE',
+  'BLOCKED',
+  'NO OP',
+  'ABORTED'
+]);
+const MAX_ERROR_LINES: number = 10;
+const PIPE_MIN_INTERVAL_MS: number = 2000;
+const PIPE_HEARTBEAT_MS: number = 10000;
+const TTY_INTERVAL_MS: number = 100;
+
+export interface IAgentProgressRendererOptions {
+  readonly commandName: string;
+  readonly isTTY: boolean;
+  readonly columns: number;
+  readonly write: (text: string) => void;
+  readonly now?: () => number;
+  readonly startTimeMs?: number;
+}
+
+interface IAgentFinalResult {
+  readonly exitCode: number;
+  readonly errorMessage?: string;
+}
+
+/**
+ * Compact progress for agents on the daemon path: an immediate first line, at most
+ * three live rows (TTY) or throttled append-only lines (pipes), and a guaranteed
+ * bounded final summary line, even when no operation ran.
+ */
+export class AgentProgressRenderer {
+  readonly #options: IAgentProgressRendererOptions;
+  readonly #now: () => number;
+  readonly #startTimeMs: number;
+  readonly #registered: Set<string> = new Set();
+  readonly #statuses: Map<string, string> = new Map();
+  readonly #running: Set<string> = new Set();
+  readonly #counts: Map<string, number> = new Map();
+  readonly #failed: string[] = [];
+  readonly #stderrTails: Map<string, string[]> = new Map();
+  readonly #stdoutTails: Map<string, string[]> = new Map();
+  #total: number = 0;
+  #done: number = 0;
+  #lastActivity: string = '';
+  #phase: string = 'connecting to rushd (auto-starts if needed)';
+  #painted: number = 0;
+  #frame: number = 0;
+  #lastLineKey: string = '';
+  #lastLineAtMs: number = -Infinity;
+  #timer: ReturnType<typeof setInterval> | undefined;
+  #stopped: boolean = false;
+
+  public constructor(options: IAgentProgressRendererOptions) {
+    this.#options = options;
+    this.#now = options.now ?? Date.now;
+    this.#startTimeMs = options.startTimeMs ?? this.#now();
+  }
+
+  /** Writes the first line and starts the spinner / heartbeat. */
+  public start(): void {
+    this.#render(true);
+    this.#timer = setInterval(
+      () => this.#render(false),
+      this.#options.isTTY ? TTY_INTERVAL_MS : PIPE_MIN_INTERVAL_MS
+    );
+    this.#timer.unref?.();
+  }
+
+  public setPhase(phase: string): void {
+    if (phase === this.#phase) {
+      return;
+    }
+    this.#phase = phase;
+    this.#render(true);
+  }
+
+  public onQueuePosition(position: number): void {
+    this.setPhase(`queued behind another request (position ${position})`);
+  }
+
+  public onEvent(event: IDaemonEventEnvelope): void {
+    const payload: Record<string, unknown> = (event.payload ?? {}) as Record<string, unknown>;
+    switch (event.type) {
+      case 'operationRegistered': {
+        if (!payload.silent && typeof payload.operationId === 'string') {
+          this.#registered.add(payload.operationId);
+        }
+        break;
+      }
+      case 'operationStatusChanged': {
+        const operationId: unknown = payload.operationId;
+        const status: unknown = payload.status;
+        if (typeof operationId !== 'string' || typeof status !== 'string') {
+          break;
+        }
+        this.#phase = 'running';
+        const previous: string | undefined = this.#statuses.get(operationId);
+        this.#statuses.set(operationId, status);
+        if (status === 'EXECUTING') {
+          this.#running.add(operationId);
+        }
+        if (TERMINAL_STATUSES.has(status) && (previous === undefined || !TERMINAL_STATUSES.has(previous))) {
+          this.#running.delete(operationId);
+          this.#done++;
+          this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
+          if (status === 'FAILURE') {
+            this.#failed.push(operationId);
+          } else {
+            this.#stdoutTails.delete(operationId);
+            this.#stderrTails.delete(operationId);
+          }
+        }
+        break;
+      }
+      case 'extension': {
+        const data: { totalOperations?: unknown } | undefined = payload.data as
+          | { totalOperations?: unknown }
+          | undefined;
+        if (data && typeof data.totalOperations === 'number') {
+          this.#total = Math.max(this.#total, data.totalOperations);
+        }
+        break;
+      }
+      case 'activityChanged': {
+        if (typeof payload.text === 'string' && payload.text.trim()) {
+          this.#lastActivity = payload.text.trim().split('\n')[0];
+          if (this.#phase !== 'running') {
+            this.#phase = 'running';
+          }
+        }
+        break;
+      }
+    }
+    this.#render(false);
+  }
+
+  /**
+   * Keeps bounded per-operation stderr and stdout tails (the last lines of each). They are only
+   * printed for failed operations; stdout is used when an operation reported its diagnostics
+   * there (tsc, eslint, jest) and wrote nothing to stderr.
+   */
+  public onLog(bytes: Uint8Array, operationId: string, stream: 'stdout' | 'stderr'): void {
+    const status: string | undefined = this.#statuses.get(operationId);
+    if (status !== undefined && TERMINAL_STATUSES.has(status) && status !== 'FAILURE') {
+      return;
+    }
+    const tails: Map<string, string[]> = stream === 'stderr' ? this.#stderrTails : this.#stdoutTails;
+    for (const line of Buffer.from(bytes).toString('utf8').split('\n')) {
+      if (!line.trim()) {
+        continue;
+      }
+      let tail: string[] | undefined = tails.get(operationId);
+      if (!tail) {
+        tail = [];
+        tails.set(operationId, tail);
+      }
+      tail.push(line.trim());
+      if (tail.length > MAX_ERROR_LINES) {
+        tail.shift();
+      }
+    }
+  }
+
+  /** Stops rendering without a summary (e.g. the request is handed to in-process Rush). */
+  public dispose(): void {
+    this.#stop();
+  }
+
+  /** Stops the live region and writes the final summary line, at most once. */
+  public finish(result: IAgentFinalResult | undefined): void {
+    if (!this.#stop()) {
+      return;
+    }
+    const succeeded: boolean = result !== undefined && result.exitCode === 0;
+    const total: number = this.#getTotal();
+    const parts: string[] = [...this.#counts].map(([status, count]) => `${count} ${status.toLowerCase()}`);
+    const scope: string =
+      total === 0 && succeeded
+        ? 'up to date (no operations needed)'
+        : `${this.#done}/${total} operations${parts.length ? ` (${parts.join(', ')})` : ''}`;
+    let line: string = `rush ${this.#options.commandName}: ${succeeded ? 'SUCCESS' : 'FAILURE'} ${scope} in ${this.#elapsed()}`;
+    if (this.#failed.length) {
+      line += ` · failed: ${this.#failed.join(', ')}`;
+    }
+    if (result?.errorMessage) {
+      line += ` · ${result.errorMessage}`;
+    }
+    this.#options.write(`${line}\n`);
+    if (!succeeded) {
+      for (const errorLine of this.#getFailureLines().slice(0, MAX_ERROR_LINES)) {
+        this.#options.write(`  ${errorLine}\n`);
+      }
+    }
+  }
+
+  /** Failed operations' tails, or every operation's stderr tail when no operation failed. */
+  #getFailureLines(): string[] {
+    const operationIds: Iterable<string> = this.#failed.length ? this.#failed : this.#stderrTails.keys();
+    const lines: string[] = [];
+    for (const operationId of operationIds) {
+      const tail: string[] = this.#stderrTails.get(operationId) ?? this.#stdoutTails.get(operationId) ?? [];
+      for (const line of tail) {
+        lines.push(`${operationId}: ${line}`);
+      }
+    }
+    return lines;
+  }
+
+  /** Returns false if rendering had already stopped; after stopping, nothing more is written. */
+  #stop(): boolean {
+    if (this.#stopped) {
+      return false;
+    }
+    this.#stopped = true;
+    if (this.#timer) {
+      clearInterval(this.#timer);
+      this.#timer = undefined;
+    }
+    this.#clear();
+    return true;
+  }
+
+  #getTotal(): number {
+    return Math.max(this.#total, this.#registered.size, this.#done);
+  }
+
+  #elapsed(): string {
+    return `${((this.#now() - this.#startTimeMs) / 1000).toFixed(1)}s`;
+  }
+
+  #rows(): [string, string, string] {
+    const total: number = this.#getTotal();
+    const running: string[] = [...this.#running];
+    const shown: string =
+      running.slice(0, 3).join(', ') + (running.length > 3 ? ` +${running.length - 3} more` : '');
+    const counter: string = total ? ` ${this.#done}/${total}` : '';
+    return [
+      `rush ${this.#options.commandName}${counter} · ${this.#elapsed()} · ${this.#phase}`,
+      running.length ? `running: ${shown}` : '',
+      this.#lastActivity
+    ];
+  }
+
+  #render(force: boolean): void {
+    if (this.#stopped) {
+      return;
+    }
+    const rows: [string, string, string] = this.#rows();
+    if (this.#options.isTTY) {
+      const width: number = Math.max(20, this.#options.columns || 80) - 1;
+      const clip = (row: string): string => (row.length > width ? `${row.slice(0, width - 1)}…` : row);
+      const frame: string = SPINNER_FRAMES[this.#frame++ % SPINNER_FRAMES.length];
+      const text: string = [`${frame} ${rows[0]}`, rows[1], rows[2]].map(clip).join('\n');
+      this.#options.write(`${this.#painted ? `\x1b[${this.#painted}A\x1b[0J` : '\x1b[?25l'}${text}\n`);
+      this.#painted = 3;
+      return;
+    }
+    const key: string = `${this.#phase}|${this.#done}`;
+    const nowMs: number = this.#now();
+    const sinceLast: number = nowMs - this.#lastLineAtMs;
+    if (!force && (sinceLast < PIPE_MIN_INTERVAL_MS || (key === this.#lastLineKey && sinceLast < PIPE_HEARTBEAT_MS))) {
+      return;
+    }
+    this.#lastLineKey = key;
+    this.#lastLineAtMs = nowMs;
+    this.#options.write(`${rows[0]}${rows[1] ? ` · ${rows[1]}` : ''}\n`);
+  }
+
+  #clear(): void {
+    if (this.#options.isTTY && this.#painted) {
+      this.#options.write(`\x1b[${this.#painted}A\x1b[0J\x1b[?25h`);
+      this.#painted = 0;
+    }
+  }
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 102c9b732b..1145164c4f 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -25,7 +25,9 @@ import { ConsoleTerminalProvider } from '@rushstack/terminal';
 import { executeDaemonCommandAsync } from './daemonCommands';
 import { formatAdmissionFailure, getConfiguredAdmission } from './ClientAdmissionControls';
 import { ClientOperationRenderer } from './ClientOperationRenderer';
+import type { AgentProgressRenderer } from './AgentProgressRenderer';
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
+import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultDiagnostic } from './resultDiagnostics';
 import { writeStreamAsync } from './writeStreamAsync';
@@ -41,7 +43,10 @@ interface IWorkspaceJson {
   readonly daemon?: IDaemonConfigurationJson;
 }
 
-export async function launchClientAsync(rushx: boolean): Promise<void> {
+export async function launchClientAsync(
+  rushx: boolean,
+  agentRenderer?: AgentProgressRenderer
+): Promise<void> {
   const cwd: string = process.cwd();
   const environment: Readonly<NodeJS.ProcessEnv> = Object.freeze({ ...process.env });
   const rushJsonPath: string | undefined = tryFindRushJsonLocation(cwd);
@@ -55,11 +60,13 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
     environment,
     enabled: config.enabled,
     rushx,
-    hasTerminal: !!(process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY)
+    hasTerminal: !!(process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY),
+    useRushReporter: !rushx && !!rushJsonPath && readUseRushReporter(rushJsonPath)
   });
   const selectedVersion: string =
     environment.RUSH_PREVIEW_VERSION ?? workspace?.rushVersion ?? getBundledRushVersion();
   if (!rushx && route.commandName === 'daemon') {
+    agentRenderer?.dispose();
     if ((route.argv[1] === 'start' || route.argv[1] === 'restart') && process.argv.includes('--no-daemon')) {
       throw new Error(`--no-daemon cannot be combined with daemon ${route.argv[1]}.`);
     }
@@ -76,12 +83,17 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
     return;
   }
   if (!route.daemon || !rushJsonPath || route.commandName === undefined) {
+    agentRenderer?.dispose();
     launchInProcess(route.argv, rushx, selectedVersion);
     return;
   }
   const terminal: ConsoleTerminalProvider = new ConsoleTerminalProvider();
   const verbosity: DaemonVerbosity =
-    route.argv.includes('--verbose') || route.argv.includes('-v') ? 'verbose' : 'quiet';
+    route.argv.includes('--verbose') || route.argv.includes('-v')
+      ? 'verbose'
+      : agentRenderer
+        ? 'normal'
+        : 'quiet';
   const request: IDaemonRequestEnvelope = captureDaemonRequest({
     argv: route.argv,
     commandName: route.commandName,
@@ -130,6 +142,7 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
       !(error instanceof loadVersionSelectedDaemonLauncher().DaemonLauncherUnavailableError)
     )
       throw error;
+    agentRenderer?.dispose();
     process.stderr.write(`rush-client: ${error.message} Using in-process Rush.\n`);
     launchInProcess(route.argv, rushx, selectedVersion);
     return;
@@ -167,19 +180,25 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
       );
     }
     await renderer.initializeAsync();
+    agentRenderer?.setPhase('request submitted; preparing the workspace graph');
     outcome = await executeWithDaemonRestartAsync(client, connection, {
       request,
       abortSignal: abort.signal,
       onStdoutAsync: async (bytes, operationId) => {
+        if (agentRenderer) return agentRenderer.onLog(bytes, operationId, 'stdout');
         await writeDiscoveryAsync();
         await renderer.writeLogAsync(bytes, operationId, 'stdout');
       },
       onStderrAsync: async (bytes, operationId) => {
+        if (agentRenderer) return agentRenderer.onLog(bytes, operationId, 'stderr');
         await writeDiscoveryAsync();
         await renderer.writeLogAsync(bytes, operationId, 'stderr');
       },
-      onEventAsync: (event) => renderer.writeEventAsync(event),
-      onQueuePositionAsync: process.stderr.isTTY
+      onEventAsync: async (event) =>
+        agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event),
+      onQueuePositionAsync: agentRenderer
+        ? async (position) => agentRenderer.onQueuePosition(position)
+        : process.stderr.isTTY
         ? (position) =>
             writeStreamAsync(
               process.stderr,
@@ -206,6 +225,7 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
     }
   }
   if (outcome.kind === 'result') {
+    agentRenderer?.finish(outcome.result);
     process.exitCode = outcome.result.exitCode;
     const diagnostic: string | undefined = getResultDiagnostic(outcome.result);
     if (diagnostic) {
@@ -217,10 +237,13 @@ export async function launchClientAsync(rushx: boolean): Promise<void> {
       );
     }
   } else if (outcome.kind === 'rejected') {
+    agentRenderer?.finish({ exitCode: 1, errorMessage: `daemon rejected the request (${outcome.rejection.code})` });
     throw new Error(`Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`);
   } else if (abort.signal.aborted) {
+    agentRenderer?.finish({ exitCode: 130, errorMessage: 'cancelled' });
     process.exitCode = 130;
   } else {
+    agentRenderer?.dispose();
     process.stderr.write(`rush-client: ${outcome.message ?? outcome.reason}; using in-process Rush.\n`);
     launchInProcess(route.argv, rushx, selectedVersion);
   }
diff --git a/apps/rush-cli-client/src/outputSelection.ts b/apps/rush-cli-client/src/outputSelection.ts
new file mode 100644
index 0000000000..cc5bce489c
--- /dev/null
+++ b/apps/rush-cli-client/src/outputSelection.ts
@@ -0,0 +1,143 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** Environment variable that selects the rush-client output mode: `agent` or `legacy`. */
+export const RUSHD_OUTPUT_ENV_VAR: 'RUSHD_OUTPUT' = 'RUSHD_OUTPUT';
+
+/**
+ * Agent markers that auto-select agent output. This intentionally matches the default of
+ * `detectAgent()` in `@rushstack/reporter` (libraries/reporter/src/config/AgentDetection.ts).
+ */
+const AGENT_MARKERS: readonly string[] = ['COPILOT_CLI'];
+const INACTIVE_VALUES: ReadonlySet<string> = new Set(['', '0', 'false', 'no', 'off']);
+const NATIVE_REPORTER_FLAGS: readonly string[] = ['--reporter', '--output', '--log-level'];
+
+export type ClientOutputMode = 'agent' | 'legacy';
+
+function isActive(value: string | undefined): boolean {
+  return value !== undefined && !INACTIVE_VALUES.has(value.trim().toLowerCase());
+}
+
+/**
+ * Returns true when `RUSH_REPORTER` requests a native reporter, i.e. it is set to anything other than
+ * the `legacy` escape hatch. Normalized like `isLegacyEmergencyFallbackRequested()` in `@rushstack/reporter`.
+ */
+export function isNativeReporterEnvironmentRequested(value: string | undefined): boolean {
+  return value !== undefined && value.trim().toLowerCase() !== 'legacy';
+}
+
+/**
+ * Returns the command name for early agent output, or undefined when the invocation has no plain
+ * command (a leading option, `--help`/`-h`, or `daemon`). Daemon admission controls (`--no-wait`,
+ * `--wait-timeout SECONDS`) are skipped like `parseClientAdmissionControls()`, which is not imported
+ * here to avoid loading `@rushstack/rush-daemon-protocol` before the first line; invalid controls
+ * are reported later by the full parser.
+ */
+export function getAgentCommandName(argv: ReadonlyArray<string>): string | undefined {
+  const remaining: string[] = [];
+  for (let index: number = 0; index < argv.length && argv[index] !== '--'; index++) {
+    const arg: string = argv[index];
+    if (arg === '--wait-timeout') {
+      index++;
+    } else if (arg !== '--no-wait' && !arg.startsWith('--wait-timeout=')) {
+      remaining.push(arg);
+    }
+  }
+  const commandName: string | undefined = remaining[0];
+  if (
+    commandName === undefined ||
+    commandName.startsWith('-') ||
+    commandName === 'daemon' ||
+    remaining.includes('--help') ||
+    remaining.includes('-h')
+  ) {
+    return undefined;
+  }
+  return commandName;
+}
+
+/**
+ * Returns true when the invocation explicitly selects a reporter, output or log level
+ * (`--reporter`, `--output`, `--log-level` before `--`, `RUSH_REPORTER` other than `legacy`,
+ * or `RUSH_LOG_LEVEL`). Such requests always use the native reporter path.
+ */
+export function hasExplicitReporterControls(
+  argv: ReadonlyArray<string>,
+  environment: Readonly<Record<string, string | undefined>>
+): boolean {
+  if (environment.RUSH_LOG_LEVEL !== undefined) {
+    return true;
+  }
+  if (isNativeReporterEnvironmentRequested(environment.RUSH_REPORTER)) {
+    return true;
+  }
+  const separator: number = argv.indexOf('--');
+  const prefix: ReadonlyArray<string> = separator < 0 ? argv : argv.slice(0, separator);
+  return prefix.some((arg) => NATIVE_REPORTER_FLAGS.some((name) => arg === name || arg.startsWith(`${name}=`)));
+}
+
+/**
+ * Reads the `useRushReporter` opt-in from `common/config/rush/experiments.json` next to `rush.json`.
+ * A missing or unreadable file means the opt-in is absent; in-process Rush reports invalid files.
+ */
+export function readUseRushReporter(rushJsonPath: string): boolean {
+  const experimentsPath: string = path.join(path.dirname(rushJsonPath), 'common', 'config', 'rush', 'experiments.json');
+  let contents: string;
+  try {
+    contents = fs.readFileSync(experimentsPath, 'utf8');
+  } catch {
+    return false;
+  }
+  const uncommented: string = contents.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  return /"useRushReporter"\s*:\s*true\b/.test(uncommented);
+}
+
+/** Finds `rush.json` in `startingFolder` or an ancestor without loading `@microsoft/rush-lib`. */
+export function findRushJsonPath(startingFolder: string): string | undefined {
+  let folder: string = path.resolve(startingFolder);
+  for (;;) {
+    const candidate: string = path.join(folder, 'rush.json');
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const parent: string = path.dirname(folder);
+    if (parent === folder) {
+      return undefined;
+    }
+    folder = parent;
+  }
+}
+
+export interface IClientOutputModeOptions {
+  readonly argv: ReadonlyArray<string>;
+  readonly environment: Readonly<Record<string, string | undefined>>;
+  /** Whether the repository opted into the native reporter (experiments.json `useRushReporter`). */
+  readonly useRushReporter?: boolean;
+}
+
+/**
+ * Selects the rush-client output mode. Requests that will use the native reporter path
+ * (explicit reporter controls, `--no-daemon`, or a `useRushReporter` repository) always use `legacy`,
+ * so that nothing is written ahead of native reporter output. Otherwise:
+ * 1. `RUSHD_OUTPUT=agent|legacy`
+ * 2. an active agent marker (`COPILOT_CLI`) selects `agent`
+ * 3. otherwise `legacy` (the unchanged default output)
+ */
+export function selectClientOutputMode(options: IClientOutputModeOptions): ClientOutputMode {
+  const { argv, environment } = options;
+  const separator: number = argv.indexOf('--');
+  const prefix: ReadonlyArray<string> = separator < 0 ? argv : argv.slice(0, separator);
+  if (options.useRushReporter || prefix.includes('--no-daemon') || hasExplicitReporterControls(argv, environment)) {
+    return 'legacy';
+  }
+  const explicit: string | undefined = environment[RUSHD_OUTPUT_ENV_VAR]?.trim().toLowerCase();
+  if (explicit === 'agent' || explicit === 'legacy') {
+    return explicit;
+  }
+  return AGENT_MARKERS.some((name) => isActive(environment[name])) ? 'agent' : 'legacy';
+}
\ No newline at end of file
diff --git a/apps/rush-cli-client/src/routing.ts b/apps/rush-cli-client/src/routing.ts
index 33b6c9418a..b9f8c52f84 100644
--- a/apps/rush-cli-client/src/routing.ts
+++ b/apps/rush-cli-client/src/routing.ts
@@ -6,6 +6,7 @@ import type { IRushXCommandLineArguments } from '@microsoft/rush-lib';
 
 import { loadRushLib } from './lazyRushModules';
 import { parseClientAdmissionControls, type IClientAdmissionControls } from './ClientAdmissionControls';
+import { isNativeReporterEnvironmentRequested } from './outputSelection';
 
 const neverDaemonize: ReadonlySet<string> = new Set([
   'add',
@@ -34,6 +35,8 @@ export interface IClientRouteOptions {
   readonly enabled: boolean;
   readonly rushx: boolean;
   readonly hasTerminal?: boolean;
+  /** The repository's experiments.json `useRushReporter` opt-in; such requests use the native reporter. */
+  readonly useRushReporter?: boolean;
 }
 
 export interface IClientRoute {
@@ -59,11 +62,12 @@ export function selectClientRoute(options: IClientRouteOptions): IClientRoute {
   const commandName: string | undefined = rushxArguments ? rushxArguments.commandName || undefined : argv[0];
   const reporterControls: boolean =
     options.environment.RUSH_LOG_LEVEL !== undefined ||
-    (options.environment.RUSH_REPORTER !== undefined && options.environment.RUSH_REPORTER !== 'legacy') ||
+    isNativeReporterEnvironmentRequested(options.environment.RUSH_REPORTER) ||
     (!options.rushx &&
       prefix.some((arg) =>
         ['--reporter', '--output', '--log-level'].some((name) => arg === name || arg.startsWith(`${name}=`))
-      ));
+      )) ||
+    (!options.rushx && !!options.useRushReporter);
   const ci: boolean = ['CI', 'TF_BUILD', 'GITHUB_ACTIONS', 'JENKINS_URL', 'TEAMCITY_VERSION'].some((key) => {
     const value: string | undefined = options.environment[key];
     return value !== undefined && value !== '' && value !== '0' && value !== 'false';
diff --git a/apps/rush-cli-client/src/start.ts b/apps/rush-cli-client/src/start.ts
index d940f3f82a..989adb4e9f 100644
--- a/apps/rush-cli-client/src/start.ts
+++ b/apps/rush-cli-client/src/start.ts
@@ -1,9 +1,40 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { launchClientAsync } from './launchClient';
+import { AgentProgressRenderer } from './AgentProgressRenderer';
+import {
+  findRushJsonPath,
+  getAgentCommandName,
+  readUseRushReporter,
+  selectClientOutputMode
+} from './outputSelection';
 
-launchClientAsync(false).catch((error: Error) => {
+const startTimeMs: number = Date.now();
+const argv: string[] = process.argv.slice(2);
+const commandName: string | undefined = getAgentCommandName(argv);
+const rushJsonPath: string | undefined = findRushJsonPath(process.cwd());
+// Write the agent status line before loading @microsoft/rush-lib (hundreds of milliseconds).
+const agentRenderer: AgentProgressRenderer | undefined =
+  selectClientOutputMode({
+    argv,
+    environment: process.env,
+    useRushReporter: !!rushJsonPath && readUseRushReporter(rushJsonPath)
+  }) === 'agent' &&
+  commandName !== undefined
+    ? new AgentProgressRenderer({
+        commandName,
+        isTTY: !!process.stdout.isTTY && process.env.TERM !== 'dumb',
+        columns: process.stdout.columns || 80,
+        write: (text: string) => process.stdout.write(text),
+        startTimeMs
+      })
+    : undefined;
+agentRenderer?.start();
+
+const { launchClientAsync } = require('./launchClient') as typeof import('./launchClient');
+
+launchClientAsync(false, agentRenderer).catch((error: Error) => {
+  agentRenderer?.finish({ exitCode: 1, errorMessage: error.message });
   process.stderr.write(`rush-client: ${error.message}\n`);
   process.exitCode = 1;
 });
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
new file mode 100644
index 0000000000..6a23fc2c5c
--- /dev/null
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -0,0 +1,199 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  type DaemonEventType,
+  type IDaemonEventEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+
+function event(type: DaemonEventType, payload: unknown): IDaemonEventEnvelope {
+  return {
+    eventId: 'event',
+    sessionId: 'session',
+    sequence: 1,
+    timestamp: new Date().toISOString(),
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    source: { packageName: 'test', packageVersion: '1.0.0' },
+    privacy: 'public',
+    required: false,
+    type,
+    payload
+  };
+}
+
+const ANSI_ESCAPE: RegExp = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`, 'g');
+
+function createRenderer(isTTY: boolean): { renderer: AgentProgressRenderer; output: string[]; clock: { ms: number } } {
+  const output: string[] = [];
+  const clock: { ms: number } = { ms: 0 };
+  const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+    commandName: 'build',
+    isTTY,
+    columns: 60,
+    write: (text: string) => output.push(text),
+    now: () => clock.ms,
+    startTimeMs: 0
+  });
+  return { renderer, output, clock };
+}
+
+function status(operationId: string, value: string): IDaemonEventEnvelope {
+  return event('operationStatusChanged', { operationId, previousStatus: 'READY', status: value });
+}
+
+describe(AgentProgressRenderer.name, () => {
+  it('writes a first line immediately and a bounded summary for a successful build (pipe)', () => {
+    const { renderer, output, clock } = createRenderer(false);
+    renderer.start();
+    expect(output).toEqual(['rush build · 0.0s · connecting to rushd (auto-starts if needed)\n']);
+    renderer.onEvent(event('operationRegistered', { operationId: 'a (build)', silent: false }));
+    renderer.onEvent(event('operationRegistered', { operationId: 'b (build)', silent: false }));
+    renderer.onEvent(event('operationRegistered', { operationId: 'hidden', silent: true }));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('noise\n'), 'a (build)', 'stdout');
+    clock.ms = 2500;
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onEvent(status('b (build)', 'SKIPPED'));
+    clock.ms = 3000;
+    renderer.finish({ exitCode: 0 });
+    renderer.dispose();
+    expect(output.join('')).not.toContain('noise');
+    expect(output[output.length - 1]).toBe(
+      'rush build: SUCCESS 2/2 operations (1 success, 1 skipped) in 3.0s\n'
+    );
+    expect(output.length).toBeLessThanOrEqual(4);
+  });
+
+  it('reports an up-to-date request instead of printing nothing', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.finish({ exitCode: 0 });
+    expect(output).toEqual(['rush build: SUCCESS up to date (no operations needed) in 0.0s\n']);
+  });
+
+  it('lists failed operations and a bounded stderr tail on failure', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(status('p05 (build)', 'EXECUTING'));
+    for (let i = 0; i < 20; i++) {
+      renderer.onLog(Buffer.from(`error ${i}\n`), 'p05 (build)', 'stderr');
+    }
+    renderer.onEvent(status('p05 (build)', 'FAILURE'));
+    renderer.onEvent(status('p06 (build)', 'BLOCKED'));
+    renderer.finish({ exitCode: 1 });
+    const text: string = output.join('');
+    expect(text).toContain('rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: p05 (build)\n');
+    expect(text).toContain('  p05 (build): error 10\n');
+    expect(text).toContain('  p05 (build): error 19\n');
+    expect(text).not.toContain('error 9\n');
+  });
+
+  it('keeps failure diagnostics when successful operations wrote stderr first', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(status('noisy (build)', 'EXECUTING'));
+    for (let i = 0; i < 20; i++) {
+      renderer.onLog(Buffer.from(`warning ${i}\n`), 'noisy (build)', 'stderr');
+    }
+    renderer.onEvent(status('noisy (build)', 'SUCCESS WITH WARNINGS'));
+    renderer.onEvent(status('broken (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('the real error\n'), 'broken (build)', 'stderr');
+    renderer.onEvent(status('broken (build)', 'FAILURE'));
+    renderer.finish({ exitCode: 1 });
+    const text: string = output.join('');
+    expect(text).toContain('  broken (build): the real error\n');
+    expect(text).not.toContain('noisy (build): warning');
+  });
+
+  it('counts ABORTED operations as finished', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(event('operationRegistered', { operationId: 'a (build)', silent: false }));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'ABORTED'));
+    renderer.finish({ exitCode: 1 });
+    expect(output[output.length - 1]).toBe('rush build: FAILURE 1/1 operations (1 aborted) in 0.0s\n');
+  });
+
+  it('writes the final line at most once and nothing after it', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.finish({ exitCode: 1, errorMessage: 'daemon rejected the request (x)' });
+    renderer.finish({ exitCode: 1, errorMessage: 'again' });
+    renderer.onQueuePosition(3);
+    renderer.dispose();
+    expect(output).toEqual(['rush build: FAILURE 0/0 operations in 0.0s · daemon rejected the request (x)\n']);
+  });
+
+  it('does not repeat an unchanged queue position', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onQueuePosition(2);
+    renderer.onQueuePosition(2);
+    renderer.onQueuePosition(2);
+    expect(output).toHaveLength(1);
+    renderer.onQueuePosition(1);
+    expect(output).toHaveLength(2);
+    renderer.dispose();
+  });
+
+  it('shows the stdout tail of a failed operation that reported errors on stdout', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(status('ok (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('ok noise\n'), 'ok (build)', 'stdout');
+    renderer.onEvent(status('ok (build)', 'SUCCESS'));
+    renderer.onEvent(status('tsc (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('src/x.ts(1,1): error TS1005: stdout-error\n'), 'tsc (build)', 'stdout');
+    renderer.onEvent(status('tsc (build)', 'FAILURE'));
+    renderer.finish({ exitCode: 1 });
+    const text: string = output.join('');
+    expect(text).toContain('  tsc (build): src/x.ts(1,1): error TS1005: stdout-error\n');
+    expect(text).not.toContain('ok noise');
+  });
+
+  it('shows queue position immediately', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onQueuePosition(2);
+    expect(output[0]).toContain('queued behind another request (position 2)');
+  });
+
+  it('writes a final summary line after a queued request completes', () => {
+    const { renderer, output, clock } = createRenderer(false);
+    renderer.start();
+    renderer.onQueuePosition(1);
+    clock.ms = 4000;
+    renderer.finish({ exitCode: 0 });
+    expect(output[output.length - 1]).toBe('rush build: SUCCESS up to date (no operations needed) in 4.0s\n');
+  });
+
+  it('throttles progress lines on a pipe', () => {
+    const { renderer, output, clock } = createRenderer(false);
+    renderer.start();
+    for (let i = 0; i < 50; i++) {
+      clock.ms = i * 10;
+      renderer.onEvent(status(`p${i} (build)`, 'EXECUTING'));
+    }
+    expect(output).toHaveLength(1);
+    clock.ms = 2500;
+    renderer.onEvent(status('p0 (build)', 'SUCCESS'));
+    expect(output).toHaveLength(2);
+    clock.ms = 3000;
+    renderer.onEvent(status('p1 (build)', 'SUCCESS'));
+    expect(output).toHaveLength(2);
+    renderer.dispose();
+  });
+
+  it('renders at most three live rows on a TTY and clears them before the summary', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    renderer.onEvent(status('a-very-long-project-name-that-will-not-fit (build)', 'EXECUTING'));
+    renderer.finish({ exitCode: 0 });
+    const frames: string[] = output.slice(0, -2);
+    for (const frame of frames) {
+      const rows: string[] = frame.replace(ANSI_ESCAPE, '').split('\n');
+      expect(rows.length).toBe(4); // three rows plus the trailing newline
+      for (const row of rows) {
+        expect(row.length).toBeLessThanOrEqual(59);
+      }
+    }
+    expect(output[output.length - 2]).toBe('\x1b[3A\x1b[0J\x1b[?25h');
+    expect(output[output.length - 1]).toContain('rush build: SUCCESS');
+  });
+});
diff --git a/apps/rush-cli-client/src/test/outputSelection.test.ts b/apps/rush-cli-client/src/test/outputSelection.test.ts
new file mode 100644
index 0000000000..23f11f467d
--- /dev/null
+++ b/apps/rush-cli-client/src/test/outputSelection.test.ts
@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  findRushJsonPath,
+  getAgentCommandName,
+  readUseRushReporter,
+  selectClientOutputMode
+} from '../outputSelection';
+
+describe(selectClientOutputMode.name, () => {
+  it.each([
+    { argv: ['build'], environment: {}, mode: 'legacy' },
+    { argv: ['build'], environment: { RUSHD_OUTPUT: 'agent' }, mode: 'agent' },
+    { argv: ['build'], environment: { RUSHD_OUTPUT: ' AGENT ' }, mode: 'agent' },
+    { argv: ['build'], environment: { COPILOT_CLI: '1' }, mode: 'agent' },
+    { argv: ['build'], environment: { COPILOT_CLI: 'false' }, mode: 'legacy' },
+    { argv: ['build'], environment: { COPILOT_CLI: '1', RUSHD_OUTPUT: 'legacy' }, mode: 'legacy' },
+    { argv: ['build'], environment: { CLAUDECODE: '1' }, mode: 'legacy' },
+    { argv: ['build'], environment: { COPILOT_CLI: '1', RUSH_REPORTER: 'legacy' }, mode: 'agent' },
+    { argv: ['build'], environment: { COPILOT_CLI: '1', RUSH_REPORTER: ' LEGACY ' }, mode: 'agent' },
+    // Explicit reporter controls always keep the native reporter path, and nothing is written ahead of it.
+    { argv: ['build', '--reporter=ai'], environment: { RUSHD_OUTPUT: 'agent' }, mode: 'legacy' },
+    { argv: ['build', '--reporter', 'ai'], environment: { COPILOT_CLI: '1' }, mode: 'legacy' },
+    { argv: ['build', '--reporter=ai', '--no-daemon'], environment: { COPILOT_CLI: '1' }, mode: 'legacy' },
+    { argv: ['build', '--no-daemon'], environment: { RUSHD_OUTPUT: 'agent' }, mode: 'legacy' },
+    { argv: ['build', '--output', 'x.log'], environment: { RUSHD_OUTPUT: 'agent' }, mode: 'legacy' },
+    { argv: ['build'], environment: { RUSHD_OUTPUT: 'agent', RUSH_REPORTER: 'ai' }, mode: 'legacy' },
+    { argv: ['build'], environment: { RUSHD_OUTPUT: 'agent', RUSH_LOG_LEVEL: 'debug' }, mode: 'legacy' },
+    { argv: ['build', '--', '--reporter=ai'], environment: { RUSHD_OUTPUT: 'agent' }, mode: 'agent' }
+  ])('selects $mode for $argv with $environment', ({ argv, environment, mode }) => {
+    expect(selectClientOutputMode({ argv, environment })).toBe(mode);
+  });
+
+  it('keeps useRushReporter repositories on the native reporter output', () => {
+    expect(
+      selectClientOutputMode({ argv: ['build'], environment: { COPILOT_CLI: '1' }, useRushReporter: true })
+    ).toBe('legacy');
+  });
+});
+
+describe(getAgentCommandName.name, () => {
+  it.each([
+    { argv: ['build'], commandName: 'build' },
+    { argv: ['--wait-timeout', '1.25', 'build'], commandName: 'build' },
+    { argv: ['--wait-timeout=2', 'build', '-t', 'a'], commandName: 'build' },
+    { argv: ['--no-wait', 'rebuild'], commandName: 'rebuild' },
+    { argv: ['--', 'build'], commandName: undefined },
+    { argv: ['-q', 'build'], commandName: undefined },
+    { argv: ['daemon', 'status'], commandName: undefined },
+    { argv: ['build', '--help'], commandName: undefined },
+    { argv: ['build', '-h'], commandName: undefined },
+    { argv: ['build', '--', '--help'], commandName: 'build' },
+    { argv: [], commandName: undefined }
+  ])('returns $commandName for $argv', ({ argv, commandName }) => {
+    expect(getAgentCommandName(argv)).toBe(commandName);
+  });
+});
+
+describe(readUseRushReporter.name, () => {
+  let folder: string;
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-selection-'));
+    fs.writeFileSync(path.join(folder, 'rush.json'), '{}');
+    fs.mkdirSync(path.join(folder, 'common', 'config', 'rush'), { recursive: true });
+  });
+  afterEach(() => fs.rmSync(folder, { recursive: true, force: true }));
+
+  function write(contents: string): void {
+    fs.writeFileSync(path.join(folder, 'common', 'config', 'rush', 'experiments.json'), contents);
+  }
+
+  it('reads the opt-in and ignores commented-out settings', () => {
+    const rushJsonPath: string = path.join(folder, 'rush.json');
+    expect(readUseRushReporter(rushJsonPath)).toBe(false);
+    write('{\n  // "useRushReporter": true,\n  /* "useRushReporter": true */\n}\n');
+    expect(readUseRushReporter(rushJsonPath)).toBe(false);
+    write('{ "useRushReporter": false }');
+    expect(readUseRushReporter(rushJsonPath)).toBe(false);
+    write('{\n  "useRushReporter": true\n}\n');
+    expect(readUseRushReporter(rushJsonPath)).toBe(true);
+  });
+
+  it('finds rush.json from a nested folder', () => {
+    const nested: string = path.join(folder, 'common', 'config');
+    expect(findRushJsonPath(nested)).toBe(path.join(folder, 'rush.json'));
+  });
+});
\ No newline at end of file
diff --git a/apps/rush-cli-client/src/test/routing.test.ts b/apps/rush-cli-client/src/test/routing.test.ts
index b71a98a4e6..0bac92c254 100644
--- a/apps/rush-cli-client/src/test/routing.test.ts
+++ b/apps/rush-cli-client/src/test/routing.test.ts
@@ -16,6 +16,7 @@ describe('opt-in routing', () => {
     { argv: ['build', '--log-level=debug'], enabled: true, environment: {}, daemon: false },
     { argv: ['build'], enabled: true, environment: { RUSH_REPORTER: 'json' }, daemon: false },
     { argv: ['build'], enabled: true, environment: { RUSH_REPORTER: 'legacy' }, daemon: true },
+    { argv: ['build'], enabled: true, environment: { RUSH_REPORTER: ' LEGACY ' }, daemon: true },
     { argv: ['install'], enabled: true, environment: { RUSH_DAEMON: '1' }, daemon: true },
     { argv: ['update'], enabled: true, environment: { RUSH_DAEMON: '1' }, daemon: true },
     { argv: ['install', '--no-daemon'], enabled: true, environment: { RUSH_DAEMON: '1' }, daemon: false },
@@ -23,11 +24,30 @@ describe('opt-in routing', () => {
     { argv: ['publish'], enabled: true, environment: { RUSH_DAEMON: '1' }, daemon: false },
     { argv: ['daemon', 'status'], enabled: true, environment: {}, daemon: false },
     { argv: ['--help'], enabled: true, environment: {}, daemon: false },
-    { argv: ['build', '--help'], enabled: true, environment: {}, daemon: false }
+    { argv: ['build', '--help'], enabled: true, environment: {}, daemon: false },
+    { argv: ['build', '--reporter=ai'], enabled: true, environment: {}, daemon: false },
+    { argv: ['build', '--reporter', 'ai'], enabled: true, environment: {}, daemon: false },
+    { argv: ['build', '--reporter=ai', '--no-daemon'], enabled: true, environment: {}, daemon: false },
+    { argv: ['build'], enabled: true, environment: { RUSH_REPORTER: 'ai' }, daemon: false },
+    { argv: ['build'], enabled: true, environment: {}, useRushReporter: true, daemon: false },
+    { argv: ['build'], enabled: true, environment: {}, useRushReporter: false, daemon: true }
   ])('selects $daemon for $argv', ({ daemon, ...options }) => {
     expect(selectClientRoute({ ...options, rushx: false }).daemon).toBe(daemon);
   });
 
+  it('forwards an explicit AI reporter flag unchanged to the native path', () => {
+    expect(
+      selectClientRoute({ argv: ['build', '--reporter', 'ai'], enabled: true, environment: {}, rushx: false })
+    ).toMatchObject({ argv: ['build', '--reporter', 'ai'], daemon: false });
+  });
+
+  it('ignores useRushReporter for rushx scripts', () => {
+    expect(
+      selectClientRoute({ argv: ['build'], enabled: true, environment: {}, rushx: true, useRushReporter: true })
+        .daemon
+    ).toBe(true);
+  });
+
   it('preserves script arguments after -- and permits scripts named like built-ins', () => {
     expect(
       selectClientRoute({
diff --git a/common/changes/@rushstack/rush-cli-client/agent-reporter_2026-09-24-02-35.json b/common/changes/@rushstack/rush-cli-client/agent-reporter_2026-09-24-02-35.json
new file mode 100644
index 0000000000..97bc13b49c
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-reporter_2026-09-24-02-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Add an opt-in agent output mode on the daemon path (RUSHD_OUTPUT=agent or COPILOT_CLI) with an immediate first line, bounded live progress, and a guaranteed final summary; keep repositories that opt into useRushReporter on the native reporter path.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 8c34d131a3271c6dceb74b0537d7f807115c8c21 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:17:54 -0700
Subject: [PATCH 008/265] [rush-daemon] Run rushx scripts without exclusive
 admission and complete on child exit (#6091)

* [rush-daemon] Run rushx scripts without exclusive admission and complete on child exit

Fixes #6085

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-cli-client] Update rushx tests for admission-free script execution

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Keep close-based child completion on Windows

Windows cannot recover a child's descendants after it exits, so closing pipes remain the only signal that native install/update workers have finished.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Scope post-exit output drain progress to each child

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../src/test/RushXDaemonAlias.test.ts         |  29 +--
 .../src/test/RushXDaemonBoundaries.test.ts    |  25 +--
 .../src/test/pipedInput.test.ts               |  14 +-
 .../rushx-admission-6085_2026-09-24.json      |  10 +
 common/reviews/api/rush-daemon.api.md         |   4 +
 .../src/DaemonRequestDispatcher.ts            |   1 +
 .../src/GlobalCommandExecutionContext.ts      | 138 +++++++++++---
 .../rush-daemon/src/GlobalCommandRequest.ts   |   5 +
 .../src/GlobalCommandRequestRouter.ts         |  35 ++--
 .../test/GlobalCommandRequestRouter.test.ts   | 177 ++++++++++++++++++
 10 files changed, 354 insertions(+), 84 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/rushx-admission-6085_2026-09-24.json

diff --git a/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts b/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
index 7c6a4361be..b8f81115f6 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
@@ -128,7 +128,7 @@ console.log(JSON.stringify({
     expect(result.stdout.length).toBe(0);
   });
 
-  it('pins physical request identity when an alias changes while waiting for admission', async () => {
+  it('runs through an alias without waiting for admission behind an exclusive request', async () => {
     fixture.write(
       'retargeted/projects/a/package.json',
       JSON.stringify({
@@ -163,33 +163,16 @@ console.log(JSON.stringify({
       invocationKind: 'rush'
     });
     await holding;
-    const input: PassThrough = new PassThrough();
-    input.end('not consumed before execution');
+    const onQueuePositionAsync = jest.fn(async () => undefined);
     try {
       const result = await fixture.runAsync(
         fixture.request(['-q', 'build'], path.join(aliasRoot, 'projects/a')),
         undefined,
-        {
-          stdin: input,
-          onQueuePositionAsync: async () => {
-            fs.unlinkSync(aliasRoot);
-            fs.symlinkSync(
-              path.join(physicalRoot, 'retargeted'),
-              aliasRoot,
-              process.platform === 'win32' ? 'junction' : 'dir'
-            );
-            release();
-          }
-        }
+        { onQueuePositionAsync }
       );
-      if (process.platform === 'win32') {
-        expect(result.outcome).toMatchObject({
-          kind: 'result',
-          result: { exitCode: 1, errorMessage: expect.stringContaining('invocation directory changed') }
-        });
-        expect(input.read().toString()).toBe('not consumed before execution');
-      } else {
-        expect(result.exitCode).toBe(0);
+      expect(result.exitCode).toBe(0);
+      expect(onQueuePositionAsync).not.toHaveBeenCalled();
+      if (process.platform !== 'win32') {
         expect(JSON.parse(result.stdout.toString()).cwd).toBe(path.join(physicalRoot, 'projects/a'));
       }
       expect(fs.existsSync(path.join(physicalRoot, 'retargeted/projects/a/executed'))).toBe(false);
diff --git a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
index 451373461d..ecb58c4df2 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
@@ -156,7 +156,7 @@ describe('native Rushx execution boundaries', () => {
     }
   );
 
-  it('fails visibly without running or reading when hooks change during queue admission', async () => {
+  it('runs a script without queueing behind an exclusive workspace request', async () => {
     const cwd: string = await startAsync();
     let release: () => void = () => {};
     let started: () => void = () => {};
@@ -177,25 +177,14 @@ describe('native Rushx execution boundaries', () => {
     });
     const holder = fixture.runAsync({ ...fixture.request(['hold'], cwd), invocationKind: 'rush' });
     await holding;
-    const stdin: PassThrough = new PassThrough();
-    stdin.end('not-consumed');
+    const onQueuePositionAsync = jest.fn(async () => undefined);
     try {
-      const result = await fixture.runAsync(fixture.request(['build'], cwd), undefined, {
-        stdin,
-        onQueuePositionAsync: async () => {
-          const file: string = path.join(fixture.folder, 'rush.json');
-          const config = JSON.parse(fs.readFileSync(file, 'utf8'));
-          fixture.write(
-            'rush.json',
-            JSON.stringify({ ...config, eventHooks: { preRushx: ['node hook.cjs'] } })
-          );
-          release();
-        }
+      const result = await fixture.runAsync(fixture.request(['-q', 'build'], cwd), undefined, {
+        onQueuePositionAsync
       });
-      expect(result.outcome).toMatchObject({ kind: 'result', result: { exitCode: 1, outcome: 'failure' } });
-      expect(result.stderr.toString()).toContain('Rush configuration changed');
-      expect(stdin.read().toString()).toBe('not-consumed');
-      expect(fs.existsSync(path.join(cwd, 'runs.txt'))).toBe(false);
+      expect(result.outcome).toMatchObject({ kind: 'result', result: { exitCode: 0, outcome: 'success' } });
+      expect(onQueuePositionAsync).not.toHaveBeenCalled();
+      expect(fs.readFileSync(path.join(cwd, 'runs.txt'), 'utf8')).toBe('ran\n');
     } finally {
       release();
       await holder;
diff --git a/apps/rush-cli-client/src/test/pipedInput.test.ts b/apps/rush-cli-client/src/test/pipedInput.test.ts
index aac77051f4..0de06c1cc3 100644
--- a/apps/rush-cli-client/src/test/pipedInput.test.ts
+++ b/apps/rush-cli-client/src/test/pipedInput.test.ts
@@ -132,11 +132,11 @@ describe('standalone client piped input', () => {
   );
 
   it.each([
-    { args: ['--no-wait'], admission: { noWait: true }, reason: 'no-wait' },
-    { args: ['--wait-timeout=0.01'], admission: { waitTimeoutMs: 10 }, reason: 'wait-timeout' }
+    { args: ['--no-wait'], admission: { noWait: true } },
+    { args: ['--wait-timeout=0.01'], admission: { waitTimeoutMs: 10 } }
   ])(
-    'forwards $args without leaking queue flags to scripts',
-    async ({ args, admission, reason }) => {
+    'forwards $args without leaking queue flags to scripts, which do not queue for admission',
+    async ({ args, admission }) => {
       let started: () => void = () => {};
       let release: () => void = () => {};
       const running: Promise<void> = new Promise((resolve) => {
@@ -178,9 +178,9 @@ describe('standalone client piped input', () => {
           })
         ]);
         const result: IPipedResult = await invokeAsync(Buffer.alloc(0), true, args);
-        expect(result.code).toBe(1);
-        expect(result.stderr.toString()).toContain(`daemon admission failed (${reason})`);
-        expect(runScriptAsync).not.toHaveBeenCalled();
+        expect(result.code).toBe(0);
+        expect(result.stderr.toString()).not.toContain('daemon admission failed');
+        expect(runScriptAsync).toHaveBeenCalledTimes(1);
       } finally {
         release();
         await holding;
diff --git a/common/changes/@rushstack/rush-daemon/rushx-admission-6085_2026-09-24.json b/common/changes/@rushstack/rush-daemon/rushx-admission-6085_2026-09-24.json
new file mode 100644
index 0000000000..413e48926e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushx-admission-6085_2026-09-24.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Run Rushx package scripts without exclusive workspace admission, complete global command requests on child exit plus a bounded output drain, and terminate an exited child's process group on cancellation.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index dfb68a7841..fd40da63ca 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -7,6 +7,7 @@
 /// <reference types="node" />
 
 import * as childProcess from 'node:child_process';
+import type { DaemonInvocationKind } from '@rushstack/rush-daemon-protocol';
 import type { DaemonRushCommandOrigin } from '@rushstack/rush-daemon-protocol';
 import type { DaemonTerminalRequirement } from '@rushstack/rush-daemon-protocol';
 import * as fs from 'node:fs';
@@ -435,6 +436,8 @@ export interface IResolvedGlobalCommandRequest {
     // (undocumented)
     readonly environment: IGlobalCommandEnvironment;
     // (undocumented)
+    readonly invocationKind?: DaemonInvocationKind;
+    // (undocumented)
     readonly requestId: string;
     // (undocumented)
     readonly terminal: IGlobalCommandTerminalProperties;
@@ -452,6 +455,7 @@ export interface IResolveGlobalCommandRequestOptions {
     readonly cwd: string;
     // (undocumented)
     readonly environment: Readonly<NodeJS.ProcessEnv>;
+    readonly invocationKind?: DaemonInvocationKind;
     // (undocumented)
     readonly requestId: string;
     // (undocumented)
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index e78e631731..d984b44f91 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -201,6 +201,7 @@ async function dispatchWorkspaceRequestAsync(
     commandOrigin: isRushxInvocation(envelope) ? 'custom' : envelope.commandOrigin,
     cwd: envelope.cwd,
     environment: envelope.environment,
+    invocationKind: isRushxInvocation(envelope) ? 'rushx' : 'rush',
     requestId: envelope.requestId,
     terminal: {
       ...envelope.terminal,
diff --git a/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts b/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
index bbdfa7ef93..c2cffbb35a 100644
--- a/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
+++ b/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
@@ -27,6 +27,11 @@ import { waitForLinuxProcessGroupExitAsync } from './LinuxProcessGroupExit';
 import { recordWorkspaceRequestCleanupFailure } from './WorkspaceRequestResources';
 
 const MAX_PENDING_TERMINAL_BYTES: number = 1024 * 1024;
+/**
+ * How long an exited child's output pipes may stay idle before they are destroyed. A pipe that is still held open by
+ * a descendant must not keep the request (and its client) waiting indefinitely.
+ */
+const CHILD_OUTPUT_DRAIN_IDLE_TIMEOUT_MS: number = 250;
 
 /**
  * Options for a request-scoped child process.
@@ -160,6 +165,12 @@ interface ITrackedChild {
   readonly completion: Promise<void>;
 }
 
+/** Forwarding activity for one child's output, used to bound its post-exit drain. */
+interface IChildOutputProgress {
+  events: number;
+  pendingWrites: number;
+}
+
 export class GlobalCommandExecutionContext implements IGlobalCommandExecutionContext, AsyncDisposable {
   readonly #abortController: AbortController = new AbortController();
   readonly #client: IGlobalCommandRequestClient;
@@ -260,18 +271,22 @@ export class GlobalCommandExecutionContext implements IGlobalCommandExecutionCon
       windowsHide: options.windowsHide
     });
     SubprocessTerminator.killProcessTreeOnExit(child, SubprocessTerminator.RECOMMENDED_OPTIONS);
-    const completion: Promise<void> = this.#trackChildAsync(child).catch((error: unknown) => {
-      this.#childCompletionErrors.push(error);
-    });
+    const outputProgress: IChildOutputProgress | undefined =
+      options.forwardOutput !== false ? { events: 0, pendingWrites: 0 } : undefined;
+    const completion: Promise<void> = this.#trackChildAsync(child, outputProgress).catch(
+      (error: unknown) => {
+        this.#childCompletionErrors.push(error);
+      }
+    );
     const trackedChild: ITrackedChild = { completion };
     this.#trackedChildren.add(trackedChild);
     void completion.then(() => this.#trackedChildren.delete(trackedChild));
     if (options.forwardInput === true) {
       this.#attachChildInput(child);
     }
-    if (options.forwardOutput !== false) {
-      this.#forwardChildOutput(child.stdout, 'stdout');
-      this.#forwardChildOutput(child.stderr, 'stderr');
+    if (outputProgress) {
+      this.#forwardChildOutput(child.stdout, 'stdout', outputProgress);
+      this.#forwardChildOutput(child.stderr, 'stderr', outputProgress);
     }
     return child;
   }
@@ -339,33 +354,34 @@ export class GlobalCommandExecutionContext implements IGlobalCommandExecutionCon
     this.#abortController.abort(reason);
   }
 
-  async #trackChildAsync(child: childProcess.ChildProcessWithoutNullStreams): Promise<void> {
-    const terminateChild = (): void => {
-      try {
-        SubprocessTerminator.killProcessTree(child, SubprocessTerminator.RECOMMENDED_OPTIONS);
-      } catch (error) {
-        this.#childTerminationErrors.push(this.#recordResourceCleanupFailure(error));
-        try {
-          child.kill('SIGKILL');
-        } catch (fallbackError) {
-          this.#childTerminationErrors.push(this.#recordResourceCleanupFailure(fallbackError));
-        }
-      }
-    };
+  async #trackChildAsync(
+    child: childProcess.ChildProcessWithoutNullStreams,
+    outputProgress: IChildOutputProgress | undefined
+  ): Promise<void> {
+    const terminateChild = (): void => this.#terminateChild(child);
     this.abortSignal.addEventListener('abort', terminateChild, { once: true });
     let childError: Error | undefined;
     try {
+      // On POSIX, complete on 'exit' rather than 'close': a background descendant may inherit and hold the output
+      // pipes open, and the child's process group is killed below. Windows cannot recover descendants after the child
+      // exits, so the pipes closing remains the only signal that the child's descendants have exited.
       await new Promise<void>((resolve) => {
         child.once('error', (error: Error) => {
           childError = error;
         });
+        if (process.platform !== 'win32') {
+          child.once('exit', () => resolve());
+        }
         child.once('close', () => resolve());
       });
+      terminateExitedChildProcessGroup(child);
+      await this.#drainChildOutputAsync(child, outputProgress);
+    } catch (error) {
+      throw this.#recordResourceCleanupFailure(error);
     } finally {
       this.abortSignal.removeEventListener('abort', terminateChild);
     }
     try {
-      terminateExitedChildProcessGroup(child);
       if (process.platform === 'linux' && child.pid !== undefined) {
         await waitForLinuxProcessGroupExitAsync(child.pid);
       }
@@ -375,18 +391,94 @@ export class GlobalCommandExecutionContext implements IGlobalCommandExecutionCon
     if (childError) throw childError;
   }
 
+  /**
+   * Terminates the child's whole process tree.
+   *
+   * @remarks
+   * `SubprocessTerminator.killProcessTree` is a no-op once the direct child has exited, which would leave its
+   * surviving process group running, so an exited child's group is signalled directly.
+   */
+  #terminateChild(child: childProcess.ChildProcessWithoutNullStreams): void {
+    try {
+      if (hasChildExited(child)) {
+        terminateExitedChildProcessGroup(child);
+      } else {
+        SubprocessTerminator.killProcessTree(child, SubprocessTerminator.RECOMMENDED_OPTIONS);
+      }
+    } catch (error) {
+      this.#childTerminationErrors.push(this.#recordResourceCleanupFailure(error));
+      try {
+        child.kill('SIGKILL');
+      } catch (fallbackError) {
+        this.#childTerminationErrors.push(this.#recordResourceCleanupFailure(fallbackError));
+      }
+    }
+  }
+
+  /**
+   * Waits for output that the exited child left in its pipes.
+   *
+   * @remarks
+   * Forwarded output is drained until its pipes close or stay idle for a bounded time; the deadline is extended only
+   * while this child's own output is still being forwarded, so a slow client does not truncate it and unrelated output
+   * cannot keep the drain open. An idle pipe, for example one held by a descendant outside the child's process group,
+   * is then destroyed. Output that the caller consumes itself is not forwarded, so its progress cannot be observed;
+   * those pipes are awaited until they close or the request aborts.
+   */
+  async #drainChildOutputAsync(
+    child: childProcess.ChildProcessWithoutNullStreams,
+    progress: IChildOutputProgress | undefined
+  ): Promise<void> {
+    if (child.stdout.closed && child.stderr.closed) {
+      return;
+    }
+    let lastEvents: number | undefined = progress?.events;
+    await new Promise<void>((resolve) => {
+      let timer: NodeJS.Timeout | undefined;
+      const finish = (): void => {
+        clearTimeout(timer);
+        this.abortSignal.removeEventListener('abort', finish);
+        resolve();
+      };
+      const check = (): void => {
+        const events: number | undefined = progress?.events;
+        const progressed: boolean = events !== lastEvents || (progress?.pendingWrites ?? 0) > 0;
+        if (!progressed || this.abortSignal.aborted) {
+          finish();
+        } else {
+          lastEvents = events;
+          timer = setTimeout(check, CHILD_OUTPUT_DRAIN_IDLE_TIMEOUT_MS);
+        }
+      };
+      child.once('close', finish);
+      this.abortSignal.addEventListener('abort', finish, { once: true });
+      if (this.abortSignal.aborted) {
+        finish();
+      } else if (progress) {
+        timer = setTimeout(check, CHILD_OUTPUT_DRAIN_IDLE_TIMEOUT_MS);
+      }
+    });
+    child.stdout.destroy();
+    child.stderr.destroy();
+  }
+
   #recordResourceCleanupFailure(error: unknown): Error {
     return recordWorkspaceRequestCleanupFailure(this.workspaceSession, this.#request.requestId, error);
   }
 
   #forwardChildOutput(
     source: NodeJS.ReadableStream & { pause(): unknown; resume(): unknown },
-    stream: 'stdout' | 'stderr'
+    stream: 'stdout' | 'stderr',
+    progress: IChildOutputProgress
   ): void {
     source.on('data', (chunk: Buffer | string) => {
       source.pause();
       const bytes: Uint8Array = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+      progress.events++;
+      progress.pendingWrites++;
       void this.#writer.writeAsync(stream, bytes).then(() => {
+        progress.events++;
+        progress.pendingWrites--;
         if (!this.abortSignal.aborted) {
           source.resume();
         }
@@ -402,6 +494,10 @@ export class GlobalCommandExecutionContext implements IGlobalCommandExecutionCon
   }
 }
 
+function hasChildExited(child: childProcess.ChildProcess): boolean {
+  return child.exitCode !== null || child.signalCode !== null;
+}
+
 function terminateExitedChildProcessGroup(child: childProcess.ChildProcessWithoutNullStreams): void {
   if (process.platform === 'win32' || child.pid === undefined) {
     return;
diff --git a/libraries/rush-daemon/src/GlobalCommandRequest.ts b/libraries/rush-daemon/src/GlobalCommandRequest.ts
index ed396b7dfd..0b41a05f27 100644
--- a/libraries/rush-daemon/src/GlobalCommandRequest.ts
+++ b/libraries/rush-daemon/src/GlobalCommandRequest.ts
@@ -7,6 +7,7 @@ import * as path from 'node:path';
 import { EnvironmentMap } from '@rushstack/node-core-library';
 import { validateDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 import type {
+  DaemonInvocationKind,
   DaemonRushCommandOrigin,
   DaemonTerminalRequirement,
   IDaemonRequestAdmissionOptions
@@ -48,6 +49,8 @@ export interface IResolveGlobalCommandRequestOptions {
   readonly commandOrigin: DaemonRushCommandOrigin;
   readonly cwd: string;
   readonly environment: Readonly<NodeJS.ProcessEnv>;
+  /** Whether the request runs a Rush command or a Rushx package script. Defaults to `rush`. */
+  readonly invocationKind?: DaemonInvocationKind;
   readonly requestId: string;
   readonly terminal: IGlobalCommandTerminalProperties;
 }
@@ -63,6 +66,7 @@ export interface IResolvedGlobalCommandRequest {
   readonly commandOrigin: DaemonRushCommandOrigin;
   readonly cwd: string;
   readonly environment: IGlobalCommandEnvironment;
+  readonly invocationKind?: DaemonInvocationKind;
   readonly requestId: string;
   readonly terminal: IGlobalCommandTerminalProperties;
 }
@@ -101,6 +105,7 @@ export function resolveGlobalCommandRequest(
     commandOrigin: options.commandOrigin,
     cwd,
     environment: new GlobalCommandEnvironment(options.environment),
+    invocationKind: options.invocationKind === 'rushx' ? 'rushx' : 'rush',
     requestId: options.requestId,
     terminal: resolveTerminalProperties(options.terminal)
   });
diff --git a/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts b/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts
index 8ce2d4a61f..95cbb69c35 100644
--- a/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts
+++ b/libraries/rush-daemon/src/GlobalCommandRequestRouter.ts
@@ -97,20 +97,25 @@ export class GlobalCommandRequestRouter {
       throw new DaemonRequiresInProcessError(policy);
     }
     let admissionController: RequestAdmissionController | undefined;
-    let lease: IRequestLease;
+    let lease: IRequestLease | undefined;
     try {
-      admissionController = new RequestAdmissionController({
-        admission: request.admission,
-        client,
-        requestId: request.requestId
-      });
-      lease = await admissionController.acquireAsync(
-        getWorkspaceRequestScheduler(this.#workspaceSession),
-        classifyRushCommand({
-          commandName: request.commandName,
-          commandOrigin: request.commandOrigin
-        })
-      );
+      // Rushx package scripts do not read or mutate daemon-owned workspace state after resolution, so they bypass
+      // workspace admission. Native rushx takes no workspace lock either, and holding a scheduler lease for the
+      // script's whole lifetime would serialize concurrent scripts and block unrelated builds (issue #6085).
+      if (request.invocationKind !== 'rushx') {
+        admissionController = new RequestAdmissionController({
+          admission: request.admission,
+          client,
+          requestId: request.requestId
+        });
+        lease = await admissionController.acquireAsync(
+          getWorkspaceRequestScheduler(this.#workspaceSession),
+          classifyRushCommand({
+            commandName: request.commandName,
+            commandOrigin: request.commandOrigin
+          })
+        );
+      }
     } catch (error) {
       admissionController?.dispose();
       return await finishAfterAdmissionErrorAsync(request.requestId, client, interactiveSession, error);
@@ -126,10 +131,10 @@ export class GlobalCommandRequestRouter {
           this.#workspaceSession
         );
       } finally {
-        lease.release();
+        lease?.release();
       }
     } finally {
-      admissionController.dispose();
+      admissionController?.dispose();
     }
   }
 }
diff --git a/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts b/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
index dc549b31f1..4fe768425a 100644
--- a/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
+++ b/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
@@ -466,6 +466,183 @@ describe(GlobalCommandRequestRouter.name, () => {
     }
   );
 
+  it('does not hold workspace admission for Rushx package scripts', async () => {
+    const session: TestWorkspaceSession = new TestWorkspaceSession(TEST_REPO_ROOT);
+    const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(session);
+    const exclusiveLease = await getWorkspaceRequestScheduler(session).acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      noWait: true
+    });
+    const bothStarted = createDeferred<void>();
+    let startedCount: number = 0;
+    const runScriptAsync = (requestId: string): Promise<IGlobalCommandRequestResult> =>
+      router.executeAsync(
+        router.resolveRequest({
+          ...createRequestOptions(requestId, FIRST_CWD, {}, 80),
+          invocationKind: 'rushx'
+        }),
+        async () => {
+          if (++startedCount === 2) bothStarted.resolve();
+          await bothStarted.promise;
+          return { exitCode: 0 };
+        },
+        new TestGlobalCommandClient()
+      );
+    try {
+      const results: IGlobalCommandRequestResult[] = await Promise.all([
+        runScriptAsync('script-1'),
+        runScriptAsync('script-2')
+      ]);
+      expect(results.map(({ outcome }) => outcome)).toEqual(['success', 'success']);
+      await expect(
+        router.executeAsync(
+          router.resolveRequest({
+            ...createRequestOptions('rush-custom', FIRST_CWD, {}, 80),
+            admission: { noWait: true }
+          }),
+          async () => ({ exitCode: 0 }),
+          new TestGlobalCommandClient()
+        )
+      ).resolves.toMatchObject({ outcome: 'failure' });
+    } finally {
+      exclusiveLease.release();
+    }
+  });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'completes on child exit when a background descendant holds the output pipes',
+    async () => {
+      const session: TestWorkspaceSession = new TestWorkspaceSession(TEST_REPO_ROOT);
+      const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(session);
+      const client: TestGlobalCommandClient = new TestGlobalCommandClient();
+      // The detached grandchild leaves the child's process group, so only the bounded pipe drain can release it.
+      const script: string = [
+        "const { spawn } = require('node:child_process');",
+        "const grandchild = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 60000)'],",
+        "  { detached: true, stdio: 'inherit' });",
+        'grandchild.unref();',
+        "process.stdout.write('grandchild=' + grandchild.pid + '\\n');"
+      ].join('\n');
+      const startTime: number = Date.now();
+      const result: IGlobalCommandRequestResult = await router.executeAsync(
+        router.resolveRequest(createRequestOptions('background-descendant', FIRST_CWD, {}, 80)),
+        async (context) => {
+          const child = context.spawnChild(process.execPath, ['-e', script]);
+          const exitCode: number | null = await new Promise((resolve) =>
+            child.once('close', (code: number | null) => resolve(code))
+          );
+          return { exitCode: exitCode ?? 1 };
+        },
+        client
+      );
+      const output: string = client.chunks.map(({ text }) => text).join('');
+      const grandchildPid: number = Number(/grandchild=(\d+)/.exec(output)?.[1]);
+      try {
+        expect(grandchildPid).toBeGreaterThan(0);
+        expect(result).toMatchObject({ exitCode: 0, outcome: 'success' });
+        expect(Date.now() - startTime).toBeLessThan(30000);
+      } finally {
+        if (grandchildPid > 0) {
+          process.kill(grandchildPid, 'SIGKILL');
+        }
+      }
+    }
+  );
+
+  (process.platform === 'win32' ? it.skip : it)(
+    "does not extend an exited child's drain with another child's output",
+    async () => {
+      const session: TestWorkspaceSession = new TestWorkspaceSession(TEST_REPO_ROOT);
+      const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(session);
+      const client: TestGlobalCommandClient = new TestGlobalCommandClient();
+      const heldScript: string = [
+        "const { spawn } = require('node:child_process');",
+        "const grandchild = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 60000)'],",
+        "  { detached: true, stdio: 'inherit' });",
+        'grandchild.unref();',
+        "process.stdout.write('grandchild=' + grandchild.pid + '\\n');"
+      ].join('\n');
+      let heldCloseMs: number | undefined;
+      const result: IGlobalCommandRequestResult = await router.executeAsync(
+        router.resolveRequest(createRequestOptions('unrelated-output', FIRST_CWD, {}, 80)),
+        async (context) => {
+          const chatty = context.spawnChild(process.execPath, [
+            '-e',
+            "setInterval(() => process.stdout.write('.'), 20)"
+          ]);
+          const startTime: number = Date.now();
+          const held = context.spawnChild(process.execPath, ['-e', heldScript]);
+          await new Promise<void>((resolve) => held.once('close', () => resolve()));
+          heldCloseMs = Date.now() - startTime;
+          chatty.kill('SIGKILL');
+          await new Promise<void>((resolve) => chatty.once('close', () => resolve()));
+          return { exitCode: 0 };
+        },
+        client
+      );
+      const output: string = client.chunks.map(({ text }) => text).join('');
+      const grandchildPid: number = Number(/grandchild=(\d+)/.exec(output)?.[1]);
+      try {
+        expect(grandchildPid).toBeGreaterThan(0);
+        expect(result).toMatchObject({ outcome: 'success' });
+        expect(heldCloseMs).toBeLessThan(10000);
+      } finally {
+        if (grandchildPid > 0) {
+          process.kill(grandchildPid, 'SIGKILL');
+        }
+      }
+    },
+    30000
+  );
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'terminates the process group on cancellation after the direct child exited',
+    async () => {
+      const session: TestWorkspaceSession = new TestWorkspaceSession(TEST_REPO_ROOT);
+      const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(session);
+      const client: TestGlobalCommandClient = new TestGlobalCommandClient();
+      const killProcessTreeSpy: jest.SpyInstance = jest.spyOn(SubprocessTerminator, 'killProcessTree');
+      const processKillSpy: jest.SpyInstance = jest.spyOn(process, 'kill');
+      const script: string = [
+        "const { spawn } = require('node:child_process');",
+        "const grandchild = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 60000)'],",
+        "  { detached: true, stdio: 'inherit' });",
+        'grandchild.unref();',
+        "process.stdout.write('grandchild=' + grandchild.pid + '\\n');"
+      ].join('\n');
+      let childPid: number | undefined;
+      let output: string = '';
+      try {
+        const result: IGlobalCommandRequestResult = await router.executeAsync(
+          router.resolveRequest(createRequestOptions('cancel-after-exit', FIRST_CWD, {}, 80)),
+          async (context) => {
+            const child = context.spawnChild(process.execPath, ['-e', script], { forwardOutput: false });
+            childPid = child.pid;
+            child.stdout.on('data', (chunk: Buffer) => {
+              output += chunk.toString();
+            });
+            await new Promise<void>((resolve) => child.once('exit', () => resolve()));
+            processKillSpy.mockClear();
+            client.abortController.abort(new Error('client cancelled'));
+            await new Promise<void>((resolve) => child.once('close', () => resolve()));
+            return { exitCode: 0 };
+          },
+          client
+        );
+        expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+        expect(killProcessTreeSpy).not.toHaveBeenCalled();
+        expect(processKillSpy).toHaveBeenCalledWith(-(childPid ?? 0), 'SIGKILL');
+      } finally {
+        killProcessTreeSpy.mockRestore();
+        processKillSpy.mockRestore();
+        const grandchildPid: number = Number(/grandchild=(\d+)/.exec(output)?.[1]);
+        if (grandchildPid > 0) {
+          process.kill(grandchildPid, 'SIGKILL');
+        }
+      }
+    }
+  );
+
   it('reports child spawn failures during request cleanup', async () => {
     const session: TestWorkspaceSession = new TestWorkspaceSession(TEST_REPO_ROOT);
     const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(session);

From 83922cad193b660b1487c33fede50a52451fb8d7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:18:06 -0700
Subject: [PATCH 009/265] [rush-daemon] Read Linux process group state from
 procfs instead of ps (#6087)

* [rush-daemon] Read Linux process group state from procfs instead of ps

Fixes #6072

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Bound procfs scans and never trust a scan with unreadable entries

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 ...process-group-checks_2026-09-24-03-00.json |  10 +
 .../rush-daemon/src/LinuxProcessGroupExit.ts  | 108 ++++++++++-
 .../src/test/LinuxProcessGroupExit.test.ts    | 182 +++++++++++++++++-
 .../test/NativeMutationCleanupFailure.test.ts |   6 +-
 4 files changed, 291 insertions(+), 15 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/fix-rushd-procfs-process-group-checks_2026-09-24-03-00.json

diff --git a/common/changes/@rushstack/rush-daemon/fix-rushd-procfs-process-group-checks_2026-09-24-03-00.json b/common/changes/@rushstack/rush-daemon/fix-rushd-procfs-process-group-checks_2026-09-24-03-00.json
new file mode 100644
index 0000000000..11fbf2beaf
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/fix-rushd-procfs-process-group-checks_2026-09-24-03-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "On Linux, verify that a rushx or global command's process group has exited by reading /proc instead of running `ps --sid`, so cleanup no longer fails (and retires the workspace session) on images without procps `ps` or with busybox `ps`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/LinuxProcessGroupExit.ts b/libraries/rush-daemon/src/LinuxProcessGroupExit.ts
index 5aa60f1c32..67b2181360 100644
--- a/libraries/rush-daemon/src/LinuxProcessGroupExit.ts
+++ b/libraries/rush-daemon/src/LinuxProcessGroupExit.ts
@@ -2,16 +2,42 @@
 // See LICENSE in the project root for license information.
 
 import { execFile } from 'node:child_process';
+import * as fs from 'node:fs';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
+const PROC_ROOT: string = '/proc';
+const PID_ENTRY_REGEXP: RegExp = /^\d+$/;
+// Indices into the fields that follow "(comm) " in /proc/<pid>/stat.
+const PROC_STAT_STATE_INDEX: number = 0;
+const PROC_STAT_SESSION_INDEX: number = 3;
+const PROC_STAT_READ_CONCURRENCY: number = 32;
+// Sentinel (never a real one-letter state) for a procfs entry that exists but cannot be read.
+const UNREADABLE_STATE: string = '<unreadable>';
 const DEFAULT_EXIT_TIMEOUT_MS: number = 5_000;
 const EXIT_POLL_INTERVAL_MS: number = 10;
 const MAX_TIMEOUT_MS: number = 0x7fffffff;
 
-/** Waits for a captured detached Linux group/session to disappear or contain only zombies. */
+/** Reads Linux procfs. Injectable so tests can simulate process tables or a missing procfs. */
+export interface ILinuxProcfsReader {
+  /** Lists the entries of the procfs root; rejects when procfs is unavailable. */
+  readonly listEntriesAsync: () => Promise<string[]>;
+  /** Reads `/proc/<pid>/stat`; rejects when the process has exited. */
+  readonly readStatAsync: (pid: string) => Promise<string>;
+}
+
+export const NODE_PROCFS_READER: ILinuxProcfsReader = {
+  listEntriesAsync: () => fs.promises.readdir(PROC_ROOT),
+  readStatAsync: (pid: string) => fs.promises.readFile(`${PROC_ROOT}/${pid}/stat`, 'utf8')
+};
+
+/**
+ * Waits for a captured detached Linux group/session to disappear or contain only zombies.
+ * Member states come from procfs; `ps --sid` is used only when procfs is unavailable.
+ */
 export async function waitForLinuxProcessGroupExitAsync(
   groupId: number,
-  timeoutMs: number = DEFAULT_EXIT_TIMEOUT_MS
+  timeoutMs: number = DEFAULT_EXIT_TIMEOUT_MS,
+  procfs: ILinuxProcfsReader = NODE_PROCFS_READER
 ): Promise<void> {
   if (!Number.isSafeInteger(groupId) || groupId <= 0 || groupId === process.pid) {
     throw new RangeError('Expected an owned child process group ID.');
@@ -25,7 +51,7 @@ export async function waitForLinuxProcessGroupExitAsync(
     if (remaining <= 0) {
       throw new Error(`Owned Linux process group ${groupId} did not exit within ${timeoutMs}ms.`);
     }
-    const states: string[] = await readSessionStatesAsync(groupId, remaining);
+    const states: string[] = await readSessionStatesAsync(groupId, remaining, procfs);
     if (states.length > 0 && states.every((state) => state.startsWith('Z'))) return;
     await delayAsync(Math.min(EXIT_POLL_INTERVAL_MS, remaining));
   }
@@ -44,7 +70,81 @@ function processGroupExists(groupId: number): boolean {
   }
 }
 
-function readSessionStatesAsync(groupId: number, timeoutMs: number): Promise<string[]> {
+async function readSessionStatesAsync(
+  groupId: number,
+  timeoutMs: number,
+  procfs: ILinuxProcfsReader
+): Promise<string[]> {
+  const states: string[] | undefined = await tryReadSessionStatesFromProcAsync(groupId, procfs);
+  return states ?? (await readSessionStatesFromPsAsync(groupId, timeoutMs));
+}
+
+/**
+ * Reads member states from procfs, which every Linux system has; `ps` is missing from slim/distroless images
+ * and busybox `ps` does not support `--sid`. Returns `undefined` when procfs is unavailable or an entry cannot
+ * be read, so the caller falls back to `ps`.
+ */
+async function tryReadSessionStatesFromProcAsync(
+  groupId: number,
+  procfs: ILinuxProcfsReader
+): Promise<string[] | undefined> {
+  let entries: string[];
+  try {
+    entries = await procfs.listEntriesAsync();
+  } catch {
+    return undefined;
+  }
+  const pids: string[] = entries.filter((entry: string) => PID_ENTRY_REGEXP.test(entry));
+  const states: string[] = [];
+  // Bound concurrent reads so a large process table cannot flood the shared libuv thread pool.
+  for (let start: number = 0; start < pids.length; start += PROC_STAT_READ_CONCURRENCY) {
+    const batch: (string | undefined)[] = await Promise.all(
+      pids
+        .slice(start, start + PROC_STAT_READ_CONCURRENCY)
+        .map((pid: string) => readSessionMemberStateAsync(pid, groupId, procfs))
+    );
+    for (const state of batch) {
+      if (state === undefined) continue;
+      // An unreadable entry could hide a live member, so procfs cannot prove the group exited.
+      if (state === UNREADABLE_STATE) return undefined;
+      // One live member already means "not exited"; only a zombies-only result needs a full scan.
+      if (!state.startsWith('Z')) return [state];
+      states.push(state);
+    }
+  }
+  return states;
+}
+
+/**
+ * Returns the member's state, `undefined` for a vanished PID or another session, or `UNREADABLE_STATE`
+ * when the entry cannot be read (for example `hidepid` or `EIO`) and so might hide a live member.
+ */
+async function readSessionMemberStateAsync(
+  pid: string,
+  groupId: number,
+  procfs: ILinuxProcfsReader
+): Promise<string | undefined> {
+  let stat: string;
+  try {
+    stat = await procfs.readStatAsync(pid);
+  } catch (error) {
+    return isProcessGoneError(error) ? undefined : UNREADABLE_STATE;
+  }
+  // Format: "pid (comm) state ppid pgrp session ..."; comm may contain spaces and parentheses.
+  const fields: string[] = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+  return Number(fields[PROC_STAT_SESSION_INDEX]) === groupId ? fields[PROC_STAT_STATE_INDEX] : undefined;
+}
+
+function isProcessGoneError(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error.code === 'ENOENT' || error.code === 'ESRCH')
+  );
+}
+
+function readSessionStatesFromPsAsync(groupId: number, timeoutMs: number): Promise<string[]> {
   return new Promise((resolve, reject) => {
     // detached=true creates a new process group and session with the child's PID.
     execFile(
diff --git a/libraries/rush-daemon/src/test/LinuxProcessGroupExit.test.ts b/libraries/rush-daemon/src/test/LinuxProcessGroupExit.test.ts
index 5d4af13f54..237854b90d 100644
--- a/libraries/rush-daemon/src/test/LinuxProcessGroupExit.test.ts
+++ b/libraries/rush-daemon/src/test/LinuxProcessGroupExit.test.ts
@@ -8,13 +8,17 @@ jest.mock('node:child_process', () => ({
 
 import * as childProcess from 'node:child_process';
 
-import { waitForLinuxProcessGroupExitAsync } from '../LinuxProcessGroupExit';
+import { type ILinuxProcfsReader, waitForLinuxProcessGroupExitAsync } from '../LinuxProcessGroupExit';
 
 const GROUP_ID: number = 123_456_789;
 const execFileMock = jest.mocked(childProcess.execFile);
 const gone = (): never => {
   throw Object.assign(new Error('No such process group'), { code: 'ESRCH' });
 };
+const NO_PROCFS: ILinuxProcfsReader = {
+  listEntriesAsync: () => Promise.reject(Object.assign(new Error('No procfs'), { code: 'ENOENT' })),
+  readStatAsync: () => Promise.reject(new Error('Unexpected procfs read'))
+};
 
 function reportPs(
   args: Parameters<typeof childProcess.execFile>,
@@ -28,7 +32,10 @@ function reportPs(
   return new childProcess.ChildProcess();
 }
 
-describe('Linux subprocess group completion', () => {
+describe('Linux subprocess group completion (ps fallback without procfs)', () => {
+  const waitAsync = (groupId: number, timeoutMs?: number): Promise<void> =>
+    waitForLinuxProcessGroupExitAsync(groupId, timeoutMs, NO_PROCFS);
+
   beforeEach(() => {
     execFileMock.mockReset();
     jest.spyOn(process, 'kill').mockReturnValue(true);
@@ -40,14 +47,14 @@ describe('Linux subprocess group completion', () => {
 
   it('avoids process inspection when the captured group has disappeared', async () => {
     jest.mocked(process.kill).mockImplementation(gone);
-    await waitForLinuxProcessGroupExitAsync(GROUP_ID);
+    await waitAsync(GROUP_ID);
     expect(execFileMock).not.toHaveBeenCalled();
   });
 
   it('waits for live members rather than treating signal delivery as completion', async () => {
     let queries: number = 0;
     execFileMock.mockImplementation((...args) => reportPs(args, ++queries === 1 ? 'R\nZ\n' : 'Z\nZ\n'));
-    await waitForLinuxProcessGroupExitAsync(GROUP_ID);
+    await waitAsync(GROUP_ID);
     expect(queries).toBe(2);
     expect(
       jest.mocked(process.kill).mock.calls.every(([pid, signal]) => pid === -GROUP_ID && signal === 0)
@@ -59,19 +66,19 @@ describe('Linux subprocess group completion', () => {
     execFileMock.mockImplementation((...args) =>
       reportPs(args, '', Object.assign(new Error('No matching processes'), { code: 1 }))
     );
-    await waitForLinuxProcessGroupExitAsync(GROUP_ID);
+    await waitAsync(GROUP_ID);
     expect(process.kill).toHaveBeenCalledTimes(2);
   });
 
   it('surfaces inspection failures instead of completing cleanup', async () => {
     const failure = Object.assign(new Error('Cannot execute ps'), { code: 'ENOENT' });
     execFileMock.mockImplementation((...args) => reportPs(args, '', failure));
-    await expect(waitForLinuxProcessGroupExitAsync(GROUP_ID)).rejects.toBe(failure);
+    await expect(waitAsync(GROUP_ID)).rejects.toBe(failure);
   });
 
   it('rejects inspection diagnostics rather than trusting incomplete process state', async () => {
     execFileMock.mockImplementation((...args) => reportPs(args, 'Z\n', undefined, 'inspection warning'));
-    await expect(waitForLinuxProcessGroupExitAsync(GROUP_ID)).rejects.toThrow('inspection warning');
+    await expect(waitAsync(GROUP_ID)).rejects.toThrow('inspection warning');
   });
 
   it('does not mistake permission denial for a released group', async () => {
@@ -79,16 +86,171 @@ describe('Linux subprocess group completion', () => {
     jest.mocked(process.kill).mockImplementation(() => {
       throw failure;
     });
-    await expect(waitForLinuxProcessGroupExitAsync(GROUP_ID)).rejects.toBe(failure);
+    await expect(waitAsync(GROUP_ID)).rejects.toBe(failure);
   });
 
   it('bounds the wait for members that remain live', async () => {
     execFileMock.mockImplementation((...args) => reportPs(args, 'S\n'));
-    await expect(waitForLinuxProcessGroupExitAsync(GROUP_ID, 25)).rejects.toThrow('did not exit within 25ms');
+    await expect(waitAsync(GROUP_ID, 25)).rejects.toThrow('did not exit within 25ms');
   });
 
   it.each([0, -1, 1.5, process.pid])('rejects invalid or unowned group ID %s', async (pid) => {
-    await expect(waitForLinuxProcessGroupExitAsync(pid)).rejects.toThrow('owned child process group');
+    await expect(waitAsync(pid)).rejects.toThrow('owned child process group');
     expect(process.kill).not.toHaveBeenCalled();
   });
 });
+
+describe('Linux subprocess group completion (procfs)', () => {
+  const procStat = (pid: number, state: string, session: number): string =>
+    `${pid} (sh -c (x) y) ${state} 1 ${session} ${session} 0 -1 4194560`;
+  let table: Map<string, string>;
+  const fakeProcfs: ILinuxProcfsReader = {
+    listEntriesAsync: async () => ['self', 'sys', ...table.keys()],
+    readStatAsync: async (pid: string) => {
+      const stat: string | undefined = table.get(pid);
+      if (stat === undefined) throw Object.assign(new Error('gone'), { code: 'ENOENT' });
+      return stat;
+    }
+  };
+  const waitAsync = (timeoutMs?: number): Promise<void> =>
+    waitForLinuxProcessGroupExitAsync(GROUP_ID, timeoutMs, fakeProcfs);
+
+  beforeEach(() => {
+    execFileMock.mockReset();
+    jest.spyOn(process, 'kill').mockReturnValue(true);
+    table = new Map();
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('completes from procfs without executing ps when only zombies remain', async () => {
+    table = new Map([
+      ['10', procStat(10, 'Z', GROUP_ID)],
+      ['11', procStat(11, 'S', 42)]
+    ]);
+    await waitAsync();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('ignores members of other sessions whose command names look like session fields', async () => {
+    table = new Map([
+      ['10', procStat(10, 'Z', GROUP_ID)],
+      ['11', `11 (x) S 1 ${GROUP_ID} ${GROUP_ID}) S 1 42 42 0 -1 4194560`]
+    ]);
+    await waitAsync();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('ignores members that exit between listing and reading', async () => {
+    const reads: string[] = [];
+    const racingProcfs: ILinuxProcfsReader = {
+      listEntriesAsync: async () => ['10', '11'],
+      readStatAsync: async (pid: string) => {
+        reads.push(pid);
+        if (pid === '11') throw Object.assign(new Error('gone'), { code: 'ENOENT' });
+        return procStat(10, 'Z', GROUP_ID);
+      }
+    };
+    await waitForLinuxProcessGroupExitAsync(GROUP_ID, undefined, racingProcfs);
+    expect(reads.sort()).toEqual(['10', '11']);
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('waits for live session members found in procfs', async () => {
+    table = new Map([['10', procStat(10, 'R', GROUP_ID)]]);
+    setTimeout(() => {
+      table = new Map([['10', procStat(10, 'Z', GROUP_ID)]]);
+    }, 30);
+    await waitAsync();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('bounds the wait for live procfs members', async () => {
+    table = new Map([['10', procStat(10, 'S', GROUP_ID)]]);
+    await expect(waitAsync(25)).rejects.toThrow('did not exit within 25ms');
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it.each(['EACCES', 'EIO'])(
+    'does not trust a zombie when another entry is unreadable (%s); falls back to ps',
+    async (code) => {
+      table = new Map([['10', procStat(10, 'Z', GROUP_ID)]]);
+      const unreadableProcfs: ILinuxProcfsReader = {
+        listEntriesAsync: async () => ['10', '11'],
+        readStatAsync: async (pid: string) => {
+          if (pid === '11') throw Object.assign(new Error('unreadable'), { code });
+          return fakeProcfs.readStatAsync(pid);
+        }
+      };
+      let queries: number = 0;
+      execFileMock.mockImplementation((...args) => reportPs(args, ++queries === 1 ? 'S\nZ\n' : 'Z\nZ\n'));
+      await waitForLinuxProcessGroupExitAsync(GROUP_ID, undefined, unreadableProcfs);
+      expect(queries).toBe(2);
+    }
+  );
+
+  it('surfaces the ps failure when an unreadable entry forces the fallback and ps is missing', async () => {
+    const unreadableProcfs: ILinuxProcfsReader = {
+      listEntriesAsync: async () => ['10', '11'],
+      readStatAsync: async (pid: string) => {
+        if (pid === '11') throw Object.assign(new Error('unreadable'), { code: 'EACCES' });
+        return procStat(10, 'Z', GROUP_ID);
+      }
+    };
+    const failure = Object.assign(new Error('spawn ps ENOENT'), { code: 'ENOENT' });
+    execFileMock.mockImplementation((...args) => reportPs(args, '', failure));
+    await expect(waitForLinuxProcessGroupExitAsync(GROUP_ID, undefined, unreadableProcfs)).rejects.toBe(
+      failure
+    );
+  });
+
+  it('treats ESRCH from a stat read as a vanished process', async () => {
+    const racingProcfs: ILinuxProcfsReader = {
+      listEntriesAsync: async () => ['10', '11'],
+      readStatAsync: async (pid: string) => {
+        if (pid === '11') throw Object.assign(new Error('gone'), { code: 'ESRCH' });
+        return procStat(10, 'Z', GROUP_ID);
+      }
+    };
+    await waitForLinuxProcessGroupExitAsync(GROUP_ID, undefined, racingProcfs);
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('bounds concurrent stat reads and stops scanning after a live member', async () => {
+    const pids: string[] = Array.from({ length: 200 }, (unused, index) => String(index + 1));
+    let inFlight: number = 0;
+    let maxInFlight: number = 0;
+    let reads: number = 0;
+    let live: boolean = true;
+    const largeProcfs: ILinuxProcfsReader = {
+      listEntriesAsync: async () => pids,
+      readStatAsync: async (pid: string) => {
+        reads++;
+        maxInFlight = Math.max(maxInFlight, ++inFlight);
+        await new Promise((resolve) => setImmediate(resolve));
+        inFlight--;
+        return pid === '1' ? procStat(1, live ? 'R' : 'Z', GROUP_ID) : procStat(Number(pid), 'S', 42);
+      }
+    };
+    setTimeout(() => {
+      live = false;
+    }, 30);
+    await waitForLinuxProcessGroupExitAsync(GROUP_ID, undefined, largeProcfs);
+    expect(maxInFlight).toBeLessThanOrEqual(32);
+    const scans: number = jest.mocked(process.kill).mock.calls.length;
+    // Each scan while the member is live stops after the first batch; only the final scan reads everything.
+    expect(scans).toBeGreaterThan(1);
+    expect(reads).toBeLessThanOrEqual((scans - 1) * 32 + pids.length);
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+
+  it('does not depend on ps being installed while procfs is readable', async () => {
+    execFileMock.mockImplementation((...args) =>
+      reportPs(args, '', Object.assign(new Error('spawn ps ENOENT'), { code: 'ENOENT' }))
+    );
+    table = new Map([['10', procStat(10, 'Z', GROUP_ID)]]);
+    await waitAsync();
+    expect(execFileMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
index 873a07b5f9..c64a429c1b 100644
--- a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
+++ b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
@@ -68,7 +68,11 @@ jest.setTimeout(30_000);
         .spyOn(linuxProcessGroupExit, 'waitForLinuxProcessGroupExitAsync')
         .mockImplementation(async (pid) => {
           workerPid = pid;
-          await originalWait(pid, 25);
+          // Hide procfs so the injected `ps` inspection outcome is what the join observes.
+          await originalWait(pid, 25, {
+            listEntriesAsync: () => Promise.reject(new Error('procfs hidden by test')),
+            readStatAsync: () => Promise.reject(new Error('procfs hidden by test'))
+          });
         });
       jest
         .spyOn(process, 'kill')

From 061f27d30026e8f1c6977b955e9945a7f8bd01db Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:18:25 -0700
Subject: [PATCH 010/265] [rush-lib] Skip build cache writes when an
 operation's inputs changed during execution (#6086)

* [rush-lib] Skip build cache writes when an operation's inputs changed during execution

The cache key is derived from the iteration's inputs snapshot, but the outputs were written under that key without re-verifying the inputs. Record a stat signature of each cacheable operation's tracked input files right after the snapshot and refuse the cache write if it changed.

Fixes #6073

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-lib] Also detect new input files, block downstream cache writes, and resolve absolute input paths

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 ...build-cache-poisoning-race_2026-09-24.json |   9 ++
 .../operations/CacheableOperationPlugin.ts    |  69 +++++++-
 .../operations/InputFilesStatSignature.ts     | 151 ++++++++++++++++++
 .../test/InputFilesStatSignature.test.ts      | 147 +++++++++++++++++
 4 files changed, 374 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/fix-build-cache-poisoning-race_2026-09-24.json
 create mode 100644 libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts

diff --git a/common/changes/@microsoft/rush/fix-build-cache-poisoning-race_2026-09-24.json b/common/changes/@microsoft/rush/fix-build-cache-poisoning-race_2026-09-24.json
new file mode 100644
index 0000000000..87048f4639
--- /dev/null
+++ b/common/changes/@microsoft/rush/fix-build-cache-poisoning-race_2026-09-24.json
@@ -0,0 +1,9 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix a build cache poisoning race: skip writing a build cache entry when an operation's tracked input files changed while it was executing.",
+      "type": "patch"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index c915abf8ca..6213db3ede 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -2,8 +2,9 @@
 // See LICENSE in the project root for license information.
 
 import * as crypto from 'node:crypto';
+import * as path from 'node:path';
 
-import { InternalError, NewlineKind, Sort } from '@rushstack/node-core-library';
+import { InternalError, NewlineKind, Sort, Executable } from '@rushstack/node-core-library';
 import { CollatedTerminal, type CollatedWriter } from '@rushstack/stream-collator';
 import {
   DiscardStdoutTransform,
@@ -28,6 +29,13 @@ import {
 import type { CobuildConfiguration } from '../../api/CobuildConfiguration';
 import { DisjointSet } from '../cobuild/DisjointSet';
 import { PeriodicCallback } from './PeriodicCallback';
+import {
+  captureInputFilesState,
+  haveInputFilesChanged,
+  hasUntrackedGitFiles,
+  type IInputFilesState
+} from './InputFilesStatSignature';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
 import { NullTerminalProvider } from '../../utilities/NullTerminalProvider';
 import type { Operation } from './Operation';
 import type { IOperationRunnerContext } from './IOperationRunner';
@@ -70,6 +78,11 @@ export interface IOperationBuildCacheContext {
   periodicCallback: PeriodicCallback;
   cacheRestored: boolean;
   isCacheReadAttempted: boolean;
+
+  // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
+  // the iteration's inputs snapshot. Used to refuse cache writes if the inputs changed while the operation
+  // was executing.
+  inputFilesState?: IInputFilesState;
 }
 
 export interface ICacheableOperationPluginOptions {
@@ -102,10 +115,33 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
   readonly #options: ICacheableOperationPluginOptions;
 
+  #gitPathResolved: boolean = false;
+  #gitPath: string | undefined;
+
   public constructor(options: ICacheableOperationPluginOptions) {
     this.#options = options;
   }
 
+  #isNewInput(
+    newEntryPaths: ReadonlyArray<string>,
+    rootDirectory: string,
+    projectFolder: string,
+    outputFolderNames: ReadonlyArray<string>
+  ): boolean {
+    if (!this.#gitPathResolved) {
+      this.#gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
+      this.#gitPathResolved = true;
+    }
+    if (!this.#gitPath) {
+      // Without Git we cannot tell whether the new entries are ignored, so assume they are inputs.
+      return true;
+    }
+    const outputFolderPaths: string[] = outputFolderNames.map((folderName: string) =>
+      path.resolve(projectFolder, folderName)
+    );
+    return hasUntrackedGitFiles(this.#gitPath, rootDirectory, newEntryPaths, outputFolderPaths);
+  }
+
   public apply(hooks: PhasedCommandHooks): void {
     const {
       allowWarningsInSuccessfulBuild,
@@ -184,6 +220,11 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
             disjointSet?.add(operation);
 
+            const inputFilesState: IInputFilesState | undefined =
+              cacheWriteEnabled && !cacheDisabledReason && record.enabled
+                ? captureInputFilesState(inputsSnapshot.rootDirectory, fileHashes.keys())
+                : undefined;
+
             const buildCacheContext: IOperationBuildCacheContext = {
               // Supports cache writes by default for initial operations.
               // Don't write during watch runs for performance reasons (and to avoid flooding the cache)
@@ -200,7 +241,8 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                 interval: PERIODIC_CALLBACK_INTERVAL_IN_SECONDS * 1000
               }),
               cacheRestored: false,
-              isCacheReadAttempted: false
+              isCacheReadAttempted: false,
+              inputFilesState
             };
             // Upstream runners may mutate the property of build cache context for downstream runners
             this.#buildCacheContextByOperation.set(operation, buildCacheContext);
@@ -545,6 +587,29 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             if (!setCacheEntryPromise && taskIsSuccessful && isCacheWriteAllowed && operationBuildCache) {
               setCacheEntryPromise = () => operationBuildCache.trySetCacheEntryAsync(buildCacheTerminal);
             }
+            const { inputFilesState } = buildCacheContext;
+            if (
+              !cacheRestored &&
+              isCacheWriteAllowed &&
+              inputFilesState &&
+              haveInputFilesChanged(inputFilesState, (newEntryPaths: ReadonlyArray<string>) =>
+                this.#isNewInput(
+                  newEntryPaths,
+                  inputFilesState.rootDirectory,
+                  project.projectFolder,
+                  buildCacheContext.outputFolderNames
+                )
+              )
+            ) {
+              // The cache key was derived from the iteration's inputs snapshot. Storing outputs produced from
+              // edited inputs under that key would poison the cache for every consumer of the entry.
+              // Consumers' cache keys also embed this operation's pre-edit state, so block their writes too.
+              buildCacheTerminal.writeLine(
+                'Input files changed while this operation was executing; not writing a build cache entry.'
+              );
+              buildCacheContext.isCacheWriteAllowed = false;
+              setCacheEntryPromise = undefined;
+            }
             if (!cacheRestored) {
               const cacheWriteSuccess: boolean | undefined = await setCacheEntryPromise?.();
               await setCompletedStatePromiseFunction?.();
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
new file mode 100644
index 0000000000..aef3eaff54
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -0,0 +1,151 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { Executable } from '@rushstack/node-core-library';
+
+/**
+ * The on-disk state of an operation's tracked input files, captured right after the inputs snapshot
+ * (from which the operation's build cache key is derived) was taken.
+ */
+export interface IInputFilesState {
+  /**
+   * The repository root that relative input file paths were resolved against.
+   */
+  readonly rootDirectory: string;
+  /**
+   * Absolute paths of the tracked input files.
+   */
+  readonly filePaths: ReadonlyArray<string>;
+  /**
+   * Signature of the size, modification time, and inode of each tracked input file.
+   */
+  readonly statSignature: string;
+  /**
+   * For each folder inside the repository that contains a tracked input file, the names of its entries.
+   * Used to detect files (or folders) that were created after the snapshot was taken.
+   */
+  readonly folderEntries: ReadonlyMap<string, ReadonlySet<string>>;
+}
+
+/**
+ * Given the absolute paths of entries that appeared in input folders after the snapshot was taken,
+ * returns true if any of them is a potential input of the operation (e.g. an untracked, non-ignored file).
+ */
+export type IsNewInputCallback = (newEntryPaths: ReadonlyArray<string>) => boolean;
+
+/**
+ * Computes a cheap signature of the on-disk identity (size, mtime, inode) of the specified files.
+ * Missing files are included in the signature, so deleting or creating a listed file also changes it.
+ */
+export function getInputFilesStatSignature(filePaths: Iterable<string>): string {
+  const hasher: crypto.Hash = crypto.createHash('sha1');
+  for (const filePath of filePaths) {
+    const stats: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+    if (stats) {
+      hasher.update(`${filePath}\0${stats.size}\0${stats.mtimeNs}\0${stats.ino}\n`);
+    } else {
+      hasher.update(`${filePath}\0missing\n`);
+    }
+  }
+  return hasher.digest('hex');
+}
+
+function tryReadFolderEntries(folderPath: string): Set<string> | undefined {
+  try {
+    return new Set(fs.readdirSync(folderPath));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Captures the on-disk state of an operation's tracked input files.
+ *
+ * @param rootDirectory - The repository root that relative input file paths are resolved against
+ * @param inputFilePaths - The tracked input file paths. Relative paths are resolved against `rootDirectory`;
+ *   absolute paths (e.g. `dependsOnAdditionalFiles` outside of the repository) are stat'ed but their folders
+ *   are not watched for new entries.
+ */
+export function captureInputFilesState(
+  rootDirectory: string,
+  inputFilePaths: Iterable<string>
+): IInputFilesState {
+  const filePaths: string[] = [];
+  const folderEntries: Map<string, ReadonlySet<string>> = new Map();
+  for (const inputFilePath of inputFilePaths) {
+    const absolutePath: string = path.resolve(rootDirectory, inputFilePath);
+    filePaths.push(absolutePath);
+    if (!path.isAbsolute(inputFilePath)) {
+      const folderPath: string = path.dirname(absolutePath);
+      if (!folderEntries.has(folderPath)) {
+        folderEntries.set(folderPath, tryReadFolderEntries(folderPath) ?? new Set());
+      }
+    }
+  }
+  return { rootDirectory, filePaths, statSignature: getInputFilesStatSignature(filePaths), folderEntries };
+}
+
+/**
+ * Returns the absolute paths of entries that exist now but did not exist when the folder entries were captured.
+ */
+export function getNewFolderEntries(folderEntries: ReadonlyMap<string, ReadonlySet<string>>): string[] {
+  const newEntryPaths: string[] = [];
+  for (const [folderPath, originalEntries] of folderEntries) {
+    const currentEntries: Set<string> | undefined = tryReadFolderEntries(folderPath);
+    if (currentEntries) {
+      for (const entry of currentEntries) {
+        if (!originalEntries.has(entry)) {
+          newEntryPaths.push(path.join(folderPath, entry));
+        }
+      }
+    }
+  }
+  return newEntryPaths;
+}
+
+/**
+ * Returns true if any of the operation's tracked input files was modified, deleted, or replaced, or if a
+ * potential new input file was created in one of the input folders, since the state was captured.
+ */
+export function haveInputFilesChanged(state: IInputFilesState, isNewInput: IsNewInputCallback): boolean {
+  if (getInputFilesStatSignature(state.filePaths) !== state.statSignature) {
+    return true;
+  }
+  const newEntryPaths: string[] = getNewFolderEntries(state.folderEntries);
+  return newEntryPaths.length > 0 && isNewInput(newEntryPaths);
+}
+
+function toGitPathspec(rootDirectory: string, absolutePath: string): string {
+  return path.relative(rootDirectory, absolutePath).split(path.sep).join('/');
+}
+
+/**
+ * Uses Git to determine whether any of the specified paths is, or contains, an untracked file that is not
+ * ignored by `.gitignore`, excluding the specified folders (typically the operation's output folders).
+ * If Git fails, conservatively returns true.
+ */
+export function hasUntrackedGitFiles(
+  gitPath: string,
+  rootDirectory: string,
+  candidatePaths: ReadonlyArray<string>,
+  excludedFolderPaths: ReadonlyArray<string>
+): boolean {
+  const args: string[] = ['ls-files', '--others', '--exclude-standard', '-z', '--'];
+  for (const candidatePath of candidatePaths) {
+    args.push(`:(literal)${toGitPathspec(rootDirectory, candidatePath)}`);
+  }
+  for (const excludedFolderPath of excludedFolderPaths) {
+    args.push(`:(exclude,literal)${toGitPathspec(rootDirectory, excludedFolderPath)}`);
+  }
+  const result: ReturnType<typeof Executable.spawnSync> = Executable.spawnSync(gitPath, args, {
+    currentWorkingDirectory: rootDirectory
+  });
+  if (result.status !== 0) {
+    return true;
+  }
+  return result.stdout.length > 0;
+}
\ No newline at end of file
diff --git a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
new file mode 100644
index 0000000000..0e0839c269
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
@@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as child_process from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  captureInputFilesState,
+  getNewFolderEntries,
+  hasUntrackedGitFiles,
+  haveInputFilesChanged,
+  type IInputFilesState
+} from '../InputFilesStatSignature';
+
+describe('InputFilesStatSignature', () => {
+  let tempFolder: string;
+  let srcFolder: string;
+  let fileA: string;
+  let fileB: string;
+  let noNewInputs: jest.Mock<boolean, [ReadonlyArray<string>]>;
+
+  function capture(...absolutePaths: string[]): IInputFilesState {
+    return captureInputFilesState(
+      tempFolder,
+      absolutePaths.map((filePath: string) => path.relative(tempFolder, filePath))
+    );
+  }
+
+  beforeEach(() => {
+    tempFolder = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-input-stat-')));
+    srcFolder = path.join(tempFolder, 'src');
+    fs.mkdirSync(srcFolder);
+    fileA = path.join(srcFolder, 'a.ts');
+    fileB = path.join(srcFolder, 'b.ts');
+    fs.writeFileSync(fileA, 'export const a = 1;');
+    fs.writeFileSync(fileB, 'export const b = 1;');
+    noNewInputs = jest.fn().mockReturnValue(false);
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempFolder, { recursive: true, force: true });
+  });
+
+  describe(haveInputFilesChanged.name, () => {
+    it('reports no change when the input files are unchanged', () => {
+      const state: IInputFilesState = capture(fileA, fileB);
+      expect(state.filePaths).toEqual([fileA, fileB]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).not.toHaveBeenCalled();
+    });
+
+    it('detects a modified input file', () => {
+      const state: IInputFilesState = capture(fileA, fileB);
+      fs.writeFileSync(fileB, 'export const b = 2; // edited during the build');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    it('detects a same-size edit with a different modification time', () => {
+      const state: IInputFilesState = capture(fileA);
+      fs.writeFileSync(fileA, 'export const a = 2;');
+      const future: Date = new Date(Date.now() + 60 * 1000);
+      fs.utimesSync(fileA, future, future);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    it('detects a deleted input file', () => {
+      const state: IInputFilesState = capture(fileA, fileB);
+      fs.unlinkSync(fileA);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    it('asks whether files created in an input folder are inputs', () => {
+      const state: IInputFilesState = capture(fileA, fileB);
+      const fileC: string = path.join(srcFolder, 'c.ts');
+      fs.writeFileSync(fileC, 'export const c = 1;');
+
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).toHaveBeenCalledWith([fileC]);
+
+      expect(haveInputFilesChanged(state, () => true)).toBe(true);
+    });
+
+    it('reports a folder created in an input folder', () => {
+      const state: IInputFilesState = capture(fileA);
+      fs.mkdirSync(path.join(srcFolder, 'nested'));
+      fs.writeFileSync(path.join(srcFolder, 'nested', 'd.ts'), 'export const d = 1;');
+      expect(getNewFolderEntries(state.folderEntries)).toEqual([path.join(srcFolder, 'nested')]);
+    });
+
+    it('ignores files created outside of the input folders', () => {
+      const state: IInputFilesState = capture(fileA);
+      fs.writeFileSync(path.join(tempFolder, 'unrelated.txt'), 'not an input');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).not.toHaveBeenCalled();
+    });
+
+    it('resolves absolute input paths as-is and does not watch their folders', () => {
+      const state: IInputFilesState = captureInputFilesState(path.join(tempFolder, 'other-root'), [fileA]);
+      expect(state.filePaths).toEqual([fileA]);
+      expect(state.folderEntries.size).toBe(0);
+      fs.writeFileSync(fileA, 'export const a = 3; // edited during the build');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+  });
+
+  describe(hasUntrackedGitFiles.name, () => {
+    const gitPath: string = 'git';
+
+    function git(...args: string[]): void {
+      child_process.execFileSync(gitPath, args, { cwd: tempFolder, stdio: 'ignore' });
+    }
+
+    beforeEach(() => {
+      git('init', '-q');
+      fs.writeFileSync(path.join(tempFolder, '.gitignore'), 'temp/\n*.log\n');
+      git('add', '-A');
+    });
+
+    it('returns false for ignored files and excluded folders', () => {
+      fs.mkdirSync(path.join(srcFolder, 'temp'));
+      fs.writeFileSync(path.join(srcFolder, 'temp', 'x.ts'), '');
+      fs.writeFileSync(path.join(srcFolder, 'build.log'), '');
+      fs.mkdirSync(path.join(srcFolder, 'lib'));
+      fs.writeFileSync(path.join(srcFolder, 'lib', 'a.js'), '');
+
+      expect(
+        hasUntrackedGitFiles(
+          gitPath,
+          tempFolder,
+          [path.join(srcFolder, 'temp'), path.join(srcFolder, 'build.log'), path.join(srcFolder, 'lib')],
+          [path.join(srcFolder, 'lib')]
+        )
+      ).toBe(false);
+    });
+
+    it('returns true for new untracked files and folders that are not ignored', () => {
+      fs.writeFileSync(path.join(srcFolder, 'c.ts'), '');
+      fs.mkdirSync(path.join(srcFolder, 'nested'));
+      fs.writeFileSync(path.join(srcFolder, 'nested', 'd.ts'), '');
+
+      expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'c.ts')], [])).toBe(true);
+      expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'nested')], [])).toBe(true);
+    });
+  });
+});
\ No newline at end of file

From 560efefd6202d08c97d28a7194634096f41f7539 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:18:44 -0700
Subject: [PATCH 011/265] [rush-daemon] Only count resource-holding projects
 toward warmSetMaxProjects (#6081)

* [rush-daemon] Only count resource-holding projects toward warmSetMaxProjects

The warm-set project cap deleted retained results of resource-free (shell/null runner) projects beyond rank 20, so every no-op build of a >20-project workspace re-restored those projects from the build cache. The cap now only counts and evicts projects holding an active runner or watcher, and equal-recency ties keep the explicitly requested target.

Fixes #6049

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Update watch-policy test for requested-target retention order

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Count closable runners without isActive as warm resource holders

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 apps/rush-cli-client/README.md                |  4 +-
 .../fix-warmset-cap_2026-09-24-01-00.json     | 10 +++
 .../fix-warmset-cap_2026-09-24-01-00.json     | 10 +++
 .../fix-warmset-cap_2026-09-24-01-00.json     | 10 +++
 libraries/rush-daemon/README.md               | 10 ++-
 libraries/rush-daemon/src/WarmSetRanking.ts   |  4 +
 libraries/rush-daemon/src/WorkspaceWarmSet.ts | 36 ++++++--
 .../src/test/WarmSetRanking.test.ts           | 11 +++
 .../src/test/WarmSetTestFixture.ts            | 24 +++++
 .../src/test/WorkspaceWarmSet.test.ts         | 87 +++++++++++++++++++
 .../src/test/WorkspaceWatchPolicy.test.ts     |  3 +-
 .../rush-lib/src/api/DaemonConfiguration.ts   |  5 +-
 .../rush-lib/src/schemas/rush.schema.json     |  2 +-
 13 files changed, 202 insertions(+), 14 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/fix-warmset-cap_2026-09-24-01-00.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/fix-warmset-cap_2026-09-24-01-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/fix-warmset-cap_2026-09-24-01-00.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index dda32fb6ef..66d54e7f3b 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -211,8 +211,8 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `watch` | `RUSH_DAEMON_WATCH` | false | Persistent host observation of requested warm projects; false keeps root/config guards only. Never schedules builds |
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
-| `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling |
-| `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort retained-project limit; never trims requested execution |
+| `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
+| `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
 | `autoWarmByTelemetry` | `RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY` | false | Measured retention ranking with conservative LRU fallback; no speculative scripts |
 
 For genuine persistent Node execution, enable `usePersistentIpcRunners` and add
diff --git a/common/changes/@microsoft/rush/fix-warmset-cap_2026-09-24-01-00.json b/common/changes/@microsoft/rush/fix-warmset-cap_2026-09-24-01-00.json
new file mode 100644
index 0000000000..95f657e41d
--- /dev/null
+++ b/common/changes/@microsoft/rush/fix-warmset-cap_2026-09-24-01-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Document that the daemon warmSetMaxProjects limit only counts projects holding warm resources (active runners or file watchers).",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/fix-warmset-cap_2026-09-24-01-00.json b/common/changes/@rushstack/rush-cli-client/fix-warmset-cap_2026-09-24-01-00.json
new file mode 100644
index 0000000000..9eec39ac08
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/fix-warmset-cap_2026-09-24-01-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the warmSetMaxProjects and warmMemoryBudgetMB daemon policy semantics.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-daemon/fix-warmset-cap_2026-09-24-01-00.json b/common/changes/@rushstack/rush-daemon/fix-warmset-cap_2026-09-24-01-00.json
new file mode 100644
index 0000000000..98fe35f1aa
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/fix-warmset-cap_2026-09-24-01-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Fix warmSetMaxProjects evicting the retained results of resource-free projects, which made every no-op build of a workspace with more than 20 projects re-restore the excess projects from the build cache. The cap now only counts and releases projects that hold a live runner or watcher, and ties keep the explicitly requested target over its dependencies.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 7979146a41..4ee695eba8 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -300,13 +300,15 @@ preserves its records and diagnostics without failing an otherwise successful bu
 | --- | --- |
 | `watch` | Retains host observation of requested warm projects between requests when true. False (the default) keeps root/config guards only. Never schedules builds. |
 | `warmIdleTimeoutSeconds` | Expires unused project runners, watchers and retained results after requests finish. Unchanged requests refresh recency too. |
-| `warmSetMaxProjects` | Retains the highest-ranked idle projects within the limit; executing/prepared and explicitly protected work is exempt. |
-| `warmMemoryBudgetMB` | Attempts idle eviction under sampled daemon-plus-measured-child RSS pressure. Never treats cache files as memory or claims a hard RSS ceiling. |
+| `warmSetMaxProjects` | Limits the projects that hold warm **resources** (an active runner such as a persistent IPC child, or a `watch: true` file watcher). The lowest-ranked holders are released (runners closed, watchers removed, records deleted); executing/prepared and explicitly protected work is exempt. Projects whose only retained state is operation results from resource-free (shell/null) runners neither count toward nor are evicted for this limit, so no-op re-requests of large workspaces stay skipped. |
+| `warmMemoryBudgetMB` | Attempts idle eviction under sampled daemon-plus-measured-child RSS pressure. The comparison uses the **whole daemon process RSS** (graph, Node heap and retained records, typically 130-190 MiB) plus measured child RSS, so a budget below the daemon's baseline evicts every idle project on each pass and disables warm skipping. Never treats cache files as memory or claims a hard RSS ceiling. |
 | `autoWarmByTelemetry` | Promotes already-requested high-value work instead of pure LRU. Never schedules or executes speculative scripts. |
 
 One deterministic best-first comparator is shared by retention and reverse-order eviction. With complete
-measurements it uses `(timeSavedMs * requestFrequency) / residentMemoryBytes`, then recency, then ordinal project
-name. Measured entries precede the missing-data bucket; that bucket uses LRU and the same name tie-break.
+measurements it uses `(timeSavedMs * requestFrequency) / residentMemoryBytes`, then recency, then whether the
+project owned an explicitly requested target (an enabled operation with no enabled consumer, so `--to x` keeps
+`x` over its same-request dependencies), then ordinal project name. Measured entries precede the missing-data
+bucket; that bucket uses LRU and the same tie-breaks.
 Without telemetry mode the entire order is LRU. Savings compare actual cold and reused execution stopwatches
 (or native non-cached duration versus cache-restoration duration); no startup cost or RSS is invented.
 `operation-graph`'s existing `WatchLoop` now reports its own measured RSS in an optional IPC completion field.
diff --git a/libraries/rush-daemon/src/WarmSetRanking.ts b/libraries/rush-daemon/src/WarmSetRanking.ts
index cc50659d62..e4b069d970 100644
--- a/libraries/rush-daemon/src/WarmSetRanking.ts
+++ b/libraries/rush-daemon/src/WarmSetRanking.ts
@@ -8,6 +8,8 @@ export interface IWarmSetRank {
   readonly frequency: number;
   readonly timeSavedMs: number | undefined;
   readonly residentMemoryBytes: number | undefined;
+  /** The project owned a selection root (an enabled operation with no enabled consumer) when last requested. */
+  readonly requestedTarget?: boolean;
 }
 
 export function getWarmSetScore(entry: IWarmSetRank): number | undefined {
@@ -38,5 +40,7 @@ export function compareWarmSetRanks(a: IWarmSetRank, b: IWarmSetRank, telemetry:
     if (aScore !== undefined && bScore !== undefined && aScore !== bScore) return bScore - aScore;
   }
   if (a.lastUsed !== b.lastUsed) return b.lastUsed - a.lastUsed;
+  // A request stamps its whole closure with one timestamp; keep the explicit target over its dependencies.
+  if (!a.requestedTarget !== !b.requestedTarget) return a.requestedTarget ? -1 : 1;
   return a.key === b.key ? 0 : a.key < b.key ? -1 : 1;
 }
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 17461ea2da..3b7e5aa5f5 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -53,6 +53,7 @@ interface IProjectHistory {
   readonly operations: Operation[];
   lastUsed: number;
   frequency: number;
+  requestedTarget: boolean;
 }
 
 interface IOperationTiming {
@@ -63,6 +64,8 @@ interface IOperationTiming {
 interface IWarmProject extends IWarmSetRank {
   readonly operations: ReadonlyArray<Operation>;
   readonly protected: boolean;
+  /** Owns a live runner or a file watcher. Only these count toward, and are evicted for, `warmSetMaxProjects`. */
+  readonly holdsResources: boolean;
 }
 
 const PLUGIN_NAME: string = 'WorkspaceWarmSet';
@@ -99,7 +102,7 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       const name: string = operation.associatedProject.packageName;
       let project: IProjectHistory | undefined = this.#projects.get(name);
       if (!project) {
-        project = { operations: [], lastUsed: now, frequency: 0 };
+        project = { operations: [], lastUsed: now, frequency: 0, requestedTarget: false };
         this.#projects.set(name, project);
       }
       project.operations.push(operation);
@@ -110,9 +113,11 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       const requested: string[] = [];
       const requestedAt: number = performance.now();
       for (const [name, project] of this.#projects) {
-        if (!project.operations.some((operation) => operation.enabled !== false)) continue;
+        const enabled: Operation[] = project.operations.filter((operation) => operation.enabled !== false);
+        if (!enabled.length) continue;
         project.lastUsed = requestedAt;
         project.frequency++;
+        project.requestedTarget = enabled.some((operation) => !hasEnabledConsumer(operation));
         requested.push(name);
       }
       try {
@@ -202,7 +207,9 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       overMemoryBudget:
         daemonResidentMemoryBytes + measuredRunnerMemoryBytes >
         this.#configuration.warmMemoryBudgetMB * BYTES_PER_MB,
-      overProjectLimit: projects.length > this.#configuration.warmSetMaxProjects,
+      // Retained results of resource-free projects are cheap and are what makes a warm no-op skip possible.
+      overProjectLimit:
+        projects.filter((project) => project.holdsResources).length > this.#configuration.warmSetMaxProjects,
       deferredReason: this.#deferredReason,
       cleanupFailures: [
         ...this.#cleanupFailures.values(),
@@ -358,7 +365,8 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         project.operations.every(
           (operation) => !graph.resultByOperation.has(operation) && !operation.runner?.isActive
         );
-      if (!unrequested && !expired && !status.overMemoryBudget && !status.overProjectLimit) continue;
+      const overProjectLimit: boolean = status.overProjectLimit && project.holdsResources;
+      if (!unrequested && !expired && !status.overMemoryBudget && !overProjectLimit) continue;
       try {
         await graph.closeRunnersAsync(project.operations);
         if (project.operations.some((operation) => operation.runner?.isActive)) {
@@ -409,7 +417,9 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         ...history,
         residentMemoryBytes,
         timeSavedMs,
-        protected: history.operations.some((operation) => protectedOperations?.has(operation))
+        protected: history.operations.some((operation) => protectedOperations?.has(operation)),
+        holdsResources:
+          watched.has(key) || resident.some((operation) => mayHoldRunnerResources(operation.runner))
       });
     }
     return projects.sort((a, b) => compareWarmSetRanks(a, b, this.#configuration.autoWarmByTelemetry));
@@ -499,6 +509,22 @@ function isMeasuredMemory(bytes: number | undefined): bytes is number {
   return bytes !== undefined && Number.isSafeInteger(bytes) && bytes > 0;
 }
 
+/**
+ * `isActive` is optional for backward compatibility; a retained runner that leaves it undefined but can be closed
+ * may own background resources, matching the conservative accounting in `getStatus()`.
+ */
+function mayHoldRunnerResources(runner: IOperationRunner | undefined): boolean {
+  if (!runner) return false;
+  return runner.isActive === undefined ? !!runner.closeAsync : runner.isActive;
+}
+
+function hasEnabledConsumer(operation: Operation): boolean {
+  for (const consumer of operation.consumers) {
+    if (consumer.enabled !== false) return true;
+  }
+  return false;
+}
+
 function isGraphBusy(graph: IOperationGraph): boolean {
   return (
     graph.hasScheduledIteration ||
diff --git a/libraries/rush-daemon/src/test/WarmSetRanking.test.ts b/libraries/rush-daemon/src/test/WarmSetRanking.test.ts
index b400bd1770..3ca6c70dca 100644
--- a/libraries/rush-daemon/src/test/WarmSetRanking.test.ts
+++ b/libraries/rush-daemon/src/test/WarmSetRanking.test.ts
@@ -49,6 +49,17 @@ describe('warm retention and eviction ranking', () => {
     ).toEqual(rank(true));
   });
 
+  it('prefers the explicitly requested target over same-request dependencies before the key tie-break', () => {
+    const entries: IWarmSetRank[] = [
+      entry('a-dependency', { lastUsed: 2 }),
+      entry('z-target', { lastUsed: 2, requestedTarget: true }),
+      entry('older-target', { lastUsed: 1, requestedTarget: true })
+    ];
+    expect(
+      [...entries].sort((a, b) => compareWarmSetRanks(a, b, false)).map((item) => item.key)
+    ).toEqual(['z-target', 'a-dependency', 'older-target']);
+  });
+
   it('has a transitive missing-data order rather than a pair-dependent score/LRU comparison', () => {
     const entries = [
       entry('high-old', { timeSavedMs: 400, lastUsed: 1 }),
diff --git a/libraries/rush-daemon/src/test/WarmSetTestFixture.ts b/libraries/rush-daemon/src/test/WarmSetTestFixture.ts
index b534fb498c..6588f22566 100644
--- a/libraries/rush-daemon/src/test/WarmSetTestFixture.ts
+++ b/libraries/rush-daemon/src/test/WarmSetTestFixture.ts
@@ -32,6 +32,8 @@ export interface IWarmFixtureOptions {
   readonly ipc?: boolean;
   readonly cache?: boolean;
   readonly configurationKind?: 'direct' | 'rig' | 'inherited';
+  /** Adds independent shell-runner projects p01..pNN beside a, b and c. */
+  readonly extraProjectCount?: number;
 }
 
 export const GENEROUS_WARM_CONFIGURATION: WorkspaceWarmSetConfiguration = {
@@ -139,6 +141,7 @@ export class WarmSetTestFixture implements AsyncDisposable {
           );
           fixture.write('a/config/rush-project.json', '{"extends":"../../common/temp/inherited.json"}');
         }
+        if (options.extraProjectCount) addExtraProjects(fixture, options.extraProjectCount);
       }, false);
     });
     result._attachOnInitialization();
@@ -223,6 +226,27 @@ export class WarmSetTestFixture implements AsyncDisposable {
   }
 }
 
+export function getExtraProjectNames(count: number): string[] {
+  return Array.from({ length: count }, (unused, index) => `p${String(index + 1).padStart(2, '0')}`);
+}
+
+function addExtraProjects(fixture: DaemonGraphTestFixture, count: number): void {
+  const names: string[] = getExtraProjectNames(count);
+  const rushJson: { projects: object[] } = JSON.parse(
+    fs.readFileSync(path.join(fixture.folder, 'rush.json'), 'utf8')
+  );
+  rushJson.projects.push(...names.map((name) => ({ packageName: name, projectFolder: name })));
+  fixture.write('rush.json', JSON.stringify(rushJson));
+  for (const name of names) {
+    fixture.write(
+      `${name}/package.json`,
+      JSON.stringify({ name, version: '1.0.0', scripts: { '_phase:compile': 'node build.cjs' } })
+    );
+    fixture.write(`${name}/input.txt`, 'one');
+    fixture.write(`${name}/build.cjs`, `require('node:fs').appendFileSync('../runs.txt', '${name}\\n');`);
+  }
+}
+
 /** Test engines may supply real IPC runners; the production non-watch resolver still selects shells. */
 export function useNativeIpcRunners(graph: IOperationGraph): void {
   for (const operation of graph.operations) {
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index 8eaddb9ce7..f4193dbd27 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -16,6 +16,8 @@ import { createDeferred } from './DaemonRequestWireTestUtilities';
 import { createNativeScriptGateAsync, runNativeCommandAsync } from './NativeEngineTestCommands';
 import {
   captureWarmRankingDurations,
+  GENEROUS_WARM_CONFIGURATION,
+  getExtraProjectNames,
   getMeasuredFixtureRetentionOrder,
   WarmSetTestFixture,
   type IWarmFixtureOptions
@@ -93,6 +95,91 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(fixture.runs()).toEqual(runs);
   });
 
+  it('keeps the explicitly requested target over its same-request dependencies at the project cap', async () => {
+    const { warm, graph } = await startAsync();
+    test!.update({ warmSetMaxProjects: 1 });
+    expect((await warm.maintainAsync()).retainedProjectNames).toEqual(['b']);
+    expect(graph.resultByOperation.has(test!.operation('a'))).toBe(false);
+  });
+
+  it('does not count or evict resource-free retained results for the project cap, but still evicts resource holders', async () => {
+    test = await WarmSetTestFixture.createAsync({ extraProjectCount: 40 });
+    test.configuration = { ...GENEROUS_WARM_CONFIGURATION, watch: false, warmSetMaxProjects: 20 };
+    const { fixture } = test;
+    const build = async (): Promise<void> => {
+      const exchange = await fixture.runAsync(['build', '--parallelism', '8']);
+      expect(exchange.terminal).toMatchObject({ payload: { exitCode: 0 } });
+    };
+    await build();
+    const { warm, graph, watcher } = test;
+    const projectCount: number = 43;
+    const built = await warm.maintainAsync();
+    expect(built.overProjectLimit).toBe(false);
+    expect(built.retainedProjectNames).toHaveLength(projectCount);
+    expect(graph.resultByOperation.size).toBe(projectCount);
+    expect(watcher.watchedProjectNames.size).toBe(0);
+    const runs: string[] = fixture.runs();
+    expect(runs).toHaveLength(projectCount);
+
+    // A repeated no-op build skips every retained project instead of re-running or restoring it.
+    await build();
+    expect((await warm.maintainAsync()).retainedProjectNames).toHaveLength(projectCount);
+    expect(fixture.runs()).toEqual(runs);
+    expect(graph.resultByOperation.size).toBe(projectCount);
+
+    // 21 real resource holders exceed the cap of 20: exactly the lowest-ranked holder is released.
+    const closed: string[] = [];
+    for (const name of getExtraProjectNames(21)) {
+      let active: boolean = true;
+      test.operation(name).runner = {
+        name: `resident-${name}`,
+        isNoOp: false,
+        cacheable: false,
+        reportTiming: false,
+        silent: false,
+        warningsAreAllowed: false,
+        get isActive() {
+          return active;
+        },
+        residentMemoryBytes: 1024,
+        getConfigHash: () => '',
+        executeAsync: async () => OperationStatus.Success,
+        closeAsync: async () => {
+          active = false;
+          closed.push(name);
+        }
+      };
+    }
+    expect(warm.getStatus().overProjectLimit).toBe(true);
+    const capped = await warm.maintainAsync();
+    expect(closed).toEqual(['p21']);
+    expect(graph.resultByOperation.has(test.operation('p21'))).toBe(false);
+    expect(graph.resultByOperation.size).toBe(projectCount - 1);
+    expect(capped.overProjectLimit).toBe(false);
+    expect(capped.measuredRunnerMemoryBytes).toBe(20 * 1024);
+
+    // A closable legacy runner that omits the optional isActive flag is conservatively a resource holder.
+    const legacyClosed: string[] = [];
+    test.operation('p22').runner = {
+      name: 'legacy-p22',
+      isNoOp: false,
+      cacheable: false,
+      reportTiming: false,
+      silent: false,
+      warningsAreAllowed: false,
+      getConfigHash: () => '',
+      executeAsync: async () => OperationStatus.Success,
+      closeAsync: async () => {
+        legacyClosed.push('p22');
+      }
+    };
+    expect(warm.getStatus().overProjectLimit).toBe(true);
+    expect((await warm.maintainAsync()).overProjectLimit).toBe(false);
+    expect(legacyClosed).toEqual(['p22']);
+    expect(graph.resultByOperation.has(test.operation('p22'))).toBe(false);
+    expect(graph.resultByOperation.size).toBe(projectCount - 2);
+  });
+
   it('lets autoWarmByTelemetry change actual retention using real cold/reused durations and IPC RSS', async () => {
     const { fixture, warm, graph } = await startAsync({ ipc: true });
     const coldDurations = captureWarmRankingDurations(graph);
diff --git a/libraries/rush-daemon/src/test/WorkspaceWatchPolicy.test.ts b/libraries/rush-daemon/src/test/WorkspaceWatchPolicy.test.ts
index fcef21ab5c..7f37422b26 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWatchPolicy.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWatchPolicy.test.ts
@@ -40,7 +40,8 @@ describe('daemon.watch observation-only policy', () => {
       expect((await pongAsync(fixture)).workspace?.warmSet).toMatchObject({
         configuration: { watch: false },
         watchedProjectNames: [],
-        retainedProjectNames: ['a', 'b']
+        // Ranked best-first: the requested target b precedes its same-request dependency a.
+        retainedProjectNames: ['b', 'a']
       });
       fixture.write('a/input.txt', 'changed-unwatched');
       await fixture.buildSuccessfullyAsync();
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 582c57f83e..695dcaa548 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -19,7 +19,10 @@ export interface IDaemonConfigurationJson {
   readonly warmIdleTimeoutSeconds?: number;
   /** Best-effort sampled RSS budget for an attached warm set, not a hard ceiling. Defaults to 512 MiB. */
   readonly warmMemoryBudgetMB?: number;
-  /** Best-effort retained project limit; active/protected work is exempt. Defaults to 20 projects. */
+  /**
+   * Best-effort limit on projects holding warm resources (active runners or file watchers); active/protected work
+   * is exempt, and retained results of resource-free projects do not count. Defaults to 20 projects.
+   */
   readonly warmSetMaxProjects?: number;
   /** Prefer measured time-saved * frequency / resident-memory retention over LRU. Never starts scripts. Defaults to false. */
   readonly autoWarmByTelemetry?: boolean;
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 9e6e6328cf..801ccdafc3 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -305,7 +305,7 @@
           "minimum": 1,
           "maximum": 9007199254740991,
           "default": 20,
-          "description": "Best-effort retained project limit for an attached warm set, at most 9007199254740991 (Number.MAX_SAFE_INTEGER). RUSH_DAEMON_WARM_SET_MAX_PROJECTS overrides."
+          "description": "Best-effort limit on projects holding warm resources (active runners or file watchers) in an attached warm set, at most 9007199254740991 (Number.MAX_SAFE_INTEGER). Retained results of resource-free projects do not count and are not evicted for this limit. RUSH_DAEMON_WARM_SET_MAX_PROJECTS overrides."
         },
         "autoWarmByTelemetry": {
           "type": "boolean",

From 7a0348d7c0505f739cda036ac255b1c506eabd6b Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Thu, 24 Sep 2026 14:18:58 -0700
Subject: [PATCH 012/265] [rush-daemon] Print the native operation summary and
 duration line on the daemon path (#6068)

* [rush-daemon] Print the native operation summary and duration line for phased requests

Fixes #6053

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Fix summary test typing

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-sdk] Update the export snapshot for _printOperationStatus

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Honor the request warnings policy in the operation summary

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 ...rushd-summary-banner_2026-09-24-01-30.json |  11 ++
 ...rushd-summary-banner_2026-09-24-01-30.json |  11 ++
 common/reviews/api/rush-lib.api.md            |   3 +
 .../rush-daemon/src/PhasedRequestRouter.ts    |  16 ++
 .../rush-daemon/src/PhasedRequestSummary.ts   | 182 +++++++++++++++++
 .../src/test/PhasedRequestSummary.test.ts     | 185 ++++++++++++++++++
 libraries/rush-lib/src/index.ts               |   1 +
 .../test/__snapshots__/script.test.ts.snap    |   1 +
 8 files changed, 410 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/rushd-summary-banner_2026-09-24-01-30.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-summary-banner_2026-09-24-01-30.json
 create mode 100644 libraries/rush-daemon/src/PhasedRequestSummary.ts
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts

diff --git a/common/changes/@microsoft/rush/rushd-summary-banner_2026-09-24-01-30.json b/common/changes/@microsoft/rush/rushd-summary-banner_2026-09-24-01-30.json
new file mode 100644
index 0000000000..c7e8ba2f44
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-summary-banner_2026-09-24-01-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Expose the internal operation summary printer so the Rush daemon can print the native end-of-run summary.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-summary-banner_2026-09-24-01-30.json b/common/changes/@rushstack/rush-daemon/rushd-summary-banner_2026-09-24-01-30.json
new file mode 100644
index 0000000000..89b47051e2
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-summary-banner_2026-09-24-01-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Print the native operation summary tables and the \"rush <command> (<duration>)\" line for each phased request, including warm no-op builds.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index c553ceacb8..1b712f18dd 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1599,6 +1599,9 @@ export type PnpmStoreOptions = PnpmStoreLocation;
 // @public
 export type PnpmTrustPolicy = 'no-downgrade' | 'off';
 
+// @internal
+export function _printOperationStatus(terminal: ITerminal, result: IExecutionResult): void;
+
 // @beta (undocumented)
 export class ProjectChangeAnalyzer {
     constructor(rushConfiguration: RushConfiguration);
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 430751653c..1a6e9bd0a7 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -20,6 +20,7 @@ import type {
 
 import { PhasedRequestEventSink } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
+import { writePhasedRequestSummary } from './PhasedRequestSummary';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
 import { DaemonShutdownError, getDaemonShutdownReason } from './DaemonShutdownError';
@@ -71,6 +72,8 @@ interface IPreparedPhasedRequest {
   readonly requestSettings: IPhasedCommandEngineRequestSettings | undefined;
   readonly requestSettingsKey: string;
   readonly selection: IResolvedSelection;
+  /** The `performance.now()` timestamp at which the router received the request. */
+  readonly startTimeMs: number;
   readonly warningsAllowedByEnvironment: boolean;
 }
 
@@ -124,6 +127,7 @@ export class PhasedRequestRouter {
     onExecutionStarting?: () => void,
     requestSettings?: IPhasedCommandEngineRequestSettings
   ): Promise<IDaemonPhasedRequestResult> {
+    const startTimeMs: number = performance.now();
     validateRequestIdentity(request);
     const interactiveSession: IInteractiveRequestSession | undefined = validateInteractiveSession(
       request,
@@ -203,6 +207,7 @@ export class PhasedRequestRouter {
               requestSettings,
               requestSettingsKey: JSON.stringify(requestSettings ?? null),
               selection,
+              startTimeMs,
               warningsAllowedByEnvironment,
               onExecutionStarting
             },
@@ -618,6 +623,17 @@ class PhasedRequestBatchCoordinator {
     }
     const cleanupErrors: unknown[] = [...batchCleanupErrors];
     if (entry.requestSink) {
+      if (entry.participated && this.#isEntryLive(entry)) {
+        writePhasedRequestSummary({
+          activeOperations: entry.selection.activeOperations,
+          commandName: entry.request.commandName,
+          elapsedMs: performance.now() - entry.startTimeMs,
+          executionError,
+          graph: this.#graph,
+          sink: entry.requestSink,
+          warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
+        });
+      }
       try {
         await entry.requestSink.flushAsync();
       } catch (error) {
diff --git a/libraries/rush-daemon/src/PhasedRequestSummary.ts b/libraries/rush-daemon/src/PhasedRequestSummary.ts
new file mode 100644
index 0000000000..ed0628d60b
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedRequestSummary.ts
@@ -0,0 +1,182 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IOperationExecutionResult,
+  IOperationGraph,
+  Operation,
+  _IOperationActivityOptions
+} from '@microsoft/rush-lib';
+import { OperationStatus, _printOperationStatus } from '@microsoft/rush-lib';
+import { Terminal, TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
+
+const SECONDS_PER_MINUTE: number = 60;
+const MILLISECONDS_PER_SECOND: number = 1000;
+const SUMMARIZED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Aborted,
+  OperationStatus.Blocked,
+  OperationStatus.Failure,
+  OperationStatus.FromCache,
+  OperationStatus.NoOp,
+  OperationStatus.Skipped,
+  OperationStatus.Success,
+  OperationStatus.SuccessWithWarning
+]);
+
+/** The subset of a request event sink used to render a request's end-of-run summary. */
+export interface IPhasedRequestSummarySink {
+  getObservedResult(operation: Operation): { readonly executionResult: IOperationExecutionResult } | undefined;
+  onActivity(text: string, options?: _IOperationActivityOptions): void;
+}
+
+export interface IWritePhasedRequestSummaryOptions {
+  readonly activeOperations: ReadonlyArray<Operation>;
+  readonly commandName: string;
+  readonly elapsedMs: number;
+  readonly executionError: unknown;
+  readonly graph: IOperationGraph;
+  readonly sink: IPhasedRequestSummarySink;
+  /** Whether the request environment allows warnings in a successful build (`RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD`). */
+  readonly warningsAllowedByEnvironment: boolean;
+}
+
+/**
+ * Buffers terminal output into request-scoped activity events, one event per contiguous stream run.
+ */
+class RequestActivityTerminalProvider implements ITerminalProvider {
+  public readonly supportsColor: boolean = false;
+  public readonly eolCharacter: string = '\n';
+  readonly #sink: IPhasedRequestSummarySink;
+  #buffer: string = '';
+  #stderr: boolean = false;
+
+  public constructor(sink: IPhasedRequestSummarySink) {
+    this.#sink = sink;
+  }
+
+  public write(text: string, severity: TerminalProviderSeverity): void {
+    if (severity === TerminalProviderSeverity.verbose || severity === TerminalProviderSeverity.debug) {
+      return;
+    }
+    const stderr: boolean =
+      severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning;
+    if (stderr !== this.#stderr) {
+      this.flush();
+      this.#stderr = stderr;
+    }
+    this.#buffer += text;
+  }
+
+  public flush(): void {
+    if (this.#buffer.length > 0) {
+      this.#sink.onActivity(this.#buffer, { stderr: this.#stderr });
+      this.#buffer = '';
+    }
+  }
+}
+
+/**
+ * Writes the native end-of-run summary (the status tables and the `rush <command> (<duration>)` line) for one
+ * phased request into that request's own event sink.
+ *
+ * @remarks
+ * Coalesced requests share one graph iteration, so the summary is computed per request from the request's own
+ * selection rather than from the whole iteration. Selected operations that the warm graph did not need to run are
+ * reported as already up to date, so a warm no-op still reports what it checked.
+ */
+export function writePhasedRequestSummary(options: IWritePhasedRequestSummaryOptions): void {
+  const { commandName, elapsedMs, executionError, sink } = options;
+  const provider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(sink);
+  const terminal: Terminal = new Terminal(provider);
+  const duration: string = formatDuration(elapsedMs);
+  if (executionError === undefined) {
+    const operationResults: ReadonlyMap<Operation, IOperationExecutionResult> =
+      collectSummaryResults(options);
+    _printOperationStatus(terminal, {
+      operationResults,
+      status: getSummaryStatus(operationResults, options.warningsAllowedByEnvironment)
+    });
+    terminal.writeLine(`rush ${commandName} (${duration})`);
+  } else {
+    terminal.writeErrorLine(`rush ${commandName} - Errors! (${duration})`);
+  }
+  provider.flush();
+}
+
+function collectSummaryResults(
+  options: IWritePhasedRequestSummaryOptions
+): ReadonlyMap<Operation, IOperationExecutionResult> {
+  const { activeOperations, graph, sink } = options;
+  const active: ReadonlySet<Operation> = new Set(activeOperations);
+  const results: Map<Operation, IOperationExecutionResult> = new Map();
+  // Iterate the graph so the summary lists operations in the same order as the native summary.
+  for (const operation of graph.operations) {
+    if (!active.has(operation) || operation.runner?.silent !== false) {
+      continue;
+    }
+    const observed: IOperationExecutionResult | undefined =
+      sink.getObservedResult(operation)?.executionResult;
+    if (observed && !observed.silent) {
+      if (SUMMARIZED_STATUSES.has(observed.status)) {
+        results.set(operation, observed);
+      }
+      continue;
+    }
+    // A silent observed record belongs to an operation the graph disabled because it was already up to date.
+    const previous: IOperationExecutionResult | undefined =
+      observed ?? graph.resultByOperation.get(operation);
+    if (previous) {
+      results.set(operation, createUpToDateResult(previous));
+    }
+  }
+  return results;
+}
+
+function createUpToDateResult(previous: IOperationExecutionResult): IOperationExecutionResult {
+  // The summary only reads these members for skipped operations; the shared record itself must not change.
+  const upToDate: Pick<IOperationExecutionResult, 'operation' | 'silent' | 'status' | 'stopwatch'> = {
+    operation: previous.operation,
+    silent: false,
+    status: OperationStatus.Skipped,
+    stopwatch: previous.stopwatch
+  };
+  return upToDate as IOperationExecutionResult;
+}
+
+function getSummaryStatus(
+  results: ReadonlyMap<Operation, IOperationExecutionResult>,
+  warningsAllowedByEnvironment: boolean
+): OperationStatus {
+  let status: OperationStatus = OperationStatus.Success;
+  for (const [operation, result] of results) {
+    switch (result.status) {
+      case OperationStatus.Failure:
+      case OperationStatus.Blocked:
+        return OperationStatus.Failure;
+      case OperationStatus.Aborted:
+        status = OperationStatus.Aborted;
+        break;
+      case OperationStatus.SuccessWithWarning:
+        if (
+          status === OperationStatus.Success &&
+          !warningsAllowedByEnvironment &&
+          !operation.runner?.warningsAreAllowed
+        ) {
+          status = OperationStatus.SuccessWithWarning;
+        }
+        break;
+    }
+  }
+  return status;
+}
+
+/** Matches the native Rush stopwatch format, for example `1.23 seconds` or `2 minutes 3.4 seconds`. */
+function formatDuration(elapsedMs: number): string {
+  const totalSeconds: number = elapsedMs / MILLISECONDS_PER_SECOND;
+  if (totalSeconds > SECONDS_PER_MINUTE) {
+    const minutes: number = Math.floor(totalSeconds / SECONDS_PER_MINUTE);
+    const seconds: number = totalSeconds % SECONDS_PER_MINUTE;
+    return `${minutes.toFixed(0)} minute${minutes === 1 ? '' : 's'} ${seconds.toFixed(1)} seconds`;
+  }
+  return `${totalSeconds.toFixed(2)} seconds`;
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts b/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts
new file mode 100644
index 0000000000..a2f05f65af
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts
@@ -0,0 +1,185 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonPhasedOperationSelection, IDaemonPhasedRequest } from '@rushstack/rush-daemon-protocol';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const DURATION_LINE: RegExp = /^rush build \(\d+\.\d\d seconds\)$/m;
+
+function createRequest(requestId: string, ...operationIds: string[]): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: operationIds.map(
+      (operationId: string): IDaemonPhasedOperationSelection => ({ enabledState: true, operationId })
+    ),
+    requestId
+  };
+}
+
+function createFixture(statusA: OperationStatus = OperationStatus.Success): ITestRoutingFixture {
+  return createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A, statusA)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+      [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+    ]),
+    [[OPERATION_B, OPERATION_A]]
+  );
+}
+
+function getActivity(client: TestPhasedRequestClient, stream: 'stdout' | 'stderr'): string {
+  let text: string = '';
+  for (const { event } of client.writes) {
+    const payload: { stream?: string; text?: string } | undefined =
+      event?.type === 'activityChanged' ? (event.payload as { stream?: string; text?: string }) : undefined;
+    if (payload?.stream === stream) {
+      text += payload.text;
+    }
+  }
+  return text;
+}
+
+function getSummary(stdout: string): string {
+  // Operation headers are structured events, so the first activity banner starts the end-of-run summary.
+  return stdout.slice(stdout.indexOf('==[ '));
+}
+
+describe('phased request summary', () => {
+  it('reports the native summary tables and duration line after a cold build', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      await new PhasedRequestRouter(fixture.session).executeAsync(
+        createRequest('cold', OPERATION_B),
+        client
+      );
+      const stdout: string = getActivity(client, 'stdout');
+      const summary: string = getSummary(stdout);
+      expect(summary).toContain('==[ SUCCESS: 2 operations ]==');
+      expect(summary).toContain('These operations completed successfully:');
+      expect(summary).toContain(`  ${OPERATION_A}`);
+      expect(summary).toContain(`  ${OPERATION_B}`);
+      expect(summary).not.toContain(OPERATION_C);
+      expect(stdout).toMatch(DURATION_LINE);
+      expect(stdout.indexOf('==[ SUCCESS')).toBeLessThan(stdout.search(DURATION_LINE));
+      expect(client.writes[client.writes.length - 1].result).toBeDefined();
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports up-to-date operations and the duration line for a warm no-op', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(createRequest('cold', OPERATION_B), new TestPhasedRequestClient());
+      // Simulate the incremental plugin disabling every operation whose inputs did not change.
+      fixture.graph.hooks.configureIteration.tap('test', (records) => {
+        for (const record of records.values()) {
+          record.enabled = false;
+        }
+      });
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result = await router.executeAsync(createRequest('warm', OPERATION_B), client);
+      expect(result.scheduled).toBe(false);
+      const stdout: string = getActivity(client, 'stdout');
+      expect(stdout).toContain('==[ SKIPPED: 2 operations ]==');
+      expect(stdout).toContain('These operations were already up to date:');
+      expect(stdout).toMatch(DURATION_LINE);
+      expect(getActivity(client, 'stderr')).toBe('');
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports failed and blocked operations and the duration line for a failing build', async () => {
+    const fixture: ITestRoutingFixture = createFixture(OperationStatus.Failure);
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result = await new PhasedRequestRouter(fixture.session).executeAsync(
+        createRequest('failing', OPERATION_B),
+        client
+      );
+      expect(result.exitCode).not.toBe(0);
+      const stdout: string = getActivity(client, 'stdout');
+      expect(stdout).toContain('==[ BLOCKED: 1 operation ]==');
+      expect(stdout).toContain('==[ FAILURE: 1 operation ]==');
+      expect(stdout).toContain(`--[ FAILURE: ${OPERATION_A} ]--`);
+      expect(stdout).toMatch(DURATION_LINE);
+      expect(getActivity(client, 'stderr')).toContain('Operations failed.');
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('honors the request warnings policy in the summary verdict', async () => {
+    for (const [allowWarnings, expectedVerdict] of [
+      ['0', 'Operations succeeded with warnings.'],
+      ['1', '']
+    ] as const) {
+      const fixture: ITestRoutingFixture = createFixture(OperationStatus.SuccessWithWarning);
+      try {
+        const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+        await new PhasedRequestRouter(fixture.session).executeAsync(
+          {
+            ...createRequest('warning', OPERATION_A),
+            environment: { RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD: allowWarnings }
+          },
+          client
+        );
+        expect(getActivity(client, 'stdout')).toContain('==[ SUCCESS WITH WARNINGS: 1 operation ]==');
+        expect(getActivity(client, 'stdout')).toMatch(DURATION_LINE);
+        const stderr: string = getActivity(client, 'stderr');
+        if (expectedVerdict) {
+          expect(stderr).toContain(expectedVerdict);
+        } else {
+          expect(stderr).not.toContain('Operations succeeded with warnings.');
+        }
+      } finally {
+        await fixture.session[Symbol.asyncDispose]();
+      }
+    }
+  });
+
+  it('gives each coalesced request a summary of only its own selection', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      await Promise.all([
+        router.executeAsync(createRequest('a', OPERATION_A), clientA),
+        router.executeAsync(createRequest('c', OPERATION_C), clientC)
+      ]);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+      const stdoutA: string = getSummary(getActivity(clientA, 'stdout'));
+      const stdoutC: string = getSummary(getActivity(clientC, 'stdout'));
+      expect(stdoutA).toContain('==[ SUCCESS: 1 operation ]==');
+      expect(stdoutA).toContain(`  ${OPERATION_A}`);
+      expect(stdoutA).not.toContain(OPERATION_C);
+      expect(stdoutC).toContain('==[ SUCCESS: 1 operation ]==');
+      expect(stdoutC).toContain(`  ${OPERATION_C}`);
+      expect(stdoutC).not.toContain(OPERATION_A);
+      expect(stdoutA).toMatch(DURATION_LINE);
+      expect(stdoutC).toMatch(DURATION_LINE);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index 8af91cfeca..a2346d9e99 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -174,6 +174,7 @@ export type {
 export { type IOperationOptions, type OperationEnabledState, Operation } from './logic/operations/Operation';
 export { type IParallelismScalar, type Parallelism } from './logic/operations/ParseParallelism';
 export { OperationStatus } from './logic/operations/OperationStatus';
+export { _printOperationStatus } from './logic/operations/OperationResultSummarizerPlugin';
 export {
   PhasedCommandEngine,
   type IPhasedCommandEngine,
diff --git a/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap b/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
index 799804d99f..e6cb906e49 100644
--- a/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
+++ b/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
@@ -69,6 +69,7 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   '_OperationStateFile',
   '_RushGlobalFolder',
   '_RushInternals',
+  '_printOperationStatus',
   '_rushSdk_loadInternalModule',
   'captureProjectConfigurationFingerprintAsync',
   'captureWorkspaceInputFingerprintAsync',

From 3d690ab03afea0a9e455874d89faa3b68689e524 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Fri, 25 Sep 2026 13:26:42 -0700
Subject: [PATCH 013/265] [rush-daemon] Fix summary writer racing early
 coalesced results (#6095)

The early per-client result path (#6092) runs from onOperationCompleted, which the record's finalizeOperation() invokes synchronously before closing its StdioSummarizer. The summary writer (#6068) reads the failure tail from that summarizer, so it threw. Yield once before producing the early result.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 ...ix-main-summary-race_2026-09-24-21-45.json | 11 ++++
 .../rush-daemon/src/PhasedRequestRouter.ts    | 22 +++++---
 .../src/test/PhasedRequestSummary.test.ts     | 51 +++++++++++++++++++
 3 files changed, 76 insertions(+), 8 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/fix-main-summary-race_2026-09-24-21-45.json

diff --git a/common/changes/@rushstack/rush-daemon/fix-main-summary-race_2026-09-24-21-45.json b/common/changes/@rushstack/rush-daemon/fix-main-summary-race_2026-09-24-21-45.json
new file mode 100644
index 0000000000..8c97b33d05
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/fix-main-summary-race_2026-09-24-21-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Fix an early coalesced phased result writing its summary before the failed operation's output summarizer was closed.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 1a6e9bd0a7..c943eee794 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -572,15 +572,21 @@ class PhasedRequestBatchCoordinator {
     }
     entry.unsubscribe?.();
     entry.unsubscribe = undefined;
-    entry.finishPromise = this.#produceResultAsync(entry, true, undefined, [], undefined, true).catch(
-      (error: unknown) => {
-        // Unlike a batch-wide failure, an early result's failure concerns only this client.
-        if (!entry.completed) {
-          this.#completeEntry(entry);
-          entry.reject(error);
-        }
+    entry.finishPromise = this.#produceEarlyResultAsync(entry).catch((error: unknown) => {
+      // Unlike a batch-wide failure, an early result's failure concerns only this client.
+      if (!entry.completed) {
+        this.#completeEntry(entry);
+        entry.reject(error);
       }
-    );
+    });
+  }
+
+  async #produceEarlyResultAsync(entry: IBatchEntry): Promise<void> {
+    // The sink is notified from the record's `finalizeOperation()`, which synchronously precedes the close of
+    // the record's StdioSummarizer and ProblemCollector. The summary reads the failure tail from the closed
+    // summarizer, so yield once to let the notifying record finish closing before the summary is written.
+    await Promise.resolve();
+    await this.#produceResultAsync(entry, true, undefined, [], undefined, true);
   }
 
   #requestIterationAbort(): void {
diff --git a/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts b/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts
index a2f05f65af..5c3063d1ba 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestSummary.test.ts
@@ -156,6 +156,57 @@ describe('phased request summary', () => {
     }
   });
 
+  it('writes the failure summary before an early result while the coalesced batch continues', async () => {
+    let releaseC: () => void = () => undefined;
+    const cHeld: Promise<void> = new Promise<void>((resolve) => {
+      releaseC = resolve;
+    });
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [
+          OPERATION_A,
+          new TestOperationRunner(OPERATION_A, OperationStatus.Failure, async (terminal) =>
+            terminal.writeErrorLine('a-failure-detail')
+          )
+        ],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C, OperationStatus.Success, () => cHeld)]
+      ]),
+      [[OPERATION_B, OPERATION_A]]
+    );
+    fixture.graph.parallelism = 2;
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const resultAPromise = router.executeAsync(createRequest('a', OPERATION_A), clientA);
+      const resultCPromise = router.executeAsync(createRequest('c', OPERATION_C), clientC);
+
+      const resultA = await resultAPromise;
+      // The early result is published while the shared iteration still runs the other client's selection.
+      expect(fixture.graph.status).toBe(OperationStatus.Executing);
+      expect(resultA).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      const stdoutA: string = getActivity(clientA, 'stdout');
+      const summaryA: string = getSummary(stdoutA);
+      expect(summaryA).toContain('==[ FAILURE: 1 operation ]==');
+      expect(summaryA).toContain(`--[ FAILURE: ${OPERATION_A} ]--`);
+      expect(summaryA).toContain('a-failure-detail');
+      expect(summaryA).not.toContain(OPERATION_C);
+      expect(stdoutA).toMatch(DURATION_LINE);
+      expect(getActivity(clientA, 'stderr')).toContain('Operations failed.');
+      expect(clientA.writes[clientA.writes.length - 1].result).toBe(resultA);
+
+      releaseC();
+      const resultC = await resultCPromise;
+      expect(resultC).toMatchObject({ exitCode: 0, outcome: 'success' });
+      const summaryC: string = getSummary(getActivity(clientC, 'stdout'));
+      expect(summaryC).toContain('==[ SUCCESS: 1 operation ]==');
+      expect(summaryC).not.toContain(OPERATION_A);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
   it('gives each coalesced request a summary of only its own selection', async () => {
     const fixture: ITestRoutingFixture = createFixture();
     try {

From c026f9e004d59e055e324b8133da523b0084602e Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Fri, 25 Sep 2026 16:19:07 -0700
Subject: [PATCH 014/265] [rush-daemon] Terminate running operations when a
 daemon client cancels (#6065)

* [rush-daemon] Terminate running operations when a daemon client cancels

Fixes #6060

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Address review: kill exited-shell process groups, honor aborted flag, detach pre-execution cancellations

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Tolerate gated scripts being terminated by a hard abort in native engine tests

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../rush-cli-client/src/clientCancellation.ts |  40 ++++
 apps/rush-cli-client/src/launchClient.ts      |  38 +++-
 .../src/test/launchClient.test.ts             |  51 +++++
 .../test/persistentIpcCancellation.test.ts    |   5 +-
 .../rushd-cancel-hard-abort_2026-09-23.json   |  11 +
 .../rushd-cancel-hard-abort_2026-09-23.json   |  11 +
 .../rushd-cancel-hard-abort_2026-09-23.json   |  11 +
 common/reviews/api/rush-lib.api.md            |   5 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  74 ++++++-
 .../src/test/NativeEngineTestCommands.ts      |   2 +
 .../src/test/PhasedRequestBatching.test.ts    |  20 +-
 .../test/PhasedRequestCancellation.test.ts    | 189 +++++++++++++++++
 .../test/PhasedRequestRouterTestUtilities.ts  |  16 +-
 .../cli/scriptActions/PhasedScriptAction.ts   |   3 +-
 .../src/logic/operations/IOperationGraph.ts   |   5 +-
 .../src/logic/operations/IOperationRunner.ts  |   8 +
 .../operations/OperationExecutionRecord.ts    |   6 +
 .../src/logic/operations/OperationGraph.ts    |  21 +-
 .../logic/operations/ShellOperationRunner.ts  |  46 +++-
 .../test/ShellOperationRunnerAbort.test.ts    | 199 ++++++++++++++++++
 20 files changed, 720 insertions(+), 41 deletions(-)
 create mode 100644 apps/rush-cli-client/src/clientCancellation.ts
 create mode 100644 common/changes/@microsoft/rush/rushd-cancel-hard-abort_2026-09-23.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/rushd-cancel-hard-abort_2026-09-23.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-cancel-hard-abort_2026-09-23.json
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerAbort.test.ts

diff --git a/apps/rush-cli-client/src/clientCancellation.ts b/apps/rush-cli-client/src/clientCancellation.ts
new file mode 100644
index 0000000000..4c60a964eb
--- /dev/null
+++ b/apps/rush-cli-client/src/clientCancellation.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+
+import type { DaemonClientOutcome } from '@rushstack/rush-client-core';
+
+/** Signals that cancel a daemon-routed command. */
+export const CANCELLATION_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+
+const SIGNAL_EXIT_CODE_BASE: number = 128;
+
+/**
+ * Returns the conventional shell exit code for a process terminated by `signal` (128 + signal number),
+ * e.g. 130 for SIGINT and 143 for SIGTERM.
+ */
+export function getSignalExitCode(signal: NodeJS.Signals): number {
+  return SIGNAL_EXIT_CODE_BASE + (os.constants.signals[signal] ?? os.constants.signals.SIGINT);
+}
+
+/** Formats the notice printed when a daemon-routed command is cancelled. */
+export function formatCancellationMessage(commandName: string): string {
+  return `rush-client: ${commandName} cancelled.\n`;
+}
+
+/**
+ * Returns whether a daemon outcome represents a cancelled command. A result is cancelled when the daemon reports it
+ * as aborted, even if an operation failure determines its semantic outcome. A completed (non-aborted) result wins
+ * over a late signal, and a rejection is never reported as a cancellation.
+ */
+export function isCancelledOutcome(outcome: DaemonClientOutcome, signalled: boolean): boolean {
+  switch (outcome.kind) {
+    case 'result':
+      return outcome.result.aborted;
+    case 'rejected':
+      return false;
+    default:
+      return signalled;
+  }
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 1145164c4f..6ae500af55 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -26,6 +26,12 @@ import { executeDaemonCommandAsync } from './daemonCommands';
 import { formatAdmissionFailure, getConfiguredAdmission } from './ClientAdmissionControls';
 import { ClientOperationRenderer } from './ClientOperationRenderer';
 import type { AgentProgressRenderer } from './AgentProgressRenderer';
+import {
+  CANCELLATION_SIGNALS,
+  formatCancellationMessage,
+  getSignalExitCode,
+  isCancelledOutcome
+} from './clientCancellation';
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
@@ -148,9 +154,13 @@ export async function launchClientAsync(
     return;
   }
   const abort: AbortController = new AbortController();
-  const onSignal = (): void => abort.abort();
-  process.on('SIGINT', onSignal);
-  process.on('SIGTERM', onSignal);
+  let cancellationSignal: NodeJS.Signals | undefined;
+  // Windows test harnesses emit signals without a name; treat those as Ctrl+C.
+  const onSignal = (signal?: NodeJS.Signals): void => {
+    cancellationSignal ??= signal ?? 'SIGINT';
+    abort.abort();
+  };
+  for (const signal of CANCELLATION_SIGNALS) process.on(signal, onSignal);
   const renderer: ClientOperationRenderer = new ClientOperationRenderer({
     requestId: request.requestId,
     colorLevel: terminal.supportsColor ? 1 : 0,
@@ -166,7 +176,7 @@ export async function launchClientAsync(
     writeAsync: (bytes, stream) =>
       writeStreamAsync(stream === 'stderr' ? process.stderr : process.stdout, bytes)
   });
-  let outcome: DaemonClientOutcome;
+  let outcome: DaemonClientOutcome | undefined;
   const discoveryLines: string[] = [];
   const writeDiscoveryAsync = async (): Promise<void> => {
     if (discoveryLines.length > 0) {
@@ -215,16 +225,27 @@ export async function launchClientAsync(
           }
         : undefined
     });
+  } catch (error) {
+    // After cancellation, a transport failure (e.g. the cancellation deadline) still means "cancelled".
+    if (!abort.signal.aborted || !(error instanceof DaemonClientError)) throw error;
+    outcome = undefined;
   } finally {
-    process.removeListener('SIGINT', onSignal);
-    process.removeListener('SIGTERM', onSignal);
+    for (const signal of CANCELLATION_SIGNALS) process.removeListener(signal, onSignal);
     try {
       await renderer.closeAsync();
     } finally {
       await client.closeAsync();
     }
   }
-  if (outcome.kind === 'result') {
+  if (outcome === undefined || isCancelledOutcome(outcome, abort.signal.aborted)) {
+    const exitCode: number = getSignalExitCode(cancellationSignal ?? 'SIGINT');
+    agentRenderer?.finish({ exitCode, errorMessage: 'cancelled' });
+    process.exitCode = exitCode;
+    // After SIGHUP the terminal may be gone; the exit code is what matters.
+    await writeStreamAsync(process.stderr, Buffer.from(formatCancellationMessage(route.commandName))).catch(
+      () => undefined
+    );
+  } else if (outcome.kind === 'result') {
     agentRenderer?.finish(outcome.result);
     process.exitCode = outcome.result.exitCode;
     const diagnostic: string | undefined = getResultDiagnostic(outcome.result);
@@ -239,9 +260,6 @@ export async function launchClientAsync(
   } else if (outcome.kind === 'rejected') {
     agentRenderer?.finish({ exitCode: 1, errorMessage: `daemon rejected the request (${outcome.rejection.code})` });
     throw new Error(`Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`);
-  } else if (abort.signal.aborted) {
-    agentRenderer?.finish({ exitCode: 130, errorMessage: 'cancelled' });
-    process.exitCode = 130;
   } else {
     agentRenderer?.dispose();
     process.stderr.write(`rush-client: ${outcome.message ?? outcome.reason}; using in-process Rush.\n`);
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index d454c99c4e..39b091f31f 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -11,6 +11,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { Rush } from '@microsoft/rush-lib';
 import { DaemonClient, connectOrStartDaemonAsync, getDaemonLogFilePath } from '@rushstack/rush-client-core';
+import type { DaemonClientOutcome } from '@rushstack/rush-client-core';
 import { RushDaemonHost, WorkspaceSession } from '@rushstack/rush-daemon';
 import {
   removeTestFolderAsync,
@@ -20,6 +21,12 @@ import { captureTestDaemonListenerAsync } from '@rushstack/rush-daemon/lib/test/
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
+import {
+  CANCELLATION_SIGNALS,
+  formatCancellationMessage,
+  getSignalExitCode,
+  isCancelledOutcome
+} from '../clientCancellation';
 
 interface IInvocationResult {
   readonly code: number | undefined;
@@ -493,3 +500,47 @@ describe('standalone rushx fallback', () => {
     expect(result.stderr).toContain('--no-daemon cannot be combined with daemon start');
   });
 });
+
+describe('daemon client cancellation exit codes', () => {
+  const abortedResult: DaemonClientOutcome = {
+    kind: 'result',
+    result: { requestId: 'r', outcome: 'aborted', exitCode: 1, aborted: true }
+  };
+
+  it('maps cancellation signals to 128 + signal number', () => {
+    expect(getSignalExitCode('SIGINT')).toBe(130);
+    expect(getSignalExitCode('SIGTERM')).toBe(143);
+    expect(getSignalExitCode('SIGHUP')).toBe(129);
+    expect(CANCELLATION_SIGNALS).toEqual(['SIGINT', 'SIGTERM', 'SIGHUP']);
+  });
+
+  it('treats an aborted daemon result as cancelled instead of copying its exit code', () => {
+    expect(isCancelledOutcome(abortedResult, true)).toBe(true);
+    // Ctrl+C read from a raw-mode TTY cancels without a process signal.
+    expect(isCancelledOutcome(abortedResult, false)).toBe(true);
+    expect(formatCancellationMessage('build')).toBe('rush-client: build cancelled.\n');
+  });
+
+  it('treats a cancelled result as cancelled even when a failure outcome takes precedence', () => {
+    const cancelledWithFailure: DaemonClientOutcome = {
+      kind: 'result',
+      result: { requestId: 'r', outcome: 'failure', exitCode: 1, aborted: true }
+    };
+    expect(isCancelledOutcome(cancelledWithFailure, true)).toBe(true);
+  });
+
+  it('keeps completed results and rejections when a signal arrives late', () => {
+    const succeeded: DaemonClientOutcome = {
+      kind: 'result',
+      result: { requestId: 'r', outcome: 'success', exitCode: 0, aborted: false }
+    };
+    const rejected: DaemonClientOutcome = {
+      kind: 'rejected',
+      rejection: { requestId: 'r', code: 'unsupportedProtocolVersion', message: 'no' }
+    } as unknown as DaemonClientOutcome;
+    expect(isCancelledOutcome(succeeded, true)).toBe(false);
+    expect(isCancelledOutcome(rejected, true)).toBe(false);
+    expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, true)).toBe(true);
+    expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, false)).toBe(false);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts b/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
index ddc6c5eb5d..883d2f83ab 100644
--- a/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
+++ b/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
@@ -55,8 +55,9 @@ describe('public-client cancellation of an admitted Node operation', () => {
         }
         if (process.platform === 'win32') client.send('SIGINT');
         else client.kill('SIGINT');
-        // Phased cancellation preserves the daemon's existing aborted-result exit code.
-        expect(await closed).toEqual([1, null]);
+        // Cancellation terminates the client like a native signal (128 + SIGINT).
+        expect(await closed).toEqual([130, null]);
+        expect(stderr).toContain('rush-client: build cancelled.');
         expect(stderr).not.toMatch(/using in-process|not retried|timed out/i);
         expect(fixture.events().filter((event) => event.kind === 'ready')).toHaveLength(1);
         expect(fixture.events().filter((event) => event.kind === 'complete')).toHaveLength(2);
diff --git a/common/changes/@microsoft/rush/rushd-cancel-hard-abort_2026-09-23.json b/common/changes/@microsoft/rush/rushd-cancel-hard-abort_2026-09-23.json
new file mode 100644
index 0000000000..9cddb07fcf
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-cancel-hard-abort_2026-09-23.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add an opt-in hard abort for operation graphs (`abortCurrentIterationAsync({ terminateRunning: true })`) that terminates running shell operation process trees and reports them as Aborted; daemon engine graphs enable it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/rushd-cancel-hard-abort_2026-09-23.json b/common/changes/@rushstack/rush-cli-client/rushd-cancel-hard-abort_2026-09-23.json
new file mode 100644
index 0000000000..8487bcf692
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/rushd-cancel-hard-abort_2026-09-23.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Exit with 128+signal (130/143/129) and print a cancellation notice when a daemon-routed command is cancelled; handle SIGHUP like SIGTERM.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-cancel-hard-abort_2026-09-23.json b/common/changes/@rushstack/rush-daemon/rushd-cancel-hard-abort_2026-09-23.json
new file mode 100644
index 0000000000..0fc8c070a3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-cancel-hard-abort_2026-09-23.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Terminate running operations when the last live client cancels a phased request, and answer a cancelling client immediately when other clients still need the shared work.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 1b712f18dd..7b82e2af5d 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -721,7 +721,9 @@ export interface IOperationExecutionResult extends IBaseOperationExecutionResult
 // @alpha
 export interface IOperationGraph {
     readonly abortController: AbortController;
-    abortCurrentIterationAsync(): Promise<void>;
+    abortCurrentIterationAsync(options?: {
+        terminateRunning?: boolean;
+    }): Promise<void>;
     addTerminalDestination(destination: TerminalWritable): void;
     allowOversubscription: boolean;
     closeRunnersAsync(operations?: Iterable<Operation>): Promise<void>;
@@ -823,6 +825,7 @@ export interface IOperationRunner {
 
 // @beta
 export interface IOperationRunnerContext {
+    readonly abortSignal?: AbortSignal;
     collatedWriter: CollatedWriter;
     // @internal
     createChildProcessReporter(): _IOperationChildProcessReporter | undefined;
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index c943eee794..dda743a498 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -101,6 +101,12 @@ const OBSERVED_STATUS_OVERRIDES_RETAINED: ReadonlySet<OperationStatus> = new Set
   OperationStatus.Blocked,
   OperationStatus.Skipped
 ]);
+const IN_PROGRESS_STATUSES: ReadonlySet<string> = new Set<string>([
+  OperationStatus.Waiting,
+  OperationStatus.Ready,
+  OperationStatus.Queued,
+  OperationStatus.Executing
+]);
 
 /**
  * Routes one caller-resolved phased request through a real warm workspace operation graph.
@@ -422,6 +428,12 @@ class PhasedRequestBatchCoordinator {
         this.#graph,
         participants.map((entry: IBatchEntry) => entry.selection)
       );
+      for (const entry of batch) {
+        if (!participants.includes(entry)) {
+          // Clients that cancelled before execution must not wait for the participants' work.
+          this.#finishDetachedEntry(entry);
+        }
+      }
       for (const entry of participants) {
         entry.participated = true;
         const activeOperationIds: ReadonlySet<string> = new Set(
@@ -531,6 +543,16 @@ class PhasedRequestBatchCoordinator {
       }
     }
 
+    if (
+      entry.executionStarted &&
+      this.#currentBatch?.includes(entry) &&
+      this.#hasLiveBatchParticipant()
+    ) {
+      // Other live participants still need the shared work: detach this client and answer it now.
+      this.#finishDetachedEntry(entry);
+      return;
+    }
+
     if (
       entry.executionStarted &&
       this.#currentBatch &&
@@ -541,10 +563,43 @@ class PhasedRequestBatchCoordinator {
     }
   }
 
+  #finishDetachedEntry(entry: IBatchEntry): void {
+    entry.finishPromise ??= this.#produceResultAsync(
+      entry,
+      entry.participated,
+      undefined,
+      [],
+      undefined,
+      true
+    ).catch((error: unknown) => {
+      if (!entry.completed) {
+        this.#completeEntry(entry);
+        entry.reject(error);
+      }
+    });
+  }
+
   #isEntryLive(entry: IBatchEntry): boolean {
     return !entry.abortRequested && !entry.client.abortSignal.aborted && entry.outputError === undefined;
   }
 
+  /**
+   * Whether a live client still needs the current batch's iteration, including compatible requests that were
+   * accepted into the pending queue and will join the batch once the execution lease is acquired.
+   */
+  #hasLiveBatchParticipant(): boolean {
+    if (this.#currentBatch?.some((candidate: IBatchEntry) => this.#needsIteration(candidate))) {
+      return true;
+    }
+    return (
+      this.#acceptingCurrentBatch &&
+      this.#pending.some(
+        (candidate: IBatchEntry) =>
+          candidate.exclusivityClass === RequestExclusivityClass.SharedBuild && this.#isEntryLive(candidate)
+      )
+    );
+  }
+
   /** Whether a live participant still waits for the running iteration to produce its result. */
   #needsIteration(entry: IBatchEntry): boolean {
     return entry.finishPromise === undefined && this.#isEntryLive(entry);
@@ -590,7 +645,8 @@ class PhasedRequestBatchCoordinator {
   }
 
   #requestIterationAbort(): void {
-    const abortPromise: Promise<void> = this.#graph.abortCurrentIterationAsync();
+    // Nobody needs the running work any more, so terminate in-flight operations instead of awaiting them.
+    const abortPromise: Promise<void> = this.#graph.abortCurrentIterationAsync({ terminateRunning: true });
     this.#abortTail = Promise.all([this.#abortTail, abortPromise])
       .then(() => undefined)
       .catch((error: unknown) => {
@@ -984,12 +1040,14 @@ function collectOperationOutcomes(
     const retained: IOperationExecutionResult | undefined = graph.resultByOperation.get(operation);
     let status: string | undefined;
     let errorMessage: string | undefined;
-    if (
+    if (iterationInProgress && observed !== undefined) {
+      // While the iteration still runs, retained results may predate this iteration, and work this client
+      // stopped observing before it finished (a detached cancellation) was abandoned.
+      status = IN_PROGRESS_STATUSES.has(observed.status) ? OperationStatus.Aborted : observed.status;
+      errorMessage = observed.executionResult.error?.message;
+    } else if (
       observed !== undefined &&
-      // While the iteration still runs, retained results may predate this iteration.
-      (iterationInProgress ||
-        retained === undefined ||
-        OBSERVED_STATUS_OVERRIDES_RETAINED.has(observed.status))
+      (retained === undefined || OBSERVED_STATUS_OVERRIDES_RETAINED.has(observed.status))
     ) {
       status = observed.status;
       errorMessage = observed.executionResult.error?.message;
@@ -998,6 +1056,10 @@ function collectOperationOutcomes(
       errorMessage = retained?.error?.message ?? observed?.executionResult.error?.message;
     }
     status ??= fillMissingAsAborted ? OperationStatus.Aborted : undefined;
+    if (fillMissingAsAborted && status !== undefined && IN_PROGRESS_STATUSES.has(status)) {
+      // The client stopped observing before this operation finished, e.g. because it was terminated.
+      status = OperationStatus.Aborted;
+    }
     if (status === undefined) {
       continue;
     }
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts b/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
index b334e12e96..324916efbe 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
@@ -61,6 +61,8 @@ export async function createNativeScriptGateAsync(
   const server: net.Server = net.createServer((socket) => {
     sockets.add(socket);
     socket.once('close', () => sockets.delete(socket));
+    // A daemon shutdown or cancellation may terminate the gated script, which resets its connection.
+    socket.on('error', () => undefined);
     entered.resolve();
   });
   await new Promise<void>((resolve, reject) => {
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index 3d67e07eb5..1cde7c35a6 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -431,7 +431,7 @@ describe('shared phased request batching', () => {
     expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
   });
 
-  it('reports authoritative retained status when a client cancels during a shared operation', async () => {
+  it('answers a client that cancels during a shared operation immediately, without waiting for the batch', async () => {
     const operationStarted: IDeferred = createDeferred();
     const releaseOperation: IDeferred = createDeferred();
     const fixture: ITestRoutingFixture = createFixture({
@@ -448,12 +448,14 @@ describe('shared phased request batching', () => {
     await operationStarted.promise;
 
     cancelledClient.abortController.abort();
+    // The shared operation is still running for the other client.
+    const cancelledResult: IDaemonPhasedRequestResult = await cancelled;
     releaseOperation.resolve();
-    const [cancelledResult, continuingResult] = await Promise.all([cancelled, continuing]);
+    const continuingResult: IDaemonPhasedRequestResult = await continuing;
 
     expect(cancelledResult).toMatchObject({ aborted: true, outcome: 'aborted' });
     expect(cancelledResult.operationResults).toEqual([
-      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success })
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Aborted })
     ]);
     expect(continuingResult).toMatchObject({ exitCode: 0, outcome: 'success' });
     expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
@@ -486,7 +488,7 @@ describe('shared phased request batching', () => {
     ]);
   });
 
-  it('preserves failure precedence when a client cancels during a failing shared operation', async () => {
+  it('keeps failure for the continuing client when another client cancels during a failing shared operation', async () => {
     const operationStarted: IDeferred = createDeferred();
     const releaseOperation: IDeferred = createDeferred();
     const fixture: ITestRoutingFixture = createFixture({
@@ -506,14 +508,16 @@ describe('shared phased request batching', () => {
     await operationStarted.promise;
 
     cancelledClient.abortController.abort();
+    const cancelledResult: IDaemonPhasedRequestResult = await cancelled;
     releaseOperation.resolve();
-    const [cancelledResult, continuingResult] = await Promise.all([cancelled, continuing]);
+    const continuingResult: IDaemonPhasedRequestResult = await continuing;
 
-    expect(cancelledResult).toMatchObject({ aborted: true, exitCode: 1, outcome: 'failure' });
-    expect(cancelledResult.operationResults).toEqual([
+    // The cancelled client detached before the shared operation failed.
+    expect(cancelledResult).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(continuingResult).toMatchObject({ aborted: false, exitCode: 1, outcome: 'failure' });
+    expect(continuingResult.operationResults).toEqual([
       expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Failure })
     ]);
-    expect(continuingResult).toMatchObject({ aborted: false, exitCode: 1, outcome: 'failure' });
     expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
   });
 
diff --git a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
new file mode 100644
index 0000000000..7642e99cb4
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
@@ -0,0 +1,189 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ITerminal } from '@rushstack/terminal';
+import type { IDaemonPhasedRequest, IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+import { type IOperationRunnerContext, OperationStatus } from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const PROMPT_CANCELLATION_MS: number = 1000;
+
+function createRequest(requestId: string, operationId: string): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: [{ enabledState: true, operationId }],
+    requestId
+  };
+}
+
+interface IHangingOperation {
+  readonly started: Promise<void>;
+  readonly terminated: Promise<void>;
+  readonly signals: AbortSignal[];
+  readonly release: () => void;
+}
+
+/** An operation that only finishes when released, or when its hard-abort signal fires (like a killed process). */
+function createHangingOperation(): {
+  hanging: IHangingOperation;
+  actionAsync: (terminal: ITerminal, context: IOperationRunnerContext) => Promise<OperationStatus | void>;
+} {
+  let onStarted: () => void = () => undefined;
+  let onTerminated: () => void = () => undefined;
+  let release: () => void = () => undefined;
+  const released: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+  const signals: AbortSignal[] = [];
+  const hanging: IHangingOperation = {
+    started: new Promise<void>((resolve) => (onStarted = resolve)),
+    terminated: new Promise<void>((resolve) => (onTerminated = resolve)),
+    signals,
+    release: () => release()
+  };
+  const actionAsync = async (
+    terminal: ITerminal,
+    context: IOperationRunnerContext
+  ): Promise<OperationStatus | void> => {
+    const { abortSignal } = context;
+    if (!abortSignal) throw new Error('Expected a hard-abort signal for daemon operations.');
+    signals.push(abortSignal);
+    onStarted();
+    const aborted: Promise<void> = new Promise<void>((resolve) =>
+      abortSignal.addEventListener('abort', () => resolve(), { once: true })
+    );
+    await Promise.race([aborted, released]);
+    if (abortSignal.aborted) {
+      onTerminated();
+      return OperationStatus.Aborted;
+    }
+  };
+  return { hanging, actionAsync };
+}
+
+function createFixture(
+  actionAsync: (terminal: ITerminal, context: IOperationRunnerContext) => Promise<OperationStatus | void>
+): ITestRoutingFixture {
+  return createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, actionAsync)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B)]
+    ]),
+    [],
+    { supportsTerminateRunning: true }
+  );
+}
+
+describe('phased request client cancellation', () => {
+  it('terminates running operations when the last client cancels and releases the graph promptly', async () => {
+    const { hanging, actionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createFixture(actionAsync);
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_A),
+      client
+    );
+    await hanging.started;
+
+    const cancelledAt: number = Date.now();
+    client.abortController.abort();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+
+    expect(Date.now() - cancelledAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    await hanging.terminated;
+    expect(abortSpy).toHaveBeenCalledWith({ terminateRunning: true });
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(result.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Aborted })
+    ]);
+    // The aborted operation is not retained, and the next client is admitted immediately.
+    expect(fixture.graph.resultByOperation.size).toBe(0);
+    const next: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('next', OPERATION_B),
+      new TestPhasedRequestClient('two')
+    );
+    expect(next).toMatchObject({ exitCode: 0, outcome: 'success' });
+  });
+
+  it('only detaches a cancelling client while another live client still needs the running work', async () => {
+    const { hanging, actionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createFixture(actionAsync);
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_A),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    await hanging.started;
+    const abortCallsBeforeCancellation: number = abortSpy.mock.calls.length;
+
+    cancelledClient.abortController.abort();
+    const cancelledResult: IDaemonPhasedRequestResult = await cancelled;
+
+    expect(cancelledResult).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(abortSpy).toHaveBeenCalledTimes(abortCallsBeforeCancellation);
+    expect(hanging.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
+
+    hanging.release();
+    expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('answers a cancelling client at once when an accepted pending client will join the batch', async () => {
+    const { hanging, actionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createFixture(actionAsync);
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    let onReconciling: () => void = () => undefined;
+    const reconciling: Promise<void> = new Promise<void>((resolve) => (onReconciling = resolve));
+    let releaseReconcile: () => void = () => undefined;
+    const reconcileReleased: Promise<void> = new Promise<void>((resolve) => (releaseReconcile = resolve));
+    fixture.session.onReconcileAsync = async () => {
+      onReconciling();
+      await reconcileReleased;
+    };
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_A),
+      cancelledClient
+    );
+    await reconciling;
+    // Accepted while the batch is still being prepared, so it joins once preparation finishes.
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    // Let the continuing request finish preparation and enter the pending queue.
+    for (let tick: number = 0; tick < 20; tick++) {
+      await new Promise<void>((resolve) => setImmediate(resolve));
+    }
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    releaseReconcile();
+    await hanging.started;
+    expect(hanging.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+    hanging.release();
+    expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts b/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
index 41f17440d7..58a52c478d 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
@@ -137,14 +137,16 @@ export class TestOperationRunner implements IOperationRunner {
   public closeCount: number = 0;
   public runCount: number = 0;
 
-  readonly #actionAsync: ((terminal: ITerminal) => Promise<void>) | undefined;
+  readonly #actionAsync:
+    | ((terminal: ITerminal, context: IOperationRunnerContext) => Promise<void | OperationStatus>)
+    | undefined;
   readonly #status: OperationStatus;
   public readonly name: string;
 
   public constructor(
     name: string,
     status: OperationStatus = OperationStatus.Success,
-    actionAsync?: (terminal: ITerminal) => Promise<void>
+    actionAsync?: (terminal: ITerminal, context: IOperationRunnerContext) => Promise<void | OperationStatus>
   ) {
     this.name = name;
     this.#status = status;
@@ -160,8 +162,8 @@ export class TestOperationRunner implements IOperationRunner {
     this.runCount++;
     return context.runWithTerminalAsync(
       async (terminal: ITerminal): Promise<OperationStatus> => {
-        await this.#actionAsync?.(terminal);
-        return this.#status;
+        const status: void | OperationStatus = await this.#actionAsync?.(terminal, context);
+        return status ?? this.#status;
       },
       { createLogFile: false, logFileSuffix: '' }
     );
@@ -216,7 +218,8 @@ export class TestRoutingWorkspaceSession implements IWorkspaceSession {
 
 export function createRoutingFixture(
   runnerById: ReadonlyMap<string, TestOperationRunner>,
-  dependencies: ReadonlyArray<readonly [string, string]> = []
+  dependencies: ReadonlyArray<readonly [string, string]> = [],
+  graphOptionOverrides: Partial<IOperationGraphOptions> = {}
 ): ITestRoutingFixture {
   const operations: Map<string, Operation> = new Map();
   const runners: Map<string, TestOperationRunner> = new Map(runnerById);
@@ -252,7 +255,8 @@ export function createRoutingFixture(
     destinations: [new MockWritable()],
     parallelism: 1,
     pauseNextIteration: false,
-    quietMode: false
+    quietMode: false,
+    ...graphOptionOverrides
   };
   // The package's bundled public declarations and deep-import declarations describe the same runtime classes,
   // but TypeScript assigns them distinct recursive identities.
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 89a0dbd3f7..b04cb177b4 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -815,6 +815,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         getInputsSnapshotAsync: getGraphInputsSnapshotAsync,
         abortController: this.sessionAbortController,
         closeRunnersOnAbort: !onEngine,
+        supportsTerminateRunning: !!onEngine,
         telemetry: executionTelemetryHandler
       };
 
@@ -1066,7 +1067,7 @@ async function disposeEngineGraphAsync(
   graph.abortController.abort();
   const errors: unknown[] = [];
   for (const cleanupAsync of [
-    () => graph.abortCurrentIterationAsync(),
+    () => graph.abortCurrentIterationAsync({ terminateRunning: true }),
     () => graph.closeRunnersAsync(),
     async () => {
       await cobuildConfiguration?.destroyLockProviderAsync();
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index 5575bf77ab..e6b4316fbe 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -106,8 +106,11 @@ export interface IOperationGraph {
   /**
    * Abort the current execution iteration, if any. Operations that have already started
    * will run to completion; only operations that have not yet begun will be aborted.
+   *
+   * If `options.terminateRunning` is true and the graph supports it, operations that are already running are also
+   * signaled to terminate (via `IOperationRunnerContext.abortSignal`) and are reported as `Aborted`.
    */
-  abortCurrentIterationAsync(): Promise<void>;
+  abortCurrentIterationAsync(options?: { terminateRunning?: boolean }): Promise<void>;
 
   /**
    * Cleans up any resources used by the operation runners, if applicable.
diff --git a/libraries/rush-lib/src/logic/operations/IOperationRunner.ts b/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
index 1e820a0af4..f422083d85 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
@@ -63,6 +63,14 @@ export interface IOperationRunnerContext {
    */
   readonly shouldRunnerPersist: boolean;
 
+  /**
+   * When defined, this signal is aborted if the host requests termination of in-progress work
+   * (see `IOperationGraph.abortCurrentIterationAsync` with `terminateRunning: true`). Runners that observe it
+   * should promptly stop any work they started (for example, kill their child process tree) and return
+   * `OperationStatus.Aborted`. It is `undefined` when the graph does not support terminating running operations.
+   */
+  readonly abortSignal?: AbortSignal;
+
   /**
    * The environment in which the operation is being executed.
    * A return value of `undefined` indicates that it should inherit the environment from the parent process.
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index ed7c448268..129d5c04c5 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -51,6 +51,8 @@ export interface IOperationExecutionRecordContext {
   invalidate?: (operations: Iterable<Operation>, reason: string) => void;
   inputsSnapshot: IInputsSnapshot | undefined;
   maxParallelism: number;
+  /** Aborted when the host requests termination of running operations in this iteration. */
+  terminateSignal?: AbortSignal;
 
   /**
    * Optional structured event sink for dual-emit. When present, every status
@@ -245,6 +247,10 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     return this.#context.createEnvironment?.(this);
   }
 
+  public get abortSignal(): AbortSignal | undefined {
+    return this.#context.terminateSignal;
+  }
+
   public getInvalidateCallback(): (reason: string) => void {
     const invalidateFn: ((operations: Iterable<Operation>, reason: string) => void) | undefined =
       this.#context.invalidate;
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index 17a57096d0..a3ed25bb1c 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -54,6 +54,12 @@ export interface IOperationGraphOptions {
   abortController: AbortController;
   /** Hosts with awaited lifetime cleanup can disable the legacy fire-and-forget abort cleanup. */
   closeRunnersOnAbort?: boolean;
+  /**
+   * If true, runners receive `IOperationRunnerContext.abortSignal`, and
+   * `abortCurrentIterationAsync({ terminateRunning: true })` terminates operations that are already running.
+   * Runners may isolate their child processes (e.g. in a separate process group) to support this.
+   */
+  supportsTerminateRunning?: boolean;
 
   isWatch?: boolean;
   pauseNextIteration?: boolean;
@@ -82,6 +88,7 @@ interface IStatefulExecutionContext {
  */
 interface IExecutionIterationContext extends IOperationExecutionRecordContext {
   abortController: AbortController;
+  terminateController: AbortController | undefined;
   terminal: CollatedTerminal;
 
   records: Map<Operation, OperationExecutionRecord>;
@@ -176,6 +183,7 @@ export class OperationGraph implements IOperationGraph {
 
   // Immutable properties from options
   readonly #isWatch: boolean;
+  readonly #supportsTerminateRunning: boolean;
   readonly #telemetry: IOperationGraphTelemetry | undefined;
   readonly #getInputsSnapshotAsync: (() => Promise<IInputsSnapshot | undefined>) | undefined;
 
@@ -220,11 +228,13 @@ export class OperationGraph implements IOperationGraph {
       abortController,
       isWatch = false,
       pauseNextIteration = false,
+      supportsTerminateRunning = false,
       telemetry,
       getInputsSnapshotAsync
     } = options;
 
     this.operations = operations;
+    this.#supportsTerminateRunning = supportsTerminateRunning;
 
     this.#maxParallelism = maxParallelism;
     this.#parallelism = coerceParallelism(parallelism, maxParallelism, 1);
@@ -627,9 +637,12 @@ export class OperationGraph implements IOperationGraph {
     return true;
   }
 
-  public async abortCurrentIterationAsync(): Promise<void> {
+  public async abortCurrentIterationAsync(options?: { terminateRunning?: boolean }): Promise<void> {
     const iteration: IExecutionIterationContext | undefined = this.#currentIteration;
     if (iteration) {
+      if (options?.terminateRunning) {
+        iteration.terminateController?.abort();
+      }
       iteration.abortController.abort();
       try {
         await iteration.promise;
@@ -709,10 +722,16 @@ export class OperationGraph implements IOperationGraph {
       return hooks.createEnvironmentForOperation.call({ ...process.env }, record);
     }
 
+    const terminateController: AbortController | undefined = this.#supportsTerminateRunning
+      ? new AbortController()
+      : undefined;
+
     // Convert the developer graph to the mutable execution graph
     const iterationContext: IExecutionIterationContext = {
       iterationId: this.#nextIterationId++,
       abortController,
+      terminateController,
+      terminateSignal: terminateController?.signal,
       startTime,
       streamCollator,
       terminal,
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
index c76fce6931..627236e23b 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
@@ -4,7 +4,7 @@
 import type * as child_process from 'node:child_process';
 import * as path from 'node:path';
 
-import { Path } from '@rushstack/node-core-library';
+import { Path, SubprocessTerminator } from '@rushstack/node-core-library';
 import { type ITerminal, type ITerminalProvider, TerminalProviderSeverity } from '@rushstack/terminal';
 
 import type { IPhase } from '../../api/CommandLineConfiguration';
@@ -103,7 +103,7 @@ export class ShellOperationRunner implements IOperationRunner {
 
         const { rushConfiguration, projectFolder } = this.#rushProject;
 
-        const { environment: initialEnvironment } = context;
+        const { environment: initialEnvironment, abortSignal } = context;
         const childProcessReporter: IOperationChildProcessReporter | undefined =
           !IS_WINDOWS && isHeftCommand(commandToRun) ? context.createChildProcessReporter() : undefined;
 
@@ -117,8 +117,28 @@ export class ShellOperationRunner implements IOperationRunner {
           },
           initialEnvironment,
           additionalEnvironment: childProcessReporter?.environment,
-          stdio: childProcessReporter?.stdio
+          stdio: childProcessReporter?.stdio,
+          // Isolate the process tree so that a hard abort can terminate it.
+          connectSubprocessTerminator: abortSignal !== undefined
         });
+        const terminateProcessTree: () => void = () => {
+          try {
+            if (!IS_WINDOWS && subProcess.pid !== undefined && typeof subProcess.exitCode === 'number') {
+              // The shell already exited, but descendants in its process group may still hold its stdio open.
+              // killProcessTree() is a no-op in that state, so signal the process group directly.
+              killExitedProcessGroup(subProcess.pid);
+            } else {
+              SubprocessTerminator.killProcessTree(subProcess, SubprocessTerminator.RECOMMENDED_OPTIONS);
+            }
+          } catch (error) {
+            terminal.writeErrorLine(`Failed to terminate the operation process tree: ${error}`);
+          }
+        };
+        if (abortSignal?.aborted) {
+          terminateProcessTree();
+        } else {
+          abortSignal?.addEventListener('abort', terminateProcessTree, { once: true });
+        }
         let reporterError: Error | undefined;
         const reporterDrainPromise: Promise<void> = childProcessReporter
           ? childProcessReporter
@@ -164,9 +184,14 @@ export class ShellOperationRunner implements IOperationRunner {
         const [{ exitCode, signal }]: [
           { readonly exitCode: number | null; readonly signal: NodeJS.Signals | null },
           void
-        ] = await Promise.all([closePromise, reporterDrainPromise]);
+        ] = await Promise.all([closePromise, reporterDrainPromise]).finally(() => {
+          abortSignal?.removeEventListener('abort', terminateProcessTree);
+        });
 
-        if (signal) {
+        if (abortSignal?.aborted) {
+          terminal.writeLine('Terminated because the operation was aborted.');
+          return OperationStatus.Aborted;
+        } else if (signal) {
           // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
           context.error = new OperationError('error', `Terminated by signal: ${signal}`);
           return OperationStatus.Failure;
@@ -195,6 +220,17 @@ export class ShellOperationRunner implements IOperationRunner {
   }
 }
 
+function killExitedProcessGroup(pid: number): void {
+  try {
+    // The process group ID cannot be reused while any member of the group is still alive.
+    process.kill(-pid, 'SIGKILL');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ESRCH') {
+      throw error;
+    }
+  }
+}
+
 /**
  * Returns whether a lifecycle command directly launches Heft.
  *
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerAbort.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerAbort.test.ts
new file mode 100644
index 0000000000..930f63170d
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerAbort.test.ts
@@ -0,0 +1,199 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { MockWritable } = jest.requireActual('@rushstack/terminal');
+  return { ...actual, initializeProjectLogFilesAsync: jest.fn(async () => new MockWritable()) };
+});
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { type ILifecycleCommandOptions, Utilities } from '../../../utilities/Utilities';
+import type { IExecutionResult } from '../IOperationExecutionResult';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+
+// Spawns a grandchild that never exits, reports its PID, then waits forever itself.
+const NEVER_ENDING_TREE_SCRIPT: string = `
+  const grandchild = require('node:child_process').spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+  process.stdout.write('grandchild=' + grandchild.pid + '\\n');
+  setInterval(() => {}, 1000);
+`;
+
+// Spawns a grandchild that inherits stdout and never exits, reports its PID, then exits itself.
+const EXITED_PARENT_TREE_SCRIPT: string = `
+  const grandchild = require('node:child_process').spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: ['ignore', 'inherit', 'ignore'] });
+  process.stdout.write('grandchild=' + grandchild.pid + '\\n', () => process.exit(0));
+`;
+
+function isAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function waitForExitAsync(pid: number, timeoutMs: number): Promise<boolean> {
+  const deadline: number = Date.now() + timeoutMs;
+  while (isAlive(pid)) {
+    if (Date.now() >= deadline) return false;
+    await delayAsync(20);
+  }
+  return true;
+}
+
+describe('ShellOperationRunner hard abort', () => {
+  let child: ChildProcess | undefined;
+  let grandchildPid: number | undefined;
+  let spawnOptions: ILifecycleCommandOptions | undefined;
+
+  function createGraph(
+    supportsTerminateRunning: boolean,
+    script: string = NEVER_ENDING_TREE_SCRIPT
+  ): {
+    graph: OperationGraph;
+    grandchildStarted: Promise<number>;
+  } {
+    let onGrandchild: (pid: number) => void = () => undefined;
+    const grandchildStarted: Promise<number> = new Promise((resolve) => (onGrandchild = resolve));
+    jest.spyOn(Utilities, 'executeLifecycleCommandAsync').mockImplementation((command, options) => {
+      spawnOptions = options;
+      child = spawn(process.execPath, ['-e', script], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        detached: !!options.connectSubprocessTerminator && SubprocessTerminator.RECOMMENDED_OPTIONS.detached
+      });
+      child.stdout!.on('data', (chunk: Buffer) => {
+        const match: RegExpMatchArray | null = chunk.toString().match(/grandchild=(\d+)/);
+        if (match) {
+          grandchildPid = Number(match[1]);
+          onGrandchild(grandchildPid);
+        }
+      });
+      return child;
+    });
+    const phase: IPhase = {
+      name: 'build',
+      allowWarningsOnSuccess: false,
+      associatedParameters: new Set(),
+      dependencies: { self: new Set(), upstream: new Set() },
+      isSynthetic: false,
+      logFilenameIdentifier: 'build',
+      missingScriptBehavior: 'silent'
+    };
+    const project: RushConfigurationProject = {
+      packageName: 'sleeper',
+      projectFolder: __dirname,
+      rushConfiguration: { commonTempFolder: __dirname }
+    } as RushConfigurationProject;
+    const runner: ShellOperationRunner = new ShellOperationRunner({
+      phase,
+      rushProject: project,
+      displayName: 'sleeper',
+      initialCommand: 'node sleeper.js',
+      incrementalCommand: undefined,
+      commandForHash: 'node sleeper.js',
+      ignoredParameterValues: []
+    });
+    const operation: Operation = new Operation({ phase, project, runner, logFilenameIdentifier: 'sleeper' });
+    const graph: OperationGraph = new OperationGraph(new Set([operation]), {
+      quietMode: true,
+      debugMode: false,
+      parallelism: 1,
+      allowOversubscription: true,
+      destinations: [new MockWritable()],
+      abortController: new AbortController(),
+      supportsTerminateRunning
+    });
+    return { graph, grandchildStarted };
+  }
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    const lastChild: ChildProcess | undefined = child;
+    const lastGrandchildPid: number | undefined = grandchildPid;
+    child = undefined;
+    grandchildPid = undefined;
+    spawnOptions = undefined;
+    if (lastGrandchildPid !== undefined && isAlive(lastGrandchildPid)) {
+      process.kill(lastGrandchildPid, 'SIGKILL');
+    }
+    if (lastChild && lastChild.exitCode === null && lastChild.signalCode === null) {
+      const closed: Promise<unknown> = once(lastChild, 'close');
+      lastChild.kill('SIGKILL');
+      await closed;
+    }
+  });
+
+  it('kills the running process tree and reports Aborted without waiting for it to finish', async () => {
+    const { graph, grandchildStarted } = createGraph(true);
+    const execution: Promise<IExecutionResult> = graph.executeAsync({});
+    const pid: number = await grandchildStarted;
+    expect(spawnOptions?.connectSubprocessTerminator).toBe(true);
+
+    const abortStart: number = Date.now();
+    await graph.abortCurrentIterationAsync({ terminateRunning: true });
+    const result: IExecutionResult = await execution;
+
+    expect(Date.now() - abortStart).toBeLessThan(5000);
+    expect(result.status).toBe(OperationStatus.Aborted);
+    const [record] = [...result.operationResults.values()];
+    expect(record.status).toBe(OperationStatus.Aborted);
+    expect(record.error).toBeUndefined();
+    expect(child!.exitCode !== null || child!.signalCode !== null).toBe(true);
+    expect(await waitForExitAsync(pid, 5000)).toBe(true);
+    // Aborted operations are not retained as the last execution result.
+    expect(graph.resultByOperation.size).toBe(0);
+  }, 20000);
+
+  // Process groups are POSIX-only; Windows terminates the tree via TaskKill while the parent is alive.
+  (process.platform === 'win32' ? it.skip : it)(
+    'kills descendants that keep the output open after the shell itself has exited',
+    async () => {
+      const { graph, grandchildStarted } = createGraph(true, EXITED_PARENT_TREE_SCRIPT);
+      const execution: Promise<IExecutionResult> = graph.executeAsync({});
+      const pid: number = await grandchildStarted;
+      const parent: ChildProcess = child!;
+      if (parent.exitCode === null) {
+        await once(parent, 'exit');
+      }
+      expect(isAlive(pid)).toBe(true);
+
+      await graph.abortCurrentIterationAsync({ terminateRunning: true });
+      const result: IExecutionResult = await execution;
+
+      expect(result.status).toBe(OperationStatus.Aborted);
+      expect(await waitForExitAsync(pid, 5000)).toBe(true);
+    },
+    20000
+  );
+
+  it('does not isolate or terminate processes when the graph does not support it', async () => {
+    const { graph, grandchildStarted } = createGraph(false);
+    const execution: Promise<IExecutionResult> = graph.executeAsync({});
+    await grandchildStarted;
+    expect(spawnOptions?.connectSubprocessTerminator).toBe(false);
+
+    // A soft abort only prevents unstarted work; the running process keeps going.
+    const abortPromise: Promise<void> = graph.abortCurrentIterationAsync({ terminateRunning: true });
+    await delayAsync(300);
+    expect(child!.exitCode).toBeNull();
+    expect(child!.signalCode).toBeNull();
+
+    child!.kill('SIGKILL');
+    await abortPromise;
+    expect((await execution).status).toBe(OperationStatus.Failure);
+  }, 20000);
+});

From 982b33b16c9571b518747c68cfd1ebe1a1ccdd14 Mon Sep 17 00:00:00 2001
From: Sean Larkin <selarkin@microsoft.com>
Date: Fri, 25 Sep 2026 17:42:18 -0700
Subject: [PATCH 015/265] [rush-daemon] Invalidate warm operations whose
 declared outputs were deleted or changed (#6069)

* [rush-daemon] Invalidate warm operations whose declared outputs were deleted or changed

Fixes #6058

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Force re-execution of invalidated outputs under legacy skip detection

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [rush-daemon] Keep output fingerprints until legacy skip cleanup succeeds

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../output-invalidation_2026-09-23.json       |  10 ++
 libraries/rush-daemon/README.md               |   6 +-
 .../src/OperationOutputFingerprints.ts        | 128 ++++++++++++++++++
 .../src/ProductionDaemonRequestResolver.ts    |  11 +-
 .../ProductionDaemonRequestResolver.test.ts   |  60 ++++++++
 5 files changed, 212 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/output-invalidation_2026-09-23.json
 create mode 100644 libraries/rush-daemon/src/OperationOutputFingerprints.ts

diff --git a/common/changes/@rushstack/rush-daemon/output-invalidation_2026-09-23.json b/common/changes/@rushstack/rush-daemon/output-invalidation_2026-09-23.json
new file mode 100644
index 0000000000..217487259d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/output-invalidation_2026-09-23.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Re-run or restore a warm operation when its declared output folders were deleted or changed outside the daemon, instead of reporting it as up to date.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 4ee695eba8..8f745e2993 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -135,7 +135,11 @@ fallback can run immediately after a completed single-client warm request withou
 A real native command holding the lock causes preparation or execution to be refused; there is no lock bypass or
 automatic retry. A later explicit request can retry after contention ends, including contention during the first
 engine initialization. A dirty native lock left by another command invalidates retained successes so the native
-incremental/cache pipeline can reconcile possibly changed ignored outputs. Installation validity is also checked on
+incremental/cache pipeline can reconcile possibly changed ignored outputs. Declared `outputFolderNames` are also
+fingerprinted (one `stat` per folder: existence, identity and modification time) when an operation succeeds or is
+restored from cache; a request whose reconciliation finds a missing or changed output folder (for example after
+`rm -rf lib`, `git clean -xdf` or `heft clean`) invalidates only that operation, so it is re-executed or restored from
+the build cache. In-place edits of nested output files are not detected. Installation validity is also checked on
 every snapshot refresh. Disposal stops new leases, awaits an outstanding lease, then aborts the graph lifetime and awaits
 runner/provider cleanup. The existing operation-completion cleanup is unchanged.
 
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
new file mode 100644
index 0000000000..7536718113
--- /dev/null
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -0,0 +1,128 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import {
+  OperationStatus,
+  type IOperationExecutionResult,
+  type IOperationGraph,
+  type Operation
+} from '@microsoft/rush-lib';
+
+const PLUGIN_NAME: 'DaemonOperationOutputFingerprints' = 'DaemonOperationOutputFingerprints';
+
+/**
+ * Retained results that allow the warm graph to skip an operation. Other statuses always re-run.
+ */
+const TRACKED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Success,
+  OperationStatus.FromCache
+]);
+
+interface IOutputFingerprint {
+  readonly record: IOperationExecutionResult;
+  readonly fingerprint: string;
+}
+
+/**
+ * Detects retained successful operations whose declared output folders were changed outside the daemon.
+ *
+ * @remarks
+ * Build outputs are normally git-ignored, so they do not contribute to any operation state hash. Without
+ * this check, deleting an output folder (`rm -rf lib`, `git clean -xdf`, `heft clean`) leaves a warm graph
+ * that reports the operation as up to date. The fingerprint is deliberately cheap: one `stat` per declared
+ * output folder, capturing existence, identity and modification time. This detects deletion, recreation,
+ * and adding, removing or renaming direct children; it does not detect in-place edits of nested files.
+ */
+export class OperationOutputFingerprints {
+  readonly #fingerprints: Map<Operation, IOutputFingerprint> = new Map();
+  readonly #graph: IOperationGraph;
+
+  public constructor(graph: IOperationGraph) {
+    this.#graph = graph;
+    graph.hooks.afterExecuteIterationAsync.tap(
+      PLUGIN_NAME,
+      (status: OperationStatus, records: ReadonlyMap<Operation, IOperationExecutionResult>) => {
+        this.#recordIteration(records);
+        return status;
+      }
+    );
+  }
+
+  /**
+   * Returns retained successful operations whose output folders no longer match the recorded fingerprint.
+   *
+   * @remarks
+   * Fingerprints of changed operations are forgotten only after all cleanup succeeded, so a failed
+   * reconciliation retries the output check on the next request instead of trusting the stale result.
+   */
+  public getOperationsWithChangedOutputs(): Operation[] {
+    const changed: Operation[] = [];
+    for (const [operation, { record, fingerprint }] of this.#fingerprints) {
+      if (!this.#isRetained(operation, record)) {
+        this.#fingerprints.delete(operation);
+      } else if (getOutputFingerprint(operation) !== fingerprint) {
+        changed.push(operation);
+      }
+    }
+    for (const operation of changed) {
+      forgetLegacySkipState(operation);
+    }
+    for (const operation of changed) {
+      this.#fingerprints.delete(operation);
+    }
+    return changed;
+  }
+
+  #recordIteration(records: ReadonlyMap<Operation, IOperationExecutionResult>): void {
+    for (const [operation, record] of records) {
+      // Only records produced by this iteration become the retained result; disabled operations keep
+      // their earlier record and fingerprint.
+      if (this.#isRetained(operation, record)) {
+        const fingerprint: string | undefined = getOutputFingerprint(operation);
+        if (fingerprint === undefined) {
+          this.#fingerprints.delete(operation);
+        } else {
+          this.#fingerprints.set(operation, { record, fingerprint });
+        }
+      }
+    }
+  }
+
+  #isRetained(operation: Operation, record: IOperationExecutionResult): boolean {
+    return this.#graph.resultByOperation.get(operation) === record && TRACKED_STATUSES.has(record.status);
+  }
+}
+
+/**
+ * Without a build cache, Rush's legacy skip detection reports an operation as skipped when its recorded
+ * input state is unchanged, even though its outputs are gone. Remove that record (as the legacy skip logic
+ * does itself before executing) so the invalidated operation is executed instead.
+ */
+function forgetLegacySkipState(operation: Operation): void {
+  fs.rmSync(
+    path.join(
+      operation.associatedProject.projectRushTempFolder,
+      `package-deps_${operation.logFilenameIdentifier}.json`
+    ),
+    { force: true }
+  );
+}
+
+function getOutputFingerprint(operation: Operation): string | undefined {
+  const folderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+  if (!folderNames?.length) {
+    return undefined;
+  }
+  const { projectFolder } = operation.associatedProject;
+  return folderNames
+    .map((folderName: string) => {
+      const stats: fs.Stats | undefined = fs.statSync(path.resolve(projectFolder, folderName), {
+        throwIfNoEntry: false
+      });
+      return stats ? `${folderName}:${stats.ino}:${stats.mtimeMs}` : `${folderName}:missing`;
+    })
+    .join('|');
+}
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 6467828ef5..69518fef3a 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -32,6 +32,7 @@ import {
 } from './WorkspaceEngineComponentFactory';
 import type { IWorkspaceSession, IWorkspaceSessionComponents } from './WorkspaceSession';
 import { EngineTerminalProvider } from './EngineTerminalProvider';
+import { OperationOutputFingerprints } from './OperationOutputFingerprints';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
 
@@ -197,6 +198,9 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       }
       try {
         terminal.attach(engine.operationGraph);
+        const outputFingerprints: OperationOutputFingerprints = new OperationOutputFingerprints(
+          engine.operationGraph
+        );
         const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
           createEngineComponentsAsync: async () => ({
             ...engine,
@@ -218,8 +222,11 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           shape: engine,
           refreshInputsOnEveryRequest: true,
           validateGraphInputsAsync: this.#validateGraphInputsAsync,
-          mapInvalidationsToOperationsAsync: async (invalidationOptions) =>
-            getChangedOperations(invalidationOptions)
+          mapInvalidationsToOperationsAsync: async (invalidationOptions) => [
+            ...getChangedOperations(invalidationOptions),
+            // Outputs are git-ignored and absent from state hashes, so check them separately.
+            ...outputFingerprints.getOperationsWithChangedOutputs()
+          ]
         });
         const components: IWorkspaceSessionComponents = await factory.createAsync(options);
         return {
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 01f38bfd80..bdf1634744 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1330,6 +1330,66 @@ process.exit(23);
     }
   });
 
+  it('re-runs only the operation whose declared outputs were deleted after a warm build', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toEqual(expect.arrayContaining(['a:one:', 'b:one:', 'c:one:']));
+      expect((await runAsync(fixture, 'warm', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/a/lib'), { recursive: true });
+      expect((await runAsync(fixture, 'unrelated', ['build', '--only', 'c'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect((await runAsync(fixture, 'deleted', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3)).toEqual(['a:one:']);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'utf8')).toBe('one');
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/c/lib/extra.txt'), 'stray');
+      expect((await runAsync(fixture, 'changed', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(4)).toEqual(['c:one:']);
+      expect((await runAsync(fixture, 'unchanged', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(runs(fixture)).toHaveLength(5);
+      expect(fixture.session.operationGraph).toBe(graph);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('restores deleted outputs of a warm operation from the native build cache', async () => {
+    const fixture: IFixture = await createFixtureAsync(true);
+    try {
+      await runAsync(fixture, 'initial', ['build', '--to', 'b']);
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/a/lib'), { recursive: true });
+      const deleted: ITerminalExchange = await runAsync(fixture, 'deleted', ['build', '--to', 'b']);
+      expect(deleted.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { operationResults } = (deleted.terminal as { payload: IDaemonPhasedRequestResult }).payload;
+      expect(operationResults.filter((result) => result.status !== 'SKIPPED')).toEqual([
+        expect.objectContaining({ operationId: 'a (compile)', status: 'FROM CACHE' })
+      ]);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'utf8')).toBe('one');
+      expect((await runAsync(fixture, 'restored', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('reconciles changes made without a connected client and preserves an empty native selection', async () => {
     const fixture: IFixture = await createFixtureAsync();
     let reconnected: DaemonRequestWireClient | undefined;

From 9bba9ef639d3e2223940627030c62a5af767cad4 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:31:54 +0000
Subject: [PATCH 016/265] [rush-lib] Workspace fingerprint: ignore build state
 of projects nested under common/config (and 3 more)

Swarm integration step 1; original commit 433c87f24f (merge of swarm/r05 at 190d77ea17).

Commits folded into this step (4):
- 40b5b24d72 [rush-lib] Workspace fingerprint: ignore build state of projects nested under common/config
- 1880e7b2b7 [rush-daemon] Warm set: keep resource-free retained results under memory pressure and idle expiry
- 07e908d32d [rush-daemon] Admission: don't spend a default wait budget behind a graph load or across an admitted request's execution
- 190d77ea17 [rush-lib] Move the nested common/config fingerprint test to the end of its suite

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ested-config-project_2026-09-28-12-25.json |   9 +
 ...5-warm-set-retention_2026-09-28-12-26.json |   9 +
 ...transition-admission_2026-09-28-12-45.json |  10 ++
 ...5-warm-set-retention_2026-09-28-12-26.json |  10 ++
 docs/rush/environment-variables.md            |   4 +-
 libraries/rush-daemon/README.md               |  16 +-
 .../src/WorkspaceRequestAdmission.ts          | 140 ++++++++++++++-
 .../src/WorkspaceRequestLifecycle.ts          |  51 +++---
 libraries/rush-daemon/src/WorkspaceWarmSet.ts |  33 ++--
 .../src/test/DaemonGraphTestFixture.ts        |   3 +
 .../test/WorkspaceRequestAdmission.test.ts    | 159 ++++++++++++++++++
 .../test/WorkspaceTransitionAdmission.test.ts | 111 ++++++++++++
 .../src/test/WorkspaceWarmSet.test.ts         |  31 ++++
 .../rush-lib/src/api/DaemonConfiguration.ts   |  10 +-
 .../src/api/WorkspaceInputFingerprint.ts      |  64 ++++++-
 .../test/WorkspaceInputFingerprint.test.ts    |  61 +++++++
 .../rush-lib/src/schemas/rush.schema.json     |   4 +-
 17 files changed, 671 insertions(+), 54 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r05-nested-config-project_2026-09-28-12-25.json
 create mode 100644 common/changes/@microsoft/rush/swarm-r05-warm-set-retention_2026-09-28-12-26.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-transition-admission_2026-09-28-12-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-warm-set-retention_2026-09-28-12-26.json
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-r05-nested-config-project_2026-09-28-12-25.json b/common/changes/@microsoft/rush/swarm-r05-nested-config-project_2026-09-28-12-25.json
new file mode 100644
index 0000000000..9ae1f6188c
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r05-nested-config-project_2026-09-28-12-25.json
@@ -0,0 +1,9 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Daemon: running the operations of a Rush project folder nested under common/config no longer changes the workspace configuration fingerprint and forces a graph reload on the next request.",
+      "type": "none"
+    }
+  ]
+}
diff --git a/common/changes/@microsoft/rush/swarm-r05-warm-set-retention_2026-09-28-12-26.json b/common/changes/@microsoft/rush/swarm-r05-warm-set-retention_2026-09-28-12-26.json
new file mode 100644
index 0000000000..c81cf84f7a
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r05-warm-set-retention_2026-09-28-12-26.json
@@ -0,0 +1,9 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Document that daemon warm-set idle expiry and memory budget do not evict retained results of resource-free projects.",
+      "type": "none"
+    }
+  ]
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-transition-admission_2026-09-28-12-45.json b/common/changes/@rushstack/rush-daemon/swarm-r05-transition-admission_2026-09-28-12-45.json
new file mode 100644
index 0000000000..73f03d8079
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-transition-admission_2026-09-28-12-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Admission: a client-default wait budget no longer runs while another request loads or reloads the workspace graph, or while its own admitted request is routed and executed, so early arrivals and graph-gate waiters no longer fail with wait-timeout behind a slow cold load.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-warm-set-retention_2026-09-28-12-26.json b/common/changes/@rushstack/rush-daemon/swarm-r05-warm-set-retention_2026-09-28-12-26.json
new file mode 100644
index 0000000000..dc03220e72
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-warm-set-retention_2026-09-28-12-26.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Warm set: memory pressure and idle expiry release only runners and watchers, so retained results of resource-free projects keep warm no-op skips; the pressure warning is reported once per state.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 35f266c2f2..5ca22ad77b 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -27,8 +27,8 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | `30` | Maximum request admission wait. Nonnegative seconds, at most 2147483.647; converted to whole milliseconds by rounding down. Per-invocation `--wait-timeout` or `--no-wait` takes precedence. Overrides `queueTimeoutSeconds`. |
 | `RUSH_DAEMON_WATCH` | `0` | Observe requested warm projects between requests. Never schedules builds and does not enable `--watch` mode. Root/config guards and request-time input reconciliation remain active when disabled. Overrides `watch`. |
 | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | `0` | Enable explicitly configured `operationSettings[].daemonIpc` Node workers for supported incremental daemon builds. Does not convert arbitrary shell scripts into persistent workers. Overrides `usePersistentIpcRunners`. |
-| `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners, project watchers and results. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
-| `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work is exempt. Overrides `warmMemoryBudgetMB`. |
+| `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
+| `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
 | `RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY` | `0` | Rank retention using measured time saved, frequency and memory, with conservative LRU fallback. Never speculatively executes scripts. Overrides `autoWarmByTelemetry`. |
 | `RUSH_DAEMON_EXPERIMENTAL` | `0` | Enable the experimental `rush-client daemon graph` command surface. Does not start a daemon or enable builds; no corresponding `rush.json` property. |
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 31171ac55d..2e489bbb43 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -313,9 +313,9 @@ preserves its records and diagnostics without failing an otherwise successful bu
 | Policy | Runtime behavior |
 | --- | --- |
 | `watch` | Retains host observation of requested warm projects between requests when true. False (the default) keeps root/config guards only. Never schedules builds. |
-| `warmIdleTimeoutSeconds` | Expires unused project runners, watchers and retained results after requests finish. Unchanged requests refresh recency too. |
+| `warmIdleTimeoutSeconds` | Expires unused project runners and watchers, together with those projects' retained results, after requests finish. Unchanged requests refresh recency too. Projects whose only retained state is operation results from resource-free (shell/null) runners do not expire: those results are revalidated on every request and stay until the generation ends, so an agent that returns after a long pause still gets no-op skips. |
 | `warmSetMaxProjects` | Limits the projects that hold warm **resources** (an active runner such as a persistent IPC child, or a `watch: true` file watcher). The lowest-ranked holders are released (runners closed, watchers removed, records deleted); executing/prepared and explicitly protected work is exempt. Projects whose only retained state is operation results from resource-free (shell/null) runners neither count toward nor are evicted for this limit, so no-op re-requests of large workspaces stay skipped. |
-| `warmMemoryBudgetMB` | Attempts idle eviction under sampled daemon-plus-measured-child RSS pressure. The comparison uses the **whole daemon process RSS** (graph, Node heap and retained records, typically 130-190 MiB) plus measured child RSS, so a budget below the daemon's baseline evicts every idle project on each pass and disables warm skipping. Never treats cache files as memory or claims a hard RSS ceiling. |
+| `warmMemoryBudgetMB` | Attempts idle eviction of resource-holding projects under sampled daemon-plus-measured-child RSS pressure. The comparison uses the **whole daemon process RSS** (graph, Node heap and retained records, typically 130-190 MiB for a small workspace and more for a large one) plus measured child RSS, so a budget below the daemon's baseline releases every idle runner and watcher on each pass. Retained results of resource-free projects are not evicted for the budget, so warm skipping keeps working, and the pressure warning is reported once per distinct state. Never treats cache files as memory or claims a hard RSS ceiling. |
 | `autoWarmByTelemetry` | Promotes already-requested high-value work instead of pure LRU. Never schedules or executes speculative scripts. |
 
 One deterministic best-first comparator is shared by retention and reverse-order eviction. With complete
@@ -459,10 +459,16 @@ the static built-in command policy (`SHARED-BUILD`, `SHARED-READ`, or `EXCLUSIVE
 built-in names fail closed to `EXCLUSIVE`, including plugin replacements of built-in names. Queued clients receive
 ordered, one-based position controls and can request fail-fast or bounded waiting. One progress channel covers both
 workspace admission and the temporary phased graph-execution gate. An explicit `noWait` or `waitTimeoutMs` is one
-absolute deadline for both waits. When the client marks `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), the
-deadline bounds workspace admission only: a `SHARED-BUILD` request that arrives after the current batch has closed waits
+absolute deadline for both waits. When the client marks `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), it is
+a budget that only contention spends: a `SHARED-BUILD` request that arrives after the current batch has closed waits
 on the graph-execution gate without a deadline, because it is queued only behind running compatible shared builds, and
-then runs in the next batch. Cancellation, disconnect, or queue-output failure removes queued work before it can execute.
+then runs in the next batch. A request queued behind another request that holds exclusive workspace admission to load
+or reload the graph does not spend the budget during that load, so every build that arrives while the first build
+after startup loads the graph is admitted when the load finishes. The budget does run while that other request still
+waits for exclusive admission, so requests behind a reload that cannot start, for example behind a long build, still
+time out. Routing and executing an admitted request do not spend the budget either: a request that re-enters
+workspace admission to reload the graph after its inputs changed keeps the budget it had when it was admitted.
+Cancellation, disconnect, or queue-output failure removes queued work before it can execute.
 A requesting client receives only its enabled dependency closure's WS1 raw chunks and structured events through
 backpressured, ordered callbacks, followed exactly once by a typed final command result after all preceding output
 drains. The result translates only that client's operation subset to Rush's success, warning, failure, or abort exit
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index a541976266..edf357db67 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -96,12 +96,78 @@ class QueuePositionWriter {
   }
 }
 
+/**
+ * Reports whether a request that other requests wait behind is doing work on their behalf, such as loading the
+ * workspace graph that they need.
+ */
+export class AdmissionProgress {
+  readonly #listeners: Set<() => void> = new Set();
+  #active: boolean = false;
+
+  public get active(): boolean {
+    return this.#active;
+  }
+
+  public setActive(active: boolean): void {
+    if (this.#active === active) return;
+    this.#active = active;
+    for (const listener of [...this.#listeners]) listener();
+  }
+
+  public subscribe(listener: () => void): () => void {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+}
+
+/** A wait budget that is spent only while `progress` is inactive. */
+class ProgressPausedBudget {
+  readonly #onExhausted: () => void;
+  readonly #progress: AdmissionProgress;
+  readonly #unsubscribe: () => void;
+  #remainingMs: number;
+  #runningSinceMs: number | undefined;
+  #timer: ReturnType<typeof setTimeout> | undefined;
+
+  public constructor(remainingMs: number, progress: AdmissionProgress, onExhausted: () => void) {
+    this.#remainingMs = remainingMs;
+    this.#progress = progress;
+    this.#onExhausted = onExhausted;
+    this.#unsubscribe = progress.subscribe(() => this.#update());
+    this.#update();
+  }
+
+  /** Stops spending and returns the unspent budget. */
+  public stop(): number {
+    this.#unsubscribe();
+    this.#pause();
+    return this.#remainingMs;
+  }
+
+  #update(): void {
+    if (this.#progress.active) {
+      this.#pause();
+    } else if (this.#runningSinceMs === undefined) {
+      this.#runningSinceMs = Date.now();
+      this.#timer = setTimeout(this.#onExhausted, this.#remainingMs);
+    }
+  }
+
+  #pause(): void {
+    if (this.#runningSinceMs === undefined) return;
+    this.#remainingMs = Math.max(0, this.#remainingMs - (Date.now() - this.#runningSinceMs));
+    this.#runningSinceMs = undefined;
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+  }
+}
+
 export class RequestAdmissionController {
   readonly #abortController: AbortController = new AbortController();
   readonly #abortFromClient: () => void;
   readonly #admission: IDaemonRequestAdmissionOptions | undefined;
   readonly #client: IRequestAdmissionClient;
-  readonly #deadlineMs: number | undefined;
+  #deadlineMs: number | undefined;
   readonly #writer: QueuePositionWriter | undefined;
 
   public constructor(options: IRequestAdmissionControllerOptions) {
@@ -124,7 +190,7 @@ export class RequestAdmissionController {
     }
   }
 
-  /** Waits for workspace admission, bounded by the request's absolute admission deadline. */
+  /** Waits for workspace admission within the request's remaining admission budget. */
   public async acquireAsync(
     scheduler: RequestScheduler,
     exclusivityClass: RequestExclusivityClass
@@ -161,17 +227,83 @@ export class RequestAdmissionController {
     );
   }
 
+  /**
+   * Waits for shared-build workspace admission while another request loads or reloads the workspace graph.
+   *
+   * @remarks
+   * While `transition` reports progress, the other request holds the exclusive gate and is loading the graph that
+   * this request needs, so a client-default timeout is not spent: at a cold start every concurrent build waits for
+   * the first build's graph load. The default budget is still spent while the transition itself waits for another
+   * request, so a transition that cannot start does not hold its followers indefinitely. Unspent budget carries over
+   * to later waits of this request. An explicit `noWait` or `waitTimeoutMs` applies unchanged.
+   */
+  public async acquireBehindTransitionAsync(
+    scheduler: RequestScheduler,
+    transition: AdmissionProgress
+  ): Promise<IRequestLease> {
+    const waitingFor: string = "another request's load or reload of the workspace graph";
+    const remainingMs: number | undefined = this.#getRemainingWaitTimeoutMs();
+    if (!this.#admission?.waitTimeoutIsDefault || remainingMs === undefined) {
+      return await this.#acquireAsync(scheduler, RequestExclusivityClass.SharedBuild, remainingMs, waitingFor);
+    }
+    const exhausted: AbortController = new AbortController();
+    const budget: ProgressPausedBudget = new ProgressPausedBudget(remainingMs, transition, () =>
+      exhausted.abort()
+    );
+    try {
+      return await this.#acquireAsync(
+        scheduler,
+        RequestExclusivityClass.SharedBuild,
+        undefined,
+        waitingFor,
+        AbortSignal.any([this.#abortController.signal, exhausted.signal])
+      );
+    } catch (error) {
+      if (!exhausted.signal.aborted || this.#abortController.signal.aborted) throw error;
+      throw this.#getReportedError(
+        new RequestSchedulerError(
+          RequestSchedulerErrorCode.WaitTimeout,
+          `The request was not admitted within ${this.#admission.waitTimeoutMs}ms.`
+        ),
+        waitingFor
+      );
+    } finally {
+      this.#deadlineMs = Date.now() + budget.stop();
+    }
+  }
+
+  /**
+   * Runs `action`, such as routing and executing an admitted request, without spending a client-default budget.
+   *
+   * @remarks
+   * Work after admission either runs or waits behind progress, such as the exempt graph-execution gate. A request that
+   * re-enters workspace admission afterwards, for example to reload the graph after its inputs changed, therefore
+   * keeps the budget it had before `action`. An explicit `noWait` or `waitTimeoutMs` keeps its absolute deadline.
+   */
+  public async runOutsideDefaultBudgetAsync<T>(action: () => Promise<T>): Promise<T> {
+    const remainingMs: number | undefined = this.#getRemainingWaitTimeoutMs();
+    if (!this.#admission?.waitTimeoutIsDefault || remainingMs === undefined) {
+      return await action();
+    }
+    try {
+      return await action();
+    } finally {
+      this.#deadlineMs = Date.now() + remainingMs;
+    }
+  }
+
   async #acquireAsync(
     scheduler: RequestScheduler,
     exclusivityClass: RequestExclusivityClass,
     waitTimeoutMs: number | undefined,
-    waitingFor: string
+    waitingFor: string,
+    abortSignal: AbortSignal = this.#abortController.signal
   ): Promise<IRequestLease> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     let lease: IRequestLease | undefined;
     try {
       lease = await scheduler.acquireAsync({
-        abortSignal: this.#abortController.signal,
+        abortSignal,
         exclusivityClass,
         noWait: this.#admission?.noWait,
         onQueuePositionChanged: writer ? (position: number) => writer.enqueue(position) : undefined,
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 2ee815aad2..699c1eec21 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -35,6 +35,7 @@ import {
   type IRequestLease
 } from './RequestScheduler';
 import {
+  AdmissionProgress,
   RequestAdmissionController,
   getRequestAdmissionErrorCode,
   getWorkspaceRequestScheduler
@@ -126,6 +127,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   #restartPending: boolean = false;
   #lastReloadTier: WorkspaceInputChangeTier = WorkspaceInputChangeTier.Reuse;
   #transitioning: boolean = false;
+  /** Active while the transition owner holds the exclusive gate and loads or reloads the workspace graph. */
+  readonly #transitionProgress: AdmissionProgress = new AdmissionProgress();
   #cleanupFailure: unknown;
   #disposePromise: Promise<void> | undefined;
 
@@ -204,25 +207,28 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     try {
       for (let attempt: number = 0; ; attempt++) {
         try {
-          generation = await this.#prepareAsync(envelope, client, admission, ticket);
+          const prepared: IPreparedGeneration = await this.#prepareAsync(envelope, client, admission, ticket);
+          generation = prepared;
           const requestEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
             admission: admission.remainingAdmission
           };
-          if (isMutation(envelope)) {
-            await this.#executeMutationAsync(generation, requestEnvelope, client, state, dispatchAsync);
-          } else {
-            await dispatchAsync({
-              envelope: requestEnvelope,
-              client,
-              workspaceSession: generation.session,
-              resolver: generation.resolver,
-              onExecutionStarting: () => {
-                this.#assertGeneration(generation!);
-                state.began = true;
-              }
-            });
-          }
+          await admission.runOutsideDefaultBudgetAsync(async () => {
+            if (isMutation(envelope)) {
+              await this.#executeMutationAsync(prepared, requestEnvelope, client, state, dispatchAsync);
+            } else {
+              await dispatchAsync({
+                envelope: requestEnvelope,
+                client,
+                workspaceSession: prepared.session,
+                resolver: prepared.resolver,
+                onExecutionStarting: () => {
+                  this.#assertGeneration(prepared);
+                  state.began = true;
+                }
+              });
+            }
+          });
           return;
         } catch (error) {
           if (
@@ -294,7 +300,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     admittedLease?: IRequestLease
   ): Promise<IPreparedGeneration> {
     let lease: IRequestLease =
-      admittedLease ?? (await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
+      admittedLease ??
+      (this.#transitioning
+        ? await admission.acquireBehindTransitionAsync(this.#gate, this.#transitionProgress)
+        : await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
     let ownsTransition: boolean = false;
     try {
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
@@ -429,15 +438,16 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         if (this.#restartPending) throw new RestartPendingBeforeExecution();
       }
       if (this.#transitioning) {
-        const shared: IRequestLease = await admission.acquireAsync(
+        const shared: IRequestLease = await admission.acquireBehindTransitionAsync(
           this.#gate,
-          RequestExclusivityClass.SharedBuild
+          this.#transitionProgress
         );
         return await this.#prepareAsync(envelope, client, admission, ticket, shared);
       }
       this.#transitioning = ownsTransition = true;
       this.#cancelObservers();
       lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
+      this.#transitionProgress.setActive(true);
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
       if (this.#closing)
         throw new Error('The workspace is restarting. No operation was scheduled or executed.');
@@ -609,7 +619,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       if (!(error instanceof RestartBeforeExecution)) lease.release();
       throw error;
     } finally {
-      if (ownsTransition) this.#transitioning = false;
+      if (ownsTransition) {
+        this.#transitioning = false;
+        this.#transitionProgress.setActive(false);
+      }
     }
   }
 
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 3b7e5aa5f5..bf037cabc0 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -233,11 +233,13 @@ export class WorkspaceWarmSet implements AsyncDisposable {
           const now: number = performance.now();
           const delay: number = Math.min(
             MAX_POLL_DELAY_MS,
-            ...this.#rankProjects().map((project) => {
-              const remaining: number =
-                project.lastUsed + this.#configuration.warmIdleTimeoutSeconds * 1000 - now;
-              return remaining > 0 ? Math.max(1, remaining) : RETRY_DELAY_MS;
-            })
+            ...this.#rankProjects()
+              .filter((project) => this.#mayRelease(project))
+              .map((project) => {
+                const remaining: number =
+                  project.lastUsed + this.#configuration.warmIdleTimeoutSeconds * 1000 - now;
+                return remaining > 0 ? Math.max(1, remaining) : RETRY_DELAY_MS;
+              })
           );
           this.#schedule(
             this.#deferredReason || this.#watcherPolicyFailure ? Math.min(delay, RETRY_DELAY_MS) : delay
@@ -365,8 +367,13 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         project.operations.every(
           (operation) => !graph.resultByOperation.has(operation) && !operation.runner?.isActive
         );
-      const overProjectLimit: boolean = status.overProjectLimit && project.holdsResources;
-      if (!unrequested && !expired && !status.overMemoryBudget && !overProjectLimit) continue;
+      // Idle expiry and every limit release runners and watchers, and finish an eviction that failed earlier.
+      // Otherwise the retained results of a resource-free project stay until the generation ends: they are
+      // revalidated on every request, they are what makes a warm no-op skip possible, and dropping them cannot
+      // bring daemon RSS below the budget.
+      const release: boolean =
+        this.#mayRelease(project) && (expired || status.overMemoryBudget || status.overProjectLimit);
+      if (!unrequested && !release) continue;
       try {
         await graph.closeRunnersAsync(project.operations);
         if (project.operations.some((operation) => operation.runner?.isActive)) {
@@ -384,6 +391,10 @@ export class WorkspaceWarmSet implements AsyncDisposable {
     }
   }
 
+  #mayRelease(project: IWarmProject): boolean {
+    return project.holdsResources || this.#cleanupFailures.has(project.key);
+  }
+
   #rankProjects(): IWarmProject[] {
     const { operationGraph: graph, watcher, getProtectedOperations } = this.#options;
     const protectedOperations: ReadonlySet<Operation> | undefined = getProtectedOperations?.();
@@ -463,14 +474,14 @@ export class WorkspaceWarmSet implements AsyncDisposable {
   }
 
   #reportPressure(status: IWorkspaceWarmSetStatus): void {
-    // A queued project-cap cleanup is normal during a request; status still exposes the deferral.
-    if (status.deferredReason && !status.overMemoryBudget) return;
+    // Cleanup queued behind a request is normal and status still exposes the deferral. Only a completed pass
+    // shows what remains, and the key ignores the deferral so alternating busy/idle passes do not repeat it.
+    if (status.deferredReason) return;
     const key: string | undefined =
       status.overMemoryBudget || status.overProjectLimit
         ? JSON.stringify([
             status.overMemoryBudget,
             status.overProjectLimit,
-            status.deferredReason,
             status.protectedProjectNames,
             status.cleanupFailures,
             status.unmeasuredRunnerCount
@@ -483,7 +494,7 @@ export class WorkspaceWarmSet implements AsyncDisposable {
             `limit ${this.#configuration.warmSetMaxProjects} projects): daemon RSS ${status.daemonResidentMemoryBytes} bytes, ` +
             `measured child RSS ${status.measuredRunnerMemoryBytes} bytes, ${status.unmeasuredRunnerCount} unmeasured runners, ` +
             `${status.retainedProjectNames.length} retained projects, ${status.protectedProjectNames.length} protected. ` +
-            `Deferred: ${status.deferredReason ?? 'no'}. Active/protected resources and remaining daemon memory cannot be forced below the budget.`
+            `Active or protected resources, resource-free retained results and remaining daemon memory are not released to meet the budget.`
         )
       );
     }
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index 21b01d472c..844b581ed1 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -34,6 +34,8 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   public session!: WorkspaceSession;
   public host!: RushDaemonHost;
   public getSuccessorLaunchAsync: GetWorkspaceSuccessorLaunchAsync | undefined;
+  /** Awaited before each workspace session is created, including a request's graph load or reload. */
+  public beforeCreateSessionAsync: (() => Promise<void>) | undefined;
   public readonly folder: string = fs.realpathSync.native(
     fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-graph-'))
   );
@@ -154,6 +156,7 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
             }
           },
       createWorkspaceSessionAsync: async (options) => {
+        await this.beforeCreateSessionAsync?.();
         this.session = await WorkspaceSession.createAsync(options);
         return this.session;
       }
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
new file mode 100644
index 0000000000..232687ffb5
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -0,0 +1,159 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import { AdmissionProgress, RequestAdmissionController } from '../WorkspaceRequestAdmission';
+
+const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100, waitTimeoutIsDefault: true };
+const EXPLICIT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100 };
+
+interface IAcquisition {
+  settled: boolean;
+  lease?: IRequestLease;
+  error?: unknown;
+}
+
+function track(promise: Promise<IRequestLease>): IAcquisition {
+  const acquisition: IAcquisition = { settled: false };
+  promise.then(
+    (lease: IRequestLease) => {
+      acquisition.settled = true;
+      acquisition.lease = lease;
+    },
+    (error: unknown) => {
+      acquisition.settled = true;
+      acquisition.error = error;
+    }
+  );
+  return acquisition;
+}
+
+function createController(
+  admission: IDaemonRequestAdmissionOptions,
+  abortSignal: AbortSignal = new AbortController().signal
+): RequestAdmissionController {
+  return new RequestAdmissionController({ admission, client: { abortSignal }, requestId: 'request' });
+}
+
+describe(RequestAdmissionController.name, () => {
+  let scheduler: RequestScheduler;
+  let owner: IRequestLease;
+  let transition: AdmissionProgress;
+
+  beforeEach(async () => {
+    jest.useFakeTimers();
+    scheduler = new RequestScheduler();
+    owner = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive });
+    transition = new AdmissionProgress();
+  });
+
+  afterEach(() => {
+    owner.release();
+    jest.useRealTimers();
+  });
+
+  it('does not spend a default budget while the transition it waits behind makes progress', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(10_000);
+    expect(waiting.settled).toBe(false);
+
+    scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+    transition.setActive(false);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.settled).toBe(true);
+    expect(waiting.error).toBeUndefined();
+    expect(waiting.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    waiting.lease?.release();
+    controller.dispose();
+  });
+
+  it('spends a default budget while the transition itself waits, and carries the rest across progress', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(60);
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(10_000);
+    transition.setActive(false);
+    await jest.advanceTimersByTimeAsync(39);
+    expect(waiting.settled).toBe(false);
+
+    await jest.advanceTimersByTimeAsync(1);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message: expect.stringContaining(
+        "not admitted within 100ms while waiting for another request's load or reload of the workspace graph"
+      )
+    });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it('keeps an explicit deadline behind a transition that makes progress', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(99);
+    expect(waiting.settled).toBe(false);
+
+    await jest.advanceTimersByTimeAsync(1);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    controller.dispose();
+  });
+
+  it('reports cancellation behind a transition as an abort', async () => {
+    const client: AbortController = new AbortController();
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET, client.signal);
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    client.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.Aborted });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it('keeps an unspent default budget across admitted work for a later admission wait', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    await jest.advanceTimersByTimeAsync(40);
+    const work: Promise<void> = controller.runOutsideDefaultBudgetAsync(
+      () => new Promise<void>((resolve) => setTimeout(resolve, 10_000))
+    );
+    await jest.advanceTimersByTimeAsync(10_000);
+    await work;
+    expect(controller.remainingAdmission).toEqual({ ...DEFAULT_BUDGET, waitTimeoutMs: 60 });
+
+    const waiting: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild));
+    await jest.advanceTimersByTimeAsync(59);
+    expect(waiting.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message: expect.stringContaining('not admitted within 100ms while waiting for workspace admission')
+    });
+    controller.dispose();
+  });
+
+  it('keeps an explicit deadline running across admitted work', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    const work: Promise<void> = controller.runOutsideDefaultBudgetAsync(
+      () => new Promise<void>((resolve) => setTimeout(resolve, 10_000))
+    );
+    await jest.advanceTimersByTimeAsync(10_000);
+    await work;
+    expect(controller.remainingAdmission).toEqual({ waitTimeoutMs: 0 });
+
+    const waiting: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild));
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    controller.dispose();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
new file mode 100644
index 0000000000..1337cb515f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
@@ -0,0 +1,111 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { createDeferred, type IDeferred, type ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 300, waitTimeoutIsDefault: true };
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+function expectWaitTimeout(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({
+    kind: 'requestResult',
+    payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+  });
+}
+
+describe('workspace admission behind a graph transition', () => {
+  it('admits builds that arrive while another build loads the graph without spending their default budget', async () => {
+    const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+    try {
+      const loadStarted: IDeferred<void> = createDeferred<void>();
+      const releaseLoad: IDeferred<void> = createDeferred<void>();
+      fixture.beforeCreateSessionAsync = async () => {
+        loadStarted.resolve();
+        await releaseLoad.promise;
+      };
+      const first: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B);
+      await loadStarted.promise;
+
+      const withDefaultBudget: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, {
+        admission: DEFAULT_BUDGET
+      });
+      const withExplicitBudget: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+        admission: { waitTimeoutMs: 300 }
+      });
+      expectWaitTimeout(withExplicitBudget);
+      await delayAsync(600);
+
+      fixture.beforeCreateSessionAsync = undefined;
+      releaseLoad.resolve();
+      expectSuccess(await first);
+      expectSuccess(await withDefaultBudget);
+      expect(fixture.runs()).toEqual(['a', 'b']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('keeps a graph-gate waiter default budget for its reload after an input change', async () => {
+    const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
+      created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
+      created.write(
+        'a/build.cjs',
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+          "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+      );
+    });
+    const releaseFile: string = path.join(fixture.folder, 'release-a');
+    try {
+      const long: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await waitForAsync(() => fixture.runs().includes('a'), 'the long build to start');
+
+      // Reuses the generation, then waits at the graph-execution gate, which a default budget does not limit.
+      const graphGateWaiter: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A, {
+        admission: DEFAULT_BUDGET
+      });
+      await delayAsync(500);
+      const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+      const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+      fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+
+      // Needs a reload, so it waits for exclusive admission until the long build ends.
+      const reload: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await delayAsync(500);
+      // A reload that cannot start is not progress, so a default budget behind it is still spent.
+      expectWaitTimeout(await fixture.runAsync(BUILD_A, { admission: DEFAULT_BUDGET }));
+
+      fs.writeFileSync(releaseFile, '');
+      expectSuccess(await long);
+      expectSuccess(await reload);
+      // The waiter's batch finds the changed input and re-enters admission behind the reload.
+      expectSuccess(await graphGateWaiter);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index f4193dbd27..8f3d81c702 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -260,6 +260,37 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(fixture.runs()).toEqual(['a', 'b']);
   });
 
+  it('keeps resource-free retained results under memory pressure and idle expiry, and warns once', async () => {
+    test = await WarmSetTestFixture.createAsync();
+    test.configuration = { ...GENEROUS_WARM_CONFIGURATION, watch: false };
+    const { fixture } = test;
+    await fixture.buildSuccessfullyAsync();
+    const { warm, graph, watcher } = test;
+    const records: Map<string, IOperationExecutionResult | undefined> = new Map(
+      ['a', 'b'].map((name) => [name, graph.resultByOperation.get(test!.operation(name))])
+    );
+    expect([...records.values()].every((record) => record !== undefined)).toBe(true);
+    const runs: string[] = fixture.runs();
+    test.update({ watch: false, warmMemoryBudgetMB: 0.01, warmIdleTimeoutSeconds: 0.01 });
+    await delayAsync(50);
+    for (let pass: number = 0; pass < 2; pass++) {
+      const status = await warm.maintainAsync();
+      expect(status).toMatchObject({ overMemoryBudget: true, overProjectLimit: false });
+      expect(status.deferredReason).toBeUndefined();
+      expect([...status.retainedProjectNames].sort()).toEqual(['a', 'b']);
+    }
+    for (const [name, record] of records) {
+      expect(graph.resultByOperation.get(test.operation(name))).toBe(record);
+    }
+    expect(watcher.watchedProjectNames.size).toBe(0);
+
+    // The retained results still make an unchanged build a warm no-op skip.
+    await fixture.buildSuccessfullyAsync();
+    await warm.maintainAsync();
+    expect(fixture.runs()).toEqual(runs);
+    expect(test.diagnostics.filter((error) => error.message.includes('Warm-set pressure'))).toHaveLength(1);
+  });
+
   it('reports missing child measurements and uses conservative LRU instead of inventing memory scores', async () => {
     const { fixture, warm } = await startAsync({ ipc: true });
     const missing = ['a', 'b'].map((name) => test!.operation(name).runner!);
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 695dcaa548..0869ebacb3 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -15,9 +15,15 @@ export interface IDaemonConfigurationJson {
   readonly usePersistentIpcRunners?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
-  /** Idle resource expiration in an attached daemon warm set. Defaults to 300 seconds. */
+  /**
+   * Idle resource expiration in an attached daemon warm set; retained results of resource-free projects do not
+   * expire. Defaults to 300 seconds.
+   */
   readonly warmIdleTimeoutSeconds?: number;
-  /** Best-effort sampled RSS budget for an attached warm set, not a hard ceiling. Defaults to 512 MiB. */
+  /**
+   * Best-effort sampled RSS budget for an attached warm set, not a hard ceiling; active/protected work and retained
+   * results of resource-free projects are exempt. Defaults to 512 MiB.
+   */
   readonly warmMemoryBudgetMB?: number;
   /**
    * Best-effort limit on projects holding warm resources (active runners or file watchers); active/protected work
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 9bf466e493..b4262da1e2 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -236,7 +236,20 @@ export async function captureWorkspaceInputFingerprintAsync(
     installation.add(path.join(subspace.getSubspaceTempFolderPath(), 'last-install.flag'));
   }
   installation.add(path.join(rushConfiguration.commonTempFolder, 'current-variants.json'));
-  const configurationFiles: string[] = await listFilesAsync(path.join(root, 'common', 'config'), false);
+  const projectFolders: string[] = [];
+  for (const project of rushJson.projects) {
+    const projectFolder: string = path.resolve(root, project.projectFolder);
+    if (!Path.isUnderOrEqual(projectFolder, root)) {
+      throw new Error('A fingerprint project folder must be inside the workspace.');
+    }
+    projectFolders.push(projectFolder);
+  }
+  const commonConfigFolder: string = path.join(root, 'common', 'config');
+  const configurationFiles: string[] = await listFilesAsync(
+    commonConfigFolder,
+    false,
+    getNestedProjectFolders(commonConfigFolder, projectFolders, rushConfiguration)
+  );
   for (const filename of configurationFiles) {
     (isProcessBoundConfiguration(filename) ? installation : definitions).add(filename);
   }
@@ -249,11 +262,7 @@ export async function captureWorkspaceInputFingerprintAsync(
       definitions.add(filename);
     }
   }
-  for (const project of rushJson.projects) {
-    const projectFolder: string = path.resolve(root, project.projectFolder);
-    if (!Path.isUnderOrEqual(projectFolder, root)) {
-      throw new Error('A fingerprint project folder must be inside the workspace.');
-    }
+  for (const projectFolder of projectFolders) {
     for (const relativePath of [
       'package.json',
       '.gitignore',
@@ -333,7 +342,38 @@ async function hashFilesAsync(filenames: Iterable<string>): Promise<string> {
   return hashText(JSON.stringify(entries));
 }
 
-async function listFilesAsync(folderOrFile: string, runtime: boolean): Promise<string[]> {
+/**
+ * Returns the Rush project folders nested inside `common/config`. Rush reads such a project only through the
+ * project definition files fingerprinted for every project, and running its operations rewrites logs, build
+ * outputs and `.rush/temp` state inside it, which must not look like a configuration change. A project folder
+ * that is inside or contains a Rush configuration folder is never excluded.
+ */
+function getNestedProjectFolders(
+  commonConfigFolder: string,
+  projectFolders: ReadonlyArray<string>,
+  rushConfiguration: RushConfiguration
+): ReadonlySet<string> {
+  const rushConfigurationFolders: string[] = [
+    rushConfiguration.commonRushConfigFolder,
+    path.join(commonConfigFolder, 'subspaces'),
+    ...rushConfiguration.subspaces.map((subspace) => subspace.getSubspaceConfigFolderPath())
+  ];
+  return new Set(
+    projectFolders.filter(
+      (projectFolder) =>
+        Path.isUnder(projectFolder, commonConfigFolder) &&
+        !rushConfigurationFolders.some(
+          (folder) => Path.isUnderOrEqual(folder, projectFolder) || Path.isUnderOrEqual(projectFolder, folder)
+        )
+    )
+  );
+}
+
+async function listFilesAsync(
+  folderOrFile: string,
+  runtime: boolean,
+  excludedFolders: ReadonlySet<string> = new Set()
+): Promise<string[]> {
   try {
     const stat: Awaited<ReturnType<typeof fs.stat>> = await fs.stat(folderOrFile);
     if (!stat.isDirectory()) return [folderOrFile];
@@ -341,8 +381,14 @@ async function listFilesAsync(folderOrFile: string, runtime: boolean): Promise<s
     for (const entry of await fs.readdir(folderOrFile, { withFileTypes: true })) {
       if (entry.name === 'node_modules' || (runtime && entry.name === 'test')) continue;
       const filename: string = path.join(folderOrFile, entry.name);
-      if (entry.isDirectory()) files.push(...(await listFilesAsync(filename, runtime)));
-      else if (!runtime || (/\.(?:js|cjs|mjs|json)$/.test(entry.name) && !entry.name.endsWith('.test.js'))) {
+      if (entry.isDirectory()) {
+        if (!excludedFolders.has(filename)) {
+          files.push(...(await listFilesAsync(filename, runtime, excludedFolders)));
+        }
+      } else if (
+        !runtime ||
+        (/\.(?:js|cjs|mjs|json)$/.test(entry.name) && !entry.name.endsWith('.test.js'))
+      ) {
         files.push(filename);
       }
     }
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index a81b6b66a9..8982ac0494 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -192,4 +192,65 @@ describe('workspace input fingerprints', () => {
       fs.rmSync(folder, { recursive: true, force: true });
     }
   });
+
+  it('ignores operation state inside a project nested in common/config but not its definitions', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write(
+        'rush.json',
+        JSON.stringify({
+          rushVersion: '5.179.0',
+          pnpmVersion: '10.27.0',
+          projectFolderMaxDepth: 4,
+          projects: [
+            { packageName: 'pipelines', projectFolder: 'common/config/pipelines' },
+            { packageName: 'inside-rush', projectFolder: 'common/config/rush/inside-rush' }
+          ]
+        })
+      );
+      write('common/config/pipelines/package.json', '{"name":"pipelines","version":"1.0.0"}');
+      write('common/config/rush/inside-rush/package.json', '{"name":"inside-rush","version":"1.0.0"}');
+      write('common/config/rush/command-line.json', '{"commands":[]}');
+      write('common/config/other/settings.json', '{}');
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+
+      let previous: IWorkspaceInputFingerprint = await captureAsync();
+      for (const relativePath of [
+        'common/config/pipelines/rush-logs/pipelines._phase_build.log',
+        'common/config/pipelines/.rush/temp/operation/_phase_build/state.json',
+        'common/config/pipelines/lib/index.js',
+        'common/config/pipelines/config/heft.json'
+      ]) {
+        write(relativePath, String(Math.random()));
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(next.configurationHash).toBe(previous.configurationHash);
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Reuse);
+      }
+      for (const [relativePath, content] of [
+        ['common/config/pipelines/package.json', '{"name":"pipelines","version":"1.0.1"}'],
+        ['common/config/pipelines/config/rush-project.json', '{"operationSettings":[]}'],
+        ['common/config/pipelines/config/rig.json', '{"rigPackageName":"rig"}'],
+        ['common/config/rush/command-line.json', '{"commands":[],"parameters":[]}'],
+        ['common/config/rush/inside-rush/rush-logs/inside-rush._phase_build.log', 'log'],
+        ['common/config/other/settings.json', '{"changed":true}']
+      ]) {
+        write(relativePath, content);
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Reload);
+        previous = next;
+      }
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 801ccdafc3..980113494a 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -290,7 +290,7 @@
           "exclusiveMinimum": true,
           "maximum": 2147483.647,
           "default": 300,
-          "description": "Idle resource expiration for an attached warm set in seconds, at most 2147483.647 (the signed 32-bit millisecond limit of setTimeout). RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS overrides."
+          "description": "Idle resource expiration for an attached warm set in seconds, at most 2147483.647 (the signed 32-bit millisecond limit of setTimeout). Retained results of resource-free projects do not expire. RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS overrides."
         },
         "warmMemoryBudgetMB": {
           "type": "number",
@@ -298,7 +298,7 @@
           "exclusiveMinimum": true,
           "maximum": 9007199254740991,
           "default": 512,
-          "description": "Best-effort sampled RSS budget in MiB, not a hard process/tree memory ceiling. At most 9007199254740991 (Number.MAX_SAFE_INTEGER). Active/protected work is exempt. RUSH_DAEMON_WARM_MEMORY_BUDGET_MB overrides."
+          "description": "Best-effort sampled RSS budget in MiB, not a hard process/tree memory ceiling. At most 9007199254740991 (Number.MAX_SAFE_INTEGER). Active/protected work and retained results of resource-free projects are exempt. RUSH_DAEMON_WARM_MEMORY_BUDGET_MB overrides."
         },
         "warmSetMaxProjects": {
           "type": "integer",

From 593dbcfc723e9bb591549d896d3ae73d05beb876 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:31:54 +0000
Subject: [PATCH 017/265] [rush-daemon] Warm set: read status once per
 maintenance pass, not once per project (and 1 more)

Swarm integration step 2; original commit 8553b2be55 (merge of swarm/r07 at d94054e04d).

Commits folded into this step (2):
- 57dd6a4b45 [rush-daemon] Warm set: read status once per maintenance pass, not once per project
- d94054e04d [rush-lib] Share rig profile loads across projects in the uncached rush-project.json load

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rig-profile-realpath_2026-09-28-13-00.json |  10 +
 ...warm-set-status-once_2026-09-28-12-50.json |  10 +
 libraries/rush-daemon/src/WorkspaceWarmSet.ts |   6 +-
 .../WorkspaceWarmSetMaintenanceCost.test.ts   | 176 ++++++++++++++++++
 .../src/api/RushProjectConfiguration.ts       |  60 +++++-
 .../api/test/RushProjectConfiguration.test.ts |  56 ++++++
 6 files changed, 313 insertions(+), 5 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r07-rig-profile-realpath_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r07-warm-set-status-once_2026-09-28-12-50.json
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-r07-rig-profile-realpath_2026-09-28-13-00.json b/common/changes/@microsoft/rush/swarm-r07-rig-profile-realpath_2026-09-28-13-00.json
new file mode 100644
index 0000000000..c0a5dec20c
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r07-rig-profile-realpath_2026-09-28-13-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "The daemon's uncached rush-project.json load resolves each rig profile folder to its real path, so projects that reach one rig through their own node_modules symlinks share one load of the rig's files instead of re-reading and re-resolving them per project.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r07-warm-set-status-once_2026-09-28-12-50.json b/common/changes/@rushstack/rush-daemon/swarm-r07-warm-set-status-once_2026-09-28-12-50.json
new file mode 100644
index 0000000000..cf46ceb8d9
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r07-warm-set-status-once_2026-09-28-12-50.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Warm set: an idle maintenance pass reads its status once, and again only after an eviction attempt, instead of once per retained project, so a pass that evicts nothing no longer blocks the daemon for seconds in large repos.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index bf037cabc0..0be59f2249 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -355,11 +355,14 @@ export class WorkspaceWarmSet implements AsyncDisposable {
 
   async #evictIdleAsync(): Promise<void> {
     const { operationGraph: graph, watcher } = this.#options;
+    // getStatus() re-ranks every project. Only an eviction attempt (which awaits) can change it during a pass, so
+    // it is reused until then; recomputing it per project made a pass without evictions quadratic.
+    let currentStatus: IWorkspaceWarmSetStatus | undefined;
     // Retention and eviction use exactly the same ordering, reversed only to release the lowest value first.
     for (const project of this.#rankProjects().reverse()) {
       if (this.#disposed) break;
       if (project.protected) continue;
-      const status: IWorkspaceWarmSetStatus = this.getStatus();
+      const status: IWorkspaceWarmSetStatus = (currentStatus ??= this.getStatus());
       const expired: boolean =
         performance.now() - project.lastUsed >= this.#configuration.warmIdleTimeoutSeconds * 1000;
       const unrequested: boolean =
@@ -388,6 +391,7 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         this.#cleanupFailures.set(project.key, message);
         this.#diagnose(new Error(message, { cause: error }));
       }
+      currentStatus = undefined;
     }
   }
 
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
new file mode 100644
index 0000000000..b9d42c040c
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
@@ -0,0 +1,176 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  OperationStatus,
+  type IOperationGraph,
+  type IOperationRunner,
+  type Operation
+} from '@microsoft/rush-lib';
+
+import type { RequestScheduler } from '../RequestScheduler';
+import type { WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
+import {
+  WorkspaceWarmSet,
+  type IWorkspaceWarmSetStatus,
+  type WorkspaceWarmSetConfiguration
+} from '../WorkspaceWarmSet';
+
+type Tap = (...args: unknown[]) => unknown;
+
+const CONFIGURATION: WorkspaceWarmSetConfiguration = {
+  watch: false,
+  warmIdleTimeoutSeconds: 3600,
+  warmMemoryBudgetMB: 1024 * 1024,
+  warmSetMaxProjects: 20,
+  autoWarmByTelemetry: false
+};
+
+interface ITestGraph {
+  readonly graph: IOperationGraph;
+  readonly operations: Operation[];
+  readonly requestAll: () => void;
+}
+
+function createHook(taps: Tap[]): { tap: (options: unknown, fn: Tap) => void } {
+  return {
+    tap: (options: unknown, fn: Tap) => {
+      taps.push(fn);
+    }
+  };
+}
+
+// A graph shaped like a warm odsp-web generation: every project has retained results and nothing is running.
+function createGraph(projectCount: number): ITestGraph {
+  const operations: Operation[] = [];
+  for (let i: number = 0; i < projectCount; i++) {
+    operations.push({
+      name: `p${i} (build)`,
+      associatedProject: { packageName: `p${i}` },
+      enabled: true,
+      runner: undefined,
+      consumers: new Set()
+    } as unknown as Operation);
+  }
+  const configureIterationTaps: Tap[] = [];
+  const resultByOperation: Map<Operation, unknown> = new Map(
+    operations.map((operation) => [operation, { status: OperationStatus.Success }])
+  );
+  const graph: IOperationGraph = {
+    operations: new Set(operations),
+    resultByOperation,
+    hooks: {
+      configureIteration: createHook(configureIterationTaps),
+      beforeExecuteOperationAsync: createHook([]),
+      afterExecuteIterationAsync: createHook([]),
+      onIdle: createHook([])
+    },
+    hasScheduledIteration: false,
+    status: OperationStatus.Ready,
+    abortController: new AbortController(),
+    deleteResults: (deleted: Iterable<Operation>): void => {
+      for (const operation of deleted) resultByOperation.delete(operation);
+    },
+    closeRunnersAsync: async (closed: Iterable<Operation>): Promise<void> => {
+      for (const operation of closed) await operation.runner?.closeAsync?.();
+    }
+  } as unknown as IOperationGraph;
+  return {
+    graph,
+    operations,
+    requestAll: () => {
+      for (const tap of configureIterationTaps) tap(new Map(), new Map(), {});
+    }
+  };
+}
+
+function attach(
+  graph: IOperationGraph,
+  configuration: Partial<WorkspaceWarmSetConfiguration> = {}
+): WorkspaceWarmSet {
+  return WorkspaceWarmSet.attach({
+    operationGraph: graph,
+    configuration: { ...CONFIGURATION, ...configuration },
+    scheduler: { acquireAsync: async () => ({ release: () => undefined }) } as unknown as RequestScheduler,
+    acquireExecutionLeaseAsync: async () => ({ [Symbol.asyncDispose]: async () => undefined }),
+    watcher: {
+      watchedProjectNames: new Set<string>(),
+      watchProjects: () => undefined,
+      unwatchProjectsAsync: async () => undefined
+    } as unknown as WorkspaceSessionFileWatcher
+  });
+}
+
+function createResidentRunner(): IOperationRunner {
+  let active: boolean = true;
+  return {
+    name: 'resident',
+    isNoOp: false,
+    cacheable: false,
+    reportTiming: false,
+    silent: false,
+    warningsAreAllowed: false,
+    get isActive(): boolean {
+      return active;
+    },
+    getConfigHash: () => '',
+    executeAsync: async () => OperationStatus.Success,
+    closeAsync: async () => {
+      active = false;
+    }
+  };
+}
+
+async function countStatusReadsInPassAsync(warm: WorkspaceWarmSet): Promise<number> {
+  // Let the pass scheduled by attachment and by the simulated request settle, so only the measured pass is counted.
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  await warm.maintainAsync();
+  const getStatus: jest.SpyInstance = jest.spyOn(warm, 'getStatus');
+  try {
+    await warm.maintainAsync();
+    return getStatus.mock.calls.length;
+  } finally {
+    getStatus.mockRestore();
+  }
+}
+
+describe('warm-set maintenance cost', () => {
+  const disposables: WorkspaceWarmSet[] = [];
+  afterEach(async () => {
+    for (const warm of disposables.splice(0)) await warm[Symbol.asyncDispose]();
+  });
+
+  it('reads status a constant number of times in a pass that evicts nothing, regardless of project count', async () => {
+    const counts: number[] = [];
+    for (const projectCount of [10, 2000]) {
+      const { graph, requestAll } = createGraph(projectCount);
+      const warm: WorkspaceWarmSet = attach(graph);
+      disposables.push(warm);
+      requestAll();
+      counts.push(await countStatusReadsInPassAsync(warm));
+      expect(graph.resultByOperation.size).toBe(projectCount);
+      expect(warm.getStatus().retainedProjectNames).toHaveLength(projectCount);
+    }
+    expect(counts[1]).toBe(counts[0]);
+    expect(counts[0]).toBeLessThanOrEqual(2);
+  });
+
+  it('re-reads status after each eviction attempt, so it stops evicting once back under the project cap', async () => {
+    const { graph, operations, requestAll } = createGraph(40);
+    for (const operation of operations.slice(0, 5)) operation.runner = createResidentRunner();
+    const warm: WorkspaceWarmSet = attach(graph, { warmSetMaxProjects: 3 });
+    disposables.push(warm);
+    requestAll();
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    const getStatus: jest.SpyInstance = jest.spyOn(warm, 'getStatus');
+    const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    // Two evictions: one read before the first attempt, one after each attempt, one for the pass result.
+    expect(getStatus.mock.calls.length).toBeLessThanOrEqual(4);
+    getStatus.mockRestore();
+    expect(status.overProjectLimit).toBe(false);
+    const evicted: Operation[] = operations.filter((operation) => !graph.resultByOperation.has(operation));
+    expect(evicted).toHaveLength(2);
+    expect(evicted.every((operation) => operation.runner?.isActive === false)).toBe(true);
+    expect(graph.resultByOperation.size).toBe(38);
+  });
+});
diff --git a/libraries/rush-lib/src/api/RushProjectConfiguration.ts b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
index d3e356756b..f9c0668547 100644
--- a/libraries/rush-lib/src/api/RushProjectConfiguration.ts
+++ b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
@@ -6,7 +6,12 @@ import * as path from 'node:path';
 import { AlreadyReportedError, Async, FileSystem, JsonFile, Path } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
 import { ProjectConfigurationFile, InheritanceType } from '@rushstack/heft-config-file';
-import { RigConfig, type IRigConfigJson, type ILoadForProjectFolderOptions } from '@rushstack/rig-package';
+import {
+  RigConfig,
+  type IRigConfig,
+  type IRigConfigJson,
+  type ILoadForProjectFolderOptions
+} from '@rushstack/rig-package';
 
 import type { RushConfigurationProject } from './RushConfigurationProject';
 import { RushConstants } from '../logic/RushConstants';
@@ -660,7 +665,7 @@ async function _tryLoadJsonForProjectAsync(
     loaders?.configurationFile ?? RUSH_PROJECT_CONFIGURATION_FILE;
   const oldConfigurationFile: ProjectConfigurationFile<IOldRushProjectJson> =
     loaders?.oldConfigurationFile ?? OLD_RUSH_PROJECT_CONFIGURATION_FILE;
-  const rigConfig: RigConfig | undefined = loaders
+  const rigConfig: IRigConfig | undefined = loaders
     ? await loadIsolatedRigConfigAsync(project.projectFolder)
     : await RigConfig.loadForProjectFolderAsync({ projectFolderPath: project.projectFolder });
 
@@ -699,7 +704,50 @@ async function _tryLoadJsonForProjectAsync(
   }
 }
 
-async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<RigConfig | undefined> {
+/**
+ * A found rig whose resolved profile folder is the real path of the rig package's profile folder.
+ */
+class RealProfileFolderRigConfig implements IRigConfig {
+  public readonly projectFolderOriginalPath: string;
+  public readonly projectFolderPath: string;
+  public readonly rigFound: boolean;
+  public readonly filePath: string;
+  public readonly rigPackageName: string;
+  public readonly rigProfile: string;
+  public readonly relativeProfileFolderPath: string;
+  readonly #rigConfig: IRigConfig;
+  readonly #profileFolder: string;
+
+  public constructor(rigConfig: IRigConfig, profileFolder: string) {
+    this.projectFolderOriginalPath = rigConfig.projectFolderOriginalPath;
+    this.projectFolderPath = rigConfig.projectFolderPath;
+    this.rigFound = rigConfig.rigFound;
+    this.filePath = rigConfig.filePath;
+    this.rigPackageName = rigConfig.rigPackageName;
+    this.rigProfile = rigConfig.rigProfile;
+    this.relativeProfileFolderPath = rigConfig.relativeProfileFolderPath;
+    this.#rigConfig = rigConfig;
+    this.#profileFolder = profileFolder;
+  }
+
+  public getResolvedProfileFolder(): string {
+    return this.#profileFolder;
+  }
+
+  public async getResolvedProfileFolderAsync(): Promise<string> {
+    return this.#profileFolder;
+  }
+
+  public tryResolveConfigFilePath(configFileRelativePath: string): string | undefined {
+    return this.#rigConfig.tryResolveConfigFilePath(configFileRelativePath);
+  }
+
+  public async tryResolveConfigFilePathAsync(configFileRelativePath: string): Promise<string | undefined> {
+    return await this.#rigConfig.tryResolveConfigFilePathAsync(configFileRelativePath);
+  }
+}
+
+async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<IRigConfig | undefined> {
   let rigJson: IRigConfigJson;
   try {
     rigJson = await JsonFile.loadAsync(path.join(projectFolder, 'config', 'rig.json'));
@@ -718,14 +766,18 @@ async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<RigCon
   };
   const rigConfig: RigConfig = await RigConfig.loadForProjectFolderAsync(options);
   if (rigConfig.rigFound) {
+    let profileFolder: string;
     try {
       // The configuration file loader resolves the rig profile synchronously, which serializes these
       // concurrent project loads. Resolving it asynchronously first caches the same result on this instance.
-      await rigConfig.getResolvedProfileFolderAsync();
+      profileFolder = await rigConfig.getResolvedProfileFolderAsync();
     } catch {
       // A fresh instance reports the failure exactly as the native loader does, if and when the rig is used.
       return await RigConfig.loadForProjectFolderAsync(options);
     }
+    // Each project reaches a shared rig through its own node_modules symlink, and the loaders cache by file
+    // path. The real profile folder lets every project share one load of the rig's files and "extends" chain.
+    return new RealProfileFolderRigConfig(rigConfig, await FileSystem.getRealPathAsync(profileFolder));
   }
   return rigConfig;
 }
diff --git a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
index 74dba0d20b..61e4dbee64 100644
--- a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
@@ -5,6 +5,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { FileSystem, Path } from '@rushstack/node-core-library';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import type { CommandLineParameter } from '@rushstack/ts-command-line';
 
@@ -165,6 +166,61 @@ describe(RushProjectConfiguration.name, () => {
       const configurations = await loadAsync(ownFile);
       expect(getOutputFolderNames(configurations.get(ownFile))).toEqual(['from-project']);
     });
+
+    it('loads a rig profile shared through per-project node_modules symlinks once, with native results', async () => {
+      write('store/example-rig/package.json', { name: 'example-rig', version: '1.0.0' });
+      write('store/example-rig/profiles/default/config/rush-project.json', {
+        extends: '../../../shared/rush-project.json',
+        operationSettings: [{ operationName: '_phase:build', outputFolderNames: ['from-rig'] }]
+      });
+      write('store/example-rig/shared/rush-project.json', {
+        operationSettings: [{ operationName: '_phase:test', outputFolderNames: ['from-shared'] }]
+      });
+      const names: string[] = ['linked-1', 'linked-2', 'linked-3', 'linked-own'];
+      for (const name of names) {
+        write(`${name}/package.json`, { name, version: '1.0.0' });
+        write(`${name}/config/rig.json`, { rigPackageName: 'example-rig' });
+        fs.mkdirSync(path.join(folder, name, 'node_modules'));
+        fs.symlinkSync(
+          path.join(folder, 'store/example-rig'),
+          path.join(folder, name, 'node_modules/example-rig'),
+          'junction'
+        );
+      }
+      write('linked-own/config/rush-project.json', {
+        operationSettings: [{ operationName: '_phase:build', outputFolderNames: ['from-project'] }]
+      });
+      const projects: RushConfigurationProject[] = names.map(project);
+
+      const readFileAsync: jest.SpyInstance = jest.spyOn(FileSystem, 'readFileAsync');
+      let configurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>;
+      let readPaths: string[];
+      try {
+        configurations = await loadAsync(...projects);
+        readPaths = readFileAsync.mock.calls.map(([filePath]) => Path.convertToSlashes(filePath));
+      } finally {
+        readFileAsync.mockRestore();
+      }
+      expect(readPaths.filter((p) => p.endsWith('/profiles/default/config/rush-project.json'))).toHaveLength(1);
+      expect(readPaths.filter((p) => p.endsWith('/shared/rush-project.json'))).toHaveLength(1);
+
+      for (const linked of projects.slice(0, 3)) {
+        expect(getOutputFolderNames(configurations.get(linked))).toEqual(['from-rig']);
+        expect([
+          ...configurations.get(linked)!.operationSettingsByOperationName.get('_phase:test')!.outputFolderNames!
+        ]).toEqual(['from-shared']);
+      }
+      expect(getOutputFolderNames(configurations.get(projects[3]))).toEqual(['from-project']);
+
+      const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+      for (const linked of projects) {
+        const native: RushProjectConfiguration | undefined = await RushProjectConfiguration.tryLoadForProjectAsync(
+          linked,
+          terminal
+        );
+        expect(configurations.get(linked)!._getJsonForFingerprint()).toBe(native!._getJsonForFingerprint());
+      }
+    });
   });
 
   describe('operationSettingsByOperationName', () => {

From cd7a2a5b738c5efad7e06980b6bba8d3db5e8e6a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:57:14 +0000
Subject: [PATCH 018/265] [rush-lib] Keep RUSH_DAEMON* variables out of
 lifecycle script environments (and 3 more)

Swarm integration step 3; original commit 3b2d24277d (merge of swarm/r06 at 6c10e241a4).



Commits folded into this step (4):
- 803345396b [rush-lib] Keep RUSH_DAEMON* variables out of lifecycle script environments
- b49d8b10cb [rush-daemon] Keep one daemon across per-session environment differences
- 36892176cb [rush-daemon-transport] Reap detached operation groups of a daemon that died uncleanly
- 6c10e241a4 [rush-daemon] Run each operation with its requester's per-session environment

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/RushXDaemonBoundaries.test.ts    |  19 ++
 .../rush/rushd-env-identity_2026-09-28.json   |  11 ++
 .../rush/rushd-operation-env_2026-09-28.json  |  11 ++
 ...ushd-request-operation-env_2026-09-28.json |  11 ++
 ...ushd-request-operation-env_2026-09-28.json |  11 ++
 .../rushd-orphan-groups_2026-09-28.json       |  11 ++
 .../rushd-env-identity_2026-09-28.json        |  11 ++
 ...ushd-request-operation-env_2026-09-28.json |  11 ++
 common/reviews/api/rush-lib.api.md            |  13 +-
 .../src/DaemonGroupTermination.ts             |  52 ++++++
 .../src/DaemonListener.ts                     |   7 +-
 .../src/DaemonListenerLifetime.ts             |  14 +-
 .../src/DaemonOperationGroupReaper.ts         |  75 ++++++++
 .../src/DaemonOperationGroupRecorder.ts       |  70 ++++++++
 .../src/DaemonOperationGroups.ts              |  65 +++++++
 .../src/DaemonOrphanReaper.ts                 |  98 +++-------
 .../src/DaemonProcessGroup.ts                 |  10 +-
 .../src/DaemonProcessStat.ts                  |  72 ++++++++
 .../src/DaemonReapOptions.ts                  |  63 +++++++
 .../src/DaemonReclaim.ts                      |  11 +-
 .../test/DaemonOperationGroupReaper.test.ts   |  77 ++++++++
 .../test/DaemonOperationGroupRecorder.test.ts |  61 +++++++
 .../src/test/DaemonOrphanReaper.test.ts       |   2 +-
 .../src/test/DaemonProcessStat.test.ts        |  50 ++++++
 .../src/test/FakeOperationDaemonFixture.ts    |  64 +++++++
 .../src/test/OperationGroupFixture.ts         |  49 +++++
 .../test/OperationGroupReapOnReclaim.test.ts  |  59 ++++++
 .../test/OperationGroupTermination.test.ts    |  83 +++++++++
 .../src/test/OrphanReaperFixture.ts           |  73 ++++++--
 .../src/test/ProcessWaitFixture.ts            |  53 ++++++
 .../rush-daemon/src/PhasedRequestRouter.ts    |  30 +++-
 .../src/ProductionDaemonRequestResolver.ts    |   8 +-
 .../src/RushXDaemonRequestResolver.ts         |   3 +
 .../src/VersionSelectedDaemonLauncher.ts      |  11 +-
 .../src/test/PhasedRequestBatching.test.ts    |  62 ++++++-
 .../ProductionDaemonRequestResolver.test.ts   |  75 +++++++-
 .../VersionSelectedDaemonLauncher.test.ts     |  20 +++
 .../test/WorkspaceReloadTierStatus.test.ts    |  21 ++-
 .../rush-lib/src/api/PhasedCommandEngine.ts   |  10 +-
 .../src/api/WorkspaceInputFingerprint.ts      | 160 ++++++++++++++---
 ...asedCommandEngineParameterIdentity.test.ts |  39 ++++
 .../test/WorkspaceInputFingerprint.test.ts    |  97 ++++++++++
 .../rush-lib/src/cli/RushCommandLineParser.ts |  11 ++
 .../cli/scriptActions/PhasedScriptAction.ts   |  32 +++-
 libraries/rush-lib/src/index.ts               |   3 +
 .../src/logic/incremental/InputsSnapshot.ts   |  93 ++++++----
 .../incremental/test/InputsSnapshot.test.ts   |  36 ++++
 .../src/logic/operations/IOperationGraph.ts   |  12 ++
 .../operations/OperationExecutionRecord.ts    |  11 +-
 .../src/logic/operations/OperationGraph.ts    |  18 +-
 ...OperationGraphOperationEnvironment.test.ts | 170 ++++++++++++++++++
 libraries/rush-lib/src/utilities/Utilities.ts |   7 +
 .../src/utilities/test/Utilities.test.ts      |  32 ++++
 53 files changed, 1994 insertions(+), 184 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-env-identity_2026-09-28.json
 create mode 100644 common/changes/@microsoft/rush/rushd-operation-env_2026-09-28.json
 create mode 100644 common/changes/@microsoft/rush/rushd-request-operation-env_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/rushd-request-operation-env_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/rushd-orphan-groups_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-env-identity_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-request-operation-env_2026-09-28.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonProcessStat.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonReapOptions.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts

diff --git a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
index ecb58c4df2..37534a31ab 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
@@ -156,6 +156,25 @@ describe('native Rushx execution boundaries', () => {
     }
   );
 
+  it("serves a request that sets a variable the daemon host starts without, with the request's value", async () => {
+    const parallelism: string | undefined = process.env.RUSH_PARALLELISM;
+    // A daemon host does not inherit the request-scoped variables of the client that started it.
+    delete process.env.RUSH_PARALLELISM;
+    let cwd: string;
+    try {
+      cwd = await startAsync();
+    } finally {
+      if (parallelism !== undefined) process.env.RUSH_PARALLELISM = parallelism;
+    }
+    fixture.write('projects/a/script.cjs', 'console.log(process.env.RUSH_PARALLELISM);');
+    const result: IRequestResult = await fixture.runAsync(
+      fixture.request(['-q', 'build'], cwd, fixture.environment({ RUSH_PARALLELISM: '2' }))
+    );
+    expect(result.outcome.kind).toBe('result');
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.toString()).toBe('2\n');
+  });
+
   it('runs a script without queueing behind an exclusive workspace request', async () => {
     const cwd: string = await startAsync();
     let release: () => void = () => {};
diff --git a/common/changes/@microsoft/rush/rushd-env-identity_2026-09-28.json b/common/changes/@microsoft/rush/rushd-env-identity_2026-09-28.json
new file mode 100644
index 0000000000..dee50fac66
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-env-identity_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Stop per-session variables (`RUSHD_OUTPUT`, `RUSH_PARALLELISM`, `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, `RUSH_INVOKED_FOLDER`, systemd, editor, terminal and coding-agent session markers) and repeated `PATH` entries from changing a long-lived host's workspace identity, and read an engine request's `RUSH_PARALLELISM` from that request's environment.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/rushd-operation-env_2026-09-28.json b/common/changes/@microsoft/rush/rushd-operation-env_2026-09-28.json
new file mode 100644
index 0000000000..b959f07eaa
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-operation-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Keep `RUSH_DAEMON*` variables out of lifecycle script environments, so that project tooling that starts an older Rush release, which rejects them as unknown `RUSH_*` variables, works when the command was routed through the Rush daemon.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/rushd-request-operation-env_2026-09-28.json b/common/changes/@microsoft/rush/rushd-request-operation-env_2026-09-28.json
new file mode 100644
index 0000000000..1396212768
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-request-operation-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `IOperationGraphIterationOptions.getOperationEnvironment` and `getWorkspaceRequestOperationEnvironment`, so that a long-lived host can start each operation, and hash its `dependsOnEnvVars`, from the environment of the request that selected it rather than from its own `process.env`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/rushd-request-operation-env_2026-09-28.json b/common/changes/@rushstack/rush-cli-client/rushd-request-operation-env_2026-09-28.json
new file mode 100644
index 0000000000..67822bf202
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/rushd-request-operation-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Cover a `rushx` request that sets `RUSH_PARALLELISM`, which the daemon now serves.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/rushd-orphan-groups_2026-09-28.json b/common/changes/@rushstack/rush-daemon-transport/rushd-orphan-groups_2026-09-28.json
new file mode 100644
index 0000000000..96e2b98b92
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/rushd-orphan-groups_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "On Linux, record the detached process groups that a daemon's operations lead, and when reclaiming the socket of a daemon that died uncleanly (SIGKILL/OOM), terminate the recorded groups that are proven to still belong to it (SIGTERM, then SIGKILL after a grace period), so that a successor daemon does not re-run those operations while the orphans are still writing.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-env-identity_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-env-identity_2026-09-28.json
new file mode 100644
index 0000000000..5f0bfa1a78
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-env-identity_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep one daemon across clients whose environments differ only in per-session variables, apply each request's own `RUSH_PARALLELISM`, and start the daemon without the starting client's `RUSH_PARALLELISM` and `COPILOT_AGENT_SESSION_ID`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-request-operation-env_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-request-operation-env_2026-09-28.json
new file mode 100644
index 0000000000..ca002cab9e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-request-operation-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Run each phased operation with the per-session variables (such as `COPILOT_AGENT_SESSION_ID`, `GIT_ASKPASS`, terminal markers and `RUSH_INVOKED_FOLDER`) of the request that selected it, and hash its `dependsOnEnvVars` from those same values, rather than from the environment of the client that started the daemon. Serve `rushx` requests that set a per-request variable such as `RUSH_PARALLELISM` instead of running them in-process.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 7b82e2af5d..0215d58fda 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -384,6 +384,12 @@ export type GetInputsSnapshotAsyncFn = () => Promise<IInputsSnapshot | undefined
 // @alpha
 export function getWorkspaceFingerprintEnvironmentEntries(environment: Readonly<Record<string, string | undefined>>): [string, string][];
 
+// @alpha
+export function getWorkspaceHostEnvironment(environment: Readonly<Record<string, string | undefined>>): Record<string, string>;
+
+// @alpha
+export function getWorkspaceRequestOperationEnvironment(hostEnvironment: Readonly<Record<string, string | undefined>>, requestEnvironment: Readonly<Record<string, string | undefined>>): Record<string, string>;
+
 // @alpha (undocumented)
 export interface IBaseOperationExecutionResult {
     getStateHash(): string;
@@ -616,7 +622,7 @@ export interface IIndividualVersionJson extends IVersionPolicyJson {
 
 // @beta
 export interface IInputsSnapshot {
-    getOperationOwnStateHash(project: IRushConfigurationProjectForSnapshot, operationName?: string): string;
+    getOperationOwnStateHash(project: IRushConfigurationProjectForSnapshot, operationName?: string, environment?: Readonly<Record<string, string | undefined>>): string;
     getTrackedFileHashesForOperation(project: IRushConfigurationProjectForSnapshot, operationName?: string): ReadonlyMap<string, string>;
     readonly hashes: ReadonlyMap<string, string>;
     readonly hasUncommittedChanges: boolean;
@@ -766,6 +772,7 @@ export interface _IOperationGraphEventSink {
 
 // @alpha
 export interface IOperationGraphIterationOptions {
+    getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
     // (undocumented)
     inputsSnapshot?: IInputsSnapshot;
     startTime?: number;
@@ -903,6 +910,7 @@ export interface IParsePhasedCommandOptions {
     readonly argv: ReadonlyArray<string>;
     // (undocumented)
     readonly cwd: string;
+    readonly environment?: Readonly<Record<string, string | undefined>>;
     // (undocumented)
     readonly rushConfiguration: RushConfiguration;
     // (undocumented)
@@ -2125,6 +2133,9 @@ export enum WorkspaceInputChangeTier {
     Reuse = 0
 }
 
+// @alpha
+export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string>;
+
 // @alpha
 export class WorkspaceRuntimeFingerprintCache {
     get changedPaths(): ReadonlyArray<string>;
diff --git a/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts b/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
new file mode 100644
index 0000000000..df74a2495e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IReapContext } from './DaemonReapOptions';
+
+const POLL_INTERVAL_MS: number = 20;
+
+/** Outcome of reaping a dead daemon's orphaned process groups. */
+export type DaemonOrphanReapOutcome = 'none' | 'terminated' | 'killed';
+
+function listExistingGroups(context: IReapContext, groupIds: readonly number[]): number[] {
+  return groupIds.filter((groupId: number) => context.ops.groupExists(groupId));
+}
+
+function haveAllExited(context: IReapContext, groupIds: readonly number[]): boolean {
+  return !groupIds.some((groupId: number) => context.ops.groupExists(groupId));
+}
+
+async function waitForGroupsExitAsync(context: IReapContext, groupIds: readonly number[]): Promise<boolean> {
+  const deadline: number = context.ops.now() + context.graceMs;
+  while (context.ops.now() < deadline) {
+    if (haveAllExited(context, groupIds)) return true;
+    await context.ops.delayAsync(POLL_INTERVAL_MS);
+  }
+  return haveAllExited(context, groupIds);
+}
+
+function signalExistingGroups(
+  context: IReapContext,
+  groupIds: readonly number[],
+  signal: NodeJS.Signals
+): void {
+  for (const groupId of listExistingGroups(context, groupIds)) {
+    context.ops.signalGroup(groupId, signal);
+  }
+}
+
+/**
+ * Sends SIGTERM to every group, then SIGKILL to those still present after `graceMs`, and throws if any is
+ * still present after a further `graceMs`. The groups share each grace period. Call only for groups proven
+ * to belong to the dead daemon, under the reclaim mutex.
+ */
+export async function terminateProcessGroupsAsync(
+  context: IReapContext,
+  groupIds: readonly number[]
+): Promise<DaemonOrphanReapOutcome> {
+  signalExistingGroups(context, groupIds, 'SIGTERM');
+  if (await waitForGroupsExitAsync(context, groupIds)) return 'terminated';
+  signalExistingGroups(context, groupIds, 'SIGKILL');
+  if (await waitForGroupsExitAsync(context, groupIds)) return 'killed';
+  throw new Error(`Processes of dead daemon ${context.deadPid} survived SIGKILL; not reclaiming its socket.`);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonListener.ts b/libraries/rush-daemon-transport/src/DaemonListener.ts
index df37a5749b..083ba3ae50 100644
--- a/libraries/rush-daemon-transport/src/DaemonListener.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListener.ts
@@ -9,6 +9,8 @@ import { DaemonFrameConnection } from './DaemonFrameConnection';
 import { listenWithReclaimAsync } from './DaemonListenerBinding';
 import { DaemonListenerLifetime } from './DaemonListenerLifetime';
 import { ensureDaemonRuntimeDir, writeDaemonLockfile } from './DaemonLockfile';
+import { startOperationGroupRecording } from './DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder } from './DaemonOperationGroups';
 import { assertDaemonOwnershipAvailable } from './DaemonOwnership';
 import type { IDaemonPaths } from './DaemonPaths';
 
@@ -31,7 +33,10 @@ export interface IDaemonListenerOptions {
 export class DaemonFrameListener {
   readonly #lifetime: DaemonListenerLifetime;
   private constructor(server: net.Server, paths: IDaemonPaths) {
-    this.#lifetime = new DaemonListenerLifetime(server, paths);
+    // Record detached operation groups for as long as this process owns the lockfile, so a successor can
+    // reap them if this daemon dies uncleanly.
+    const folder: string = getOperationGroupsFolder(paths.lockfilePath, process.pid);
+    this.#lifetime = new DaemonListenerLifetime(server, paths, startOperationGroupRecording(folder));
   }
   /** Binds the socket/pipe path and writes the PID lockfile. */
   public static async listenAsync(
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
index ee6f22141b..90f79a48b6 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
@@ -4,17 +4,28 @@
 import type * as net from 'node:net';
 
 import { removeDaemonArtifacts } from './DaemonLockfile';
+import type { StopOperationGroupRecording } from './DaemonOperationGroupRecorder';
 import type { IDaemonPaths } from './DaemonPaths';
 
+function keepNoRecords(): void {
+  // Nothing was recorded before the lockfile was written.
+}
+
 export class DaemonListenerLifetime {
   readonly #paths: IDaemonPaths;
   readonly #server: net.Server;
+  readonly #stopRecording: StopOperationGroupRecording;
   #closePromise: Promise<void> | undefined;
   #stopPromise: Promise<void> | undefined;
 
-  public constructor(server: net.Server, paths: IDaemonPaths) {
+  public constructor(
+    server: net.Server,
+    paths: IDaemonPaths,
+    stopRecording: StopOperationGroupRecording = keepNoRecords
+  ) {
     this.#server = server;
     this.#paths = paths;
+    this.#stopRecording = stopRecording;
   }
 
   public stopAcceptingAsync(): Promise<void> {
@@ -29,6 +40,7 @@ export class DaemonListenerLifetime {
 
   async #closeOnceAsync(): Promise<void> {
     await this.stopAcceptingAsync();
+    this.#stopRecording();
     removeDaemonArtifacts(this.#paths.lockfilePath, this.#paths.socketPath);
   }
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
new file mode 100644
index 0000000000..f1d4a45068
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -0,0 +1,75 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
+import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
+import {
+  getOperationGroupsFolder,
+  readOperationGroupRecords,
+  removeOperationGroupRecords
+} from './DaemonOperationGroups';
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import type { IProcessStat } from './DaemonProcessStat';
+import { createReapContext, isSignalableGroup } from './DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+
+const NO_MEMBERS: number = 0;
+const LIST_SEPARATOR: string = ', ';
+
+function isSameLeader(leader: IProcessStat, record: IOperationGroupRecord): boolean {
+  const { groupId } = record;
+  return leader.startTime === record.startTime && leader.groupId === groupId && leader.sessionId === groupId;
+}
+
+// Every group lives inside one session. A group whose session is its own id was created by setsid() of
+// the recorded leader (or of a reused pid that also called setsid(), which needs the pid space to wrap);
+// a shell job's group lives in its shell's session and is rejected.
+function isLeaderlessOperationGroup(groupId: number, context: IReapContext): boolean {
+  const members: IProcessStat[] = context.ops.listLiveGroupMembers(groupId);
+  return members.length > NO_MEMBERS && members.every((member: IProcessStat) => member.sessionId === groupId);
+}
+
+function isProvenOperationGroup(record: IOperationGroupRecord, context: IReapContext): boolean {
+  if (!isSignalableGroup(record.groupId, context)) return false;
+  const leader: IProcessStat | undefined = context.ops.readProcessStat(record.groupId);
+  return leader ? isSameLeader(leader, record) : isLeaderlessOperationGroup(record.groupId, context);
+}
+
+async function terminateAndLogAsync(
+  context: IReapContext,
+  groupIds: number[]
+): Promise<DaemonOrphanReapOutcome> {
+  const outcome: DaemonOrphanReapOutcome = await terminateProcessGroupsAsync(context, groupIds);
+  context.ops.log(
+    `Reclaimed dead daemon ${context.deadPid}: its orphaned operation process groups ` +
+      `${groupIds.join(LIST_SEPARATOR)} were ${outcome}.`
+  );
+  return outcome;
+}
+
+/**
+ * Terminates the detached operation process groups that dead daemon `deadPid` recorded while it ran
+ * (see `startOperationGroupRecording`), then deletes the records.
+ *
+ * @remarks
+ * A record is signaled only when it provably still names the daemon's operation: its leader is alive with
+ * the recorded start time and still leads group and session `groupId` (a reused pid has another start
+ * time), or its leader has exited and every live member of the group is in session `groupId`. Unproven
+ * records are dropped without a signal. Records survive a failed reap, so the next reclaim retries.
+ * Call only under the reclaim mutex, after the daemon has been proven dead.
+ */
+export async function reapDeadDaemonOperationGroupsAsync(
+  lockfilePath: string,
+  deadPid: number,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<DaemonOrphanReapOutcome> {
+  const context: IReapContext = createReapContext(deadPid, options);
+  const folder: string = getOperationGroupsFolder(lockfilePath, deadPid);
+  const groupIds: number[] = readOperationGroupRecords(folder)
+    .filter((record: IOperationGroupRecord) => isProvenOperationGroup(record, context))
+    .map((record: IOperationGroupRecord) => record.groupId);
+  const outcome: DaemonOrphanReapOutcome =
+    groupIds.length > NO_MEMBERS ? await terminateAndLogAsync(context, groupIds) : 'none';
+  removeOperationGroupRecords(folder);
+  return outcome;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
new file mode 100644
index 0000000000..9ea4368ddb
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+import * as diagnosticsChannel from 'node:diagnostics_channel';
+
+import {
+  removeOperationGroupRecord,
+  removeOperationGroupRecords,
+  writeOperationGroupRecord
+} from './DaemonOperationGroups';
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { readProcessStat } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+
+// Node publishes every new ChildProcess on this built-in channel (since v16.18; built-in channels are
+// experimental). If it ever stops publishing, nothing is recorded and reclaim falls back to the daemon group.
+const CHILD_PROCESS_CHANNEL: string = 'child_process';
+const SPAWN_EVENT: string = 'spawn';
+const EXIT_EVENT: string = 'exit';
+
+interface IChildProcessMessage {
+  readonly process: ChildProcess;
+}
+
+/** Stops recording and deletes the records; call it when the daemon releases its lockfile. */
+export type StopOperationGroupRecording = () => void;
+
+function bestEffort(action: () => void): void {
+  try {
+    action();
+  } catch {
+    // A lost record only means this group is not reaped if the daemon later dies uncleanly.
+  }
+}
+
+// A `detached` child (SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX) leads its own group and session,
+// so it is outside the daemon's process group and needs a record of its own.
+function isGroupAndSessionLeader(stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined && stat.groupId === stat.pid && stat.sessionId === stat.pid;
+}
+
+function recordWhileRunning(child: ChildProcess, folder: string): void {
+  // 'spawn' is emitted on the next tick after exec, before the child can be reaped, so its pid is still its own.
+  const stat: IProcessStat | undefined = child.pid === undefined ? undefined : readProcessStat(child.pid);
+  if (!isGroupAndSessionLeader(stat)) return;
+  const record: IOperationGroupRecord = { groupId: stat.pid, startTime: stat.startTime };
+  bestEffort(() => writeOperationGroupRecord(folder, record));
+  child.once(EXIT_EVENT, () => bestEffort(() => removeOperationGroupRecord(folder, record)));
+}
+
+/**
+ * Records every child this process spawns into its own process group and session, until that child exits,
+ * so that a successor can reap them if this daemon dies without killing them (SIGKILL, OOM).
+ *
+ * @remarks
+ * Linux only: records need `/proc` start times to rule out pid reuse. Elsewhere this records nothing.
+ */
+export function startOperationGroupRecording(folder: string): StopOperationGroupRecording {
+  if (readProcessStat(process.pid) === undefined) return () => undefined;
+  const onChildProcess = (message: unknown): void => {
+    const child: ChildProcess = (message as IChildProcessMessage).process;
+    child.once(SPAWN_EVENT, () => recordWhileRunning(child, folder));
+  };
+  diagnosticsChannel.subscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
+  return () => {
+    diagnosticsChannel.unsubscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
+    bestEffort(() => removeOperationGroupRecords(folder));
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
new file mode 100644
index 0000000000..57fc2f4fb4
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
@@ -0,0 +1,65 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+const FOLDER_INFIX: string = '.groups-';
+const NAME_SEPARATOR: string = '-';
+const RECORD_NAME_PATTERN: RegExp = /^(\d+)-(\d+)$/;
+const GROUP_ID_MATCH: number = 1;
+const START_TIME_MATCH: number = 2;
+const DIR_MODE: number = 0o700;
+const FILE_MODE: number = 0o600;
+const EMPTY_FILE: string = '';
+
+/** A running operation process group: its leader's pid (which is the group id) and start time. */
+export interface IOperationGroupRecord {
+  readonly groupId: number;
+  readonly startTime: string;
+}
+
+/** The sidecar folder in which daemon `daemonPid` records the process groups of its running operations. */
+export function getOperationGroupsFolder(lockfilePath: string, daemonPid: number): string {
+  return `${lockfilePath}${FOLDER_INFIX}${daemonPid}`;
+}
+
+function getRecordPath(folder: string, record: IOperationGroupRecord): string {
+  return path.join(folder, `${record.groupId}${NAME_SEPARATOR}${record.startTime}`);
+}
+
+/** Records a running group as an empty file whose name is the record, so no record is ever half-written. */
+export function writeOperationGroupRecord(folder: string, record: IOperationGroupRecord): void {
+  fs.mkdirSync(folder, { recursive: true, mode: DIR_MODE });
+  fs.writeFileSync(getRecordPath(folder, record), EMPTY_FILE, { mode: FILE_MODE });
+}
+
+/** Forgets a group whose leader has exited. */
+export function removeOperationGroupRecord(folder: string, record: IOperationGroupRecord): void {
+  fs.rmSync(getRecordPath(folder, record), { force: true });
+}
+
+function parseRecordName(name: string): IOperationGroupRecord | undefined {
+  const match: RegExpExecArray | null = RECORD_NAME_PATTERN.exec(name);
+  return match ? { groupId: Number(match[GROUP_ID_MATCH]), startTime: match[START_TIME_MATCH] } : undefined;
+}
+
+function isRecord(record: IOperationGroupRecord | undefined): record is IOperationGroupRecord {
+  return record !== undefined;
+}
+
+/** Reads the recorded groups; a missing or unreadable folder holds none. */
+export function readOperationGroupRecords(folder: string): IOperationGroupRecord[] {
+  let names: string[];
+  try {
+    names = fs.readdirSync(folder);
+  } catch {
+    return [];
+  }
+  return names.map(parseRecordName).filter(isRecord);
+}
+
+/** Deletes the sidecar folder and every record in it; idempotent. */
+export function removeOperationGroupRecords(folder: string): void {
+  fs.rmSync(folder, { recursive: true, force: true });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
index bd4c61534b..9de74cb9d3 100644
--- a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
@@ -1,75 +1,25 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
+import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
 import type { IDaemonLockfile } from './DaemonLockfile';
-import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
-import { POSIX_PROCESS_GROUP_OPS } from './DaemonProcessGroup';
+import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import { createReapContext, isSignalableGroup } from './DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
 
-const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
-// 0 and 1 are never daemons, and kill(-0)/kill(-1) would signal our own group or every process.
-const FIRST_USER_PID: number = 2;
-const POLL_INTERVAL_MS: number = 20;
-const DEFAULT_GRACE_MS: number = 2000;
-
-/** Outcome of reaping a dead daemon's process group. */
-export type DaemonOrphanReapOutcome = 'none' | 'terminated' | 'killed';
-
-/** Options for {@link reapDeadDaemonProcessGroupAsync}; every field defaults to the real process. */
-export interface IDaemonOrphanReaperOptions {
-  readonly ops?: IDaemonProcessGroupOps;
-  readonly platform?: NodeJS.Platform;
-  readonly selfPid?: number;
-  /** How long SIGTERM'd (and then SIGKILL'd) processes get to exit. */
-  readonly graceMs?: number;
-}
-
-interface IReapContext {
-  readonly ops: IDaemonProcessGroupOps;
-  readonly deadPid: number;
-  readonly graceMs: number;
-}
-type OrphanCheck = (pid: number) => boolean;
-
-function isNeitherSelfNorOwnGroup(pid: number, selfPid: number, ops: IDaemonProcessGroupOps): boolean {
-  // Fail closed: an unknown own group might be `pid` (e.g. rush-client run by an operation).
-  const ownGroupId: number | undefined = ops.ownGroupId();
-  return pid !== selfPid && ownGroupId !== undefined && pid !== ownGroupId;
-}
-
-function orphanChecks(options: IDaemonOrphanReaperOptions, ops: IDaemonProcessGroupOps): OrphanCheck[] {
-  return [
-    () => (options.platform ?? process.platform) !== WINDOWS_PLATFORM,
-    (pid: number) => Number.isSafeInteger(pid) && pid >= FIRST_USER_PID,
-    (pid: number) => isNeitherSelfNorOwnGroup(pid, options.selfPid ?? process.pid, ops),
-    (pid: number) => !ops.isProcessAlive(pid),
-    (pid: number) => ops.groupExists(pid)
-  ];
-}
-
-async function waitForGroupExitAsync(context: IReapContext): Promise<boolean> {
-  const deadline: number = context.ops.now() + context.graceMs;
-  while (context.ops.now() < deadline) {
-    if (!context.ops.groupExists(context.deadPid)) return true;
-    await context.ops.delayAsync(POLL_INTERVAL_MS);
-  }
-  return !context.ops.groupExists(context.deadPid);
-}
-
-async function terminateGroupAsync(context: IReapContext): Promise<DaemonOrphanReapOutcome> {
-  context.ops.signalGroup(context.deadPid, 'SIGTERM');
-  if (await waitForGroupExitAsync(context)) return 'terminated';
-  context.ops.signalGroup(context.deadPid, 'SIGKILL');
-  if (await waitForGroupExitAsync(context)) return 'killed';
-  throw new Error(`Processes of dead daemon ${context.deadPid} survived SIGKILL; not reclaiming its socket.`);
+function isOrphanedDaemonGroup(context: IReapContext): boolean {
+  return isSignalableGroup(context.deadPid, context) && context.ops.groupExists(context.deadPid);
 }
 
 /**
- * Terminates operation processes left behind by a daemon that died without joining them (SIGKILL, OOM).
+ * Terminates processes left behind in a dead daemon's own process group (SIGKILL, OOM).
  *
  * @remarks
- * The daemon is spawned detached, so its pid is its process group id, and phased operation children inherit
- * that group (children spawned with their own detached group are out of scope). Sends SIGTERM, then SIGKILL
- * after `graceMs`, and throws if the group still has not exited after a further `graceMs`.
+ * The daemon is spawned detached, so its pid is its process group id, and children it spawns without
+ * `detached` inherit that group. Detached operation children lead groups of their own; see
+ * {@link reapDeadDaemonOperationGroupsAsync}. Sends SIGTERM, then SIGKILL after `graceMs`, and throws if the
+ * group still has not exited after a further `graceMs`.
  * PID-reuse guard: only group `deadPid` is signaled, and only once `deadPid` is proven dead while the group
  * still exists; POSIX never reuses a pid still in use as a process group id, so every remaining member
  * belongs to the dead daemon. Never signals the caller's pid or group, and does nothing when the caller's
@@ -80,21 +30,19 @@ export async function reapDeadDaemonProcessGroupAsync(
   options: IDaemonOrphanReaperOptions = {}
 ): Promise<DaemonOrphanReapOutcome> {
   const context: IReapContext = createReapContext(deadPid, options);
-  if (!orphanChecks(options, context.ops).every((check: OrphanCheck) => check(deadPid))) return 'none';
-  const outcome: DaemonOrphanReapOutcome = await terminateGroupAsync(context);
+  if (!isOrphanedDaemonGroup(context)) return 'none';
+  const outcome: DaemonOrphanReapOutcome = await terminateProcessGroupsAsync(context, [deadPid]);
   context.ops.log(`Reclaimed dead daemon ${deadPid}: its orphaned operation process group was ${outcome}.`);
   return outcome;
 }
 
-function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
-  return {
-    ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
-    deadPid,
-    graceMs: options.graceMs ?? DEFAULT_GRACE_MS
-  };
-}
-
-/** Reaps the orphaned operations of a reclaimed daemon's recorded owner, if there is one. */
-export async function reapOrphansOfDeadOwnerAsync(owner: IDaemonLockfile | undefined): Promise<void> {
-  if (owner) await reapDeadDaemonProcessGroupAsync(owner.pid);
+/** Reaps the orphaned processes of a reclaimed daemon's recorded owner, if there is one. */
+export async function reapOrphansOfDeadOwnerAsync(
+  lockfilePath: string,
+  owner: IDaemonLockfile | undefined,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<void> {
+  if (!owner) return;
+  await reapDeadDaemonProcessGroupAsync(owner.pid, options);
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, owner.pid, options);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
index a8eb871383..09ba56928d 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
@@ -5,6 +5,8 @@ import * as fs from 'node:fs';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { isDaemonProcessAlive } from './DaemonLockfile';
+import { listLiveGroupMembers, readProcessStat } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
 
 const NO_SIGNAL: number = 0;
 const NO_SUCH_PROCESS: string = 'ESRCH';
@@ -15,13 +17,17 @@ const FIELD_SEPARATOR: string = ' ';
 // After the ")" that ends the command name come: " <state> <ppid> <pgrp> ...".
 const PGRP_FIELD_INDEX: number = 3;
 
-/** Process probing/signaling used to reap a dead daemon's process group; injectable for tests. */
+/** Process probing/signaling used to reap a dead daemon's orphaned process groups; injectable for tests. */
 export interface IDaemonProcessGroupOps {
   readonly isProcessAlive: (pid: number) => boolean;
   readonly groupExists: (groupId: number) => boolean;
   readonly signalGroup: (groupId: number, signal: NodeJS.Signals) => void;
   /** The caller's own process group id, or `undefined` when the platform cannot report it. */
   readonly ownGroupId: () => number | undefined;
+  /** Reads a process's `/proc` identity, or `undefined` when it is gone (or there is no `/proc`). */
+  readonly readProcessStat: (pid: number) => IProcessStat | undefined;
+  /** The processes in a group that have not exited. */
+  readonly listLiveGroupMembers: (groupId: number) => IProcessStat[];
   readonly delayAsync: (ms: number) => Promise<void>;
   readonly now: () => number;
   readonly log: (message: string) => void;
@@ -70,6 +76,8 @@ export const POSIX_PROCESS_GROUP_OPS: IDaemonProcessGroupOps = {
   groupExists,
   signalGroup,
   ownGroupId,
+  readProcessStat,
+  listLiveGroupMembers,
   delayAsync: async (ms: number) => {
     await delayAsync(ms);
   },
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
new file mode 100644
index 0000000000..6a1401d8ab
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const PROC_ROOT: string = '/proc';
+const STAT_FILE_NAME: string = 'stat';
+const UTF8: BufferEncoding = 'utf8';
+const COMM_END: string = ')';
+const FIELD_SEPARATOR: string = ' ';
+const PID_PATTERN: RegExp = /^\d+$/;
+// Indices into the fields after the ")" that ends the command name (proc_pid_stat(5)):
+// ") <state> <ppid> <pgrp> <session> ...", where starttime is field 22 of the whole record.
+const STATE_INDEX: number = 1;
+const GROUP_INDEX: number = 3;
+const SESSION_INDEX: number = 4;
+const START_TIME_INDEX: number = 20;
+const EXITED_STATES: ReadonlySet<string> = new Set(['Z', 'X']);
+
+/** The identity fields of one Linux `/proc/<pid>/stat` record. */
+export interface IProcessStat {
+  readonly pid: number;
+  readonly groupId: number;
+  readonly sessionId: number;
+  /** Clock ticks after boot when the process started; a reused pid gets a different value. */
+  readonly startTime: string;
+  /** `true` for a zombie: it has exited but its parent has not reaped it yet. */
+  readonly exited: boolean;
+}
+
+function parseProcessStat(pid: number, stat: string): IProcessStat {
+  // The command name may contain spaces and ")", so parse after its last ")".
+  const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
+  return {
+    pid,
+    groupId: Number(fields[GROUP_INDEX]),
+    sessionId: Number(fields[SESSION_INDEX]),
+    startTime: fields[START_TIME_INDEX],
+    exited: EXITED_STATES.has(fields[STATE_INDEX])
+  };
+}
+
+/** Reads `/proc/<pid>/stat`; `undefined` when the process is gone or the platform has no `/proc`. */
+export function readProcessStat(pid: number): IProcessStat | undefined {
+  try {
+    return parseProcessStat(pid, fs.readFileSync(`${PROC_ROOT}/${pid}/${STAT_FILE_NAME}`, UTF8));
+  } catch {
+    return undefined;
+  }
+}
+
+function isLiveMemberOf(groupId: number, stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined && stat.groupId === groupId && !stat.exited;
+}
+
+function listProcessIds(): number[] {
+  try {
+    return fs
+      .readdirSync(PROC_ROOT)
+      .filter((name: string) => PID_PATTERN.test(name))
+      .map(Number);
+  } catch {
+    return [];
+  }
+}
+
+/** Lists the processes of group `groupId` that have not exited, by scanning `/proc`. */
+export function listLiveGroupMembers(groupId: number): IProcessStat[] {
+  return listProcessIds()
+    .map(readProcessStat)
+    .filter((stat: IProcessStat | undefined): stat is IProcessStat => isLiveMemberOf(groupId, stat));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
new file mode 100644
index 0000000000..550183106c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
@@ -0,0 +1,63 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
+import { POSIX_PROCESS_GROUP_OPS } from './DaemonProcessGroup';
+
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+// 0 and 1 are never daemons, and kill(-0)/kill(-1) would signal our own group or every process.
+const FIRST_USER_PID: number = 2;
+const DEFAULT_GRACE_MS: number = 2000;
+
+/** Options for reaping a dead daemon's orphans; every field defaults to the real process. */
+export interface IDaemonOrphanReaperOptions {
+  readonly ops?: IDaemonProcessGroupOps;
+  readonly platform?: NodeJS.Platform;
+  readonly selfPid?: number;
+  /** How long SIGTERM'd (and then SIGKILL'd) processes get to exit. */
+  readonly graceMs?: number;
+}
+
+/** {@link IDaemonOrphanReaperOptions} with every default applied, for the dead daemon `deadPid`. */
+export interface IReapContext {
+  readonly ops: IDaemonProcessGroupOps;
+  readonly platform: NodeJS.Platform;
+  readonly selfPid: number;
+  readonly deadPid: number;
+  readonly graceMs: number;
+}
+
+function resolveCaller(options: IDaemonOrphanReaperOptions): Pick<IReapContext, 'platform' | 'selfPid'> {
+  return { platform: options.platform ?? process.platform, selfPid: options.selfPid ?? process.pid };
+}
+
+/** Applies the defaults of {@link IDaemonOrphanReaperOptions}. */
+export function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
+  return {
+    ...resolveCaller(options),
+    ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
+    deadPid,
+    graceMs: options.graceMs ?? DEFAULT_GRACE_MS
+  };
+}
+
+function isNeitherSelfNorOwnGroup(groupId: number, context: IReapContext): boolean {
+  // Fail closed: an unknown own group might be `groupId` (e.g. rush-client run by an operation).
+  const ownGroupId: number | undefined = context.ops.ownGroupId();
+  return groupId !== context.selfPid && ownGroupId !== undefined && groupId !== ownGroupId;
+}
+
+type GroupCheck = (groupId: number, context: IReapContext) => boolean;
+
+const SIGNALABLE_GROUP_CHECKS: readonly GroupCheck[] = [
+  (groupId: number, context: IReapContext) => context.platform !== WINDOWS_PLATFORM,
+  (groupId: number) => Number.isSafeInteger(groupId) && groupId >= FIRST_USER_PID,
+  isNeitherSelfNorOwnGroup,
+  // A live daemon still owns its operations.
+  (groupId: number, context: IReapContext) => !context.ops.isProcessAlive(context.deadPid)
+];
+
+/** `true` when group `groupId` may be signaled at all: POSIX, a user pid, not ours, and its daemon is dead. */
+export function isSignalableGroup(groupId: number, context: IReapContext): boolean {
+  return SIGNALABLE_GROUP_CHECKS.every((check: GroupCheck) => check(groupId, context));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index 92f0ed9323..5ce5a8d0e4 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -5,11 +5,7 @@ import * as fs from 'node:fs';
 
 import { connectDaemonAsync } from './DaemonConnector';
 import type { DaemonFrameConnection } from './DaemonFrameConnection';
-import {
-  isDaemonProcessAlive,
-  readDaemonLockfile,
-  removeDaemonArtifacts
-} from './DaemonLockfile';
+import { isDaemonProcessAlive, readDaemonLockfile, removeDaemonArtifacts } from './DaemonLockfile';
 import { reapOrphansOfDeadOwnerAsync } from './DaemonOrphanReaper';
 import type { IDaemonPaths } from './DaemonPaths';
 import { tryAcquireReclaimLock } from './DaemonReclaimLock';
@@ -26,7 +22,8 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may
  * unlink the socket path, so a concurrent starter cannot delete a socket that
  * another process just bound. Operation processes still running in the dead
- * daemon's process group are terminated first (see `DaemonOrphanReaper`).
+ * daemon's process group, or in the operation process groups it recorded, are
+ * terminated first (see `DaemonOrphanReaper`).
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
@@ -68,7 +65,7 @@ async function reclaimUnderLockAsync(paths: IDaemonPaths): Promise<void> {
     throwAlreadyRunning(paths, 'it answers a connect probe');
   }
   // A daemon that died uncleanly leaves its operations running; stop them before a successor re-runs them.
-  await reapOrphansOfDeadOwnerAsync(owner);
+  await reapOrphansOfDeadOwnerAsync(paths.lockfilePath, owner);
   removeDaemonArtifacts(paths.lockfilePath, paths.socketPath);
 }
 
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
new file mode 100644
index 0000000000..a77feb6589
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import {
+  OPERATION_CHILD,
+  OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const REUSED_START: string = '999';
+const SHELL_SESSION: number = 3000;
+
+async function reapAsync(processes: readonly IProcessStat[]): Promise<IFakeGroup & { outcome: string }> {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', processes });
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+  return { ...fake, outcome };
+}
+
+it('signals a recorded group whose leader is alive with the recorded start time', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync(operationTree(OPERATION_GROUP));
+  expect(result.outcome).toBe('terminated');
+  expect(result.targets).toEqual([OPERATION_GROUP]);
+  expect(result.logs).toEqual([expect.stringContaining(`groups ${OPERATION_GROUP} were terminated`)]);
+});
+
+it('signals a group whose leader has exited when every live member is in its session', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync(operationTree(OPERATION_GROUP, false));
+  expect(result.outcome).toBe('terminated');
+  expect(result.targets).toEqual([OPERATION_GROUP]);
+});
+
+it('never signals a reused pid: the leader has another start time', async () => {
+  const reused: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), startTime: REUSED_START };
+  const result: IFakeGroup & { outcome: string } = await reapAsync([reused]);
+  expect(result.outcome).toBe('none');
+  expect(result.signals).toEqual([]);
+});
+
+it('never signals a leader that no longer leads its own session', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync([
+    stat(OPERATION_GROUP, OPERATION_GROUP, SHELL_SESSION)
+  ]);
+  expect(result.signals).toEqual([]);
+});
+
+it('never signals a leaderless group of another session, such as a shell job with a reused pid', async () => {
+  const result: IFakeGroup & { outcome: string } = await reapAsync([
+    stat(OPERATION_CHILD, OPERATION_GROUP, SHELL_SESSION)
+  ]);
+  expect(result.signals).toEqual([]);
+});
+
+it('never signals a group whose only members have exited', async () => {
+  const zombie: IProcessStat = { ...stat(OPERATION_CHILD, OPERATION_GROUP), exited: true };
+  const result: IFakeGroup & { outcome: string } = await reapAsync([zombie]);
+  expect(result.outcome).toBe('none');
+  expect(result.signals).toEqual([]);
+});
+
+it('does nothing when the dead daemon recorded no groups', async () => {
+  const fake: IFakeGroup = createFakeGroup({ processes: operationTree(OPERATION_GROUP) });
+  const lockfilePath: string = recordGroups([]);
+  await expect(
+    reapDeadDaemonOperationGroupsAsync(`${lockfilePath}.missing`, DEAD_PID, fake.options)
+  ).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts
new file mode 100644
index 0000000000..5b760e4ca7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupRecorder.test.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import type { StopOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+// SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX.
+const DETACHED: SpawnOptions = { detached: true, stdio: 'ignore' };
+const ATTACHED: SpawnOptions = { stdio: 'ignore' };
+const NO_RECORDS: number = 0;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function spawnAsync(options: SpawnOptions): Promise<ChildProcess> {
+  const child: ChildProcess = spawn(process.execPath, SLEEP_ARGS, options);
+  await once(child, 'spawn');
+  started = [...started, ...identifyStarted([Number(child.pid)])];
+  return child;
+}
+
+function recordOf(child: ChildProcess): IOperationGroupRecord {
+  const pid: number = Number(child.pid);
+  return { groupId: pid, startTime: String(readProcessStat(pid)?.startTime) };
+}
+
+linuxIt('records a detached child while it runs, and no child that shares the daemon group', async () => {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  const detached: ChildProcess = await spawnAsync(DETACHED);
+  await spawnAsync(ATTACHED);
+  expect(readOperationGroupRecords(folder)).toEqual([recordOf(detached)]);
+  detached.kill('SIGKILL');
+  expect(await waitUntilAsync(() => readOperationGroupRecords(folder).length === NO_RECORDS)).toBe(true);
+  stop();
+  expect(fs.existsSync(folder)).toBe(false);
+});
+
+linuxIt('records nothing after it stops', async () => {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  startOperationGroupRecording(folder)();
+  await spawnAsync(DETACHED);
+  expect(readOperationGroupRecords(folder)).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
index a775495413..1defa97d7c 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
@@ -2,7 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { reapDeadDaemonProcessGroupAsync } from '../DaemonOrphanReaper';
-import type { IDaemonOrphanReaperOptions } from '../DaemonOrphanReaper';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
 
 import { DEAD_PID, SELF_PID, createFakeGroup } from './OrphanReaperFixture';
 import type { IFakeGroup } from './OrphanReaperFixture';
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
new file mode 100644
index 0000000000..fdb0bd95b5
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
@@ -0,0 +1,50 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import { listLiveGroupMembers, readProcessStat } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Linux caps pid_max at 2^22, so this pid never exists.
+const IMPOSSIBLE_PID: number = 4194305;
+const SLEEP_SECONDS: string = '30';
+const DIGITS: RegExp = /^\d+$/;
+
+linuxIt('reads the group, session and start time of a live process', () => {
+  const self: IProcessStat | undefined = readProcessStat(process.pid);
+  expect(self).toMatchObject({
+    pid: process.pid,
+    groupId: POSIX_PROCESS_GROUP_OPS.ownGroupId(),
+    exited: false
+  });
+  expect(self?.startTime).toMatch(DIGITS);
+  expect(readProcessStat(IMPOSSIBLE_PID)).toBeUndefined();
+});
+
+linuxIt('lists the live members of a process group', () => {
+  const members: IProcessStat[] = listLiveGroupMembers(Number(POSIX_PROCESS_GROUP_OPS.ownGroupId()));
+  expect(members.map((member: IProcessStat) => member.pid)).toContain(process.pid);
+});
+
+linuxIt('parses a command name that contains spaces and parentheses', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-stat-'));
+  const executable: string = path.join(folder, 'a) b (c');
+  fs.symlinkSync('/bin/sleep', executable);
+  const child: ChildProcess = spawn(executable, [SLEEP_SECONDS], { detached: true, stdio: 'ignore' });
+  await once(child, 'spawn');
+  const pid: number = Number(child.pid);
+  const stat: IProcessStat | undefined = readProcessStat(pid);
+  child.kill('SIGKILL');
+  await once(child, 'exit');
+  fs.rmSync(folder, { recursive: true, force: true });
+  expect(stat).toMatchObject({ pid, groupId: pid, sessionId: pid, exited: false });
+  expect(stat?.startTime).toMatch(DIGITS);
+});
diff --git a/libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts b/libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts
new file mode 100644
index 0000000000..c545fb3a84
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FakeOperationDaemonFixture.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { writeDaemonLockfile } from '../DaemonLockfile';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+const FAKE_DAEMON_OPTIONS: SpawnOptions = { detached: true, stdio: ['ignore', 'pipe', 'ignore'] };
+const SPACE: string = ' ';
+// The fake daemon runs the real recorder, then spawns two operations the way Rush does
+// (`detached: true` = SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX), each with a grandchild. The
+// first operation's shell waits for its grandchild; the second exits when the daemon's stdin pipe closes,
+// which leaves a leaderless group behind.
+const FAKE_DAEMON_SCRIPT: string = `
+const [recorder, groups, lockfile] = process.argv.slice(1);
+require(recorder).startOperationGroupRecording(require(groups).getOperationGroupsFolder(lockfile, process.pid));
+const spawnOperation = (tail) => require('node:child_process').spawn('/bin/sh',
+  ['-c', 'sleep 30 </dev/null >/dev/null 2>&1 & echo $!; ' + tail], { detached: true, stdio: ['pipe', 'pipe', 'ignore'] });
+const pidsOf = (op) => new Promise((resolve) => op.stdout.once('data', (d) => resolve(op.pid + ' ' + String(d).trim())));
+Promise.all([spawnOperation('wait'), spawnOperation('read line')].map(pidsOf))
+  .then((pids) => process.stdout.write(pids.join(' ') + '\\n'));
+setInterval(() => {}, 1000);`;
+
+/** A fake daemon that recorded two detached operations, each with a grandchild. */
+export interface IFakeDaemon {
+  readonly daemon: ChildProcess;
+  /** Leader and grandchild of the waiting operation, then of the exiting one. */
+  readonly pids: number[];
+}
+
+/** Starts the fake daemon and waits until both operations and their grandchildren run. */
+export async function startFakeDaemonAsync(paths: IDaemonPaths): Promise<IFakeDaemon> {
+  const modules: string[] = ['DaemonOperationGroupRecorder', 'DaemonOperationGroups'].map((name: string) =>
+    path.join(__dirname, '..', `${name}.js`)
+  );
+  const args: string[] = ['-e', FAKE_DAEMON_SCRIPT, ...modules, paths.lockfilePath];
+  const daemon: ChildProcess = spawn(process.execPath, args, FAKE_DAEMON_OPTIONS);
+  const [chunk] = (await once(daemon.stdout as Readable, 'data')) as [Buffer];
+  return { daemon, pids: chunk.toString().trim().split(SPACE).map(Number) };
+}
+
+/** SIGKILLs the fake daemon, as the OOM killer would, leaving its operations behind. */
+export async function killFakeDaemonAsync(fake: IFakeDaemon): Promise<void> {
+  fake.daemon.kill('SIGKILL');
+  await once(fake.daemon, 'exit');
+  (fake.daemon.stdout as Readable).destroy();
+}
+
+/** Writes the lockfile the dead fake daemon would have left. */
+export function writeDeadOwnerLockfile(paths: IDaemonPaths, fake: IFakeDaemon): void {
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: Number(fake.daemon.pid),
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts
new file mode 100644
index 0000000000..6b045d7e93
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupFixture.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { DEAD_PID } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+/** The leader pid (and group and session id) of the first fake detached operation. */
+export const OPERATION_GROUP: number = 5000;
+/** A second fake detached operation. */
+export const OTHER_OPERATION_GROUP: number = 6000;
+/** The start time recorded for every fake operation leader. */
+export const RECORDED_START: string = '777';
+const CHILD_OFFSET: number = 1;
+/** The pid of the child in {@link OPERATION_GROUP}'s tree. */
+export const OPERATION_CHILD: number = OPERATION_GROUP + CHILD_OFFSET;
+
+/** A fake `/proc` stat record for a live process. */
+export function stat(pid: number, groupId: number, sessionId: number = groupId): IProcessStat {
+  return { pid, groupId, sessionId, startTime: RECORDED_START, exited: false };
+}
+
+/** A fake operation tree: the leader (unless it exited) and one child, both in group and session `groupId`. */
+export function operationTree(groupId: number, leaderAlive: boolean = true): IProcessStat[] {
+  const child: IProcessStat = stat(groupId + CHILD_OFFSET, groupId);
+  return leaderAlive ? [stat(groupId, groupId), child] : [child];
+}
+
+/** A lockfile path whose dead daemon ({@link DEAD_PID}) recorded `groupIds`. */
+export function recordGroups(groupIds: readonly number[]): string {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  fs.mkdirSync(folder, { recursive: true });
+  for (const groupId of groupIds) {
+    const record: IOperationGroupRecord = { groupId, startTime: RECORDED_START };
+    writeOperationGroupRecord(folder, record);
+  }
+  return lockfilePath;
+}
+
+/** `true` when the dead daemon's records for `lockfilePath` still exist. */
+export function recordsRemain(lockfilePath: string): boolean {
+  return fs.existsSync(getOperationGroupsFolder(lockfilePath, DEAD_PID));
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
new file mode 100644
index 0000000000..8051359a9e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+
+import {
+  killFakeDaemonAsync,
+  startFakeDaemonAsync,
+  writeDeadOwnerLockfile
+} from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Above the worst case of two 5 s polls plus the reaper's SIGTERM and SIGKILL grace periods, so that a
+// regression fails an assertion instead of timing out.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+
+function recordedGroupIds(folder: string): Set<number> {
+  return new Set(readOperationGroupRecords(folder).map((record: IOperationGroupRecord) => record.groupId));
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  // A failed assertion must not leave this test's processes running.
+  killStillRunning(started);
+  started = [];
+  jest.restoreAllMocks();
+});
+
+async function reapsOrphanedOperationGroupsAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  const folder: string = getOperationGroupsFolder(paths.lockfilePath, Number(fake.daemon.pid));
+  expect(recordedGroupIds(folder)).toEqual(new Set([waitingLeader, exitingLeader]));
+  await killFakeDaemonAsync(fake);
+  // Reaped, not merely a zombie, so reclaim finds a group without its leader.
+  expect(await waitUntilAsync(() => isGone(exitingLeader))).toBe(true);
+  writeDeadOwnerLockfile(paths, fake);
+  await reclaimStaleDaemonAsync(paths);
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+  expect(readOperationGroupRecords(folder)).toEqual([]);
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${waitingLeader}`), expect.anything());
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${exitingLeader}`), expect.anything());
+}
+
+posixIt(
+  'reaps detached operation groups orphaned by a SIGKILLed daemon, with or without their leader',
+  reapsOrphanedOperationGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
new file mode 100644
index 0000000000..dfb3c7dc42
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
@@ -0,0 +1,83 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import {
+  OPERATION_GROUP,
+  OTHER_OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { DEAD_PID, SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+
+const BOTH_GROUPS: readonly number[] = [OPERATION_GROUP, OTHER_OPERATION_GROUP];
+const SWAPPER_PID: number = 0;
+const INIT_PID: number = 1;
+const UNSAFE_GROUPS: readonly number[] = [SWAPPER_PID, INIT_PID, SELF_PID];
+
+function createOperations(spec: IFakeGroupSpec): IFakeGroup {
+  return createFakeGroup({
+    ...spec,
+    processes: [...operationTree(OPERATION_GROUP), ...operationTree(OTHER_OPERATION_GROUP)]
+  });
+}
+
+it('signals every proven group together and escalates the survivors to SIGKILL', async () => {
+  const fake: IFakeGroup = createOperations({ exitsOn: 'SIGKILL' });
+  const lockfilePath: string = recordGroups(BOTH_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'killed'
+  );
+  expect(fake.signals).toEqual(['SIGTERM', 'SIGTERM', 'SIGKILL', 'SIGKILL']);
+  expect(fake.targets).toEqual([...BOTH_GROUPS, ...BOTH_GROUPS]);
+  expect(fake.logs).toEqual([
+    expect.stringContaining(`${OPERATION_GROUP}, ${OTHER_OPERATION_GROUP} were killed`)
+  ]);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+});
+
+it('fails the reclaim and keeps the records when a group survives SIGKILL', async () => {
+  const fake: IFakeGroup = createOperations({});
+  const lockfilePath: string = recordGroups(BOTH_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).rejects.toThrow(
+    /survived SIGKILL/
+  );
+  expect(recordsRemain(lockfilePath)).toBe(true);
+});
+
+it.each<[string, IFakeGroupSpec, IDaemonOrphanReaperOptions]>([
+  ['the daemon is alive', { daemonAlive: true }, {}],
+  ['the caller leads the group', { ownGroupId: OPERATION_GROUP }, {}],
+  ['the caller group is unknown', { unknownOwnGroup: true }, {}],
+  ['the caller is the leader', {}, { selfPid: OPERATION_GROUP }],
+  ['on Windows', {}, { platform: 'win32' }]
+])(
+  'never signals a recorded group when %s',
+  async (name: string, spec: IFakeGroupSpec, overrides: IDaemonOrphanReaperOptions) => {
+    const fake: IFakeGroup = createOperations({ ...spec, exitsOn: 'SIGTERM' });
+    const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+    const options: IDaemonOrphanReaperOptions = { ...fake.options, ...overrides };
+    await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+    expect(fake.signals).toEqual([]);
+  }
+);
+
+it('never signals the kernel, init or the caller, even as proven leaders', async () => {
+  const leaders: IProcessStat[] = UNSAFE_GROUPS.map((groupId: number) => stat(groupId, groupId));
+  const fake: IFakeGroup = createFakeGroup({
+    ownGroupId: OPERATION_GROUP,
+    exitsOn: 'SIGTERM',
+    processes: leaders
+  });
+  const lockfilePath: string = recordGroups(UNSAFE_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'none'
+  );
+  expect(fake.signals).toEqual([]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
index c0e1f8bede..59fdcb4014 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
@@ -1,8 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonOrphanReaperOptions } from '../DaemonOrphanReaper';
 import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
 
 /** The pid of the fake dead daemon, which is also its process group id. */
 export const DEAD_PID: number = 4242;
@@ -14,6 +15,8 @@ const CLOCK_START: number = 0;
 /** A fake process table recording every signal sent and every message logged. */
 export interface IFakeGroup {
   readonly signals: NodeJS.Signals[];
+  /** The group id of every signal in {@link IFakeGroup.signals}, in the same order. */
+  readonly targets: number[];
   readonly logs: string[];
   readonly options: IDaemonOrphanReaperOptions;
 }
@@ -21,30 +24,74 @@ export interface IFakeGroup {
 /** Describes the fake process table. */
 export interface IFakeGroupSpec {
   readonly daemonAlive?: boolean;
-  /** The signal after which the group is gone; omitted means it never exits. */
+  /** The signal after which every group is gone; omitted means they never exit. */
   readonly exitsOn?: NodeJS.Signals;
   readonly ownGroupId?: number;
   readonly unknownOwnGroup?: boolean;
   readonly anyGroupExists?: boolean;
+  /** Processes outside the dead daemon's own group, such as detached operation trees. */
+  readonly processes?: readonly IProcessStat[];
 }
 
-/** Creates a fake process table with a virtual clock. */
-export function createFakeGroup(spec: IFakeGroupSpec): IFakeGroup {
-  const signals: NodeJS.Signals[] = [];
-  const logs: string[] = [];
+interface IFakeTable extends Omit<IFakeGroup, 'options'> {
+  readonly spec: IFakeGroupSpec;
+}
+
+function hasExited(table: IFakeTable): boolean {
+  return table.signals.some((signal: NodeJS.Signals) => signal === table.spec.exitsOn);
+}
+
+function liveProcesses(table: IFakeTable): readonly IProcessStat[] {
+  return hasExited(table) ? [] : (table.spec.processes ?? []);
+}
+
+function isKnownGroup(table: IFakeTable, groupId: number): boolean {
+  return table.spec.anyGroupExists === true || groupId === DEAD_PID;
+}
+
+function groupExists(table: IFakeTable, groupId: number): boolean {
+  const inTable: boolean = liveProcesses(table).some((stat: IProcessStat) => stat.groupId === groupId);
+  return !hasExited(table) && (isKnownGroup(table, groupId) || inTable);
+}
+
+function createProcessOps(
+  table: IFakeTable
+): Pick<IDaemonProcessGroupOps, 'readProcessStat' | 'listLiveGroupMembers'> {
+  return {
+    readProcessStat: (pid: number) => liveProcesses(table).find((stat: IProcessStat) => stat.pid === pid),
+    listLiveGroupMembers: (groupId: number) =>
+      liveProcesses(table).filter((stat: IProcessStat) => stat.groupId === groupId && !stat.exited)
+  };
+}
+
+function createGroupOps(table: IFakeTable): IDaemonProcessGroupOps {
+  const { spec } = table;
   let clock: number = CLOCK_START;
-  const ops: IDaemonProcessGroupOps = {
+  return {
     isProcessAlive: () => spec.daemonAlive === true,
-    groupExists: (groupId: number) =>
-      (spec.anyGroupExists === true || groupId === DEAD_PID) &&
-      !signals.some((signal: NodeJS.Signals) => signal === spec.exitsOn),
-    signalGroup: (groupId: number, signal: NodeJS.Signals) => signals.push(signal),
+    groupExists: (groupId: number) => groupExists(table, groupId),
+    signalGroup: (groupId: number, signal: NodeJS.Signals) => {
+      table.targets.push(groupId);
+      table.signals.push(signal);
+    },
     ownGroupId: () => (spec.unknownOwnGroup === true ? undefined : (spec.ownGroupId ?? SELF_PID)),
+    ...createProcessOps(table),
     delayAsync: async (ms: number) => {
       clock += ms;
     },
     now: () => clock,
-    log: (message: string) => logs.push(message)
+    log: (message: string) => table.logs.push(message)
+  };
+}
+
+/** Creates a fake process table with a virtual clock. */
+export function createFakeGroup(spec: IFakeGroupSpec): IFakeGroup {
+  const table: IFakeTable = { spec, signals: [], targets: [], logs: [] };
+  const options: IDaemonOrphanReaperOptions = {
+    ops: createGroupOps(table),
+    platform: 'linux',
+    selfPid: SELF_PID,
+    graceMs: GRACE_MS
   };
-  return { signals, logs, options: { ops, platform: 'linux', selfPid: SELF_PID, graceMs: GRACE_MS } };
+  return { signals: table.signals, targets: table.targets, logs: table.logs, options };
 }
diff --git a/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts b/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
new file mode 100644
index 0000000000..546c6007c6
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const FIRST_ATTEMPT: number = 0;
+const POLL_ATTEMPTS: number = 250;
+const POLL_INTERVAL_MS: number = 20;
+
+/** `true` while `pid` runs; a zombie that has exited does not count. */
+export function isAlive(pid: number): boolean {
+  const stat: IProcessStat | undefined = readProcessStat(pid);
+  return stat !== undefined && !stat.exited;
+}
+
+/** `true` once `pid` has exited and been reaped, so `/proc` has no record of it. */
+export function isGone(pid: number): boolean {
+  return readProcessStat(pid) === undefined;
+}
+
+/** Polls `condition` for up to 5 s. */
+export async function waitUntilAsync(condition: () => boolean): Promise<boolean> {
+  for (let attempt: number = FIRST_ATTEMPT; attempt < POLL_ATTEMPTS; attempt++) {
+    if (condition()) return true;
+    await delayAsync(POLL_INTERVAL_MS);
+  }
+  return condition();
+}
+
+/** A process a test started, identified by pid and start time so that a reused pid is never signaled. */
+export interface IStartedProcess {
+  readonly pid: number;
+  readonly startTime: string | undefined;
+}
+
+/** Identifies processes a test has just started. */
+export function identifyStarted(pids: readonly number[]): IStartedProcess[] {
+  return pids.map((pid: number) => ({ pid, startTime: readProcessStat(pid)?.startTime }));
+}
+
+function isStillRunning({ pid, startTime }: IStartedProcess): boolean {
+  return startTime !== undefined && readProcessStat(pid)?.startTime === startTime;
+}
+
+/** SIGKILLs the started processes that are still the same processes; for test cleanup only. */
+export function killStillRunning(started: readonly IStartedProcess[]): void {
+  for (const { pid } of started.filter(isStillRunning)) {
+    process.kill(pid, 'SIGKILL');
+  }
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index dda743a498..b132616378 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -8,7 +8,7 @@ import type {
   Operation,
   _IOperationGraphEventSink
 } from '@microsoft/rush-lib';
-import { OperationStatus } from '@microsoft/rush-lib';
+import { getWorkspaceRequestOperationEnvironment, OperationStatus } from '@microsoft/rush-lib';
 import { Sort } from '@rushstack/node-core-library';
 import type {
   IDaemonPhasedEngineShape,
@@ -458,7 +458,8 @@ class PhasedRequestBatchCoordinator {
       try {
         for (const entry of participants) entry.onExecutionStarting?.();
         scheduled = await this.#graph.scheduleIterationAsync({
-          inputsSnapshot: this.#workspaceSession.inputsSnapshot
+          inputsSnapshot: this.#workspaceSession.inputsSnapshot,
+          getOperationEnvironment: createOperationEnvironmentLookup(participants)
         });
         if (scheduled) {
           await Promise.all(
@@ -875,6 +876,31 @@ function validateRequestIdentity(request: IDaemonPhasedRequest): void {
   }
 }
 
+/**
+ * Gives each operation of an iteration the environment of the first participant that selected it, as a native
+ * command would run it in its invoker's environment. An operation that several participants share runs once, in
+ * the first participant's environment.
+ */
+function createOperationEnvironmentLookup(
+  participants: ReadonlyArray<IBatchEntry>
+): (operation: Operation) => Readonly<Record<string, string | undefined>> {
+  const environmentByOperation: Map<Operation, Readonly<Record<string, string>>> = new Map();
+  let firstEnvironment: Readonly<Record<string, string>> | undefined;
+  for (const entry of participants) {
+    const environment: Readonly<Record<string, string>> = getWorkspaceRequestOperationEnvironment(
+      process.env,
+      entry.request.environment
+    );
+    firstEnvironment ??= environment;
+    for (const operation of entry.selection.activeOperations) {
+      if (!environmentByOperation.has(operation)) {
+        environmentByOperation.set(operation, environment);
+      }
+    }
+  }
+  return (operation: Operation) => environmentByOperation.get(operation) ?? firstEnvironment ?? process.env;
+}
+
 function validateNonemptyName(value: string, kind: string): void {
   if (value.length === 0 || value.trim() !== value) {
     throw new Error(`Invalid phased request ${kind}: "${value}".`);
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 4cdf68c46e..73249df527 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -5,6 +5,7 @@ import * as path from 'node:path';
 
 import type { LockFile } from '@rushstack/node-core-library';
 import {
+  EnvironmentVariableNames,
   getWorkspaceFingerprintEnvironmentEntries,
   PhasedCommandEngine,
   PhasedCommandEngineBusyError,
@@ -129,7 +130,11 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         commandName: envelope.commandName,
         commandOrigin: envelope.commandOrigin,
         engineShape: shape,
-        environment: envelope.environment,
+        // Native Rush assigns the invocation's folder at CLI startup (Rush._assignRushInvokedFolder).
+        environment: {
+          ...envelope.environment,
+          [EnvironmentVariableNames.RUSH_INVOKED_FOLDER]: envelope.cwd
+        },
         operationSelection,
         requestId: envelope.requestId,
         terminalRequirement: envelope.terminal.terminalRequirement
@@ -162,6 +167,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       command = await PhasedCommandEngine.parseAsync({
         argv: envelope.argv,
         cwd: envelope.cwd,
+        environment: envelope.environment,
         rushConfiguration: workspaceSession.rushConfiguration,
         terminalProvider: terminal
       });
diff --git a/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts b/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts
index 0d08c2f830..0ccd334714 100644
--- a/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/RushXDaemonRequestResolver.ts
@@ -12,6 +12,7 @@ import {
   daemonEnvironmentVariables,
   RushConfiguration,
   RushXCommand,
+  workspaceRequestScopedEnvironmentVariables,
   type IRushXCommandLineArguments
 } from '@microsoft/rush-lib';
 import { EnvironmentMap, FileSystem, JsonFile } from '@rushstack/node-core-library';
@@ -40,6 +41,8 @@ export class RushXDaemonRequestResolver implements IDaemonRequestResolver {
   readonly #startupEnvironment: NodeJS.ProcessEnv = { ...process.env };
   readonly #requestLocalRushVariables: ReadonlySet<string> = new Set([
     ...Object.values(daemonEnvironmentVariables),
+    // A daemon host starts without these, so any request that sets one differs from the startup environment.
+    ...workspaceRequestScopedEnvironmentVariables,
     'RUSH_DAEMON_EXPERIMENTAL',
     'RUSH_INVOKED_FOLDER',
     'RUSH_QUIET_MODE'
diff --git a/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts b/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
index f931b84277..f5c82ab50b 100644
--- a/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
+++ b/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
@@ -6,7 +6,7 @@ import { once } from 'node:events';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 
-import { _FlagFile } from '@microsoft/rush-lib';
+import { _FlagFile, getWorkspaceHostEnvironment } from '@microsoft/rush-lib';
 import { EnvironmentConfiguration } from '@microsoft/rush-lib/lib/api/EnvironmentConfiguration';
 import {
   DependencySpecifier,
@@ -77,13 +77,8 @@ export function getSelectedDaemonStartCommand(
       context.repoRoot
     ],
     cwd: context.repoRoot,
-    environment: Object.freeze(
-      Object.fromEntries(
-        Object.entries(context.environment).filter(
-          (entry): entry is [string, string] => entry[1] !== undefined
-        )
-      )
-    )
+    // The daemon outlives the client that starts it, so it keeps none of that client's request-scoped values.
+    environment: Object.freeze(getWorkspaceHostEnvironment(context.environment))
   };
 }
 
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index 1cde7c35a6..aab404064f 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -10,7 +10,7 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import { RUSHD_OPERATION_HEADER, RUSHD_OPERATION_STREAM_CLOSED } from '@rushstack/rush-daemon-protocol';
 import { OperationStatus } from '@microsoft/rush-lib';
-import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type { IOperationRunnerContext, IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
 
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import {
@@ -24,6 +24,9 @@ import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRoute
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
 const OPERATION_C: string = 'project-c (_phase:test)';
+const SESSION_VARIABLE: string = 'COPILOT_AGENT_SESSION_ID';
+
+type TestOperationAction = (terminal: ITerminal, context: IOperationRunnerContext) => Promise<void>;
 
 interface IDeferred {
   readonly promise: Promise<void>;
@@ -57,9 +60,9 @@ function createRequest(
 }
 
 function createFixture(options?: {
-  readonly actionAAsync?: (terminal: ITerminal) => Promise<void>;
-  readonly actionBAsync?: (terminal: ITerminal) => Promise<void>;
-  readonly actionCAsync?: (terminal: ITerminal) => Promise<void>;
+  readonly actionAAsync?: TestOperationAction;
+  readonly actionBAsync?: TestOperationAction;
+  readonly actionCAsync?: TestOperationAction;
   readonly statusA?: OperationStatus;
 }): ITestRoutingFixture {
   return createRoutingFixture(
@@ -197,6 +200,57 @@ describe('shared phased request batching', () => {
     expect(getResultOperationIds(consumer)).toEqual([OPERATION_A, OPERATION_B]);
   });
 
+  it('gives each operation of a shared iteration the environment of the first request that selected it', async () => {
+    const sessions: Map<string, string | undefined> = new Map();
+    const record =
+      (operationId: string): TestOperationAction =>
+      async (terminal: ITerminal, context: IOperationRunnerContext): Promise<void> => {
+        sessions.set(operationId, context.environment?.[SESSION_VARIABLE]);
+      };
+    const fixture: ITestRoutingFixture = createFixture({
+      actionAAsync: record(OPERATION_A),
+      actionBAsync: record(OPERATION_B),
+      actionCAsync: record(OPERATION_C)
+    });
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const withSession = (request: IDaemonPhasedRequest, session?: string): IDaemonPhasedRequest => ({
+      ...request,
+      environment: session === undefined ? {} : { [SESSION_VARIABLE]: session }
+    });
+    const daemonSession: string | undefined = process.env[SESSION_VARIABLE];
+    process.env[SESSION_VARIABLE] = 'daemon';
+    try {
+      await Promise.all([
+        router.executeAsync(
+          withSession(createRequest('a', OPERATION_A), 'session-A'),
+          new TestPhasedRequestClient('one')
+        ),
+        // Project B depends on project A, which the first request already selected.
+        router.executeAsync(
+          withSession(createRequest('b', OPERATION_B), 'session-B'),
+          new TestPhasedRequestClient('two')
+        ),
+        router.executeAsync(
+          withSession(createRequest('c', OPERATION_C)),
+          new TestPhasedRequestClient('three')
+        )
+      ]);
+    } finally {
+      if (daemonSession === undefined) delete process.env[SESSION_VARIABLE];
+      else process.env[SESSION_VARIABLE] = daemonSession;
+    }
+
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_A, 'session-A'],
+        [OPERATION_B, 'session-B'],
+        [OPERATION_C, undefined]
+      ])
+    );
+  });
+
   it('shares one iteration for disjoint selections while isolating streams, events, and results', async () => {
     const fixture: ITestRoutingFixture = createFixture({
       actionAAsync: async (terminal: ITerminal): Promise<void> => terminal.writeLine('only-a'),
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index bdf1634744..dd82aa7c09 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -218,6 +218,11 @@ if (fs.existsSync(gateFile)) {
   });
 }
 fs.appendFileSync('../../runs.txt', name + ':' + input + ':' + process.argv.slice(2).join(' ') + '\\n');
+const environmentFile = path.resolve('../../common/temp/operation-environment.txt');
+if (fs.existsSync(environmentFile)) {
+  const { COPILOT_AGENT_SESSION_ID = null, RUSH_INVOKED_FOLDER = null } = process.env;
+  fs.appendFileSync(environmentFile, JSON.stringify([name, COPILOT_AGENT_SESSION_ID, RUSH_INVOKED_FOLDER]) + '\\n');
+}
 fs.mkdirSync('lib', { recursive: true });
 fs.writeFileSync('lib/output.txt', input);
 console.log('built-' + name + '-' + input);
@@ -349,6 +354,49 @@ function requestEnvironment(): Record<string, string> {
 }
 
 describe('native production daemon engine', () => {
+  it("runs each request's operations with its requester's session and invocation folder", async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const recordFile: string = path.join(fixture.repoRoot, 'common/temp/operation-environment.txt');
+    const projectFolder: string = path.join(fixture.repoRoot, 'projects/a');
+    const daemonSession: string | undefined = process.env.COPILOT_AGENT_SESSION_ID;
+    // This in-process host's own value stands in for the session that started the daemon.
+    process.env.COPILOT_AGENT_SESSION_ID = 'daemon-starter';
+    try {
+      fs.writeFileSync(recordFile, '');
+      const requests: ReadonlyArray<readonly [string, string | undefined, string]> = [
+        ['first-a', 'session-A', fixture.repoRoot],
+        ['then-b', 'session-B', projectFolder],
+        ['again-a', 'session-A', fixture.repoRoot],
+        ['unset', undefined, fixture.repoRoot]
+      ];
+      for (const [requestId, session, cwd] of requests) {
+        const environment: Record<string, string> = requestEnvironment();
+        delete environment.COPILOT_AGENT_SESSION_ID;
+        if (session !== undefined) environment.COPILOT_AGENT_SESSION_ID = session;
+        const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['rebuild', '--only', 'a'], {
+          cwd,
+          environment
+        });
+        expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      }
+      const records: unknown[] = fs
+        .readFileSync(recordFile, 'utf8')
+        .trim()
+        .split('\n')
+        .map((line: string) => JSON.parse(line));
+      expect(records).toEqual([
+        ['a', 'session-A', fixture.repoRoot],
+        ['a', 'session-B', projectFolder],
+        ['a', 'session-A', fixture.repoRoot],
+        ['a', null, fixture.repoRoot]
+      ]);
+    } finally {
+      if (daemonSession === undefined) delete process.env.COPILOT_AGENT_SESSION_ID;
+      else process.env.COPILOT_AGENT_SESSION_ID = daemonSession;
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('preserves resolver decoration and isolated invocation routing across native generation reloads', async () => {
     const events: string[] = [];
     const fixture: IFixture = await createFixtureAsync(false, 'direct', {
@@ -418,6 +466,31 @@ describe('native production daemon engine', () => {
     }
   });
 
+  it('serves client output and request-scoped settings in the same generation instead of restarting', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial-settings', ['build', '--only', 'a']);
+      const session: WorkspaceSession = fixture.session;
+      const graph: IOperationGraph | undefined = session.operationGraph;
+      const environment: Record<string, string> = {
+        ...requestEnvironment(),
+        RUSH_PARALLELISM: process.env.RUSH_PARALLELISM === '1' ? '2' : '1',
+        RUSHD_OUTPUT: process.env.RUSHD_OUTPUT === 'legacy' ? 'agent' : 'legacy',
+        COPILOT_AGENT_SESSION_ID: 'another-agent-session'
+      };
+      expect(
+        (await runAsync(fixture, 'request-scoped-settings', ['build', '--only', 'a'], { environment }))
+          .terminal
+      ).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0, scheduled: false } });
+      expect(fixture.session).toBe(session);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(readDaemonLockfile(fixture.host.paths.lockfilePath)?.pid).toBe(process.pid);
+      expect(runs(fixture)).toEqual(['a:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('keeps the selected native SDK handoff instead of restarting for a foreign client engine path', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
@@ -598,7 +671,7 @@ describe('native production daemon engine', () => {
       const oldGraph: IOperationGraph = fixture.session.operationGraph!;
       const environment: Record<string, string> = {
         ...requestEnvironment(),
-        RUSH_PARALLELISM: process.env.RUSH_PARALLELISM === '1' ? '2' : '1'
+        RUSHSTACK_DAEMON_TEST_HARD_INPUT: 'changed'
       };
       expect(
         (await runAsync(fixture, 'hard', ['build', '--only', 'a'], { environment })).terminal
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 34ea43c4ee..1187628df5 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -90,6 +90,26 @@ describe('version-selected daemon launcher', () => {
     expect(process.env._RUSH_LIB_PATH).toBe(originalRushLibPath);
   });
 
+  it("starts the daemon without the starting client's request-scoped variables", () => {
+    const command = getSelectedDaemonStartCommand(path.join(repoRoot, 'package.json'), {
+      ...context,
+      environment: {
+        HOME: '/home/user',
+        RUSH_PARALLELISM: '48',
+        COPILOT_AGENT_SESSION_ID: 'session-1',
+        RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+        RUSHD_OUTPUT: 'agent',
+        UNSET: undefined
+      }
+    });
+    expect(command.environment).toEqual({
+      HOME: '/home/user',
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      RUSHD_OUTPUT: 'agent'
+    });
+    expect(Object.isFrozen(command.environment)).toBe(true);
+  });
+
   it('never relabels the bundled engine as a different requested version', async () => {
     fs.writeFileSync(path.join(repoRoot, 'rush.json'), JSON.stringify({ rushVersion: '5.178.1' }));
     await expect(
diff --git a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
index afc7bc6a13..b8d770ac40 100644
--- a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as path from 'node:path';
+
 import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
@@ -81,7 +83,24 @@ it('reuses the warm generation when only volatile per-shell environment variable
         _: '/usr/bin/env'
       },
       terminal: { ...fixture.environment, TERM: 'dumb', COLUMNS: '91', WSL_INTEROP: '/run/WSL/1_interop' },
-      routing: { ...fixture.environment, RUSH_DAEMON: '1', RUSH_DAEMON_EXPERIMENTAL: '1' }
+      routing: { ...fixture.environment, RUSH_DAEMON: '1', RUSH_DAEMON_EXPERIMENTAL: '1' },
+      client: {
+        ...fixture.environment,
+        RUSHD_OUTPUT: 'legacy',
+        RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: '600',
+        RUSH_PARALLELISM: '2'
+      },
+      session: {
+        ...fixture.environment,
+        INVOCATION_ID: 'b0f1',
+        COPILOT_CLI: '1',
+        COPILOT_AGENT_SESSION_ID: 'another-session',
+        VSCODE_IPC_HOOK_CLI: '/run/vscode-ipc.sock'
+      },
+      repeatedPath: {
+        ...fixture.environment,
+        PATH: [fixture.environment.PATH, fixture.environment.PATH].join(path.delimiter)
+      }
     })) {
       const result = await fixture.runAsync(['build', '--to', 'b', '--parallelism', '3'], { environment });
       expect(result.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 5c085cf201..707faae6ec 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -41,6 +41,12 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
 export interface IParsePhasedCommandOptions {
   readonly argv: ReadonlyArray<string>;
   readonly cwd: string;
+  /**
+   * The environment of the client that sent the command. It supplies the defaults of environment-backed
+   * parameters (`RUSH_PARALLELISM`), because a long-lived host's own environment belongs to no request.
+   * Defaults to `process.env`.
+   */
+  readonly environment?: Readonly<Record<string, string | undefined>>;
   readonly rushConfiguration: RushConfiguration;
   readonly terminalProvider: ITerminalProvider;
 }
@@ -83,7 +89,7 @@ export class PhasedCommandEngine {
   }
 
   public static async parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine> {
-    const { rushConfiguration, terminalProvider, cwd, argv } = options;
+    const { rushConfiguration, terminalProvider, cwd, argv, environment = process.env } = options;
     const resolvedCwd: string = await resolvePhasedCommandCwdAsync(cwd, rushConfiguration.rushJsonFolder);
     if (argv.length === 0 || argv.includes('--help') || argv.includes('-h')) {
       throw new Error('Command help must be handled by the native CLI, not by an engine request.');
@@ -95,7 +101,7 @@ export class PhasedCommandEngine {
     }
     const parser: RushCommandLineParser = new RushCommandLineParser({
       cwd: resolvedCwd,
-      engine: { rushConfiguration, terminalProvider }
+      engine: { rushConfiguration, terminalProvider, environment }
     });
     await parser.executeWithoutErrorHandlingAsync([...argv]);
     const action: CommandLineAction | undefined = parser.selectedAction;
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index b4262da1e2..a6ea56664e 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -38,27 +38,42 @@ export interface IWorkspaceInputFingerprintOptions {
  * Environment variable names that are excluded from {@link IWorkspaceInputFingerprint.environmentHash}.
  *
  * @remarks
- * These variables are maintained per shell, terminal, remote session or client invocation. Rush never reads them
- * to configure the engine, construct the operation graph or compute operation hashes, so a difference must not
- * discard a warm workspace:
+ * These variables are maintained per shell, terminal, remote session, service unit, agent session or client
+ * invocation. Rush never reads them to configure the engine, construct the operation graph or compute operation
+ * hashes, so a difference must not discard a warm workspace:
  *
  * - shell bookkeeping: `_`, `PWD`, `OLDPWD`, `SHLVL`, `PS1`, `HISTFILE`, `HISTSIZE`
  *   (a child shell recomputes `PWD`/`SHLVL`/`_` for its own working directory)
  * - terminal presentation: `TERM`, `TERM_PROGRAM`, `TERM_PROGRAM_VERSION`, `TERM_SESSION_ID`, `COLORTERM`,
- *   `COLUMNS`, `LINES`, `LS_COLORS`, `WINDOWID`
+ *   `COLUMNS`, `LINES`, `LS_COLORS`, `WINDOWID`, and the per-window handles of terminal emulators:
+ *   `WT_SESSION`, `WT_PROFILE_ID`, `ITERM_SESSION_ID`
  * - session and multiplexer handles: `WSL_INTEROP`, `WSLENV`, `SSH_CLIENT`, `SSH_CONNECTION`, `SSH_TTY`,
  *   `SSH_AUTH_SOCK`, `TMUX`, `TMUX_PANE`, `STY`, `XDG_SESSION_ID`, `XDG_SESSION_TYPE`, `DBUS_SESSION_BUS_ADDRESS`
- * - `INIT_CWD`, which Rush removes from every lifecycle script environment and sets explicitly where needed
- * - client routing: `RUSH_DAEMON` and `RUSH_DAEMON_AUTO_START` only select and start a daemon, and
- *   `RUSH_DAEMON_EXPERIMENTAL` is read from each request rather than from the process
+ * - service manager metadata that systemd assigns to every unit and scope: `INVOCATION_ID`, `JOURNAL_STREAM`,
+ *   `MANAGERPID`, `SYSTEMD_EXEC_PID`, `MEMORY_PRESSURE_WATCH`, `MEMORY_PRESSURE_WRITE`
+ * - editor and credential-prompt handles of an integrated terminal: `VSCODE_IPC_HOOK_CLI`,
+ *   `VSCODE_GIT_IPC_HANDLE`, `VSCODE_GIT_ASKPASS_MAIN`, `VSCODE_GIT_ASKPASS_NODE`,
+ *   `VSCODE_GIT_ASKPASS_EXTRA_ARGS`, `VSCODE_INJECTION`, `VSCODE_NONCE`, `GIT_ASKPASS`, `SSH_ASKPASS`
+ * - coding agent session markers: `COPILOT_CLI`, `COPILOT_AGENT_SESSION_ID`, `COPILOT_LOADER_PID`,
+ *   `COPILOT_CLI_BINARY_VERSION`, `COPILOT_CLI_RESOLVED_DIST_DIR`, `CLAUDECODE`, `CLAUDE_CODE_ENTRYPOINT`
+ * - `INIT_CWD`, which Rush removes from every lifecycle script environment and sets explicitly where needed,
+ *   and `RUSH_INVOKED_FOLDER`, which Rush assigns for each invocation
+ * - client routing and presentation: `RUSH_DAEMON` and `RUSH_DAEMON_AUTO_START` only select and start a daemon,
+ *   `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` is sent as each request's admission deadline, `RUSHD_OUTPUT` selects
+ *   the client's output mode, and `RUSH_DAEMON_EXPERIMENTAL` is read from each request rather than from the process
+ * - `RUSH_PARALLELISM`, which a long-lived host applies to each request as its `--parallelism` default
  *
  * Every other variable remains a process-bound input, including the remaining `RUSH_*` settings (such as
  * `RUSH_BUILD_CACHE_*` and the daemon's own `RUSH_DAEMON_*` resource settings), `NODE_*`, npm/pnpm
- * configuration, `PATH` and `HOME`. On Windows, names are matched case-insensitively.
+ * configuration, credentials, `PATH` and `HOME`. On Windows, names are matched case-insensitively.
+ * `PATH` is compared without repeated entries, because a later duplicate can never change which executable
+ * a lookup finds.
  *
- * A long-lived host that ignores these variables keeps the values from its own startup environment for the
- * processes it launches. Projects that need one of these values as an operation input should not rely on it
- * being request-specific in such a host.
+ * A long-lived host that ignores these variables must not give the processes it launches the values of the
+ * client that started it. Each operation instead takes every one of these variables from the request that it
+ * serves ({@link getWorkspaceRequestOperationEnvironment}), and does not receive the variable when that
+ * request does not define it. The host's own process also drops {@link workspaceRequestScopedEnvironmentVariables},
+ * because code running inside it reads them from `process.env`.
  *
  * @alpha
  */
@@ -79,6 +94,9 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'LINES',
   'LS_COLORS',
   'WINDOWID',
+  'WT_SESSION',
+  'WT_PROFILE_ID',
+  'ITERM_SESSION_ID',
   'WSL_INTEROP',
   'WSLENV',
   'SSH_CLIENT',
@@ -91,19 +109,62 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'XDG_SESSION_ID',
   'XDG_SESSION_TYPE',
   'DBUS_SESSION_BUS_ADDRESS',
+  'INVOCATION_ID',
+  'JOURNAL_STREAM',
+  'MANAGERPID',
+  'SYSTEMD_EXEC_PID',
+  'MEMORY_PRESSURE_WATCH',
+  'MEMORY_PRESSURE_WRITE',
+  'VSCODE_IPC_HOOK_CLI',
+  'VSCODE_GIT_IPC_HANDLE',
+  'VSCODE_GIT_ASKPASS_MAIN',
+  'VSCODE_GIT_ASKPASS_NODE',
+  'VSCODE_GIT_ASKPASS_EXTRA_ARGS',
+  'VSCODE_INJECTION',
+  'VSCODE_NONCE',
+  'GIT_ASKPASS',
+  'SSH_ASKPASS',
+  'COPILOT_CLI',
+  'COPILOT_AGENT_SESSION_ID',
+  'COPILOT_LOADER_PID',
+  'COPILOT_CLI_BINARY_VERSION',
+  'COPILOT_CLI_RESOLVED_DIST_DIR',
+  'CLAUDECODE',
+  'CLAUDE_CODE_ENTRYPOINT',
   'INIT_CWD',
+  'RUSH_INVOKED_FOLDER',
   'RUSH_DAEMON',
   'RUSH_DAEMON_AUTO_START',
-  'RUSH_DAEMON_EXPERIMENTAL'
+  'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
+  'RUSHD_OUTPUT',
+  'RUSH_DAEMON_EXPERIMENTAL',
+  'RUSH_PARALLELISM'
+]);
+
+/**
+ * The subset of {@link workspaceFingerprintIgnoredEnvironmentVariables} whose value belongs to one request.
+ *
+ * @remarks
+ * A long-lived host must not inherit these variables from the client that started it: it applies
+ * `RUSH_PARALLELISM` from each request's own environment, and code running inside the host that reads a session
+ * identifier such as `COPILOT_AGENT_SESSION_ID` from `process.env` would otherwise attribute every later session's
+ * work to the first one.
+ * On Windows, names are matched case-insensitively.
+ *
+ * @alpha
+ */
+export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string> = new Set([
+  'RUSH_PARALLELISM',
+  'COPILOT_AGENT_SESSION_ID'
 ]);
 
 /**
  * Returns the defined environment entries that participate in workspace fingerprints, sorted by name.
  *
  * @remarks
- * Omits undefined values and {@link workspaceFingerprintIgnoredEnvironmentVariables}. Hosts that compare
- * environments outside {@link captureWorkspaceInputFingerprintAsync} must use this function so that every
- * comparison applies the same normalization.
+ * Omits undefined values and {@link workspaceFingerprintIgnoredEnvironmentVariables}, and removes repeated
+ * `PATH` entries. Hosts that compare environments outside {@link captureWorkspaceInputFingerprintAsync} must use
+ * this function so that every comparison applies the same normalization.
  *
  * @alpha
  */
@@ -111,13 +172,68 @@ export function getWorkspaceFingerprintEnvironmentEntries(
   environment: Readonly<Record<string, string | undefined>>
 ): [string, string][] {
   const isWindows: boolean = process.platform === 'win32';
-  return Object.entries(environment)
-    .filter(
-      (entry): entry is [string, string] =>
-        entry[1] !== undefined &&
-        !workspaceFingerprintIgnoredEnvironmentVariables.has(isWindows ? entry[0].toUpperCase() : entry[0])
-    )
-    .sort(([left], [right]) => Sort.compareByValue(left, right));
+  const entries: [string, string][] = [];
+  for (const [name, value] of Object.entries(environment)) {
+    if (value === undefined) continue;
+    const normalizedName: string = isWindows ? name.toUpperCase() : name;
+    if (workspaceFingerprintIgnoredEnvironmentVariables.has(normalizedName)) continue;
+    entries.push([name, normalizedName === 'PATH' ? removeRepeatedPathEntries(value) : value]);
+  }
+  return entries.sort(([left], [right]) => Sort.compareByValue(left, right));
+}
+
+/**
+ * Returns a copy of a host startup environment without {@link workspaceRequestScopedEnvironmentVariables}.
+ *
+ * @alpha
+ */
+export function getWorkspaceHostEnvironment(
+  environment: Readonly<Record<string, string | undefined>>
+): Record<string, string> {
+  const isWindows: boolean = process.platform === 'win32';
+  const hostEnvironment: Record<string, string> = {};
+  for (const [name, value] of Object.entries(environment)) {
+    if (
+      value !== undefined &&
+      !workspaceRequestScopedEnvironmentVariables.has(isWindows ? name.toUpperCase() : name)
+    ) {
+      hostEnvironment[name] = value;
+    }
+  }
+  return hostEnvironment;
+}
+
+/**
+ * Returns the environment that an operation starts from when a long-lived host runs it for a request.
+ *
+ * @remarks
+ * Every variable in {@link workspaceFingerprintIgnoredEnvironmentVariables} takes the request's value, and is
+ * omitted when the request does not define it, so that the operation sees its own requester's session, terminal
+ * and credential-helper variables. Every other variable comes from the host, whose environment matches the
+ * request's for identity. A host returns the result from `IOperationGraphIterationOptions.getOperationEnvironment`.
+ * On Windows, names are matched case-insensitively.
+ *
+ * @alpha
+ */
+export function getWorkspaceRequestOperationEnvironment(
+  hostEnvironment: Readonly<Record<string, string | undefined>>,
+  requestEnvironment: Readonly<Record<string, string | undefined>>
+): Record<string, string> {
+  const isWindows: boolean = process.platform === 'win32';
+  const isRequestValue = (name: string): boolean =>
+    workspaceFingerprintIgnoredEnvironmentVariables.has(isWindows ? name.toUpperCase() : name);
+  const environment: Record<string, string> = {};
+  for (const [name, value] of Object.entries(hostEnvironment)) {
+    if (value !== undefined && !isRequestValue(name)) environment[name] = value;
+  }
+  for (const [name, value] of Object.entries(requestEnvironment)) {
+    if (value !== undefined && isRequestValue(name)) environment[name] = value;
+  }
+  return environment;
+}
+
+function removeRepeatedPathEntries(value: string): string {
+  return Array.from(new Set(value.split(path.delimiter))).join(path.delimiter);
 }
 
 /**
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
index 6aebbe7d35..49b1c296e1 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
@@ -107,4 +107,43 @@ describe(`${PhasedCommandEngine.name} parameter identity`, () => {
       parallelism: { scalar: 0.5 }
     });
   });
+
+  it("takes the RUSH_PARALLELISM default from the request's environment, not the host's", async () => {
+    const parseInEnvironmentAsync = async (
+      environment: Record<string, string | undefined>,
+      ...argv: string[]
+    ): Promise<PhasedCommandEngine> =>
+      await PhasedCommandEngine.parseAsync({
+        argv,
+        cwd: folder,
+        environment,
+        rushConfiguration,
+        terminalProvider: new NoOpTerminalProvider()
+      });
+    const hostValue: string | undefined = process.env.RUSH_PARALLELISM;
+    process.env.RUSH_PARALLELISM = '7';
+    try {
+      expect((await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build')).requestSettings).toEqual({
+        quietMode: true,
+        parallelism: 3
+      });
+      expect(
+        (await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build', '-p', '5')).requestSettings
+          .parallelism
+      ).toBe(5);
+      expect((await parseInEnvironmentAsync({}, 'build')).requestSettings.parallelism).toEqual(
+        parseParallelism(undefined)
+      );
+      const baseline: string = (await parseInEnvironmentAsync({}, 'build')).parameterIdentity;
+      expect((await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build')).parameterIdentity).toBe(
+        baseline
+      );
+    } finally {
+      if (hostValue === undefined) {
+        delete process.env.RUSH_PARALLELISM;
+      } else {
+        process.env.RUSH_PARALLELISM = hostValue;
+      }
+    }
+  });
 });
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 8982ac0494..e6496a515e 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -9,6 +9,10 @@ import {
   captureWorkspaceInputFingerprintAsync,
   classifyWorkspaceInputChange,
   getWorkspaceFingerprintEnvironmentEntries,
+  getWorkspaceHostEnvironment,
+  getWorkspaceRequestOperationEnvironment,
+  workspaceFingerprintIgnoredEnvironmentVariables,
+  workspaceRequestScopedEnvironmentVariables,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
   type IWorkspaceInputFingerprint
@@ -117,6 +121,21 @@ describe('workspace input fingerprints', () => {
         { SSH_CONNECTION: '10.0.0.1 1 10.0.0.2 22', SSH_AUTH_SOCK: '/tmp/agent', TMUX: '/tmp/tmux' },
         { INIT_CWD: '/repo/packages/p03' },
         { RUSH_DAEMON: '1', RUSH_DAEMON_AUTO_START: '0', RUSH_DAEMON_EXPERIMENTAL: '1' },
+        { RUSHD_OUTPUT: 'legacy', RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: '600' },
+        { RUSH_PARALLELISM: '48', RUSH_INVOKED_FOLDER: '/repo/packages/p03' },
+        { INVOCATION_ID: 'a1b2', JOURNAL_STREAM: '8:123', MANAGERPID: '1', SYSTEMD_EXEC_PID: '42' },
+        {
+          VSCODE_IPC_HOOK_CLI: '/run/vscode.sock',
+          VSCODE_GIT_IPC_HANDLE: '/run/git.sock',
+          GIT_ASKPASS: '/a'
+        },
+        {
+          COPILOT_CLI: '1',
+          COPILOT_AGENT_SESSION_ID: 'session-2',
+          COPILOT_LOADER_PID: '77',
+          WT_SESSION: 'w'
+        },
+        { PATH: `${base.PATH}${path.delimiter}${base.PATH}` },
         { TERM: undefined, PWD: undefined }
       ]) {
         expect(await getHashAsync({ ...base, ...volatile })).toBe(baseHash);
@@ -126,9 +145,12 @@ describe('workspace input fingerprints', () => {
         { RUSH_BUILD_CACHE_ENABLED: '1' },
         { RUSH_BUILD_CACHE_WRITE_ALLOWED: '0' },
         { RUSH_DAEMON_WATCH: '1' },
+        { RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400' },
         { NODE_OPTIONS: '--max-old-space-size=8192' },
         { NPM_CONFIG_REGISTRY: 'https://example.invalid/' },
+        { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'core.fsmonitor', GIT_CONFIG_VALUE_0: 'false' },
         { PATH: '/usr/bin:/usr/local/bin' },
+        { PATH: ['/opt/node/bin', '/usr/local/bin', '/usr/bin'].join(path.delimiter) },
         { HOME: '/home/other' }
       ]) {
         expect(await getHashAsync({ ...base, ...relevant })).not.toBe(baseHash);
@@ -137,11 +159,86 @@ describe('workspace input fingerprints', () => {
         ['HOME', '/home/user'],
         ['PATH', '/usr/local/bin:/usr/bin']
       ]);
+      const repeatedPath: string = ['/a', '/b', '/a', '', '/c', '', '/b'].join(path.delimiter);
+      expect(getWorkspaceFingerprintEnvironmentEntries({ PATH: repeatedPath })).toEqual([
+        ['PATH', ['/a', '/b', '', '/c'].join(path.delimiter)]
+      ]);
     } finally {
       fs.rmSync(folder, { recursive: true, force: true });
     }
   });
 
+  it('keeps request-scoped variables out of a host environment', () => {
+    const environment: Record<string, string | undefined> = {
+      HOME: '/home/user',
+      RUSH_PARALLELISM: '48',
+      COPILOT_AGENT_SESSION_ID: 'session-1',
+      RUSHD_OUTPUT: 'agent',
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      UNSET: undefined
+    };
+    expect(getWorkspaceHostEnvironment(environment)).toEqual({
+      HOME: '/home/user',
+      RUSHD_OUTPUT: 'agent',
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400'
+    });
+    for (const name of workspaceRequestScopedEnvironmentVariables) {
+      expect(workspaceFingerprintIgnoredEnvironmentVariables.has(name)).toBe(true);
+    }
+  });
+
+  it("gives operations the request's values of variables that are not host identity", () => {
+    const hostEnvironment: Record<string, string | undefined> = {
+      HOME: '/home/user',
+      PATH: '/usr/bin',
+      NODE_OPTIONS: '--max-old-space-size=8192',
+      COPILOT_AGENT_SESSION_ID: 'session-A',
+      COPILOT_CLI: '1',
+      GIT_ASKPASS: '/window-A/askpass.sh',
+      WT_SESSION: 'wt-A',
+      UNSET: undefined
+    };
+    const requestEnvironment: Record<string, string | undefined> = {
+      HOME: '/home/other',
+      PATH: '/other/bin',
+      COPILOT_AGENT_SESSION_ID: 'session-B',
+      RUSH_PARALLELISM: '2',
+      WT_SESSION: 'wt-B',
+      RUSH_INVOKED_FOLDER: '/repo/apps/b',
+      TERM: undefined
+    };
+    expect(getWorkspaceRequestOperationEnvironment(hostEnvironment, requestEnvironment)).toEqual({
+      HOME: '/home/user',
+      PATH: '/usr/bin',
+      NODE_OPTIONS: '--max-old-space-size=8192',
+      COPILOT_AGENT_SESSION_ID: 'session-B',
+      RUSH_PARALLELISM: '2',
+      WT_SESSION: 'wt-B',
+      RUSH_INVOKED_FOLDER: '/repo/apps/b'
+    });
+    expect(getWorkspaceRequestOperationEnvironment(hostEnvironment, {})).toEqual({
+      HOME: '/home/user',
+      PATH: '/usr/bin',
+      NODE_OPTIONS: '--max-old-space-size=8192'
+    });
+  });
+
+  it('matches request variable names case-insensitively on Windows', () => {
+    const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+    const mixedCaseSessionVariable: string = 'Copilot_Agent_Session_Id';
+    Object.defineProperty(process, 'platform', { ...platform, value: 'win32' });
+    try {
+      expect(
+        getWorkspaceRequestOperationEnvironment(
+          { Path: 'C:\\bin', [mixedCaseSessionVariable]: 'session-A' },
+          { Path: 'D:\\bin', COPILOT_AGENT_SESSION_ID: 'session-B' }
+        )
+      ).toEqual({ Path: 'C:\\bin', COPILOT_AGENT_SESSION_ID: 'session-B' });
+    } finally {
+      Object.defineProperty(process, 'platform', platform);
+    }
+  });
+
   it('classifies content, configuration and process-bound identities', () => {
     const current: IWorkspaceInputFingerprint = {
       configurationHash: 'configuration',
diff --git a/libraries/rush-lib/src/cli/RushCommandLineParser.ts b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
index 3127c27e7d..5c6cd6521e 100644
--- a/libraries/rush-lib/src/cli/RushCommandLineParser.ts
+++ b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
@@ -98,6 +98,8 @@ export interface IRushCommandLineParserOptions {
   engine?: {
     rushConfiguration: RushConfiguration;
     terminalProvider: ITerminalProvider;
+    /** The environment of the request; see {@link RushCommandLineParser.engineEnvironment}. */
+    environment?: Readonly<Record<string, string | undefined>>;
   };
 }
 
@@ -203,6 +205,15 @@ export class RushCommandLineParser extends CommandLineParser {
     return this.#rushOptions.cwd;
   }
 
+  /**
+   * For a parser that serves a long-lived engine host, the environment of the request being parsed. Actions read
+   * environment-backed parameter defaults from it instead of from `process.env`.
+   */
+  public get engineEnvironment(): Readonly<Record<string, string | undefined>> | undefined {
+    const engine: IRushCommandLineParserOptions['engine'] = this.#rushOptions.engine;
+    return engine ? (engine.environment ?? process.env) : undefined;
+  }
+
   public constructor(options?: Partial<IRushCommandLineParserOptions>) {
     super({
       toolFilename: 'rush',
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 2ff886b205..fe92a4c5ac 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -176,6 +176,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   readonly #alwaysInstall: boolean | undefined;
   readonly #includeAllProjectsInWatchGraph: boolean;
   readonly #terminal: ITerminal;
+  readonly #engineEnvironment: Readonly<Record<string, string | undefined>> | undefined;
 
   readonly #changedProjectsOnlyParameter: CommandLineFlagParameter | undefined;
   readonly #selectionParameters: SelectionParameterSet;
@@ -225,13 +226,15 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     this.hooks = new PhasedCommandHooks();
 
     this.#terminal = new Terminal(this.rushSession.terminalProvider);
+    this.#engineEnvironment = options.parser.engineEnvironment;
 
     this.#parallelismParameter = this.#enableParallelism
       ? this.defineStringParameter({
           parameterLongName: '--parallelism',
           parameterShortName: '-p',
           argumentName: 'COUNT',
-          environmentVariable: EnvironmentVariableNames.RUSH_PARALLELISM,
+          // An engine host reads this default from the request's environment instead; see #getParallelism().
+          environmentVariable: this.#engineEnvironment ? undefined : EnvironmentVariableNames.RUSH_PARALLELISM,
           description:
             'Specifies the maximum number of concurrent processes to launch during a build.' +
             ' The COUNT should be a positive integer, a percentage value (eg. "50%") or the word "max"' +
@@ -408,10 +411,31 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   public getEngineRequestSettings(): IPhasedCommandEngineRequestSettings {
     return {
       quietMode: !this.#verboseParameter.value,
-      parallelism: this.#enableParallelism ? parseParallelism(this.#parallelismParameter?.value) : 1
+      parallelism: this.#getParallelism()
     };
   }
 
+  /**
+   * The `--parallelism` value, else the `RUSH_PARALLELISM` default, or 1 if the command does not run in parallel.
+   * An engine parser takes the default from the request's environment, because the host process belongs to no
+   * request; on Windows its name is matched case-insensitively, like `process.env`.
+   */
+  #getParallelism(): Parallelism {
+    if (!this.#enableParallelism) return 1;
+    const engineEnvironment: Readonly<Record<string, string | undefined>> | undefined =
+      this.#engineEnvironment;
+    let value: string | undefined = this.#parallelismParameter?.value;
+    if (value === undefined && engineEnvironment) {
+      const name: string = EnvironmentVariableNames.RUSH_PARALLELISM;
+      const key: string | undefined =
+        process.platform === 'win32'
+          ? Object.keys(engineEnvironment).find((candidate: string) => candidate.toUpperCase() === name)
+          : name;
+      value = key === undefined ? undefined : engineEnvironment[key];
+    }
+    return parseParallelism(value);
+  }
+
   public async selectEngineOperationsAsync(
     graph: IOperationGraph
   ): Promise<ReadonlyMap<Operation, OperationEnabledState>> {
@@ -512,9 +536,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     // if this is parallelizable, then use the value from the flag (undefined or a number),
     // if parallelism is not enabled, then restrict to 1 core
     const maxParallelism: number = getNumberOfCores();
-    const parallelism: Parallelism = this.#enableParallelism
-      ? parseParallelism(this.#parallelismParameter?.value)
-      : 1;
+    const parallelism: Parallelism = this.#getParallelism();
 
     await measureAsyncFn(`${PERF_PREFIX}:applyStandardPlugins`, async () => {
       // Generates the default operation graph
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index a2346d9e99..33caab8118 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -188,7 +188,10 @@ export {
   captureProjectConfigurationFingerprintAsync,
   classifyWorkspaceInputChange,
   getWorkspaceFingerprintEnvironmentEntries,
+  getWorkspaceHostEnvironment,
+  getWorkspaceRequestOperationEnvironment,
   workspaceFingerprintIgnoredEnvironmentVariables,
+  workspaceRequestScopedEnvironmentVariables,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
   type IWorkspaceInputFingerprint,
diff --git a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
index 4fa4d1b0ac..f48fd9b356 100644
--- a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
+++ b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
@@ -167,9 +167,15 @@ export interface IInputsSnapshot {
    * the command being executed and the final hashes of the operation's dependencies to compute the final hash for the operation.
    * @param project - The Rush project to compute the state hash for
    * @param operationName - The name of the operation (phase) to get hashes for. If omitted, returns a generic hash for the whole project, as used for bulk commands.
+   * @param environment - The environment that the operation runs with, if it differs from the environment of the
+   * snapshot. The operation's `dependsOnEnvVars` are hashed from it.
    * @returns The local state hash for the project. This is a hash of the environment, the project's tracked files, and any additional files.
    */
-  getOperationOwnStateHash(project: IRushConfigurationProjectForSnapshot, operationName?: string): string;
+  getOperationOwnStateHash(
+    project: IRushConfigurationProjectForSnapshot,
+    operationName?: string,
+    environment?: Readonly<Record<string, string | undefined>>
+  ): string;
 }
 
 /**
@@ -377,59 +383,80 @@ export class InputsSnapshot implements IInputsSnapshot {
    */
   public getOperationOwnStateHash(
     project: IRushConfigurationProjectForSnapshot,
-    operationName?: string
+    operationName?: string,
+    environment?: Readonly<Record<string, string | undefined>>
   ): string {
     const record: IInternalInputsSnapshotProjectMetadata | undefined = this.#projectMetadataMap.get(project);
     if (!record) {
       throw new Error(`No information available for project at ${project.projectFolder}`);
     }
 
+    const operationSettings: Readonly<IOperationSettings> | undefined = operationName
+      ? record.projectConfig?.operationSettingsByOperationName.get(operationName)
+      : undefined;
+    const snapshotEnvironment: Readonly<Record<string, string | undefined>> = this.#environment;
+    if (
+      environment &&
+      operationSettings?.dependsOnEnvVars?.some(
+        (envVar: string) => (environment[envVar] || '') !== (snapshotEnvironment[envVar] || '')
+      )
+    ) {
+      // The operation's environment differs from the snapshot's in a variable that it hashes, so don't memoize.
+      return this.#computeOperationOwnStateHash(project, operationName, operationSettings, environment);
+    }
+
     const { hashByOperationName } = record;
     let hash: string | undefined = hashByOperationName.get(operationName);
     if (!hash) {
-      const hashes: ReadonlyMap<string, string> = this.getTrackedFileHashesForOperation(
+      hash = this.#computeOperationOwnStateHash(
         project,
-        operationName
+        operationName,
+        operationSettings,
+        snapshotEnvironment
       );
+      hashByOperationName.set(operationName, hash);
+    }
 
-      const hasher: Hash = createHash('sha1');
-      // If this is for a specific operation, apply operation-specific options
-      if (operationName) {
-        const operationSettings: Readonly<IOperationSettings> | undefined =
-          record.projectConfig?.operationSettingsByOperationName.get(operationName);
-        if (operationSettings) {
-          const { dependsOnEnvVars, dependsOnNodeVersion, outputFolderNames } = operationSettings;
-          if (dependsOnEnvVars) {
-            // As long as we enumerate environment variables in a consistent order, we will get a stable hash.
-            // Changing the order in rush-project.json will change the hash anyway since the file contents are part of the hash.
-            for (const envVar of dependsOnEnvVars) {
-              hasher.update(`${hashDelimiter}$${envVar}=${this.#environment[envVar] || ''}`);
-            }
-          }
-
-          if (dependsOnNodeVersion) {
-            const granularity: NodeVersionGranularity =
-              dependsOnNodeVersion === true ? 'patch' : dependsOnNodeVersion;
-            hasher.update(`${hashDelimiter}nodeVersion=${this.#nodeVersionByGranularity[granularity]}`);
-          }
+    return hash;
+  }
 
-          if (outputFolderNames) {
-            hasher.update(`${hashDelimiter}${JSON.stringify(outputFolderNames)}`);
-          }
+  #computeOperationOwnStateHash(
+    project: IRushConfigurationProjectForSnapshot,
+    operationName: string | undefined,
+    operationSettings: Readonly<IOperationSettings> | undefined,
+    environment: Readonly<Record<string, string | undefined>>
+  ): string {
+    const hashes: ReadonlyMap<string, string> = this.getTrackedFileHashesForOperation(project, operationName);
+
+    const hasher: Hash = createHash('sha1');
+    // If this is for a specific operation, apply operation-specific options
+    if (operationSettings) {
+      const { dependsOnEnvVars, dependsOnNodeVersion, outputFolderNames } = operationSettings;
+      if (dependsOnEnvVars) {
+        // As long as we enumerate environment variables in a consistent order, we will get a stable hash.
+        // Changing the order in rush-project.json will change the hash anyway since the file contents are part of the hash.
+        for (const envVar of dependsOnEnvVars) {
+          hasher.update(`${hashDelimiter}$${envVar}=${environment[envVar] || ''}`);
         }
       }
 
-      // Hash the base project files
-      for (const [filePath, fileHash] of hashes) {
-        hasher.update(`${hashDelimiter}${filePath}${hashDelimiter}${fileHash}`);
+      if (dependsOnNodeVersion) {
+        const granularity: NodeVersionGranularity =
+          dependsOnNodeVersion === true ? 'patch' : dependsOnNodeVersion;
+        hasher.update(`${hashDelimiter}nodeVersion=${this.#nodeVersionByGranularity[granularity]}`);
       }
 
-      hash = hasher.digest('hex');
+      if (outputFolderNames) {
+        hasher.update(`${hashDelimiter}${JSON.stringify(outputFolderNames)}`);
+      }
+    }
 
-      hashByOperationName.set(operationName, hash);
+    // Hash the base project files
+    for (const [filePath, fileHash] of hashes) {
+      hasher.update(`${hashDelimiter}${filePath}${hashDelimiter}${fileHash}`);
     }
 
-    return hash;
+    return hasher.digest('hex');
   }
 
   *#resolveHashes(filePaths: Iterable<string>): Generator<[string, string]> {
diff --git a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
index 0ace6c1472..901fad97cc 100644
--- a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
+++ b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
@@ -713,5 +713,41 @@ describe(InputsSnapshot.name, () => {
       expect(result2).not.toEqual(baseline);
       expect(result2).not.toEqual(result1);
     });
+
+    it("Hashes dependsOnEnvVars from an operation's own environment when one is supplied", () => {
+      const { project, options } = getTestConfig();
+      const projectConfig: Pick<RushProjectConfiguration, 'operationSettingsByOperationName'> = {
+        operationSettingsByOperationName: new Map([
+          ['_phase:build', { operationName: '_phase:build', dependsOnEnvVars: ['ENV_VAR'] }]
+        ])
+      };
+      const createSnapshot = (environment: Record<string, string>): InputsSnapshot =>
+        new InputsSnapshot({
+          ...options,
+          projectMap: new Map([[project, { projectConfig: projectConfig as RushProjectConfiguration }]]),
+          environment
+        });
+      const snapshotA: InputsSnapshot = createSnapshot({ ENV_VAR: 'a', OTHER: 'a' });
+      const snapshotB: InputsSnapshot = createSnapshot({ ENV_VAR: 'b' });
+      const hashA: string = createSnapshot({ ENV_VAR: 'a' }).getOperationOwnStateHash(
+        project,
+        '_phase:build'
+      );
+      const hashB: string = snapshotB.getOperationOwnStateHash(project, '_phase:build');
+      expect(hashB).not.toEqual(hashA);
+
+      // An operation that runs with another environment gets the hash of a snapshot of that environment,
+      // whether or not the snapshot's own hash was already computed.
+      expect(snapshotA.getOperationOwnStateHash(project, '_phase:build', { ENV_VAR: 'b' })).toEqual(hashB);
+      expect(snapshotA.getOperationOwnStateHash(project, '_phase:build')).toEqual(hashA);
+      expect(snapshotA.getOperationOwnStateHash(project, '_phase:build', { ENV_VAR: 'b' })).toEqual(hashB);
+      // Variables that the operation does not depend on never change its hash.
+      expect(
+        snapshotA.getOperationOwnStateHash(project, '_phase:build', { ENV_VAR: 'a', OTHER: 'b' })
+      ).toEqual(hashA);
+      expect(snapshotA.getOperationOwnStateHash(project, undefined, { ENV_VAR: 'b' })).toEqual(
+        snapshotB.getOperationOwnStateHash(project, undefined)
+      );
+    });
   });
 });
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index e6b4316fbe..9b72d55383 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -21,6 +21,18 @@ export interface IOperationGraphIterationOptions {
    * The time when the iteration was scheduled, if available, as returned by `performance.now()`.
    */
   startTime?: number;
+
+  /**
+   * Returns the environment that an operation of this iteration starts from, before any
+   * `createEnvironmentForOperation` tap. The operation's `dependsOnEnvVars` are hashed from the same environment.
+   * When omitted, every operation starts from `process.env` and hashes the environment of the inputs snapshot.
+   *
+   * @remarks
+   * A long-lived host serves requests from clients whose environments differ from its own, and one iteration can
+   * serve several requests. The host gives each operation the environment of a request that selected it
+   * (see `getWorkspaceRequestOperationEnvironment`).
+   */
+  getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
 }
 
 /**
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index 129d5c04c5..f786b97113 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -48,6 +48,11 @@ export interface IOperationExecutionRecordContext {
   streamCollator: StreamCollator | undefined;
   onOperationStateChanged?: (record: OperationExecutionRecord) => void;
   createEnvironment?: (record: OperationExecutionRecord) => IEnvironment;
+  /**
+   * The environment that an operation starts from, before any `createEnvironmentForOperation` tap, when it is not
+   * the environment of the inputs snapshot. The operation's `dependsOnEnvVars` are hashed from it.
+   */
+  getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
   invalidate?: (operations: Iterable<Operation>, reason: string) => void;
   inputsSnapshot: IInputsSnapshot | undefined;
   maxParallelism: number;
@@ -429,7 +434,11 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
       // - Git hashes of tracked files in the associated project
       // - Git hash of the shrinkwrap file for the project
       // - Git hashes of any files specified in `dependsOnAdditionalFiles` (must not be associated with a project)
-      const local: string = inputsSnapshot.getOperationOwnStateHash(associatedProject, associatedPhase.name);
+      const local: string = inputsSnapshot.getOperationOwnStateHash(
+        associatedProject,
+        associatedPhase.name,
+        this.#context.getOperationEnvironment?.(this.operation)
+      );
 
       // Examples of data in the config hash:
       // - CLI parameters (ShellOperationRunner)
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index a3ed25bb1c..09da8be3a0 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -691,9 +691,16 @@ export class OperationGraph implements IOperationGraph {
     const getInputsSnapshotAsync: (() => Promise<IInputsSnapshot | undefined>) | undefined =
       this.#getInputsSnapshotAsync;
 
-    const { startTime = performance.now(), inputsSnapshot = await getInputsSnapshotAsync?.() } =
-      iterationOptions;
-    const iterationOptionsForCallbacks: IOperationGraphIterationOptions = { startTime, inputsSnapshot };
+    const {
+      startTime = performance.now(),
+      inputsSnapshot = await getInputsSnapshotAsync?.(),
+      getOperationEnvironment
+    } = iterationOptions;
+    const iterationOptionsForCallbacks: IOperationGraphIterationOptions = {
+      startTime,
+      inputsSnapshot,
+      getOperationEnvironment
+    };
 
     const { hooks } = this;
 
@@ -719,7 +726,9 @@ export class OperationGraph implements IOperationGraph {
     const graph: OperationGraph = this;
 
     function createEnvironmentForOperation(record: OperationExecutionRecord): IEnvironment {
-      return hooks.createEnvironmentForOperation.call({ ...process.env }, record);
+      const baseEnvironment: Readonly<Record<string, string | undefined>> =
+        getOperationEnvironment?.(record.operation) ?? process.env;
+      return hooks.createEnvironmentForOperation.call({ ...baseEnvironment }, record);
     }
 
     const terminateController: AbortController | undefined = this.#supportsTerminateRunning
@@ -739,6 +748,7 @@ export class OperationGraph implements IOperationGraph {
       maxParallelism: this.#maxParallelism,
       onOperationStateChanged: undefined,
       createEnvironment: createEnvironmentForOperation,
+      getOperationEnvironment,
       invalidate: graph.invalidateOperations.bind(graph),
       get debugMode(): boolean {
         return graph.debugMode;
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
new file mode 100644
index 0000000000..653c027eb2
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
@@ -0,0 +1,170 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IEnvironment } from '../../../utilities/Utilities';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type { IOperationGraphIterationOptions } from '../IOperationGraph';
+import type { IOperationRunnerContext } from '../IOperationRunner';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const SESSION_VARIABLE: string = 'RUSH_TEST_OPERATION_ENVIRONMENT_SESSION';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+class EnvironmentRecordingRunner extends MockOperationRunner {
+  public readonly sessions: (string | undefined)[] = [];
+
+  public override async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    this.sessions.push(context.environment?.[SESSION_VARIABLE]);
+    return await super.executeAsync(context);
+  }
+}
+
+function createGraph(runners: ReadonlyArray<EnvironmentRecordingRunner>): OperationGraph {
+  const operations: Operation[] = runners.map(
+    (runner: EnvironmentRecordingRunner) =>
+      new Operation({
+        runner,
+        logFilenameIdentifier: runner.name,
+        phase: mockPhase,
+        project: { packageName: runner.name } as unknown as RushConfigurationProject
+      })
+  );
+  return new OperationGraph(new Set(operations), {
+    quietMode: false,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+}
+
+describe('OperationGraph operation environment', () => {
+  afterEach(() => {
+    delete process.env[SESSION_VARIABLE];
+  });
+
+  it('starts operations from process.env by default', async () => {
+    process.env[SESSION_VARIABLE] = 'host';
+    const runner: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('operation');
+    const graph: OperationGraph = createGraph([runner]);
+
+    expect((await graph.executeAsync({})).status).toBe(OperationStatus.Success);
+    expect(runner.sessions).toEqual(['host']);
+  });
+
+  it('starts each operation from the environment that the iteration chooses for it, before plugin taps', async () => {
+    process.env[SESSION_VARIABLE] = 'host';
+    const first: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('first');
+    const second: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('second');
+    const graph: OperationGraph = createGraph([first, second]);
+    const tapSessions: (string | undefined)[] = [];
+    graph.hooks.createEnvironmentForOperation.tap('test', (environment: IEnvironment) => {
+      tapSessions.push(environment[SESSION_VARIABLE]);
+      // A tap edits its own copy, never the environment that the iteration supplied.
+      environment[SESSION_VARIABLE] = `${environment[SESSION_VARIABLE]}+tap`;
+      return environment;
+    });
+    const sessionA: Readonly<Record<string, string>> = { [SESSION_VARIABLE]: 'A' };
+    const sessionB: Readonly<Record<string, string>> = { [SESSION_VARIABLE]: 'B' };
+
+    const iterations: (IOperationGraphIterationOptions['getOperationEnvironment'] | undefined)[] = [
+      (operation: Operation) => (operation.runner === first ? sessionA : sessionB),
+      () => sessionB,
+      undefined
+    ];
+    for (const getOperationEnvironment of iterations) {
+      expect((await graph.executeAsync({ getOperationEnvironment })).status).toBe(OperationStatus.Success);
+    }
+
+    expect(first.sessions).toEqual(['A+tap', 'B+tap', 'host+tap']);
+    expect(second.sessions).toEqual(['B+tap', 'B+tap', 'host+tap']);
+    expect(tapSessions.sort()).toEqual(['A', 'B', 'B', 'B', 'host', 'host']);
+    expect([sessionA, sessionB, process.env[SESSION_VARIABLE]]).toEqual([
+      { [SESSION_VARIABLE]: 'A' },
+      { [SESSION_VARIABLE]: 'B' },
+      'host'
+    ]);
+  });
+
+  it("hashes each operation's inputs with the environment that it starts from", async () => {
+    const first: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('first');
+    const second: EnvironmentRecordingRunner = new EnvironmentRecordingRunner('second');
+    const graph: OperationGraph = createGraph([first, second]);
+    const hashedEnvironments: Map<string, Readonly<Record<string, string | undefined>> | undefined> =
+      new Map();
+    const inputsSnapshot: IInputsSnapshot = {
+      hashes: new Map(),
+      rootDirectory: '/repo',
+      hasUncommittedChanges: false,
+      getTrackedFileHashesForOperation: () => new Map(),
+      getOperationOwnStateHash: (
+        project: IRushConfigurationProjectForSnapshot,
+        operationName?: string,
+        environment?: Readonly<Record<string, string | undefined>>
+      ) => {
+        hashedEnvironments.set((project as RushConfigurationProject).packageName, environment);
+        return 'local';
+      }
+    };
+    const sessionA: Readonly<Record<string, string>> = { [SESSION_VARIABLE]: 'A' };
+
+    await graph.executeAsync({
+      inputsSnapshot,
+      getOperationEnvironment: (operation: Operation) => (operation.runner === first ? sessionA : {})
+    });
+    expect(hashedEnvironments).toEqual(
+      new Map([
+        ['first', sessionA],
+        ['second', {}]
+      ])
+    );
+
+    hashedEnvironments.clear();
+    await graph.executeAsync({ inputsSnapshot });
+    expect(hashedEnvironments).toEqual(
+      new Map([
+        ['first', undefined],
+        ['second', undefined]
+      ])
+    );
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/Utilities.ts b/libraries/rush-lib/src/utilities/Utilities.ts
index 8c7a4b6078..df68af0e61 100644
--- a/libraries/rush-lib/src/utilities/Utilities.ts
+++ b/libraries/rush-lib/src/utilities/Utilities.ts
@@ -820,6 +820,13 @@ function _createEnvironmentForRushCommand(options: ICreateEnvironmentForRushComm
       continue;
     }
 
+    // RUSH_DAEMON* variables only route a client to the daemon and configure the daemon host. Project
+    // tooling never reads them, and a Rush release that predates the daemon rejects them as unknown
+    // RUSH_* variables, which breaks tools that start their own copy of Rush.
+    if (normalizedKey.startsWith('RUSH_DAEMON')) {
+      continue;
+    }
+
     // Use the uppercased environment variable name on Windows because environment variable names
     // are case-insensitive on Windows
     environment[normalizedKey] = options.initialEnvironment[key];
diff --git a/libraries/rush-lib/src/utilities/test/Utilities.test.ts b/libraries/rush-lib/src/utilities/test/Utilities.test.ts
index 5ab24d3ab6..b69fad4d4d 100644
--- a/libraries/rush-lib/src/utilities/test/Utilities.test.ts
+++ b/libraries/rush-lib/src/utilities/test/Utilities.test.ts
@@ -349,6 +349,38 @@ describe(Utilities.name, () => {
           expect(options.shell).toBeUndefined();
         }
       });
+
+      it('does not pass the daemon routing and host settings to lifecycle commands', () => {
+        const spawn = jest
+          .fn<ChildProcess, [string, ReadonlyArray<string>, SpawnOptions]>()
+          .mockReturnValue(new ChildProcess());
+        Utilities.executeLifecycleCommandAsync('echo request', {
+          rushConfiguration: undefined,
+          workingDirectory: process.cwd(),
+          initCwd: process.cwd(),
+          handleOutput: false,
+          environmentPathOptions: {},
+          initialEnvironment: {
+            RUSH_DAEMON: '1',
+            RUSH_DAEMON_AUTO_START: '0',
+            RUSH_DAEMON_EXPERIMENTAL: '1',
+            RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+            RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: '65536',
+            RUSH_BUILD_CACHE_ENABLED: '1',
+            RUSH_PREVIEW_VERSION: '5.0.0',
+            REQUEST_VALUE: 'request'
+          },
+          stdio: 'pipe',
+          spawn
+        });
+        const environment: NodeJS.ProcessEnv = spawn.mock.calls[0][2].env!;
+        expect(Object.keys(environment).filter((name: string) => /^RUSH_DAEMON/i.test(name))).toEqual([]);
+        expect(environment).toMatchObject({
+          RUSH_BUILD_CACHE_ENABLED: '1',
+          RUSH_PREVIEW_VERSION: '5.0.0',
+          REQUEST_VALUE: 'request'
+        });
+      });
     });
   });
 });

From ba3ff35857c4bde32fa4ca5c5a7080a588ac09e9 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:12:02 +0000
Subject: [PATCH 019/265] [rush-lib] Let daemon engines serve builds with
 declared daemon-compatible plugins (and 1 more)

Swarm integration step 4; original commit 1e786a4252 (merge of swarm/r01 at 162ff05eaf).



Commits folded into this step (2):
- 5fe505bf1a [rush-lib] Let daemon engines serve builds with declared daemon-compatible plugins
- 162ff05eaf [rush-lib] Walk each plugin package once in the daemon runtime fingerprint

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...n-compatible-plugins_2026-09-28-13-00.json |  10 +
 ...n-compatible-plugins_2026-09-28-13-00.json |  10 +
 common/reviews/api/rush-lib.api.md            |   4 +-
 docs/rush/dogfooding-rush-daemon.md           |  67 ++++-
 docs/rush/environment-variables.md            |   1 +
 .../src/ProductionDaemonRequestResolver.ts    |  13 +-
 libraries/rush-lib/assets/rush-init/rush.json |   5 +-
 .../rush-lib/src/api/DaemonConfiguration.ts   |  43 ++-
 .../src/api/EnvironmentConfiguration.ts       |   3 +
 .../rush-lib/src/api/PhasedCommandEngine.ts   |  57 +++-
 .../src/api/WorkspaceInputFingerprint.ts      |  18 +-
 .../src/api/test/DaemonConfiguration.test.ts  |  65 ++++-
 .../src/api/test/PhasedCommandEngine.test.ts  | 262 +++++++++++++++---
 .../test/WorkspaceInputFingerprint.test.ts    |  87 ++++++
 .../src/api/test/WorkspaceRuntimeWalk.test.ts |  53 ++++
 .../PluginLoader/AutoinstallerPluginLoader.ts |  12 +
 .../PluginLoader/PluginLoaderBase.ts          |   2 +
 .../src/pluginFramework/PluginManager.ts      |  45 +--
 .../schemas/rush-plugin-manifest.schema.json  |   4 +
 .../rush-lib/src/schemas/rush.schema.json     |   9 +
 20 files changed, 688 insertions(+), 82 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/daemon-compatible-plugins_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-compatible-plugins_2026-09-28-13-00.json
 create mode 100644 libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts

diff --git a/common/changes/@microsoft/rush/daemon-compatible-plugins_2026-09-28-13-00.json b/common/changes/@microsoft/rush/daemon-compatible-plugins_2026-09-28-13-00.json
new file mode 100644
index 0000000000..bdc4a73d31
--- /dev/null
+++ b/common/changes/@microsoft/rush/daemon-compatible-plugins_2026-09-28-13-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let daemon engines serve commands that a configured Rush plugin participates in when the plugin is declared daemon-compatible, through the `daemonCompatible` manifest field, the rush.json `daemon.compatiblePlugins` setting, or the `RUSH_DAEMON_COMPATIBLE_PLUGINS` environment variable. Treat the installed code of every configured plugin as a daemon runtime input.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-compatible-plugins_2026-09-28-13-00.json b/common/changes/@rushstack/rush-daemon/daemon-compatible-plugins_2026-09-28-13-00.json
new file mode 100644
index 0000000000..4c2528cae8
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-compatible-plugins_2026-09-28-13-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Serve build and rebuild requests that a declared daemon-compatible plugin participates in, and log compatible plugin names that match no configured plugin.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 0215d58fda..4e3184e502 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -326,6 +326,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
     readonly RUSH_DAEMON_WARM_SET_MAX_PROJECTS: "RUSH_DAEMON_WARM_SET_MAX_PROJECTS";
     readonly RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: "RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY";
+    readonly RUSH_DAEMON_COMPATIBLE_PLUGINS: "RUSH_DAEMON_COMPATIBLE_PLUGINS";
     readonly RUSH_DAEMON_EXPERIMENTAL: "RUSH_DAEMON_EXPERIMENTAL";
 };
 
@@ -524,6 +525,7 @@ export interface ICustomTipsJson {
 export interface IDaemonConfigurationJson {
     readonly autoStart?: boolean;
     readonly autoWarmByTelemetry?: boolean;
+    readonly compatiblePlugins?: ReadonlyArray<string>;
     readonly enabled?: boolean;
     readonly idleTimeoutSeconds?: number;
     readonly queueTimeoutSeconds?: number;
@@ -1268,7 +1270,6 @@ export interface IWorkspaceInputFingerprint {
     readonly environmentHash: string;
     // (undocumented)
     readonly installationHash: string;
-    // (undocumented)
     readonly runtimeHash: string;
     // (undocumented)
     readonly selectedRushVersion: string;
@@ -1533,6 +1534,7 @@ export class PhasedCommandEngine {
     static parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine>;
     get requestSettings(): IPhasedCommandEngineRequestSettings;
     selectOperationsAsync(graph: IOperationGraph): Promise<ReadonlyMap<Operation, OperationEnabledState>>;
+    readonly unmatchedCompatiblePluginNames: ReadonlyArray<string>;
 }
 
 // @alpha
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 5ab364cda1..7cd51776c7 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -189,7 +189,9 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
 - **Plugins.** This repository's only configured plugin, `@rushstack/rush-published-versions-json-plugin`,
   is associated only with `record-published-versions` and is inert for builds. A plugin without
   `associatedCommands`, a plugin associated with `build` or `rebuild`, or a plugin command-line that defines
-  the command, one of its phases, or a parameter for either would make those builds fall back to native Rush.
+  the command, one of its phases, or a parameter for either would make those builds fall back to native Rush,
+  unless the plugin is declared daemon-compatible. See
+  [Rush plugins in daemon engines](#rush-plugins-in-daemon-engines).
 - **Windows.** Native Windows validation of the daemon code saw unresolved, intermittent failures in which
   Git `hash-object --stdin-paths` exited with `0xC0000142` (DLL initialization failed) while the daemon
   captured workspace snapshots under Jest. Direct fixtures did not reproduce it, and it did not occur while
@@ -200,6 +202,69 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   tool; if you see that, [refresh the snapshot](#refresh-the-snapshot).
 - **CI** stays in-process unless `RUSH_DAEMON=1` is set; do not set it in CI workflows.
 
+## Rush plugins in daemon engines
+
+A daemon engine applies each Rush plugin once and then serves many requests from one long-lived process.
+A plugin written for a single native command can therefore misbehave, so the daemon serves a `build` or
+`rebuild` that a configured plugin participates in only if the plugin is declared daemon-compatible. A plugin
+participates if it has no `associatedCommands` (Rush initializes it for every command), is associated with
+the command, or its command-line.json defines the command, one of its phases, or a parameter for either.
+Any other plugin is inert for the build and needs no declaration.
+
+Declare a plugin in one of these ways:
+
+- **The plugin author** sets `"daemonCompatible": true` on the plugin's entry in `rush-plugin-manifest.json`.
+  Releases whose schemas predate this setting reject such a manifest, and then every command fails, not only
+  builds. Set it only in plugin versions that are installed with a Rush release that accepts it, as with the
+  `@rushstack` plugins, which are versioned with Rush; otherwise leave the declaration to repositories.
+- **The repository** lists the plugin's `pluginName` from `rush-plugins.json` in the `rush.json` setting
+  `"daemon": { "compatiblePlugins": [...] }`, after verifying the plugin against the contract below.
+- **One shell** sets `RUSH_DAEMON_COMPATIBLE_PLUGINS` to a comma-separated list of plugin names, which
+  replaces the `rush.json` list; an empty value lists no plugins. Releases whose schemas predate these
+  settings reject the manifest and `rush.json` keys, so a repository that still selects such a release can
+  only use this variable, and only for `rush-client`. The value is part of the daemon's environment
+  identity, so changing it starts a new daemon.
+
+A listed name that matches no configured plugin has no effect; the request that creates the daemon's engine
+prints a warning, which the daemon's launcher log also keeps. An undeclared participating plugin makes the
+request fall back to native Rush, with a message that names the plugin and each reason.
+
+The engine lifecycle that a declared plugin must support:
+
+- **Once per engine:** the plugin's `apply()`, `runAnyPhasedCommand`, `runPhasedCommand.for(<command>)`,
+  `createOperationsAsync` and `onGraphCreatedAsync`. The engine builds the graph for every project, with
+  `isWatch` false; each request then selects operations from it. A request whose parameters differ from the
+  engine's (other than project selection, `--verbose`, `--parallelism` and `--timeline`) or a changed
+  configuration file replaces the engine, and the new engine applies the plugin again in the same process.
+  Module-level state therefore outlives an engine.
+- **Once per iteration:** the operation graph hooks, such as `configureIteration`,
+  `beforeExecuteIterationAsync`, `before`/`afterExecuteOperationAsync`, `createEnvironmentForOperation` and
+  `afterExecuteIterationAsync`. One iteration can serve several concurrent requests. If every operation that
+  a request selects is up to date, the daemon aborts the iteration before it runs anything, so
+  `beforeExecuteIterationAsync` and the operation hooks don't fire. Don't rely on iteration hooks for
+  per-request work.
+- **Disposal:** the engine aborts `IOperationGraph.abortController`, cancels the current iteration, and then
+  closes every operation runner. Release resources from the abort signal or the runner's `closeAsync()`.
+
+Rules for a daemon-compatible plugin:
+
+- Don't change process globals: no writes to `process.env`, `process.exitCode`, the current directory or
+  `process.argv`, and no patching or clearing of global functions such as `setTimeout`. They belong to the
+  daemon and to every other request.
+- Keep request-specific state per iteration, not per process or per engine (session IDs, start times,
+  performance marks).
+- Never prompt. The daemon has no terminal; fail fast with a message that the requesting client sees, and
+  continue without the feature where possible.
+- Read the operation's environment (from `createEnvironmentForOperation`), not the daemon's `process.env`.
+- Write output through the session's logger. Output written while an iteration runs reaches that iteration's
+  clients, and output written while the engine is created reaches the request that created it; the daemon
+  drops output written between iterations.
+
+Node.js loads a plugin's code only once, so the daemon treats the installed package folder of every configured
+plugin as part of its implementation: a change to a plugin's `.js` or `.json` files, including through a
+`link:` dependency, starts a new daemon for the next request. Declaration (`lib-dts`) and ES module (`lib-esm`)
+output folders are left out, because a plugin's CommonJS entry point doesn't load them.
+
 ## Version skew and `RUSH_PREVIEW_VERSION`
 
 `rush-client` runs the daemon with its bundled engine only if that engine's version equals the selected Rush
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 5ca22ad77b..721e370fc3 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -31,6 +31,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
 | `RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY` | `0` | Rank retention using measured time saved, frequency and memory, with conservative LRU fallback. Never speculatively executes scripts. Overrides `autoWarmByTelemetry`. |
+| `RUSH_DAEMON_COMPATIBLE_PLUGINS` | empty | Comma-separated `pluginName` values of configured Rush plugins that the repository has verified for long-lived daemon engines, in addition to plugins whose manifest sets `daemonCompatible`. Entries are trimmed; an empty entry is an error, and an empty value lists no plugins. Part of the daemon's environment identity. Overrides `compatiblePlugins`. See [Rush plugins in daemon engines](./dogfooding-rush-daemon.md#rush-plugins-in-daemon-engines). |
 | `RUSH_DAEMON_EXPERIMENTAL` | `0` | Enable the experimental `rush-client daemon graph` command surface. Does not start a daemon or enable builds; no corresponding `rush.json` property. |
 
 The timeout maximum is the signed 32-bit millisecond limit used by Node.js `setTimeout`,
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 73249df527..141749594b 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -45,9 +45,9 @@ import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
  * scheduling parameters (`--verbose`, `--parallelism`, `--timeline`) are applied per request instead.
  * Incompatible parameters,
  * environments, or graph inputs are rejected before scheduling; no request is retried automatically.
- * The initial supported surface excludes external plugins that participate in the requested command,
- * .env initialization, install/watch, event-hook scripts, and rushx/global commands. Use the unchanged
- * native CLI for those surfaces.
+ * The initial supported surface excludes external plugins that participate in the requested command
+ * (unless their manifest or the repository declares them daemon-compatible), .env initialization,
+ * install/watch, event-hook scripts, and rushx/global commands. Use the unchanged native CLI for those surfaces.
  * @beta
  */
 export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
@@ -195,6 +195,13 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     session: IWorkspaceSession
   ): Promise<void> {
     if (!session.initializeEngineAsync) throw new Error('This session cannot bind a native engine.');
+    if (command.unmatchedCompatiblePluginNames.length > 0) {
+      // The binding request's output also carries this warning; the launcher log keeps it for daemon diagnostics.
+      process.stderr.write(
+        `Warning: the daemon's compatible plugin list names plugins that are not configured in ` +
+          `rush-plugins.json: ${command.unmatchedCompatiblePluginNames.join(', ')}\n`
+      );
+    }
     await session.initializeEngineAsync(async (options) => {
       let engine: IPhasedCommandEngine;
       try {
diff --git a/libraries/rush-lib/assets/rush-init/rush.json b/libraries/rush-lib/assets/rush-init/rush.json
index 33fec40008..2e66256750 100644
--- a/libraries/rush-lib/assets/rush-init/rush.json
+++ b/libraries/rush-lib/assets/rush-init/rush.json
@@ -337,6 +337,8 @@
    * Warm-set policies require the generation-owned WorkspaceWarmSet host attachment.
    * They retain requested work without starting scripts and impose no hard process-RSS ceiling.
    * The watch option retains host observation of warm project files between requests, without running builds.
+   * The daemon serves a command that a configured Rush plugin participates in only if the plugin's manifest
+   * declares "daemonCompatible", or if "compatiblePlugins" lists the plugin's name. Otherwise it runs in-process.
    */
   /*[LINE "HYPOTHETICAL"]*/ "daemon": {
     /*[LINE "HYPOTHETICAL"]*/ "enabled": false,
@@ -348,7 +350,8 @@
     /*[LINE "HYPOTHETICAL"]*/ "warmIdleTimeoutSeconds": 300,
     /*[LINE "HYPOTHETICAL"]*/ "warmMemoryBudgetMB": 512,
     /*[LINE "HYPOTHETICAL"]*/ "warmSetMaxProjects": 20,
-    /*[LINE "HYPOTHETICAL"]*/ "autoWarmByTelemetry": false
+    /*[LINE "HYPOTHETICAL"]*/ "autoWarmByTelemetry": false,
+    /*[LINE "HYPOTHETICAL"]*/ "compatiblePlugins": []
   /*[LINE "HYPOTHETICAL"]*/ },
 
   /**
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 0869ebacb3..09c17f999d 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -32,6 +32,11 @@ export interface IDaemonConfigurationJson {
   readonly warmSetMaxProjects?: number;
   /** Prefer measured time-saved * frequency / resident-memory retention over LRU. Never starts scripts. Defaults to false. */
   readonly autoWarmByTelemetry?: boolean;
+  /**
+   * Names of configured Rush plugins (their `pluginName` in rush-plugins.json) that the repository has verified
+   * for long-lived daemon engines, in addition to plugins whose manifest sets `daemonCompatible`. Defaults to none.
+   */
+  readonly compatiblePlugins?: ReadonlyArray<string>;
 }
 
 const defaults: Required<IDaemonConfigurationJson> = {
@@ -44,7 +49,8 @@ const defaults: Required<IDaemonConfigurationJson> = {
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
   warmSetMaxProjects: 20,
-  autoWarmByTelemetry: false
+  autoWarmByTelemetry: false,
+  compatiblePlugins: Object.freeze([])
 };
 
 /** The exact recognized environment names. Unknown RUSH_DAEMON* names are rejected. @beta */
@@ -59,7 +65,8 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
     warmSetMaxProjects: 'RUSH_DAEMON_WARM_SET_MAX_PROJECTS',
-    autoWarmByTelemetry: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY'
+    autoWarmByTelemetry: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY',
+    compatiblePlugins: 'RUSH_DAEMON_COMPATIBLE_PLUGINS'
   });
 
 /**
@@ -101,10 +108,40 @@ export function resolveDaemonConfiguration(
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
     warmIdleTimeoutSeconds: numberOption('warmIdleTimeoutSeconds', json, environment),
     warmMemoryBudgetMB: numberOption('warmMemoryBudgetMB', json, environment),
-    warmSetMaxProjects: numberOption('warmSetMaxProjects', json, environment)
+    warmSetMaxProjects: numberOption('warmSetMaxProjects', json, environment),
+    compatiblePlugins: pluginNamesOption(json, environment)
   });
 }
 
+function pluginNamesOption(
+  json: IDaemonConfigurationJson,
+  environment: Readonly<Record<string, string | undefined>>
+): ReadonlyArray<string> {
+  const configured: unknown = json.compatiblePlugins;
+  if (
+    configured !== undefined &&
+    (!Array.isArray(configured) ||
+      configured.some((name: unknown) => typeof name !== 'string' || !isPluginName(name)))
+  ) {
+    throw new Error('daemon.compatiblePlugins must be an array of plugin names.');
+  }
+  const name: string = daemonEnvironmentVariables.compatiblePlugins;
+  const value: string | undefined = environment[name];
+  if (value === undefined) {
+    return configured ? Object.freeze([...(configured as string[])]) : defaults.compatiblePlugins;
+  }
+  // An empty value overrides rush.json with no plugins.
+  const names: string[] = value.trim() === '' ? [] : value.split(',').map((entry: string) => entry.trim());
+  if (!names.every(isPluginName)) {
+    throw new Error(`${name} must be a comma-separated list of plugin names.`);
+  }
+  return Object.freeze(names);
+}
+
+function isPluginName(name: string): boolean {
+  return name !== '' && name === name.trim() && !name.includes(',');
+}
+
 function booleanOption(
   key: 'enabled' | 'autoStart' | 'watch' | 'autoWarmByTelemetry' | 'usePersistentIpcRunners',
   json: IDaemonConfigurationJson,
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index b8f3357b17..00357ce7d2 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -286,6 +286,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_WARM_SET_MAX_PROJECTS: 'RUSH_DAEMON_WARM_SET_MAX_PROJECTS',
   /** Enables telemetry-weighted retention of requested work in an attached warm set. */
   RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY',
+  /** Overrides the plugins that the repository has verified for long-lived daemon engines. */
+  RUSH_DAEMON_COMPATIBLE_PLUGINS: 'RUSH_DAEMON_COMPATIBLE_PLUGINS',
   /** Gates the experimental graph client; requires host graph integration. */
   RUSH_DAEMON_EXPERIMENTAL: 'RUSH_DAEMON_EXPERIMENTAL'
 } as const;
@@ -697,6 +699,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_SET_MAX_PROJECTS:
           case EnvironmentVariableNames.RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY:
+          case EnvironmentVariableNames.RUSH_DAEMON_COMPATIBLE_PLUGINS:
           case EnvironmentVariableNames.RUSH_DAEMON_EXPERIMENTAL:
             // Validated together by resolveDaemonConfiguration().
             break;
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 707faae6ec..56940a44ca 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -4,7 +4,7 @@
 import * as path from 'node:path';
 
 import { FileSystem, LockFile } from '@rushstack/node-core-library';
-import type { ITerminalProvider } from '@rushstack/terminal';
+import { Terminal, type ITerminalProvider } from '@rushstack/terminal';
 import type { CommandLineAction } from '@rushstack/ts-command-line';
 
 import { RushCommandLineParser } from '../cli/RushCommandLineParser';
@@ -67,10 +67,13 @@ export interface IPhasedCommandEngineRequestSettings {
  *
  * @remarks
  * The initial engine surface deliberately rejects watch/install, event-hook scripts, .env files, and
- * external plugins that Rush would initialize for the command or whose command-line.json shapes it.
- * Those require request-scoped initialization and asynchronous disposal contracts before they can
- * safely run in a shared process. Plugins associated only with other commands are inert and permitted.
- * Native graph/cache plugins are not replaced.
+ * external plugins that Rush would initialize for the command or whose command-line.json shapes it, unless
+ * the plugin's manifest (`daemonCompatible`) or the repository (`daemon.compatiblePlugins`) declares that the
+ * plugin supports the engine lifecycle. An engine applies each plugin once and serves many requests: session
+ * hooks, `createOperationsAsync` (with every project and `isWatch` false) and `onGraphCreatedAsync` run once
+ * per engine, operation graph hooks run for each iteration (which can serve several coalesced requests), and
+ * disposal aborts `IOperationGraph.abortController` and then closes every operation runner. Plugins associated
+ * only with other commands are inert and permitted. Native graph/cache plugins are not replaced.
  * @alpha
  */
 export class PhasedCommandEngine {
@@ -80,12 +83,22 @@ export class PhasedCommandEngine {
 
   public readonly parameterIdentity: string;
   public readonly commandName: string;
+  /**
+   * Names listed by `daemon.compatiblePlugins` (or `RUSH_DAEMON_COMPATIBLE_PLUGINS`) that match no plugin
+   * configured in rush-plugins.json. They have no effect and are usually misspellings, so hosts should report them.
+   */
+  public readonly unmatchedCompatiblePluginNames: ReadonlyArray<string>;
 
-  private constructor(parser: RushCommandLineParser, action: PhasedScriptAction) {
+  private constructor(
+    parser: RushCommandLineParser,
+    action: PhasedScriptAction,
+    unmatchedCompatiblePluginNames: ReadonlyArray<string>
+  ) {
     this._parser = parser;
     this._action = action;
     this.commandName = action.actionName;
     this.parameterIdentity = action.getEngineParameterIdentity();
+    this.unmatchedCompatiblePluginNames = unmatchedCompatiblePluginNames;
   }
 
   public static async parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine> {
@@ -108,20 +121,38 @@ export class PhasedCommandEngine {
     if (!(action instanceof PhasedScriptAction) || !['build', 'rebuild'].includes(action.actionName)) {
       throw new Error('The production daemon engine currently supports native build and rebuild only.');
     }
+    const compatiblePluginNames: ReadonlySet<string> = new Set(rushConfiguration.daemon.compatiblePlugins);
+    const configuredPluginNames: ReadonlySet<string> = parser.pluginManager.configuredPluginNames;
+    const unmatchedCompatiblePluginNames: ReadonlyArray<string> = Array.from(compatiblePluginNames).filter(
+      (pluginName) => !configuredPluginNames.has(pluginName)
+    );
+    if (unmatchedCompatiblePluginNames.length > 0) {
+      new Terminal(terminalProvider).writeWarningLine(
+        `The daemon's compatible plugin list (rush.json "daemon.compatiblePlugins" or ` +
+          `RUSH_DAEMON_COMPATIBLE_PLUGINS) names plugins that are not configured in rush-plugins.json: ` +
+          `${unmatchedCompatiblePluginNames.map((pluginName) => `"${pluginName}"`).join(', ')}. ` +
+          `Check that each entry is the plugin's "pluginName".`
+      );
+    }
     // Plugins which the command would never initialize, and whose command-line.json does not shape
-    // this command, cannot affect a shared engine. Every other external plugin still requires native Rush.
-    const participatingPlugins: ReadonlyArray<string> = parser.pluginManager.getPluginsParticipatingInCommand(
+    // this command, cannot affect a shared engine. Every other external plugin must be declared compatible
+    // with the engine lifecycle; otherwise the command still requires native Rush.
+    const incompatiblePlugins: ReadonlyArray<string> = parser.pluginManager.getPluginsIncompatibleWithEngine(
       action.actionName,
-      action.schedulablePhaseNames
+      action.schedulablePhaseNames,
+      compatiblePluginNames
     );
-    if (participatingPlugins.length > 0) {
+    if (incompatiblePlugins.length > 0) {
       throw new Error(
-        `Daemon engine execution does not yet support Rush plugins that participate in "${action.actionName}": ` +
-          `${participatingPlugins.join('; ')}. Use --no-daemon.`
+        `Daemon engine execution does not support Rush plugins that participate in "${action.actionName}" ` +
+          `unless they are declared daemon-compatible: ${incompatiblePlugins.join('; ')}. A plugin declares this ` +
+          `with "daemonCompatible" in its rush-plugin-manifest.json; a repository can list plugins it has ` +
+          `verified in the rush.json "daemon.compatiblePlugins" setting or RUSH_DAEMON_COMPATIBLE_PLUGINS. ` +
+          `Use --no-daemon.`
       );
     }
     action.validateEngineCommand();
-    return new PhasedCommandEngine(parser, action);
+    return new PhasedCommandEngine(parser, action, unmatchedCompatiblePluginNames);
   }
 
   /**
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index a6ea56664e..5fa2acbe4c 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -20,6 +20,10 @@ export interface IWorkspaceInputFingerprint {
   readonly configurationHash: string;
   readonly environmentHash: string;
   readonly installationHash: string;
+  /**
+   * The Node.js executable and version, the running Rush package, the host's `runtimePaths`, and the installed
+   * package folder of every configured Rush plugin. A change requires a new process.
+   */
   readonly runtimeHash: string;
   readonly selectedRushVersion: string;
 }
@@ -264,7 +268,8 @@ export class WorkspaceRuntimeFingerprintCache {
   /** @internal */
   public _hashPaths(paths: ReadonlyArray<string>): string {
     const filenames: Set<string> = new Set();
-    for (const filename of paths) {
+    // Several configured plugins often come from one package, whose folder is walked only once.
+    for (const filename of new Set(paths)) {
       for (const file of listRuntimeFilesSync(filename)) filenames.add(file);
     }
     const entries: ReadonlyArray<string>[] = [];
@@ -399,6 +404,11 @@ export async function captureWorkspaceInputFingerprintAsync(
     path.join(packageFolder, 'dist'),
     ...(options.runtimePaths ?? [])
   ];
+  // A host loads plugins with require(), and Node.js never reloads a module, so a plugin's implementation is
+  // bound to the process that loaded it: an engine recreated in the same process would reuse the old code.
+  for (const pluginConfiguration of rushConfiguration._rushPluginsConfiguration.configuration.plugins) {
+    runtimePaths.push(AutoinstallerPluginLoader.getPluginPackageFolder(rushConfiguration, pluginConfiguration));
+  }
   const runtimeHash: string = (options.runtimeCache ?? new WorkspaceRuntimeFingerprintCache())._hashPaths(
     runtimePaths
   );
@@ -521,12 +531,16 @@ function isProcessBoundConfiguration(filename: string): boolean {
   );
 }
 
+// Declaration and ES module output, which a plugin's CommonJS entry point doesn't load. Listing them would only
+// slow down the synchronous walk that every request runs.
+const NON_RUNTIME_FOLDER_NAMES: ReadonlySet<string> = new Set(['node_modules', 'test', 'lib-dts', 'lib-esm']);
+
 function listRuntimeFilesSync(folderOrFile: string): string[] {
   try {
     if (!fsSync.statSync(folderOrFile).isDirectory()) return [folderOrFile];
     const files: string[] = [];
     for (const entry of fsSync.readdirSync(folderOrFile, { withFileTypes: true })) {
-      if (entry.name === 'node_modules' || entry.name === 'test') continue;
+      if (NON_RUNTIME_FOLDER_NAMES.has(entry.name)) continue;
       const filename: string = path.join(folderOrFile, entry.name);
       if (entry.isDirectory()) files.push(...listRuntimeFilesSync(filename));
       else if (/\.(?:js|cjs|mjs|json)$/.test(entry.name) && !entry.name.endsWith('.test.js'))
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index c2e46f39ad..fb16ad2fd5 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -52,7 +52,12 @@ describe('daemon configuration', () => {
     { warmMemoryBudgetMB: 0 },
     { warmSetMaxProjects: 0.5 },
     { autoWarmByTelemetry: 1 },
-    { usePersistentIpcRunners: 'true' }
+    { usePersistentIpcRunners: 'true' },
+    { compatiblePlugins: 'rush-example-plugin' },
+    { compatiblePlugins: [''] },
+    { compatiblePlugins: [' rush-example-plugin'] },
+    { compatiblePlugins: ['rush-a-plugin,rush-b-plugin'] },
+    { compatiblePlugins: [1] }
   ])('publishes schema rejection for %j', (daemon) => {
     const schema = JsonSchema.fromLoadedObject(schemaJson);
     expect(() =>
@@ -63,6 +68,55 @@ describe('daemon configuration', () => {
     ).toThrow();
   });
 
+  it('resolves compatible plugin names from the environment, then configuration, then no plugins', () => {
+    expect(resolveDaemonConfiguration({}, {}).compatiblePlugins).toEqual([]);
+    const configured: string[] = ['rush-a-plugin', 'rush-b-plugin'];
+    expect(resolveDaemonConfiguration({ compatiblePlugins: configured }, {}).compatiblePlugins).toEqual(
+      configured
+    );
+    expect(
+      resolveDaemonConfiguration(
+        { compatiblePlugins: configured },
+        { RUSH_DAEMON_COMPATIBLE_PLUGINS: ' rush-c-plugin , rush-d-plugin' }
+      ).compatiblePlugins
+    ).toEqual(['rush-c-plugin', 'rush-d-plugin']);
+    // An empty value is an explicit override that declares no plugins.
+    for (const value of ['', ' ']) {
+      expect(
+        resolveDaemonConfiguration({ compatiblePlugins: configured }, { RUSH_DAEMON_COMPATIBLE_PLUGINS: value })
+          .compatiblePlugins
+      ).toEqual([]);
+    }
+    const resolved: readonly string[] = resolveDaemonConfiguration(
+      { compatiblePlugins: configured },
+      {}
+    ).compatiblePlugins;
+    expect(Object.isFrozen(resolved)).toBe(true);
+    expect(resolved).not.toBe(configured);
+  });
+
+  it.each([',', 'rush-a-plugin,', 'rush-a-plugin,,rush-b-plugin', ' , rush-a-plugin'])(
+    'rejects compatible plugin override %j with an empty entry',
+    (value) => {
+      expect(() => resolveDaemonConfiguration({}, { RUSH_DAEMON_COMPATIBLE_PLUGINS: value })).toThrow(
+        'RUSH_DAEMON_COMPATIBLE_PLUGINS must be a comma-separated list of plugin names.'
+      );
+    }
+  );
+
+  it.each([
+    'rush-example-plugin',
+    [''],
+    [' rush-example-plugin'],
+    ['rush-a-plugin,rush-b-plugin'],
+    [1],
+    [null]
+  ])('rejects configured compatible plugins %j', (compatiblePlugins) => {
+    expect(() =>
+      resolveDaemonConfiguration({ compatiblePlugins: compatiblePlugins as unknown as string[] }, {})
+    ).toThrow('daemon.compatiblePlugins must be an array of plugin names.');
+  });
+
   it('accepts all valid knobs in the published schema', () => {
     JsonSchema.fromLoadedObject(schemaJson).validateObject(
       {
@@ -73,5 +127,14 @@ describe('daemon configuration', () => {
       },
       'rush.json'
     );
+    JsonSchema.fromLoadedObject(schemaJson).validateObject(
+      {
+        rushVersion: '5.179.0',
+        pnpmVersion: '10.27.0',
+        projects: [],
+        daemon: resolveDaemonConfiguration({ compatiblePlugins: ['rush-example-plugin'] }, {})
+      },
+      'rush.json'
+    );
   });
 });
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index 1faae1ece9..8b3f371b9b 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -5,7 +5,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
-import { NoOpTerminalProvider } from '@rushstack/terminal';
+import { NoOpTerminalProvider, StringBufferTerminalProvider } from '@rushstack/terminal';
 
 import { PhasedCommandEngine } from '../PhasedCommandEngine';
 import { RushConfiguration } from '../RushConfiguration';
@@ -13,11 +13,23 @@ import { RushConfiguration } from '../RushConfiguration';
 const PACKAGE_NAME: string = '@example/rush-example-plugin';
 const PLUGIN_NAME: string = 'rush-example-plugin';
 const PLUGIN_COMMAND: string = 'record-example';
+const OTHER_PLUGIN_NAME: string = 'rush-other-plugin';
+const COMPATIBLE_PLUGINS_VARIABLE: string = 'RUSH_DAEMON_COMPATIBLE_PLUGINS';
 
 interface IPluginFixture {
+  /** Defaults to PLUGIN_NAME. The plugin's package is `@example/<pluginName>`. */
+  readonly pluginName?: string;
   readonly associatedCommands?: string[];
   readonly commandLineJson?: object;
   readonly writeManifest?: boolean;
+  readonly daemonCompatible?: boolean;
+}
+
+interface IRepoFixture {
+  readonly plugins: ReadonlyArray<IPluginFixture>;
+  /** The rush.json `daemon.compatiblePlugins` setting. */
+  readonly compatiblePlugins?: string[];
+  readonly commandLineJson?: object;
 }
 
 // Mirrors the command-scoped plugin that rushstack configures in common/config/rush/rush-plugins.json.
@@ -34,6 +46,21 @@ const COMMAND_SCOPED_COMMAND_LINE_JSON: object = {
   ]
 };
 
+// A plugin that shapes the build phase, like odsp-web's fstrace plugin.
+const PHASE_SHAPING_COMMAND_LINE_JSON: object = {
+  ...COMMAND_SCOPED_COMMAND_LINE_JSON,
+  phases: [{ name: '_phase:build' }],
+  parameters: [
+    {
+      parameterKind: 'flag',
+      longName: '--example-flag',
+      description: 'An example flag.',
+      associatedCommands: [PLUGIN_COMMAND],
+      associatedPhases: ['_phase:build']
+    }
+  ]
+};
+
 const REPO_COMMAND_LINE_JSON: object = {
   commands: [
     {
@@ -48,45 +75,66 @@ const REPO_COMMAND_LINE_JSON: object = {
   phases: [{ name: '_phase:build', dependencies: { upstream: ['_phase:build'] } }]
 };
 
-function createRepo(plugin: IPluginFixture): string {
+function getPackageName(plugin: IPluginFixture): string {
+  return `@example/${plugin.pluginName ?? PLUGIN_NAME}`;
+}
+
+function createRepo(repo: IRepoFixture): string {
   const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-plugins-'));
   const write = (relativePath: string, json: object): void => {
     const filename: string = path.join(folder, relativePath);
     fs.mkdirSync(path.dirname(filename), { recursive: true });
     fs.writeFileSync(filename, JSON.stringify(json));
   };
-  write('rush.json', { rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] });
-  write('common/config/rush/command-line.json', REPO_COMMAND_LINE_JSON);
+  write('rush.json', {
+    rushVersion: '5.179.0',
+    pnpmVersion: '10.27.0',
+    projects: [],
+    ...(repo.compatiblePlugins ? { daemon: { compatiblePlugins: repo.compatiblePlugins } } : {})
+  });
+  write('common/config/rush/command-line.json', repo.commandLineJson ?? REPO_COMMAND_LINE_JSON);
   write('common/config/rush/rush-plugins.json', {
-    plugins: [{ packageName: PACKAGE_NAME, pluginName: PLUGIN_NAME, autoinstallerName: 'plugins' }]
+    plugins: repo.plugins.map((plugin) => ({
+      packageName: getPackageName(plugin),
+      pluginName: plugin.pluginName ?? PLUGIN_NAME,
+      autoinstallerName: 'plugins'
+    }))
   });
   write('common/autoinstallers/plugins/package.json', {
     name: 'plugins',
     version: '1.0.0',
     private: true,
-    dependencies: { [PACKAGE_NAME]: '1.0.0' }
+    dependencies: Object.fromEntries(repo.plugins.map((plugin) => [getPackageName(plugin), '1.0.0']))
   });
-  const storeFolder: string = `common/autoinstallers/plugins/rush-plugins/${PACKAGE_NAME}`;
-  if (plugin.writeManifest !== false) {
-    write(`${storeFolder}/rush-plugin-manifest.json`, {
-      plugins: [
-        {
-          pluginName: PLUGIN_NAME,
-          description: 'An example plugin.',
-          entryPoint: './lib/index.js',
-          associatedCommands: plugin.associatedCommands,
-          commandLineJsonFilePath: './command-line.json'
-        }
-      ]
-    });
-  }
-  if (plugin.commandLineJson) {
-    write(`${storeFolder}/${PLUGIN_NAME}/command-line.json`, plugin.commandLineJson);
+  for (const plugin of repo.plugins) {
+    const pluginName: string = plugin.pluginName ?? PLUGIN_NAME;
+    const storeFolder: string = `common/autoinstallers/plugins/rush-plugins/${getPackageName(plugin)}`;
+    if (plugin.writeManifest !== false) {
+      write(`${storeFolder}/rush-plugin-manifest.json`, {
+        plugins: [
+          {
+            pluginName,
+            description: 'An example plugin.',
+            entryPoint: './lib/index.js',
+            associatedCommands: plugin.associatedCommands,
+            commandLineJsonFilePath: './command-line.json',
+            daemonCompatible: plugin.daemonCompatible
+          }
+        ]
+      });
+    }
+    if (plugin.commandLineJson) {
+      write(`${storeFolder}/${pluginName}/command-line.json`, plugin.commandLineJson);
+    }
   }
   return folder;
 }
 
-async function parseBuildAsync(folder: string, argv: string[] = ['build']): Promise<PhasedCommandEngine> {
+async function parseBuildAsync(
+  folder: string,
+  argv: string[] = ['build'],
+  terminalProvider: NoOpTerminalProvider | StringBufferTerminalProvider = new NoOpTerminalProvider()
+): Promise<PhasedCommandEngine> {
   const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
     path.join(folder, 'rush.json')
   );
@@ -94,19 +142,28 @@ async function parseBuildAsync(folder: string, argv: string[] = ['build']): Prom
     argv,
     cwd: folder,
     rushConfiguration,
-    terminalProvider: new NoOpTerminalProvider()
+    terminalProvider
   });
 }
 
 describe(PhasedCommandEngine.name, () => {
   const folders: string[] = [];
-  function createTestRepo(plugin: IPluginFixture): string {
-    const folder: string = createRepo(plugin);
+  function createTestRepo(plugin: IPluginFixture, repo?: Omit<IRepoFixture, 'plugins'>): string {
+    return createMultiPluginTestRepo({ ...repo, plugins: [plugin] });
+  }
+  function createMultiPluginTestRepo(repo: IRepoFixture): string {
+    const folder: string = createRepo(repo);
     folders.push(folder);
     return folder;
   }
 
+  const originalCompatiblePlugins: string | undefined = process.env[COMPATIBLE_PLUGINS_VARIABLE];
   afterEach(() => {
+    if (originalCompatiblePlugins === undefined) {
+      delete process.env[COMPATIBLE_PLUGINS_VARIABLE];
+    } else {
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = originalCompatiblePlugins;
+    }
     for (const folder of folders.splice(0)) {
       fs.rmSync(folder, { recursive: true, force: true });
     }
@@ -132,8 +189,11 @@ describe(PhasedCommandEngine.name, () => {
   it('rejects an unassociated plugin, which Rush initializes for every command', async () => {
     const folder: string = createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON });
     await expect(parseBuildAsync(folder)).rejects.toThrow(
-      `Daemon engine execution does not yet support Rush plugins that participate in "build": ` +
-        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is initialized for every command. Use --no-daemon.`
+      `Daemon engine execution does not support Rush plugins that participate in "build" unless they are ` +
+        `declared daemon-compatible: "${PLUGIN_NAME}" (${PACKAGE_NAME}) is initialized for every command. ` +
+        `A plugin declares this with "daemonCompatible" in its rush-plugin-manifest.json; a repository can ` +
+        `list plugins it has verified in the rush.json "daemon.compatiblePlugins" setting or ` +
+        `RUSH_DAEMON_COMPATIBLE_PLUGINS. Use --no-daemon.`
     );
   });
 
@@ -177,19 +237,7 @@ describe(PhasedCommandEngine.name, () => {
   it('rejects a plugin parameter associated with a phase of the requested command', async () => {
     const folder: string = createTestRepo({
       associatedCommands: [PLUGIN_COMMAND],
-      commandLineJson: {
-        ...COMMAND_SCOPED_COMMAND_LINE_JSON,
-        phases: [{ name: '_phase:build' }],
-        parameters: [
-          {
-            parameterKind: 'flag',
-            longName: '--example-flag',
-            description: 'An example flag.',
-            associatedCommands: [PLUGIN_COMMAND],
-            associatedPhases: ['_phase:build']
-          }
-        ]
-      }
+      commandLineJson: PHASE_SHAPING_COMMAND_LINE_JSON
     });
     await expect(parseBuildAsync(folder)).rejects.toThrow(
       `"${PLUGIN_NAME}" (${PACKAGE_NAME}) associates "--example-flag" with the "_phase:build" phase`
@@ -202,4 +250,136 @@ describe(PhasedCommandEngine.name, () => {
       `"${PLUGIN_NAME}" (${PACKAGE_NAME}): its manifest could not be read`
     );
   });
+
+  describe('daemon-compatible declarations', () => {
+    // Associated with build and rebuild, and shapes a build phase and parameter, like odsp-web's fstrace plugin.
+    const BUILD_PLUGIN: IPluginFixture = {
+      associatedCommands: [PLUGIN_COMMAND, 'build', 'rebuild'],
+      commandLineJson: PHASE_SHAPING_COMMAND_LINE_JSON
+    };
+
+    async function expectAcceptedAsync(folder: string): Promise<void> {
+      for (const commandName of ['build', 'rebuild']) {
+        const command: PhasedCommandEngine = await parseBuildAsync(folder, [commandName]);
+        expect(command.commandName).toBe(commandName);
+        expect(command.unmatchedCompatiblePluginNames).toEqual([]);
+      }
+    }
+
+    it('reports every reason for an undeclared plugin', async () => {
+      const folder: string = createTestRepo(BUILD_PLUGIN);
+      const label: string = `"${PLUGIN_NAME}" (${PACKAGE_NAME})`;
+      await expect(parseBuildAsync(folder)).rejects.toThrow(
+        `${label} is associated with "build"; ${label} defines the "_phase:build" phase; ` +
+          `${label} associates "--example-flag" with the "_phase:build" phase. A plugin declares this`
+      );
+    });
+
+    it('accepts a plugin whose manifest declares it daemon-compatible', async () => {
+      await expectAcceptedAsync(createTestRepo({ ...BUILD_PLUGIN, daemonCompatible: true }));
+    });
+
+    it('accepts a plugin that rush.json declares daemon-compatible', async () => {
+      await expectAcceptedAsync(createTestRepo(BUILD_PLUGIN, { compatiblePlugins: [PLUGIN_NAME] }));
+    });
+
+    it('accepts a plugin that RUSH_DAEMON_COMPATIBLE_PLUGINS declares, overriding rush.json', async () => {
+      const folder: string = createTestRepo(BUILD_PLUGIN, { compatiblePlugins: [] });
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = ` ${PLUGIN_NAME} `;
+      await expectAcceptedAsync(folder);
+    });
+
+    it('lets an empty RUSH_DAEMON_COMPATIBLE_PLUGINS withdraw the rush.json declarations', async () => {
+      const folder: string = createTestRepo(BUILD_PLUGIN, { compatiblePlugins: [PLUGIN_NAME] });
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = '';
+      await expect(parseBuildAsync(folder)).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+      );
+    });
+
+    it('accepts a declared plugin that Rush initializes for every command', async () => {
+      await expectAcceptedAsync(
+        createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON, daemonCompatible: true })
+      );
+      await expectAcceptedAsync(
+        createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON }, { compatiblePlugins: [PLUGIN_NAME] })
+      );
+    });
+
+    it('still rejects an undeclared plugin next to a declared one, and reports only the undeclared one', async () => {
+      const folder: string = createMultiPluginTestRepo({
+        plugins: [BUILD_PLUGIN, { pluginName: OTHER_PLUGIN_NAME, associatedCommands: ['build'] }],
+        compatiblePlugins: [PLUGIN_NAME]
+      });
+      const error: Error | undefined = await parseBuildAsync(folder).then(
+        () => undefined,
+        (reason: Error) => reason
+      );
+      expect(error?.message).toContain(
+        `unless they are declared daemon-compatible: "${OTHER_PLUGIN_NAME}" (@example/${OTHER_PLUGIN_NAME}) ` +
+          `is associated with "build". A plugin declares this`
+      );
+      expect(error?.message).not.toContain(PLUGIN_NAME);
+    });
+
+    it('fails closed for a declared plugin whose manifest or command-line.json cannot be read', async () => {
+      await expect(
+        parseBuildAsync(createTestRepo({ writeManifest: false }, { compatiblePlugins: [PLUGIN_NAME] }))
+      ).rejects.toThrow(`"${PLUGIN_NAME}" (${PACKAGE_NAME}): its manifest could not be read`);
+      // The native parser also reads the file, and may fail first; either way, parsing fails.
+      await expect(
+        parseBuildAsync(
+          createTestRepo({ ...BUILD_PLUGIN, daemonCompatible: true, commandLineJson: { commands: 'invalid' } })
+        )
+      ).rejects.toThrow(/command-line\.json/);
+    });
+
+    it('keeps the parameters that a declared plugin reads in the engine parameter identity', async () => {
+      // odsp-web's fstrace plugin reads --fstrace-mode, which the repository's command-line.json defines.
+      const folder: string = createTestRepo(
+        { ...BUILD_PLUGIN, daemonCompatible: true },
+        {
+          commandLineJson: {
+            ...REPO_COMMAND_LINE_JSON,
+            parameters: [
+              {
+                parameterKind: 'choice',
+                longName: '--example-mode',
+                description: 'An example mode.',
+                associatedCommands: ['build'],
+                alternatives: [
+                  { name: 'on', description: 'On.' },
+                  { name: 'off', description: 'Off.' }
+                ],
+                defaultValue: 'on'
+              }
+            ]
+          }
+        }
+      );
+      const defaultIdentity: string = (await parseBuildAsync(folder)).parameterIdentity;
+      expect((await parseBuildAsync(folder)).parameterIdentity).toBe(defaultIdentity);
+      expect((await parseBuildAsync(folder, ['build', '--example-mode', 'off'])).parameterIdentity).not.toBe(
+        defaultIdentity
+      );
+    });
+
+    it('warns about declared names that match no configured plugin', async () => {
+      const folder: string = createTestRepo(
+        { ...BUILD_PLUGIN, daemonCompatible: true },
+        { compatiblePlugins: ['rush-exmaple-plugin', PLUGIN_NAME] }
+      );
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const command: PhasedCommandEngine = await parseBuildAsync(folder, ['build'], terminalProvider);
+      expect(command.unmatchedCompatiblePluginNames).toEqual(['rush-exmaple-plugin']);
+      expect(terminalProvider.getWarningOutput()).toContain(
+        'names plugins that are not configured in rush-plugins.json: "rush-exmaple-plugin".'
+      );
+      // A misspelled name does not declare the plugin that it was meant to name.
+      process.env[COMPATIBLE_PLUGINS_VARIABLE] = 'rush-exmaple-plugin';
+      await expect(parseBuildAsync(createTestRepo(BUILD_PLUGIN))).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+      );
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index e6496a515e..90f646331c 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -92,6 +92,91 @@ describe('workspace input fingerprints', () => {
     }
   });
 
+  it('restarts when the implementation of a configured plugin changes, including through a link', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write('rush.json', JSON.stringify({ rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] }));
+      write(
+        'common/config/rush/rush-plugins.json',
+        JSON.stringify({
+          plugins: [
+            { packageName: '@example/installed', pluginName: 'installed', autoinstallerName: 'plugins' },
+            { packageName: '@example/linked', pluginName: 'linked', autoinstallerName: 'plugins' }
+          ]
+        })
+      );
+      write('common/autoinstallers/plugins/package.json', '{"name":"plugins","version":"1.0.0"}');
+      write('common/autoinstallers/plugins/node_modules/@example/installed/lib/index.js', 'exports.v = 1;');
+      // Like a `link:` dependency, whose implementation is checked in outside node_modules.
+      write('common/autoinstallers/plugins/linked-plugin/release/index.js', 'exports.v = 1;');
+      fs.symlinkSync(
+        path.join(folder, 'common/autoinstallers/plugins/linked-plugin'),
+        path.join(folder, 'common/autoinstallers/plugins/node_modules/@example/linked'),
+        'junction'
+      );
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+
+      let previous: IWorkspaceInputFingerprint = await captureAsync();
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(WorkspaceInputChangeTier.Reuse);
+      for (const [relativePath, content] of [
+        ['common/autoinstallers/plugins/node_modules/@example/installed/lib/index.js', 'exports.v = 2;'],
+        ['common/autoinstallers/plugins/linked-plugin/release/index.js', 'exports.v = 2;'],
+        ['common/autoinstallers/plugins/linked-plugin/release/worker.js', 'exports.w = 1;']
+      ]) {
+        write(relativePath, content);
+        const next: IWorkspaceInputFingerprint = await captureAsync();
+        expect(classifyWorkspaceInputChange(previous, next)).toBe(WorkspaceInputChangeTier.Restart);
+        expect(runtimeCache.changedPaths).toContain(
+          path.join(
+            folder,
+            relativePath.replace('plugins/linked-plugin/', 'plugins/node_modules/@example/linked/')
+          )
+        );
+        previous = next;
+      }
+      // Files that Node.js never loads as plugin code do not restart the host.
+      write('common/autoinstallers/plugins/linked-plugin/README.md', 'Documentation');
+      write('common/autoinstallers/plugins/linked-plugin/lib-esm/index.js', 'export const v = 2;');
+      write('common/autoinstallers/plugins/linked-plugin/lib-dts/tsdoc-metadata.json', '{}');
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(WorkspaceInputChangeTier.Reuse);
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('reloads when rush.json declares daemon-compatible plugins', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const rushJsonPath: string = path.join(folder, 'rush.json');
+      const rushJson: object = { rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] };
+      fs.writeFileSync(rushJsonPath, JSON.stringify(rushJson));
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(rushJsonPath);
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      const captureAsync = (): Promise<IWorkspaceInputFingerprint> =>
+        captureWorkspaceInputFingerprintAsync({ rushConfiguration, runtimeCache, environment: {} });
+      const previous: IWorkspaceInputFingerprint = await captureAsync();
+      fs.writeFileSync(
+        rushJsonPath,
+        JSON.stringify({ ...rushJson, daemon: { compatiblePlugins: ['rush-example-plugin'] } })
+      );
+      expect(classifyWorkspaceInputChange(previous, await captureAsync())).toBe(
+        WorkspaceInputChangeTier.Reload
+      );
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
   it('ignores volatile per-shell variables but not engine, Node.js or tool resolution inputs', async () => {
     const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
     try {
@@ -142,6 +227,8 @@ describe('workspace input fingerprints', () => {
       }
       for (const relevant of [
         { FOO: '1' },
+        // Declaring a plugin daemon-compatible changes which plugins the engine applies.
+        { RUSH_DAEMON_COMPATIBLE_PLUGINS: 'rush-example-plugin' },
         { RUSH_BUILD_CACHE_ENABLED: '1' },
         { RUSH_BUILD_CACHE_WRITE_ALLOWED: '0' },
         { RUSH_DAEMON_WATCH: '1' },
diff --git a/libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts b/libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts
new file mode 100644
index 0000000000..192c572255
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/WorkspaceRuntimeWalk.test.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('node:fs', () => {
+  const actual: typeof import('node:fs') = jest.requireActual('node:fs');
+  return { ...actual, readdirSync: jest.fn(actual.readdirSync) };
+});
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { captureWorkspaceInputFingerprintAsync } from '../WorkspaceInputFingerprint';
+import { RushConfiguration } from '../RushConfiguration';
+
+describe('workspace runtime walk', () => {
+  it('walks a package folder that several configured plugins share only once per capture', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write('rush.json', JSON.stringify({ rushVersion: '5.179.0', pnpmVersion: '10.27.0', projects: [] }));
+      write(
+        'common/config/rush/rush-plugins.json',
+        JSON.stringify({
+          plugins: ['first', 'second', 'third'].map((pluginName: string) => ({
+            packageName: '@example/plugins',
+            pluginName,
+            autoinstallerName: 'plugins'
+          }))
+        })
+      );
+      const packageFolder: string = 'common/autoinstallers/plugins/node_modules/@example/plugins';
+      write(`${packageFolder}/release/first.js`, 'exports.v = 1;');
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+
+      const readdirSync: jest.Mock = fs.readdirSync as unknown as jest.Mock;
+      readdirSync.mockClear();
+      await captureWorkspaceInputFingerprintAsync({ rushConfiguration, environment: {} });
+      const walks: unknown[] = readdirSync.mock.calls.filter(
+        ([walked]: unknown[]) => walked === path.join(folder, packageFolder)
+      );
+      expect(walks).toHaveLength(1);
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts b/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts
index 8c464bcc6d..fb4ed3a438 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginLoader/AutoinstallerPluginLoader.ts
@@ -80,6 +80,18 @@ export class AutoinstallerPluginLoader extends PluginLoaderBase<IRushPluginConfi
     ];
   }
 
+  /**
+   * The installed package folder from which Rush loads a configured plugin's implementation
+   * (`common/autoinstallers/<name>/node_modules/<packageName>`). It may be a link to a folder elsewhere.
+   */
+  public static getPluginPackageFolder(
+    rushConfiguration: RushConfiguration,
+    pluginConfiguration: IRushPluginConfiguration
+  ): string {
+    const { autoinstallerName, packageName } = pluginConfiguration;
+    return path.join(rushConfiguration.commonAutoinstallersFolder, autoinstallerName, 'node_modules', packageName);
+  }
+
   public update(): void {
     const packageName: string = this.packageName;
     const pluginName: string = this.pluginName;
diff --git a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
index d9fd335af0..4c26791a62 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
@@ -30,6 +30,8 @@ export interface IRushPluginManifest {
   associatedCommands?: string[];
   commandLineJsonFilePath?: string;
   rushVersionRange?: string;
+  /** Declares that the plugin honors the long-lived daemon engine lifecycle. */
+  daemonCompatible?: boolean;
 }
 
 export interface IRushPluginManifestJson {
diff --git a/libraries/rush-lib/src/pluginFramework/PluginManager.ts b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
index 8321713a1a..2322d6f071 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginManager.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
@@ -10,7 +10,7 @@ import { BuiltInPluginLoader, type IBuiltInPluginConfiguration } from './PluginL
 import type { IRushPlugin } from './IRushPlugin';
 import { AutoinstallerPluginLoader } from './PluginLoader/AutoinstallerPluginLoader';
 import { _createRushSessionForPlugin, type RushSession } from './RushSession';
-import type { PluginLoaderBase } from './PluginLoader/PluginLoaderBase';
+import type { PluginLoaderBase, IRushPluginManifest } from './PluginLoader/PluginLoaderBase';
 import { Rush } from '../api/Rush';
 import type { RushGlobalFolder } from '../api/RushGlobalFolder';
 
@@ -123,6 +123,11 @@ export class PluginManager {
     return this.#loadedPluginNames;
   }
 
+  /** The `pluginName` of every plugin configured in rush-plugins.json, whether or not it has been loaded. */
+  public get configuredPluginNames(): ReadonlySet<string> {
+    return new Set(this.#autoinstallerPluginLoaders.map((pluginLoader) => pluginLoader.pluginName));
+  }
+
   public async updateAsync(): Promise<void> {
     await this._preparePluginAutoinstallersAsync(this.#autoinstallerPluginLoaders);
     const preparedAutoinstallerNames: Set<string> = new Set<string>();
@@ -201,35 +206,33 @@ export class PluginManager {
   }
 
   /**
-   * Explains why configured autoinstaller plugins could participate in the specified phased command.
+   * Explains why configured autoinstaller plugins prevent a long-lived engine from serving the specified
+   * phased command.
    *
    * @remarks
-   * A plugin is inert for the command only if Rush will neither initialize it (it is associated with
-   * specific commands, none of which is this command) nor use its command-line.json to define the
-   * command, a phase of the command, or a parameter associated with either. A manifest or command-line
-   * file that cannot be read is reported rather than assumed to be inert.
+   * A plugin is compatible with a long-lived engine if its manifest sets `daemonCompatible` or its name is in
+   * `compatiblePluginNames`. Any other plugin is inert for the command only if Rush will neither initialize it
+   * (it is associated with specific commands, none of which is this command) nor use its command-line.json to
+   * define the command, a phase of the command, or a parameter associated with either. A manifest or
+   * command-line file that cannot be read is reported rather than assumed to be compatible or inert.
    *
-   * @returns An empty array if every configured autoinstaller plugin is inert for the command.
+   * @returns An empty array if every configured autoinstaller plugin is compatible with, or inert for, the command.
    */
-  public getPluginsParticipatingInCommand(
+  public getPluginsIncompatibleWithEngine(
     commandName: string,
-    phaseNames: ReadonlySet<string>
+    phaseNames: ReadonlySet<string>,
+    compatiblePluginNames: ReadonlySet<string>
   ): ReadonlyArray<string> {
     const reasons: string[] = [];
     for (const pluginLoader of this.#autoinstallerPluginLoaders) {
       const pluginLabel: string = `"${pluginLoader.pluginName}" (${pluginLoader.packageName})`;
-      let associatedCommands: ReadonlyArray<string> | undefined;
+      let manifest: IRushPluginManifest;
       try {
-        associatedCommands = pluginLoader.pluginManifest.associatedCommands;
+        manifest = pluginLoader.pluginManifest;
       } catch (error) {
         reasons.push(`${pluginLabel}: its manifest could not be read: ${(error as Error).message}`);
         continue;
       }
-      if (!associatedCommands) {
-        reasons.push(`${pluginLabel} is initialized for every command`);
-      } else if (associatedCommands.includes(commandName)) {
-        reasons.push(`${pluginLabel} is associated with "${commandName}"`);
-      }
 
       let commandLineConfiguration: CommandLineConfiguration | undefined;
       try {
@@ -238,6 +241,16 @@ export class PluginManager {
         reasons.push(`${pluginLabel}: its command-line.json could not be read: ${(error as Error).message}`);
         continue;
       }
+      if (manifest.daemonCompatible || compatiblePluginNames.has(pluginLoader.pluginName)) {
+        continue;
+      }
+
+      const { associatedCommands } = manifest;
+      if (!associatedCommands) {
+        reasons.push(`${pluginLabel} is initialized for every command`);
+      } else if (associatedCommands.includes(commandName)) {
+        reasons.push(`${pluginLabel} is associated with "${commandName}"`);
+      }
       if (!commandLineConfiguration) {
         continue;
       }
diff --git a/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json b/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
index 43cfaf13b7..2a37a30e76 100644
--- a/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
+++ b/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
@@ -46,6 +46,10 @@
             "description": "Specifies the semver range of Rush versions supported by this plugin.",
             "type": "string",
             "minLength": 1
+          },
+          "daemonCompatible": {
+            "description": "If true, the plugin declares that it works in a long-lived Rush daemon engine, where one applied instance serves many requests: its session hooks and createOperationsAsync run once per engine (with isWatch false), and its operation graph hooks run for each iteration. Such a plugin does not change process globals (such as process.env, process.exitCode, the working directory or global timers), keeps no per-request state in the process, never prompts, reads the operation environment rather than the daemon's process.env, and releases its resources when the engine is disposed. Without it, the daemon runs commands that the plugin participates in with in-process Rush, unless the repository lists the plugin in the rush.json \"daemon.compatiblePlugins\" setting.",
+            "type": "boolean"
           }
         }
       }
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 980113494a..b702606300 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -311,6 +311,15 @@
           "type": "boolean",
           "default": false,
           "description": "Prefer measured time-saved * frequency / resident-memory retention over LRU. Never starts unrequested scripts. RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY overrides."
+        },
+        "compatiblePlugins": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[^\\s,](?:[^,]*[^\\s,])?$"
+          },
+          "default": [],
+          "description": "Names of configured Rush plugins (their pluginName in rush-plugins.json) that this repository has verified for long-lived daemon engines, in addition to plugins whose manifest sets daemonCompatible. A daemon request for a command that any other configured plugin participates in runs with in-process Rush. RUSH_DAEMON_COMPATIBLE_PLUGINS (a comma-separated list) overrides."
         }
       }
     },

From 78b29c21557553fbcf1a109b0ea59b518badff89 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:23:19 +0000
Subject: [PATCH 020/265] [rush-daemon] Abort a shared iteration's leftover
 work once no remaining client needs it

Swarm integration step 5; original commit 02f83a99ae (merge of swarm/r05 at bd7ac88caa).
Refs: board 207.



Commits folded into this step (1):
- bd7ac88caa [rush-daemon] Abort a shared iteration's leftover work once no remaining client needs it (board 207)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...m-r05-cancel-orphans_2026-09-28-13-14.json |  10 ++
 libraries/rush-daemon/README.md               |   5 +-
 .../rush-daemon/src/PhasedIterationDemand.ts  |  93 +++++++++++
 .../src/PhasedRequestEventMultiplexer.ts      |   2 +-
 .../rush-daemon/src/PhasedRequestEventSink.ts |   2 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  40 ++++-
 .../src/test/PhasedIterationDemand.test.ts    | 158 ++++++++++++++++++
 .../src/test/PhasedRequestBatching.test.ts    |   4 +-
 .../test/PhasedRequestCancellation.test.ts    | 119 +++++++++++++
 9 files changed, 427 insertions(+), 6 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-cancel-orphans_2026-09-28-13-14.json
 create mode 100644 libraries/rush-daemon/src/PhasedIterationDemand.ts
 create mode 100644 libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-cancel-orphans_2026-09-28-13-14.json b/common/changes/@rushstack/rush-daemon/swarm-r05-cancel-orphans_2026-09-28-13-14.json
new file mode 100644
index 0000000000..7cc8049401
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-cancel-orphans_2026-09-28-13-14.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Cancellation: when a client leaves a shared iteration, the daemon aborts the iteration as soon as every operation a remaining client needs has finished, so work that only the departed client needed is never started (or is terminated) instead of delaying the remaining client's result and every later request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 2e489bbb43..4cadfb0bda 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -484,7 +484,10 @@ remaining clients. The last client that still needs the iteration receives its r
 release, as for a single client. An early result is not published when any of the client's operations was aborted;
 iteration-wide failures that occur after an early result are reported only to the remaining clients. Requests
 admitted after scheduling starts form a later batch. Cancelling or disconnecting one client removes its subscription without aborting work needed by other
-clients; the graph iteration is aborted only after every client in that batch has stopped needing it.
+clients; the graph iteration is aborted once every client in that batch has stopped needing it, or once every
+operation that a remaining client needs has finished while work that only departed clients needed has not. In the
+latter case unstarted operations never start and running ones are terminated, so neither the remaining client's
+result nor later requests wait for work that nobody needs.
 
 The typed phased router remains separate from native initialization. `ProductionDaemonRequestResolver` supplies
 validated exact selections from `PhasedCommandEngine`; other integrations retain the existing dependency-closure
diff --git a/libraries/rush-daemon/src/PhasedIterationDemand.ts b/libraries/rush-daemon/src/PhasedIterationDemand.ts
new file mode 100644
index 0000000000..2349b884e8
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedIterationDemand.ts
@@ -0,0 +1,93 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationExecutionResult, Operation } from '@microsoft/rush-lib';
+
+import type { IRequestEventSink } from './PhasedRequestEventMultiplexer';
+import { TERMINAL_OPERATION_STATUSES } from './PhasedRequestEventSink';
+
+/**
+ * Tracks whether the unfinished work of a shared iteration is still needed by one of the batch's remaining clients.
+ *
+ * @remarks
+ * A batch arms the tracker when a participating client leaves (cancellation or output failure) while other
+ * participants remain. From then on, the tracker reports the iteration as abandoned, exactly once, as soon as every
+ * operation that a remaining client needs has reached a terminal status while enabled operations that only departed
+ * clients needed are still unfinished. Disabled operations finish without running anything, so they alone never
+ * make an iteration abandoned.
+ *
+ * The tracker observes status changes rather than completion events: the graph dispatches an operation's dependents
+ * before that operation's completion event, so aborting on completion could start a process only to terminate it.
+ */
+export class PhasedIterationDemand implements IRequestEventSink {
+  readonly #onAbandoned: () => void;
+  readonly #unfinished: Set<IOperationExecutionResult> = new Set();
+  #abandoned: boolean = false;
+  #needed: ReadonlySet<Operation> | undefined;
+  #neededUnfinished: number = 0;
+
+  public constructor(onAbandoned: () => void) {
+    this.#onAbandoned = onAbandoned;
+  }
+
+  /** Whether the iteration was reported as abandoned. */
+  public get abandoned(): boolean {
+    return this.#abandoned;
+  }
+
+  /**
+   * Arms the tracker with, or narrows it to, the operations that the remaining clients still need.
+   */
+  public restrictTo(neededOperations: Iterable<Operation>): void {
+    this.#needed = new Set(neededOperations);
+    this.#countNeededUnfinished();
+    this.#evaluate();
+  }
+
+  public onIterationScheduled(records: Iterable<IOperationExecutionResult>): void {
+    this.#unfinished.clear();
+    for (const record of records) {
+      if (!TERMINAL_OPERATION_STATUSES.has(record.status)) {
+        this.#unfinished.add(record);
+      }
+    }
+    this.#countNeededUnfinished();
+    this.#evaluate();
+  }
+
+  public onOperationStatusChanged(record: IOperationExecutionResult): void {
+    if (!TERMINAL_OPERATION_STATUSES.has(record.status) || !this.#unfinished.delete(record)) {
+      return;
+    }
+    if (this.#needed?.has(record.operation)) {
+      this.#neededUnfinished--;
+      this.#evaluate();
+    }
+  }
+
+  #countNeededUnfinished(): void {
+    let neededUnfinished: number = 0;
+    if (this.#needed) {
+      for (const record of this.#unfinished) {
+        if (this.#needed.has(record.operation)) {
+          neededUnfinished++;
+        }
+      }
+    }
+    this.#neededUnfinished = neededUnfinished;
+  }
+
+  #evaluate(): void {
+    if (this.#abandoned || !this.#needed || this.#neededUnfinished > 0) {
+      return;
+    }
+    // Every unfinished operation is now one that no remaining client needs.
+    for (const record of this.#unfinished) {
+      if (record.enabled) {
+        this.#abandoned = true;
+        this.#onAbandoned();
+        return;
+      }
+    }
+  }
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
index 25f7850339..39991db255 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
@@ -9,7 +9,7 @@ import type {
 } from '@microsoft/rush-lib';
 import type { ITerminalChunk } from '@rushstack/terminal';
 
-interface IRequestEventSink extends _IOperationGraphEventSink {
+export interface IRequestEventSink extends _IOperationGraphEventSink {
   onIterationScheduled(records: Iterable<IOperationExecutionResult>): void;
 }
 
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index d4a315526f..0fc35cbf01 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -29,7 +29,7 @@ const EVENT_SOURCE_PACKAGE: string = '@microsoft/rush-lib';
 const EVENT_SOURCE_COMPONENT: string = 'OperationGraph';
 const TEXT_ENCODER: InstanceType<typeof TextEncoder> = new TextEncoder();
 // Mirrors rush-lib's TERMINAL_STATUSES, which is not part of its public API.
-const TERMINAL_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
+export const TERMINAL_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Success,
   OperationStatus.SuccessWithWarning,
   OperationStatus.Skipped,
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index b132616378..76ccbba728 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -20,6 +20,7 @@ import type {
 
 import { PhasedRequestEventSink } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
+import { PhasedIterationDemand } from './PhasedIterationDemand';
 import { writePhasedRequestSummary } from './PhasedRequestSummary';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
@@ -244,6 +245,8 @@ class PhasedRequestBatchCoordinator {
   readonly #abortErrors: unknown[] = [];
   #abortTail: Promise<void> = Promise.resolve();
   #acceptingCurrentBatch: boolean = false;
+  /** Set while the current batch's iteration may execute; see `#restrictBatchDemand`. */
+  #batchDemand: PhasedIterationDemand | undefined;
   #currentBatch: ReadonlyArray<IBatchEntry> | undefined;
   #drainScheduled: boolean = false;
   #nextGraphLeasePromise: Promise<IRequestLease> | undefined;
@@ -434,6 +437,9 @@ class PhasedRequestBatchCoordinator {
           this.#finishDetachedEntry(entry);
         }
       }
+      const demand: PhasedIterationDemand = new PhasedIterationDemand(() => this.#onBatchAbandoned(demand));
+      this.#batchDemand = demand;
+      const unsubscribeDemand: () => void = this.#multiplexer.subscribe(demand);
       for (const entry of participants) {
         entry.participated = true;
         const activeOperationIds: ReadonlySet<string> = new Set(
@@ -472,7 +478,7 @@ class PhasedRequestBatchCoordinator {
             })
           );
           const executionPromise: Promise<boolean> = this.#graph.executeScheduledIterationAsync();
-          if (!participants.some((entry: IBatchEntry) => this.#needsIteration(entry))) {
+          if (!participants.some((entry: IBatchEntry) => this.#needsIteration(entry)) || demand.abandoned) {
             // Let executeScheduledIterationAsync promote the scheduled iteration before aborting it.
             await Promise.resolve();
             this.#requestIterationAbort();
@@ -494,6 +500,8 @@ class PhasedRequestBatchCoordinator {
           }
         }
       } finally {
+        this.#batchDemand = undefined;
+        unsubscribeDemand();
         for (const entry of participants) {
           entry.unsubscribe?.();
           entry.unsubscribe = undefined;
@@ -551,6 +559,9 @@ class PhasedRequestBatchCoordinator {
     ) {
       // Other live participants still need the shared work: detach this client and answer it now.
       this.#finishDetachedEntry(entry);
+      if (entry.participated) {
+        this.#restrictBatchDemand();
+      }
       return;
     }
 
@@ -580,6 +591,30 @@ class PhasedRequestBatchCoordinator {
     });
   }
 
+  /**
+   * Narrows the running iteration to the remaining participants' selections after a participant left it.
+   *
+   * @remarks
+   * The departed client's selection stays merged into the iteration, so without this the last remaining
+   * participant would wait for, and queued requests would queue behind, work that only the departed client needed.
+   * Once every operation a remaining participant needs has finished, the iteration is aborted instead: operations
+   * that have not started are never started, and running ones are terminated, as when every client cancels.
+   */
+  #restrictBatchDemand(): void {
+    this.#batchDemand?.restrictTo(
+      (this.#currentBatch ?? []).flatMap((candidate: IBatchEntry) =>
+        this.#needsIteration(candidate) ? candidate.selection.activeOperations : []
+      )
+    );
+  }
+
+  #onBatchAbandoned(demand: PhasedIterationDemand): void {
+    // Before the iteration starts executing, `#executeBatchAsync` aborts it once it has been promoted.
+    if (this.#batchDemand === demand && this.#graph.status === OperationStatus.Executing) {
+      this.#requestIterationAbort();
+    }
+  }
+
   #isEntryLive(entry: IBatchEntry): boolean {
     return !entry.abortRequested && !entry.client.abortSignal.aborted && entry.outputError === undefined;
   }
@@ -614,7 +649,8 @@ class PhasedRequestBatchCoordinator {
    * The sink invokes this after the operations' final events and log chunks were enqueued, and `#finishEntryAsync`
    * drains them before writing the result. The iteration, graph lease and execution lease stay owned by the batch.
    * The last participant that needs the iteration keeps the ordinary contract: its result follows iteration end
-   * and execution lease release, so single-client requests and warm-state retention are unchanged.
+   * and execution lease release, so single-client requests and warm-state retention are unchanged. When other
+   * participants left the batch, `#restrictBatchDemand` makes that end prompt by aborting work only they needed.
    */
   #finishSettledEntry(entry: IBatchEntry): void {
     if (
diff --git a/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
new file mode 100644
index 0000000000..476d3d4c62
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
@@ -0,0 +1,158 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationExecutionResult, Operation } from '@microsoft/rush-lib';
+import { OperationStatus } from '@microsoft/rush-lib';
+
+import { PhasedIterationDemand } from '../PhasedIterationDemand';
+
+interface ITestRecord {
+  readonly enabled: boolean;
+  readonly operation: Operation;
+  status: OperationStatus;
+}
+
+function createRecord(name: string, enabled: boolean = true): ITestRecord {
+  return { enabled, operation: { name } as unknown as Operation, status: OperationStatus.Waiting };
+}
+
+function asResult(record: ITestRecord): IOperationExecutionResult {
+  return record as unknown as IOperationExecutionResult;
+}
+
+interface ITestDemand {
+  readonly abandonedCount: () => number;
+  readonly demand: PhasedIterationDemand;
+  readonly schedule: (...records: ReadonlyArray<ITestRecord>) => void;
+  readonly setStatus: (record: ITestRecord, status: OperationStatus) => void;
+}
+
+function createDemand(): ITestDemand {
+  let abandonedCount: number = 0;
+  const demand: PhasedIterationDemand = new PhasedIterationDemand(() => abandonedCount++);
+  return {
+    abandonedCount: () => abandonedCount,
+    demand,
+    schedule: (...records: ReadonlyArray<ITestRecord>) => demand.onIterationScheduled(records.map(asResult)),
+    setStatus: (record: ITestRecord, status: OperationStatus) => {
+      record.status = status;
+      demand.onOperationStatusChanged(asResult(record));
+    }
+  };
+}
+
+describe(PhasedIterationDemand.name, () => {
+  it('never reports an iteration abandoned until it is armed', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const other: ITestRecord = createRecord('other');
+    schedule(needed, other);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(0);
+    expect(demand.abandoned).toBe(false);
+  });
+
+  it('reports abandonment once, when the needed work finishes before enabled unneeded work', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const running: ITestRecord = createRecord('running');
+    const waiting: ITestRecord = createRecord('waiting');
+    schedule(needed, running, waiting);
+    demand.restrictTo([needed.operation]);
+    setStatus(running, OperationStatus.Executing);
+    setStatus(needed, OperationStatus.Executing);
+    expect(abandonedCount()).toBe(0);
+
+    setStatus(needed, OperationStatus.Success);
+    expect(abandonedCount()).toBe(1);
+    expect(demand.abandoned).toBe(true);
+
+    setStatus(running, OperationStatus.Aborted);
+    setStatus(waiting, OperationStatus.Aborted);
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('does not report abandonment when unneeded work finishes first', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const other: ITestRecord = createRecord('other');
+    schedule(needed, other);
+    demand.restrictTo([needed.operation]);
+
+    setStatus(other, OperationStatus.Success);
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(0);
+  });
+
+  it('ignores unfinished records that are disabled, since they run nothing', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    schedule(needed, createRecord('disabled', false));
+    demand.restrictTo([needed.operation]);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(0);
+  });
+
+  it('counts only the first terminal status of an iteration record', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const first: ITestRecord = createRecord('first');
+    const second: ITestRecord = createRecord('second');
+    schedule(first, second, createRecord('unneeded'));
+    demand.restrictTo([first.operation, second.operation]);
+
+    setStatus(first, OperationStatus.Success);
+    // For example, a failing cache write after the operation succeeded.
+    setStatus(first, OperationStatus.Failure);
+    // A record outside the iteration, such as a retained result that is invalidated, is ignored.
+    demand.onOperationStatusChanged(asResult({ ...second, status: OperationStatus.Success }));
+    expect(abandonedCount()).toBe(0);
+
+    setStatus(second, OperationStatus.Blocked);
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('reports abandonment at once when it is armed after the needed work finished', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    schedule(needed, createRecord('unneeded'));
+    setStatus(needed, OperationStatus.FromCache);
+    expect(abandonedCount()).toBe(0);
+
+    demand.restrictTo([needed.operation]);
+
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('narrows to the remaining clients when another client leaves', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const small: ITestRecord = createRecord('small');
+    const large: ITestRecord = createRecord('large');
+    schedule(small, large, createRecord('departed'));
+    demand.restrictTo([small.operation, large.operation]);
+    setStatus(small, OperationStatus.Success);
+    expect(abandonedCount()).toBe(0);
+
+    demand.restrictTo([small.operation]);
+
+    expect(abandonedCount()).toBe(1);
+  });
+
+  it('applies an arming that precedes scheduling, and treats records that are already terminal as finished', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const alreadyFinished: ITestRecord = createRecord('already-finished');
+    alreadyFinished.status = OperationStatus.Success;
+    demand.restrictTo([needed.operation, alreadyFinished.operation]);
+    schedule(needed, alreadyFinished, createRecord('unneeded'));
+    expect(abandonedCount()).toBe(0);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(abandonedCount()).toBe(1);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index aab404064f..bca1bde260 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -476,12 +476,14 @@ describe('shared phased request batching', () => {
     const abortCallCountBeforeCancellation: number = abortSpy.mock.calls.length;
 
     cancelledClient.abortController.abort();
+    // The continuing client still needs its running operation, so the cancellation itself aborts nothing. Once that
+    // operation finishes, work that only the cancelled client needed may be aborted (PhasedRequestCancellation.test).
+    expect(abortSpy).toHaveBeenCalledTimes(abortCallCountBeforeCancellation);
     releaseOperation.resolve();
     const [cancelledResult, continuingResult] = await Promise.all([cancelled, continuing]);
 
     expect(cancelledResult).toMatchObject({ aborted: true, outcome: 'aborted' });
     expect(continuingResult).toMatchObject({ exitCode: 0, outcome: 'success' });
-    expect(abortSpy).toHaveBeenCalledTimes(abortCallCountBeforeCancellation);
     expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
   });
 
diff --git a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
index 7642e99cb4..44c3358cd4 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
@@ -16,7 +16,23 @@ import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
 
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
 const PROMPT_CANCELLATION_MS: number = 1000;
+const TIMED_OUT: 'timed out' = 'timed out';
+
+async function raceWithTimeoutAsync<T>(promise: Promise<T>, timeoutMs: number): Promise<T | typeof TIMED_OUT> {
+  let timer: NodeJS.Timeout | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<typeof TIMED_OUT>((resolve) => {
+        timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 function createRequest(requestId: string, operationId: string): IDaemonPhasedRequest {
   return {
@@ -186,4 +202,107 @@ describe('phased request client cancellation', () => {
     hanging.release();
     expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
   });
+
+  it('never starts work that only a cancelled client needed once the remaining client has its operations', async () => {
+    const { hanging: shared, actionAsync: sharedActionAsync } = createHangingOperation();
+    const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();
+    // The cancelled client needs A, then B, then C. The remaining client needs only A.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, sharedActionAsync)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Success, orphanActionAsync)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ]),
+      [
+        [OPERATION_B, OPERATION_A],
+        [OPERATION_C, OPERATION_B]
+      ],
+      { supportsTerminateRunning: true }
+    );
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_C),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    await shared.started;
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+    // The remaining client still needs the running shared operation.
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+
+    const releasedAt: number = Date.now();
+    shared.release();
+    const result: IDaemonPhasedRequestResult | typeof TIMED_OUT = await raceWithTimeoutAsync(
+      continuing,
+      PROMPT_CANCELLATION_MS
+    );
+    // Lets an iteration that started the abandoned work finish, so a failure below is reported cleanly.
+    orphan.release();
+
+    expect(result).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(Date.now() - releasedAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success })
+    ]);
+    expect(abortSpy).toHaveBeenCalledWith({ terminateRunning: true });
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(0);
+    // The remaining client's result stays warm; the abandoned operations are not retained.
+    expect(new Set([...fixture.graph.resultByOperation.keys()].map(({ name }) => name))).toEqual(
+      new Set([OPERATION_A])
+    );
+  });
+
+  it('terminates running work that only a cancelled client needed once the remaining client has its operations', async () => {
+    const { hanging: remaining, actionAsync: remainingActionAsync } = createHangingOperation();
+    const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, remainingActionAsync)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Success, orphanActionAsync)]
+      ]),
+      [],
+      { supportsTerminateRunning: true }
+    );
+    fixture.graph.parallelism = 2;
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_B),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    await Promise.all([remaining.started, orphan.started]);
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+    // While the remaining client's operation runs, the iteration is left alone.
+    expect(orphan.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
+
+    const releasedAt: number = Date.now();
+    remaining.release();
+    const result: IDaemonPhasedRequestResult | typeof TIMED_OUT = await raceWithTimeoutAsync(
+      continuing,
+      PROMPT_CANCELLATION_MS
+    );
+    orphan.release();
+
+    expect(result).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(Date.now() - releasedAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success })
+    ]);
+    expect(orphan.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([true]);
+    await orphan.terminated;
+  });
 });

From cf3ff0106a2d5c74ace62b7dbcfe1829432bd11f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:47:41 +0000
Subject: [PATCH 021/265] [rush-lib] Run the initial script for every command
 outside watch mode

Swarm integration step 6; original commit 519ae33c8d.
Refs: task 50, board 115.

ShellOperationRunner runs a phase's `:incremental` script whenever the operation
has a last state. Native `rush build` executes one iteration, so only watch mode
ever had one, and watch mode turns cache writes off. rushd keeps one operation
graph across requests, so from its second request on a daemon `build` ran
`_phase:build:incremental` (in odsp-web, `heft run --only build --` without
--clean) with cache writes on. Outputs of a deleted or renamed source file stayed
in lib/ and were cached under the key native Rush computes for the clean build,
so later native builds restored them (t04 board 115, board 450).

ShellOperationRunnerPlugin now sets the incremental command only in watch mode.
Every other command runs the initial script, exactly as a single `rush build`
does, which is option (a) of task 50. Native `rush build` is unchanged (it never
has a last state) and watch mode keeps `:incremental` with writes off.

Tests: a rush-lib unit test runs a repeated operation with and without watch
mode, and a daemon integration test runs three warm builds of a project with an
`:incremental` script. Before the fix the second daemon build logged
"Invoking (incremental): node build.cjs --incremental" followed by
"Successfully set cache entry".

(cherry picked from commit e382d2ac80f881451b7d527ea9a97e3037880923)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...script-outside-watch_2026-09-28-14-05.json | 11 +++
 ...script-outside-watch_2026-09-28-14-05.json | 11 +++
 .../ProductionDaemonRequestResolver.test.ts   | 33 ++++++-
 .../operations/ShellOperationRunnerPlugin.ts  | 14 ++-
 .../test/ShellOperationRunnerPlugin.test.ts   | 94 ++++++++++++++++++-
 5 files changed, 155 insertions(+), 8 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/initial-script-outside-watch_2026-09-28-14-05.json
 create mode 100644 common/changes/@rushstack/rush-daemon/initial-script-outside-watch_2026-09-28-14-05.json

diff --git a/common/changes/@microsoft/rush/initial-script-outside-watch_2026-09-28-14-05.json b/common/changes/@microsoft/rush/initial-script-outside-watch_2026-09-28-14-05.json
new file mode 100644
index 0000000000..f5dedf2dae
--- /dev/null
+++ b/common/changes/@microsoft/rush/initial-script-outside-watch_2026-09-28-14-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Run a phase's `:incremental` script only for repeated watch-mode iterations. A long-lived host that runs separate commands on one operation graph now runs the initial script, as a single `rush build` does, so outputs of deleted inputs are not kept or written to the build cache.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/initial-script-outside-watch_2026-09-28-14-05.json b/common/changes/@rushstack/rush-daemon/initial-script-outside-watch_2026-09-28-14-05.json
new file mode 100644
index 0000000000..3086d1cb95
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/initial-script-outside-watch_2026-09-28-14-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that every warm daemon build request runs the initial script of an operation, as native `rush build` does.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index dd82aa7c09..704df32f27 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -77,6 +77,8 @@ interface IFixtureOptions {
   readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
   readonly onSessionCreated?: (session: WorkspaceSession) => void;
   readonly resolver?: IDaemonRequestResolver;
+  /** Adds the watch-only `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
+  readonly incrementalScript?: boolean;
 }
 
 class DecoratedTestResolver implements IDaemonRequestResolver {
@@ -189,7 +191,12 @@ async function createFixtureAsync(
       JSON.stringify({
         name,
         version: '1.0.0',
-        scripts: { '_phase:compile': 'node build.cjs' },
+        scripts: {
+          '_phase:compile': 'node build.cjs',
+          ...(options.incrementalScript
+            ? { '_phase:compile:incremental': 'node build.cjs --incremental' }
+            : {})
+        },
         dependencies: name === 'b' ? { a: '1.0.0' } : {}
       })
     );
@@ -1403,6 +1410,30 @@ process.exit(23);
     }
   });
 
+  it('runs the initial script for every warm build request, as native rush build does, not the watch-only one', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', { incrementalScript: true });
+    try {
+      for (const [requestId, input] of [
+        ['initial-script-1', 'one'],
+        ['initial-script-2', 'two'],
+        ['initial-script-3', 'three']
+      ]) {
+        fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), input);
+        const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'a']);
+        expect(exchange.terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status: 'SUCCESS' }] }
+        });
+        expect(logText(exchange)).toContain('Invoking (initial): node build.cjs');
+      }
+      // A watch-only incremental script can keep outputs of deleted inputs, and its output would be cached
+      // under the key of the initial script that native Rush runs.
+      expect(runs(fixture)).toEqual(['a:one:', 'a:two:', 'a:three:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('re-runs only the operation whose declared outputs were deleted after a warm build', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
index 990aedb617..3330ac8e32 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
@@ -30,7 +30,7 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
         operations: Set<Operation>,
         context: ICreateOperationsContext
       ): Set<Operation> {
-        const { rushConfiguration, isIncrementalBuildAllowed } = context;
+        const { rushConfiguration, isIncrementalBuildAllowed, isWatch } = context;
 
         const getCustomParameterValues: (operation: Operation) => ICustomParameterValuesForOperation =
           getCustomParameterValuesByOperation();
@@ -52,12 +52,16 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
             // This is the command that will be used to identify the cache entry for this operation
             const commandForHash: string | undefined = shellCommand ?? scripts?.[phaseName];
 
-            // For execution of non-initial iterations, prefer the `:incremental` script if it exists.
+            // For execution of non-initial watch iterations, prefer the `:incremental` script if it exists.
             // However, the `shellCommand` value still takes precedence per the spec for that feature.
+            // Outside watch mode, every command runs the initial script, as a single `rush build` does, even
+            // when a long-lived host (rushd) executes it on a graph that already ran the operation. The
+            // incremental script may keep outputs of deleted inputs, and only watch mode disables cache writes.
             const initialCommand: string | undefined = shellCommand ?? scripts?.[phaseName];
-            const incrementalCommand: string | undefined = isIncrementalBuildAllowed
-              ? (shellCommand ?? scripts?.[`${phaseName}:incremental`])
-              : undefined;
+            const incrementalCommand: string | undefined =
+              isIncrementalBuildAllowed && isWatch
+                ? (shellCommand ?? scripts?.[`${phaseName}:incremental`])
+                : undefined;
 
             operation.runner = initializeShellOperationRunner({
               phase,
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
index 3e558acc90..b93ecb3d91 100644
--- a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
@@ -1,9 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type * as childProcess from 'node:child_process';
+import { EventEmitter } from 'node:events';
 import path from 'node:path';
+import { PassThrough } from 'node:stream';
+
 import { JsonFile } from '@rushstack/node-core-library';
-import { ConsoleTerminalProvider, Terminal } from '@rushstack/terminal';
+import {
+  ConsoleTerminalProvider,
+  StringBufferTerminalProvider,
+  Terminal,
+  type ITerminal,
+  type ITerminalProvider
+} from '@rushstack/terminal';
 import { CommandLineAction, CommandLineParser, type CommandLineParameter } from '@rushstack/ts-command-line';
 
 import { RushConfiguration } from '../../../api/RushConfiguration';
@@ -13,7 +23,11 @@ import {
   type IParameterJson,
   type IPhase
 } from '../../../api/CommandLineConfiguration';
-import type { Operation } from '../Operation';
+import { Operation } from '../Operation';
+import type { IOperationRunnerContext } from '../IOperationRunner';
+import { OperationStatus } from '../OperationStatus';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { Utilities } from '../../../utilities/Utilities';
 import type { ICommandLineJson } from '../../../api/CommandLineJson';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
 import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
@@ -259,4 +273,80 @@ describe(ShellOperationRunnerPlugin.name, () => {
     // All projects snapshot
     expect(Array.from(operations, serializeOperation)).toMatchSnapshot();
   });
+
+  it.each([
+    [false, ['node build.js', 'node build.js']],
+    [true, ['node build.js', 'node build.js --incremental']]
+  ])(
+    'runs the :incremental script for a repeated operation only in watch mode (isWatch: %s)',
+    async (isWatch: boolean, expectedCommands: string[]) => {
+      const phase: IPhase = {
+        name: '_phase:build',
+        isSynthetic: false,
+        missingScriptBehavior: 'error',
+        allowWarningsOnSuccess: false,
+        associatedParameters: new Set()
+      } as unknown as IPhase;
+      const project: RushConfigurationProject = {
+        packageName: 'a',
+        projectFolder: process.cwd(),
+        packageJson: {
+          scripts: {
+            '_phase:build': 'node build.js',
+            '_phase:build:incremental': 'node build.js --incremental'
+          }
+        },
+        rushConfiguration: { commonTempFolder: process.cwd() }
+      } as unknown as RushConfigurationProject;
+      const operation: Operation = new Operation({ phase, project, logFilenameIdentifier: 'a' });
+      const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+      new ShellOperationRunnerPlugin().apply(hooks);
+      await hooks.createOperationsAsync.promise(new Set([operation]), {
+        isIncrementalBuildAllowed: true,
+        isWatch
+      } as unknown as ICreateOperationsContext);
+
+      const commands: string[] = [];
+      const executeSpy = jest
+        .spyOn(Utilities, 'executeLifecycleCommandAsync')
+        .mockImplementation((command) => {
+          commands.push(command.trim());
+          const stdout: PassThrough = new PassThrough();
+          const stderr: PassThrough = new PassThrough();
+          const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+            stdout,
+            stderr,
+            stdio: []
+          }) as unknown as childProcess.ChildProcess;
+          queueMicrotask(() => {
+            stdout.end();
+            stderr.end();
+            child.emit('close', 0, null);
+          });
+          return child;
+        });
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const context: IOperationRunnerContext = {
+        environment: undefined,
+        async runWithTerminalAsync<T>(
+          callback: (
+            terminal: ITerminal,
+            operationTerminalProvider: ITerminalProvider,
+            structuredChildOutputTerminalProvider: ITerminalProvider
+          ) => Promise<T>
+        ): Promise<T> {
+          return await callback(new Terminal(terminalProvider), terminalProvider, terminalProvider);
+        }
+      } as unknown as IOperationRunnerContext;
+      try {
+        await expect(operation.runner!.executeAsync(context)).resolves.toBe(OperationStatus.Success);
+        await expect(
+          operation.runner!.executeAsync(context, { status: OperationStatus.Success })
+        ).resolves.toBe(OperationStatus.Success);
+      } finally {
+        executeSpy.mockRestore();
+      }
+      expect(commands).toEqual(expectedCommands);
+    }
+  );
 });

From 889b2b4007d3dc4039bc7cbf02bfb090d8a11d22 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 15:23:57 +0000
Subject: [PATCH 022/265] [rush-daemon] Share input captures between concurrent
 requests

Swarm integration step 7; original commit f7ac88dc9d (merge of swarm/r07 at 55a16f14ef).
Refs: F1 coalescer, board 555.

GATE OK ch01 board 930 (tree 41b2227d59). CONFIRMED by ch03 board 681, t06 board 701/board 749, t01 board 861. Only 55a16f14ef; b6692d09a5 (task 74) is not gated.

Commits folded into this step (1):
- 55a16f14ef [rush-daemon] Share input captures between concurrent requests

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...hared-input-captures_2026-09-28-13-45.json |  10 ++
 .../rush-daemon/src/FreshCaptureCoalescer.ts  |  49 ++++++
 .../src/WorkspaceRequestLifecycle.ts          |  58 ++++---
 .../src/test/FreshCaptureCoalescer.test.ts    | 150 ++++++++++++++++++
 .../test/WorkspaceInputCaptureSharing.test.ts |  83 ++++++++++
 5 files changed, 327 insertions(+), 23 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r07-shared-input-captures_2026-09-28-13-45.json
 create mode 100644 libraries/rush-daemon/src/FreshCaptureCoalescer.ts
 create mode 100644 libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r07-shared-input-captures_2026-09-28-13-45.json b/common/changes/@rushstack/rush-daemon/swarm-r07-shared-input-captures_2026-09-28-13-45.json
new file mode 100644
index 0000000000..00bed838d1
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r07-shared-input-captures_2026-09-28-13-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Concurrent requests share workspace input and project configuration captures instead of each running its own. A request never receives a capture that started before it arrived, so a burst of N warm builds costs at most two captures instead of N.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/FreshCaptureCoalescer.ts b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
new file mode 100644
index 0000000000..1b16286973
--- /dev/null
+++ b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+interface ICapture<TValue> {
+  readonly running: Promise<TValue>;
+  next: Promise<TValue> | undefined;
+}
+
+function ignore(): void {}
+
+/**
+ * Shares workspace input captures between concurrent requests, without ever giving a caller a capture that
+ * began before the caller asked for one.
+ *
+ * @remarks
+ * A capture reads the workspace while it runs, so a capture that is already running can miss a change made just
+ * before a later caller arrived. A caller that finds a capture running therefore waits for the next capture,
+ * which starts when the running one settles and is shared by every caller that arrived in the meantime.
+ * Concurrent callers cost at most two captures instead of one each, and every caller receives a result that is
+ * at least as fresh as a capture it started itself. Nothing is retained once a capture settles.
+ *
+ * Callers that pass the same scope and key must request the same capture.
+ */
+export class FreshCaptureCoalescer<TScope extends object, TValue> {
+  readonly #captures: WeakMap<TScope, Map<string, ICapture<TValue>>> = new WeakMap();
+
+  public captureAsync(scope: TScope, key: string, captureAsync: () => Promise<TValue>): Promise<TValue> {
+    const capture: ICapture<TValue> | undefined = this.#captures.get(scope)?.get(key);
+    if (!capture) return this.#start(scope, key, captureAsync);
+    capture.next ??= capture.running.then(ignore, ignore).then(() => this.#start(scope, key, captureAsync));
+    return capture.next;
+  }
+
+  #start(scope: TScope, key: string, captureAsync: () => Promise<TValue>): Promise<TValue> {
+    let captures: Map<string, ICapture<TValue>> | undefined = this.#captures.get(scope);
+    if (!captures) {
+      captures = new Map();
+      this.#captures.set(scope, captures);
+    }
+    const running: Promise<TValue> = new Promise<TValue>((resolve) => resolve(captureAsync()));
+    const capture: ICapture<TValue> = { running, next: undefined };
+    captures.set(key, capture);
+    const forget: () => void = () => {
+      if (captures.get(key) === capture) captures.delete(key);
+    };
+    running.then(forget, forget);
+    return running;
+  }
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 699c1eec21..0cf37b2483 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -8,11 +8,13 @@ import {
   captureWorkspaceInputFingerprintAsync,
   classifyWorkspaceInputChange,
   EnvironmentVariableNames,
+  getWorkspaceFingerprintEnvironmentEntries,
   PhasedCommandEngineBusyError,
   Rush,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
-  type IWorkspaceInputFingerprint
+  type IWorkspaceInputFingerprint,
+  type RushConfiguration
 } from '@microsoft/rush-lib';
 import { LockFile } from '@rushstack/node-core-library';
 import { NoOpTerminalProvider, Terminal } from '@rushstack/terminal';
@@ -52,6 +54,7 @@ import type {
   IWorkspaceSuccessorLaunch
 } from './WorkspaceProcessRestart';
 import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './WorkspaceRestartArbiter';
+import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
 
 interface IExecutionState {
   began: boolean;
@@ -116,6 +119,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #runtimePaths: ReadonlyArray<string> = [__dirname, path.resolve(__dirname, '../package.json')];
   readonly #startupFingerprint: IWorkspaceInputFingerprint;
   readonly #runtimeCache: WorkspaceRuntimeFingerprintCache;
+  // Concurrent requests share captures; each capture still starts after the requests it serves arrived.
+  readonly #fingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, IWorkspaceInputFingerprint> =
+    new FreshCaptureCoalescer();
+  readonly #projectFingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, string> =
+    new FreshCaptureCoalescer();
   #fingerprint: IWorkspaceInputFingerprint;
   #projectFingerprint: string | undefined;
   #commandIdentity: string | undefined;
@@ -364,10 +372,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             currentTier !== WorkspaceInputChangeTier.Reuse ||
             (this.#boundSession &&
               this.#projectFingerprint !==
-                (await captureProjectConfigurationFingerprintAsync(
-                  session.rushConfiguration,
-                  this.#terminal
-                )))
+                (await this.#captureProjectFingerprintAsync(session)))
           ) {
             throw new Error(
               'Graph inputs changed. Load the new generation with a supported build request; no operation was scheduled or executed.'
@@ -405,10 +410,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           abortSignal: client.abortSignal
         });
         if (tier === WorkspaceInputChangeTier.Reuse) {
-          projectFingerprint = await captureProjectConfigurationFingerprintAsync(
-            session.rushConfiguration,
-            this.#terminal
-          );
+          projectFingerprint = await this.#captureProjectFingerprintAsync(session);
           if (
             this.#boundSession !== session ||
             this.#commandIdentity !== commandIdentity ||
@@ -502,10 +504,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         session.invalidations.getSnapshot().isWatcherHealthy &&
         !session.invalidations.hasUnattributedUnknownChanges
       ) {
-        projectFingerprint = await captureProjectConfigurationFingerprintAsync(
-          session.rushConfiguration,
-          this.#terminal
-        );
+        projectFingerprint = await this.#captureProjectFingerprintAsync(session);
         if (projectFingerprint === this.#projectFingerprint) {
           this.#lastReloadTier = WorkspaceInputChangeTier.Reuse;
           this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
@@ -587,10 +586,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         expectedFingerprint = after;
         this.#boundSession = session;
         this.#fingerprint = after;
-        this.#projectFingerprint = await captureProjectConfigurationFingerprintAsync(
-          session.rushConfiguration,
-          this.#terminal
-        );
+        this.#projectFingerprint = await this.#captureProjectFingerprintAsync(session);
         this.#commandIdentity = await getResolverLifecycle(resolver).getCommandParameterIdentityAsync({
           envelope,
           workspaceSession: session,
@@ -640,12 +636,28 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     session: IWorkspaceSession,
     envelope: IDaemonRequestEnvelope
   ): Promise<IWorkspaceInputFingerprint> {
-    return captureWorkspaceInputFingerprintAsync({
-      rushConfiguration: session.rushConfiguration,
-      environment: envelope.environment,
-      runtimePaths: this.#runtimePaths,
-      runtimeCache: this.#runtimeCache
-    });
+    const { rushConfiguration } = session;
+    const { environment } = envelope;
+    // The capture reads only these parts of an environment, normalized as every fingerprint comparison is.
+    const key: string = JSON.stringify([
+      environment.RUSH_PREVIEW_VERSION ?? null,
+      getWorkspaceFingerprintEnvironmentEntries(environment)
+    ]);
+    return this.#fingerprintCaptures.captureAsync(rushConfiguration, key, () =>
+      captureWorkspaceInputFingerprintAsync({
+        rushConfiguration,
+        environment,
+        runtimePaths: this.#runtimePaths,
+        runtimeCache: this.#runtimeCache
+      })
+    );
+  }
+
+  #captureProjectFingerprintAsync(session: IWorkspaceSession): Promise<string> {
+    const { rushConfiguration } = session;
+    return this.#projectFingerprintCaptures.captureAsync(rushConfiguration, '', () =>
+      captureProjectConfigurationFingerprintAsync(rushConfiguration, this.#terminal)
+    );
   }
 
   #classify(fingerprint: IWorkspaceInputFingerprint, mutation: boolean): WorkspaceInputChangeTier {
diff --git a/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
new file mode 100644
index 0000000000..207f2f79e1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
@@ -0,0 +1,150 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
+
+interface IStartedCapture {
+  readonly index: number;
+  readonly resolve: (value: string) => void;
+  readonly reject: (error: Error) => void;
+}
+
+/** Captures that start in order and settle only when the test says so. */
+class ControlledCaptures {
+  public readonly started: IStartedCapture[] = [];
+
+  public readonly captureAsync = (): Promise<string> => {
+    return new Promise<string>((resolve, reject) => {
+      this.started.push({ index: this.started.length, resolve, reject });
+    });
+  };
+}
+
+async function flushAsync(): Promise<void> {
+  await new Promise((resolve) => setImmediate(resolve));
+}
+
+describe(FreshCaptureCoalescer.name, () => {
+  it('starts a capture for a caller when none is running and retains nothing once it settles', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    expect(captures.started).toHaveLength(1);
+    captures.started[0].resolve('first');
+    await expect(first).resolves.toBe('first');
+
+    const second: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('second');
+    await expect(second).resolves.toBe('second');
+  });
+
+  it('gives every caller that arrives during a capture one shared capture that starts after it settles', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const joiners: Promise<string>[] = [1, 2, 3].map(() =>
+      coalescer.captureAsync(scope, 'key', captures.captureAsync)
+    );
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+
+    captures.started[0].resolve('before the joiners asked');
+    await expect(first).resolves.toBe('before the joiners asked');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+
+    captures.started[1].resolve('after the joiners asked');
+    await expect(Promise.all(joiners)).resolves.toEqual([
+      'after the joiners asked',
+      'after the joiners asked',
+      'after the joiners asked'
+    ]);
+    expect(captures.started).toHaveLength(2);
+  });
+
+  it('never gives a caller a capture that started before the caller asked', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+    const results: Promise<[number, string]>[] = [];
+    const ask = (): void => {
+      const startedBeforeAsking: number = captures.started.length;
+      results.push(
+        coalescer
+          .captureAsync(scope, 'key', captures.captureAsync)
+          .then((value: string): [number, string] => [startedBeforeAsking, value])
+      );
+    };
+
+    ask(); // starts capture 0
+    ask(); // waits for capture 1
+    captures.started[0].resolve('0');
+    await flushAsync();
+    ask(); // capture 1 is running, so this waits for capture 2
+    ask();
+    captures.started[1].resolve('1');
+    await flushAsync();
+    captures.started[2].resolve('2');
+    await flushAsync();
+    ask(); // nothing is running, so this starts capture 3
+    captures.started[3].resolve('3');
+
+    const settled: [number, string][] = await Promise.all(results);
+    expect(settled).toEqual([
+      [0, '0'],
+      [1, '1'],
+      [2, '2'],
+      [2, '2'],
+      [3, '3']
+    ]);
+    for (const [startedBeforeAsking, value] of settled) {
+      expect(Number(value)).toBeGreaterThanOrEqual(startedBeforeAsking);
+    }
+  });
+
+  it('rejects the callers of a failed capture and still runs the next capture for callers that arrived during it', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const failed: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const joiner: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    captures.started[0].reject(new Error('a configuration file is being rewritten'));
+    await expect(failed).rejects.toThrow('a configuration file is being rewritten');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('rewritten');
+    await expect(joiner).resolves.toBe('rewritten');
+  });
+
+  it('returns a rejected promise when the capture function throws synchronously', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const result: Promise<string> = coalescer.captureAsync(scope, 'key', () => {
+      throw new Error('cannot start');
+    });
+    await expect(result).rejects.toThrow('cannot start');
+    await expect(coalescer.captureAsync(scope, 'key', async () => 'started')).resolves.toBe('started');
+  });
+
+  it('never shares a capture between different scopes or keys', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const firstScope: object = {};
+    const secondScope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const results: Promise<string>[] = [
+      coalescer.captureAsync(firstScope, 'a', captures.captureAsync),
+      coalescer.captureAsync(firstScope, 'b', captures.captureAsync),
+      coalescer.captureAsync(secondScope, 'a', captures.captureAsync)
+    ];
+    expect(captures.started).toHaveLength(3);
+    for (const capture of captures.started) capture.resolve(String(capture.index));
+    await expect(Promise.all(results)).resolves.toEqual(['0', '1', '2']);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
new file mode 100644
index 0000000000..2f8b3b6a27
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
@@ -0,0 +1,83 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync)
+  };
+});
+
+import * as rushLib from '@microsoft/rush-lib';
+
+import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(60_000);
+
+const WAIT_TIMEOUT_MS: number = 20_000;
+const captureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
+  jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+
+async function waitForAsync(description: string, condition: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + WAIT_TIMEOUT_MS;
+  while (!condition()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting until ${description}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+it('serves concurrent warm builds from one project configuration capture that started after they arrived', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) =>
+    setDaemonPolicy(created, {})
+  );
+  let release: () => void = () => {};
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    const generation: number = fixture.host.workspaceGeneration;
+
+    const requests: jest.SpyInstance = jest.spyOn(FreshCaptureCoalescer.prototype, 'captureAsync');
+    // The project configuration coalescer uses one key per workspace configuration.
+    const projectCaptureRequests = (): number =>
+      requests.mock.calls.filter(([, key]: unknown[]) => key === '').length;
+    captureMock.mockClear();
+    const gate: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+    const actual: typeof rushLib.captureProjectConfigurationFingerprintAsync = jest.requireActual<
+      typeof rushLib
+    >('@microsoft/rush-lib').captureProjectConfigurationFingerprintAsync;
+    captureMock.mockImplementationOnce(async (...args) => {
+      await gate;
+      return await actual(...args);
+    });
+
+    const first: ReturnType<DaemonGraphTestFixture['buildAsync']> = fixture.buildAsync();
+    await waitForAsync('the first build is capturing', () => captureMock.mock.calls.length === 1);
+    const joiners: ReturnType<DaemonGraphTestFixture['buildAsync']>[] = [
+      fixture.buildAsync(),
+      fixture.buildAsync(),
+      fixture.buildAsync()
+    ];
+    await waitForAsync(
+      'every build asked for a capture',
+      () => Math.max(projectCaptureRequests(), captureMock.mock.calls.length) === 4
+    );
+    expect(captureMock).toHaveBeenCalledTimes(1);
+    release();
+
+    for (const exchange of await Promise.all([first, ...joiners])) {
+      expect(exchange.terminal).toMatchObject({ payload: { exitCode: 0 } });
+    }
+    // The joiners arrived while the first capture was running, so they shared one that started after them.
+    expect(captureMock).toHaveBeenCalledTimes(2);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    requests.mockRestore();
+  } finally {
+    release();
+    await fixture[Symbol.asyncDispose]();
+  }
+});

From d5ccd5b7e024e2cf207629e328c566ac32300c60 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 15:50:25 +0000
Subject: [PATCH 023/265] [rush-lib] Skip cache writes when input files change
 while the inputs snapshot is taken

Swarm integration step 8; original commit bc03023091 (merge of swarm/r06 at 29f86b181c).
Refs: task 77.

ch01 GATE OK board 1019 (tree 80c9659bac); claim board 698, CONFIRMED by o04 board 738, o03 board 742, o05 board 748.

Commits folded into this step (2):
- a644819daf [rush-lib] Don't write a build cache entry for inputs saved while the snapshot was taken
- 29f86b181c [rush-lib] Make the parameter identity test independent of the host's RUSH_PARALLELISM

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...napshot-window-input-guard_2026-09-28.json |  11 ++
 common/reviews/api/rush-lib.api.md            |   1 +
 ...asedCommandEngineParameterIdentity.test.ts |   2 +
 .../src/logic/ProjectChangeAnalyzer.ts        |   5 +-
 .../src/logic/incremental/InputsSnapshot.ts   |  22 +++-
 .../incremental/test/InputsSnapshot.test.ts   |   8 ++
 .../operations/CacheableOperationPlugin.ts    | 103 +++++++++++----
 .../operations/InputFilesStatSignature.ts     |  66 +++++++++-
 .../test/CacheableOperationPlugin.test.ts     | 119 ++++++++++++++++--
 .../test/InputFilesStatSignature.test.ts      |  80 +++++++++++-
 .../logic/test/ProjectChangeAnalyzer.test.ts  |  14 +++
 11 files changed, 387 insertions(+), 44 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-snapshot-window-input-guard_2026-09-28.json

diff --git a/common/changes/@microsoft/rush/rushd-snapshot-window-input-guard_2026-09-28.json b/common/changes/@microsoft/rush/rushd-snapshot-window-input-guard_2026-09-28.json
new file mode 100644
index 0000000000..d6ba28db8e
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-snapshot-window-input-guard_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where a tracked input file that was saved while Rush was reading the working tree could produce a build cache entry whose outputs don't match its cache key. Such files are now hashed again before the entry is written, and the write is skipped if the hash no longer matches. Adds `IInputsSnapshot.workingTreeReadStartTimeMs`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 4e3184e502..94c081b8f9 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -629,6 +629,7 @@ export interface IInputsSnapshot {
     readonly hashes: ReadonlyMap<string, string>;
     readonly hasUncommittedChanges: boolean;
     readonly rootDirectory: string;
+    readonly workingTreeReadStartTimeMs?: number;
 }
 
 // @public
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
index 49b1c296e1..e0799d6a68 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
@@ -26,6 +26,8 @@ describe(`${PhasedCommandEngine.name} parameter identity`, () => {
     return await PhasedCommandEngine.parseAsync({
       argv,
       cwd: folder,
+      // Otherwise environment-backed defaults such as RUSH_PARALLELISM come from the test host.
+      environment: {},
       rushConfiguration,
       terminalProvider: new NoOpTerminalProvider()
     });
diff --git a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
index 960c313db3..14dcadd0ba 100644
--- a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
+++ b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
@@ -424,6 +424,8 @@ export class ProjectChangeAnalyzer {
       }
 
       return async function tryGetSnapshotAsync(): Promise<IInputsSnapshot | undefined> {
+        // Recorded before Git reads the working tree: a file saved after this may be newer than its hash.
+        const workingTreeReadStartTimeMs: number = Date.now();
         try {
           const [{ files: hashes, symlinks, hasUncommittedChanges }, additionalFiles] = await Promise.all([
             getDetailedRepoStateAsync(rootDirectory, additionalRelativePathsToHash, gitPath, filterPath),
@@ -459,7 +461,8 @@ export class ProjectChangeAnalyzer {
             hasUncommittedChanges,
             lookupByPath,
             projectMap,
-            rootDir: rootDirectory
+            rootDir: rootDirectory,
+            workingTreeReadStartTimeMs
           });
         } catch (e) {
           // If getRepoState fails, don't fail the whole build. Treat this case as if we don't know anything about
diff --git a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
index f48fd9b356..14949e73d4 100644
--- a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
+++ b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
@@ -123,6 +123,10 @@ export interface IInputsSnapshotParameters {
    * The directory that all relative paths are relative to.
    */
   rootDir: string;
+  /**
+   * {@inheritdoc IInputsSnapshot.workingTreeReadStartTimeMs}
+   */
+  workingTreeReadStartTimeMs?: number;
 }
 
 const { hashDelimiter } = RushConstants;
@@ -149,6 +153,16 @@ export interface IInputsSnapshot {
    */
   readonly hasUncommittedChanges: boolean;
 
+  /**
+   * The time, in milliseconds since the epoch, at which this snapshot began reading the state of the working tree,
+   * if known.
+   *
+   * @remarks
+   * A tracked file that was modified at or after this time may be newer than its hash in `hashes`, because Git
+   * may have read the file before it was saved.
+   */
+  readonly workingTreeReadStartTimeMs?: number;
+
   /**
    * Gets the map of file paths to Git hashes that will be used to compute the local state hash of the operation.
    * Exposed separately from the final state hash to facilitate detailed change detection.
@@ -200,6 +214,10 @@ export class InputsSnapshot implements IInputsSnapshot {
    * {@inheritdoc IInputsSnapshot.rootDirectory}
    */
   public readonly rootDirectory: string;
+  /**
+   * {@inheritdoc IInputsSnapshot.workingTreeReadStartTimeMs}
+   */
+  public readonly workingTreeReadStartTimeMs: number | undefined;
 
   /**
    * The metadata for each project. This is a superset of the information in `projectMap` and includes caching of queries.
@@ -239,7 +257,8 @@ export class InputsSnapshot implements IInputsSnapshot {
       hasUncommittedChanges,
       lookupByPath,
       nodeVersion = process.version,
-      rootDir
+      rootDir,
+      workingTreeReadStartTimeMs
     } = params;
     const projectMetadataMap: Map<
       IRushConfigurationProjectForSnapshot,
@@ -299,6 +318,7 @@ export class InputsSnapshot implements IInputsSnapshot {
     this.hashes = hashes;
     this.hasUncommittedChanges = hasUncommittedChanges;
     this.rootDirectory = rootDir;
+    this.workingTreeReadStartTimeMs = workingTreeReadStartTimeMs;
   }
 
   /**
diff --git a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
index 901fad97cc..c0b85794b3 100644
--- a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
+++ b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
@@ -49,6 +49,14 @@ describe(InputsSnapshot.name, () => {
     return { project, input };
   }
 
+  it('Exposes the time at which it began reading the working tree', () => {
+    const { options } = getTestConfig();
+    expect(new InputsSnapshot(options).workingTreeReadStartTimeMs).toBeUndefined();
+    expect(
+      new InputsSnapshot({ ...options, workingTreeReadStartTimeMs: 1234 }).workingTreeReadStartTimeMs
+    ).toBe(1234);
+  });
+
   describe(InputsSnapshot.prototype.getTrackedFileHashesForOperation.name, () => {
     it('Handles trivial input', () => {
       const { project, input } = getTrivialSnapshot();
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 6213db3ede..55037496af 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -5,6 +5,7 @@ import * as crypto from 'node:crypto';
 import * as path from 'node:path';
 
 import { InternalError, NewlineKind, Sort, Executable } from '@rushstack/node-core-library';
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
 import { CollatedTerminal, type CollatedWriter } from '@rushstack/stream-collator';
 import {
   DiscardStdoutTransform,
@@ -80,9 +81,11 @@ export interface IOperationBuildCacheContext {
   isCacheReadAttempted: boolean;
 
   // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
-  // the iteration's inputs snapshot. Used to refuse cache writes if the inputs changed while the operation
-  // was executing.
+  // the iteration's inputs snapshot. Used to refuse cache writes if the inputs changed while the snapshot was
+  // being taken or while the operation was executing.
   inputFilesState?: IInputFilesState;
+  // The hashes of the tracked input files in the iteration's inputs snapshot
+  inputFileHashes?: ReadonlyMap<string, string>;
 }
 
 export interface ICacheableOperationPluginOptions {
@@ -122,24 +125,54 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
     this.#options = options;
   }
 
+  #getGitPath(): string | undefined {
+    if (!this.#gitPathResolved) {
+      this.#gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
+      this.#gitPathResolved = true;
+    }
+    return this.#gitPath;
+  }
+
   #isNewInput(
     newEntryPaths: ReadonlyArray<string>,
     rootDirectory: string,
     projectFolder: string,
     outputFolderNames: ReadonlyArray<string>
   ): boolean {
-    if (!this.#gitPathResolved) {
-      this.#gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
-      this.#gitPathResolved = true;
-    }
-    if (!this.#gitPath) {
+    const gitPath: string | undefined = this.#getGitPath();
+    if (!gitPath) {
       // Without Git we cannot tell whether the new entries are ignored, so assume they are inputs.
       return true;
     }
     const outputFolderPaths: string[] = outputFolderNames.map((folderName: string) =>
       path.resolve(projectFolder, folderName)
     );
-    return hasUntrackedGitFiles(this.#gitPath, rootDirectory, newEntryPaths, outputFolderPaths);
+    return hasUntrackedGitFiles(gitPath, rootDirectory, newEntryPaths, outputFolderPaths);
+  }
+
+  /**
+   * Returns true if the current Git hash of any of the specified files differs from its hash in the inputs
+   * snapshot. If the files cannot be hashed, conservatively returns true.
+   */
+  async #haveSnapshotHashesChangedAsync(
+    rootDirectory: string,
+    filePaths: ReadonlyArray<string>,
+    snapshotHashes: ReadonlyMap<string, string> | undefined
+  ): Promise<boolean> {
+    const gitPath: string | undefined = this.#getGitPath();
+    if (!gitPath || !snapshotHashes) {
+      return true;
+    }
+    try {
+      for (const [filePath, hash] of await hashFilesAsync(rootDirectory, filePaths, gitPath)) {
+        if (snapshotHashes.get(filePath) !== hash) {
+          return true;
+        }
+      }
+      return false;
+    } catch {
+      return true;
+    }
   }
 
   public apply(hooks: PhasedCommandHooks): void {
@@ -222,7 +255,11 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
             const inputFilesState: IInputFilesState | undefined =
               cacheWriteEnabled && !cacheDisabledReason && record.enabled
-                ? captureInputFilesState(inputsSnapshot.rootDirectory, fileHashes.keys())
+                ? captureInputFilesState(
+                    inputsSnapshot.rootDirectory,
+                    fileHashes.keys(),
+                    inputsSnapshot.workingTreeReadStartTimeMs
+                  )
                 : undefined;
 
             const buildCacheContext: IOperationBuildCacheContext = {
@@ -242,7 +279,8 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }),
               cacheRestored: false,
               isCacheReadAttempted: false,
-              inputFilesState
+              inputFilesState,
+              inputFileHashes: inputFilesState ? fileHashes : undefined
             };
             // Upstream runners may mutate the property of build cache context for downstream runners
             this.#buildCacheContextByOperation.set(operation, buildCacheContext);
@@ -587,26 +625,41 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             if (!setCacheEntryPromise && taskIsSuccessful && isCacheWriteAllowed && operationBuildCache) {
               setCacheEntryPromise = () => operationBuildCache.trySetCacheEntryAsync(buildCacheTerminal);
             }
-            const { inputFilesState } = buildCacheContext;
-            if (
-              !cacheRestored &&
-              isCacheWriteAllowed &&
-              inputFilesState &&
-              haveInputFilesChanged(inputFilesState, (newEntryPaths: ReadonlyArray<string>) =>
-                this.#isNewInput(
-                  newEntryPaths,
+            const { inputFilesState, inputFileHashes } = buildCacheContext;
+            let inputFilesChangedMessage: string | undefined;
+            if (!cacheRestored && isCacheWriteAllowed && inputFilesState) {
+              // If Git hashed a file that was saved during the snapshot before it was saved, the outputs were
+              // built from newer content than the cache key describes.
+              const haveSnapshotHashesChanged: boolean =
+                inputFilesState.filesChangedDuringSnapshot.length > 0 &&
+                (await this.#haveSnapshotHashesChangedAsync(
                   inputFilesState.rootDirectory,
-                  project.projectFolder,
-                  buildCacheContext.outputFolderNames
+                  inputFilesState.filesChangedDuringSnapshot,
+                  inputFileHashes
+                ));
+              const { outputFolderNames } = buildCacheContext;
+              if (
+                haveInputFilesChanged(inputFilesState, (newEntryPaths: ReadonlyArray<string>) =>
+                  this.#isNewInput(
+                    newEntryPaths,
+                    inputFilesState.rootDirectory,
+                    project.projectFolder,
+                    outputFolderNames
+                  )
                 )
-              )
-            ) {
+              ) {
+                inputFilesChangedMessage =
+                  'Input files changed while this operation was executing; not writing a build cache entry.';
+              } else if (haveSnapshotHashesChanged) {
+                inputFilesChangedMessage =
+                  'Input files changed while the inputs snapshot was being taken; not writing a build cache entry.';
+              }
+            }
+            if (inputFilesChangedMessage) {
               // The cache key was derived from the iteration's inputs snapshot. Storing outputs produced from
               // edited inputs under that key would poison the cache for every consumer of the entry.
               // Consumers' cache keys also embed this operation's pre-edit state, so block their writes too.
-              buildCacheTerminal.writeLine(
-                'Input files changed while this operation was executing; not writing a build cache entry.'
-              );
+              buildCacheTerminal.writeLine(inputFilesChangedMessage);
               buildCacheContext.isCacheWriteAllowed = false;
               setCacheEntryPromise = undefined;
             }
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
index aef3eaff54..1e32a0da61 100644
--- a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -7,6 +7,18 @@ import * as path from 'node:path';
 
 import { Executable } from '@rushstack/node-core-library';
 
+/**
+ * How far outside of the snapshot window a file time may be and still count as a save during the window.
+ * File times can trail `Date.now()` by a clock tick (about 16 ms on Windows), or by up to 2 seconds on file systems
+ * with coarse time stamps (FAT). A file that is flagged by mistake only costs a `git hash-object` call.
+ */
+export const FILE_TIME_TOLERANCE_MS: number = 2000;
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1000000);
+
+function millisecondsToNanoseconds(timeMs: number): bigint {
+  return BigInt(Math.floor(timeMs)) * NANOSECONDS_PER_MILLISECOND;
+}
+
 /**
  * The on-disk state of an operation's tracked input files, captured right after the inputs snapshot
  * (from which the operation's build cache key is derived) was taken.
@@ -29,6 +41,13 @@ export interface IInputFilesState {
    * Used to detect files (or folders) that were created after the snapshot was taken.
    */
   readonly folderEntries: ReadonlyMap<string, ReadonlySet<string>>;
+  /**
+   * The tracked input file paths, as passed to `captureInputFilesState`, whose modification or status change time
+   * falls between the time that the inputs snapshot began reading the working tree and the time that this state
+   * was captured. Git may have hashed such a file before it was saved, so its hash in the snapshot (from which the
+   * build cache key was derived) may be stale even though its stats do not change again.
+   */
+  readonly filesChangedDuringSnapshot: ReadonlyArray<string>;
 }
 
 /**
@@ -42,14 +61,24 @@ export type IsNewInputCallback = (newEntryPaths: ReadonlyArray<string>) => boole
  * Missing files are included in the signature, so deleting or creating a listed file also changes it.
  */
 export function getInputFilesStatSignature(filePaths: Iterable<string>): string {
+  return hashInputFilesStats(filePaths);
+}
+
+function hashInputFilesStats(
+  filePaths: Iterable<string>,
+  onStats?: (index: number, stats: fs.BigIntStats) => void
+): string {
   const hasher: crypto.Hash = crypto.createHash('sha1');
+  let index: number = 0;
   for (const filePath of filePaths) {
     const stats: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
     if (stats) {
       hasher.update(`${filePath}\0${stats.size}\0${stats.mtimeNs}\0${stats.ino}\n`);
+      onStats?.(index, stats);
     } else {
       hasher.update(`${filePath}\0missing\n`);
     }
+    index++;
   }
   return hasher.digest('hex');
 }
@@ -69,15 +98,20 @@ function tryReadFolderEntries(folderPath: string): Set<string> | undefined {
  * @param inputFilePaths - The tracked input file paths. Relative paths are resolved against `rootDirectory`;
  *   absolute paths (e.g. `dependsOnAdditionalFiles` outside of the repository) are stat'ed but their folders
  *   are not watched for new entries.
+ * @param snapshotStartTimeMs - When the inputs snapshot began reading the working tree
+ *   (`IInputsSnapshot.workingTreeReadStartTimeMs`), if known. Used to compute `filesChangedDuringSnapshot`.
  */
 export function captureInputFilesState(
   rootDirectory: string,
-  inputFilePaths: Iterable<string>
+  inputFilePaths: Iterable<string>,
+  snapshotStartTimeMs?: number
 ): IInputFilesState {
+  const originalFilePaths: string[] = [];
   const filePaths: string[] = [];
   const folderEntries: Map<string, ReadonlySet<string>> = new Map();
   for (const inputFilePath of inputFilePaths) {
     const absolutePath: string = path.resolve(rootDirectory, inputFilePath);
+    originalFilePaths.push(inputFilePath);
     filePaths.push(absolutePath);
     if (!path.isAbsolute(inputFilePath)) {
       const folderPath: string = path.dirname(absolutePath);
@@ -86,7 +120,33 @@ export function captureInputFilesState(
       }
     }
   }
-  return { rootDirectory, filePaths, statSignature: getInputFilesStatSignature(filePaths), folderEntries };
+  const windowStartNs: bigint | undefined =
+    snapshotStartTimeMs === undefined
+      ? undefined
+      : millisecondsToNanoseconds(snapshotStartTimeMs - FILE_TIME_TOLERANCE_MS);
+  // For each file with a time at or after the start of the window, the earliest such time
+  const earliestTimeInWindowNsByIndex: Map<number, bigint> = new Map();
+  const statSignature: string = hashInputFilesStats(filePaths, (index: number, stats: fs.BigIntStats) => {
+    if (windowStartNs === undefined) {
+      return;
+    }
+    for (const timeNs of [stats.mtimeNs, stats.ctimeNs]) {
+      const earliestTimeNs: bigint | undefined = earliestTimeInWindowNsByIndex.get(index);
+      if (timeNs >= windowStartNs && (earliestTimeNs === undefined || timeNs < earliestTimeNs)) {
+        earliestTimeInWindowNsByIndex.set(index, timeNs);
+      }
+    }
+  });
+  // The window ends after the files were stat'ed, so that a save during the loop is inside it. A later file time
+  // (e.g. an mtime set in the future) is not a save during the window.
+  const windowEndNs: bigint = millisecondsToNanoseconds(Date.now() + FILE_TIME_TOLERANCE_MS);
+  const filesChangedDuringSnapshot: string[] = [];
+  for (const [index, timeNs] of earliestTimeInWindowNsByIndex) {
+    if (timeNs <= windowEndNs) {
+      filesChangedDuringSnapshot.push(originalFilePaths[index]);
+    }
+  }
+  return { rootDirectory, filePaths, statSignature, folderEntries, filesChangedDuringSnapshot };
 }
 
 /**
@@ -148,4 +208,4 @@ export function hasUntrackedGitFiles(
     return true;
   }
   return result.stdout.length > 0;
-}
\ No newline at end of file
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index a9b3ad395a..ffdee0680e 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -42,7 +42,19 @@ jest.mock('../OperationMetadataManager', () => {
 jest.mock('../../buildCache/OperationBuildCache', () => ({
   OperationBuildCache: { forOperation: jest.fn() }
 }));
+jest.mock('@rushstack/package-deps-hash', () => {
+  const actual: typeof import('@rushstack/package-deps-hash') = jest.requireActual(
+    '@rushstack/package-deps-hash'
+  );
+  return { ...actual, hashFilesAsync: jest.fn(actual.hashFilesAsync) };
+});
 
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
 import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
@@ -60,6 +72,7 @@ import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
 import type { IExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { FILE_TIME_TOLERANCE_MS } from '../InputFilesStatSignature';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -99,18 +112,21 @@ interface ITestGraph {
   graph: OperationGraph;
   operations: Map<string, Operation>;
   localHashes: Map<string, string>;
+  // The tracked input file hashes of each operation in the inputs snapshot, by name
+  trackedFileHashes: Map<string, Map<string, string>>;
   executions: string[];
   cacheWrites: string[];
-  executeAsync(): Promise<IExecutionResult>;
+  executeAsync(workingTreeReadStartTimeMs?: number): Promise<IExecutionResult>;
 }
 
 /**
  * Creates a linear chain of cacheable operations: names[0] <- names[1] <- ... (each depends on the previous).
  */
-async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
+async function createTestGraphAsync(names: string[], rootDirectory: string = '/repo'): Promise<ITestGraph> {
   const executions: string[] = [];
   const cacheWrites: string[] = [];
   const localHashes: Map<string, string> = new Map();
+  const trackedFileHashes: Map<string, Map<string, string>> = new Map();
   const operations: Map<string, Operation> = new Map();
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
 
@@ -118,7 +134,7 @@ async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
   for (const name of names) {
     const project: RushConfigurationProject = {
       packageName: name,
-      projectFolder: `/repo/${name}`
+      projectFolder: `${rootDirectory}/${name}`
     } as unknown as RushConfigurationProject;
     projectConfigurations.set(project, {
       getCacheDisabledReason: () => undefined
@@ -176,33 +192,51 @@ async function createTestGraphAsync(names: string[]): Promise<ITestGraph> {
     projectConfigurations
   } as unknown as IOperationGraphContext);
 
-  const inputsSnapshot: IInputsSnapshot = {
-    hashes: new Map(),
-    rootDirectory: '/repo',
-    hasUncommittedChanges: false,
-    getTrackedFileHashesForOperation: () => new Map(),
-    getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
-  };
-
   return {
     graph,
     operations,
     localHashes,
+    trackedFileHashes,
     executions,
     cacheWrites,
-    executeAsync: async () => {
+    executeAsync: async (workingTreeReadStartTimeMs?: number) => {
       executions.length = 0;
       cacheWrites.length = 0;
+      const inputsSnapshot: IInputsSnapshot = {
+        hashes: new Map(),
+        rootDirectory,
+        hasUncommittedChanges: false,
+        workingTreeReadStartTimeMs,
+        getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
+          trackedFileHashes.get(project.packageName) ?? new Map(),
+        getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
+      };
       return await graph.executeAsync({ inputsSnapshot });
     }
   };
 }
 
+function getGitBlobHash(content: string): string {
+  return crypto
+    .createHash('sha1')
+    .update(`blob ${Buffer.byteLength(content)}\0${content}`)
+    .digest('hex');
+}
+
+function getLatestFileTimeMs(filePath: string): number {
+  const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+  return Number((mtimeNs > ctimeNs ? mtimeNs : ctimeNs) / BigInt(1000000));
+}
+
 function getStatus(testGraph: ITestGraph, result: IExecutionResult, name: string): OperationStatus {
   return (result.operationResults.get(testGraph.operations.get(name)!) as OperationExecutionRecord).status;
 }
 
 describe(CacheableOperationPlugin.name, () => {
+  beforeEach(() => {
+    jest.mocked(hashFilesAsync).mockClear();
+  });
+
   it('writes cache entries for all operations in a cold iteration', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
 
@@ -300,4 +334,65 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.executions).toEqual(['a', 'c']);
     expect(testGraph.cacheWrites).toEqual(['a']);
   });
+
+  describe('input files saved while the inputs snapshot was being taken', () => {
+    const inputFile: string = 'a/src/index.ts';
+    let rootDirectory: string;
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      fs.mkdirSync(path.join(rootDirectory, 'a', 'src'), { recursive: true });
+      fs.writeFileSync(path.join(rootDirectory, inputFile), 'export const a = 2;');
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    it('does not write cache entries if Git hashed the file before it was saved', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 1;')]]));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      // "b" consumed outputs of "a" that do not match the state hash of "a", so it must not write either.
+      expect(testGraph.cacheWrites).toEqual([]);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+      expect(jest.mocked(hashFilesAsync).mock.calls[0].slice(0, 2)).toEqual([rootDirectory, [inputFile]]);
+
+      // The next snapshot hashes the saved content, so the outputs are rebuilt and cached.
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 2;')]]));
+      testGraph.localHashes.set('a', 'a-v2');
+      await testGraph.executeAsync(
+        getLatestFileTimeMs(path.join(rootDirectory, inputFile)) + FILE_TIME_TOLERANCE_MS + 1
+      );
+
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+    });
+
+    it('writes cache entries if Git hashed the file after it was saved', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 2;')]]));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not hash files that were saved before the snapshot started', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 2;')]]));
+
+      await testGraph.executeAsync(
+        getLatestFileTimeMs(path.join(rootDirectory, inputFile)) + FILE_TIME_TOLERANCE_MS + 1
+      );
+
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
index 0e0839c269..ca626bcc18 100644
--- a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
@@ -8,6 +8,7 @@ import * as path from 'node:path';
 
 import {
   captureInputFilesState,
+  FILE_TIME_TOLERANCE_MS,
   getNewFolderEntries,
   hasUntrackedGitFiles,
   haveInputFilesChanged,
@@ -22,9 +23,14 @@ describe('InputFilesStatSignature', () => {
   let noNewInputs: jest.Mock<boolean, [ReadonlyArray<string>]>;
 
   function capture(...absolutePaths: string[]): IInputFilesState {
+    return captureAt(undefined, ...absolutePaths);
+  }
+
+  function captureAt(snapshotStartTimeMs: number | undefined, ...absolutePaths: string[]): IInputFilesState {
     return captureInputFilesState(
       tempFolder,
-      absolutePaths.map((filePath: string) => path.relative(tempFolder, filePath))
+      absolutePaths.map((filePath: string) => path.relative(tempFolder, filePath)),
+      snapshotStartTimeMs
     );
   }
 
@@ -105,6 +111,76 @@ describe('InputFilesStatSignature', () => {
     });
   });
 
+  describe('filesChangedDuringSnapshot', () => {
+    const nanosecondsPerMillisecond: bigint = BigInt(1000000);
+
+    function getLatestFileTimeMs(filePath: string): number {
+      const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+      return Number((mtimeNs > ctimeNs ? mtimeNs : ctimeNs) / nanosecondsPerMillisecond);
+    }
+
+    function getStatusChangeTimeMs(filePath: string): number {
+      return Number(fs.statSync(filePath, { bigint: true }).ctimeNs / nanosecondsPerMillisecond);
+    }
+
+    it('is empty if the snapshot start time is unknown', () => {
+      expect(capture(fileA, fileB).filesChangedDuringSnapshot).toEqual([]);
+    });
+
+    it('lists a file modified at or after the snapshot start, within the tolerance', () => {
+      const fileTimeMs: number = getLatestFileTimeMs(fileA);
+      expect(captureAt(fileTimeMs + FILE_TIME_TOLERANCE_MS, fileA).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileA)
+      ]);
+      expect(captureAt(fileTimeMs + FILE_TIME_TOLERANCE_MS + 1, fileA).filesChangedDuringSnapshot).toEqual(
+        []
+      );
+    });
+
+    it('lists only the files that changed after the snapshot start', () => {
+      const snapshotStartTimeMs: number = getLatestFileTimeMs(fileB) + FILE_TIME_TOLERANCE_MS + 1;
+      // Wait for the file system clock to pass the start of the window
+      const deadlineMs: number = Date.now() + 10000;
+      do {
+        fs.writeFileSync(fileB, `export const b = ${Date.now()}; // saved during the snapshot`);
+      } while (
+        getLatestFileTimeMs(fileB) < snapshotStartTimeMs - FILE_TIME_TOLERANCE_MS &&
+        Date.now() < deadlineMs
+      );
+
+      expect(captureAt(snapshotStartTimeMs, fileA, fileB).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileB)
+      ]);
+    });
+
+    it('uses the status change time if the modification time was set back', () => {
+      const past: Date = new Date(Date.now() - 3600 * 1000);
+      fs.utimesSync(fileA, past, past);
+      const statusChangeTimeMs: number = getStatusChangeTimeMs(fileA);
+      expect(fs.statSync(fileA).mtimeMs).toBeLessThan(statusChangeTimeMs - FILE_TIME_TOLERANCE_MS);
+
+      expect(captureAt(statusChangeTimeMs, fileA).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileA)
+      ]);
+    });
+
+    it('ignores file times after the end of the window', () => {
+      const future: Date = new Date(Date.now() + 3600 * 1000);
+      fs.utimesSync(fileA, future, future);
+      // Only the modification time, which is in the future, is at or after the start of the window
+      const snapshotStartTimeMs: number = getStatusChangeTimeMs(fileA) + FILE_TIME_TOLERANCE_MS + 1;
+
+      expect(captureAt(snapshotStartTimeMs, fileA).filesChangedDuringSnapshot).toEqual([]);
+    });
+
+    it('skips missing files', () => {
+      const missingFile: string = path.join(srcFolder, 'missing.ts');
+      expect(captureAt(0, missingFile, fileA).filesChangedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileA)
+      ]);
+    });
+  });
+
   describe(hasUntrackedGitFiles.name, () => {
     const gitPath: string = 'git';
 
@@ -144,4 +220,4 @@ describe('InputFilesStatSignature', () => {
       expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'nested')], [])).toBe(true);
     });
   });
-});
\ No newline at end of file
+});
diff --git a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
index c9138b3c85..8bb271d8bd 100644
--- a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
+++ b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
@@ -25,6 +25,7 @@ const mockHashes: Map<string, string> = new Map([
 // Mock function for customizing repo changes in each test
 const mockGetRepoChanges: jest.MockedFunction<typeof import('@rushstack/package-deps-hash').getRepoChanges> =
   jest.fn();
+const mockOnGetDetailedRepoState: jest.Mock<void, []> = jest.fn();
 
 jest.mock(`@rushstack/package-deps-hash`, () => {
   return {
@@ -32,6 +33,7 @@ jest.mock(`@rushstack/package-deps-hash`, () => {
       return dir;
     },
     getDetailedRepoStateAsync(): IDetailedRepoState {
+      mockOnGetDetailedRepoState();
       return {
         hasSubmodules: false,
         hasUncommittedChanges: false,
@@ -152,8 +154,17 @@ describe(ProjectChangeAnalyzer.name, () => {
       const terminal: Terminal = new Terminal(terminalProvider);
       const mockSnapshotValue: {} = {};
       mockSnapshot.mockImplementation(() => mockSnapshotValue);
+      let repoStateReadTimeMs: number | undefined;
+      mockOnGetDetailedRepoState.mockImplementationOnce(() => {
+        repoStateReadTimeMs = Date.now();
+        // Make sure that a time recorded after the working tree was read is later than this one
+        while (Date.now() <= repoStateReadTimeMs + 1) {
+          // Busy wait
+        }
+      });
       const snapshotProvider: GetInputsSnapshotAsyncFn | undefined =
         await projectChangeAnalyzer._tryGetSnapshotProviderAsync(new Map(), terminal);
+      const beforeSnapshotTimeMs: number = Date.now();
       const snapshot: IInputsSnapshot | undefined = await snapshotProvider?.();
 
       expect(snapshot).toBe(mockSnapshotValue);
@@ -167,6 +178,9 @@ describe(ProjectChangeAnalyzer.name, () => {
       expect(mockInput.hashes).toEqual(mockHashes);
       expect(mockInput.rootDir).toEqual(rootDir);
       expect(mockInput.additionalHashes).toEqual(new Map());
+      // The start time is recorded before Git reads the working tree
+      expect(mockInput.workingTreeReadStartTimeMs).toBeGreaterThanOrEqual(beforeSnapshotTimeMs);
+      expect(mockInput.workingTreeReadStartTimeMs).toBeLessThanOrEqual(repoStateReadTimeMs!);
     });
   });
 

From ef51bf74247a8a8e4954bd0116d8c36b3a15a8d5 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 16:37:37 +0000
Subject: [PATCH 024/265] [rush-daemon] don't let a request received during a
 batch's reconcile join that batch

Swarm integration step 9; original commit d0ed461613 (merge of swarm/r05 at 199c69347c).
Refs: board 371, task 72.

ch01 GATE OK board 1152 (gated tree 5c2b6b6cbf).

Commits folded into this step (1):
- 199c69347c [rush-daemon] Don't let a request received during a batch's reconcile join that batch (board 371)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...swarm-r05-stale-join_2026-09-28-14-10.json |  10 ++
 common/reviews/api/rush-daemon.api.md         |   3 +-
 .../src/DaemonRequestDispatcher.ts            |  10 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  24 ++-
 .../src/WorkspaceRequestLifecycle.ts          |   2 +
 .../src/test/PhasedRequestBatching.test.ts    | 167 ++++++++++++++++++
 .../test/PhasedRequestCancellation.test.ts    |  58 +++++-
 .../ProductionDaemonRequestResolver.test.ts   |  57 ++++--
 8 files changed, 303 insertions(+), 28 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-stale-join_2026-09-28-14-10.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-stale-join_2026-09-28-14-10.json b/common/changes/@rushstack/rush-daemon/swarm-r05-stale-join_2026-09-28-14-10.json
new file mode 100644
index 0000000000..0f55dd4c37
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-stale-join_2026-09-28-14-10.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A shared build batch no longer accepts a compatible request that the daemon received after the batch started to reconcile its inputs. That request runs in a later batch that reconciles again, instead of on a snapshot read before its changes. Requests received before the reconcile started still join the batch.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index fd40da63ca..0d30e1b2dc 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -206,6 +206,7 @@ export interface IDispatchWorkspaceRequestOptions {
     readonly envelope: IDaemonRequestEnvelope;
     // (undocumented)
     readonly onExecutionStarting?: () => void;
+    readonly receivedTimeMs?: number;
     // (undocumented)
     readonly resolver: IDaemonRequestResolver | undefined;
     // (undocumented)
@@ -691,7 +692,7 @@ export type MapWorkspaceInvalidationsToOperationsAsync = (options: IMapWorkspace
 // @beta
 export class PhasedRequestRouter {
     constructor(workspaceSession: IWorkspaceSession);
-    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings): Promise<IDaemonPhasedRequestResult>;
+    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings, receivedTimeMs?: number): Promise<IDaemonPhasedRequestResult>;
 }
 
 // @beta
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index d984b44f91..8a72ae6f9c 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -94,6 +94,11 @@ export interface IDispatchWorkspaceRequestOptions {
   readonly workspaceSession: IWorkspaceSession;
   readonly resolver: IDaemonRequestResolver | undefined;
   readonly onExecutionStarting?: () => void;
+  /**
+   * The `performance.now()` timestamp at which the daemon received the request. A phased request can join a batch
+   * whose input reconcile started after this time; see {@link PhasedRequestRouter.executeAsync}.
+   */
+  readonly receivedTimeMs?: number;
 }
 
 /** Executes an already admitted workspace generation without resolving against another session. @beta */
@@ -158,7 +163,7 @@ export class DaemonRequestDispatcher implements AsyncDisposable {
 async function dispatchWorkspaceRequestAsync(
   options: IDispatchWorkspaceRequestOptions
 ): Promise<IDaemonCommandResult | undefined> {
-  const { envelope, client, workspaceSession, resolver, onExecutionStarting } = options;
+  const { envelope, client, workspaceSession, resolver, onExecutionStarting, receivedTimeMs } = options;
   workspaceSession.assertActive?.();
   if (
     !isRushxInvocation(envelope) &&
@@ -191,7 +196,8 @@ async function dispatchWorkspaceRequestAsync(
       createPhasedClient(client),
       resolved.exactSelection,
       onExecutionStarting,
-      resolved.requestSettings
+      resolved.requestSettings,
+      receivedTimeMs
     );
   }
   const globalRouter: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(workspaceSession);
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 76ccbba728..1d2dfd9fd7 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -73,6 +73,8 @@ interface IPreparedPhasedRequest {
   readonly requestSettings: IPhasedCommandEngineRequestSettings | undefined;
   readonly requestSettingsKey: string;
   readonly selection: IResolvedSelection;
+  /** The `performance.now()` timestamp at which the daemon received the request; see `#canJoinCurrentBatch`. */
+  readonly receivedTimeMs: number;
   /** The `performance.now()` timestamp at which the router received the request. */
   readonly startTimeMs: number;
   readonly warningsAllowedByEnvironment: boolean;
@@ -126,13 +128,20 @@ export class PhasedRequestRouter {
     this.#workspaceSession = workspaceSession;
   }
 
-  /** Validates and executes one resolved phased request against the warm graph. */
+  /**
+   * Validates and executes one resolved phased request against the warm graph.
+   *
+   * @remarks
+   * `receivedTimeMs` is the `performance.now()` timestamp at which the daemon received the request. The request can
+   * join a batch whose input reconcile started after this time. It defaults to the time of this call.
+   */
   public async executeAsync(
     request: IDaemonPhasedRequest,
     client: IPhasedRequestClient,
     exactSelection: boolean = false,
     onExecutionStarting?: () => void,
-    requestSettings?: IPhasedCommandEngineRequestSettings
+    requestSettings?: IPhasedCommandEngineRequestSettings,
+    receivedTimeMs?: number
   ): Promise<IDaemonPhasedRequestResult> {
     const startTimeMs: number = performance.now();
     validateRequestIdentity(request);
@@ -210,6 +219,7 @@ export class PhasedRequestRouter {
               client,
               exclusivityClass,
               interactiveSession,
+              receivedTimeMs: receivedTimeMs ?? startTimeMs,
               request,
               requestSettings,
               requestSettingsKey: JSON.stringify(requestSettings ?? null),
@@ -250,6 +260,8 @@ class PhasedRequestBatchCoordinator {
   #currentBatch: ReadonlyArray<IBatchEntry> | undefined;
   #drainScheduled: boolean = false;
   #nextGraphLeasePromise: Promise<IRequestLease> | undefined;
+  /** When the current batch's input reconcile started, or undefined before it starts. */
+  #reconcileStartTimeMs: number | undefined;
   #running: boolean = false;
 
   public constructor(
@@ -335,6 +347,7 @@ class PhasedRequestBatchCoordinator {
         }
         this.#currentBatch = batch;
         this.#acceptingCurrentBatch = first.exclusivityClass === RequestExclusivityClass.SharedBuild;
+        this.#reconcileStartTimeMs = undefined;
         for (const entry of batch) {
           entry.executionStarted = true;
         }
@@ -344,6 +357,7 @@ class PhasedRequestBatchCoordinator {
           await Promise.all(batch.map((entry: IBatchEntry) => this.#rejectEntryAsync(entry, error)));
         } finally {
           this.#acceptingCurrentBatch = false;
+          this.#reconcileStartTimeMs = undefined;
           this.#currentBatch = undefined;
         }
       }
@@ -364,6 +378,8 @@ class PhasedRequestBatchCoordinator {
     }
     return (
       this.#acceptingCurrentBatch &&
+      // A request received after the reconcile started may have changed an input that the reconcile already read.
+      (this.#reconcileStartTimeMs === undefined || request.receivedTimeMs < this.#reconcileStartTimeMs) &&
       this.#currentBatch?.[0]?.exclusivityClass === RequestExclusivityClass.SharedBuild &&
       this.#currentBatch[0].requestSettingsKey === request.requestSettingsKey
     );
@@ -407,12 +423,16 @@ class PhasedRequestBatchCoordinator {
         throw new Error('The warm workspace operation graph is not idle.');
       }
       executionLease = await this.#workspaceSession.acquireExecutionLeaseAsync?.();
+      // Requests received before this point made their changes before the reconcile reads the inputs, so they can
+      // still join while it runs. Requests received later wait for the next batch, which reconciles again.
+      this.#reconcileStartTimeMs = performance.now();
       await this.#workspaceSession.reconcileInvalidationsAsync();
 
       if (batch[0].exclusivityClass === RequestExclusivityClass.SharedBuild) {
         this.#takeCompatiblePending(batch);
       }
       this.#acceptingCurrentBatch = false;
+
       const participants: IBatchEntry[] = batch.filter((entry: IBatchEntry) => this.#isEntryLive(entry));
       if (participants.length === 0) {
         const beforeResultAsync: (() => Promise<void>) | undefined = executionLease
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 0cf37b2483..b13176adca 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -176,6 +176,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     destination: IDaemonRequestDispatchClient,
     dispatchAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
+    const receivedTimeMs: number = performance.now();
     // Native Rush owns its SDK handoff; a foreign client's bundled engine must not override this one.
     const envelope: IDaemonRequestEnvelope = {
       ...request,
@@ -230,6 +231,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
                 client,
                 workspaceSession: prepared.session,
                 resolver: prepared.resolver,
+                receivedTimeMs,
                 onExecutionStarting: () => {
                   this.#assertGeneration(prepared);
                   state.began = true;
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index bca1bde260..6333cea8d6 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -86,6 +86,30 @@ function getResultOperationIds(result: IDaemonPhasedRequestResult): ReadonlyArra
   return result.operationResults.map(({ operationId }) => operationId);
 }
 
+/** One input file of project-c: the version on disk, and the version that the latest reconcile read. */
+class TestWorkspaceInput {
+  #diskVersion: number = 0;
+  #snapshotVersion: number | undefined;
+
+  public edit(): void {
+    this.#diskVersion++;
+  }
+
+  public read(): void {
+    this.#snapshotVersion = this.#diskVersion;
+  }
+
+  public describe(): string {
+    return `snapshot=${this.#snapshotVersion} disk=${this.#diskVersion}`;
+  }
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
 interface IExecutionLeaseTracker {
   readonly events: string[];
 }
@@ -638,6 +662,149 @@ describe('shared phased request batching', () => {
     expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
   });
 
+  it('puts a compatible request received during the reconcile into a later batch that reconciles again', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    const inputRead: IDeferred = createDeferred();
+    const finishFirstReconcile: IDeferred = createDeferred();
+    let reconcileCount: number = 0;
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      reconcileCount++;
+      events.push('reconcile:start');
+      input.read();
+      if (reconcileCount === 1) {
+        inputRead.resolve();
+        // The reconcile has read project-c's input and is still reading the rest of the workspace.
+        await finishFirstReconcile.promise;
+      }
+      events.push('reconcile:end');
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first = router.executeAsync(
+      createRequest('first', OPERATION_A),
+      new TestPhasedRequestClient('one')
+    );
+    await inputRead.promise;
+
+    // Another client changes project-c's input, then submits a compatible build that needs it.
+    input.edit();
+    events.push('edit');
+    const second = router.executeAsync(
+      createRequest('second', OPERATION_C),
+      new TestPhasedRequestClient('two')
+    );
+    await settleAsync();
+    finishFirstReconcile.resolve();
+
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    // Joining the first batch would run project-c on the inputs read before its change ("snapshot=0 disk=1").
+    expect(events).toEqual([
+      'reconcile:start',
+      'edit',
+      'reconcile:end',
+      'reconcile:start',
+      'reconcile:end',
+      'run:C snapshot=1 disk=1'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('lets a compatible request that is pending before the reconcile join the batch and see its change', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    const leaseRequested: IDeferred = createDeferred();
+    const grantLease: IDeferred = createDeferred();
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      leaseRequested.resolve();
+      await grantLease.promise;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      events.push('reconcile');
+      input.read();
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first = router.executeAsync(
+      createRequest('first', OPERATION_A),
+      new TestPhasedRequestClient('one')
+    );
+    await leaseRequested.promise;
+
+    input.edit();
+    events.push('edit');
+    const second = router.executeAsync(
+      createRequest('second', OPERATION_C),
+      new TestPhasedRequestClient('two')
+    );
+    await settleAsync();
+    grantLease.resolve();
+
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(events).toEqual(['edit', 'reconcile', 'run:C snapshot=1 disk=1']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('lets a request received before the reconcile began join the batch when it reaches the router during it', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    const reconcileStarted: IDeferred = createDeferred();
+    const finishReconcile: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      events.push('reconcile:start');
+      input.read();
+      reconcileStarted.resolve();
+      await finishReconcile.promise;
+      events.push('reconcile:end');
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+    // The second client changes project-c's input and the daemon receives its request, which then waits (for
+    // example behind a graph load) and reaches the router only while the first batch reconciles.
+    input.edit();
+    events.push('edit');
+    const secondReceivedTimeMs: number = performance.now();
+    const first = router.executeAsync(
+      createRequest('first', OPERATION_A),
+      new TestPhasedRequestClient('one')
+    );
+    await reconcileStarted.promise;
+    const second = router.executeAsync(
+      createRequest('second', OPERATION_C),
+      new TestPhasedRequestClient('two'),
+      false,
+      undefined,
+      undefined,
+      secondReceivedTimeMs
+    );
+    await settleAsync();
+    finishReconcile.resolve();
+
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(events).toEqual(['edit', 'reconcile:start', 'reconcile:end', 'run:C snapshot=1 disk=1']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
   it('lets a late shared build wait past a default timeout while a compatible batch executes', async () => {
     const operationStarted: IDeferred = createDeferred();
     const releaseOperation: IDeferred = createDeferred();
diff --git a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
index 44c3358cd4..7941f76a7f 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
@@ -20,7 +20,10 @@ const OPERATION_C: string = 'project-c (_phase:test)';
 const PROMPT_CANCELLATION_MS: number = 1000;
 const TIMED_OUT: 'timed out' = 'timed out';
 
-async function raceWithTimeoutAsync<T>(promise: Promise<T>, timeoutMs: number): Promise<T | typeof TIMED_OUT> {
+async function raceWithTimeoutAsync<T>(
+  promise: Promise<T>,
+  timeoutMs: number
+): Promise<T | typeof TIMED_OUT> {
   let timer: NodeJS.Timeout | undefined;
   try {
     return await Promise.race([
@@ -167,11 +170,54 @@ describe('phased request client cancellation', () => {
     const { hanging, actionAsync } = createHangingOperation();
     const fixture: ITestRoutingFixture = createFixture(actionAsync);
     const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    let onLeaseRequested: () => void = () => undefined;
+    const leaseRequested: Promise<void> = new Promise<void>((resolve) => (onLeaseRequested = resolve));
+    let grantLease: () => void = () => undefined;
+    const leaseGranted: Promise<void> = new Promise<void>((resolve) => (grantLease = resolve));
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      onLeaseRequested();
+      await leaseGranted;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_A),
+      cancelledClient
+    );
+    await leaseRequested;
+    // Accepted while the batch waits for its execution lease, so it joins before the batch reconciles.
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('two')
+    );
+    // Let the continuing request finish preparation and enter the pending queue.
+    for (let tick: number = 0; tick < 20; tick++) {
+      await new Promise<void>((resolve) => setImmediate(resolve));
+    }
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    grantLease();
+    await hanging.started;
+    expect(hanging.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+    hanging.release();
+    expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+  });
+
+  it('keeps a request received during the reconcile out of the batch when its only participant cancels', async () => {
+    const { hanging, actionAsync } = createHangingOperation();
+    const fixture: ITestRoutingFixture = createFixture(actionAsync);
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
     let onReconciling: () => void = () => undefined;
     const reconciling: Promise<void> = new Promise<void>((resolve) => (onReconciling = resolve));
     let releaseReconcile: () => void = () => undefined;
     const reconcileReleased: Promise<void> = new Promise<void>((resolve) => (releaseReconcile = resolve));
+    let reconciles: number = 0;
     fixture.session.onReconcileAsync = async () => {
+      reconciles++;
       onReconciling();
       await reconcileReleased;
     };
@@ -182,23 +228,25 @@ describe('phased request client cancellation', () => {
       cancelledClient
     );
     await reconciling;
-    // Accepted while the batch is still being prepared, so it joins once preparation finishes.
+    // Received after the reconcile started, so it waits for the next batch, which reconciles again.
     const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
       createRequest('continuing', OPERATION_A),
       new TestPhasedRequestClient('two')
     );
-    // Let the continuing request finish preparation and enter the pending queue.
     for (let tick: number = 0; tick < 20; tick++) {
       await new Promise<void>((resolve) => setImmediate(resolve));
     }
 
     cancelledClient.abortController.abort();
+    // The cancelled client is the batch's last participant, so its result still follows the batch's reconcile.
+    expect(await raceWithTimeoutAsync(cancelled, 100)).toBe(TIMED_OUT);
+    releaseReconcile();
     expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
 
-    releaseReconcile();
     await hanging.started;
+    expect(reconciles).toBe(2);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
     expect(hanging.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([false]);
-    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
     hanging.release();
     expect(await continuing).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
   });
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 704df32f27..408f74dbd5 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -7,13 +7,11 @@ import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
 
 import {
-  PhasedCommandEngine,
   Rush,
   RushProjectConfiguration,
   RushUserConfiguration,
   type IOperationGraph,
   type Operation,
-  type OperationEnabledState,
   type RushConfigurationProject
 } from '@microsoft/rush-lib';
 import {
@@ -48,6 +46,8 @@ import {
   type IWorkspaceResolverLifecycle
 } from '../WorkspaceResolverLifecycle';
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IRequestLease } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import { TestPhasedRequestClient } from './PhasedRequestRouterTestUtilities';
 import {
   createNativeScriptGateAsync,
@@ -909,9 +909,11 @@ process.exit(23);
 
   it('uses one native lease for a merged batch and excludes native actions throughout reconciliation and execution', async () => {
     const fixture: IFixture = await createFixtureAsync();
+    const leaseRequested: IDeferred<void> = createDeferred();
+    const grantLease: IDeferred<void> = createDeferred();
     const reconcileEntered: IDeferred<void> = createDeferred();
     const releaseReconciliation: IDeferred<void> = createDeferred();
-    const secondSelection: IDeferred<void> = createDeferred();
+    const secondAdmitted: IDeferred<void> = createDeferred();
     let secondClient: DaemonRequestWireClient | undefined;
     let gate: INativeScriptGate | undefined;
     let first: Promise<ITerminalExchange> | undefined;
@@ -922,7 +924,15 @@ process.exit(23);
       await fixture.session.quiesceWarmSetAsync();
       const graph: IOperationGraph = fixture.session.operationGraph!;
       const scheduleSpy: jest.SpyInstance = jest.spyOn(graph, 'scheduleIterationAsync');
-      const leaseSpy: jest.SpyInstance = jest.spyOn(fixture.session, 'acquireExecutionLeaseAsync');
+      const acquireExecutionLeaseAsync: WorkspaceSession['acquireExecutionLeaseAsync'] =
+        fixture.session.acquireExecutionLeaseAsync.bind(fixture.session);
+      const leaseSpy: jest.SpyInstance = jest
+        .spyOn(fixture.session, 'acquireExecutionLeaseAsync')
+        .mockImplementationOnce(async () => {
+          leaseRequested.resolve();
+          await grantLease.promise;
+          return await acquireExecutionLeaseAsync();
+        });
       const reconcileAsync: WorkspaceSession['reconcileInvalidationsAsync'] =
         fixture.session.reconcileInvalidationsAsync.bind(fixture.session);
       jest.spyOn(fixture.session, 'reconcileInvalidationsAsync').mockImplementationOnce(async () => {
@@ -930,28 +940,38 @@ process.exit(23);
         await releaseReconciliation.promise;
         return await reconcileAsync();
       });
-      const selectAsync: PhasedCommandEngine['selectOperationsAsync'] =
-        PhasedCommandEngine.prototype.selectOperationsAsync;
-      let selections: number = 0;
-      jest.spyOn(PhasedCommandEngine.prototype, 'selectOperationsAsync').mockImplementation(async function (
-        this: PhasedCommandEngine,
-        selectedGraph: IOperationGraph
+      const routeAsync: PhasedRequestRouter['executeAsync'] = PhasedRequestRouter.prototype.executeAsync;
+      let routedRequests: number = 0;
+      jest.spyOn(PhasedRequestRouter.prototype, 'executeAsync').mockImplementation(async function (
+        this: PhasedRequestRouter,
+        ...args: Parameters<PhasedRequestRouter['executeAsync']>
       ) {
-        const selection: ReadonlyMap<Operation, OperationEnabledState> = await selectAsync.call(
-          this,
-          selectedGraph
-        );
-        if (++selections === 2) secondSelection.resolve();
-        return selection;
+        routedRequests++;
+        return await routeAsync.apply(this, args);
+      });
+      const admitAsync: RequestAdmissionController['acquireAsync'] =
+        RequestAdmissionController.prototype.acquireAsync;
+      jest.spyOn(RequestAdmissionController.prototype, 'acquireAsync').mockImplementation(async function (
+        this: RequestAdmissionController,
+        ...args: Parameters<RequestAdmissionController['acquireAsync']>
+      ) {
+        const lease: IRequestLease = await admitAsync.apply(this, args);
+        // The router admits each request once, after the workspace lifecycle has, and then enqueues it.
+        if (routedRequests === 2) secondAdmitted.resolve();
+        return lease;
       });
       gate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
       secondClient = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
       await secondClient.handshakeAsync();
       first = runAsync(fixture, 'dependency', ['build', '--to', 'a']);
-      await reconcileEntered.promise;
+      await leaseRequested.promise;
+      // Accepted while the batch waits for its native lease, so it joins before the batch reconciles.
       second = runAsync({ ...fixture, client: secondClient }, 'consumer', ['build', '--to', 'b']);
-      await secondSelection.promise;
+      await secondAdmitted.promise;
+      // After admission, the router enqueues the request without awaiting.
       await new Promise<void>((resolve) => setImmediate(resolve));
+      grantLease.resolve();
+      await reconcileEntered.promise;
       expect(await runNativeCommandAsync(fixture.repoRoot, ['rebuild', '--only', 'c'])).toMatchObject({
         exitCode: 1,
         stdout: expect.stringContaining('Another Rush command')
@@ -980,6 +1000,7 @@ process.exit(23);
       expect(scheduleSpy).toHaveBeenCalledTimes(1);
       expect(runs(fixture)).toEqual(['c:one:', 'a:one:', 'b:one:']);
     } finally {
+      grantLease.resolve();
       releaseReconciliation.resolve();
       await gate?.releaseAsync();
       await first;

From 103bd5e050c5a004b682ba2e0a4abe763db04048 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 17:04:32 +0000
Subject: [PATCH 025/265] [rush-daemon] Another request's graph load doesn't
 spend any finite wait timeout

Swarm integration step 10; original commit 908dcc1f27 (merge of swarm/r05 at 868e4b9299).
Refs: task 7 part 3, board 891.

ch01 GATE OK board 1196 (gated tree 55698be825).

Commits folded into this step (1):
- 868e4b9299 [rush-daemon] Admission: another request's graph load doesn't spend any finite wait timeout

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  27 ++-
 .../src/ClientAdmissionControls.ts            |  11 +-
 .../src/test/ClientAdmissionControls.test.ts  |  13 +-
 ...mission-wait-timeout_2026-09-28-13-45.json |  10 +
 ...mission-wait-timeout_2026-09-28-13-45.json |  10 +
 docs/rush/environment-variables.md            |   2 +-
 libraries/rush-daemon/README.md               |  26 +--
 .../src/WorkspaceRequestAdmission.ts          | 158 +++++++++++-----
 .../src/WorkspaceRequestLifecycle.ts          |   2 +-
 .../src/WorkspaceRestartArbiter.ts            |   2 +-
 .../test/WorkspaceRequestAdmission.test.ts    | 175 +++++++++++-------
 .../test/WorkspaceTransitionAdmission.test.ts |  46 ++++-
 12 files changed, 335 insertions(+), 147 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index ba0dcca5da..f651b98bab 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -49,15 +49,22 @@ rounded down to milliseconds. These controls are mutually exclusive and are
 consumed before forwarding, never appended to a project script. Arguments after
 `--` remain literal script arguments.
 
-The queue timeout is measured from when the daemon receives the request. An
-explicit `--no-wait`, `--wait-timeout`, `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, or
-`daemon.queueTimeoutSeconds` in `rush.json` bounds the entire wait: waiting for
-workspace admission and waiting for a running build that the request could not
-join. The built-in 30-second default bounds only workspace admission (for example,
-waiting for a command that needs exclusive access). With the default, a build that
-arrives while a compatible build is already running waits for it to finish and then
-runs, instead of failing after 30 seconds. On a timeout, the client exits with
-code 1 and says how to wait longer.
+The queue timeout is measured from when the daemon receives the request, and only
+time spent waiting for other requests counts against it, whether it comes from
+`--wait-timeout`, `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, `daemon.queueTimeoutSeconds`
+in `rush.json`, or the built-in 30-second default. Waiting while another request
+loads or reloads the workspace graph does not count, so every build that arrives
+while the first build after startup loads the graph runs once the load finishes.
+That wait fails after 10 times the timeout (5 minutes with the default), so a load
+that never finishes does not hold other requests forever. The request's own routing
+and execution do not count either. A configured or per-invocation timeout also
+limits waiting for a running build that the request could not join; the built-in
+default does not. With the default, a build that arrives while a compatible build is
+already running waits for it to finish and then runs, instead of failing after 30
+seconds. `--no-wait` fails wherever the request would wait. On a timeout, the client
+exits with code 1 and suggests `--wait-timeout`. It does not suggest exporting
+`RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, because Rush versions that do not recognize a
+`RUSH_` environment variable fail every command while it is set.
 
 Admission controls also apply to experimental graph requests, but not
 `start|stop|restart|status|logs`. They affect daemon admission only; native fallback
@@ -212,7 +219,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `enabled` | `RUSH_DAEMON` | false | Client routing |
 | `autoStart` | `RUSH_DAEMON_AUTO_START` | true | Only after opt-in |
 | `idleTimeoutSeconds` | `RUSH_DAEMON_IDLE_TIMEOUT_SECONDS` | 900 | Host idle shutdown after request/output/cleanup drain |
-| `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. The default does not bound waiting behind a running compatible build; an explicit value does |
+| `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. Time behind another request's graph load (up to 10 times the limit) and the request's own work do not count. The default does not limit waiting behind a running compatible build; an explicit value does |
 | `watch` | `RUSH_DAEMON_WATCH` | false | Persistent host observation of requested warm projects; false keeps root/config guards only. Never schedules builds |
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
diff --git a/apps/rush-cli-client/src/ClientAdmissionControls.ts b/apps/rush-cli-client/src/ClientAdmissionControls.ts
index a0dc6cb017..bd3d04edeb 100644
--- a/apps/rush-cli-client/src/ClientAdmissionControls.ts
+++ b/apps/rush-cli-client/src/ClientAdmissionControls.ts
@@ -82,12 +82,15 @@ export function formatAdmissionFailure(
     return `${prefix}: another daemon request is using this workspace and --no-wait was specified.\n`;
   }
   if (code === 'wait-timeout') {
-    const seconds: string =
-      admission?.waitTimeoutMs === undefined ? '' : ` after ${admission.waitTimeoutMs / 1000}s`;
+    const timeout: string =
+      admission?.waitTimeoutMs === undefined
+        ? ''
+        : ` after its ${admission.waitTimeoutMs / 1000}s wait timeout`;
     return (
-      `${prefix}: timed out${seconds} waiting for another daemon request in this workspace to finish ` +
+      `${prefix}: timed out${timeout} waiting for another daemon request in this workspace to finish ` +
       '(a command that needs exclusive access, or a running build). ' +
-      'To wait longer, use --wait-timeout <seconds> or set RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS.\n'
+      // Only the per-invocation flag is offered: Rush versions that do not recognize the variable reject it.
+      'To wait longer, pass --wait-timeout <seconds>.\n'
     );
   }
   return `${prefix}.\n`;
diff --git a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
index 5aea17bc37..c835699a2f 100644
--- a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
+++ b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
@@ -68,17 +68,20 @@ describe(getConfiguredAdmission.name, () => {
     });
   });
 
-  it('keeps an explicitly configured timeout as one absolute deadline', () => {
+  it('does not mark an explicitly configured timeout as the default', () => {
     expect(getConfiguredAdmission({ queueTimeoutSeconds: 1.5, explicit: true })).toEqual({ waitTimeoutMs: 1500 });
   });
 });
 
 describe(formatAdmissionFailure.name, () => {
-  it('explains a wait timeout and how to wait longer', () => {
+  it('explains a wait timeout and offers only the per-invocation way to wait longer', () => {
     const message: string = formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 });
-    expect(message).toContain('daemon admission failed (wait-timeout): timed out after 5s waiting for');
-    expect(message).toContain('--wait-timeout <seconds>');
-    expect(message).toContain('RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS');
+    expect(message).toContain(
+      'daemon admission failed (wait-timeout): timed out after its 5s wait timeout waiting for'
+    );
+    expect(message).toContain('pass --wait-timeout <seconds>');
+    // Exporting it would break later commands of Rush versions that reject unknown RUSH_ variables.
+    expect(message).not.toContain('RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS');
   });
 
   it('explains a no-wait failure', () => {
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json b/common/changes/@rushstack/rush-cli-client/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json
new file mode 100644
index 0000000000..f0547ce6ea
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "A daemon admission timeout names the timeout that expired and suggests only --wait-timeout, because exporting RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS breaks Rush versions that do not recognize it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json b/common/changes/@rushstack/rush-daemon/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json
new file mode 100644
index 0000000000..454b715b4f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-admission-wait-timeout_2026-09-28-13-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Admission: time spent waiting while another request loads or reloads the workspace graph no longer counts against any finite wait timeout, explicit or default, and is limited to 10 times that timeout instead; an admitted request's own routing and execution no longer spend an explicit timeout either. Timeout messages suggest --wait-timeout rather than exporting RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 721e370fc3..590a0932a3 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -24,7 +24,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON` | `0` | Opt into daemon execution through the separate clients. `0` disables it. Overrides `daemon.enabled`. |
 | `RUSH_DAEMON_AUTO_START` | `1` | Start an absent compatible daemon after daemon execution is selected. Does not itself opt in. Overrides `autoStart`. |
 | `RUSH_DAEMON_IDLE_TIMEOUT_SECONDS` | `900` | Shut down after the last pending request, output drain and cleanup are complete. Positive seconds, at most 2147483.647. Overrides `idleTimeoutSeconds`. |
-| `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | `30` | Maximum request admission wait. Nonnegative seconds, at most 2147483.647; converted to whole milliseconds by rounding down. Per-invocation `--wait-timeout` or `--no-wait` takes precedence. Overrides `queueTimeoutSeconds`. |
+| `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | `30` | Maximum request admission wait. Nonnegative seconds, at most 2147483.647; converted to whole milliseconds by rounding down. Time behind another request's load of the workspace graph (up to 10 times this value) does not count. Per-invocation `--wait-timeout` or `--no-wait` takes precedence. Overrides `queueTimeoutSeconds`. |
 | `RUSH_DAEMON_WATCH` | `0` | Observe requested warm projects between requests. Never schedules builds and does not enable `--watch` mode. Root/config guards and request-time input reconciliation remain active when disabled. Overrides `watch`. |
 | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | `0` | Enable explicitly configured `operationSettings[].daemonIpc` Node workers for supported incremental daemon builds. Does not convert arbitrary shell scripts into persistent workers. Overrides `usePersistentIpcRunners`. |
 | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 4cadfb0bda..250201ec20 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -457,17 +457,21 @@ the router validates both, reconciles retained invalidations, applies the select
 and runs at most one scheduled iteration. A workspace-wide `RequestScheduler` admits phased and global routes using
 the static built-in command policy (`SHARED-BUILD`, `SHARED-READ`, or `EXCLUSIVE`); custom-origin commands and unknown
 built-in names fail closed to `EXCLUSIVE`, including plugin replacements of built-in names. Queued clients receive
-ordered, one-based position controls and can request fail-fast or bounded waiting. One progress channel covers both
-workspace admission and the temporary phased graph-execution gate. An explicit `noWait` or `waitTimeoutMs` is one
-absolute deadline for both waits. When the client marks `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), it is
-a budget that only contention spends: a `SHARED-BUILD` request that arrives after the current batch has closed waits
-on the graph-execution gate without a deadline, because it is queued only behind running compatible shared builds, and
-then runs in the next batch. A request queued behind another request that holds exclusive workspace admission to load
-or reload the graph does not spend the budget during that load, so every build that arrives while the first build
-after startup loads the graph is admitted when the load finishes. The budget does run while that other request still
-waits for exclusive admission, so requests behind a reload that cannot start, for example behind a long build, still
-time out. Routing and executing an admitted request do not spend the budget either: a request that re-enters
-workspace admission to reload the graph after its inputs changed keeps the budget it had when it was admitted.
+ordered, one-based position controls and can request fail-fast or time-limited waiting. One progress channel covers
+both workspace admission and the temporary phased graph-execution gate. `noWait` fails at once wherever the request
+would wait. A finite `waitTimeoutMs` is a budget that only contention spends, whether it is the client's default or an
+explicit value. A request queued behind another request that holds exclusive workspace admission to load or reload
+the graph does not spend its budget during that load, so every build that arrives while the first build after startup
+loads the graph is admitted when the load finishes. That wait is limited separately, to 10 times `waitTimeoutMs`, so
+a load that never finishes does not hold the requests behind it indefinitely. The budget does run while that other
+request still waits for exclusive admission, so requests behind a reload that cannot start, for example behind a long
+build, still time out. Routing and executing an admitted request do not spend the budget either. Routing boundaries
+such as the graph-execution gate apply the remaining budget they receive, and a request that re-enters workspace
+admission to reload the graph after its inputs changed starts again from the budget it had when it was admitted; time
+it spent at those boundaries is not charged again. The default and an explicit value differ only at the
+graph-execution gate. When the client marks `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), a `SHARED-BUILD`
+request that arrives after the current batch has closed waits there without a deadline, because it is queued only
+behind running compatible shared builds, and then runs in the next batch. An explicit value still limits that wait.
 Cancellation, disconnect, or queue-output failure removes queued work before it can execute.
 A requesting client receives only its enabled dependency closure's WS1 raw chunks and structured events through
 backpressured, ordered callbacks, followed exactly once by a typed final command result after all preceding output
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index edf357db67..40e49c264e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -1,7 +1,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { validateDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+import {
+  MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS,
+  validateDaemonRequestAdmissionOptions
+} from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonRequestAdmissionErrorCode,
   IDaemonRequestAdmissionOptions,
@@ -33,6 +36,14 @@ export interface IRequestAdmissionControllerOptions {
 }
 
 const REQUEST_SCHEDULER_BY_SESSION: WeakMap<IWorkspaceSession, RequestScheduler> = new WeakMap();
+/** A request waits for another request's graph load or reload for up to this many times its wait timeout. */
+const GRAPH_LOAD_WAIT_FACTOR: number = 10;
+// Only the per-invocation flag is offered: Rush versions that do not recognize the environment variable reject it.
+const WAIT_LONGER_HINT: string = 'Use --wait-timeout <seconds> to wait longer.';
+
+function formatSeconds(ms: number): string {
+  return `${Math.round(ms / 100) / 10}s`;
+}
 
 class WorkspaceRequestScheduler extends RequestScheduler {
   readonly #session: IWorkspaceSession;
@@ -120,45 +131,75 @@ export class AdmissionProgress {
   }
 }
 
-/** A wait budget that is spent only while `progress` is inactive. */
+/**
+ * A wait budget that is spent only while `progress` is inactive.
+ *
+ * @remarks
+ * Waiting while `progress` is active is limited separately, to `maxPausedMs` in total, so that a wedged transition
+ * does not hold the requests behind it indefinitely. `onExhausted` receives whether that limit, rather than the
+ * budget, ran out.
+ */
 class ProgressPausedBudget {
-  readonly #onExhausted: () => void;
+  readonly #maxPausedMs: number;
+  readonly #onExhausted: (pausedLimitReached: boolean) => void;
   readonly #progress: AdmissionProgress;
   readonly #unsubscribe: () => void;
+  #intervalStartMs: number = 0;
+  #paused: boolean = false;
+  #pausedMs: number = 0;
   #remainingMs: number;
-  #runningSinceMs: number | undefined;
   #timer: ReturnType<typeof setTimeout> | undefined;
 
-  public constructor(remainingMs: number, progress: AdmissionProgress, onExhausted: () => void) {
+  public constructor(
+    remainingMs: number,
+    maxPausedMs: number,
+    progress: AdmissionProgress,
+    onExhausted: (pausedLimitReached: boolean) => void
+  ) {
     this.#remainingMs = remainingMs;
+    this.#maxPausedMs = maxPausedMs;
     this.#progress = progress;
     this.#onExhausted = onExhausted;
-    this.#unsubscribe = progress.subscribe(() => this.#update());
-    this.#update();
+    this.#unsubscribe = progress.subscribe(() => {
+      this.#endInterval();
+      this.#startInterval();
+    });
+    this.#startInterval();
   }
 
-  /** Stops spending and returns the unspent budget. */
-  public stop(): number {
-    this.#unsubscribe();
-    this.#pause();
+  /** The time that was not spent from the budget because `progress` was active. */
+  public get pausedMs(): number {
+    return this.#pausedMs;
+  }
+
+  /** The unspent budget. */
+  public get remainingMs(): number {
     return this.#remainingMs;
   }
 
-  #update(): void {
-    if (this.#progress.active) {
-      this.#pause();
-    } else if (this.#runningSinceMs === undefined) {
-      this.#runningSinceMs = Date.now();
-      this.#timer = setTimeout(this.#onExhausted, this.#remainingMs);
-    }
+  /** Stops spending; `pausedMs` and `remainingMs` are final afterwards. Calling it again has no effect. */
+  public stop(): void {
+    this.#unsubscribe();
+    this.#endInterval();
   }
 
-  #pause(): void {
-    if (this.#runningSinceMs === undefined) return;
-    this.#remainingMs = Math.max(0, this.#remainingMs - (Date.now() - this.#runningSinceMs));
-    this.#runningSinceMs = undefined;
+  #startInterval(): void {
+    this.#paused = this.#progress.active;
+    this.#intervalStartMs = Date.now();
+    const delayMs: number = this.#paused ? this.#maxPausedMs - this.#pausedMs : this.#remainingMs;
+    this.#timer = setTimeout(() => this.#onExhausted(this.#paused), Math.max(0, delayMs));
+  }
+
+  #endInterval(): void {
+    if (this.#timer === undefined) return;
     clearTimeout(this.#timer);
     this.#timer = undefined;
+    const elapsedMs: number = Date.now() - this.#intervalStartMs;
+    if (this.#paused) {
+      this.#pausedMs += elapsedMs;
+    } else {
+      this.#remainingMs = Math.max(0, this.#remainingMs - elapsedMs);
+    }
   }
 }
 
@@ -209,7 +250,7 @@ export class RequestAdmissionController {
    * @remarks
    * A shared-build request that reaches this gate is only waiting behind running compatible shared builds, which is
    * progress rather than contention. A client-default timeout therefore does not apply to that wait; an explicit
-   * `noWait` or `waitTimeoutMs` still applies, using the same absolute deadline as workspace admission.
+   * `noWait` or `waitTimeoutMs` still applies, using the request's remaining admission budget.
    */
   public async acquireGraphExecutionAsync(
     scheduler: RequestScheduler,
@@ -232,10 +273,12 @@ export class RequestAdmissionController {
    *
    * @remarks
    * While `transition` reports progress, the other request holds the exclusive gate and is loading the graph that
-   * this request needs, so a client-default timeout is not spent: at a cold start every concurrent build waits for
-   * the first build's graph load. The default budget is still spent while the transition itself waits for another
-   * request, so a transition that cannot start does not hold its followers indefinitely. Unspent budget carries over
-   * to later waits of this request. An explicit `noWait` or `waitTimeoutMs` applies unchanged.
+   * this request needs, so the request's wait timeout is not spent: at a cold start every concurrent build waits for
+   * the first build's graph load, whether its timeout is the client default or explicit. That wait is limited
+   * separately, to `GRAPH_LOAD_WAIT_FACTOR` times the wait timeout, so a wedged load does not hold its followers
+   * indefinitely. The timeout is still spent while the transition itself waits for another request, so a transition
+   * that cannot start does not hold its followers either. Unspent time carries over to later waits of this request.
+   * `noWait` still fails at once.
    */
   public async acquireBehindTransitionAsync(
     scheduler: RequestScheduler,
@@ -243,12 +286,27 @@ export class RequestAdmissionController {
   ): Promise<IRequestLease> {
     const waitingFor: string = "another request's load or reload of the workspace graph";
     const remainingMs: number | undefined = this.#getRemainingWaitTimeoutMs();
-    if (!this.#admission?.waitTimeoutIsDefault || remainingMs === undefined) {
-      return await this.#acquireAsync(scheduler, RequestExclusivityClass.SharedBuild, remainingMs, waitingFor);
+    const waitTimeoutMs: number | undefined = this.#admission?.waitTimeoutMs;
+    if (remainingMs === undefined || waitTimeoutMs === undefined) {
+      return await this.#acquireAsync(
+        scheduler,
+        RequestExclusivityClass.SharedBuild,
+        remainingMs,
+        waitingFor
+      );
     }
     const exhausted: AbortController = new AbortController();
-    const budget: ProgressPausedBudget = new ProgressPausedBudget(remainingMs, transition, () =>
-      exhausted.abort()
+    let pausedLimitReached: boolean = false;
+    const budget: ProgressPausedBudget = new ProgressPausedBudget(
+      remainingMs,
+      Math.min(GRAPH_LOAD_WAIT_FACTOR * waitTimeoutMs, MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS),
+      transition,
+      (reachedPausedLimit: boolean) => {
+        if (!exhausted.signal.aborted) {
+          pausedLimitReached = reachedPausedLimit;
+          exhausted.abort();
+        }
+      }
     );
     try {
       return await this.#acquireAsync(
@@ -259,30 +317,38 @@ export class RequestAdmissionController {
         AbortSignal.any([this.#abortController.signal, exhausted.signal])
       );
     } catch (error) {
+      budget.stop();
       if (!exhausted.signal.aborted || this.#abortController.signal.aborted) throw error;
-      throw this.#getReportedError(
-        new RequestSchedulerError(
-          RequestSchedulerErrorCode.WaitTimeout,
-          `The request was not admitted within ${this.#admission.waitTimeoutMs}ms.`
-        ),
-        waitingFor
+      const message: string = pausedLimitReached
+        ? `The request was not admitted within ${GRAPH_LOAD_WAIT_FACTOR} times its ${waitTimeoutMs}ms wait ` +
+          `timeout because ${waitingFor} was still running after ${formatSeconds(budget.pausedMs)}.`
+        : `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ` +
+          `${waitingFor}` +
+          (budget.pausedMs > 0
+            ? `; ${formatSeconds(budget.pausedMs)} spent while that request loaded the graph did not count.`
+            : '.');
+      throw new RequestSchedulerError(
+        RequestSchedulerErrorCode.WaitTimeout,
+        `${message} ${WAIT_LONGER_HINT}`
       );
     } finally {
-      this.#deadlineMs = Date.now() + budget.stop();
+      budget.stop();
+      this.#deadlineMs = Date.now() + budget.remainingMs;
     }
   }
 
   /**
-   * Runs `action`, such as routing and executing an admitted request, without spending a client-default budget.
+   * Runs `action`, such as routing and executing an admitted request, without spending the request's wait timeout.
    *
    * @remarks
-   * Work after admission either runs or waits behind progress, such as the exempt graph-execution gate. A request that
-   * re-enters workspace admission afterwards, for example to reload the graph after its inputs changed, therefore
-   * keeps the budget it had before `action`. An explicit `noWait` or `waitTimeoutMs` keeps its absolute deadline.
+   * Work after admission either runs or waits at a routing boundary that applies the timeout it received, such as the
+   * graph-execution gate. A request that re-enters workspace admission afterwards, for example to reload the graph
+   * after its inputs changed, therefore keeps the unspent timeout it had before `action`, whether that timeout is the
+   * client default or explicit.
    */
-  public async runOutsideDefaultBudgetAsync<T>(action: () => Promise<T>): Promise<T> {
+  public async runOutsideWaitBudgetAsync<T>(action: () => Promise<T>): Promise<T> {
     const remainingMs: number | undefined = this.#getRemainingWaitTimeoutMs();
-    if (!this.#admission?.waitTimeoutIsDefault || remainingMs === undefined) {
+    if (remainingMs === undefined) {
       return await action();
     }
     try {
@@ -361,8 +427,8 @@ export class RequestAdmissionController {
     ) {
       return new RequestSchedulerError(
         RequestSchedulerErrorCode.WaitTimeout,
-        `The request was not admitted within ${waitTimeoutMs}ms while waiting for ${waitingFor}. ` +
-          'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.'
+        `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ${waitingFor}. ` +
+          WAIT_LONGER_HINT
       );
     }
     return error;
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index b13176adca..9b51147ecb 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -222,7 +222,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             ...envelope,
             admission: admission.remainingAdmission
           };
-          await admission.runOutsideDefaultBudgetAsync(async () => {
+          await admission.runOutsideWaitBudgetAsync(async () => {
             if (isMutation(envelope)) {
               await this.#executeMutationAsync(prepared, requestEnvelope, client, state, dispatchAsync);
             } else {
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index 9fb26f6455..b1228eaca7 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -114,7 +114,7 @@ export class WorkspaceRestartArbiter {
               new RequestSchedulerError(
                 RequestSchedulerErrorCode.WaitTimeout,
                 'The request was not admitted before the daemon could restart for its environment. ' +
-                  'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.'
+                  'Use --wait-timeout <seconds> to wait longer.'
               )
             ),
           Math.min(MAX_TIMER_DELAY_MS, Math.max(0, deadline - Date.now()))
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
index 232687ffb5..23b261466b 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -1,7 +1,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+import {
+  type IDaemonRequestAdmissionOptions,
+  MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS
+} from '@rushstack/rush-daemon-protocol';
 
 import {
   type IRequestLease,
@@ -13,6 +16,10 @@ import { AdmissionProgress, RequestAdmissionController } from '../WorkspaceReque
 
 const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100, waitTimeoutIsDefault: true };
 const EXPLICIT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100 };
+const BUDGETS: ReadonlyArray<{ kind: string; budget: IDaemonRequestAdmissionOptions }> = [
+  { kind: 'a default', budget: DEFAULT_BUDGET },
+  { kind: 'an explicit', budget: EXPLICIT_BUDGET }
+];
 
 interface IAcquisition {
   settled: boolean;
@@ -59,53 +66,99 @@ describe(RequestAdmissionController.name, () => {
     jest.useRealTimers();
   });
 
-  it('does not spend a default budget while the transition it waits behind makes progress', async () => {
-    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
-    transition.setActive(true);
-    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
-    await jest.advanceTimersByTimeAsync(10_000);
-    expect(waiting.settled).toBe(false);
+  it.each(BUDGETS)(
+    'does not spend $kind timeout while the transition it waits behind makes progress',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      transition.setActive(true);
+      const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+      await jest.advanceTimersByTimeAsync(999);
+      expect(waiting.settled).toBe(false);
+
+      scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+      transition.setActive(false);
+      await jest.advanceTimersByTimeAsync(0);
+      expect(waiting.settled).toBe(true);
+      expect(waiting.error).toBeUndefined();
+      expect(waiting.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+      waiting.lease?.release();
+      controller.dispose();
+    }
+  );
 
-    scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
-    transition.setActive(false);
-    await jest.advanceTimersByTimeAsync(0);
-    expect(waiting.settled).toBe(true);
-    expect(waiting.error).toBeUndefined();
-    expect(waiting.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
-    waiting.lease?.release();
-    controller.dispose();
-  });
+  it.each(BUDGETS)(
+    'spends $kind timeout while the transition itself waits, and carries the rest across progress',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+      await jest.advanceTimersByTimeAsync(60);
+      transition.setActive(true);
+      await jest.advanceTimersByTimeAsync(900);
+      transition.setActive(false);
+      await jest.advanceTimersByTimeAsync(39);
+      expect(waiting.settled).toBe(false);
+
+      await jest.advanceTimersByTimeAsync(1);
+      expect(waiting.error).toMatchObject({
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message:
+          "The request was not admitted within its 100ms wait timeout while waiting for another request's load " +
+          'or reload of the workspace graph; 0.9s spent while that request loaded the graph did not count. ' +
+          'Use --wait-timeout <seconds> to wait longer.'
+      });
+      expect(scheduler.queuedRequestCount).toBe(0);
+      controller.dispose();
+    }
+  );
 
-  it('spends a default budget while the transition itself waits, and carries the rest across progress', async () => {
-    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
-    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
-    await jest.advanceTimersByTimeAsync(60);
+  it('fails once the transition it waits behind has made progress for ten times its timeout', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
     transition.setActive(true);
-    await jest.advanceTimersByTimeAsync(10_000);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(600);
+    // Time spent while the transition waits is budget, not paused time, so it does not advance the paused limit.
     transition.setActive(false);
-    await jest.advanceTimersByTimeAsync(39);
+    await jest.advanceTimersByTimeAsync(50);
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(399);
     expect(waiting.settled).toBe(false);
 
     await jest.advanceTimersByTimeAsync(1);
     expect(waiting.error).toMatchObject({
       code: RequestSchedulerErrorCode.WaitTimeout,
-      message: expect.stringContaining(
-        "not admitted within 100ms while waiting for another request's load or reload of the workspace graph"
-      )
+      message:
+        "The request was not admitted within 10 times its 100ms wait timeout because another request's load " +
+        'or reload of the workspace graph was still running after 1s. Use --wait-timeout <seconds> to wait longer.'
     });
     expect(scheduler.queuedRequestCount).toBe(0);
     controller.dispose();
   });
 
-  it('keeps an explicit deadline behind a transition that makes progress', async () => {
-    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+  it('limits the paused wait for the largest timeout to the timer range', async () => {
+    const client: AbortController = new AbortController();
+    const controller: RequestAdmissionController = createController(
+      { waitTimeoutMs: MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS },
+      client.signal
+    );
     transition.setActive(true);
     const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
-    await jest.advanceTimersByTimeAsync(99);
+    // A delay beyond the timer range would fire after 1ms.
+    await jest.advanceTimersByTimeAsync(10_000);
     expect(waiting.settled).toBe(false);
 
-    await jest.advanceTimersByTimeAsync(1);
-    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    client.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.Aborted });
+    controller.dispose();
+  });
+
+  it('fails at once behind a transition when the request does not wait', async () => {
+    const controller: RequestAdmissionController = createController({ noWait: true });
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.NoWait });
+    expect(scheduler.queuedRequestCount).toBe(0);
     controller.dispose();
   });
 
@@ -121,39 +174,31 @@ describe(RequestAdmissionController.name, () => {
     controller.dispose();
   });
 
-  it('keeps an unspent default budget across admitted work for a later admission wait', async () => {
-    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
-    await jest.advanceTimersByTimeAsync(40);
-    const work: Promise<void> = controller.runOutsideDefaultBudgetAsync(
-      () => new Promise<void>((resolve) => setTimeout(resolve, 10_000))
-    );
-    await jest.advanceTimersByTimeAsync(10_000);
-    await work;
-    expect(controller.remainingAdmission).toEqual({ ...DEFAULT_BUDGET, waitTimeoutMs: 60 });
-
-    const waiting: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild));
-    await jest.advanceTimersByTimeAsync(59);
-    expect(waiting.settled).toBe(false);
-    await jest.advanceTimersByTimeAsync(1);
-    expect(waiting.error).toMatchObject({
-      code: RequestSchedulerErrorCode.WaitTimeout,
-      message: expect.stringContaining('not admitted within 100ms while waiting for workspace admission')
-    });
-    controller.dispose();
-  });
-
-  it('keeps an explicit deadline running across admitted work', async () => {
-    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
-    const work: Promise<void> = controller.runOutsideDefaultBudgetAsync(
-      () => new Promise<void>((resolve) => setTimeout(resolve, 10_000))
-    );
-    await jest.advanceTimersByTimeAsync(10_000);
-    await work;
-    expect(controller.remainingAdmission).toEqual({ waitTimeoutMs: 0 });
-
-    const waiting: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild));
-    await jest.advanceTimersByTimeAsync(0);
-    expect(waiting.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
-    controller.dispose();
-  });
+  it.each(BUDGETS)(
+    'keeps the unspent part of $kind timeout across admitted work for a later admission wait',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      await jest.advanceTimersByTimeAsync(40);
+      const work: Promise<void> = controller.runOutsideWaitBudgetAsync(
+        () => new Promise<void>((resolve) => setTimeout(resolve, 10_000))
+      );
+      await jest.advanceTimersByTimeAsync(10_000);
+      await work;
+      expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 60 });
+
+      const waiting: IAcquisition = track(
+        controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild)
+      );
+      await jest.advanceTimersByTimeAsync(59);
+      expect(waiting.settled).toBe(false);
+      await jest.advanceTimersByTimeAsync(1);
+      expect(waiting.error).toMatchObject({
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message:
+          'The request was not admitted within its 100ms wait timeout while waiting for workspace admission. ' +
+          'Use --wait-timeout <seconds> to wait longer.'
+      });
+      controller.dispose();
+    }
+  );
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
index 1337cb515f..2d8586d358 100644
--- a/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
@@ -39,7 +39,7 @@ function expectWaitTimeout(exchange: ITerminalExchange): void {
 }
 
 describe('workspace admission behind a graph transition', () => {
-  it('admits builds that arrive while another build loads the graph without spending their default budget', async () => {
+  it('admits builds that arrive while another build loads the graph without spending their wait timeout', async () => {
     const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
     try {
       const loadStarted: IDeferred<void> = createDeferred<void>();
@@ -54,22 +54,60 @@ describe('workspace admission behind a graph transition', () => {
       const withDefaultBudget: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, {
         admission: DEFAULT_BUDGET
       });
-      const withExplicitBudget: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+      // Raising the timeout must not make a build fail behind a load that the default timeout waits for.
+      const withExplicitBudget: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, {
         admission: { waitTimeoutMs: 300 }
       });
-      expectWaitTimeout(withExplicitBudget);
       await delayAsync(600);
 
       fixture.beforeCreateSessionAsync = undefined;
       releaseLoad.resolve();
       expectSuccess(await first);
       expectSuccess(await withDefaultBudget);
+      expectSuccess(await withExplicitBudget);
       expect(fixture.runs()).toEqual(['a', 'b']);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
   });
 
+  it('fails a build that has waited behind a graph load for ten times its wait timeout', async () => {
+    const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+    const loadStarted: IDeferred<void> = createDeferred<void>();
+    const releaseLoad: IDeferred<void> = createDeferred<void>();
+    try {
+      fixture.beforeCreateSessionAsync = async () => {
+        loadStarted.resolve();
+        await releaseLoad.promise;
+      };
+      const first: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B);
+      await loadStarted.promise;
+
+      const startedAt: number = Date.now();
+      const behindWedgedLoad: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+        admission: { waitTimeoutMs: 100 }
+      });
+      expect(Date.now() - startedAt).toBeGreaterThanOrEqual(900);
+      expectWaitTimeout(behindWedgedLoad);
+      expect(behindWedgedLoad.terminal).toMatchObject({
+        payload: {
+          errorMessage: expect.stringContaining(
+            "within 10 times its 100ms wait timeout because another request's load or reload of the workspace " +
+              'graph was still running'
+          )
+        }
+      });
+
+      fixture.beforeCreateSessionAsync = undefined;
+      releaseLoad.resolve();
+      expectSuccess(await first);
+    } finally {
+      // A failed expectation must not leave the load held, which would keep the fixture from shutting down.
+      releaseLoad.resolve();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('keeps a graph-gate waiter default budget for its reload after an input change', async () => {
     const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
       created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
@@ -105,6 +143,8 @@ describe('workspace admission behind a graph transition', () => {
       // The waiter's batch finds the changed input and re-enters admission behind the reload.
       expectSuccess(await graphGateWaiter);
     } finally {
+      // A failed expectation must not leave the long build running, which would keep the fixture from shutting down.
+      fs.writeFileSync(releaseFile, '');
       await fixture[Symbol.asyncDispose]();
     }
   });

From 86780e6b4ffd0561e2ce9d81812a636d432b2b89 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 17:04:33 +0000
Subject: [PATCH 026/265] [rush-lib] Keep cache trust for unselected retained
 results and re-verify untrusted ones

Swarm integration step 11; original commit 4456f17460 (merge of swarm/r07 at 53654af37c).
Refs: board 401, task 74, board 982, board 1024.

ch01 GATE OK board 1197 (gated tree 3014a03bb8).

Commits folded into this step (3):
- b6692d09a5 [rush-lib] Keep cache trust for unselected retained results and re-verify untrusted ones
- 492126a051 [rush-lib] Re-verify retained results built against unverified dependency outputs without the build cache
- 53654af37c [rush-daemon] Test that input captures are shared only between equal fingerprint environments

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...etained-result-trust_2026-09-28-14-10.json |  10 +
 ...ify-retained-results_2026-09-28-15-25.json |  10 +
 ...ure-environment-test_2026-09-28-15-47.json |  10 +
 .../test/WorkspaceInputCaptureSharing.test.ts |  67 ++-
 .../operations/CacheableOperationPlugin.ts    |  31 +-
 .../logic/operations/PhasedOperationPlugin.ts |  98 +++-
 .../operations/RetainedResultVerification.ts  |  76 ++++
 .../test/CacheableOperationPlugin.test.ts     |  26 +-
 ...ableOperationPluginRetainedResults.test.ts | 414 +++++++++++++++++
 ...asedOperationPluginRetainedResults.test.ts | 418 ++++++++++++++++++
 10 files changed, 1144 insertions(+), 16 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json
 create mode 100644 common/changes/@microsoft/rush/swarm-r07-verify-retained-results_2026-09-28-15-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r07-input-capture-environment-test_2026-09-28-15-47.json
 create mode 100644 libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json b/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json
new file mode 100644
index 0000000000..f77be5bea1
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "In long-lived operation graphs such as the Rush daemon, an operation that a request did not select no longer blocks build cache writes for its consumers if its retained result is trusted at its current state hash. A selected operation whose retained result is not trusted is now restored from the build cache or run again instead of being skipped, so it no longer stops cache writes for its consumers or keeps outputs that were built against dependencies that have since been rebuilt.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@microsoft/rush/swarm-r07-verify-retained-results_2026-09-28-15-25.json b/common/changes/@microsoft/rush/swarm-r07-verify-retained-results_2026-09-28-15-25.json
new file mode 100644
index 0000000000..82bc56e33d
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r07-verify-retained-results_2026-09-28-15-25.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "In long-lived operation graphs such as the Rush daemon, a selected operation whose retained result was built against outputs of a dependency that have since been rebuilt is now run again instead of being skipped, even if build cache writes are disabled or the build cache is off.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r07-input-capture-environment-test_2026-09-28-15-47.json b/common/changes/@rushstack/rush-daemon/swarm-r07-input-capture-environment-test_2026-09-28-15-47.json
new file mode 100644
index 0000000000..b1cf0aeb7c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r07-input-capture-environment-test_2026-09-28-15-47.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that concurrent requests share workspace input captures only when their fingerprint environments are equal.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
index 2f8b3b6a27..23bce5cc3d 100644
--- a/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceInputCaptureSharing.test.ts
@@ -5,7 +5,8 @@ jest.mock('@microsoft/rush-lib', () => {
   const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
   return {
     ...actual,
-    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync)
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync),
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync)
   };
 });
 
@@ -20,6 +21,8 @@ jest.setTimeout(60_000);
 const WAIT_TIMEOUT_MS: number = 20_000;
 const captureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
   jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+const inputCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
+  jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
 
 async function waitForAsync(description: string, condition: () => boolean): Promise<void> {
   const deadline: number = Date.now() + WAIT_TIMEOUT_MS;
@@ -81,3 +84,65 @@ it('serves concurrent warm builds from one project configuration capture that st
     await fixture[Symbol.asyncDispose]();
   }
 });
+
+it('shares input fingerprint captures only between requests whose fingerprint environments are equal', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) =>
+    setDaemonPolicy(created, {})
+  );
+  let release: () => void = () => {};
+  const requests: jest.SpyInstance = jest.spyOn(FreshCaptureCoalescer.prototype, 'captureAsync');
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    const generation: number = fixture.host.workspaceGeneration;
+
+    // A variable that is part of the workspace fingerprint environment, unlike TERM and COLUMNS.
+    const variable: string = 'RUSHD_CAPTURE_SHARING_TEST';
+    const capturedValues = (): (string | undefined)[] =>
+      inputCaptureMock.mock.calls.map(([options]) => options.environment[variable]);
+    // The project configuration coalescer uses the empty key; input captures use environment keys.
+    const inputCaptureRequests = (): number =>
+      requests.mock.calls.filter(([, key]: unknown[]) => key !== '').length;
+    requests.mockClear();
+    inputCaptureMock.mockClear();
+    const gate: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+    const actual: typeof rushLib.captureWorkspaceInputFingerprintAsync = jest.requireActual<
+      typeof rushLib
+    >('@microsoft/rush-lib').captureWorkspaceInputFingerprintAsync;
+    inputCaptureMock.mockImplementationOnce(async (...args) => {
+      await gate;
+      return await actual(...args);
+    });
+
+    const first: ReturnType<DaemonGraphTestFixture['buildAsync']> = fixture.buildAsync();
+    await waitForAsync('the first build is capturing', () => inputCaptureMock.mock.calls.length === 1);
+    const argv: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+    const volatile: ReturnType<DaemonGraphTestFixture['runAsync']> = fixture.runAsync(argv, {
+      environment: { ...fixture.environment, TERM: 'dumb', COLUMNS: '91' }
+    });
+    const other: ReturnType<DaemonGraphTestFixture['runAsync']> = fixture.runAsync(argv, {
+      environment: { ...fixture.environment, [variable]: 'other' }
+    });
+    await waitForAsync('every build asked for an input capture', () => inputCaptureRequests() === 3);
+    // The request with another environment captured it at once. The request that differs only in volatile
+    // variables waits for the next capture that it can share.
+    expect(capturedValues()).toEqual([undefined, 'other']);
+    release();
+
+    const [firstResult, volatileResult, otherResult] = await Promise.all([first, volatile, other]);
+    expect(firstResult.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    expect(volatileResult.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    // Only the request with another environment needs a new daemon process, which this host cannot launch.
+    expect(otherResult.terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { message: expect.stringContaining('A new daemon process is required (environment)') }
+    });
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    requests.mockRestore();
+    release();
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 55037496af..b3b3e10ea2 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -48,11 +48,14 @@ import type {
 } from '../../pluginFramework/PhasedCommandHooks';
 import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
 import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration';
-import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
+import { enableUnverifiedRetainedOperations } from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
 const PERIODIC_CALLBACK_INTERVAL_IN_SECONDS: number = 10;
+// Runs after the default-stage taps (e.g. PhasedOperationPlugin) have decided which operations to enable.
+const RE_ENABLE_UNTRUSTED_RESULTS_STAGE: number = 1;
 
 export interface IProjectDeps {
   files: { [filePath: string]: string };
@@ -201,6 +204,21 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         }
         this.#buildCacheContextByOperation.clear();
       });
+      graph.hooks.configureIteration.tap(
+        { name: PLUGIN_NAME, stage: RE_ENABLE_UNTRUSTED_RESULTS_STAGE },
+        (
+          currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
+          lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
+          iterationOptions: IOperationGraphIterationOptions
+        ) => {
+          // PhasedOperationPlugin re-verifies results that were built against unverified dependency outputs.
+          // This also re-verifies results that are not trusted for other reasons, e.g. because their input files
+          // changed while they were executing. Without cache writes, nothing is ever trusted.
+          if (buildCacheConfiguration.cacheWriteEnabled && iterationOptions.inputsSnapshot) {
+            enableUnverifiedRetainedOperations(currentStates, lastStates, trustedStateHashByOperation);
+          }
+        }
+      );
       graph.hooks.beforeExecuteIterationAsync.tap(
         PLUGIN_NAME,
         (
@@ -692,13 +710,10 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               // Skipping generally means we cannot guarantee integrity, so prevent cache writes in dependents.
               // The exception is an operation that was not re-run because a previous iteration of this graph
               // produced a trusted result at exactly the same state hash (e.g. a result retained by a
-              // long-lived graph such as the Rush daemon). Since the state hash of an operation covers the
-              // state hashes of all of its dependencies, a consumer's cache key fully describes this input.
-              if (
-                blockCacheWrite ||
-                record.operation.enabled === false ||
-                trustedStateHashByOperation.get(operation) !== record.getStateHash()
-              ) {
+              // long-lived graph such as the Rush daemon), whether or not this iteration selected it. Since the
+              // state hash of an operation covers the state hashes of all of its dependencies, a consumer's
+              // cache key fully describes this input.
+              if (blockCacheWrite || trustedStateHashByOperation.get(operation) !== record.getStateHash()) {
                 blockCacheWrite = true;
                 trustedStateHashByOperation.delete(operation);
               }
diff --git a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
index ac98661fc6..1584cba611 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
@@ -17,8 +17,9 @@ import type {
   IOperationExecutionResult,
   IOperationStateHashComponents
 } from './IOperationExecutionResult';
-import { SUCCESS_STATUSES } from './OperationStatus';
+import { OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import { enableUnverifiedRetainedOperations } from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'PhasedOperationPlugin' = 'PhasedOperationPlugin';
 
@@ -124,6 +125,18 @@ function createOperations(
 }
 
 function configureExecutionManager(graph: IOperationGraph, context: IOperationGraphContext): void {
+  // The state hash at which each operation last produced its outputs, or restored them from the build cache,
+  // in an iteration of this graph in which the outputs of all of its dependencies were verified.
+  const verifiedStateHashByOperation: Map<Operation, string> = new Map();
+  // The records of the executing iteration, if its state hashes are available.
+  let iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+
+  graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>) => {
+    for (const operation of operations) {
+      verifiedStateHashByOperation.delete(operation);
+    }
+  });
+
   graph.hooks.configureIteration.tap(
     PLUGIN_NAME,
     (
@@ -132,8 +145,91 @@ function configureExecutionManager(graph: IOperationGraph, context: IOperationGr
       iterationOptions: IOperationGraphIterationOptions
     ) => {
       configureOperations(currentStates, lastStates, iterationOptions);
+      if (iterationOptions.inputsSnapshot) {
+        // A retained result that is current by state hash can still have been built against outputs of a
+        // dependency that were not current, e.g. by an `--only` request.
+        enableUnverifiedRetainedOperations(currentStates, lastStates, verifiedStateHashByOperation);
+      }
+    }
+  );
+
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    PLUGIN_NAME,
+    (
+      records: ReadonlyMap<Operation, IOperationExecutionResult>,
+      iterationOptions: IOperationGraphIterationOptions
+    ): void => {
+      if (iterationOptions.inputsSnapshot) {
+        iterationRecords = records;
+      } else {
+        // Without state hashes, nothing can be verified.
+        iterationRecords = undefined;
+        verifiedStateHashByOperation.clear();
+      }
     }
   );
+
+  graph.hooks.afterExecuteOperationAsync.tap(PLUGIN_NAME, (record: IOperationExecutionResult) => {
+    if (iterationRecords) {
+      updateVerifiedStateHash(record, iterationRecords, verifiedStateHashByOperation);
+    }
+  });
+
+  graph.hooks.afterExecuteIterationAsync.tap(PLUGIN_NAME, (status: OperationStatus) => {
+    iterationRecords = undefined;
+    return status;
+  });
+}
+
+function updateVerifiedStateHash(
+  record: IOperationExecutionResult,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>,
+  verifiedStateHashByOperation: Map<Operation, string>
+): void {
+  const { operation } = record;
+  switch (record.status) {
+    case OperationStatus.Skipped: {
+      // The outputs were left as they were.
+      return;
+    }
+
+    case OperationStatus.FromCache: {
+      // The outputs were restored from the build cache entry for this state hash.
+      verifiedStateHashByOperation.set(operation, record.getStateHash());
+      return;
+    }
+
+    case OperationStatus.Success:
+    case OperationStatus.SuccessWithWarning:
+    case OperationStatus.NoOp: {
+      if (areDependenciesVerified(operation, records, verifiedStateHashByOperation)) {
+        verifiedStateHashByOperation.set(operation, record.getStateHash());
+        return;
+      }
+      break;
+    }
+
+    default: {
+      // The outputs may be incomplete.
+      break;
+    }
+  }
+
+  verifiedStateHashByOperation.delete(operation);
+}
+
+function areDependenciesVerified(
+  operation: Operation,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>,
+  verifiedStateHashByOperation: ReadonlyMap<Operation, string>
+): boolean {
+  for (const dependency of operation.dependencies) {
+    const dependencyRecord: IOperationExecutionResult | undefined = records.get(dependency);
+    if (!dependencyRecord || verifiedStateHashByOperation.get(dependency) !== dependencyRecord.getStateHash()) {
+      return false;
+    }
+  }
+  return true;
 }
 
 function shouldEnableOperation(
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
new file mode 100644
index 0000000000..e354e44463
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { Operation } from './Operation';
+import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
+import { SUCCESS_STATUSES } from './OperationStatus';
+
+/**
+ * Re-enables selected operations whose successful result retained by a previous iteration of a long-lived graph
+ * (e.g. the Rush daemon) is current by state hash, but not verified at that state hash, so that they are restored
+ * from the build cache or executed instead of being skipped. Such a result was produced while the outputs of one
+ * of its dependencies were not verified (e.g. that dependency was not selected and had changed), so its outputs
+ * may not match its state hash. Skipping it would keep outputs that were built against dependency outputs that
+ * have since been rebuilt.
+ *
+ * An operation is only re-enabled if none of its dependencies will remain unverified, since otherwise running it
+ * again would not produce a verified result either. An operation that is disabled for another reason than a
+ * current retained result, e.g. by a plugin that performs the work itself, is left disabled.
+ *
+ * @param records - The records of the iteration that is being configured
+ * @param lastStates - The results retained by previous iterations of the graph
+ * @param verifiedStateHashByOperation - The state hash at which the retained result of each operation is verified
+ */
+export function enableUnverifiedRetainedOperations(
+  records: ReadonlyMap<Operation, IConfigurableOperation>,
+  lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
+  verifiedStateHashByOperation: ReadonlyMap<Operation, string>
+): void {
+  // Whether the result of each operation will still be unverified at the end of this iteration.
+  const remainsUnverifiedByOperation: Map<Operation, boolean> = new Map();
+
+  function remainsUnverified(operation: Operation): boolean {
+    const known: boolean | undefined = remainsUnverifiedByOperation.get(operation);
+    if (known !== undefined) {
+      return known;
+    }
+    // Treat a dependency cycle as unverified; the real value is assigned below.
+    remainsUnverifiedByOperation.set(operation, true);
+
+    let unverified: boolean = false;
+    for (const dependency of operation.dependencies) {
+      if (remainsUnverified(dependency)) {
+        unverified = true;
+        break;
+      }
+    }
+
+    const record: IConfigurableOperation | undefined = records.get(operation);
+    if (!record) {
+      unverified = true;
+    } else if (!unverified && !record.enabled && !operation.isNoOp) {
+      // The operation will be skipped, which only keeps a verified result if it is verified at this state hash.
+      const stateHash: string = record.getStateHash();
+      if (verifiedStateHashByOperation.get(operation) !== stateHash) {
+        const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
+        if (
+          operation.enabled === true &&
+          lastState &&
+          SUCCESS_STATUSES.has(lastState.status) &&
+          lastState.getStateHash() === stateHash
+        ) {
+          record.enabled = true;
+        } else {
+          unverified = true;
+        }
+      }
+    }
+
+    remainsUnverifiedByOperation.set(operation, unverified);
+    return unverified;
+  }
+
+  for (const operation of records.keys()) {
+    remainsUnverified(operation);
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index ffdee0680e..6c7f1cb80f 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -276,7 +276,7 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.cacheWrites).toEqual(['c']);
   });
 
-  it('does not write a cache entry when a dependency was skipped by the user (e.g. --only)', async () => {
+  it('writes a cache entry when a dependency that was not selected (e.g. --only) is trusted at its state hash', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     await testGraph.executeAsync();
 
@@ -284,6 +284,20 @@ describe(CacheableOperationPlugin.name, () => {
     testGraph.localHashes.set('b', 'b-v2');
     const result: IExecutionResult = await testGraph.executeAsync();
 
+    expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+  });
+
+  it('does not write a cache entry when a dependency that was not selected (e.g. --only) has changed', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+
+    testGraph.operations.get('a')!.enabled = false;
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    const result: IExecutionResult = await testGraph.executeAsync();
+
     expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
     expect(testGraph.executions).toEqual(['b']);
     expect(testGraph.cacheWrites).toEqual([]);
@@ -299,7 +313,7 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.cacheWrites).toEqual([]);
   });
 
-  it('does not trust a retained result that was produced while one of its dependencies was skipped', async () => {
+  it('re-executes a retained result that was produced while one of its dependencies was skipped', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
     const a: Operation = testGraph.operations.get('a')!;
 
@@ -314,10 +328,10 @@ describe(CacheableOperationPlugin.name, () => {
     testGraph.localHashes.set('c', 'c-v2');
     const result: IExecutionResult = await testGraph.executeAsync();
 
-    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
-    expect(testGraph.executions).toEqual(['a', 'c']);
-    // "b" was built against an unknown "a", so "c" must not write to the cache.
-    expect(testGraph.cacheWrites).toEqual(['a']);
+    // "b" was built against an unknown "a", so it must not be skipped now that "a" has executed.
+    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Success);
+    expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
   });
 
   it('does not trust results whose state hash changed without re-execution', async () => {
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
new file mode 100644
index 0000000000..4581d7c702
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -0,0 +1,414 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+jest.mock('../OperationMetadataManager', () => {
+  class MockOperationMetadataManager {
+    public readonly logFilenameIdentifier: string;
+    public readonly metadataFolderPath: string = '.rush/temp/operation/mock';
+    public readonly stateFile: { state: undefined } = { state: undefined };
+    public constructor({ operation }: { operation: { logFilenameIdentifier: string } }) {
+      this.logFilenameIdentifier = operation.logFilenameIdentifier;
+    }
+    public async saveAsync(): Promise<void> {
+      /* noop */
+    }
+    public async tryRestoreAsync(): Promise<void> {
+      /* noop */
+    }
+    public tryRestoreStopwatch<T>(originalStopwatch: T): T {
+      return originalStopwatch;
+    }
+  }
+  return { OperationMetadataManager: MockOperationMetadataManager };
+});
+jest.mock('../../buildCache/OperationBuildCache', () => ({
+  OperationBuildCache: { forOperation: jest.fn() }
+}));
+
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
+import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
+import { CacheableOperationPlugin } from '../CacheableOperationPlugin';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { OperationGraph } from '../OperationGraph';
+import { Operation } from '../Operation';
+import { OperationStatus } from '../OperationStatus';
+import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
+import type { IExecutionResult } from '../IOperationExecutionResult';
+import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+class CacheableMockRunner implements IOperationRunner {
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean = false;
+  public readonly isNoOp: boolean = false;
+  public readonly name: string;
+  readonly #executions: string[];
+
+  public constructor(name: string, executions: string[]) {
+    this.name = name;
+    this.#executions = executions;
+  }
+
+  public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    this.#executions.push(this.name);
+    return OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'config';
+  }
+}
+
+interface ITestGraph {
+  graph: OperationGraph;
+  operations: Map<string, Operation>;
+  localHashes: Map<string, string>;
+  executions: string[];
+  cacheWrites: string[];
+  cacheRestores: string[];
+  executeAsync(): Promise<IExecutionResult>;
+}
+
+interface ITestGraphOptions {
+  /**
+   * The names of the dependencies of each operation. By default, each operation depends on the previous one.
+   */
+  dependencies?: Record<string, string[]>;
+  cacheWriteEnabled?: boolean;
+}
+
+/**
+ * Creates a graph of cacheable operations. By default it is a linear chain: names[0] <- names[1] <- ...
+ * The mock build cache stores an entry per operation and state hash, and restores it if it exists.
+ */
+async function createTestGraphAsync(names: string[], options: ITestGraphOptions = {}): Promise<ITestGraph> {
+  const { dependencies, cacheWriteEnabled = true } = options;
+  const executions: string[] = [];
+  const cacheWrites: string[] = [];
+  const cacheRestores: string[] = [];
+  const cacheEntries: Set<string> = new Set();
+  const localHashes: Map<string, string> = new Map();
+  const operations: Map<string, Operation> = new Map();
+  const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+
+  let previous: Operation | undefined;
+  for (const name of names) {
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder: `/repo/${name}`
+    } as unknown as RushConfigurationProject;
+    projectConfigurations.set(project, {
+      getCacheDisabledReason: () => undefined
+    } as unknown as RushProjectConfiguration);
+    const operation: Operation = new Operation({
+      runner: new CacheableMockRunner(name, executions),
+      logFilenameIdentifier: name,
+      phase: mockPhase,
+      project
+    });
+    if (previous && !dependencies) {
+      operation.addDependency(previous);
+    }
+    previous = operation;
+    operations.set(name, operation);
+    localHashes.set(name, `${name}-v1`);
+  }
+  for (const [name, dependencyNames] of Object.entries(dependencies ?? {})) {
+    for (const dependencyName of dependencyNames) {
+      operations.get(name)!.addDependency(operations.get(dependencyName)!);
+    }
+  }
+
+  jest.mocked(OperationBuildCache.forOperation).mockImplementation((record) => {
+    const name: string = record.operation.associatedProject.packageName;
+    const getCacheKey = (): string => `${name}@${record.getStateHash()}`;
+    return {
+      tryRestoreFromCacheAsync: async () => {
+        const restored: boolean = cacheEntries.has(getCacheKey());
+        if (restored) {
+          cacheRestores.push(name);
+        }
+        return restored;
+      },
+      trySetCacheEntryAsync: async () => {
+        cacheWrites.push(name);
+        cacheEntries.add(getCacheKey());
+        return true;
+      }
+    } as unknown as OperationBuildCache;
+  });
+
+  const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new CacheableOperationPlugin({
+    allowWarningsInSuccessfulBuild: false,
+    buildCacheConfiguration: {
+      buildCacheEnabled: true,
+      cacheWriteEnabled
+    } as unknown as BuildCacheConfiguration,
+    cobuildConfiguration: undefined,
+    terminal,
+    excludeAppleDoubleFiles: false,
+    useDirectFileTransfersForBuildCache: false
+  }).apply(hooks);
+
+  const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    projectConfigurations
+  } as unknown as IOperationGraphContext);
+
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes: new Map(),
+    rootDirectory: '/repo',
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: () => new Map(),
+    getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
+  };
+
+  return {
+    graph,
+    operations,
+    localHashes,
+    executions,
+    cacheWrites,
+    cacheRestores,
+    executeAsync: async () => {
+      executions.length = 0;
+      cacheWrites.length = 0;
+      cacheRestores.length = 0;
+      return await graph.executeAsync({ inputsSnapshot });
+    }
+  };
+}
+
+function getStatus(testGraph: ITestGraph, result: IExecutionResult, name: string): OperationStatus {
+  return (result.operationResults.get(testGraph.operations.get(name)!) as OperationExecutionRecord).status;
+}
+
+// How results retained by earlier iterations of a long-lived graph (e.g. the Rush daemon) are trusted.
+describe(`${CacheableOperationPlugin.name} retained results`, () => {
+  it('resumes cache writes for consumers after an --only request', async () => {
+    // "lib" <- "tool" <- "app", like @rushstack/node-core-library <- @rushstack/ts-command-line <- @rushstack/heft
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app']);
+    const lib: Operation = testGraph.operations.get('lib')!;
+    const app: Operation = testGraph.operations.get('app')!;
+    await testGraph.executeAsync();
+
+    // S1: edit "app", then --to app
+    testGraph.localHashes.set('app', 'app-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['app']);
+
+    // S2: edit "tool", then --only tool
+    testGraph.localHashes.set('tool', 'tool-v2');
+    lib.enabled = false;
+    app.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['tool']);
+    expect(testGraph.cacheWrites).toEqual(['tool']);
+
+    // S3: --to app
+    lib.enabled = true;
+    app.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+
+    // S4: edit "app", then --to app
+    testGraph.localHashes.set('app', 'app-v3');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+  });
+
+  it('keeps trusting operations that a request did not select', async () => {
+    // "a" <- "b" <- "c", and "a" <- "tool"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c', 'tool'], {
+      dependencies: { b: ['a'], c: ['b'], tool: ['a'] }
+    });
+    const { operations } = testGraph;
+    await testGraph.executeAsync();
+
+    for (let round: number = 2; round <= 3; round++) {
+      // --to tool
+      testGraph.localHashes.set('tool', `tool-v${round}`);
+      operations.get('b')!.enabled = false;
+      operations.get('c')!.enabled = false;
+      operations.get('tool')!.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['tool']);
+      expect(testGraph.cacheWrites).toEqual(['tool']);
+
+      // --to c
+      testGraph.localHashes.set('c', `c-v${round}`);
+      operations.get('b')!.enabled = true;
+      operations.get('c')!.enabled = true;
+      operations.get('tool')!.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['c']);
+      expect(testGraph.cacheWrites).toEqual(['c']);
+    }
+  });
+
+  it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both: "b" is built against the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to b: "b" has the same state hash as its retained result, but "a" is rebuilt.
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Success);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute an untrusted retained result while a dependency that was not selected is untrusted', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    testGraph.operations.get('a')!.enabled = false;
+
+    // Cold --only b: "a" has never executed in this graph.
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Repeating the request cannot produce a trusted result for "b", so it is skipped.
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('restores an untrusted retained result from the build cache when an entry exists', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing "a": "b" is built against the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Revert "a", then --to b: both have entries from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.FromCache);
+    expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.FromCache);
+    expect(testGraph.executions).toEqual([]);
+    expect(testGraph.cacheRestores).toEqual(['a', 'b']);
+
+    // Both are trusted again.
+    testGraph.localHashes.set('b', 'b-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+  });
+
+  it('does not re-execute untrusted retained results when cache writes are disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    testGraph.localHashes.set('b', 'b-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('re-executes a retained result that was built against a dependency that has since been rebuilt when cache writes are disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-enable operations that another plugin disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    // Like a plugin that performs the work itself. This tap runs after PhasedOperationPlugin's.
+    testGraph.graph.hooks.configureIteration.tap('TestPlugin', (records) => {
+      for (const record of records.values()) {
+        record.enabled = false;
+      }
+    });
+
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
new file mode 100644
index 0000000000..325a1ea315
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
@@ -0,0 +1,418 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
+import { LegacySkipPlugin } from '../LegacySkipPlugin';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { OperationGraph } from '../OperationGraph';
+import { Operation } from '../Operation';
+import { OperationStatus } from '../OperationStatus';
+import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
+import type { IExecutionResult } from '../IOperationExecutionResult';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+class MockRunner implements IOperationRunner {
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean = false;
+  public readonly name: string;
+  public readonly isNoOp: boolean;
+  readonly #executions: string[];
+
+  public constructor(name: string, isNoOp: boolean, executions: string[]) {
+    this.name = name;
+    this.isNoOp = isNoOp;
+    this.#executions = executions;
+  }
+
+  public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    if (this.isNoOp) {
+      return OperationStatus.NoOp;
+    }
+    this.#executions.push(this.name);
+    return OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'config';
+  }
+}
+
+interface ITestGraph {
+  graph: OperationGraph;
+  operations: Map<string, Operation>;
+  localHashes: Map<string, string>;
+  executions: string[];
+  executeAsync(): Promise<IExecutionResult>;
+}
+
+interface ITestGraphOptions {
+  /**
+   * Operations that have no work.
+   */
+  noOps?: ReadonlySet<string>;
+  /**
+   * If set, the incremental state files of the legacy skip detection are stored in this folder.
+   */
+  legacySkipFolder?: string;
+}
+
+/**
+ * Creates a graph from the names of the dependencies of each operation, without the build cache.
+ */
+async function createTestGraphAsync(
+  dependencies: Record<string, string[]>,
+  options: ITestGraphOptions = {}
+): Promise<ITestGraph> {
+  const { noOps, legacySkipFolder } = options;
+  const executions: string[] = [];
+  const localHashes: Map<string, string> = new Map();
+  const operations: Map<string, Operation> = new Map();
+
+  for (const name of Object.keys(dependencies)) {
+    const projectFolder: string = path.join(legacySkipFolder ?? '/repo', name);
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder,
+      projectRushTempFolder: projectFolder
+    } as unknown as RushConfigurationProject;
+    const operation: Operation = new Operation({
+      runner: new MockRunner(name, !!noOps?.has(name), executions),
+      logFilenameIdentifier: name,
+      phase: mockPhase,
+      project
+    });
+    operations.set(name, operation);
+    localHashes.set(name, `${name}-v1`);
+  }
+  for (const [name, dependencyNames] of Object.entries(dependencies)) {
+    for (const dependencyName of dependencyNames) {
+      operations.get(name)!.addDependency(operations.get(dependencyName)!);
+    }
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  if (legacySkipFolder) {
+    new LegacySkipPlugin({
+      allowWarningsInSuccessfulBuild: false,
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      changedProjectsOnly: false,
+      isIncrementalBuildAllowed: true
+    }).apply(hooks);
+  }
+
+  const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    projectConfigurations: new Map()
+  } as unknown as IOperationGraphContext);
+
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes: new Map(),
+    rootDirectory: '/repo',
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
+      new Map([[`${project.packageName}/src/index.ts`, localHashes.get(project.packageName)!]]),
+    getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
+  };
+
+  return {
+    graph,
+    operations,
+    localHashes,
+    executions,
+    executeAsync: async () => {
+      executions.length = 0;
+      return await graph.executeAsync({ inputsSnapshot });
+    }
+  };
+}
+
+// How results retained by earlier iterations of a long-lived graph (e.g. the Rush daemon) are verified,
+// whether or not the build cache is in use.
+describe(`${PhasedOperationPlugin.name} retained results`, () => {
+  it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both: "b" is built against the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b: "b" has the same state hash as its retained result, but "a" is rebuilt.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('re-executes every retained result in a chain that was built against unverified outputs', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'], c: ['b'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    const b: Operation = testGraph.operations.get('b')!;
+    const c: Operation = testGraph.operations.get('c')!;
+    await testGraph.executeAsync();
+
+    // --only b, then --only c, after editing "a" and "b"
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    c.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    b.enabled = false;
+    c.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+
+    // --to c
+    a.enabled = true;
+    b.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+  });
+
+  it('verifies results through operations without work', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(
+      { a: [], n: ['a'], b: ['n'] },
+      { noOps: new Set(['n']) }
+    );
+    const a: Operation = testGraph.operations.get('a')!;
+    const n: Operation = testGraph.operations.get('n')!;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    // --only b, after editing "a" and "b"
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    n.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b
+    a.enabled = true;
+    n.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute a retained result that was built against unchanged dependencies that were not selected', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing "b"
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not re-execute a retained result while a dependency that was not selected is unverified', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    testGraph.operations.get('a')!.enabled = false;
+
+    // Cold --only b: "a" has never executed in this graph.
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // Repeating the request cannot produce a verified result for "b", so it is skipped.
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('re-executes a consumer whose dependency was rebuilt by a request that did not select it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ b: [], c: ['b'] });
+    const c: Operation = testGraph.operations.get('c')!;
+    await testGraph.executeAsync();
+
+    // --to b, after editing "b"
+    testGraph.localHashes.set('b', 'b-v2');
+    c.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to c
+    c.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+  });
+
+  it('does not re-execute retained results of operations that ignore dependency changes', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    const b: Operation = testGraph.operations.get('b')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // --to b --changed-projects-only
+    a.enabled = 'ignore-dependency-changes';
+    b.enabled = 'ignore-dependency-changes';
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a']);
+  });
+
+  it('does not re-enable operations that a later configureIteration tap disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // --only b, after editing both
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+
+    // Like a plugin that performs the work itself.
+    testGraph.graph.hooks.configureIteration.tap({ name: 'TestPlugin', stage: 1 }, (records) => {
+      for (const record of records.values()) {
+        record.enabled = false;
+      }
+    });
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  describe('with legacy skip detection', () => {
+    let legacySkipFolder: string;
+
+    beforeEach(() => {
+      legacySkipFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-legacy-skip-'));
+    });
+
+    afterEach(() => {
+      fs.rmSync(legacySkipFolder, { recursive: true, force: true });
+    });
+
+    it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      const a: Operation = testGraph.operations.get('a')!;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['a', 'b']);
+
+      // --only b, after editing both
+      testGraph.localHashes.set('a', 'a-v2');
+      testGraph.localHashes.set('b', 'b-v2');
+      a.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+
+      // --to b
+      a.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['a', 'b']);
+
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+      expect(testGraph.executions).toEqual([]);
+    });
+
+    it('re-executes a consumer whose dependency was rebuilt by a request that did not select it', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync({ b: [], c: ['b'] }, { legacySkipFolder });
+      const c: Operation = testGraph.operations.get('c')!;
+      await testGraph.executeAsync();
+
+      // --to b, after editing "b"
+      testGraph.localHashes.set('b', 'b-v2');
+      c.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+
+      // --to c: the files of "c" did not change, and "b" does not execute.
+      c.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['c']);
+    });
+
+    it('still skips an unverified retained result if no dependency executes', async () => {
+      // Build once in another process, then start a long-lived graph.
+      await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual([]);
+
+      // --to b, after editing "b": "a" is skipped, so it is not verified in this graph.
+      testGraph.localHashes.set('b', 'b-v2');
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+
+      // --to b: the legacy skip detection still skips "b".
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual([]);
+    });
+  });
+});

From f3cc6afdf5f62f988cf49fd9d487eb9e75526024 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 17:15:47 +0000
Subject: [PATCH 027/265] [rush-cli-client] Show engine and plugin warnings in
 agent output; keep the daemon alive when git hash-object fails

Swarm integration step 12; original commit cc5c6aab7e (merge of swarm/r01 at 575cbf5698).
Refs: board 601, task 80, board 899.

ch01 GATE OK board 1272 and board 1273 (gated tree b691997c35).

Commits folded into this step (3):
- c11ee10320 [rush-cli-client] Show engine and plugin warnings in agent output
- c77aa1dbef [package-deps-hash] Handle a git hash-object failure while ls-files and status still run
- 575cbf5698 [package-deps-hash] Name the git command that failed in the error message

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  4 +-
 apps/rush-cli-client/src/AgentNotices.ts      | 51 ++++++++++
 .../src/AgentProgressRenderer.ts              | 12 ++-
 .../src/test/AgentNotices.test.ts             | 97 +++++++++++++++++++
 ...01-git-error-command_2026-09-28-15-02.json | 11 +++
 ...ash-object-rejection_2026-09-28-14-47.json | 11 +++
 ...tput-engine-warnings_2026-09-28-13-52.json | 10 ++
 ...tput-engine-warnings_2026-09-28-13-52.json | 10 ++
 ...tput-engine-warnings_2026-09-28-13-52.json | 10 ++
 .../reviews/api/rush-daemon-protocol.api.md   |  1 +
 .../package-deps-hash/src/getRepoState.ts     | 13 ++-
 .../src/test/getRepoDeps.test.ts              | 76 ++++++++++++++-
 .../src/DaemonOperationPayloads.ts            |  6 ++
 .../rush-daemon/src/EngineActivityOptions.ts  | 32 ++++++
 .../rush-daemon/src/EngineTerminalProvider.ts |  5 +-
 .../rush-daemon/src/PhasedRequestEventSink.ts | 25 ++---
 .../src/test/EngineActivity.test.ts           | 90 +++++++++++++++++
 17 files changed, 441 insertions(+), 23 deletions(-)
 create mode 100644 apps/rush-cli-client/src/AgentNotices.ts
 create mode 100644 apps/rush-cli-client/src/test/AgentNotices.test.ts
 create mode 100644 common/changes/@rushstack/package-deps-hash/swarm-r01-git-error-command_2026-09-28-15-02.json
 create mode 100644 common/changes/@rushstack/package-deps-hash/swarm-r01-hash-object-rejection_2026-09-28-14-47.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-output-engine-warnings_2026-09-28-13-52.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/agent-output-engine-warnings_2026-09-28-13-52.json
 create mode 100644 common/changes/@rushstack/rush-daemon/agent-output-engine-warnings_2026-09-28-13-52.json
 create mode 100644 libraries/rush-daemon/src/EngineActivityOptions.ts
 create mode 100644 libraries/rush-daemon/src/test/EngineActivity.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index f651b98bab..1fb55ae3fb 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -98,7 +98,9 @@ use `--reporter=ai` for machine-parsed records. It writes a first status line be
 `@microsoft/rush-lib` is loaded, then at most three live rows on a TTY (append-only lines
 throttled to one per 2 seconds on a pipe), the queue position when waiting for admission,
 and always one final summary line (`rush build: SUCCESS 12/12 operations (...) in 3.1s`, or
-`up to date (no operations needed)`). On failure, it lists failed operations and a
+`up to date (no operations needed)`). Warnings and errors that Rush or a Rush plugin writes
+outside any operation (for example a plugin that continues without the cloud build cache)
+precede the summary line, at most three lines of them. On failure, it lists failed operations and a
 bounded tail (10 lines) of their stderr, or of their stdout when they wrote no stderr.
 Operation logs are otherwise not printed; use `RUSHD_OUTPUT=legacy` for full logs. When
 a request falls back to in-process Rush, agent mode stops and native output follows.
diff --git a/apps/rush-cli-client/src/AgentNotices.ts b/apps/rush-cli-client/src/AgentNotices.ts
new file mode 100644
index 0000000000..154f44ff47
--- /dev/null
+++ b/apps/rush-cli-client/src/AgentNotices.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads the agent renderer before @microsoft/rush-lib.
+
+/** The most warning and error lines printed before the summary line. */
+const MAX_NOTICE_LINES: number = 3;
+/** A longer line is cut to this many characters. */
+const MAX_NOTICE_LENGTH: number = 300;
+
+function clip(line: string): string {
+  return line.length > MAX_NOTICE_LENGTH ? `${line.slice(0, MAX_NOTICE_LENGTH - 1)}…` : line;
+}
+
+/**
+ * Collects the warnings and errors that Rush or a Rush plugin wrote while the daemon engine loaded or ran, for
+ * example a plugin that continues without the cloud build cache, or a daemon-compatible plugin name that
+ * matches no configured plugin. They arrive as `activityChanged` events with a `severity` and no operation
+ * scope. Agent output shows other activity only in its live row, which a pipe never prints.
+ */
+export class AgentNotices {
+  readonly #lines: Set<string> = new Set();
+
+  /** Records the lines of an activity payload that is a warning or an error outside any operation. */
+  public add(payload: Readonly<Record<string, unknown>>, operationId: string | undefined): void {
+    const { severity, text } = payload;
+    if (operationId !== undefined || typeof text !== 'string') {
+      return;
+    }
+    if (severity !== 'warning' && severity !== 'error') {
+      return;
+    }
+    for (const line of text.split('\n')) {
+      const trimmed: string = line.trim();
+      if (trimmed) {
+        this.#lines.add(trimmed);
+      }
+    }
+  }
+
+  /** The first distinct lines, each cut to a maximum length, followed by the number of lines left out. */
+  public getLines(): string[] {
+    const lines: string[] = [...this.#lines];
+    const shown: string[] = lines.slice(0, MAX_NOTICE_LINES).map(clip);
+    const omitted: number = lines.length - shown.length;
+    if (omitted > 0) {
+      shown.push(`+${omitted} more warning and error lines; RUSHD_OUTPUT=legacy prints them all`);
+    }
+    return shown;
+  }
+}
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 08fa108796..87e8a41d97 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -6,6 +6,8 @@
 
 import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
 
+import { AgentNotices } from './AgentNotices';
+
 const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 const TERMINAL_STATUSES: ReadonlySet<string> = new Set([
   'SUCCESS',
@@ -52,6 +54,7 @@ export class AgentProgressRenderer {
   readonly #failed: string[] = [];
   readonly #stderrTails: Map<string, string[]> = new Map();
   readonly #stdoutTails: Map<string, string[]> = new Map();
+  readonly #notices: AgentNotices = new AgentNotices();
   #total: number = 0;
   #done: number = 0;
   #lastActivity: string = '';
@@ -135,6 +138,7 @@ export class AgentProgressRenderer {
         break;
       }
       case 'activityChanged': {
+        this.#notices.add(payload, event.scope?.operationId);
         if (typeof payload.text === 'string' && payload.text.trim()) {
           this.#lastActivity = payload.text.trim().split('\n')[0];
           if (this.#phase !== 'running') {
@@ -179,11 +183,17 @@ export class AgentProgressRenderer {
     this.#stop();
   }
 
-  /** Stops the live region and writes the final summary line, at most once. */
+  /**
+   * Stops the live region and writes the final summary line, at most once. Warnings and errors that Rush or a
+   * plugin wrote outside any operation precede it.
+   */
   public finish(result: IAgentFinalResult | undefined): void {
     if (!this.#stop()) {
       return;
     }
+    for (const notice of this.#notices.getLines()) {
+      this.#options.write(`${notice}\n`);
+    }
     const succeeded: boolean = result !== undefined && result.exitCode === 0;
     const total: number = this.#getTotal();
     const parts: string[] = [...this.#counts].map(([status, count]) => `${count} ${status.toLowerCase()}`);
diff --git a/apps/rush-cli-client/src/test/AgentNotices.test.ts b/apps/rush-cli-client/src/test/AgentNotices.test.ts
new file mode 100644
index 0000000000..5a3f96995e
--- /dev/null
+++ b/apps/rush-cli-client/src/test/AgentNotices.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  type IDaemonActivityPayload,
+  type IDaemonEventEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { AgentNotices } from '../AgentNotices';
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+
+const UNMATCHED_PLUGIN_WARNING: string =
+  "Warning: the daemon's compatible plugin list names plugins that are not configured in rush-plugins.json: typo-plugin\n";
+const CACHE_WARNING: string =
+  'The Rush daemon never signs in interactively, so this build continues without signing in to the cloud build cache.\n';
+
+function activity(payload: IDaemonActivityPayload, operationId?: string): IDaemonEventEnvelope {
+  return {
+    eventId: 'event',
+    sessionId: 'session',
+    sequence: 1,
+    timestamp: new Date().toISOString(),
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    source: { packageName: 'test', packageVersion: '1.0.0' },
+    privacy: 'public',
+    required: true,
+    type: 'activityChanged',
+    scope: operationId === undefined ? undefined : { operationId },
+    payload
+  };
+}
+
+function createRenderer(isTTY: boolean): { renderer: AgentProgressRenderer; output: string[] } {
+  const output: string[] = [];
+  const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+    commandName: 'build',
+    isTTY,
+    columns: 60,
+    write: (text: string) => output.push(text),
+    now: () => 0,
+    startTimeMs: 0
+  });
+  return { renderer, output };
+}
+
+describe(AgentNotices.name, () => {
+  it('keeps the distinct lines of warnings and errors outside any operation', () => {
+    const notices: AgentNotices = new AgentNotices();
+    notices.add({ severity: 'warning', stream: 'stderr', text: UNMATCHED_PLUGIN_WARNING }, undefined);
+    notices.add({ severity: 'warning', stream: 'stderr', text: UNMATCHED_PLUGIN_WARNING }, undefined);
+    notices.add({ severity: 'error', stream: 'stderr', text: '\nFirst line\n  second line  \n' }, undefined);
+    notices.add({ stream: 'stderr', text: 'Operations failed.\n' }, undefined);
+    notices.add({ stream: 'stdout', text: 'FSTrace: Enabled\n' }, undefined);
+    notices.add({ severity: 'warning', stream: 'stderr', text: 'operation warning\n' }, 'a (build)');
+    expect(notices.getLines()).toEqual([UNMATCHED_PLUGIN_WARNING.trim(), 'First line', 'second line']);
+  });
+
+  it('prints at most three lines, each cut to 300 characters, and counts the rest', () => {
+    const notices: AgentNotices = new AgentNotices();
+    notices.add({ severity: 'warning', text: `${'x'.repeat(400)}\nb\nc\nd\ne\n` }, undefined);
+    const lines: string[] = notices.getLines();
+    expect(lines).toEqual([
+      `${'x'.repeat(299)}…`,
+      'b',
+      'c',
+      '+2 more warning and error lines; RUSHD_OUTPUT=legacy prints them all'
+    ]);
+  });
+});
+
+describe(`${AgentProgressRenderer.name} notices`, () => {
+  it.each([false, true])('prints plugin warnings before the summary line (isTTY: %s)', (isTTY: boolean) => {
+    const { renderer, output } = createRenderer(isTTY);
+    renderer.start();
+    renderer.onEvent(activity({ severity: 'warning', stream: 'stderr', text: UNMATCHED_PLUGIN_WARNING }));
+    renderer.onEvent(activity({ severity: 'warning', stream: 'stderr', text: CACHE_WARNING }));
+    renderer.onEvent(activity({ stream: 'stdout', text: 'rush build (0.50 seconds)\n' }));
+    const beforeFinish: number = output.length;
+    renderer.finish({ exitCode: 0 });
+    expect(output.slice(beforeFinish).filter((text: string) => !text.startsWith('\x1b'))).toEqual([
+      UNMATCHED_PLUGIN_WARNING,
+      CACHE_WARNING,
+      'rush build: SUCCESS up to date (no operations needed) in 0.0s\n'
+    ]);
+  });
+
+  it('prints nothing more when no warning or error was written', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(activity({ stream: 'stderr', text: 'Operations succeeded with warnings.\n' }));
+    const beforeFinish: number = output.length;
+    renderer.finish({ exitCode: 0 });
+    expect(output.slice(beforeFinish)).toEqual([
+      'rush build: SUCCESS up to date (no operations needed) in 0.0s\n'
+    ]);
+  });
+});
diff --git a/common/changes/@rushstack/package-deps-hash/swarm-r01-git-error-command_2026-09-28-15-02.json b/common/changes/@rushstack/package-deps-hash/swarm-r01-git-error-command_2026-09-28-15-02.json
new file mode 100644
index 0000000000..e460c63b55
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/swarm-r01-git-error-command_2026-09-28-15-02.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Name the Git command that failed (for example `git hash-object`) in the error from `getRepoStateAsync` and `getDetailedRepoStateAsync`, instead of `git --no-optional-locks`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/package-deps-hash/swarm-r01-hash-object-rejection_2026-09-28-14-47.json b/common/changes/@rushstack/package-deps-hash/swarm-r01-hash-object-rejection_2026-09-28-14-47.json
new file mode 100644
index 0000000000..31552615ca
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/swarm-r01-hash-object-rejection_2026-09-28-14-47.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Fix an unhandled promise rejection in `getDetailedRepoStateAsync` when `git hash-object` fails before `git ls-files` and `git status` finish, for example on an additional path that does not exist. The error now reaches the caller instead of ending the process.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/agent-output-engine-warnings_2026-09-28-13-52.json b/common/changes/@rushstack/rush-cli-client/agent-output-engine-warnings_2026-09-28-13-52.json
new file mode 100644
index 0000000000..995e8af912
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-output-engine-warnings_2026-09-28-13-52.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, print the warnings and errors that Rush or a Rush plugin wrote outside any operation before the summary line (at most three lines), instead of showing them only in the live row.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/agent-output-engine-warnings_2026-09-28-13-52.json b/common/changes/@rushstack/rush-daemon-protocol/agent-output-engine-warnings_2026-09-28-13-52.json
new file mode 100644
index 0000000000..410d064d19
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/agent-output-engine-warnings_2026-09-28-13-52.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `severity` to `activityChanged` payloads, set on the warnings and errors that Rush or a Rush plugin wrote while the engine loaded or ran.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol"
+}
diff --git a/common/changes/@rushstack/rush-daemon/agent-output-engine-warnings_2026-09-28-13-52.json b/common/changes/@rushstack/rush-daemon/agent-output-engine-warnings_2026-09-28-13-52.json
new file mode 100644
index 0000000000..c4722622fe
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/agent-output-engine-warnings_2026-09-28-13-52.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Mark the warnings and errors that Rush or a Rush plugin writes through the engine terminal with a `severity` in their activity events.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 0584bcb366..a00763848c 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -216,6 +216,7 @@ export const FRAME_HEADER_BYTES: number;
 
 // @beta
 export interface IDaemonActivityPayload {
+    readonly severity?: 'warning' | 'error';
     readonly stream?: 'stdout' | 'stderr';
     readonly text: string;
 }
diff --git a/libraries/package-deps-hash/src/getRepoState.ts b/libraries/package-deps-hash/src/getRepoState.ts
index 45cb07a8dd..e88cf1900c 100644
--- a/libraries/package-deps-hash/src/getRepoState.ts
+++ b/libraries/package-deps-hash/src/getRepoState.ts
@@ -363,7 +363,9 @@ async function spawnGitAsync(
   if (status !== 0) {
     ensureGitMinimumVersion(gitPath);
 
-    throw new Error(`git ${args[0]} exited with code ${status}:\n${stderr}`);
+    // Name the git command itself, not the first of the STANDARD_GIT_OPTIONS in front of it
+    const command: string | undefined = args.find((arg: string) => !STANDARD_GIT_OPTIONS.includes(arg));
+    throw new Error(`git ${command} exited with code ${status}:\n${stderr}`);
   }
 
   return stdout;
@@ -554,13 +556,16 @@ export async function getDetailedRepoStateAsync(
     gitPath
   );
 
-  const [{ files, symlinks, submodules }, locallyModifiedFiles] = await Promise.all([
+  // Await all three at once. `git hash-object` can fail before the other two finish, for example on an additional
+  // path that does not exist. Its rejection needs a handler right away, or Node reports it as unhandled and exits.
+  const [{ files, symlinks, submodules }, locallyModifiedFiles, hashObjectResult] = await Promise.all([
     statePromise,
-    locallyModifiedPromise
+    locallyModifiedPromise,
+    hashObjectPromise
   ]);
 
   // The result of "git hash-object" will be a list of file hashes delimited by newlines
-  for (const [filePath, hash] of await hashObjectPromise) {
+  for (const [filePath, hash] of hashObjectResult) {
     files.set(filePath, hash);
   }
 
diff --git a/libraries/package-deps-hash/src/test/getRepoDeps.test.ts b/libraries/package-deps-hash/src/test/getRepoDeps.test.ts
index c78e034386..2694e2dbe6 100644
--- a/libraries/package-deps-hash/src/test/getRepoDeps.test.ts
+++ b/libraries/package-deps-hash/src/test/getRepoDeps.test.ts
@@ -2,7 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
-import { execSync, type SpawnSyncReturns } from 'node:child_process';
+import { execSync, type ChildProcess, type SpawnSyncReturns } from 'node:child_process';
 
 import {
   getDetailedRepoStateAsync,
@@ -12,7 +12,7 @@ import {
   parseGitHashObject
 } from '../getRepoState';
 
-import { Executable, FileSystem } from '@rushstack/node-core-library';
+import { Executable, FileSystem, type IExecutableSpawnOptions } from '@rushstack/node-core-library';
 
 const SOURCE_PATH: string = path
   .join(__dirname)
@@ -326,4 +326,76 @@ describe(getDetailedRepoStateAsync.name, () => {
       FileSystem.deleteFile(tempFilePath1);
     }
   });
+
+  it('rejects when git hash-object fails, without waiting for git ls-files and git status', async () => {
+    // `git hash-object` fails fast on an additional path that does not exist. Its promise used to be awaited only
+    // after `git ls-files` and `git status` finished, so until then its rejection had no handler. Under Node's
+    // default `--unhandled-rejections=throw`, that ended the process (a Rush daemon, in the reported crash).
+    //
+    // To make the ordering deterministic, the 'close' events of ls-files and status are held back until the end.
+    let releaseHeldProcesses: () => void = () => {};
+    const heldProcessesReleased: Promise<void> = new Promise((resolve) => {
+      releaseHeldProcesses = resolve;
+    });
+    let onHashObjectClosed: () => void = () => {};
+    const hashObjectClosed: Promise<void> = new Promise((resolve) => {
+      onHashObjectClosed = resolve;
+    });
+
+    const spawn: typeof Executable.spawn = Executable.spawn.bind(Executable);
+    const spawnSpy: jest.SpyInstance = jest
+      .spyOn(Executable, 'spawn')
+      .mockImplementation(
+        (filename: string, args: string[], options?: IExecutableSpawnOptions): ChildProcess => {
+          const childProcess: ChildProcess = spawn(filename, args, options);
+          const emit: ChildProcess['emit'] = childProcess.emit.bind(childProcess);
+          const isHashObject: boolean = args.includes('hash-object');
+          childProcess.emit = ((eventName: string | symbol, ...eventArgs: unknown[]): boolean => {
+            if (eventName === 'close' && !isHashObject) {
+              void heldProcessesReleased.then(() => emit(eventName, ...eventArgs));
+              return true;
+            }
+            const hadListeners: boolean = emit(eventName, ...eventArgs);
+            if (eventName === 'close') {
+              onHashObjectClosed();
+            }
+            return hadListeners;
+          }) as ChildProcess['emit'];
+          return childProcess;
+        }
+      );
+
+    let outcome: { error: unknown } | undefined;
+    const settled: Promise<void> = getDetailedRepoStateAsync(
+      SOURCE_PATH,
+      [`${TEST_PREFIX}testProject/does-not-exist.txt`],
+      undefined,
+      FILTERS
+    ).then(
+      () => {
+        outcome = { error: undefined };
+      },
+      (error: unknown) => {
+        outcome = { error };
+      }
+    );
+
+    try {
+      await hashObjectClosed;
+      // Every step from the hash-object exit to the rejection runs as a microtask, so one macrotask is enough.
+      await new Promise<void>((resolve) => setImmediate(resolve));
+
+      expect(spawnSpy).toHaveBeenCalledTimes(3);
+      // Before the fix, the promise was still pending at this point.
+      expect(outcome).toEqual({
+        error: expect.objectContaining({
+          message: expect.stringMatching(/^git hash-object exited with code 128:[\s\S]*does-not-exist\.txt/)
+        })
+      });
+    } finally {
+      releaseHeldProcesses();
+      await settled;
+      spawnSpy.mockRestore();
+    }
+  });
 });
diff --git a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
index 926e20e449..9f700d26c7 100644
--- a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
@@ -44,4 +44,10 @@ export interface IDaemonActivityPayload {
   readonly text: string;
   /** The stream the line was written to. Defaults to `stdout`. */
   readonly stream?: 'stdout' | 'stderr';
+  /**
+   * Set when Rush or a Rush plugin wrote the text as a warning or an error while the engine loaded or ran,
+   * which native Rush prints in yellow or red. Absent on other activity, including the end-of-run summary.
+   * Clients that print only a summary can still show these lines.
+   */
+  readonly severity?: 'warning' | 'error';
 }
diff --git a/libraries/rush-daemon/src/EngineActivityOptions.ts b/libraries/rush-daemon/src/EngineActivityOptions.ts
new file mode 100644
index 0000000000..bd87825125
--- /dev/null
+++ b/libraries/rush-daemon/src/EngineActivityOptions.ts
@@ -0,0 +1,32 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { _IOperationActivityOptions } from '@microsoft/rush-lib';
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+/**
+ * Activity options for text that Rush or a Rush plugin wrote through a daemon engine's terminal. The graph's event
+ * sink (PhasedRequestEventMultiplexer) passes the options object unchanged to each request's event sink.
+ */
+export interface IEngineActivityOptions extends _IOperationActivityOptions {
+  /**
+   * Set when the text is a warning or an error. Request event sinks copy it into the activity payload, so
+   * clients that print only a summary can still show these lines.
+   */
+  readonly severity?: 'warning' | 'error';
+}
+
+const WARNING_ACTIVITY: IEngineActivityOptions = { stderr: true, severity: 'warning' };
+const ERROR_ACTIVITY: IEngineActivityOptions = { stderr: true, severity: 'error' };
+const OUTPUT_ACTIVITY: IEngineActivityOptions = { stderr: false };
+
+export function getEngineActivityOptions(severity: TerminalProviderSeverity): IEngineActivityOptions {
+  switch (severity) {
+    case TerminalProviderSeverity.warning:
+      return WARNING_ACTIVITY;
+    case TerminalProviderSeverity.error:
+      return ERROR_ACTIVITY;
+    default:
+      return OUTPUT_ACTIVITY;
+  }
+}
diff --git a/libraries/rush-daemon/src/EngineTerminalProvider.ts b/libraries/rush-daemon/src/EngineTerminalProvider.ts
index 88345d0372..cb13c5d782 100644
--- a/libraries/rush-daemon/src/EngineTerminalProvider.ts
+++ b/libraries/rush-daemon/src/EngineTerminalProvider.ts
@@ -4,6 +4,7 @@
 import type { IOperationGraph, _IOperationGraphEventSink } from '@microsoft/rush-lib';
 import { TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
 
+import { getEngineActivityOptions } from './EngineActivityOptions';
 import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
 
 export class EngineTerminalProvider implements ITerminalProvider {
@@ -95,8 +96,6 @@ export class EngineTerminalProvider implements ITerminalProvider {
     ) {
       return;
     }
-    this.#graph?.eventSink?.onActivity?.(text, {
-      stderr: severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning
-    });
+    this.#graph?.eventSink?.onActivity?.(text, getEngineActivityOptions(severity));
   }
 }
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index 0fc35cbf01..4a849617c8 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -3,12 +3,7 @@
 
 import { randomUUID } from 'node:crypto';
 
-import type {
-  IOperationExecutionResult,
-  Operation,
-  _IOperationActivityOptions,
-  _IOperationGraphEventSink
-} from '@microsoft/rush-lib';
+import type { IOperationExecutionResult, Operation, _IOperationGraphEventSink } from '@microsoft/rush-lib';
 import { OperationStatus } from '@microsoft/rush-lib';
 import {
   DAEMON_PROTOCOL_VERSION,
@@ -17,12 +12,14 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonEventType,
+  IDaemonActivityPayload,
   IDaemonEventEnvelope,
   IDaemonEventScope
 } from '@rushstack/rush-daemon-protocol';
 import { TerminalChunkKind } from '@rushstack/terminal';
 import type { ITerminalChunk } from '@rushstack/terminal';
 
+import type { IEngineActivityOptions } from './EngineActivityOptions';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 
 const EVENT_SOURCE_PACKAGE: string = '@microsoft/rush-lib';
@@ -236,16 +233,20 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     }
   }
 
-  public onActivity(text: string, options?: _IOperationActivityOptions): void {
+  public onActivity(text: string, options?: IEngineActivityOptions): void {
     const operationId: string | undefined = options?.operationId;
     if (operationId !== undefined && !this.#activeOperationIds.has(operationId)) {
       return;
     }
-    this.#emitEvent(
-      'activityChanged',
-      { stream: options?.stderr === true ? 'stderr' : 'stdout', text },
-      { required: true, scope: operationId === undefined ? undefined : { operationId } }
-    );
+    const payload: IDaemonActivityPayload = {
+      stream: options?.stderr === true ? 'stderr' : 'stdout',
+      text,
+      ...(options?.severity === undefined ? undefined : { severity: options.severity })
+    };
+    this.#emitEvent('activityChanged', payload, {
+      required: true,
+      scope: operationId === undefined ? undefined : { operationId }
+    });
   }
 
   #emitEvent(type: DaemonEventType, payload: unknown, options?: IEventOptions): void {
diff --git a/libraries/rush-daemon/src/test/EngineActivity.test.ts b/libraries/rush-daemon/src/test/EngineActivity.test.ts
new file mode 100644
index 0000000000..87859ca4f1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/EngineActivity.test.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+import { EngineTerminalProvider } from '../EngineTerminalProvider';
+import { PhasedRequestEventMultiplexer } from '../PhasedRequestEventMultiplexer';
+import { PhasedRequestEventSink } from '../PhasedRequestEventSink';
+import { TestPhasedRequestClient } from './PhasedRequestRouterTestUtilities';
+
+type HookName = 'configureIteration' | 'beforeExecuteIterationAsync' | 'afterExecuteIterationAsync';
+
+interface IActivityHarness {
+  readonly client: TestPhasedRequestClient;
+  readonly sink: PhasedRequestEventSink;
+  readonly terminal: EngineTerminalProvider;
+  callHook(name: HookName): void;
+}
+
+function createHarness(): IActivityHarness {
+  const taps: Map<HookName, () => void> = new Map();
+  const hook = (name: HookName): { tap(options: unknown, fn: () => void): void } => ({
+    tap: (options: unknown, fn: () => void) => taps.set(name, fn)
+  });
+  const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+  const graph: IOperationGraph = {
+    debugMode: false,
+    eventSink: multiplexer,
+    hooks: {
+      configureIteration: hook('configureIteration'),
+      beforeExecuteIterationAsync: hook('beforeExecuteIterationAsync'),
+      afterExecuteIterationAsync: hook('afterExecuteIterationAsync')
+    }
+  } as unknown as IOperationGraph;
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const sink: PhasedRequestEventSink = new PhasedRequestEventSink({
+    activeOperationIds: new Set(),
+    client,
+    getNextSequence: () => client.getNextEventSequence(),
+    onWriteFailure: () => undefined,
+    rushVersion: '5.178.1'
+  });
+  multiplexer.subscribe(sink);
+  const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+  terminal.attach(graph);
+  return { client, sink, terminal, callHook: (name: HookName) => taps.get(name)!() };
+}
+
+async function getActivityPayloadsAsync(harness: IActivityHarness): Promise<unknown[]> {
+  await harness.sink.flushAsync();
+  return harness.client.writes
+    .map(({ event }) => event)
+    .filter((event: IDaemonEventEnvelope | undefined) => event?.type === 'activityChanged')
+    .map((event: IDaemonEventEnvelope | undefined) => event!.payload);
+}
+
+describe('engine terminal activity', () => {
+  it('marks warnings and errors that Rush or a plugin writes, whether buffered or written during an iteration', async () => {
+    const harness: IActivityHarness = createHarness();
+    harness.terminal.write('buffered warning\n', TerminalProviderSeverity.warning);
+    harness.terminal.write('buffered output\n', TerminalProviderSeverity.log);
+    harness.callHook('configureIteration');
+    harness.callHook('beforeExecuteIterationAsync');
+    harness.terminal.write('plugin warning\n', TerminalProviderSeverity.warning);
+    harness.terminal.write('plugin error\n', TerminalProviderSeverity.error);
+    harness.terminal.write('plugin output\n', TerminalProviderSeverity.log);
+    harness.terminal.write('plugin detail\n', TerminalProviderSeverity.verbose);
+
+    expect(await getActivityPayloadsAsync(harness)).toStrictEqual([
+      { severity: 'warning', stream: 'stderr', text: 'buffered warning\n' },
+      { stream: 'stdout', text: 'buffered output\n' },
+      { severity: 'warning', stream: 'stderr', text: 'plugin warning\n' },
+      { severity: 'error', stream: 'stderr', text: 'plugin error\n' },
+      { stream: 'stdout', text: 'plugin output\n' }
+    ]);
+  });
+
+  it('leaves other activity, such as the end-of-run summary, without a severity', async () => {
+    const harness: IActivityHarness = createHarness();
+    harness.sink.onActivity('Operations failed.\n', { stderr: true });
+    harness.sink.onActivity('rush build (1.00 seconds)\n');
+
+    expect(await getActivityPayloadsAsync(harness)).toStrictEqual([
+      { stream: 'stderr', text: 'Operations failed.\n' },
+      { stream: 'stdout', text: 'rush build (1.00 seconds)\n' }
+    ]);
+  });
+});

From 6a05b01dee46e87bed03fbaa9baaf07624b3ad8c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 17:52:56 +0000
Subject: [PATCH 028/265] [node-core-library] LockFile ties, TZ/locale rule,
 /proc start times and own-start memo

Swarm integration step 13; original commit 0347cd0dbb.
Refs: tasks 67, D and 62.

ch01 GATE OK board 1389; o05 board 1360 (task 62 on ch01-t62: 32/32 served in 3 of 3 bursts); t01 board 1106/board 1186.

Commits folded into this step (6):
- 3dfb75ec86 [node-core-library] Don't grant a LockFile twice when lockfile birthtimes tie
- 074f207217 [node-core-library] Keep the LockFile of a running process with another time zone or locale
- 4e43a1ef8f [node-core-library] Don't set dirtyWhenAcquired when the holder releases the lock during a check
- ad9c1211b4 [node-core-library] Read the start times of other LockFile processes from /proc on Linux
- 698af4ef92 [node-core-library] Run ps for the start time of the current LockFile process only once on Linux
- 9249e85d63 [rush-client-core] Test clients that start the daemon at the same time

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../lockfile-birthtime-tie_2026-09-28.json    |  10 +
 .../lockfile-own-start-time_2026-09-28.json   |  10 +
 .../lockfile-proc-start-time_2026-09-28.json  |  10 +
 ...lockfile-start-time-locale_2026-09-28.json |  10 +
 .../startup-burst-test_2026-09-28.json        |  10 +
 libraries/node-core-library/src/LockFile.ts   | 356 +++++++++-
 .../src/test/LockFile.test.ts                 | 608 +++++++++++++++++-
 .../src/test/connectOrStartDaemon.test.ts     |  52 +-
 .../src/test/fixtures/daemon.ts               |   8 +-
 9 files changed, 1040 insertions(+), 34 deletions(-)
 create mode 100644 common/changes/@rushstack/node-core-library/lockfile-birthtime-tie_2026-09-28.json
 create mode 100644 common/changes/@rushstack/node-core-library/lockfile-own-start-time_2026-09-28.json
 create mode 100644 common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json
 create mode 100644 common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-client-core/startup-burst-test_2026-09-28.json

diff --git a/common/changes/@rushstack/node-core-library/lockfile-birthtime-tie_2026-09-28.json b/common/changes/@rushstack/node-core-library/lockfile-birthtime-tie_2026-09-28.json
new file mode 100644
index 0000000000..c2d5042e06
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/lockfile-birthtime-tie_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "Fix `LockFile` on Linux and macOS granting a lock to two processes at once when their lockfiles have the same birthtime. A tie no longer lets either process acquire the lock in that attempt; instead, `LockFile.tryAcquire()` waits a random time and tries again with a new lockfile, up to 4 attempts.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}
diff --git a/common/changes/@rushstack/node-core-library/lockfile-own-start-time_2026-09-28.json b/common/changes/@rushstack/node-core-library/lockfile-own-start-time_2026-09-28.json
new file mode 100644
index 0000000000..04de10dff9
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/lockfile-own-start-time_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "On Linux, `LockFile` now runs `ps` for the start time of the current process only once, instead of each time it tries to acquire a lock. It runs `ps` again if the system clock is set or `process.env.TZ` changes.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}
diff --git a/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json b/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json
new file mode 100644
index 0000000000..e06b6e046b
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "Make `LockFile` on Linux much faster when other processes hold or wait for the same lock. It now confirms that another process's lockfile is valid by reading /proc, instead of running a `ps` command for each lockfile on each attempt.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}
diff --git a/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json b/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json
new file mode 100644
index 0000000000..0c02c7c84f
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "Fix `LockFile` on Linux and macOS deleting the lockfile of a running process, and granting the lock again, when that process has a different time zone or locale. A lockfile whose start time doesn't match is now kept if its process started before the lockfile was created.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}
diff --git a/common/changes/@rushstack/rush-client-core/startup-burst-test_2026-09-28.json b/common/changes/@rushstack/rush-client-core/startup-burst-test_2026-09-28.json
new file mode 100644
index 0000000000..bbb09270b5
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/startup-burst-test_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add a test in which 32 clients start at once against a daemon that takes 8 seconds to start. All of them must connect, and `ps` must run about once per client.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/libraries/node-core-library/src/LockFile.ts b/libraries/node-core-library/src/LockFile.ts
index c8c913056e..ea39a31b97 100644
--- a/libraries/node-core-library/src/LockFile.ts
+++ b/libraries/node-core-library/src/LockFile.ts
@@ -138,6 +138,147 @@ export function getProcessStartTime(pid: number): string | undefined {
   throw new Error(`Unexpected output from the "ps" command`);
 }
 
+const LSTART_MONTHS: string[] = [
+  'Jan',
+  'Feb',
+  'Mar',
+  'Apr',
+  'May',
+  'Jun',
+  'Jul',
+  'Aug',
+  'Sep',
+  'Oct',
+  'Nov',
+  'Dec'
+];
+
+/**
+ * Helper function that is exported for unit tests only.
+ * Returns the time when the process started, in milliseconds since the epoch, rounded down to a whole second.
+ * Unlike getProcessStartTime(), the result doesn't depend on the time zone or locale of the current process.
+ * Returns undefined if the process doesn't exist with that pid, or if its start time can't be determined.
+ */
+export function getProcessStartTimeMs(pid: number): number | undefined {
+  const pidString: string = pid.toString();
+  if (pid < 0 || pidString.indexOf('e') >= 0 || pidString.indexOf('E') >= 0) {
+    return undefined;
+  }
+  let args: string[];
+  if (process.platform === 'darwin') {
+    args = [`-p ${pidString}`, '-o lstart'];
+  } else if (process.platform === 'linux') {
+    args = ['-p', pidString, '-o', 'lstart'];
+  } else {
+    return undefined;
+  }
+
+  // "ps -o lstart" formats the time using the time zone and locale of the "ps" process
+  const psResult: child_process.SpawnSyncReturns<string> = child_process.spawnSync('ps', args, {
+    encoding: 'utf8',
+    env: { ...process.env, LC_ALL: 'C', TZ: 'UTC0' }
+  });
+
+  // For example: "Sun Sep 27 17:15:08 2026"
+  const match: RegExpExecArray | null =
+    /^\s*[A-Za-z]{3} ([A-Za-z]{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})\s*$/.exec(
+      (psResult.stdout || '').split('\n')[1] || ''
+    );
+  if (!match) {
+    return undefined;
+  }
+  const month: number = LSTART_MONTHS.indexOf(match[1]);
+  if (month < 0) {
+    return undefined;
+  }
+  return Date.UTC(
+    Number(match[6]),
+    month,
+    Number(match[2]),
+    Number(match[3]),
+    Number(match[4]),
+    Number(match[5])
+  );
+}
+
+const LSTART_DAYS: string[] = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+
+// The number of clock ticks per second in /proc/[pid]/stat.  This is sysconf(_SC_CLK_TCK), which Linux fixes
+// at 100 (USER_HZ) on every architecture that Node.js supports.
+const LINUX_CLOCK_TICKS_PER_SECOND: number = 100;
+
+/**
+ * Helper function that is exported for unit tests only.
+ * Linux only: returns the time when the system booted, in seconds since the epoch, from the "btime" line of
+ * /proc/stat.  "ps -o lstart" adds the start time of a process to this time.
+ */
+export function getLinuxBootTimeSeconds(): number {
+  const match: RegExpExecArray | null = /^btime (\d+)$/m.exec(FileSystem.readFile('/proc/stat'));
+  if (!match) {
+    throw new Error('The contents of /proc/stat have an unexpected format');
+  }
+  return Number(match[1]);
+}
+
+/**
+ * The start time of a Linux process, in the formats that getProcessStartTime() returns.
+ */
+export interface ILinuxProcessStartTime {
+  /**
+   * What "ps -o lstart" prints with the C locale and the current time zone, for example "Mon Sep 28 13:52:39 2026"
+   */
+  lstart: string;
+  /**
+   * The start time in clock ticks after boot, from /proc/[pid]/stat.  getProcessStartTime() returns this if
+   * "ps" can't be run.
+   */
+  ticks: string;
+}
+
+/**
+ * Helper function that is exported for unit tests only.
+ * Linux only: returns the start time of a process from /proc, without running "ps" like getProcessStartTime()
+ * does.  Returns undefined if the process doesn't exist with that pid.  Throws if /proc can't be read for another
+ * reason, or if it has an unexpected format.
+ * @param pid - The process ID
+ * @param getBootTimeSeconds - Returns what getLinuxBootTimeSeconds() returns
+ */
+export function getLinuxProcessStartTime(
+  pid: number,
+  getBootTimeSeconds: () => number
+): ILinuxProcessStartTime | undefined {
+  const pidString: string = pid.toString();
+  if (pid < 0 || pidString.indexOf('e') >= 0 || pidString.indexOf('E') >= 0) {
+    throw new Error(`"pid" is negative or too large`);
+  }
+  let stat: string;
+  try {
+    stat = FileSystem.readFile(`/proc/${pidString}/stat`);
+  } catch (error) {
+    // ESRCH means that the process exited while we were reading the file.
+    if (FileSystem.isNotExistError(error as Error) || (error as NodeJS.ErrnoException).code === 'ESRCH') {
+      return undefined;
+    }
+    throw error;
+  }
+  const ticks: string | undefined = getProcessStartTimeFromProcStat(stat);
+  if (ticks === undefined || !/^[0-9]+$/.test(ticks)) {
+    throw new Error(`The contents of /proc/${pidString}/stat have an unexpected format`);
+  }
+
+  // Like "ps", round down to a whole second and use "%a %b %e %H:%M:%S %Y" in the local time zone.
+  const date: Date = new Date(
+    (getBootTimeSeconds() + Math.floor(Number(ticks) / LINUX_CLOCK_TICKS_PER_SECOND)) * 1000
+  );
+  const twoDigits: (value: number) => string = (value: number) => (value < 10 ? `0${value}` : `${value}`);
+  const lstart: string =
+    `${LSTART_DAYS[date.getDay()]} ${LSTART_MONTHS[date.getMonth()]} ` +
+    `${date.getDate() < 10 ? ' ' : ''}${date.getDate()} ` +
+    `${twoDigits(date.getHours())}:${twoDigits(date.getMinutes())}:${twoDigits(date.getSeconds())} ` +
+    `${date.getFullYear()}`;
+  return { lstart, ticks };
+}
+
 // A set of locks that currently exist in the current process, to be used when
 // multiple locks are acquired in the same process.
 const IN_PROC_LOCKS: Set<string> = new Set<string>();
@@ -145,12 +286,41 @@ const IN_PROC_LOCKS: Set<string> = new Set<string>();
 // The function used to determine a process's start time.  Overridable for unit testing.
 let _getStartTime: (pid: number) => string | undefined = getProcessStartTime;
 
+// On Linux, what _getStartTime() returned for the current process, and what getLinuxProcessStartTime()
+// returned for it at the same time.  See _getCurrentProcessStartTime().
+let _currentProcessStartTime: { startTime: string; linuxLstart: string } | undefined;
+
 /**
  * For unit testing only: overrides the function used to determine a process's start time.
  * @internal
  */
 export function _setLockFileGetProcessStartTime(fn: (pid: number) => string | undefined): void {
   _getStartTime = fn;
+  _currentProcessStartTime = undefined;
+}
+
+/**
+ * Returns the start time of the current process, which its lockfiles contain.  On Linux, this runs "ps" again only
+ * if the start time that /proc gives changes, which happens when the system clock is set or process.env.TZ
+ * changes.  A process that acquires locks often would otherwise run "ps" each time, which is slow when there are
+ * many processes.
+ */
+function _getCurrentProcessStartTime(getLinuxBootTime: () => number): string | undefined {
+  let linuxLstart: string | undefined;
+  if (process.platform === 'linux') {
+    try {
+      linuxLstart = getLinuxProcessStartTime(process.pid, getLinuxBootTime)?.lstart;
+    } catch (error) {
+      // /proc can't be read, so run "ps" every time.
+    }
+  }
+  if (linuxLstart !== undefined && _currentProcessStartTime?.linuxLstart === linuxLstart) {
+    return _currentProcessStartTime.startTime;
+  }
+  const startTime: string | undefined = _getStartTime(process.pid);
+  _currentProcessStartTime =
+    startTime !== undefined && linuxLstart !== undefined ? { startTime, linuxLstart } : undefined;
+  return startTime;
 }
 
 /**
@@ -415,6 +585,67 @@ function _tryAcquireInner(
   }
 }
 
+// How much later than a lockfile's birthtime its process may appear to have started.  "ps" reports whole
+// seconds, and the system clock can be adjusted while a process runs.
+const START_TIME_TOLERANCE_MS: number = 5000;
+
+/**
+ * Called when the start time in the lockfile of another running process differs from the start time that
+ * we got for its PID.  Returns true if the lockfile still belongs to that process.
+ */
+function _isLockFileOfRunningProcess(
+  pid: string,
+  lockFileStartTime: string | undefined,
+  lockFileBirthtimeMs: number | undefined
+): boolean {
+  // "ps -o lstart" formats the start time using the time zone and locale of the process that runs it,
+  // so a process whose TZ, LANG, LC_TIME or LC_ALL differs from ours wrote its start time differently.
+  // If the start time differs because the lockfile's process exited and the OS gave its PID to a new
+  // process, then the new process started after the lockfile was created.  An empty lockfile is still
+  // treated as stale here, as before.
+  if (!lockFileStartTime || lockFileBirthtimeMs === undefined) {
+    return false;
+  }
+  const startTimeMs: number | undefined = getProcessStartTimeMs(parseInt(pid, 10));
+  return startTimeMs !== undefined && startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS;
+}
+
+/**
+ * Returns true if /proc shows that the lockfile of another process belongs to the running process with its PID.
+ * This is much faster than running "ps", which reads the files of every process in /proc.  Returns false if the
+ * start time in the lockfile is different, if /proc can't tell, or if this isn't Linux.  Then the caller must
+ * run "ps", so this never makes a lockfile stale.
+ */
+function _isLockFileOfLinuxProcess(
+  pid: string,
+  lockFileStartTime: string | undefined,
+  getBootTimeSeconds: () => number
+): boolean {
+  if (process.platform !== 'linux' || !lockFileStartTime) {
+    return false;
+  }
+  let startTime: ILinuxProcessStartTime | undefined;
+  try {
+    startTime = getLinuxProcessStartTime(parseInt(pid, 10), getBootTimeSeconds);
+  } catch (error) {
+    // For example, /proc isn't mounted, or it doesn't let us read the files of this process.
+    return false;
+  }
+  // These are the formats that getProcessStartTime() returns.  If the other process wrote its start time with a
+  // locale other than C, the caller runs "ps".
+  return (
+    startTime !== undefined &&
+    (lockFileStartTime === startTime.lstart || lockFileStartTime === startTime.ticks)
+  );
+}
+
+// Returned by _tryAcquireMacOrLinuxOnce() when the lockfile of another process has the same birthtime as ours.
+const TIED: unique symbol = Symbol('tied');
+// The maximum number of attempts that _tryAcquireMacOrLinux() makes while lockfiles keep tying.
+const MAX_TIED_ATTEMPTS: number = 4;
+// After a tie, the next attempt waits a random time of up to this many milliseconds times the attempt number.
+const TIE_RETRY_DELAY_MS: number = 20;
+
 /**
  * Attempts to acquire the lock on a Linux or OSX machine
  */
@@ -423,19 +654,59 @@ function _tryAcquireMacOrLinux(
   resourceName: string,
   pidLockFilePath: string
 ): ITryAcquireResult | undefined {
-  // get the current process identifier (PID)
-  const pid: number = process.pid;
+  // On Linux, the time when the system booted, which we read from /proc/stat at most once per call
+  let linuxBootTimeSeconds: number | undefined;
+  const getLinuxBootTime: () => number = () => {
+    if (linuxBootTimeSeconds === undefined) {
+      linuxBootTimeSeconds = getLinuxBootTimeSeconds();
+    }
+    return linuxBootTimeSeconds;
+  };
 
   // Suppose that a process terminates unexpectedly without deleting its PID-based lockfile,
   // then we check to see if the process is still alive.  The OS may have given the same PID
   // to a new process, how to detect that?  We will rely on getProcessStartTime() which
   // is stored in the file itself for comparison.
-  const startTime: string | undefined = _getStartTime(pid);
+  const startTime: string | undefined = _getCurrentProcessStartTime(getLinuxBootTime);
 
   if (!startTime) {
     throw new Error(`Unable to calculate start time for current process.`);
   }
 
+  for (let attempt: number = 1; ; attempt++) {
+    const result: ITryAcquireResult | typeof TIED | undefined = _tryAcquireMacOrLinuxOnce(
+      resourceFolder,
+      resourceName,
+      pidLockFilePath,
+      startTime,
+      getLinuxBootTime
+    );
+    if (result !== TIED) {
+      return result;
+    }
+    if (attempt >= MAX_TIED_ATTEMPTS) {
+      return undefined;
+    }
+    // If the other process also saw the tie, neither of us has the lock.  Wait a random time so that
+    // our next lockfile is unlikely to tie again, and try again.
+    const delayMs: number = 1 + Math.floor(Math.random() * TIE_RETRY_DELAY_MS * attempt);
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
+  }
+}
+
+/**
+ * Makes one attempt to acquire the lock on a Linux or OSX machine
+ */
+function _tryAcquireMacOrLinuxOnce(
+  resourceFolder: string,
+  resourceName: string,
+  pidLockFilePath: string,
+  startTime: string,
+  getLinuxBootTime: () => number
+): ITryAcquireResult | typeof TIED | undefined {
+  // get the current process identifier (PID)
+  const pid: number = process.pid;
+
   let lockFileHandle: FileWriter | undefined;
 
   let result: ITryAcquireResult | undefined;
@@ -448,8 +719,8 @@ function _tryAcquireMacOrLinux(
     lockFileHandle.write(startTime);
     const currentBirthTimeMs: number = lockFileHandle.getStatistics().birthtime.getTime();
 
-    let smallestBirthTimeMs: number = currentBirthTimeMs;
-    let smallestBirthTimePid: string = pid.toString();
+    // Set if another process has a lockfile with the same birthtime as ours
+    let tied: boolean = false;
 
     // now, scan the directory for all lockfiles
     const files: string[] = FileSystem.readFolderItemNames(resourceFolder);
@@ -475,9 +746,6 @@ function _tryAcquireMacOrLinux(
 
         // console.log(`FOUND OTHER LOCKFILE: ${otherPid}`);
 
-        // Actual start time of the other PID
-        const otherPidCurrentStartTime: string | undefined = _getStartTime(parseInt(otherPid, 10));
-
         // The start time from the file, which we will compare with otherPidCurrentStartTime
         // to determine whether the PID got reused by a new process.
         let otherPidOldStartTime: string | undefined;
@@ -506,6 +774,13 @@ function _tryAcquireMacOrLinux(
 
             // console.log(`Ignoring lock for pid ${otherPid} because its lockfile is newer than ours.`);
             continue;
+          } else if (otherBirthtimeMs === currentBirthTimeMs) {
+            // ==> Tie
+            // The other process's file has the same birthtime as ours, and they may acquire the lock
+            // after they finish writing the contents, so we must not treat this file as stale below.
+            // See the comment about ties below.
+            tied = true;
+            continue;
           } else if (
             otherBirthtimeMs - currentBirthTimeMs < 0 &&
             otherBirthtimeMs - currentBirthTimeMs > -1000
@@ -522,16 +797,39 @@ function _tryAcquireMacOrLinux(
         }
 
         // console.log(`Other pid ${otherPid} lockfile has start time: "${otherPidOldStartTime}"`);
+
+        // Actual start time of the other PID.  On Linux, /proc usually shows that the file belongs to the
+        // process with that PID, and then we don't need to run "ps", which is slow when there are many
+        // processes.  When many processes wait for the same lock, each of their attempts checks the file
+        // of every other process.
+        const otherPidCurrentStartTime: string | undefined = _isLockFileOfLinuxProcess(
+          otherPid,
+          otherPidOldStartTime,
+          getLinuxBootTime
+        )
+          ? otherPidOldStartTime
+          : _getStartTime(parseInt(otherPid, 10));
+
         // console.log(`Other pid ${otherPid} actually has start time: "${otherPidCurrentStartTime}"`);
 
         // Time to compare
-        if (!otherPidCurrentStartTime || otherPidOldStartTime !== otherPidCurrentStartTime) {
+        if (
+          !otherPidCurrentStartTime ||
+          (otherPidOldStartTime !== otherPidCurrentStartTime &&
+            !_isLockFileOfRunningProcess(otherPid, otherPidOldStartTime, otherBirthtimeMs))
+        ) {
           // ==> Stale lockfile
           // This file doesn't prevent us from acquiring the lock, but it does indicate that
           // the resource was left in a dirty state.  (If we delete the file right now, that
           // information would be lost, so we clean up later when we acquire successfully.)
 
           // console.log(`Other pid ${otherPid} is no longer executing!`);
+
+          // We checked the other process after we read its file.  If the file is gone now, the other process
+          // released the lock in between, so the resource isn't dirty.
+          if (!FileSystem.exists(fileInFolderPath)) {
+            continue;
+          }
           staleFilesToDelete.push(fileInFolderPath);
           continue;
         }
@@ -541,33 +839,29 @@ function _tryAcquireMacOrLinux(
 
         if (otherBirthtimeMs !== undefined) {
           // ==> We found a valid file belonging to another process.
-          // With multiple parties trying to acquire, the winner is the smallestBirthTime,
-          // so we need to sort.
-
-          // the other lock file was created before the current earliest lock file
-          // or the other lock file was created at the same exact time, but has earlier pid
-
-          // note that it is acceptable to do a direct comparison of the PIDs in this case
-          // since we are establishing a consistent order to apply to the lock files in all
-          // execution instances.
-
-          // it doesn't matter that the PIDs roll over, we've already
-          // established that these processes all started at the same time, so we just
-          // need to get all instances of the lock test to agree which one won.
-          if (
-            otherBirthtimeMs < smallestBirthTimeMs ||
-            (otherBirthtimeMs === smallestBirthTimeMs && otherPid < smallestBirthTimePid)
-          ) {
-            smallestBirthTimeMs = otherBirthtimeMs;
-            smallestBirthTimePid = otherPid;
+          // With multiple parties trying to acquire, the winner is the one with the earliest file.
+          if (otherBirthtimeMs < currentBirthTimeMs) {
+            // we do not have the lock
+            return undefined;
+          }
+
+          if (otherBirthtimeMs === currentBirthTimeMs) {
+            // ==> Tie
+            // Birthtimes have millisecond precision (often coarser), so files created at about the
+            // same time can have equal birthtimes.  We read the folder only once, so the other process
+            // may have read it before our file existed and concluded that it holds the lock.  Breaking
+            // the tie by PID could then let both processes acquire the lock.  Instead, a tie means that
+            // neither process acquires the lock in this attempt.  At least one of the two processes
+            // sees the other's file, so at most one of them acquires the lock.
+            tied = true;
           }
         }
       }
     }
 
-    if (smallestBirthTimePid !== pid.toString()) {
-      // we do not have the lock
-      return undefined;
+    if (tied) {
+      // we do not have the lock, but we may acquire it if we try again with a new file
+      return TIED;
     }
 
     let dirtyWhenAcquired: boolean = false;
diff --git a/libraries/node-core-library/src/test/LockFile.test.ts b/libraries/node-core-library/src/test/LockFile.test.ts
index 44957de4b9..f9ea13aee2 100644
--- a/libraries/node-core-library/src/test/LockFile.test.ts
+++ b/libraries/node-core-library/src/test/LockFile.test.ts
@@ -2,14 +2,18 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import * as child_process from 'node:child_process';
 import {
   LockFile,
   type ILockFileHandle,
   getProcessStartTime,
   getProcessStartTimeFromProcStat,
+  getProcessStartTimeMs,
+  getLinuxBootTimeSeconds,
+  getLinuxProcessStartTime,
   _setLockFileGetProcessStartTime
 } from '../LockFile';
-import { FileSystem } from '../FileSystem';
+import { FileSystem, type FileSystemStats, type IFileSystemReadFileOptions } from '../FileSystem';
 import { FileWriter } from '../FileWriter';
 import * as WindowsLockFile from '../WindowsLockFile';
 
@@ -17,6 +21,41 @@ function setLockFileGetProcessStartTime(fn: (process: number) => string | undefi
   _setLockFileGetProcessStartTime(fn);
 }
 
+/**
+ * Replaces the contents of a file that FileSystem.readFile() reads, or makes reading it fail.
+ */
+function mockReadFile(filePath: string, contents: string | NodeJS.ErrnoException): void {
+  const originalReadFile: typeof FileSystem.readFile = FileSystem.readFile;
+  jest
+    .spyOn(FileSystem, 'readFile')
+    .mockImplementation((readFilePath: string, options?: IFileSystemReadFileOptions) => {
+      if (readFilePath !== filePath) {
+        return originalReadFile(readFilePath, options);
+      }
+      if (typeof contents !== 'string') {
+        throw contents;
+      }
+      return contents;
+    });
+}
+
+/**
+ * Runs "ps -o lstart" for a process with the C locale, and returns what it prints.
+ */
+function getLstartWithCLocale(pid: number, timeZone?: string): string {
+  return child_process
+    .spawnSync('ps', ['-p', `${pid}`, '-o', 'lstart'], {
+      encoding: 'utf8',
+      env: { ...process.env, LC_ALL: 'C', ...(timeZone === undefined ? {} : { TZ: timeZone }) }
+    })
+    .stdout.split('\n')[1]
+    .trim();
+}
+
+function createEaccesError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' });
+}
+
 // lib/test
 const libTestFolder: string = path.resolve(__dirname, '../../lib-commonjs/test');
 
@@ -450,6 +489,573 @@ describe(LockFile.name, () => {
 
         lock!.release();
       });
+
+      test("doesn't mark dirtyWhenAcquired if other process releases the lock and exits after its lockfile is read", () => {
+        // ensure test folder is clean
+        const testFolder: string = path.join(libTestFolder, '17');
+        FileSystem.ensureEmptyFolder(testFolder);
+
+        const resourceName: string = 'test';
+
+        const otherPid: number = 999999999;
+        const otherPidStartTime: string = '2012-01-02 12:53:12';
+
+        const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+
+        // create an open lockfile for other process
+        const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
+        lockFileHandle.write(otherPidStartTime);
+        lockFileHandle.close();
+
+        // simulate other process lock release and exit while the current process checks whether it is running
+        setLockFileGetProcessStartTime((pid: number) => {
+          if (pid === otherPid) {
+            FileSystem.deleteFile(otherPidLockFileName);
+            return undefined;
+          }
+          return getProcessStartTime(pid);
+        });
+
+        const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+        expect(lock).toBeDefined();
+        expect(lock!.dirtyWhenAcquired).toEqual(false);
+        expect(lock!.isReleased).toEqual(false);
+
+        lock!.release();
+      });
+
+      describe('when lockfiles have the same birthtime', () => {
+        const resourceName: string = 'test';
+        // Compared as strings, this is larger than any real PID, so a PID tie-break would favor this process.
+        const otherPid: number = 999999999;
+        const otherPidStartTime: string = '2012-01-02 12:53:12';
+        const birthtime: Date = new Date(1500000000000);
+
+        interface IOtherLockFile {
+          otherPidLockFileName: string;
+          ourGetStatisticsSpy: jest.SpyInstance;
+        }
+
+        function prepareOtherLockFile(
+          testFolder: string,
+          contents: string,
+          otherBirthtime: Date,
+          deleteAfterFirstRead: boolean = false
+        ): IOtherLockFile {
+          FileSystem.ensureEmptyFolder(testFolder);
+          const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+          const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
+          lockFileHandle.write(contents);
+          lockFileHandle.close();
+
+          // the other process is still running
+          setLockFileGetProcessStartTime((pid: number) => {
+            return pid === otherPid ? otherPidStartTime : getProcessStartTime(pid);
+          });
+
+          const ourGetStatisticsSpy: jest.SpyInstance = jest
+            .spyOn(FileWriter.prototype, 'getStatistics')
+            .mockReturnValue({ birthtime } as FileSystemStats);
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            if (path.resolve(filePath) !== otherPidLockFileName) {
+              return originalGetStatistics(filePath);
+            }
+            if (deleteAfterFirstRead) {
+              // Like us, the other process saw the tie, so it deletes its lockfile before trying again.
+              FileSystem.deleteFile(otherPidLockFileName);
+            }
+            return { birthtime: otherBirthtime } as FileSystemStats;
+          });
+          return { otherPidLockFileName, ourGetStatisticsSpy };
+        }
+
+        test('cannot acquire a lock if another valid lock has the same birthtime and a larger pid', () => {
+          const testFolder: string = path.join(libTestFolder, '6');
+          const { otherPidLockFileName, ourGetStatisticsSpy } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            birthtime
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          // The other process may have read the folder before our lockfile existed, in which case it
+          // already holds the lock, so a tie must not let us acquire it.  We try again with a new
+          // lockfile a few times before giving up.
+          expect(lock).toBeUndefined();
+          expect(ourGetStatisticsSpy).toHaveBeenCalledTimes(4);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+          expect(FileSystem.exists(LockFile.getLockFilePath(testFolder, resourceName))).toEqual(false);
+        });
+
+        test('cannot acquire a lock or delete the other lockfile if it is still empty', () => {
+          const testFolder: string = path.join(libTestFolder, '7');
+          const { otherPidLockFileName } = prepareOtherLockFile(testFolder, '', birthtime);
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          // The other process hasn't written its start time yet, so its lockfile is not stale.
+          expect(lock).toBeUndefined();
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('can acquire a lock after a tie if the other process gives up', () => {
+          const testFolder: string = path.join(libTestFolder, '8');
+          const { otherPidLockFileName, ourGetStatisticsSpy } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            birthtime,
+            true
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(false);
+          expect(ourGetStatisticsSpy).toHaveBeenCalledTimes(2);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('does not try again if another valid lock is older', () => {
+          const testFolder: string = path.join(libTestFolder, '9');
+          const { otherPidLockFileName, ourGetStatisticsSpy } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            new Date(birthtime.getTime() - 1)
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeUndefined();
+          expect(ourGetStatisticsSpy).toHaveBeenCalledTimes(1);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('can acquire a lock if the other valid lock is newer', () => {
+          const testFolder: string = path.join(libTestFolder, '10');
+          const { otherPidLockFileName } = prepareOtherLockFile(
+            testFolder,
+            otherPidStartTime,
+            new Date(birthtime.getTime() + 1)
+          );
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(false);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+          lock!.release();
+        });
+      });
+
+      describe('when the start time in a lockfile differs from the start time of its running process', () => {
+        const resourceName: string = 'test';
+        // The parent process is still running, and it started before any lockfile that this test creates.
+        const otherPid: number = process.ppid;
+
+        function createOtherLockFile(testFolder: string, contents: string): string {
+          FileSystem.ensureEmptyFolder(testFolder);
+          const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+          const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
+          lockFileHandle.write(contents);
+          lockFileHandle.close();
+          return otherPidLockFileName;
+        }
+
+        test('cannot acquire a lock if the other process wrote its start time in another time zone', () => {
+          const testFolder: string = path.join(libTestFolder, '11');
+          // This is UTC+14 (or UTC-12 if that is the local time zone).  POSIX time zones need no time zone database.
+          const otherTimeZone: string = new Date().getTimezoneOffset() === -840 ? 'XYZ+12' : 'XYZ-14';
+          // What the other process writes if it runs with TZ=otherTimeZone
+          const otherPidStartTime: string = child_process
+            .spawnSync('ps', ['-p', `${otherPid}`, '-o', 'lstart'], {
+              encoding: 'utf8',
+              env: { ...process.env, TZ: otherTimeZone }
+            })
+            .stdout.split('\n')[1]
+            .trim();
+          expect(otherPidStartTime).not.toEqual(getProcessStartTime(otherPid));
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, otherPidStartTime);
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          // The other process is running and started before its lockfile was created, so it holds the lock.
+          expect(lock).toBeUndefined();
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('deletes the lockfile if its PID now belongs to a process that started after the lockfile was created', () => {
+          const testFolder: string = path.join(libTestFolder, '12');
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Thu Jan  1 00:00:10 1970');
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            return path.resolve(filePath) === otherPidLockFileName
+              ? ({ birthtime: new Date(10000) } as FileSystemStats)
+              : originalGetStatistics(filePath);
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('deletes an empty lockfile that is more than 1 second old', () => {
+          const testFolder: string = path.join(libTestFolder, '13');
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, '');
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            return path.resolve(filePath) === otherPidLockFileName
+              ? ({ birthtime: new Date(Date.now() - 2000) } as FileSystemStats)
+              : originalGetStatistics(filePath);
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test("doesn't mark dirtyWhenAcquired if the process releases the lock and exits before its start time is checked again", () => {
+          const testFolder: string = path.join(libTestFolder, '19');
+          // No process has this PID, so the second check of its start time finds that the process exited.
+          const exitedPid: number = 999999999;
+          FileSystem.ensureEmptyFolder(testFolder);
+          const exitedPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, exitedPid);
+          const lockFileHandle: FileWriter = FileWriter.open(exitedPidLockFileName);
+          lockFileHandle.write('Mon Jan  2 12:53:12 2012');
+          lockFileHandle.close();
+
+          // Before its lockfile is read, the process is running, and its start time is formatted differently,
+          // as if it had another time zone.
+          setLockFileGetProcessStartTime((pid: number) => {
+            return pid === exitedPid ? 'Mon Jan  2 04:53:12 2012' : getProcessStartTime(pid);
+          });
+          // Right after its lockfile is read, the process releases the lock and exits.
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            const statistics: FileSystemStats = originalGetStatistics(filePath);
+            if (path.resolve(filePath) === exitedPidLockFileName) {
+              FileSystem.deleteFile(exitedPidLockFileName);
+            }
+            return statistics;
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(false);
+          lock!.release();
+        });
+      });
+
+      describe(getProcessStartTimeMs.name, () => {
+        test('returns the start time of a process', () => {
+          const startTimeMs: number | undefined = getProcessStartTimeMs(process.pid);
+          expect(startTimeMs).toBeDefined();
+          expect(startTimeMs! % 1000).toEqual(0);
+          expect(Math.abs(startTimeMs! - (Date.now() - process.uptime() * 1000))).toBeLessThan(5000);
+        });
+
+        test('does not depend on the time zone', () => {
+          const startTimeMs: number | undefined = getProcessStartTimeMs(process.pid);
+          const originalTimeZone: string | undefined = process.env.TZ;
+          process.env.TZ = 'XYZ-14';
+          try {
+            expect(getProcessStartTimeMs(process.pid)).toEqual(startTimeMs);
+          } finally {
+            if (originalTimeZone === undefined) {
+              delete process.env.TZ;
+            } else {
+              process.env.TZ = originalTimeZone;
+            }
+          }
+        });
+
+        test('returns undefined if the process does not exist', () => {
+          expect(getProcessStartTimeMs(999999999)).toBeUndefined();
+        });
+      });
+
+      if (process.platform === 'linux') {
+        describe(getLinuxProcessStartTime.name, () => {
+          test('returns what "ps -o lstart" prints with the C locale', () => {
+            for (const pid of [process.pid, process.ppid, 1]) {
+              expect(getLinuxProcessStartTime(pid, getLinuxBootTimeSeconds)!.lstart).toEqual(
+                getLstartWithCLocale(pid)
+              );
+            }
+          });
+
+          test('uses the time zone of the process, like "ps"', () => {
+            // A test can't change the time zone of its own process in Jest, so this runs another process.
+            const timeZone: string = new Date().getTimezoneOffset() === -840 ? 'XYZ+12' : 'XYZ-14';
+            const lockFileModulePath: string = require.resolve('../LockFile');
+            const script: string =
+              `const { getLinuxProcessStartTime, getLinuxBootTimeSeconds } = require(${JSON.stringify(lockFileModulePath)});` +
+              `console.log(getLinuxProcessStartTime(${process.pid}, getLinuxBootTimeSeconds).lstart);`;
+            const lstart: string = child_process
+              .spawnSync(process.execPath, ['-e', script], {
+                encoding: 'utf8',
+                env: { ...process.env, TZ: timeZone }
+              })
+              .stdout.trim();
+
+            expect(lstart).toEqual(getLstartWithCLocale(process.pid, timeZone));
+            expect(lstart).not.toEqual(
+              getLinuxProcessStartTime(process.pid, getLinuxBootTimeSeconds)!.lstart
+            );
+          });
+
+          test('returns the start time in clock ticks from /proc/[pid]/stat', () => {
+            expect(getLinuxProcessStartTime(process.pid, getLinuxBootTimeSeconds)!.ticks).toEqual(
+              getProcessStartTimeFromProcStat(FileSystem.readFile(`/proc/${process.pid}/stat`))
+            );
+          });
+
+          test('reads /proc/[pid]/stat if the command name contains spaces and parentheses', () => {
+            mockReadFile(
+              '/proc/12345/stat',
+              '12345 (a) (b) S 1 1 1 0 -1 4194304 0 0 0 0 0 0 0 0 20 0 1 0 250 0 0\n'
+            );
+            // 250 ticks are 2.5 seconds, which "ps" rounds down.  This is September 8 or 9, 2001 in any time zone.
+            const expectedLstart: string = child_process
+              .spawnSync('date', ['-d', '@1000000002', '+%a %b %e %H:%M:%S %Y'], {
+                encoding: 'utf8',
+                env: { ...process.env, LC_ALL: 'C' }
+              })
+              .stdout.trim();
+
+            expect(getLinuxProcessStartTime(12345, () => 1000000000)).toEqual({
+              lstart: expectedLstart,
+              ticks: '250'
+            });
+            expect(expectedLstart).toMatch(/^[A-Z][a-z]{2} Sep {2}[89] \d\d:\d\d:\d\d 2001$/);
+          });
+
+          test('returns undefined if the process does not exist', () => {
+            expect(getLinuxProcessStartTime(999999999, getLinuxBootTimeSeconds)).toBeUndefined();
+          });
+
+          test('throws if /proc/[pid]/stat cannot be read', () => {
+            mockReadFile('/proc/12345/stat', createEaccesError());
+            expect(() => getLinuxProcessStartTime(12345, getLinuxBootTimeSeconds)).toThrow('EACCES');
+          });
+
+          test('throws if /proc/[pid]/stat has an unexpected format', () => {
+            mockReadFile('/proc/12345/stat', '12345 (node) S 1\n');
+            expect(() => getLinuxProcessStartTime(12345, getLinuxBootTimeSeconds)).toThrow(
+              'unexpected format'
+            );
+          });
+        });
+
+        describe('when other lockfiles belong to running processes', () => {
+          const resourceName: string = 'test';
+          let childProcesses: child_process.ChildProcess[] = [];
+
+          afterEach(() => {
+            for (const childProcess of childProcesses) {
+              childProcess.kill();
+            }
+            childProcesses = [];
+          });
+
+          function startProcesses(count: number): number[] {
+            for (let i: number = 0; i < count; i++) {
+              childProcesses.push(child_process.spawn('sleep', ['60'], { stdio: 'ignore' }));
+            }
+            return childProcesses.map((childProcess: child_process.ChildProcess) => childProcess.pid!);
+          }
+
+          // Creates a lockfile for each process that is newer than the lockfile of this process,
+          // so that tryAcquire() checks all of them and then acquires the lock.
+          function createNewerLockFiles(
+            testFolder: string,
+            otherPids: number[],
+            getContents: (pid: number) => string
+          ): string[] {
+            FileSystem.ensureEmptyFolder(testFolder);
+            const otherPidLockFileNames: string[] = otherPids.map((otherPid: number) => {
+              const otherPidLockFileName: string = LockFile.getLockFilePath(
+                testFolder,
+                resourceName,
+                otherPid
+              );
+              FileSystem.writeFile(otherPidLockFileName, getContents(otherPid));
+              return otherPidLockFileName;
+            });
+            const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+            jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+              return otherPidLockFileNames.includes(path.resolve(filePath))
+                ? ({ birthtime: new Date(Date.now() + 60000) } as FileSystemStats)
+                : originalGetStatistics(filePath);
+            });
+            return otherPidLockFileNames;
+          }
+
+          function expectToAcquireAndKeep(testFolder: string, otherPidLockFileNames: string[]): void {
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(false);
+            for (const otherPidLockFileName of otherPidLockFileNames) {
+              expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+            }
+            lock!.release();
+          }
+
+          test('does not run "ps" for them', () => {
+            const testFolder: string = path.join(libTestFolder, '14');
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              [process.ppid, 1, ...startProcesses(6)],
+              getLstartWithCLocale
+            );
+            // LockFile calls the functions of this module object, so they can be spied on here.
+            const nativeChildProcess: typeof child_process = jest.requireActual('node:child_process');
+            const spawnSyncSpy: jest.SpyInstance = jest.spyOn(nativeChildProcess, 'spawnSync');
+            const readFileSpy: jest.SpyInstance = jest.spyOn(FileSystem, 'readFile');
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            // "ps" ran only for the start time of this process.
+            expect(spawnSyncSpy).toHaveBeenCalledTimes(1);
+            expect(spawnSyncSpy.mock.calls[0][1]).toEqual(['-p', `${process.pid}`, '-o', 'lstart']);
+            // The boot time was read once.
+            expect(readFileSpy.mock.calls.filter((args: unknown[]) => args[0] === '/proc/stat')).toHaveLength(
+              1
+            );
+          });
+
+          test('does not run "ps" if a lockfile has the start time in clock ticks', () => {
+            const testFolder: string = path.join(libTestFolder, '15');
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              startProcesses(1),
+              (otherPid: number) => getLinuxProcessStartTime(otherPid, getLinuxBootTimeSeconds)!.ticks
+            );
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid]]);
+          });
+
+          test('runs "ps" if /proc/[pid]/stat cannot be read', () => {
+            const testFolder: string = path.join(libTestFolder, '16');
+            const otherPids: number[] = startProcesses(1);
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              getLstartWithCLocale
+            );
+            mockReadFile(`/proc/${otherPids[0]}/stat`, createEaccesError());
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
+          });
+        });
+
+        describe('when this process acquires locks again', () => {
+          const resourceName: string = 'test';
+          const testFolder: string = path.join(libTestFolder, '18');
+
+          beforeEach(() => {
+            FileSystem.ensureEmptyFolder(testFolder);
+          });
+
+          // Returns what the lockfile of this process contained
+          function acquireAndRelease(): string {
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+            expect(lock).toBeDefined();
+            const contents: string = FileSystem.readFile(LockFile.getLockFilePath(testFolder, resourceName));
+            lock!.release();
+            return contents;
+          }
+
+          test('runs "ps" for the start time of this process only once', () => {
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+            const expectedStartTime: string = getProcessStartTime(process.pid)!;
+
+            for (let i: number = 0; i < 3; i++) {
+              expect(acquireAndRelease()).toEqual(expectedStartTime);
+            }
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid]]);
+          });
+
+          test('runs "ps" again if the boot time changes, as it does when the system clock is set', () => {
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            acquireAndRelease();
+            mockReadFile('/proc/stat', `btime ${getLinuxBootTimeSeconds() - 3600}\n`);
+            acquireAndRelease();
+            acquireAndRelease();
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [process.pid]]);
+          });
+
+          test('runs "ps" again if it did not return the start time', () => {
+            const getStartTimeSpy: jest.Mock = jest
+              .fn(getProcessStartTime)
+              .mockImplementationOnce(() => undefined);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expect(() => LockFile.tryAcquire(testFolder, resourceName)).toThrow(
+              'Unable to calculate start time for current process.'
+            );
+            acquireAndRelease();
+            acquireAndRelease();
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [process.pid]]);
+          });
+
+          test('runs "ps" for other processes each time', () => {
+            const otherPid: number = 999999999;
+            const otherPidStartTime: string = '2012-01-02 12:53:12';
+            const otherPidLockFileName: string = LockFile.getLockFilePath(testFolder, resourceName, otherPid);
+            FileSystem.writeFile(otherPidLockFileName, otherPidStartTime);
+            const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+            jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+              return path.resolve(filePath) === otherPidLockFileName
+                ? ({ birthtime: new Date(Date.now() - 60000) } as FileSystemStats)
+                : originalGetStatistics(filePath);
+            });
+            const getStartTimeSpy: jest.Mock = jest.fn((pid: number) =>
+              pid === otherPid ? otherPidStartTime : getProcessStartTime(pid)
+            );
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            for (let i: number = 0; i < 3; i++) {
+              expect(LockFile.tryAcquire(testFolder, resourceName)).toBeUndefined();
+            }
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPid], [otherPid], [otherPid]]);
+          });
+
+          test('uses the new function after the function is replaced', () => {
+            setLockFileGetProcessStartTime(() => 'Mon Jan  1 00:00:00 2024');
+            expect(acquireAndRelease()).toEqual('Mon Jan  1 00:00:00 2024');
+
+            setLockFileGetProcessStartTime(() => 'Tue Jan  2 00:00:00 2024');
+            expect(acquireAndRelease()).toEqual('Tue Jan  2 00:00:00 2024');
+          });
+        });
+      }
     });
   }
 
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index bc11e815bd..027d2e22bf 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -343,6 +343,53 @@ describe('detached daemon startup', () => {
     await client.closeAsync();
   }, 15000);
 
+  // On Linux, LockFile checks the owners of other lockfiles. It used to run "ps" for each of them on every attempt,
+  // and "ps" reads every process on the system, so clients that started at once timed out on a busy machine.
+  (process.platform === 'linux' ? it : it.skip)(
+    'connects 32 concurrent clients to a daemon that takes 8 seconds to start, running "ps" once per client',
+    async () => {
+      const clientCount: number = 32;
+      fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '8000');
+      // A "ps" script ahead of the real one on the PATH records the client that runs each "ps" command.
+      const binFolder: string = path.join(folder, 'bin');
+      const psCallsPath: string = path.join(folder, 'ps-calls');
+      fs.mkdirSync(binFolder);
+      fs.writeFileSync(
+        path.join(binFolder, 'ps'),
+        `#!/bin/sh\necho "$PPID" >> '${psCallsPath}'\nPATH='${process.env.PATH}' exec ps "$@"\n`,
+        { mode: 0o755 }
+      );
+      // The default deadline, instead of the 7 seconds that this suite uses.
+      const startOptions: IConnectOrStartDaemonOptions = { ...options, startupTimeoutMs: 15000 };
+      const starters: ChildProcess[] = Array.from({ length: clientCount }, () =>
+        spawn(process.execPath, [path.join(__dirname, 'fixtures/starter.js'), JSON.stringify(startOptions)], {
+          // With another locale, "ps" can print localized names, and LockFile then runs "ps" to check them.
+          env: { ...process.env, PATH: `${binFolder}${path.delimiter}${process.env.PATH}`, LC_ALL: 'C' },
+          stdio: ['ignore', 'ignore', 'pipe']
+        })
+      );
+      starterProcesses.push(...starters);
+      const results = await Promise.all(
+        starters.map(async (starter) => {
+          let stderr: string = '';
+          starter.stderr!.on('data', (chunk: Buffer) => {
+            stderr += chunk.toString();
+          });
+          const [code] = await once(starter, 'close');
+          return { code, stderr };
+        })
+      );
+
+      expect(results).toEqual(Array.from({ length: clientCount }, () => ({ code: 0, stderr: '' })));
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+      // Each client runs "ps" once, for its own start time. Lockfiles of other clients are checked with /proc.
+      const psCalls: number = fs.readFileSync(psCallsPath, 'utf8').trim().split('\n').length;
+      expect(psCalls).toBeGreaterThan(0);
+      expect(psCalls).toBeLessThan(2 * clientCount);
+    },
+    30000
+  );
+
   it('replaces a mismatched daemon exactly once for concurrent clients before requests start', async () => {
     const old = await connectOrStartDaemonAsync(options);
     const previous = await old.status;
@@ -468,7 +515,10 @@ describe('detached daemon startup', () => {
         expect(starts).toBeGreaterThanOrEqual(2);
         expect(starts).toBeLessThanOrEqual(7);
         // The deadline may expire after the last successor started but before the request was resubmitted.
-        const requests: number = fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n').length;
+        const requests: number = fs
+          .readFileSync(path.join(folder, 'requests'), 'utf8')
+          .trim()
+          .split('\n').length;
         expect(requests).toBeGreaterThanOrEqual(starts - 1);
         expect(requests).toBeLessThanOrEqual(starts);
       } else {
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index e03e1cc12e..5d04da0f96 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -39,7 +39,7 @@ async function mainAsync(): Promise<void> {
       await new Promise((resolve) => setTimeout(resolve, 20));
     }
   }
-  await new Promise((resolve) => setTimeout(resolve, 250));
+  await new Promise((resolve) => setTimeout(resolve, readStartupDelayMs(folder)));
   const listener = await DaemonFrameListener.listenAsync(paths, {
     protocolVersion: DAEMON_PROTOCOL_VERSION,
     onConnection: (connection) => {
@@ -127,6 +127,12 @@ async function mainAsync(): Promise<void> {
   }
 }
 
+/** How long the daemon waits before it listens: 250 milliseconds, or the number in the "startup-delay-ms" file. */
+function readStartupDelayMs(folder: string): number {
+  const delayPath: string = path.join(folder, 'startup-delay-ms');
+  return fs.existsSync(delayPath) ? Number(fs.readFileSync(delayPath, 'utf8')) : 250;
+}
+
 mainAsync().catch((error: Error) => {
   process.stderr.write(`${error.stack}\n`);
   process.exitCode = 1;

From bc5e6c9e40d5c0fa10f051f00ca71f363c86d7e2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 18:05:55 +0000
Subject: [PATCH 029/265] [rush-daemon] A request can share an input capture
 that started after it was received

Swarm integration step 14; original commit f2ec9ffc26.

ch01 GATE OK board 1430 (tree ae49a66e47 with o07's stack); t06 CONFIRMED board 1365; o05 board 1412 (cold split gone in auto-start mode).

Commits folded into this step (1):
- a4de3fe5fe [rush-daemon] Share running input captures that started after a request was received

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...time-capture-sharing_2026-09-28-16-31.json |  10 +
 .../rush-daemon/src/FreshCaptureCoalescer.ts  |  42 ++-
 .../src/WorkspaceRequestLifecycle.ts          |  48 ++-
 .../src/test/FreshCaptureCoalescer.test.ts    | 144 +++++++++
 .../test/WorkspaceInputCaptureReceipt.test.ts | 294 ++++++++++++++++++
 5 files changed, 520 insertions(+), 18 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r07-receipt-time-capture-sharing_2026-09-28-16-31.json
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r07-receipt-time-capture-sharing_2026-09-28-16-31.json b/common/changes/@rushstack/rush-daemon/swarm-r07-receipt-time-capture-sharing_2026-09-28-16-31.json
new file mode 100644
index 0000000000..ca7fb34a1e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r07-receipt-time-capture-sharing_2026-09-28-16-31.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A build request can share a workspace input or project configuration capture that is already running if the capture started after the daemon received the request, instead of waiting for the next capture. Builds that arrive together, or that wait behind a graph load, now share one capture. Captures that detect changes during a graph reload, and graph control captures, still start after they are requested.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/FreshCaptureCoalescer.ts b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
index 1b16286973..a9f4865264 100644
--- a/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
+++ b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
@@ -2,15 +2,26 @@
 // See LICENSE in the project root for license information.
 
 interface ICapture<TValue> {
+  readonly startTimeMs: number;
   readonly running: Promise<TValue>;
   next: Promise<TValue> | undefined;
 }
 
+/**
+ * Options for {@link FreshCaptureCoalescer}.
+ */
+export interface IFreshCaptureCoalescerOptions {
+  /**
+   * Returns the current time on the clock that callers use for `notBeforeMs`. Defaults to `performance.now()`.
+   */
+  readonly now?: () => number;
+}
+
 function ignore(): void {}
 
 /**
  * Shares workspace input captures between concurrent requests, without ever giving a caller a capture that
- * began before the caller asked for one.
+ * began before the caller asked for one, or before the time that the caller passes as `notBeforeMs`.
  *
  * @remarks
  * A capture reads the workspace while it runs, so a capture that is already running can miss a change made just
@@ -19,14 +30,38 @@ function ignore(): void {}
  * Concurrent callers cost at most two captures instead of one each, and every caller receives a result that is
  * at least as fresh as a capture it started itself. Nothing is retained once a capture settles.
  *
+ * A caller that knows an earlier time after which every change it depends on was made, such as the time at which
+ * the daemon received its request, can pass that time as `notBeforeMs`. It then shares a running capture that
+ * started at or after that time instead of waiting for the next one.
+ *
  * Callers that pass the same scope and key must request the same capture.
  */
 export class FreshCaptureCoalescer<TScope extends object, TValue> {
   readonly #captures: WeakMap<TScope, Map<string, ICapture<TValue>>> = new WeakMap();
+  readonly #now: () => number;
+
+  public constructor(options: IFreshCaptureCoalescerOptions = {}) {
+    this.#now = options.now ?? (() => performance.now());
+  }
 
-  public captureAsync(scope: TScope, key: string, captureAsync: () => Promise<TValue>): Promise<TValue> {
+  /**
+   * Returns a capture that started after this call, or at or after `notBeforeMs` if it is specified.
+   *
+   * @param scope - Captures are shared only within a scope.
+   * @param key - Identifies the capture within the scope.
+   * @param captureAsync - Starts a capture when the caller cannot share one.
+   * @param notBeforeMs - A time on this coalescer's clock. A running capture that started at or after this time is
+   * shared with the caller. If it is not specified, the caller shares only a capture that starts after this call.
+   */
+  public captureAsync(
+    scope: TScope,
+    key: string,
+    captureAsync: () => Promise<TValue>,
+    notBeforeMs?: number
+  ): Promise<TValue> {
     const capture: ICapture<TValue> | undefined = this.#captures.get(scope)?.get(key);
     if (!capture) return this.#start(scope, key, captureAsync);
+    if (notBeforeMs !== undefined && capture.startTimeMs >= notBeforeMs) return capture.running;
     capture.next ??= capture.running.then(ignore, ignore).then(() => this.#start(scope, key, captureAsync));
     return capture.next;
   }
@@ -37,8 +72,9 @@ export class FreshCaptureCoalescer<TScope extends object, TValue> {
       captures = new Map();
       this.#captures.set(scope, captures);
     }
+    const startTimeMs: number = this.#now();
     const running: Promise<TValue> = new Promise<TValue>((resolve) => resolve(captureAsync()));
-    const capture: ICapture<TValue> = { running, next: undefined };
+    const capture: ICapture<TValue> = { startTimeMs, running, next: undefined };
     captures.set(key, capture);
     const forget: () => void = () => {
       if (captures.get(key) === capture) captures.delete(key);
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 9b51147ecb..d6d3e60a3d 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -120,6 +120,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #startupFingerprint: IWorkspaceInputFingerprint;
   readonly #runtimeCache: WorkspaceRuntimeFingerprintCache;
   // Concurrent requests share captures; each capture still starts after the requests it serves arrived.
+  // The coalescers' default clock, performance.now(), is also the clock of receivedTimeMs.
   readonly #fingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, IWorkspaceInputFingerprint> =
     new FreshCaptureCoalescer();
   readonly #projectFingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, string> =
@@ -216,7 +217,13 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     try {
       for (let attempt: number = 0; ; attempt++) {
         try {
-          const prepared: IPreparedGeneration = await this.#prepareAsync(envelope, client, admission, ticket);
+          const prepared: IPreparedGeneration = await this.#prepareAsync(
+            envelope,
+            client,
+            admission,
+            ticket,
+            receivedTimeMs
+          );
           generation = prepared;
           const requestEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
@@ -307,6 +314,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     client: IDaemonRequestDispatchClient,
     admission: RequestAdmissionController,
     ticket: IWorkspaceRestartTicket | undefined,
+    receivedTimeMs: number,
     admittedLease?: IRequestLease
   ): Promise<IPreparedGeneration> {
     let lease: IRequestLease =
@@ -401,7 +409,9 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           fingerprint: this.#fingerprint
         };
       }
-      let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
+      // The client changes the workspace before it sends a request, so any capture that started after the request
+      // was received sees those changes. Captures that must detect changes made during a transition stay strict.
+      let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope, receivedTimeMs);
       let tier: WorkspaceInputChangeTier = this.#classify(fingerprint, isMutation(envelope));
       let commandIdentity: string | undefined;
       let projectFingerprint: string | undefined;
@@ -412,7 +422,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           abortSignal: client.abortSignal
         });
         if (tier === WorkspaceInputChangeTier.Reuse) {
-          projectFingerprint = await this.#captureProjectFingerprintAsync(session);
+          projectFingerprint = await this.#captureProjectFingerprintAsync(session, receivedTimeMs);
           if (
             this.#boundSession !== session ||
             this.#commandIdentity !== commandIdentity ||
@@ -446,7 +456,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           this.#gate,
           this.#transitionProgress
         );
-        return await this.#prepareAsync(envelope, client, admission, ticket, shared);
+        return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs, shared);
       }
       this.#transitioning = ownsTransition = true;
       this.#cancelObservers();
@@ -636,7 +646,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   #captureAsync(
     session: IWorkspaceSession,
-    envelope: IDaemonRequestEnvelope
+    envelope: IDaemonRequestEnvelope,
+    notBeforeMs?: number
   ): Promise<IWorkspaceInputFingerprint> {
     const { rushConfiguration } = session;
     const { environment } = envelope;
@@ -645,20 +656,27 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       environment.RUSH_PREVIEW_VERSION ?? null,
       getWorkspaceFingerprintEnvironmentEntries(environment)
     ]);
-    return this.#fingerprintCaptures.captureAsync(rushConfiguration, key, () =>
-      captureWorkspaceInputFingerprintAsync({
-        rushConfiguration,
-        environment,
-        runtimePaths: this.#runtimePaths,
-        runtimeCache: this.#runtimeCache
-      })
+    return this.#fingerprintCaptures.captureAsync(
+      rushConfiguration,
+      key,
+      () =>
+        captureWorkspaceInputFingerprintAsync({
+          rushConfiguration,
+          environment,
+          runtimePaths: this.#runtimePaths,
+          runtimeCache: this.#runtimeCache
+        }),
+      notBeforeMs
     );
   }
 
-  #captureProjectFingerprintAsync(session: IWorkspaceSession): Promise<string> {
+  #captureProjectFingerprintAsync(session: IWorkspaceSession, notBeforeMs?: number): Promise<string> {
     const { rushConfiguration } = session;
-    return this.#projectFingerprintCaptures.captureAsync(rushConfiguration, '', () =>
-      captureProjectConfigurationFingerprintAsync(rushConfiguration, this.#terminal)
+    return this.#projectFingerprintCaptures.captureAsync(
+      rushConfiguration,
+      '',
+      () => captureProjectConfigurationFingerprintAsync(rushConfiguration, this.#terminal),
+      notBeforeMs
     );
   }
 
diff --git a/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
index 207f2f79e1..fe2dbb66f6 100644
--- a/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
+++ b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
@@ -20,6 +20,12 @@ class ControlledCaptures {
   };
 }
 
+/** A clock that moves only when the test says so. */
+class ManualClock {
+  public nowMs: number = 0;
+  public readonly now = (): number => this.nowMs;
+}
+
 async function flushAsync(): Promise<void> {
   await new Promise((resolve) => setImmediate(resolve));
 }
@@ -132,6 +138,144 @@ describe(FreshCaptureCoalescer.name, () => {
     await expect(coalescer.captureAsync(scope, 'key', async () => 'started')).resolves.toBe('started');
   });
 
+  it('shares a running capture with callers whose notBeforeMs is at or before the time it started', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    clock.nowMs = 20;
+    const receivedWhenItStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      10
+    );
+    const receivedBeforeItStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      5
+    );
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+
+    captures.started[0].resolve('started at 10');
+    await expect(Promise.all([first, receivedWhenItStarted, receivedBeforeItStarted])).resolves.toEqual([
+      'started at 10',
+      'started at 10',
+      'started at 10'
+    ]);
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+  });
+
+  it('makes callers whose notBeforeMs is after the running capture started wait for the next capture', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    clock.nowMs = 11;
+    const receivedLater: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 11);
+    const strict: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('started at 11');
+    await expect(Promise.all([receivedLater, strict])).resolves.toEqual(['started at 11', 'started at 11']);
+  });
+
+  it('records when a next capture starts, not when it was queued', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    clock.nowMs = 12;
+    const queued: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    // The running capture started too early for this caller, so it shares the next capture that is already queued.
+    const queuedWithReceipt: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 12);
+    clock.nowMs = 30;
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+
+    const receivedBeforeNextStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      25
+    );
+    const receivedAfterNextStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      31
+    );
+    captures.started[1].resolve('started at 30');
+    await expect(Promise.all([queued, queuedWithReceipt, receivedBeforeNextStarted])).resolves.toEqual([
+      'started at 30',
+      'started at 30',
+      'started at 30'
+    ]);
+    await flushAsync();
+    expect(captures.started).toHaveLength(3);
+    captures.started[2].resolve('started after 31');
+    await expect(receivedAfterNextStarted).resolves.toBe('started after 31');
+  });
+
+  it('rejects a caller that shared a running capture that failed, as if it had asked before it started', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const failed: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const shared: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].reject(new Error('a configuration file is being rewritten'));
+    await expect(failed).rejects.toThrow('a configuration file is being rewritten');
+    await expect(shared).rejects.toThrow('a configuration file is being rewritten');
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+  });
+
+  it('compares notBeforeMs with performance.now() by default', async () => {
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    const receivedTimeMs: number = performance.now();
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const shared: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, receivedTimeMs);
+    const receivedLater: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      performance.now() + 60_000
+    );
+    await flushAsync();
+    expect(captures.started).toHaveLength(1);
+    captures.started[0].resolve('first');
+    await expect(Promise.all([first, shared])).resolves.toEqual(['first', 'first']);
+    await flushAsync();
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('second');
+    await expect(receivedLater).resolves.toBe('second');
+  });
+
   it('never shares a capture between different scopes or keys', async () => {
     const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
     const firstScope: object = {};
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
new file mode 100644
index 0000000000..93132421a0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
@@ -0,0 +1,294 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync),
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync)
+  };
+});
+
+import * as rushLib from '@microsoft/rush-lib';
+
+import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
+import { DaemonGraphTestFixture, responseSnapshot } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(60_000);
+
+type CaptureRequest = [scope: object, key: string, captureAsync: () => Promise<unknown>, notBeforeMs?: number];
+type BuildExchange = ReturnType<DaemonGraphTestFixture['buildAsync']>;
+
+interface IGate {
+  readonly promise: Promise<void>;
+  readonly release: () => void;
+}
+
+const WAIT_TIMEOUT_MS: number = 20_000;
+const actualRushLib: typeof rushLib = jest.requireActual('@microsoft/rush-lib');
+const workspaceCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
+  jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
+const projectCaptureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
+  jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+const originalCaptureAsync: FreshCaptureCoalescer<object, unknown>['captureAsync'] =
+  FreshCaptureCoalescer.prototype.captureAsync;
+
+function createGate(): IGate {
+  let release: () => void = () => {};
+  const promise: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+  return { promise, release: () => release() };
+}
+
+async function waitForAsync(description: string, condition: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + WAIT_TIMEOUT_MS;
+  while (!condition()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting until ${description}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+// The project configuration coalescer uses one key per workspace configuration.
+function isProjectRequest(request: unknown[]): boolean {
+  return request[1] === '';
+}
+
+function describeRequest(request: unknown[]): [string, string] {
+  return [isProjectRequest(request) ? 'project' : 'workspace', typeof request[3]];
+}
+
+function countRequests(requests: jest.SpyInstance, kind: 'workspace' | 'project'): number {
+  return requests.mock.calls.filter((request: unknown[]) => describeRequest(request)[0] === kind).length;
+}
+
+/**
+ * Makes the first `count` workspace input requests wait until all of them have arrived, and then makes them in
+ * one loop, as requests that were received together would if none of them was delayed on the way.
+ */
+function holdWorkspaceRequests(requests: jest.SpyInstance, count: number): void {
+  const waiting: (() => void)[] = [];
+  requests.mockImplementation(function (
+    this: FreshCaptureCoalescer<object, unknown>,
+    ...request: CaptureRequest
+  ): Promise<unknown> {
+    if (waiting.length === count || isProjectRequest(request)) return originalCaptureAsync.apply(this, request);
+    return new Promise((resolve) => {
+      waiting.push(() => resolve(originalCaptureAsync.apply(this, request)));
+      if (waiting.length === count) for (const start of waiting) start();
+    });
+  });
+}
+
+function gateNextCapture<TArgs extends unknown[], TResult>(
+  mock: jest.MockedFunction<(...args: TArgs) => Promise<TResult>>,
+  actual: (...args: TArgs) => Promise<TResult>
+): IGate {
+  const gate: IGate = createGate();
+  mock.mockImplementationOnce(async (...args: TArgs) => {
+    await gate.promise;
+    return await actual(...args);
+  });
+  return gate;
+}
+
+async function expectSuccessfulBuildsAsync(builds: BuildExchange[]): Promise<void> {
+  for (const exchange of await Promise.all(builds)) {
+    expect(exchange.terminal).toMatchObject({ payload: { exitCode: 0 } });
+  }
+}
+
+async function createWarmFixtureAsync(): Promise<DaemonGraphTestFixture> {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) =>
+    setDaemonPolicy(created, {})
+  );
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    return fixture;
+  } catch (error) {
+    await fixture[Symbol.asyncDispose]();
+    throw error;
+  }
+}
+
+describe('workspace input captures shared from the time a request was received', () => {
+  const gates: IGate[] = [];
+  let requests: jest.SpyInstance | undefined;
+  let fixture: DaemonGraphTestFixture | undefined;
+
+  function spyOnRequests(): jest.SpyInstance {
+    requests = jest.spyOn(FreshCaptureCoalescer.prototype, 'captureAsync');
+    return requests;
+  }
+
+  function gate(next: IGate): IGate {
+    gates.push(next);
+    return next;
+  }
+
+  afterEach(async () => {
+    for (const next of gates.splice(0)) next.release();
+    requests?.mockRestore();
+    requests = undefined;
+    const disposing: DaemonGraphTestFixture | undefined = fixture;
+    fixture = undefined;
+    try {
+      await disposing?.[Symbol.asyncDispose]();
+    } finally {
+      workspaceCaptureMock.mockReset();
+      workspaceCaptureMock.mockImplementation(actualRushLib.captureWorkspaceInputFingerprintAsync);
+      projectCaptureMock.mockReset();
+      projectCaptureMock.mockImplementation(actualRushLib.captureProjectConfigurationFingerprintAsync);
+    }
+  });
+
+  it('shares the first captures of warm builds that were all received before those captures started', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const generation: number = warm.host.workspaceGeneration;
+    const spy: jest.SpyInstance = spyOnRequests();
+    holdWorkspaceRequests(spy, 3);
+    workspaceCaptureMock.mockClear();
+    projectCaptureMock.mockClear();
+    const projectGate: IGate = gate(
+      gateNextCapture(projectCaptureMock, actualRushLib.captureProjectConfigurationFingerprintAsync)
+    );
+
+    const builds: BuildExchange[] = [warm.buildAsync(), warm.buildAsync(), warm.buildAsync()];
+    await waitForAsync(
+      'every build asked for a project configuration capture',
+      () => countRequests(spy, 'project') === 3
+    );
+    // A strict coalescer would start a second capture for the builds that reached it after the first one started.
+    expect(workspaceCaptureMock).toHaveBeenCalledTimes(1);
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+    projectGate.release();
+
+    await expectSuccessfulBuildsAsync(builds);
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+    expect(warm.host.workspaceGeneration).toBe(generation);
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+  });
+
+  it('never shares a capture that started before a build was received', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const spy: jest.SpyInstance = spyOnRequests();
+    workspaceCaptureMock.mockClear();
+    projectCaptureMock.mockClear();
+    const workspaceGate: IGate = gate(
+      gateNextCapture(workspaceCaptureMock, actualRushLib.captureWorkspaceInputFingerprintAsync)
+    );
+    const projectGate: IGate = gate(
+      gateNextCapture(projectCaptureMock, actualRushLib.captureProjectConfigurationFingerprintAsync)
+    );
+
+    const first: BuildExchange = warm.buildAsync();
+    await waitForAsync('the first build is capturing', () => workspaceCaptureMock.mock.calls.length === 1);
+    const late: BuildExchange = warm.buildAsync();
+    await waitForAsync('the late build asked for a capture', () => countRequests(spy, 'workspace') === 2);
+    workspaceGate.release();
+    await waitForAsync(
+      'both builds asked for a project configuration capture',
+      () => countRequests(spy, 'project') === 2
+    );
+    // The late build was received after the first workspace capture started, so it waited for its own.
+    expect(workspaceCaptureMock).toHaveBeenCalledTimes(2);
+    projectGate.release();
+
+    await expectSuccessfulBuildsAsync([first, late]);
+    // It was received before the first project configuration capture started, so it shared that one.
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps the receipt time for builds that wait behind a transition', async () => {
+    fixture = await DaemonGraphTestFixture.createAsync((created) => setDaemonPolicy(created, {}));
+    const cold: DaemonGraphTestFixture = fixture;
+    const spy: jest.SpyInstance = spyOnRequests();
+    workspaceCaptureMock.mockClear();
+    const workspaceGate: IGate = gate(
+      gateNextCapture(workspaceCaptureMock, actualRushLib.captureWorkspaceInputFingerprintAsync)
+    );
+
+    const first: BuildExchange = cold.buildAsync();
+    await waitForAsync('the first build is capturing', () => workspaceCaptureMock.mock.calls.length === 1);
+    const waiters: BuildExchange[] = [cold.buildAsync(), cold.buildAsync()];
+    await waitForAsync('every build asked for a capture', () => countRequests(spy, 'workspace') === 3);
+    workspaceGate.release();
+    await expectSuccessfulBuildsAsync([first, ...waiters]);
+    expect(cold.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+
+    const byReceipt: Map<number, string[]> = new Map();
+    for (const request of spy.mock.calls as unknown[][]) {
+      const notBeforeMs: unknown = request[3];
+      if (typeof notBeforeMs !== 'number') continue;
+      byReceipt.set(notBeforeMs, [...(byReceipt.get(notBeforeMs) ?? []), describeRequest(request)[0]]);
+    }
+    // One build loads the graph. The others were admitted before it began, wait behind its transition, and then
+    // prepare again with the time at which they were received.
+    expect([...byReceipt.values()].sort((a: string[], b: string[]) => a.length - b.length)).toEqual([
+      ['workspace', 'project'],
+      ['workspace', 'project', 'workspace', 'project'],
+      ['workspace', 'project', 'workspace', 'project']
+    ]);
+  });
+
+  it('passes the receipt time only to the captures that decide whether a request can reuse the workspace', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const spy: jest.SpyInstance = spyOnRequests();
+
+    await warm.buildSuccessfullyAsync();
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    // The last capture validates the graph inputs before execution and must start after it was requested.
+    expect(spy.mock.calls.map(describeRequest)).toEqual([
+      ['workspace', 'number'],
+      ['project', 'number'],
+      ['workspace', 'undefined']
+    ]);
+
+    spy.mockClear();
+    setDaemonPolicy(warm, { warmSetMaxProjects: 19 });
+    await warm.buildSuccessfullyAsync();
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+    // A transition detects changes made while it runs, so every capture after the first one is strict.
+    const reload: [string, string][] = spy.mock.calls.map(describeRequest);
+    expect(reload[0]).toEqual(['workspace', 'number']);
+    expect(reload.slice(1).map(([, notBeforeMs]) => notBeforeMs)).toEqual(
+      reload.slice(1).map(() => 'undefined')
+    );
+    expect(reload).toContainEqual(['project', 'undefined']);
+
+    spy.mockClear();
+    responseSnapshot(await warm.graphAsync('invalidate', '--project', 'a'));
+    // Graph control checks the inputs of the generation it changes, so its captures are strict as well.
+    expect(spy.mock.calls.map(describeRequest)).toEqual([
+      ['workspace', 'undefined'],
+      ['project', 'undefined']
+    ]);
+  });
+
+  it('checks the project configurations again with a strict capture when a transition can reuse the workspace', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const generation: number = warm.host.workspaceGeneration;
+    const spy: jest.SpyInstance = spyOnRequests();
+    projectCaptureMock.mockClear();
+    // The project configurations changed before the build was received and changed back before its transition.
+    projectCaptureMock.mockImplementationOnce(async () => 'a project configuration that was changed back');
+
+    await warm.buildSuccessfullyAsync();
+    expect(warm.host.workspaceGeneration).toBe(generation);
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(projectCaptureMock).toHaveBeenCalledTimes(2);
+    expect(spy.mock.calls.map(describeRequest)).toEqual([
+      ['workspace', 'number'],
+      ['project', 'number'],
+      ['workspace', 'undefined'],
+      ['project', 'undefined'],
+      ['workspace', 'undefined']
+    ]);
+  });
+});

From 14fbc543a80b547b1ab0c1776179c8ce15ed99cc Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 18:33:59 +0000
Subject: [PATCH 030/265] [rush-lib] Hand requests to in-process Rush when a
 project's configuration cannot load

Swarm integration step 15; original commit 69f30e84ab (merge of swarm/r01-t70 at c1b5c95adb).
Scope: task 70.

ch01 GATE OK board 1522 (tree 3a564b4533; WorkspaceRequestLifecycle.ts resolved with r07's board 1231 recipe: the Reuse capture stays tolerant and keeps task 94's receipt); o01 board 1291; r01 board 1250.

Commits folded into this step (5):
- 08aed7efd2 [package-deps-hash] Handle a git hash-object failure while ls-files and status still run
- 3d786c1f78 [package-deps-hash] Name the git command that failed in the error message
- a11aa6b774 [rush-lib] Name the project whose configuration an engine cannot load
- 24cf595d6a [rush-lib] Report a missing project dependency file to an engine's host
- c1b5c95adb [rush-daemon] Hand requests to in-process Rush when a project's configuration cannot load

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...sing-shrinkwrap-deps_2026-09-28-16-20.json |  11 ++
 ...-configuration-error_2026-09-28-16-20.json |  11 ++
 ...nfiguration-fallback_2026-09-28-16-20.json |  11 ++
 common/reviews/api/rush-lib.api.md            |  10 +-
 .../src/ProductionDaemonRequestResolver.ts    |  31 +++++
 .../src/WorkspaceRequestLifecycle.ts          |  27 ++++-
 .../ProductionDaemonRequestResolver.test.ts   | 112 +++++++++++++++++-
 ...dCommandEngineProjectConfigurationError.ts |  27 +++++
 .../src/api/RushProjectConfiguration.ts       |  33 ++++--
 .../src/api/WorkspaceInputFingerprint.ts      |   6 +-
 .../api/test/RushProjectConfiguration.test.ts |  36 +++++-
 .../cli/scriptActions/PhasedScriptAction.ts   |  30 ++++-
 libraries/rush-lib/src/index.ts               |   1 +
 .../src/logic/ProjectChangeAnalyzer.ts        |  79 +++++++++++-
 .../logic/test/ProjectChangeAnalyzer.test.ts  | 106 ++++++++++++++++-
 15 files changed, 498 insertions(+), 33 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r01-engine-missing-shrinkwrap-deps_2026-09-28-16-20.json
 create mode 100644 common/changes/@microsoft/rush/swarm-r01-engine-project-configuration-error_2026-09-28-16-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r01-project-configuration-fallback_2026-09-28-16-20.json
 create mode 100644 libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts

diff --git a/common/changes/@microsoft/rush/swarm-r01-engine-missing-shrinkwrap-deps_2026-09-28-16-20.json b/common/changes/@microsoft/rush/swarm-r01-engine-missing-shrinkwrap-deps_2026-09-28-16-20.json
new file mode 100644
index 0000000000..c0323e2384
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r01-engine-missing-shrinkwrap-deps_2026-09-28-16-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "An engine that cannot take an inputs snapshot because a project's shrinkwrap-deps.json is missing, including one deleted after the engine started, now reports Rush's \"A project dependency file (...) is missing\" error instead of continuing without a snapshot. That error also takes precedence over a project configuration error, because \"rush install\" fixes both. Rush's warning for a file deleted during watch mode names the file instead of the failed Git command.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/swarm-r01-engine-project-configuration-error_2026-09-28-16-20.json b/common/changes/@microsoft/rush/swarm-r01-engine-project-configuration-error_2026-09-28-16-20.json
new file mode 100644
index 0000000000..b9c6b1b1c6
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r01-engine-project-configuration-error_2026-09-28-16-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "An engine reports a project whose rush-project.json or rig cannot be loaded with the new PhasedCommandEngineProjectConfigurationError, which names the project. A host such as the Rush daemon, which loads every project, can then hand the request to in-process Rush, which loads only the projects that it selects.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r01-project-configuration-fallback_2026-09-28-16-20.json b/common/changes/@rushstack/rush-daemon/swarm-r01-project-configuration-fallback_2026-09-28-16-20.json
new file mode 100644
index 0000000000..ad5c2594d6
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r01-project-configuration-fallback_2026-09-28-16-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When the daemon cannot load a project's configuration, for example after a filtered install left the rig package of an unselected project uninstalled, it hands each request to in-process Rush with a one-line reason instead of rejecting every build, and writes the full error to the daemon log. A missing shrinkwrap-deps.json is still rejected, because in-process Rush cannot build without it either, with Rush's \"rush install\" instruction as the last line.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 94c081b8f9..35b81910c8 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1548,6 +1548,12 @@ export class PhasedCommandEngineConfigurationChangedError extends Error {
     constructor();
 }
 
+// @alpha
+export class PhasedCommandEngineProjectConfigurationError extends Error {
+    constructor(projectName: string, cause: unknown);
+    readonly projectName: string;
+}
+
 // @alpha
 export class PhasedCommandHooks {
     readonly createOperationsAsync: AsyncSeriesWaterfallHook<[
@@ -1625,7 +1631,9 @@ export class ProjectChangeAnalyzer {
     // (undocumented)
     protected getChangesByProject(lookup: LookupByPath<RushConfigurationProject>, changedFiles: Map<string, IFileDiffStatus>): Map<RushConfigurationProject, Map<string, IFileDiffStatus>>;
     // @internal
-    _tryGetSnapshotProviderAsync(projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>, terminal: ITerminal, projectSelection?: ReadonlySet<RushConfigurationProject>): Promise<GetInputsSnapshotAsyncFn | undefined>;
+    _tryGetSnapshotProviderAsync(projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>, terminal: ITerminal, projectSelection?: ReadonlySet<RushConfigurationProject>, options?: {
+        readonly throwOnMissingProjectShrinkwrapFile?: boolean;
+    }): Promise<GetInputsSnapshotAsyncFn | undefined>;
 }
 
 export { ReporterExtensionEventName }
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 141749594b..2edb24d3b7 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -3,6 +3,7 @@
 
 import * as path from 'node:path';
 
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import type { LockFile } from '@rushstack/node-core-library';
 import {
   EnvironmentVariableNames,
@@ -10,6 +11,7 @@ import {
   PhasedCommandEngine,
   PhasedCommandEngineBusyError,
   PhasedCommandEngineConfigurationChangedError,
+  PhasedCommandEngineProjectConfigurationError,
   type IPhasedCommandEngine,
   type IInputsSnapshot,
   type IOperationGraph,
@@ -208,6 +210,9 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         engine = await command.createEngineAsync(this.#preparationLock);
       } catch (error) {
         if (error instanceof PhasedCommandEngineBusyError) throw error;
+        if (error instanceof PhasedCommandEngineProjectConfigurationError) {
+          throw createProjectConfigurationFallback(error);
+        }
         throw new Error(terminal.describeError(error), { cause: error });
       }
       try {
@@ -269,6 +274,32 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   }
 }
 
+/**
+ * An engine loads the configuration of every project, whereas native Rush loads only the projects that a request
+ * selects. In-process Rush can therefore serve a request that the daemon cannot, for example after a filtered
+ * install, and it reports the error itself if the request selects the project.
+ */
+function createProjectConfigurationFallback(
+  error: PhasedCommandEngineProjectConfigurationError
+): DaemonRequestDispatchError {
+  // The launcher log keeps the whole error for daemon diagnostics; the client prints one line.
+  process.stderr.write(`Warning: ${error.message}\n`);
+  const cause: unknown = error.cause;
+  const detail: string =
+    cause instanceof Error && !(cause instanceof AlreadyReportedError)
+      ? `: ${cause.message.split('\n', 1)[0]}`
+      : '';
+  const hint: string =
+    (cause as { code?: unknown } | undefined)?.code === 'MODULE_NOT_FOUND'
+      ? ' (the daemon loads every project, so it needs a full "rush install")'
+      : '';
+  return new DaemonRequestDispatchError(
+    'unsupported',
+    `The daemon could not load the configuration of project "${error.projectName}"${detail}${hint}`,
+    { cause: error }
+  );
+}
+
 function environmentIdentity(environment: Readonly<Record<string, string | undefined>>): string {
   return JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment));
 }
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index d6d3e60a3d..96349a42b2 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -10,6 +10,7 @@ import {
   EnvironmentVariableNames,
   getWorkspaceFingerprintEnvironmentEntries,
   PhasedCommandEngineBusyError,
+  PhasedCommandEngineProjectConfigurationError,
   Rush,
   WorkspaceInputChangeTier,
   WorkspaceRuntimeFingerprintCache,
@@ -422,10 +423,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           abortSignal: client.abortSignal
         });
         if (tier === WorkspaceInputChangeTier.Reuse) {
-          projectFingerprint = await this.#captureProjectFingerprintAsync(session, receivedTimeMs);
+          projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session, receivedTimeMs);
           if (
             this.#boundSession !== session ||
             this.#commandIdentity !== commandIdentity ||
+            projectFingerprint === undefined ||
             this.#projectFingerprint !== projectFingerprint ||
             this.#forceReload ||
             !session.invalidations.getSnapshot().isWatcherHealthy ||
@@ -516,8 +518,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         session.invalidations.getSnapshot().isWatcherHealthy &&
         !session.invalidations.hasUnattributedUnknownChanges
       ) {
-        projectFingerprint = await this.#captureProjectFingerprintAsync(session);
-        if (projectFingerprint === this.#projectFingerprint) {
+        projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
+        if (projectFingerprint !== undefined && projectFingerprint === this.#projectFingerprint) {
           this.#lastReloadTier = WorkspaceInputChangeTier.Reuse;
           this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
           return {
@@ -598,7 +600,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         expectedFingerprint = after;
         this.#boundSession = session;
         this.#fingerprint = after;
-        this.#projectFingerprint = await this.#captureProjectFingerprintAsync(session);
+        this.#projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
         this.#commandIdentity = await getResolverLifecycle(resolver).getCommandParameterIdentityAsync({
           envelope,
           workspaceSession: session,
@@ -680,6 +682,23 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     );
   }
 
+  /**
+   * Returns undefined, which must not match any fingerprint, if a project's configuration cannot be loaded.
+   * Binding a new generation then reports the error, or hands the request to in-process Rush, which loads only
+   * the projects that a request selects.
+   */
+  async #tryCaptureProjectFingerprintAsync(
+    session: IWorkspaceSession,
+    notBeforeMs?: number
+  ): Promise<string | undefined> {
+    try {
+      return await this.#captureProjectFingerprintAsync(session, notBeforeMs);
+    } catch (error) {
+      if (error instanceof PhasedCommandEngineProjectConfigurationError) return undefined;
+      throw error;
+    }
+  }
+
   #classify(fingerprint: IWorkspaceInputFingerprint, mutation: boolean): WorkspaceInputChangeTier {
     if (
       fingerprint.selectedRushVersion !== Rush.version ||
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 408f74dbd5..c9c31ac580 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -79,6 +79,8 @@ interface IFixtureOptions {
   readonly resolver?: IDaemonRequestResolver;
   /** Adds the watch-only `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
   readonly incrementalScript?: boolean;
+  /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
+  readonly pnpm?: boolean;
 }
 
 class DecoratedTestResolver implements IDaemonRequestResolver {
@@ -137,7 +139,7 @@ async function createFixtureAsync(
     'rush.json',
     JSON.stringify({
       rushVersion: RUSH_VERSION,
-      npmVersion: '10.0.0',
+      ...(options.pnpm ? { pnpmVersion: '9.15.9' } : { npmVersion: '10.0.0' }),
       // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
       daemon: { warmMemoryBudgetMB: 100_000 },
       projectFolderMinDepth: 2,
@@ -150,7 +152,11 @@ async function createFixtureAsync(
   );
   write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\n**/lib/\n**/node_modules/\nruns.txt\n');
   write('common/temp/last-link.flag', '{}');
-  write('common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
+  if (options.pnpm) {
+    write('common/config/rush/pnpm-lock.yaml', "lockfileVersion: '9.0'\n");
+  } else {
+    write('common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
+  }
   write(
     'common/config/rush/command-line.json',
     JSON.stringify({
@@ -207,6 +213,7 @@ async function createFixtureAsync(
       })
     );
     write(`projects/${name}/input.txt`, 'one');
+    if (options.pnpm) write(`projects/${name}/.rush/temp/shrinkwrap-deps.json`, '{}');
     write(
       `projects/${name}/build.cjs`,
       `
@@ -1585,16 +1592,115 @@ process.exit(23);
 
   it('rejects invalid inherited project configuration before creating a graph or running scripts', async () => {
     const fixture: IFixture = await createFixtureAsync();
+    const stderrWrite: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
     try {
       fs.writeFileSync(
         path.join(fixture.repoRoot, 'projects/a/config/rush-project.json'),
         '{"extends":"./unowned.json"}'
       );
       expect((await runAsync(fixture, 'unsupported', ['build'])).terminal).toMatchObject({
-        kind: 'requestRejected'
+        kind: 'requestRejected',
+        // In-process Rush reports the error natively if the request selects the project.
+        payload: {
+          code: 'unsupported',
+          message: expect.stringMatching(/^The daemon could not load the configuration of project "a": /)
+        }
       });
+      expect(stderrWrite).toHaveBeenCalledWith(
+        expect.stringMatching(/^Warning: Rush could not load the configuration of project "a": /)
+      );
       expect(fixture.session.operationGraph).toBeUndefined();
       expect(runs(fixture)).toEqual([]);
+    } finally {
+      stderrWrite.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('hands requests to in-process Rush while a project that a filtered install skipped has no rig package', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'rig');
+    const rigFolder: string = path.join(fixture.repoRoot, 'projects/a/node_modules/fixture-rig');
+    const installedRigFolder: string = `${rigFolder}-installed`;
+    const stderr: string[] = [];
+    const stderrWrite: jest.SpyInstance = jest
+      .spyOn(process.stderr, 'write')
+      .mockImplementation((chunk: string | Uint8Array) => stderr.push(chunk.toString()) > 0);
+    const expectFallbackAsync = async (requestId: string): Promise<void> => {
+      stderr.length = 0;
+      const rejected: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'c']);
+      expect(rejected.terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: {
+          code: 'unsupported',
+          message:
+            `The daemon could not load the configuration of project "a": Cannot find module ` +
+            `'fixture-rig/package.json' from '${path.join(fixture.repoRoot, 'projects/a')}' ` +
+            '(the daemon loads every project, so it needs a full "rush install")'
+        }
+      });
+      expect(stderr.join('')).toContain(
+        `Warning: Rush could not load the configuration of project "a": Cannot find module 'fixture-rig/package.json'`
+      );
+    };
+    try {
+      fs.renameSync(rigFolder, installedRigFolder);
+      await expectFallbackAsync('unbound');
+      expect(fixture.session.operationGraph).toBeUndefined();
+
+      fs.renameSync(installedRigFolder, rigFolder);
+      const installed: ITerminalExchange = await runAsync(fixture, 'installed', ['build', '--only', 'c']);
+      expect(installed.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+
+      // Removing an installed package changes no watched file, but the next request must not reuse the graph.
+      fs.renameSync(rigFolder, installedRigFolder);
+      await expectFallbackAsync('uninstalled');
+      fs.renameSync(installedRigFolder, rigFolder);
+      const reinstalled: ITerminalExchange = await runAsync(fixture, 'reinstalled', ['build', '--only', 'c']);
+      expect(reinstalled.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(runs(fixture)).toEqual(['c:one:']);
+    } finally {
+      stderrWrite.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('rejects a missing project dependency file with the native instruction as the last line', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { pnpm: true });
+    const dependencyFile: string = path.join(fixture.repoRoot, 'projects/c/.rush/temp/shrinkwrap-deps.json');
+    const instruction: string =
+      `A project dependency file (${dependencyFile}) is missing. ` +
+      'You may need to run "rush install" or "rush update".';
+    const expectRejectedAsync = async (requestId: string): Promise<void> => {
+      const { terminal } = await runAsync(fixture, requestId, ['build', '--only', 'a']);
+      expect(terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'routingFailed' } });
+      const { message } = (terminal as { payload: { message: string } }).payload;
+      expect(message.split('\n').pop()).toBe(instruction);
+    };
+    try {
+      fs.rmSync(dependencyFile);
+      await expectRejectedAsync('cold');
+      expect(fixture.session.operationGraph).toBeUndefined();
+
+      fs.writeFileSync(dependencyFile, '{}');
+      const initial: ITerminalExchange = await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+      expect(initial.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      fs.rmSync(dependencyFile);
+      await expectRejectedAsync('warm');
+
+      fs.writeFileSync(dependencyFile, '{}');
+      const restored: ITerminalExchange = await runAsync(fixture, 'restored', ['build', '--only', 'a']);
+      expect(restored.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+
+      // A project added before "rush install" has no dependency file, so in-process Rush cannot hash the repo
+      // state either. Its missing rig package must not hide that instruction.
+      fs.rmSync(dependencyFile);
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/c/config/rush-project.json'));
+      fs.writeFileSync(
+        path.join(fixture.repoRoot, 'projects/c/config/rig.json'),
+        '{"rigPackageName":"uninstalled-rig"}'
+      );
+      await expectRejectedAsync('added');
+      expect(runs(fixture)).toEqual(['a:one:']);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts
new file mode 100644
index 0000000000..063271df68
--- /dev/null
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineProjectConfigurationError.ts
@@ -0,0 +1,27 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { AlreadyReportedError } from '@rushstack/node-core-library';
+
+/**
+ * The engine could not load the native configuration of a project.
+ *
+ * @remarks
+ * An engine loads every project in the workspace, whereas a native command loads only the projects that it
+ * selects. A native command may therefore succeed where the engine cannot, for example after a filtered
+ * install that left the rig package of an unselected project uninstalled. No operation has begun.
+ * @alpha
+ */
+export class PhasedCommandEngineProjectConfigurationError extends Error {
+  /** The package name of the project whose configuration could not be loaded. */
+  public readonly projectName: string;
+
+  public constructor(projectName: string, cause: unknown) {
+    // An AlreadyReportedError has written its details to the terminal; its own message adds nothing.
+    const detail: string =
+      cause instanceof Error && !(cause instanceof AlreadyReportedError) ? `: ${cause.message}` : '.';
+    super(`Rush could not load the configuration of project "${projectName}"${detail}`, { cause });
+    this.name = 'PhasedCommandEngineProjectConfigurationError';
+    this.projectName = projectName;
+  }
+}
diff --git a/libraries/rush-lib/src/api/RushProjectConfiguration.ts b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
index f9c0668547..9ce3da893d 100644
--- a/libraries/rush-lib/src/api/RushProjectConfiguration.ts
+++ b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
@@ -21,6 +21,7 @@ import schemaJson from '../schemas/rush-project.schema.json';
 import anythingSchemaJson from '../schemas/anything.schema.json';
 import { HotlinkManager } from '../utilities/HotlinkManager';
 import type { RushConfiguration } from './RushConfiguration';
+import { PhasedCommandEngineProjectConfigurationError } from './PhasedCommandEngineProjectConfigurationError';
 
 /**
  * Describes the file structure for the `<project root>/config/rush-project.json` config file.
@@ -572,6 +573,10 @@ export class RushProjectConfiguration {
   /**
    * Loads a fresh native configuration snapshot without reading or modifying process-wide
    * project, inherited-file, or rig caches. The loaders are owned only by this invocation.
+   *
+   * @remarks
+   * Throws a {@link PhasedCommandEngineProjectConfigurationError} that names a project whose
+   * configuration could not be loaded.
    * @internal
    */
   public static async _tryLoadForProjectsUncachedAsync(
@@ -589,20 +594,24 @@ export class RushProjectConfiguration {
     await Async.forEachAsync(
       projects,
       async (project) => {
-        const rushProjectJson: IRushProjectJson | undefined = await _tryLoadJsonForProjectAsync(
-          project,
-          terminal,
-          loaders
-        );
-        if (rushProjectJson) {
-          result.set(
+        try {
+          const rushProjectJson: IRushProjectJson | undefined = await _tryLoadJsonForProjectAsync(
             project,
-            new RushProjectConfiguration(
-              project,
-              rushProjectJson,
-              _getRushProjectConfiguration(project, rushProjectJson, terminal)
-            )
+            terminal,
+            loaders
           );
+          if (rushProjectJson) {
+            result.set(
+              project,
+              new RushProjectConfiguration(
+                project,
+                rushProjectJson,
+                _getRushProjectConfiguration(project, rushProjectJson, terminal)
+              )
+            );
+          }
+        } catch (error) {
+          throw new PhasedCommandEngineProjectConfigurationError(project.packageName, error);
         }
       },
       { concurrency: 50 }
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 5fa2acbe4c..b8914cfab9 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -421,7 +421,11 @@ export async function captureWorkspaceInputFingerprintAsync(
   };
 }
 
-/** Fingerprints native merged project/rig/inherited configuration using invocation-owned loader caches. @alpha */
+/**
+ * Fingerprints native merged project/rig/inherited configuration using invocation-owned loader caches.
+ * Throws a {@link PhasedCommandEngineProjectConfigurationError} if a project's configuration cannot be loaded.
+ * @alpha
+ */
 export async function captureProjectConfigurationFingerprintAsync(
   rushConfiguration: RushConfiguration,
   terminal: ITerminal
diff --git a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
index 61e4dbee64..8db1a1fb44 100644
--- a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
@@ -5,13 +5,14 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
-import { FileSystem, Path } from '@rushstack/node-core-library';
+import { AlreadyReportedError, FileSystem, Path } from '@rushstack/node-core-library';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import type { CommandLineParameter } from '@rushstack/ts-command-line';
 
 import type { IPhase } from '../CommandLineConfiguration';
 import type { RushConfigurationProject } from '../RushConfigurationProject';
 import { RushProjectConfiguration } from '../RushProjectConfiguration';
+import { PhasedCommandEngineProjectConfigurationError } from '../PhasedCommandEngineProjectConfigurationError';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function stripSymbolsFromObject(obj: any | undefined): void {
@@ -167,6 +168,39 @@ describe(RushProjectConfiguration.name, () => {
       expect(getOutputFolderNames(configurations.get(ownFile))).toEqual(['from-project']);
     });
 
+    it('names the project whose rig package is not installed, with the native error as the cause', async () => {
+      write('uninstalled/package.json', { name: 'uninstalled', version: '1.0.0' });
+      write('uninstalled/config/rig.json', { rigPackageName: 'uninstalled-rig' });
+      const uninstalled: RushConfigurationProject = project('uninstalled');
+      const nativeError: Error = await RushProjectConfiguration.tryLoadForProjectAsync(
+        uninstalled,
+        new Terminal(new StringBufferTerminalProvider())
+      ).then(
+        () => {
+          throw new Error('The native load succeeded.');
+        },
+        (error: Error) => error
+      );
+      expect(nativeError).toMatchObject({ code: 'MODULE_NOT_FOUND' });
+
+      const error: unknown = await loadAsync(project('rigged'), uninstalled).catch((e: unknown) => e);
+      expect(error).toBeInstanceOf(PhasedCommandEngineProjectConfigurationError);
+      expect(error).toMatchObject({
+        projectName: 'uninstalled',
+        message: `Rush could not load the configuration of project "uninstalled": ${nativeError.message}`,
+        cause: { code: 'MODULE_NOT_FOUND', message: nativeError.message }
+      });
+    });
+
+    it('does not repeat the message of an error that has already been reported', () => {
+      expect(
+        new PhasedCommandEngineProjectConfigurationError('reported', new AlreadyReportedError())
+      ).toMatchObject({
+        projectName: 'reported',
+        message: 'Rush could not load the configuration of project "reported".'
+      });
+    });
+
     it('loads a rig profile shared through per-project node_modules symlinks once, with native results', async () => {
       write('store/example-rig/package.json', { name: 'example-rig', version: '1.0.0' });
       write('store/example-rig/profiles/default/config/rush-project.json', {
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index fe92a4c5ac..0e6b9ba4a1 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -55,7 +55,10 @@ import { associateParametersByPhase } from '../parsing/associateParametersByPhas
 import { PhasedOperationPlugin } from '../../logic/operations/PhasedOperationPlugin';
 import { ShellOperationRunnerPlugin } from '../../logic/operations/ShellOperationRunnerPlugin';
 import { Event } from '../../api/EventHooks';
-import { ProjectChangeAnalyzer } from '../../logic/ProjectChangeAnalyzer';
+import {
+  ProjectChangeAnalyzer,
+  tryGetMissingProjectShrinkwrapFileErrorAsync
+} from '../../logic/ProjectChangeAnalyzer';
 import { OperationStatus } from '../../logic/operations/OperationStatus';
 import type { IExecutionResult } from '../../logic/operations/IOperationExecutionResult';
 import { OperationResultSummarizerPlugin } from '../../logic/operations/OperationResultSummarizerPlugin';
@@ -732,7 +735,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         ? new Map()
         : await measureAsyncFn(`${PERF_PREFIX}:loadProjectConfigurations`, () =>
             onEngine
-              ? RushProjectConfiguration._tryLoadForProjectsUncachedAsync(relevantProjects, terminal)
+              ? this.#loadEngineProjectConfigurationsAsync(relevantProjects, terminal)
               : RushProjectConfiguration.tryLoadForProjectsAsync(relevantProjects, terminal)
           );
       const projectConfigurationIdentity: string | undefined = onEngine
@@ -781,7 +784,9 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
               projectConfigurations,
               terminal,
               // We need to include all dependencies, otherwise build cache id calculation will be incorrect
-              relevantProjects
+              relevantProjects,
+              // An engine cannot continue without a snapshot, so it reports why none could be taken.
+              { throwOnMissingProjectShrinkwrapFile: !!onEngine }
             );
           const innerInitialSnapshot: IInputsSnapshot | undefined = innerGetInputsSnapshotAsync
             ? await innerGetInputsSnapshotAsync()
@@ -820,7 +825,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           ? async () => {
               await this.#validateInstallStateAsync();
               const currentConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
-                await RushProjectConfiguration._tryLoadForProjectsUncachedAsync(relevantProjects, terminal);
+                await this.#loadEngineProjectConfigurationsAsync(relevantProjects, terminal);
               if (
                 (await getProjectConfigurationIdentityAsync(
                   currentConfigurations,
@@ -1025,6 +1030,23 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     }
   }
 
+  /**
+   * Loads the configuration of every specified project for an engine, which loads projects that a native
+   * command might not select.
+   */
+  async #loadEngineProjectConfigurationsAsync(
+    projects: ReadonlySet<RushConfigurationProject>,
+    terminal: ITerminal
+  ): Promise<ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>> {
+    try {
+      return await RushProjectConfiguration._tryLoadForProjectsUncachedAsync(projects, terminal);
+    } catch (error) {
+      // An incomplete install can leave both a project dependency file and a rig package missing. Without the
+      // file, native Rush cannot analyze the repo state either, so report it: "rush install" fixes both.
+      throw (await tryGetMissingProjectShrinkwrapFileErrorAsync(this.rushConfiguration)) ?? error;
+    }
+  }
+
   async #validateInstallStateAsync(): Promise<void> {
     if (!this._runsBeforeInstall) {
       await measureAsyncFn(`${PERF_PREFIX}:checkInstallFlag`, async () => {
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index 33caab8118..b45248e94f 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -182,6 +182,7 @@ export {
   type IParsePhasedCommandOptions
 } from './api/PhasedCommandEngine';
 export { PhasedCommandEngineConfigurationChangedError } from './api/PhasedCommandEngineConfigurationChangedError';
+export { PhasedCommandEngineProjectConfigurationError } from './api/PhasedCommandEngineProjectConfigurationError';
 export { PhasedCommandEngineBusyError } from './api/PhasedCommandEngineBusyError';
 export {
   captureWorkspaceInputFingerprintAsync,
diff --git a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
index 14dcadd0ba..ed5353620a 100644
--- a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
+++ b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
@@ -86,6 +86,18 @@ export interface IRawRepoState {
   rawHashes: Map<string, string>;
 }
 
+/**
+ * A project dependency file (shrinkwrap-deps.json) that change detection hashes is missing.
+ */
+class MissingProjectShrinkwrapFileError extends Error {
+  public constructor(projectShrinkwrapFilePath: string) {
+    super(
+      `A project dependency file (${projectShrinkwrapFilePath}) is missing. You may need to run ` +
+        '"rush install" or "rush update".'
+    );
+  }
+}
+
 /**
  * @beta
  */
@@ -316,13 +328,21 @@ export class ProjectChangeAnalyzer {
   /**
    * Gets a snapshot of the input state of the Rush workspace that can be queried for incremental
    * build operations and use by the build cache.
+   *
+   * @remarks
+   * If the state cannot be calculated, this writes a warning and continues without a snapshot. With
+   * `throwOnMissingProjectShrinkwrapFile`, a missing project dependency file (shrinkwrap-deps.json) instead
+   * throws its error, whether it is detected when the provider is created or when a snapshot fails. A host that
+   * cannot continue without a snapshot can then report that actionable cause.
    * @internal
    */
   public async _tryGetSnapshotProviderAsync(
     projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>,
     terminal: ITerminal,
-    projectSelection?: ReadonlySet<RushConfigurationProject>
+    projectSelection?: ReadonlySet<RushConfigurationProject>,
+    options?: { readonly throwOnMissingProjectShrinkwrapFile?: boolean }
   ): Promise<GetInputsSnapshotAsyncFn | undefined> {
+    const throwOnMissingProjectShrinkwrapFile: boolean = !!options?.throwOnMissingProjectShrinkwrapFile;
     try {
       const gitPath: string = this.#git.getGitPathOrThrow();
 
@@ -375,6 +395,7 @@ export class ProjectChangeAnalyzer {
 
       // Include project shrinkwrap files as part of the computation
       const additionalRelativePathsToHash: string[] = [];
+      const projectShrinkwrapFilePaths: string[] = [];
       const globalAdditionalFiles: string[] = [];
       if (rushConfiguration.isPnpm) {
         await Async.forEachAsync(rushConfiguration.projects, async (project: RushConfigurationProject) => {
@@ -384,16 +405,16 @@ export class ProjectChangeAnalyzer {
               return;
             }
 
-            throw new Error(
-              `A project dependency file (${projectShrinkwrapFilePath}) is missing. You may need to run ` +
-                '"rush install" or "rush update".'
-            );
+            throw new MissingProjectShrinkwrapFileError(projectShrinkwrapFilePath);
           }
 
           const relativeProjectShrinkwrapFilePath: string = Path.convertToSlashes(
             path.relative(rootDirectory, projectShrinkwrapFilePath)
           );
           additionalRelativePathsToHash.push(relativeProjectShrinkwrapFilePath);
+          if (!rushConfiguration.subspacesFeatureEnabled) {
+            projectShrinkwrapFilePaths.push(projectShrinkwrapFilePath);
+          }
         });
       } else {
         // Add the shrinkwrap file to every project's dependencies
@@ -465,11 +486,18 @@ export class ProjectChangeAnalyzer {
             workingTreeReadStartTimeMs
           });
         } catch (e) {
+          // The files were checked once, when this provider was created. A file removed since then fails
+          // "git hash-object" with an obscure message, so check them again, only after a failure.
+          const error: Error = (await tryGetMissingFileErrorAsync(projectShrinkwrapFilePaths)) ?? e;
+          if (throwOnMissingProjectShrinkwrapFile && error instanceof MissingProjectShrinkwrapFileError) {
+            throw error;
+          }
+
           // If getRepoState fails, don't fail the whole build. Treat this case as if we don't know anything about
           // the state of the files in the repo. This can happen if the environment doesn't have Git.
           terminal.writeWarningLine(
             `Error calculating the state of the repo. (inner error: ${
-              e.stack ?? e.message ?? e
+              error.stack ?? error.message ?? error
             }). Continuing without diffing files.`
           );
 
@@ -477,6 +505,10 @@ export class ProjectChangeAnalyzer {
         }
       };
     } catch (e) {
+      if (throwOnMissingProjectShrinkwrapFile && e instanceof MissingProjectShrinkwrapFileError) {
+        throw e;
+      }
+
       // If getRepoState fails, don't fail the whole build. Treat this case as if we don't know anything about
       // the state of the files in the repo. This can happen if the environment doesn't have Git.
       terminal.writeWarningLine(
@@ -687,6 +719,41 @@ async function isVersionBumpChangeAsync(
   }
 }
 
+/**
+ * Returns an error naming the first of the specified project dependency files that is missing, if any.
+ */
+async function tryGetMissingFileErrorAsync(
+  projectShrinkwrapFilePaths: ReadonlyArray<string>
+): Promise<MissingProjectShrinkwrapFileError | undefined> {
+  const exists: boolean[] = await Async.mapAsync(
+    projectShrinkwrapFilePaths,
+    (filePath: string) => FileSystem.existsAsync(filePath),
+    { concurrency: 50 }
+  );
+  const missingIndex: number = exists.indexOf(false);
+  return missingIndex < 0
+    ? undefined
+    : new MissingProjectShrinkwrapFileError(projectShrinkwrapFilePaths[missingIndex]);
+}
+
+/**
+ * Returns the error that {@link ProjectChangeAnalyzer._tryGetSnapshotProviderAsync} reports for a missing
+ * project dependency file, if any is missing. This happens when a project is added before "rush install".
+ */
+export async function tryGetMissingProjectShrinkwrapFileErrorAsync(
+  rushConfiguration: RushConfiguration
+): Promise<Error | undefined> {
+  if (!rushConfiguration.isPnpm || rushConfiguration.subspacesFeatureEnabled) {
+    return undefined;
+  }
+
+  return await tryGetMissingFileErrorAsync(
+    rushConfiguration.projects.map((project: RushConfigurationProject) =>
+      BaseProjectShrinkwrapFile.getFilePathForProject(project)
+    )
+  );
+}
+
 interface IAdditionalGlob {
   project: RushConfigurationProject;
   operationName: string;
diff --git a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
index 8bb271d8bd..5d85cffa1d 100644
--- a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
+++ b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
@@ -114,6 +114,7 @@ jest.mock('../incremental/InputsSnapshot', () => {
   };
 });
 
+import * as fs from 'node:fs';
 import { resolve } from 'node:path';
 
 import type { IDetailedRepoState, IFileDiffStatus } from '@rushstack/package-deps-hash';
@@ -122,7 +123,8 @@ import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import {
   ProjectChangeAnalyzer,
   isPackageJsonVersionBumpChange,
-  isPackageJsonVersionOnlyChange
+  isPackageJsonVersionOnlyChange,
+  tryGetMissingProjectShrinkwrapFileErrorAsync
 } from '../ProjectChangeAnalyzer';
 import { RushConfiguration } from '../../api/RushConfiguration';
 import type {
@@ -182,6 +184,108 @@ describe(ProjectChangeAnalyzer.name, () => {
       expect(mockInput.workingTreeReadStartTimeMs).toBeGreaterThanOrEqual(beforeSnapshotTimeMs);
       expect(mockInput.workingTreeReadStartTimeMs).toBeLessThanOrEqual(repoStateReadTimeMs!);
     });
+
+    describe('with PNPM project dependency files', () => {
+      let folder: string;
+      let rushConfiguration: RushConfiguration;
+      let terminalProvider: StringBufferTerminalProvider;
+      let terminal: Terminal;
+      const dependencyFile = (name: string): string =>
+        resolve(folder, name, '.rush/temp/shrinkwrap-deps.json');
+      const instruction = (name: string): string =>
+        `A project dependency file (${dependencyFile(name)}) is missing. ` +
+        'You may need to run "rush install" or "rush update".';
+      const gitFailure: () => never = () => {
+        throw new Error('git hash-object failed');
+      };
+      const hostOptions: { throwOnMissingProjectShrinkwrapFile: boolean } = {
+        throwOnMissingProjectShrinkwrapFile: true
+      };
+
+      beforeEach(() => {
+        // Change detection requires a Git working tree, which contains this folder.
+        folder = fs.mkdtempSync(resolve(__dirname, 'shrinkwrap-deps-'));
+        fs.writeFileSync(
+          resolve(folder, 'rush.json'),
+          JSON.stringify({
+            rushVersion: '5.162.0',
+            pnpmVersion: '9.15.9',
+            projects: ['a', 'b'].map((name) => ({ packageName: name, projectFolder: name }))
+          })
+        );
+        for (const name of ['a', 'b']) {
+          fs.mkdirSync(resolve(folder, name, '.rush/temp'), { recursive: true });
+          fs.writeFileSync(resolve(folder, name, 'package.json'), JSON.stringify({ name, version: '1.0.0' }));
+          fs.writeFileSync(dependencyFile(name), '{}');
+        }
+        rushConfiguration = RushConfiguration.loadFromConfigurationFile(resolve(folder, 'rush.json'));
+        terminalProvider = new StringBufferTerminalProvider();
+        terminal = new Terminal(terminalProvider);
+      });
+
+      afterEach(() => {
+        fs.rmSync(folder, { recursive: true, force: true });
+      });
+
+      it('warns and continues without a snapshot provider if a file is missing', async () => {
+        fs.rmSync(dependencyFile('b'));
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        await expect(analyzer._tryGetSnapshotProviderAsync(new Map(), terminal)).resolves.toBeUndefined();
+        expect(terminalProvider.getWarningOutput()).toContain(instruction('b'));
+      });
+
+      it('throws the error of a missing file for a host that requires a snapshot', async () => {
+        fs.rmSync(dependencyFile('b'));
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        await expect(
+          analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, hostOptions)
+        ).rejects.toThrow(new Error(instruction('b')));
+        expect(terminalProvider.getWarningOutput()).toBe('');
+      });
+
+      it('reports a file that was removed after the provider was created instead of the Git failure', async () => {
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        const nativeProvider: GetInputsSnapshotAsyncFn | undefined =
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal);
+        const hostProvider: GetInputsSnapshotAsyncFn | undefined =
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, hostOptions);
+        fs.rmSync(dependencyFile('a'));
+        mockOnGetDetailedRepoState.mockImplementationOnce(gitFailure).mockImplementationOnce(gitFailure);
+
+        await expect(nativeProvider!()).resolves.toBeUndefined();
+        expect(terminalProvider.getWarningOutput()).toContain(instruction('a'));
+        expect(terminalProvider.getWarningOutput()).not.toContain('git hash-object failed');
+        await expect(hostProvider!()).rejects.toThrow(new Error(instruction('a')));
+      });
+
+      it('continues without a snapshot after other failures, even for a host that requires one', async () => {
+        const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+        const hostProvider: GetInputsSnapshotAsyncFn | undefined =
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, hostOptions);
+        mockOnGetDetailedRepoState.mockImplementationOnce(gitFailure);
+
+        await expect(hostProvider!()).resolves.toBeUndefined();
+        expect(terminalProvider.getWarningOutput()).toContain('git hash-object failed');
+      });
+
+      it('finds the first missing file in project order', async () => {
+        await expect(
+          tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)
+        ).resolves.toBeUndefined();
+        fs.rmSync(dependencyFile('b'));
+        fs.rmSync(dependencyFile('a'));
+        await expect(tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)).resolves.toEqual(
+          new Error(instruction('a'))
+        );
+      });
+    });
+
+    it('never reports a missing project dependency file for a package manager that has none', async () => {
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        resolve(__dirname, 'repo', 'rush.json')
+      );
+      await expect(tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)).resolves.toBeUndefined();
+    });
   });
 
   describe(ProjectChangeAnalyzer.prototype.getChangedProjectsAsync.name, () => {

From bd7bc498d42e6b1514f388475937c53f1eb63248 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 18:39:57 +0000
Subject: [PATCH 031/265] [rush-lib] With cache writes off, a result whose
 inputs changed during the run is not trusted as up to date

Swarm integration step 16; original commit d6ac7c43f3 (merge of swarm/r06-t92 at 72c2f0e4f8).
Scope: task 92.

ch01 GATE OK board 1563 (tree 5c0b0ac25d); r06 board 1270; CONFIRMED by t03, t04, ch05 and o03.

Commits folded into this step (1):
- 72c2f0e4f8 [rush-lib] Re-run operations whose inputs changed during the iteration, also with cache writes off

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...nverifiable-changed-inputs_2026-09-28.json |  11 ++
 ...nverifiable-changed-inputs_2026-09-28.json |  11 ++
 libraries/rush-daemon/README.md               |   4 +
 .../operations/CacheableOperationPlugin.ts    |  20 +++-
 .../logic/operations/PhasedOperationPlugin.ts |  21 +++-
 .../operations/RetainedResultVerification.ts  |  23 ++++
 .../test/CacheableOperationPlugin.test.ts     | 106 +++++++++++++++++-
 ...asedOperationPluginRetainedResults.test.ts |  29 ++++-
 8 files changed, 208 insertions(+), 17 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-unverifiable-changed-inputs_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-unverifiable-changed-inputs_2026-09-28.json

diff --git a/common/changes/@microsoft/rush/rushd-unverifiable-changed-inputs_2026-09-28.json b/common/changes/@microsoft/rush/rushd-unverifiable-changed-inputs_2026-09-28.json
new file mode 100644
index 0000000000..dd6bcf7778
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-unverifiable-changed-inputs_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where a long-lived operation graph, such as the Rush daemon, with build cache writes disabled kept an operation as up to date after its tracked input files changed while the inputs snapshot was being taken or while the operation was executing, so that a later build after the files were changed back skipped the operation and its consumers over outputs built from the changed files.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-unverifiable-changed-inputs_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-unverifiable-changed-inputs_2026-09-28.json
new file mode 100644
index 0000000000..76c1432beb
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-unverifiable-changed-inputs_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Document that a cacheable operation whose tracked input files changed while the inputs snapshot was taken or while it executed is run again by the next request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
\ No newline at end of file
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 250201ec20..a28234b3df 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -98,6 +98,10 @@ unchanged and are checked normally. Phased operation processes inherit the daemo
 see the daemon's startup values for the ignored variables rather than the submitting shell's values.
 Compatible selections reuse the same graph and records. An unchanged successful build schedules no work; rebuild
 still invalidates the graph on each request. Every execution refreshes operation inputs under its native lease.
+With the build cache enabled, a cacheable operation whose tracked input files change while the inputs snapshot is
+taken or while it executes is not kept as up to date, whether or not cache writes are allowed: the next request runs
+it and its consumers again, even if the files were changed back in between. Operations whose build cache is
+disabled, and workspaces without a build cache, don't get this check.
 
 A generation lease spans resolution through final output. Reload also takes exclusive workspace admission and
 the native preparation lock, discards paused prepared work, and awaits old runner/plugin/watcher cleanup before
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index b3b3e10ea2..5f96073993 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -50,7 +50,7 @@ import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperat
 import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration';
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
-import { enableUnverifiedRetainedOperations } from './RetainedResultVerification';
+import { enableUnverifiedRetainedOperations, markResultUnverifiable } from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
 const PERIODIC_CALLBACK_INTERVAL_IN_SECONDS: number = 10;
@@ -84,8 +84,9 @@ export interface IOperationBuildCacheContext {
   isCacheReadAttempted: boolean;
 
   // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
-  // the iteration's inputs snapshot. Used to refuse cache writes if the inputs changed while the snapshot was
-  // being taken or while the operation was executing.
+  // the iteration's inputs snapshot. Used to refuse cache writes, and to keep a long-lived graph from skipping
+  // the operation later, if the inputs changed while the snapshot was being taken or while the operation was
+  // executing.
   inputFilesState?: IInputFilesState;
   // The hashes of the tracked input files in the iteration's inputs snapshot
   inputFileHashes?: ReadonlyMap<string, string>;
@@ -271,8 +272,10 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
             disjointSet?.add(operation);
 
+            // Captured even if cache writes are disabled, since a long-lived graph (e.g. the Rush daemon) must not
+            // retain outputs that were built from input files that changed during the iteration.
             const inputFilesState: IInputFilesState | undefined =
-              cacheWriteEnabled && !cacheDisabledReason && record.enabled
+              !cacheDisabledReason && record.enabled
                 ? captureInputFilesState(
                     inputsSnapshot.rootDirectory,
                     fileHashes.keys(),
@@ -645,7 +648,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             }
             const { inputFilesState, inputFileHashes } = buildCacheContext;
             let inputFilesChangedMessage: string | undefined;
-            if (!cacheRestored && isCacheWriteAllowed && inputFilesState) {
+            if (!cacheRestored && inputFilesState) {
               // If Git hashed a file that was saved during the snapshot before it was saved, the outputs were
               // built from newer content than the cache key describes.
               const haveSnapshotHashesChanged: boolean =
@@ -677,9 +680,14 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               // The cache key was derived from the iteration's inputs snapshot. Storing outputs produced from
               // edited inputs under that key would poison the cache for every consumer of the entry.
               // Consumers' cache keys also embed this operation's pre-edit state, so block their writes too.
-              buildCacheTerminal.writeLine(inputFilesChangedMessage);
+              if (isCacheWriteAllowed) {
+                buildCacheTerminal.writeLine(inputFilesChangedMessage);
+              }
               buildCacheContext.isCacheWriteAllowed = false;
               setCacheEntryPromise = undefined;
+              // For the same reason, a long-lived graph must not skip this operation, or the consumers built against
+              // its outputs, while the state hash is unchanged, whether or not cache writes are enabled.
+              markResultUnverifiable(record);
             }
             if (!cacheRestored) {
               const cacheWriteSuccess: boolean | undefined = await setCacheEntryPromise?.();
diff --git a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
index 1584cba611..093ce3fc7f 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
@@ -19,9 +19,12 @@ import type {
 } from './IOperationExecutionResult';
 import { OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
-import { enableUnverifiedRetainedOperations } from './RetainedResultVerification';
+import { enableUnverifiedRetainedOperations, isResultUnverifiable } from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'PhasedOperationPlugin' = 'PhasedOperationPlugin';
+// Runs after the default-stage taps (e.g. CacheableOperationPlugin's input file checks), which can mark a result as
+// unverifiable.
+const VERIFY_RESULT_STAGE: number = 1;
 
 /**
  * Core phased command plugin that provides the functionality for generating a base operation graph
@@ -169,11 +172,14 @@ function configureExecutionManager(graph: IOperationGraph, context: IOperationGr
     }
   );
 
-  graph.hooks.afterExecuteOperationAsync.tap(PLUGIN_NAME, (record: IOperationExecutionResult) => {
-    if (iterationRecords) {
-      updateVerifiedStateHash(record, iterationRecords, verifiedStateHashByOperation);
+  graph.hooks.afterExecuteOperationAsync.tap(
+    { name: PLUGIN_NAME, stage: VERIFY_RESULT_STAGE },
+    (record: IOperationExecutionResult) => {
+      if (iterationRecords) {
+        updateVerifiedStateHash(record, iterationRecords, verifiedStateHashByOperation);
+      }
     }
-  });
+  );
 
   graph.hooks.afterExecuteIterationAsync.tap(PLUGIN_NAME, (status: OperationStatus) => {
     iterationRecords = undefined;
@@ -202,7 +208,10 @@ function updateVerifiedStateHash(
     case OperationStatus.Success:
     case OperationStatus.SuccessWithWarning:
     case OperationStatus.NoOp: {
-      if (areDependenciesVerified(operation, records, verifiedStateHashByOperation)) {
+      if (
+        !isResultUnverifiable(record) &&
+        areDependenciesVerified(operation, records, verifiedStateHashByOperation)
+      ) {
         verifiedStateHashByOperation.set(operation, record.getStateHash());
         return;
       }
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
index e354e44463..f15be001ff 100644
--- a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -5,6 +5,29 @@ import type { Operation } from './Operation';
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import { SUCCESS_STATUSES } from './OperationStatus';
 
+const unverifiableResults: WeakSet<IOperationExecutionResult> = new WeakSet();
+
+/**
+ * Records that the outputs of a result of the executing iteration may not match its state hash, e.g. because input
+ * files of the operation changed while the inputs snapshot was being taken or while the operation was executing.
+ * Such a result is never verified at its state hash, so a later iteration of a long-lived graph runs the operation
+ * again, and the consumers that were built against its outputs, instead of skipping them.
+ *
+ * @remarks
+ * Call this from an `afterExecuteOperationAsync` tap with the default stage. The taps that verify results use a
+ * later stage.
+ */
+export function markResultUnverifiable(result: IOperationExecutionResult): void {
+  unverifiableResults.add(result);
+}
+
+/**
+ * Returns true if `markResultUnverifiable` was called for the result.
+ */
+export function isResultUnverifiable(result: IOperationExecutionResult): boolean {
+  return unverifiableResults.has(result);
+}
+
 /**
  * Re-enables selected operations whose successful result retained by a previous iteration of a long-lived graph
  * (e.g. the Rush daemon) is current by state hash, but not verified at that state hash, so that they are restored
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index 6c7f1cb80f..b0d532c5c8 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -92,14 +92,17 @@ class CacheableMockRunner implements IOperationRunner {
   public readonly isNoOp: boolean = false;
   public readonly name: string;
   readonly #executions: string[];
+  readonly #onExecute: ((name: string) => void) | undefined;
 
-  public constructor(name: string, executions: string[]) {
+  public constructor(name: string, executions: string[], onExecute?: (name: string) => void) {
     this.name = name;
     this.#executions = executions;
+    this.#onExecute = onExecute;
   }
 
   public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
     this.#executions.push(this.name);
+    this.#onExecute?.(this.name);
     return OperationStatus.Success;
   }
 
@@ -116,19 +119,26 @@ interface ITestGraph {
   trackedFileHashes: Map<string, Map<string, string>>;
   executions: string[];
   cacheWrites: string[];
+  // Called when an operation executes, e.g. to save one of its input files while it executes
+  onExecute: ((name: string) => void) | undefined;
   executeAsync(workingTreeReadStartTimeMs?: number): Promise<IExecutionResult>;
 }
 
 /**
  * Creates a linear chain of cacheable operations: names[0] <- names[1] <- ... (each depends on the previous).
  */
-async function createTestGraphAsync(names: string[], rootDirectory: string = '/repo'): Promise<ITestGraph> {
+async function createTestGraphAsync(
+  names: string[],
+  rootDirectory: string = '/repo',
+  cacheWriteEnabled: boolean = true
+): Promise<ITestGraph> {
   const executions: string[] = [];
   const cacheWrites: string[] = [];
   const localHashes: Map<string, string> = new Map();
   const trackedFileHashes: Map<string, Map<string, string>> = new Map();
   const operations: Map<string, Operation> = new Map();
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+  let onExecute: ((name: string) => void) | undefined;
 
   let previous: Operation | undefined;
   for (const name of names) {
@@ -140,7 +150,7 @@ async function createTestGraphAsync(names: string[], rootDirectory: string = '/r
       getCacheDisabledReason: () => undefined
     } as unknown as RushProjectConfiguration);
     const operation: Operation = new Operation({
-      runner: new CacheableMockRunner(name, executions),
+      runner: new CacheableMockRunner(name, executions, (executedName: string) => onExecute?.(executedName)),
       logFilenameIdentifier: name,
       phase: mockPhase,
       project
@@ -171,7 +181,7 @@ async function createTestGraphAsync(names: string[], rootDirectory: string = '/r
     allowWarningsInSuccessfulBuild: false,
     buildCacheConfiguration: {
       buildCacheEnabled: true,
-      cacheWriteEnabled: true
+      cacheWriteEnabled
     } as unknown as BuildCacheConfiguration,
     cobuildConfiguration: undefined,
     terminal,
@@ -199,6 +209,12 @@ async function createTestGraphAsync(names: string[], rootDirectory: string = '/r
     trackedFileHashes,
     executions,
     cacheWrites,
+    get onExecute(): ((name: string) => void) | undefined {
+      return onExecute;
+    },
+    set onExecute(value: ((name: string) => void) | undefined) {
+      onExecute = value;
+    },
     executeAsync: async (workingTreeReadStartTimeMs?: number) => {
       executions.length = 0;
       cacheWrites.length = 0;
@@ -408,5 +424,87 @@ describe(CacheableOperationPlugin.name, () => {
       expect(testGraph.cacheWrites).toEqual(['a', 'b']);
       expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
     });
+
+    it.each([true, false])(
+      'runs the operations again if a later snapshot has the same state hashes (cache writes enabled: %s)',
+      async (cacheWriteEnabled: boolean) => {
+        const testGraph: ITestGraph = await createTestGraphAsync(
+          ['a', 'b'],
+          rootDirectory,
+          cacheWriteEnabled
+        );
+        const inputFilePath: string = path.join(rootDirectory, inputFile);
+        testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 1;')]]));
+
+        await testGraph.executeAsync(Date.now());
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual([]);
+
+        // Reverting the save gives the next snapshot the same state hashes, but the outputs of "a" and "b" were
+        // built from the saved content.
+        fs.writeFileSync(inputFilePath, 'export const a = 1;');
+        const afterRevertMs: number = getLatestFileTimeMs(inputFilePath) + FILE_TIME_TOLERANCE_MS + 1;
+        await testGraph.executeAsync(afterRevertMs);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual(cacheWriteEnabled ? ['a', 'b'] : []);
+
+        const hotResult: IExecutionResult = await testGraph.executeAsync(afterRevertMs);
+        expect(hotResult.status).toBe(OperationStatus.NoOp);
+        expect(testGraph.executions).toEqual([]);
+      }
+    );
+  });
+
+  describe('input files saved while an operation executes', () => {
+    const inputFile: string = 'a/src/index.ts';
+    let rootDirectory: string;
+    let inputFilePath: string;
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      fs.mkdirSync(path.join(rootDirectory, 'a', 'src'), { recursive: true });
+      inputFilePath = path.join(rootDirectory, inputFile);
+      fs.writeFileSync(inputFilePath, 'export const a = 1;');
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    it.each([true, false])(
+      'runs the operations again if a later snapshot has the same state hashes (cache writes enabled: %s)',
+      async (cacheWriteEnabled: boolean) => {
+        const testGraph: ITestGraph = await createTestGraphAsync(
+          ['a', 'b'],
+          rootDirectory,
+          cacheWriteEnabled
+        );
+        testGraph.trackedFileHashes.set('a', new Map([[inputFile, getGitBlobHash('export const a = 1;')]]));
+        const afterWriteMs: number = getLatestFileTimeMs(inputFilePath) + FILE_TIME_TOLERANCE_MS + 1;
+        testGraph.onExecute = (name: string) => {
+          if (name === 'a') {
+            // A different size, so that the save is detected even if the file time does not change
+            fs.writeFileSync(inputFilePath, 'export const a = 22;');
+          }
+        };
+
+        await testGraph.executeAsync(afterWriteMs);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual([]);
+
+        // Reverting the save gives the next snapshot the same state hashes, but the outputs of "a" and "b" may
+        // have been built from the saved content.
+        testGraph.onExecute = undefined;
+        fs.writeFileSync(inputFilePath, 'export const a = 1;');
+        const afterRevertMs: number = getLatestFileTimeMs(inputFilePath) + FILE_TIME_TOLERANCE_MS + 1;
+        await testGraph.executeAsync(afterRevertMs);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(testGraph.cacheWrites).toEqual(cacheWriteEnabled ? ['a', 'b'] : []);
+
+        const hotResult: IExecutionResult = await testGraph.executeAsync(afterRevertMs);
+        expect(hotResult.status).toBe(OperationStatus.NoOp);
+        expect(testGraph.executions).toEqual([]);
+      }
+    );
   });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
index 325a1ea315..d748569f95 100644
--- a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
@@ -36,7 +36,8 @@ import { OperationGraph } from '../OperationGraph';
 import { Operation } from '../Operation';
 import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
-import type { IExecutionResult } from '../IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import { markResultUnverifiable } from '../RetainedResultVerification';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -303,6 +304,32 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
     expect(testGraph.executions).toEqual(['c']);
   });
 
+  it('re-executes a result that a plugin marked unverifiable, and the results built against it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const a: Operation = testGraph.operations.get('a')!;
+    let isMarkingA: boolean = true;
+    // Like CacheableOperationPlugin when input files of "a" changed while "a" was executing
+    testGraph.graph.hooks.afterExecuteOperationAsync.tap(
+      'TestPlugin',
+      (record: IOperationExecutionResult) => {
+        if (isMarkingA && record.operation === a) {
+          markResultUnverifiable(record);
+        }
+      }
+    );
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    // The same state hashes
+    isMarkingA = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
   it('does not re-execute retained results of operations that ignore dependency changes', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
     const a: Operation = testGraph.operations.get('a')!;

From afcb54555b27065a101d3a040f8f00d1711cdac7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 18:40:05 +0000
Subject: [PATCH 032/265] [rush-lib] A failed pnpm install releases the
 package-manager lock

Swarm integration step 17; original commit 9a58fc2f85 (merge of swarm/r01-t103 at 93eacefb71).
Scope: task 103.

ch01 GATE OK board 1565 (tree e234c8d86d); o04 CONFIRMED board 1477; r01 board 1440. This is upstream row 16's commit.

Commits folded into this step (1):
- 93eacefb71 [rush-lib] Release the package manager lock when installing the package manager fails

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...package-manager-lock_2026-09-28-17-58.json |  11 ++
 .../logic/installManager/InstallHelpers.ts    | 110 +++++++++---------
 .../src/logic/test/InstallHelpers.test.ts     |  68 ++++++++++-
 3 files changed, 136 insertions(+), 53 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r01-release-package-manager-lock_2026-09-28-17-58.json

diff --git a/common/changes/@microsoft/rush/swarm-r01-release-package-manager-lock_2026-09-28-17-58.json b/common/changes/@microsoft/rush/swarm-r01-release-package-manager-lock_2026-09-28-17-58.json
new file mode 100644
index 0000000000..decf751408
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r01-release-package-manager-lock_2026-09-28-17-58.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Release the package manager lock in `~/.rush` when installing the package manager fails. Before, a long-lived process such as the Rush daemon kept the lock after a failed install, and every later request waited for it forever.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts b/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
index 8ae6806b00..0ff8126e63 100644
--- a/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
+++ b/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
@@ -494,66 +494,72 @@ export class InstallHelpers {
 
     logIfConsoleOutputIsNotRestricted(`Acquired lock for ${packageManagerAndVersion}`);
 
-    if (!(await packageManagerMarker.isValidAsync()) || lock.dirtyWhenAcquired) {
-      logIfConsoleOutputIsNotRestricted(
-        Colorize.bold(`Installing ${packageManager} version ${packageManagerVersion}\n`)
-      );
-
-      // note that this will remove the last-install flag from the directory
-      await Utilities.installPackageInDirectoryAsync({
-        directory: packageManagerToolFolder,
-        packageName: packageManager,
-        version: rushConfiguration.packageManagerToolVersion,
-        tempPackageTitle: `${packageManager}-local-install`,
-        maxInstallAttempts: maxInstallAttempts,
-        // This is using a local configuration to install a package in a shared global location.
-        // Generally that's a bad practice, but in this case if we can successfully install
-        // the package at all, we can reasonably assume it's good for all the repositories.
-        // In particular, we'll assume that two different NPM registries cannot have two
-        // different implementations of the same version of the same package.
-        // This was needed for: https://github.com/microsoft/rushstack/issues/691
-        commonRushConfigFolder: rushConfiguration.commonRushConfigFolder,
-        // Only filter npm-incompatible properties when the repo uses pnpm or yarn.
-        // If the repo uses npm, the .npmrc is already configured for npm, so don't filter.
-        filterNpmIncompatibleProperties: rushConfiguration.packageManager !== 'npm'
-      });
+    try {
+      if (!(await packageManagerMarker.isValidAsync()) || lock.dirtyWhenAcquired) {
+        logIfConsoleOutputIsNotRestricted(
+          Colorize.bold(`Installing ${packageManager} version ${packageManagerVersion}\n`)
+        );
 
-      logIfConsoleOutputIsNotRestricted(
-        `Successfully installed ${packageManager} version ${packageManagerVersion}`
-      );
-    } else {
-      logIfConsoleOutputIsNotRestricted(
-        `Found ${packageManager} version ${packageManagerVersion} in ${packageManagerToolFolder}`
-      );
-    }
+        // note that this will remove the last-install flag from the directory
+        await Utilities.installPackageInDirectoryAsync({
+          directory: packageManagerToolFolder,
+          packageName: packageManager,
+          version: rushConfiguration.packageManagerToolVersion,
+          tempPackageTitle: `${packageManager}-local-install`,
+          maxInstallAttempts: maxInstallAttempts,
+          // This is using a local configuration to install a package in a shared global location.
+          // Generally that's a bad practice, but in this case if we can successfully install
+          // the package at all, we can reasonably assume it's good for all the repositories.
+          // In particular, we'll assume that two different NPM registries cannot have two
+          // different implementations of the same version of the same package.
+          // This was needed for: https://github.com/microsoft/rushstack/issues/691
+          commonRushConfigFolder: rushConfiguration.commonRushConfigFolder,
+          // Only filter npm-incompatible properties when the repo uses pnpm or yarn.
+          // If the repo uses npm, the .npmrc is already configured for npm, so don't filter.
+          filterNpmIncompatibleProperties: rushConfiguration.packageManager !== 'npm'
+        });
+
+        logIfConsoleOutputIsNotRestricted(
+          `Successfully installed ${packageManager} version ${packageManagerVersion}`
+        );
+      } else {
+        logIfConsoleOutputIsNotRestricted(
+          `Found ${packageManager} version ${packageManagerVersion} in ${packageManagerToolFolder}`
+        );
+      }
 
-    await packageManagerMarker.createAsync();
+      await packageManagerMarker.createAsync();
 
-    // Example: "C:\MyRepo\common\temp"
-    FileSystem.ensureFolder(rushConfiguration.commonTempFolder);
+      // Example: "C:\MyRepo\common\temp"
+      FileSystem.ensureFolder(rushConfiguration.commonTempFolder);
 
-    // Example: "C:\MyRepo\common\temp\pnpm-local"
-    const localPackageManagerToolFolder: string = `${rushConfiguration.commonTempFolder}/${packageManager}-local`;
+      // Example: "C:\MyRepo\common\temp\pnpm-local"
+      const localPackageManagerToolFolder: string = `${rushConfiguration.commonTempFolder}/${packageManager}-local`;
 
-    logIfConsoleOutputIsNotRestricted(`\nSymlinking "${localPackageManagerToolFolder}"`);
-    logIfConsoleOutputIsNotRestricted(`  --> "${packageManagerToolFolder}"`);
+      logIfConsoleOutputIsNotRestricted(`\nSymlinking "${localPackageManagerToolFolder}"`);
+      logIfConsoleOutputIsNotRestricted(`  --> "${packageManagerToolFolder}"`);
 
-    // We cannot use FileSystem.exists() to test the existence of a symlink, because it will
-    // return false for broken symlinks.  There is no way to test without catching an exception.
-    try {
-      await FileSystem.deleteFolderAsync(localPackageManagerToolFolder);
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
-        throw error;
+      // We cannot use FileSystem.exists() to test the existence of a symlink, because it will
+      // return false for broken symlinks.  There is no way to test without catching an exception.
+      try {
+        await FileSystem.deleteFolderAsync(localPackageManagerToolFolder);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+          throw error;
+        }
       }
-    }
-
-    await FileSystem.createSymbolicLinkJunctionAsync({
-      linkTargetPath: packageManagerToolFolder,
-      newLinkPath: localPackageManagerToolFolder
-    });
 
-    lock.release();
+      await FileSystem.createSymbolicLinkJunctionAsync({
+        linkTargetPath: packageManagerToolFolder,
+        newLinkPath: localPackageManagerToolFolder
+      });
+    } finally {
+      // A long-lived process such as the Rush daemon calls this again after a failed install.
+      // LockFile keeps an in-process record of every held lock, so a lock that is never released
+      // makes that later call wait forever. A failed install empties the tool folder first, which
+      // removes the last-install flag, so the next caller installs again.
+      lock.release();
+    }
   }
 }
 
diff --git a/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts b/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
index e974122307..f7cc1ba6d4 100644
--- a/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
+++ b/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
@@ -1,12 +1,18 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { type IPackageJson, JsonFile } from '@rushstack/node-core-library';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem, type IPackageJson, JsonFile, LockFile } from '@rushstack/node-core-library';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import { TestUtilities } from '@rushstack/heft-config-file';
 
 import { InstallHelpers } from '../installManager/InstallHelpers';
 import { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushGlobalFolder } from '../../api/RushGlobalFolder';
+import { Utilities } from '../../utilities/Utilities';
 import type { PnpmWorkspaceFile } from '../pnpm/PnpmWorkspaceFile';
 
 describe(InstallHelpers.name, () => {
@@ -70,6 +76,66 @@ describe(InstallHelpers.name, () => {
     });
   });
 
+  describe(InstallHelpers.ensureLocalPackageManagerAsync.name, () => {
+    const packageManagerVersion: string = '8.14.0';
+    const lockResourceName: string = `pnpm-${packageManagerVersion}`;
+    let tempFolder: string;
+    let rushConfiguration: RushConfiguration;
+    let rushGlobalFolder: RushGlobalFolder;
+    let installPackageMock: jest.SpyInstance;
+
+    beforeEach(() => {
+      tempFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-ensure-local-package-manager-'));
+      rushConfiguration = {
+        packageManager: 'pnpm',
+        packageManagerToolVersion: packageManagerVersion,
+        commonRushConfigFolder: `${tempFolder}/repo/common/config/rush`,
+        commonTempFolder: `${tempFolder}/repo/common/temp`
+      } as unknown as RushConfiguration;
+      rushGlobalFolder = { nodeSpecificPath: `${tempFolder}/rush-home` } as unknown as RushGlobalFolder;
+      installPackageMock = jest
+        .spyOn(Utilities, 'installPackageInDirectoryAsync')
+        .mockRejectedValue(new Error('Unexpected package manager install'));
+    });
+
+    afterEach(() => {
+      installPackageMock.mockRestore();
+      fs.rmSync(tempFolder, { recursive: true, force: true });
+    });
+
+    it('releases the package manager lock when the install fails, so the same process can retry', async () => {
+      installPackageMock
+        .mockRejectedValueOnce(new Error('npm error code E401'))
+        .mockResolvedValueOnce(undefined);
+
+      await expect(
+        InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true)
+      ).rejects.toThrow('npm error code E401');
+
+      // A Rush daemon calls this again in the same process. If the failed call still held the lock,
+      // tryAcquire would return undefined here and the retry below would wait forever.
+      const lockAfterFailure: LockFile | undefined = LockFile.tryAcquire(
+        rushGlobalFolder.nodeSpecificPath,
+        lockResourceName
+      );
+      expect(lockAfterFailure).toBeDefined();
+      lockAfterFailure?.release();
+
+      await InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true);
+
+      expect(installPackageMock).toHaveBeenCalledTimes(2);
+      await expect(
+        FileSystem.getLinkStatisticsAsync(`${rushConfiguration.commonTempFolder}/pnpm-local`)
+      ).resolves.toBeDefined();
+      const lockAfterSuccess: LockFile | undefined = LockFile.tryAcquire(
+        rushGlobalFolder.nodeSpecificPath,
+        lockResourceName
+      );
+      expect(lockAfterSuccess).toBeDefined();
+      lockAfterSuccess?.release();
+    });
+  });
+
   describe(InstallHelpers.generateCommonPackageJsonAsync.name, () => {
     let mockJsonFileSaveAsync: jest.SpyInstance;
     let terminal: Terminal;

From ab2fb7786b786369e718b9cd1fb86d2a1eca336c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 19:16:03 +0000
Subject: [PATCH 033/265] [rush-daemon-transport] rush-lib path handoff,
 startup reservation, lost-connection message and a private runtime folder

Swarm integration step 18; original commit 261e4320dd (merge of swarm/r03-t87 at d9366621c8).
Scope: tasks 4+5, 68, 86 and 87.

ch01 GATE OK board 1675 (tree f85ce62f88). Commits: bb1d272738 (tasks 4+5), 959cbb84ee (task 68), a68e4d96a5, 696dba1d3e (task 86) and d9366621c8 (task 87).

Commits folded into this step (5):
- bb1d272738 [rush-lib] Hand off a by-name resolvable rush-lib and load built-in cache plugins from deploy outputs
- 959cbb84ee [rush-client-core] Resolve a retained startup reservation next to a ready daemon
- a68e4d96a5 [rush-client-core] Resolve a remaining startup reservation before a plain daemon stop
- 696dba1d3e [rush-client-core] Explain a daemon that exited before delivering a result
- d9366621c8 [rush-daemon] Meet one daemon per checkout whatever TMPDIR or XDG_RUNTIME_DIR says (task 87)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  60 ++-
 apps/rush-cli-client/package.json             |   3 +
 apps/rush-cli-client/src/daemonCommands.ts    |  84 +++-
 .../src/daemonConnectionOptions.ts            |  18 +-
 .../src/test/NativeBuildTestFixture.ts        |   2 +-
 .../test/daemonConnectionSelection.test.ts    |  24 ++
 .../src/test/launchClient.test.ts             | 134 +++++-
 .../r03-runtime-folder_2026-09-28-17-15.json  |  11 +
 ...ush-lib-path-handoff_2026-09-28-13-10.json |  11 +
 ...explain-daemon-crash_2026-09-28-15-52.json |  11 +
 .../r03-runtime-folder_2026-09-28-17-15.json  |  11 +
 ...ush-lib-path-handoff_2026-09-28-13-10.json |  11 +
 ...-startup-reservation_2026-09-28-14-25.json |  11 +
 ...resolves-reservation_2026-09-28-15-31.json |  11 +
 ...explain-daemon-crash_2026-09-28-15-52.json |  11 +
 .../r03-runtime-folder_2026-09-28-17-15.json  |  11 +
 ...-startup-reservation_2026-09-28-14-25.json |  11 +
 ...resolves-reservation_2026-09-28-15-31.json |  11 +
 .../r03-runtime-folder_2026-09-28-17-15.json  |  11 +
 .../r03-runtime-folder_2026-09-28-17-15.json  |  11 +
 .../r03-runtime-folder_2026-09-28-17-15.json  |  11 +
 ...ush-lib-path-handoff_2026-09-28-13-10.json |  11 +
 .../rush/deploy-rush-daemon-dogfood.json      |  35 +-
 .../config/subspaces/default/pnpm-lock.yaml   |  26 +-
 .../config/subspaces/default/repo-state.json  |   2 +-
 common/reviews/api/rush-client-core.api.md    |  19 +
 .../reviews/api/rush-daemon-protocol.api.md   |   3 +
 .../reviews/api/rush-daemon-transport.api.md  |   9 +-
 docs/rush/dogfooding-rush-daemon.md           |   7 +-
 libraries/rush-client-core/README.md          |  38 +-
 .../rush-client-core/src/DaemonClient.ts      |   4 +-
 .../rush-client-core/src/DaemonClientError.ts |   4 +
 .../rush-client-core/src/DaemonDisconnect.ts  | 185 ++++++++
 .../rush-client-core/src/DaemonOwnership.ts   |   2 +-
 .../src/DaemonRuntimeFolder.ts                |  60 +++
 .../rush-client-core/src/DaemonStartup.ts     | 117 ++++-
 .../src/DaemonStartupReservation.ts           | 114 +++++
 .../rush-client-core/src/ProcessStartTime.ts  |  23 +-
 .../src/connectOrStartDaemon.ts               | 228 ++++++++--
 .../src/executeWithDaemonRestart.ts           |  30 +-
 libraries/rush-client-core/src/index.ts       |   7 +
 .../src/test/DaemonDisconnect.test.ts         | 121 ++++++
 .../src/test/ProcessStartTime.test.ts         |  14 +-
 .../src/test/UnreapedChildProcess.ts          |  26 ++
 .../src/test/connectOrStartDaemon.test.ts     | 400 +++++++++++++++++-
 .../src/test/fixtures/daemon.ts               |  43 +-
 .../src/DaemonProtocolVersion.ts              |   9 +-
 libraries/rush-daemon-protocol/src/index.ts   |   4 +-
 libraries/rush-daemon-transport/README.md     |  13 +-
 .../src/DaemonFileIdentity.ts                 |  60 +++
 .../src/DaemonListener.ts                     |  24 +-
 .../src/DaemonListenerBinding.ts              |  18 +-
 .../src/DaemonListenerLifetime.ts             |  23 +-
 .../src/DaemonLockfile.ts                     |  14 +-
 .../src/DaemonOperationGroupReaper.ts         |  26 +-
 .../src/DaemonOrphanReaper.ts                 |  18 +-
 .../src/DaemonOwnedEntry.ts                   |  28 ++
 .../rush-daemon-transport/src/DaemonPaths.ts  |  56 ++-
 .../src/DaemonReapOptions.ts                  |  11 +-
 .../src/DaemonReclaim.ts                      |   8 +-
 .../src/DaemonRuntimeDir.ts                   |  52 +++
 .../src/DaemonRuntimeFolderCheck.ts           |  64 +++
 .../src/DaemonSocketPublication.ts            |  88 ++++
 .../src/DaemonTransportError.ts               |   4 +-
 libraries/rush-daemon-transport/src/index.ts  |   9 +-
 .../src/test/DaemonPaths.test.ts              |  36 +-
 .../src/test/FileIdentity.test.ts             |  65 +++
 .../src/test/ListenerSuccession.test.ts       |  71 ++++
 .../src/test/RecordOwnership.test.ts          |  97 +++++
 .../src/test/RuntimeFolder.test.ts            |  98 +++++
 .../src/test/TestDaemonFixture.ts             |  33 +-
 libraries/rush-daemon/README.md               |   4 +-
 libraries/rush-daemon/package.json            |   3 +
 .../rush-daemon/src/RushLibPathHandoff.ts     |  30 ++
 .../src/SelectedDaemonBootstrap.ts            |   4 +-
 .../src/WorkspaceRequestLifecycle.ts          |   6 +-
 .../ProductionDaemonRequestResolver.test.ts   |  42 ++
 .../src/test/RushLibPathHandoff.test.ts       |  47 ++
 .../src/test/SuccessfulMutationFixture.ts     |   2 +-
 .../VersionSelectedDaemonLauncher.test.ts     |  10 +-
 .../src/api/WorkspaceInputFingerprint.ts      |  17 +-
 .../test/WorkspaceInputFingerprint.test.ts    |  12 +-
 .../src/pluginFramework/PluginManager.ts      |  33 +-
 .../test/PluginManager.test.ts                | 129 ++++++
 .../src/utilities/RushLibPathHandoff.ts       | 106 +++++
 .../rush-lib/src/utilities/SetRushLibPath.ts  |  22 +-
 .../utilities/test/RushLibPathHandoff.test.ts | 200 +++++++++
 87 files changed, 3428 insertions(+), 175 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/r03-runtime-folder_2026-09-28-17-15.json
 create mode 100644 common/changes/@microsoft/rush/r03-rush-lib-path-handoff_2026-09-28-13-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-explain-daemon-crash_2026-09-28-15-52.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-runtime-folder_2026-09-28-17-15.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-rush-lib-path-handoff_2026-09-28-13-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-startup-reservation_2026-09-28-14-25.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-stop-resolves-reservation_2026-09-28-15-31.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-explain-daemon-crash_2026-09-28-15-52.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-runtime-folder_2026-09-28-17-15.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-startup-reservation_2026-09-28-14-25.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-stop-resolves-reservation_2026-09-28-15-31.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r03-runtime-folder_2026-09-28-17-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r03-runtime-folder_2026-09-28-17-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r03-runtime-folder_2026-09-28-17-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r03-rush-lib-path-handoff_2026-09-28-13-10.json
 create mode 100644 libraries/rush-client-core/src/DaemonDisconnect.ts
 create mode 100644 libraries/rush-client-core/src/DaemonRuntimeFolder.ts
 create mode 100644 libraries/rush-client-core/src/DaemonStartupReservation.ts
 create mode 100644 libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
 create mode 100644 libraries/rush-client-core/src/test/UnreapedChildProcess.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts
 create mode 100644 libraries/rush-daemon/src/RushLibPathHandoff.ts
 create mode 100644 libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts
 create mode 100644 libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts
 create mode 100644 libraries/rush-lib/src/utilities/RushLibPathHandoff.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 1fb55ae3fb..96c9d681da 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -176,9 +176,10 @@ coalesced iteration, not while idle; native commands and `--no-daemon` can run
 after a completed request without stopping the daemon.
 
 Native workspace dispatch copies the request envelope and normalizes only the
-engine-owned `_RUSH_LIB_PATH` to this daemon's real engine. Foreign client SDK
-paths therefore neither select the wrong SDK nor cause a false restart. All other
-environment inputs remain unchanged and participate in normal lifecycle checks.
+engine-owned `_RUSH_LIB_PATH` to this daemon's own engine, keeping the spelling
+that the engine chose when it loaded. Foreign client SDK paths therefore neither
+select the wrong SDK nor cause a false restart. All other environment inputs
+remain unchanged and participate in normal lifecycle checks.
 
 Protocol 0.10 permits a bounded retry only when a pre-execution command result
 explicitly carries `retryAfterRestart: true`. `executeWithDaemonRestartAsync`
@@ -190,6 +191,15 @@ only an unstarted request can receive
 the typed retry authorization. Accepted queued requests drain their typed restart
 results before the old connection closes.
 
+When the connection is lost before a command's result, the command fails with exit code 1
+and is not retried. The diagnostic keeps "Daemon disconnected before delivering a result; the
+command was not retried." and says what happened to rushd. If its process exited (a crash, an
+out-of-memory kill or a signal), it names the PID, points to `rush-client daemon logs` and, if
+the daemon exits again, to `--no-daemon` (`rushx-client --no-daemon` for Rushx), and quotes on a
+second line the fatal error that the launcher log recorded after the command was sent. If
+rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
+or `daemon restart` still end a command as cancelled (exit code 130).
+
 Piped input uses protocol 0.7's negotiated stdin admission and EOF. The client does
 not read input until the command attaches an input destination, and sends bounded
 chunks only as the daemon grants write credits. EOF follows all preceding writes;
@@ -268,13 +278,44 @@ It does not replace a peer lacking safe shutdown support. Foreign package instal
 is a client preparation step; host self-restart selects only bundled or already cached
 compatible installations, never installing while the old workspace is being cleaned up.
 
+Every client of a checkout finds its daemon in one per-user runtime folder: on Linux and
+macOS, `/tmp/rushd-<uid>/`, whatever `TMPDIR` or `XDG_RUNTIME_DIR` a shell, job, service or
+sandbox sets. It holds the socket (`<key>.sock`), the ownership record
+(`<key>.pid.json`) and the launcher log. To move it, set `RUSHD_RUNTIME_DIR` to an absolute
+path for every client of that checkout; the folder becomes `$RUSHD_RUNTIME_DIR/rushd-<uid>/`,
+and its file system must support hard links. A client passes the folder to the daemon it starts.
+Windows uses the named pipe `\\.\pipe\rushd-<key>` and is unchanged.
+The client refuses a runtime folder that is a symbolic link, is not a directory or belongs to
+another user: commands run in-process with that reason, and `daemon` commands exit 1. Remove
+the folder or set `RUSHD_RUNTIME_DIR`. A folder that others can open is made owner-only (`0700`).
+`TMPDIR`, `TMP`, `TEMP`, `XDG_RUNTIME_DIR` and `RUSHD_RUNTIME_DIR` never select a different
+daemon; each operation receives the requesting client's values.
+Clients and daemons before protocol 0.12 used `$XDG_RUNTIME_DIR/rushd-<uid>/` or the
+temporary folder instead. A daemon started there stays there, where current clients do not
+look, until it idles out or is stopped with that older client (`rush-client daemon stop`).
+An older client that starts a current engine while `XDG_RUNTIME_DIR` or `TMPDIR` is set does
+not find it and runs in-process, so upgrade `rush-cli-client` with the engine.
+
 `rush-client daemon status` only connects and checks hello/pong. It never starts
 a process, reclaims files, or treats a PID file as evidence of readiness. Both
 commands print one JSON object with `state: "ready"`, `socketPath`, and the actual
 pong fields (`uptimeMs`, available versions, optional `pid` and
 `residentMemoryBytes`, and an optional `workspace` snapshot). Exit code 0 means protocol
 readiness, not build support. An unreachable/incompatible endpoint, invalid
-arguments, or startup failure returns exit code 1 with a diagnostic.
+arguments, or startup failure returns exit code 1 with a diagnostic. When the endpoint
+refuses connections and its ownership record (`<key>.pid.json`) names a PID that no longer
+exists, the diagnostic adds that rushd exited without shutting down (an orderly shutdown
+removes the record) and that `daemon logs` may show why.
+
+A startup reservation (`<key>.pid.json.starting`) refuses another daemon launch until
+the daemon it reserved becomes ready. Status reports one that remains as
+`startupReservation` with its `path`, the startup helper's `helperPid` when recorded, and
+`helperState`: `running` (the helper still waits for readiness), `exited` (nothing else will
+release it), or `unknown` (written by an older client). Status never removes it. Next to a
+ready daemon, the next command that uses, stops or restarts that daemon removes it; when status
+cannot connect, its diagnostic explains the reservation. After an `exited` helper, every automatic start is
+refused at once unless that daemon still becomes ready: check `daemon logs`, and if the daemon
+failed to start, run `daemon stop --force`.
 
 The optional workspace snapshot reports the provider generation/token, graph existence,
 and available warm accounting without initializing a graph. Missing fields are unknown,
@@ -302,7 +343,11 @@ followed by EOF. It reports `state: "shutdownAccepted"` with exit code 0; this
 does not assert successful workspace disposal. Stop is idempotent: when nothing
 listens at the endpoint it reports `state: "notRunning"` with exit code 0. An
 unsupported protocol, missing acknowledgement, handshake failure, or timeout
-returns exit code 1. It does not auto-start anything.
+returns exit code 1. It does not auto-start anything. Before shutdown, it removes a startup
+reservation that remains next to that daemon, as restart does, so that the reservation cannot
+refuse the next start once the daemon is gone. It does so only for the live owner in the
+ownership record, under the start mutex (waiting up to 15 seconds for it); a reservation that
+it cannot resolve stays in place and is reported as `startupReservation`.
 
 `rush-client daemon stop --force` stops a running daemon the same way, then waits
 (up to 15 seconds) for it to release its listener and ownership record and removes
@@ -319,7 +364,10 @@ that every fail-closed startup message points to.
 `rush-client daemon restart` first verifies that the selected Rush version has a
 launcher and captures the original lock's PID/start timestamp, checking that it
 matches pong's positive PID and the selected endpoint, then performs acknowledged
-shutdown. It waits for original ownership release or a demonstrably dead owner
+shutdown. Before shutdown, it removes a startup reservation that remains next to that
+daemon (under the start mutex), so that the reservation cannot refuse the successor; if
+another client holds the mutex for 15 seconds, restart fails without stopping the daemon.
+It waits for original ownership release or a demonstrably dead owner
 before calling the existing locked starter. A live owner fails closed at
 the startup deadline; no PID is killed and no live ownership record is deleted.
 A newly
diff --git a/apps/rush-cli-client/package.json b/apps/rush-cli-client/package.json
index eb3f9a1609..3633851af4 100644
--- a/apps/rush-cli-client/package.json
+++ b/apps/rush-cli-client/package.json
@@ -36,6 +36,9 @@
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",
+    "@rushstack/rush-amazon-s3-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-azure-storage-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-http-build-cache-plugin": "workspace:*",
     "eslint": "~9.37.0",
     "local-node-rig": "workspace:*"
   }
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index fd19088343..6568b5e298 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -6,14 +6,20 @@ import * as path from 'node:path';
 import {
   DaemonClient,
   connectOrStartDaemonAsync,
+  inspectDaemonStartupReservation,
   requestDaemonShutdownAsync,
   resetDaemonArtifactsAsync,
-  type IConnectOrStartDaemonOptions
+  resolveDaemonStartupReservationAsync,
+  type IConnectOrStartDaemonOptions,
+  type IDaemonStartupReservationInfo
 } from '@rushstack/rush-client-core';
 import {
   DaemonTransportError,
   DaemonTransportErrorCode,
-  type IDaemonLockfile
+  isDaemonProcessAlive,
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 
@@ -99,7 +105,8 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
         await writeStatusAsync({
           state: 'ready',
           socketPath: connectionOptions.paths.socketPath,
-          ...(await started.status)
+          ...(await started.status),
+          ...getStartupReservationStatus(connectionOptions.paths)
         });
       } finally {
         await started.closeAsync();
@@ -113,12 +120,18 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
     await writeStatusAsync({
       state: removedPaths.length > 0 ? 'reset' : 'notRunning',
       socketPath: connectionOptions.paths.socketPath,
-      ...(options.argv[1] === '--force' ? { removedPaths } : {})
+      ...(options.argv[1] === '--force' ? { removedPaths } : {}),
+      ...getStartupReservationStatus(connectionOptions.paths)
     });
     return;
   }
   try {
     if (command === 'stop') {
+      if (options.argv[1] !== '--force') {
+        // Once the daemon is gone, nothing proves a remaining reservation stale, so it would refuse every later
+        // automatic start. A reservation that cannot be resolved is still reported; --force removes it below.
+        await resolveDaemonStartupReservationAsync(client, connectionOptions.paths).catch(() => false);
+      }
       const { activeRequests } = await client.shutdownAsync();
       if (activeRequests) {
         await writeStreamAsync(
@@ -147,7 +160,8 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       await writeStatusAsync({
         state: 'shutdownAccepted',
         socketPath: connectionOptions.paths.socketPath,
-        ...cancelled
+        ...cancelled,
+        ...getStartupReservationStatus(connectionOptions.paths)
       });
       return;
     }
@@ -157,7 +171,8 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       await writeStatusAsync({
         state: 'ready',
         socketPath: connectionOptions.paths.socketPath,
-        ...(await readyClient.status)
+        ...(await readyClient.status),
+        ...getStartupReservationStatus(connectionOptions.paths)
       });
     } finally {
       if (readyClient !== client) await readyClient.closeAsync();
@@ -182,8 +197,63 @@ async function connectExistingAsync(
     ) {
       return undefined;
     }
-    throw error;
+    throw explainStartupReservation(explainExitedDaemon(error, options.paths), options.paths);
+  }
+}
+
+/**
+ * Explains a refused connection whose ownership record names a daemon that no longer runs. An orderly
+ * shutdown removes the record, so that daemon exited without shutting down, for example after a crash.
+ */
+function explainExitedDaemon(error: unknown, paths: IDaemonPaths): unknown {
+  if (!(error instanceof DaemonTransportError) || error.code !== DaemonTransportErrorCode.connectionRefused) {
+    return error;
+  }
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
+  if (
+    owner?.socketPath !== paths.socketPath ||
+    !Number.isSafeInteger(owner.pid) ||
+    owner.pid <= 0 ||
+    isDaemonProcessAlive(owner.pid)
+  ) {
+    return error;
+  }
+  return new DaemonTransportError(
+    error.code,
+    `${error.message} rushd (PID ${owner.pid}) exited without shutting down; "rush-client daemon logs" may show why.`
+  );
+}
+
+/**
+ * Reports a startup reservation, which refuses another daemon launch until it is resolved. Clients resolve it
+ * once the daemon it reserved is ready, so the next command that uses, stops or restarts a ready daemon resolves
+ * a remaining one; status only reports it.
+ */
+function getStartupReservationStatus(paths: IDaemonPaths): {
+  startupReservation?: IDaemonStartupReservationInfo;
+} {
+  const startupReservation: IDaemonStartupReservationInfo | undefined =
+    inspectDaemonStartupReservation(paths);
+  return startupReservation ? { startupReservation } : {};
+}
+
+/** Explains that a remaining startup reservation refuses another daemon launch, and what can resolve it. */
+function explainStartupReservation(error: unknown, paths: IDaemonPaths): unknown {
+  const reservation: IDaemonStartupReservationInfo | undefined = inspectDaemonStartupReservation(paths);
+  if (!reservation || !(error instanceof Error)) return error;
+  const helper: string = `its startup helper (PID ${reservation.helperPid})`;
+  let explanation: string;
+  switch (reservation.helperState) {
+    case 'running':
+      explanation = `A daemon is starting: ${helper} is still waiting for it to become ready; retry shortly.`;
+      break;
+    case 'exited':
+      explanation = `The startup reservation at ${reservation.path} remains, but ${helper} exited before the daemon became ready, so the reservation refuses every automatic start unless that daemon still becomes ready. Check "rush-client daemon logs"; if the daemon failed to start, run "rush-client daemon stop --force" to remove it.`;
+      break;
+    default:
+      explanation = `The startup reservation at ${reservation.path} refuses another daemon launch. Check "rush-client daemon logs"; if no daemon is starting, run "rush-client daemon stop --force" to remove it.`;
   }
+  return new Error(`${error.message} ${explanation}`, { cause: error });
 }
 
 async function restartDaemonAsync(
diff --git a/apps/rush-cli-client/src/daemonConnectionOptions.ts b/apps/rush-cli-client/src/daemonConnectionOptions.ts
index bb87818b85..26f7158a9d 100644
--- a/apps/rush-cli-client/src/daemonConnectionOptions.ts
+++ b/apps/rush-cli-client/src/daemonConnectionOptions.ts
@@ -4,8 +4,15 @@
 import * as fs from 'node:fs';
 
 import { JsonFile } from '@rushstack/node-core-library';
-import type { IConnectOrStartDaemonOptions } from '@rushstack/rush-client-core';
-import { computeDaemonWorkspaceKey, resolveDaemonPathsFromProcess } from '@rushstack/rush-daemon-transport';
+import {
+  assertDaemonRuntimeFolderIsPrivate,
+  type IConnectOrStartDaemonOptions
+} from '@rushstack/rush-client-core';
+import {
+  computeDaemonWorkspaceKey,
+  resolveDaemonPathsFromProcess,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
 import { readDaemonInstallationMetadata } from '@rushstack/rush-daemon/lib/DaemonInstallation';
 import type * as VersionSelectedDaemonLauncherModule from '@rushstack/rush-daemon/lib/VersionSelectedDaemonLauncher';
 
@@ -26,8 +33,13 @@ export function getDaemonConnectionOptions(
       'The synchronous launcher only supports its installed engine; use asynchronous version selection.'
     );
   }
+  const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
+    computeDaemonWorkspaceKey({ canonicalRepoRoot, rushVersion })
+  );
+  // Every daemon command trusts files in this folder: the socket, the lockfile, the log and the reservation.
+  assertDaemonRuntimeFolderIsPrivate(paths);
   return {
-    paths: resolveDaemonPathsFromProcess(computeDaemonWorkspaceKey({ canonicalRepoRoot, rushVersion })),
+    paths,
     expectedDaemonVersion: daemonPackage.version,
     startCommand: autoStart
       ? loadVersionSelectedDaemonLauncher().getSelectedDaemonStartCommand(daemonPackagePath, {
diff --git a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
index 07eb1bd763..ace2ae4152 100644
--- a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
+++ b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
@@ -47,7 +47,7 @@ export function createNativeBuildTestFixture(): INativeBuildTestFixture {
     CI: 'false',
     TF_BUILD: 'false',
     GITHUB_ACTIONS: 'false',
-    XDG_RUNTIME_DIR: folder
+    RUSHD_RUNTIME_DIR: folder
   };
   const invocationClosures: Promise<unknown[]>[] = [];
   const callbacks: Promise<void>[] = [];
diff --git a/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts b/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
index 98daf2fe4d..52e503a603 100644
--- a/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
+++ b/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
@@ -6,6 +6,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { Rush } from '@microsoft/rush-lib';
+import { DaemonClientError } from '@rushstack/rush-client-core';
 import { computeDaemonWorkspaceKey, resolveDaemonPathsFromProcess } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions, getDaemonConnectionOptionsAsync } from '../daemonConnectionOptions';
@@ -48,6 +49,29 @@ describe('version-selected daemon connection options', () => {
     );
   });
 
+  (process.platform === 'win32' ? it.skip : it)(
+    'refuses an unsafe runtime folder before any daemon command uses it',
+    () => {
+      const base: string = path.join(repoRoot, 'runtime');
+      fs.mkdirSync(base);
+      fs.symlinkSync(repoRoot, path.join(base, `rushd-${process.getuid?.()}`));
+      const previous: string | undefined = process.env.RUSHD_RUNTIME_DIR;
+      process.env.RUSHD_RUNTIME_DIR = base;
+      let error: unknown;
+      try {
+        getDaemonConnectionOptions(repoRoot, Rush.version, process.env, false);
+      } catch (thrown) {
+        error = thrown;
+      } finally {
+        if (previous === undefined) delete process.env.RUSHD_RUNTIME_DIR;
+        else process.env.RUSHD_RUNTIME_DIR = previous;
+      }
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect(error).toMatchObject({ code: 'startupFailed' });
+      expect((error as Error).message).toContain('is unsafe: it is a symbolic link');
+    }
+  );
+
   it('does not select or install a launcher for a connect-only invocation', async () => {
     const options = await getDaemonConnectionOptionsAsync(repoRoot, '5.178.1', {}, false);
     expect(options.startCommand).toBeUndefined();
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index 39b091f31f..e8f70172b5 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -18,7 +18,7 @@ import {
   waitForTestProcessExitAsync
 } from '@rushstack/rush-daemon/lib/test/TestProcessExit';
 import { captureTestDaemonListenerAsync } from '@rushstack/rush-daemon/lib/test/TestDaemonListener';
-import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
 import {
@@ -306,6 +306,138 @@ describe('standalone rushx fallback', () => {
     }
   }, 30000);
 
+  it('stop resolves a startup reservation next to a ready daemon so that a later start launches', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    try {
+      const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+      expect(started.code).toBe(0);
+      const { pid }: { pid: number } = JSON.parse(started.stdout);
+      fs.writeFileSync(reservation, 'abandoned');
+      const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop']);
+      expect(stopped).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(stopped.stdout)).toEqual({
+        state: 'shutdownAccepted',
+        socketPath: paths.socketPath,
+        cancelledRequests: 0
+      });
+      expect(fs.existsSync(reservation)).toBe(false);
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+      const restarted: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+      expect(restarted).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(restarted.stdout).pid).not.toBe(pid);
+      expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  it('reports a startup reservation next to a ready daemon, and restart resolves it', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    try {
+      const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+      expect(started.code).toBe(0);
+      const { pid }: { pid: number } = JSON.parse(started.stdout);
+      fs.writeFileSync(reservation, 'abandoned');
+      const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(status).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(status.stdout)).toMatchObject({
+        state: 'ready',
+        pid,
+        startupReservation: { path: reservation, helperState: 'unknown' }
+      });
+      // Status only reports the reservation.
+      expect(fs.readFileSync(reservation, 'utf8')).toBe('abandoned');
+      const restarted: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'restart']);
+      expect(restarted).toMatchObject({ code: 0, stderr: '' });
+      const successor: Record<string, unknown> = JSON.parse(restarted.stdout);
+      expect(successor).toMatchObject({ state: 'ready', pid: expect.any(Number) });
+      expect(successor.pid).not.toBe(pid);
+      expect(successor).not.toHaveProperty('startupReservation');
+      expect(fs.existsSync(reservation)).toBe(false);
+      expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  it.each(['exited', 'running'])(
+    'status explains a startup reservation (helper %s) while no daemon is ready',
+    async (helperState) => {
+      const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+      const reservation: string = `${paths.lockfilePath}.starting`;
+      fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+      let helperPid: number = process.pid;
+      if (helperState === 'exited') {
+        const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+        await once(exited, 'close');
+        helperPid = exited.pid!;
+      }
+      fs.writeFileSync(
+        reservation,
+        JSON.stringify({ token: 'fixture', helperPid, helperStartedAt: new Date().toISOString() })
+      );
+      const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(status).toMatchObject({ code: 1, stdout: '' });
+      expect(status.stderr).toContain('Could not connect to daemon');
+      expect(status.stderr).toContain(
+        helperState === 'exited'
+          ? `its startup helper (PID ${helperPid}) exited before the daemon became ready, so the reservation refuses every automatic start unless that daemon still becomes ready. Check "rush-client daemon logs"; if the daemon failed to start, run "rush-client daemon stop --force" to remove it.`
+          : `A daemon is starting: its startup helper (PID ${helperPid}) is still waiting for it to become ready; retry shortly.`
+      );
+      const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop']);
+      expect(stopped).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(stopped.stdout)).toEqual({
+        state: 'notRunning',
+        socketPath: paths.socketPath,
+        startupReservation: { path: reservation, helperPid, helperState }
+      });
+      const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+      expect(reset).toMatchObject({ code: 0, stderr: '' });
+      expect(JSON.parse(reset.stdout)).toEqual({
+        state: 'reset',
+        socketPath: paths.socketPath,
+        removedPaths: [reservation]
+      });
+    }
+  );
+
+  it('status names a recorded daemon that exited without shutting down', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+    const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+    await once(exited, 'close');
+    const record: IDaemonLockfile = {
+      pid: exited.pid!,
+      protocolVersion: { major: 0, minor: 11 },
+      startedAt: new Date().toISOString(),
+      socketPath: paths.socketPath
+    };
+    try {
+      fs.writeFileSync(paths.lockfilePath, JSON.stringify(record));
+      const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(status).toMatchObject({ code: 1, stdout: '' });
+      expect(status.stderr).toContain(
+        `Could not connect to daemon at ${paths.socketPath}. rushd (PID ${record.pid}) exited without shutting down; "rush-client daemon logs" may show why.`
+      );
+      // A record for another endpoint says nothing about the daemon at this one.
+      fs.writeFileSync(
+        paths.lockfilePath,
+        JSON.stringify({ ...record, socketPath: `${paths.socketPath}.x` })
+      );
+      const other: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+      expect(other).toMatchObject({ code: 1, stdout: '' });
+      expect(other.stderr).toContain('Could not connect to daemon');
+      expect(other.stderr).not.toContain('exited without shutting down');
+    } finally {
+      fs.rmSync(paths.lockfilePath, { force: true });
+    }
+  });
+
   (process.platform === 'win32' ? it.skip : it)(
     'stop --force removes stale artifacts left by a killed daemon',
     async () => {
diff --git a/common/changes/@microsoft/rush/r03-runtime-folder_2026-09-28-17-15.json b/common/changes/@microsoft/rush/r03-runtime-folder_2026-09-28-17-15.json
new file mode 100644
index 0000000000..8112f0cd39
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-runtime-folder_2026-09-28-17-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Temporary and runtime folder variables (`TMPDIR`, `TMP`, `TEMP`, `XDG_RUNTIME_DIR` and `RUSHD_RUNTIME_DIR`) no longer select a different Rush daemon, and a daemon no longer keeps the `TMPDIR` or `XDG_RUNTIME_DIR` of the client that started it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/r03-rush-lib-path-handoff_2026-09-28-13-10.json b/common/changes/@microsoft/rush/r03-rush-lib-path-handoff_2026-09-28-13-10.json
new file mode 100644
index 0000000000..7fb30b2a6a
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-rush-lib-path-handoff_2026-09-28-13-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a source-built rush-lib cannot be found by name from its real path (for example in a `rush deploy` output), spell `_RUSH_LIB_PATH` through the host's `node_modules/@microsoft/rush-lib` link, and load the built-in build cache plugins that the host installs next to that link.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-explain-daemon-crash_2026-09-28-15-52.json b/common/changes/@rushstack/rush-cli-client/r03-explain-daemon-crash_2026-09-28-15-52.json
new file mode 100644
index 0000000000..99273dcc38
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-explain-daemon-crash_2026-09-28-15-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "After a daemon crash, commands and `rush-client daemon status` say that rushd exited and point to `rush-client daemon logs` and `--no-daemon`, instead of only reporting a lost connection.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-runtime-folder_2026-09-28-17-15.json b/common/changes/@rushstack/rush-cli-client/r03-runtime-folder_2026-09-28-17-15.json
new file mode 100644
index 0000000000..04b1a1ca29
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-runtime-folder_2026-09-28-17-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Use one daemon per checkout whatever `TMPDIR` or `XDG_RUNTIME_DIR` a shell, job or service sets; `RUSHD_RUNTIME_DIR` moves its folder from `/tmp/rushd-<uid>`. A runtime folder that is a symbolic link or belongs to another user is refused.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-rush-lib-path-handoff_2026-09-28-13-10.json b/common/changes/@rushstack/rush-cli-client/r03-rush-lib-path-handoff_2026-09-28-13-10.json
new file mode 100644
index 0000000000..690b855dd3
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-rush-lib-path-handoff_2026-09-28-13-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-startup-reservation_2026-09-28-14-25.json b/common/changes/@rushstack/rush-cli-client/r03-startup-reservation_2026-09-28-14-25.json
new file mode 100644
index 0000000000..b79ef158b2
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-startup-reservation_2026-09-28-14-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Report a remaining startup reservation and its helper's state as `startupReservation` in `rush-client daemon status` and `daemon stop`, explain it when status cannot connect, and let `daemon restart` resolve it before it stops the old daemon.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-stop-resolves-reservation_2026-09-28-15-31.json b/common/changes/@rushstack/rush-cli-client/r03-stop-resolves-reservation_2026-09-28-15-31.json
new file mode 100644
index 0000000000..41881f9d8d
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-stop-resolves-reservation_2026-09-28-15-31.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Let `rush-client daemon stop` resolve a startup reservation that remains next to the ready daemon before it stops it, as `daemon restart` does, so that the next start is not refused.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-explain-daemon-crash_2026-09-28-15-52.json b/common/changes/@rushstack/rush-client-core/r03-explain-daemon-crash_2026-09-28-15-52.json
new file mode 100644
index 0000000000..89e95ab426
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-explain-daemon-crash_2026-09-28-15-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When the connection is lost before a result, `executeWithDaemonRestartAsync()` now says whether the daemon process exited, quotes the fatal error that its launcher log recorded, and names `rush-client daemon logs` and `--no-daemon`; the request is still never retried.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-runtime-folder_2026-09-28-17-15.json b/common/changes/@rushstack/rush-client-core/r03-runtime-folder_2026-09-28-17-15.json
new file mode 100644
index 0000000000..c4ecee9621
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-runtime-folder_2026-09-28-17-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Pass the runtime folder to a daemon being started as `RUSHD_RUNTIME_DIR`, and report an unsafe runtime folder as `startupFailed` (`assertDaemonRuntimeFolderIsPrivate`).",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-startup-reservation_2026-09-28-14-25.json b/common/changes/@rushstack/rush-client-core/r03-startup-reservation_2026-09-28-14-25.json
new file mode 100644
index 0000000000..6521eb05aa
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-startup-reservation_2026-09-28-14-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Record the startup helper's PID in the daemon startup reservation, and resolve a reservation that remains next to a ready daemon whose ownership is attested, so that a first start slower than the helper's wait no longer blocks every later start. Refuse another launch at once when the recorded helper has exited, resolve the reservation before an explicit restart's shutdown, and add `inspectDaemonStartupReservation()`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-stop-resolves-reservation_2026-09-28-15-31.json b/common/changes/@rushstack/rush-client-core/r03-stop-resolves-reservation_2026-09-28-15-31.json
new file mode 100644
index 0000000000..7bda75c247
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-stop-resolves-reservation_2026-09-28-15-31.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `resolveDaemonStartupReservationAsync()`, which resolves a startup reservation that remains next to a connected, attested daemon before a caller stops that daemon.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r03-runtime-folder_2026-09-28-17-15.json b/common/changes/@rushstack/rush-daemon-protocol/r03-runtime-folder_2026-09-28-17-15.json
new file mode 100644
index 0000000000..c3d7c9edfb
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r03-runtime-folder_2026-09-28-17-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Advertise protocol minor 12 (`DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR`): clients and daemons meet in `/tmp/rushd-<uid>` (or `$RUSHD_RUNTIME_DIR/rushd-<uid>`) instead of a folder chosen by `XDG_RUNTIME_DIR` or `TMPDIR`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/r03-runtime-folder_2026-09-28-17-15.json b/common/changes/@rushstack/rush-daemon-transport/r03-runtime-folder_2026-09-28-17-15.json
new file mode 100644
index 0000000000..0419d3749d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r03-runtime-folder_2026-09-28-17-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Clients and daemons find each other in `/tmp/rushd-<uid>` (or `$RUSHD_RUNTIME_DIR/rushd-<uid>`) whatever `TMPDIR` or `XDG_RUNTIME_DIR` says. A listener publishes its socket with a hard link and removes its socket and ownership record on close only while they are still its own. The runtime folder must be an owned directory, not a symbolic link, and reapers skip records they do not own.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r03-runtime-folder_2026-09-28-17-15.json b/common/changes/@rushstack/rush-daemon/r03-runtime-folder_2026-09-28-17-15.json
new file mode 100644
index 0000000000..f061cf5f73
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r03-runtime-folder_2026-09-28-17-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Listen in `/tmp/rushd-<uid>` (or `$RUSHD_RUNTIME_DIR/rushd-<uid>`), where current clients look, instead of in `$XDG_RUNTIME_DIR` or the temporary folder.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r03-rush-lib-path-handoff_2026-09-28-13-10.json b/common/changes/@rushstack/rush-daemon/r03-rush-lib-path-handoff_2026-09-28-13-10.json
new file mode 100644
index 0000000000..66ec1f2f82
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r03-rush-lib-path-handoff_2026-09-28-13-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep the selected engine's own spelling of `_RUSH_LIB_PATH` when it names the same rush-lib, so plugins in a deployed daemon can resolve rush-lib by name.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/config/rush/deploy-rush-daemon-dogfood.json b/common/config/rush/deploy-rush-daemon-dogfood.json
index c83062bf53..e30a102fe0 100644
--- a/common/config/rush/deploy-rush-daemon-dogfood.json
+++ b/common/config/rush/deploy-rush-daemon-dogfood.json
@@ -11,5 +11,38 @@
 {
   "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/deploy-scenario.schema.json",
 
-  "deploymentProjectNames": ["@rushstack/rush-cli-client"]
+  "deploymentProjectNames": ["@rushstack/rush-cli-client"],
+
+  /**
+   * A published @microsoft/rush-lib depends on its built-in build cache plugins. The source-built copy lists them
+   * in "publishOnlyDependencies" instead, and loads them from next to the rush-lib link of the host script that
+   * loaded it: @microsoft/rush (the in-process fallback), rush-client (when it loads rush-lib before handing off
+   * to @microsoft/rush) and rush-daemon. Each of these hosts declares the plugins as devDependencies.
+   */
+  "projectSettings": [
+    {
+      "projectName": "@microsoft/rush",
+      "additionalDependenciesToInclude": [
+        "@rushstack/rush-amazon-s3-build-cache-plugin",
+        "@rushstack/rush-azure-storage-build-cache-plugin",
+        "@rushstack/rush-http-build-cache-plugin"
+      ]
+    },
+    {
+      "projectName": "@rushstack/rush-cli-client",
+      "additionalDependenciesToInclude": [
+        "@rushstack/rush-amazon-s3-build-cache-plugin",
+        "@rushstack/rush-azure-storage-build-cache-plugin",
+        "@rushstack/rush-http-build-cache-plugin"
+      ]
+    },
+    {
+      "projectName": "@rushstack/rush-daemon",
+      "additionalDependenciesToInclude": [
+        "@rushstack/rush-amazon-s3-build-cache-plugin",
+        "@rushstack/rush-azure-storage-build-cache-plugin",
+        "@rushstack/rush-http-build-cache-plugin"
+      ]
+    }
+  ]
 }
diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml
index 2d4e19dd39..9254358cf5 100644
--- a/common/config/subspaces/default/pnpm-lock.yaml
+++ b/common/config/subspaces/default/pnpm-lock.yaml
@@ -451,6 +451,15 @@ importers:
       '@rushstack/heft':
         specifier: workspace:*
         version: link:../heft
+      '@rushstack/rush-amazon-s3-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-amazon-s3-build-cache-plugin
+      '@rushstack/rush-azure-storage-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-azure-storage-build-cache-plugin
+      '@rushstack/rush-http-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-http-build-cache-plugin
       eslint:
         specifier: ~9.37.0
         version: 9.37.0
@@ -4197,6 +4206,15 @@ importers:
       '@rushstack/heft':
         specifier: workspace:*
         version: link:../../apps/heft
+      '@rushstack/rush-amazon-s3-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-amazon-s3-build-cache-plugin
+      '@rushstack/rush-azure-storage-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-azure-storage-build-cache-plugin
+      '@rushstack/rush-http-build-cache-plugin':
+        specifier: workspace:*
+        version: link:../../rush-plugins/rush-http-build-cache-plugin
       eslint:
         specifier: ~9.37.0
         version: 9.37.0
@@ -4817,7 +4835,7 @@ importers:
         version: 1.3.1(@types/node@20.17.19)
       '@rushstack/heft-node-rig':
         specifier: 2.11.51
-        version: 2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)
+        version: 2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)
       '@types/jest':
         specifier: 30.0.0
         version: 30.0.0
@@ -24938,7 +24956,7 @@ snapshots:
     transitivePeerDependencies:
       - '@types/node'
 
-  '@rushstack/heft-jest-plugin@2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)':
+  '@rushstack/heft-jest-plugin@2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)':
     dependencies:
       '@jest/core': 30.3.0(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))
       '@jest/reporters': 30.3.0
@@ -24971,13 +24989,13 @@ snapshots:
     transitivePeerDependencies:
       - '@types/node'
 
-  '@rushstack/heft-node-rig@2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)':
+  '@rushstack/heft-node-rig@2.11.51(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)':
     dependencies:
       '@microsoft/api-extractor': 7.59.2(@types/node@20.17.19)
       '@rushstack/eslint-config': 4.8.0(eslint@9.37.0)(typescript@5.8.2)
       '@rushstack/heft': 1.3.1(@types/node@20.17.19)
       '@rushstack/heft-api-extractor-plugin': 1.3.28(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)
-      '@rushstack/heft-jest-plugin': 2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(babel-plugin-macros@3.1.0)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)
+      '@rushstack/heft-jest-plugin': 2.0.18(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/jest@30.0.0)(@types/node@20.17.19)(esbuild-register@3.6.0(esbuild@0.28.0))(jest-environment-jsdom@30.3.0)(jest-environment-node@30.3.0)
       '@rushstack/heft-lint-plugin': 1.3.0(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)
       '@rushstack/heft-typescript-plugin': 1.3.23(@rushstack/heft@1.3.1(@types/node@20.17.19))(@types/node@20.17.19)
       '@types/jest': 30.0.0
diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json
index 7b9bfa0d93..c4bdac4d9b 100644
--- a/common/config/subspaces/default/repo-state.json
+++ b/common/config/subspaces/default/repo-state.json
@@ -1,5 +1,5 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "85270521602b3b33e51d632eb11e4defdabae46d",
+  "pnpmShrinkwrapHash": "0bba018dc100225f133b4d52644f2ce57c457132",
   "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c"
 }
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 465a2ce471..4a07758b95 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -16,6 +16,9 @@ import { IDaemonRequestRejectedMessage } from '@rushstack/rush-daemon-protocol';
 import { IDaemonShutdownAckMessage } from '@rushstack/rush-daemon-protocol';
 import type { Readable } from 'node:stream';
 
+// @beta
+export function assertDaemonRuntimeFolderIsPrivate(paths: IDaemonPaths): void;
+
 // @beta
 export function captureDaemonRequest(options: ICaptureDaemonRequestOptions): IDaemonRequestEnvelope;
 
@@ -57,6 +60,9 @@ export type DaemonClientOutcome = {
     readonly rejection: IDaemonRequestRejectedMessage['payload'];
 };
 
+// @beta
+export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
+
 // @beta
 export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, execution: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
 
@@ -139,10 +145,23 @@ export interface IDaemonStartCommand {
     readonly environment: Readonly<Record<string, string>>;
 }
 
+// @beta
+export interface IDaemonStartupReservationInfo {
+    readonly helperPid?: number;
+    readonly helperState: DaemonStartupHelperState;
+    readonly path: string;
+}
+
+// @beta
+export function inspectDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservationInfo | undefined;
+
 // @beta
 export function requestDaemonShutdownAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<Pick<IDaemonLockfile, 'pid' | 'startedAt'>>;
 
 // @beta
 export function resetDaemonArtifactsAsync(paths: IDaemonPaths, options?: IDaemonArtifactResetOptions): Promise<IDaemonArtifactResetResult>;
 
+// @beta
+export function resolveDaemonStartupReservationAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<boolean>;
+
 ```
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index a00763848c..1747837712 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -79,6 +79,9 @@ export const DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR: number;
 // @beta
 export const DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR: number;
 
+// @beta
+export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number;
+
 // @beta
 export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number;
 
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index adb1942b0d..df4aaef215 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -8,12 +8,18 @@ import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 import type * as net from 'node:net';
 
+// @beta
+export function assertDaemonRuntimeDirIsPrivate(paths: IDaemonPaths): void;
+
 // @beta
 export function computeDaemonWorkspaceKey(input: IWorkspaceKeyInput): string;
 
 // @beta
 export function connectDaemonAsync(socketPath: string, options?: IDaemonConnectorOptions): Promise<DaemonFrameConnection>;
 
+// @beta
+export const DAEMON_RUNTIME_DIR_ENV_VAR: 'RUSHD_RUNTIME_DIR';
+
 // @beta
 export class DaemonFrameConnection {
     constructor(socket: net.Socket);
@@ -53,7 +59,8 @@ export enum DaemonTransportErrorCode {
     connectionRefused = "connectionRefused",
     connectionTimeout = "connectionTimeout",
     daemonAlreadyRunning = "daemonAlreadyRunning",
-    transportClosed = "transportClosed"
+    transportClosed = "transportClosed",
+    unsafeRuntimeDirectory = "unsafeRuntimeDirectory"
 }
 
 // @beta
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 7cd51776c7..9a5c3d282d 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -55,8 +55,11 @@ workspace, run the following from the repository root. It must print a path unde
 node -p "require('fs').realpathSync(require.resolve('@microsoft/rush-lib', { paths: [require('path').resolve('common/temp/rush-daemon-dogfood/apps/rush-cli-client')] }))"
 ```
 
-The built-in cloud build-cache plugins are not part of the snapshot. That is fine for this repository, whose
-build cache is `local-only`.
+The snapshot also contains Rush's built-in cloud build-cache plugins (`amazon-s3`, `azure-blob-storage` and
+`http`), next to the `@microsoft/rush-lib` links of `@microsoft/rush`, `rush-client` and the daemon. A source-built rush-lib loads them
+from there, and it points `_RUSH_LIB_PATH` at that same link. So plugins that resolve `@microsoft/rush-lib` by name
+from `_RUSH_LIB_PATH` work in both the daemon and the in-process fallback. This repository's own build cache is
+`local-only`, so it doesn't need them.
 
 ## 3. Opt in and build
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index f2a1389416..3d3c57504a 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -41,13 +41,30 @@ returns a `restartRetriesExhausted` fallback outcome so the caller can run in-pr
 Cancellation stops waiting without killing a daemon. Disabling auto-start still
 permits waiting for a host-started successor, but never lets the client spawn one.
 
+A connection lost before the result stays a `disconnected` `DaemonClientError`. Its message
+starts with "Daemon disconnected before delivering a result; the command was not retried."
+and `executeWithDaemonRestartAsync()` appends what happened to the daemon that served the
+attempt, identified by its pong PID. If that process exited within about a second (on Linux,
+an exited process that is not reaped yet counts), the message names the PID, `rush-client
+daemon logs` and `--no-daemon` (`rushx-client` for Rushx requests), and adds a second line
+with the first fatal error that `<lockfilePath>.log` gained after the request was sent: a
+Node.js uncaught-exception report or a V8 `FATAL ERROR:` line, clipped to one printable line.
+If the process still runs, the message says that only the connection closed. After the abort
+signal fires, the error is unchanged, so the caller reports the cancellation.
+
 `connectOrStartDaemonAsync()` accepts an **explicit, version-selected** executable,
 arguments, environment and cwd. It does not discover or install a Rush version.
+It adds `RUSHD_RUNTIME_DIR`, set to the base of `paths.runtimeDir`, to that environment, so the
+daemon resolves the same paths as its clients whatever environment it inherits.
+A runtime folder that is a symbolic link, is not a directory or belongs to another user is
+refused as `startupFailed` before anything in it is trusted
+(`assertDaemonRuntimeFolderIsPrivate()`); one that others can open is made owner-only.
 It reuses transport paths/reclaim checks and node-core-library's process-identity
 aware `LockFile` for the first-start mutex, including kernel-enforced exclusive
 file sharing on Windows. The winning client rechecks readiness,
-reclaims only an absent/dead owner, and reserves `<lockfilePath>.starting` before
-handing the explicit command to a detached startup helper. The helper spawns without
+reclaims only an absent/dead owner, spawns a detached startup helper, and reserves
+`<lockfilePath>.starting` for it (recording the helper's PID and start time) before
+handing it the explicit command. The helper spawns the launcher without
 a shell and retains that reservation until the daemon completes hello/ping readiness,
 independently of whether the requesting client survives. It waits for a live launcher for
 at least 120 seconds, even when the requesting client's own deadline is shorter, so a slow
@@ -73,6 +90,23 @@ Recovery of an abandoned reservation requires operator confirmation that the ori
 startup cannot still publish an endpoint; normal successful startup releases it
 automatically. Cancellation stops the client waiting, not the detached handoff.
 
+A client resolves a reservation on the same evidence the helper waits for, so a daemon
+that became ready after its helper stopped waiting (for example a first start slower than
+120 seconds) is still used: holding the start mutex, the client needs a daemon that
+completes hello/ping at the endpoint and whose pong PID is the live owner in the
+ownership record for that socket, and it removes the reservation only if it is unchanged.
+Reservations written by older clients, without a helper, are resolved the same way.
+The recorded helper decides how long a refused launch waits: while it is alive, a starting
+client waits for it until the client's own deadline; once it is provably gone (its PID
+no longer exists or was reused), nothing else can release the reservation, so clients
+refuse another launch at once. `inspectDaemonStartupReservation(paths)` reports the
+reservation and its helper's state without changing it (`rush-client daemon status`), and
+`requestDaemonShutdownAsync()` resolves a reservation for the attested daemon before it
+sends shutdown, so that its successor can start. `resolveDaemonStartupReservationAsync(client,
+paths)` does the same for a caller that stops the daemon without replacing it (`rush-client
+daemon stop`): it returns false and keeps the reservation when the daemon is not the attested
+owner, the reservation changed, or another client holds the start mutex past the timeout.
+
 If a wire-compatible daemon reports the wrong implementation version and an explicit
 replacement launcher is available, startup serializes replacement under that same mutex.
 It verifies the old endpoint's attested ownership, requests shutdown, waits for ownership
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 9cdc0e5b21..2e7b2831c4 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -30,7 +30,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import { connectDaemonAsync, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
-import { DaemonClientError } from './DaemonClientError';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientError';
 
 const MAX_STDIN_CHUNK_BYTES: number = 64 * 1024;
 
@@ -138,7 +138,7 @@ export class DaemonClient {
             'disconnected',
             this.#shutdown
               ? 'Daemon disconnected before acknowledging shutdown.'
-              : 'Daemon disconnected before delivering a result; the command was not retried.'
+              : DAEMON_DISCONNECTED_MESSAGE
           )
       );
     });
diff --git a/libraries/rush-client-core/src/DaemonClientError.ts b/libraries/rush-client-core/src/DaemonClientError.ts
index 09b21b881f..3b32286fa8 100644
--- a/libraries/rush-client-core/src/DaemonClientError.ts
+++ b/libraries/rush-client-core/src/DaemonClientError.ts
@@ -4,6 +4,10 @@
 /** A failure before readiness, or a connection lost without an authoritative result. @beta */
 export type DaemonClientErrorCode = 'timeout' | 'versionMismatch' | 'disconnected' | 'startupFailed';
 
+/** Guidance and tools match this sentence, so explanations of a lost connection are appended after it. */
+export const DAEMON_DISCONNECTED_MESSAGE: string =
+  'Daemon disconnected before delivering a result; the command was not retried.';
+
 /** An actionable client failure. Never replay a request following a disconnect. @beta */
 export class DaemonClientError extends Error {
   public readonly code: DaemonClientErrorCode;
diff --git a/libraries/rush-client-core/src/DaemonDisconnect.ts b/libraries/rush-client-core/src/DaemonDisconnect.ts
new file mode 100644
index 0000000000..14ad575411
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonDisconnect.ts
@@ -0,0 +1,185 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from './DaemonClient';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientError';
+import { getDaemonLogFilePath } from './DaemonLogFile';
+import { isOwnerProcessAlive } from './DaemonOwnership';
+import { isProcessDefunct } from './ProcessStartTime';
+
+/** A process closes its connections while it exits, so it can briefly outlive them. */
+const EXIT_WAIT_MS: number = 1000;
+const EXIT_POLL_INTERVAL_MS: number = 20;
+/** A crash report is the last thing a daemon writes; a successor started since then writes little. */
+const MAX_LOG_READ_BYTES: number = 64 * 1024;
+const MAX_LOGGED_ERROR_LENGTH: number = 240;
+
+const V8_FATAL_ERROR: RegExp = /^FATAL ERROR: \S/;
+const NODE_REPORT_TRAILER: RegExp = /^Node\.js v\d+\.\d+\.\d+/;
+const SOURCE_LOCATION: RegExp = /:\d+$/;
+const SOURCE_ARROW: RegExp = /^\s*\^[\^~]*\s*$/;
+const STACK_FRAME: RegExp = /^\s+at /;
+const TRACE_UNCAUGHT_HINT: string = '(Use `node --trace-uncaught';
+const CONTROL_CHARACTERS: RegExp = /\p{Cc}/gu;
+
+/** The daemon process that serves a request, and the size of its launcher log when the request was sent. */
+export interface IServingDaemon {
+  readonly pid: number;
+  /** The ownership record's start time when the record names this process; it detects a reused PID. */
+  readonly startedAt: string | undefined;
+  readonly logFilePath: string;
+  readonly logOffset: number | undefined;
+}
+
+/** Identifies the daemon behind a ready client, or returns undefined for a peer that does not report its PID. */
+export async function observeServingDaemonAsync(
+  client: DaemonClient,
+  paths: IDaemonPaths
+): Promise<IServingDaemon | undefined> {
+  const { pid } = await client.status;
+  if (pid === undefined) return undefined;
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
+  const logFilePath: string = getDaemonLogFilePath(paths);
+  return {
+    pid,
+    startedAt: owner?.pid === pid ? owner.startedAt : undefined,
+    logFilePath,
+    logOffset: tryGetFileSize(logFilePath)
+  };
+}
+
+/**
+ * Explains a connection lost before a request's result by what happened to the daemon process: whether it
+ * exited, the fatal error its launcher log recorded, and how to recover. The request is never replayed.
+ * Other errors are returned unchanged.
+ */
+export async function explainLostConnectionAsync(
+  error: unknown,
+  daemon: IServingDaemon | undefined,
+  request: IDaemonRequestEnvelope
+): Promise<unknown> {
+  if (!daemon || !isConnectionLoss(error)) return error;
+  const exited: boolean | undefined = await waitForExitAsync(daemon);
+  if (exited === undefined) return error;
+  if (!exited) {
+    return new DaemonClientError(
+      'disconnected',
+      `${DAEMON_DISCONNECTED_MESSAGE} The connection to rushd (PID ${daemon.pid}) closed, but the daemon is still running; run the command again.`,
+      { cause: error }
+    );
+  }
+  const loggedError: string | undefined = readLoggedFatalError(daemon);
+  const client: string = request.invocationKind === 'rushx' ? 'rushx-client' : 'rush-client';
+  const message: string =
+    `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${daemon.pid}) exited while it ran the command; ` +
+    `"rush-client daemon logs" ${loggedError ? 'shows' : 'may show'} why. Run the command again; ` +
+    `if the daemon exits again, run the command with "${client} --no-daemon".`;
+  return new DaemonClientError(
+    'disconnected',
+    loggedError ? `${message}\nThe daemon log reports: ${loggedError}` : message,
+    { cause: error }
+  );
+}
+
+/**
+ * Returns the first fatal error in launcher log lines: V8's `FATAL ERROR:` line, or the message of Node's report
+ * of an uncaught exception (its location, source line and caret, the error with its stack, then the Node.js
+ * version). Returns undefined when the first report does not have that shape.
+ */
+export function findLoggedFatalError(lines: ReadonlyArray<string>): string | undefined {
+  for (let index: number = 0; index < lines.length; index++) {
+    if (V8_FATAL_ERROR.test(lines[index])) return lines[index].trim();
+    if (NODE_REPORT_TRAILER.test(lines[index])) return findUncaughtErrorMessage(lines, index);
+  }
+  return undefined;
+}
+
+function findUncaughtErrorMessage(lines: ReadonlyArray<string>, trailer: number): string | undefined {
+  let arrow: number = trailer - 1;
+  while (arrow >= 2 && !SOURCE_ARROW.test(lines[arrow])) arrow--;
+  if (arrow < 2 || !SOURCE_LOCATION.test(lines[arrow - 2])) return undefined;
+  const message: string[] = [];
+  for (let index: number = arrow + 1; index < trailer && !STACK_FRAME.test(lines[index]); index++) {
+    const line: string = lines[index].trim();
+    if (line && !line.startsWith(TRACE_UNCAUGHT_HINT)) message.push(line);
+  }
+  return message.length ? message.join(' ') : undefined;
+}
+
+function isConnectionLoss(error: unknown): boolean {
+  if (error instanceof DaemonClientError) return error.code === 'disconnected';
+  if (error instanceof DaemonTransportError) return error.code === DaemonTransportErrorCode.transportClosed;
+  const code: unknown =
+    typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+  return code === 'ECONNRESET' || code === 'EPIPE';
+}
+
+/** Resolves true once the process is gone, false if it still runs after the wait, or undefined if unknown. */
+async function waitForExitAsync(daemon: IServingDaemon): Promise<boolean | undefined> {
+  const deadline: number = Date.now() + EXIT_WAIT_MS;
+  for (;;) {
+    try {
+      if (!isOwnerProcessAlive(daemon) || isProcessDefunct(daemon.pid)) return true;
+    } catch {
+      // For example EPERM: the PID exists but cannot be inspected.
+      return undefined;
+    }
+    if (Date.now() >= deadline) return false;
+    await delayAsync(EXIT_POLL_INTERVAL_MS);
+  }
+}
+
+/** The fatal error that the launcher log gained since the request was sent, clipped to one printable line. */
+function readLoggedFatalError(daemon: IServingDaemon): string | undefined {
+  if (daemon.logOffset === undefined) return undefined;
+  const text: string | undefined = readLogTail(daemon.logFilePath, daemon.logOffset);
+  const loggedError: string | undefined = text && findLoggedFatalError(text.split(/\r?\n/));
+  if (!loggedError) return undefined;
+  const printable: string = loggedError.replace(CONTROL_CHARACTERS, '');
+  return printable.length > MAX_LOGGED_ERROR_LENGTH
+    ? `${printable.slice(0, MAX_LOGGED_ERROR_LENGTH - 1)}…`
+    : printable;
+}
+
+/** Reads at most the last {@link MAX_LOG_READ_BYTES} after `offset`; undefined when the log cannot be read. */
+function readLogTail(logFilePath: string, offset: number): string | undefined {
+  let fd: number | undefined;
+  try {
+    fd = fs.openSync(
+      logFilePath,
+      // These distinct native flags have non-overlapping values.
+      fs.constants.O_RDONLY +
+        (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK)
+    );
+    const stats: fs.Stats = fs.fstatSync(fd);
+    if (!stats.isFile() || stats.size < offset) return undefined;
+    const start: number = Math.max(offset, stats.size - MAX_LOG_READ_BYTES);
+    const buffer: Buffer = Buffer.alloc(stats.size - start);
+    return buffer.toString('utf8', 0, fs.readSync(fd, buffer, 0, buffer.length, start));
+  } catch {
+    return undefined;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function tryGetFileSize(filePath: string): number | undefined {
+  try {
+    const stats: fs.Stats = fs.statSync(filePath);
+    return stats.isFile() ? stats.size : undefined;
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index a7226d0ee9..c48949b75f 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -18,7 +18,7 @@ const RESET_RETRY_MS: number = 100;
 
 /** Printed wherever automatic recovery fails closed. */
 export const DAEMON_RESET_HINT: string =
-  'If no daemon is running for this workspace, run "rush-client daemon stop --force" to remove its stale files.';
+  'If "rush-client daemon status" cannot connect, run "rush-client daemon stop --force" to remove this workspace\'s stale daemon files.';
 
 export type DaemonOwnership = Pick<IDaemonLockfile, 'pid' | 'startedAt'>;
 
diff --git a/libraries/rush-client-core/src/DaemonRuntimeFolder.ts b/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
new file mode 100644
index 0000000000..3d5694fc55
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
@@ -0,0 +1,60 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  assertDaemonRuntimeDirIsPrivate,
+  ensureDaemonRuntimeDir,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from './DaemonClientError';
+
+function toClientError(error: unknown): unknown {
+  return error instanceof DaemonTransportError &&
+    error.code === DaemonTransportErrorCode.unsafeRuntimeDirectory
+    ? new DaemonClientError('startupFailed', error.message, { cause: error })
+    : error;
+}
+
+/**
+ * Checks the daemon runtime folder, when it exists, before a client trusts the socket, lockfile or log inside
+ * it (see `assertDaemonRuntimeDirIsPrivate` in `@rushstack/rush-daemon-transport`).
+ *
+ * @throws {@link DaemonClientError} with code `startupFailed` when the folder is unsafe, so that a caller that
+ * falls back to in-process Rush for startup failures also does so here.
+ *
+ * @beta
+ */
+export function assertDaemonRuntimeFolderIsPrivate(paths: IDaemonPaths): void {
+  try {
+    assertDaemonRuntimeDirIsPrivate(paths);
+  } catch (error) {
+    throw toClientError(error);
+  }
+}
+
+/** Creates and checks the runtime folder, reporting an unsafe one as {@link assertDaemonRuntimeFolderIsPrivate} does. */
+export function ensureDaemonRuntimeFolder(paths: IDaemonPaths): void {
+  try {
+    ensureDaemonRuntimeDir(paths);
+  } catch (error) {
+    throw toClientError(error);
+  }
+}
+
+/**
+ * Adds the base of the runtime folder that this client looks in to a daemon's start environment, so the daemon
+ * listens there whatever `XDG_RUNTIME_DIR`, `TMPDIR` or `RUSHD_RUNTIME_DIR` it would otherwise inherit.
+ */
+export function withDaemonRuntimeFolder(
+  environment: Readonly<Record<string, string>>,
+  paths: IDaemonPaths
+): Readonly<Record<string, string>> {
+  if (paths.runtimeDir === undefined) return environment;
+  return { ...environment, [DAEMON_RUNTIME_DIR_ENV_VAR]: path.dirname(paths.runtimeDir) };
+}
diff --git a/libraries/rush-client-core/src/DaemonStartup.ts b/libraries/rush-client-core/src/DaemonStartup.ts
index 8fcd8e8477..56b01abdd4 100644
--- a/libraries/rush-client-core/src/DaemonStartup.ts
+++ b/libraries/rush-client-core/src/DaemonStartup.ts
@@ -24,31 +24,138 @@ export interface IDaemonStartupOptions {
   readonly timeoutMs: number;
 }
 
+/**
+ * The detached startup helper recorded in a reservation. Only this process releases the reservation after
+ * readiness, so once it is provably gone, waiting for it cannot help.
+ */
+export interface IDaemonStartupHelper {
+  readonly pid: number;
+  /** Recorded after the helper was spawned, so a later process that reuses the PID is detectable. */
+  readonly startedAt: string;
+}
+
+/** A startup reservation as found on disk. */
+export interface IDaemonStartupReservation {
+  /** The exact contents, compared before removal; undefined when the entry cannot be read as a file. */
+  readonly contents: string | undefined;
+  /** Undefined for a reservation that does not record a helper, for example one written by an older client. */
+  readonly helper: IDaemonStartupHelper | undefined;
+}
+
+interface IDaemonStartupRecord {
+  readonly token: string;
+  readonly helperPid: number;
+  readonly helperStartedAt: string;
+}
+
 export function getDaemonStartupFilePath(paths: IDaemonPaths): string {
   return `${paths.lockfilePath}.starting`;
 }
 
-export function reserveDaemonStartup(paths: IDaemonPaths): string {
+/**
+ * Reserves startup for a spawned helper that has not yet received its options, so the reservation names
+ * the helper before any launcher can start.
+ */
+export function reserveDaemonStartup(paths: IDaemonPaths, helper: IDaemonStartupHelper): string {
   const token: string = randomUUID();
-  fs.writeFileSync(getDaemonStartupFilePath(paths), token, { flag: 'wx', mode: 0o600 });
+  const record: IDaemonStartupRecord = { token, helperPid: helper.pid, helperStartedAt: helper.startedAt };
+  fs.writeFileSync(getDaemonStartupFilePath(paths), JSON.stringify(record), { flag: 'wx', mode: 0o600 });
   return token;
 }
 
+export function readDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservation | undefined {
+  const filePath: string = getDaemonStartupFilePath(paths);
+  let contents: string;
+  try {
+    contents = fs.readFileSync(filePath, 'utf8');
+  } catch (error) {
+    // Any other entry (for example a directory or a dangling link) still refuses another launch.
+    return isNotFound(error) && !fs.lstatSync(filePath, { throwIfNoEntry: false })
+      ? undefined
+      : { contents: undefined, helper: undefined };
+  }
+  const record: IDaemonStartupRecord | undefined = parseStartupRecord(contents);
+  return {
+    contents,
+    helper: record && { pid: record.helperPid, startedAt: record.helperStartedAt }
+  };
+}
+
+/**
+ * Removes `reservation` unless it changed since it was read, and reports whether it is gone.
+ * The caller must hold the start mutex, so the only concurrent change is the helper's own release.
+ */
+export function removeDaemonStartupIfUnchanged(
+  paths: IDaemonPaths,
+  reservation: IDaemonStartupReservation
+): boolean {
+  const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!current) return true;
+  if (reservation.contents === undefined || current.contents !== reservation.contents) return false;
+  unlinkIfPresent(getDaemonStartupFilePath(paths));
+  return true;
+}
+
 function assertReservation(paths: IDaemonPaths, token: string): void {
-  if (fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8') !== token) {
+  const contents: string = fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8');
+  if (parseStartupRecord(contents)?.token !== token) {
     throw new DaemonClientError('startupFailed', 'The daemon startup reservation changed ownership.');
   }
 }
 
+/**
+ * Releases the helper's own reservation. A missing reservation is already resolved: clients remove one only
+ * under the start mutex, after the same readiness evidence the helper waits for.
+ */
 export function releaseDaemonStartup(paths: IDaemonPaths, token: string): void {
-  assertReservation(paths, token);
-  fs.unlinkSync(getDaemonStartupFilePath(paths));
+  try {
+    assertReservation(paths, token);
+  } catch (error) {
+    if (isNotFound(error)) return;
+    throw error;
+  }
+  unlinkIfPresent(getDaemonStartupFilePath(paths));
+}
+
+function parseStartupRecord(contents: string): IDaemonStartupRecord | undefined {
+  let record: unknown;
+  try {
+    record = JSON.parse(contents);
+  } catch {
+    return undefined;
+  }
+  if (typeof record !== 'object' || record === null) return undefined;
+  const { token, helperPid, helperStartedAt } = record as Partial<
+    Record<keyof IDaemonStartupRecord, unknown>
+  >;
+  return typeof token === 'string' &&
+    typeof helperPid === 'number' &&
+    Number.isSafeInteger(helperPid) &&
+    helperPid > 0 &&
+    typeof helperStartedAt === 'string' &&
+    Number.isFinite(Date.parse(helperStartedAt))
+    ? { token, helperPid, helperStartedAt }
+    : undefined;
+}
+
+function unlinkIfPresent(filePath: string): void {
+  try {
+    fs.unlinkSync(filePath);
+  } catch (error) {
+    if (!isNotFound(error)) throw error;
+  }
+}
+
+function isNotFound(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
 }
 
 /**
  * Runs independently of the requesting client. Once spawn succeeds, only protocol readiness releases
  * the reservation: an arbitrary launcher may outlive its parent or spawn descendants.
  * Failure before readiness deliberately leaves a durable reservation instead of guessing that a PID is safe.
+ * The reservation records this helper, so once it exits, later clients report the retained reservation at once
+ * instead of waiting for a release that cannot happen.
  */
 export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Promise<void> {
   const { paths, startCommand: start, token, timeoutMs } = options;
diff --git a/libraries/rush-client-core/src/DaemonStartupReservation.ts b/libraries/rush-client-core/src/DaemonStartupReservation.ts
new file mode 100644
index 0000000000..301a21cff6
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonStartupReservation.ts
@@ -0,0 +1,114 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  readDaemonLockfile,
+  type IDaemonLockfile,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from './DaemonClient';
+import { isDaemonOwnership, isOwnerProcessAlive } from './DaemonOwnership';
+import {
+  getDaemonStartupFilePath,
+  readDaemonStartupReservation,
+  removeDaemonStartupIfUnchanged,
+  type IDaemonStartupHelper,
+  type IDaemonStartupReservation
+} from './DaemonStartup';
+import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+
+/**
+ * What a startup reservation's recorded helper can still do. `running`: it may still release the reservation.
+ * `exited`: it is provably gone, so only a client that finds the daemon ready, or
+ * `resetDaemonArtifactsAsync()`, removes the reservation. `unknown`: the reservation records no helper,
+ * for example because an older client wrote it.
+ * @beta
+ */
+export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
+
+/** A daemon startup reservation (`<lockfilePath>.starting`), as reported by diagnostics. @beta */
+export interface IDaemonStartupReservationInfo {
+  /** The reservation file. */
+  readonly path: string;
+  /** The detached startup helper that releases the reservation once the daemon is ready, when recorded. */
+  readonly helperPid?: number;
+  /** Whether the helper can still release the reservation. */
+  readonly helperState: DaemonStartupHelperState;
+}
+
+/**
+ * Reads this workspace's startup reservation without changing it.
+ * @returns `undefined` when no reservation exists.
+ * @beta
+ */
+export function inspectDaemonStartupReservation(
+  paths: IDaemonPaths
+): IDaemonStartupReservationInfo | undefined {
+  const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!reservation) return undefined;
+  const { helper } = reservation;
+  return {
+    path: getDaemonStartupFilePath(paths),
+    ...(helper ? { helperPid: helper.pid } : {}),
+    helperState: getStartupHelperState(reservation)
+  };
+}
+
+export function getStartupHelperState(reservation: IDaemonStartupReservation): DaemonStartupHelperState {
+  if (!reservation.helper) return 'unknown';
+  return isStartupHelperAlive(reservation.helper) ? 'running' : 'exited';
+}
+
+function isStartupHelperAlive(helper: IDaemonStartupHelper): boolean {
+  try {
+    return isOwnerProcessAlive(helper);
+  } catch {
+    // For example EPERM: the PID exists but belongs to another user, so the helper cannot be shown to be gone.
+    return true;
+  }
+}
+
+/**
+ * Removes a retained startup reservation on the evidence that its helper waits for: a daemon that completed
+ * hello/ping at this endpoint. This also requires `pid` to be the live owner in the ownership record, so the
+ * endpoint cannot be handed to a second launch. The caller must hold the start mutex; a reservation made
+ * after this check is never removed.
+ * @returns true when no reservation remains.
+ */
+export function resolveStartupReservationForReadyDaemon(
+  paths: IDaemonPaths,
+  pid: number | undefined
+): boolean {
+  const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!reservation) return true;
+  if (pid === undefined || !isAttestedDaemonOwner(paths, pid)) return false;
+  return removeDaemonStartupIfUnchanged(paths, reservation);
+}
+
+/**
+ * {@link resolveStartupReservationForReadyDaemon} for a connected client, taking the start mutex without waiting.
+ * Returns false, keeping the reservation, while another client or this process holds the mutex.
+ */
+export async function tryResolveStartupReservationAsync(
+  client: DaemonClient,
+  paths: IDaemonPaths
+): Promise<boolean> {
+  const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+  if (!lock) return false;
+  try {
+    return resolveStartupReservationForReadyDaemon(paths, (await client.status).pid);
+  } finally {
+    await lock.releaseAsync();
+  }
+}
+
+function isAttestedDaemonOwner(paths: IDaemonPaths, pid: number): boolean {
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
+  if (!isDaemonOwnership(owner) || owner.pid !== pid || owner.socketPath !== paths.socketPath) return false;
+  try {
+    return isOwnerProcessAlive(owner);
+  } catch {
+    return false;
+  }
+}
diff --git a/libraries/rush-client-core/src/ProcessStartTime.ts b/libraries/rush-client-core/src/ProcessStartTime.ts
index a258752e5d..b2d318507b 100644
--- a/libraries/rush-client-core/src/ProcessStartTime.ts
+++ b/libraries/rush-client-core/src/ProcessStartTime.ts
@@ -6,6 +6,7 @@ import { performance } from 'node:perf_hooks';
 
 // USER_HZ is fixed at 100 on mainstream Linux ABIs; it is verified against this process before use.
 const USER_HZ: number = 100;
+const PROC_STAT_STATE_FIELD: number = 3;
 const PROC_STAT_START_TIME_FIELD: number = 22;
 const MAX_CALIBRATION_ERROR_MS: number = 1000;
 /** A process that began this long after a record was written cannot be the record's writer. */
@@ -48,7 +49,25 @@ function readUptimeSeconds(): number | undefined {
   }
 }
 
+/**
+ * True only on Linux when `pid` has exited but its parent has not reaped it yet. Such a zombie still accepts
+ * signal 0, but it can no longer run or hold connections.
+ */
+export function isProcessDefunct(pid: number): boolean {
+  if (process.platform !== 'linux') return false;
+  const state: string | undefined = readStatFields(pid)?.[PROC_STAT_STATE_FIELD - 3];
+  return state === 'Z' || state === 'X';
+}
+
 function readStartSeconds(pid: number | 'self'): number | undefined {
+  const fields: string[] | undefined = readStatFields(pid);
+  if (!fields) return undefined;
+  const jiffies: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
+  return Number.isSafeInteger(jiffies) && jiffies >= 0 ? jiffies / USER_HZ : undefined;
+}
+
+/** The fields of `/proc/<pid>/stat` from field 3 (the process state) on. */
+function readStatFields(pid: number | 'self'): string[] | undefined {
   let stat: string;
   try {
     stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
@@ -58,10 +77,8 @@ function readStartSeconds(pid: number | 'self'): number | undefined {
   // The command name (field 2) may contain spaces and parentheses; fields after it never do.
   const commandEnd: number = stat.lastIndexOf(')');
   if (commandEnd < 0) return undefined;
-  const fields: string[] = stat
+  return stat
     .slice(commandEnd + 1)
     .trim()
     .split(' ');
-  const jiffies: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
-  return Number.isSafeInteger(jiffies) && jiffies >= 0 ? jiffies / USER_HZ : undefined;
 }
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 93aa22ba0e..b6f0b46e4b 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -11,7 +11,6 @@ import { DAEMON_LIFECYCLE_PROTOCOL_MINOR } from '@rushstack/rush-daemon-protocol
 import {
   DaemonTransportError,
   DaemonTransportErrorCode,
-  ensureDaemonRuntimeDir,
   reclaimStaleDaemonAsync,
   readDaemonLockfile,
   type IDaemonLockfile,
@@ -30,12 +29,24 @@ import {
   reclaimAbandonedOwnershipAsync,
   type DaemonOwnership
 } from './DaemonOwnership';
+import {
+  assertDaemonRuntimeFolderIsPrivate,
+  ensureDaemonRuntimeFolder,
+  withDaemonRuntimeFolder
+} from './DaemonRuntimeFolder';
 import {
   getDaemonStartupFilePath,
+  readDaemonStartupReservation,
   reserveDaemonStartup,
-  releaseDaemonStartup,
-  type IDaemonStartupOptions
+  type IDaemonStartupOptions,
+  type IDaemonStartupReservation
 } from './DaemonStartup';
+import {
+  getStartupHelperState,
+  resolveStartupReservationForReadyDaemon,
+  tryResolveStartupReservationAsync,
+  type DaemonStartupHelperState
+} from './DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 interface IStartupHelper {
@@ -50,6 +61,9 @@ interface IStartupHelper {
  */
 const STARTUP_HELPER_READINESS_TIMEOUT_MS: number = 120_000;
 
+/** Matches the default of {@link DaemonClient.shutdownAsync}. */
+const DEFAULT_SHUTDOWN_TIMEOUT_MS: number = 15000;
+
 /** A version-selected launch command supplied by the embedding application, never guessed by the core. @beta */
 export interface IDaemonStartCommand {
   readonly command: string;
@@ -94,6 +108,7 @@ export async function connectOrStartDaemonAsync(
   }
   const deadline: number = Date.now() + timeoutMs;
   options.abortSignal?.throwIfAborted();
+  assertDaemonRuntimeFolderIsPrivate(options.paths);
   await waitForPreviousDaemonAsync(options.paths, options.previousDaemon, deadline, options.abortSignal);
   const initial: DaemonClient | undefined = await tryConnectAsync(options, deadline);
   if (initial) return initial;
@@ -121,7 +136,7 @@ async function startDaemonAsync(
   options: IConnectOrStartDaemonOptions & { readonly startCommand: IDaemonStartCommand },
   deadline: number
 ): Promise<DaemonClient> {
-  ensureDaemonRuntimeDir(options.paths);
+  ensureDaemonRuntimeFolder(options.paths);
   let lock: IStartupLock | undefined;
   let backoffMs: number = 50;
   while (Date.now() < deadline) {
@@ -137,19 +152,7 @@ async function startDaemonAsync(
   }
   if (!lock) throw startupError(options, 'timed out waiting for another starting client');
   try {
-    while (fs.lstatSync(getDaemonStartupFilePath(options.paths), { throwIfNoEntry: false })) {
-      const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
-      if (ready) return ready;
-      if (Date.now() >= deadline) {
-        throw startupError(
-          options,
-          `has an unresolved startup handoff at ${getDaemonStartupFilePath(options.paths)}; refusing another launch. ${DAEMON_RESET_HINT}`
-        );
-      }
-      await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
-        signal: options.abortSignal
-      });
-    }
+    await waitForStartupReservationAsync(options, deadline);
     const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
     if (ready) return ready;
     const replacement: DaemonClient | undefined = await replaceMismatchedDaemonAsync(options, deadline);
@@ -195,6 +198,76 @@ async function startDaemonAsync(
   }
 }
 
+/**
+ * Holding the start mutex, waits until no startup reservation remains. The helper releases its reservation once
+ * the daemon completes hello/ping, and this client resolves it on the same evidence, so a daemon that became
+ * ready after its helper stopped waiting is still used. Another launch is refused while the reservation remains:
+ * at once when its helper exited, since nothing else will release it, and otherwise at the deadline.
+ */
+async function waitForStartupReservationAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
+): Promise<void> {
+  while (true) {
+    options.abortSignal?.throwIfAborted();
+    const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(options.paths);
+    if (!reservation) return;
+    if (await tryResolveForReadyDaemonAsync(options, deadline)) continue;
+    const helperState: DaemonStartupHelperState = getStartupHelperState(reservation);
+    if (helperState === 'exited' || Date.now() >= deadline) {
+      // The helper may have released its reservation just before it exited.
+      const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(options.paths);
+      if (!current || current.contents !== reservation.contents) continue;
+      throw startupError(options, describeUnresolvedReservation(options.paths, reservation, helperState));
+    }
+    await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
+      signal: options.abortSignal
+    });
+  }
+}
+
+/**
+ * Resolves the startup reservation if a daemon of any version completes hello/ping at the endpoint, which is
+ * the readiness the helper waits for; the normal flow then replaces a mismatched daemon. The caller holds the
+ * start mutex.
+ */
+async function tryResolveForReadyDaemonAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
+): Promise<boolean> {
+  let client: DaemonClient | undefined;
+  try {
+    client = await tryConnectEndpointAsync({ ...options, expectedDaemonVersion: undefined }, deadline);
+  } catch (error) {
+    // Nor would the helper treat a daemon with an incompatible protocol as ready.
+    if (error instanceof DaemonClientError && error.code === 'versionMismatch') return false;
+    throw error;
+  }
+  if (!client) return false;
+  try {
+    return resolveStartupReservationForReadyDaemon(options.paths, (await client.status).pid);
+  } finally {
+    await client.closeAsync();
+  }
+}
+
+function describeUnresolvedReservation(
+  paths: IDaemonPaths,
+  reservation: IDaemonStartupReservation,
+  helperState: DaemonStartupHelperState
+): string {
+  const prefix: string = `has an unresolved startup handoff at ${getDaemonStartupFilePath(paths)}`;
+  const helperPid: number | undefined = reservation.helper?.pid;
+  switch (helperState) {
+    case 'exited':
+      return `${prefix}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch. ${DAEMON_RESET_HINT}`;
+    case 'running':
+      return `${prefix}: its startup helper (PID ${helperPid}) is still waiting for the daemon to become ready; refusing another launch`;
+    default:
+      return `${prefix}; refusing another launch. ${DAEMON_RESET_HINT}`;
+  }
+}
+
 /**
  * Captures attested ownership and requests shutdown without claiming that cleanup has finished.
  * Pass the returned identity as previousDaemon to connectOrStartDaemonAsync before replacement.
@@ -220,10 +293,79 @@ export async function requestDaemonShutdownAsync(
     pid: owner.pid,
     startedAt: owner.startedAt
   };
+  await resolveReservationBeforeShutdownAsync(paths, pid, timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS);
   await client.shutdownAsync(timeoutMs);
   return previousDaemon;
 }
 
+/**
+ * A retained startup reservation would refuse the successor's launch, so it is resolved first; `pid` answered
+ * hello/ping and is attested as the owner. Waits for the start mutex, since another client may be resolving it.
+ */
+async function resolveReservationBeforeShutdownAsync(
+  paths: IDaemonPaths,
+  pid: number,
+  timeoutMs: number
+): Promise<void> {
+  if (!readDaemonStartupReservation(paths)) return;
+  const lock: IStartupLock | undefined = await waitForStartupLockAsync(paths, timeoutMs);
+  if (!lock) {
+    throw new DaemonClientError(
+      'startupFailed',
+      `Another client is starting the daemon for ${paths.lockfilePath}; shutdown was not sent.`
+    );
+  }
+  try {
+    if (!resolveStartupReservationForReadyDaemon(paths, pid)) {
+      throw new DaemonClientError(
+        'startupFailed',
+        `The daemon startup reservation at ${getDaemonStartupFilePath(paths)} could not be resolved for PID ${pid}; shutdown was not sent.`
+      );
+    }
+  } finally {
+    await lock.releaseAsync();
+  }
+}
+
+/**
+ * Resolves a startup reservation that remains next to a connected, ready daemon before that daemon is stopped.
+ * Afterwards no ready daemon would prove the reservation stale, so it would refuse every automatic start. The
+ * daemon must be the live owner in the ownership record for the endpoint, and the reservation is removed only
+ * if unchanged. Waits for the start mutex for up to `timeoutMs` (15000 milliseconds by default), since another
+ * client may be resolving it.
+ * @returns true when no reservation remains; false when one is kept.
+ * @beta
+ */
+export async function resolveDaemonStartupReservationAsync(
+  client: DaemonClient,
+  paths: IDaemonPaths,
+  timeoutMs: number = DEFAULT_SHUTDOWN_TIMEOUT_MS
+): Promise<boolean> {
+  if (!readDaemonStartupReservation(paths)) return true;
+  const { pid } = await client.status;
+  const lock: IStartupLock | undefined = await waitForStartupLockAsync(paths, timeoutMs);
+  if (!lock) return false;
+  try {
+    return resolveStartupReservationForReadyDaemon(paths, pid);
+  } finally {
+    await lock.releaseAsync();
+  }
+}
+
+/** Returns undefined when another client still holds the start mutex after `timeoutMs`. */
+async function waitForStartupLockAsync(
+  paths: IDaemonPaths,
+  timeoutMs: number
+): Promise<IStartupLock | undefined> {
+  const deadline: number = Date.now() + timeoutMs;
+  let lock: IStartupLock | undefined;
+  while (!(lock = await tryAcquireStartupLockAsync(paths))) {
+    if (Date.now() >= deadline) return undefined;
+    await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())));
+  }
+  return lock;
+}
+
 async function replaceMismatchedDaemonAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
@@ -255,23 +397,36 @@ async function replaceMismatchedDaemonAsync(
 async function tryConnectAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
+): Promise<DaemonClient | undefined> {
+  const client: DaemonClient | undefined = await tryConnectEndpointAsync(options, deadline);
+  if (!client) return undefined;
+  // Do not expose a just-started daemon to shutdown/restart until its startup reservation is resolved:
+  // by the helper, or here once the daemon is ready. This never waits for the start mutex, and a client
+  // holding it (including this process) resolves the reservation itself.
+  let usable: boolean = false;
+  try {
+    options.abortSignal?.throwIfAborted();
+    usable =
+      !readDaemonStartupReservation(options.paths) ||
+      (await tryResolveStartupReservationAsync(client, options.paths));
+  } finally {
+    if (!usable) await client.closeAsync();
+  }
+  return usable ? client : undefined;
+}
+
+/** Connects and completes hello/ping, whether or not a startup reservation remains. */
+async function tryConnectEndpointAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
 ): Promise<DaemonClient | undefined> {
   options.abortSignal?.throwIfAborted();
   try {
-    const client: DaemonClient = await DaemonClient.connectAsync({
+    return await DaemonClient.connectAsync({
       ...options,
       socketPath: options.paths.socketPath,
       timeoutMs: Math.min(options.timeoutMs ?? 1000, Math.max(1, deadline - Date.now()))
     });
-    // Do not expose a just-started daemon to shutdown/restart until the helper finishes the handoff.
-    let pendingStartup: boolean = true;
-    try {
-      options.abortSignal?.throwIfAborted();
-      pendingStartup = !!fs.lstatSync(getDaemonStartupFilePath(options.paths), { throwIfNoEntry: false });
-    } finally {
-      if (pendingStartup) await client.closeAsync();
-    }
-    return pendingStartup ? undefined : client;
   } catch (error) {
     options.abortSignal?.throwIfAborted();
     if (
@@ -403,7 +558,8 @@ async function spawnDetachedAsync(
 ): Promise<IStartupHelper> {
   const start: IDaemonStartCommand = {
     ...options.startCommand!,
-    cwd: path.resolve(options.startCommand!.cwd)
+    cwd: path.resolve(options.startCommand!.cwd),
+    environment: withDaemonRuntimeFolder(options.startCommand!.environment, options.paths)
   };
   const logFilePath: string = getDaemonLogFilePath(options.paths);
   // These distinct native flags have non-overlapping values.
@@ -427,7 +583,6 @@ async function spawnDetachedAsync(
       }
       fs.fchmodSync(logFd, 0o600);
     }
-    const token: string = reserveDaemonStartup(options.paths);
     let helper: IStartupHelper | undefined;
     try {
       const child: ChildProcess = spawn(process.execPath, [path.join(__dirname, 'runDaemonStartup.js')], {
@@ -443,7 +598,6 @@ async function spawnDetachedAsync(
       await once(child, 'spawn');
     } catch (error) {
       if (helper) await helper.closed;
-      releaseDaemonStartup(options.paths, token);
       throw new DaemonClientError(
         'startupFailed',
         `Unable to start ${start.command}; inspect ${logFilePath}.`,
@@ -451,6 +605,17 @@ async function spawnDetachedAsync(
       );
     }
     const { child } = helper;
+    let token: string;
+    try {
+      // The helper launches nothing until it receives its options, so the reservation can name it first.
+      // Its start time is taken after the spawn, so the helper can never look like a later reuse of its PID.
+      token = reserveDaemonStartup(options.paths, { pid: child.pid!, startedAt: new Date().toISOString() });
+    } catch (error) {
+      // Disconnected without options, the helper exits without launching.
+      child.disconnect();
+      await helper.closed;
+      throw error;
+    }
     child.unref();
     const startup: IDaemonStartupOptions = {
       paths: options.paths,
@@ -500,8 +665,9 @@ async function waitForHelperExitAsync(
 }
 
 function startupError(options: IConnectOrStartDaemonOptions, reason: string): DaemonClientError {
+  const sentence: string = /[.!?]$/.test(reason) ? reason : `${reason}.`;
   return new DaemonClientError(
     'startupFailed',
-    `Daemon startup ${reason}. Inspect ${getDaemonLogFilePath(options.paths)} and retry, or use --no-daemon.`
+    `Daemon startup ${sentence} Inspect ${getDaemonLogFilePath(options.paths)} and retry, or use --no-daemon.`
   );
 }
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index e0d8563648..d63c6d3ce7 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -10,6 +10,11 @@ import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from './
 import { captureDaemonRequest } from './captureDaemonRequest';
 import type { DaemonClient, DaemonClientOutcome, IDaemonClientExecuteOptions } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
+import {
+  explainLostConnectionAsync,
+  observeServingDaemonAsync,
+  type IServingDaemon
+} from './DaemonDisconnect';
 
 /**
  * The maximum number of successors a single request follows. Each restart serves at least one other
@@ -27,6 +32,8 @@ const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
  * Restarts are retried with jittered backoff inside the request's admission deadline; once the
  * retries or the deadline are exhausted, a `fallback` outcome lets the caller run in-process instead.
  * The connection options must select the request's expected daemon and startup environment.
+ * A connection lost before the result is reported as a `disconnected` error that says whether the daemon
+ * process exited, what its launcher log recorded and how to recover, unless the request was aborted first.
  * @beta
  */
 export async function executeWithDaemonRestartAsync(
@@ -41,7 +48,10 @@ export async function executeWithDaemonRestartAsync(
       : (execution.abortSignal ?? connection.abortSignal);
   const waitTimeoutMs: number | undefined = execution.request.admission?.waitTimeoutMs;
   let owner: IDaemonLockfile | undefined = await attestOwnerAsync(client, connection);
-  let outcome: DaemonClientOutcome = await client.executeAsync({ ...execution, abortSignal });
+  let outcome: DaemonClientOutcome = await executeOnDaemonAsync(client, connection, {
+    ...execution,
+    abortSignal
+  });
   let previous: DaemonClient | undefined;
   try {
     for (let retry: number = 1; outcome.kind === 'result' && outcome.result.retryAfterRestart; retry++) {
@@ -97,7 +107,7 @@ export async function executeWithDaemonRestartAsync(
       const remainingMs: number | undefined = getRemainingMs();
       if (isExpired(remainingMs)) return restartExhaustedOutcome(retry);
       owner = await attestOwnerAsync(successor, connection);
-      outcome = await successor.executeAsync({
+      outcome = await executeOnDaemonAsync(successor, connection, {
         ...execution,
         abortSignal,
         request:
@@ -115,6 +125,22 @@ export async function executeWithDaemonRestartAsync(
   }
 }
 
+/** Executes one attempt; a lost connection is explained by what happened to the daemon that served it. */
+async function executeOnDaemonAsync(
+  client: DaemonClient,
+  connection: IConnectOrStartDaemonOptions,
+  execution: IDaemonClientExecuteOptions
+): Promise<DaemonClientOutcome> {
+  const daemon: IServingDaemon | undefined = await observeServingDaemonAsync(client, connection.paths);
+  try {
+    return await client.executeAsync(execution);
+  } catch (error) {
+    // After cancellation the caller reports the cancellation, whatever the connection did afterwards.
+    if (execution.abortSignal?.aborted) throw error;
+    throw await explainLostConnectionAsync(error, daemon, execution.request);
+  }
+}
+
 function isExpired(remainingMs: number | undefined): boolean {
   return remainingMs !== undefined && remainingMs <= 0;
 }
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index 7597de72ab..6f3fbd5e3c 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -20,10 +20,17 @@ export {
   type IDaemonArtifactResetOptions,
   type IDaemonArtifactResetResult
 } from './DaemonOwnership';
+export { assertDaemonRuntimeFolderIsPrivate } from './DaemonRuntimeFolder';
+export {
+  inspectDaemonStartupReservation,
+  type DaemonStartupHelperState,
+  type IDaemonStartupReservationInfo
+} from './DaemonStartupReservation';
 export { executeWithDaemonRestartAsync } from './executeWithDaemonRestart';
 export {
   connectOrStartDaemonAsync,
   requestDaemonShutdownAsync,
+  resolveDaemonStartupReservationAsync,
   type IConnectOrStartDaemonOptions,
   type IDaemonStartCommand
 } from './connectOrStartDaemon';
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
new file mode 100644
index 0000000000..39d6bde652
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -0,0 +1,121 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import { DaemonTransportError, DaemonTransportErrorCode } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
+import { explainLostConnectionAsync, findLoggedFatalError, type IServingDaemon } from '../DaemonDisconnect';
+import { isProcessDefunct } from '../ProcessStartTime';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+/** The lines that this Node.js version writes to stderr when `script` fails with an uncaught error. */
+function getCrashReport(script: string): string[] {
+  const { status, stderr } = spawnSync(process.execPath, ['-e', script], { encoding: 'utf8' });
+  expect(status).not.toBe(0);
+  return stderr.split(/\r?\n/);
+}
+
+describe(findLoggedFatalError.name, () => {
+  it('returns the message of an uncaught error without its stack', () => {
+    const report: string[] = getCrashReport("setImmediate(() => { throw new Error('first\\nsecond'); })");
+    expect(findLoggedFatalError(['rushd started', ...report])).toBe('Error: first second');
+  });
+
+  it('returns the message of an unhandled rejection', () => {
+    expect(findLoggedFatalError(getCrashReport("Promise.reject(new TypeError('rejected'))"))).toBe(
+      'TypeError: rejected'
+    );
+    expect(findLoggedFatalError(getCrashReport("Promise.reject('reason')"))).toMatch(
+      /^UnhandledPromiseRejection: .* "reason"\.$/
+    );
+  });
+
+  it('returns a thrown value that is not an error', () => {
+    expect(findLoggedFatalError(getCrashReport("throw 'a plain string'"))).toBe('a plain string');
+  });
+
+  it("returns V8's fatal error line", () => {
+    const lines: string[] = [
+      '<--- JS stacktrace --->',
+      '',
+      'FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory',
+      '----- Native stack trace -----'
+    ];
+    expect(findLoggedFatalError(lines)).toBe(
+      'FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory'
+    );
+  });
+
+  it('returns the first report', () => {
+    const lines: string[] = [
+      ...getCrashReport("throw new Error('first')"),
+      ...getCrashReport("throw new Error('second')")
+    ];
+    expect(findLoggedFatalError(lines)).toBe('Error: first');
+  });
+
+  it('returns undefined without a complete report', () => {
+    const report: string[] = getCrashReport("throw new Error('boom')");
+    const trailer: number = report.findIndex((line) => line.startsWith('Node.js v'));
+    expect(trailer).toBeGreaterThan(0);
+    expect(findLoggedFatalError(report.slice(0, trailer))).toBeUndefined();
+    expect(findLoggedFatalError(report.slice(3))).toBeUndefined();
+    expect(findLoggedFatalError(['rushd started', 'Node.js v22.0.0'])).toBeUndefined();
+  });
+});
+
+describe(explainLostConnectionAsync.name, () => {
+  const request: IDaemonRequestEnvelope = captureDaemonRequest({
+    argv: ['build'],
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    cwd: os.tmpdir(),
+    environment: {},
+    terminal: { isTTY: false, supportsColor: false }
+  });
+
+  function getServingDaemon(pid: number): IServingDaemon {
+    return {
+      pid,
+      startedAt: undefined,
+      logFilePath: path.join(os.tmpdir(), 'missing.log'),
+      logOffset: undefined
+    };
+  }
+
+  it('returns other failures, and failures without a known daemon, unchanged', async () => {
+    const timeout: DaemonClientError = new DaemonClientError('timeout', 'The daemon did not answer.');
+    expect(await explainLostConnectionAsync(timeout, getServingDaemon(process.pid), request)).toBe(timeout);
+    const lost: DaemonClientError = new DaemonClientError('disconnected', DAEMON_DISCONNECTED_MESSAGE);
+    expect(await explainLostConnectionAsync(lost, undefined, request)).toBe(lost);
+  });
+
+  linuxIt('treats a daemon that exited but is not reaped yet as exited', async () => {
+    await withUnreapedChildAsync(async (child) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      const closed: DaemonTransportError = new DaemonTransportError(
+        DaemonTransportErrorCode.transportClosed,
+        'The daemon connection closed.'
+      );
+      const startedAt: number = Date.now();
+      const explained: unknown = await explainLostConnectionAsync(closed, getServingDaemon(child), request);
+      expect(Date.now() - startedAt).toBeLessThan(500);
+      expect(explained).toBeInstanceOf(DaemonClientError);
+      expect(explained).toMatchObject({
+        code: 'disconnected',
+        cause: closed,
+        message: `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${child}) exited while it ran the command; "rush-client daemon logs" may show why. Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".`
+      });
+    });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/ProcessStartTime.test.ts b/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
index a7a9ff4418..f2d1db45cb 100644
--- a/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
+++ b/libraries/rush-client-core/src/test/ProcessStartTime.test.ts
@@ -4,8 +4,10 @@
 import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
 import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { isProcessStartedAfter, tryGetProcessStartTimeMs } from '../ProcessStartTime';
+import { isProcessDefunct, isProcessStartedAfter, tryGetProcessStartTimeMs } from '../ProcessStartTime';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
 
 const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
 
@@ -28,4 +30,14 @@ describe('process start time', () => {
     expect(isProcessStartedAfter(exited.pid!, new Date(0).toISOString())).toBe(false);
     expect(isProcessStartedAfter(process.pid, 'not a timestamp')).toBe(false);
   });
+
+  linuxIt('detects an exited process that its parent has not reaped', async () => {
+    await withUnreapedChildAsync(async (child, parent) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      expect(isProcessDefunct(child)).toBe(true);
+      expect(isProcessDefunct(parent)).toBe(false);
+      expect(isProcessDefunct(process.pid)).toBe(false);
+    });
+  });
 });
diff --git a/libraries/rush-client-core/src/test/UnreapedChildProcess.ts b/libraries/rush-client-core/src/test/UnreapedChildProcess.ts
new file mode 100644
index 0000000000..b5767015fb
--- /dev/null
+++ b/libraries/rush-client-core/src/test/UnreapedChildProcess.ts
@@ -0,0 +1,26 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+
+/**
+ * Runs `callbackAsync` with the PID of a process that exits after 200 ms but stays unreaped, because its parent
+ * never waits for it, and the parent's PID. POSIX only.
+ */
+export async function withUnreapedChildAsync(
+  callbackAsync: (pid: number, parentPid: number) => Promise<void>
+): Promise<void> {
+  // The shell starts a short-lived child, then becomes a process that never reaps it.
+  const parent: ChildProcess = spawn('/bin/sh', ['-c', 'sleep 0.2 & echo $!; exec sleep 10'], {
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const closed: Promise<unknown[]> = once(parent, 'close');
+  try {
+    const [output] = await once(parent.stdout!, 'data');
+    await callbackAsync(Number(String(output).trim()), parent.pid!);
+  } finally {
+    parent.kill();
+    await closed;
+  }
+}
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 027d2e22bf..8d7d89b397 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { spawn, type ChildProcess } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
 import * as net from 'node:net';
@@ -10,19 +11,28 @@ import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { FileSystem } from '@rushstack/node-core-library';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import {
   readDaemonLockfile,
   type IDaemonLockfile,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
-import { DaemonClient } from '../DaemonClient';
+import { DaemonClient, type DaemonClientOutcome } from '../DaemonClient';
+import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
-import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import {
+  connectOrStartDaemonAsync,
+  requestDaemonShutdownAsync,
+  resolveDaemonStartupReservationAsync,
+  type IConnectOrStartDaemonOptions
+} from '../connectOrStartDaemon';
 import { executeWithDaemonRestartAsync } from '../executeWithDaemonRestart';
-import { getDaemonStartupFilePath } from '../DaemonStartup';
+import { getDaemonStartupFilePath, releaseDaemonStartup, reserveDaemonStartup } from '../DaemonStartup';
+import { inspectDaemonStartupReservation } from '../DaemonStartupReservation';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 describe('detached daemon startup', () => {
@@ -134,12 +144,36 @@ describe('detached daemon startup', () => {
     return daemonPid;
   }
 
+  async function getExitedPidAsync(): Promise<number> {
+    const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+    await once(exited, 'close');
+    return exited.pid!;
+  }
+
+  function writeReservation(helperPid: number, helperStartedAt: string = new Date().toISOString()): string {
+    const contents: string = JSON.stringify({ token: randomUUID(), helperPid, helperStartedAt });
+    fs.writeFileSync(getDaemonStartupFilePath(paths), contents);
+    return contents;
+  }
+
+  async function startFixtureDaemonAsync(): Promise<number> {
+    const client: DaemonClient = await connectOrStartDaemonAsync(options);
+    const { pid } = await client.status;
+    await client.closeAsync();
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    return pid!;
+  }
+
   it('fails closed for successor starters while the original detached daemon remains pre-bind', async () => {
     const daemonPid: number = await killStarterBeforeBindAsync();
     const results = await Promise.all(
       Array.from({ length: 4 }, () => startClient({ ...options, startupTimeoutMs: 700 }).result)
     );
     expect(results.every(({ code }) => code !== 0)).toBe(true);
+    // The helper is alive, so the client that holds the start lock waits for it until its own deadline.
+    expect(
+      results.some(({ stderr }) => stderr.includes('is still waiting for the daemon to become ready'))
+    ).toBe(true);
     expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
     expect(fs.existsSync(paths.lockfilePath)).toBe(false);
 
@@ -214,6 +248,218 @@ describe('detached daemon startup', () => {
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
   });
 
+  it('refuses another launch at once when the startup helper exited without releasing its reservation', async () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    const failing: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
+    };
+    await expect(connectOrStartDaemonAsync(failing)).rejects.toThrow('Unable to start');
+    const contents: string = fs.readFileSync(startupPath, 'utf8');
+    const { helperPid } = JSON.parse(contents);
+    expect(inspectDaemonStartupReservation(paths)).toEqual({
+      path: startupPath,
+      helperPid,
+      helperState: 'exited'
+    });
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 20000 }).then(
+      () => new Error('Expected startup to be refused.'),
+      (refusal: Error) => refusal
+    );
+    expect(Date.now() - started).toBeLessThan(3000);
+    expect(error.message).toContain(
+      `unresolved startup handoff at ${startupPath}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch.`
+    );
+    expect(error.message).toContain('daemon stop --force');
+    expect(error.message).not.toContain('..');
+    expect(fs.readFileSync(startupPath, 'utf8')).toBe(contents);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  });
+
+  it.each(['legacy', 'exited helper', 'no auto-start'])(
+    'uses and resolves a ready daemon next to a retained startup reservation (%s)',
+    async (kind) => {
+      const daemonPid: number = await startFixtureDaemonAsync();
+      if (kind === 'legacy') {
+        fs.writeFileSync(getDaemonStartupFilePath(paths), randomUUID());
+      } else {
+        writeReservation(await getExitedPidAsync());
+      }
+      const started: number = Date.now();
+      const client: DaemonClient = await connectOrStartDaemonAsync(
+        kind === 'no auto-start' ? { paths, expectedDaemonVersion: 'fixture' } : options
+      );
+      try {
+        expect((await client.status).pid).toBe(daemonPid);
+      } finally {
+        await client.closeAsync();
+      }
+      expect(Date.now() - started).toBeLessThan(3000);
+      expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    }
+  );
+
+  it('resolves a retained startup reservation before replacing a mismatched ready daemon', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    fs.writeFileSync(getDaemonStartupFilePath(paths), randomUUID());
+    const replacement: DaemonClient = await connectOrStartDaemonAsync({
+      ...options,
+      expectedDaemonVersion: 'replacement',
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'replacement'] }
+    });
+    try {
+      const status = await replacement.status;
+      expect(status.daemonVersion).toBe('replacement');
+      expect(status.pid).not.toBe(daemonPid);
+    } finally {
+      await replacement.closeAsync();
+    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
+  });
+
+  it('keeps a startup reservation next to a ready daemon that is not the attested owner', async () => {
+    await startFixtureDaemonAsync();
+    const owner: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+    fs.writeFileSync(paths.lockfilePath, JSON.stringify({ ...JSON.parse(owner), pid: process.pid }));
+    const contents: string = writeReservation(await getExitedPidAsync());
+    try {
+      await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 2000 })).rejects.toThrow(
+        'unresolved startup handoff'
+      );
+      await expect(connectOrStartDaemonAsync({ paths, expectedDaemonVersion: 'fixture' })).rejects.toThrow(
+        'auto-start is disabled'
+      );
+      expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+    } finally {
+      fs.writeFileSync(paths.lockfilePath, owner);
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+
+  it('resolves a retained startup reservation before shutdown so that a successor can start', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    writeReservation(await getExitedPidAsync());
+    const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+    const previousDaemon = await requestDaemonShutdownAsync(running, paths).finally(() =>
+      running.closeAsync()
+    );
+    expect(previousDaemon.pid).toBe(daemonPid);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    const successor: DaemonClient = await connectOrStartDaemonAsync({ ...options, previousDaemon });
+    try {
+      expect((await successor.status).pid).not.toBe(daemonPid);
+    } finally {
+      await successor.closeAsync();
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
+  });
+
+  it('does not request shutdown while the start lock keeps a startup reservation unresolved', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    const contents: string = writeReservation(await getExitedPidAsync());
+    const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+    expect(lock).toBeDefined();
+    const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+    try {
+      await expect(requestDaemonShutdownAsync(running, paths, 300)).rejects.toThrow('shutdown was not sent');
+    } finally {
+      await running.closeAsync();
+      await lock!.releaseAsync();
+    }
+    expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+    const client: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await client.status).pid).toBe(daemonPid);
+    } finally {
+      await client.closeAsync();
+    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  });
+
+  it('resolves a startup reservation before a plain stop only for the attested ready daemon', async () => {
+    const daemonPid: number = await startFixtureDaemonAsync();
+    const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+    try {
+      await expect(resolveDaemonStartupReservationAsync(running, paths)).resolves.toBe(true);
+      const contents: string = writeReservation(await getExitedPidAsync());
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      expect(lock).toBeDefined();
+      try {
+        await expect(resolveDaemonStartupReservationAsync(running, paths, 300)).resolves.toBe(false);
+      } finally {
+        await lock!.releaseAsync();
+      }
+      const owner: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      fs.writeFileSync(paths.lockfilePath, JSON.stringify({ ...JSON.parse(owner), pid: process.pid }));
+      try {
+        await expect(resolveDaemonStartupReservationAsync(running, paths)).resolves.toBe(false);
+      } finally {
+        fs.writeFileSync(paths.lockfilePath, owner);
+      }
+      expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+      await expect(resolveDaemonStartupReservationAsync(running, paths)).resolves.toBe(true);
+      expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+      await running.shutdownAsync();
+    } finally {
+      await running.closeAsync();
+    }
+    // With the reservation resolved, a later start launches a new daemon instead of being refused.
+    await waitForTestProcessExitAsync(daemonPid);
+    const successor: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await successor.status).pid).not.toBe(daemonPid);
+    } finally {
+      await successor.closeAsync();
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(2);
+  });
+
+  it('reports a startup reservation and whether its helper can still release it', async () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    expect(inspectDaemonStartupReservation(paths)).toBeUndefined();
+    fs.writeFileSync(startupPath, randomUUID());
+    expect(inspectDaemonStartupReservation(paths)).toEqual({ path: startupPath, helperState: 'unknown' });
+    writeReservation(process.pid);
+    expect(inspectDaemonStartupReservation(paths)).toEqual({
+      path: startupPath,
+      helperPid: process.pid,
+      helperState: 'running'
+    });
+    const exitedPid: number = await getExitedPidAsync();
+    writeReservation(exitedPid);
+    expect(inspectDaemonStartupReservation(paths)).toEqual({
+      path: startupPath,
+      helperPid: exitedPid,
+      helperState: 'exited'
+    });
+    if (process.platform === 'linux') {
+      // This process started after the recorded helper, so it merely reuses the PID.
+      writeReservation(process.pid, new Date(Date.now() - 3600000).toISOString());
+      expect(inspectDaemonStartupReservation(paths)).toMatchObject({ helperState: 'exited' });
+    }
+    fs.unlinkSync(startupPath);
+    fs.mkdirSync(startupPath);
+    expect(inspectDaemonStartupReservation(paths)).toEqual({ path: startupPath, helperState: 'unknown' });
+    fs.rmdirSync(startupPath);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  });
+
+  it('lets a startup helper release only its own reservation, tolerating one already resolved', () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    const helper = { pid: process.pid, startedAt: new Date().toISOString() };
+    const token: string = reserveDaemonStartup(paths, helper);
+    expect(() => reserveDaemonStartup(paths, helper)).toThrow('EEXIST');
+    expect(() => releaseDaemonStartup(paths, randomUUID())).toThrow('changed ownership');
+    expect(fs.existsSync(startupPath)).toBe(true);
+    releaseDaemonStartup(paths, token);
+    expect(fs.existsSync(startupPath)).toBe(false);
+    releaseDaemonStartup(paths, token);
+    expect(fs.existsSync(startupPath)).toBe(false);
+  });
+
   it.each([false, true])(
     'preserves an explicit launcher and environment (relative cwd: %s)',
     async (relative) => {
@@ -623,6 +869,122 @@ describe('detached daemon startup', () => {
     }
   });
 
+  describe('when the connection is lost before the result', () => {
+    const exitedMessage = (pid: number, logged: boolean, client: string = 'rush-client'): string =>
+      `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while it ran the command; ` +
+      `"rush-client daemon logs" ${logged ? 'shows' : 'may show'} why. Run the command again; ` +
+      `if the daemon exits again, run the command with "${client} --no-daemon".`;
+
+    function withMode(mode: string): IConnectOrStartDaemonOptions {
+      return {
+        ...options,
+        startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+      };
+    }
+
+    function captureRequest(invocationKind?: 'rushx'): IDaemonRequestEnvelope {
+      return captureDaemonRequest({
+        argv: ['test'],
+        commandName: 'test',
+        commandOrigin: 'custom',
+        cwd: folder,
+        environment: {},
+        terminal: { isTTY: false, supportsColor: false },
+        invocationKind
+      });
+    }
+
+    async function waitForRequestAsync(): Promise<void> {
+      const deadline: number = Date.now() + 5000;
+      while (!fs.existsSync(path.join(folder, 'requests')) && Date.now() < deadline) await delayAsync(20);
+      expect(fs.existsSync(path.join(folder, 'requests'))).toBe(true);
+    }
+
+    it('says that rushd exited and quotes the error it logged, without retrying', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('crash-on-request');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const { pid } = await client.status;
+      const error: unknown = await executeWithDaemonRestartAsync(client, connection, {
+        request: captureRequest()
+      }).catch((failure: unknown) => failure);
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect(error).toMatchObject({
+        code: 'disconnected',
+        message:
+          `${exitedMessage(pid!, true)}\n` +
+          'The daemon log reports: Error: fixture daemon crash while running the request'
+      });
+      expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8')).toBe('fixture\n');
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${pid}\n`);
+    });
+
+    it('ignores log output from before the request and names the rushx client', async () => {
+      const earlierCrash: string = [
+        '/earlier/daemon.js:1',
+        "throw new Error('an earlier crash');",
+        '^',
+        '',
+        'Error: an earlier crash',
+        '    at /earlier/daemon.js:1:7',
+        '',
+        'Node.js v22.0.0',
+        ''
+      ].join('\n');
+      fs.writeFileSync(getDaemonLogFilePath(paths), earlierCrash);
+      const connection: IConnectOrStartDaemonOptions = withMode('kill-on-request');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const { pid } = await client.status;
+      await expect(
+        executeWithDaemonRestartAsync(client, connection, { request: captureRequest('rushx') })
+      ).rejects.toMatchObject({ code: 'disconnected', message: exitedMessage(pid!, false, 'rushx-client') });
+      expect(fs.readFileSync(getDaemonLogFilePath(paths), 'utf8')).toContain(earlierCrash);
+    });
+
+    it('says the connection closed while rushd still runs', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('close-on-request');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const { pid } = await client.status;
+      await expect(
+        executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+      ).rejects.toMatchObject({
+        code: 'disconnected',
+        message: `${DAEMON_DISCONNECTED_MESSAGE} The connection to rushd (PID ${pid}) closed, but the daemon is still running; run the command again.`
+      });
+      expect(fs.existsSync(path.join(folder, `stopped-${pid}`))).toBe(false);
+    });
+
+    it('keeps the plain text after the request was cancelled', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('crash-on-cancel');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const abort: AbortController = new AbortController();
+      const pending: Promise<DaemonClientOutcome> = executeWithDaemonRestartAsync(client, connection, {
+        request: captureRequest(),
+        abortSignal: abort.signal
+      });
+      await waitForRequestAsync();
+      abort.abort();
+      await expect(pending).rejects.toMatchObject({
+        code: 'disconnected',
+        message: DAEMON_DISCONNECTED_MESSAGE
+      });
+    });
+
+    it('keeps the aborted result that an orderly shutdown sends', async () => {
+      const connection: IConnectOrStartDaemonOptions = withMode('hold-until-shutdown');
+      const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+      const pending: Promise<DaemonClientOutcome> = executeWithDaemonRestartAsync(client, connection, {
+        request: captureRequest()
+      });
+      await waitForRequestAsync();
+      const stopping: DaemonClient = await connectOrStartDaemonAsync(connection);
+      await stopping.shutdownAsync();
+      expect(await pending).toMatchObject({
+        kind: 'result',
+        result: { exitCode: 130, outcome: 'aborted', aborted: true }
+      });
+    });
+  });
+
   it('waits through published ownership handoff even without a captured predecessor', async () => {
     const running = await connectOrStartDaemonAsync({
       ...options,
@@ -717,6 +1079,38 @@ describe('detached daemon startup', () => {
     expect(fs.readFileSync(logFilePath, 'utf8')).toContain('Cannot find module');
   });
 
+  it('tells the daemon it starts which runtime folder its clients look in', async () => {
+    const client = await connectOrStartDaemonAsync(options);
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'runtime-base'), 'utf8')).toBe(path.dirname(folder));
+  });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'reports a linked runtime folder as a startup failure without starting a daemon',
+    async () => {
+      const link: string = `${folder}-link`;
+      fs.symlinkSync(folder, link);
+      try {
+        const failure: Promise<DaemonClient> = connectOrStartDaemonAsync({
+          ...options,
+          paths: {
+            runtimeDir: link,
+            socketPath: path.join(link, 'd.sock'),
+            lockfilePath: path.join(link, 'daemon.pid.json')
+          }
+        });
+        await expect(failure).rejects.toBeInstanceOf(DaemonClientError);
+        await expect(failure).rejects.toMatchObject({ code: 'startupFailed' });
+        await expect(failure).rejects.toThrow(
+          `The daemon runtime folder ${link} is unsafe: it is a symbolic link`
+        );
+        expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+      } finally {
+        fs.unlinkSync(link);
+      }
+    }
+  );
+
   (process.platform === 'win32' ? it.skip : it)(
     'refuses linked log destinations without changing their target',
     async () => {
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 5d04da0f96..6256888197 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -20,11 +20,14 @@ async function mainAsync(): Promise<void> {
   const paths: IDaemonPaths = JSON.parse(process.argv[2]);
   const folder: string = path.dirname(paths.lockfilePath);
   const daemonVersion: string = process.argv[3] ?? 'fixture';
-  const restartMode: string | undefined = process.argv[4];
+  const mode: string | undefined = process.argv[4];
+  const restartMode: string | undefined = mode?.startsWith('restart-') ? mode : undefined;
   const connections: Set<DaemonFrameConnection> = new Set();
   let closing: Promise<void> | undefined;
+  let heldRequest: { connection: DaemonFrameConnection; requestId: string } | undefined;
   fs.appendFileSync(path.join(folder, 'starts'), `${process.pid}\n`);
   fs.appendFileSync(path.join(folder, 'parents'), `${process.ppid}\n`);
+  fs.writeFileSync(path.join(folder, 'runtime-base'), process.env.RUSHD_RUNTIME_DIR ?? '(unset)');
   process.stdout.write('launcher stdout\n');
   process.stderr.write('launcher stderr\n');
   if (fs.existsSync(path.join(folder, 'hold-prebind'))) {
@@ -65,6 +68,18 @@ async function mainAsync(): Promise<void> {
           });
         } else if (message.kind === 'requestStart') {
           fs.appendFileSync(path.join(folder, 'requests'), `${daemonVersion}\n`);
+          if (mode === 'crash-on-request' || mode === 'kill-on-request') {
+            exitAbruptly();
+            return;
+          }
+          if (mode === 'close-on-request') {
+            await connection.closeAsync();
+            return;
+          }
+          if (mode === 'hold-until-shutdown' || mode === 'crash-on-cancel') {
+            heldRequest = { connection, requestId: message.payload.requestId };
+            return;
+          }
           if (message.payload.admission?.waitTimeoutMs !== undefined) {
             fs.appendFileSync(path.join(folder, 'waits'), `${message.payload.admission.waitTimeoutMs}\n`);
           }
@@ -92,7 +107,24 @@ async function mainAsync(): Promise<void> {
             fs.appendFileSync(path.join(folder, 'restarted'), 'r');
             await stopAsync();
           }
+        } else if (message.kind === 'requestCancel' && mode === 'crash-on-cancel') {
+          exitAbruptly();
         } else if (message.kind === 'shutdown') {
+          if (heldRequest) {
+            // Like rushd, an orderly shutdown ends a running request with an aborted result first.
+            await heldRequest.connection.sendFrameAsync({
+              kind: DaemonFrameType.controlJson,
+              payload: encodeDaemonControlMessage({
+                kind: 'requestResult',
+                payload: {
+                  requestId: heldRequest.requestId,
+                  exitCode: 130,
+                  outcome: 'aborted',
+                  aborted: true
+                }
+              })
+            });
+          }
           await connection.sendFrameAsync({
             kind: DaemonFrameType.controlJson,
             payload: encodeDaemonControlMessage({ kind: 'shutdownAck', payload: {} })
@@ -116,6 +148,15 @@ async function mainAsync(): Promise<void> {
     return closing;
   }
 
+  /** Exits like a crashed daemon, without cleanup. The test expects this exit, so it also counts as stopped. */
+  function exitAbruptly(): void {
+    fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
+    if (mode === 'kill-on-request') process.kill(process.pid, 'SIGKILL');
+    setImmediate(() => {
+      throw new Error('fixture daemon crash\nwhile running the request');
+    });
+  }
+
   async function closeOnceAsync(): Promise<void> {
     clearInterval(timer);
     const stopped: Promise<void> = listener.stopAcceptingAsync();
diff --git a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
index b35d1d6883..37a661c978 100644
--- a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
@@ -28,6 +28,13 @@ export const DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR: number = 10;
 /** The first additive protocol minor whose shutdown acknowledgement reports the active request count. @beta */
 export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number = 11;
 
+/**
+ * The first protocol minor whose clients and daemons meet in `/tmp/rushd-<uid>` (or in the folder that
+ * `RUSHD_RUNTIME_DIR` names) rather than in one chosen by `XDG_RUNTIME_DIR` or `TMPDIR`, and whose workspace
+ * identity ignores temporary and runtime folder variables. @beta
+ */
+export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number = 12;
+
 /**
  * A rushd wire protocol version.
  *
@@ -61,7 +68,7 @@ export interface IDaemonProtocolVersion {
  */
 export const DAEMON_PROTOCOL_VERSION: IDaemonProtocolVersion = {
   major: 0,
-  minor: DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR
+  minor: DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR
 };
 
 /**
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 1537163377..575a87e8e3 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -29,10 +29,10 @@ export { DAEMON_INVOCATION_KIND_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR, DAEMON_PROTOCOL_VERSION } from './DaemonProtocolVersion';
+export { DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from './DaemonProtocolVersion';
-export { isDaemonProtocolCompatible } from './DaemonProtocolVersion';
-export type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
+export { isDaemonProtocolCompatible, type IDaemonProtocolVersion } from './DaemonProtocolVersion';
 export type { IDaemonClientCaps } from './DaemonClientCaps';
 export { DAEMON_CONTROL_MESSAGE_KINDS, isDaemonControlMessageKind } from './DaemonControlKinds';
 export type { DaemonControlMessageKind } from './DaemonControlKinds';
diff --git a/libraries/rush-daemon-transport/README.md b/libraries/rush-daemon-transport/README.md
index 4abb9d30ef..f0322bf8cf 100644
--- a/libraries/rush-daemon-transport/README.md
+++ b/libraries/rush-daemon-transport/README.md
@@ -7,8 +7,13 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
 - **Workspace keys** — `sha256(canonicalRepoRoot + rushVersion + startupOptions)`, so distinct
   workspaces, Rush versions, or startup options resolve to distinct daemon endpoints while the
   same workspace stays stable across runs.
-- **Per-user path derivation** — `$XDG_RUNTIME_DIR`-aware Unix domain sockets on POSIX and
-  `\\.\pipe\rushd-<key>` named pipes on Windows.
+- **Per-user path derivation** — Unix domain sockets in `/tmp/rushd-<uid>/` on POSIX, or in
+  `$RUSHD_RUNTIME_DIR/rushd-<uid>/` when that variable is an absolute path, and
+  `\\.\pipe\rushd-<key>` named pipes on Windows. `TMPDIR` and `XDG_RUNTIME_DIR` are not
+  consulted, because they differ between the shells, jobs and services of one user. A daemon
+  resolves its paths with the same rule, and a client that starts one passes the folder it
+  chose as `RUSHD_RUNTIME_DIR`. The folder must be a directory (not a symbolic link) that the
+  user owns; one that others can open is made owner-only (`0700`).
 - **`net` listener and connector** — framed with
   [`@rushstack/rush-daemon-protocol`](https://www.npmjs.com/package/@rushstack/rush-daemon-protocol),
   with backpressure-aware writes and serialized async frame handlers for inbound flow control.
@@ -18,6 +23,10 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
   retaining ownership. Hosts release the endpoint with `closeAsync()` after their resources have
   finished disposing. A live owner prevents rebinding even when its socket has already closed;
   repeated closes cannot remove a successor's endpoint.
+- **Owner-safe publication** — a listener binds a private name and hard-links it to the socket
+  path, so it never replaces a live peer's socket; the runtime folder's file system must support
+  hard links. On close it removes the socket and ownership record only while they are still the
+  files it created, so a predecessor that shuts down late never removes a successor's endpoint.
 
 Part of the Rush 6 / rushd re-architecture:
 [microsoft/rushstack#5894](https://github.com/microsoft/rushstack/issues/5894).
diff --git a/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
new file mode 100644
index 0000000000..2d2c896b67
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
@@ -0,0 +1,60 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+const READ_ONLY: string = 'r';
+
+/** The device and inode of a file that this process created. */
+export interface IDaemonFileIdentity {
+  readonly dev: number;
+  readonly ino: number;
+  /** An open descriptor that keeps the inode in use, so no later file can get its number (POSIX only). */
+  readonly fd?: number;
+}
+
+/** The identity of the file (not a link target) at `filePath`, or `undefined` when nothing is there. */
+export function readFileIdentity(filePath: string): IDaemonFileIdentity | undefined {
+  const stats: fs.Stats | undefined = fs.lstatSync(filePath, { throwIfNoEntry: false });
+  return stats && { dev: stats.dev, ino: stats.ino };
+}
+
+/**
+ * Returns the identity of the file that this process just wrote at `filePath`, and holds it open on POSIX.
+ *
+ * @remarks
+ * XFS and ext4 give a deleted file's inode number to the next file created, which could then pass for this one
+ * in {@link removeOwnFile}. The open descriptor keeps the inode in use until {@link removeOwnFile} releases it.
+ * An NTFS file id includes a sequence number that changes on reuse, so Windows needs no descriptor.
+ */
+export function pinFileIdentity(filePath: string): IDaemonFileIdentity {
+  const fd: number = fs.openSync(filePath, READ_ONLY);
+  const { dev, ino } = fs.fstatSync(fd);
+  if (process.platform !== WINDOWS_PLATFORM) return { dev, ino, fd };
+  fs.closeSync(fd);
+  return { dev, ino };
+}
+
+function isSameFile(current: IDaemonFileIdentity | undefined, expected: IDaemonFileIdentity): boolean {
+  if (!current) return false;
+  return current.dev === expected.dev && current.ino === expected.ino;
+}
+
+function release(identity: IDaemonFileIdentity): void {
+  if (identity.fd !== undefined) fs.closeSync(identity.fd);
+}
+
+/**
+ * Deletes `filePath` only while it is still the file this process created, then releases `identity`. Call it
+ * once for each identity.
+ *
+ * @remarks
+ * Once a daemon's socket or lockfile has been replaced, for example after someone deleted it and a successor
+ * started, the name belongs to the successor, which must stay reachable when this daemon exits.
+ */
+export function removeOwnFile(filePath: string, identity: IDaemonFileIdentity | undefined): void {
+  if (!identity) return;
+  if (isSameFile(readFileIdentity(filePath), identity)) fs.rmSync(filePath, { force: true });
+  release(identity);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonListener.ts b/libraries/rush-daemon-transport/src/DaemonListener.ts
index 083ba3ae50..6a8e18b76c 100644
--- a/libraries/rush-daemon-transport/src/DaemonListener.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListener.ts
@@ -5,14 +5,18 @@ import * as net from 'node:net';
 
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 
+import { pinFileIdentity } from './DaemonFileIdentity';
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import { DaemonFrameConnection } from './DaemonFrameConnection';
 import { listenWithReclaimAsync } from './DaemonListenerBinding';
 import { DaemonListenerLifetime } from './DaemonListenerLifetime';
-import { ensureDaemonRuntimeDir, writeDaemonLockfile } from './DaemonLockfile';
+import type { IDaemonListenerFiles } from './DaemonListenerLifetime';
+import { writeDaemonLockfile } from './DaemonLockfile';
 import { startOperationGroupRecording } from './DaemonOperationGroupRecorder';
 import { getOperationGroupsFolder } from './DaemonOperationGroups';
 import { assertDaemonOwnershipAvailable } from './DaemonOwnership';
 import type { IDaemonPaths } from './DaemonPaths';
+import { ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 
 /** Options for {@link DaemonFrameListener.listenAsync}. @beta */
 export interface IDaemonListenerOptions {
@@ -32,11 +36,11 @@ export interface IDaemonListenerOptions {
  * @beta */
 export class DaemonFrameListener {
   readonly #lifetime: DaemonListenerLifetime;
-  private constructor(server: net.Server, paths: IDaemonPaths) {
+  private constructor(server: net.Server, paths: IDaemonPaths, files: IDaemonListenerFiles) {
     // Record detached operation groups for as long as this process owns the lockfile, so a successor can
     // reap them if this daemon dies uncleanly.
     const folder: string = getOperationGroupsFolder(paths.lockfilePath, process.pid);
-    this.#lifetime = new DaemonListenerLifetime(server, paths, startOperationGroupRecording(folder));
+    this.#lifetime = new DaemonListenerLifetime(server, paths, files, startOperationGroupRecording(folder));
   }
   /** Binds the socket/pipe path and writes the PID lockfile. */
   public static async listenAsync(
@@ -48,19 +52,20 @@ export class DaemonFrameListener {
       options.onConnection(new DaemonFrameConnection(socket));
     });
     ensureDaemonRuntimeDir(paths);
-    await listenWithReclaimAsync(server, paths);
+    const socket: IDaemonFileIdentity | undefined = await listenWithReclaimAsync(server, paths);
     // Lockfile after bind: a pre-existing stale record must read as dead, not
     // as a live owner that would make reclaim refuse.
+    let lockfile: IDaemonFileIdentity | undefined;
     try {
-      writeListenerLockfile(paths, options);
+      lockfile = writeListenerLockfile(paths, options);
     } catch (error) {
-      await new DaemonListenerLifetime(server, paths).stopAcceptingAsync();
+      await new DaemonListenerLifetime(server, paths, { socket }).stopAcceptingAsync();
       throw error;
     }
-    return new DaemonFrameListener(server, paths);
+    return new DaemonFrameListener(server, paths, { socket, lockfile });
   }
 
-  /** Stops accepting connections and releases the socket/pipe and lockfile. */
+  /** Stops accepting connections and releases the socket/pipe and lockfile, unless a successor replaced them. */
   public closeAsync(): Promise<void> {
     return this.#lifetime.closeAsync();
   }
@@ -70,11 +75,12 @@ export class DaemonFrameListener {
   }
 }
 
-function writeListenerLockfile(paths: IDaemonPaths, options: IDaemonListenerOptions): void {
+function writeListenerLockfile(paths: IDaemonPaths, options: IDaemonListenerOptions): IDaemonFileIdentity {
   writeDaemonLockfile(paths.lockfilePath, {
     pid: process.pid,
     protocolVersion: options.protocolVersion,
     startedAt: options.startedAt ?? new Date().toISOString(),
     socketPath: paths.socketPath
   });
+  return pinFileIdentity(paths.lockfilePath);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
index 77885fa935..a10afacb56 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
@@ -3,15 +3,31 @@
 
 import type * as net from 'node:net';
 
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import { ADDRESS_IN_USE, listenOrErrorAsync, toListenTransportError } from './DaemonListenerNet';
 import type { INetError } from './DaemonListenerNet';
 import type { IDaemonPaths } from './DaemonPaths';
 import { reclaimStaleDaemonAsync } from './DaemonReclaim';
+import { listenPublishedAsync } from './DaemonSocketPublication';
 
 const FIRST_ATTEMPT: number = 0;
 const RECLAIM_ATTEMPT: number = 1;
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 
-export async function listenWithReclaimAsync(server: net.Server, paths: IDaemonPaths): Promise<void> {
+/**
+ * Binds the listener, reclaiming its path once from a dead daemon. Returns the identity of a POSIX socket;
+ * a Windows named pipe has no file and disappears with its server.
+ */
+export async function listenWithReclaimAsync(
+  server: net.Server,
+  paths: IDaemonPaths
+): Promise<IDaemonFileIdentity | undefined> {
+  if (process.platform !== WINDOWS_PLATFORM) return listenPublishedAsync(server, paths);
+  await listenPipeWithReclaimAsync(server, paths);
+  return undefined;
+}
+
+async function listenPipeWithReclaimAsync(server: net.Server, paths: IDaemonPaths): Promise<void> {
   for (let attempt: number = FIRST_ATTEMPT; attempt <= RECLAIM_ATTEMPT; attempt++) {
     const bound: boolean = await tryListenOnceAsync(server, paths, attempt);
     if (bound) {
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
index 90f79a48b6..a7a81b2493 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
@@ -3,15 +3,23 @@
 
 import type * as net from 'node:net';
 
-import { removeDaemonArtifacts } from './DaemonLockfile';
+import { removeOwnFile } from './DaemonFileIdentity';
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import type { StopOperationGroupRecording } from './DaemonOperationGroupRecorder';
 import type { IDaemonPaths } from './DaemonPaths';
 
+/** The files a listener created: its published POSIX socket and its lockfile. */
+export interface IDaemonListenerFiles {
+  readonly socket?: IDaemonFileIdentity;
+  readonly lockfile?: IDaemonFileIdentity;
+}
+
 function keepNoRecords(): void {
   // Nothing was recorded before the lockfile was written.
 }
 
 export class DaemonListenerLifetime {
+  readonly #files: IDaemonListenerFiles;
   readonly #paths: IDaemonPaths;
   readonly #server: net.Server;
   readonly #stopRecording: StopOperationGroupRecording;
@@ -21,15 +29,17 @@ export class DaemonListenerLifetime {
   public constructor(
     server: net.Server,
     paths: IDaemonPaths,
+    files: IDaemonListenerFiles,
     stopRecording: StopOperationGroupRecording = keepNoRecords
   ) {
     this.#server = server;
     this.#paths = paths;
+    this.#files = files;
     this.#stopRecording = stopRecording;
   }
 
   public stopAcceptingAsync(): Promise<void> {
-    this.#stopPromise ??= new Promise<void>((resolve) => this.#server.close(() => resolve()));
+    this.#stopPromise ??= this.#stopOnceAsync();
     return this.#stopPromise;
   }
 
@@ -38,9 +48,16 @@ export class DaemonListenerLifetime {
     return this.#closePromise;
   }
 
+  #stopOnceAsync(): Promise<void> {
+    // Unlink before closing, as libuv does for the path it bound, but only this listener's own socket: the
+    // name may belong to a successor by now.
+    removeOwnFile(this.#paths.socketPath, this.#files.socket);
+    return new Promise<void>((resolve: () => void) => this.#server.close(() => resolve()));
+  }
+
   async #closeOnceAsync(): Promise<void> {
     await this.stopAcceptingAsync();
     this.#stopRecording();
-    removeDaemonArtifacts(this.#paths.lockfilePath, this.#paths.socketPath);
+    removeOwnFile(this.#paths.lockfilePath, this.#files.lockfile);
   }
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonLockfile.ts b/libraries/rush-daemon-transport/src/DaemonLockfile.ts
index f81fbd1ef7..a8db247a39 100644
--- a/libraries/rush-daemon-transport/src/DaemonLockfile.ts
+++ b/libraries/rush-daemon-transport/src/DaemonLockfile.ts
@@ -6,8 +6,6 @@ import * as path from 'node:path';
 
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 
-import type { IDaemonPaths } from './DaemonPaths';
-
 const UTF8: BufferEncoding = 'utf8';
 const NO_SIGNAL: number = 0;
 const DIR_MODE: number = 0o700;
@@ -25,14 +23,6 @@ export interface IDaemonLockfile {
   readonly socketPath: string;
 }
 
-/** Creates the per-user runtime directory (mode `0700`) when the platform has one.
- * Must be called before binding a POSIX socket inside it. @beta */
-export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void {
-  if (paths.runtimeDir !== undefined) {
-    fs.mkdirSync(paths.runtimeDir, { recursive: true, mode: DIR_MODE });
-  }
-}
-
 /** Returns `true` when a process with `pid` exists and is signalable. @beta */
 export function isDaemonProcessAlive(pid: number): boolean {
   try {
@@ -68,7 +58,9 @@ export function writeDaemonLockfile(lockfilePath: string, lockfile: IDaemonLockf
   fs.writeFileSync(lockfilePath, JSON.stringify(lockfile), { encoding: UTF8, mode: FILE_MODE });
 }
 
-/** Removes the daemon lockfile and (on POSIX) the stale socket file; idempotent. @beta */
+/** Removes the daemon lockfile and (on POSIX) the stale socket file; idempotent.
+ * Only for a dead owner's files: a daemon removes its own with an identity check, since a successor may
+ * already have replaced them. @beta */
 export function removeDaemonArtifacts(lockfilePath: string, socketPath: string): void {
   for (const filePath of [lockfilePath, socketPath]) {
     try {
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index f1d4a45068..98fbb7c589 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -9,12 +9,14 @@ import {
   removeOperationGroupRecords
 } from './DaemonOperationGroups';
 import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { isOwnedEntry } from './DaemonOwnedEntry';
 import type { IProcessStat } from './DaemonProcessStat';
 import { createReapContext, isSignalableGroup } from './DaemonReapOptions';
 import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
 
 const NO_MEMBERS: number = 0;
 const LIST_SEPARATOR: string = ', ';
+const NOTHING_REAPED: DaemonOrphanReapOutcome = 'none';
 
 function isSameLeader(leader: IProcessStat, record: IOperationGroupRecord): boolean {
   const { groupId } = record;
@@ -47,6 +49,19 @@ async function terminateAndLogAsync(
   return outcome;
 }
 
+async function reapRecordedGroupsAsync(
+  folder: string,
+  context: IReapContext
+): Promise<DaemonOrphanReapOutcome> {
+  const groupIds: number[] = readOperationGroupRecords(folder)
+    .filter((record: IOperationGroupRecord) => isProvenOperationGroup(record, context))
+    .map((record: IOperationGroupRecord) => record.groupId);
+  const outcome: DaemonOrphanReapOutcome =
+    groupIds.length > NO_MEMBERS ? await terminateAndLogAsync(context, groupIds) : NOTHING_REAPED;
+  removeOperationGroupRecords(folder);
+  return outcome;
+}
+
 /**
  * Terminates the detached operation process groups that dead daemon `deadPid` recorded while it ran
  * (see `startOperationGroupRecording`), then deletes the records.
@@ -56,6 +71,7 @@ async function terminateAndLogAsync(
  * the recorded start time and still leads group and session `groupId` (a reused pid has another start
  * time), or its leader has exited and every live member of the group is in session `groupId`. Unproven
  * records are dropped without a signal. Records survive a failed reap, so the next reclaim retries.
+ * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
  * Call only under the reclaim mutex, after the daemon has been proven dead.
  */
 export async function reapDeadDaemonOperationGroupsAsync(
@@ -65,11 +81,7 @@ export async function reapDeadDaemonOperationGroupsAsync(
 ): Promise<DaemonOrphanReapOutcome> {
   const context: IReapContext = createReapContext(deadPid, options);
   const folder: string = getOperationGroupsFolder(lockfilePath, deadPid);
-  const groupIds: number[] = readOperationGroupRecords(folder)
-    .filter((record: IOperationGroupRecord) => isProvenOperationGroup(record, context))
-    .map((record: IOperationGroupRecord) => record.groupId);
-  const outcome: DaemonOrphanReapOutcome =
-    groupIds.length > NO_MEMBERS ? await terminateAndLogAsync(context, groupIds) : 'none';
-  removeOperationGroupRecords(folder);
-  return outcome;
+  return isOwnedEntry(folder, 'directory', context.uid)
+    ? reapRecordedGroupsAsync(folder, context)
+    : NOTHING_REAPED;
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
index 9de74cb9d3..e1433d0f4c 100644
--- a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
@@ -5,7 +5,8 @@ import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
 import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
 import type { IDaemonLockfile } from './DaemonLockfile';
 import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
-import { createReapContext, isSignalableGroup } from './DaemonReapOptions';
+import { isOwnedEntry } from './DaemonOwnedEntry';
+import { createReapContext, isSignalableGroup, resolveCallerUid } from './DaemonReapOptions';
 import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
 
 function isOrphanedDaemonGroup(context: IReapContext): boolean {
@@ -36,13 +37,24 @@ export async function reapDeadDaemonProcessGroupAsync(
   return outcome;
 }
 
-/** Reaps the orphaned processes of a reclaimed daemon's recorded owner, if there is one. */
+function isOwnRecord(
+  lockfilePath: string,
+  owner: IDaemonLockfile | undefined,
+  options: IDaemonOrphanReaperOptions
+): owner is IDaemonLockfile {
+  return owner !== undefined && isOwnedEntry(lockfilePath, 'file', resolveCallerUid(options));
+}
+
+/**
+ * Reaps the orphaned processes of a reclaimed daemon's recorded owner, if there is one. A lockfile that is a
+ * symbolic link, or that another user owns, names no daemon of this user, so nothing is signaled.
+ */
 export async function reapOrphansOfDeadOwnerAsync(
   lockfilePath: string,
   owner: IDaemonLockfile | undefined,
   options: IDaemonOrphanReaperOptions = {}
 ): Promise<void> {
-  if (!owner) return;
+  if (!isOwnRecord(lockfilePath, owner, options)) return;
   await reapDeadDaemonProcessGroupAsync(owner.pid, options);
   await reapDeadDaemonOperationGroupsAsync(lockfilePath, owner.pid, options);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts b/libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts
new file mode 100644
index 0000000000..a7d82d8801
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOwnedEntry.ts
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+/** What a record must be: a regular file or a directory, never a symbolic link. */
+export type DaemonOwnedEntryKind = 'file' | 'directory';
+
+const DIRECTORY: DaemonOwnedEntryKind = 'directory';
+
+function isKind(stats: fs.Stats, kind: DaemonOwnedEntryKind): boolean {
+  return kind === DIRECTORY ? stats.isDirectory() : stats.isFile();
+}
+
+function isOwner(stats: fs.Stats, uid: number | undefined): boolean {
+  // Windows has no user ids to compare.
+  return uid === undefined || stats.uid === uid;
+}
+
+/** `true` when `entryPath` itself (not a link target) is a `kind` that user `uid` owns. */
+export function isOwnedEntry(
+  entryPath: string,
+  kind: DaemonOwnedEntryKind,
+  uid: number | undefined
+): boolean {
+  const stats: fs.Stats | undefined = fs.lstatSync(entryPath, { throwIfNoEntry: false });
+  return stats !== undefined && isOwner(stats, uid) && isKind(stats, kind);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonPaths.ts b/libraries/rush-daemon-transport/src/DaemonPaths.ts
index fb1f4e558a..6e3b78134d 100644
--- a/libraries/rush-daemon-transport/src/DaemonPaths.ts
+++ b/libraries/rush-daemon-transport/src/DaemonPaths.ts
@@ -8,7 +8,16 @@ const PIPE_PREFIX: string = '\\\\.\\pipe\\';
 const SOCKET_SUFFIX: string = '.sock';
 const LOCKFILE_SUFFIX: string = '.pid.json';
 const RUNTIME_DIR_NAME: string = 'rushd';
-const XDG_RUNTIME_DIR_ENV: string = 'XDG_RUNTIME_DIR';
+// Unlike TMPDIR or XDG_RUNTIME_DIR, /tmp is the same folder for every process of a user, whatever its
+// environment (sudo, cron, env -i, ssh without PAM, a service unit), so all of them meet at one daemon.
+const SHARED_POSIX_TEMP_DIR: string = '/tmp';
+
+/**
+ * The environment variable that moves the per-user runtime directory on POSIX. Only an absolute path is used.
+ *
+ * @beta
+ */
+export const DAEMON_RUNTIME_DIR_ENV_VAR: 'RUSHD_RUNTIME_DIR' = 'RUSHD_RUNTIME_DIR';
 
 /**
  * The platform facts {@link resolveDaemonPaths} needs, injectable for tests.
@@ -40,18 +49,18 @@ export interface IDaemonPaths {
   readonly lockfilePath: string;
 }
 
-/**
- * Resolves the per-user socket/pipe and lockfile paths for a workspace key.
- *
- * @remarks
- * POSIX: `$XDG_RUNTIME_DIR/rushd-<uid>/` (falling back to `<os.tmpdir()>/rushd-<uid>/`),
- * with the socket at `rushd-<key>.sock` inside it. Windows: the named pipe
- * `\\.\pipe\rushd-<key>`; the lockfile lives in `<os.tmpdir()>/rushd/` (the
- * temporary directory is already per-user on Windows).
- *
- * @beta
- */
-export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspaceKey: string): IDaemonPaths {
+/** The base folder that `RUSHD_RUNTIME_DIR` names, when it is an absolute path. */
+function getConfiguredRuntimeBase(environment: IDaemonPathEnvironment): string | undefined {
+  const value: string | undefined = environment.env[DAEMON_RUNTIME_DIR_ENV_VAR];
+  return value !== undefined && path.posix.isAbsolute(value) ? value : undefined;
+}
+
+/** Resolves the paths of `workspaceKey` in the runtime directory `<base>/rushd-<uid>` (POSIX). */
+function resolveDaemonPathsInBase(
+  environment: IDaemonPathEnvironment,
+  workspaceKey: string,
+  base: string
+): IDaemonPaths {
   if (environment.platform === WINDOWS_PLATFORM) {
     return {
       runtimeDir: undefined,
@@ -59,7 +68,6 @@ export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspac
       lockfilePath: path.win32.join(environment.tmpdir, RUNTIME_DIR_NAME, `${workspaceKey}${LOCKFILE_SUFFIX}`)
     };
   }
-  const base: string = environment.env[XDG_RUNTIME_DIR_ENV] ?? environment.tmpdir;
   const runtimeDir: string = path.posix.join(base, `${RUNTIME_DIR_NAME}-${environment.uid}`);
   return {
     runtimeDir,
@@ -67,3 +75,23 @@ export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspac
     lockfilePath: path.posix.join(runtimeDir, `${workspaceKey}${LOCKFILE_SUFFIX}`)
   };
 }
+
+/**
+ * Resolves the per-user socket/pipe and lockfile paths at which a client finds the daemon of a workspace key.
+ *
+ * @remarks
+ * POSIX: `/tmp/rushd-<uid>/`, or `$RUSHD_RUNTIME_DIR/rushd-<uid>/` when that variable is an absolute path,
+ * with the socket at `rushd-<key>.sock` inside it. `TMPDIR` and `XDG_RUNTIME_DIR` are deliberately not
+ * consulted: they differ between the shells, services and tools of one user, which would give one checkout
+ * one daemon per environment. Windows: the named pipe `\\.\pipe\rushd-<key>`; the lockfile lives in
+ * `<os.tmpdir()>/rushd/` (the temporary directory is already per-user on Windows).
+ * A daemon resolves the paths it listens at with this same rule, and a client that starts one passes the
+ * base it chose as `RUSHD_RUNTIME_DIR`, so a daemon, its successor and every client of a checkout meet at
+ * one endpoint.
+ *
+ * @beta
+ */
+export function resolveDaemonPaths(environment: IDaemonPathEnvironment, workspaceKey: string): IDaemonPaths {
+  const base: string = getConfiguredRuntimeBase(environment) ?? SHARED_POSIX_TEMP_DIR;
+  return resolveDaemonPathsInBase(environment, workspaceKey, base);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
index 550183106c..68e6468be3 100644
--- a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
@@ -16,6 +16,8 @@ export interface IDaemonOrphanReaperOptions {
   readonly selfPid?: number;
   /** How long SIGTERM'd (and then SIGKILL'd) processes get to exit. */
   readonly graceMs?: number;
+  /** The caller's user id (`process.getuid()`); only records that this user owns are acted on. */
+  readonly uid?: number;
 }
 
 /** {@link IDaemonOrphanReaperOptions} with every default applied, for the dead daemon `deadPid`. */
@@ -25,19 +27,26 @@ export interface IReapContext {
   readonly selfPid: number;
   readonly deadPid: number;
   readonly graceMs: number;
+  readonly uid: number | undefined;
 }
 
 function resolveCaller(options: IDaemonOrphanReaperOptions): Pick<IReapContext, 'platform' | 'selfPid'> {
   return { platform: options.platform ?? process.platform, selfPid: options.selfPid ?? process.pid };
 }
 
+/** The user whose records may be acted on. */
+export function resolveCallerUid(options: IDaemonOrphanReaperOptions): number | undefined {
+  return options.uid ?? process.getuid?.();
+}
+
 /** Applies the defaults of {@link IDaemonOrphanReaperOptions}. */
 export function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
   return {
     ...resolveCaller(options),
     ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
     deadPid,
-    graceMs: options.graceMs ?? DEFAULT_GRACE_MS
+    graceMs: options.graceMs ?? DEFAULT_GRACE_MS,
+    uid: resolveCallerUid(options)
   };
 }
 
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index 5ce5a8d0e4..779b343008 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -10,6 +10,7 @@ import { reapOrphansOfDeadOwnerAsync } from './DaemonOrphanReaper';
 import type { IDaemonPaths } from './DaemonPaths';
 import { tryAcquireReclaimLock } from './DaemonReclaimLock';
 import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
+import { assertDaemonRuntimeDirIsPrivate } from './DaemonRuntimeDir';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 
 /**
@@ -23,15 +24,18 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * unlink the socket path, so a concurrent starter cannot delete a socket that
  * another process just bound. Operation processes still running in the dead
  * daemon's process group, or in the operation process groups it recorded, are
- * terminated first (see `DaemonOrphanReaper`).
+ * terminated first (see `DaemonOrphanReaper`). Nothing is read, reaped or
+ * removed unless the runtime directory is a private directory of this user.
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
- * the reclaim lock.
+ * the reclaim lock, and with code `unsafeRuntimeDirectory` for an unsafe
+ * runtime directory.
  *
  * @beta
  */
 export async function reclaimStaleDaemonAsync(paths: IDaemonPaths): Promise<void> {
+  assertDaemonRuntimeDirIsPrivate(paths);
   // The mutex lives beside the lockfile (never the same file): the lockfile
   // records the *running* daemon's live PID, while the mutex only ever records
   // a reclaimer's pid. So a live daemon is "locked" (its PID alive), while a
diff --git a/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts b/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
new file mode 100644
index 0000000000..914b5240e4
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from './DaemonPaths';
+import { verifyRuntimeFolder } from './DaemonRuntimeFolderCheck';
+
+const DIR_MODE: number = 0o700;
+
+function getCurrentUid(): number | undefined {
+  return process.getuid?.();
+}
+
+function tryCreateFolder(folder: string): unknown {
+  try {
+    fs.mkdirSync(folder, { recursive: true, mode: DIR_MODE });
+    return undefined;
+  } catch (error) {
+    return error;
+  }
+}
+
+/**
+ * Checks the per-user runtime directory, when it exists, before a client trusts the socket inside it.
+ *
+ * @remarks
+ * The folder must be a real directory (not a symbolic link) that the current user owns; one that is also
+ * open to others is changed to mode `0700`. Otherwise another user could have created it first, for example
+ * in `/tmp`, and could listen at the socket path or plant the records that reclaim acts on.
+ *
+ * @throws {@link DaemonTransportError} with code `unsafeRuntimeDirectory`.
+ *
+ * @beta
+ */
+export function assertDaemonRuntimeDirIsPrivate(paths: IDaemonPaths): void {
+  if (paths.runtimeDir !== undefined) verifyRuntimeFolder(paths.runtimeDir, getCurrentUid());
+}
+
+/**
+ * Creates the per-user runtime directory (mode `0700`) when the platform has one, and checks it as
+ * {@link assertDaemonRuntimeDirIsPrivate} does. Must be called before binding a POSIX socket inside it.
+ *
+ * @beta
+ */
+export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void {
+  if (paths.runtimeDir === undefined) return;
+  const failure: unknown = tryCreateFolder(paths.runtimeDir);
+  // An entry in the way (such as a file or a dangling link) is explained by the check, not by mkdir.
+  verifyRuntimeFolder(paths.runtimeDir, getCurrentUid());
+  if (failure !== undefined) throw failure;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts b/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
new file mode 100644
index 0000000000..a9cce175ec
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from './DaemonPaths';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+const DIR_MODE: number = 0o700;
+// The remainder by 0o100 is the group and other permission bits; by 0o10000, all permission bits.
+const GROUP_AND_OTHER_MODE_MODULUS: number = 0o100;
+const PERMISSION_MODE_MODULUS: number = 0o10000;
+const NO_MODE_BITS: number = 0;
+const OCTAL_RADIX: number = 8;
+
+interface IUnsafeFolderCheck {
+  readonly isUnsafe: (stats: fs.Stats, uid: number | undefined) => boolean;
+  readonly reason: string;
+}
+
+const UNSAFE_FOLDER_CHECKS: readonly IUnsafeFolderCheck[] = [
+  { isUnsafe: (stats: fs.Stats) => stats.isSymbolicLink(), reason: 'it is a symbolic link' },
+  { isUnsafe: (stats: fs.Stats) => !stats.isDirectory(), reason: 'it is not a directory' },
+  {
+    // Windows has no uid to compare.
+    isUnsafe: (stats: fs.Stats, uid: number | undefined) => uid !== undefined && stats.uid !== uid,
+    reason: 'another user owns it'
+  }
+];
+
+function createUnsafeFolderError(folder: string, stats: fs.Stats, reason: string): DaemonTransportError {
+  const mode: string = (stats.mode % PERMISSION_MODE_MODULUS).toString(OCTAL_RADIX);
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.unsafeRuntimeDirectory,
+    `The daemon runtime folder ${folder} is unsafe: ${reason} (owner uid ${stats.uid}, mode ${mode}). ` +
+      `Remove it, or set ${DAEMON_RUNTIME_DIR_ENV_VAR} to an absolute path of a folder that only you can write.`
+  );
+}
+
+function restrictToOwner(folder: string, stats: fs.Stats, uid: number | undefined): void {
+  // Windows has no POSIX permission bits to tighten.
+  if (uid !== undefined && stats.mode % GROUP_AND_OTHER_MODE_MODULUS !== NO_MODE_BITS) {
+    fs.chmodSync(folder, DIR_MODE);
+  }
+}
+
+function assertSafeFolder(folder: string, stats: fs.Stats, uid: number | undefined): void {
+  const unsafe: IUnsafeFolderCheck | undefined = UNSAFE_FOLDER_CHECKS.find((check: IUnsafeFolderCheck) =>
+    check.isUnsafe(stats, uid)
+  );
+  if (unsafe) throw createUnsafeFolderError(folder, stats, unsafe.reason);
+  restrictToOwner(folder, stats, uid);
+}
+
+/**
+ * When `folder` exists, throws unless it is a directory (not a symbolic link) that user `uid` owns, and makes
+ * it owner-only (mode `0700`) when others have any access. Without a `uid` (Windows), only the kind is checked.
+ *
+ * @throws {@link DaemonTransportError} with code `unsafeRuntimeDirectory`.
+ */
+export function verifyRuntimeFolder(folder: string, uid: number | undefined): void {
+  const stats: fs.Stats | undefined = fs.lstatSync(folder, { throwIfNoEntry: false });
+  if (stats) assertSafeFolder(folder, stats, uid);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
new file mode 100644
index 0000000000..d3e72e3c8c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
@@ -0,0 +1,88 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import type * as net from 'node:net';
+import * as path from 'node:path';
+
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
+import { listenOrErrorAsync, toListenTransportError } from './DaemonListenerNet';
+import type { INetError } from './DaemonListenerNet';
+import type { IDaemonPaths } from './DaemonPaths';
+import { reclaimStaleDaemonAsync } from './DaemonReclaim';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+const PRIVATE_NAME_PREFIX: string = '.bind-';
+const PRIVATE_NAME_SEPARATOR: string = '-';
+const PRIVATE_NAME_RANDOM_BYTES: number = 4;
+const HEX: BufferEncoding = 'hex';
+const SOCKET_MODE: number = 0o600;
+const ALREADY_EXISTS: string = 'EEXIST';
+
+function getPrivateSocketPath(socketPath: string): string {
+  const suffix: string = crypto.randomBytes(PRIVATE_NAME_RANDOM_BYTES).toString(HEX);
+  const name: string = `${PRIVATE_NAME_PREFIX}${process.pid}${PRIVATE_NAME_SEPARATOR}${suffix}`;
+  return path.join(path.dirname(socketPath), name);
+}
+
+function closeServerAsync(server: net.Server): Promise<void> {
+  return new Promise<void>((resolve: () => void) => server.close(() => resolve()));
+}
+
+/** Gives the private socket the name `socketPath`; `false` when that name exists (link(2) never replaces). */
+function tryLink(privatePath: string, socketPath: string): boolean {
+  try {
+    fs.linkSync(privatePath, socketPath);
+    return true;
+  } catch (error) {
+    if ((error as INetError).code !== ALREADY_EXISTS) throw error;
+    return false;
+  }
+}
+
+function stillInUse(socketPath: string): DaemonTransportError {
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.daemonAlreadyRunning,
+    `The daemon path ${socketPath} is still in use after reclaim.`
+  );
+}
+
+async function publishAsync(privatePath: string, paths: IDaemonPaths): Promise<IDaemonFileIdentity> {
+  fs.chmodSync(privatePath, SOCKET_MODE);
+  const { dev, ino } = fs.lstatSync(privatePath);
+  if (!tryLink(privatePath, paths.socketPath)) {
+    // Reclaim a dead daemon's leftovers once (this throws while their owner lives), then try again.
+    await reclaimStaleDaemonAsync(paths);
+    if (!tryLink(privatePath, paths.socketPath)) throw stillInUse(paths.socketPath);
+  }
+  return { dev, ino };
+}
+
+/**
+ * Binds a POSIX socket under a private name and then publishes it at `paths.socketPath`.
+ *
+ * @remarks
+ * When a server closes, libuv unlinks the path it bound, whichever file has that name by then. The published
+ * name may by then belong to a successor (after someone deleted this daemon's socket and another daemon
+ * started), so only the private name is ever bound, and it is deleted as soon as the socket is published.
+ * Publishing uses link(2), which, unlike bind or rename, never replaces an existing name. The socket is made
+ * owner-only before it is published. Returns the identity of the published socket; the listening socket keeps
+ * its inode in use, so the identity needs no open descriptor.
+ */
+export async function listenPublishedAsync(
+  server: net.Server,
+  paths: IDaemonPaths
+): Promise<IDaemonFileIdentity> {
+  const privatePath: string = getPrivateSocketPath(paths.socketPath);
+  const error: INetError | undefined = await listenOrErrorAsync(server, privatePath);
+  if (error) throw toListenTransportError(error, privatePath);
+  try {
+    return await publishAsync(privatePath, paths);
+  } catch (publishError) {
+    await closeServerAsync(server);
+    throw publishError;
+  } finally {
+    fs.rmSync(privatePath, { force: true });
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonTransportError.ts b/libraries/rush-daemon-transport/src/DaemonTransportError.ts
index 7a7efb9310..48e9dfb121 100644
--- a/libraries/rush-daemon-transport/src/DaemonTransportError.ts
+++ b/libraries/rush-daemon-transport/src/DaemonTransportError.ts
@@ -14,7 +14,9 @@ export enum DaemonTransportErrorCode {
   /** The connection attempt exceeded the configured timeout. */
   connectionTimeout = 'connectionTimeout',
   /** The transport was closed while an operation was in flight. */
-  transportClosed = 'transportClosed'
+  transportClosed = 'transportClosed',
+  /** The per-user runtime directory is a symbolic link, is not a directory, or another user owns it. */
+  unsafeRuntimeDirectory = 'unsafeRuntimeDirectory'
 }
 
 /**
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index 4674d34b02..7623e62198 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -18,7 +18,6 @@ export { connectDaemonAsync, type IDaemonConnectorOptions } from './DaemonConnec
 export { DaemonFrameConnection } from './DaemonFrameConnection';
 export { DaemonFrameListener, type IDaemonListenerOptions } from './DaemonListener';
 export {
-  ensureDaemonRuntimeDir,
   isDaemonProcessAlive,
   readDaemonLockfile,
   removeDaemonArtifacts,
@@ -26,9 +25,15 @@ export {
   type IDaemonLockfile
 } from './DaemonLockfile';
 export { tryAcquireReclaimLock, type DaemonReclaimLockOutcome } from './DaemonReclaimLock';
-export { resolveDaemonPaths, type IDaemonPathEnvironment, type IDaemonPaths } from './DaemonPaths';
+export {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  resolveDaemonPaths,
+  type IDaemonPathEnvironment,
+  type IDaemonPaths
+} from './DaemonPaths';
 export { resolveDaemonPathsFromProcess } from './DaemonPathsFromProcess';
 export { reclaimStaleDaemonAsync } from './DaemonReclaim';
+export { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 export { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 export {
   computeDaemonWorkspaceKey,
diff --git a/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts b/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts
index aee4c54bce..ffe6bfdbd6 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonPaths.test.ts
@@ -1,32 +1,38 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonPathEnvironment } from '../DaemonPaths';
+import type { IDaemonPathEnvironment, IDaemonPaths } from '../DaemonPaths';
 import { resolveDaemonPaths } from '../DaemonPaths';
 
 const TEST_UID: number = 1000;
 const KEY: string = 'rushd-deadbeef';
+const IGNORED_VALUES: readonly string[] = ['', 'relative/folder'];
 
 function posixEnv(env: Readonly<Record<string, string>>): IDaemonPathEnvironment {
-  return { platform: 'linux', env, tmpdir: '/tmp', uid: TEST_UID };
+  return { platform: 'linux', env, tmpdir: '/var/tmp/per-session', uid: TEST_UID };
 }
 
-it('uses XDG_RUNTIME_DIR on POSIX when set', () => {
-  const paths: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(
-    posixEnv({ XDG_RUNTIME_DIR: '/run/user/1000' }),
-    KEY
-  );
-  expect(paths.socketPath).toBe('/run/user/1000/rushd-1000/rushd-deadbeef.sock');
-  expect(paths.lockfilePath).toBe('/run/user/1000/rushd-1000/rushd-deadbeef.pid.json');
+it('meets in /tmp on POSIX, whatever TMPDIR and XDG_RUNTIME_DIR say', () => {
+  const plain: IDaemonPaths = resolveDaemonPaths(posixEnv({}), KEY);
+  expect(plain.socketPath).toBe('/tmp/rushd-1000/rushd-deadbeef.sock');
+  expect(plain.lockfilePath).toBe('/tmp/rushd-1000/rushd-deadbeef.pid.json');
+  const session: IDaemonPathEnvironment = posixEnv({ XDG_RUNTIME_DIR: '/run/user/1000', TMPDIR: '/scratch' });
+  expect(resolveDaemonPaths(session, KEY)).toEqual(plain);
+});
+
+it('moves the runtime directory to an absolute RUSHD_RUNTIME_DIR', () => {
+  const paths: IDaemonPaths = resolveDaemonPaths(posixEnv({ RUSHD_RUNTIME_DIR: '/run/rush' }), KEY);
+  expect(paths.runtimeDir).toBe('/run/rush/rushd-1000');
+  expect(paths.socketPath).toBe('/run/rush/rushd-1000/rushd-deadbeef.sock');
 });
 
-it('falls back to the temp dir on POSIX without XDG_RUNTIME_DIR', () => {
-  const paths: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(posixEnv({}), KEY);
-  expect(paths.socketPath).toBe('/tmp/rushd-1000/rushd-deadbeef.sock');
+it.each(IGNORED_VALUES)('ignores RUSHD_RUNTIME_DIR=%j, which is not an absolute path', (value: string) => {
+  const paths: IDaemonPaths = resolveDaemonPaths(posixEnv({ RUSHD_RUNTIME_DIR: value }), KEY);
+  expect(paths.runtimeDir).toBe('/tmp/rushd-1000');
 });
 
 it('uses a named pipe on Windows', () => {
-  const paths: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(
+  const paths: IDaemonPaths = resolveDaemonPaths(
     { platform: 'win32', env: {}, tmpdir: 'C:\\Users\\u\\AppData\\Local\\Temp', uid: undefined },
     KEY
   );
@@ -36,7 +42,7 @@ it('uses a named pipe on Windows', () => {
 });
 
 it('derives distinct paths for distinct keys', () => {
-  const first: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(posixEnv({}), KEY);
-  const second: ReturnType<typeof resolveDaemonPaths> = resolveDaemonPaths(posixEnv({}), 'rushd-00000000');
+  const first: IDaemonPaths = resolveDaemonPaths(posixEnv({}), KEY);
+  const second: IDaemonPaths = resolveDaemonPaths(posixEnv({}), 'rushd-00000000');
   expect(first.socketPath).not.toBe(second.socketPath);
 });
diff --git a/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts b/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
new file mode 100644
index 0000000000..3ad643c1e0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
@@ -0,0 +1,65 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import type { IDaemonFileIdentity } from '../DaemonFileIdentity';
+import { pinFileIdentity, readFileIdentity, removeOwnFile } from '../DaemonFileIdentity';
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const UTF8: BufferEncoding = 'utf8';
+const SOCKET_MODE: number = 0o600;
+const PERMISSION_MODULUS: number = 0o1000;
+const PRIVATE_NAME_PREFIX: string = '.bind-';
+
+function createFile(paths: IDaemonPaths, content: string): string {
+  const filePath: string = path.join(paths.runtimeDir ?? '', 'file');
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content);
+  return filePath;
+}
+
+posixIt('keeps a pinned inode in use, so a replacement never passes for the file it replaced', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'first');
+  const pinned: IDaemonFileIdentity = pinFileIdentity(filePath);
+  fs.rmSync(filePath);
+  fs.writeFileSync(filePath, 'second');
+  expect(readFileIdentity(filePath)?.ino).not.toBe(pinned.ino);
+  removeOwnFile(filePath, pinned);
+  expect(fs.readFileSync(filePath, UTF8)).toBe('second');
+  expect(() => fs.fstatSync(pinned.fd ?? Number.NaN)).toThrow();
+  removeIsolatedBase(paths);
+});
+
+posixIt('removes a file that is still the pinned one', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'only');
+  removeOwnFile(filePath, pinFileIdentity(filePath));
+  expect(fs.existsSync(filePath)).toBe(false);
+  removeIsolatedBase(paths);
+});
+
+posixIt('publishes an owner-only socket and deletes the private name it bound', async () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  try {
+    expect(fs.lstatSync(paths.socketPath).isSocket()).toBe(true);
+    expect(fs.lstatSync(paths.socketPath).mode % PERMISSION_MODULUS).toBe(SOCKET_MODE);
+    const names: string[] = fs.readdirSync(paths.runtimeDir ?? '');
+    expect(names.filter((name: string) => name.startsWith(PRIVATE_NAME_PREFIX))).toEqual([]);
+  } finally {
+    await listener.closeAsync();
+    removeIsolatedBase(paths);
+  }
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts b/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
new file mode 100644
index 0000000000..abd43150e2
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
@@ -0,0 +1,71 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { connectDaemonAsync } from '../DaemonConnector';
+import type { DaemonFrameConnection } from '../DaemonFrameConnection';
+import { DaemonFrameListener } from '../DaemonListener';
+import { readDaemonLockfile } from '../DaemonLockfile';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createDeferred, createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+
+// A named pipe can't be deleted while its server runs, so only POSIX has a successor in this sense.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const SUCCESSOR: string = 'successor';
+
+function listenAsync(paths: IDaemonPaths, reached?: IDeferred<string>): Promise<DaemonFrameListener> {
+  return DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => reached?.resolve(SUCCESSOR)
+  });
+}
+
+async function expectSuccessorReachableAsync(paths: IDaemonPaths, reached: IDeferred<string>): Promise<void> {
+  expect(readDaemonLockfile(paths.lockfilePath)?.socketPath).toBe(paths.socketPath);
+  const client: DaemonFrameConnection = await connectDaemonAsync(paths.socketPath);
+  await expect(reached.promise).resolves.toBe(SUCCESSOR);
+  await client.closeAsync();
+}
+
+async function expectPredecessorCloseSparesSuccessorAsync(
+  deleteFiles: (paths: IDaemonPaths) => void
+): Promise<void> {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const predecessor: DaemonFrameListener = await listenAsync(paths);
+  deleteFiles(paths);
+  const reached: IDeferred<string> = createDeferred<string>();
+  const successor: DaemonFrameListener = await listenAsync(paths, reached);
+  try {
+    await predecessor.closeAsync();
+    await expectSuccessorReachableAsync(paths, reached);
+  } finally {
+    await successor.closeAsync();
+    removeIsolatedBase(paths);
+  }
+}
+
+posixIt('keeps a successor reachable after a predecessor whose socket and lockfile were deleted closes', () =>
+  expectPredecessorCloseSparesSuccessorAsync((paths: IDaemonPaths) => {
+    fs.rmSync(paths.socketPath);
+    fs.rmSync(paths.lockfilePath);
+  })
+);
+
+posixIt('keeps a successor reachable after a predecessor whose runtime folder was deleted closes', () =>
+  expectPredecessorCloseSparesSuccessorAsync((paths: IDaemonPaths) => {
+    fs.rmSync(paths.runtimeDir ?? paths.socketPath, { recursive: true });
+  })
+);
+
+posixIt('removes its own socket and lockfile when it closes', async () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const listener: DaemonFrameListener = await listenAsync(paths);
+  await listener.closeAsync();
+  expect(fs.readdirSync(paths.runtimeDir ?? paths.socketPath)).toEqual([]);
+  removeIsolatedBase(paths);
+});
diff --git a/libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts b/libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts
new file mode 100644
index 0000000000..9cc68e6d56
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/RecordOwnership.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import type { IDaemonLockfile } from '../DaemonLockfile';
+import { writeDaemonLockfile } from '../DaemonLockfile';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { reapOrphansOfDeadOwnerAsync } from '../DaemonOrphanReaper';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_GROUP, operationTree, recordGroups, recordsRemain } from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const NO_UID: number = 0;
+const FIRST_INDEX: number = 0;
+const EPOCH_MS: number = 0;
+const OTHER_USER_OFFSET: number = 1;
+const LINK_TARGET_SUFFIX: string = '.target';
+const OWNER: IDaemonLockfile = {
+  pid: DEAD_PID,
+  protocolVersion: DAEMON_PROTOCOL_VERSION,
+  startedAt: new Date(EPOCH_MS).toISOString(),
+  socketPath: 'unused'
+};
+
+const createdEntries: string[] = [];
+
+afterEach(() => {
+  for (const entry of createdEntries.splice(FIRST_INDEX)) fs.rmSync(entry, { recursive: true, force: true });
+});
+
+function recordOwnGroups(): string {
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  for (const entry of [lockfilePath, getOperationGroupsFolder(lockfilePath, DEAD_PID)]) {
+    createdEntries.push(entry, `${entry}${LINK_TARGET_SUFFIX}`);
+  }
+  return lockfilePath;
+}
+
+function createFake(): IFakeGroup {
+  return createFakeGroup({ exitsOn: 'SIGTERM', processes: operationTree(OPERATION_GROUP) });
+}
+
+function asAnotherUser(options: IDaemonOrphanReaperOptions): IDaemonOrphanReaperOptions {
+  return { ...options, uid: (process.getuid?.() ?? NO_UID) + OTHER_USER_OFFSET };
+}
+
+function moveBehindLink(entryPath: string): void {
+  fs.renameSync(entryPath, `${entryPath}${LINK_TARGET_SUFFIX}`);
+  fs.symlinkSync(`${entryPath}${LINK_TARGET_SUFFIX}`, entryPath);
+}
+
+function recordDeadOwner(): string {
+  const lockfilePath: string = recordOwnGroups();
+  writeDaemonLockfile(lockfilePath, OWNER);
+  return lockfilePath;
+}
+
+posixIt('never signals the groups in a record folder that is a symbolic link', async () => {
+  const fake: IFakeGroup = createFake();
+  const lockfilePath: string = recordOwnGroups();
+  moveBehindLink(getOperationGroupsFolder(lockfilePath, DEAD_PID));
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'none'
+  );
+  expect(fake.signals).toEqual([]);
+  expect(recordsRemain(lockfilePath)).toBe(true);
+});
+
+posixIt('never signals the groups in a record folder of another user', async () => {
+  const fake: IFakeGroup = createFake();
+  const lockfilePath: string = recordOwnGroups();
+  const options: IDaemonOrphanReaperOptions = asAnotherUser(fake.options);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+posixIt('never signals the owner named by a lockfile of another user, or behind a link', async () => {
+  const fake: IFakeGroup = createFake();
+  const lockfilePath: string = recordDeadOwner();
+  await reapOrphansOfDeadOwnerAsync(lockfilePath, OWNER, asAnotherUser(fake.options));
+  moveBehindLink(lockfilePath);
+  await reapOrphansOfDeadOwnerAsync(lockfilePath, OWNER, fake.options);
+  expect(fake.signals).toEqual([]);
+});
+
+it('signals the group of the owner named by a lockfile of this user', async () => {
+  const fake: IFakeGroup = createFake();
+  await reapOrphansOfDeadOwnerAsync(recordDeadOwner(), OWNER, fake.options);
+  expect(fake.targets).toEqual([DEAD_PID]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts b/libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts
new file mode 100644
index 0000000000..a0f65eb349
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/RuntimeFolder.test.ts
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { verifyRuntimeFolder } from '../DaemonRuntimeFolderCheck';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// Windows has no runtime folder: its named pipes live in the kernel's pipe namespace.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const PRIVATE_MODE: number = 0o700;
+const OPEN_MODE: number = 0o755;
+const PERMISSION_MODULUS: number = 0o1000;
+const NO_UID: number = 0;
+const OTHER_USER_OFFSET: number = 1;
+const LINK_TARGET_SUFFIX: string = '.target';
+
+type Planter = (folder: string) => void;
+
+const PLANTERS: readonly [string, Planter][] = [
+  [
+    'it is a symbolic link',
+    (folder: string) => {
+      fs.mkdirSync(`${folder}${LINK_TARGET_SUFFIX}`, { mode: PRIVATE_MODE });
+      fs.symlinkSync(`${folder}${LINK_TARGET_SUFFIX}`, folder);
+    }
+  ],
+  ['it is not a directory', (folder: string) => fs.writeFileSync(folder, '')]
+];
+
+function getMode(folder: string): number {
+  return fs.statSync(folder).mode % PERMISSION_MODULUS;
+}
+
+function getOtherUid(): number {
+  return (process.getuid?.() ?? NO_UID) + OTHER_USER_OFFSET;
+}
+
+function captureError(action: () => void): unknown {
+  try {
+    action();
+  } catch (error) {
+    return error;
+  }
+}
+
+posixIt('creates the runtime folder owner-only, and tightens one that others can enter', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const folder: string = paths.runtimeDir ?? '';
+  ensureDaemonRuntimeDir(paths);
+  expect(getMode(folder)).toBe(PRIVATE_MODE);
+  fs.chmodSync(folder, OPEN_MODE);
+  assertDaemonRuntimeDirIsPrivate(paths);
+  expect(getMode(folder)).toBe(PRIVATE_MODE);
+  removeIsolatedBase(paths);
+});
+
+posixIt.each(PLANTERS)('refuses a runtime folder when %s', async (reason: string, plant: Planter) => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  plant(paths.runtimeDir ?? '');
+  const expected: object = {
+    code: DaemonTransportErrorCode.unsafeRuntimeDirectory,
+    message: expect.stringContaining(reason)
+  };
+  const error: unknown = captureError(() => assertDaemonRuntimeDirIsPrivate(paths));
+  expect(error).toMatchObject(expected);
+  expect((error as Error).message).toContain(DAEMON_RUNTIME_DIR_ENV_VAR);
+  expect(captureError(() => ensureDaemonRuntimeDir(paths))).toMatchObject(expected);
+  await expect(reclaimStaleDaemonAsync(paths)).rejects.toMatchObject(expected);
+  const listening: Promise<DaemonFrameListener> = DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  await expect(listening).rejects.toMatchObject(expected);
+  removeIsolatedBase(paths);
+});
+
+posixIt('refuses a runtime folder of another user without changing it', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const folder: string = paths.runtimeDir ?? '';
+  fs.mkdirSync(folder, { mode: OPEN_MODE });
+  fs.chmodSync(folder, OPEN_MODE);
+  expect(captureError(() => verifyRuntimeFolder(folder, getOtherUid()))).toMatchObject({
+    code: DaemonTransportErrorCode.unsafeRuntimeDirectory,
+    message: expect.stringContaining('another user owns it')
+  });
+  expect(getMode(folder)).toBe(OPEN_MODE);
+  removeIsolatedBase(paths);
+});
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts b/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
index b04a4f0f85..08585b307a 100644
--- a/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import * as os from 'node:os';
+import * as path from 'node:path';
 
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 
@@ -9,21 +11,44 @@ import { connectDaemonAsync } from '../DaemonConnector';
 import type { DaemonFrameConnection } from '../DaemonFrameConnection';
 import { DaemonFrameListener } from '../DaemonListener';
 import type { IDaemonPaths } from '../DaemonPaths';
-import { resolveDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR, resolveDaemonPaths } from '../DaemonPaths';
 
 let testKeyCounter: number = 0;
 const COUNTER_START: number = 1;
+const ISOLATED_BASE_PREFIX: string = 'rushd-test-base-';
+// Short, as a socket path must be (104 bytes on macOS); the daemon's own default base is /tmp too.
+const POSIX_TEMP_FOLDER: string = '/tmp';
 
-/** Creates unique daemon paths for the current platform in the temp dir. */
-export function createTestDaemonPaths(): IDaemonPaths {
+function resolveTestDaemonPaths(env: Readonly<Record<string, string>>): IDaemonPaths {
   testKeyCounter += COUNTER_START;
   const workspaceKey: string = `rushd-test-${process.pid}-${testKeyCounter}`;
   return resolveDaemonPaths(
-    { platform: process.platform, env: {}, tmpdir: os.tmpdir(), uid: process.getuid?.() },
+    { platform: process.platform, env, tmpdir: os.tmpdir(), uid: process.getuid?.() },
     workspaceKey
   );
 }
 
+/** Creates unique daemon paths for the current platform in the user's shared runtime directory. */
+export function createTestDaemonPaths(): IDaemonPaths {
+  return resolveTestDaemonPaths({});
+}
+
+/**
+ * Creates unique daemon paths in a new runtime base of their own (see {@link removeIsolatedBase}), for tests
+ * that delete or replace the runtime directory. Real daemons use the shared one.
+ */
+export function createIsolatedTestDaemonPaths(): IDaemonPaths {
+  const parent: string = process.platform === 'win32' ? os.tmpdir() : POSIX_TEMP_FOLDER;
+  const base: string = fs.mkdtempSync(path.join(parent, ISOLATED_BASE_PREFIX));
+  return resolveTestDaemonPaths({ [DAEMON_RUNTIME_DIR_ENV_VAR]: base });
+}
+
+/** Deletes the runtime base of paths from {@link createIsolatedTestDaemonPaths}. */
+export function removeIsolatedBase(paths: IDaemonPaths): void {
+  if (paths.runtimeDir !== undefined)
+    fs.rmSync(path.dirname(paths.runtimeDir), { recursive: true, force: true });
+}
+
 /** A minimal deferred promise for crossing the callback/async boundary. */
 export interface IDeferred<T> {
   readonly promise: Promise<T>;
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index a28234b3df..5b121b1c42 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -86,7 +86,9 @@ The host uses stable fingerprints to classify native requests:
 Configuration fingerprints use contents rather than timestamps. Runtime content hashes are cached only behind
 file identity/size/mtime/ctime checks; touching unchanged content does not itself change a fingerprint.
 Native dispatch first copies the envelope and normalizes only engine-owned `_RUSH_LIB_PATH` to this daemon's
-real engine, preventing false restarts or wrong SDK selection from a foreign client path. Environment
+own engine, preventing false restarts or wrong SDK selection from a foreign client path. The daemon keeps the
+spelling that its engine chose when it loaded: a source-built rush-lib, such as one in a `rush deploy` output,
+is spelled through the daemon's own `node_modules/@microsoft/rush-lib` link so plugins can resolve it by name. Environment
 comparisons (the tier-2 fingerprint and the production resolver's startup-environment check) both use rush-lib's
 `getWorkspaceFingerprintEnvironmentEntries()`, which omits `workspaceFingerprintIgnoredEnvironmentVariables`:
 volatile per-shell, terminal, session and client-routing variables such as `PWD`, `OLDPWD`, `SHLVL`, `_`,
diff --git a/libraries/rush-daemon/package.json b/libraries/rush-daemon/package.json
index c89c2059a4..663f3128ca 100644
--- a/libraries/rush-daemon/package.json
+++ b/libraries/rush-daemon/package.json
@@ -56,6 +56,9 @@
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",
+    "@rushstack/rush-amazon-s3-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-azure-storage-build-cache-plugin": "workspace:*",
+    "@rushstack/rush-http-build-cache-plugin": "workspace:*",
     "eslint": "~9.37.0",
     "local-node-rig": "workspace:*"
   },
diff --git a/libraries/rush-daemon/src/RushLibPathHandoff.ts b/libraries/rush-daemon/src/RushLibPathHandoff.ts
new file mode 100644
index 0000000000..14a924e5ac
--- /dev/null
+++ b/libraries/rush-daemon/src/RushLibPathHandoff.ts
@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+/**
+ * Returns the daemon's own `_RUSH_LIB_PATH` value for the rush-lib at `entryPoint`.
+ *
+ * @remarks
+ * When rush-lib loads, it may spell its entry point through a `node_modules` link, so that plugins can
+ * resolve it by name (for example in a `rush deploy` output). That spelling is kept whenever it names the
+ * same file as `entryPoint`. Anything else, such as a foreign client's engine, is replaced by `entryPoint`.
+ */
+export function getRushLibPathHandoff(entryPoint: string, currentValue: string | undefined): string {
+  if (currentValue === undefined || currentValue === entryPoint) {
+    return entryPoint;
+  }
+  const realEntryPoint: string | undefined = tryGetRealPath(entryPoint);
+  return realEntryPoint !== undefined && tryGetRealPath(currentValue) === realEntryPoint
+    ? currentValue
+    : entryPoint;
+}
+
+function tryGetRealPath(filePath: string): string | undefined {
+  try {
+    return fs.realpathSync.native(filePath);
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
index ee8d7b1e97..f39cbd2717 100644
--- a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
+++ b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
@@ -13,6 +13,7 @@ import {
   type IDaemonInstallationMetadata,
   type IInstalledDaemonLauncher
 } from './DaemonInstallation';
+import { getRushLibPathHandoff } from './RushLibPathHandoff';
 import { installWindowsHideDefault } from './WindowsSubprocessConsoles';
 
 async function mainAsync(): Promise<void> {
@@ -30,7 +31,8 @@ async function mainAsync(): Promise<void> {
     throw new Error(`Rush runtime and installed metadata disagree for ${metadata.launcherPath}.`);
   }
   // This is the native Rush SDK handoff, pointing at the actual selected engine, not the caller's engine.
-  process.env._RUSH_LIB_PATH = rushLibEntryPoint;
+  // Loading the selected rush-lib already set it; its spelling is kept if it names that engine.
+  process.env._RUSH_LIB_PATH = getRushLibPathHandoff(rushLibEntryPoint, process.env._RUSH_LIB_PATH);
   const protocol: { DAEMON_PROTOCOL_VERSION?: IDaemonProtocolVersion } = selectedRequire(
     '@rushstack/rush-daemon-protocol'
   );
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 96349a42b2..9bc35cba8e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -45,6 +45,7 @@ import {
 } from './WorkspaceRequestAdmission';
 import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
+import { getRushLibPathHandoff } from './RushLibPathHandoff';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
@@ -184,7 +185,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       ...request,
       environment: {
         ...request.environment,
-        [EnvironmentVariableNames._RUSH_LIB_PATH]: require.resolve('@microsoft/rush-lib')
+        [EnvironmentVariableNames._RUSH_LIB_PATH]: getRushLibPathHandoff(
+          require.resolve('@microsoft/rush-lib'),
+          process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
+        )
       }
     };
     if (this.#restartPending) {
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index c9c31ac580..0667da53eb 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -525,6 +525,48 @@ describe('native production daemon engine', () => {
     }
   });
 
+  it('keeps its own linked spelling of the native SDK handoff', async () => {
+    // A deployed daemon spells rush-lib through its own node_modules link, so plugins can resolve it by name.
+    const originalRushLibPath: string | undefined = process.env._RUSH_LIB_PATH;
+    const linkRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-sdk-link-'));
+    const rushLibFolder: string = path.dirname(require.resolve('@microsoft/rush-lib/package.json'));
+    const rushLibLink: string = path.join(linkRoot, 'node_modules', '@microsoft', 'rush-lib');
+    fs.mkdirSync(path.dirname(rushLibLink), { recursive: true });
+    fs.symlinkSync(rushLibFolder, rushLibLink, 'junction');
+    const linkedEntryPoint: string = path.join(
+      rushLibLink,
+      path.relative(rushLibFolder, require.resolve('@microsoft/rush-lib'))
+    );
+    process.env._RUSH_LIB_PATH = linkedEntryPoint;
+    try {
+      const fixture: IFixture = await createFixtureAsync();
+      try {
+        expect((await runAsync(fixture, 'linked-sdk', ['build', '--only', 'a'])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0 }
+        });
+        const environment: Record<string, string> = {
+          ...requestEnvironment(),
+          _RUSH_LIB_PATH: path.join(fixture.repoRoot, 'foreign-client-engine.js')
+        };
+        expect(
+          (await runAsync(fixture, 'foreign-linked-sdk', ['build', '--only', 'a'], { environment })).terminal
+        ).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0, scheduled: false } });
+        expect(process.env._RUSH_LIB_PATH).toBe(linkedEntryPoint);
+        expect(runs(fixture)).toEqual(['a:one:']);
+      } finally {
+        await fixture[Symbol.asyncDispose]();
+      }
+    } finally {
+      if (originalRushLibPath === undefined) {
+        delete process.env._RUSH_LIB_PATH;
+      } else {
+        process.env._RUSH_LIB_PATH = originalRushLibPath;
+      }
+      fs.rmSync(linkRoot, { recursive: true, force: true });
+    }
+  });
+
   it('replaces configuration and command shape in-process without using a disposed generation', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
diff --git a/libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts b/libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts
new file mode 100644
index 0000000000..6a0a3b9d11
--- /dev/null
+++ b/libraries/rush-daemon/src/test/RushLibPathHandoff.test.ts
@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { getRushLibPathHandoff } from '../RushLibPathHandoff';
+
+describe(getRushLibPathHandoff.name, () => {
+  let folder: string;
+  let entryPoint: string;
+  let linkedEntryPoint: string;
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-lib-path-')));
+    const rushLibFolder: string = path.join(folder, 'libraries', 'rush-lib');
+    fs.mkdirSync(path.join(rushLibFolder, 'lib-commonjs'), { recursive: true });
+    entryPoint = path.join(rushLibFolder, 'lib-commonjs', 'index.js');
+    fs.writeFileSync(entryPoint, '');
+    const rushLibLink: string = path.join(folder, 'daemon', 'node_modules', '@microsoft', 'rush-lib');
+    fs.mkdirSync(path.dirname(rushLibLink), { recursive: true });
+    fs.symlinkSync(rushLibFolder, rushLibLink, 'junction');
+    linkedEntryPoint = path.join(rushLibLink, 'lib-commonjs', 'index.js');
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('uses the entry point when nothing is set', () => {
+    expect(getRushLibPathHandoff(entryPoint, undefined)).toBe(entryPoint);
+  });
+
+  it('keeps a linked spelling of the same entry point', () => {
+    expect(getRushLibPathHandoff(entryPoint, linkedEntryPoint)).toBe(linkedEntryPoint);
+  });
+
+  it('replaces a different or missing engine', () => {
+    const otherEntryPoint: string = path.join(folder, 'other', 'index.js');
+    fs.mkdirSync(path.dirname(otherEntryPoint), { recursive: true });
+    fs.writeFileSync(otherEntryPoint, '');
+
+    expect(getRushLibPathHandoff(entryPoint, otherEntryPoint)).toBe(entryPoint);
+    expect(getRushLibPathHandoff(entryPoint, path.join(folder, 'missing.js'))).toBe(entryPoint);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
index 3e2b004672..c6a00d72b3 100644
--- a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
+++ b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
@@ -104,7 +104,7 @@ export class SuccessfulMutationFixture implements AsyncDisposable {
       ...process.env,
       HOME: home,
       USERPROFILE: home,
-      XDG_RUNTIME_DIR: path.join(this.folder, 'runtime'),
+      RUSHD_RUNTIME_DIR: path.join(this.folder, 'runtime'),
       RUSH_GLOBAL_FOLDER: path.join(this.folder, 'rush-global'),
       RUSH_PNPM_STORE_PATH: path.join(this.folder, 'store'),
       RUSH_TEMP_FOLDER: undefined,
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 1187628df5..5458cc0ad3 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -56,6 +56,7 @@ describe('version-selected daemon launcher', () => {
         RUSH_GLOBAL_FOLDER: path.join(repoRoot, 'global'),
         RUSH_PREVIEW_VERSION: undefined,
         NPM_CONFIG_CACHE: path.join(repoRoot, 'npm-cache'),
+        RUSHD_RUNTIME_DIR: path.join(repoRoot, 'runtime'),
         XDG_RUNTIME_DIR: path.join(repoRoot, 'runtime'),
         TMPDIR: path.join(repoRoot, 'runtime'),
         TMP: path.join(repoRoot, 'runtime'),
@@ -99,13 +100,20 @@ describe('version-selected daemon launcher', () => {
         COPILOT_AGENT_SESSION_ID: 'session-1',
         RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
         RUSHD_OUTPUT: 'agent',
+        // The first client's session folders may disappear while the daemon lives on.
+        TMPDIR: '/tmp/session-1',
+        XDG_RUNTIME_DIR: '/run/user/1000',
+        TEMP: '/tmp/temp-1',
+        RUSHD_RUNTIME_DIR: '/var/rushd',
         UNSET: undefined
       }
     });
     expect(command.environment).toEqual({
       HOME: '/home/user',
       RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
-      RUSHD_OUTPUT: 'agent'
+      RUSHD_OUTPUT: 'agent',
+      TEMP: '/tmp/temp-1',
+      RUSHD_RUNTIME_DIR: '/var/rushd'
     });
     expect(Object.isFrozen(command.environment)).toBe(true);
   });
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index b8914cfab9..0505b2633f 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -66,6 +66,8 @@ export interface IWorkspaceInputFingerprintOptions {
  *   `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` is sent as each request's admission deadline, `RUSHD_OUTPUT` selects
  *   the client's output mode, and `RUSH_DAEMON_EXPERIMENTAL` is read from each request rather than from the process
  * - `RUSH_PARALLELISM`, which a long-lived host applies to each request as its `--parallelism` default
+ * - temporary and runtime folders, which are often set per session, job or sandbox: `TMPDIR`, `TMP`, `TEMP` and
+ *   `XDG_RUNTIME_DIR`, and `RUSHD_RUNTIME_DIR`, which only selects the folder where a client meets its daemon
  *
  * Every other variable remains a process-bound input, including the remaining `RUSH_*` settings (such as
  * `RUSH_BUILD_CACHE_*` and the daemon's own `RUSH_DAEMON_*` resource settings), `NODE_*`, npm/pnpm
@@ -142,7 +144,12 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   'RUSHD_OUTPUT',
   'RUSH_DAEMON_EXPERIMENTAL',
-  'RUSH_PARALLELISM'
+  'RUSH_PARALLELISM',
+  'TMPDIR',
+  'TMP',
+  'TEMP',
+  'XDG_RUNTIME_DIR',
+  'RUSHD_RUNTIME_DIR'
 ]);
 
 /**
@@ -152,14 +159,18 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
  * A long-lived host must not inherit these variables from the client that started it: it applies
  * `RUSH_PARALLELISM` from each request's own environment, and code running inside the host that reads a session
  * identifier such as `COPILOT_AGENT_SESSION_ID` from `process.env` would otherwise attribute every later session's
- * work to the first one.
+ * work to the first one. Likewise, the first client's `TMPDIR` or `XDG_RUNTIME_DIR` may be removed when that
+ * client's session or job ends, while the host lives on. (`TMP` and `TEMP` stay, because Windows has no usable
+ * default for them.)
  * On Windows, names are matched case-insensitively.
  *
  * @alpha
  */
 export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string> = new Set([
   'RUSH_PARALLELISM',
-  'COPILOT_AGENT_SESSION_ID'
+  'COPILOT_AGENT_SESSION_ID',
+  'TMPDIR',
+  'XDG_RUNTIME_DIR'
 ]);
 
 /**
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 90f646331c..400cc891eb 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -221,7 +221,9 @@ describe('workspace input fingerprints', () => {
           WT_SESSION: 'w'
         },
         { PATH: `${base.PATH}${path.delimiter}${base.PATH}` },
-        { TERM: undefined, PWD: undefined }
+        { TERM: undefined, PWD: undefined },
+        { TMPDIR: '/scratch/job-1', XDG_RUNTIME_DIR: '/run/user/1000' },
+        { TMP: 'C:\\Temp\\2', TEMP: 'C:\\Temp\\2', RUSHD_RUNTIME_DIR: '/run/rush' }
       ]) {
         expect(await getHashAsync({ ...base, ...volatile })).toBe(baseHash);
       }
@@ -262,12 +264,18 @@ describe('workspace input fingerprints', () => {
       COPILOT_AGENT_SESSION_ID: 'session-1',
       RUSHD_OUTPUT: 'agent',
       RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      TMPDIR: '/scratch/job-1',
+      XDG_RUNTIME_DIR: '/run/user/1000',
+      TEMP: 'C:\\Temp',
+      RUSHD_RUNTIME_DIR: '/run/rush',
       UNSET: undefined
     };
     expect(getWorkspaceHostEnvironment(environment)).toEqual({
       HOME: '/home/user',
       RUSHD_OUTPUT: 'agent',
-      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400'
+      RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
+      TEMP: 'C:\\Temp',
+      RUSHD_RUNTIME_DIR: '/run/rush'
     });
     for (const name of workspaceRequestScopedEnvironmentVariables) {
       expect(workspaceFingerprintIgnoredEnvironmentVariables.has(name)).toBe(true);
diff --git a/libraries/rush-lib/src/pluginFramework/PluginManager.ts b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
index 2322d6f071..e5c2223cdc 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginManager.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { FileSystem, Import, InternalError } from '@rushstack/node-core-library';
+import { FileSystem, Import, InternalError, type IPackageJson } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
 
 import type { CommandLineConfiguration } from '../api/CommandLineConfiguration';
@@ -13,6 +13,8 @@ import { _createRushSessionForPlugin, type RushSession } from './RushSession';
 import type { PluginLoaderBase, IRushPluginManifest } from './PluginLoader/PluginLoaderBase';
 import { Rush } from '../api/Rush';
 import type { RushGlobalFolder } from '../api/RushGlobalFolder';
+import { findNodeModulesPackageFolder } from '../utilities/RushLibPathHandoff';
+import { rushLibPathHandoff } from '../utilities/SetRushLibPath';
 
 export interface IPluginManagerOptions {
   terminal: ITerminal;
@@ -61,19 +63,38 @@ export class PluginManager {
     // "publishOnlyDependencies" which gets moved into "dependencies" during publishing.
     const builtInPluginConfigurations: IBuiltInPluginConfiguration[] = options.builtInPluginConfigurations;
 
-    const ownPackageJsonDependencies: Record<string, string> = Rush._rushLibPackageJson.dependencies || {};
+    const ownPackageJson: IPackageJson & { publishOnlyDependencies?: Record<string, string> } =
+      Rush._rushLibPackageJson;
+    const ownPackageJsonDependencies: Record<string, string> = ownPackageJson.dependencies || {};
+    const publishOnlyDependencies: Record<string, string> = ownPackageJson.publishOnlyDependencies || {};
     function tryAddBuiltInPlugin(builtInPluginName: string, pluginPackageName?: string): void {
       if (!pluginPackageName) {
         pluginPackageName = `@rushstack/${builtInPluginName}`;
       }
+      if (
+        builtInPluginConfigurations.some(
+          ({ packageName, pluginName }) => packageName === pluginPackageName && pluginName === builtInPluginName
+        )
+      ) {
+        // The host already provides this plugin, as apps/rush/src/start-dev.ts does.
+        return;
+      }
+      let pluginPackageFolder: string | undefined;
       if (ownPackageJsonDependencies[pluginPackageName]) {
+        pluginPackageFolder = Import.resolvePackage({
+          packageName: pluginPackageName,
+          baseFolderPath: __dirname
+        });
+      } else if (publishOnlyDependencies[pluginPackageName] && rushLibPathHandoff) {
+        // An unpublished rush-lib, such as one in a "rush deploy" output, uses the plugins that its host
+        // installed next to the rush-lib link that _RUSH_LIB_PATH goes through.
+        pluginPackageFolder = findNodeModulesPackageFolder(rushLibPathHandoff.packageFolder, pluginPackageName);
+      }
+      if (pluginPackageFolder) {
         builtInPluginConfigurations.push({
           packageName: pluginPackageName,
           pluginName: builtInPluginName,
-          pluginPackageFolder: Import.resolvePackage({
-            packageName: pluginPackageName,
-            baseFolderPath: __dirname
-          })
+          pluginPackageFolder
         });
       }
     }
diff --git a/libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts b/libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts
new file mode 100644
index 0000000000..443e90a293
--- /dev/null
+++ b/libraries/rush-lib/src/pluginFramework/test/PluginManager.test.ts
@@ -0,0 +1,129 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+let mockRushLibPathHandoff: IRushLibPathHandoff | undefined;
+jest.mock('../../utilities/SetRushLibPath', () => ({
+  get rushLibPathHandoff(): IRushLibPathHandoff | undefined {
+    return mockRushLibPathHandoff;
+  }
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IPackageJson } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { Rush } from '../../api/Rush';
+import type { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushGlobalFolder } from '../../api/RushGlobalFolder';
+import type { IRushLibPathHandoff } from '../../utilities/RushLibPathHandoff';
+import type { IBuiltInPluginConfiguration } from '../PluginLoader/BuiltInPluginLoader';
+import { PluginManager } from '../PluginManager';
+import type { RushSession } from '../RushSession';
+
+const S3_PACKAGE: string = '@rushstack/rush-amazon-s3-build-cache-plugin';
+const AZURE_PACKAGE: string = '@rushstack/rush-azure-storage-build-cache-plugin';
+const HTTP_PACKAGE: string = '@rushstack/rush-http-build-cache-plugin';
+
+describe(PluginManager.name, () => {
+  let folder: string;
+  let hostNodeModules: string;
+
+  function addBuiltInPlugins(
+    builtInPluginConfigurations: IBuiltInPluginConfiguration[]
+  ): IBuiltInPluginConfiguration[] {
+    // The constructor adds Rush's own built-in plugins to the host's list.
+    new PluginManager({
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      rushConfiguration: undefined as unknown as RushConfiguration,
+      rushSession: {} as RushSession,
+      builtInPluginConfigurations,
+      restrictConsoleOutput: false,
+      rushGlobalFolder: {} as RushGlobalFolder
+    });
+    return builtInPluginConfigurations;
+  }
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-plugin-manager-')));
+    hostNodeModules = path.join(folder, 'deploy', 'apps', 'host', 'node_modules');
+    const rushLibLink: string = path.join(hostNodeModules, '@microsoft', 'rush-lib');
+    fs.mkdirSync(rushLibLink, { recursive: true });
+    fs.writeFileSync(path.join(rushLibLink, 'package.json'), '{}');
+    for (const packageName of [S3_PACKAGE, AZURE_PACKAGE]) {
+      fs.mkdirSync(path.join(hostNodeModules, packageName), { recursive: true });
+      fs.writeFileSync(path.join(hostNodeModules, packageName, 'package.json'), '{}');
+    }
+    mockRushLibPathHandoff = {
+      entryPoint: path.join(rushLibLink, 'lib-commonjs', 'index.js'),
+      packageFolder: rushLibLink
+    };
+    jest.spyOn(Rush, '_rushLibPackageJson', 'get').mockReturnValue({
+      name: '@microsoft/rush-lib',
+      version: '1.0.0',
+      dependencies: {},
+      publishOnlyDependencies: {
+        [S3_PACKAGE]: 'workspace:*',
+        [AZURE_PACKAGE]: 'workspace:*',
+        [HTTP_PACKAGE]: 'workspace:*'
+      }
+    } as IPackageJson);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('registers publish-only built-in plugins that the host installed next to its rush-lib link', () => {
+    expect(addBuiltInPlugins([])).toEqual([
+      {
+        packageName: S3_PACKAGE,
+        pluginName: 'rush-amazon-s3-build-cache-plugin',
+        pluginPackageFolder: path.join(hostNodeModules, S3_PACKAGE)
+      },
+      {
+        packageName: AZURE_PACKAGE,
+        pluginName: 'rush-azure-storage-build-cache-plugin',
+        pluginPackageFolder: path.join(hostNodeModules, AZURE_PACKAGE)
+      },
+      {
+        packageName: AZURE_PACKAGE,
+        pluginName: 'rush-azure-interactive-auth-plugin',
+        pluginPackageFolder: path.join(hostNodeModules, AZURE_PACKAGE)
+      }
+    ]);
+  });
+
+  it('does not add a built-in plugin that the host already provides', () => {
+    const hostAzurePlugin: IBuiltInPluginConfiguration = {
+      packageName: AZURE_PACKAGE,
+      pluginName: 'rush-azure-storage-build-cache-plugin',
+      pluginPackageFolder: path.join(folder, 'dev', AZURE_PACKAGE)
+    };
+
+    expect(
+      addBuiltInPlugins([hostAzurePlugin]).map(({ pluginName, pluginPackageFolder }) => [
+        pluginName,
+        pluginPackageFolder
+      ])
+    ).toEqual([
+      ['rush-azure-storage-build-cache-plugin', path.join(folder, 'dev', AZURE_PACKAGE)],
+      ['rush-amazon-s3-build-cache-plugin', path.join(hostNodeModules, S3_PACKAGE)],
+      ['rush-azure-interactive-auth-plugin', path.join(hostNodeModules, AZURE_PACKAGE)]
+    ]);
+  });
+
+  it('registers no publish-only plugin when rush-lib is not linked next to it', () => {
+    const localRushLib: string = path.join(folder, 'deploy', 'libraries', 'rush-lib');
+    fs.mkdirSync(localRushLib, { recursive: true });
+    mockRushLibPathHandoff = {
+      entryPoint: path.join(localRushLib, 'lib-commonjs', 'index.js'),
+      packageFolder: localRushLib
+    };
+
+    expect(addBuiltInPlugins([])).toEqual([]);
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/RushLibPathHandoff.ts b/libraries/rush-lib/src/utilities/RushLibPathHandoff.ts
new file mode 100644
index 0000000000..60136347c8
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/RushLibPathHandoff.ts
@@ -0,0 +1,106 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library';
+
+const RUSH_LIB_PACKAGE_NAME: string = '@microsoft/rush-lib';
+
+/**
+ * The rush-lib entry point that Rush hands to plugins and child processes as `_RUSH_LIB_PATH`.
+ */
+export interface IRushLibPathHandoff {
+  /** The entry point handed off as `_RUSH_LIB_PATH`. */
+  readonly entryPoint: string;
+  /** The rush-lib package folder, spelled the same way as `entryPoint`. */
+  readonly packageFolder: string;
+}
+
+export interface IGetRushLibPathHandoffOptions {
+  /** The folder of the loaded rush-lib package. */
+  readonly packageFolder: string;
+  /** The loaded rush-lib entry point, inside `packageFolder`. */
+  readonly entryPoint: string;
+  /** Scripts whose own `node_modules` folders may link rush-lib, such as `process.argv[1]`. */
+  readonly hostScriptPaths: ReadonlyArray<string | undefined>;
+  /** The inherited `_RUSH_LIB_PATH` value, if any. */
+  readonly inheritedEntryPoint: string | undefined;
+}
+
+/**
+ * Returns the first `node_modules/<packageName>` folder that Node.js module lookup finds from `startFolder`.
+ * Symbolic links are not followed, so the result keeps the spelling of `startFolder`.
+ */
+export function findNodeModulesPackageFolder(startFolder: string, packageName: string): string | undefined {
+  let folder: string = path.resolve(startFolder);
+  for (;;) {
+    if (path.basename(folder) !== 'node_modules') {
+      const packageFolder: string = path.join(folder, 'node_modules', packageName);
+      if (FileSystem.exists(path.join(packageFolder, 'package.json'))) {
+        return packageFolder;
+      }
+    }
+    const parentFolder: string = path.dirname(folder);
+    if (parentFolder === folder) {
+      return undefined;
+    }
+    folder = parentFolder;
+  }
+}
+
+/**
+ * Chooses how to spell the rush-lib entry point in `_RUSH_LIB_PATH`.
+ *
+ * @remarks
+ * Plugins resolve `@microsoft/rush-lib` and its dependencies by name from `_RUSH_LIB_PATH`. That needs a
+ * `node_modules/@microsoft/rush-lib` folder above the path. Installed packages always have one, so their real
+ * path is used unchanged. A local project folder, such as one in a `rush deploy` output, doesn't. Its entry
+ * point is spelled through the `node_modules` link of the host script that loaded it, or else of an inherited
+ * `_RUSH_LIB_PATH` that points at the same file.
+ */
+export function getRushLibPathHandoff(options: IGetRushLibPathHandoffOptions): IRushLibPathHandoff {
+  const { packageFolder, entryPoint, hostScriptPaths, inheritedEntryPoint } = options;
+  const realPackageFolder: string | undefined = tryGetRealPath(packageFolder);
+  const findRushLibLink: (fromPath: string) => string | undefined = (fromPath: string) => {
+    const linkFolder: string | undefined = findNodeModulesPackageFolder(
+      path.dirname(fromPath),
+      RUSH_LIB_PACKAGE_NAME
+    );
+    return linkFolder !== undefined && tryGetRealPath(linkFolder) === realPackageFolder
+      ? linkFolder
+      : undefined;
+  };
+
+  if (realPackageFolder === undefined || findRushLibLink(entryPoint) !== undefined) {
+    return { entryPoint, packageFolder };
+  }
+
+  const relativeEntryPoint: string = path.relative(packageFolder, entryPoint);
+  for (const hostScriptPath of hostScriptPaths) {
+    const realHostScriptPath: string | undefined = hostScriptPath ? tryGetRealPath(hostScriptPath) : undefined;
+    const linkFolder: string | undefined = realHostScriptPath ? findRushLibLink(realHostScriptPath) : undefined;
+    if (linkFolder !== undefined) {
+      return { entryPoint: path.join(linkFolder, relativeEntryPoint), packageFolder: linkFolder };
+    }
+  }
+
+  if (inheritedEntryPoint && tryGetRealPath(inheritedEntryPoint) === tryGetRealPath(entryPoint)) {
+    const linkFolder: string | undefined = findRushLibLink(inheritedEntryPoint);
+    const spelledEntryPoint: string | undefined =
+      linkFolder !== undefined ? path.join(linkFolder, relativeEntryPoint) : undefined;
+    if (linkFolder !== undefined && spelledEntryPoint === path.resolve(inheritedEntryPoint)) {
+      return { entryPoint: spelledEntryPoint, packageFolder: linkFolder };
+    }
+  }
+
+  return { entryPoint, packageFolder };
+}
+
+function tryGetRealPath(fileOrFolderPath: string): string | undefined {
+  try {
+    return FileSystem.getRealPath(fileOrFolderPath);
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-lib/src/utilities/SetRushLibPath.ts b/libraries/rush-lib/src/utilities/SetRushLibPath.ts
index ffc527ff22..f032e043fd 100644
--- a/libraries/rush-lib/src/utilities/SetRushLibPath.ts
+++ b/libraries/rush-lib/src/utilities/SetRushLibPath.ts
@@ -4,10 +4,26 @@
 import { PackageJsonLookup } from '@rushstack/node-core-library';
 
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
+import { getRushLibPathHandoff, type IRushLibPathHandoff } from './RushLibPathHandoff';
 
-const rootDir: string | undefined = PackageJsonLookup.instance.tryGetPackageFolderFor(__dirname);
-if (rootDir) {
+function setRushLibPath(): IRushLibPathHandoff | undefined {
+  const rootDir: string | undefined = PackageJsonLookup.instance.tryGetPackageFolderFor(__dirname);
+  if (!rootDir) {
+    return undefined;
+  }
   // Route to the 'main' field of package.json
   const rushLibIndex: string = require.resolve(rootDir, { paths: [] });
-  process.env[EnvironmentVariableNames._RUSH_LIB_PATH] = rushLibIndex;
+  const handoff: IRushLibPathHandoff = getRushLibPathHandoff({
+    packageFolder: rootDir,
+    entryPoint: rushLibIndex,
+    hostScriptPaths: [process.argv[1]],
+    inheritedEntryPoint: process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
+  });
+  process.env[EnvironmentVariableNames._RUSH_LIB_PATH] = handoff.entryPoint;
+  return handoff;
 }
+
+/**
+ * The `_RUSH_LIB_PATH` value that this rush-lib set when it was loaded.
+ */
+export const rushLibPathHandoff: IRushLibPathHandoff | undefined = setRushLibPath();
diff --git a/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts b/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
new file mode 100644
index 0000000000..0b3437cb10
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
@@ -0,0 +1,200 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  findNodeModulesPackageFolder,
+  getRushLibPathHandoff,
+  type IRushLibPathHandoff
+} from '../RushLibPathHandoff';
+
+const ENTRY_POINT_SUBPATH: string = path.join('lib-commonjs', 'index.js');
+
+describe(getRushLibPathHandoff.name, () => {
+  let folder: string;
+  let localRushLib: string;
+  let hostScript: string;
+  let hostLink: string;
+
+  function writePackage(packageFolder: string, name: string): void {
+    fs.mkdirSync(path.join(packageFolder, 'lib-commonjs'), { recursive: true });
+    fs.writeFileSync(
+      path.join(packageFolder, 'package.json'),
+      JSON.stringify({ name, version: '1.0.0', main: './lib-commonjs/index.js' })
+    );
+    fs.writeFileSync(path.join(packageFolder, ENTRY_POINT_SUBPATH), 'module.exports = {};');
+  }
+
+  function link(target: string, newLinkPath: string): void {
+    fs.mkdirSync(path.dirname(newLinkPath), { recursive: true });
+    fs.symlinkSync(target, newLinkPath, 'junction');
+  }
+
+  // Resolves the way plugins do, from a process outside of any rush-lib package scope.
+  function resolveByName(request: string, fromPath: string): string {
+    return childProcess
+      .execFileSync(
+        process.execPath,
+        ['-e', 'process.stdout.write(require.resolve(process.argv[1], { paths: [process.argv[2]] }))'].concat(
+          request,
+          fromPath
+        ),
+        { cwd: folder, encoding: 'utf8' }
+      )
+      .toString();
+  }
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-path-handoff-')));
+    // A "rush deploy" layout: rush-lib is a local project folder, and each host links it.
+    localRushLib = path.join(folder, 'deploy', 'libraries', 'rush-lib');
+    writePackage(localRushLib, '@microsoft/rush-lib');
+    writePackage(path.join(folder, 'deploy', 'libraries', 'node-core-library'), '@rushstack/node-core-library');
+    link(
+      path.join(folder, 'deploy', 'libraries', 'node-core-library'),
+      path.join(localRushLib, 'node_modules', '@rushstack', 'node-core-library')
+    );
+    hostScript = path.join(folder, 'deploy', 'apps', 'host', 'bin', 'host');
+    fs.mkdirSync(path.dirname(hostScript), { recursive: true });
+    fs.writeFileSync(hostScript, '');
+    hostLink = path.join(folder, 'deploy', 'apps', 'host', 'node_modules', '@microsoft', 'rush-lib');
+    link(localRushLib, hostLink);
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('keeps the real path of an installed rush-lib', () => {
+    const installedRushLib: string = path.join(folder, 'install', 'node_modules', '@microsoft', 'rush-lib');
+    writePackage(installedRushLib, '@microsoft/rush-lib');
+    const entryPoint: string = path.join(installedRushLib, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: installedRushLib,
+        entryPoint,
+        hostScriptPaths: [hostScript],
+        inheritedEntryPoint: path.join(hostLink, ENTRY_POINT_SUBPATH)
+      })
+    ).toEqual({ entryPoint, packageFolder: installedRushLib });
+  });
+
+  it('spells a local rush-lib through the node_modules link of the host script', () => {
+    const handoff: IRushLibPathHandoff = getRushLibPathHandoff({
+      packageFolder: localRushLib,
+      entryPoint: path.join(localRushLib, ENTRY_POINT_SUBPATH),
+      hostScriptPaths: [undefined, hostScript],
+      inheritedEntryPoint: undefined
+    });
+
+    expect(handoff).toEqual({ entryPoint: path.join(hostLink, ENTRY_POINT_SUBPATH), packageFolder: hostLink });
+    // This is how plugins find rush-lib and its dependencies from _RUSH_LIB_PATH.
+    expect(fs.realpathSync.native(resolveByName('@microsoft/rush-lib/package.json', handoff.entryPoint))).toBe(
+      path.join(localRushLib, 'package.json')
+    );
+    expect(
+      fs.realpathSync.native(resolveByName('@rushstack/node-core-library/package.json', handoff.packageFolder))
+    ).toBe(path.join(folder, 'deploy', 'libraries', 'node-core-library', 'package.json'));
+  });
+
+  it('follows a symbolic link to the host script before looking for its node_modules folder', () => {
+    const scriptAlias: string = path.join(folder, 'bin', 'host');
+    fs.mkdirSync(path.dirname(scriptAlias), { recursive: true });
+    fs.symlinkSync(hostScript, scriptAlias);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint: path.join(localRushLib, ENTRY_POINT_SUBPATH),
+        hostScriptPaths: [scriptAlias],
+        inheritedEntryPoint: undefined
+      }).packageFolder
+    ).toBe(hostLink);
+  });
+
+  it('ignores a host whose own rush-lib is a different package', () => {
+    const otherHostScript: string = path.join(folder, 'other', 'bin', 'host');
+    fs.mkdirSync(path.dirname(otherHostScript), { recursive: true });
+    fs.writeFileSync(otherHostScript, '');
+    writePackage(path.join(folder, 'other', 'node_modules', '@microsoft', 'rush-lib'), '@microsoft/rush-lib');
+    // A link further up would be shadowed by the host's own rush-lib, so it must not be used either.
+    link(localRushLib, path.join(folder, 'node_modules', '@microsoft', 'rush-lib'));
+    const entryPoint: string = path.join(localRushLib, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint,
+        hostScriptPaths: [otherHostScript, path.join(folder, 'missing', 'script')],
+        inheritedEntryPoint: undefined
+      })
+    ).toEqual({ entryPoint, packageFolder: localRushLib });
+  });
+
+  it('keeps an inherited spelling of the same entry point', () => {
+    const inheritedEntryPoint: string = path.join(hostLink, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint: path.join(localRushLib, ENTRY_POINT_SUBPATH),
+        hostScriptPaths: [path.join(folder, 'missing', 'script')],
+        inheritedEntryPoint
+      })
+    ).toEqual({ entryPoint: inheritedEntryPoint, packageFolder: hostLink });
+  });
+
+  it('replaces an inherited path that names a different engine', () => {
+    const otherRushLib: string = path.join(folder, 'other', 'node_modules', '@microsoft', 'rush-lib');
+    writePackage(otherRushLib, '@microsoft/rush-lib');
+    const entryPoint: string = path.join(localRushLib, ENTRY_POINT_SUBPATH);
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: localRushLib,
+        entryPoint,
+        hostScriptPaths: [],
+        inheritedEntryPoint: path.join(otherRushLib, ENTRY_POINT_SUBPATH)
+      })
+    ).toEqual({ entryPoint, packageFolder: localRushLib });
+  });
+});
+
+describe(findNodeModulesPackageFolder.name, () => {
+  let folder: string;
+
+  beforeEach(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-node-modules-lookup-')));
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('finds a package next to a linked package without following the link', () => {
+    const target: string = path.join(folder, 'target');
+    fs.mkdirSync(target, { recursive: true });
+    fs.writeFileSync(path.join(target, 'package.json'), '{}');
+    const plugin: string = path.join(folder, 'host', 'node_modules', '@scope', 'plugin');
+    fs.mkdirSync(plugin, { recursive: true });
+    fs.writeFileSync(path.join(plugin, 'package.json'), '{}');
+    const linkedPackage: string = path.join(folder, 'host', 'node_modules', '@scope', 'linked');
+    fs.symlinkSync(target, linkedPackage, 'junction');
+
+    expect(findNodeModulesPackageFolder(linkedPackage, '@scope/plugin')).toBe(plugin);
+    expect(findNodeModulesPackageFolder(target, '@scope/plugin')).toBeUndefined();
+  });
+
+  it('does not look for node_modules inside a node_modules folder', () => {
+    const nested: string = path.join(folder, 'node_modules', 'node_modules', 'pkg');
+    fs.mkdirSync(nested, { recursive: true });
+    fs.writeFileSync(path.join(nested, 'package.json'), '{}');
+
+    expect(findNodeModulesPackageFolder(path.join(folder, 'node_modules', 'a'), 'pkg')).toBeUndefined();
+  });
+});

From c5158102b26b1f4b6ee0717c01a83026ded675d1 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 19:29:42 +0000
Subject: [PATCH 034/265] [rush-client-core] Wait for a daemon a live process
 is still starting instead of running Rush in-process

Swarm integration step 19; original commit a81a00520d (merge of o07/startup-fallback at 668753ad4d).
Scope: task 95.

Brings 647a8bf902 [rush-client-core] and 668753ad4d [rush-cli-client].
Gate: ch01 GATE OK board 1731 (tree e4a00622d4); burst: t01 board 1716.

Commits folded into this step (2):
- 647a8bf902 [rush-client-core] Wait for a daemon that a live process is still starting before permitting in-process Rush
- 668753ad4d [rush-cli-client] Don't run Rush in-process while daemon startup is still pending

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  14 +
 apps/rush-cli-client/src/launchClient.ts      |  19 +-
 .../src/test/startupPendingFallback.test.ts   | 109 ++++++
 ...tup-pending-fallback_2026-09-28-16-58.json |  11 +
 ...tup-pending-fallback_2026-09-28-16-58.json |  11 +
 common/reviews/api/rush-client-core.api.md    |  13 +
 docs/rush/dogfooding-rush-daemon.md           |   8 +-
 libraries/rush-client-core/README.md          |  15 +
 .../src/connectOrAwaitDaemonStartup.ts        | 136 ++++++++
 libraries/rush-client-core/src/index.ts       |   5 +
 .../test/connectOrAwaitDaemonStartup.test.ts  | 311 ++++++++++++++++++
 .../src/test/fixtures/awaitingStarter.ts      |  58 ++++
 .../src/test/fixtures/startLockHolder.ts      |  28 ++
 13 files changed, 733 insertions(+), 5 deletions(-)
 create mode 100644 apps/rush-cli-client/src/test/startupPendingFallback.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/startup-pending-fallback_2026-09-28-16-58.json
 create mode 100644 common/changes/@rushstack/rush-client-core/startup-pending-fallback_2026-09-28-16-58.json
 create mode 100644 libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
 create mode 100644 libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
 create mode 100644 libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts
 create mode 100644 libraries/rush-client-core/src/test/fixtures/startLockHolder.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 96c9d681da..fcbfaa9d06 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -42,6 +42,20 @@ Routing precedence:
 3. `RUSH_DAEMON` overrides `rush.json`'s `daemon.enabled`; the default is false.
 4. Auto-start is considered only after selecting daemon execution.
 
+When the selected daemon cannot be reached or started, an ordinary invocation prints the reason and runs
+in-process (`rush-client: <reason> Using in-process Rush.`). A startup failure while a live process can
+still make the daemon ready is the exception: a process that listens at the endpoint but does not
+complete hello/ping in time, a startup helper that still waits for its daemon, or another client that
+holds the start mutex, as in a burst of clients that all find no daemon. In-process Rush would take the
+repository lock, and the daemon would then reject the requests it serves with "Another Rush command is
+already running in this repository." Instead, the client keeps trying for one more startup deadline
+(15 seconds, so about 30 seconds in all) and uses the daemon once it is ready. It says so when it starts
+waiting (`rush-client: The daemon is not ready yet. <live process>, so this command waits up to 15 s more
+for it instead of running Rush in-process.`; agent output shows "rushd is still starting; waiting for it"
+as the progress phase). If the daemon is still not ready, the command exits with code 1. The message
+gives the startup error with its `--no-daemon` hint, then the process that is still live, "so Rush was
+not run in-process", and a pointer to `rush-client daemon status`.
+
 `--no-wait` fails immediately when daemon admission is unavailable.
 `--wait-timeout SECONDS` (or `--wait-timeout=SECONDS`) overrides the configured queue
 timeout; finite nonnegative decimal seconds up to 2147483.647 are accepted and
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 6ae500af55..00cd328d1e 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -13,7 +13,7 @@ import { JsonFile } from '@rushstack/node-core-library';
 import {
   DaemonClientError,
   captureDaemonRequest,
-  connectOrStartDaemonAsync,
+  connectOrAwaitDaemonStartupAsync,
   executeWithDaemonRestartAsync,
   type DaemonClient,
   type DaemonClientOutcome,
@@ -141,7 +141,22 @@ export async function launchClientAsync(
         verbosity
       }
     };
-    client = await connectOrStartDaemonAsync(connection);
+    // While a live daemon or starter can still make the daemon ready, a startup failure rejects with a
+    // DaemonStartupPendingError, which is not a DaemonClientError, so Rush does not run in-process next to it.
+    client = await connectOrAwaitDaemonStartupAsync({
+      ...connection,
+      onAwaitStartup: (owner: string, waitMs: number): void => {
+        if (agentRenderer) {
+          agentRenderer.setPhase('rushd is still starting; waiting for it');
+          return;
+        }
+        const seconds: number = Math.round(waitMs / 1000);
+        process.stderr.write(
+          `rush-client: The daemon is not ready yet. ${owner}, so this command waits up to ${seconds} s ` +
+            'more for it instead of running Rush in-process.\n'
+        );
+      }
+    });
   } catch (error) {
     if (
       !(error instanceof DaemonClientError) &&
diff --git a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
new file mode 100644
index 0000000000..934fad1ace
--- /dev/null
+++ b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
@@ -0,0 +1,109 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync
+} from '@rushstack/rush-client-core';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+
+describe('a daemon startup failure', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let output: jest.SpyInstance;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-startup-pending-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    output = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
+    delete process.env.RUSH_PREVIEW_VERSION;
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('fails the command instead of running Rush in-process while daemon startup is pending', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonStartupPendingError('Another client is still starting the daemon.'));
+    await expect(launchClientAsync(false)).rejects.toThrow('Another client is still starting the daemon.');
+    expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledTimes(1);
+    expect(process.argv).toEqual([process.execPath, 'rush-client', 'build', '--to', 'project']);
+    expect(output).not.toHaveBeenCalledWith(expect.stringContaining('Using in-process Rush'));
+  });
+
+  it('says why it keeps waiting for a daemon that is still starting', async () => {
+    const pending: DaemonStartupPendingError = new DaemonStartupPendingError('Still starting.');
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockImplementation(async (options) => {
+      options.onAwaitStartup?.('Its startup helper (PID 42) is still waiting for the daemon', 15000);
+      throw pending;
+    });
+    await expect(launchClientAsync(false)).rejects.toBe(pending);
+    expect(output).toHaveBeenCalledWith(
+      'rush-client: The daemon is not ready yet. Its startup helper (PID 42) is still waiting for the daemon, ' +
+        'so this command waits up to 15 s more for it instead of running Rush in-process.\n'
+    );
+
+    // Agent output shows it as the phase of its progress line instead.
+    output.mockClear();
+    const write: jest.Mock = jest.fn();
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write
+    });
+    await expect(launchClientAsync(false, renderer)).rejects.toBe(pending);
+    expect(write).toHaveBeenCalledWith(expect.stringContaining('rushd is still starting; waiting for it'));
+    expect(output).not.toHaveBeenCalledWith(expect.stringContaining('The daemon is not ready yet'));
+  });
+
+  it('still runs Rush in-process after a startup failure that no live process owns', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonClientError('startupFailed', 'No ready daemon; auto-start is disabled.'));
+    await launchClientAsync(false);
+    expect(process.argv[1]).toBe(
+      path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rush')
+    );
+    expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
+    expect(output).toHaveBeenCalledWith(
+      'rush-client: No ready daemon; auto-start is disabled. Using in-process Rush.\n'
+    );
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/startup-pending-fallback_2026-09-28-16-58.json b/common/changes/@rushstack/rush-cli-client/startup-pending-fallback_2026-09-28-16-58.json
new file mode 100644
index 0000000000..d815203aa5
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/startup-pending-fallback_2026-09-28-16-58.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When daemon startup fails while a listener, a startup helper, or another starting client can still make the daemon ready, a command says so and keeps trying for one more startup deadline, and then fails with exit code 1, instead of running Rush in-process, where it would take the repository lock from the requests that the daemon serves.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/startup-pending-fallback_2026-09-28-16-58.json b/common/changes/@rushstack/rush-client-core/startup-pending-fallback_2026-09-28-16-58.json
new file mode 100644
index 0000000000..0252cfc12d
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/startup-pending-fallback_2026-09-28-16-58.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `connectOrAwaitDaemonStartupAsync()` and `DaemonStartupPendingError` for callers that run Rush in-process when no daemon is available: after a startup failure, they keep trying for one more startup deadline while a listener, a running startup helper, or another starting client can still make the daemon ready, and then get an error that does not permit running in-process. The optional `onAwaitStartup` callback names that process when the extra wait begins.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 4a07758b95..c28959d376 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -22,6 +22,9 @@ export function assertDaemonRuntimeFolderIsPrivate(paths: IDaemonPaths): void;
 // @beta
 export function captureDaemonRequest(options: ICaptureDaemonRequestOptions): IDaemonRequestEnvelope;
 
+// @beta
+export function connectOrAwaitDaemonStartupAsync(options: IConnectOrAwaitDaemonStartupOptions): Promise<DaemonClient>;
+
 // @beta
 export function connectOrStartDaemonAsync(options: IConnectOrStartDaemonOptions): Promise<DaemonClient>;
 
@@ -63,6 +66,11 @@ export type DaemonClientOutcome = {
 // @beta
 export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
 
+// @beta
+export class DaemonStartupPendingError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+
 // @beta
 export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, execution: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
 
@@ -77,6 +85,11 @@ export interface ICaptureDaemonRequestOptions extends Omit<IDaemonRequestEnvelop
     readonly requestId?: string;
 }
 
+// @beta
+export interface IConnectOrAwaitDaemonStartupOptions extends IConnectOrStartDaemonOptions {
+    onAwaitStartup?: (owner: string, waitMs: number) => void;
+}
+
 // @beta
 export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectOptions, 'socketPath'> {
     readonly abortSignal?: AbortSignal;
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 9a5c3d282d..77a9fb7106 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -155,9 +155,11 @@ node common/scripts/install-run-rush.js deploy --scenario rush-daemon-dogfood --
 ```
 
 On Windows, the first daemon start from a new or refreshed snapshot can take longer than the client's 15-second
-startup deadline while Windows scans the newly written files. That request then uses native Rush (with a
-`rush-client: ... Using in-process Rush.` message), but the daemon finishes starting in the background and the next
-request uses it.
+startup deadline while Windows scans the newly written files. Because the startup helper is still waiting for the
+daemon, the client says so and keeps trying for another 15 seconds, then uses the daemon once it is ready. If it is
+still not ready, the request fails with exit code 1 and a `rush-client: ...` message that says Rush was not run
+in-process, rather than running native Rush next to the starting daemon. The daemon finishes starting in the
+background, so rerun the command (`rush-client daemon status` shows when it is ready).
 
 The daemon's identity is the canonical repository root plus the selected Rush version, so each checkout or
 worktree has its own daemon, and `rush-client daemon ...` commands address the daemon for the checkout that
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 3d3c57504a..b611c372fc 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -119,6 +119,21 @@ Socket resets and broken pipes during hello/ping readiness are retried within th
 a closing host may still retain its listener while joining owned resources. This applies only before
 `requestStart`; a connection failure after execution begins still never permits replay.
 
+`connectOrAwaitDaemonStartupAsync()` wraps `connectOrStartDaemonAsync()` for a caller that runs Rush
+in-process when no daemon is available, as the CLI client does. A `startupFailed` or `timeout` error
+alone does not make that safe while a live process can still make the daemon ready: a listener at the
+endpoint that did not complete hello/ping in time, a recorded startup helper that is still running, or
+another client that holds the start mutex. In-process Rush would take the repository lock that the
+daemon's requests need. The wrapper instead keeps connecting (and starting, through the same mutex and
+reservation) until one more startup deadline has passed. If the daemon is still not ready, it rejects
+with `DaemonStartupPendingError`, which is not a `DaemonClientError`: the message is the startup error
+followed by the process that is still live, and `cause` is that error. When none remains, it rejects at
+once with the original `DaemonClientError`, for example when auto-start is disabled and nothing listens,
+or when the helper has exited. An ownership record alone does not count, because a daemon publishes it
+only after binding. Other errors, such as `versionMismatch`, pass through unchanged. Before it keeps
+waiting, it calls the optional `onAwaitStartup(owner, waitMs)` once, with the live process and the
+remaining wait, so that the caller can say why the command has not started yet.
+
 `getDaemonLogFilePath(paths)` is the shared stable path used by both the launcher
 and the CLI's local `daemon logs` reader. Child stdout/stderr are appended across
 restarts, including startup failures; the parent always closes its descriptor
diff --git a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
new file mode 100644
index 0000000000..7364009944
--- /dev/null
+++ b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
@@ -0,0 +1,136 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from './DaemonClient';
+import { DaemonClientError } from './DaemonClientError';
+import { isEndpointUnboundAsync } from './DaemonOwnership';
+import { readDaemonStartupReservation, type IDaemonStartupReservation } from './DaemonStartup';
+import { getStartupHelperState } from './DaemonStartupReservation';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
+import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+
+/** Matches the default of {@link IConnectOrStartDaemonOptions.startupTimeoutMs}. */
+const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
+/** Keeps a retry that fails at once from spinning until the deadline. */
+const RETRY_DELAY_MS: number = 100;
+
+/**
+ * Daemon startup did not finish in time, but a live process can still make the daemon ready. Unlike a
+ * {@link DaemonClientError}, this does not mean that running Rush in-process is safe: it would compete with
+ * that daemon for the repository.
+ * @beta
+ */
+export class DaemonStartupPendingError extends Error {
+  public constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'DaemonStartupPendingError';
+  }
+}
+
+/**
+ * Options for {@link connectOrAwaitDaemonStartupAsync}.
+ * @beta
+ */
+export interface IConnectOrAwaitDaemonStartupOptions extends IConnectOrStartDaemonOptions {
+  /**
+   * Called at most once, when startup did not finish in time but a live process can still make the daemon
+   * ready, just before this waits up to `waitMs` more for it. `owner` describes that process, for example
+   * "Its startup helper (PID 123) is still waiting for the daemon". A caller can say why it is still waiting.
+   */
+  onAwaitStartup?: (owner: string, waitMs: number) => void;
+}
+
+/**
+ * {@link connectOrStartDaemonAsync} for a caller that runs Rush in-process when the daemon is unavailable.
+ * @remarks When startup fails while a live process can still make the daemon ready (a listener at the endpoint,
+ * a startup helper that still waits for its daemon, or another client that holds the start mutex), this retries
+ * for one more startup deadline. If the daemon is still not ready, it rejects with a
+ * {@link DaemonStartupPendingError}. It rejects with a {@link DaemonClientError} only when no such process
+ * remains, so that the caller can run Rush in-process without competing with a daemon for the repository.
+ * @beta
+ */
+export async function connectOrAwaitDaemonStartupAsync(
+  options: IConnectOrAwaitDaemonStartupOptions
+): Promise<DaemonClient> {
+  try {
+    return await connectOrStartDaemonAsync(options);
+  } catch (error) {
+    if (!isStartupFailure(error)) throw error;
+    return await awaitLiveStartupAsync(options, error);
+  }
+}
+
+async function awaitLiveStartupAsync(
+  options: IConnectOrAwaitDaemonStartupOptions,
+  firstError: DaemonClientError
+): Promise<DaemonClient> {
+  const deadline: number = Date.now() + (options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS);
+  let lastError: DaemonClientError = firstError;
+  for (let attempt: number = 0; ; attempt++) {
+    const owner: string | undefined = await findLiveStartupOwnerAsync(options.paths);
+    if (owner === undefined) throw lastError;
+    if (Date.now() >= deadline) {
+      throw new DaemonStartupPendingError(
+        `${lastError.message} ${owner}, so Rush was not run in-process, where it would compete with that daemon for the repository. "rush-client daemon status" reports when the daemon is ready.`,
+        { cause: lastError }
+      );
+    }
+    if (attempt === 0) {
+      options.onAwaitStartup?.(owner, deadline - Date.now());
+    } else {
+      await delayAsync(Math.min(RETRY_DELAY_MS, Math.max(1, deadline - Date.now())), undefined, {
+        signal: options.abortSignal
+      });
+    }
+    try {
+      return await connectOrStartDaemonAsync({
+        ...options,
+        startupTimeoutMs: Math.max(1, deadline - Date.now())
+      });
+    } catch (error) {
+      if (!isStartupFailure(error)) throw error;
+      lastError = error;
+    }
+  }
+}
+
+function isStartupFailure(error: unknown): error is DaemonClientError {
+  return error instanceof DaemonClientError && (error.code === 'startupFailed' || error.code === 'timeout');
+}
+
+/**
+ * Describes a live process that can still make this workspace's daemon ready, or returns `undefined`.
+ * An ownership record alone is not such evidence: a daemon publishes it only after it binds, so a record
+ * next to an unbound endpoint belongs to a daemon that is shutting down or to a reused PID.
+ */
+async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<string | undefined> {
+  if (!fs.existsSync(path.dirname(paths.lockfilePath))) return undefined;
+  if (!(await isEndpointUnboundAsync(paths.socketPath))) {
+    return `A process listens at ${paths.socketPath} but was not ready in time`;
+  }
+  let reservation: IDaemonStartupReservation | undefined;
+  try {
+    reservation = readDaemonStartupReservation(paths);
+  } catch {
+    // An unreadable reservation is no evidence of a live helper.
+  }
+  if (reservation?.helper && getStartupHelperState(reservation) === 'running') {
+    return `Its startup helper (PID ${reservation.helper.pid}) is still waiting for the daemon`;
+  }
+  let lock: IStartupLock | undefined;
+  try {
+    lock = await tryAcquireStartupLockAsync(paths);
+  } catch {
+    // A start mutex that cannot be checked is no evidence of a live starter.
+    return undefined;
+  }
+  if (!lock) return 'Another client is still starting the daemon';
+  await lock.releaseAsync();
+  return undefined;
+}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index 6f3fbd5e3c..c1ae540535 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -27,6 +27,11 @@ export {
   type IDaemonStartupReservationInfo
 } from './DaemonStartupReservation';
 export { executeWithDaemonRestartAsync } from './executeWithDaemonRestart';
+export {
+  connectOrAwaitDaemonStartupAsync,
+  DaemonStartupPendingError,
+  type IConnectOrAwaitDaemonStartupOptions
+} from './connectOrAwaitDaemonStartup';
 export {
   connectOrStartDaemonAsync,
   requestDaemonShutdownAsync,
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
new file mode 100644
index 0000000000..c120d3416b
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
@@ -0,0 +1,311 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClientError } from '../DaemonClientError';
+import { getDaemonStartupFilePath } from '../DaemonStartup';
+import { DaemonStartupPendingError, connectOrAwaitDaemonStartupAsync } from '../connectOrAwaitDaemonStartup';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+interface IAwaitingResult {
+  readonly kind: 'connected' | 'pending' | 'fallback' | 'error';
+  readonly pid?: number;
+  readonly message?: string;
+  readonly elapsedMs: number;
+  readonly notices: { owner: string; waitMs: number }[];
+}
+
+describe('connectOrAwaitDaemonStartupAsync', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+  let children: ChildProcess[];
+
+  beforeEach(() => {
+    children = [];
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-await-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-await-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    for (const child of children) {
+      if (child.exitCode === null && child.signalCode === null) {
+        const closed: Promise<unknown[]> = once(child, 'close');
+        child.kill('SIGKILL');
+        await closed;
+      }
+    }
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  function run(
+    fixture: string,
+    args: string[]
+  ): { child: ChildProcess; result: Promise<{ code: number | null; stdout: string; stderr: string }> } {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [path.join(__dirname, 'fixtures', fixture), ...args],
+      {
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
+    );
+    children.push(child);
+    let stdout: string = '';
+    let stderr: string = '';
+    child.stdout!.on('data', (chunk: Buffer) => {
+      stdout += chunk.toString();
+    });
+    child.stderr!.on('data', (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+    return { child, result: once(child, 'close').then(([code]) => ({ code, stdout, stderr })) };
+  }
+
+  async function runAwaitingAsync(
+    startOptions: IConnectOrStartDaemonOptions,
+    signalFolder?: string
+  ): Promise<IAwaitingResult> {
+    const { code, stdout, stderr } = await run(
+      'awaitingStarter.js',
+      signalFolder ? [JSON.stringify(startOptions), signalFolder] : [JSON.stringify(startOptions)]
+    ).result;
+    expect({ code, stderr }).toEqual({ code: 0, stderr: '' });
+    return JSON.parse(stdout);
+  }
+
+  async function waitForFileAsync(filePath: string): Promise<string> {
+    const deadline: number = Date.now() + 10000;
+    while (!fs.existsSync(filePath) && Date.now() < deadline) await delayAsync(20);
+    return fs.readFileSync(filePath, 'utf8');
+  }
+
+  async function waitForLinesAsync(filePath: string, count: number): Promise<void> {
+    const deadline: number = Date.now() + 30000;
+    const countLines = (): number =>
+      fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').trim().split('\n').length : 0;
+    while (countLines() < count && Date.now() < deadline) await delayAsync(20);
+  }
+
+  it('keeps every client on the daemon when it becomes ready only after their first startup deadline', async () => {
+    const clientCount: number = 8;
+    // On a loaded host, the first attempts end up to about 2 seconds apart, and the daemon takes up to about
+    // 3 seconds after its release to serve every client, so the earliest client's second deadline needs room.
+    const startupTimeoutMs: number = 10000;
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const burst: IConnectOrStartDaemonOptions = { ...options, startupTimeoutMs };
+    // A client that does not wait shows that the first deadline expires before the daemon listens.
+    const control = run('starter.js', [JSON.stringify(burst)]);
+    const results: Promise<IAwaitingResult[]> = Promise.all(
+      Array.from({ length: clientCount }, () => runAwaitingAsync(burst, folder))
+    );
+    // The clients start together, so that their first deadlines expire together even on a loaded host.
+    await waitForLinesAsync(path.join(folder, 'clients'), clientCount);
+    fs.writeFileSync(path.join(folder, 'go'), '');
+    const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+    // A client's first deadline has expired once it says that it keeps waiting.
+    await waitForLinesAsync(path.join(folder, 'notices'), clientCount);
+    const controlResult = await control.result;
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+
+    expect(controlResult.code).toBe(1);
+    expect(controlResult.stderr).toContain('Daemon startup');
+    for (const result of await results) {
+      expect(result).toMatchObject({ kind: 'connected', pid: daemonPid });
+      expect(result.elapsedMs).toBeGreaterThan(startupTimeoutMs);
+      // Each client said once why it kept waiting: the daemon binds only after every client has done so.
+      expect(result.notices).toHaveLength(1);
+      expect(result.notices[0].owner).toMatch(
+        /^(Its startup helper \(PID \d+\) is still waiting for the daemon|Another client is still starting the daemon)$/
+      );
+      expect(result.notices[0].waitMs).toBeGreaterThan(0);
+      expect(result.notices[0].waitMs).toBeLessThanOrEqual(startupTimeoutMs);
+    }
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 60000);
+
+  it('fails without permitting in-process Rush while the startup helper still waits after a second deadline', async () => {
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const result: IAwaitingResult = await runAwaitingAsync({ ...options, startupTimeoutMs: 2000 });
+    const daemonPid: number = Number(fs.readFileSync(path.join(folder, 'prebind'), 'utf8'));
+    const helperPid: number = Number(fs.readFileSync(path.join(folder, 'parents'), 'utf8'));
+    expect(result.kind).toBe('pending');
+    expect(result.elapsedMs).toBeGreaterThanOrEqual(4000);
+    expect(result.message).toContain(
+      `Its startup helper (PID ${helperPid}) is still waiting for the daemon, so Rush was not run in-process`
+    );
+    expect(result.message).toContain('use --no-daemon');
+    expect(result.message).toContain('"rush-client daemon status"');
+    expect(result.notices).toEqual([
+      {
+        owner: `Its startup helper (PID ${helperPid}) is still waiting for the daemon`,
+        waitMs: expect.any(Number)
+      }
+    ]);
+
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    const client = await connectOrStartDaemonAsync(options);
+    expect((await client.status).pid).toBe(daemonPid);
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+  }, 30000);
+
+  it('fails without permitting in-process Rush while a listener does not become ready', async () => {
+    // Accepts connections but never answers, like a daemon whose event loop is blocked.
+    const sockets: Set<net.Socket> = new Set();
+    const listener: net.Server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+    });
+    await new Promise<void>((resolve) => listener.listen(paths.socketPath, resolve));
+    const onAwaitStartup: jest.Mock = jest.fn();
+    try {
+      const error: unknown = await connectOrAwaitDaemonStartupAsync({
+        ...options,
+        startupTimeoutMs: 2000,
+        onAwaitStartup
+      }).then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      expect(error).toBeInstanceOf(DaemonStartupPendingError);
+      expect(error).not.toBeInstanceOf(DaemonClientError);
+      expect((error as Error).message).toContain(
+        `A process listens at ${paths.socketPath} but was not ready in time, so Rush was not run in-process`
+      );
+      expect(onAwaitStartup.mock.calls).toEqual([
+        [`A process listens at ${paths.socketPath} but was not ready in time`, expect.any(Number)]
+      ]);
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => listener.close(() => resolve()));
+    }
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  }, 30000);
+
+  it('fails without permitting in-process Rush while another client holds the start mutex', async () => {
+    const holder = run('startLockHolder.js', [JSON.stringify(paths)]);
+    await waitForFileAsync(path.join(folder, 'lock-held'));
+    const started: number = Date.now();
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const error: unknown = await connectOrAwaitDaemonStartupAsync({
+      ...options,
+      startupTimeoutMs: 2000,
+      onAwaitStartup
+    }).then(
+      () => undefined,
+      (rejection: unknown) => rejection
+    );
+    expect(Date.now() - started).toBeGreaterThanOrEqual(4000);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect((error as Error).message).toContain(
+      'Another client is still starting the daemon, so Rush was not run in-process'
+    );
+    expect(error).toHaveProperty('cause.code', 'startupFailed');
+    expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+    expect(onAwaitStartup.mock.calls[0][0]).toBe('Another client is still starting the daemon');
+    expect(onAwaitStartup.mock.calls[0][1]).toBeGreaterThan(0);
+    expect(onAwaitStartup.mock.calls[0][1]).toBeLessThanOrEqual(2000);
+
+    fs.writeFileSync(path.join(folder, 'release-lock'), '');
+    expect(await holder.result).toEqual({ code: 0, stdout: '', stderr: '' });
+    // Once the starter is gone, the same failure permits in-process Rush again, without a notice.
+    await expect(
+      connectOrAwaitDaemonStartupAsync({
+        paths,
+        expectedDaemonVersion: 'fixture',
+        startupTimeoutMs: 500,
+        onAwaitStartup
+      })
+    ).rejects.toBeInstanceOf(DaemonClientError);
+    expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  }, 30000);
+
+  it('rejects at once with the startup error when nothing live owns the workspace', async () => {
+    const started: number = Date.now();
+    const onAwaitStartup: jest.Mock = jest.fn();
+    await expect(
+      connectOrAwaitDaemonStartupAsync({ paths, expectedDaemonVersion: 'fixture', onAwaitStartup })
+    ).rejects.toThrow(
+      new DaemonClientError(
+        'startupFailed',
+        `No ready daemon at ${paths.socketPath}; auto-start is disabled.`
+      )
+    );
+
+    // A launcher that exits before readiness leaves a reservation whose helper has exited.
+    const failing: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
+    };
+    const failure: unknown = await connectOrAwaitDaemonStartupAsync({ ...failing, onAwaitStartup }).catch(
+      (error: unknown) => error
+    );
+    expect(failure).toBeInstanceOf(DaemonClientError);
+    expect((failure as Error).message).toContain('Unable to start');
+    const refusal: unknown = await connectOrAwaitDaemonStartupAsync({ ...options, onAwaitStartup }).catch(
+      (error: unknown) => error
+    );
+    expect(refusal).toBeInstanceOf(DaemonClientError);
+    expect((refusal as Error).message).toContain('exited before the daemon became ready');
+    expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  }, 30000);
+
+  it('leaves a version mismatch to the caller as before', async () => {
+    const running = await connectOrStartDaemonAsync(options);
+    await running.closeAsync();
+    await expect(
+      connectOrAwaitDaemonStartupAsync({ paths, expectedDaemonVersion: 'replacement' })
+    ).rejects.toMatchObject({ code: 'versionMismatch' });
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts b/libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts
new file mode 100644
index 0000000000..10dad54b93
--- /dev/null
+++ b/libraries/rush-client-core/src/test/fixtures/awaitingStarter.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DaemonClientError } from '../../DaemonClientError';
+import type { IConnectOrStartDaemonOptions } from '../../connectOrStartDaemon';
+import {
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync
+} from '../../connectOrAwaitDaemonStartup';
+
+/**
+ * Prints one JSON line: whether the client connected, may run Rush in-process, or must fail, and every
+ * onAwaitStartup call. Given a folder as the second argument, it first appends its PID to "clients" there and
+ * waits for a "go" file, and it appends its PID to "notices" there on each onAwaitStartup call.
+ */
+async function mainAsync(): Promise<void> {
+  const options: IConnectOrStartDaemonOptions = JSON.parse(process.argv[2]);
+  const signalFolder: string | undefined = process.argv[3];
+  if (signalFolder) {
+    fs.appendFileSync(path.join(signalFolder, 'clients'), `${process.pid}\n`);
+    while (!fs.existsSync(path.join(signalFolder, 'go'))) await delayAsync(10);
+  }
+  const startedAt: number = Date.now();
+  const notices: { owner: string; waitMs: number }[] = [];
+  try {
+    const client = await connectOrAwaitDaemonStartupAsync({
+      ...options,
+      onAwaitStartup: (owner: string, waitMs: number) => {
+        notices.push({ owner, waitMs });
+        if (signalFolder) fs.appendFileSync(path.join(signalFolder, 'notices'), `${process.pid}\n`);
+      }
+    });
+    const elapsedMs: number = Date.now() - startedAt;
+    const { pid } = await client.status;
+    await client.closeAsync();
+    process.stdout.write(`${JSON.stringify({ kind: 'connected', pid, elapsedMs, notices })}\n`);
+  } catch (error) {
+    const kind: string =
+      error instanceof DaemonStartupPendingError
+        ? 'pending'
+        : error instanceof DaemonClientError
+          ? 'fallback'
+          : 'error';
+    const elapsedMs: number = Date.now() - startedAt;
+    process.stdout.write(
+      `${JSON.stringify({ kind, message: (error as Error).message, elapsedMs, notices })}\n`
+    );
+  }
+}
+
+mainAsync().catch((error: Error) => {
+  process.stderr.write(`${error.stack}\n`);
+  process.exitCode = 1;
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/startLockHolder.ts b/libraries/rush-client-core/src/test/fixtures/startLockHolder.ts
new file mode 100644
index 0000000000..08d5140af7
--- /dev/null
+++ b/libraries/rush-client-core/src/test/fixtures/startLockHolder.ts
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../../StartupLock';
+
+/** Holds the start mutex, like a client that has not reserved startup yet, until a "release-lock" file exists. */
+async function mainAsync(): Promise<void> {
+  const paths: IDaemonPaths = JSON.parse(process.argv[2]);
+  const folder: string = path.dirname(paths.lockfilePath);
+  const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+  if (!lock) throw new Error('The start mutex is already held.');
+  fs.writeFileSync(path.join(folder, 'lock-held'), String(process.pid));
+  const expiry: number = Date.now() + 30000;
+  while (!fs.existsSync(path.join(folder, 'release-lock')) && Date.now() < expiry) {
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  await lock.releaseAsync();
+}
+
+mainAsync().catch((error: Error) => {
+  process.stderr.write(`${error.stack}\n`);
+  process.exitCode = 1;
+});

From adf57d5899acef39a810edd704a3d51a0e796670 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:24:09 +0000
Subject: [PATCH 035/265] [rush-lib] Reuse workspace input digests and project
 configurations while their files are unchanged

Swarm integration step 20; original commit 0f987a5b62 (merge of swarm/r07-t93-on-s10 at 18900fe380).
Scope: task 93.

Brings 143f21a891 and 18900fe380 [rush-lib].
Gate: ch01 GATE OK board 1869 (tree 8892a71708); m01 CONFIRMED board 1738 and board 1818; t04 board 1794.

Commits folded into this step (2):
- 143f21a891 [rush-lib] Reuse workspace input digests and project configurations while their files are unchanged
- 18900fe380 [rush-lib] Test that a project configuration that failed to load is loaded afresh once it is fixed

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...use-unchanged-inputs_2026-09-28-18-30.json |  10 +
 common/reviews/api/rush-lib.api.md            |   2 +
 .../src/api/RushProjectConfiguration.ts       | 337 +++++++++++++++++-
 .../src/api/WorkspaceInputFingerprint.ts      | 124 +++++--
 .../api/test/RushProjectConfiguration.test.ts | 310 ++++++++++++++++
 .../test/WorkspaceInputFingerprint.test.ts    |  86 +++++
 .../src/utilities/FileContentStamp.ts         |  36 ++
 .../utilities/test/FileContentStamp.test.ts   |  46 +++
 8 files changed, 903 insertions(+), 48 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/reuse-unchanged-inputs_2026-09-28-18-30.json
 create mode 100644 libraries/rush-lib/src/utilities/FileContentStamp.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts

diff --git a/common/changes/@microsoft/rush/reuse-unchanged-inputs_2026-09-28-18-30.json b/common/changes/@microsoft/rush/reuse-unchanged-inputs_2026-09-28-18-30.json
new file mode 100644
index 0000000000..4f59def32d
--- /dev/null
+++ b/common/changes/@microsoft/rush/reuse-unchanged-inputs_2026-09-28-18-30.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Long-lived hosts such as the Rush daemon now reuse the content digests of workspace definition and installation files, and the merged rush-project.json configuration of each project, while the files they were computed from are unchanged. A file that changed within the last few seconds is always read again, and a configuration is reloaded if any file of its rig or \"extends\" chain changes or resolves to another file.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 35b81910c8..9e61e8f19d 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -2150,6 +2150,8 @@ export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string>;
 // @alpha
 export class WorkspaceRuntimeFingerprintCache {
     get changedPaths(): ReadonlyArray<string>;
+    // @internal
+    _hashInputFilesAsync(filenames: Iterable<string>): Promise<string>;
     // @internal (undocumented)
     _hashPaths(paths: ReadonlyArray<string>): string;
 }
diff --git a/libraries/rush-lib/src/api/RushProjectConfiguration.ts b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
index 9ce3da893d..17dc406e30 100644
--- a/libraries/rush-lib/src/api/RushProjectConfiguration.ts
+++ b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
@@ -2,8 +2,9 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import * as fs from 'node:fs';
 
-import { AlreadyReportedError, Async, FileSystem, JsonFile, Path } from '@rushstack/node-core-library';
+import { AlreadyReportedError, Async, FileSystem, Import, JsonFile, Path } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
 import { ProjectConfigurationFile, InheritanceType } from '@rushstack/heft-config-file';
 import {
@@ -22,6 +23,12 @@ import anythingSchemaJson from '../schemas/anything.schema.json';
 import { HotlinkManager } from '../utilities/HotlinkManager';
 import type { RushConfiguration } from './RushConfiguration';
 import { PhasedCommandEngineProjectConfigurationError } from './PhasedCommandEngineProjectConfigurationError';
+import {
+  getFileStamp,
+  getSettledBeforeNs,
+  isFileStatSettled,
+  MISSING_FILE_STAMP
+} from '../utilities/FileContentStamp';
 
 /**
  * Describes the file structure for the `<project root>/config/rush-project.json` config file.
@@ -311,11 +318,52 @@ const OLD_RUSH_PROJECT_CONFIGURATION_FILE: ProjectConfigurationFile<IOldRushProj
 
 const _configCache: Map<RushConfigurationProject, RushProjectConfiguration | false> = new Map();
 
-interface IIsolatedProjectConfigurationLoaders {
+interface IProjectConfigurationLoaders {
   readonly configurationFile: ProjectConfigurationFile<IRushProjectJson>;
   readonly oldConfigurationFile: ProjectConfigurationFile<IOldRushProjectJson>;
 }
 
+/** A configuration file that a load read, or found missing. */
+interface IConfigurationFileInput {
+  /** The path the loader reads. */
+  readonly filePath: string;
+  readonly stamp: string;
+  /** The file's `extends` value and the path it resolved to. */
+  readonly parent: { readonly specifier: string; readonly filePath: string } | undefined;
+}
+
+/** The rig profile that a project without its own configuration file loads it from. */
+interface IRigProfileInput {
+  /** `<project>/node_modules/<rig>/package.json`, the first path that the rig package can resolve to. */
+  readonly packageJsonPath: string;
+  /** `<project>/node_modules/<rig>/profiles/<profile>` */
+  readonly profileFolderPath: string;
+  /** The profile folder's real path, which the loader reads the rig's configuration file from. */
+  readonly realProfileFolderPath: string;
+}
+
+interface IProjectConfigurationInputs {
+  readonly rigJsonStamp: string;
+  readonly ownFileStamp: string;
+  readonly rigProfile: IRigProfileInput | undefined;
+  /** The loaded file and its `extends` chain, or the missing rig configuration file. */
+  readonly files: ReadonlyArray<IConfigurationFileInput>;
+}
+
+interface IProjectConfigurationCacheEntry {
+  readonly rushProjectJson: IRushProjectJson | undefined;
+  readonly jsonForFingerprint: string | undefined;
+  /** Undefined if the load can't be reused, for example because one of its files changed too recently. */
+  readonly inputs: IProjectConfigurationInputs | undefined;
+}
+
+/**
+ * The last configuration that {@link RushProjectConfiguration._tryLoadForProjectsUncachedAsync} loaded for a
+ * project, with the inputs it was loaded from.
+ */
+const _currentConfigurationCache: WeakMap<RushConfigurationProject, IProjectConfigurationCacheEntry> =
+  new WeakMap();
+
 /**
  * Use this class to load the "config/rush-project.json" config file.
  *
@@ -343,10 +391,11 @@ export class RushProjectConfiguration {
   private constructor(
     project: RushConfigurationProject,
     rushProjectJson: IRushProjectJson,
-    operationSettingsByOperationName: ReadonlyMap<string, IOperationSettings>
+    operationSettingsByOperationName: ReadonlyMap<string, IOperationSettings>,
+    jsonForFingerprint: string = JSON.stringify(rushProjectJson)
   ) {
     this.project = project;
-    this.#jsonForFingerprint = JSON.stringify(rushProjectJson);
+    this.#jsonForFingerprint = jsonForFingerprint;
     this.incrementalBuildIgnoredGlobs = rushProjectJson.incrementalBuildIgnoredGlobs || [];
     this.disableBuildCacheForProject = rushProjectJson.disableBuildCacheForProject || false;
     this.operationSettingsByOperationName = operationSettingsByOperationName;
@@ -571,45 +620,60 @@ export class RushProjectConfiguration {
   }
 
   /**
-   * Loads a fresh native configuration snapshot without reading or modifying process-wide
-   * project, inherited-file, or rig caches. The loaders are owned only by this invocation.
+   * Loads a native configuration snapshot of the current files without reading or modifying the process-wide
+   * project, inherited-file, or rig caches of other loads. The loaders are owned only by this invocation.
    *
    * @remarks
    * Throws a {@link PhasedCommandEngineProjectConfigurationError} that names a project whose
    * configuration could not be loaded.
+   *
+   * A project's merged configuration is reused from an earlier call only if every input of its load is
+   * unchanged: the stamps (identity, size, mtime and ctime) of its `config/rig.json`, its own
+   * `config/rush-project.json`, and each file of the `extends` chain that was loaded; the path each `extends`
+   * value resolves to; and, for a configuration that comes from a rig, the real path of the rig profile folder
+   * that the project's `node_modules` reaches. A configuration is recorded only if each of its files had
+   * already been unchanged for a few seconds when it was examined, and only after a load that succeeded; the
+   * warnings are reported again by every call.
    * @internal
    */
   public static async _tryLoadForProjectsUncachedAsync(
     projects: Iterable<RushConfigurationProject>,
     terminal: ITerminal
   ): Promise<ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>> {
-    const loaders: IIsolatedProjectConfigurationLoaders = {
+    const loaders: IProjectConfigurationLoaders = {
       configurationFile: createProjectConfigurationFile(),
       oldConfigurationFile: new ProjectConfigurationFile<IOldRushProjectJson>({
         projectRelativeFilePath: RUSH_PROJECT_CONFIGURATION_FILE.projectRelativeFilePath,
         jsonSchemaObject: anythingSchemaJson
       })
     };
+    const view: ConfigurationInputView = _createConfigurationInputView();
     const result: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
     await Async.forEachAsync(
       projects,
       async (project) => {
         try {
-          const rushProjectJson: IRushProjectJson | undefined = await _tryLoadJsonForProjectAsync(
+          const entry: IProjectConfigurationCacheEntry = await _getCurrentConfigurationEntryAsync(
             project,
             terminal,
-            loaders
+            loaders,
+            view
           );
+          const { rushProjectJson } = entry;
           if (rushProjectJson) {
             result.set(
               project,
               new RushProjectConfiguration(
                 project,
                 rushProjectJson,
-                _getRushProjectConfiguration(project, rushProjectJson, terminal)
+                _getRushProjectConfiguration(project, rushProjectJson, terminal),
+                entry.jsonForFingerprint
               )
             );
           }
+          if (entry.inputs) {
+            _currentConfigurationCache.set(project, entry);
+          }
         } catch (error) {
           throw new PhasedCommandEngineProjectConfigurationError(project.packageName, error);
         }
@@ -667,17 +731,26 @@ export class RushProjectConfiguration {
 
 async function _tryLoadJsonForProjectAsync(
   project: RushConfigurationProject,
-  terminal: ITerminal,
-  loaders?: IIsolatedProjectConfigurationLoaders
+  terminal: ITerminal
 ): Promise<IRushProjectJson | undefined> {
-  const configurationFile: ProjectConfigurationFile<IRushProjectJson> =
-    loaders?.configurationFile ?? RUSH_PROJECT_CONFIGURATION_FILE;
-  const oldConfigurationFile: ProjectConfigurationFile<IOldRushProjectJson> =
-    loaders?.oldConfigurationFile ?? OLD_RUSH_PROJECT_CONFIGURATION_FILE;
-  const rigConfig: IRigConfig | undefined = loaders
-    ? await loadIsolatedRigConfigAsync(project.projectFolder)
-    : await RigConfig.loadForProjectFolderAsync({ projectFolderPath: project.projectFolder });
+  return await _tryLoadJsonForProjectWithRigAsync(
+    project,
+    terminal,
+    {
+      configurationFile: RUSH_PROJECT_CONFIGURATION_FILE,
+      oldConfigurationFile: OLD_RUSH_PROJECT_CONFIGURATION_FILE
+    },
+    await RigConfig.loadForProjectFolderAsync({ projectFolderPath: project.projectFolder })
+  );
+}
 
+async function _tryLoadJsonForProjectWithRigAsync(
+  project: RushConfigurationProject,
+  terminal: ITerminal,
+  loaders: IProjectConfigurationLoaders,
+  rigConfig: IRigConfig | undefined
+): Promise<IRushProjectJson | undefined> {
+  const { configurationFile, oldConfigurationFile } = loaders;
   try {
     return await configurationFile.tryLoadConfigurationFileForProjectAsync(
       terminal,
@@ -791,6 +864,228 @@ async function loadIsolatedRigConfigAsync(projectFolder: string): Promise<IRigCo
   return rigConfig;
 }
 
+async function _getCurrentConfigurationEntryAsync(
+  project: RushConfigurationProject,
+  terminal: ITerminal,
+  loaders: IProjectConfigurationLoaders,
+  view: ConfigurationInputView
+): Promise<IProjectConfigurationCacheEntry> {
+  const entry: IProjectConfigurationCacheEntry | undefined = _currentConfigurationCache.get(project);
+  if (entry && view.isCurrent(project, entry)) {
+    return entry;
+  }
+  _currentConfigurationCache.delete(project);
+  // Examined before the loader reads them.
+  const rigJson: IConfigurationFileStat | undefined = view.getStat(getRigJsonPath(project));
+  const ownFile: IConfigurationFileStat | undefined = view.getStat(getOwnConfigurationFilePath(project));
+  const rigConfig: IRigConfig | undefined = await loadIsolatedRigConfigAsync(project.projectFolder);
+  const inputs: IProjectConfigurationInputs | undefined =
+    rigJson?.settled && ownFile?.settled
+      ? await view.tryGetInputsAsync(project, rigConfig, rigJson.stamp, ownFile.stamp)
+      : undefined;
+  const rushProjectJson: IRushProjectJson | undefined = await _tryLoadJsonForProjectWithRigAsync(
+    project,
+    terminal,
+    loaders,
+    rigConfig
+  );
+  return {
+    rushProjectJson,
+    jsonForFingerprint: rushProjectJson && JSON.stringify(rushProjectJson),
+    inputs
+  };
+}
+
+function getRigJsonPath(project: RushConfigurationProject): string {
+  return path.join(project.projectFolder, 'config', 'rig.json');
+}
+
+function getOwnConfigurationFilePath(project: RushConfigurationProject): string {
+  // The path that the loader reads.
+  return path.resolve(project.projectFolder, RUSH_PROJECT_CONFIGURATION_FILE.projectRelativeFilePath);
+}
+
+interface IConfigurationFileStat {
+  readonly stamp: string;
+  /** Whether the file had been unchanged long enough for its stamp to identify its content. */
+  readonly settled: boolean;
+}
+
+const getNativeRealPath: (folderPath: string) => string =
+  // As in the "resolve" package, which Windows network paths make fall back to the JavaScript implementation.
+  process.platform === 'win32' ? fs.realpathSync : fs.realpathSync.native;
+
+/**
+ * The file system state that one {@link RushProjectConfiguration._tryLoadForProjectsUncachedAsync} call compares
+ * recorded inputs with. Each fact is examined at most once per call, and a file is always examined before the
+ * call's loader reads it.
+ */
+class ConfigurationInputView {
+  readonly #settledBeforeNs: bigint = getSettledBeforeNs();
+  readonly #stats: Map<string, IConfigurationFileStat | undefined> = new Map();
+  readonly #realPaths: Map<string, string | undefined> = new Map();
+  readonly #resolutions: Map<string, string | undefined> = new Map();
+  readonly #fileInputs: Map<string, Promise<ReadonlyArray<IConfigurationFileInput> | undefined>> = new Map();
+
+  /** Returns undefined for a path that isn't a regular file or can't be examined. */
+  public getStat(filePath: string): IConfigurationFileStat | undefined {
+    if (!this.#stats.has(filePath)) {
+      let result: IConfigurationFileStat | undefined;
+      try {
+        // statSync follows links, so dev and ino identify the file whose content is loaded.
+        const stat: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+        if (!stat) {
+          result = { stamp: MISSING_FILE_STAMP, settled: true };
+        } else if (stat.isFile()) {
+          result = { stamp: getFileStamp(stat), settled: isFileStatSettled(stat, this.#settledBeforeNs) };
+        }
+      } catch (error) {
+        if (FileSystem.isNotExistError(error as Error)) {
+          result = { stamp: MISSING_FILE_STAMP, settled: true };
+        }
+      }
+      this.#stats.set(filePath, result);
+    }
+    return this.#stats.get(filePath);
+  }
+
+  public isCurrent(project: RushConfigurationProject, entry: IProjectConfigurationCacheEntry): boolean {
+    const { inputs } = entry;
+    if (
+      !inputs ||
+      this.getStat(getRigJsonPath(project))?.stamp !== inputs.rigJsonStamp ||
+      this.getStat(getOwnConfigurationFilePath(project))?.stamp !== inputs.ownFileStamp ||
+      (inputs.rigProfile && !this.#isRigProfileCurrent(inputs.rigProfile))
+    ) {
+      return false;
+    }
+    return inputs.files.every(
+      ({ filePath, stamp, parent }) =>
+        this.getStat(filePath)?.stamp === stamp &&
+        (!parent || this.#resolveExtends(parent.specifier, filePath) === parent.filePath)
+    );
+  }
+
+  /**
+   * Records what a load of the project's configuration depends on, before the loader reads any of it. Returns
+   * undefined if the load can't be reused.
+   */
+  public async tryGetInputsAsync(
+    project: RushConfigurationProject,
+    rigConfig: IRigConfig | undefined,
+    rigJsonStamp: string,
+    ownFileStamp: string
+  ): Promise<IProjectConfigurationInputs | undefined> {
+    let rigProfile: IRigProfileInput | undefined;
+    let filePath: string | undefined;
+    if (ownFileStamp !== MISSING_FILE_STAMP) {
+      filePath = getOwnConfigurationFilePath(project);
+    } else if (rigConfig instanceof RealProfileFolderRigConfig) {
+      const rigFolderPath: string = path.join(project.projectFolder, 'node_modules', rigConfig.rigPackageName);
+      rigProfile = {
+        packageJsonPath: path.join(rigFolderPath, 'package.json'),
+        profileFolderPath: path.join(rigFolderPath, rigConfig.relativeProfileFolderPath),
+        realProfileFolderPath: rigConfig.getResolvedProfileFolder()
+      };
+      // The shortcut that a reuse checks must agree with the loader's own resolution of the rig.
+      if (!this.#isRigProfileCurrent(rigProfile)) return undefined;
+      filePath = path.resolve(
+        rigProfile.realProfileFolderPath,
+        RUSH_PROJECT_CONFIGURATION_FILE.projectRelativeFilePath
+      );
+    } else if (rigConfig?.rigFound) {
+      // The rig package can't be resolved, which the loader reports if it needs the rig.
+      return undefined;
+    }
+    const files: ReadonlyArray<IConfigurationFileInput> | undefined = filePath
+      ? await this.#getFileInputsAsync(filePath)
+      : [];
+    return files && { rigJsonStamp, ownFileStamp, rigProfile, files };
+  }
+
+  #isRigProfileCurrent(rigProfile: IRigProfileInput): boolean {
+    // When this file exists, the rig package resolves to it before any other candidate.
+    const packageJson: IConfigurationFileStat | undefined = this.getStat(rigProfile.packageJsonPath);
+    return (
+      packageJson !== undefined &&
+      packageJson.stamp !== MISSING_FILE_STAMP &&
+      this.#getRealPath(rigProfile.profileFolderPath) === rigProfile.realProfileFolderPath
+    );
+  }
+
+  #getRealPath(folderPath: string): string | undefined {
+    if (!this.#realPaths.has(folderPath)) {
+      let realPath: string | undefined;
+      try {
+        realPath = getNativeRealPath(folderPath);
+      } catch {
+        // A missing profile folder is reported by the loader.
+      }
+      this.#realPaths.set(folderPath, realPath);
+    }
+    return this.#realPaths.get(folderPath);
+  }
+
+  #resolveExtends(specifier: string, configurationFilePath: string): string | undefined {
+    const baseFolderPath: string = path.dirname(configurationFilePath);
+    const key: string = `${baseFolderPath}\0${specifier}`;
+    if (!this.#resolutions.has(key)) {
+      let resolvedPath: string | undefined;
+      try {
+        // As the configuration file loader resolves "extends".
+        resolvedPath = Import.resolveModule({ modulePath: specifier, baseFolderPath });
+      } catch {
+        // The loader reports the failure.
+      }
+      this.#resolutions.set(key, resolvedPath);
+    }
+    return this.#resolutions.get(key);
+  }
+
+  #getFileInputsAsync(filePath: string): Promise<ReadonlyArray<IConfigurationFileInput> | undefined> {
+    let result: Promise<ReadonlyArray<IConfigurationFileInput> | undefined> | undefined =
+      this.#fileInputs.get(filePath);
+    if (!result) {
+      result = this.#readFileInputsAsync(filePath);
+      this.#fileInputs.set(filePath, result);
+    }
+    return result;
+  }
+
+  async #readFileInputsAsync(
+    firstFilePath: string
+  ): Promise<ReadonlyArray<IConfigurationFileInput> | undefined> {
+    const files: IConfigurationFileInput[] = [];
+    const visited: Set<string> = new Set();
+    for (let filePath: string | undefined = firstFilePath; filePath !== undefined; ) {
+      const stat: IConfigurationFileStat | undefined = this.getStat(filePath);
+      if (!stat?.settled || visited.has(filePath)) return undefined;
+      visited.add(filePath);
+      let specifier: unknown;
+      if (stat.stamp !== MISSING_FILE_STAMP) {
+        try {
+          specifier = JsonFile.parseString(await FileSystem.readFileAsync(filePath))?.extends;
+        } catch {
+          // The loader reports the failure.
+          return undefined;
+        }
+      }
+      if (specifier && typeof specifier !== 'string') return undefined;
+      const parentPath: string | undefined = specifier
+        ? this.#resolveExtends(specifier as string, filePath)
+        : undefined;
+      if (specifier && parentPath === undefined) return undefined;
+      files.push({
+        filePath,
+        stamp: stat.stamp,
+        parent: parentPath !== undefined ? { specifier: specifier as string, filePath: parentPath } : undefined
+      });
+      filePath = parentPath;
+    }
+    return files;
+  }
+}
+
 /**
  * Parses and validates the operation settings from the rush-project.json data. Returns the
  * validated `operationSettingsByOperationName` map used to construct a {@link RushProjectConfiguration}.
@@ -858,3 +1153,7 @@ function _getRushProjectConfiguration(
 
   return operationSettingsByOperationName;
 }
+
+function _createConfigurationInputView(): ConfigurationInputView {
+  return new ConfigurationInputView();
+}
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 0505b2633f..47d5df524c 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -14,6 +14,7 @@ import type { RushConfigurationProject } from './RushConfigurationProject';
 import { RushProjectConfiguration } from './RushProjectConfiguration';
 import { getDaemonIpcImplementationIdentityAsync } from '../logic/operations/DaemonIpcConfiguration';
 import { AutoinstallerPluginLoader } from '../pluginFramework/PluginLoader/AutoinstallerPluginLoader';
+import { getFileStamp, getSettledBeforeNs, isFileStatSettled } from '../utilities/FileContentStamp';
 
 /** Stable inputs which distinguish reusable, reloadable, and process-bound workspace state. @alpha */
 export interface IWorkspaceInputFingerprint {
@@ -34,7 +35,11 @@ export interface IWorkspaceInputFingerprintOptions {
   readonly environment: Readonly<Record<string, string | undefined>>;
   /** Additional implementation files/folders owned by the embedding host. */
   readonly runtimePaths?: ReadonlyArray<string>;
-  /** Invocation-owner cache for implementation files; workspace definitions are always read by content. */
+  /**
+   * Invocation-owner cache for file digests. Workspace definitions are always compared by content: a cached
+   * digest is reused only for a file that had stopped changing before it was read (see
+   * {@link WorkspaceRuntimeFingerprintCache}).
+   */
   readonly runtimeCache?: WorkspaceRuntimeFingerprintCache;
 }
 
@@ -251,6 +256,11 @@ function removeRepeatedPathEntries(value: string): string {
   return Array.from(new Set(value.split(path.delimiter))).join(path.delimiter);
 }
 
+interface IFileDigest {
+  readonly stamp: string;
+  readonly entry: ReadonlyArray<string>;
+}
+
 /**
  * Memoizes runtime content digests behind file identity, size, nanosecond mtime and ctime checks.
  * Changes to metadata alone still produce the same content fingerprint.
@@ -261,10 +271,22 @@ function removeRepeatedPathEntries(value: string): string {
  * updates the cache; hosts can inspect {@link WorkspaceRuntimeFingerprintCache.changedPaths}
  * when reporting why a process restart is required.
  *
+ * The cache also memoizes the digests of workspace definition and installation files, which users edit while
+ * a host is running. Such a digest is recorded only if the file's ctime and mtime were at least 3 seconds old
+ * when the file was examined, and it is reused only while the file's identity, size, mtime and ctime are
+ * unchanged. A file that changed more recently is read again by every capture. Every write updates a file's
+ * ctime, which userspace can't set, so a later write can't keep the recorded stamp even on a filesystem whose
+ * timestamps are coarse, provided that the filesystem's clock agrees with the host's to within that margin.
+ *
+ * Like the runtime digests, a memoized entry keeps the file's resolved path while the identity of the file it
+ * reaches is unchanged. A symbolic link that is retargeted to another hard link of the same file, or a parent
+ * folder that is moved without changing the file, keeps the previous resolved path.
+ *
  * @alpha
  */
 export class WorkspaceRuntimeFingerprintCache {
-  private readonly _files: Map<string, { stamp: string; entry: ReadonlyArray<string> }> = new Map();
+  private readonly _files: Map<string, IFileDigest> = new Map();
+  private readonly _inputFiles: Map<string, IFileDigest> = new Map();
   private _baseline: ReadonlyMap<string, string> | undefined;
   private _changedPaths: ReadonlyArray<string> = [];
 
@@ -289,8 +311,8 @@ export class WorkspaceRuntimeFingerprintCache {
         // statSync follows links, so dev and ino identify the file that is loaded. Its resolved path is
         // recomputed whenever that identity changes, which avoids a costly realpath for every unchanged file.
         const stat: fsSync.BigIntStats = fsSync.statSync(filename, { bigint: true });
-        const stamp: string = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
-        let cached: { stamp: string; entry: ReadonlyArray<string> } | undefined = this._files.get(filename);
+        const stamp: string = getFileStamp(stat);
+        let cached: IFileDigest | undefined = this._files.get(filename);
         if (cached?.stamp !== stamp) {
           cached = {
             stamp,
@@ -318,6 +340,58 @@ export class WorkspaceRuntimeFingerprintCache {
     );
     return hashText(JSON.stringify(entries));
   }
+
+  /**
+   * Hashes workspace definition or installation files by content, as `[filename, realpath, sha256]` entries or
+   * `[filename, 'missing']`. See the remarks of {@link WorkspaceRuntimeFingerprintCache} for when a digest is reused.
+   * @internal
+   */
+  public async _hashInputFilesAsync(filenames: Iterable<string>): Promise<string> {
+    const settledBeforeNs: bigint = getSettledBeforeNs();
+    const sortedFilenames: string[] = Array.from(filenames).sort();
+    const entries: ReadonlyArray<string>[] = new Array(sortedFilenames.length);
+    const misses: { index: number; stat: fsSync.BigIntStats | undefined }[] = [];
+    for (let index: number = 0; index < sortedFilenames.length; index++) {
+      const filename: string = sortedFilenames[index];
+      let stat: fsSync.BigIntStats | undefined;
+      try {
+        // statSync follows links, so dev and ino identify the file whose content is hashed.
+        stat = fsSync.statSync(filename, { bigint: true, throwIfNoEntry: false });
+      } catch {
+        // Hashing the file reports the error, or its absence, as an uncached capture does.
+        misses.push({ index, stat: undefined });
+        continue;
+      }
+      if (!stat) {
+        this._inputFiles.delete(filename);
+        entries[index] = [filename, 'missing'];
+      } else if (!stat.isFile()) {
+        misses.push({ index, stat: undefined });
+      } else {
+        const cached: IFileDigest | undefined = this._inputFiles.get(filename);
+        if (cached?.stamp === getFileStamp(stat)) {
+          entries[index] = cached.entry;
+        } else {
+          misses.push({ index, stat });
+        }
+      }
+    }
+    await Async.forEachAsync(
+      misses,
+      async ({ index, stat }) => {
+        const filename: string = sortedFilenames[index];
+        const entry: ReadonlyArray<string> = await hashFileAsync(filename);
+        entries[index] = entry;
+        if (stat && entry.length === 3 && isFileStatSettled(stat, settledBeforeNs)) {
+          this._inputFiles.set(filename, { stamp: getFileStamp(stat), entry });
+        } else {
+          this._inputFiles.delete(filename);
+        }
+      },
+      { concurrency: 3 }
+    );
+    return hashText(JSON.stringify(entries));
+  }
 }
 
 /** The strongest action required by a workspace input change. @alpha */
@@ -420,13 +494,12 @@ export async function captureWorkspaceInputFingerprintAsync(
   for (const pluginConfiguration of rushConfiguration._rushPluginsConfiguration.configuration.plugins) {
     runtimePaths.push(AutoinstallerPluginLoader.getPluginPackageFolder(rushConfiguration, pluginConfiguration));
   }
-  const runtimeHash: string = (options.runtimeCache ?? new WorkspaceRuntimeFingerprintCache())._hashPaths(
-    runtimePaths
-  );
+  const cache: WorkspaceRuntimeFingerprintCache = options.runtimeCache ?? new WorkspaceRuntimeFingerprintCache();
+  const runtimeHash: string = cache._hashPaths(runtimePaths);
   return {
-    configurationHash: await hashFilesAsync(definitions),
+    configurationHash: await cache._hashInputFilesAsync(definitions),
     environmentHash: hashText(JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment))),
-    installationHash: await hashFilesAsync(installation),
+    installationHash: await cache._hashInputFilesAsync(installation),
     runtimeHash: hashText(JSON.stringify([process.execPath, process.version, runtimeHash])),
     selectedRushVersion: environment.RUSH_PREVIEW_VERSION ?? rushJson.rushVersion
   };
@@ -461,26 +534,19 @@ function hashText(text: string): string {
   return createHash('sha256').update(text).digest('hex');
 }
 
-async function hashFilesAsync(filenames: Iterable<string>): Promise<string> {
-  const entries: string[][] = await Async.mapAsync(
-    Array.from(filenames).sort(),
-    async (filename) => {
-      try {
-        return [
-          filename,
-          await fs.realpath(filename),
-          createHash('sha256')
-            .update(await fs.readFile(filename))
-            .digest('hex')
-        ];
-      } catch (error) {
-        if (!FileSystem.isNotExistError(error as Error)) throw error;
-        return [filename, 'missing'];
-      }
-    },
-    { concurrency: 3 }
-  );
-  return hashText(JSON.stringify(entries));
+async function hashFileAsync(filename: string): Promise<ReadonlyArray<string>> {
+  try {
+    return [
+      filename,
+      await fs.realpath(filename),
+      createHash('sha256')
+        .update(await fs.readFile(filename))
+        .digest('hex')
+    ];
+  } catch (error) {
+    if (!FileSystem.isNotExistError(error as Error)) throw error;
+    return [filename, 'missing'];
+  }
 }
 
 /**
diff --git a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
index 8db1a1fb44..bdb3fe6bdb 100644
--- a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
@@ -226,6 +226,8 @@ describe(RushProjectConfiguration.name, () => {
       });
       const projects: RushConfigurationProject[] = names.map(project);
 
+      // Files that changed moments ago aren't recorded for reuse, which would read them once more.
+      const dateNow: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(Date.now());
       const readFileAsync: jest.SpyInstance = jest.spyOn(FileSystem, 'readFileAsync');
       let configurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>;
       let readPaths: string[];
@@ -234,6 +236,7 @@ describe(RushProjectConfiguration.name, () => {
         readPaths = readFileAsync.mock.calls.map(([filePath]) => Path.convertToSlashes(filePath));
       } finally {
         readFileAsync.mockRestore();
+        dateNow.mockRestore();
       }
       expect(readPaths.filter((p) => p.endsWith('/profiles/default/config/rush-project.json'))).toHaveLength(1);
       expect(readPaths.filter((p) => p.endsWith('/shared/rush-project.json'))).toHaveLength(1);
@@ -255,6 +258,313 @@ describe(RushProjectConfiguration.name, () => {
         expect(configurations.get(linked)!._getJsonForFingerprint()).toBe(native!._getJsonForFingerprint());
       }
     });
+
+    describe('reuse of unchanged configurations', () => {
+      const realDateNow: () => number = Date.now;
+      let dateNow: jest.SpyInstance;
+      let readFileAsync: jest.SpyInstance;
+
+      /** Makes every file look as if it had been unchanged for several seconds. */
+      const settleFiles = (): void => {
+        dateNow.mockImplementation(() => realDateNow() + 10_000);
+      };
+      /** Makes the files that exist look as if they had just changed, however long the test takes. */
+      const stopClock = (): void => {
+        dateNow.mockReturnValue(realDateNow());
+      };
+      const takeReadCount = (): number => {
+        const count: number = readFileAsync.mock.calls.length;
+        readFileAsync.mockClear();
+        return count;
+      };
+      /** Waits until a write gets a later ctime than the file has, which a coarse clock can delay. */
+      const waitForLaterCtime = (relativePath: string): void => {
+        const { ctimeNs } = fs.statSync(path.join(folder, relativePath), { bigint: true });
+        const probePath: string = path.join(folder, 'probe');
+        do {
+          fs.writeFileSync(probePath, '');
+        } while (fs.statSync(probePath, { bigint: true }).ctimeNs <= ctimeNs);
+      };
+      const link = (linkPath: string, targetPath: string): void => {
+        const fullLinkPath: string = path.join(folder, linkPath);
+        fs.mkdirSync(path.dirname(fullLinkPath), { recursive: true });
+        fs.rmSync(fullLinkPath, { force: true });
+        fs.symlinkSync(path.join(folder, targetPath), fullLinkPath, 'junction');
+      };
+      const operationSettings = (operationName: string, outputFolderName: string): object => ({
+        operationSettings: [{ operationName, outputFolderNames: [outputFolderName] }]
+      });
+      const getOutputFolders = (
+        configuration: RushProjectConfiguration | undefined
+      ): Record<string, string[]> =>
+        Object.fromEntries(
+          Array.from(configuration?.operationSettingsByOperationName ?? [], ([name, settings]) => [
+            name,
+            [...(settings.outputFolderNames ?? [])]
+          ])
+        );
+      /** Checks the configuration that is loaded for the project, and for a project that has never been loaded. */
+      const expectOutputFoldersAsync = async (
+        rushProject: RushConfigurationProject,
+        expected: Record<string, string[]>
+      ): Promise<void> => {
+        const unloaded: RushConfigurationProject = project(rushProject.packageName);
+        expect(getOutputFolders((await loadAsync(rushProject)).get(rushProject))).toEqual(expected);
+        expect(getOutputFolders((await loadAsync(unloaded)).get(unloaded))).toEqual(expected);
+      };
+
+      beforeEach(() => {
+        dateNow = jest.spyOn(Date, 'now');
+        readFileAsync = jest.spyOn(FileSystem, 'readFileAsync');
+      });
+
+      afterEach(() => {
+        jest.restoreAllMocks();
+      });
+
+      it('reuses unchanged configurations without reading any file', async () => {
+        settleFiles();
+        write('plain/package.json', { name: 'plain', version: '1.0.0' });
+        const projects: RushConfigurationProject[] = ['rigged', 'own-file', 'plain'].map(project);
+        const first: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> = await loadAsync(
+          ...projects
+        );
+        expect(takeReadCount()).toBeGreaterThan(0);
+        const second: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> = await loadAsync(
+          ...projects
+        );
+        expect(takeReadCount()).toBe(0);
+        expect([...second.keys()]).toEqual(projects.slice(0, 2));
+        for (const rushProject of projects.slice(0, 2)) {
+          expect(second.get(rushProject)!._getJsonForFingerprint()).toBe(
+            first.get(rushProject)!._getJsonForFingerprint()
+          );
+          expect(getOutputFolders(second.get(rushProject))).toEqual(getOutputFolders(first.get(rushProject)));
+        }
+      });
+
+      it('loads a configuration again after any file that it was loaded from changes', async () => {
+        settleFiles();
+        const rigged: RushConfigurationProject = project('rigged');
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-rig'] });
+        write(
+          'rigged/node_modules/example-rig/profiles/default/config/rush-project.json',
+          operationSettings('_phase:build', 'from-rig-2')
+        );
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-rig-2'] });
+
+        // The project's own file takes precedence over the rig's while it exists.
+        write('rigged/config/rush-project.json', operationSettings('_phase:build', 'from-project'));
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-project'] });
+        // An edit that keeps the file's identity, size and modification time
+        const ownFilePath: string = path.join(folder, 'rigged/config/rush-project.json');
+        fs.utimesSync(ownFilePath, 1_000_000, 1_000_000);
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-project'] });
+        waitForLaterCtime('rigged/config/rush-project.json');
+        write('rigged/config/rush-project.json', operationSettings('_phase:build', 'from-PROJECT'));
+        fs.utimesSync(ownFilePath, 1_000_000, 1_000_000);
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-PROJECT'] });
+        fs.rmSync(ownFilePath);
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-rig-2'] });
+
+        write(
+          'rigged/node_modules/example-rig/profiles/other/config/rush-project.json',
+          operationSettings('_phase:build', 'from-other')
+        );
+        write('rigged/config/rig.json', { rigPackageName: 'example-rig', rigProfile: 'other' });
+        await expectOutputFoldersAsync(rigged, { '_phase:build': ['from-other'] });
+
+        write('rigged/config/base.json', operationSettings('_phase:test', 'from-base'));
+        write('rigged/config/rush-project.json', {
+          extends: './base.json',
+          ...operationSettings('_phase:build', 'from-project')
+        });
+        await expectOutputFoldersAsync(rigged, {
+          '_phase:build': ['from-project'],
+          '_phase:test': ['from-base']
+        });
+        write('rigged/config/base.json', operationSettings('_phase:test', 'from-base-2'));
+        await expectOutputFoldersAsync(rigged, {
+          '_phase:build': ['from-project'],
+          '_phase:test': ['from-base-2']
+        });
+      });
+
+      it('loads a configuration again after its rig or an extended package resolves to another folder', async () => {
+        settleFiles();
+        for (const version of ['1', '2']) {
+          write(`store/shared-config@${version}/package.json`, { name: 'shared-config', version });
+          write(
+            `store/shared-config@${version}/rush-project.json`,
+            operationSettings('_phase:test', `from-shared-${version}`)
+          );
+          write(`store/example-rig@${version}/package.json`, { name: 'example-rig', version });
+          write(`store/example-rig@${version}/profiles/default/config/rush-project.json`, {
+            extends: 'shared-config/rush-project.json',
+            ...operationSettings('_phase:build', `from-rig-${version}`)
+          });
+          link(`store/example-rig@${version}/node_modules/shared-config`, 'store/shared-config@1');
+        }
+        write('linked/package.json', { name: 'linked', version: '1.0.0' });
+        write('linked/config/rig.json', { rigPackageName: 'example-rig' });
+        link('linked/node_modules/example-rig', 'store/example-rig@1');
+        const linked: RushConfigurationProject = project('linked');
+        await expectOutputFoldersAsync(linked, {
+          '_phase:build': ['from-rig-1'],
+          '_phase:test': ['from-shared-1']
+        });
+        link('linked/node_modules/example-rig', 'store/example-rig@2');
+        await expectOutputFoldersAsync(linked, {
+          '_phase:build': ['from-rig-2'],
+          '_phase:test': ['from-shared-1']
+        });
+        link('store/example-rig@2/node_modules/shared-config', 'store/shared-config@2');
+        await expectOutputFoldersAsync(linked, {
+          '_phase:build': ['from-rig-2'],
+          '_phase:test': ['from-shared-2']
+        });
+      });
+
+      it('loads a configuration again after the rig package leaves the project node_modules folder', async () => {
+        settleFiles();
+        write('nested/package.json', { name: 'nested', version: '1.0.0' });
+        write('nested/config/rig.json', { rigPackageName: 'example-rig' });
+        for (const [rigFolderPath, outputFolderName] of [
+          ['nested/node_modules/example-rig', 'from-nested'],
+          ['node_modules/example-rig', 'from-hoisted']
+        ]) {
+          write(`${rigFolderPath}/package.json`, { name: 'example-rig', version: '1.0.0' });
+          write(
+            `${rigFolderPath}/profiles/default/config/rush-project.json`,
+            operationSettings('_phase:build', outputFolderName)
+          );
+        }
+        const nested: RushConfigurationProject = project('nested');
+        await expectOutputFoldersAsync(nested, { '_phase:build': ['from-nested'] });
+        // Without its package.json, the folder no longer provides the rig package, even though the profile
+        // folder is still there.
+        fs.rmSync(path.join(folder, 'nested/node_modules/example-rig/package.json'));
+        await expectOutputFoldersAsync(nested, { '_phase:build': ['from-hoisted'] });
+      });
+
+      it('reads a configuration again while any of its files may still be changing', async () => {
+        const rigged: RushConfigurationProject = project('rigged');
+        const loadTwiceAsync = async (): Promise<number> => {
+          await loadAsync(rigged);
+          takeReadCount();
+          await loadAsync(rigged);
+          return takeReadCount();
+        };
+        stopClock();
+        expect(await loadTwiceAsync()).toBeGreaterThan(0);
+
+        settleFiles();
+        const rigFilePath: string = path.join(
+          folder,
+          'rigged/node_modules/example-rig/profiles/default/config/rush-project.json'
+        );
+        const future: number = realDateNow() / 1000 + 60;
+        fs.utimesSync(rigFilePath, future, future);
+        expect(await loadTwiceAsync()).toBeGreaterThan(0);
+        fs.utimesSync(rigFilePath, 1_000_000, 1_000_000);
+        expect(await loadTwiceAsync()).toBe(0);
+      });
+
+      it('reports errors and warnings on every call', async () => {
+        settleFiles();
+        write('deprecated/package.json', { name: 'deprecated', version: '1.0.0' });
+        write('deprecated/config/rush-project.json', {
+          operationSettings: [
+            { operationName: '_phase:build', sharding: { count: 2, shardOperationSettings: {} } }
+          ]
+        });
+        write('duplicate/package.json', { name: 'duplicate', version: '1.0.0' });
+        write('duplicate/config/rush-project.json', {
+          operationSettings: [{ operationName: '_phase:build' }, { operationName: '_phase:build' }]
+        });
+        const [deprecated, duplicate, missingProfile] = ['deprecated', 'duplicate', 'missing-profile'].map(
+          project
+        );
+        const deprecatedReadCounts: number[] = [];
+        for (let i: number = 0; i < 2; i++) {
+          const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+          const terminal: Terminal = new Terminal(terminalProvider);
+          takeReadCount();
+          await RushProjectConfiguration._tryLoadForProjectsUncachedAsync([deprecated], terminal);
+          deprecatedReadCounts.push(takeReadCount());
+          expect(terminalProvider.getWarningOutput()).toContain(
+            'DEPRECATED: The "sharding.shardOperationSettings" field is deprecated.'
+          );
+          await expect(
+            RushProjectConfiguration._tryLoadForProjectsUncachedAsync([duplicate], terminal)
+          ).rejects.toThrow();
+          expect(terminalProvider.getErrorOutput()).toContain(
+            'The operation "_phase:build" appears multiple times'
+          );
+          await expect(
+            RushProjectConfiguration._tryLoadForProjectsUncachedAsync([missingProfile], terminal)
+          ).rejects.toThrow('The rig profile "missing" is not defined by the rig package "example-rig"');
+        }
+        // The second warning comes from a reused configuration.
+        expect(deprecatedReadCounts[0]).toBeGreaterThan(0);
+        expect(deprecatedReadCounts[1]).toBe(0);
+        write(
+          'missing-profile/node_modules/example-rig/profiles/missing/config/rush-project.json',
+          operationSettings('_phase:build', 'from-missing')
+        );
+        await expectOutputFoldersAsync(missingProfile, { '_phase:build': ['from-missing'] });
+      });
+
+      it('loads a configuration afresh after a load that failed is fixed', async () => {
+        settleFiles();
+        const rigged: RushConfigurationProject = project('rigged');
+        const loadWithReadCountAsync = async (): Promise<[Record<string, string[]>, number]> => {
+          takeReadCount();
+          const configurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+            await loadAsync(rigged);
+          return [getOutputFolders(configurations.get(rigged)), takeReadCount()];
+        };
+        const expectProjectErrorAsync = async (cause: object): Promise<void> => {
+          const error: unknown = await loadAsync(rigged).catch((e: unknown) => e);
+          expect(error).toBeInstanceOf(PhasedCommandEngineProjectConfigurationError);
+          expect(error).toMatchObject({ projectName: 'rigged', cause });
+        };
+        const ownFilePath: string = 'rigged/config/rush-project.json';
+        write(ownFilePath, operationSettings('_phase:build', 'from-project'));
+        const recordedContent: string = fs.readFileSync(path.join(folder, ownFilePath)).toString();
+        expect((await loadWithReadCountAsync())[0]).toEqual({ '_phase:build': ['from-project'] });
+        expect(await loadWithReadCountAsync()).toEqual([{ '_phase:build': ['from-project'] }, 0]);
+
+        waitForLaterCtime(ownFilePath);
+        fs.writeFileSync(path.join(folder, ownFilePath), recordedContent.slice(0, -1));
+        await expectProjectErrorAsync({});
+        await expectProjectErrorAsync({});
+        // Even with the content that it had when its configuration was recorded, the file is read again.
+        waitForLaterCtime(ownFilePath);
+        fs.writeFileSync(path.join(folder, ownFilePath), recordedContent);
+        const [fixedOutputFolders, fixedReadCount] = await loadWithReadCountAsync();
+        expect(fixedOutputFolders).toEqual({ '_phase:build': ['from-project'] });
+        expect(fixedReadCount).toBeGreaterThan(0);
+        expect(await loadWithReadCountAsync()).toEqual([{ '_phase:build': ['from-project'] }, 0]);
+
+        fs.rmSync(path.join(folder, ownFilePath));
+        write('rigged/config/rig.json', { rigPackageName: 'uninstalled-rig' });
+        await expectProjectErrorAsync({ code: 'MODULE_NOT_FOUND' });
+        await expectProjectErrorAsync({ code: 'MODULE_NOT_FOUND' });
+        write('rigged/node_modules/uninstalled-rig/package.json', {
+          name: 'uninstalled-rig',
+          version: '1.0.0'
+        });
+        write(
+          'rigged/node_modules/uninstalled-rig/profiles/default/config/rush-project.json',
+          operationSettings('_phase:build', 'from-installed-rig')
+        );
+        const [installedOutputFolders, installedReadCount] = await loadWithReadCountAsync();
+        expect(installedOutputFolders).toEqual({ '_phase:build': ['from-installed-rig'] });
+        expect(installedReadCount).toBeGreaterThan(0);
+        expect(await loadWithReadCountAsync()).toEqual([{ '_phase:build': ['from-installed-rig'] }, 0]);
+      });
+    });
   });
 
   describe('operationSettingsByOperationName', () => {
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 400cc891eb..f31d382118 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -445,4 +445,90 @@ describe('workspace input fingerprints', () => {
       fs.rmSync(folder, { recursive: true, force: true });
     }
   });
+
+  it('reuses the digests of definition and installation files only once they have stopped changing', async () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-fingerprint-'));
+    const realDateNow: () => number = Date.now;
+    const readFile: jest.SpyInstance = jest.spyOn(fs.promises, 'readFile');
+    try {
+      const write = (relativePath: string, content: string): void => {
+        const filename: string = path.join(folder, relativePath);
+        fs.mkdirSync(path.dirname(filename), { recursive: true });
+        fs.writeFileSync(filename, content);
+      };
+      write(
+        'rush.json',
+        JSON.stringify({
+          rushVersion: '5.179.0',
+          pnpmVersion: '10.27.0',
+          projects: [{ packageName: 'a', projectFolder: 'a' }]
+        })
+      );
+      write('a/package.json', '{"name":"a","version":"1.0.0"}');
+      write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 1');
+      write('npmrc/a', 'registry=https://a.example/');
+      write('npmrc/b', 'registry=https://b.example/');
+      fs.symlinkSync(path.join(folder, 'npmrc/a'), path.join(folder, '.npmrc'));
+      const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+        path.join(folder, 'rush.json')
+      );
+      const packageJsonPath: string = path.join(rushConfiguration.rushJsonFolder, 'a', 'package.json');
+      const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+      /** Returns the fingerprint and the number of times that the capture read the project's package.json. */
+      const captureAsync = async (): Promise<[IWorkspaceInputFingerprint, number]> => {
+        readFile.mockClear();
+        const fingerprint: IWorkspaceInputFingerprint = await captureWorkspaceInputFingerprintAsync({
+          rushConfiguration,
+          runtimeCache,
+          environment: {}
+        });
+        return [fingerprint, readFile.mock.calls.filter(([filename]) => filename === packageJsonPath).length];
+      };
+
+      // Files that changed moments ago are read by every capture.
+      const dateNow: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(realDateNow());
+      const [first, firstReadCount] = await captureAsync();
+      expect(firstReadCount).toBe(1);
+      expect(await captureAsync()).toEqual([first, 1]);
+      // Once they have been unchanged for a few seconds, a capture records digests that later captures reuse.
+      dateNow.mockImplementation(() => realDateNow() + 10_000);
+      expect(await captureAsync()).toEqual([first, 1]);
+      expect(await captureAsync()).toEqual([first, 0]);
+
+      // An edit that keeps the file's identity, size and modification time
+      fs.utimesSync(packageJsonPath, 1_000_000, 1_000_000);
+      expect(await captureAsync()).toEqual([first, 1]);
+      const { ctimeNs } = fs.statSync(packageJsonPath, { bigint: true });
+      const probePath: string = path.join(folder, 'probe');
+      do {
+        // A coarse clock can give a write the same ctime as the previous one.
+        fs.writeFileSync(probePath, '');
+      } while (fs.statSync(probePath, { bigint: true }).ctimeNs <= ctimeNs);
+      write('a/package.json', '{"name":"a","version":"1.0.1"}');
+      fs.utimesSync(packageJsonPath, 1_000_000, 1_000_000);
+      const [edited, editedReadCount] = await captureAsync();
+      expect(editedReadCount).toBe(1);
+      expect(classifyWorkspaceInputChange(first, edited)).toBe(WorkspaceInputChangeTier.Reload);
+      expect(await captureAsync()).toEqual([edited, 0]);
+
+      // A link that reaches another file
+      fs.rmSync(path.join(folder, '.npmrc'));
+      fs.symlinkSync(path.join(folder, 'npmrc/b'), path.join(folder, '.npmrc'));
+      const [retargeted] = await captureAsync();
+      expect(classifyWorkspaceInputChange(edited, retargeted)).toBe(WorkspaceInputChangeTier.Reload);
+      // A file that is removed, and then created again
+      fs.rmSync(packageJsonPath);
+      const [removed] = await captureAsync();
+      expect(classifyWorkspaceInputChange(retargeted, removed)).toBe(WorkspaceInputChangeTier.Reload);
+      write('a/package.json', '{"name":"a","version":"1.0.1"}');
+      expect(await captureAsync()).toEqual([retargeted, 1]);
+      // An installation file
+      write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 10');
+      const [installed] = await captureAsync();
+      expect(classifyWorkspaceInputChange(retargeted, installed)).toBe(WorkspaceInputChangeTier.Restart);
+    } finally {
+      jest.restoreAllMocks();
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/libraries/rush-lib/src/utilities/FileContentStamp.ts b/libraries/rush-lib/src/utilities/FileContentStamp.ts
new file mode 100644
index 0000000000..646ed7b627
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/FileContentStamp.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+/**
+ * A file whose ctime or mtime is newer than this many milliseconds must not be memoized by its stamp.
+ *
+ * @remarks
+ * Every write updates a file's ctime, and userspace can't set it. A stamp recorded for a file whose last change
+ * was already this old can't hide a later write, because that write gets a newer ctime even on a filesystem
+ * whose timestamps have a coarse granularity (a jiffy on Linux, 2 seconds on FAT). The argument assumes that the
+ * filesystem's clock agrees with this process's clock to within this margin, as a local filesystem's does.
+ */
+export const SETTLED_FILE_AGE_MS: number = 3000;
+
+/** The stamp recorded for a path that doesn't exist. */
+export const MISSING_FILE_STAMP: string = 'missing';
+
+/**
+ * The ctime and mtime a file must be older than for its stamp to be memoized. Take it before examining any of
+ * the files, so that a write made after a file's examination gets a later ctime.
+ */
+export function getSettledBeforeNs(): bigint {
+  return BigInt(Date.now() - SETTLED_FILE_AGE_MS) * BigInt(1e6);
+}
+
+/** Identifies a file's content by the identity, size, nanosecond mtime and ctime of the file it reaches. */
+export function getFileStamp(stat: fs.BigIntStats): string {
+  return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+}
+
+/** Whether a file examined after `settledBeforeNs` was taken may be memoized by its stamp. */
+export function isFileStatSettled(stat: fs.BigIntStats, settledBeforeNs: bigint): boolean {
+  return stat.ctimeNs < settledBeforeNs && stat.mtimeNs < settledBeforeNs;
+}
diff --git a/libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts b/libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts
new file mode 100644
index 0000000000..cd2a3288a4
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/FileContentStamp.test.ts
@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+import {
+  getFileStamp,
+  getSettledBeforeNs,
+  isFileStatSettled,
+  SETTLED_FILE_AGE_MS
+} from '../FileContentStamp';
+
+const MS: bigint = BigInt(1e6);
+
+function createStat(mtimeMs: number, ctimeMs: number): fs.BigIntStats {
+  return {
+    dev: BigInt(1),
+    ino: BigInt(2),
+    size: BigInt(3),
+    mtimeNs: BigInt(mtimeMs) * MS + BigInt(4),
+    ctimeNs: BigInt(ctimeMs) * MS + BigInt(5)
+  } as fs.BigIntStats;
+}
+
+describe('FileContentStamp', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('identifies a file by identity, size and nanosecond times', () => {
+    expect(getFileStamp(createStat(10, 20))).toBe('1:2:3:10000004:20000005');
+  });
+
+  it('settles files whose ctime and mtime are both older than the margin', () => {
+    jest.spyOn(Date, 'now').mockReturnValue(100_000);
+    const settledBeforeNs: bigint = getSettledBeforeNs();
+    expect(settledBeforeNs).toBe(BigInt(100_000 - SETTLED_FILE_AGE_MS) * MS);
+
+    const boundaryMs: number = 100_000 - SETTLED_FILE_AGE_MS;
+    expect(isFileStatSettled(createStat(boundaryMs - 1, boundaryMs - 1), settledBeforeNs)).toBe(true);
+    // Any time in the same millisecond as the bound is too recent.
+    expect(isFileStatSettled(createStat(boundaryMs - 1, boundaryMs), settledBeforeNs)).toBe(false);
+    // A future mtime set with utimes() doesn't settle a file whose ctime is old.
+    expect(isFileStatSettled(createStat(200_000, boundaryMs - 1), settledBeforeNs)).toBe(false);
+  });
+});

From 9000351f8336623d0347b5640ccb05cfdad94715 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:28:45 +0000
Subject: [PATCH 036/265] [rush-cli-client] The daemon's admission and
 restart-drain reasons in full in agent output, and rushd's startup wait as a
 pipe line

Swarm integration step 21; original commit 478f4d3af0 (merge of swarm/r04-t83-a81 at 4d1a045fca).
Scope: task 83.

Brings task 83's chain as resolved onto a81a00520d: 244ed8b1f5 (merge of swarm/r04-t83-clip @9d71dbe9bb, the clip fix for board 1539) and 4d1a045fca, with board 711 (1886d80936), tasks 79, 71 and 50 and the restart-drain timeout.
Gate: ch01 GATE OK board 1872 (lifts board 1778); combined with task 93, tree d0e8df0156, full suite board 1888.

Commits folded into this step (21):
- 2e7d278d8f [rush-daemon] Report the full log path of failed and warning operations
- 3b91eec856 [rush-cli-client] Keep spawned test clients on the default output when tests run in an agent shell
- 1ae03fc555 [rush-cli-client] Agent output that holds at repository scale
- 862ed5e676 [rush-cli-client] Do not report a daemon shutdown as a user cancellation
- 39cae5f22b [rush-cli-client] Send no terminal width for a pseudo-terminal without a size
- 5f3c36fe17 [rush-daemon] Describe a rejected request without the debug messages of the graph load (task 71)
- 563e541fdf [rush-cli-client] Cap a multi-line error message in agent output (task 71)
- 2377740ab9 [rush-daemon] Keep the loaded graph when a request only selects an unknown project (task 71)
- e382d2ac80 [rush-lib] Run the initial script for every command outside watch mode (task 50, board 115)
- b7bba00fb3 [rush-cli-client] Never leave agent output silent on a pipe (task 79)
- feacc54bf7 [rush-daemon] Report a restart drain as a queue position (task 79)
- 1886d80936 [rush-cli-client] Report Ctrl+C during graph preparation as cancelled (board 711)
- ae31023aad [rush-cli-client] Report an empty selection in agent output (board 634)
- bacfa3d5af [rush-daemon] Do not apply the client-default queue timeout to a restart drain (task 83)
- 5f1c7b4f1b [rush-cli-client] Keep "daemon admission failed (<code>)" in the agent summary; word an empty selection like native Rush (board 785, board 634)
- 3b5dc578d6 [rush-daemon] Document the restart drain and its client-default timeout (task 83)
- cbf8a3a45e [rush-daemon] Apply the client-default timeout to a restart drain while a rushx script runs or for later requests (task 83)
- 6cd768c6b3 [rush-daemon] Suggest stopping the rushx script when a restart drain times out behind one (task 83)
- b2f9d78f1f [rush-daemon] Name the waived time when a restart drain times out (task 83)
- 9d71dbe9bb Write the daemon's reason for an admission failure in full in agent output (task 83, board 1539)
- 4d1a045fca Write rushd's startup wait as a pipe line in agent output (task 83 on task 95)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  61 +-
 .../src/AgentOperationTracker.ts              | 246 ++++++
 .../src/AgentProgressRenderer.ts              | 464 ++++++++----
 .../src/OperationOutputExcerpt.ts             | 224 ++++++
 .../rush-cli-client/src/clientCancellation.ts |  12 +-
 apps/rush-cli-client/src/launchClient.ts      |  27 +-
 apps/rush-cli-client/src/outputSelection.ts   |   4 +
 apps/rush-cli-client/src/start.ts             |   9 +-
 apps/rush-cli-client/src/terminalColumns.ts   |  12 +
 .../src/test/AgentProgressRenderer.test.ts    | 699 ++++++++++++++++--
 .../src/test/GraphGenerationWire.test.ts      |   5 +-
 .../src/test/NativeBuildTestFixture.test.ts   |  30 +
 .../src/test/NativeBuildTestFixture.ts        |   4 +-
 .../src/test/OperationOutputExcerpt.test.ts   | 255 +++++++
 .../src/test/RushXDaemonTestFixture.ts        |   4 +-
 .../src/test/TestProcessEnvironment.ts        |  18 +
 .../src/test/daemonGraph.test.ts              |   3 +-
 .../src/test/daemonLogs.test.ts               |  11 +-
 .../src/test/launchClient.test.ts             |  39 +-
 .../src/test/nativeMutation.test.ts           |   4 +-
 .../src/test/pipedInput.test.ts               |   4 +-
 .../src/test/terminalColumns.test.ts          |  18 +
 ...mission-failure-code_2026-09-28-15-08.json |  11 +
 ...gent-empty-selection_2026-09-28-14-45.json |  11 +
 .../agent-error-detail_2026-09-28-13-30.json  |  11 +
 .../agent-output-scale_2026-09-28-13-00.json  |  11 +
 .../agent-pipe-status_2026-09-28-14-20.json   |  11 +
 ...l-before-engine-init_2026-09-28-14-45.json |  11 +
 ...utdown-not-cancelled_2026-09-28-13-00.json |  11 +
 ...t83-admission-reason_2026-09-28-18-55.json |  10 +
 ...83-startup-wait-line_2026-09-28-20-10.json |  10 +
 .../zero-size-pty_2026-09-28-13-00.json       |  11 +
 ...rain-default-timeout_2026-09-28-15-08.json |  11 +
 ...gent-output-log-path_2026-09-28-13-00.json |  11 +
 ...rain-default-timeout_2026-09-28-15-08.json |  11 +
 ...gent-output-log-path_2026-09-28-13-00.json |  11 +
 ...ejection-keeps-graph_2026-09-28-13-45.json |  11 +
 ...-without-debug-lines_2026-09-28-13-30.json |  11 +
 ...rain-default-timeout_2026-09-28-15-08.json |  11 +
 ...drain-queue-position_2026-09-28-14-20.json |  11 +
 .../reviews/api/rush-daemon-protocol.api.md   |   1 +
 .../src/executeWithDaemonRestart.ts           |  20 +-
 .../src/test/connectOrStartDaemon.test.ts     |  38 +
 .../src/test/fixtures/daemon.ts               |  11 +
 .../src/DaemonOperationPayloads.ts            |   5 +
 .../src/DaemonRequestAdmission.ts             |   6 +-
 libraries/rush-daemon/README.md               |  18 +-
 .../rush-daemon/src/EngineTerminalProvider.ts |  31 +-
 .../rush-daemon/src/PhasedRequestEventSink.ts |  16 +-
 .../src/WorkspaceRequestAdmission.ts          |  34 +-
 .../src/WorkspaceRequestLifecycle.ts          |  38 +-
 .../src/WorkspaceRestartArbiter.ts            | 143 +++-
 .../src/test/EngineTerminalProvider.test.ts   |  34 +
 .../src/test/PhasedRequestEventSink.test.ts   |  42 +-
 .../ProductionDaemonRequestResolver.test.ts   |  27 +
 .../src/test/RestartDrainAdmission.test.ts    | 131 ++++
 .../src/test/WorkspaceRestartArbiter.test.ts  | 198 ++++-
 .../test/WorkspaceRestartArbitration.test.ts  |  15 +
 58 files changed, 2840 insertions(+), 317 deletions(-)
 create mode 100644 apps/rush-cli-client/src/AgentOperationTracker.ts
 create mode 100644 apps/rush-cli-client/src/OperationOutputExcerpt.ts
 create mode 100644 apps/rush-cli-client/src/terminalColumns.ts
 create mode 100644 apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
 create mode 100644 apps/rush-cli-client/src/test/TestProcessEnvironment.ts
 create mode 100644 apps/rush-cli-client/src/test/terminalColumns.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-admission-failure-code_2026-09-28-15-08.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-empty-selection_2026-09-28-14-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-error-detail_2026-09-28-13-30.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-output-scale_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-pipe-status_2026-09-28-14-20.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/cancel-before-engine-init_2026-09-28-14-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/daemon-shutdown-not-cancelled_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t83-admission-reason_2026-09-28-18-55.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t83-startup-wait-line_2026-09-28-20-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/zero-size-pty_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-client-core/restart-drain-default-timeout_2026-09-28-15-08.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/agent-output-log-path_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/restart-drain-default-timeout_2026-09-28-15-08.json
 create mode 100644 common/changes/@rushstack/rush-daemon/agent-output-log-path_2026-09-28-13-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rejection-keeps-graph_2026-09-28-13-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rejection-without-debug-lines_2026-09-28-13-30.json
 create mode 100644 common/changes/@rushstack/rush-daemon/restart-drain-default-timeout_2026-09-28-15-08.json
 create mode 100644 common/changes/@rushstack/rush-daemon/restart-drain-queue-position_2026-09-28-14-20.json
 create mode 100644 libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index fcbfaa9d06..790c03a04d 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -52,7 +52,7 @@ already running in this repository." Instead, the client keeps trying for one mo
 (15 seconds, so about 30 seconds in all) and uses the daemon once it is ready. It says so when it starts
 waiting (`rush-client: The daemon is not ready yet. <live process>, so this command waits up to 15 s more
 for it instead of running Rush in-process.`; agent output shows "rushd is still starting; waiting for it"
-as the progress phase). If the daemon is still not ready, the command exits with code 1. The message
+as the progress phase, and on a pipe writes it as a progress line). If the daemon is still not ready, the command exits with code 1. The message
 gives the startup error with its `--no-daemon` hint, then the process that is still live, "so Rush was
 not run in-process", and a pointer to `rush-client daemon status`.
 
@@ -72,13 +72,19 @@ while the first build after startup loads the graph runs once the load finishes.
 That wait fails after 10 times the timeout (5 minutes with the default), so a load
 that never finishes does not hold other requests forever. The request's own routing
 and execution do not count either. A configured or per-invocation timeout also
-limits waiting for a running build that the request could not join; the built-in
-default does not. With the default, a build that arrives while a compatible build is
-already running waits for it to finish and then runs, instead of failing after 30
-seconds. `--no-wait` fails wherever the request would wait. On a timeout, the client
-exits with code 1 and suggests `--wait-timeout`. It does not suggest exporting
-`RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, because Rush versions that do not recognize a
-`RUSH_` environment variable fail every command while it is set.
+limits waiting for a running build that the request could not join, and waiting for
+the requests that the daemon is serving to finish before it restarts for the
+request's environment. The built-in default does not: with it, a build that arrives
+while a compatible build is already running waits for it to finish and then runs,
+instead of failing after 30 seconds, and a request that needs a restart waits for
+the requests that were running when it arrived to finish and then runs on the
+restarted daemon. The default still limits a restart wait while the daemon runs a
+`rushx` script, such as a dev server, which may not exit until it is stopped, and
+while it serves requests that arrived later. `--no-wait` fails wherever the request
+would wait. On a timeout, the client exits with code 1 and suggests
+`--wait-timeout`. It does not suggest exporting `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`,
+because Rush versions that do not recognize a `RUSH_` environment variable fail
+every command while it is set.
 
 Admission controls also apply to experimental graph requests, but not
 `start|stop|restart|status|logs`. They affect daemon admission only; native fallback
@@ -109,15 +115,34 @@ agent mode writes nothing ahead of it. Otherwise, selection precedence is:
 
 Agent mode is plain text for humans and agents, not the AI reporter's JSON record format;
 use `--reporter=ai` for machine-parsed records. It writes a first status line before
-`@microsoft/rush-lib` is loaded, then at most three live rows on a TTY (append-only lines
-throttled to one per 2 seconds on a pipe), the queue position when waiting for admission,
-and always one final summary line (`rush build: SUCCESS 12/12 operations (...) in 3.1s`, or
-`up to date (no operations needed)`). Warnings and errors that Rush or a Rush plugin writes
-outside any operation (for example a plugin that continues without the cloud build cache)
-precede the summary line, at most three lines of them. On failure, it lists failed operations and a
-bounded tail (10 lines) of their stderr, or of their stdout when they wrote no stderr.
-Operation logs are otherwise not printed; use `RUSHD_OUTPUT=legacy` for full logs. When
-a request falls back to in-process Rush, agent mode stops and native output follows.
+`@microsoft/rush-lib` is loaded, then at most three live rows on a TTY. On a pipe it writes
+at most three progress lines in total, however many operations run and however long they
+take: a wait for a daemon that is still starting (`rushd is still starting; waiting for it (up to 15s more)`),
+the start, the first wait for admission (`queued behind another request (position N)`),
+the start of execution, and the first failure, in that order until three were written. It
+always ends with one summary line, for example
+`rush build: SUCCESS 772/772 operations (12 success, 760 from cache) in 3.1s`, or
+`up to date (no operations needed)`, or, when the selection parameters matched no projects,
+`rush build: SUCCESS 0 operations in 0.5s · the selection parameters did not match any projects`.
+The counts follow the native summary: silent operations
+(such as phases a project does not define) are not counted unless they fail, and operations
+that did not need to run (`SKIPPED` or `NO OP` in native output) are counted as `up to date`. The verdict is
+`SUCCESS`, `FAILURE` or `CANCELLED` (Ctrl+C or a termination signal); a request that a daemon
+shutdown aborted is a `FAILURE` whose summary line gives the reason, with exit code 1. When the
+daemon did not admit the request in time, or at once with `--no-wait`, the reason on the summary
+line starts with `daemon admission failed (wait-timeout)` or `daemon admission failed (no-wait)`,
+as in legacy output, followed by the daemon's reason in full. Warnings and errors that Rush or a
+Rush plugin writes outside any operation (for example a plugin that continues without the cloud
+build cache) precede the summary line, and any failure report, at most three lines of them.
+
+When the request fails, a report comes before the summary line. It covers up to three failed
+operations, or, if none failed, the operations whose warnings failed the request. Each one gets a
+`failed: <operation> · full log: <path>` line (`warnings: …` for warnings) and a short excerpt
+of its output: error lines with the line that follows them first, then the last lines. Stack
+frames, `Require stack:` lists and progress noise are left out. The summary line names up to five
+failed (or warning) operations. Every operation's full output is in its project's `rush-logs/`
+folder, whether or not it was printed. When a request falls back to in-process Rush, agent mode
+stops and native output follows.
 
 Positively identified built-in `install` and `update` follow the same opt-in routing
 precedence as workspace builds and require protocol **0.10**
@@ -245,7 +270,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `enabled` | `RUSH_DAEMON` | false | Client routing |
 | `autoStart` | `RUSH_DAEMON_AUTO_START` | true | Only after opt-in |
 | `idleTimeoutSeconds` | `RUSH_DAEMON_IDLE_TIMEOUT_SECONDS` | 900 | Host idle shutdown after request/output/cleanup drain |
-| `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. Time behind another request's graph load (up to 10 times the limit) and the request's own work do not count. The default does not limit waiting behind a running compatible build; an explicit value does |
+| `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. Time behind another request's graph load (up to 10 times the limit) and the request's own work do not count. The default does not limit waiting behind a running compatible build, or, for a daemon restart, behind requests that were already running (while no `rushx` script is running); an explicit value does |
 | `watch` | `RUSH_DAEMON_WATCH` | false | Persistent host observation of requested warm projects; false keeps root/config guards only. Never schedules builds |
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
diff --git a/apps/rush-cli-client/src/AgentOperationTracker.ts b/apps/rush-cli-client/src/AgentOperationTracker.ts
new file mode 100644
index 0000000000..e2381da3b4
--- /dev/null
+++ b/apps/rush-cli-client/src/AgentOperationTracker.ts
@@ -0,0 +1,246 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it (through AgentProgressRenderer) before
+// @microsoft/rush-lib.
+
+import { OperationOutputExcerpt } from './OperationOutputExcerpt';
+
+const FAILURE: string = 'FAILURE';
+const SUCCESS_WITH_WARNINGS: string = 'SUCCESS WITH WARNINGS';
+const EXECUTING: string = 'EXECUTING';
+
+/** The order in which status counts are listed in the summary: problems first. */
+const STATUS_ORDER: ReadonlyArray<string> = [
+  FAILURE,
+  'BLOCKED',
+  'ABORTED',
+  SUCCESS_WITH_WARNINGS,
+  'SUCCESS',
+  'FROM CACHE',
+  'SKIPPED',
+  'NO OP'
+];
+const TERMINAL_STATUSES: ReadonlySet<string> = new Set(STATUS_ORDER);
+
+export interface IAgentOperationStatusUpdate {
+  readonly operationId: string;
+  readonly status: string;
+  /** The operation's full log file, when the daemon reports one (failures and warnings). */
+  readonly logFilePath?: string;
+}
+
+/** An operation's final status, as reported in the daemon's result. */
+export interface IAgentOperationResult {
+  readonly operationId: string;
+  readonly status: string;
+  readonly errorMessage?: string;
+}
+
+/** An operation that explains a failed request, with the excerpt and log file to print for it. */
+export interface IAgentProblemOperation {
+  readonly operationId: string;
+  readonly logFilePath: string | undefined;
+  readonly excerpt: OperationOutputExcerpt | undefined;
+  /** The engine's error for the operation, when the daemon's result reported one. */
+  readonly errorMessage: string | undefined;
+}
+
+/**
+ * Tracks one request's operations for agent output: progress counters, running and failed operations,
+ * and short output excerpts for the operations that can explain a failure.
+ *
+ * @remarks
+ * Silent operations (for example phases that a project does not define) are registered but are not part of
+ * the progress totals, matching the native `x of y` operation headers; only a silent failure is counted.
+ * Counters follow status transitions, so an operation that is reset and runs again is counted once.
+ * Output that belongs to no registered operation (a global command's byte stream) is kept as one excerpt.
+ */
+export class AgentOperationTracker {
+  readonly #registered: Set<string> = new Set();
+  readonly #silent: Set<string> = new Set();
+  readonly #statuses: Map<string, string> = new Map();
+  readonly #running: Set<string> = new Set();
+  readonly #counts: Map<string, number> = new Map();
+  readonly #failed: Set<string> = new Set();
+  readonly #warned: Set<string> = new Set();
+  readonly #excerpts: Map<string, OperationOutputExcerpt> = new Map();
+  readonly #logFilePaths: Map<string, string> = new Map();
+  readonly #errorMessages: Map<string, string> = new Map();
+  readonly #globalExcerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+  #headerTotal: number = 0;
+  #done: number = 0;
+
+  /** The number of non-silent operations that reached a terminal status. */
+  public get done(): number {
+    return this.#done;
+  }
+
+  /** The number of non-silent operations in the request, once known. */
+  public get total(): number {
+    return Math.max(this.#headerTotal, this.#registered.size);
+  }
+
+  /** Operations currently executing, oldest first. */
+  public get running(): ReadonlyArray<string> {
+    return [...this.#running];
+  }
+
+  /** Failed operations, in the order they failed. */
+  public get failed(): ReadonlyArray<string> {
+    return [...this.#failed];
+  }
+
+  /** Operations that succeeded with warnings, in the order they finished. */
+  public get warned(): ReadonlyArray<string> {
+    return [...this.#warned];
+  }
+
+  /** Whether any output arrived that belongs to no operation (for example a global command's output). */
+  public get hasGlobalOutput(): boolean {
+    return this.#globalExcerpt.lineCount > 0;
+  }
+
+  /** Whether the daemon announced any operation for the request, including silent ones. */
+  public get hasOperations(): boolean {
+    return this.#registered.size > 0 || this.#silent.size > 0;
+  }
+
+  public get globalExcerpt(): OperationOutputExcerpt {
+    return this.#globalExcerpt;
+  }
+
+  /** Status counts in summary order, for example `[['FAILURE', 1], ['BLOCKED', 3]]`. */
+  public getCounts(): ReadonlyArray<[string, number]> {
+    return STATUS_ORDER.filter((status) => (this.#counts.get(status) ?? 0) > 0).map((status) => [
+      status,
+      this.#counts.get(status) ?? 0
+    ]);
+  }
+
+  public register(operationId: string, silent: boolean): void {
+    if (silent && !this.#registered.has(operationId)) {
+      this.#silent.add(operationId);
+    } else if (!silent) {
+      this.#silent.delete(operationId);
+      this.#registered.add(operationId);
+    }
+  }
+
+  /** Records the engine's per-request operation total (from the operation header extension). */
+  public setHeaderTotal(total: number): void {
+    this.#headerTotal = Math.max(this.#headerTotal, total);
+  }
+
+  /** Applies a status change. Returns true when it is the request's first failure. */
+  public updateStatus(update: IAgentOperationStatusUpdate): boolean {
+    const { operationId, status } = update;
+    if (this.#silent.has(operationId)) {
+      if (status !== FAILURE) {
+        return false;
+      }
+      // Failed operations are reported even if silent, as in the native summary.
+      this.register(operationId, false);
+    }
+    // An operation that was never registered still counts, so `done` never exceeds `total`.
+    this.#registered.add(operationId);
+    const firstFailure: boolean = status === FAILURE && this.#failed.size === 0;
+    const previous: string | undefined = this.#statuses.get(operationId);
+    this.#statuses.set(operationId, status);
+    if (previous !== undefined && TERMINAL_STATUSES.has(previous)) {
+      this.#done--;
+      this.#counts.set(previous, (this.#counts.get(previous) ?? 1) - 1);
+      this.#failed.delete(operationId);
+      this.#warned.delete(operationId);
+    }
+    if (status === EXECUTING) {
+      this.#running.add(operationId);
+    } else {
+      this.#running.delete(operationId);
+    }
+    if (TERMINAL_STATUSES.has(status)) {
+      this.#onTerminalStatus(update);
+    }
+    return firstFailure;
+  }
+
+  /**
+   * Applies the daemon's final operation results to operations whose final status this client did not see,
+   * for example an operation still executing when the daemon shut down, which the result reports as aborted.
+   *
+   * @remarks
+   * The results also list silent operations without saying so, so an operation that no event announced is
+   * only added when it failed.
+   */
+  public reconcile(results: ReadonlyArray<IAgentOperationResult>): void {
+    for (const { operationId, status, errorMessage } of results) {
+      const current: string | undefined = this.#statuses.get(operationId);
+      const known: boolean = this.#registered.has(operationId) || this.#silent.has(operationId);
+      if (
+        TERMINAL_STATUSES.has(status) &&
+        (known || status === FAILURE) &&
+        (current === undefined || !TERMINAL_STATUSES.has(current))
+      ) {
+        this.updateStatus({ operationId, status });
+      }
+      if (errorMessage && this.#statuses.get(operationId) === FAILURE) {
+        this.#errorMessages.set(operationId, errorMessage);
+      }
+    }
+  }
+
+  /** Records output. Output of operations that already succeeded without warnings is discarded. */
+  public appendLog(operationId: string, text: string, stream: 'stdout' | 'stderr'): void {
+    if (this.#silent.has(operationId)) {
+      return;
+    }
+    const status: string | undefined = this.#statuses.get(operationId);
+    if (status === undefined && !this.#registered.has(operationId)) {
+      this.#globalExcerpt.append(text, stream);
+      return;
+    }
+    if (status !== undefined && TERMINAL_STATUSES.has(status) && !this.#isProblemStatus(status)) {
+      return;
+    }
+    let excerpt: OperationOutputExcerpt | undefined = this.#excerpts.get(operationId);
+    if (!excerpt) {
+      excerpt = new OperationOutputExcerpt();
+      this.#excerpts.set(operationId, excerpt);
+    }
+    excerpt.append(text, stream);
+  }
+
+  /**
+   * The operations that explain a failed request: failed operations, or, when none failed, operations that
+   * reported warnings (warnings fail a build unless the command allows them).
+   */
+  public getProblemOperations(): ReadonlyArray<IAgentProblemOperation> {
+    const operationIds: ReadonlyArray<string> = this.#failed.size ? this.failed : this.warned;
+    return operationIds.map((operationId) => ({
+      operationId,
+      logFilePath: this.#logFilePaths.get(operationId),
+      excerpt: this.#excerpts.get(operationId),
+      errorMessage: this.#errorMessages.get(operationId)
+    }));
+  }
+
+  #isProblemStatus(status: string): boolean {
+    return status === FAILURE || status === SUCCESS_WITH_WARNINGS;
+  }
+
+  #onTerminalStatus(update: IAgentOperationStatusUpdate): void {
+    const { operationId, status, logFilePath } = update;
+    this.#done++;
+    this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
+    if (!this.#isProblemStatus(status)) {
+      this.#excerpts.delete(operationId);
+      return;
+    }
+    // Record unterminated last lines now, so a kept excerpt holds no partial-line buffer.
+    this.#excerpts.get(operationId)?.flush();
+    (status === FAILURE ? this.#failed : this.#warned).add(operationId);
+    if (logFilePath) {
+      this.#logFilePaths.set(operationId, logFilePath);
+    }
+  }
+}
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 87e8a41d97..6195aac9f9 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -4,25 +4,56 @@
 // Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib
 // so that the first line can be written within a few milliseconds.
 
-import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type { DaemonRequestAdmissionErrorCode, IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
 
 import { AgentNotices } from './AgentNotices';
+import {
+  AgentOperationTracker,
+  type IAgentOperationResult,
+  type IAgentProblemOperation
+} from './AgentOperationTracker';
+import { clipLine } from './OperationOutputExcerpt';
 
 const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-const TERMINAL_STATUSES: ReadonlySet<string> = new Set([
-  'SUCCESS',
-  'SUCCESS WITH WARNINGS',
-  'SKIPPED',
-  'FROM CACHE',
-  'FAILURE',
-  'BLOCKED',
-  'NO OP',
-  'ABORTED'
-]);
-const MAX_ERROR_LINES: number = 10;
-const PIPE_MIN_INTERVAL_MS: number = 2000;
-const PIPE_HEARTBEAT_MS: number = 10000;
+/** On a pipe, the most milestone lines written before the summary, however long the request runs. */
+const MAX_PIPE_PROGRESS_LINES: number = 3;
+/** On a pipe, how long the first line waits for the connection, so that a fast connect costs one line, not two. */
+const PIPE_FIRST_LINE_DELAY_MS: number = 1000;
+/**
+ * On a pipe, a status line is written whenever nothing was written for this long, so that a reader can tell a slow
+ * request from a hung one. Agent shells return partial output after 30 s. These lines are not milestones.
+ */
+const PIPE_STATUS_INTERVAL_MS: number = 25_000;
+const SENT_PHASE: string = 'sent to rushd; preparing the workspace graph';
+const STARTING_PHASE: string = 'rushd is still starting; waiting for it';
 const TTY_INTERVAL_MS: number = 100;
+/** The most failed (or warning) operations whose output excerpt is printed. */
+const MAX_REPORTED_OPERATIONS: number = 3;
+/** Excerpt lines for the first reported operation, which is most often the root cause. */
+const FIRST_OPERATION_EXCERPT_LINES: number = 8;
+const OTHER_OPERATION_EXCERPT_LINES: number = 3;
+const GLOBAL_OUTPUT_EXCERPT_LINES: number = 8;
+/** The most operation names listed in the summary line, and in a live row. */
+const MAX_SUMMARY_NAMES: number = 5;
+const MAX_LIVE_NAMES: number = 3;
+const MAX_MESSAGE_LENGTH: number = 300;
+/**
+ * Lines of a multi-line error message printed after its first line: the first and last lines of the rest, since a
+ * message that ends with the error after the diagnostics written before it can be thousands of lines long.
+ */
+const ERROR_DETAIL_HEAD_LINES: number = 2;
+const ERROR_DETAIL_TAIL_LINES: number = 5;
+/**
+ * Summary labels that differ from the native status name. A daemon reports an operation that is unchanged since
+ * it last ran as `NO OP` (when no operation in the iteration had to run) or as `SKIPPED`; both mean up to date.
+ */
+const STATUS_LABELS: ReadonlyMap<string, string> = new Map([
+  ['SKIPPED', 'up to date'],
+  ['NO OP', 'up to date']
+]);
+
+type PipeMilestone = 'starting' | 'sent' | 'queued' | 'running' | 'failure';
+type Verdict = 'SUCCESS' | 'FAILURE' | 'CANCELLED';
 
 export interface IAgentProgressRendererOptions {
   readonly commandName: string;
@@ -33,38 +64,68 @@ export interface IAgentProgressRendererOptions {
   readonly startTimeMs?: number;
 }
 
-interface IAgentFinalResult {
+export interface IAgentFinalResult {
   readonly exitCode: number;
   readonly errorMessage?: string;
+  /** Whether the command was cancelled (for example with Ctrl+C); reported as `CANCELLED`, not `FAILURE`. */
+  readonly cancelled?: boolean;
+  /** The daemon's final operation results, which may report statuses that no event carried. */
+  readonly operationResults?: ReadonlyArray<IAgentOperationResult>;
+  /** Why the daemon did not admit the request, if it did not. */
+  readonly admissionErrorCode?: DaemonRequestAdmissionErrorCode;
+}
+
+function formatNames(names: ReadonlyArray<string>, maxNames: number): string {
+  const shown: string = names.slice(0, maxNames).join(', ');
+  return names.length > maxNames ? `${shown} +${names.length - maxNames} more` : shown;
+}
+
+function getErrorDetail(lines: ReadonlyArray<string>): string[] {
+  const omitted: number = lines.length - ERROR_DETAIL_HEAD_LINES - ERROR_DETAIL_TAIL_LINES;
+  if (omitted <= 1) {
+    return [...lines];
+  }
+  return [
+    ...lines.slice(0, ERROR_DETAIL_HEAD_LINES),
+    `… ${omitted} more lines …`,
+    ...lines.slice(-ERROR_DETAIL_TAIL_LINES)
+  ];
 }
 
 /**
- * Compact progress for agents on the daemon path: an immediate first line, at most
- * three live rows (TTY) or throttled append-only lines (pipes), and a guaranteed
- * bounded final summary line, even when no operation ran.
+ * Compact progress for agents on the daemon path: an immediate first line, at most three live rows (TTY) or
+ * at most three progress lines in total (pipes), and a guaranteed one-line summary, even when no
+ * operation ran. On failure, the summary is preceded by each failed operation's log file and a short
+ * excerpt of its output.
+ *
+ * @remarks
+ * On a pipe, a line is written at a milestone: when the client waits for a daemon that is still starting, when the
+ * request is sent to the daemon, the first time it waits for admission, the start of execution, and the first
+ * failure; once three lines were written, later milestones are left to the summary. A connection that takes
+ * longer than a second gets a line of its own first, unless a milestone came first. Whenever
+ * nothing was written for 25 s, a status line with the counts and the running operations follows, so a reader
+ * never sees more than 25 s of silence, and a request shorter than that costs no status lines at all.
  */
 export class AgentProgressRenderer {
   readonly #options: IAgentProgressRendererOptions;
   readonly #now: () => number;
   readonly #startTimeMs: number;
-  readonly #registered: Set<string> = new Set();
-  readonly #statuses: Map<string, string> = new Map();
-  readonly #running: Set<string> = new Set();
-  readonly #counts: Map<string, number> = new Map();
-  readonly #failed: string[] = [];
-  readonly #stderrTails: Map<string, string[]> = new Map();
-  readonly #stdoutTails: Map<string, string[]> = new Map();
+  readonly #tracker: AgentOperationTracker = new AgentOperationTracker();
+  readonly #milestones: Set<PipeMilestone> = new Set();
   readonly #notices: AgentNotices = new AgentNotices();
-  #total: number = 0;
-  #done: number = 0;
   #lastActivity: string = '';
   #phase: string = 'connecting to rushd (auto-starts if needed)';
   #painted: number = 0;
   #frame: number = 0;
-  #lastLineKey: string = '';
-  #lastLineAtMs: number = -Infinity;
+  #pipeLines: number = 0;
   #timer: ReturnType<typeof setInterval> | undefined;
+  #firstLineTimer: ReturnType<typeof setTimeout> | undefined;
+  #statusTimer: ReturnType<typeof setTimeout> | undefined;
+  /** The last queue position and when it was reported, until operations start. */
+  #queued: { readonly position: number; readonly elapsed: string } | undefined;
   #stopped: boolean = false;
+  /** The error message that the summary line contains in full, once written. */
+  #reportedErrorMessage: string | undefined;
 
   public constructor(options: IAgentProgressRendererOptions) {
     this.#options = options;
@@ -72,13 +133,19 @@ export class AgentProgressRenderer {
     this.#startTimeMs = options.startTimeMs ?? this.#now();
   }
 
-  /** Writes the first line and starts the spinner / heartbeat. */
+  /**
+   * On a TTY, paints the first line and starts the spinner. On a pipe, writes the first line after a second
+   * unless another line came first, and starts the status lines.
+   */
   public start(): void {
-    this.#render(true);
-    this.#timer = setInterval(
-      () => this.#render(false),
-      this.#options.isTTY ? TTY_INTERVAL_MS : PIPE_MIN_INTERVAL_MS
-    );
+    if (!this.#options.isTTY) {
+      this.#firstLineTimer = setTimeout(() => this.#writePipeLine(this.#rows()[0]), PIPE_FIRST_LINE_DELAY_MS);
+      this.#firstLineTimer.unref?.();
+      this.#scheduleStatusLine();
+      return;
+    }
+    this.#paint();
+    this.#timer = setInterval(() => this.#paint(), TTY_INTERVAL_MS);
     this.#timer.unref?.();
   }
 
@@ -87,45 +154,46 @@ export class AgentProgressRenderer {
       return;
     }
     this.#phase = phase;
-    this.#render(true);
+    if (this.#options.isTTY) {
+      this.#paint();
+    }
+  }
+
+  /**
+   * The daemon is not ready yet, but a live process can still make it ready, so the client waits up to `waitMs`
+   * more for it instead of running Rush in-process. On a pipe, says so once.
+   */
+  public onAwaitStartup(waitMs: number): void {
+    this.setPhase(STARTING_PHASE);
+    this.#writeMilestone('starting', ` (up to ${Math.round(waitMs / 1000)}s more)`);
+  }
+
+  /** The daemon has the request. On a pipe, says so, and that the next line can take a while. */
+  public onRequestSent(): void {
+    this.setPhase(SENT_PHASE);
+    this.#writeMilestone('sent', ` (status at least every ${PIPE_STATUS_INTERVAL_MS / 1000}s)`);
   }
 
   public onQueuePosition(position: number): void {
+    this.#queued = { position, elapsed: this.#elapsed() };
     this.setPhase(`queued behind another request (position ${position})`);
+    this.#writeMilestone('queued');
   }
 
   public onEvent(event: IDaemonEventEnvelope): void {
+    if (this.#stopped) {
+      return;
+    }
     const payload: Record<string, unknown> = (event.payload ?? {}) as Record<string, unknown>;
     switch (event.type) {
       case 'operationRegistered': {
-        if (!payload.silent && typeof payload.operationId === 'string') {
-          this.#registered.add(payload.operationId);
+        if (typeof payload.operationId === 'string') {
+          this.#tracker.register(payload.operationId, !!payload.silent);
         }
         break;
       }
       case 'operationStatusChanged': {
-        const operationId: unknown = payload.operationId;
-        const status: unknown = payload.status;
-        if (typeof operationId !== 'string' || typeof status !== 'string') {
-          break;
-        }
-        this.#phase = 'running';
-        const previous: string | undefined = this.#statuses.get(operationId);
-        this.#statuses.set(operationId, status);
-        if (status === 'EXECUTING') {
-          this.#running.add(operationId);
-        }
-        if (TERMINAL_STATUSES.has(status) && (previous === undefined || !TERMINAL_STATUSES.has(previous))) {
-          this.#running.delete(operationId);
-          this.#done++;
-          this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
-          if (status === 'FAILURE') {
-            this.#failed.push(operationId);
-          } else {
-            this.#stdoutTails.delete(operationId);
-            this.#stderrTails.delete(operationId);
-          }
-        }
+        this.#onStatusChanged(payload);
         break;
       }
       case 'extension': {
@@ -133,7 +201,7 @@ export class AgentProgressRenderer {
           | { totalOperations?: unknown }
           | undefined;
         if (data && typeof data.totalOperations === 'number') {
-          this.#total = Math.max(this.#total, data.totalOperations);
+          this.#tracker.setHeaderTotal(data.totalOperations);
         }
         break;
       }
@@ -141,41 +209,20 @@ export class AgentProgressRenderer {
         this.#notices.add(payload, event.scope?.operationId);
         if (typeof payload.text === 'string' && payload.text.trim()) {
           this.#lastActivity = payload.text.trim().split('\n')[0];
-          if (this.#phase !== 'running') {
-            this.#phase = 'running';
-          }
+          this.#phase = 'running';
+          this.#queued = undefined;
         }
         break;
       }
     }
-    this.#render(false);
   }
 
   /**
-   * Keeps bounded per-operation stderr and stdout tails (the last lines of each). They are only
-   * printed for failed operations; stdout is used when an operation reported its diagnostics
-   * there (tsc, eslint, jest) and wrote nothing to stderr.
+   * Keeps short excerpts of operation output. They are only printed for operations that explain a failed
+   * request (failed operations, or operations with warnings when warnings failed the request).
    */
   public onLog(bytes: Uint8Array, operationId: string, stream: 'stdout' | 'stderr'): void {
-    const status: string | undefined = this.#statuses.get(operationId);
-    if (status !== undefined && TERMINAL_STATUSES.has(status) && status !== 'FAILURE') {
-      return;
-    }
-    const tails: Map<string, string[]> = stream === 'stderr' ? this.#stderrTails : this.#stdoutTails;
-    for (const line of Buffer.from(bytes).toString('utf8').split('\n')) {
-      if (!line.trim()) {
-        continue;
-      }
-      let tail: string[] | undefined = tails.get(operationId);
-      if (!tail) {
-        tail = [];
-        tails.set(operationId, tail);
-      }
-      tail.push(line.trim());
-      if (tail.length > MAX_ERROR_LINES) {
-        tail.shift();
-      }
-    }
+    this.#tracker.appendLog(operationId, Buffer.from(bytes).toString('utf8'), stream);
   }
 
   /** Stops rendering without a summary (e.g. the request is handed to in-process Rush). */
@@ -184,47 +231,137 @@ export class AgentProgressRenderer {
   }
 
   /**
-   * Stops the live region and writes the final summary line, at most once. Warnings and errors that Rush or a
-   * plugin wrote outside any operation precede it.
+   * Stops the live region and writes the failure report (on failure) and the final summary line, at most once.
+   * Warnings and errors that Rush or a plugin wrote outside any operation precede them. The summary line carries
+   * the first line of the error message; the further lines of a multi-line message precede it, at most eight,
+   * with the middle ones elided. Returns true when the error message was reported, now or by an earlier call, so
+   * callers need not repeat it: only a single line too long for the summary line is not, unless it gives the
+   * reason for an admission failure, which is never clipped.
    */
-  public finish(result: IAgentFinalResult | undefined): void {
+  public finish(result: IAgentFinalResult | undefined): boolean {
+    const errorMessage: string | undefined = result?.errorMessage?.trim();
     if (!this.#stop()) {
-      return;
+      return errorMessage !== undefined && errorMessage === this.#reportedErrorMessage;
     }
     for (const notice of this.#notices.getLines()) {
       this.#options.write(`${notice}\n`);
     }
-    const succeeded: boolean = result !== undefined && result.exitCode === 0;
-    const total: number = this.#getTotal();
-    const parts: string[] = [...this.#counts].map(([status, count]) => `${count} ${status.toLowerCase()}`);
-    const scope: string =
-      total === 0 && succeeded
-        ? 'up to date (no operations needed)'
-        : `${this.#done}/${total} operations${parts.length ? ` (${parts.join(', ')})` : ''}`;
-    let line: string = `rush ${this.#options.commandName}: ${succeeded ? 'SUCCESS' : 'FAILURE'} ${scope} in ${this.#elapsed()}`;
-    if (this.#failed.length) {
-      line += ` · failed: ${this.#failed.join(', ')}`;
+    if (result?.operationResults) {
+      this.#tracker.reconcile(result.operationResults);
     }
-    if (result?.errorMessage) {
-      line += ` · ${result.errorMessage}`;
-    }
-    this.#options.write(`${line}\n`);
-    if (!succeeded) {
-      for (const errorLine of this.#getFailureLines().slice(0, MAX_ERROR_LINES)) {
-        this.#options.write(`  ${errorLine}\n`);
+    const verdict: Verdict = result?.cancelled
+      ? 'CANCELLED'
+      : result !== undefined && result.exitCode === 0
+        ? 'SUCCESS'
+        : 'FAILURE';
+    const lines: string[] = verdict === 'SUCCESS' ? [] : this.#getFailureReport(verdict);
+    // A phased result without operations, for which the daemon announced none, had an empty selection.
+    const emptySelection: boolean =
+      verdict === 'SUCCESS' && result?.operationResults?.length === 0 && !this.#tracker.hasOperations;
+    let summary: string = this.#getSummaryLine(verdict, emptySelection);
+    if (errorMessage) {
+      const [firstLine, ...detail] = errorMessage.split('\n').filter((line) => line.trim());
+      const admissionErrorCode: string | undefined =
+        verdict === 'FAILURE' &&
+        (result?.admissionErrorCode === 'no-wait' || result?.admissionErrorCode === 'wait-timeout')
+          ? result.admissionErrorCode
+          : undefined;
+      // Keep the string that legacy output prints for a busy workspace, which guidance tells agents to look for.
+      const prefix: string = admissionErrorCode ? `daemon admission failed (${admissionErrorCode}): ` : '';
+      // The daemon's reason for an admission failure says what the request waited for and what to do instead, and
+      // the caller has no better text for it, so it is never clipped.
+      const summaryMessage: string = admissionErrorCode ? firstLine : clipLine(firstLine, MAX_MESSAGE_LENGTH);
+      summary += ` · ${prefix}${summaryMessage}`;
+      if (detail.length) {
+        lines.push(...getErrorDetail(detail).map((line) => `  ${clipLine(line, MAX_MESSAGE_LENGTH)}`));
       }
+      if (detail.length || summaryMessage === firstLine) {
+        this.#reportedErrorMessage = errorMessage;
+      }
+    }
+    lines.push(summary);
+    this.#options.write(lines.map((line) => `${line}\n`).join(''));
+    return this.#reportedErrorMessage !== undefined;
+  }
+
+  #onStatusChanged(payload: Record<string, unknown>): void {
+    const { operationId, status, logFilePath } = payload;
+    if (typeof operationId !== 'string' || typeof status !== 'string') {
+      return;
+    }
+    const firstFailure: boolean = this.#tracker.updateStatus({
+      operationId,
+      status,
+      logFilePath: typeof logFilePath === 'string' ? logFilePath : undefined
+    });
+    this.#phase = 'running';
+    this.#queued = undefined;
+    this.#writeMilestone('running');
+    if (firstFailure) {
+      this.#writeMilestone('failure', ` · first failure: ${operationId}`);
+    }
+  }
+
+  #getSummaryLine(verdict: Verdict, emptySelection: boolean): string {
+    const tracker: AgentOperationTracker = this.#tracker;
+    const { total, done } = tracker;
+    const countsByLabel: Map<string, number> = new Map();
+    for (const [status, count] of tracker.getCounts()) {
+      const label: string = STATUS_LABELS.get(status) ?? status.toLowerCase();
+      countsByLabel.set(label, (countsByLabel.get(label) ?? 0) + count);
+    }
+    const counts: string[] = [...countsByLabel].map(([label, count]) => `${count} ${label}`);
+    const matchedNothing: boolean = total === 0 && done === 0 && emptySelection && !tracker.hasGlobalOutput;
+    let scope: string = '';
+    if (total > 0 || done > 0) {
+      scope = ` ${done}/${total} operations${counts.length ? ` (${counts.join(', ')})` : ''}`;
+    } else if (matchedNothing) {
+      scope = ' 0 operations';
+    } else if (verdict === 'SUCCESS' && !tracker.hasGlobalOutput) {
+      scope = ' up to date (no operations needed)';
+    }
+    let line: string = `rush ${this.#options.commandName}: ${verdict}${scope} in ${this.#elapsed()}`;
+    if (tracker.failed.length) {
+      line += ` · failed: ${formatNames(tracker.failed, MAX_SUMMARY_NAMES)}`;
+    } else if (verdict === 'FAILURE' && tracker.warned.length) {
+      line += ` · warnings: ${formatNames(tracker.warned, MAX_SUMMARY_NAMES)}`;
+    } else if (matchedNothing) {
+      // Worded like native Rush's "The command line selection parameters did not match any projects."
+      line += ' · the selection parameters did not match any projects';
     }
+    return line;
   }
 
-  /** Failed operations' tails, or every operation's stderr tail when no operation failed. */
-  #getFailureLines(): string[] {
-    const operationIds: Iterable<string> = this.#failed.length ? this.#failed : this.#stderrTails.keys();
+  /**
+   * Each failed operation's log file and output excerpt. Without failed operations: operations with warnings
+   * (they fail a build unless the command allows warnings), or else output that belongs to no operation. A
+   * cancelled command reports only failed operations.
+   */
+  #getFailureReport(verdict: Verdict): string[] {
+    const tracker: AgentOperationTracker = this.#tracker;
+    if (verdict === 'CANCELLED' && !tracker.failed.length) {
+      return [];
+    }
+    const problems: ReadonlyArray<IAgentProblemOperation> = tracker.getProblemOperations();
+    if (!problems.length) {
+      return tracker.globalExcerpt.getExcerpt(GLOBAL_OUTPUT_EXCERPT_LINES).map((line) => `  ${line}`);
+    }
+    const label: string = tracker.failed.length ? 'failed' : 'warnings';
     const lines: string[] = [];
-    for (const operationId of operationIds) {
-      const tail: string[] = this.#stderrTails.get(operationId) ?? this.#stdoutTails.get(operationId) ?? [];
-      for (const line of tail) {
-        lines.push(`${operationId}: ${line}`);
+    for (const [index, problem] of problems.slice(0, MAX_REPORTED_OPERATIONS).entries()) {
+      const logFile: string = problem.logFilePath ? ` · full log: ${problem.logFilePath}` : '';
+      lines.push(`${label}: ${problem.operationId}${logFile}`);
+      const maxLines: number = index === 0 ? FIRST_OPERATION_EXCERPT_LINES : OTHER_OPERATION_EXCERPT_LINES;
+      const excerpt: string[] = problem.excerpt?.getExcerpt(maxLines) ?? [];
+      if (!excerpt.length && problem.errorMessage) {
+        excerpt.push(clipLine(problem.errorMessage.trim().split('\n')[0], MAX_MESSAGE_LENGTH));
       }
+      lines.push(...(excerpt.length ? excerpt : ['(no output)']).map((line) => `  ${line}`));
+    }
+    const hidden: number = problems.length - MAX_REPORTED_OPERATIONS;
+    if (hidden > 0) {
+      const what: string = label === 'failed' ? 'failed operations' : 'operations with warnings';
+      lines.push(`+${hidden} more ${what}; their logs are in each project's rush-logs folder`);
     }
     return lines;
   }
@@ -235,6 +372,9 @@ export class AgentProgressRenderer {
       return false;
     }
     this.#stopped = true;
+    for (const timer of [this.#firstLineTimer, this.#statusTimer]) {
+      clearTimeout(timer);
+    }
     if (this.#timer) {
       clearInterval(this.#timer);
       this.#timer = undefined;
@@ -243,50 +383,86 @@ export class AgentProgressRenderer {
     return true;
   }
 
-  #getTotal(): number {
-    return Math.max(this.#total, this.#registered.size, this.#done);
-  }
-
   #elapsed(): string {
     return `${((this.#now() - this.#startTimeMs) / 1000).toFixed(1)}s`;
   }
 
   #rows(): [string, string, string] {
-    const total: number = this.#getTotal();
-    const running: string[] = [...this.#running];
-    const shown: string =
-      running.slice(0, 3).join(', ') + (running.length > 3 ? ` +${running.length - 3} more` : '');
-    const counter: string = total ? ` ${this.#done}/${total}` : '';
+    const { total, done, running, failed } = this.#tracker;
+    const counter: string = total ? ` ${done}/${total}` : '';
     return [
       `rush ${this.#options.commandName}${counter} · ${this.#elapsed()} · ${this.#phase}`,
-      running.length ? `running: ${shown}` : '',
-      this.#lastActivity
+      running.length ? `running: ${formatNames(running, MAX_LIVE_NAMES)}` : '',
+      failed.length ? `failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : this.#lastActivity
     ];
   }
 
-  #render(force: boolean): void {
-    if (this.#stopped) {
+  #writeMilestone(milestone: PipeMilestone, suffix: string = ''): void {
+    if (this.#options.isTTY || this.#stopped || this.#milestones.has(milestone)) {
       return;
     }
-    const rows: [string, string, string] = this.#rows();
-    if (this.#options.isTTY) {
-      const width: number = Math.max(20, this.#options.columns || 80) - 1;
-      const clip = (row: string): string => (row.length > width ? `${row.slice(0, width - 1)}…` : row);
-      const frame: string = SPINNER_FRAMES[this.#frame++ % SPINNER_FRAMES.length];
-      const text: string = [`${frame} ${rows[0]}`, rows[1], rows[2]].map(clip).join('\n');
-      this.#options.write(`${this.#painted ? `\x1b[${this.#painted}A\x1b[0J` : '\x1b[?25l'}${text}\n`);
-      this.#painted = 3;
-      return;
+    this.#milestones.add(milestone);
+    this.#writePipeLine(`${this.#rows()[0]}${suffix}`);
+  }
+
+  #writePipeLine(line: string): void {
+    if (this.#pipeLines < MAX_PIPE_PROGRESS_LINES) {
+      this.#pipeLines++;
+      this.#writeStatus(line);
+    }
+  }
+
+  /** Writes a line on a pipe; the first line and the next status line are then due later. */
+  #writeStatus(line: string): void {
+    clearTimeout(this.#firstLineTimer);
+    this.#firstLineTimer = undefined;
+    this.#options.write(`${line}\n`);
+    if (this.#statusTimer) {
+      this.#scheduleStatusLine();
+    }
+  }
+
+  #scheduleStatusLine(): void {
+    clearTimeout(this.#statusTimer);
+    this.#statusTimer = setTimeout(() => {
+      if (!this.#stopped) {
+        this.#writeStatus(this.#getStatusLine());
+      }
+    }, PIPE_STATUS_INTERVAL_MS);
+    this.#statusTimer.unref?.();
+  }
+
+  /**
+   * A pipe status line: the counts, then the running operations, or else what the request waits for. The daemon
+   * does not report admission, so after a queue position this says when the position was reported instead of
+   * claiming that the request is still queued.
+   */
+  #getStatusLine(): string {
+    const { total, done, running, failed } = this.#tracker;
+    let activity: string = this.#phase;
+    if (running.length) {
+      activity = `running: ${formatNames(running, MAX_LIVE_NAMES)}`;
+    } else if (this.#queued) {
+      activity =
+        `waiting for admission or the workspace graph ` +
+        `(queue position ${this.#queued.position} at ${this.#queued.elapsed})`;
     }
-    const key: string = `${this.#phase}|${this.#done}`;
-    const nowMs: number = this.#now();
-    const sinceLast: number = nowMs - this.#lastLineAtMs;
-    if (!force && (sinceLast < PIPE_MIN_INTERVAL_MS || (key === this.#lastLineKey && sinceLast < PIPE_HEARTBEAT_MS))) {
+    const failures: string = failed.length ? ` · failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : '';
+    const counter: string = total ? ` ${done}/${total}` : '';
+    return `rush ${this.#options.commandName}${counter} · ${this.#elapsed()} · ${activity}${failures}`;
+  }
+
+  #paint(): void {
+    if (this.#stopped) {
       return;
     }
-    this.#lastLineKey = key;
-    this.#lastLineAtMs = nowMs;
-    this.#options.write(`${rows[0]}${rows[1] ? ` · ${rows[1]}` : ''}\n`);
+    const rows: [string, string, string] = this.#rows();
+    const width: number = Math.max(20, this.#options.columns || 80) - 1;
+    const clip = (row: string): string => (row.length > width ? `${row.slice(0, width - 1)}…` : row);
+    const frame: string = SPINNER_FRAMES[this.#frame++ % SPINNER_FRAMES.length];
+    const text: string = [`${frame} ${rows[0]}`, rows[1], rows[2]].map(clip).join('\n');
+    this.#options.write(`${this.#painted ? `\x1b[${this.#painted}A\x1b[0J` : '\x1b[?25l'}${text}\n`);
+    this.#painted = 3;
   }
 
   #clear(): void {
diff --git a/apps/rush-cli-client/src/OperationOutputExcerpt.ts b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
new file mode 100644
index 0000000000..98671349c3
--- /dev/null
+++ b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
@@ -0,0 +1,224 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it (through AgentProgressRenderer) before
+// @microsoft/rush-lib.
+
+const ESC: string = String.fromCharCode(27);
+const BEL: string = String.fromCharCode(7);
+/** Matches ANSI CSI sequences (colors, cursor movement) and OSC sequences (hyperlinks, titles). */
+const ANSI_ESCAPE_PATTERN: RegExp = new RegExp(
+  `${ESC}(?:\\[[0-?]*[ -/]*[@-~]|\\][^${BEL}${ESC}]*(?:${BEL}|${ESC}\\\\))`,
+  'g'
+);
+/** A Heft task prefix such as `[build:typescript]`, followed by the line's content. */
+const TASK_PREFIX_PATTERN: RegExp = /^(\[[^\]\s]+\])\s*(.*)$/;
+/**
+ * Lines that carry no diagnostic value in a short excerpt: JavaScript stack frames, `Require stack:` and its
+ * module paths, code frames (`> 113 | code`, `    |   ^`), decorative banners (`---- build finished ----`),
+ * and the lines Rush itself writes into every operation's output (the command it invokes and the build cache
+ * status). A failed operation is always a cache miss, and "not found" would otherwise make that line look
+ * like an error.
+ */
+const NOISE_PATTERNS: ReadonlyArray<RegExp> = [
+  /^at\s.*(?::\d+(?::\d+)?\)?|\((?:index \d+|native|<anonymous>)\))$/,
+  /^Require stack:$/,
+  /^-\s+(?:\/|[A-Za-z]:[\\/]|\\\\)\S*$/,
+  /^(?:>\s*)?\d*\s*\|/,
+  /^[-=]{3,}(?:\s.*\s[-=]{3,})?$/,
+  /^Invoking(?: \((?:initial|incremental)\))?: /,
+  /^(?:This project was not found in the build cache|Build cache hit|Successfully set cache entry)\.$/,
+  /^Caching build output folders: /
+];
+const ERROR_PATTERN: RegExp =
+  /\b(?:errors?|exception|fatal|failed|failure|FAIL|cannot|could not|unable to|not found|TS\d{4,5})\b|\bERR(?:!|_[A-Z0-9_]+)|[●✖✕]/i;
+const NO_ERRORS_PATTERN: RegExp = /\b(?:0|no) errors?\b/i;
+/** Lines without any letter (bare exit codes, progress percentages, caret markers) explain nothing. */
+const LETTER_PATTERN: RegExp = /\p{L}/u;
+
+/** Lines longer than this keep their start and end, joined by an ellipsis. */
+const MAX_LINE_LENGTH: number = 300;
+const CLIPPED_LINE_TAIL_LENGTH: number = 80;
+/** Raw lines are clipped to this length before they are classified, so huge lines cost little. */
+const MAX_RAW_LINE_LENGTH: number = 4096;
+/** A partial line longer than this (for example a progress bar without newlines) is recorded as a line. */
+const MAX_PARTIAL_LINE_LENGTH: number = 65536;
+const HEAD_LINES: number = 8;
+const TAIL_LINES: number = 3;
+const ERROR_LINES: number = 8;
+/** Excerpt rows reserved for the last lines, which usually contain a tool's own error summary. */
+const TAIL_RESERVE: number = 2;
+
+type OutputStream = 'stdout' | 'stderr';
+
+interface IExcerptLine {
+  /** The arrival order across both streams, used to print the excerpt in output order. */
+  readonly index: number;
+  readonly text: string;
+}
+
+interface IErrorLine extends IExcerptLine {
+  /** The line that followed this error line, which often continues its message. */
+  context?: IExcerptLine;
+}
+
+interface IStreamLines {
+  readonly head: IExcerptLine[];
+  readonly tail: IExcerptLine[];
+  partial: string;
+}
+
+/**
+ * Normalizes one line of operation output for an excerpt: removes ANSI escapes and carriage-return overwrites,
+ * and collapses whitespace after a Heft task prefix. Returns undefined for lines that are empty or noise.
+ */
+export function normalizeExcerptLine(rawLine: string): string | undefined {
+  let line: string = clipLine(rawLine, MAX_RAW_LINE_LENGTH);
+  if (line.includes(ESC)) {
+    line = line.replace(ANSI_ESCAPE_PATTERN, '');
+  }
+  if (line.endsWith('\r')) {
+    line = line.slice(0, -1);
+  }
+  line = line.slice(line.lastIndexOf('\r') + 1).trim();
+  const prefixMatch: RegExpMatchArray | null = TASK_PREFIX_PATTERN.exec(line);
+  const content: string = prefixMatch ? prefixMatch[2].trim() : line;
+  if (!LETTER_PATTERN.test(content) || NOISE_PATTERNS.some((pattern) => pattern.test(content))) {
+    return undefined;
+  }
+  return clipLine(prefixMatch ? `${prefixMatch[1]} ${content}` : content, MAX_LINE_LENGTH);
+}
+
+/** Returns whether a normalized line looks like an error message. */
+export function isErrorLine(line: string): boolean {
+  return ERROR_PATTERN.test(line) && !NO_ERRORS_PATTERN.test(line);
+}
+
+/** Shortens a line to at most `maxLength` characters, keeping its start and its end. */
+export function clipLine(line: string, maxLength: number): string {
+  if (line.length <= maxLength) {
+    return line;
+  }
+  const tailLength: number = Math.min(CLIPPED_LINE_TAIL_LENGTH, Math.floor(maxLength / 3));
+  return `${line.slice(0, maxLength - tailLength - 1)}…${line.slice(line.length - tailLength)}`;
+}
+
+/**
+ * Keeps a short excerpt of one operation's output, to explain a failure in a few lines.
+ *
+ * @remarks
+ * Memory use does not grow with the output: only the first and last lines of each stream are kept, plus the
+ * first distinct error-looking lines of either stream, each with the next line of the same stream. The
+ * excerpt prefers error lines, then the end of the output (where tools print their error summary), then its
+ * beginning. Like the native `StdioSummarizer`, head and tail lines come from stderr when the operation wrote
+ * any, otherwise from stdout; error lines come from both, because tools such as tsc and eslint report errors
+ * on stdout. Stack frames, `Require stack:` paths and code frames are dropped, so they cannot crowd out the
+ * cause.
+ */
+export class OperationOutputExcerpt {
+  readonly #streams: Record<OutputStream, IStreamLines> = {
+    stdout: { head: [], tail: [], partial: '' },
+    stderr: { head: [], tail: [], partial: '' }
+  };
+  readonly #errors: IErrorLine[] = [];
+  readonly #errorTexts: Set<string> = new Set();
+  /**
+   * Per stream, the error line whose context is the stream's next line. The streams are separate pipes, so the
+   * next line of the other stream is unrelated to the error.
+   */
+  readonly #pendingContext: Record<OutputStream, IErrorLine | undefined> = {
+    stdout: undefined,
+    stderr: undefined
+  };
+  #lineCount: number = 0;
+
+  /** The number of non-empty, non-noise lines seen so far. */
+  public get lineCount(): number {
+    return this.#lineCount;
+  }
+
+  /** Records a chunk of output; a line split across chunks is joined. */
+  public append(text: string, stream: OutputStream): void {
+    const lines: IStreamLines = this.#streams[stream];
+    const pieces: string[] = (lines.partial + text).split('\n');
+    lines.partial = pieces.pop() ?? '';
+    if (lines.partial.length > MAX_PARTIAL_LINE_LENGTH) {
+      pieces.push(lines.partial);
+      lines.partial = '';
+    }
+    for (const piece of pieces) {
+      this.#addLine(piece, stream);
+    }
+  }
+
+  /** Records any unterminated last lines. Further output is still accepted. */
+  public flush(): void {
+    for (const stream of ['stdout', 'stderr'] as const) {
+      const lines: IStreamLines = this.#streams[stream];
+      if (lines.partial) {
+        const partial: string = lines.partial;
+        lines.partial = '';
+        this.#addLine(partial, stream);
+      }
+    }
+  }
+
+  /** Returns at most `maxLines` lines that best explain the output, in output order. */
+  public getExcerpt(maxLines: number): string[] {
+    this.flush();
+    const preferred: IStreamLines = this.#streams.stderr.head.length
+      ? this.#streams.stderr
+      : this.#streams.stdout;
+    const chosen: Map<number, IExcerptLine> = new Map();
+    const texts: Set<string> = new Set();
+    const add = (line: IExcerptLine | undefined, limit: number): void => {
+      if (line && chosen.size < limit && !chosen.has(line.index) && !texts.has(line.text)) {
+        chosen.set(line.index, line);
+        texts.add(line.text);
+      }
+    };
+    const errorLimit: number = Math.max(1, maxLines - TAIL_RESERVE);
+    for (const errorLine of this.#errors) {
+      add(errorLine, errorLimit);
+      add(errorLine.context, errorLimit);
+    }
+    // Newest first, so the last line (often the tool's own error summary) is always kept.
+    for (let i: number = preferred.tail.length - 1; i >= 0; i--) {
+      add(preferred.tail[i], maxLines);
+    }
+    for (const errorLine of this.#errors) {
+      add(errorLine, maxLines);
+    }
+    for (const line of preferred.head) {
+      add(line, maxLines);
+    }
+    return [...chosen.values()].sort((a, b) => a.index - b.index).map((line) => line.text);
+  }
+
+  #addLine(rawLine: string, stream: OutputStream): void {
+    const text: string | undefined = normalizeExcerptLine(rawLine);
+    if (text === undefined) {
+      return;
+    }
+    const line: IExcerptLine = { index: this.#lineCount++, text };
+    const lines: IStreamLines = this.#streams[stream];
+    if (lines.head.length < HEAD_LINES) {
+      lines.head.push(line);
+    }
+    lines.tail.push(line);
+    if (lines.tail.length > TAIL_LINES) {
+      lines.tail.shift();
+    }
+    const pendingContext: IErrorLine | undefined = this.#pendingContext[stream];
+    if (pendingContext) {
+      pendingContext.context = line;
+      this.#pendingContext[stream] = undefined;
+    }
+    if (this.#errors.length < ERROR_LINES && !this.#errorTexts.has(text) && isErrorLine(text)) {
+      const errorLine: IErrorLine = { ...line };
+      this.#errors.push(errorLine);
+      this.#errorTexts.add(text);
+      this.#pendingContext[stream] = errorLine;
+    }
+  }
+}
diff --git a/apps/rush-cli-client/src/clientCancellation.ts b/apps/rush-cli-client/src/clientCancellation.ts
index 4c60a964eb..f3a2102bff 100644
--- a/apps/rush-cli-client/src/clientCancellation.ts
+++ b/apps/rush-cli-client/src/clientCancellation.ts
@@ -25,15 +25,19 @@ export function formatCancellationMessage(commandName: string): string {
 
 /**
  * Returns whether a daemon outcome represents a cancelled command. A result is cancelled when the daemon reports it
- * as aborted, even if an operation failure determines its semantic outcome. A completed (non-aborted) result wins
- * over a late signal, and a rejection is never reported as a cancellation.
+ * as aborted, even if an operation failure determines its semantic outcome, unless the daemon aborted it for its own
+ * reason (such as a daemon shutdown), which the result's error message carries and a signal did not cause. A
+ * completed (non-aborted) result wins over a late signal. A rejection is only a cancellation when the client was
+ * signalled and the daemon could not route the request: that is how the daemon answers a request cancelled before
+ * engine initialization. A rejection of the request itself (for example an invalid or unsupported request) is
+ * always reported.
  */
 export function isCancelledOutcome(outcome: DaemonClientOutcome, signalled: boolean): boolean {
   switch (outcome.kind) {
     case 'result':
-      return outcome.result.aborted;
+      return outcome.result.aborted && (signalled || !outcome.result.errorMessage);
     case 'rejected':
-      return false;
+      return signalled && outcome.rejection.code === 'routingFailed';
     default:
       return signalled;
   }
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 00cd328d1e..7ff5cd2572 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -36,6 +36,7 @@ import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultDiagnostic } from './resultDiagnostics';
+import { getTerminalColumns } from './terminalColumns';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
   getBundledRushVersion,
@@ -112,7 +113,7 @@ export async function launchClientAsync(
     terminal: {
       isTTY: !!process.stdout.isTTY,
       supportsColor: terminal.supportsColor,
-      columns: process.stdout.columns,
+      columns: getTerminalColumns(process.stdout),
       acceptsStdin: true
     },
     admission:
@@ -147,7 +148,7 @@ export async function launchClientAsync(
       ...connection,
       onAwaitStartup: (owner: string, waitMs: number): void => {
         if (agentRenderer) {
-          agentRenderer.setPhase('rushd is still starting; waiting for it');
+          agentRenderer.onAwaitStartup(waitMs);
           return;
         }
         const seconds: number = Math.round(waitMs / 1000);
@@ -182,7 +183,7 @@ export async function launchClientAsync(
     verbosity,
     terminal: {
       get columns() {
-        return process.stdout.columns ?? 80;
+        return getTerminalColumns(process.stdout) ?? 80;
       },
       get isTTY() {
         return !!process.stdout.isTTY;
@@ -205,7 +206,7 @@ export async function launchClientAsync(
       );
     }
     await renderer.initializeAsync();
-    agentRenderer?.setPhase('request submitted; preparing the workspace graph');
+    agentRenderer?.onRequestSent();
     outcome = await executeWithDaemonRestartAsync(client, connection, {
       request,
       abortSignal: abort.signal,
@@ -254,17 +255,24 @@ export async function launchClientAsync(
   }
   if (outcome === undefined || isCancelledOutcome(outcome, abort.signal.aborted)) {
     const exitCode: number = getSignalExitCode(cancellationSignal ?? 'SIGINT');
-    agentRenderer?.finish({ exitCode, errorMessage: 'cancelled' });
+    agentRenderer?.finish(
+      outcome?.kind === 'result'
+        ? { ...outcome.result, exitCode, cancelled: true }
+        : { exitCode, cancelled: true }
+    );
     process.exitCode = exitCode;
     // After SIGHUP the terminal may be gone; the exit code is what matters.
     await writeStreamAsync(process.stderr, Buffer.from(formatCancellationMessage(route.commandName))).catch(
       () => undefined
     );
   } else if (outcome.kind === 'result') {
-    agentRenderer?.finish(outcome.result);
+    // In agent mode the summary line may already carry the complete error message; do not repeat it.
+    const reportedByAgent: boolean = agentRenderer?.finish(outcome.result) ?? false;
     process.exitCode = outcome.result.exitCode;
     const diagnostic: string | undefined = getResultDiagnostic(outcome.result);
-    if (diagnostic) {
+    if (reportedByAgent) {
+      // The summary line already explains the failure.
+    } else if (diagnostic) {
       await writeStreamAsync(process.stderr, Buffer.from(diagnostic));
     } else if (outcome.result.admissionErrorCode) {
       await writeStreamAsync(
@@ -273,8 +281,9 @@ export async function launchClientAsync(
       );
     }
   } else if (outcome.kind === 'rejected') {
-    agentRenderer?.finish({ exitCode: 1, errorMessage: `daemon rejected the request (${outcome.rejection.code})` });
-    throw new Error(`Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`);
+    const message: string = `Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`;
+    agentRenderer?.finish({ exitCode: 1, errorMessage: message });
+    throw new Error(message);
   } else {
     agentRenderer?.dispose();
     process.stderr.write(`rush-client: ${outcome.message ?? outcome.reason}; using in-process Rush.\n`);
diff --git a/apps/rush-cli-client/src/outputSelection.ts b/apps/rush-cli-client/src/outputSelection.ts
index cc5bce489c..5378bdf1d8 100644
--- a/apps/rush-cli-client/src/outputSelection.ts
+++ b/apps/rush-cli-client/src/outputSelection.ts
@@ -14,6 +14,10 @@ export const RUSHD_OUTPUT_ENV_VAR: 'RUSHD_OUTPUT' = 'RUSHD_OUTPUT';
  * `detectAgent()` in `@rushstack/reporter` (libraries/reporter/src/config/AgentDetection.ts).
  */
 const AGENT_MARKERS: readonly string[] = ['COPILOT_CLI'];
+
+/** Every environment variable that `selectClientOutputMode()` reads to choose between agent and legacy output. */
+export const CLIENT_OUTPUT_SELECTION_ENV_VARS: readonly string[] = [RUSHD_OUTPUT_ENV_VAR, ...AGENT_MARKERS];
+
 const INACTIVE_VALUES: ReadonlySet<string> = new Set(['', '0', 'false', 'no', 'off']);
 const NATIVE_REPORTER_FLAGS: readonly string[] = ['--reporter', '--output', '--log-level'];
 
diff --git a/apps/rush-cli-client/src/start.ts b/apps/rush-cli-client/src/start.ts
index 989adb4e9f..ca87ecc13d 100644
--- a/apps/rush-cli-client/src/start.ts
+++ b/apps/rush-cli-client/src/start.ts
@@ -23,7 +23,8 @@ const agentRenderer: AgentProgressRenderer | undefined =
   commandName !== undefined
     ? new AgentProgressRenderer({
         commandName,
-        isTTY: !!process.stdout.isTTY && process.env.TERM !== 'dumb',
+        // A pty without a size (e.g. `script` run without a terminal) cannot be repainted; treat it as a pipe.
+        isTTY: !!process.stdout.isTTY && process.env.TERM !== 'dumb' && !!process.stdout.columns,
         columns: process.stdout.columns || 80,
         write: (text: string) => process.stdout.write(text),
         startTimeMs
@@ -34,7 +35,9 @@ agentRenderer?.start();
 const { launchClientAsync } = require('./launchClient') as typeof import('./launchClient');
 
 launchClientAsync(false, agentRenderer).catch((error: Error) => {
-  agentRenderer?.finish({ exitCode: 1, errorMessage: error.message });
-  process.stderr.write(`rush-client: ${error.message}\n`);
+  // In agent mode the summary line may already carry the complete message; do not repeat it.
+  if (!agentRenderer?.finish({ exitCode: 1, errorMessage: error.message })) {
+    process.stderr.write(`rush-client: ${error.message}\n`);
+  }
   process.exitCode = 1;
 });
diff --git a/apps/rush-cli-client/src/terminalColumns.ts b/apps/rush-cli-client/src/terminalColumns.ts
new file mode 100644
index 0000000000..9ab79e6b1a
--- /dev/null
+++ b/apps/rush-cli-client/src/terminalColumns.ts
@@ -0,0 +1,12 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Returns the stream's terminal width, or undefined when it has none. A pseudo-terminal that was never sized
+ * (for example `script` started from a non-terminal) reports 0 columns, which the daemon rejects as request
+ * metadata; treat it like a stream without a width.
+ */
+export function getTerminalColumns(stream: { readonly columns?: number }): number | undefined {
+  const { columns } = stream;
+  return columns !== undefined && Number.isSafeInteger(columns) && columns > 0 ? columns : undefined;
+}
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 6a23fc2c5c..3fdee47959 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -26,45 +26,84 @@ function event(type: DaemonEventType, payload: unknown): IDaemonEventEnvelope {
 
 const ANSI_ESCAPE: RegExp = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`, 'g');
 
-function createRenderer(isTTY: boolean): { renderer: AgentProgressRenderer; output: string[]; clock: { ms: number } } {
+interface ITestRenderer {
+  renderer: AgentProgressRenderer;
+  output: string[];
+  clock: { ms: number };
+  /** All output, split into lines. */
+  lines(): string[];
+}
+
+function createRenderer(isTTY: boolean, commandName: string = 'build'): ITestRenderer {
   const output: string[] = [];
   const clock: { ms: number } = { ms: 0 };
   const renderer: AgentProgressRenderer = new AgentProgressRenderer({
-    commandName: 'build',
+    commandName,
     isTTY,
     columns: 60,
     write: (text: string) => output.push(text),
     now: () => clock.ms,
     startTimeMs: 0
   });
-  return { renderer, output, clock };
+  return { renderer, output, clock, lines: () => output.join('').split('\n').slice(0, -1) };
+}
+
+function registered(operationId: string, silent: boolean = false): IDaemonEventEnvelope {
+  return event('operationRegistered', { operationId, silent });
+}
+
+function status(operationId: string, value: string, logFilePath?: string): IDaemonEventEnvelope {
+  return event('operationStatusChanged', {
+    operationId,
+    previousStatus: 'READY',
+    status: value,
+    logFilePath
+  });
+}
+
+function header(
+  operationId: string,
+  completedOperations: number,
+  totalOperations: number
+): IDaemonEventEnvelope {
+  return event('extension', {
+    name: 'rushd.operation-header',
+    data: { operationId, completedOperations, totalOperations }
+  });
 }
 
-function status(operationId: string, value: string): IDaemonEventEnvelope {
-  return event('operationStatusChanged', { operationId, previousStatus: 'READY', status: value });
+function fail(renderer: AgentProgressRenderer, operationId: string, errorLines: ReadonlyArray<string>): void {
+  renderer.onEvent(status(operationId, 'EXECUTING'));
+  renderer.onLog(Buffer.from(errorLines.map((line) => `${line}\n`).join('')), operationId, 'stderr');
+  renderer.onEvent(status(operationId, 'FAILURE', `/repo/${operationId.split(' ')[0]}/rush-logs/x.log`));
 }
 
 describe(AgentProgressRenderer.name, () => {
-  it('writes a first line immediately and a bounded summary for a successful build (pipe)', () => {
-    const { renderer, output, clock } = createRenderer(false);
+  it('writes one line when the request is sent, then milestones and a summary for a successful build (pipe)', () => {
+    const { renderer, output, clock, lines } = createRenderer(false);
     renderer.start();
-    expect(output).toEqual(['rush build · 0.0s · connecting to rushd (auto-starts if needed)\n']);
-    renderer.onEvent(event('operationRegistered', { operationId: 'a (build)', silent: false }));
-    renderer.onEvent(event('operationRegistered', { operationId: 'b (build)', silent: false }));
-    renderer.onEvent(event('operationRegistered', { operationId: 'hidden', silent: true }));
+    expect(output).toEqual([]);
+    renderer.onRequestSent();
+    expect(output).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)\n'
+    ]);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('b (build)'));
+    renderer.onEvent(registered('hidden', true));
     renderer.onEvent(status('a (build)', 'EXECUTING'));
     renderer.onLog(Buffer.from('noise\n'), 'a (build)', 'stdout');
     clock.ms = 2500;
     renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onEvent(status('hidden', 'SUCCESS'));
     renderer.onEvent(status('b (build)', 'SKIPPED'));
     clock.ms = 3000;
-    renderer.finish({ exitCode: 0 });
+    expect(renderer.finish({ exitCode: 0 })).toBe(false);
     renderer.dispose();
-    expect(output.join('')).not.toContain('noise');
-    expect(output[output.length - 1]).toBe(
-      'rush build: SUCCESS 2/2 operations (1 success, 1 skipped) in 3.0s\n'
-    );
-    expect(output.length).toBeLessThanOrEqual(4);
+    expect(lines()).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+      'rush build 0/2 · 0.0s · running',
+      'rush build: SUCCESS 2/2 operations (1 success, 1 up to date) in 3.0s'
+    ]);
   });
 
   it('reports an up-to-date request instead of printing nothing', () => {
@@ -73,68 +112,278 @@ describe(AgentProgressRenderer.name, () => {
     expect(output).toEqual(['rush build: SUCCESS up to date (no operations needed) in 0.0s\n']);
   });
 
-  it('lists failed operations and a bounded stderr tail on failure', () => {
-    const { renderer, output } = createRenderer(false);
-    renderer.onEvent(status('p05 (build)', 'EXECUTING'));
-    for (let i = 0; i < 20; i++) {
-      renderer.onLog(Buffer.from(`error ${i}\n`), 'p05 (build)', 'stderr');
-    }
-    renderer.onEvent(status('p05 (build)', 'FAILURE'));
+  it('tells an empty selection apart from a request whose operations were all up to date (#634)', () => {
+    const hot: ITestRenderer = createRenderer(false);
+    // The daemon announces retained operations as silent and reports their retained results.
+    hot.renderer.onEvent(registered('a (build)', true));
+    hot.renderer.onEvent(registered('b (build)', true));
+    hot.renderer.finish({
+      exitCode: 0,
+      operationResults: [
+        { operationId: 'a (build)', status: 'SUCCESS' },
+        { operationId: 'b (build)', status: 'FROM CACHE' }
+      ]
+    });
+    expect(hot.output).toEqual(['rush build: SUCCESS up to date (no operations needed) in 0.0s\n']);
+
+    const empty: ITestRenderer = createRenderer(false);
+    empty.renderer.finish({ exitCode: 0, operationResults: [] });
+    expect(empty.output).toEqual([
+      'rush build: SUCCESS 0 operations in 0.0s · the selection parameters did not match any projects\n'
+    ]);
+  });
+
+  it('reports a failed operation with its log file and an excerpt, before the summary line', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(
+      renderer,
+      'p05 (build)',
+      Array.from({ length: 20 }, (unused, i) => `error ${i}`)
+    );
     renderer.onEvent(status('p06 (build)', 'BLOCKED'));
     renderer.finish({ exitCode: 1 });
-    const text: string = output.join('');
-    expect(text).toContain('rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: p05 (build)\n');
-    expect(text).toContain('  p05 (build): error 10\n');
-    expect(text).toContain('  p05 (build): error 19\n');
-    expect(text).not.toContain('error 9\n');
+    expect(lines()).toEqual([
+      'rush build 0/1 · 0.0s · running',
+      'rush build 1/1 · 0.0s · running · first failure: p05 (build)',
+      'failed: p05 (build) · full log: /repo/p05/rush-logs/x.log',
+      '  error 0',
+      '  error 1',
+      '  error 2',
+      '  error 3',
+      '  error 4',
+      '  error 5',
+      '  error 18',
+      '  error 19',
+      'rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: p05 (build)'
+    ]);
   });
 
   it('keeps failure diagnostics when successful operations wrote stderr first', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onEvent(status('noisy (build)', 'EXECUTING'));
-    for (let i = 0; i < 20; i++) {
+    for (let i: number = 0; i < 20; i++) {
       renderer.onLog(Buffer.from(`warning ${i}\n`), 'noisy (build)', 'stderr');
     }
     renderer.onEvent(status('noisy (build)', 'SUCCESS WITH WARNINGS'));
-    renderer.onEvent(status('broken (build)', 'EXECUTING'));
-    renderer.onLog(Buffer.from('the real error\n'), 'broken (build)', 'stderr');
-    renderer.onEvent(status('broken (build)', 'FAILURE'));
+    fail(renderer, 'broken (build)', ['the real error']);
     renderer.finish({ exitCode: 1 });
     const text: string = output.join('');
-    expect(text).toContain('  broken (build): the real error\n');
-    expect(text).not.toContain('noisy (build): warning');
+    expect(text).toContain(
+      'failed: broken (build) · full log: /repo/broken/rush-logs/x.log\n  the real error\n'
+    );
+    expect(text).not.toContain('warning 1');
+    expect(text).toMatch(/· failed: broken \(build\)\n$/);
+  });
+
+  it('reports unchanged operations as up to date, whether the daemon says SKIPPED or NO OP', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(status('a (build)', 'NO OP'));
+    renderer.onEvent(status('b (build)', 'SKIPPED'));
+    renderer.onEvent(status('c (build)', 'FROM CACHE'));
+    renderer.finish({ exitCode: 0 });
+    expect(output[output.length - 1]).toBe(
+      'rush build: SUCCESS 3/3 operations (1 from cache, 2 up to date) in 0.0s\n'
+    );
   });
 
   it('counts ABORTED operations as finished', () => {
     const { renderer, output } = createRenderer(false);
-    renderer.onEvent(event('operationRegistered', { operationId: 'a (build)', silent: false }));
+    renderer.onEvent(registered('a (build)'));
     renderer.onEvent(status('a (build)', 'EXECUTING'));
     renderer.onEvent(status('a (build)', 'ABORTED'));
     renderer.finish({ exitCode: 1 });
     expect(output[output.length - 1]).toBe('rush build: FAILURE 1/1 operations (1 aborted) in 0.0s\n');
   });
 
+  it('reports a cancelled command as CANCELLED, without the output of the interrupted operations', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('b (build)'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('error: interrupted by SIGINT\n'), 'a (build)', 'stderr');
+    renderer.finish({
+      exitCode: 130,
+      cancelled: true,
+      operationResults: [
+        { operationId: 'a (build)', status: 'ABORTED' },
+        { operationId: 'b (build)', status: 'ABORTED' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'rush build 0/2 · 0.0s · running',
+      'rush build: CANCELLED 2/2 operations (2 aborted) in 0.0s'
+    ]);
+  });
+
+  it('still reports the failures of a cancelled command', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(renderer, 'a (build)', ['src/a.ts(1,1): error TS2322: bad']);
+    renderer.finish({ exitCode: 130, cancelled: true });
+    expect(lines().slice(-3)).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  src/a.ts(1,1): error TS2322: bad',
+      'rush build: CANCELLED 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it('applies final statuses from the daemon result that no event reported', () => {
+    const { renderer, lines } = createRenderer(false);
+    const reason: string =
+      'The Rush daemon was shut down (idle timeout) while this request was running; re-run the command.';
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('b (build)'));
+    renderer.onEvent(registered('silent (build)', true));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onEvent(status('b (build)', 'EXECUTING'));
+    const reported: boolean = renderer.finish({
+      exitCode: 1,
+      errorMessage: reason,
+      operationResults: [
+        { operationId: 'a (build)', status: 'SUCCESS' },
+        { operationId: 'b (build)', status: 'ABORTED' },
+        { operationId: 'silent (build)', status: 'ABORTED' },
+        // The result lists silent operations too; one that no event announced is not counted.
+        { operationId: 'unannounced (build)', status: 'NO OP' }
+      ]
+    });
+    expect(reported).toBe(true);
+    expect(lines().slice(-1)).toEqual([
+      `rush build: FAILURE 2/2 operations (1 aborted, 1 success) in 0.0s · ${reason}`
+    ]);
+  });
+
+  it("prints a failed operation's error from the daemon result when the operation wrote no output", () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [{ operationId: 'a (build)', status: 'FAILURE', errorMessage: 'spawn heft ENOENT' }]
+    });
+    expect(lines().slice(-3)).toEqual([
+      'failed: a (build)',
+      '  spawn heft ENOENT',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it('tells a repeated finish whether its error message was already reported in full', () => {
+    const { renderer, output } = createRenderer(false);
+    const message: string = 'Daemon rejected the request (routingFailed): Another Rush command is running.';
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(true);
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(true);
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'another message' })).toBe(false);
+    expect(output).toEqual([`rush build: FAILURE in 0.0s · ${message}\n`]);
+  });
+
+  it('keeps the legacy "daemon admission failed (<code>)" string in the summary line (#785)', () => {
+    const timeout: ITestRenderer = createRenderer(false);
+    const message: string =
+      'The request was not admitted within 30000ms while waiting for workspace admission. ' +
+      'Use --wait-timeout <seconds> or RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS to wait longer.';
+    expect(
+      timeout.renderer.finish({ exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: message })
+    ).toBe(true);
+    expect(timeout.output).toEqual([
+      `rush build: FAILURE in 0.0s · daemon admission failed (wait-timeout): ${message}\n`
+    ]);
+
+    const noWait: ITestRenderer = createRenderer(false);
+    noWait.renderer.finish({
+      exitCode: 1,
+      admissionErrorCode: 'no-wait',
+      errorMessage: 'The workspace is busy.'
+    });
+    expect(noWait.output).toEqual([
+      'rush build: FAILURE in 0.0s · daemon admission failed (no-wait): The workspace is busy.\n'
+    ]);
+
+    // A request aborted while it waited, for example by a daemon shutdown, is not a busy workspace.
+    const aborted: ITestRenderer = createRenderer(false);
+    aborted.renderer.finish({
+      exitCode: 1,
+      admissionErrorCode: 'aborted',
+      errorMessage: 'The Rush daemon was shut down.'
+    });
+    expect(aborted.output).toEqual(['rush build: FAILURE in 0.0s · The Rush daemon was shut down.\n']);
+  });
+
+  it('writes the reason for an admission failure in full however long it is, so the caller adds nothing', () => {
+    // A restart drain that timed out behind a rushx script after it waived time: 350 characters.
+    const message: string =
+      'The request was not admitted before the daemon could restart for its environment, which waits for the ' +
+      'requests that the daemon is serving to finish, including a rushx script that may not exit until it is ' +
+      'stopped; 61.8s spent waiting for requests that were already running did not count. Stop the script, ' +
+      'or use --wait-timeout <seconds> to wait longer.';
+    expect(message.length).toBeGreaterThan(300);
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: message })).toBe(
+      true
+    );
+    expect(output).toEqual([
+      `rush build: FAILURE in 0.0s · daemon admission failed (wait-timeout): ${message}\n`
+    ]);
+  });
+
+  it('clips any other single-line error message that is too long, and leaves it to the caller', () => {
+    const message: string = `Rush failed: ${'x'.repeat(400)} (end)`;
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(false);
+    expect(output).toHaveLength(1);
+    expect(output[0]).toMatch(/^rush build: FAILURE in 0\.0s · Rush failed: x+…x+ \(end\)\n$/);
+    expect(output[0].length).toBeLessThan(message.length);
+  });
+
   it('writes the final line at most once and nothing after it', () => {
     const { renderer, output } = createRenderer(false);
-    renderer.finish({ exitCode: 1, errorMessage: 'daemon rejected the request (x)' });
-    renderer.finish({ exitCode: 1, errorMessage: 'again' });
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'daemon rejected the request (x)' })).toBe(true);
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'again' })).toBe(false);
     renderer.onQueuePosition(3);
+    renderer.onEvent(status('a (build)', 'FAILURE'));
     renderer.dispose();
-    expect(output).toEqual(['rush build: FAILURE 0/0 operations in 0.0s · daemon rejected the request (x)\n']);
+    expect(output).toEqual(['rush build: FAILURE in 0.0s · daemon rejected the request (x)\n']);
   });
 
-  it('does not repeat an unchanged queue position', () => {
+  it('writes the further lines of a multi-line error message before the summary line', () => {
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, errorMessage: 'first line\n\nsecond line\n' })).toBe(true);
+    expect(output).toEqual(['  second line\nrush build: FAILURE in 0.0s · first line\n']);
+  });
+
+  it('elides the middle of an error message with thousands of lines and keeps its last lines', () => {
+    const { renderer, output } = createRenderer(false);
+    const diagnostics: string[] = Array.from({ length: 1745 }, (unused, index) => `debug line ${index}`);
+    const message: string = [
+      'Daemon rejected the request (invalidRequest): Incremental strategy: cache restoration',
+      ...diagnostics,
+      'The project name "@x/nope" passed to "--to" does not exist in rush.json.',
+      'An error occurred.'
+    ].join('\n');
+    expect(renderer.finish({ exitCode: 1, errorMessage: message })).toBe(true);
+    expect(output.join('').split('\n')).toEqual([
+      '  debug line 0',
+      '  debug line 1',
+      '  … 1740 more lines …',
+      '  debug line 1742',
+      '  debug line 1743',
+      '  debug line 1744',
+      '  The project name "@x/nope" passed to "--to" does not exist in rush.json.',
+      '  An error occurred.',
+      'rush build: FAILURE in 0.0s · Daemon rejected the request (invalidRequest): Incremental strategy: cache restoration',
+      ''
+    ]);
+  });
+
+  it('writes the queue milestone once, however often the position changes', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onQueuePosition(2);
     renderer.onQueuePosition(2);
-    renderer.onQueuePosition(2);
-    expect(output).toHaveLength(1);
     renderer.onQueuePosition(1);
-    expect(output).toHaveLength(2);
+    expect(output).toEqual(['rush build · 0.0s · queued behind another request (position 2)\n']);
     renderer.dispose();
   });
 
-  it('shows the stdout tail of a failed operation that reported errors on stdout', () => {
+  it('shows the excerpt of a failed operation that reported errors on stdout', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onEvent(status('ok (build)', 'EXECUTING'));
     renderer.onLog(Buffer.from('ok noise\n'), 'ok (build)', 'stdout');
@@ -144,10 +393,21 @@ describe(AgentProgressRenderer.name, () => {
     renderer.onEvent(status('tsc (build)', 'FAILURE'));
     renderer.finish({ exitCode: 1 });
     const text: string = output.join('');
-    expect(text).toContain('  tsc (build): src/x.ts(1,1): error TS1005: stdout-error\n');
+    expect(text).toContain('failed: tsc (build)\n  src/x.ts(1,1): error TS1005: stdout-error\n');
     expect(text).not.toContain('ok noise');
   });
 
+  it('says so when a failed operation wrote no output', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('quiet (build)', 'FAILURE'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().slice(-3)).toEqual([
+      'failed: quiet (build)',
+      '  (no output)',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: quiet (build)'
+    ]);
+  });
+
   it('shows queue position immediately', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onQueuePosition(2);
@@ -163,21 +423,310 @@ describe(AgentProgressRenderer.name, () => {
     expect(output[output.length - 1]).toBe('rush build: SUCCESS up to date (no operations needed) in 4.0s\n');
   });
 
-  it('throttles progress lines on a pipe', () => {
-    const { renderer, output, clock } = createRenderer(false);
+  it('writes at most three progress lines and one summary line on a pipe at odsp-web scale', () => {
+    const { renderer, clock, lines } = createRenderer(false);
     renderer.start();
-    for (let i = 0; i < 50; i++) {
-      clock.ms = i * 10;
+    renderer.onRequestSent();
+    renderer.onQueuePosition(1);
+    const operationIds: string[] = Array.from({ length: 772 }, (unused, i) => `p${i} (build)`);
+    for (const operationId of operationIds) {
+      renderer.onEvent(registered(operationId));
+    }
+    for (let i: number = 0; i < 1200; i++) {
+      renderer.onEvent(registered(`p${i} (tool-build)`, true));
+    }
+    for (const [index, operationId] of operationIds.entries()) {
+      clock.ms = index * 270;
+      renderer.onEvent(status(operationId, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`building ${operationId}\n`), operationId, 'stdout');
+      renderer.onEvent(status(operationId, index % 2 ? 'FROM CACHE' : 'SUCCESS'));
+      renderer.onEvent(header(operationId, index + 1, 772));
+      renderer.onEvent(event('activityChanged', { text: `${index + 1} of 772 operations complete` }));
+    }
+    for (let i: number = 0; i < 1200; i++) {
+      renderer.onEvent(status(`p${i} (tool-build)`, 'NO OP'));
+    }
+    clock.ms = 210_000;
+    renderer.finish({ exitCode: 0 });
+    expect(lines()).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+      'rush build · 0.0s · queued behind another request (position 1)',
+      'rush build 0/772 · 0.0s · running',
+      'rush build: SUCCESS 772/772 operations (386 success, 386 from cache) in 210.0s'
+    ]);
+  });
+
+  it('keeps a failure at odsp-web scale to the progress lines, the failure report and one summary line', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.start();
+    renderer.onRequestSent();
+    for (let i: number = 0; i < 772; i++) {
+      renderer.onEvent(registered(`p${i} (build)`));
+    }
+    for (let i: number = 0; i < 700; i++) {
       renderer.onEvent(status(`p${i} (build)`, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`${'noise '.repeat(20)}\n`.repeat(50)), `p${i} (build)`, 'stdout');
+      renderer.onEvent(status(`p${i} (build)`, 'SUCCESS'));
     }
-    expect(output).toHaveLength(1);
-    clock.ms = 2500;
-    renderer.onEvent(status('p0 (build)', 'SUCCESS'));
-    expect(output).toHaveLength(2);
-    clock.ms = 3000;
-    renderer.onEvent(status('p1 (build)', 'SUCCESS'));
-    expect(output).toHaveLength(2);
-    renderer.dispose();
+    fail(renderer, 'p700 (build)', [
+      'src/x.ts:1:1 - error TS2304: Cannot find name "y".',
+      'Encountered 1 error'
+    ]);
+    for (let i: number = 701; i < 772; i++) {
+      renderer.onEvent(status(`p${i} (build)`, 'BLOCKED'));
+    }
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+      'rush build 0/772 · 0.0s · running',
+      'rush build 701/772 · 0.0s · running · first failure: p700 (build)',
+      'failed: p700 (build) · full log: /repo/p700/rush-logs/x.log',
+      '  src/x.ts:1:1 - error TS2304: Cannot find name "y".',
+      '  Encountered 1 error',
+      'rush build: FAILURE 772/772 operations (1 failure, 71 blocked, 700 success) in 0.0s · failed: p700 (build)'
+    ]);
+  });
+
+  it('ignores silent operations in the counters unless they fail', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(registered('s1 (tool-build)', true));
+    renderer.onEvent(registered('s2 (tool-build)', true));
+    renderer.onLog(Buffer.from('silent output\n'), 's1 (tool-build)', 'stderr');
+    renderer.onEvent(status('s1 (tool-build)', 'NO OP'));
+    renderer.onEvent(status('s2 (tool-build)', 'FAILURE'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 1 });
+    const text: string = output.join('');
+    expect(text).not.toContain('silent output');
+    expect(output[output.length - 1]).toMatch(
+      /rush build: FAILURE 2\/2 operations \(1 failure, 1 success\) in 0\.0s · failed: s2 \(tool-build\)\n$/
+    );
+  });
+
+  it('uses the per-request total from the operation header', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(header('a (build)', 1, 772));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 0 });
+    expect(lines()).toEqual([
+      'rush build 1/772 · 0.0s · running',
+      'rush build: SUCCESS 1/772 operations (1 success) in 0.0s'
+    ]);
+  });
+
+  it('counts an operation that runs again once', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(status('a (build)', 'FAILURE'));
+    renderer.onEvent(status('a (build)', 'READY'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 0 });
+    expect(output[output.length - 1]).toBe('rush build: SUCCESS 1/1 operations (1 success) in 0.0s\n');
+  });
+
+  it('reports operations with warnings when the warnings failed the request', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('w (build)', 'EXECUTING'));
+    renderer.onLog(
+      Buffer.from('[build:lint] Warning: src/x.ts:1:1 - (rule) message\n'),
+      'w (build)',
+      'stderr'
+    );
+    renderer.onEvent(status('w (build)', 'SUCCESS WITH WARNINGS', '/repo/w/rush-logs/w._phase_build.log'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().slice(-3)).toEqual([
+      'warnings: w (build) · full log: /repo/w/rush-logs/w._phase_build.log',
+      '  [build:lint] Warning: src/x.ts:1:1 - (rule) message',
+      'rush build: FAILURE 1/1 operations (1 success with warnings) in 0.0s · warnings: w (build)'
+    ]);
+  });
+
+  it('does not report warnings when the request succeeded', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('w (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Warning: x\n'), 'w (build)', 'stderr');
+    renderer.onEvent(status('w (build)', 'SUCCESS WITH WARNINGS'));
+    renderer.finish({ exitCode: 0 });
+    expect(lines().slice(-1)).toEqual([
+      'rush build: SUCCESS 1/1 operations (1 success with warnings) in 0.0s'
+    ]);
+    expect(lines().join('\n')).not.toContain('Warning: x');
+  });
+
+  it('caps the reported operations, their excerpts and the names in the summary', () => {
+    const { renderer, lines } = createRenderer(false);
+    for (let i: number = 0; i < 8; i++) {
+      fail(
+        renderer,
+        `f${i} (build)`,
+        Array.from({ length: 12 }, (unused, j) => `f${i} error ${j}`)
+      );
+    }
+    renderer.finish({ exitCode: 1 });
+    const report: string[] = lines().slice(2);
+    expect(report.filter((line) => line.startsWith('failed: '))).toEqual([
+      'failed: f0 (build) · full log: /repo/f0/rush-logs/x.log',
+      'failed: f1 (build) · full log: /repo/f1/rush-logs/x.log',
+      'failed: f2 (build) · full log: /repo/f2/rush-logs/x.log'
+    ]);
+    expect(report.filter((line) => line.startsWith('  f0 '))).toHaveLength(8);
+    expect(report.filter((line) => line.startsWith('  f1 '))).toHaveLength(3);
+    expect(report.filter((line) => line.startsWith('  f2 '))).toHaveLength(3);
+    expect(report.slice(-2)).toEqual([
+      "+5 more failed operations; their logs are in each project's rush-logs folder",
+      'rush build: FAILURE 8/8 operations (8 failure) in 0.0s · failed: f0 (build), f1 (build), f2 (build), ' +
+        'f3 (build), f4 (build) +3 more'
+    ]);
+  });
+
+  it('shows the output of a command that failed without running operations', () => {
+    const { renderer, lines } = createRenderer(false, 'install');
+    renderer.onLog(Buffer.from('Installing packages\n'), 'request-id', 'stdout');
+    renderer.onLog(
+      Buffer.from('ERR_PNPM_FETCH_401 GET https://registry.example/pkg: Unauthorized\n'),
+      'request-id',
+      'stderr'
+    );
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      '  ERR_PNPM_FETCH_401 GET https://registry.example/pkg: Unauthorized',
+      'rush install: FAILURE in 0.0s'
+    ]);
+  });
+
+  it('does not claim a successful global command was up to date', () => {
+    const { renderer, output } = createRenderer(false, 'install');
+    renderer.onLog(Buffer.from('Installing packages\n'), 'request-id', 'stdout');
+    renderer.finish({ exitCode: 0 });
+    expect(output).toEqual(['rush install: SUCCESS in 0.0s\n']);
+  });
+
+  describe('on a pipe, with timers', () => {
+    beforeEach(() => jest.useFakeTimers());
+    afterEach(() => jest.useRealTimers());
+
+    function advance(clock: { ms: number }, ms: number): void {
+      clock.ms += ms;
+      jest.advanceTimersByTime(ms);
+    }
+
+    it('writes the connecting line only when the connection takes more than a second', () => {
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 999);
+      expect(output).toEqual([]);
+      advance(clock, 1);
+      renderer.onRequestSent();
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 1.0s · connecting to rushd (auto-starts if needed)',
+        'rush build · 1.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+    });
+
+    it('writes one line when the client waits for a daemon that is still starting (task 95)', () => {
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 300);
+      renderer.onAwaitStartup(15_000);
+      expect(lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)'
+      ]);
+      advance(clock, 1_000);
+      renderer.onAwaitStartup(15_000);
+      expect(output).toHaveLength(1);
+      advance(clock, 11_000);
+      renderer.onRequestSent();
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)',
+        'rush build · 12.3s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+    });
+
+    it('writes nothing for a request that is handed to in-process Rush within a second', () => {
+      const { renderer, output, clock } = createRenderer(false);
+      renderer.start();
+      advance(clock, 500);
+      renderer.dispose();
+      advance(clock, 60_000);
+      expect(output).toEqual([]);
+    });
+
+    it('writes a status line after 25 s of silence, with the running and failed operations', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'c', 'd', 'e']) {
+        renderer.onEvent(registered(`${name} (build)`));
+      }
+      advance(clock, 20_000);
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onEvent(status('b (build)', 'EXECUTING'));
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.onEvent(status('c (build)', 'EXECUTING'));
+      renderer.onEvent(status('d (build)', 'EXECUTING'));
+      renderer.onEvent(status('e (build)', 'EXECUTING'));
+      fail(renderer, 'a (build)', ['error TS2322']);
+      advance(clock, 25_000);
+      renderer.onEvent(status('b (build)', 'SUCCESS'));
+      advance(clock, 25_000);
+      clock.ms += 1000;
+      renderer.finish({ exitCode: 1 });
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build 0/5 · 20.0s · running',
+        'rush build 0/5 · 45.0s · running: a (build), b (build)',
+        // The first failure is a milestone, so it is written although status lines were written before it.
+        'rush build 1/5 · 45.0s · running · first failure: a (build)',
+        'rush build 1/5 · 70.0s · running: b (build), c (build), d (build) +1 more · failed: a (build)',
+        'rush build 2/5 · 95.0s · running: c (build), d (build), e (build) · failed: a (build)',
+        'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+        '  error TS2322',
+        'rush build: FAILURE 2/5 operations (1 failure, 1 success) in 96.0s · failed: a (build)'
+      ]);
+    });
+
+    it('does not claim that a request is still queued once it may have been admitted', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 2000);
+      renderer.onQueuePosition(1);
+      advance(clock, 25_000);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build · 2.0s · queued behind another request (position 1)',
+        'rush build · 27.0s · waiting for admission or the workspace graph (queue position 1 at 2.0s)',
+        'rush build 0/1 · 27.0s · running',
+        'rush build 0/1 · 52.0s · running: a (build)'
+      ]);
+    });
+
+    it('writes status lines after the milestone lines ran out, and none after the summary', () => {
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      renderer.onQueuePosition(1);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      fail(renderer, 'a (build)', ['error']);
+      expect(lines()).toHaveLength(3);
+      advance(clock, 25_000);
+      expect(lines()[3]).toBe('rush build 1/1 · 25.0s · running · failed: a (build)');
+      renderer.finish({ exitCode: 1 });
+      const written: number = output.length;
+      advance(clock, 100_000);
+      expect(output).toHaveLength(written);
+    });
   });
 
   it('renders at most three live rows on a TTY and clears them before the summary', () => {
@@ -196,4 +745,40 @@ describe(AgentProgressRenderer.name, () => {
     expect(output[output.length - 2]).toBe('\x1b[3A\x1b[0J\x1b[?25h');
     expect(output[output.length - 1]).toContain('rush build: SUCCESS');
   });
+
+  it('shows the wait for a daemon that is still starting as the phase on a TTY', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    renderer.onAwaitStartup(15_000);
+    renderer.dispose();
+    expect(output).toHaveLength(3);
+    // The row is clipped to the 60 columns of the test terminal.
+    expect(output[1].replace(ANSI_ESCAPE, '').split('\n')[0]).toMatch(
+      /^. rush build · 0\.0s · rushd is still starting; waiting for…$/
+    );
+  });
+
+  it('repaints a TTY on its timer rather than on every event, and shows failures in the last row', () => {
+    jest.useFakeTimers();
+    try {
+      const { renderer, output } = createRenderer(true);
+      renderer.start();
+      for (let i: number = 0; i < 100; i++) {
+        renderer.onEvent(status(`p${i} (build)`, 'EXECUTING'));
+      }
+      renderer.onEvent(status('p0 (build)', 'FAILURE'));
+      expect(output).toHaveLength(1);
+      jest.advanceTimersByTime(100);
+      expect(output).toHaveLength(2);
+      const rows: string[] = output[1].replace(ANSI_ESCAPE, '').split('\n');
+      expect(rows[0]).toMatch(/^. rush build 1\/100 · 0\.0s · running$/);
+      expect(rows[1]).toBe('running: p1 (build), p2 (build), p3 (build) +96 more');
+      expect(rows[2]).toBe('failed: p0 (build)');
+      renderer.dispose();
+      jest.advanceTimersByTime(1000);
+      expect(output).toHaveLength(3);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
 });
diff --git a/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts b/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts
index f4ec40eb3a..36c934b8ac 100644
--- a/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts
+++ b/apps/rush-cli-client/src/test/GraphGenerationWire.test.ts
@@ -30,6 +30,7 @@ import {
 import { DaemonFrameListener, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 describe('generation-aware graph reference client', () => {
   it.each([
@@ -146,7 +147,7 @@ describe('generation-aware graph reference client', () => {
           ],
           {
             cwd: folder,
-            env: { ...process.env, RUSH_DAEMON_EXPERIMENTAL: '1' },
+            env: { ...getTestProcessEnvironment(), RUSH_DAEMON_EXPERIMENTAL: '1' },
             stdio: ['ignore', 'pipe', 'pipe']
           }
         );
@@ -384,7 +385,7 @@ describe('generation-aware graph reference client', () => {
           {
             cwd: folder,
             env: {
-              ...process.env,
+              ...getTestProcessEnvironment(),
               RUSH_DAEMON_EXPERIMENTAL: '1',
               RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: mode === 'environment-timeout' ? '0.25' : undefined
             },
diff --git a/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts b/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts
index 79670f2790..e6e812b3ce 100644
--- a/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts
+++ b/apps/rush-cli-client/src/test/NativeBuildTestFixture.test.ts
@@ -9,6 +9,36 @@ import * as path from 'node:path';
 import { createNativeBuildTestFixture } from './NativeBuildTestFixture';
 
 describe('native build fixture lifetime', () => {
+  it('gives spawned clients the default output when the tests run in an agent shell', async () => {
+    const saved: Record<string, string | undefined> = {
+      COPILOT_CLI: process.env.COPILOT_CLI,
+      RUSHD_OUTPUT: process.env.RUSHD_OUTPUT
+    };
+    process.env.COPILOT_CLI = '1';
+    process.env.RUSHD_OUTPUT = 'agent';
+    const fixture = createNativeBuildTestFixture();
+    try {
+      expect(fixture.environment.COPILOT_CLI).toBeUndefined();
+      expect(fixture.environment.RUSHD_OUTPUT).toBeUndefined();
+      await fixture.runAsync(async ({ invokeAsync }) => {
+        const result = await invokeAsync(['build', '--to', 'a', '--verbose']);
+        expect(result.code).toBe(0);
+        expect(result.stderr).not.toMatch(/using in-process/i);
+        expect(result.stdout).toContain('built-a-one');
+        expect(result.stdout).not.toContain('connecting to rushd');
+      });
+    } finally {
+      for (const [name, value] of Object.entries(saved)) {
+        if (value === undefined) {
+          delete process.env[name];
+        } else {
+          process.env[name] = value;
+        }
+      }
+      await fixture.closeAsync();
+    }
+  }, 60000);
+
   it('joins the whole old callback without rebinding it to a later fixture', async () => {
     const old = createNativeBuildTestFixture();
     const next = createNativeBuildTestFixture();
diff --git a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
index ace2ae4152..659e65647a 100644
--- a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
+++ b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
@@ -17,6 +17,8 @@ import {
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 export interface INativeBuildResult {
   readonly code: number | undefined;
   readonly stdout: string;
@@ -41,7 +43,7 @@ export interface INativeBuildTestFixture {
 export function createNativeBuildTestFixture(): INativeBuildTestFixture {
   const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-native-'));
   const environment: NodeJS.ProcessEnv = {
-    ...process.env,
+    ...getTestProcessEnvironment(),
     RUSH_DAEMON: '1',
     RUSH_REPORTER: 'legacy',
     CI: 'false',
diff --git a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
new file mode 100644
index 0000000000..4e241e65b0
--- /dev/null
+++ b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
@@ -0,0 +1,255 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  OperationOutputExcerpt,
+  clipLine,
+  isErrorLine,
+  normalizeExcerptLine
+} from '../OperationOutputExcerpt';
+
+const ESC: string = String.fromCharCode(27);
+
+// Shaped like a Heft plugin that fails to load: the cause is on one line, followed by a long require stack.
+const REQUIRE_STACK_FAILURE: string = [
+  '',
+  'Internal Error: Could not load plugin from "/repo/tools/example-plugin/lib/ExamplePlugin.js": ' +
+    "Error: Cannot find module '/repo/tools/example-plugin/lib/ExamplePlugin.js'",
+  'Require stack:',
+  ...Array.from(
+    { length: 8 },
+    (unused, i) =>
+      `- /repo/common/temp/node_modules/.pnpm/@rushstack+heft@1.2.3/node_modules/@rushstack/heft/lib/m${i}.js`
+  ),
+  '',
+  'You have encountered a software defect. Please consider reporting the issue to the maintainers of this application.',
+  ''
+].join('\n');
+
+// Shaped like Heft's Jest plugin output: prefixed lines, a message, a code frame and stack frames per test.
+function jestFailure(testNames: ReadonlyArray<string>): string {
+  const lines: string[] = [];
+  for (const [index, testName] of testNames.entries()) {
+    lines.push(
+      `[test:jest]   ● ${testName}`,
+      '[test:jest] ',
+      '[test:jest]     1',
+      '[test:jest] ',
+      '[test:jest]     ERROR: The following environment variables were found with the "RUSH_" prefix,',
+      '[test:jest]     but they are not recognized by this version of Rush: RUSH_EXAMPLE',
+      '[test:jest] ',
+      '[test:jest]       11 |   if (result.status !== 0) {',
+      '[test:jest]     > 12 |     throw new Error(`${result.status}`);',
+      '[test:jest]          |           ^',
+      '[test:jest]       13 |   }',
+      '[test:jest] ',
+      `[test:jest]       at runStep (src/test/example.test.ts:12:11)`,
+      `[test:jest]       at Object.runStep (src/test/example.test.ts:${40 + index}:3)`,
+      '[test:jest] '
+    );
+  }
+  lines.push(`[test:jest] Error: ${testNames.length} Jest tests failed`, 'Encountered 1 error', '');
+  return lines.join('\n');
+}
+
+describe(normalizeExcerptLine.name, () => {
+  it('removes colors, carriage-return overwrites and the whitespace after a task prefix', () => {
+    expect(normalizeExcerptLine(`${ESC}[31merror${ESC}[39m TS2304: x`)).toBe('error TS2304: x');
+    expect(normalizeExcerptLine('progress 10%\rprogress 100%\r')).toBe('progress 100%');
+    expect(normalizeExcerptLine('[build:lint]     Warning: src/x.ts:1:1')).toBe(
+      '[build:lint] Warning: src/x.ts:1:1'
+    );
+    expect(normalizeExcerptLine(`${ESC}]8;;https://example.com${String.fromCharCode(7)}link`)).toBe('link');
+  });
+
+  it('drops empty, prefix-only and noise lines', () => {
+    for (const line of [
+      '',
+      '   ',
+      '[test:jest] ',
+      '    at Object.<anonymous> (src/x.test.ts:12:19)',
+      '    at async Promise.all (index 0)',
+      '    at new Promise (<anonymous>)',
+      'Require stack:',
+      '- /repo/node_modules/x/lib/index.js',
+      '- C:\\repo\\node_modules\\x\\lib\\index.js',
+      '[test:jest]     > 12 |     throw new Error();',
+      '[test:jest]          |           ^',
+      ' ---- build started ---- ',
+      '-------------------- Finished (12.407s) --------------------',
+      'Invoking: heft run --only build -- --clean ',
+      'Invoking (incremental): heft run --only build --',
+      'This project was not found in the build cache.',
+      'Build cache hit.',
+      'Caching build output folders: lib, lib-commonjs',
+      'Successfully set cache entry.'
+    ]) {
+      expect(normalizeExcerptLine(line)).toBeUndefined();
+    }
+  });
+
+  it('keeps English lines that merely start with "at"', () => {
+    expect(normalizeExcerptLine('at least one project failed')).toBe('at least one project failed');
+  });
+
+  it('clips very long lines, keeping their start and end', () => {
+    const line: string | undefined = normalizeExcerptLine(
+      `start ${'x'.repeat(10000)} Cannot find module 'y'`
+    );
+    expect(line?.length).toBe(300);
+    expect(line?.startsWith('start ')).toBe(true);
+    expect(line?.endsWith("Cannot find module 'y'")).toBe(true);
+  });
+});
+
+describe(isErrorLine.name, () => {
+  it.each([
+    'src/x.ts(1,1): error TS1005: expected',
+    'src/x.ts:1:1 - error TS2304: Cannot find name',
+    '[test:jest]   ● suite › test',
+    'Error: 3 Jest tests failed',
+    'npm ERR! code ELIFECYCLE',
+    'ERR_PNPM_FETCH_401 GET https://registry.example/pkg: Unauthorized',
+    'Encountered 1 error',
+    'FAIL src/x.test.ts',
+    'Could not load plugin'
+  ])('recognizes %s', (line) => {
+    expect(isErrorLine(line)).toBe(true);
+  });
+
+  it.each([
+    'Found 0 errors. Watching for file changes.',
+    'Linting finished with no errors',
+    'Compiling 12 files'
+  ])('ignores %s', (line) => {
+    expect(isErrorLine(line)).toBe(false);
+  });
+});
+
+describe(clipLine.name, () => {
+  it('leaves short lines alone', () => {
+    expect(clipLine('short', 10)).toBe('short');
+  });
+
+  it('keeps the start and end of long lines', () => {
+    expect(clipLine('abcdefghijklmnopqrstuvwxyz', 10)).toBe('abcdef…xyz');
+  });
+});
+
+describe(OperationOutputExcerpt.name, () => {
+  it('shows the cause of a plugin load failure instead of its require stack', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append(REQUIRE_STACK_FAILURE, 'stderr');
+    const lines: string[] = excerpt.getExcerpt(8);
+    expect(lines).toHaveLength(2);
+    expect(lines[0]).toMatch(/^Internal Error: Could not load plugin/);
+    expect(lines[0]).toContain("Cannot find module '");
+    expect(lines[1]).toMatch(/^You have encountered a software defect/);
+  });
+
+  it('shows the failing tests, the message and the summary of a Jest failure', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('[test:jest] PASS src/test/other.test.ts\n', 'stdout');
+    excerpt.append(jestFailure(['test one', 'test two', 'test three']), 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual([
+      '[test:jest] ● test one',
+      '[test:jest] ERROR: The following environment variables were found with the "RUSH_" prefix,',
+      '[test:jest] but they are not recognized by this version of Rush: RUSH_EXAMPLE',
+      '[test:jest] ● test two',
+      '[test:jest] ● test three',
+      '[test:jest] Error: 3 Jest tests failed',
+      'Encountered 1 error'
+    ]);
+    expect(excerpt.getExcerpt(3)).toEqual([
+      '[test:jest] ● test one',
+      '[test:jest] Error: 3 Jest tests failed',
+      'Encountered 1 error'
+    ]);
+  });
+
+  it('finds errors that tools report on stdout', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('[build:typescript] Using TypeScript version 5.8.2\n', 'stdout');
+    excerpt.append('[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".\n', 'stdout');
+    excerpt.append('[build:typescript] Encountered 1 error\n', 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual([
+      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".',
+      '[build:typescript] Encountered 1 error'
+    ]);
+  });
+
+  it("does not spend the error lines of a short excerpt on Rush's own cache and invocation lines", () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('This project was not found in the build cache.\n', 'stdout');
+    excerpt.append('Invoking (initial): heft run --only build -- --clean \n', 'stdout');
+    excerpt.append('[build:typescript] Using TypeScript version 5.8.2\n', 'stdout');
+    excerpt.append('[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".\n', 'stderr');
+    excerpt.append('[build:lint] Using ESLint version 9.37.0\n', 'stdout');
+    excerpt.append('Error: Encountered 1 error\n', 'stderr');
+    expect(excerpt.getExcerpt(3)).toEqual([
+      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".',
+      'Error: Encountered 1 error'
+    ]);
+  });
+
+  it('takes the line after an error from the same stream, not from the interleaved other stream', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append(
+      "src/x.ts(3,7): error TS2322: Type 'string' is not assignable to type 'number'.\n",
+      'stderr'
+    );
+    excerpt.append('[build:lint] still linting file 4\n', 'stdout');
+    excerpt.append('  The expected type comes from property "x".\n', 'stderr');
+    excerpt.append("src/y.ts(1,1): error TS2304: Cannot find name 'z'.\n", 'stderr');
+    excerpt.append('[build:lint] still linting file 5\n', 'stdout');
+    excerpt.append('  Did you mean "y"?\n', 'stderr');
+    excerpt.append('Encountered 2 errors\n', 'stderr');
+    expect(excerpt.getExcerpt(5)).toEqual([
+      "src/x.ts(3,7): error TS2322: Type 'string' is not assignable to type 'number'.",
+      'The expected type comes from property "x".',
+      "src/y.ts(1,1): error TS2304: Cannot find name 'z'.",
+      'Did you mean "y"?',
+      'Encountered 2 errors'
+    ]);
+  });
+
+  it('always keeps the last line, which usually is the tool summary', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    for (let i: number = 0; i < 20; i++) {
+      excerpt.append(`error ${i}\n`, 'stderr');
+    }
+    const lines: string[] = excerpt.getExcerpt(8);
+    expect(lines).toHaveLength(8);
+    expect(lines[0]).toBe('error 0');
+    expect(lines[lines.length - 1]).toBe('error 19');
+  });
+
+  it('joins lines split across chunks and records an unterminated last line', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('src/x.ts(1,1): err', 'stdout');
+    excerpt.append('or TS1005: expected\nlast line without newline', 'stdout');
+    expect(excerpt.getExcerpt(8)).toEqual([
+      'src/x.ts(1,1): error TS1005: expected',
+      'last line without newline'
+    ]);
+  });
+
+  it('does not repeat a line that was written to both streams', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append('Error: boom\n', 'stdout');
+    excerpt.append('Error: boom\n', 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual(['Error: boom']);
+  });
+
+  it('keeps memory use flat for huge output', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    for (let i: number = 0; i < 100000; i++) {
+      excerpt.append(`line ${i} ${'x'.repeat(100)}\n`, 'stdout');
+    }
+    excerpt.append('x'.repeat(200000), 'stdout');
+    expect(excerpt.lineCount).toBe(100001);
+    const lines: string[] = excerpt.getExcerpt(8);
+    expect(lines).toHaveLength(8);
+    expect(lines[lines.length - 1]).toMatch(/^x+…x+$/);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
index 389a3133f8..0f5a87b511 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
@@ -22,6 +22,8 @@ import {
 } from '@rushstack/rush-daemon';
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 export interface IScriptResult {
   readonly exitCode: number | undefined;
   readonly stdout: Buffer;
@@ -155,7 +157,7 @@ setInterval(() => {}, 1000);
 
   public environment(overrides: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
     return {
-      ...process.env,
+      ...getTestProcessEnvironment(),
       HOME: this.home,
       USERPROFILE: this.home,
       CLIENT_MARKER: 'client',
diff --git a/apps/rush-cli-client/src/test/TestProcessEnvironment.ts b/apps/rush-cli-client/src/test/TestProcessEnvironment.ts
new file mode 100644
index 0000000000..df8bac55b2
--- /dev/null
+++ b/apps/rush-cli-client/src/test/TestProcessEnvironment.ts
@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { CLIENT_OUTPUT_SELECTION_ENV_VARS } from '../outputSelection';
+
+/**
+ * Returns a copy of `base` (by default `process.env`) for the clients that tests spawn, without the variables
+ * that select the client's output mode (`RUSHD_OUTPUT` and agent markers such as `COPILOT_CLI`). Spawned
+ * clients then use the default output even when the tests run in an agent's shell. Tests of agent output set
+ * those variables explicitly.
+ */
+export function getTestProcessEnvironment(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...base };
+  for (const name of CLIENT_OUTPUT_SELECTION_ENV_VARS) {
+    delete environment[name];
+  }
+  return environment;
+}
diff --git a/apps/rush-cli-client/src/test/daemonGraph.test.ts b/apps/rush-cli-client/src/test/daemonGraph.test.ts
index 4305314b83..fd843d4e95 100644
--- a/apps/rush-cli-client/src/test/daemonGraph.test.ts
+++ b/apps/rush-cli-client/src/test/daemonGraph.test.ts
@@ -21,6 +21,7 @@ import {
 import { DaemonFrameListener, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 describe('graph client fails closed over the public wire', () => {
   it.each(['unsupported', 'missing-snapshot', 'invalid-snapshot', 'old-protocol'])(
@@ -108,7 +109,7 @@ describe('graph client fails closed over the public wire', () => {
           [path.resolve(__dirname, '../../bin/rush-client'), 'daemon', 'graph', 'show'],
           {
             cwd: folder,
-            env: { ...process.env, RUSH_DAEMON_EXPERIMENTAL: '1' },
+            env: { ...getTestProcessEnvironment(), RUSH_DAEMON_EXPERIMENTAL: '1' },
             stdio: ['ignore', 'pipe', 'pipe']
           }
         );
diff --git a/apps/rush-cli-client/src/test/daemonLogs.test.ts b/apps/rush-cli-client/src/test/daemonLogs.test.ts
index a098d9276d..630984b13a 100644
--- a/apps/rush-cli-client/src/test/daemonLogs.test.ts
+++ b/apps/rush-cli-client/src/test/daemonLogs.test.ts
@@ -15,6 +15,7 @@ import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { getDaemonConnectionOptions } from '../daemonConnectionOptions';
 import { printDaemonLogAsync } from '../daemonLogs';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 async function waitUntilAsync(predicate: () => boolean): Promise<void> {
   const deadline: number = Date.now() + 5000;
@@ -159,7 +160,7 @@ describe('daemon launcher log following', () => {
         ],
         {
           cwd: folder,
-          env: { ...process.env, RUSH_DAEMON: '1' },
+          env: { ...getTestProcessEnvironment(), RUSH_DAEMON: '1' },
           stdio: windowsSignal ? ['ignore', 'pipe', 'pipe', 'ipc'] : ['ignore', 'pipe', 'pipe']
         }
       );
@@ -213,7 +214,11 @@ describe('daemon launcher log following', () => {
     const child = spawn(
       process.execPath,
       [path.resolve(__dirname, '../../bin/rush-client'), 'daemon', 'logs', '--follow'],
-      { cwd: folder, env: { ...process.env, RUSH_DAEMON: '1' }, stdio: ['ignore', 'pipe', 'pipe'] }
+      {
+        cwd: folder,
+        env: { ...getTestProcessEnvironment(), RUSH_DAEMON: '1' },
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
     );
     const closed = once(child, 'close');
     const readable = once(child.stdout, 'readable');
@@ -268,7 +273,7 @@ describe('daemon launcher log following', () => {
         ],
         {
           cwd: folder,
-          env: { ...process.env, RUSH_DAEMON: '1' },
+          env: { ...getTestProcessEnvironment(), RUSH_DAEMON: '1' },
           stdio: windowsSignal ? ['ignore', outputFd, 'pipe', 'ipc'] : ['ignore', outputFd, 'pipe']
         }
       );
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index e8f70172b5..eadfc26bdc 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -27,6 +27,7 @@ import {
   getSignalExitCode,
   isCancelledOutcome
 } from '../clientCancellation';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
 
 interface IInvocationResult {
   readonly code: number | undefined;
@@ -106,7 +107,7 @@ describe('standalone rushx fallback', () => {
     const child: ChildProcess = spawn(process.execPath, args, {
       cwd: project,
       env: {
-        ...process.env,
+        ...getTestProcessEnvironment(),
         CLIENT_MARKER: 'script-output',
         RUSH_DAEMON: optIn ? '1' : '0',
         CI: managementArgs ? 'true' : 'false',
@@ -661,6 +662,22 @@ describe('daemon client cancellation exit codes', () => {
     expect(isCancelledOutcome(cancelledWithFailure, true)).toBe(true);
   });
 
+  it('does not report a request that a daemon shutdown aborted as cancelled, unless the client was signalled', () => {
+    const shutDown: DaemonClientOutcome = {
+      kind: 'result',
+      result: {
+        requestId: 'r',
+        outcome: 'failure',
+        exitCode: 1,
+        aborted: true,
+        errorMessage:
+          'The Rush daemon was shut down (idle timeout) while this request was running; re-run the command.'
+      }
+    };
+    expect(isCancelledOutcome(shutDown, false)).toBe(false);
+    expect(isCancelledOutcome(shutDown, true)).toBe(true);
+  });
+
   it('keeps completed results and rejections when a signal arrives late', () => {
     const succeeded: DaemonClientOutcome = {
       kind: 'result',
@@ -670,9 +687,29 @@ describe('daemon client cancellation exit codes', () => {
       kind: 'rejected',
       rejection: { requestId: 'r', code: 'unsupportedProtocolVersion', message: 'no' }
     } as unknown as DaemonClientOutcome;
+    const invalid: DaemonClientOutcome = {
+      kind: 'rejected',
+      rejection: { requestId: 'r', code: 'invalidRequest', message: 'Unknown operation id.' }
+    };
     expect(isCancelledOutcome(succeeded, true)).toBe(false);
     expect(isCancelledOutcome(rejected, true)).toBe(false);
+    expect(isCancelledOutcome(invalid, true)).toBe(false);
     expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, true)).toBe(true);
     expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, false)).toBe(false);
   });
+
+  it('treats a request that a signal cancelled before engine initialization as cancelled (#711)', () => {
+    // The daemon rejects a request that was cancelled while it prepared the workspace graph.
+    const cancelledBeforeEngine: DaemonClientOutcome = {
+      kind: 'rejected',
+      rejection: {
+        requestId: 'r',
+        code: 'routingFailed',
+        message: 'The request was cancelled before engine initialization.'
+      }
+    };
+    expect(isCancelledOutcome(cancelledBeforeEngine, true)).toBe(true);
+    // Without a signal, the daemon failed to route the request for its own reason, such as a shutdown.
+    expect(isCancelledOutcome(cancelledBeforeEngine, false)).toBe(false);
+  });
 });
diff --git a/apps/rush-cli-client/src/test/nativeMutation.test.ts b/apps/rush-cli-client/src/test/nativeMutation.test.ts
index 44158a49ca..e7db540889 100644
--- a/apps/rush-cli-client/src/test/nativeMutation.test.ts
+++ b/apps/rush-cli-client/src/test/nativeMutation.test.ts
@@ -11,6 +11,8 @@ import { Rush } from '@microsoft/rush-lib';
 import { SuccessfulMutationFixture } from '@rushstack/rush-daemon/lib/test/SuccessfulMutationFixture';
 import { computeDaemonWorkspaceKey, resolveDaemonPaths } from '@rushstack/rush-daemon-transport';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 interface IClientResult {
   readonly exitCode: number | undefined;
   readonly stdout: string;
@@ -23,7 +25,7 @@ async function invokeAsync(
 ): Promise<IClientResult> {
   const child = spawn(process.execPath, [path.resolve(__dirname, '../../bin/rush-client'), ...argv], {
     cwd: fixture.repoRoot,
-    env: { ...fixture.environment, RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' },
+    env: { ...getTestProcessEnvironment(fixture.environment), RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' },
     stdio: ['ignore', 'pipe', 'pipe']
   });
   let stdout: string = '';
diff --git a/apps/rush-cli-client/src/test/pipedInput.test.ts b/apps/rush-cli-client/src/test/pipedInput.test.ts
index 0de06c1cc3..2b3e29a03b 100644
--- a/apps/rush-cli-client/src/test/pipedInput.test.ts
+++ b/apps/rush-cli-client/src/test/pipedInput.test.ts
@@ -16,6 +16,8 @@ import {
   type IDaemonRequestResolver
 } from '@rushstack/rush-daemon';
 
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
 const SCRIPT: string =
   "const chunks=[];process.stdin.on('data',c=>{chunks.push(c);process.stdin.pause();" +
   'setTimeout(()=>process.stdin.resume(),1);});' +
@@ -86,7 +88,7 @@ describe('standalone client piped input', () => {
     const child = spawn(process.execPath, [entry, 'sample', ...admissionArgs], {
       cwd: project,
       env: {
-        ...process.env,
+        ...getTestProcessEnvironment(),
         RUSH_DAEMON: '1',
         RUSH_REPORTER: 'legacy',
         RUSH_QUIET_MODE: '1',
diff --git a/apps/rush-cli-client/src/test/terminalColumns.test.ts b/apps/rush-cli-client/src/test/terminalColumns.test.ts
new file mode 100644
index 0000000000..ea2fc00e57
--- /dev/null
+++ b/apps/rush-cli-client/src/test/terminalColumns.test.ts
@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getTerminalColumns } from '../terminalColumns';
+
+describe(getTerminalColumns.name, () => {
+  it('keeps a real terminal width', () => {
+    expect(getTerminalColumns({ columns: 123 })).toBe(123);
+  });
+
+  it.each([0, -1, 1.5, Number.NaN])('treats %p columns as unknown', (columns) => {
+    expect(getTerminalColumns({ columns })).toBeUndefined();
+  });
+
+  it('treats a stream without a width as unknown', () => {
+    expect(getTerminalColumns({})).toBeUndefined();
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/agent-admission-failure-code_2026-09-28-15-08.json b/common/changes/@rushstack/rush-cli-client/agent-admission-failure-code_2026-09-28-15-08.json
new file mode 100644
index 0000000000..7bc9a6e9d8
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-admission-failure-code_2026-09-28-15-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, keep \"daemon admission failed (<code>)\" in the summary line when the daemon did not admit a request, and word an empty selection like native Rush: \"the selection parameters did not match any projects\".",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/agent-empty-selection_2026-09-28-14-45.json b/common/changes/@rushstack/rush-cli-client/agent-empty-selection_2026-09-28-14-45.json
new file mode 100644
index 0000000000..ce0d099f74
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-empty-selection_2026-09-28-14-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, report a selection that matched no projects as such, instead of as an up-to-date build.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/agent-error-detail_2026-09-28-13-30.json b/common/changes/@rushstack/rush-cli-client/agent-error-detail_2026-09-28-13-30.json
new file mode 100644
index 0000000000..63291c8b1c
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-error-detail_2026-09-28-13-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, print at most eight further lines of a multi-line error message before the summary line, instead of the whole message on stderr.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/agent-output-scale_2026-09-28-13-00.json b/common/changes/@rushstack/rush-cli-client/agent-output-scale_2026-09-28-13-00.json
new file mode 100644
index 0000000000..ffc75bbe1a
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-output-scale_2026-09-28-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Make agent output hold at repository scale: at most three progress lines on a pipe; name the failed (or warning) operations with an error-first excerpt and the path of their full log; count skipped and no-op operations as up to date; report Ctrl+C as CANCELLED.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/agent-pipe-status_2026-09-28-14-20.json b/common/changes/@rushstack/rush-cli-client/agent-pipe-status_2026-09-28-14-20.json
new file mode 100644
index 0000000000..1509e2f741
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-pipe-status_2026-09-28-14-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "On a pipe, agent output reports when the request was sent to rushd and prints a status line with the running operations at least every 25 seconds, so a long build or wait is never silent. A pseudo-terminal without a size is treated as a pipe.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/cancel-before-engine-init_2026-09-28-14-45.json b/common/changes/@rushstack/rush-cli-client/cancel-before-engine-init_2026-09-28-14-45.json
new file mode 100644
index 0000000000..ee59cebc6e
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/cancel-before-engine-init_2026-09-28-14-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Report a command that Ctrl+C cancelled while the daemon prepared the workspace graph as cancelled (exit code 130), not as a daemon routing failure.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/daemon-shutdown-not-cancelled_2026-09-28-13-00.json b/common/changes/@rushstack/rush-cli-client/daemon-shutdown-not-cancelled_2026-09-28-13-00.json
new file mode 100644
index 0000000000..a389a1c7e1
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/daemon-shutdown-not-cancelled_2026-09-28-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Report a request that a daemon shutdown aborted as a failure with the shutdown reason and exit code 1, instead of as a user cancellation with exit code 130.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t83-admission-reason_2026-09-28-18-55.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t83-admission-reason_2026-09-28-18-55.json
new file mode 100644
index 0000000000..c6a497636f
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t83-admission-reason_2026-09-28-18-55.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, write the daemon's reason for an admission failure in full on the summary line, instead of shortening a long reason and then adding a generic wait-timeout line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t83-startup-wait-line_2026-09-28-20-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t83-startup-wait-line_2026-09-28-20-10.json
new file mode 100644
index 0000000000..ea5ac3b32d
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t83-startup-wait-line_2026-09-28-20-10.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output on a pipe, write a line when the client waits for a daemon that is still starting, as agent output on a TTY and legacy output already say.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/zero-size-pty_2026-09-28-13-00.json b/common/changes/@rushstack/rush-cli-client/zero-size-pty_2026-09-28-13-00.json
new file mode 100644
index 0000000000..13b18d2f36
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/zero-size-pty_2026-09-28-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Do not send a terminal width of 0 when stdout is a pseudo-terminal without a size; the daemon rejected every such request.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/restart-drain-default-timeout_2026-09-28-15-08.json b/common/changes/@rushstack/rush-client-core/restart-drain-default-timeout_2026-09-28-15-08.json
new file mode 100644
index 0000000000..e9f7953174
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/restart-drain-default-timeout_2026-09-28-15-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Follow a daemon restart that takes longer than the client-default queue timeout; each successor daemon applies that default to its own admission. An explicit timeout is still one deadline across restarts.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/agent-output-log-path_2026-09-28-13-00.json b/common/changes/@rushstack/rush-daemon-protocol/agent-output-log-path_2026-09-28-13-00.json
new file mode 100644
index 0000000000..d1ef986d9a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/agent-output-log-path_2026-09-28-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `logFilePath` to operation status events, which points at the full log of a failed operation or an operation with warnings.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/restart-drain-default-timeout_2026-09-28-15-08.json b/common/changes/@rushstack/rush-daemon-protocol/restart-drain-default-timeout_2026-09-28-15-08.json
new file mode 100644
index 0000000000..fee233931f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/restart-drain-default-timeout_2026-09-28-15-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Document that a client-default admission timeout does not apply while a request that waits for the daemon to restart for its environment waits for requests that were already running while no rushx script is running.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/agent-output-log-path_2026-09-28-13-00.json b/common/changes/@rushstack/rush-daemon/agent-output-log-path_2026-09-28-13-00.json
new file mode 100644
index 0000000000..87ef240c06
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/agent-output-log-path_2026-09-28-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Report the full log file path of failed operations and operations with warnings in their status events.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rejection-keeps-graph_2026-09-28-13-45.json b/common/changes/@rushstack/rush-daemon/rejection-keeps-graph_2026-09-28-13-45.json
new file mode 100644
index 0000000000..f224b43ff3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rejection-keeps-graph_2026-09-28-13-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep the workspace graph that a request loaded when only its project selection is invalid, so that the next request does not load the workspace again.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rejection-without-debug-lines_2026-09-28-13-30.json b/common/changes/@rushstack/rush-daemon/rejection-without-debug-lines_2026-09-28-13-30.json
new file mode 100644
index 0000000000..51ecd71e72
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rejection-without-debug-lines_2026-09-28-13-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Leave the verbose and debug messages written while loading the workspace out of a rejected request's error message, and do not append \"An error occurred.\" to the error lines that already describe the failure.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/restart-drain-default-timeout_2026-09-28-15-08.json b/common/changes/@rushstack/rush-daemon/restart-drain-default-timeout_2026-09-28-15-08.json
new file mode 100644
index 0000000000..c0b81bc376
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/restart-drain-default-timeout_2026-09-28-15-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Do not apply the client-default queue timeout while a request that waits for rushd to restart for its environment waits for requests that were already running while no rushx script is running, and do not count that wait against it; the default still limits the wait while a rushx script runs and waiting for later requests, and an explicit --wait-timeout or --no-wait applies to the whole wait. A restart wait that times out names the time that did not count, and suggests stopping a rushx script that it waits for.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/restart-drain-queue-position_2026-09-28-14-20.json b/common/changes/@rushstack/rush-daemon/restart-drain-queue-position_2026-09-28-14-20.json
new file mode 100644
index 0000000000..7255dde156
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/restart-drain-queue-position_2026-09-28-14-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Report a request that waits for other requests to finish before rushd restarts for its environment as a queue position, so the client can say what it is waiting for.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 1747837712..c7ec3d5863 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -410,6 +410,7 @@ export interface IDaemonOperationRegisteredPayload {
 
 // @beta
 export interface IDaemonOperationStatusChangedPayload {
+    readonly logFilePath?: string;
     readonly operationId: string;
     readonly previousStatus?: string;
     readonly status: string;
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index d63c6d3ce7..87f260e61f 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -3,7 +3,10 @@
 
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from '@rushstack/rush-daemon-protocol';
+import {
+  DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR,
+  type IDaemonRequestAdmissionOptions
+} from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
 import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
@@ -29,8 +32,9 @@ const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
 /**
  * Executes on a ready client, retrying only for a typed pre-execution restart.
  * Preserves the original request, callbacks and unread input; never retries connection loss.
- * Restarts are retried with jittered backoff inside the request's admission deadline; once the
- * retries or the deadline are exhausted, a `fallback` outcome lets the caller run in-process instead.
+ * Restarts are retried with jittered backoff inside the request's explicit admission deadline, if any (a
+ * client-default timeout applies to each daemon separately); once the retries or the deadline are exhausted,
+ * a `fallback` outcome lets the caller run in-process instead.
  * The connection options must select the request's expected daemon and startup environment.
  * A connection lost before the result is reported as a `disconnected` error that says whether the daemon
  * process exited, what its launcher log recorded and how to recover, unless the request was aborted first.
@@ -46,7 +50,13 @@ export async function executeWithDaemonRestartAsync(
     execution.abortSignal && connection.abortSignal
       ? AbortSignal.any([execution.abortSignal, connection.abortSignal])
       : (execution.abortSignal ?? connection.abortSignal);
-  const waitTimeoutMs: number | undefined = execution.request.admission?.waitTimeoutMs;
+  const admission: IDaemonRequestAdmissionOptions | undefined = execution.request.admission;
+  // A client-default timeout applies to each daemon's own admission, not to following its restarts: a daemon
+  // restarts only after the requests it serves finish, which is progress, so each successor gets the original
+  // request. An explicit timeout is one deadline across restarts.
+  const waitTimeoutMs: number | undefined = admission?.waitTimeoutIsDefault
+    ? undefined
+    : admission?.waitTimeoutMs;
   let owner: IDaemonLockfile | undefined = await attestOwnerAsync(client, connection);
   let outcome: DaemonClientOutcome = await executeOnDaemonAsync(client, connection, {
     ...execution,
@@ -183,4 +193,4 @@ function abortedOutcome(execution: IDaemonClientExecuteOptions): DaemonClientOut
     kind: 'result',
     result: { requestId: execution.request.requestId, exitCode: 130, outcome: 'aborted', aborted: true }
   };
-}
\ No newline at end of file
+}
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 8d7d89b397..324e7b01be 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -841,6 +841,44 @@ describe('detached daemon startup', () => {
     expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
   });
 
+  it.each([
+    ['a client-default timeout, which each successor applies afresh', true],
+    ['not an explicit timeout', false]
+  ])('follows a restart that takes longer than %s', async (name, isDefault) => {
+    // The first daemon answers only after the timeout, like one that restarts after a long build.
+    fs.writeFileSync(path.join(folder, 'drain-ms'), '800');
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-once']
+      }
+    };
+    const client = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['build'],
+      commandName: 'build',
+      commandOrigin: 'built-in',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false },
+      admission: isDefault ? { waitTimeoutMs: 300, waitTimeoutIsDefault: true } : { waitTimeoutMs: 300 }
+    });
+    const outcome = await executeWithDaemonRestartAsync(client, connection, { request });
+    const starts: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+    const waits: string[] = fs.readFileSync(path.join(folder, 'waits'), 'utf8').trim().split('\n');
+    if (isDefault) {
+      expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(starts).toHaveLength(2);
+      expect(waits).toEqual(['300', '300']);
+      expect(fs.readFileSync(path.join(folder, 'default-waits'), 'utf8').trim().split('\n')).toHaveLength(2);
+    } else {
+      expect(outcome).toMatchObject({ kind: 'fallback', reason: 'restartRetriesExhausted' });
+      expect(starts).toHaveLength(1);
+      expect(waits).toEqual(['300']);
+    }
+  });
+
   it('refuses restart retry if ownership was not attested before submitting', async () => {
     const connection: IConnectOrStartDaemonOptions = {
       ...options,
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 6256888197..d4d05b7cab 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -83,6 +83,12 @@ async function mainAsync(): Promise<void> {
           if (message.payload.admission?.waitTimeoutMs !== undefined) {
             fs.appendFileSync(path.join(folder, 'waits'), `${message.payload.admission.waitTimeoutMs}\n`);
           }
+          if (message.payload.admission?.waitTimeoutIsDefault) {
+            fs.appendFileSync(
+              path.join(folder, 'default-waits'),
+              `${message.payload.admission.waitTimeoutMs}\n`
+            );
+          }
           const restartCount: number = fs.existsSync(path.join(folder, 'restarted'))
             ? fs.readFileSync(path.join(folder, 'restarted'), 'utf8').length
             : 0;
@@ -90,6 +96,11 @@ async function mainAsync(): Promise<void> {
             restartMode !== undefined &&
             (restartMode !== 'restart-once' || restartCount < 1) &&
             (restartMode !== 'restart-twice' || restartCount < 2);
+          const drainMsPath: string = path.join(folder, 'drain-ms');
+          if (restart && fs.existsSync(drainMsPath)) {
+            // Like a daemon that restarts only after the requests it serves finish.
+            await new Promise((resolve) => setTimeout(resolve, Number(fs.readFileSync(drainMsPath, 'utf8'))));
+          }
           await connection.sendFrameAsync({
             kind: DaemonFrameType.controlJson,
             payload: encodeDaemonControlMessage({
diff --git a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
index 9f700d26c7..261a5a8c7d 100644
--- a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
@@ -32,6 +32,11 @@ export interface IDaemonOperationStatusChangedPayload {
   readonly status: string;
   /** The previous raw engine status string, when known. */
   readonly previousStatus?: string;
+  /**
+   * The absolute path of the operation's full text log, when the operation failed or succeeded with
+   * warnings and wrote a log. Clients that summarize output print it so the full output can be read later.
+   */
+  readonly logFilePath?: string;
 }
 
 /**
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 6be5d0c380..2320840043 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -13,8 +13,10 @@ export interface IDaemonRequestAdmissionOptions {
   /** Fail immediately when the request cannot be admitted. */
   readonly noWait?: boolean;
   /**
-   * True when `waitTimeoutMs` is a client default rather than an explicit user choice. A default timeout bounds
-   * workspace admission only, not waiting behind running compatible shared builds.
+   * True when `waitTimeoutMs` is a client default rather than an explicit user choice. A default timeout applies
+   * to each daemon's workspace admission only: not to waiting behind running compatible shared builds, nor, when
+   * the daemon restarts for the request's environment, to waiting for the requests that it was already serving
+   * while it serves no rushx script.
    */
   readonly waitTimeoutIsDefault?: boolean;
   /** Maximum queue wait in milliseconds. Omission means no timeout. */
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 5b121b1c42..dc809142de 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -176,6 +176,17 @@ Successor startup reuses `connectOrStartDaemonAsync`: acknowledged old ownership
 resources finish, startup is serialized with ordinary clients, and hello/ping readiness attests a different PID.
 `restartCompleted` reports completion or failure.
 
+A request whose environment needs another process does not restart the daemon while it serves other requests. It
+first waits for the requests that this process is serving to finish (the restart drain), and its queue position is the
+number of those requests. Like the graph-execution gate, waiting for the requests that were already being served when
+the drain began is progress rather than contention: while one of them is still being served and no rushx script is, a
+client-default `waitTimeoutMs` (`waitTimeoutIsDefault`) does not limit the drain and is not spent, and the client
+sends the request to the successor with its default again. The default still limits the drain while a rushx script is
+served, since a script may not exit until it is stopped, and while it waits for requests that arrived during the
+drain, which could otherwise keep it waiting for as long as they keep arriving. An explicit `noWait` or
+`waitTimeoutMs` limits the whole drain, and only its remaining time carries over to the successor. When a drain times
+out, its message names the time that did not count.
+
 Protocol 0.10 (`DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR`) provides bounded, typed retry authorization.
 Only a pre-execution command result may carry `retryAfterRestart: true`. During a planned restart, accepted
 queued requests drain those typed results before disconnect rather than being reduced to ambiguous connection
@@ -475,9 +486,10 @@ build, still time out. Routing and executing an admitted request do not spend th
 such as the graph-execution gate apply the remaining budget they receive, and a request that re-enters workspace
 admission to reload the graph after its inputs changed starts again from the budget it had when it was admitted; time
 it spent at those boundaries is not charged again. The default and an explicit value differ only at the
-graph-execution gate. When the client marks `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), a `SHARED-BUILD`
-request that arrives after the current batch has closed waits there without a deadline, because it is queued only
-behind running compatible shared builds, and then runs in the next batch. An explicit value still limits that wait.
+graph-execution gate and at a restart drain (see "Process restart and isolated install/update"). When the client marks
+`waitTimeoutMs` as its default (`waitTimeoutIsDefault`), a `SHARED-BUILD` request that arrives after the current batch
+has closed waits at the graph-execution gate without a deadline, because it is queued only behind running compatible
+shared builds, and then runs in the next batch. An explicit value still limits that wait.
 Cancellation, disconnect, or queue-output failure removes queued work before it can execute.
 A requesting client receives only its enabled dependency closure's WS1 raw chunks and structured events through
 backpressured, ordered callbacks, followed exactly once by a typed final command result after all preceding output
diff --git a/libraries/rush-daemon/src/EngineTerminalProvider.ts b/libraries/rush-daemon/src/EngineTerminalProvider.ts
index cb13c5d782..403a5c51b8 100644
--- a/libraries/rush-daemon/src/EngineTerminalProvider.ts
+++ b/libraries/rush-daemon/src/EngineTerminalProvider.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import type { IOperationGraph, _IOperationGraphEventSink } from '@microsoft/rush-lib';
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
 
 import { getEngineActivityOptions } from './EngineActivityOptions';
@@ -22,13 +23,23 @@ export class EngineTerminalProvider implements ITerminalProvider {
 
   /**
    * Drains buffered diagnostics into the failure description, so that they belong to the failing request
-   * and are never replayed into a later request.
+   * and are never replayed into a later request. Like the request output, the description omits verbose and
+   * debug messages unless the graph runs in debug mode: loading a large workspace writes thousands of them.
    */
   public describeError(error: unknown): string {
-    return [
-      ...this.#messages.splice(0).map(({ text }) => text),
-      error instanceof Error ? error.message : String(error)
-    ].join('\n');
+    const lines: string[] = [];
+    let hasErrorLine: boolean = false;
+    for (const { text, severity } of this.#messages.splice(0)) {
+      const line: string = text.replace(/\r?\n$/, '');
+      if (this.#isHidden(severity) || !line.trim()) continue;
+      hasErrorLine ||= severity === TerminalProviderSeverity.error;
+      lines.push(line);
+    }
+    // An AlreadyReportedError only says "An error occurred."; the error lines written before it are the report.
+    if (!(hasErrorLine && error instanceof Error && error instanceof AlreadyReportedError)) {
+      lines.push(error instanceof Error ? error.message : String(error));
+    }
+    return lines.join('\n');
   }
 
   public get hasBufferedMessages(): boolean {
@@ -89,11 +100,15 @@ export class EngineTerminalProvider implements ITerminalProvider {
     );
   }
 
-  #emit(text: string, severity: TerminalProviderSeverity): void {
-    if (
+  #isHidden(severity: TerminalProviderSeverity): boolean {
+    return (
       !this.#graph?.debugMode &&
       (severity === TerminalProviderSeverity.verbose || severity === TerminalProviderSeverity.debug)
-    ) {
+    );
+  }
+
+  #emit(text: string, severity: TerminalProviderSeverity): void {
+    if (this.#isHidden(severity)) {
       return;
     }
     this.#graph?.eventSink?.onActivity?.(text, getEngineActivityOptions(severity));
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index 4a849617c8..e726b07ccb 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -14,7 +14,8 @@ import type {
   DaemonEventType,
   IDaemonActivityPayload,
   IDaemonEventEnvelope,
-  IDaemonEventScope
+  IDaemonEventScope,
+  IDaemonOperationStatusChangedPayload
 } from '@rushstack/rush-daemon-protocol';
 import { TerminalChunkKind } from '@rushstack/terminal';
 import type { ITerminalChunk } from '@rushstack/terminal';
@@ -186,11 +187,18 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
       executionResult: result,
       status: result.status
     });
-    this.#emitEvent('operationStatusChanged', {
+    // Summarizing clients (agent output) point at the full log of the operations that explain a failure.
+    const logFilePath: string | undefined =
+      result.status === OperationStatus.Failure || result.status === OperationStatus.SuccessWithWarning
+        ? result.logFilePaths?.text
+        : undefined;
+    const payload: IDaemonOperationStatusChangedPayload = {
       operationId,
       previousStatus,
-      status: result.status
-    });
+      status: result.status,
+      ...(logFilePath ? { logFilePath } : {})
+    };
+    this.#emitEvent('operationStatusChanged', payload);
   }
 
   public onOperationHeader(operationId: string): void {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 40e49c264e..c5bf80e37e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -390,17 +390,37 @@ export class RequestAdmissionController {
     }
   }
 
-  /** Waits, within the same admission budget, until a restart would not preempt another request. */
+  /**
+   * Waits until a restart would not preempt another request. The client is told how many requests it waits for,
+   * as a queue position, since a restart waits as long as their builds.
+   *
+   * @remarks
+   * Like the per-graph execution gate, waiting for the requests that this process was already serving when the wait
+   * began is progress rather than contention. A client-default timeout therefore does not apply while one of them is
+   * still being served and no rushx script is, and that time does not count against it. The default still limits
+   * the wait while a rushx script is served, since a script may not exit until it is stopped, and waiting for
+   * requests that arrived later, which could otherwise keep the request waiting for as long as they keep arriving.
+   * An explicit `noWait` or `waitTimeoutMs` applies to the whole wait, using the same absolute deadline as workspace
+   * admission.
+   */
   public async waitForRestartDrainAsync(
     arbiter: WorkspaceRestartArbiter,
     ticket: IWorkspaceRestartTicket
   ): Promise<void> {
-    // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
-    await arbiter.waitForDrainAsync(ticket, {
-      abortSignal: this.#abortController.signal,
-      noWait: this.#admission?.noWait,
-      waitTimeoutMs: this.#getRemainingWaitTimeoutMs()
-    });
+    const writer: QueuePositionWriter | undefined = this.#writer;
+    try {
+      // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
+      const waivedMs: number = await arbiter.waitForDrainAsync(ticket, {
+        abortSignal: this.#abortController.signal,
+        noWait: this.#admission?.noWait,
+        waitTimeoutMs: this.#getRemainingWaitTimeoutMs(),
+        waivesTimeoutForServedWork: this.#admission?.waitTimeoutIsDefault === true,
+        onServingCountChanged: writer ? (servingCount: number) => writer.enqueue(servingCount) : undefined
+      });
+      if (this.#deadlineMs !== undefined) this.#deadlineMs += waivedMs;
+    } finally {
+      await writer?.flushAsync();
+    }
   }
 
   public dispose(): void {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 9bc35cba8e..030ec677f2 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -216,8 +216,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       client,
       requestId: envelope.requestId
     });
-    // Long-lived observers are cancelled by a transition, so they never delay a restart.
-    const ticket: IWorkspaceRestartTicket | undefined = observer ? undefined : this.#restartArbiter.enter();
+    // Long-lived observers are cancelled by a transition, so they never delay a restart. A rushx script does delay
+    // one until it exits, so a client-default timeout still limits waiting for it.
+    const ticket: IWorkspaceRestartTicket | undefined = observer
+      ? undefined
+      : this.#restartArbiter.enter({ runsScript: isRushxInvocation(envelope) });
     let generation: IPreparedGeneration | undefined;
     try {
       for (let attempt: number = 0; ; attempt++) {
@@ -548,6 +551,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         workspaceLease.release();
         throw new PhasedCommandEngineBusyError();
       }
+      let selectionRejection: DaemonRequestDispatchError | undefined;
       try {
         const before: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
         let expectedFingerprint: IWorkspaceInputFingerprint = before;
@@ -590,11 +594,18 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         const replacementSession: IWorkspaceSession = await this.#options.provider.reloadAsync();
         validationContext.session = replacementSession;
         session = replacementSession;
-        await resolver.resolveRequestAsync({
-          envelope,
-          workspaceSession: session,
-          abortSignal: client.abortSignal
-        });
+        try {
+          await resolver.resolveRequestAsync({
+            envelope,
+            workspaceSession: session,
+            abortSignal: client.abortSignal
+          });
+        } catch (error) {
+          // An invalid selection (such as an unknown project) fails after the new graph was bound. Keep that
+          // generation, so that the next request does not load the whole workspace again.
+          if (!isSelectionRejection(error, session)) throw error;
+          selectionRejection = error;
+        }
         const after: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
         if (classifyWorkspaceInputChange(before, after) !== WorkspaceInputChangeTier.Reuse) {
           this.#forceReload = true;
@@ -621,6 +632,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         nativeLock.release();
         workspaceLease.release();
       }
+      if (selectionRejection) throw selectionRejection;
       this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
       return {
         session,
@@ -883,6 +895,18 @@ function getResolverLifecycle(resolver: IDaemonRequestResolver): IWorkspaceResol
   return resolver.workspaceLifecycle;
 }
 
+/** A request rejected as invalid after the resolver bound a graph to the session: its selection failed. */
+function isSelectionRejection(
+  error: unknown,
+  session: IWorkspaceSession
+): error is DaemonRequestDispatchError {
+  return (
+    error instanceof DaemonRequestDispatchError &&
+    error.code === 'invalidRequest' &&
+    session.operationGraph !== undefined
+  );
+}
+
 function isGraphWatch(envelope: IDaemonRequestEnvelope): boolean {
   return isGraphRequest(envelope) && envelope.argv[1] === 'graph' && envelope.argv[2] === 'watch';
 }
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index b1228eaca7..ee76274a88 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -4,15 +4,34 @@
 import { RequestSchedulerError, RequestSchedulerErrorCode } from './RequestScheduler';
 
 const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
+const SCRIPT_TIMEOUT_CLAUSE: string = ', including a rushx script that may not exit until it is stopped';
+// Waiting longer may not help behind a script, such as a dev server, that runs until it is stopped.
+const SCRIPT_TIMEOUT_REMEDY: string = 'Stop the script, or use --wait-timeout <seconds> to wait longer.';
+const TIMEOUT_REMEDY: string = 'Use --wait-timeout <seconds> to wait longer.';
+
+/** Names the waived time, since a drain that waived time times out that much later than the wait timeout. */
+function formatWaivedTime(waivedMs: number): string {
+  const seconds: number = Math.round(waivedMs / 100) / 10;
+  return seconds === 0
+    ? ''
+    : `; ${seconds}s spent waiting for requests that were already running did not count`;
+}
 
 /** One dispatched request tracked by a {@link WorkspaceRestartArbiter}. */
 export interface IWorkspaceRestartTicket {
   readonly waitingForDrain: boolean;
 }
 
+/** Options for {@link WorkspaceRestartArbiter.enter}. */
+export interface IWorkspaceRestartTicketOptions {
+  /** The request runs a rushx script, which can run until it is stopped (for example, a dev server). */
+  readonly runsScript?: boolean;
+}
+
 interface IMutableTicket {
   waitingForDrain: boolean;
   left: boolean;
+  readonly runsScript: boolean;
 }
 
 /** Options for {@link WorkspaceRestartArbiter.waitForDrainAsync}, supplied by request admission. */
@@ -20,6 +39,18 @@ export interface IWorkspaceRestartDrainOptions {
   readonly abortSignal: AbortSignal;
   readonly noWait: boolean | undefined;
   readonly waitTimeoutMs: number | undefined;
+  /**
+   * Do not spend `waitTimeoutMs` while a request that was already being served when the wait began is still being
+   * served and no rushx script is. The timeout then limits waiting while a rushx script is served, since a script
+   * may not exit until it is stopped, and waiting for requests that arrived later, which could otherwise keep the
+   * request waiting for as long as they keep arriving.
+   */
+  readonly waivesTimeoutForServedWork?: boolean;
+  /**
+   * Called while the request waits with the number of other requests that it waits for, when the wait begins and
+   * whenever that number changes, so that the client can report the wait as a queue position.
+   */
+  readonly onServingCountChanged?: (servingCount: number) => void;
 }
 
 /**
@@ -29,16 +60,21 @@ export interface IWorkspaceRestartDrainOptions {
  */
 export class WorkspaceRestartArbiter {
   readonly #listeners: Set<() => void> = new Set();
-  #servingCount: number = 0;
+  readonly #countListeners: Set<(servingCount: number) => void> = new Set();
+  readonly #serving: Set<IMutableTicket> = new Set();
 
   /** The number of tracked requests that are not waiting for a restart. */
   public get servingCount(): number {
-    return this.#servingCount;
+    return this.#serving.size;
   }
 
-  public enter(): IWorkspaceRestartTicket {
-    this.#servingCount++;
-    const ticket: IMutableTicket = { waitingForDrain: false, left: false };
+  public enter(options?: IWorkspaceRestartTicketOptions): IWorkspaceRestartTicket {
+    const ticket: IMutableTicket = {
+      waitingForDrain: false,
+      left: false,
+      runsScript: options?.runsScript === true
+    };
+    this.#serve(ticket);
     return ticket;
   }
 
@@ -46,47 +82,100 @@ export class WorkspaceRestartArbiter {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left) return;
     state.left = true;
-    if (!state.waitingForDrain) this.#decrement();
+    if (!state.waitingForDrain) this.#stopServing(state);
   }
 
   /**
    * Waits until no other tracked request is still being served by this process, then counts the ticket
-   * as served again so concurrent restart candidates proceed one at a time.
+   * as served again so concurrent restart candidates proceed one at a time. Returns how many milliseconds of the
+   * wait did not spend `waitTimeoutMs` (see {@link IWorkspaceRestartDrainOptions.waivesTimeoutForServedWork}).
    */
   public async waitForDrainAsync(
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions
-  ): Promise<void> {
+  ): Promise<number> {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left || state.waitingForDrain) throw new Error('The restart ticket is not being served.');
     state.waitingForDrain = true;
-    this.#decrement();
+    this.#stopServing(state);
+    const waivedFor: IMutableTicket[] = options.waivesTimeoutForServedWork ? Array.from(this.#serving) : [];
+    let remainingMs: number | undefined = options.waitTimeoutMs;
+    let waivedMs: number = 0;
+    let reported: number | undefined;
+    const report = (servingCount: number): void => {
+      if (servingCount > 0 && servingCount !== reported) {
+        reported = servingCount;
+        options.onServingCountChanged?.(servingCount);
+      }
+    };
     try {
-      const deadline: number | undefined =
-        options.waitTimeoutMs === undefined ? undefined : Date.now() + options.waitTimeoutMs;
-      while (this.#servingCount > 0) {
+      while (this.#serving.size > 0) {
         if (options.noWait) {
           throw new RequestSchedulerError(
             RequestSchedulerErrorCode.NoWait,
             'Another environment is still being served; the request did not wait for a restart.'
           );
         }
-        await this.#waitForChangeAsync(options.abortSignal, deadline);
+        report(this.#serving.size);
+        const waived: boolean =
+          !this.#isServingScript() && waivedFor.some((served: IMutableTicket) => this.#serving.has(served));
+        const startedAt: number = Date.now();
+        this.#countListeners.add(report);
+        try {
+          await this.#waitForChangeAsync(
+            options.abortSignal,
+            waived || remainingMs === undefined ? undefined : startedAt + remainingMs,
+            waivedMs
+          );
+        } finally {
+          this.#countListeners.delete(report);
+          const elapsedMs: number = Date.now() - startedAt;
+          if (waived) waivedMs += elapsedMs;
+          else if (remainingMs !== undefined) remainingMs -= elapsedMs;
+        }
       }
+      return waivedMs;
     } finally {
       state.waitingForDrain = false;
-      this.#servingCount++;
+      this.#serve(state);
     }
   }
 
-  #decrement(): void {
-    this.#servingCount--;
-    if (this.#servingCount === 0) {
-      for (const listener of Array.from(this.#listeners)) listener();
-    }
+  #serve(ticket: IMutableTicket): void {
+    this.#serving.add(ticket);
+    this.#notifyChange();
+  }
+
+  #stopServing(ticket: IMutableTicket): void {
+    this.#serving.delete(ticket);
+    this.#notifyChange();
+  }
+
+  /** Reports the new count, and wakes every waiting candidate to re-check what it waits for. */
+  #notifyChange(): void {
+    for (const listener of Array.from(this.#countListeners)) listener(this.#serving.size);
+    for (const listener of Array.from(this.#listeners)) listener();
   }
 
-  #waitForChangeAsync(abortSignal: AbortSignal, deadline: number | undefined): Promise<void> {
+  #isServingScript(): boolean {
+    return Array.from(this.#serving).some((served: IMutableTicket) => served.runsScript);
+  }
+
+  #createTimeoutError(waivedMs: number): RequestSchedulerError {
+    const script: boolean = this.#isServingScript();
+    return new RequestSchedulerError(
+      RequestSchedulerErrorCode.WaitTimeout,
+      'The request was not admitted before the daemon could restart for its environment, which waits for the ' +
+        `requests that the daemon is serving to finish${script ? SCRIPT_TIMEOUT_CLAUSE : ''}` +
+        `${formatWaivedTime(waivedMs)}. ${script ? SCRIPT_TIMEOUT_REMEDY : TIMEOUT_REMEDY}`
+    );
+  }
+
+  #waitForChangeAsync(
+    abortSignal: AbortSignal,
+    deadline: number | undefined,
+    waivedMs: number
+  ): Promise<void> {
     return new Promise<void>((resolve, reject) => {
       let timer: ReturnType<typeof setTimeout> | undefined;
       const unsubscribe: AbortController = new AbortController();
@@ -99,7 +188,10 @@ export class WorkspaceRestartArbiter {
       };
       const settleAborted = (): void =>
         settle(
-          new RequestSchedulerError(RequestSchedulerErrorCode.Aborted, 'The request was aborted before execution.')
+          new RequestSchedulerError(
+            RequestSchedulerErrorCode.Aborted,
+            'The request was aborted before execution.'
+          )
         );
       if (abortSignal.aborted) {
         settleAborted();
@@ -109,14 +201,7 @@ export class WorkspaceRestartArbiter {
       abortSignal.addEventListener('abort', settleAborted, { once: true, signal: unsubscribe.signal });
       if (deadline !== undefined) {
         timer = setTimeout(
-          () =>
-            settle(
-              new RequestSchedulerError(
-                RequestSchedulerErrorCode.WaitTimeout,
-                'The request was not admitted before the daemon could restart for its environment. ' +
-                  'Use --wait-timeout <seconds> to wait longer.'
-              )
-            ),
+          () => settle(this.#createTimeoutError(waivedMs)),
           Math.min(MAX_TIMER_DELAY_MS, Math.max(0, deadline - Date.now()))
         );
       }
diff --git a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
index 2c6fcbfdf7..549b8dd99c 100644
--- a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
+++ b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { TerminalProviderSeverity } from '@rushstack/terminal';
 
 import { EngineTerminalProvider } from '../EngineTerminalProvider';
@@ -41,6 +42,39 @@ describe(EngineTerminalProvider.name, () => {
     expect(terminal.hasBufferedMessages).toBe(false);
   });
 
+  it('describes a failure without the verbose and debug messages that loading a workspace writes', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('Incremental strategy: cache restoration\n', TerminalProviderSeverity.verbose);
+    for (let index: number = 0; index < 1000; index++) {
+      terminal.write(
+        `Configuration file "p${index}/config/rush-project.json" not found.\n`,
+        TerminalProviderSeverity.debug
+      );
+    }
+    terminal.write('\n', TerminalProviderSeverity.log);
+    terminal.write('Project "a" has no "build" script.\n', TerminalProviderSeverity.warning);
+    expect(terminal.describeError(new Error('selection failed'))).toBe(
+      'Project "a" has no "build" script.\nselection failed'
+    );
+  });
+
+  it('describes an already reported error by the error lines written before it', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    terminal.write('Incremental strategy: cache restoration\n', TerminalProviderSeverity.verbose);
+    terminal.write(
+      'The project name "@x/nope" passed to "--to" does not exist in rush.json.\n',
+      TerminalProviderSeverity.error
+    );
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(
+      'The project name "@x/nope" passed to "--to" does not exist in rush.json.'
+    );
+
+    terminal.write('No error line was written.\n', TerminalProviderSeverity.warning);
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(
+      'No error line was written.\nAn error occurred.'
+    );
+  });
+
   it('drops diagnostics when the engine must be recreated', async () => {
     const terminal: EngineTerminalProvider = new EngineTerminalProvider();
     const recreate: WorkspaceEngineRecreationRequiredError = new WorkspaceEngineRecreationRequiredError();
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
index bb2bcb191d..78c41e666a 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
@@ -93,4 +93,44 @@ it('does not report settlement when an active operation was aborted', () => {
   sink.onOperationCompleted(createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Success));
 
   expect(onSettled).not.toHaveBeenCalled();
-});
\ No newline at end of file
+});
+it('points at the full log of failed operations and operations with warnings, and only those', async () => {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const sink: PhasedRequestEventSink = createSink(client);
+  const logFilePaths = { text: '/repo/project-a/rush-logs/project-a._phase_test.log' };
+  for (const status of [
+    OperationStatus.Executing,
+    OperationStatus.Failure,
+    OperationStatus.SuccessWithWarning,
+    OperationStatus.Success
+  ]) {
+    const record: IOperationExecutionResult = {
+      ...createRecord(ACTIVE_OPERATION, status),
+      logFilePaths
+    } as unknown as IOperationExecutionResult;
+    sink.onOperationStatusChanged(record, OperationStatus.Ready);
+  }
+
+  await sink.flushAsync();
+
+  const payloads: unknown[] = client.writes
+    .map(({ event }) => event)
+    .filter((event) => event?.type === 'operationStatusChanged')
+    .map((event) => event?.payload);
+  expect(payloads).toEqual([
+    { operationId: ACTIVE_OPERATION, previousStatus: 'READY', status: 'EXECUTING' },
+    {
+      operationId: ACTIVE_OPERATION,
+      previousStatus: 'READY',
+      status: 'FAILURE',
+      logFilePath: logFilePaths.text
+    },
+    {
+      operationId: ACTIVE_OPERATION,
+      previousStatus: 'READY',
+      status: 'SUCCESS WITH WARNINGS',
+      logFilePath: logFilePaths.text
+    },
+    { operationId: ACTIVE_OPERATION, previousStatus: 'READY', status: 'SUCCESS' }
+  ]);
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 0667da53eb..b4fb7b3e08 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -460,6 +460,33 @@ describe('native production daemon engine', () => {
     expect(events.at(-1)).toBe('disposed:2');
   });
 
+  it('rejects an unknown project with only the error line and keeps the graph it loaded for later requests', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      const rejection: { kind: string; payload: { code: string; message: string } } = {
+        kind: 'requestRejected',
+        payload: {
+          code: 'invalidRequest',
+          message: 'The project name "nope" passed to "--to" does not exist in rush.json.'
+        }
+      };
+      expect((await runAsync(fixture, 'cold', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      const session: WorkspaceSession = fixture.session;
+      const graph: IOperationGraph | undefined = session.operationGraph;
+      expect(graph).toBeDefined();
+      expect((await runAsync(fixture, 'again', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      expect((await runAsync(fixture, 'valid', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect(fixture.session).toBe(session);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('keeps tier0 session and graph identity for unchanged content, including metadata touches', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
diff --git a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
new file mode 100644
index 0000000000..a91e129d94
--- /dev/null
+++ b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
@@ -0,0 +1,131 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import {
+  WorkspaceRestartArbiter,
+  type IWorkspaceRestartTicket,
+  type IWorkspaceRestartTicketOptions
+} from '../WorkspaceRestartArbiter';
+
+interface IDrainTest {
+  readonly admission: RequestAdmissionController;
+  readonly arbiter: WorkspaceRestartArbiter;
+  readonly serving: IWorkspaceRestartTicket;
+  readonly ticket: IWorkspaceRestartTicket;
+}
+
+/** A restart candidate with the given admission options, and one other request that the daemon is serving. */
+function createDrainTest(
+  options: IDaemonRequestAdmissionOptions,
+  servingOptions?: IWorkspaceRestartTicketOptions
+): IDrainTest {
+  const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+  const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
+  const ticket: IWorkspaceRestartTicket = arbiter.enter();
+  const admission: RequestAdmissionController = new RequestAdmissionController({
+    admission: options,
+    client: { abortSignal: new AbortController().signal },
+    requestId: 'restart-candidate'
+  });
+  return { admission, arbiter, serving, ticket };
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  void promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await new Promise((resolve) => setImmediate(resolve));
+  return settled;
+}
+
+describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
+  it('waits past a client-default timeout, and the wait does not count against it', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({
+      waitTimeoutMs: 50,
+      waitTimeoutIsDefault: true
+    });
+    const draining: Promise<void> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    await delayAsync(250);
+    expect(await isSettledAsync(draining)).toBe(false);
+    arbiter.leave(serving);
+    await draining;
+    // The later admission steps keep what was left of the default when the drain began.
+    expect(admission.remainingAdmission).toMatchObject({ waitTimeoutIsDefault: true });
+    expect(admission.remainingAdmission?.waitTimeoutMs).toBeGreaterThan(0);
+    arbiter.leave(ticket);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('still applies a client-default timeout while it waits for a rushx script, and says why', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest(
+      { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
+      { runsScript: true }
+    );
+    const error: unknown = await admission
+      .waitForRestartDrainAsync(arbiter, ticket)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).toContain(
+      'including a rushx script that may not exit until it is stopped'
+    );
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('applies a client-default timeout to requests that arrive during the drain, once earlier ones finish', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({
+      waitTimeoutMs: 50,
+      waitTimeoutIsDefault: true
+    });
+    const draining: Promise<void> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    const late: IWorkspaceRestartTicket = arbiter.enter();
+    await delayAsync(150);
+    expect(await isSettledAsync(draining)).toBe(false);
+    arbiter.leave(serving);
+    const error: unknown = await draining.catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    arbiter.leave(ticket);
+    arbiter.leave(late);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('applies an explicit timeout to the drain, and suggests only --wait-timeout', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 50 });
+    const error: unknown = await admission
+      .waitForRestartDrainAsync(arbiter, ticket)
+      .catch((caught: unknown) => caught);
+    expect(error).toBeInstanceOf(RequestSchedulerError);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    // Setting the environment variable instead would itself restart the daemon.
+    expect((error as Error).message).toContain('--wait-timeout <seconds>');
+    expect((error as Error).message).not.toContain('RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS');
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('applies no-wait to the drain', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ noWait: true });
+    const error: unknown = await admission
+      .waitForRestartDrainAsync(arbiter, ticket)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
index 8ee1001739..10a86e2314 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
@@ -1,8 +1,14 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
 import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
-import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from '../WorkspaceRestartArbiter';
+import {
+  WorkspaceRestartArbiter,
+  type IWorkspaceRestartDrainOptions,
+  type IWorkspaceRestartTicket
+} from '../WorkspaceRestartArbiter';
 
 const WAIT: { abortSignal: AbortSignal; noWait: undefined; waitTimeoutMs: undefined } = {
   abortSignal: new AbortController().signal,
@@ -35,8 +41,8 @@ describe(WorkspaceRestartArbiter.name, () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const first: IWorkspaceRestartTicket = arbiter.enter();
     const second: IWorkspaceRestartTicket = arbiter.enter();
-    const firstWait: Promise<void> = arbiter.waitForDrainAsync(first, WAIT);
-    const secondWait: Promise<void> = arbiter.waitForDrainAsync(second, WAIT);
+    const firstWait: Promise<number> = arbiter.waitForDrainAsync(first, WAIT);
+    const secondWait: Promise<number> = arbiter.waitForDrainAsync(second, WAIT);
     const late: IWorkspaceRestartTicket = arbiter.enter();
     arbiter.leave(serving);
     expect(await isSettledAsync(firstWait)).toBe(false);
@@ -58,7 +64,7 @@ describe(WorkspaceRestartArbiter.name, () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const ticket: IWorkspaceRestartTicket = arbiter.enter();
     const abort: AbortController = new AbortController();
-    const waiting: Promise<void> = arbiter.waitForDrainAsync(ticket, {
+    const waiting: Promise<number> = arbiter.waitForDrainAsync(ticket, {
       abortSignal: abort.signal,
       noWait: mode === 'no-wait' ? true : undefined,
       waitTimeoutMs: mode === 'timeout' ? 10 : undefined
@@ -72,4 +78,186 @@ describe(WorkspaceRestartArbiter.name, () => {
     arbiter.leave(serving);
     expect(arbiter.servingCount).toBe(0);
   });
-});
\ No newline at end of file
+
+  it('reports how many requests a restart candidate waits for, whenever that number changes', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const first: IWorkspaceRestartTicket = arbiter.enter();
+    const second: IWorkspaceRestartTicket = arbiter.enter();
+    const candidate: IWorkspaceRestartTicket = arbiter.enter();
+    const counts: number[] = [];
+    const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, {
+      ...WAIT,
+      onServingCountChanged: (count: number) => counts.push(count)
+    });
+    expect(counts).toEqual([2]);
+    const late: IWorkspaceRestartTicket = arbiter.enter();
+    arbiter.leave(first);
+    arbiter.leave(second);
+    expect(counts).toEqual([2, 3, 2, 1]);
+    // Another restart candidate stops counting once it waits too; it then waits for the first candidate.
+    const other: IWorkspaceRestartTicket = arbiter.enter();
+    const otherCounts: number[] = [];
+    const otherWaiting: Promise<number> = arbiter.waitForDrainAsync(other, {
+      ...WAIT,
+      onServingCountChanged: (count: number) => otherCounts.push(count)
+    });
+    arbiter.leave(late);
+    await waiting;
+    expect(counts).toEqual([2, 3, 2, 1, 2, 1]);
+    expect(await isSettledAsync(otherWaiting)).toBe(false);
+    expect(otherCounts).toEqual([1]);
+    arbiter.leave(candidate);
+    await otherWaiting;
+    arbiter.leave(other);
+    expect(counts).toHaveLength(6);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it('reports no count for a candidate that does not wait', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const counts: number[] = [];
+    await arbiter.waitForDrainAsync(ticket, {
+      ...WAIT,
+      onServingCountChanged: (count: number) => counts.push(count)
+    });
+    const serving: IWorkspaceRestartTicket = arbiter.enter();
+    const noWait: IWorkspaceRestartTicket = arbiter.enter();
+    const error: unknown = await arbiter
+      .waitForDrainAsync(noWait, {
+        ...WAIT,
+        noWait: true,
+        onServingCountChanged: (count: number) => counts.push(count)
+      })
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    expect(counts).toEqual([]);
+    for (const served of [ticket, serving, noWait]) arbiter.leave(served);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  describe('with waivesTimeoutForServedWork', () => {
+    const WAIVED: IWorkspaceRestartDrainOptions = {
+      ...WAIT,
+      waitTimeoutMs: 50,
+      waivesTimeoutForServedWork: true
+    };
+
+    function expectWaitTimeout(error: unknown): RequestSchedulerError {
+      expect(error).toBeInstanceOf(RequestSchedulerError);
+      expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+      return error as RequestSchedulerError;
+    }
+
+    it('does not spend the timeout on requests served when the wait began, and returns that time', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      expect(await waiting).toBeGreaterThanOrEqual(140);
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout on requests that arrived after the wait began, once the earlier ones finish', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      const late: IWorkspaceRestartTicket = arbiter.enter();
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      const error: RequestSchedulerError = expectWaitTimeout(
+        await waiting.catch((caught: unknown) => caught)
+      );
+      expect(error.message).not.toContain('rushx');
+      expect(error.message).toMatch(
+        /to finish; \d+(\.\d)?s spent waiting for requests that were already running did not count\. Use --wait-timeout <seconds> to wait longer\.$/
+      );
+      for (const served of [candidate, late]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout on a rushx script, and says that the script may not exit', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const error: RequestSchedulerError = expectWaitTimeout(
+        await arbiter.waitForDrainAsync(candidate, WAIVED).catch((caught: unknown) => caught)
+      );
+      expect(error.message).toContain(
+        ', including a rushx script that may not exit until it is stopped. Stop the script, or use --wait-timeout'
+      );
+      for (const served of [candidate, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout while a rushx script is served, even next to an earlier build', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const outcome: Promise<unknown> = arbiter
+        .waitForDrainAsync(candidate, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(true);
+      expect(expectWaitTimeout(await outcome).message).toContain('including a rushx script');
+      for (const served of [candidate, earlier, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('stops spending the timeout when the rushx script exits while an earlier build is served', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      arbiter.leave(script);
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      expect(await waiting).toBeGreaterThanOrEqual(140);
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('spends the timeout once a rushx script arrives during the wait', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const outcome: Promise<unknown> = arbiter
+        .waitForDrainAsync(candidate, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(100);
+      expect(await isSettledAsync(outcome)).toBe(false);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(true);
+      expect(expectWaitTimeout(await outcome).message).toMatch(
+        /, including a rushx script that may not exit until it is stopped; \d+(\.\d)?s spent waiting for requests that were already running did not count\. Stop the script, or use --wait-timeout/
+      );
+      for (const served of [candidate, earlier, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('returns 0 when the timeout is not waived', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, {
+        ...WAIT,
+        waitTimeoutMs: 5_000
+      });
+      await delayAsync(20);
+      arbiter.leave(earlier);
+      expect(await waiting).toBe(0);
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
index 557c54ddc5..ade38105f6 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
@@ -6,6 +6,8 @@ import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import { DaemonFrameType, decodeDaemonControlMessage } from '@rushstack/rush-daemon-protocol';
+import type { DaemonControlMessage, IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
@@ -15,6 +17,15 @@ import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 
 jest.setTimeout(60_000);
 
+function getQueuePositions(exchange: ITerminalExchange): number[] {
+  return exchange.frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .flatMap((message: DaemonControlMessage) =>
+      message.kind === 'queuePosition' ? [message.payload.position] : []
+    );
+}
+
 it('queues a mismatched-environment restart until matching queued and in-flight requests drain', async () => {
   const fixture = await DaemonGraphTestFixture.createAsync((created) => {
     setDaemonPolicy(created, {});
@@ -64,6 +75,10 @@ it('queues a mismatched-environment restart until matching queued and in-flight
       payload: { exitCode: 1, retryAfterRestart: true }
     });
     expect(order[order.length - 1]).toBe('mismatched');
+    // The client is told how many requests the restart waits for: 2 while both matching requests are open, then 1.
+    const positions: number[] = getQueuePositions(restart);
+    expect(positions).toContain(2);
+    expect(positions[positions.length - 1]).toBe(1);
 
     const restarted = await fixture.host.restartCompleted;
     expect(restarted?.pid).not.toBe(before.pid);

From 96a7e496dd0e4da49d0e9ed7bd56a882cf6f2375 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 21:00:00 +0000
Subject: [PATCH 037/265] [rush-cli-client] Report failed operations as they
 fail in agent output

Swarm integration step 22; original commit 6bc6dd8f83 (merge of swarm/r04-t108-a81 at 14faa4e5be).
Scope: task 108.

Brings task 108 items 1 and 3 onto task 83: agent output prints a failed operation's first diagnostics as soon as that operation finishes, no `running` line before 10 s for quick requests, and each TypeScript error once (t07 board 1930: L4 17 of 41 on 4d1a045fca against 24 of 41 on s11; 38 of 41 with items 1 and 3 on their old base, board 1692).

Gate: ch01 GATE OK board 1980 (tree 9079647277)

Commits folded into this step (1):
- 14faa4e5be Report failed operations as they fail in agent output (task 108 items 1 and 3)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  42 ++--
 .../src/AgentOperationTracker.ts              |  17 +-
 .../src/AgentProgressRenderer.ts              | 196 ++++++++++------
 .../src/OperationOutputExcerpt.ts             |  63 ++++-
 .../src/test/AgentProgressRenderer.test.ts    | 216 +++++++++++++-----
 .../src/test/OperationOutputExcerpt.test.ts   |  49 +++-
 ...-t108-early-failures_2026-09-28-18-14.json |  10 +
 7 files changed, 420 insertions(+), 173 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t108-early-failures_2026-09-28-18-14.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 790c03a04d..3a2bd0f840 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -114,13 +114,17 @@ agent mode writes nothing ahead of it. Otherwise, selection precedence is:
 3. Otherwise `legacy`: the unchanged collated operation stream.
 
 Agent mode is plain text for humans and agents, not the AI reporter's JSON record format;
-use `--reporter=ai` for machine-parsed records. It writes a first status line before
-`@microsoft/rush-lib` is loaded, then at most three live rows on a TTY. On a pipe it writes
-at most three progress lines in total, however many operations run and however long they
-take: a wait for a daemon that is still starting (`rushd is still starting; waiting for it (up to 15s more)`),
-the start, the first wait for admission (`queued behind another request (position N)`),
-the start of execution, and the first failure, in that order until three were written. It
-always ends with one summary line, for example
+use `--reporter=ai` for machine-parsed records. On a TTY it paints at most three live rows, the
+first before `@microsoft/rush-lib` is loaded. On a pipe it writes one progress line when the
+daemon has the request (`rush build · 0.1s · sent to rushd; preparing the workspace graph
+(status at least every 25s)`), however many operations run. A longer request also gets status
+lines, so that it does not look hung: one whenever nothing was written for 25 s, with the counts
+and the running operations, and one when connecting to the daemon takes more than 10 s. A
+wait for a daemon that is still starting gets a line of its own
+(`rushd is still starting; waiting for it (up to 15s more)`). A
+request that waited for admission says so at the end of its summary line
+(`· queued behind another request (position 1 at 0.2s)`). It always ends with one summary
+line, for example
 `rush build: SUCCESS 772/772 operations (12 success, 760 from cache) in 3.1s`, or
 `up to date (no operations needed)`, or, when the selection parameters matched no projects,
 `rush build: SUCCESS 0 operations in 0.5s · the selection parameters did not match any projects`.
@@ -133,16 +137,20 @@ daemon did not admit the request in time, or at once with `--no-wait`, the reaso
 line starts with `daemon admission failed (wait-timeout)` or `daemon admission failed (no-wait)`,
 as in legacy output, followed by the daemon's reason in full. Warnings and errors that Rush or a
 Rush plugin writes outside any operation (for example a plugin that continues without the cloud
-build cache) precede the summary line, and any failure report, at most three lines of them.
-
-When the request fails, a report comes before the summary line. It covers up to three failed
-operations, or, if none failed, the operations whose warnings failed the request. Each one gets a
-`failed: <operation> · full log: <path>` line (`warnings: …` for warnings) and a short excerpt
-of its output: error lines with the line that follows them first, then the last lines. Stack
-frames, `Require stack:` lists and progress noise are left out. The summary line names up to five
-failed (or warning) operations. Every operation's full output is in its project's `rush-logs/`
-folder, whether or not it was printed. When a request falls back to in-process Rush, agent mode
-stops and native output follows.
+build cache) are written at the end, at most three lines of them, before the summary line and any
+operations reported with it.
+
+A failed operation is reported as soon as it fails, while the rest of the request runs on: a
+`failed: <operation> · full log: <path>` line and a short excerpt of its output, error lines
+with the line that follows them first, then the last lines. Stack frames, `Require stack:` lists
+and progress noise are left out, and so are a message that a tool repeats in its summary, an
+error count that the shown errors account for, and, when the first error shown names a source
+location, the lines before it. Up to three operations are reported. Two kinds are reported just
+before the summary line instead: a failed operation that wrote no output, with the error from the
+daemon's result, and, when no operation failed, the operations whose warnings failed the request
+(`warnings: …`). The summary line names up to five failed (or warning) operations. Every
+operation's full output is in its project's `rush-logs/` folder, whether or not it was printed.
+When a request falls back to in-process Rush, agent mode stops and native output follows.
 
 Positively identified built-in `install` and `update` follow the same opt-in routing
 precedence as workspace builds and require protocol **0.10**
diff --git a/apps/rush-cli-client/src/AgentOperationTracker.ts b/apps/rush-cli-client/src/AgentOperationTracker.ts
index e2381da3b4..93fae6c77c 100644
--- a/apps/rush-cli-client/src/AgentOperationTracker.ts
+++ b/apps/rush-cli-client/src/AgentOperationTracker.ts
@@ -132,19 +132,18 @@ export class AgentOperationTracker {
     this.#headerTotal = Math.max(this.#headerTotal, total);
   }
 
-  /** Applies a status change. Returns true when it is the request's first failure. */
-  public updateStatus(update: IAgentOperationStatusUpdate): boolean {
+  /** Applies a status change. */
+  public updateStatus(update: IAgentOperationStatusUpdate): void {
     const { operationId, status } = update;
     if (this.#silent.has(operationId)) {
       if (status !== FAILURE) {
-        return false;
+        return;
       }
       // Failed operations are reported even if silent, as in the native summary.
       this.register(operationId, false);
     }
     // An operation that was never registered still counts, so `done` never exceeds `total`.
     this.#registered.add(operationId);
-    const firstFailure: boolean = status === FAILURE && this.#failed.size === 0;
     const previous: string | undefined = this.#statuses.get(operationId);
     this.#statuses.set(operationId, status);
     if (previous !== undefined && TERMINAL_STATUSES.has(previous)) {
@@ -161,7 +160,6 @@ export class AgentOperationTracker {
     if (TERMINAL_STATUSES.has(status)) {
       this.#onTerminalStatus(update);
     }
-    return firstFailure;
   }
 
   /**
@@ -216,12 +214,17 @@ export class AgentOperationTracker {
    */
   public getProblemOperations(): ReadonlyArray<IAgentProblemOperation> {
     const operationIds: ReadonlyArray<string> = this.#failed.size ? this.failed : this.warned;
-    return operationIds.map((operationId) => ({
+    return operationIds.map((operationId) => this.getProblemOperation(operationId));
+  }
+
+  /** An operation's log file, output excerpt and error, to report it. */
+  public getProblemOperation(operationId: string): IAgentProblemOperation {
+    return {
       operationId,
       logFilePath: this.#logFilePaths.get(operationId),
       excerpt: this.#excerpts.get(operationId),
       errorMessage: this.#errorMessages.get(operationId)
-    }));
+    };
   }
 
   #isProblemStatus(status: string): boolean {
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 6195aac9f9..2f3dc95820 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -15,17 +15,20 @@ import {
 import { clipLine } from './OperationOutputExcerpt';
 
 const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-/** On a pipe, the most milestone lines written before the summary, however long the request runs. */
-const MAX_PIPE_PROGRESS_LINES: number = 3;
-/** On a pipe, how long the first line waits for the connection, so that a fast connect costs one line, not two. */
-const PIPE_FIRST_LINE_DELAY_MS: number = 1000;
+/**
+ * On a pipe, the connecting line is written only when the connection takes longer than this. Like a status line,
+ * it is never written in the first 10 s, so a connection that is fast, or a daemon that starts within that time,
+ * costs no line.
+ */
+const PIPE_CONNECTING_LINE_DELAY_MS: number = 10_000;
 /**
  * On a pipe, a status line is written whenever nothing was written for this long, so that a reader can tell a slow
- * request from a hung one. Agent shells return partial output after 30 s. These lines are not milestones.
+ * request from a hung one. Agent shells return partial output after 30 s. A request that ends sooner writes none.
  */
 const PIPE_STATUS_INTERVAL_MS: number = 25_000;
 const SENT_PHASE: string = 'sent to rushd; preparing the workspace graph';
 const STARTING_PHASE: string = 'rushd is still starting; waiting for it';
+const FAILURE_STATUS: string = 'FAILURE';
 const TTY_INTERVAL_MS: number = 100;
 /** The most failed (or warning) operations whose output excerpt is printed. */
 const MAX_REPORTED_OPERATIONS: number = 3;
@@ -52,9 +55,14 @@ const STATUS_LABELS: ReadonlyMap<string, string> = new Map([
   ['NO OP', 'up to date']
 ]);
 
-type PipeMilestone = 'starting' | 'sent' | 'queued' | 'running' | 'failure';
 type Verdict = 'SUCCESS' | 'FAILURE' | 'CANCELLED';
 
+/** A queue position that the daemon reported, and when. */
+interface IQueuePosition {
+  readonly position: number;
+  readonly elapsed: string;
+}
+
 export interface IAgentProgressRendererOptions {
   readonly commandName: string;
   readonly isTTY: boolean;
@@ -93,36 +101,40 @@ function getErrorDetail(lines: ReadonlyArray<string>): string[] {
 }
 
 /**
- * Compact progress for agents on the daemon path: an immediate first line, at most three live rows (TTY) or
- * at most three progress lines in total (pipes), and a guaranteed one-line summary, even when no
- * operation ran. On failure, the summary is preceded by each failed operation's log file and a short
- * excerpt of its output.
+ * Compact progress for agents on the daemon path: at most three live rows (TTY) or one line when the request is
+ * sent (pipes), each failed operation's log file and a short excerpt of its output as soon as it fails, and a
+ * guaranteed one-line summary, even when no operation ran.
  *
  * @remarks
- * On a pipe, a line is written at a milestone: when the client waits for a daemon that is still starting, when the
- * request is sent to the daemon, the first time it waits for admission, the start of execution, and the first
- * failure; once three lines were written, later milestones are left to the summary. A connection that takes
- * longer than a second gets a line of its own first, unless a milestone came first. Whenever
- * nothing was written for 25 s, a status line with the counts and the running operations follows, so a reader
- * never sees more than 25 s of silence, and a request shorter than that costs no status lines at all.
+ * On a pipe, a request that takes less than 25 s writes the line that says it was sent, its failures and its
+ * summary line, and nothing else. Status lines keep a longer request from looking hung: whenever nothing was
+ * written for 25 s, a status line with the counts and the running operations follows, and a connection that
+ * takes longer than 10 s gets one. A wait for a daemon that is still starting also gets a line, once. Only the
+ * first three failed operations are reported. Whether warnings fail the request is only known at its end, so
+ * operations with warnings are reported before the summary line; so is a failed operation that wrote no output,
+ * whose error only the daemon's result carries.
  */
 export class AgentProgressRenderer {
   readonly #options: IAgentProgressRendererOptions;
   readonly #now: () => number;
   readonly #startTimeMs: number;
   readonly #tracker: AgentOperationTracker = new AgentOperationTracker();
-  readonly #milestones: Set<PipeMilestone> = new Set();
   readonly #notices: AgentNotices = new AgentNotices();
+  /** The operations whose log file and excerpt were written, in that order. */
+  readonly #reported: Set<string> = new Set();
   #lastActivity: string = '';
   #phase: string = 'connecting to rushd (auto-starts if needed)';
   #painted: number = 0;
   #frame: number = 0;
-  #pipeLines: number = 0;
+  #startingLineWritten: boolean = false;
+  #sentLineWritten: boolean = false;
   #timer: ReturnType<typeof setInterval> | undefined;
-  #firstLineTimer: ReturnType<typeof setTimeout> | undefined;
+  #connectingTimer: ReturnType<typeof setTimeout> | undefined;
   #statusTimer: ReturnType<typeof setTimeout> | undefined;
-  /** The last queue position and when it was reported, until operations start. */
-  #queued: { readonly position: number; readonly elapsed: string } | undefined;
+  /** The last queue position, until operations start. */
+  #queued: IQueuePosition | undefined;
+  /** The first queue position, for the summary line. */
+  #firstQueued: IQueuePosition | undefined;
   #stopped: boolean = false;
   /** The error message that the summary line contains in full, once written. */
   #reportedErrorMessage: string | undefined;
@@ -134,13 +146,16 @@ export class AgentProgressRenderer {
   }
 
   /**
-   * On a TTY, paints the first line and starts the spinner. On a pipe, writes the first line after a second
-   * unless another line came first, and starts the status lines.
+   * On a TTY, paints the first line and starts the spinner. On a pipe, starts the status lines, and writes the
+   * connecting line after 10 s unless the request was sent by then.
    */
   public start(): void {
     if (!this.#options.isTTY) {
-      this.#firstLineTimer = setTimeout(() => this.#writePipeLine(this.#rows()[0]), PIPE_FIRST_LINE_DELAY_MS);
-      this.#firstLineTimer.unref?.();
+      this.#connectingTimer = setTimeout(
+        () => this.#writePipeLine(this.#rows()[0]),
+        PIPE_CONNECTING_LINE_DELAY_MS
+      );
+      this.#connectingTimer.unref?.();
       this.#scheduleStatusLine();
       return;
     }
@@ -161,23 +176,34 @@ export class AgentProgressRenderer {
 
   /**
    * The daemon is not ready yet, but a live process can still make it ready, so the client waits up to `waitMs`
-   * more for it instead of running Rush in-process. On a pipe, says so once.
+   * more for it instead of running Rush in-process. On a pipe, says so once; the connecting line is then not due.
    */
   public onAwaitStartup(waitMs: number): void {
     this.setPhase(STARTING_PHASE);
-    this.#writeMilestone('starting', ` (up to ${Math.round(waitMs / 1000)}s more)`);
+    clearTimeout(this.#connectingTimer);
+    this.#connectingTimer = undefined;
+    if (!this.#options.isTTY && !this.#stopped && !this.#startingLineWritten) {
+      this.#startingLineWritten = true;
+      this.#writePipeLine(`${this.#rows()[0]} (up to ${Math.round(waitMs / 1000)}s more)`);
+    }
   }
 
-  /** The daemon has the request. On a pipe, says so, and that the next line can take a while. */
+  /** The daemon has the request. On a pipe, says so once, and that the next line can take a while. */
   public onRequestSent(): void {
     this.setPhase(SENT_PHASE);
-    this.#writeMilestone('sent', ` (status at least every ${PIPE_STATUS_INTERVAL_MS / 1000}s)`);
+    clearTimeout(this.#connectingTimer);
+    this.#connectingTimer = undefined;
+    if (!this.#options.isTTY && !this.#stopped && !this.#sentLineWritten) {
+      this.#sentLineWritten = true;
+      this.#writePipeLine(`${this.#rows()[0]} (status at least every ${PIPE_STATUS_INTERVAL_MS / 1000}s)`);
+    }
   }
 
+  /** The request waits for admission. The status lines and the summary line say so. */
   public onQueuePosition(position: number): void {
     this.#queued = { position, elapsed: this.#elapsed() };
+    this.#firstQueued ??= this.#queued;
     this.setPhase(`queued behind another request (position ${position})`);
-    this.#writeMilestone('queued');
   }
 
   public onEvent(event: IDaemonEventEnvelope): void {
@@ -259,6 +285,11 @@ export class AgentProgressRenderer {
     const emptySelection: boolean =
       verdict === 'SUCCESS' && result?.operationResults?.length === 0 && !this.#tracker.hasOperations;
     let summary: string = this.#getSummaryLine(verdict, emptySelection);
+    // An admission failure says that the request waited, and why it stopped waiting.
+    if (this.#firstQueued && !result?.admissionErrorCode) {
+      const { position, elapsed } = this.#firstQueued;
+      summary += ` · queued behind another request (position ${position} at ${elapsed})`;
+    }
     if (errorMessage) {
       const [firstLine, ...detail] = errorMessage.split('\n').filter((line) => line.trim());
       const admissionErrorCode: string | undefined =
@@ -289,16 +320,39 @@ export class AgentProgressRenderer {
     if (typeof operationId !== 'string' || typeof status !== 'string') {
       return;
     }
-    const firstFailure: boolean = this.#tracker.updateStatus({
+    this.#tracker.updateStatus({
       operationId,
       status,
       logFilePath: typeof logFilePath === 'string' ? logFilePath : undefined
     });
     this.#phase = 'running';
     this.#queued = undefined;
-    this.#writeMilestone('running');
-    if (firstFailure) {
-      this.#writeMilestone('failure', ` · first failure: ${operationId}`);
+    if (status === FAILURE_STATUS) {
+      this.#reportFailure(operationId);
+    }
+  }
+
+  /**
+   * Writes a failed operation's log file and output excerpt as soon as it fails, while the rest of the request
+   * runs on. The operation's output all arrived before its status. An operation that wrote nothing is left to
+   * the failure report, which has the error from the daemon's result.
+   */
+  #reportFailure(operationId: string): void {
+    if (this.#stopped || this.#reported.has(operationId) || this.#reported.size >= MAX_REPORTED_OPERATIONS) {
+      return;
+    }
+    const problem: IAgentProblemOperation = this.#tracker.getProblemOperation(operationId);
+    if (!problem.excerpt?.lineCount) {
+      return;
+    }
+    const lines: string[] = this.#getProblemLines('failed', problem);
+    const text: string = lines.map((line) => `${line}\n`).join('');
+    if (this.#options.isTTY) {
+      this.#clear();
+      this.#options.write(text);
+      this.#paint();
+    } else {
+      this.#writePipeText(text);
     }
   }
 
@@ -333,9 +387,10 @@ export class AgentProgressRenderer {
   }
 
   /**
-   * Each failed operation's log file and output excerpt. Without failed operations: operations with warnings
-   * (they fail a build unless the command allows warnings), or else output that belongs to no operation. A
-   * cancelled command reports only failed operations.
+   * The log file and output excerpt of each failed operation not yet reported. Without failed operations:
+   * operations with warnings (they fail a build unless the command allows warnings), or else output that belongs
+   * to no operation. A cancelled command reports only failed operations. At most three operations are reported
+   * in all, with the operations reported as they failed.
    */
   #getFailureReport(verdict: Verdict): string[] {
     const tracker: AgentOperationTracker = this.#tracker;
@@ -348,17 +403,17 @@ export class AgentProgressRenderer {
     }
     const label: string = tracker.failed.length ? 'failed' : 'warnings';
     const lines: string[] = [];
-    for (const [index, problem] of problems.slice(0, MAX_REPORTED_OPERATIONS).entries()) {
-      const logFile: string = problem.logFilePath ? ` · full log: ${problem.logFilePath}` : '';
-      lines.push(`${label}: ${problem.operationId}${logFile}`);
-      const maxLines: number = index === 0 ? FIRST_OPERATION_EXCERPT_LINES : OTHER_OPERATION_EXCERPT_LINES;
-      const excerpt: string[] = problem.excerpt?.getExcerpt(maxLines) ?? [];
-      if (!excerpt.length && problem.errorMessage) {
-        excerpt.push(clipLine(problem.errorMessage.trim().split('\n')[0], MAX_MESSAGE_LENGTH));
+    let hidden: number = 0;
+    for (const problem of problems) {
+      if (this.#reported.has(problem.operationId)) {
+        continue;
+      }
+      if (this.#reported.size < MAX_REPORTED_OPERATIONS) {
+        lines.push(...this.#getProblemLines(label, problem));
+      } else {
+        hidden++;
       }
-      lines.push(...(excerpt.length ? excerpt : ['(no output)']).map((line) => `  ${line}`));
     }
-    const hidden: number = problems.length - MAX_REPORTED_OPERATIONS;
     if (hidden > 0) {
       const what: string = label === 'failed' ? 'failed operations' : 'operations with warnings';
       lines.push(`+${hidden} more ${what}; their logs are in each project's rush-logs folder`);
@@ -366,13 +421,33 @@ export class AgentProgressRenderer {
     return lines;
   }
 
+  /**
+   * An operation's report: its log file, then its output excerpt, which is longer for the first reported
+   * operation (most often the root cause). Records that the operation was reported.
+   */
+  #getProblemLines(label: string, problem: IAgentProblemOperation): string[] {
+    const maxLines: number = this.#reported.size
+      ? OTHER_OPERATION_EXCERPT_LINES
+      : FIRST_OPERATION_EXCERPT_LINES;
+    this.#reported.add(problem.operationId);
+    const excerpt: string[] = problem.excerpt?.getExcerpt(maxLines) ?? [];
+    if (!excerpt.length && problem.errorMessage) {
+      excerpt.push(clipLine(problem.errorMessage.trim().split('\n')[0], MAX_MESSAGE_LENGTH));
+    }
+    const logFile: string = problem.logFilePath ? ` · full log: ${problem.logFilePath}` : '';
+    return [
+      `${label}: ${problem.operationId}${logFile}`,
+      ...(excerpt.length ? excerpt : ['(no output)']).map((line) => `  ${line}`)
+    ];
+  }
+
   /** Returns false if rendering had already stopped; after stopping, nothing more is written. */
   #stop(): boolean {
     if (this.#stopped) {
       return false;
     }
     this.#stopped = true;
-    for (const timer of [this.#firstLineTimer, this.#statusTimer]) {
+    for (const timer of [this.#connectingTimer, this.#statusTimer]) {
       clearTimeout(timer);
     }
     if (this.#timer) {
@@ -397,26 +472,15 @@ export class AgentProgressRenderer {
     ];
   }
 
-  #writeMilestone(milestone: PipeMilestone, suffix: string = ''): void {
-    if (this.#options.isTTY || this.#stopped || this.#milestones.has(milestone)) {
-      return;
-    }
-    this.#milestones.add(milestone);
-    this.#writePipeLine(`${this.#rows()[0]}${suffix}`);
-  }
-
   #writePipeLine(line: string): void {
-    if (this.#pipeLines < MAX_PIPE_PROGRESS_LINES) {
-      this.#pipeLines++;
-      this.#writeStatus(line);
+    if (!this.#stopped) {
+      this.#writePipeText(`${line}\n`);
     }
   }
 
-  /** Writes a line on a pipe; the first line and the next status line are then due later. */
-  #writeStatus(line: string): void {
-    clearTimeout(this.#firstLineTimer);
-    this.#firstLineTimer = undefined;
-    this.#options.write(`${line}\n`);
+  /** Writes to a pipe; the next status line is then due 25 s later. */
+  #writePipeText(text: string): void {
+    this.#options.write(text);
     if (this.#statusTimer) {
       this.#scheduleStatusLine();
     }
@@ -424,11 +488,7 @@ export class AgentProgressRenderer {
 
   #scheduleStatusLine(): void {
     clearTimeout(this.#statusTimer);
-    this.#statusTimer = setTimeout(() => {
-      if (!this.#stopped) {
-        this.#writeStatus(this.#getStatusLine());
-      }
-    }, PIPE_STATUS_INTERVAL_MS);
+    this.#statusTimer = setTimeout(() => this.#writePipeLine(this.#getStatusLine()), PIPE_STATUS_INTERVAL_MS);
     this.#statusTimer.unref?.();
   }
 
diff --git a/apps/rush-cli-client/src/OperationOutputExcerpt.ts b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
index 98671349c3..cb5b66d54a 100644
--- a/apps/rush-cli-client/src/OperationOutputExcerpt.ts
+++ b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
@@ -35,6 +35,13 @@ const ERROR_PATTERN: RegExp =
 const NO_ERRORS_PATTERN: RegExp = /\b(?:0|no) errors?\b/i;
 /** Lines without any letter (bare exit codes, progress percentages, caret markers) explain nothing. */
 const LETTER_PATTERN: RegExp = /\p{L}/u;
+/** A severity word that some tools put before a diagnostic that they also print without it. */
+const SEVERITY_PREFIX_PATTERN: RegExp = /^(?:error|warning)\s*:\s*/i;
+const WHITESPACE_PATTERN: RegExp = /\s+/g;
+/** A tool's error count, such as Heft's `Encountered 2 errors` or tsc's `Found 1 error.` */
+const ERROR_COUNT_PATTERN: RegExp = /^(?:encountered|found) (\d+) errors?\b/i;
+/** A source location such as `src/x.ts:3:7` or `src/x.ts(3,7)`. */
+const SOURCE_LOCATION_PATTERN: RegExp = /[\w-]\.[A-Za-z]\w{0,5}(?::\d+|\(\d+,\d+\))/;
 
 /** Lines longer than this keep their start and end, joined by an ellipsis. */
 const MAX_LINE_LENGTH: number = 300;
@@ -55,6 +62,8 @@ interface IExcerptLine {
   /** The arrival order across both streams, used to print the excerpt in output order. */
   readonly index: number;
   readonly text: string;
+  /** Equal for lines that repeat one message; see {@link getRepeatKey}. */
+  readonly key: string;
 }
 
 interface IErrorLine extends IExcerptLine {
@@ -94,6 +103,40 @@ export function isErrorLine(line: string): boolean {
   return ERROR_PATTERN.test(line) && !NO_ERRORS_PATTERN.test(line);
 }
 
+/**
+ * A normalized line's message without its task prefix, a leading `Error:` or `Warning:`, case and repeated
+ * whitespace. Tools such as Heft print each diagnostic when it occurs and again in their final summary, once with
+ * and once without these, so lines with the same key repeat one message.
+ */
+function getRepeatKey(line: string): string {
+  const prefixMatch: RegExpMatchArray | null = TASK_PREFIX_PATTERN.exec(line);
+  const content: string = prefixMatch ? prefixMatch[2] : line;
+  return content.replace(SEVERITY_PREFIX_PATTERN, '').replace(WHITESPACE_PATTERN, ' ').toLowerCase();
+}
+
+/** The number of errors that a tool's error count line reports, or undefined if the line is no such count. */
+function getReportedErrorCount(line: IExcerptLine): number | undefined {
+  const match: RegExpMatchArray | null = ERROR_COUNT_PATTERN.exec(line.key);
+  return match ? Number(match[1]) : undefined;
+}
+
+/**
+ * Leaves out of chosen lines (in output order) the error counts that the chosen errors account for, and, when
+ * the first chosen error names a source location, the lines before it.
+ */
+function trimExcerpt(lines: ReadonlyArray<IExcerptLine>): IExcerptLine[] {
+  const errors: IExcerptLine[] = lines.filter(
+    (line) => getReportedErrorCount(line) === undefined && isErrorLine(line.text)
+  );
+  const kept: IExcerptLine[] = lines.filter((line) => {
+    const count: number | undefined = getReportedErrorCount(line);
+    return count === undefined || count === 0 || count > errors.length;
+  });
+  return errors.length && SOURCE_LOCATION_PATTERN.test(errors[0].text)
+    ? kept.slice(kept.indexOf(errors[0]))
+    : kept;
+}
+
 /** Shortens a line to at most `maxLength` characters, keeping its start and its end. */
 export function clipLine(line: string, maxLength: number): string {
   if (line.length <= maxLength) {
@@ -113,7 +156,9 @@ export function clipLine(line: string, maxLength: number): string {
  * beginning. Like the native `StdioSummarizer`, head and tail lines come from stderr when the operation wrote
  * any, otherwise from stdout; error lines come from both, because tools such as tsc and eslint report errors
  * on stdout. Stack frames, `Require stack:` paths and code frames are dropped, so they cannot crowd out the
- * cause.
+ * cause. A message that a tool repeats in its summary is shown once, and so is an error count that the shown
+ * errors already account for; when the first error shown names a source location, the lines before it (a
+ * tool's banner and progress) are left out.
  */
 export class OperationOutputExcerpt {
   readonly #streams: Record<OutputStream, IStreamLines> = {
@@ -121,7 +166,7 @@ export class OperationOutputExcerpt {
     stderr: { head: [], tail: [], partial: '' }
   };
   readonly #errors: IErrorLine[] = [];
-  readonly #errorTexts: Set<string> = new Set();
+  readonly #errorKeys: Set<string> = new Set();
   /**
    * Per stream, the error line whose context is the stream's next line. The streams are separate pipes, so the
    * next line of the other stream is unrelated to the error.
@@ -170,11 +215,11 @@ export class OperationOutputExcerpt {
       ? this.#streams.stderr
       : this.#streams.stdout;
     const chosen: Map<number, IExcerptLine> = new Map();
-    const texts: Set<string> = new Set();
+    const keys: Set<string> = new Set();
     const add = (line: IExcerptLine | undefined, limit: number): void => {
-      if (line && chosen.size < limit && !chosen.has(line.index) && !texts.has(line.text)) {
+      if (line && chosen.size < limit && !chosen.has(line.index) && !keys.has(line.key)) {
         chosen.set(line.index, line);
-        texts.add(line.text);
+        keys.add(line.key);
       }
     };
     const errorLimit: number = Math.max(1, maxLines - TAIL_RESERVE);
@@ -192,7 +237,7 @@ export class OperationOutputExcerpt {
     for (const line of preferred.head) {
       add(line, maxLines);
     }
-    return [...chosen.values()].sort((a, b) => a.index - b.index).map((line) => line.text);
+    return trimExcerpt([...chosen.values()].sort((a, b) => a.index - b.index)).map((line) => line.text);
   }
 
   #addLine(rawLine: string, stream: OutputStream): void {
@@ -200,7 +245,7 @@ export class OperationOutputExcerpt {
     if (text === undefined) {
       return;
     }
-    const line: IExcerptLine = { index: this.#lineCount++, text };
+    const line: IExcerptLine = { index: this.#lineCount++, text, key: getRepeatKey(text) };
     const lines: IStreamLines = this.#streams[stream];
     if (lines.head.length < HEAD_LINES) {
       lines.head.push(line);
@@ -214,10 +259,10 @@ export class OperationOutputExcerpt {
       pendingContext.context = line;
       this.#pendingContext[stream] = undefined;
     }
-    if (this.#errors.length < ERROR_LINES && !this.#errorTexts.has(text) && isErrorLine(text)) {
+    if (this.#errors.length < ERROR_LINES && !this.#errorKeys.has(line.key) && isErrorLine(text)) {
       const errorLine: IErrorLine = { ...line };
       this.#errors.push(errorLine);
-      this.#errorTexts.add(text);
+      this.#errorKeys.add(line.key);
       this.#pendingContext[stream] = errorLine;
     }
   }
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 3fdee47959..9d6921e648 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -34,13 +34,13 @@ interface ITestRenderer {
   lines(): string[];
 }
 
-function createRenderer(isTTY: boolean, commandName: string = 'build'): ITestRenderer {
+function createRenderer(isTTY: boolean, commandName: string = 'build', columns: number = 60): ITestRenderer {
   const output: string[] = [];
   const clock: { ms: number } = { ms: 0 };
   const renderer: AgentProgressRenderer = new AgentProgressRenderer({
     commandName,
     isTTY,
-    columns: 60,
+    columns,
     write: (text: string) => output.push(text),
     now: () => clock.ms,
     startTimeMs: 0
@@ -79,7 +79,7 @@ function fail(renderer: AgentProgressRenderer, operationId: string, errorLines:
 }
 
 describe(AgentProgressRenderer.name, () => {
-  it('writes one line when the request is sent, then milestones and a summary for a successful build (pipe)', () => {
+  it('writes one line when the request is sent and a summary line for a successful build (pipe)', () => {
     const { renderer, output, clock, lines } = createRenderer(false);
     renderer.start();
     expect(output).toEqual([]);
@@ -101,7 +101,6 @@ describe(AgentProgressRenderer.name, () => {
     renderer.dispose();
     expect(lines()).toEqual([
       'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
-      'rush build 0/2 · 0.0s · running',
       'rush build: SUCCESS 2/2 operations (1 success, 1 up to date) in 3.0s'
     ]);
   });
@@ -133,18 +132,17 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
-  it('reports a failed operation with its log file and an excerpt, before the summary line', () => {
+  it('reports a failed operation with its log file and an excerpt as soon as it fails', () => {
     const { renderer, lines } = createRenderer(false);
     fail(
       renderer,
       'p05 (build)',
       Array.from({ length: 20 }, (unused, i) => `error ${i}`)
     );
+    expect(lines()).toHaveLength(9);
     renderer.onEvent(status('p06 (build)', 'BLOCKED'));
     renderer.finish({ exitCode: 1 });
     expect(lines()).toEqual([
-      'rush build 0/1 · 0.0s · running',
-      'rush build 1/1 · 0.0s · running · first failure: p05 (build)',
       'failed: p05 (build) · full log: /repo/p05/rush-logs/x.log',
       '  error 0',
       '  error 1',
@@ -209,10 +207,7 @@ describe(AgentProgressRenderer.name, () => {
         { operationId: 'b (build)', status: 'ABORTED' }
       ]
     });
-    expect(lines()).toEqual([
-      'rush build 0/2 · 0.0s · running',
-      'rush build: CANCELLED 2/2 operations (2 aborted) in 0.0s'
-    ]);
+    expect(lines()).toEqual(['rush build: CANCELLED 2/2 operations (2 aborted) in 0.0s']);
   });
 
   it('still reports the failures of a cancelled command', () => {
@@ -374,13 +369,30 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
-  it('writes the queue milestone once, however often the position changes', () => {
-    const { renderer, output } = createRenderer(false);
-    renderer.onQueuePosition(2);
+  it('reports the queue in the summary line rather than in a line of its own (pipe)', () => {
+    const { renderer, output, clock } = createRenderer(false);
+    clock.ms = 100;
     renderer.onQueuePosition(2);
+    clock.ms = 5000;
     renderer.onQueuePosition(1);
-    expect(output).toEqual(['rush build · 0.0s · queued behind another request (position 2)\n']);
-    renderer.dispose();
+    expect(output).toEqual([]);
+    clock.ms = 15_000;
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.finish({ exitCode: 0 });
+    expect(output).toEqual([
+      'rush build: SUCCESS 1/1 operations (1 success) in 15.0s · ' +
+        'queued behind another request (position 2 at 0.1s)\n'
+    ]);
+  });
+
+  it('leaves the queue to the message of a request that was not admitted', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.onQueuePosition(1);
+    renderer.finish({ exitCode: 1, admissionErrorCode: 'no-wait', errorMessage: 'The workspace is busy.' });
+    expect(output).toEqual([
+      'rush build: FAILURE in 0.0s · daemon admission failed (no-wait): The workspace is busy.\n'
+    ]);
   });
 
   it('shows the excerpt of a failed operation that reported errors on stdout', () => {
@@ -408,10 +420,11 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
-  it('shows queue position immediately', () => {
-    const { renderer, output } = createRenderer(false);
+  it('shows the queue position immediately on a TTY', () => {
+    const { renderer, output } = createRenderer(true, 'build', 120);
     renderer.onQueuePosition(2);
     expect(output[0]).toContain('queued behind another request (position 2)');
+    renderer.dispose();
   });
 
   it('writes a final summary line after a queued request completes', () => {
@@ -420,10 +433,13 @@ describe(AgentProgressRenderer.name, () => {
     renderer.onQueuePosition(1);
     clock.ms = 4000;
     renderer.finish({ exitCode: 0 });
-    expect(output[output.length - 1]).toBe('rush build: SUCCESS up to date (no operations needed) in 4.0s\n');
+    expect(output[output.length - 1]).toBe(
+      'rush build: SUCCESS up to date (no operations needed) in 4.0s · ' +
+        'queued behind another request (position 1 at 0.0s)\n'
+    );
   });
 
-  it('writes at most three progress lines and one summary line on a pipe at odsp-web scale', () => {
+  it('writes one progress line and one summary line on a pipe at odsp-web scale', () => {
     const { renderer, clock, lines } = createRenderer(false);
     renderer.start();
     renderer.onRequestSent();
@@ -450,13 +466,12 @@ describe(AgentProgressRenderer.name, () => {
     renderer.finish({ exitCode: 0 });
     expect(lines()).toEqual([
       'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
-      'rush build · 0.0s · queued behind another request (position 1)',
-      'rush build 0/772 · 0.0s · running',
-      'rush build: SUCCESS 772/772 operations (386 success, 386 from cache) in 210.0s'
+      'rush build: SUCCESS 772/772 operations (386 success, 386 from cache) in 210.0s · ' +
+        'queued behind another request (position 1 at 0.0s)'
     ]);
   });
 
-  it('keeps a failure at odsp-web scale to the progress lines, the failure report and one summary line', () => {
+  it('keeps a failure at odsp-web scale to the sent line, the failure report and one summary line', () => {
     const { renderer, lines } = createRenderer(false);
     renderer.start();
     renderer.onRequestSent();
@@ -478,11 +493,8 @@ describe(AgentProgressRenderer.name, () => {
     renderer.finish({ exitCode: 1 });
     expect(lines()).toEqual([
       'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
-      'rush build 0/772 · 0.0s · running',
-      'rush build 701/772 · 0.0s · running · first failure: p700 (build)',
       'failed: p700 (build) · full log: /repo/p700/rush-logs/x.log',
       '  src/x.ts:1:1 - error TS2304: Cannot find name "y".',
-      '  Encountered 1 error',
       'rush build: FAILURE 772/772 operations (1 failure, 71 blocked, 700 success) in 0.0s · failed: p700 (build)'
     ]);
   });
@@ -509,10 +521,7 @@ describe(AgentProgressRenderer.name, () => {
     renderer.onEvent(header('a (build)', 1, 772));
     renderer.onEvent(status('a (build)', 'SUCCESS'));
     renderer.finish({ exitCode: 0 });
-    expect(lines()).toEqual([
-      'rush build 1/772 · 0.0s · running',
-      'rush build: SUCCESS 1/772 operations (1 success) in 0.0s'
-    ]);
+    expect(lines()).toEqual(['rush build: SUCCESS 1/772 operations (1 success) in 0.0s']);
   });
 
   it('counts an operation that runs again once', () => {
@@ -565,7 +574,7 @@ describe(AgentProgressRenderer.name, () => {
       );
     }
     renderer.finish({ exitCode: 1 });
-    const report: string[] = lines().slice(2);
+    const report: string[] = lines();
     expect(report.filter((line) => line.startsWith('failed: '))).toEqual([
       'failed: f0 (build) · full log: /repo/f0/rush-logs/x.log',
       'failed: f1 (build) · full log: /repo/f1/rush-logs/x.log',
@@ -581,6 +590,65 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('reports a failed operation that wrote no output with the error from the daemon result', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+    renderer.onEvent(status('quiet (build)', 'FAILURE'));
+    fail(renderer, 'b (build)', ['src/b.ts:1:1 - error TS2322: b']);
+    expect(lines()).toHaveLength(4);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'a (build)', status: 'FAILURE' },
+        { operationId: 'quiet (build)', status: 'FAILURE', errorMessage: 'spawn heft ENOENT' },
+        { operationId: 'b (build)', status: 'FAILURE' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  src/a.ts:1:1 - error TS2322: a',
+      'failed: b (build) · full log: /repo/b/rush-logs/x.log',
+      '  src/b.ts:1:1 - error TS2322: b',
+      'failed: quiet (build)',
+      '  spawn heft ENOENT',
+      'rush build: FAILURE 3/3 operations (3 failure) in 0.0s · failed: a (build), quiet (build), b (build)'
+    ]);
+  });
+
+  it('reports at most three operations in all, as they failed or before the summary line', () => {
+    const { renderer, lines } = createRenderer(false);
+    fail(renderer, 'a (build)', ['a error']);
+    for (const name of ['q1', 'q2', 'q3']) {
+      renderer.onEvent(status(`${name} (build)`, 'FAILURE'));
+    }
+    fail(renderer, 'b (build)', ['b error']);
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  a error',
+      'failed: b (build) · full log: /repo/b/rush-logs/x.log',
+      '  b error',
+      'failed: q1 (build)',
+      '  (no output)',
+      "+2 more failed operations; their logs are in each project's rush-logs folder",
+      'rush build: FAILURE 5/5 operations (5 failure) in 0.0s · ' +
+        'failed: a (build), q1 (build), q2 (build), q3 (build), b (build)'
+    ]);
+  });
+
+  it('writes a failure report above the live rows on a TTY when the operation fails', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+    renderer.dispose();
+    expect(output[1]).toBe('\x1b[3A\x1b[0J\x1b[?25h');
+    expect(output[2]).toBe(
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log\n  src/a.ts:1:1 - error TS2322: a\n'
+    );
+    expect(output[3].replace(ANSI_ESCAPE, '').split('\n')[2]).toBe('failed: a (build)');
+    expect(output.slice(4)).toEqual(['\x1b[3A\x1b[0J\x1b[?25h']);
+  });
+
   it('shows the output of a command that failed without running operations', () => {
     const { renderer, lines } = createRenderer(false, 'install');
     renderer.onLog(Buffer.from('Installing packages\n'), 'request-id', 'stdout');
@@ -612,44 +680,70 @@ describe(AgentProgressRenderer.name, () => {
       jest.advanceTimersByTime(ms);
     }
 
-    it('writes the connecting line only when the connection takes more than a second', () => {
+    it('writes the connecting line only when the connection takes more than 10 s', () => {
+      const fast: ITestRenderer = createRenderer(false);
+      fast.renderer.start();
+      advance(fast.clock, 3000);
+      fast.renderer.onRequestSent();
+      advance(fast.clock, 10_000);
+      fast.renderer.dispose();
+      expect(fast.lines()).toEqual([
+        'rush build · 3.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+
       const { renderer, output, clock, lines } = createRenderer(false);
       renderer.start();
-      advance(clock, 999);
+      advance(clock, 9999);
       expect(output).toEqual([]);
       advance(clock, 1);
       renderer.onRequestSent();
       renderer.dispose();
       expect(lines()).toEqual([
-        'rush build · 1.0s · connecting to rushd (auto-starts if needed)',
-        'rush build · 1.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+        'rush build · 10.0s · connecting to rushd (auto-starts if needed)',
+        'rush build · 10.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
       ]);
     });
 
     it('writes one line when the client waits for a daemon that is still starting (task 95)', () => {
-      const { renderer, output, clock, lines } = createRenderer(false);
-      renderer.start();
-      advance(clock, 300);
-      renderer.onAwaitStartup(15_000);
-      expect(lines()).toEqual([
+      const early: ITestRenderer = createRenderer(false);
+      early.renderer.start();
+      advance(early.clock, 300);
+      early.renderer.onAwaitStartup(15_000);
+      expect(early.lines()).toEqual([
         'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)'
       ]);
-      advance(clock, 1_000);
+      advance(early.clock, 1_000);
+      early.renderer.onAwaitStartup(15_000);
+      // The connecting line is not due after this line.
+      advance(early.clock, 11_000);
+      expect(early.output).toHaveLength(1);
+      early.renderer.onRequestSent();
+      early.renderer.dispose();
+      expect(early.lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)',
+        'rush build · 12.3s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+      ]);
+
+      // As usual, the first startup deadline (15 s) comes after the connecting line.
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 10_000);
+      advance(clock, 5_000);
       renderer.onAwaitStartup(15_000);
-      expect(output).toHaveLength(1);
-      advance(clock, 11_000);
+      advance(clock, 6_000);
       renderer.onRequestSent();
       renderer.dispose();
       expect(lines()).toEqual([
-        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more)',
-        'rush build · 12.3s · sent to rushd; preparing the workspace graph (status at least every 25s)'
+        'rush build · 10.0s · connecting to rushd (auto-starts if needed)',
+        'rush build · 15.0s · rushd is still starting; waiting for it (up to 15s more)',
+        'rush build · 21.0s · sent to rushd; preparing the workspace graph (status at least every 25s)'
       ]);
     });
 
-    it('writes nothing for a request that is handed to in-process Rush within a second', () => {
+    it('writes nothing for a request that is handed to in-process Rush within 10 s', () => {
       const { renderer, output, clock } = createRenderer(false);
       renderer.start();
-      advance(clock, 500);
+      advance(clock, 9000);
       renderer.dispose();
       advance(clock, 60_000);
       expect(output).toEqual([]);
@@ -665,9 +759,11 @@ describe(AgentProgressRenderer.name, () => {
       advance(clock, 20_000);
       renderer.onEvent(status('a (build)', 'EXECUTING'));
       renderer.onEvent(status('b (build)', 'EXECUTING'));
-      advance(clock, 24_999);
-      expect(lines()).toHaveLength(2);
+      advance(clock, 4999);
+      expect(lines()).toHaveLength(1);
       advance(clock, 1);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 20_000);
       renderer.onEvent(status('c (build)', 'EXECUTING'));
       renderer.onEvent(status('d (build)', 'EXECUTING'));
       renderer.onEvent(status('e (build)', 'EXECUTING'));
@@ -679,14 +775,12 @@ describe(AgentProgressRenderer.name, () => {
       renderer.finish({ exitCode: 1 });
       expect(lines()).toEqual([
         'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
-        'rush build 0/5 · 20.0s · running',
-        'rush build 0/5 · 45.0s · running: a (build), b (build)',
-        // The first failure is a milestone, so it is written although status lines were written before it.
-        'rush build 1/5 · 45.0s · running · first failure: a (build)',
-        'rush build 1/5 · 70.0s · running: b (build), c (build), d (build) +1 more · failed: a (build)',
-        'rush build 2/5 · 95.0s · running: c (build), d (build), e (build) · failed: a (build)',
+        'rush build 0/5 · 25.0s · running: a (build), b (build)',
+        // The failure report is written when the operation fails, and the next status line is due 25 s later.
         'failed: a (build) · full log: /repo/a/rush-logs/x.log',
         '  error TS2322',
+        'rush build 1/5 · 70.0s · running: b (build), c (build), d (build) +1 more · failed: a (build)',
+        'rush build 2/5 · 95.0s · running: c (build), d (build), e (build) · failed: a (build)',
         'rush build: FAILURE 2/5 operations (1 failure, 1 success) in 96.0s · failed: a (build)'
       ]);
     });
@@ -697,21 +791,19 @@ describe(AgentProgressRenderer.name, () => {
       renderer.onRequestSent();
       advance(clock, 2000);
       renderer.onQueuePosition(1);
-      advance(clock, 25_000);
+      advance(clock, 23_000);
       renderer.onEvent(registered('a (build)'));
       renderer.onEvent(status('a (build)', 'EXECUTING'));
       advance(clock, 25_000);
       renderer.dispose();
       expect(lines()).toEqual([
         'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
-        'rush build · 2.0s · queued behind another request (position 1)',
-        'rush build · 27.0s · waiting for admission or the workspace graph (queue position 1 at 2.0s)',
-        'rush build 0/1 · 27.0s · running',
-        'rush build 0/1 · 52.0s · running: a (build)'
+        'rush build · 25.0s · waiting for admission or the workspace graph (queue position 1 at 2.0s)',
+        'rush build 0/1 · 50.0s · running: a (build)'
       ]);
     });
 
-    it('writes status lines after the milestone lines ran out, and none after the summary', () => {
+    it('writes status lines after a failure report, and none after the summary', () => {
       const { renderer, output, clock, lines } = createRenderer(false);
       renderer.start();
       renderer.onRequestSent();
diff --git a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
index 4e241e65b0..bc139a88fd 100644
--- a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
+++ b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
@@ -157,13 +157,11 @@ describe(OperationOutputExcerpt.name, () => {
       '[test:jest] but they are not recognized by this version of Rush: RUSH_EXAMPLE',
       '[test:jest] ● test two',
       '[test:jest] ● test three',
-      '[test:jest] Error: 3 Jest tests failed',
-      'Encountered 1 error'
+      '[test:jest] Error: 3 Jest tests failed'
     ]);
     expect(excerpt.getExcerpt(3)).toEqual([
       '[test:jest] ● test one',
-      '[test:jest] Error: 3 Jest tests failed',
-      'Encountered 1 error'
+      '[test:jest] Error: 3 Jest tests failed'
     ]);
   });
 
@@ -173,8 +171,7 @@ describe(OperationOutputExcerpt.name, () => {
     excerpt.append('[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".\n', 'stdout');
     excerpt.append('[build:typescript] Encountered 1 error\n', 'stderr');
     expect(excerpt.getExcerpt(8)).toEqual([
-      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".',
-      '[build:typescript] Encountered 1 error'
+      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".'
     ]);
   });
 
@@ -187,8 +184,7 @@ describe(OperationOutputExcerpt.name, () => {
     excerpt.append('[build:lint] Using ESLint version 9.37.0\n', 'stdout');
     excerpt.append('Error: Encountered 1 error\n', 'stderr');
     expect(excerpt.getExcerpt(3)).toEqual([
-      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".',
-      'Error: Encountered 1 error'
+      '[build:typescript] src/x.ts:1:1 - error TS2304: Cannot find name "y".'
     ]);
   });
 
@@ -208,11 +204,44 @@ describe(OperationOutputExcerpt.name, () => {
       "src/x.ts(3,7): error TS2322: Type 'string' is not assignable to type 'number'.",
       'The expected type comes from property "x".',
       "src/y.ts(1,1): error TS2304: Cannot find name 'z'.",
-      'Did you mean "y"?',
-      'Encountered 2 errors'
+      'Did you mean "y"?'
     ]);
   });
 
+  it('shows a diagnostic that a tool repeats in its summary once, without the error count', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    const message: string = "src/index.ts:3:7 - (TS2322) Type 'string' is not assignable to type 'number'.";
+    excerpt.append(`[build:typescript] Error: ${message}\n`, 'stdout');
+    excerpt.append('Encountered 1 error\n', 'stderr');
+    excerpt.append(`  [build:typescript] ${message}\n`, 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual([`[build:typescript] Error: ${message}`]);
+  });
+
+  it('keeps an error count that reports more errors than the excerpt shows', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    for (let i: number = 0; i < 12; i++) {
+      excerpt.append(`src/x${i}.ts:1:1 - error TS2304: Cannot find name "y${i}".\n`, 'stdout');
+    }
+    excerpt.append('Encountered 12 errors\n', 'stderr');
+    expect(excerpt.getExcerpt(3)).toEqual([
+      'src/x0.ts:1:1 - error TS2304: Cannot find name "y0".',
+      'src/x1.ts:1:1 - error TS2304: Cannot find name "y1".',
+      'Encountered 12 errors'
+    ]);
+  });
+
+  it('leaves out the lines before an error that names a source location, but not before other errors', () => {
+    const located: OperationOutputExcerpt = new OperationOutputExcerpt();
+    located.append('[build] @x/a: start\n', 'stdout');
+    located.append("ERROR in src/index.ts:4:1: Unexpected token '}'\n", 'stdout');
+    expect(located.getExcerpt(8)).toEqual(["ERROR in src/index.ts:4:1: Unexpected token '}'"]);
+
+    const unlocated: OperationOutputExcerpt = new OperationOutputExcerpt();
+    unlocated.append('src/a.ts(1,1): something unexpected\n', 'stdout');
+    unlocated.append('Build failed\n', 'stdout');
+    expect(unlocated.getExcerpt(8)).toEqual(['src/a.ts(1,1): something unexpected', 'Build failed']);
+  });
+
   it('always keeps the last line, which usually is the tool summary', () => {
     const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
     for (let i: number = 0; i < 20; i++) {
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-early-failures_2026-09-28-18-14.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-early-failures_2026-09-28-18-14.json
new file mode 100644
index 0000000000..555f3a7a98
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-early-failures_2026-09-28-18-14.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, report a failed operation's log file and output excerpt as soon as it fails; on a pipe, write only the line that says the request was sent, plus status lines after 25 s of silence, and report the queue in the summary line. Excerpts no longer repeat a diagnostic that a tool prints again in its summary, or an error count that the shown errors account for, and start at the first error when it names a source location.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}

From 52e592c3db59d50f809c4218b7ff06184763bdb3 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:04:14 +0000
Subject: [PATCH 038/265] [rush-lib] Keep results that a plugin found up to
 date in long-lived operation graphs

Swarm integration step 23; original commit e16ed01d3a (merge of swarm/r01-t85-a81 at 4066e8f5d7).
Scope: task 85.

Brings task 85 onto task 108 items 1+3: the daemon keeps a result that a plugin such as fstrace found up to date across requests, and checks a Skipped result again when it was marked unverifiable. m01 CONFIRMED the gated tip (board 2024: 72 of 72 hot requests "1066 no op") and measured 24 of 24 hot B6 requests as "no operations needed" (board 2073); ch04 CONFIRMED 6e39ea6527 (board 2003) and posted the product-default A/B (board 2132: -0.24 s [-0.57, +0.09]). ch01's combined suite on this tree passes (board 2150: rush-lib 1169/1, a timing flake in InstallRunScripts.test that task 85 doesn't touch, 5 of 5 on rerun; rush-daemon 515/0, rush-cli-client 367/0).

Gate: ch01 GATE OK board 1955, combined suite board 2150 (tree 1c6a3bfa10)

Commits folded into this step (2):
- 95c8ece420 [rush-lib] Retain results that a plugin found up to date in long-lived operation graphs
- 4066e8f5d7 [rush-lib] Check a Skipped result again if it was marked unverifiable

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ugin-skipped-results_2026-09-28-18-39.json |  11 ++
 ...ugin-skipped-results_2026-09-28-18-39.json |  11 ++
 .../src/OperationOutputFingerprints.ts        |  12 +-
 .../ProductionDaemonRequestResolver.test.ts   |  49 ++++++
 .../src/logic/operations/IOperationGraph.ts   |   4 +-
 .../src/logic/operations/OperationGraph.ts    |   9 +-
 .../logic/operations/PhasedOperationPlugin.ts |  40 ++++-
 .../operations/RetainedResultVerification.ts  |  10 +-
 ...ableOperationPluginRetainedResults.test.ts |  72 +++++++-
 ...asedOperationPluginRetainedResults.test.ts | 154 +++++++++++++++++-
 10 files changed, 348 insertions(+), 24 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/retain-plugin-skipped-results_2026-09-28-18-39.json
 create mode 100644 common/changes/@rushstack/rush-daemon/retain-plugin-skipped-results_2026-09-28-18-39.json

diff --git a/common/changes/@microsoft/rush/retain-plugin-skipped-results_2026-09-28-18-39.json b/common/changes/@microsoft/rush/retain-plugin-skipped-results_2026-09-28-18-39.json
new file mode 100644
index 0000000000..beb64848e6
--- /dev/null
+++ b/common/changes/@microsoft/rush/retain-plugin-skipped-results_2026-09-28-18-39.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "In long-lived operation graphs such as the Rush daemon, a selected operation that a plugin or the legacy skip detection found up to date now keeps that result while its state hash is unchanged, so later builds no longer check it again.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/retain-plugin-skipped-results_2026-09-28-18-39.json b/common/changes/@rushstack/rush-daemon/retain-plugin-skipped-results_2026-09-28-18-39.json
new file mode 100644
index 0000000000..786d960c38
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/retain-plugin-skipped-results_2026-09-28-18-39.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "If the declared output folders of an operation that a plugin or the legacy skip detection found up to date are deleted, the next request runs that operation again instead of reusing its retained result.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
index 7536718113..25836885af 100644
--- a/libraries/rush-daemon/src/OperationOutputFingerprints.ts
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -14,11 +14,14 @@ import {
 const PLUGIN_NAME: 'DaemonOperationOutputFingerprints' = 'DaemonOperationOutputFingerprints';
 
 /**
- * Retained results that allow the warm graph to skip an operation. Other statuses always re-run.
+ * Retained results that allow the warm graph to skip an operation. Other statuses always re-run. The graph only
+ * retains a `Skipped` result for an operation that it selected, when a plugin (e.g. change detection) found its
+ * outputs up to date.
  */
 const TRACKED_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Success,
-  OperationStatus.FromCache
+  OperationStatus.FromCache,
+  OperationStatus.Skipped
 ]);
 
 interface IOutputFingerprint {
@@ -27,7 +30,8 @@ interface IOutputFingerprint {
 }
 
 /**
- * Detects retained successful operations whose declared output folders were changed outside the daemon.
+ * Detects retained successful or up-to-date operations whose declared output folders were changed outside
+ * the daemon.
  *
  * @remarks
  * Build outputs are normally git-ignored, so they do not contribute to any operation state hash. Without
@@ -52,7 +56,7 @@ export class OperationOutputFingerprints {
   }
 
   /**
-   * Returns retained successful operations whose output folders no longer match the recorded fingerprint.
+   * Returns retained operations whose output folders no longer match the recorded fingerprint.
    *
    * @remarks
    * Fingerprints of changed operations are forgotten only after all cleanup succeeded, so a failed
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index b4fb7b3e08..b2d718df00 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1569,6 +1569,55 @@ process.exit(23);
     }
   });
 
+  it('reuses results that legacy skip detection found up to date until their declared outputs are deleted', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toHaveLength(3);
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      // Reload the configuration without changing the inputs of any operation, so the new graph has no results.
+      const commandLineFile: string = path.join(fixture.repoRoot, 'common/config/rush/command-line.json');
+      const commandLine: { commands: object[] } = JSON.parse(fs.readFileSync(commandLineFile, 'utf8'));
+      commandLine.commands.push({
+        commandKind: 'global',
+        name: 'unrelated',
+        summary: 'Unrelated',
+        shellCommand: 'node --version'
+      });
+      fs.writeFileSync(commandLineFile, JSON.stringify(commandLine));
+      const reloaded: ITerminalExchange = await runAsync(fixture, 'reloaded', ['build']);
+      expect(reloaded.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 0,
+          scheduled: true,
+          operationResults: [
+            { operationId: 'a (compile)', status: 'SKIPPED' },
+            { operationId: 'b (compile)', status: 'SKIPPED' },
+            { operationId: 'c (compile)', status: 'SKIPPED' }
+          ]
+        }
+      });
+      expect(fixture.session.operationGraph).not.toBe(graph);
+
+      // The skipped results are current, so they are not checked again.
+      expect((await runAsync(fixture, 'warm', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/c/lib'), { recursive: true });
+      expect((await runAsync(fixture, 'deleted', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3)).toEqual(['c:one:']);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/c/lib/output.txt'), 'utf8')).toBe('one');
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('restores deleted outputs of a warm operation from the native build cache', async () => {
     const fixture: IFixture = await createFixtureAsync(true);
     try {
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index 9b72d55383..7da9225e19 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -54,7 +54,9 @@ export interface IOperationGraph {
    * A map from each `Operation` in the graph to its current result record.
    * The map is updated in real time as operations execute during an iteration.
    * Only statuses representing a completed execution (e.g. `Success`, `Failure`,
-   * `SuccessWithWarning`) write to this map; statuses such as `Skipped` or `Aborted` —
+   * `SuccessWithWarning`) write to this map, as does `Skipped` for an operation that was
+   * selected to execute and whose outputs a plugin (e.g. change detection) found up to date.
+   * Statuses such as `Aborted`, or `Skipped` for an operation that was not selected —
    * which indicate that an operation did not actually run — do not update it.
    * For operations that have not yet run in the current iteration, the map retains the
    * result from whichever prior iteration the operation last ran in.
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index 09da8be3a0..68cc1ed4c1 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -1400,8 +1400,13 @@ function _handleOperationFromCache(
  * Handle skipped operation.
  */
 function _handleOperationSkipped(record: OperationExecutionRecord, context: IStatefulExecutionContext): void {
-  // Do not set resultByOperation here. "Skipped" means the operation was not executed,
-  // so it should not be considered the last *execution* result.
+  if (record.enabled) {
+    // The operation was selected to execute, and a plugin (e.g. change detection) reported that its outputs are
+    // already up to date for its current state hash. Keep this as its last result, so that a long-lived graph
+    // (e.g. the Rush daemon) can reuse it while the state hash is unchanged instead of checking it again.
+    context.resultByOperation.set(record.operation, record);
+  }
+  // Otherwise, the operation was not executed, so it should not be considered the last *execution* result.
   if (!record.silent) {
     record.eventSink?.onActivity?.(`"${record.name}" was skipped.`, { operationId: record.name });
     record.collatedWriter.terminal.writeStdoutLine(Colorize.green(`"${record.name}" was skipped.`));
diff --git a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
index 093ce3fc7f..105cb23b26 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
@@ -26,6 +26,16 @@ const PLUGIN_NAME: 'PhasedOperationPlugin' = 'PhasedOperationPlugin';
 // unverifiable.
 const VERIFY_RESULT_STAGE: number = 1;
 
+/**
+ * The statuses of results retained by an earlier iteration of the graph that are reused while the state hash of the
+ * operation is unchanged. The graph only retains a `Skipped` result for an operation that was selected to execute,
+ * when a plugin (e.g. change detection) found its outputs up to date.
+ */
+const RETAINED_RESULT_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  ...SUCCESS_STATUSES,
+  OperationStatus.Skipped
+]);
+
 /**
  * Core phased command plugin that provides the functionality for generating a base operation graph
  * from the set of selected projects and phases.
@@ -151,7 +161,12 @@ function configureExecutionManager(graph: IOperationGraph, context: IOperationGr
       if (iterationOptions.inputsSnapshot) {
         // A retained result that is current by state hash can still have been built against outputs of a
         // dependency that were not current, e.g. by an `--only` request.
-        enableUnverifiedRetainedOperations(currentStates, lastStates, verifiedStateHashByOperation);
+        enableUnverifiedRetainedOperations(
+          currentStates,
+          lastStates,
+          verifiedStateHashByOperation,
+          RETAINED_RESULT_STATUSES
+        );
       }
     }
   );
@@ -195,8 +210,20 @@ function updateVerifiedStateHash(
   const { operation } = record;
   switch (record.status) {
     case OperationStatus.Skipped: {
-      // The outputs were left as they were.
-      return;
+      if (!record.enabled) {
+        // The operation was not selected, so its outputs were left as they were.
+        return;
+      }
+      // A plugin (e.g. change detection) found the outputs of the selected operation up to date for its state
+      // hash, which verifies them in the same way as executing it.
+      if (
+        !isResultUnverifiable(record) &&
+        areDependenciesVerified(operation, records, verifiedStateHashByOperation)
+      ) {
+        verifiedStateHashByOperation.set(operation, record.getStateHash());
+        return;
+      }
+      break;
     }
 
     case OperationStatus.FromCache: {
@@ -234,7 +261,10 @@ function areDependenciesVerified(
 ): boolean {
   for (const dependency of operation.dependencies) {
     const dependencyRecord: IOperationExecutionResult | undefined = records.get(dependency);
-    if (!dependencyRecord || verifiedStateHashByOperation.get(dependency) !== dependencyRecord.getStateHash()) {
+    if (
+      !dependencyRecord ||
+      verifiedStateHashByOperation.get(dependency) !== dependencyRecord.getStateHash()
+    ) {
       return false;
     }
   }
@@ -250,7 +280,7 @@ function shouldEnableOperation(
     return true;
   }
 
-  if (!SUCCESS_STATUSES.has(lastState.status)) {
+  if (!RETAINED_RESULT_STATUSES.has(lastState.status)) {
     return true;
   }
 
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
index f15be001ff..5cadda9523 100644
--- a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -3,7 +3,7 @@
 
 import type { Operation } from './Operation';
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
-import { SUCCESS_STATUSES } from './OperationStatus';
+import { type OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 
 const unverifiableResults: WeakSet<IOperationExecutionResult> = new WeakSet();
 
@@ -29,7 +29,7 @@ export function isResultUnverifiable(result: IOperationExecutionResult): boolean
 }
 
 /**
- * Re-enables selected operations whose successful result retained by a previous iteration of a long-lived graph
+ * Re-enables selected operations whose result retained by a previous iteration of a long-lived graph
  * (e.g. the Rush daemon) is current by state hash, but not verified at that state hash, so that they are restored
  * from the build cache or executed instead of being skipped. Such a result was produced while the outputs of one
  * of its dependencies were not verified (e.g. that dependency was not selected and had changed), so its outputs
@@ -43,11 +43,13 @@ export function isResultUnverifiable(result: IOperationExecutionResult): boolean
  * @param records - The records of the iteration that is being configured
  * @param lastStates - The results retained by previous iterations of the graph
  * @param verifiedStateHashByOperation - The state hash at which the retained result of each operation is verified
+ * @param retainedResultStatuses - The statuses of retained results that running the operation again can verify
  */
 export function enableUnverifiedRetainedOperations(
   records: ReadonlyMap<Operation, IConfigurableOperation>,
   lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
-  verifiedStateHashByOperation: ReadonlyMap<Operation, string>
+  verifiedStateHashByOperation: ReadonlyMap<Operation, string>,
+  retainedResultStatuses: ReadonlySet<OperationStatus> = SUCCESS_STATUSES
 ): void {
   // Whether the result of each operation will still be unverified at the end of this iteration.
   const remainsUnverifiedByOperation: Map<Operation, boolean> = new Map();
@@ -79,7 +81,7 @@ export function enableUnverifiedRetainedOperations(
         if (
           operation.enabled === true &&
           lastState &&
-          SUCCESS_STATUSES.has(lastState.status) &&
+          retainedResultStatuses.has(lastState.status) &&
           lastState.getStateHash() === stateHash
         ) {
           record.enabled = true;
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index 4581d7c702..3694a67830 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -58,7 +58,7 @@ import { OperationGraph } from '../OperationGraph';
 import { Operation } from '../Operation';
 import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
-import type { IExecutionResult } from '../IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 
 const mockPhase: IPhase = {
@@ -74,7 +74,7 @@ const mockPhase: IPhase = {
 class CacheableMockRunner implements IOperationRunner {
   public readonly reportTiming: boolean = true;
   public readonly silent: boolean = false;
-  public readonly cacheable: boolean = true;
+  public cacheable: boolean = true;
   public readonly warningsAreAllowed: boolean = false;
   public readonly isNoOp: boolean = false;
   public readonly name: string;
@@ -102,6 +102,10 @@ interface ITestGraph {
   executions: string[];
   cacheWrites: string[];
   cacheRestores: string[];
+  /**
+   * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
+   */
+  checks: string[];
   executeAsync(): Promise<IExecutionResult>;
 }
 
@@ -111,6 +115,11 @@ interface ITestGraphOptions {
    */
   dependencies?: Record<string, string[]>;
   cacheWriteEnabled?: boolean;
+  /**
+   * If set, emulates a plugin with its own change detection (e.g. by tracing the files that each operation reads),
+   * which reports a selected operation as skipped if its name is in this set, because its outputs are up to date.
+   */
+  upToDate?: ReadonlySet<string>;
 }
 
 /**
@@ -118,8 +127,9 @@ interface ITestGraphOptions {
  * The mock build cache stores an entry per operation and state hash, and restores it if it exists.
  */
 async function createTestGraphAsync(names: string[], options: ITestGraphOptions = {}): Promise<ITestGraph> {
-  const { dependencies, cacheWriteEnabled = true } = options;
+  const { dependencies, cacheWriteEnabled = true, upToDate } = options;
   const executions: string[] = [];
+  const checks: string[] = [];
   const cacheWrites: string[] = [];
   const cacheRestores: string[] = [];
   const cacheEntries: Set<string> = new Set();
@@ -201,6 +211,32 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     isIncrementalBuildAllowed: true,
     projectConfigurations
   } as unknown as IOperationGraphContext);
+  if (upToDate) {
+    graph.hooks.beforeExecuteIterationAsync.tap('TestChangeDetectionPlugin', (records) => {
+      for (const operation of records.keys()) {
+        (operation.runner as CacheableMockRunner).cacheable = true;
+      }
+    });
+    graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      // Before the build cache is read
+      { name: 'TestChangeDetectionPlugin', stage: -200 },
+      async (
+        record: IOperationRunnerContext & IOperationExecutionResult
+      ): Promise<OperationStatus | undefined> => {
+        if (record.silent) {
+          return;
+        }
+        const { name } = record.operation;
+        checks.push(name);
+        if (!upToDate.has(name)) {
+          return;
+        }
+        // The build cache does not handle operations that another plugin skipped.
+        (record.operation.runner as CacheableMockRunner).cacheable = false;
+        return OperationStatus.Skipped;
+      }
+    );
+  }
 
   const inputsSnapshot: IInputsSnapshot = {
     hashes: new Map(),
@@ -217,10 +253,12 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     executions,
     cacheWrites,
     cacheRestores,
+    checks,
     executeAsync: async () => {
       executions.length = 0;
       cacheWrites.length = 0;
       cacheRestores.length = 0;
+      checks.length = 0;
       return await graph.executeAsync({ inputsSnapshot });
     }
   };
@@ -398,6 +436,34 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     expect(testGraph.executions).toEqual([]);
   });
 
+  it('does not check results that a plugin found up to date again while their state hashes are unchanged', async () => {
+    const upToDate: Set<string> = new Set(['lib', 'tool', 'app']);
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], { upToDate });
+
+    // The outputs were built before this graph was created.
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['lib', 'tool', 'app']);
+    expect(testGraph.executions).toEqual([]);
+
+    // Checking a skipped result again cannot make it trusted, so it is not re-enabled.
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+
+    // Edit "app": its dependencies are not trusted, so its cache entry is not written.
+    testGraph.localHashes.set('app', 'app-v2');
+    upToDate.delete('app');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    const secondHotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(secondHotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+    expect(testGraph.executions).toEqual([]);
+  });
+
   it('does not re-enable operations that another plugin disabled', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     // Like a plugin that performs the work itself. This tap runs after PhasedOperationPlugin's.
diff --git a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
index d748569f95..da2f64382e 100644
--- a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
@@ -82,6 +82,10 @@ interface ITestGraph {
   operations: Map<string, Operation>;
   localHashes: Map<string, string>;
   executions: string[];
+  /**
+   * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
+   */
+  checks: string[];
   executeAsync(): Promise<IExecutionResult>;
 }
 
@@ -94,6 +98,11 @@ interface ITestGraphOptions {
    * If set, the incremental state files of the legacy skip detection are stored in this folder.
    */
   legacySkipFolder?: string;
+  /**
+   * If set, emulates a plugin with its own change detection (e.g. by tracing the files that each operation reads),
+   * which reports a selected operation as skipped if its name is in this set, because its outputs are up to date.
+   */
+  upToDate?: ReadonlySet<string>;
 }
 
 /**
@@ -103,8 +112,9 @@ async function createTestGraphAsync(
   dependencies: Record<string, string[]>,
   options: ITestGraphOptions = {}
 ): Promise<ITestGraph> {
-  const { noOps, legacySkipFolder } = options;
+  const { noOps, legacySkipFolder, upToDate } = options;
   const executions: string[] = [];
+  const checks: string[] = [];
   const localHashes: Map<string, string> = new Map();
   const operations: Map<string, Operation> = new Map();
 
@@ -153,6 +163,21 @@ async function createTestGraphAsync(
     isIncrementalBuildAllowed: true,
     projectConfigurations: new Map()
   } as unknown as IOperationGraphContext);
+  if (upToDate) {
+    graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      { name: 'TestChangeDetectionPlugin', stage: -200 },
+      async (
+        record: IOperationRunnerContext & IOperationExecutionResult
+      ): Promise<OperationStatus | undefined> => {
+        if (record.silent) {
+          return;
+        }
+        const { name } = record.operation;
+        checks.push(name);
+        return upToDate.has(name) ? OperationStatus.Skipped : undefined;
+      }
+    );
+  }
 
   const inputsSnapshot: IInputsSnapshot = {
     hashes: new Map(),
@@ -168,13 +193,27 @@ async function createTestGraphAsync(
     operations,
     localHashes,
     executions,
+    checks,
     executeAsync: async () => {
       executions.length = 0;
+      checks.length = 0;
       return await graph.executeAsync({ inputsSnapshot });
     }
   };
 }
 
+/**
+ * Returns the status of each operation in the result of an iteration, or "silent" if it was not selected.
+ */
+function getStatuses(testGraph: ITestGraph, result: IExecutionResult): Record<string, string> {
+  const statuses: Record<string, string> = {};
+  for (const [name, operation] of testGraph.operations) {
+    const record: IOperationExecutionResult = result.operationResults.get(operation)!;
+    statuses[name] = record.silent ? 'silent' : record.status;
+  }
+  return statuses;
+}
+
 // How results retained by earlier iterations of a long-lived graph (e.g. the Rush daemon) are verified,
 // whether or not the build cache is in use.
 describe(`${PhasedOperationPlugin.name} retained results`, () => {
@@ -374,6 +413,87 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
     expect(testGraph.executions).toEqual([]);
   });
 
+  it('reuses the result of a selected operation that a plugin found up to date while its state hash is unchanged', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+
+    // The outputs were built before this graph was created.
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+
+    // Edit "b"
+    testGraph.localHashes.set('b', 'b-v2');
+    upToDate.delete('b');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['b']);
+    expect(testGraph.executions).toEqual(['b']);
+
+    const secondHotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(secondHotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('checks a result that a plugin found up to date against outputs of a dependency that were not current again', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+
+    // --only b, after editing "a": "b" is found up to date with the outputs of the previous "a".
+    testGraph.localHashes.set('a', 'a-v2');
+    upToDate.delete('a');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['b']);
+    expect(testGraph.executions).toEqual([]);
+
+    // --to b: "b" has the same state hash as its retained result, but "a" is rebuilt, which changes the inputs of "b".
+    a.enabled = true;
+    upToDate.delete('b');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+  });
+
+  it('checks a result that a plugin found up to date again if it was marked unverifiable, and the results checked against it', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+    const a: Operation = testGraph.operations.get('a')!;
+    let isMarkingA: boolean = true;
+    // Like CacheableOperationPlugin when input files of "a" changed during the iteration
+    testGraph.graph.hooks.afterExecuteOperationAsync.tap(
+      'TestPlugin',
+      (record: IOperationExecutionResult) => {
+        if (isMarkingA && record.operation === a) {
+          markResultUnverifiable(record);
+        }
+      }
+    );
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+
+    // The same state hashes
+    isMarkingA = false;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+  });
+
   describe('with legacy skip detection', () => {
     let legacySkipFolder: string;
 
@@ -429,17 +549,41 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
       // Build once in another process, then start a long-lived graph.
       await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
       const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
-      await testGraph.executeAsync();
-      expect(testGraph.executions).toEqual([]);
+      const a: Operation = testGraph.operations.get('a')!;
 
-      // --to b, after editing "b": "a" is skipped, so it is not verified in this graph.
+      // --only b, after editing "b": "a" is not selected, so it is not verified in this graph.
       testGraph.localHashes.set('b', 'b-v2');
+      a.enabled = false;
       await testGraph.executeAsync();
       expect(testGraph.executions).toEqual(['b']);
 
-      // --to b: the legacy skip detection still skips "b".
+      // --to b: the legacy skip detection skips "a", and still skips "b".
+      a.enabled = true;
       await testGraph.executeAsync();
       expect(testGraph.executions).toEqual([]);
+
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+      expect(testGraph.executions).toEqual([]);
+    });
+
+    it('reuses results that the legacy skip detection found up to date while their state hashes are unchanged', async () => {
+      // Build once in another process, then start a long-lived graph.
+      await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      const result: IExecutionResult = await testGraph.executeAsync();
+      expect(getStatuses(testGraph, result)).toEqual({ a: 'SKIPPED', b: 'SKIPPED' });
+      expect(testGraph.executions).toEqual([]);
+
+      // No iteration is scheduled.
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+
+      // Edit "b": "a" is not checked again.
+      testGraph.localHashes.set('b', 'b-v2');
+      const changedResult: IExecutionResult = await testGraph.executeAsync();
+      expect(getStatuses(testGraph, changedResult)).toEqual({ a: 'silent', b: 'SUCCESS' });
+      expect(testGraph.executions).toEqual(['b']);
     });
   });
 });

From d2dc4375142c1bbd79a36e1a260703442e501b23 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:04:59 +0000
Subject: [PATCH 039/265] [rush-lib] Pass getOperationEnvironment to the
 before/after iteration hooks (and 7 more)

Swarm integration step 24; original commit 31a8db3e65 (merge of swarm/r01-t85-x106b at 4835a8700e).
Scope: tasks 85 and 106.

Brings task 106 (guarded :incremental builds in the daemon) and task 84 at de9a503a50 through r01's 85x106 resolution. This is step 1 of the path in board 2046 and board 2161; step 2 brings task 106's test-only tip b767c64dac. Merging b767c64dac straight onto task 85 conflicts in CacheableOperationPluginRetainedResults.test.ts.

Gate: ch01 GATE OK board 2161 (tree 8250469c70)

Commits folded into this step (8):
- c7400b3f9c [rush-lib] Pass getOperationEnvironment to the before/after iteration hooks
- e07159a38f [rush-lib] Let the daemon run :incremental scripts when a guard allows it
- 90a76234e5 [rush-lib] Register RUSH_DAEMON_INCREMENTAL_BUILDS as a known environment variable
- b1647a952a [rush-lib] Test that --only consumers of a retained incremental result skip cache writes
- aed31544c2 [rush-lib] Test that a terminated command drops its incremental base
- 69e33c03a8 [rush-lib] Format the incremental build changes with Prettier
- c3afda3587 [rush-lib] Test that a run whose inputs changed while it ran leaves no incremental base
- de9a503a50 [rush-lib] Check dependencies reached through same-project phases in the incremental guard

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   1 +
 .../rushd-incremental-builds_2026-09-28.json  |  11 +
 .../rushd-iteration-hook-env_2026-09-28.json  |  11 +
 .../rushd-incremental-builds_2026-09-28.json  |  11 +
 .../rushd-incremental-builds_2026-09-28.json  |  11 +
 common/reviews/api/rush-lib.api.md            |   2 +
 docs/rush/dogfooding-rush-daemon.md           |   8 +
 docs/rush/environment-variables.md            |   1 +
 .../src/WorkspaceEngineComponentFactory.ts    |   2 +
 .../ProductionDaemonRequestResolver.test.ts   |  67 +-
 .../rush-lib/src/api/DaemonConfiguration.ts   |  18 +-
 .../src/api/EnvironmentConfiguration.ts       |   3 +
 .../src/api/test/DaemonConfiguration.test.ts  |  16 +-
 .../api/test/EnvironmentConfiguration.test.ts |   8 +
 .../cli/scriptActions/PhasedScriptAction.ts   |  11 +
 .../operations/CacheableOperationPlugin.ts    |  63 +-
 .../IncrementalExecutionGuardPlugin.ts        | 573 +++++++++++++++
 .../operations/IncrementalExecutionState.ts   |  83 +++
 .../src/logic/operations/LegacySkipPlugin.ts  |   7 +
 .../src/logic/operations/OperationGraph.ts    |   3 +-
 .../operations/OperationOutputManifest.ts     | 218 ++++++
 .../PhasedCommandEngineExecution.ts           |   3 +-
 .../logic/operations/ShellOperationRunner.ts  | 305 +++++---
 .../operations/ShellOperationRunnerPlugin.ts  |  29 +-
 ...ableOperationPluginRetainedResults.test.ts | 114 ++-
 .../IncrementalExecutionGuardPlugin.test.ts   | 691 ++++++++++++++++++
 ...OperationGraphOperationEnvironment.test.ts |  29 +
 .../test/OperationOutputManifest.test.ts      | 125 ++++
 ...ellOperationRunnerIncrementalGuard.test.ts | 213 ++++++
 .../test/ShellOperationRunnerPlugin.test.ts   | 116 +++
 .../rush-lib/src/schemas/rush.schema.json     |   5 +
 31 files changed, 2622 insertions(+), 136 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-incremental-builds_2026-09-28.json
 create mode 100644 common/changes/@microsoft/rush/rushd-iteration-hook-env_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/rushd-incremental-builds_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-incremental-builds_2026-09-28.json
 create mode 100644 libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 3a2bd0f840..676cae2822 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -281,6 +281,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `queueTimeoutSeconds` | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | 30 | Admission wait limit. Time behind another request's graph load (up to 10 times the limit) and the request's own work do not count. The default does not limit waiting behind a running compatible build, or, for a daemon restart, behind requests that were already running (while no `rushx` script is running); an explicit value does |
 | `watch` | `RUSH_DAEMON_WATCH` | false | Persistent host observation of requested warm projects; false keeps root/config guards only. Never schedules builds |
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
+| `incrementalBuilds` | `RUSH_DAEMON_INCREMENTAL_BUILDS` | true | Runs an operation's `<phase>:incremental` script instead of its initial script when only files it builds were edited since its last successful run in the daemon and its output folders are unchanged. Additions, deletions, renames, configuration, tool, environment and command-line changes, bundled outputs, cache restores and native Rush commands run the initial script. Incremental results are never written to the build cache |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
 | `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
 | `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
diff --git a/common/changes/@microsoft/rush/rushd-incremental-builds_2026-09-28.json b/common/changes/@microsoft/rush/rushd-incremental-builds_2026-09-28.json
new file mode 100644
index 0000000000..fa138c064c
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-incremental-builds_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let the Rush daemon run an operation's `<phase>:incremental` script outside watch mode, on top of the outputs of its last successful run in the daemon, when only files that the operation builds were edited since then and its output folders are unchanged. Additions, deletions and renames of input files, changes to configuration files, build tools, dependsOnEnvVars values or the command line, bundled outputs, build cache restores and native Rush commands make it run the initial script, and the operation log says why. Results of the incremental script, and of operations built against them, are never written to the build cache. Set `daemon.incrementalBuilds` to false in rush.json, or `RUSH_DAEMON_INCREMENTAL_BUILDS=0`, to always run the initial script.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/rushd-iteration-hook-env_2026-09-28.json b/common/changes/@microsoft/rush/rushd-iteration-hook-env_2026-09-28.json
new file mode 100644
index 0000000000..965ac454d4
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-iteration-hook-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Pass `getOperationEnvironment` to the `beforeExecuteIterationAsync` and `afterExecuteIterationAsync` hooks of an operation graph, so that they receive the same iteration options as `configureIteration`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/rushd-incremental-builds_2026-09-28.json b/common/changes/@rushstack/rush-cli-client/rushd-incremental-builds_2026-09-28.json
new file mode 100644
index 0000000000..55bdda953b
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/rushd-incremental-builds_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the `incrementalBuilds` daemon setting and `RUSH_DAEMON_INCREMENTAL_BUILDS`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-incremental-builds_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-incremental-builds_2026-09-28.json
new file mode 100644
index 0000000000..6df532751c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-incremental-builds_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that daemon builds run an operation's `:incremental` script after an edit of a file that it builds, and never write its result to the build cache.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 9e61e8f19d..55724ef1d0 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -321,6 +321,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_AUTO_START: "RUSH_DAEMON_AUTO_START";
     readonly RUSH_DAEMON_WATCH: "RUSH_DAEMON_WATCH";
     readonly RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: "RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS";
+    readonly RUSH_DAEMON_INCREMENTAL_BUILDS: "RUSH_DAEMON_INCREMENTAL_BUILDS";
     readonly RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: "RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS: "RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
@@ -528,6 +529,7 @@ export interface IDaemonConfigurationJson {
     readonly compatiblePlugins?: ReadonlyArray<string>;
     readonly enabled?: boolean;
     readonly idleTimeoutSeconds?: number;
+    readonly incrementalBuilds?: boolean;
     readonly queueTimeoutSeconds?: number;
     readonly usePersistentIpcRunners?: boolean;
     readonly warmIdleTimeoutSeconds?: number;
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 77a9fb7106..ef9af40482 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -191,6 +191,14 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
 - **No persistent Heft or TypeScript workers.** Each operation still starts its Heft process; the daemon
   saves Rush startup and graph construction, not compilation. The `usePersistentIpcRunners`/`daemonIpc`
   mode requires a bundled, self-contained worker entry point, and Heft is not packaged that way.
+- **`:incremental` scripts.** With `daemon.incrementalBuilds` (on by default), an operation whose project
+  defines a `_phase:<name>:incremental` script runs it instead of the initial script when only files that the
+  operation builds were edited since its last successful run in the daemon. The operation log then says
+  `Invoking (incremental): ...`. An added, deleted or renamed input, a configuration, tool, environment or
+  command-line change, a change to its output folders, bundled outputs, a cache restore or a native `rush`
+  command make it run the initial script, and the log says why (`Not using the incremental command because
+  ...`). Incremental results are never written to the build cache, and neither are the results of operations
+  built against them. Set `RUSH_DAEMON_INCREMENTAL_BUILDS=0` to always run the initial script.
 - **Plugins.** This repository's only configured plugin, `@rushstack/rush-published-versions-json-plugin`,
   is associated only with `record-published-versions` and is inert for builds. A plugin without
   `associatedCommands`, a plugin associated with `build` or `rebuild`, or a plugin command-line that defines
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 590a0932a3..09e141ae94 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -27,6 +27,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS` | `30` | Maximum request admission wait. Nonnegative seconds, at most 2147483.647; converted to whole milliseconds by rounding down. Time behind another request's load of the workspace graph (up to 10 times this value) does not count. Per-invocation `--wait-timeout` or `--no-wait` takes precedence. Overrides `queueTimeoutSeconds`. |
 | `RUSH_DAEMON_WATCH` | `0` | Observe requested warm projects between requests. Never schedules builds and does not enable `--watch` mode. Root/config guards and request-time input reconciliation remain active when disabled. Overrides `watch`. |
 | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | `0` | Enable explicitly configured `operationSettings[].daemonIpc` Node workers for supported incremental daemon builds. Does not convert arbitrary shell scripts into persistent workers. Overrides `usePersistentIpcRunners`. |
+| `RUSH_DAEMON_INCREMENTAL_BUILDS` | `1` | Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. `0` always runs the initial script. Incremental results are never written to the build cache. Overrides `incrementalBuilds`. |
 | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
 | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
diff --git a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
index 1f2686cacd..9b34180ea6 100644
--- a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
+++ b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
@@ -23,6 +23,8 @@ import type {
   WorkspaceInvalidationTracker
 } from './WorkspaceInvalidationTracker';
 
+// Rush's incremental execution guard keeps the base of an operation that is invalidated with this reason, because it
+// compares the operation's inputs itself (INPUTS_CHANGED_INVALIDATION_REASON in rush-lib). Keep the two in sync.
 const INVALIDATION_REASON: 'workspace-inputs-changed' = 'workspace-inputs-changed';
 
 /**
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index b2d718df00..03381a9d62 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -77,8 +77,10 @@ interface IFixtureOptions {
   readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
   readonly onSessionCreated?: (session: WorkspaceSession) => void;
   readonly resolver?: IDaemonRequestResolver;
-  /** Adds the watch-only `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
+  /** Adds the `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
   readonly incrementalScript?: boolean;
+  /** Sets `daemon.incrementalBuilds` in rush.json. */
+  readonly incrementalBuilds?: boolean;
   /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
   readonly pnpm?: boolean;
 }
@@ -141,7 +143,10 @@ async function createFixtureAsync(
       rushVersion: RUSH_VERSION,
       ...(options.pnpm ? { pnpmVersion: '9.15.9' } : { npmVersion: '10.0.0' }),
       // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
-      daemon: { warmMemoryBudgetMB: 100_000 },
+      daemon: {
+        warmMemoryBudgetMB: 100_000,
+        ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds })
+      },
       projectFolderMinDepth: 2,
       projectFolderMaxDepth: 2,
       projects: ['a', 'b', 'c'].map((name) => ({
@@ -220,7 +225,7 @@ async function createFixtureAsync(
 const fs = require('node:fs');
 const path = require('node:path');
 const name = require('./package.json').name;
-const input = fs.readFileSync('input.txt', 'utf8');
+const input = fs.readFileSync(fs.existsSync('src/input.txt') ? 'src/input.txt' : 'input.txt', 'utf8');
 (async () => {
 const gateFile = path.resolve('../../common/temp/gate-' + name + '.json');
 if (fs.existsSync(gateFile)) {
@@ -1507,8 +1512,11 @@ process.exit(23);
     }
   });
 
-  it('runs the initial script for every warm build request, as native rush build does, not the watch-only one', async () => {
-    const fixture: IFixture = await createFixtureAsync(true, 'direct', { incrementalScript: true });
+  it('runs the initial script for every warm build request, as native rush build does, if incremental builds are off', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', {
+      incrementalScript: true,
+      incrementalBuilds: false
+    });
     try {
       for (const [requestId, input] of [
         ['initial-script-1', 'one'],
@@ -1531,6 +1539,55 @@ process.exit(23);
     }
   });
 
+  it('runs the incremental script for an edit of a built file, and never caches its result', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', { incrementalScript: true });
+    const inputPath: string = path.join(fixture.repoRoot, 'projects/a/src/input.txt');
+    const buildAsync = async (requestId: string, input: string, status: string): Promise<string> => {
+      fs.mkdirSync(path.dirname(inputPath), { recursive: true });
+      fs.writeFileSync(inputPath, input);
+      const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'a']);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status }] }
+      });
+      return logText(exchange);
+    };
+    try {
+      expect(await buildAsync('incremental-1', 'one', 'SUCCESS')).toContain(
+        'Invoking (initial): node build.cjs'
+      );
+      const incremental: string = await buildAsync('incremental-2', 'two', 'SUCCESS');
+      expect(incremental).toContain('Invoking (incremental): node build.cjs --incremental');
+      expect(incremental).toContain(
+        'This operation ran its incremental command; not writing a build cache entry.'
+      );
+      await buildAsync('incremental-3', 'three', 'SUCCESS');
+      // The result of the incremental script was not cached, so it runs again.
+      await buildAsync('incremental-4', 'two', 'SUCCESS');
+      // The result of the initial script was cached.
+      await buildAsync('incremental-5', 'one', 'FROM CACHE');
+      // The incremental script never runs on top of outputs restored from the build cache.
+      expect(await buildAsync('incremental-6', 'three', 'SUCCESS')).toContain(
+        'Not using the incremental command because its outputs were not built by a successful run of its own' +
+          ' command in this process.'
+      );
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), 'root');
+      expect(await buildAsync('incremental-7', 'three', 'SUCCESS')).toContain(
+        'Not using the incremental command because a configuration file changed ("projects/a/input.txt").'
+      );
+      expect(runs(fixture)).toEqual([
+        'a:one:',
+        'a:two:--incremental',
+        'a:three:--incremental',
+        'a:two:--incremental',
+        'a:three:',
+        'a:three:'
+      ]);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('re-runs only the operation whose declared outputs were deleted after a warm build', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 09c17f999d..8edf596f7e 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -13,6 +13,13 @@ export interface IDaemonConfigurationJson {
   readonly watch?: boolean;
   /** Enables explicit operationSettings[].daemonIpc Node runners for daemon builds. Defaults to false. */
   readonly usePersistentIpcRunners?: boolean;
+  /**
+   * Lets daemon builds run an operation's `<phase>:incremental` script, instead of its initial script, on top of the
+   * outputs of its last successful run in the daemon, when only files that it builds were edited since then and its
+   * output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. Results of an
+   * incremental script are not written to the build cache. Defaults to true.
+   */
+  readonly incrementalBuilds?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
   /**
@@ -45,6 +52,7 @@ const defaults: Required<IDaemonConfigurationJson> = {
   autoStart: true,
   watch: false,
   usePersistentIpcRunners: false,
+  incrementalBuilds: true,
   queueTimeoutSeconds: 30,
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
@@ -61,6 +69,7 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     autoStart: 'RUSH_DAEMON_AUTO_START',
     watch: 'RUSH_DAEMON_WATCH',
     usePersistentIpcRunners: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
+    incrementalBuilds: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
     queueTimeoutSeconds: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
@@ -103,6 +112,7 @@ export function resolveDaemonConfiguration(
     autoStart: booleanOption('autoStart', json, environment),
     watch: booleanOption('watch', json, environment),
     usePersistentIpcRunners: booleanOption('usePersistentIpcRunners', json, environment),
+    incrementalBuilds: booleanOption('incrementalBuilds', json, environment),
     autoWarmByTelemetry: booleanOption('autoWarmByTelemetry', json, environment),
     idleTimeoutSeconds: numberOption('idleTimeoutSeconds', json, environment),
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
@@ -143,7 +153,13 @@ function isPluginName(name: string): boolean {
 }
 
 function booleanOption(
-  key: 'enabled' | 'autoStart' | 'watch' | 'autoWarmByTelemetry' | 'usePersistentIpcRunners',
+  key:
+    | 'enabled'
+    | 'autoStart'
+    | 'watch'
+    | 'autoWarmByTelemetry'
+    | 'usePersistentIpcRunners'
+    | 'incrementalBuilds',
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): boolean {
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index 00357ce7d2..926237dd35 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -276,6 +276,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_WATCH: 'RUSH_DAEMON_WATCH',
   /** Enables explicitly configured persistent Node IPC operations in the daemon. */
   RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
+  /** Lets daemon builds run an operation's guarded `:incremental` script outside watch mode. */
+  RUSH_DAEMON_INCREMENTAL_BUILDS: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
   /** Overrides the request admission queue timeout. */
   RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   /** Overrides idle eviction in an attached daemon warm set. */
@@ -694,6 +696,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_AUTO_START:
           case EnvironmentVariableNames.RUSH_DAEMON_WATCH:
           case EnvironmentVariableNames.RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS:
+          case EnvironmentVariableNames.RUSH_DAEMON_INCREMENTAL_BUILDS:
           case EnvironmentVariableNames.RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index fb16ad2fd5..af95f8278d 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -11,6 +11,7 @@ describe('daemon configuration', () => {
       enabled: false,
       autoStart: true,
       usePersistentIpcRunners: false,
+      incrementalBuilds: true,
       idleTimeoutSeconds: 900
     });
     expect(
@@ -35,7 +36,8 @@ describe('daemon configuration', () => {
     { RUSH_DAEMON_WARM_SET_MAX_PROJECTS: '1.5' },
     { RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: '' },
     { RUSH_DAEMON_EXPERIMENTAL: 'yes' },
-    { RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'yes' }
+    { RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'yes' },
+    { RUSH_DAEMON_INCREMENTAL_BUILDS: 'off' }
   ])('rejects invalid overrides %j', (environment) => {
     expect(() => resolveDaemonConfiguration({}, environment)).toThrow();
   });
@@ -53,6 +55,7 @@ describe('daemon configuration', () => {
     { warmSetMaxProjects: 0.5 },
     { autoWarmByTelemetry: 1 },
     { usePersistentIpcRunners: 'true' },
+    { incrementalBuilds: 'false' },
     { compatiblePlugins: 'rush-example-plugin' },
     { compatiblePlugins: [''] },
     { compatiblePlugins: [' rush-example-plugin'] },
@@ -68,6 +71,17 @@ describe('daemon configuration', () => {
     ).toThrow();
   });
 
+  it('runs :incremental scripts in the daemon unless the environment or configuration turns it off', () => {
+    expect(resolveDaemonConfiguration({ incrementalBuilds: false }, {}).incrementalBuilds).toBe(false);
+    expect(
+      resolveDaemonConfiguration({ incrementalBuilds: false }, { RUSH_DAEMON_INCREMENTAL_BUILDS: '1' })
+        .incrementalBuilds
+    ).toBe(true);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_INCREMENTAL_BUILDS: '0' }).incrementalBuilds).toBe(
+      false
+    );
+  });
+
   it('resolves compatible plugin names from the environment, then configuration, then no plugins', () => {
     expect(resolveDaemonConfiguration({}, {}).compatiblePlugins).toEqual([]);
     const configured: string[] = ['rush-a-plugin', 'rush-b-plugin'];
diff --git a/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts b/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts
index 0dc982bb2e..ca75e513a1 100644
--- a/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/EnvironmentConfiguration.test.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import { daemonEnvironmentVariables } from '../DaemonConfiguration';
 import { EnvironmentConfiguration } from '../EnvironmentConfiguration';
 
 describe(EnvironmentConfiguration.name, () => {
@@ -37,6 +38,13 @@ describe(EnvironmentConfiguration.name, () => {
       expect(process.env.RUSH_LOG_LEVEL).toBe(env.RUSH_LOG_LEVEL);
     });
 
+    it('allows every daemon environment variable', () => {
+      for (const name of Object.values(daemonEnvironmentVariables)) {
+        process.env[name] = '1';
+      }
+      expect(EnvironmentConfiguration.validate).not.toThrow();
+    });
+
     it('does not allow unknown environment variables', () => {
       process.env['rush_foobar'] = 'asdf'; // eslint-disable-line dot-notation
       expect(EnvironmentConfiguration.validate).toThrow();
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 0e6b9ba4a1..da402638e6 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -660,6 +660,17 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           );
           new DaemonIpcOperationRunnerPlugin().apply(this.hooks);
         }
+        if (
+          onEngine &&
+          this.#isIncrementalBuildAllowed &&
+          this.rushConfiguration.daemon.incrementalBuilds &&
+          !cobuildConfiguration?.cobuildFeatureEnabled
+        ) {
+          const { IncrementalExecutionGuardPlugin } = await import(
+            /* webpackChunkName: 'IncrementalExecutionGuardPlugin' */ '../../logic/operations/IncrementalExecutionGuardPlugin'
+          );
+          new IncrementalExecutionGuardPlugin().apply(this.hooks);
+        }
         if (isWatch && this.#noIPCParameter?.value === false) {
           new (
             await import(
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 5f96073993..0a5de47256 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -51,6 +51,7 @@ import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration'
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
 import { enableUnverifiedRetainedOperations, markResultUnverifiable } from './RetainedResultVerification';
+import { wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
 const PERIODIC_CALLBACK_INTERVAL_IN_SECONDS: number = 10;
@@ -83,6 +84,12 @@ export interface IOperationBuildCacheContext {
   cacheRestored: boolean;
   isCacheReadAttempted: boolean;
 
+  // True if the outputs of this operation were produced by its incremental command in this iteration (see
+  // IncrementalExecutionGuardPlugin), or if it executed against outputs of a dependency that were. Such outputs
+  // can differ from those of the initial command, so neither they nor the outputs of their consumers are written
+  // to the build cache. Unlike a blocked cache write, this does not stop a long-lived graph from trusting them.
+  isIncrementalResult: boolean;
+
   // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
   // the iteration's inputs snapshot. Used to refuse cache writes, and to keep a long-lived graph from skipping
   // the operation later, if the inputs changed while the snapshot was being taken or while the operation was
@@ -192,10 +199,14 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
       // The state hash at which each operation last completed successfully in an iteration of this graph
       // in which cache writes were allowed for it (i.e. no dependency had an unknown state).
       const trustedStateHashByOperation: Map<Operation, string> = new Map();
+      // The trusted state hash of each operation whose trusted outputs are an incremental result, which must not
+      // be written to the build cache, nor may the outputs of its consumers.
+      const incrementalStateHashByOperation: Map<Operation, string> = new Map();
 
       graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>) => {
         for (const operation of operations) {
           trustedStateHashByOperation.delete(operation);
+          incrementalStateHashByOperation.delete(operation);
         }
         // Terminals and cobuild callbacks can retain the entire completed iteration, including other
         // projects' records. All of this scratch state is rebuilt by beforeExecuteIterationAsync.
@@ -300,6 +311,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }),
               cacheRestored: false,
               isCacheReadAttempted: false,
+              isIncrementalResult: false,
               inputFilesState,
               inputFileHashes: inputFilesState ? fileHashes : undefined
             };
@@ -576,8 +588,21 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             return;
           }
 
-          const { cobuildLock, operationBuildCache, isCacheWriteAllowed, buildCacheTerminal, cacheRestored } =
-            buildCacheContext;
+          const ranIncrementalCommand: boolean =
+            !buildCacheContext.cacheRestored && wasExecutedIncrementally(record);
+          if (ranIncrementalCommand) {
+            buildCacheContext.isIncrementalResult = true;
+          }
+
+          const {
+            cobuildLock,
+            operationBuildCache,
+            isCacheWriteAllowed: isCacheWriteAllowedForOperation,
+            isIncrementalResult,
+            buildCacheTerminal,
+            cacheRestored
+          } = buildCacheContext;
+          const isCacheWriteAllowed: boolean = isCacheWriteAllowedForOperation && !isIncrementalResult;
 
           try {
             if (!cacheRestored) {
@@ -607,6 +632,12 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               throw new InternalError(`Build Cache Terminal is not created`);
             }
 
+            if (ranIncrementalCommand && isCacheWriteAllowedForOperation) {
+              buildCacheTerminal.writeLine(
+                'This operation ran its incremental command; not writing a build cache entry.'
+              );
+            }
+
             let setCompletedStatePromiseFunction: (() => Promise<void> | undefined) | undefined;
             let setCacheEntryPromise: (() => Promise<boolean> | undefined) | undefined;
             if (cobuildLock && isCacheWriteAllowed) {
@@ -712,6 +743,8 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             this.#buildCacheContextByOperation.get(operation);
           // Status changes to direct dependents
           let blockCacheWrite: boolean = !buildCacheContext?.isCacheWriteAllowed;
+          // Whether the outputs that consumers execute against are an incremental result
+          let isIncrementalResult: boolean = false;
 
           switch (record.status) {
             case OperationStatus.Skipped: {
@@ -724,30 +757,50 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               if (blockCacheWrite || trustedStateHashByOperation.get(operation) !== record.getStateHash()) {
                 blockCacheWrite = true;
                 trustedStateHashByOperation.delete(operation);
+                incrementalStateHashByOperation.delete(operation);
+              } else {
+                isIncrementalResult =
+                  incrementalStateHashByOperation.get(operation) === record.getStateHash();
               }
               break;
             }
 
             default: {
+              // Outputs restored from the build cache are those of the initial command.
+              isIncrementalResult =
+                record.status !== OperationStatus.FromCache &&
+                (!!buildCacheContext?.isIncrementalResult || wasExecutedIncrementally(record));
               if (!blockCacheWrite && buildCacheContext && SUCCESS_STATUSES.has(record.status)) {
                 // The outputs of this operation were produced (or restored) in an iteration where cache
                 // writes were allowed, so they can be trusted by consumers in later iterations as long as
-                // the state hash is unchanged.
+                // the state hash is unchanged. An incremental result is trusted too, but it still blocks the
+                // cache writes of consumers.
                 trustedStateHashByOperation.set(operation, record.getStateHash());
+                if (isIncrementalResult) {
+                  incrementalStateHashByOperation.set(operation, record.getStateHash());
+                } else {
+                  incrementalStateHashByOperation.delete(operation);
+                }
               } else {
                 trustedStateHashByOperation.delete(operation);
+                incrementalStateHashByOperation.delete(operation);
               }
               break;
             }
           }
 
           // Apply status changes to direct dependents
-          if (blockCacheWrite) {
+          if (blockCacheWrite || isIncrementalResult) {
             for (const consumer of operation.consumers) {
               const consumerBuildCacheContext: IOperationBuildCacheContext | undefined =
                 this.#getBuildCacheContextByOperation(consumer);
               if (consumerBuildCacheContext) {
-                consumerBuildCacheContext.isCacheWriteAllowed = false;
+                if (blockCacheWrite) {
+                  consumerBuildCacheContext.isCacheWriteAllowed = false;
+                }
+                if (isIncrementalResult) {
+                  consumerBuildCacheContext.isIncrementalResult = true;
+                }
               }
             }
           }
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
new file mode 100644
index 0000000000..f643f8b135
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -0,0 +1,573 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, type Hash } from 'node:crypto';
+import * as path from 'node:path';
+
+import { FileSystem, InternalError, Path } from '@rushstack/node-core-library';
+
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import type {
+  IOperationGraphContext,
+  IPhasedCommandPlugin,
+  PhasedCommandHooks
+} from '../../pluginFramework/PhasedCommandHooks';
+import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
+import type { IOperationRunnerContext } from './IOperationRunner';
+import type { Operation } from './Operation';
+import { OperationStatus } from './OperationStatus';
+import {
+  getCommandExecution,
+  INPUTS_CHANGED_INVALIDATION_REASON,
+  NATIVE_COMMAND_INVALIDATION_REASON,
+  setIncrementalExecutionGuard,
+  type ICommandExecution,
+  type IIncrementalExecutionGuard
+} from './IncrementalExecutionState';
+import {
+  describeOutputFileChanges,
+  readOperationOutputManifestAsync,
+  type IOperationOutputManifest
+} from './OperationOutputManifest';
+import { isResultUnverifiable } from './RetainedResultVerification';
+
+const PLUGIN_NAME: 'IncrementalExecutionGuardPlugin' = 'IncrementalExecutionGuardPlugin';
+
+// Runs after the default-stage taps, e.g. CacheableOperationPlugin's input file checks, which can mark a result as
+// unverifiable.
+const RECORD_RESULT_STAGE: number = 1;
+
+const MAX_EXAMPLE_PATHS: number = 3;
+
+// Project files that configure a build rather than being built by it.
+const CONFIG_INPUT_FILE_NAME_REGEXP: RegExp =
+  /^(?:package\.json|tsconfig[^/]*\.json|\.eslintrc[^/]*|eslint\.config\.[^/]+|\.eslintignore|\.babelrc[^/]*|babel\.config\.[^/]+|[^/]+\.config\.(?:[cm]?[jt]s|json)|\.npmrc|\.browserslistrc|\.gitignore)$/;
+const CONFIG_INPUT_FOLDER_REGEXP: RegExp = /^(?:config|\.rush)\//;
+// Dependencies that are part of the build toolchain, even when they are production dependencies.
+const TOOLING_PACKAGE_NAME_REGEXP: RegExp =
+  /(?:^|[/-])(?:eslint-(?:config|plugin)|tsconfig|prettier-config|babel-(?:preset|plugin))(?:-|$)/;
+
+/**
+ * The inputs of an operation that decide whether it may run its incremental command, as of one inputs snapshot.
+ */
+export interface IIncrementalInputState {
+  /**
+   * The path of the operation's project folder relative to the root of the inputs snapshot, with a trailing `/`,
+   * or an empty string for a project at the root.
+   */
+  readonly projectPrefix: string;
+  /**
+   * The configuration hash of the operation's runner, e.g. its command line.
+   */
+  readonly configHash: string;
+  /**
+   * The values of the environment variables that the operation depends on.
+   */
+  readonly environment: string;
+  /**
+   * The state hash of each dependency of the operation, including the dependencies that it has through operations
+   * of its own project, by operation name.
+   */
+  readonly dependencyStateHashes: ReadonlyMap<string, string>;
+  /**
+   * Covers the paths of the operation's input files.
+   */
+  readonly inputPathsDigest: string;
+  /**
+   * Covers the paths and hashes of the operation's configuration input files.
+   */
+  readonly configInputsDigest: string;
+  /**
+   * The operation's input files and their hashes, used to name changed files while the snapshot is in memory.
+   */
+  readonly inputFiles: WeakRef<ReadonlyMap<string, string>>;
+}
+
+/**
+ * Captures the inputs of an operation that decide whether it may run its incremental command.
+ *
+ * @param record - The operation's result or execution record in the iteration that uses `inputsSnapshot`
+ * @param inputsSnapshot - The inputs snapshot of the iteration
+ * @param environment - The environment that the operation runs with in the iteration
+ * @param records - The results or execution records of the iteration, by operation
+ */
+export function captureIncrementalInputState(
+  record: IOperationExecutionResult,
+  inputsSnapshot: IInputsSnapshot,
+  environment: Readonly<Record<string, string | undefined>>,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>
+): IIncrementalInputState {
+  const { operation } = record;
+  const { associatedProject: project, associatedPhase: phase, settings } = operation;
+  const { config } = record.getStateHashComponents();
+
+  const inputFiles: ReadonlyMap<string, string> = inputsSnapshot.getTrackedFileHashesForOperation(
+    project,
+    phase.name
+  );
+  const projectPrefix: string = getProjectPrefix(inputsSnapshot, project);
+  const inputPathsHash: Hash = createHash('sha1');
+  const configInputsHash: Hash = createHash('sha1');
+  for (const filePath of Array.from(inputFiles.keys()).sort()) {
+    inputPathsHash.update(`${filePath}\n`);
+    if (isConfigInput(filePath, projectPrefix)) {
+      configInputsHash.update(`${filePath}\0${inputFiles.get(filePath)}\n`);
+    }
+  }
+
+  const dependencyStateHashes: Map<string, string> = new Map();
+  for (const [name, dependency] of getGuardedDependencies(operation)) {
+    const dependencyRecord: IOperationExecutionResult | undefined = records.get(dependency);
+    if (!dependencyRecord) {
+      throw new InternalError(`The iteration has no record of the operation "${name}".`);
+    }
+    dependencyStateHashes.set(name, dependencyRecord.getStateHash());
+  }
+
+  return {
+    projectPrefix,
+    configHash: config,
+    environment: (settings?.dependsOnEnvVars ?? [])
+      .map((name: string) => `${name}=${environment[name] || ''}`)
+      .join('\n'),
+    dependencyStateHashes,
+    inputPathsDigest: inputPathsHash.digest('hex'),
+    configInputsDigest: configInputsHash.digest('hex'),
+    inputFiles: new WeakRef(inputFiles)
+  };
+}
+
+/**
+ * Returns why an operation must not run its incremental command on top of the outputs of its last successful run,
+ * judging by how its inputs changed since that run, or `undefined` if the inputs allow it.
+ *
+ * @remarks
+ * The incremental command is only trusted to handle edits of the files that the operation builds. It may keep the
+ * outputs of deleted or renamed files, and it may not notice a change to the configuration or the tools of the
+ * build. The inputs therefore only allow it if these are unchanged:
+ *
+ * - the operation's command line and the environment variables that it depends on;
+ * - the set of its input files, so that no file was added, deleted or renamed;
+ * - its configuration input files: any file outside of the project folder (e.g. the shrinkwrap file or a global
+ *   additional file), any file in the project's root folder, `config/` or `.rush/` folders, and configuration files
+ *   such as `tsconfig*.json`, `.eslintrc*` or `*.config.js` anywhere in the project;
+ * - the set of its dependencies, and each dependency that belongs to another project and is not a production
+ *   dependency (`dependencies`, `optionalDependencies` or `peerDependencies` in package.json), or that is a build
+ *   tool such as a rig, a Heft plugin or a lint configuration. This includes the dependencies that the operation has
+ *   through operations of its own project, e.g. through a phase without a script that only orders its build after
+ *   the builds of other projects.
+ *
+ * @param operation - The operation
+ * @param lastState - The inputs of the operation's last successful run
+ * @param currentState - The inputs of the run that is about to start
+ */
+export function getIncrementalInputChangeReason(
+  operation: Operation,
+  lastState: IIncrementalInputState,
+  currentState: IIncrementalInputState
+): string | undefined {
+  if (lastState.configHash !== currentState.configHash) {
+    return 'its command line changed';
+  }
+  if (lastState.environment !== currentState.environment) {
+    return 'an environment variable that it depends on changed';
+  }
+  if (lastState.inputPathsDigest !== currentState.inputPathsDigest) {
+    return `input files were added, deleted or renamed${describeInputFileChanges(
+      lastState,
+      currentState,
+      (lastHash: string | undefined, currentHash: string | undefined) =>
+        (lastHash === undefined) !== (currentHash === undefined)
+    )}`;
+  }
+  if (lastState.configInputsDigest !== currentState.configInputsDigest) {
+    return `a configuration file changed${describeInputFileChanges(
+      lastState,
+      currentState,
+      (lastHash: string | undefined, currentHash: string | undefined, filePath: string) =>
+        lastHash !== currentHash && isConfigInput(filePath, currentState.projectPrefix)
+    )}`;
+  }
+
+  const { dependencyStateHashes: lastDependencies } = lastState;
+  const { dependencyStateHashes: currentDependencies } = currentState;
+  if (lastDependencies.size !== currentDependencies.size) {
+    return 'its dependencies changed';
+  }
+  const dependencyByName: ReadonlyMap<string, Operation> = getGuardedDependencies(operation);
+  for (const [name, stateHash] of currentDependencies) {
+    const lastStateHash: string | undefined = lastDependencies.get(name);
+    const dependency: Operation | undefined = dependencyByName.get(name);
+    if (lastStateHash === undefined || !dependency) {
+      return 'its dependencies changed';
+    }
+    if (lastStateHash !== stateHash) {
+      const reason: string | undefined = getToolingDependencyReason(operation, dependency);
+      if (reason) {
+        return reason;
+      }
+    }
+  }
+
+  return undefined;
+}
+
+/**
+ * Lets operations of a long-lived host, such as the Rush daemon, run their `:incremental` command outside watch mode
+ * when doing so builds the same outputs as their initial command.
+ *
+ * @remarks
+ * An operation runs its incremental command only if all of these hold, and its initial command otherwise:
+ *
+ * 1. Its last result in this graph is a success of its own command, not a result restored from the build cache, a
+ *    failure, or a run that was interrupted or whose input files changed while it ran. A native Rush command that
+ *    ran in the workspace since then forgets every such result.
+ * 2. Its inputs changed as {@link getIncrementalInputChangeReason} allows.
+ * 3. Its declared output folders hold the same files and folders as at the end of that run, and none of the folders
+ *    was recreated or had an entry added, removed or replaced since then.
+ * 4. Its outputs do not include bundles (JavaScript or CSS in a `dist` or `release` folder, or with a content hash in
+ *    the name). A bundler can replace a chunk with a differently named one and leave the old one behind.
+ *
+ * When the incremental command succeeds, the operation's output files must be the files that it had before, or the
+ * initial command runs as well. Results of the incremental command are never written to the build cache (see
+ * `CacheableOperationPlugin`).
+ */
+export class IncrementalExecutionGuardPlugin implements IPhasedCommandPlugin {
+  public apply(hooks: PhasedCommandHooks): void {
+    hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph: IOperationGraph, context: IOperationGraphContext) => {
+      if (context.isIncrementalBuildAllowed && !context.isWatch) {
+        applyToGraph(graph);
+      }
+    });
+  }
+}
+
+interface IOutputState {
+  readonly signature: string;
+  readonly cleanOnlyReason: string | undefined;
+}
+
+interface IIncrementalBase {
+  readonly inputs: IIncrementalInputState;
+  // Rejects if the output folders could not be read.
+  readonly outputsPromise: Promise<IOutputState>;
+}
+
+interface IRecordState {
+  readonly records: ReadonlyMap<Operation, IOperationExecutionResult>;
+  readonly inputsSnapshot: IInputsSnapshot;
+  readonly getOperationEnvironment: IOperationGraphIterationOptions['getOperationEnvironment'];
+  preRunOutputs?: IOperationOutputManifest;
+  verifiedOutputs?: IOutputState;
+}
+
+function applyToGraph(graph: IOperationGraph): void {
+  const baseByOperation: Map<Operation, IIncrementalBase> = new Map();
+  const cleanOnlyReasonByOperation: Map<Operation, string> = new Map();
+  const stateByRecord: WeakMap<IOperationExecutionResult, IRecordState> = new WeakMap();
+
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    PLUGIN_NAME,
+    (
+      records: ReadonlyMap<Operation, IOperationExecutionResult>,
+      iterationOptions: IOperationGraphIterationOptions
+    ): void => {
+      const { inputsSnapshot, getOperationEnvironment } = iterationOptions;
+      if (!inputsSnapshot) {
+        // Without a snapshot the inputs of later runs cannot be compared with those of this one.
+        baseByOperation.clear();
+        return;
+      }
+      for (const record of records.values()) {
+        const recordState: IRecordState = { records, inputsSnapshot, getOperationEnvironment };
+        stateByRecord.set(record, recordState);
+        const guard: IIncrementalExecutionGuard = {
+          getBlockReasonAsync: () => getBlockReasonAsync(record, recordState),
+          verifyIncrementalResultAsync: () => verifyIncrementalResultAsync(record, recordState)
+        };
+        setIncrementalExecutionGuard(record, guard);
+      }
+    }
+  );
+
+  async function getBlockReasonAsync(
+    record: IOperationExecutionResult,
+    recordState: IRecordState
+  ): Promise<string | undefined> {
+    const { operation } = record;
+    const cleanOnlyReason: string | undefined = cleanOnlyReasonByOperation.get(operation);
+    if (cleanOnlyReason) {
+      return cleanOnlyReason;
+    }
+    const base: IIncrementalBase | undefined = baseByOperation.get(operation);
+    if (!base) {
+      return 'its outputs were not built by a successful run of its own command in this process';
+    }
+
+    const inputChangeReason: string | undefined = getIncrementalInputChangeReason(
+      operation,
+      base.inputs,
+      captureIncrementalInputState(
+        record,
+        recordState.inputsSnapshot,
+        getEnvironment(record, recordState),
+        recordState.records
+      )
+    );
+    if (inputChangeReason) {
+      return inputChangeReason;
+    }
+
+    const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+    if (!outputFolderNames?.length) {
+      return 'it declares no output folders';
+    }
+    let baseOutputs: IOutputState;
+    try {
+      baseOutputs = await base.outputsPromise;
+    } catch (error) {
+      return `its output folders could not be read after its last run: ${error}`;
+    }
+    if (baseOutputs.cleanOnlyReason) {
+      cleanOnlyReasonByOperation.set(operation, baseOutputs.cleanOnlyReason);
+      return baseOutputs.cleanOnlyReason;
+    }
+    const outputs: IOperationOutputManifest = await readOperationOutputManifestAsync(
+      operation.associatedProject.projectFolder,
+      outputFolderNames
+    );
+    if (outputs.signature !== baseOutputs.signature) {
+      return 'its output folders changed since its last successful run';
+    }
+    // eslint-disable-next-line require-atomic-updates -- The runner of the execution record calls the guard sequentially.
+    recordState.preRunOutputs = outputs;
+    return undefined;
+  }
+
+  async function verifyIncrementalResultAsync(
+    record: IOperationExecutionResult,
+    recordState: IRecordState
+  ): Promise<string | undefined> {
+    const { operation } = record;
+    const { preRunOutputs } = recordState;
+    const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+    if (!preRunOutputs || !outputFolderNames) {
+      return 'the outputs of the incremental command could not be compared with the outputs before it';
+    }
+    const outputs: IOperationOutputManifest = await readOperationOutputManifestAsync(
+      operation.associatedProject.projectFolder,
+      outputFolderNames
+    );
+    const changes: string | undefined = describeOutputFileChanges(preRunOutputs.files, outputs.files);
+    if (changes) {
+      // Its outputs may be named after their content, so a later incremental run could leave stale files behind.
+      cleanOnlyReasonByOperation.set(
+        operation,
+        `its incremental command changed which output files it has in an earlier run: ${changes}`
+      );
+      return `the incremental command changed which output files it has: ${changes}`;
+    }
+    if (outputs.cleanOnlyReason) {
+      cleanOnlyReasonByOperation.set(operation, outputs.cleanOnlyReason);
+      return outputs.cleanOnlyReason;
+    }
+    // eslint-disable-next-line require-atomic-updates -- The runner of the execution record calls the guard sequentially.
+    recordState.verifiedOutputs = { signature: outputs.signature, cleanOnlyReason: undefined };
+    return undefined;
+  }
+
+  graph.hooks.afterExecuteOperationAsync.tapPromise(
+    { name: PLUGIN_NAME, stage: RECORD_RESULT_STAGE },
+    async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+      const { operation, status } = record;
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      stateByRecord.delete(record);
+
+      const execution: ICommandExecution | undefined = getCommandExecution(record);
+      if (!execution) {
+        switch (status) {
+          case OperationStatus.Skipped:
+          case OperationStatus.NoOp:
+          case OperationStatus.Blocked:
+          case OperationStatus.Aborted:
+            // No command ran, so the outputs are those of the last run.
+            return;
+          default:
+            // E.g. restored from the build cache, or executed by a runner that does not report its command.
+            baseByOperation.delete(operation);
+            return;
+        }
+      }
+
+      const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+      if (
+        !recordState ||
+        !execution.hasIncrementalCommand ||
+        !outputFolderNames?.length ||
+        cleanOnlyReasonByOperation.has(operation) ||
+        (status !== OperationStatus.Success && status !== OperationStatus.SuccessWithWarning) ||
+        isResultUnverifiable(record)
+      ) {
+        baseByOperation.delete(operation);
+        return;
+      }
+
+      const { verifiedOutputs } = recordState;
+      const outputsPromise: Promise<IOutputState> = verifiedOutputs
+        ? Promise.resolve(verifiedOutputs)
+        : readOperationOutputManifestAsync(operation.associatedProject.projectFolder, outputFolderNames).then(
+            ({ signature, cleanOnlyReason }: IOperationOutputManifest) => ({ signature, cleanOnlyReason })
+          );
+      baseByOperation.set(operation, {
+        inputs: captureIncrementalInputState(
+          record,
+          recordState.inputsSnapshot,
+          getEnvironment(record, recordState),
+          recordState.records
+        ),
+        outputsPromise
+      });
+      // Finish reading the outputs before anything else can change them, e.g. an operation that depends on this one.
+      // A failure is reported by the next check of this operation.
+      await outputsPromise.catch(() => undefined);
+    }
+  );
+
+  graph.hooks.onInvalidateOperations.tap(
+    PLUGIN_NAME,
+    (operations: Iterable<Operation>, reason: string | undefined): void => {
+      if (reason === INPUTS_CHANGED_INVALIDATION_REASON) {
+        return;
+      }
+      if (reason === NATIVE_COMMAND_INVALIDATION_REASON) {
+        baseByOperation.clear();
+        return;
+      }
+      for (const operation of operations) {
+        baseByOperation.delete(operation);
+      }
+    }
+  );
+
+  graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>): void => {
+    for (const operation of operations) {
+      baseByOperation.delete(operation);
+    }
+  });
+}
+
+function getEnvironment(
+  record: IOperationExecutionResult,
+  { getOperationEnvironment }: IRecordState
+): Readonly<Record<string, string | undefined>> {
+  return getOperationEnvironment?.(record.operation) ?? process.env;
+}
+
+function getProjectPrefix(inputsSnapshot: IInputsSnapshot, project: RushConfigurationProject): string {
+  const relativePath: string = Path.convertToSlashes(
+    path.relative(inputsSnapshot.rootDirectory, project.projectFolder)
+  );
+  return relativePath === '' ? '' : `${relativePath}/`;
+}
+
+function isConfigInput(filePath: string, projectPrefix: string): boolean {
+  if (!filePath.startsWith(projectPrefix) || path.isAbsolute(filePath)) {
+    return true;
+  }
+  const projectRelativePath: string = filePath.slice(projectPrefix.length);
+  if (!projectRelativePath.includes('/') || CONFIG_INPUT_FOLDER_REGEXP.test(projectRelativePath)) {
+    return true;
+  }
+  return CONFIG_INPUT_FILE_NAME_REGEXP.test(
+    projectRelativePath.slice(projectRelativePath.lastIndexOf('/') + 1)
+  );
+}
+
+function describeInputFileChanges(
+  lastState: IIncrementalInputState,
+  currentState: IIncrementalInputState,
+  isChanged: (lastHash: string | undefined, currentHash: string | undefined, filePath: string) => boolean
+): string {
+  const lastFiles: ReadonlyMap<string, string> | undefined = lastState.inputFiles.deref();
+  const currentFiles: ReadonlyMap<string, string> | undefined = currentState.inputFiles.deref();
+  if (!lastFiles || !currentFiles) {
+    return '';
+  }
+  const changedFiles: string[] = [];
+  for (const filePath of new Set([...lastFiles.keys(), ...currentFiles.keys()])) {
+    if (isChanged(lastFiles.get(filePath), currentFiles.get(filePath), filePath)) {
+      changedFiles.push(filePath);
+    }
+  }
+  if (changedFiles.length === 0) {
+    return '';
+  }
+  changedFiles.sort();
+  const examples: string = changedFiles
+    .slice(0, MAX_EXAMPLE_PATHS)
+    .map((filePath: string) => JSON.stringify(filePath))
+    .join(', ');
+  return ` (${examples}${changedFiles.length > MAX_EXAMPLE_PATHS ? ', ...' : ''})`;
+}
+
+/**
+ * Returns the dependencies of an operation by name, including the dependencies that it has through operations of its
+ * own project, e.g. through a phase without a script that only orders its build after the builds of other projects.
+ */
+function getGuardedDependencies(operation: Operation): ReadonlyMap<string, Operation> {
+  const { associatedProject: project } = operation;
+  const dependencyByName: Map<string, Operation> = new Map();
+  const dependents: Operation[] = [operation];
+  for (let i: number = 0; i < dependents.length; i++) {
+    for (const dependency of dependents[i].dependencies) {
+      if (dependencyByName.has(dependency.name)) {
+        continue;
+      }
+      dependencyByName.set(dependency.name, dependency);
+      if (dependency.associatedProject === project) {
+        dependents.push(dependency);
+      }
+    }
+  }
+  return dependencyByName;
+}
+
+function getToolingDependencyReason(operation: Operation, dependency: Operation): string | undefined {
+  const { associatedProject: project } = operation;
+  const { associatedProject: dependencyProject } = dependency;
+  if (dependencyProject === project) {
+    // Another phase of the same project, e.g. the build that a test operation runs against.
+    return undefined;
+  }
+  const { packageName } = dependencyProject;
+  const { dependencies, optionalDependencies, peerDependencies } = project.packageJson;
+  if (
+    !dependencies?.[packageName] &&
+    !optionalDependencies?.[packageName] &&
+    !peerDependencies?.[packageName]
+  ) {
+    return `its dependency "${packageName}" changed, and it is not a production dependency`;
+  }
+  if (isToolingProject(dependencyProject)) {
+    return `its dependency "${packageName}" changed, and it is a build tool`;
+  }
+  return undefined;
+}
+
+const isToolingProjectByProject: WeakMap<RushConfigurationProject, boolean> = new WeakMap();
+
+function isToolingProject(project: RushConfigurationProject): boolean {
+  let isTooling: boolean | undefined = isToolingProjectByProject.get(project);
+  if (isTooling === undefined) {
+    const { packageName, projectFolder } = project;
+    isTooling =
+      TOOLING_PACKAGE_NAME_REGEXP.test(packageName) ||
+      // A rig package
+      FileSystem.exists(`${projectFolder}/profiles`) ||
+      FileSystem.exists(`${projectFolder}/heft-plugin.json`);
+    isToolingProjectByProject.set(project, isTooling);
+  }
+  return isTooling;
+}
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
new file mode 100644
index 0000000000..76e0520809
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
@@ -0,0 +1,83 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The reason with which the Rush daemon invalidates operations whose inputs changed. The incremental execution
+ * guard compares the inputs itself, so such an invalidation keeps the last successful run of an operation as the
+ * base for its next run. Every other invalidation forgets the base of the operations that it invalidates.
+ *
+ * @remarks
+ * The Rush daemon only imports types from Rush, so it repeats this value.
+ */
+export const INPUTS_CHANGED_INVALIDATION_REASON: 'workspace-inputs-changed' = 'workspace-inputs-changed';
+
+/**
+ * The reason with which a long-lived host invalidates every operation after a native Rush command ran in the
+ * workspace. That command may have replaced the outputs of any operation, including those that were already
+ * invalidated, so the incremental execution guard forgets every base.
+ */
+export const NATIVE_COMMAND_INVALIDATION_REASON: 'native-command-completed' = 'native-command-completed';
+
+/**
+ * Decides whether an operation may run its `:incremental` command outside watch mode.
+ * Registered per execution record by {@link IncrementalExecutionGuardPlugin}.
+ */
+export interface IIncrementalExecutionGuard {
+  /**
+   * Returns `undefined` if the incremental command may run, otherwise why it may not, as a clause that completes
+   * "Not using the incremental command because ...", e.g. `its command line changed`.
+   */
+  getBlockReasonAsync(): Promise<string | undefined>;
+  /**
+   * Called after the incremental command succeeded. Returns `undefined` if its outputs can be kept, otherwise why
+   * the initial command must run as well, as a clause that completes "Running the initial command, because ...".
+   */
+  verifyIncrementalResultAsync(): Promise<string | undefined>;
+}
+
+/**
+ * Which command an operation runner executed for an operation in one iteration.
+ */
+export interface ICommandExecution {
+  /**
+   * The command that produced the final outputs.
+   */
+  readonly kind: 'initial' | 'incremental';
+  /**
+   * Whether the runner has an incremental command that a later iteration could use.
+   */
+  readonly hasIncrementalCommand: boolean;
+}
+
+// Both maps are keyed by the execution record, which is the runner's context and the hooks' argument.
+const guardByRecord: WeakMap<object, IIncrementalExecutionGuard> = new WeakMap();
+const commandExecutionByRecord: WeakMap<object, ICommandExecution> = new WeakMap();
+
+export function setIncrementalExecutionGuard(record: object, guard: IIncrementalExecutionGuard): void {
+  guardByRecord.set(record, guard);
+}
+
+export function getIncrementalExecutionGuard(record: object): IIncrementalExecutionGuard | undefined {
+  return guardByRecord.get(record);
+}
+
+/**
+ * Records which command a runner is about to execute for an execution record. Call it before starting the command,
+ * so that the outputs of a command that fails or is aborted are attributed to it too.
+ */
+export function setCommandExecution(record: object, execution: ICommandExecution): void {
+  commandExecutionByRecord.set(record, execution);
+}
+
+export function getCommandExecution(record: object): ICommandExecution | undefined {
+  return commandExecutionByRecord.get(record);
+}
+
+/**
+ * Returns true if the outputs of this execution record were produced by an operation's incremental command.
+ * Such outputs are never written to the build cache or recorded for legacy skip detection, and neither are the
+ * outputs of consumers that were built against them.
+ */
+export function wasExecutedIncrementally(record: object): boolean {
+  return commandExecutionByRecord.get(record)?.kind === 'incremental';
+}
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index 2b2ea20896..b7eb963fe8 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -12,6 +12,7 @@ import type { IPhasedCommandPlugin, PhasedCommandHooks } from '../../pluginFrame
 import type { IOperationGraphIterationOptions } from './IOperationGraph';
 import type { IOperationRunnerContext } from './IOperationRunner';
 import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import { wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'LegacySkipPlugin' = 'LegacySkipPlugin';
 
@@ -245,6 +246,12 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           const { packageDeps, packageDepsPath } = skipRecord;
 
+          if (wasExecutedIncrementally(record)) {
+            // The outputs of an incremental command can differ from those of the initial command, so a later
+            // command must not skip the operation.
+            return;
+          }
+
           if (
             status === OperationStatus.NoOp ||
             (packageDeps &&
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index 68cc1ed4c1..b0408511bb 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -910,7 +910,8 @@ export class OperationGraph implements IOperationGraph {
 
     const iterationOptions: IOperationGraphIterationOptions = {
       inputsSnapshot: iterationContext.inputsSnapshot,
-      startTime: iterationContext.startTime
+      startTime: iterationContext.startTime,
+      getOperationEnvironment: iterationContext.getOperationEnvironment
     };
 
     const executionQueue: AsyncOperationQueue = new AsyncOperationQueue(
diff --git a/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
new file mode 100644
index 0000000000..99932a9350
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
@@ -0,0 +1,218 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, type Hash } from 'node:crypto';
+import type * as fs from 'node:fs';
+import { lstat, readdir } from 'node:fs/promises';
+import * as path from 'node:path';
+
+/**
+ * The files in an operation's declared output folders.
+ */
+export interface IOperationOutputManifest {
+  /**
+   * Covers the path of every file and folder in the output folders, and the identity, modification time and status
+   * change time of every folder. It changes if an output is added, deleted or renamed, if a file is replaced by a
+   * rename (as atomic writes do), or if a folder is recreated. It does not change if a file is rewritten in place.
+   */
+  readonly signature: string;
+  /**
+   * Project-relative paths, with `/` separators, of the files and symbolic links in the output folders.
+   */
+  readonly files: ReadonlySet<string>;
+  /**
+   * If defined, the incremental command must never be used for this operation, and this says why.
+   */
+  readonly cleanOnlyReason: string | undefined;
+}
+
+const MAX_CONCURRENT_READS: number = 8;
+
+// A content or chunk hash in a JavaScript or CSS file name, e.g. `chunk.main_1a2b3c4d.js` or `0dd8cf755e5195a5.js`.
+// The hash must contain a digit, so that words such as `facade` are not mistaken for one.
+const HASHED_BUNDLE_FILE_REGEXP: RegExp =
+  /(?:^|[._-])([0-9a-f]{8,})(?:\.min)?\.(?:js|mjs|cjs|css)(?:\.map|\.LICENSE\.txt)?$/i;
+const BUNDLE_FILE_REGEXP: RegExp = /\.(?:js|mjs|cjs|css)$/i;
+const BUNDLE_FOLDER_REGEXP: RegExp = /^(?:dist|release)(?:[-_.][^/]*)?(?:\/|$)/i;
+// A path with a long hexadecimal run names a cache entry by the hash of its content, e.g. Jest's transform cache
+// `temp/test/jest/jest-transform-cache-<hash>-<hash>/7f/index_<hash>`. A run adds such entries without changing
+// what it builds.
+const CONTENT_ADDRESSED_PATH_REGEXP: RegExp = /[0-9a-f]{16,}/i;
+
+/**
+ * Lists the files in the output folders of an operation.
+ *
+ * @param projectFolder - The absolute path of the project folder
+ * @param outputFolderNames - The project-relative output folders of the operation
+ */
+export async function readOperationOutputManifestAsync(
+  projectFolder: string,
+  outputFolderNames: ReadonlyArray<string>
+): Promise<IOperationOutputManifest> {
+  const entries: string[] = [];
+  const files: Set<string> = new Set();
+  const limitAsync: <T>(fn: () => Promise<T>) => Promise<T> = createConcurrencyLimiter(MAX_CONCURRENT_READS);
+
+  const readFolderAsync = async (relativeFolder: string, stats: fs.Stats): Promise<void> => {
+    entries.push(`${relativeFolder}/ ${stats.ino} ${stats.mtimeMs} ${stats.ctimeMs}`);
+    const children: fs.Dirent[] = await limitAsync(() =>
+      tryReaddirAsync(path.resolve(projectFolder, relativeFolder))
+    );
+    const subfolderPromises: Promise<void>[] = [];
+    for (const child of children) {
+      const relativePath: string = `${relativeFolder}/${child.name}`;
+      if (child.isDirectory()) {
+        subfolderPromises.push(
+          limitAsync(() => tryLstatAsync(path.resolve(projectFolder, relativePath))).then(
+            async (childStats: fs.Stats | undefined) => {
+              if (childStats?.isDirectory()) {
+                await readFolderAsync(relativePath, childStats);
+              } else {
+                // It was deleted or replaced after its parent was read.
+                entries.push(`${relativePath}/ replaced`);
+              }
+            }
+          )
+        );
+      } else {
+        entries.push(relativePath);
+        files.add(relativePath);
+      }
+    }
+    await Promise.all(subfolderPromises);
+  };
+
+  await Promise.all(
+    outputFolderNames.map(async (folderName: string) => {
+      const relativePath: string = folderName.replace(/\\/g, '/').replace(/\/+$/, '');
+      const stats: fs.Stats | undefined = await limitAsync(() =>
+        tryLstatAsync(path.resolve(projectFolder, relativePath))
+      );
+      if (!stats) {
+        entries.push(`missing ${relativePath}`);
+      } else if (stats.isDirectory()) {
+        await readFolderAsync(relativePath, stats);
+      } else {
+        entries.push(`${relativePath} ${stats.ino} ${stats.mtimeMs} ${stats.ctimeMs} ${stats.size}`);
+        files.add(relativePath);
+      }
+    })
+  );
+
+  entries.sort();
+  const hash: Hash = createHash('sha1');
+  for (const entry of entries) {
+    hash.update(entry);
+    hash.update('\n');
+  }
+
+  return {
+    signature: hash.digest('hex'),
+    files,
+    cleanOnlyReason: getCleanOnlyReason(files)
+  };
+}
+
+/**
+ * Returns why an operation with these output files must always run its initial command, if it must.
+ *
+ * @remarks
+ * The incremental command does not delete outputs that a run no longer produces. Bundlers name chunks after
+ * their content or their place in the module graph, so an edit can replace a chunk with a differently named one
+ * and leave the old one behind, which a full build would not produce.
+ */
+export function getCleanOnlyReason(files: Iterable<string>): string | undefined {
+  let bundleFile: string | undefined;
+  for (const file of files) {
+    const baseName: string = file.slice(file.lastIndexOf('/') + 1);
+    const match: RegExpExecArray | null = HASHED_BUNDLE_FILE_REGEXP.exec(baseName);
+    if (match && /\d/.test(match[1])) {
+      return `its outputs include the content-hashed file "${file}"`;
+    }
+    if (bundleFile === undefined && BUNDLE_FILE_REGEXP.test(baseName) && BUNDLE_FOLDER_REGEXP.test(file)) {
+      bundleFile = file;
+    }
+  }
+  return bundleFile === undefined ? undefined : `its outputs include the bundle "${bundleFile}"`;
+}
+
+/**
+ * Describes how two sets of output files differ, e.g. `2 added ("lib/a.js", ...), 1 removed ("lib/b.js")`.
+ * Files whose paths contain a content hash, such as cache entries, are ignored.
+ */
+export function describeOutputFileChanges(
+  before: ReadonlySet<string>,
+  after: ReadonlySet<string>
+): string | undefined {
+  const added: string[] = [];
+  const removed: string[] = [];
+  for (const file of after) {
+    if (!before.has(file) && !CONTENT_ADDRESSED_PATH_REGEXP.test(file)) {
+      added.push(file);
+    }
+  }
+  for (const file of before) {
+    if (!after.has(file) && !CONTENT_ADDRESSED_PATH_REGEXP.test(file)) {
+      removed.push(file);
+    }
+  }
+  if (added.length === 0 && removed.length === 0) {
+    return undefined;
+  }
+  const describe = (files: string[], verb: string): string =>
+    `${files.length} ${verb} (${files
+      .sort()
+      .slice(0, 3)
+      .map((file: string) => JSON.stringify(file))
+      .join(', ')}${files.length > 3 ? ', ...' : ''})`;
+  return [added.length ? describe(added, 'added') : '', removed.length ? describe(removed, 'removed') : '']
+    .filter(Boolean)
+    .join(', ');
+}
+
+function createConcurrencyLimiter(maxConcurrency: number): <T>(fn: () => Promise<T>) => Promise<T> {
+  let active: number = 0;
+  const waiting: (() => void)[] = [];
+  return async <T>(fn: () => Promise<T>): Promise<T> => {
+    if (active < maxConcurrency) {
+      active++;
+    } else {
+      // The slot of a finishing call is handed over directly, so `active` is not incremented here.
+      await new Promise<void>((resolve: () => void) => waiting.push(resolve));
+    }
+    try {
+      return await fn();
+    } finally {
+      const next: (() => void) | undefined = waiting.shift();
+      if (next) {
+        next();
+      } else {
+        active--;
+      }
+    }
+  };
+}
+
+async function tryLstatAsync(filePath: string): Promise<fs.Stats | undefined> {
+  try {
+    return await lstat(filePath);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return undefined;
+    }
+    throw error;
+  }
+}
+
+async function tryReaddirAsync(folderPath: string): Promise<fs.Dirent[]> {
+  try {
+    return await readdir(folderPath, { withFileTypes: true });
+  } catch (error) {
+    const { code } = error as NodeJS.ErrnoException;
+    // The folder was deleted or replaced by a file after its parent was read; the signature still changes.
+    if (code === 'ENOENT' || code === 'ENOTDIR') {
+      return [];
+    }
+    throw error;
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts b/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts
index 4fe099a0b9..1d3c77be19 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedCommandEngineExecution.ts
@@ -5,6 +5,7 @@ import { LockFile } from '@rushstack/node-core-library';
 
 import type { IPhasedCommandEngine } from '../../api/PhasedCommandEngine';
 import { PhasedCommandEngineBusyError } from '../../api/PhasedCommandEngineBusyError';
+import { NATIVE_COMMAND_INVALIDATION_REASON } from './IncrementalExecutionState';
 
 /**
  * Owns the native process lock only while a host is reconciling or executing one graph iteration.
@@ -34,7 +35,7 @@ export class PhasedCommandEngineExecution implements AsyncDisposable {
       // Native CLI actions leave their process lock file behind on exit. Their work may have
       // changed ignored outputs, so do not trust the previous in-memory success records.
       if (lock.dirtyWhenAcquired) {
-        this._engine.operationGraph.invalidateOperations(undefined, 'native-command-completed');
+        this._engine.operationGraph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
       }
     } catch (error) {
       lock.release();
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
index 627236e23b..9283810d9c 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
@@ -17,6 +17,12 @@ import type { IOperationChildProcessReporter } from './OperationEventSink';
 import { HeftChildReporterNonFatalError } from './HeftChildProcessReporter';
 import { OperationError } from './OperationError';
 import { OperationStatus } from './OperationStatus';
+import {
+  getIncrementalExecutionGuard,
+  setCommandExecution,
+  type ICommandExecution,
+  type IIncrementalExecutionGuard
+} from './IncrementalExecutionState';
 
 export interface IShellOperationRunnerOptions {
   phase: IPhase;
@@ -24,10 +30,23 @@ export interface IShellOperationRunnerOptions {
   displayName: string;
   initialCommand: string;
   incrementalCommand: string | undefined;
+  /**
+   * If true, the incremental command runs only if a plugin registered an incremental execution guard for the
+   * operation's execution record and the guard allows it, and the guard checks the outputs of the incremental command
+   * afterwards. Otherwise the incremental command runs whenever the operation has a last state, as in watch mode.
+   * Defaults to false.
+   */
+  incrementalCommandRequiresGuard?: boolean;
   commandForHash: string;
   ignoredParameterValues: ReadonlyArray<string>;
 }
 
+interface ICommandTerminals {
+  readonly terminal: ITerminal;
+  readonly terminalProvider: ITerminalProvider;
+  readonly structuredChildOutputTerminalProvider: ITerminalProvider;
+}
+
 /**
  * An `IOperationRunner` implementation that performs an operation via a shell command.
  * Currently contains the build cache logic, pending extraction as separate operations.
@@ -48,6 +67,7 @@ export class ShellOperationRunner implements IOperationRunner {
   readonly #commandForHash: string;
   readonly #initialCommand: string;
   readonly #incrementalCommand: string | undefined;
+  readonly #incrementalCommandRequiresGuard: boolean;
 
   readonly #rushProject: RushConfigurationProject;
 
@@ -60,6 +80,7 @@ export class ShellOperationRunner implements IOperationRunner {
       rushProject,
       initialCommand,
       incrementalCommand,
+      incrementalCommandRequiresGuard = false,
       commandForHash,
       ignoredParameterValues
     } = options;
@@ -70,6 +91,7 @@ export class ShellOperationRunner implements IOperationRunner {
     this.#rushProject = rushProject;
     this.#initialCommand = initialCommand;
     this.#incrementalCommand = incrementalCommand;
+    this.#incrementalCommandRequiresGuard = incrementalCommandRequiresGuard;
     this.#commandForHash = commandForHash;
     this.#ignoredParameterValues = ignoredParameterValues;
   }
@@ -84,130 +106,53 @@ export class ShellOperationRunner implements IOperationRunner {
         terminalProvider: ITerminalProvider,
         structuredChildOutputTerminalProvider: ITerminalProvider
       ) => {
-        let hasWarningOrError: boolean = false;
-
         // Log any ignored parameters
         if (this.#ignoredParameterValues.length > 0) {
           terminal.writeLine(
             `These parameters were ignored for this operation by project-level configuration: ${this.#ignoredParameterValues.join(' ')}`
           );
         }
-        const incrementalCommand: string | undefined =
-          lastState && this.#incrementalCommand ? this.#incrementalCommand : undefined;
-        const commandToRun: string = incrementalCommand ?? this.#initialCommand;
-
-        // Run the operation
-        terminal.writeLine(
-          `Invoking (${incrementalCommand !== undefined ? 'incremental' : 'initial'}): ${commandToRun}`
-        );
 
-        const { rushConfiguration, projectFolder } = this.#rushProject;
-
-        const { environment: initialEnvironment, abortSignal } = context;
-        const childProcessReporter: IOperationChildProcessReporter | undefined =
-          !IS_WINDOWS && isHeftCommand(commandToRun) ? context.createChildProcessReporter() : undefined;
-
-        const subProcess: child_process.ChildProcess = Utilities.executeLifecycleCommandAsync(commandToRun, {
-          rushConfiguration: rushConfiguration,
-          workingDirectory: projectFolder,
-          initCwd: rushConfiguration.commonTempFolder,
-          handleOutput: true,
-          environmentPathOptions: {
-            includeProjectBin: true
-          },
-          initialEnvironment,
-          additionalEnvironment: childProcessReporter?.environment,
-          stdio: childProcessReporter?.stdio,
-          // Isolate the process tree so that a hard abort can terminate it.
-          connectSubprocessTerminator: abortSignal !== undefined
-        });
-        const terminateProcessTree: () => void = () => {
-          try {
-            if (!IS_WINDOWS && subProcess.pid !== undefined && typeof subProcess.exitCode === 'number') {
-              // The shell already exited, but descendants in its process group may still hold its stdio open.
-              // killProcessTree() is a no-op in that state, so signal the process group directly.
-              killExitedProcessGroup(subProcess.pid);
-            } else {
-              SubprocessTerminator.killProcessTree(subProcess, SubprocessTerminator.RECOMMENDED_OPTIONS);
-            }
-          } catch (error) {
-            terminal.writeErrorLine(`Failed to terminate the operation process tree: ${error}`);
-          }
+        const terminals: ICommandTerminals = {
+          terminal,
+          terminalProvider,
+          structuredChildOutputTerminalProvider
         };
-        if (abortSignal?.aborted) {
-          terminateProcessTree();
-        } else {
-          abortSignal?.addEventListener('abort', terminateProcessTree, { once: true });
+        const incrementalCommand: string | undefined = lastState ? this.#incrementalCommand : undefined;
+        if (incrementalCommand === undefined) {
+          return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
+        }
+        if (!this.#incrementalCommandRequiresGuard) {
+          return await this.#invokeCommandAsync(context, terminals, 'incremental', incrementalCommand);
         }
-        let reporterError: Error | undefined;
-        const reporterDrainPromise: Promise<void> = childProcessReporter
-          ? childProcessReporter
-              .attachAsync(subProcess, structuredChildOutputTerminalProvider)
-              .catch((error) => {
-                reporterError =
-                  error instanceof Error ? error : new Error('The Heft child reporter channel failed.');
-              })
-          : Promise.resolve();
-
-        // Hook into events, in order to get live streaming of the log
-        subProcess.stdout?.on('data', (data: Buffer) => {
-          const text: string = data.toString();
-          terminalProvider.write(text, TerminalProviderSeverity.log);
-        });
-        subProcess.stderr?.on('data', (data: Buffer) => {
-          const text: string = data.toString();
-          terminalProvider.write(text, TerminalProviderSeverity.error);
-          hasWarningOrError = true;
-        });
 
-        const closePromise: Promise<{
-          readonly exitCode: number | null;
-          readonly signal: NodeJS.Signals | null;
-        }> = new Promise(
-          (
-            resolve: (result: {
-              readonly exitCode: number | null;
-              readonly signal: NodeJS.Signals | null;
-            }) => void,
-            reject: (error: OperationError) => void
-          ) => {
-            subProcess.on('close', (exitCode: number | null, signal: NodeJS.Signals | null) => {
-              try {
-                resolve({ exitCode, signal });
-              } catch (error) {
-                context.error = error as OperationError;
-                reject(error as OperationError);
-              }
-            });
-          }
-        );
-        const [{ exitCode, signal }]: [
-          { readonly exitCode: number | null; readonly signal: NodeJS.Signals | null },
-          void
-        ] = await Promise.all([closePromise, reporterDrainPromise]).finally(() => {
-          abortSignal?.removeEventListener('abort', terminateProcessTree);
-        });
+        const guard: IIncrementalExecutionGuard | undefined = getIncrementalExecutionGuard(context);
+        if (!guard) {
+          return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
+        }
+        const blockReason: string | undefined = await getGuardResultAsync(() => guard.getBlockReasonAsync());
+        if (blockReason !== undefined) {
+          terminal.writeLine(`Not using the incremental command because ${blockReason}.`);
+          return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
+        }
 
-        if (abortSignal?.aborted) {
-          terminal.writeLine('Terminated because the operation was aborted.');
-          return OperationStatus.Aborted;
-        } else if (signal) {
-          // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
-          context.error = new OperationError('error', `Terminated by signal: ${signal}`);
-          return OperationStatus.Failure;
-        } else if (exitCode !== 0) {
-          // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
-          context.error = new OperationError('error', `Returned error code: ${exitCode}`);
-          return OperationStatus.Failure;
-        } else if (reporterError && !(reporterError instanceof HeftChildReporterNonFatalError)) {
-          // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
-          context.error = new OperationError('error', reporterError.message);
-          return OperationStatus.Failure;
-        } else if (hasWarningOrError || childProcessReporter?.hasWarningOrError) {
-          return OperationStatus.SuccessWithWarning;
-        } else {
-          return OperationStatus.Success;
+        const status: OperationStatus = await this.#invokeCommandAsync(
+          context,
+          terminals,
+          'incremental',
+          incrementalCommand
+        );
+        if (status !== OperationStatus.Success && status !== OperationStatus.SuccessWithWarning) {
+          return status;
         }
+        const rerunReason: string | undefined = await getGuardResultAsync(() =>
+          guard.verifyIncrementalResultAsync()
+        );
+        if (rerunReason === undefined) {
+          return status;
+        }
+        terminal.writeLine(`Running the initial command, because ${rerunReason}.`);
+        return await this.#invokeCommandAsync(context, terminals, 'initial', this.#initialCommand);
       },
       {
         createLogFile: true
@@ -218,6 +163,142 @@ export class ShellOperationRunner implements IOperationRunner {
   public getConfigHash(): string {
     return this.#commandForHash;
   }
+
+  async #invokeCommandAsync(
+    context: IOperationRunnerContext,
+    { terminal, terminalProvider, structuredChildOutputTerminalProvider }: ICommandTerminals,
+    kind: ICommandExecution['kind'],
+    commandToRun: string
+  ): Promise<OperationStatus> {
+    let hasWarningOrError: boolean = false;
+
+    if (this.#incrementalCommandRequiresGuard) {
+      // Recorded before the command starts, so that outputs of a command that fails or is aborted are attributed to it.
+      setCommandExecution(context, { kind, hasIncrementalCommand: this.#incrementalCommand !== undefined });
+    }
+
+    // Run the operation
+    terminal.writeLine(`Invoking (${kind}): ${commandToRun}`);
+
+    const { rushConfiguration, projectFolder } = this.#rushProject;
+
+    const { environment: initialEnvironment, abortSignal } = context;
+    const childProcessReporter: IOperationChildProcessReporter | undefined =
+      !IS_WINDOWS && isHeftCommand(commandToRun) ? context.createChildProcessReporter() : undefined;
+
+    const subProcess: child_process.ChildProcess = Utilities.executeLifecycleCommandAsync(commandToRun, {
+      rushConfiguration: rushConfiguration,
+      workingDirectory: projectFolder,
+      initCwd: rushConfiguration.commonTempFolder,
+      handleOutput: true,
+      environmentPathOptions: {
+        includeProjectBin: true
+      },
+      initialEnvironment,
+      additionalEnvironment: childProcessReporter?.environment,
+      stdio: childProcessReporter?.stdio,
+      // Isolate the process tree so that a hard abort can terminate it.
+      connectSubprocessTerminator: abortSignal !== undefined
+    });
+    const terminateProcessTree: () => void = () => {
+      try {
+        if (!IS_WINDOWS && subProcess.pid !== undefined && typeof subProcess.exitCode === 'number') {
+          // The shell already exited, but descendants in its process group may still hold its stdio open.
+          // killProcessTree() is a no-op in that state, so signal the process group directly.
+          killExitedProcessGroup(subProcess.pid);
+        } else {
+          SubprocessTerminator.killProcessTree(subProcess, SubprocessTerminator.RECOMMENDED_OPTIONS);
+        }
+      } catch (error) {
+        terminal.writeErrorLine(`Failed to terminate the operation process tree: ${error}`);
+      }
+    };
+    if (abortSignal?.aborted) {
+      terminateProcessTree();
+    } else {
+      abortSignal?.addEventListener('abort', terminateProcessTree, { once: true });
+    }
+    let reporterError: Error | undefined;
+    const reporterDrainPromise: Promise<void> = childProcessReporter
+      ? childProcessReporter.attachAsync(subProcess, structuredChildOutputTerminalProvider).catch((error) => {
+          reporterError =
+            error instanceof Error ? error : new Error('The Heft child reporter channel failed.');
+        })
+      : Promise.resolve();
+
+    // Hook into events, in order to get live streaming of the log
+    subProcess.stdout?.on('data', (data: Buffer) => {
+      const text: string = data.toString();
+      terminalProvider.write(text, TerminalProviderSeverity.log);
+    });
+    subProcess.stderr?.on('data', (data: Buffer) => {
+      const text: string = data.toString();
+      terminalProvider.write(text, TerminalProviderSeverity.error);
+      hasWarningOrError = true;
+    });
+
+    const closePromise: Promise<{
+      readonly exitCode: number | null;
+      readonly signal: NodeJS.Signals | null;
+    }> = new Promise(
+      (
+        resolve: (result: {
+          readonly exitCode: number | null;
+          readonly signal: NodeJS.Signals | null;
+        }) => void,
+        reject: (error: OperationError) => void
+      ) => {
+        subProcess.on('close', (exitCode: number | null, signal: NodeJS.Signals | null) => {
+          try {
+            resolve({ exitCode, signal });
+          } catch (error) {
+            context.error = error as OperationError;
+            reject(error as OperationError);
+          }
+        });
+      }
+    );
+    const [{ exitCode, signal }]: [
+      { readonly exitCode: number | null; readonly signal: NodeJS.Signals | null },
+      void
+    ] = await Promise.all([closePromise, reporterDrainPromise]).finally(() => {
+      abortSignal?.removeEventListener('abort', terminateProcessTree);
+    });
+
+    if (abortSignal?.aborted) {
+      terminal.writeLine('Terminated because the operation was aborted.');
+      return OperationStatus.Aborted;
+    } else if (signal) {
+      // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
+      context.error = new OperationError('error', `Terminated by signal: ${signal}`);
+      return OperationStatus.Failure;
+    } else if (exitCode !== 0) {
+      // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
+      context.error = new OperationError('error', `Returned error code: ${exitCode}`);
+      return OperationStatus.Failure;
+    } else if (reporterError && !(reporterError instanceof HeftChildReporterNonFatalError)) {
+      // eslint-disable-next-line require-atomic-updates -- This operation context has one active runner.
+      context.error = new OperationError('error', reporterError.message);
+      return OperationStatus.Failure;
+    } else if (hasWarningOrError || childProcessReporter?.hasWarningOrError) {
+      return OperationStatus.SuccessWithWarning;
+    } else {
+      return OperationStatus.Success;
+    }
+  }
+}
+
+/**
+ * Returns what an incremental execution guard returned, or why it failed.
+ */
+async function getGuardResultAsync(
+  getResultAsync: () => Promise<string | undefined>
+): Promise<string | undefined> {
+  try {
+    return await getResultAsync();
+  } catch (error) {
+    return `its incremental execution guard failed: ${error}`;
+  }
 }
 
 function killExitedProcessGroup(pid: number): void {
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
index 3330ac8e32..89f489a632 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
@@ -54,14 +54,18 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
 
             // For execution of non-initial watch iterations, prefer the `:incremental` script if it exists.
             // However, the `shellCommand` value still takes precedence per the spec for that feature.
-            // Outside watch mode, every command runs the initial script, as a single `rush build` does, even
-            // when a long-lived host (rushd) executes it on a graph that already ran the operation. The
-            // incremental script may keep outputs of deleted inputs, and only watch mode disables cache writes.
+            // Outside watch mode, the `:incremental` script only runs where a long-lived host (rushd) registers an
+            // incremental execution guard for the operation (IncrementalExecutionGuardPlugin). Without one, every
+            // command runs the initial script, as a single `rush build` does: the incremental script may keep the
+            // outputs of deleted inputs, and outside watch mode its results could be written to the build cache.
             const initialCommand: string | undefined = shellCommand ?? scripts?.[phaseName];
-            const incrementalCommand: string | undefined =
-              isIncrementalBuildAllowed && isWatch
+            const incrementalCommand: string | undefined = !isIncrementalBuildAllowed
+              ? undefined
+              : isWatch
                 ? (shellCommand ?? scripts?.[`${phaseName}:incremental`])
-                : undefined;
+                : shellCommand === undefined
+                  ? scripts?.[`${phaseName}:incremental`]
+                  : undefined;
 
             operation.runner = initializeShellOperationRunner({
               phase,
@@ -70,6 +74,7 @@ export class ShellOperationRunnerPlugin implements IPhasedCommandPlugin {
               commandForHash,
               initialCommand,
               incrementalCommand,
+              incrementalCommandRequiresGuard: !isWatch,
               customParameterValues,
               ignoredParameterValues,
               rushConfiguration
@@ -90,6 +95,10 @@ export function initializeShellOperationRunner(options: {
   rushConfiguration: RushConfiguration;
   initialCommand: string | undefined;
   incrementalCommand: string | undefined;
+  /**
+   * See `IShellOperationRunnerOptions.incrementalCommandRequiresGuard`. Defaults to false.
+   */
+  incrementalCommandRequiresGuard?: boolean;
   commandForHash?: string;
   customParameterValues: ReadonlyArray<string>;
   ignoredParameterValues: ReadonlyArray<string>;
@@ -99,6 +108,7 @@ export function initializeShellOperationRunner(options: {
     project,
     initialCommand: rawInitialCommand,
     incrementalCommand: rawIncrementalCommand,
+    incrementalCommandRequiresGuard = false,
     displayName,
     ignoredParameterValues
   } = options;
@@ -113,9 +123,13 @@ export function initializeShellOperationRunner(options: {
     const { commandForHash: rawCommandForHash, customParameterValues } = options;
 
     const initialCommand: string = formatCommand(rawInitialCommand, customParameterValues);
-    const incrementalCommand: string | undefined = rawIncrementalCommand
+    let incrementalCommand: string | undefined = rawIncrementalCommand
       ? formatCommand(rawIncrementalCommand, customParameterValues)
       : undefined;
+    if (incrementalCommandRequiresGuard && incrementalCommand === initialCommand) {
+      // Running it as the incremental command would only prevent its results from being cached.
+      incrementalCommand = undefined;
+    }
     const commandForHash: string = rawCommandForHash
       ? formatCommand(rawCommandForHash, customParameterValues)
       : initialCommand;
@@ -123,6 +137,7 @@ export function initializeShellOperationRunner(options: {
     return new ShellOperationRunner({
       initialCommand,
       incrementalCommand,
+      incrementalCommandRequiresGuard,
       commandForHash,
       displayName,
       phase,
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index 3694a67830..172a2e76e1 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -60,6 +60,7 @@ import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { setCommandExecution } from '../IncrementalExecutionState';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -79,14 +80,22 @@ class CacheableMockRunner implements IOperationRunner {
   public readonly isNoOp: boolean = false;
   public readonly name: string;
   readonly #executions: string[];
+  readonly #incrementalNames: ReadonlySet<string>;
 
-  public constructor(name: string, executions: string[]) {
+  public constructor(name: string, executions: string[], incrementalNames: ReadonlySet<string>) {
     this.name = name;
     this.#executions = executions;
+    this.#incrementalNames = incrementalNames;
   }
 
   public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
-    this.#executions.push(this.name);
+    if (this.#incrementalNames.has(this.name)) {
+      // Like a ShellOperationRunner whose incremental execution guard allowed its incremental command
+      setCommandExecution(context, { kind: 'incremental', hasIncrementalCommand: true });
+      this.#executions.push(`${this.name}:incremental`);
+    } else {
+      this.#executions.push(this.name);
+    }
     return OperationStatus.Success;
   }
 
@@ -106,6 +115,10 @@ interface ITestGraph {
    * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
    */
   checks: string[];
+  /**
+   * The names of the operations whose runner executes its incremental command
+   */
+  incrementalNames: Set<string>;
   executeAsync(): Promise<IExecutionResult>;
 }
 
@@ -132,6 +145,7 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
   const checks: string[] = [];
   const cacheWrites: string[] = [];
   const cacheRestores: string[] = [];
+  const incrementalNames: Set<string> = new Set();
   const cacheEntries: Set<string> = new Set();
   const localHashes: Map<string, string> = new Map();
   const operations: Map<string, Operation> = new Map();
@@ -147,7 +161,7 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
       getCacheDisabledReason: () => undefined
     } as unknown as RushProjectConfiguration);
     const operation: Operation = new Operation({
-      runner: new CacheableMockRunner(name, executions),
+      runner: new CacheableMockRunner(name, executions, incrementalNames),
       logFilenameIdentifier: name,
       phase: mockPhase,
       project
@@ -254,6 +268,7 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     cacheWrites,
     cacheRestores,
     checks,
+    incrementalNames,
     executeAsync: async () => {
       executions.length = 0;
       cacheWrites.length = 0;
@@ -464,6 +479,99 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     expect(testGraph.executions).toEqual([]);
   });
 
+  it('trusts an incremental result, but writes neither it nor the results built against it to the build cache', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
+
+    // Edit "a", which runs its incremental command.
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Nothing changed, so nothing runs again.
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "c": it is built against the retained outputs of "b", which were built against the incremental result.
+    testGraph.localHashes.set('c', 'c-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    const secondHotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(secondHotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "a", which runs its initial command: every result can be written again.
+    testGraph.localHashes.set('a', 'a-v3');
+    testGraph.incrementalNames.delete('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
+  });
+
+  it('does not write results built against an incremental result that the request did not select', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    const { operations } = testGraph;
+    await testGraph.executeAsync();
+
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --only b: "b" is built against the retained incremental result of "a".
+    testGraph.localHashes.set('b', 'b-v2');
+    operations.get('a')!.enabled = false;
+    operations.get('c')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --only c: "c" is built against "b", which was built against the incremental result of "a".
+    testGraph.localHashes.set('c', 'c-v2');
+    operations.get('b')!.enabled = false;
+    operations.get('c')!.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('restores a consumer of an incremental result from the build cache and trusts it as a cacheable result', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    await testGraph.executeAsync();
+
+    // Edit "a", which runs its incremental command, and "c".
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.localHashes.set('c', 'c-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b', 'c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Revert both: every operation has an entry from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    testGraph.localHashes.set('c', 'c-v1');
+    testGraph.incrementalNames.delete('a');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['a', 'b', 'c']);
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "c": it is built against restored outputs, so its result is written.
+    testGraph.localHashes.set('c', 'c-v3');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual(['c']);
+  });
+
   it('does not re-enable operations that another plugin disabled', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     // Like a plugin that performs the work itself. This tap runs after PhasedOperationPlugin's.
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
new file mode 100644
index 0000000000..02b33ea377
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -0,0 +1,691 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+jest.mock('../OperationMetadataManager', () => {
+  class MockOperationMetadataManager {
+    public readonly logFilenameIdentifier: string;
+    public readonly metadataFolderPath: string = '.rush/temp/operation/mock';
+    public readonly stateFile: { state: undefined } = { state: undefined };
+    public constructor({ operation }: { operation: { logFilenameIdentifier: string } }) {
+      this.logFilenameIdentifier = operation.logFilenameIdentifier;
+    }
+    public async saveAsync(): Promise<void> {
+      /* noop */
+    }
+    public async tryRestoreAsync(): Promise<void> {
+      /* noop */
+    }
+    public tryRestoreStopwatch<T>(originalStopwatch: T): T {
+      return originalStopwatch;
+    }
+  }
+  return { OperationMetadataManager: MockOperationMetadataManager };
+});
+
+import type * as childProcess from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { PassThrough } from 'node:stream';
+
+import { LookupByPath } from '@rushstack/lookup-by-path';
+import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IOperationSettings, RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import { Utilities } from '../../../utilities/Utilities';
+import { InputsSnapshot, type IInputsSnapshotProjectMetadata } from '../../incremental/InputsSnapshot';
+import { IncrementalExecutionGuardPlugin } from '../IncrementalExecutionGuardPlugin';
+import {
+  INPUTS_CHANGED_INVALIDATION_REASON,
+  NATIVE_COMMAND_INVALIDATION_REASON
+} from '../IncrementalExecutionState';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import { NullOperationRunner } from '../NullOperationRunner';
+import { Operation } from '../Operation';
+import type { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { markResultUnverifiable } from '../RetainedResultVerification';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+
+const PHASE_NAME: string = '_phase:build';
+const INITIAL_COMMAND: string = 'node build.js';
+const INCREMENTAL_COMMAND: string = 'node build.js --incremental';
+
+const buildPhase: IPhase = {
+  name: PHASE_NAME,
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: '_phase_build',
+  missingScriptBehavior: 'error'
+};
+
+const liteBuildPhase: IPhase = {
+  ...buildPhase,
+  name: '_phase:lite-build',
+  logFilenameIdentifier: '_phase_lite-build',
+  missingScriptBehavior: 'silent'
+};
+
+interface IProjectSpec {
+  readonly name: string;
+  readonly dependencies?: ReadonlyArray<string>;
+  readonly devDependencies?: ReadonlyArray<string>;
+  /**
+   * If set, the build writes a single bundle `dist/main.js` instead of a `lib` file per source file.
+   */
+  readonly isBundle?: boolean;
+  readonly dependsOnEnvVars?: ReadonlyArray<string>;
+  /**
+   * If set, the project has a `profiles` folder, like a rig package.
+   */
+  readonly isRig?: boolean;
+}
+
+interface IWorkspaceOptions {
+  /**
+   * If set, like the phases of the rushstack repo, the build of each project depends only on a `_phase:lite-build`
+   * operation of its own project, which has no script and depends on the builds of the project's dependencies.
+   */
+  readonly hasPassThroughPhase?: boolean;
+}
+
+interface ITestIteration {
+  readonly result: IExecutionResult;
+  /**
+   * Each command that ran, as `<project>:initial` or `<project>:incremental`
+   */
+  readonly commands: ReadonlyArray<string>;
+  readonly output: string;
+  getStatus(name: string): OperationStatus;
+}
+
+interface ITestWorkspace {
+  readonly rootFolder: string;
+  readonly graph: OperationGraph;
+  readonly operations: ReadonlyMap<string, Operation>;
+  writeFile(relativePath: string, content: string): void;
+  deleteFile(relativePath: string): void;
+  executeAsync(environment?: Readonly<Record<string, string>>): Promise<ITestIteration>;
+  /**
+   * Resolves when the next command that hangs has written its outputs. It runs until it is terminated.
+   */
+  waitForHangAsync(): Promise<void>;
+}
+
+const workspaceFolders: string[] = [];
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  for (const folder of workspaceFolders.splice(0)) {
+    fs.rmSync(folder, { recursive: true, force: true });
+  }
+});
+
+function listFiles(folder: string, exclude: ReadonlySet<string> = new Set()): string[] {
+  const files: string[] = [];
+  const visit = (relativeFolder: string): void => {
+    for (const entry of fs.readdirSync(path.join(folder, relativeFolder), { withFileTypes: true })) {
+      const relativePath: string = relativeFolder ? `${relativeFolder}/${entry.name}` : entry.name;
+      if (exclude.has(relativePath)) {
+        continue;
+      }
+      if (entry.isDirectory()) {
+        visit(relativePath);
+      } else {
+        files.push(relativePath);
+      }
+    }
+  };
+  visit('');
+  return files.sort();
+}
+
+// Like a compiler: writes a file per source file, and its incremental mode neither cleans the output folder nor
+// deletes the outputs of deleted source files. A source containing "emit:<name>" also emits "<name>.js", a
+// source containing "error" fails the build, and after the output of a source containing "hang", the build runs
+// until it is terminated (it returns undefined).
+function build(projectFolder: string, isBundle: boolean, isIncremental: boolean): number | undefined {
+  const outputFolder: string = `${projectFolder}/${isBundle ? 'dist' : 'lib'}`;
+  if (!isIncremental) {
+    fs.rmSync(outputFolder, { recursive: true, force: true });
+  }
+  fs.mkdirSync(outputFolder, { recursive: true });
+  const bundle: string[] = [];
+  for (const sourcePath of listFiles(`${projectFolder}/src`)) {
+    const source: string = fs.readFileSync(`${projectFolder}/src/${sourcePath}`, 'utf8');
+    if (source.includes('error')) {
+      return 1;
+    }
+    bundle.push(source);
+    if (!isBundle) {
+      const outputPath: string = `${outputFolder}/${sourcePath.replace(/\.ts$/, '.js')}`;
+      fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+      fs.writeFileSync(outputPath, source);
+    }
+    const emitted: RegExpExecArray | null = /emit:(\w+)/.exec(source);
+    if (emitted) {
+      fs.writeFileSync(`${outputFolder}/${emitted[1]}.js`, '');
+    }
+    if (source.includes('hang')) {
+      return undefined;
+    }
+  }
+  if (isBundle) {
+    fs.writeFileSync(`${outputFolder}/main.js`, bundle.join('\n'));
+  }
+  return 0;
+}
+
+async function createWorkspaceAsync(
+  projectSpecs: ReadonlyArray<IProjectSpec>,
+  { hasPassThroughPhase }: IWorkspaceOptions = {}
+): Promise<ITestWorkspace> {
+  const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
+  workspaceFolders.push(rootFolder);
+
+  const writeFile = (relativePath: string, content: string): void => {
+    const filePath: string = `${rootFolder}/${relativePath}`;
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  };
+
+  const commands: string[] = [];
+  const hangWaiters: (() => void)[] = [];
+  const specByFolder: Map<string, IProjectSpec> = new Map();
+  const close = (child: childProcess.ChildProcess, exitCode: number | null, signal: string | null): void => {
+    queueMicrotask(() => {
+      (child.stdout as PassThrough).end();
+      (child.stderr as PassThrough).end();
+      child.emit('close', exitCode, signal);
+    });
+  };
+  jest
+    .spyOn(Utilities, 'executeLifecycleCommandAsync')
+    .mockImplementation((command: string, { workingDirectory }: { workingDirectory: string }) => {
+      const spec: IProjectSpec = specByFolder.get(workingDirectory)!;
+      const isIncremental: boolean = command === INCREMENTAL_COMMAND;
+      commands.push(`${spec.name}:${isIncremental ? 'incremental' : 'initial'}`);
+      const exitCode: number | undefined = build(workingDirectory, !!spec.isBundle, isIncremental);
+      const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+        stdout: new PassThrough(),
+        stderr: new PassThrough(),
+        stdio: []
+      }) as unknown as childProcess.ChildProcess;
+      if (exitCode === undefined) {
+        for (const resolve of hangWaiters.splice(0)) {
+          resolve();
+        }
+      } else {
+        close(child, exitCode, null);
+      }
+      return child;
+    });
+  jest
+    .spyOn(SubprocessTerminator, 'killProcessTree')
+    .mockImplementation((child: childProcess.ChildProcess) => close(child, null, 'SIGTERM'));
+
+  const operations: Map<string, Operation> = new Map();
+  const passThroughOperations: Operation[] = [];
+  const projectMap: Map<RushConfigurationProject, IInputsSnapshotProjectMetadata> = new Map();
+  const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+  const lookupByPath: LookupByPath<RushConfigurationProject> = new LookupByPath();
+  const outputFolderByPrefix: Map<string, string> = new Map();
+  for (const spec of projectSpecs) {
+    const { name, dependencies = [], devDependencies = [], isBundle, dependsOnEnvVars, isRig } = spec;
+    const projectFolder: string = `${rootFolder}/${name}`;
+    const toVersions = (names: ReadonlyArray<string>): Record<string, string> =>
+      Object.fromEntries(names.map((dependencyName: string) => [dependencyName, 'workspace:*']));
+    const packageJson: RushConfigurationProject['packageJson'] = {
+      name,
+      version: '1.0.0',
+      dependencies: toVersions(dependencies),
+      devDependencies: toVersions(devDependencies)
+    };
+    writeFile(`${name}/package.json`, JSON.stringify(packageJson));
+    writeFile(`${name}/tsconfig.json`, '{}');
+    writeFile(`${name}/src/one.ts`, 'one');
+    writeFile(`${name}/src/sub/two.ts`, 'two');
+    if (isRig) {
+      writeFile(`${name}/profiles/default/config/heft.json`, '{}');
+    }
+
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder,
+      projectRelativeFolder: name,
+      packageJson,
+      rushConfiguration: { commonTempFolder: `${rootFolder}/common/temp` }
+    } as unknown as RushConfigurationProject;
+    const outputFolderName: string = isBundle ? 'dist' : 'lib';
+    const settings: IOperationSettings = {
+      operationName: PHASE_NAME,
+      outputFolderNames: [outputFolderName],
+      dependsOnEnvVars: dependsOnEnvVars ? [...dependsOnEnvVars] : undefined
+    };
+    const projectConfiguration: RushProjectConfiguration = {
+      operationSettingsByOperationName: new Map([[PHASE_NAME, settings]]),
+      getCacheDisabledReason: () => undefined
+    } as unknown as RushProjectConfiguration;
+    projectConfigurations.set(project, projectConfiguration);
+    projectMap.set(project, { projectConfig: projectConfiguration });
+    lookupByPath.setItem(name, project);
+    outputFolderByPrefix.set(name, outputFolderName);
+    specByFolder.set(projectFolder, spec);
+
+    const operation: Operation = new Operation({
+      phase: buildPhase,
+      project,
+      settings,
+      logFilenameIdentifier: '_phase_build',
+      runner: new ShellOperationRunner({
+        phase: buildPhase,
+        rushProject: project,
+        displayName: name,
+        initialCommand: INITIAL_COMMAND,
+        incrementalCommand: INCREMENTAL_COMMAND,
+        incrementalCommandRequiresGuard: true,
+        commandForHash: INITIAL_COMMAND,
+        ignoredParameterValues: []
+      })
+    });
+    let dependent: Operation = operation;
+    if (hasPassThroughPhase) {
+      dependent = new Operation({
+        phase: liteBuildPhase,
+        project,
+        logFilenameIdentifier: liteBuildPhase.logFilenameIdentifier,
+        runner: new NullOperationRunner({
+          name: `${name} (lite-build)`,
+          result: OperationStatus.NoOp,
+          silent: true
+        })
+      });
+      operation.addDependency(dependent);
+      passThroughOperations.push(dependent);
+    }
+    for (const dependencyName of [...dependencies, ...devDependencies]) {
+      dependent.addDependency(operations.get(dependencyName)!);
+    }
+    operations.set(name, operation);
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new IncrementalExecutionGuardPlugin().apply(hooks);
+  const destination: MockWritable = new MockWritable();
+  const graphOperations: Set<Operation> = new Set([...operations.values(), ...passThroughOperations]);
+  const graph: OperationGraph = new OperationGraph(graphOperations, {
+    quietMode: false,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [destination],
+    abortController: new AbortController(),
+    // Like the graphs of the Rush daemon
+    supportsTerminateRunning: true
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    isWatch: false,
+    projectConfigurations
+  } as unknown as IOperationGraphContext);
+
+  // Like `git hash-object` for each file, except the outputs, which are ignored by git.
+  const createInputsSnapshot = (environment: Readonly<Record<string, string>>): InputsSnapshot => {
+    const hashes: Map<string, string> = new Map();
+    for (const [prefix, outputFolderName] of outputFolderByPrefix) {
+      for (const file of listFiles(`${rootFolder}/${prefix}`, new Set([outputFolderName]))) {
+        const content: Buffer = fs.readFileSync(`${rootFolder}/${prefix}/${file}`);
+        hashes.set(`${prefix}/${file}`, createHash('sha1').update(content).digest('hex'));
+      }
+    }
+    return new InputsSnapshot({
+      rootDir: rootFolder,
+      hashes,
+      hasUncommittedChanges: false,
+      lookupByPath,
+      projectMap,
+      environment: { ...environment }
+    });
+  };
+
+  return {
+    rootFolder,
+    graph,
+    operations,
+    writeFile,
+    deleteFile: (relativePath: string) => fs.rmSync(`${rootFolder}/${relativePath}`),
+    executeAsync: async (environment: Readonly<Record<string, string>> = {}): Promise<ITestIteration> => {
+      commands.length = 0;
+      destination.reset();
+      const result: IExecutionResult = await graph.executeAsync({
+        inputsSnapshot: createInputsSnapshot(environment),
+        getOperationEnvironment: () => environment
+      });
+      return {
+        result,
+        commands: [...commands],
+        output: destination.getAllOutput(),
+        getStatus: (name: string) =>
+          (result.operationResults.get(operations.get(name)!) as OperationExecutionRecord).status
+      };
+    },
+    waitForHangAsync: () => new Promise<void>((resolve: () => void) => hangWaiters.push(resolve))
+  };
+}
+
+describe(IncrementalExecutionGuardPlugin.name, () => {
+  it('runs the incremental command for edits of built files, and the initial command otherwise', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const edited: ITestIteration = await workspace.executeAsync();
+    expect(edited.commands).toEqual(['a:incremental']);
+    expect(edited.getStatus('a')).toBe(OperationStatus.Success);
+    expect(edited.output).toContain(`Invoking (incremental): ${INCREMENTAL_COMMAND}`);
+
+    // The result of the incremental command is the base of the next one.
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    // An unchanged workspace runs nothing.
+    expect((await workspace.executeAsync()).commands).toEqual([]);
+  });
+
+  interface IInputChangeCase {
+    readonly change: (workspace: ITestWorkspace) => void;
+    readonly reason: string;
+    /**
+     * A source file that exists after the change
+     */
+    readonly sourceFile: string;
+  }
+
+  it.each<[string, IInputChangeCase]>([
+    [
+      'a file is added',
+      {
+        change: (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
+        reason: 'input files were added, deleted or renamed ("a/src/three.ts")',
+        sourceFile: 'a/src/three.ts'
+      }
+    ],
+    [
+      'a file is deleted',
+      {
+        change: (workspace: ITestWorkspace) => workspace.deleteFile('a/src/sub/two.ts'),
+        reason: 'input files were added, deleted or renamed ("a/src/sub/two.ts")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file is renamed',
+      {
+        change: (workspace: ITestWorkspace) =>
+          fs.renameSync(`${workspace.rootFolder}/a/src/one.ts`, `${workspace.rootFolder}/a/src/uno.ts`),
+        reason: 'input files were added, deleted or renamed ("a/src/one.ts", "a/src/uno.ts")',
+        sourceFile: 'a/src/uno.ts'
+      }
+    ],
+    [
+      'a configuration file changes',
+      {
+        change: (workspace: ITestWorkspace) => {
+          workspace.writeFile('a/src/one.ts', 'one 2');
+          workspace.writeFile('a/tsconfig.json', '{ "compilerOptions": {} }');
+        },
+        reason: 'a configuration file changed ("a/tsconfig.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ]
+  ])('runs the initial command if %s', async (description: string, { change, reason, sourceFile }) => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    change(workspace);
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(`Not using the incremental command because ${reason}.`);
+
+    // The result of the initial command is the new base.
+    workspace.writeFile(sourceFile, 'edited');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('runs the initial command if an environment variable that the operation depends on changes', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', dependsOnEnvVars: ['MODE'] }]);
+    await workspace.executeAsync({ MODE: 'debug' });
+
+    const changed: ITestIteration = await workspace.executeAsync({ MODE: 'ship' });
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because an environment variable that it depends on changed.'
+    );
+  });
+
+  it('runs the incremental command of a project whose production dependency changed', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b', dependencies: ['a'] }
+    ]);
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental', 'b:incremental']);
+  });
+
+  it.each([
+    [
+      'a dev dependency',
+      [{ name: 'a' }, { name: 'b', devDependencies: ['a'] }],
+      'its dependency "a" changed, and it is not a production dependency'
+    ],
+    [
+      'a rig',
+      [
+        { name: 'a', isRig: true },
+        { name: 'b', dependencies: ['a'] }
+      ],
+      'its dependency "a" changed, and it is a build tool'
+    ]
+  ])(
+    'runs the initial command of a project if %s changed',
+    async (description, projectSpecs: IProjectSpec[], reason: string) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync(projectSpecs);
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:incremental', 'b:initial']);
+      expect(changed.output).toContain(`Not using the incremental command because ${reason}.`);
+    }
+  );
+
+  it('checks the dependencies that an operation has through a phase of its own project without a script', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync(
+      [{ name: 'a' }, { name: 'b', devDependencies: ['a'] }, { name: 'c', dependencies: ['a'] }],
+      { hasPassThroughPhase: true }
+    );
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual([
+      'a:initial',
+      'b:initial',
+      'c:initial'
+    ]);
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect([...changed.commands].sort()).toEqual(['a:incremental', 'b:initial', 'c:incremental']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because its dependency "a" changed, and it is not a production dependency.'
+    );
+
+    // A change in the project of the phase without a script is judged by the operation's own inputs.
+    workspace.writeFile('b/src/one.ts', 'one 2');
+    workspace.writeFile('c/src/one.ts', 'one 2');
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['b:incremental', 'c:incremental']);
+  });
+
+  it('runs the initial command if the output folders changed since the last run', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // E.g. another tool atomically replaced an output file.
+    workspace.writeFile('a/lib/sub/two.js.tmp', 'tampered');
+    fs.renameSync(`${workspace.rootFolder}/a/lib/sub/two.js.tmp`, `${workspace.rootFolder}/a/lib/sub/two.js`);
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because its output folders changed since its last successful run.'
+    );
+  });
+
+  it('always runs the initial command of an operation that builds a bundle', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', isBundle: true }]);
+    await workspace.executeAsync();
+
+    for (const content of ['one 2', 'one 3']) {
+      workspace.writeFile('a/src/one.ts', content);
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:initial']);
+      expect(changed.output).toContain(
+        'Not using the incremental command because its outputs include the bundle "dist/main.js".'
+      );
+    }
+  });
+
+  it('runs the initial command after an incremental command that changed which output files exist', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.getStatus('a')).toBe(OperationStatus.Success);
+    expect(changed.output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").'
+    );
+
+    // Its outputs may be named after their content, so it never runs its incremental command again.
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its incremental command changed which output files it has in an earlier run: 1 added ("lib/chunk.js").'
+    );
+  });
+
+  it('runs the initial command after a failure', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'error');
+    const failed: ITestIteration = await workspace.executeAsync();
+    expect(failed.commands).toEqual(['a:incremental']);
+    expect(failed.getStatus('a')).toBe(OperationStatus.Failure);
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const fixed: ITestIteration = await workspace.executeAsync();
+    expect(fixed.commands).toEqual(['a:initial']);
+    expect(fixed.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+
+  it('runs the initial command after a command that was terminated, but not for operations that did not start', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b', dependencies: ['a'] }
+    ]);
+    await workspace.executeAsync();
+
+    // Its incremental command rewrites "lib/one.js" in place, so its output folders list the same files.
+    workspace.writeFile('a/src/one.ts', 'one hang');
+    const hung: Promise<void> = workspace.waitForHangAsync();
+    const execution: Promise<ITestIteration> = workspace.executeAsync();
+    await hung;
+    await workspace.graph.abortCurrentIterationAsync({ terminateRunning: true });
+    const aborted: ITestIteration = await execution;
+    expect(aborted.commands).toEqual(['a:incremental']);
+    expect(aborted.getStatus('a')).toBe(OperationStatus.Aborted);
+    expect(aborted.getStatus('b')).toBe(OperationStatus.Aborted);
+
+    // An aborted operation keeps its last successful result, but not its base if its command started.
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial', 'b:incremental']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+
+  it('runs the initial command after a run whose input files changed while it ran', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b', dependencies: ['a'] }
+    ]);
+    // Like CacheableOperationPlugin, e.g. when the command of "a" rewrites an API report that is one of its inputs.
+    let unverifiableProjectName: string | undefined = 'a';
+    workspace.graph.hooks.afterExecuteOperationAsync.tap('test', (record: IOperationExecutionResult) => {
+      if (record.operation.associatedProject.packageName === unverifiableProjectName) {
+        markResultUnverifiable(record);
+      }
+    });
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial', 'b:initial']);
+
+    unverifiableProjectName = undefined;
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial', 'b:incremental']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental', 'b:incremental']);
+  });
+
+  it('forgets every base after a native command, but not after an input change', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
+    await workspace.executeAsync();
+
+    workspace.graph.invalidateOperations(
+      [workspace.operations.get('a')!],
+      INPUTS_CHANGED_INVALIDATION_REASON
+    );
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    workspace.graph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    workspace.writeFile('b/src/one.ts', 'one 3');
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'b:initial']);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
index 653c027eb2..061de0a2b8 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
@@ -167,4 +167,33 @@ describe('OperationGraph operation environment', () => {
       ])
     );
   });
+
+  it('gives every iteration hook the environment lookup that the iteration was scheduled with', async () => {
+    const graph: OperationGraph = createGraph([new EnvironmentRecordingRunner('operation')]);
+    type GetOperationEnvironment = IOperationGraphIterationOptions['getOperationEnvironment'];
+    const received: [string, GetOperationEnvironment][] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastResults, options) => {
+      received.push(['configureIteration', options.getOperationEnvironment]);
+    });
+    graph.hooks.beforeExecuteIterationAsync.tapPromise('test', async (records, options) => {
+      received.push(['beforeExecuteIterationAsync', options.getOperationEnvironment]);
+    });
+    graph.hooks.afterExecuteIterationAsync.tapPromise('test', async (status, records, options) => {
+      received.push(['afterExecuteIterationAsync', options.getOperationEnvironment]);
+      return status;
+    });
+    const getOperationEnvironment: GetOperationEnvironment = () => ({ [SESSION_VARIABLE]: 'A' });
+
+    expect((await graph.executeAsync({ getOperationEnvironment })).status).toBe(OperationStatus.Success);
+    expect((await graph.executeAsync({})).status).toBe(OperationStatus.Success);
+
+    expect(received).toEqual([
+      ['configureIteration', getOperationEnvironment],
+      ['beforeExecuteIterationAsync', getOperationEnvironment],
+      ['afterExecuteIterationAsync', getOperationEnvironment],
+      ['configureIteration', undefined],
+      ['beforeExecuteIterationAsync', undefined],
+      ['afterExecuteIterationAsync', undefined]
+    ]);
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
new file mode 100644
index 0000000000..83582351ea
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
@@ -0,0 +1,125 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  describeOutputFileChanges,
+  getCleanOnlyReason,
+  readOperationOutputManifestAsync,
+  type IOperationOutputManifest
+} from '../OperationOutputManifest';
+
+describe(getCleanOnlyReason.name, () => {
+  it.each([
+    [
+      'lib/chunk.main_1a2b3c4d.js',
+      'its outputs include the content-hashed file "lib/chunk.main_1a2b3c4d.js"'
+    ],
+    ['lib/0dd8cf755e5195a5.js', 'its outputs include the content-hashed file "lib/0dd8cf755e5195a5.js"'],
+    ['lib/app-3f9a1c7b.min.css', 'its outputs include the content-hashed file "lib/app-3f9a1c7b.min.css"'],
+    [
+      'lib/vendor.4e5f6a7b.js.map',
+      'its outputs include the content-hashed file "lib/vendor.4e5f6a7b.js.map"'
+    ],
+    ['dist/main.js', 'its outputs include the bundle "dist/main.js"'],
+    ['dist-cjs/index.cjs', 'its outputs include the bundle "dist-cjs/index.cjs"'],
+    ['release/styles.css', 'its outputs include the bundle "release/styles.css"']
+  ])('treats %s as a clean-only output', (file: string, reason: string) => {
+    expect(getCleanOnlyReason(['lib/index.js', file])).toBe(reason);
+  });
+
+  it.each(['lib/index.js', 'lib/facade.js', 'lib/deadbeefcafe.js', 'lib-commonjs/a.js', 'dist/index.d.ts'])(
+    'allows incremental builds of %s',
+    (file: string) => {
+      expect(getCleanOnlyReason([file])).toBeUndefined();
+    }
+  );
+});
+
+describe(describeOutputFileChanges.name, () => {
+  it('describes added and removed files, and ignores content-addressed files', () => {
+    expect(describeOutputFileChanges(new Set(['lib/a.js']), new Set(['lib/a.js']))).toBeUndefined();
+    expect(
+      describeOutputFileChanges(
+        new Set(['lib/a.js', 'lib/b.js']),
+        new Set(['lib/a.js', 'lib/e.js', 'lib/d.js', 'lib/c.js', 'lib/f.js'])
+      )
+    ).toBe('4 added ("lib/c.js", "lib/d.js", "lib/e.js", ...), 1 removed ("lib/b.js")');
+    expect(
+      describeOutputFileChanges(
+        new Set(['temp/jest-transform-cache-0123456789abcdef-0123456789abcdef/7f/a_1']),
+        new Set(['temp/jest-transform-cache-0123456789abcdef-0123456789abcdef/8e/b_2'])
+      )
+    ).toBeUndefined();
+  });
+});
+
+describe(readOperationOutputManifestAsync.name, () => {
+  let projectFolder: string;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-manifest-'));
+    fs.mkdirSync(`${projectFolder}/lib/sub`, { recursive: true });
+    fs.writeFileSync(`${projectFolder}/lib/index.js`, 'index');
+    fs.writeFileSync(`${projectFolder}/lib/sub/util.js`, 'util');
+    fs.writeFileSync(`${projectFolder}/tsconfig.tsbuildinfo`, '{}');
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  async function readAsync(): Promise<IOperationOutputManifest> {
+    return await readOperationOutputManifestAsync(projectFolder, ['lib/', 'tsconfig.tsbuildinfo', 'lib-esm']);
+  }
+
+  it('lists the output files', async () => {
+    const manifest: IOperationOutputManifest = await readAsync();
+    expect(Array.from(manifest.files).sort()).toEqual([
+      'lib/index.js',
+      'lib/sub/util.js',
+      'tsconfig.tsbuildinfo'
+    ]);
+    expect(manifest.cleanOnlyReason).toBeUndefined();
+    expect((await readAsync()).signature).toBe(manifest.signature);
+  });
+
+  it('does not change if a file is rewritten in place', async () => {
+    const { signature } = await readAsync();
+    fs.writeFileSync(`${projectFolder}/lib/sub/util.js`, 'util 2');
+    expect((await readAsync()).signature).toBe(signature);
+  });
+
+  it.each([
+    [
+      'a file is added to a subfolder',
+      (folder: string) => fs.writeFileSync(`${folder}/lib/sub/new.js`, 'new')
+    ],
+    ['a file is deleted', (folder: string) => fs.rmSync(`${folder}/lib/sub/util.js`)],
+    [
+      'a file in a subfolder is replaced by a rename',
+      (folder: string) => {
+        fs.writeFileSync(`${folder}/lib/sub/util.js.tmp`, 'util 2');
+        fs.renameSync(`${folder}/lib/sub/util.js.tmp`, `${folder}/lib/sub/util.js`);
+      }
+    ],
+    [
+      'a folder is recreated',
+      (folder: string) => {
+        fs.rmSync(`${folder}/lib/sub`, { recursive: true });
+        fs.mkdirSync(`${folder}/lib/sub`);
+        fs.writeFileSync(`${folder}/lib/sub/util.js`, 'util');
+      }
+    ],
+    ['a missing output folder is created', (folder: string) => fs.mkdirSync(`${folder}/lib-esm`)]
+  ])('changes if %s', async (description: string, change: (folder: string) => void) => {
+    const { signature } = await readAsync();
+    // Folder modification times can have a coarse resolution.
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    change(projectFolder);
+    expect((await readAsync()).signature).not.toBe(signature);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts
new file mode 100644
index 0000000000..2ad766f703
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerIncrementalGuard.test.ts
@@ -0,0 +1,213 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import { PassThrough } from 'node:stream';
+
+import {
+  StringBufferTerminalProvider,
+  Terminal,
+  type ITerminal,
+  type ITerminalProvider
+} from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { Utilities } from '../../../utilities/Utilities';
+import type { IOperationRunnerContext } from '../IOperationRunner';
+import { OperationStatus } from '../OperationStatus';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+import {
+  getCommandExecution,
+  setIncrementalExecutionGuard,
+  type IIncrementalExecutionGuard
+} from '../IncrementalExecutionState';
+
+const INITIAL_COMMAND: string = 'node build.js';
+const INCREMENTAL_COMMAND: string = 'node build.js --incremental';
+
+interface ITestRun {
+  readonly status: OperationStatus;
+  readonly commands: ReadonlyArray<string>;
+  readonly output: string;
+  readonly context: IOperationRunnerContext;
+}
+
+interface ITestRunOptions {
+  readonly requiresGuard: boolean;
+  readonly guard?: IIncrementalExecutionGuard;
+  readonly hasLastState?: boolean;
+  readonly exitCodeByCommand?: Readonly<Record<string, number>>;
+}
+
+async function runAsync(options: ITestRunOptions): Promise<ITestRun> {
+  const { requiresGuard, guard, hasLastState = true, exitCodeByCommand = {} } = options;
+  const commands: string[] = [];
+  const executeSpy: jest.SpyInstance = jest
+    .spyOn(Utilities, 'executeLifecycleCommandAsync')
+    .mockImplementation((command: string) => {
+      commands.push(command);
+      const stdout: PassThrough = new PassThrough();
+      const stderr: PassThrough = new PassThrough();
+      const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+        stdout,
+        stderr,
+        stdio: []
+      }) as unknown as childProcess.ChildProcess;
+      queueMicrotask(() => {
+        stdout.end();
+        stderr.end();
+        child.emit('close', exitCodeByCommand[command] ?? 0, null);
+      });
+      return child;
+    });
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const context: IOperationRunnerContext = {
+    environment: undefined,
+    createChildProcessReporter: jest.fn(),
+    async runWithTerminalAsync<T>(
+      callback: (
+        terminal: ITerminal,
+        operationTerminalProvider: ITerminalProvider,
+        structuredChildOutputTerminalProvider: ITerminalProvider
+      ) => Promise<T>
+    ): Promise<T> {
+      return await callback(new Terminal(terminalProvider), terminalProvider, terminalProvider);
+    }
+  } as unknown as IOperationRunnerContext;
+  if (guard) {
+    setIncrementalExecutionGuard(context, guard);
+  }
+  const runner: ShellOperationRunner = new ShellOperationRunner({
+    phase: { allowWarningsOnSuccess: false } as IPhase,
+    rushProject: {
+      projectFolder: process.cwd(),
+      rushConfiguration: { commonTempFolder: process.cwd() }
+    } as RushConfigurationProject,
+    displayName: 'a (build)',
+    initialCommand: INITIAL_COMMAND,
+    incrementalCommand: INCREMENTAL_COMMAND,
+    incrementalCommandRequiresGuard: requiresGuard,
+    commandForHash: INITIAL_COMMAND,
+    ignoredParameterValues: []
+  });
+  try {
+    const status: OperationStatus = await runner.executeAsync(
+      context,
+      hasLastState ? { status: OperationStatus.Success } : undefined
+    );
+    return { status, commands, output: terminalProvider.getOutput(), context };
+  } finally {
+    executeSpy.mockRestore();
+  }
+}
+
+function createGuard(
+  blockReason: string | undefined,
+  rerunReason: string | undefined = undefined
+): IIncrementalExecutionGuard & {
+  getBlockReasonAsync: jest.Mock;
+  verifyIncrementalResultAsync: jest.Mock;
+} {
+  return {
+    getBlockReasonAsync: jest.fn(async () => blockReason),
+    verifyIncrementalResultAsync: jest.fn(async () => rerunReason)
+  };
+}
+
+describe(`${ShellOperationRunner.name} with an incremental command that requires a guard`, () => {
+  it('runs the initial command if no guard is registered', async () => {
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(output).toContain(`Invoking (initial): ${INITIAL_COMMAND}`);
+    expect(getCommandExecution(context)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+  });
+
+  it('runs the initial command without asking the guard if the operation has no last state', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(undefined);
+    const { commands } = await runAsync({ requiresGuard: true, guard, hasLastState: false });
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(guard.getBlockReasonAsync).not.toHaveBeenCalled();
+  });
+
+  it('runs the initial command and says why if the guard blocks the incremental command', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard('input files were added, deleted or renamed');
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(output).toContain(
+      'Not using the incremental command because input files were added, deleted or renamed.'
+    );
+    expect(guard.verifyIncrementalResultAsync).not.toHaveBeenCalled();
+    expect(getCommandExecution(context)?.kind).toBe('initial');
+  });
+
+  it('runs only the incremental command if the guard allows it and its outputs are verified', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(undefined);
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INCREMENTAL_COMMAND]);
+    expect(output).toContain(`Invoking (incremental): ${INCREMENTAL_COMMAND}`);
+    expect(guard.verifyIncrementalResultAsync).toHaveBeenCalledTimes(1);
+    expect(getCommandExecution(context)).toEqual({ kind: 'incremental', hasIncrementalCommand: true });
+  });
+
+  it('runs the initial command after the incremental command if its outputs are not verified', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(
+      undefined,
+      'the incremental command changed which output files it has: added "lib/b.js"'
+    );
+    const { status, commands, output, context } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INCREMENTAL_COMMAND, INITIAL_COMMAND]);
+    expect(output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: added "lib/b.js".'
+    );
+    expect(getCommandExecution(context)?.kind).toBe('initial');
+  });
+
+  it('does not verify or repeat a failed incremental command', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard(undefined);
+    const { status, commands, context } = await runAsync({
+      requiresGuard: true,
+      guard,
+      exitCodeByCommand: { [INCREMENTAL_COMMAND]: 1 }
+    });
+    expect(status).toBe(OperationStatus.Failure);
+    expect(commands).toEqual([INCREMENTAL_COMMAND]);
+    expect(guard.verifyIncrementalResultAsync).not.toHaveBeenCalled();
+    expect(getCommandExecution(context)?.kind).toBe('incremental');
+  });
+
+  it('runs the initial command if the guard fails', async () => {
+    const guard: IIncrementalExecutionGuard = {
+      getBlockReasonAsync: async () => {
+        throw new Error('EACCES: permission denied');
+      },
+      verifyIncrementalResultAsync: async () => undefined
+    };
+    const { status, commands, output } = await runAsync({ requiresGuard: true, guard });
+    expect(status).toBe(OperationStatus.Success);
+    expect(commands).toEqual([INITIAL_COMMAND]);
+    expect(output).toContain(
+      'Not using the incremental command because its incremental execution guard failed: Error: EACCES: permission denied.'
+    );
+  });
+});
+
+describe(`${ShellOperationRunner.name} with an incremental command that does not require a guard`, () => {
+  it('runs the incremental command for an operation with a last state, as in watch mode, without recording it', async () => {
+    const guard: ReturnType<typeof createGuard> = createGuard('its command line changed');
+    const { commands, context } = await runAsync({ requiresGuard: false, guard });
+    expect(commands).toEqual([INCREMENTAL_COMMAND]);
+    expect(guard.getBlockReasonAsync).not.toHaveBeenCalled();
+    expect(getCommandExecution(context)).toBeUndefined();
+  });
+
+  it('runs the initial command for an operation without a last state', async () => {
+    const { commands } = await runAsync({ requiresGuard: false, hasLastState: false });
+    expect(commands).toEqual([INITIAL_COMMAND]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
index b93ecb3d91..78237670cb 100644
--- a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
@@ -38,6 +38,7 @@ import {
 import { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
 import { defineCustomParameters } from '../../../cli/parsing/defineCustomParameters';
 import { associateParametersByPhase } from '../../../cli/parsing/associateParametersByPhase';
+import { getCommandExecution, setIncrementalExecutionGuard } from '../IncrementalExecutionState';
 
 interface ISerializedOperation {
   name: string;
@@ -349,4 +350,119 @@ describe(ShellOperationRunnerPlugin.name, () => {
       expect(commands).toEqual(expectedCommands);
     }
   );
+
+  describe('outside watch mode', () => {
+    async function runTwiceAsync(options: {
+      scripts: Record<string, string>;
+      shellCommand?: string;
+      guarded: boolean;
+    }): Promise<{ commands: string[]; hasIncrementalCommand: boolean | undefined }> {
+      const phase: IPhase = {
+        name: '_phase:build',
+        isSynthetic: false,
+        missingScriptBehavior: 'error',
+        allowWarningsOnSuccess: false,
+        associatedParameters: new Set(),
+        shellCommand: options.shellCommand
+      } as unknown as IPhase;
+      const project: RushConfigurationProject = {
+        packageName: 'a',
+        projectFolder: process.cwd(),
+        packageJson: { scripts: options.scripts },
+        rushConfiguration: { commonTempFolder: process.cwd() }
+      } as unknown as RushConfigurationProject;
+      const operation: Operation = new Operation({ phase, project, logFilenameIdentifier: 'a' });
+      const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+      new ShellOperationRunnerPlugin().apply(hooks);
+      await hooks.createOperationsAsync.promise(new Set([operation]), {
+        isIncrementalBuildAllowed: true,
+        isWatch: false
+      } as unknown as ICreateOperationsContext);
+
+      const commands: string[] = [];
+      const executeSpy = jest
+        .spyOn(Utilities, 'executeLifecycleCommandAsync')
+        .mockImplementation((command) => {
+          commands.push(command.trim());
+          const stdout: PassThrough = new PassThrough();
+          const stderr: PassThrough = new PassThrough();
+          const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
+            stdout,
+            stderr,
+            stdio: []
+          }) as unknown as childProcess.ChildProcess;
+          queueMicrotask(() => {
+            stdout.end();
+            stderr.end();
+            child.emit('close', 0, null);
+          });
+          return child;
+        });
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const context: IOperationRunnerContext = {
+        environment: undefined,
+        async runWithTerminalAsync<T>(
+          callback: (
+            terminal: ITerminal,
+            operationTerminalProvider: ITerminalProvider,
+            structuredChildOutputTerminalProvider: ITerminalProvider
+          ) => Promise<T>
+        ): Promise<T> {
+          return await callback(new Terminal(terminalProvider), terminalProvider, terminalProvider);
+        }
+      } as unknown as IOperationRunnerContext;
+      if (options.guarded) {
+        setIncrementalExecutionGuard(context, {
+          getBlockReasonAsync: async () => undefined,
+          verifyIncrementalResultAsync: async () => undefined
+        });
+      }
+      try {
+        await expect(operation.runner!.executeAsync(context)).resolves.toBe(OperationStatus.Success);
+        await expect(
+          operation.runner!.executeAsync(context, { status: OperationStatus.Success })
+        ).resolves.toBe(OperationStatus.Success);
+      } finally {
+        executeSpy.mockRestore();
+      }
+      return { commands, hasIncrementalCommand: getCommandExecution(context)?.hasIncrementalCommand };
+    }
+
+    it('runs the :incremental script for a repeated operation when its guard allows it', async () => {
+      const { commands, hasIncrementalCommand } = await runTwiceAsync({
+        scripts: {
+          '_phase:build': 'node build.js',
+          '_phase:build:incremental': 'node build.js --incremental'
+        },
+        guarded: true
+      });
+      expect(commands).toEqual(['node build.js', 'node build.js --incremental']);
+      expect(hasIncrementalCommand).toBe(true);
+    });
+
+    it('does not treat an :incremental script that equals the initial script as an incremental command', async () => {
+      const { commands, hasIncrementalCommand } = await runTwiceAsync({
+        scripts: {
+          '_phase:build': 'node build.js',
+          '_phase:build:incremental': 'node build.js'
+        },
+        guarded: true
+      });
+      expect(commands).toEqual(['node build.js', 'node build.js']);
+      expect(hasIncrementalCommand).toBe(false);
+    });
+
+    it('does not use the :incremental script of an operation with a shellCommand', async () => {
+      const { commands, hasIncrementalCommand } = await runTwiceAsync({
+        scripts: {
+          '_phase:build': 'node build.js',
+          '_phase:build:incremental': 'node build.js --incremental'
+        },
+        shellCommand: 'node custom.js',
+        guarded: true
+      });
+      expect(commands).toEqual(['node custom.js', 'node custom.js']);
+      expect(hasIncrementalCommand).toBe(false);
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index b702606300..ed1b151020 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -277,6 +277,11 @@
           "default": false,
           "description": "Enable explicit operationSettings[].daemonIpc Node launchers for incremental daemon builds. Never enables watch mode or unrequested execution. RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS overrides."
         },
+        "incrementalBuilds": {
+          "type": "boolean",
+          "default": true,
+          "description": "Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited since then and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. Results of an incremental script are not written to the build cache. RUSH_DAEMON_INCREMENTAL_BUILDS overrides."
+        },
         "queueTimeoutSeconds": {
           "type": "number",
           "minimum": 0,

From 9b5b7ea4b0ee3fb97b9063a43bc838daf76df425 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:05:08 +0000
Subject: [PATCH 040/265] [rush-lib] Let the daemon run :incremental scripts
 when a guard allows it

Swarm integration step 25; original commit 7d0ffb955b (merge of swarm/r06-t106 at b767c64dac).
Scope: task 106.

Brings task 106's test-only tip onto step 1 (31a8db3e65). With task 106 the daemon runs an operation's <phase>:incremental script, on top of the outputs of its last successful run in the daemon, when only files that the operation builds were edited since then and its output folders are unchanged; anything else runs the initial command. A result built on an incremental base is never written to the build cache. Kill switch: daemon.incrementalBuilds false in rush.json, or RUSH_DAEMON_INCREMENTAL_BUILDS=0. Task 84 passes getOperationEnvironment to the before/after iteration hooks.

Second agents: t03 CONFIRMED (board 2067, 37 of 39; TAMPERI is the declared limitation) and t04 CONFIRMED (board 2100). ch01 on this tree (board 2161): rush-lib 1228/0, rush-daemon 516/0, rush-cli-client 367/0; 50 mutants, 42 killed; 33 of 33 end-to-end rows against a native cache-off oracle. Known costs, per ch01's rulings in board 2161: revisiting a state restores less from the cache (Rule 2), and an in-place rewrite of an output file by another writer is not detected (TAMPERI; task 139, r06's 641c39f120 in board 2171).

Gate: ch01 GATE OK board 2161 (tree b1c0c2e690)

Commits folded into this step (1):
- b767c64dac [rush-lib] Test that an incremental result taints cache writes through an operation without a script

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ableOperationPluginRetainedResults.test.ts | 33 ++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index 172a2e76e1..ef643be028 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -61,6 +61,7 @@ import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRun
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import { setCommandExecution } from '../IncrementalExecutionState';
+import { NullOperationRunner } from '../NullOperationRunner';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -123,6 +124,10 @@ interface ITestGraph {
 }
 
 interface ITestGraphOptions {
+  /**
+   * The names of the operations that have no script, like a phase whose script is missing
+   */
+  noOpNames?: ReadonlySet<string>;
   /**
    * The names of the dependencies of each operation. By default, each operation depends on the previous one.
    */
@@ -161,7 +166,9 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
       getCacheDisabledReason: () => undefined
     } as unknown as RushProjectConfiguration);
     const operation: Operation = new Operation({
-      runner: new CacheableMockRunner(name, executions, incrementalNames),
+      runner: options.noOpNames?.has(name)
+        ? new NullOperationRunner({ name, result: OperationStatus.NoOp, silent: true })
+        : new CacheableMockRunner(name, executions, incrementalNames),
       logFilenameIdentifier: name,
       phase: mockPhase,
       project
@@ -544,6 +551,30 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     expect(testGraph.cacheWrites).toEqual([]);
   });
 
+  it('does not write results built against an incremental result through an operation without a script', async () => {
+    // "a" <- "b-lite" <- "b", like the phases of the rushstack repo: the build of a project depends only on a phase of
+    // its own project that has no script and depends on the builds of upstream projects.
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b-lite', 'b'], {
+      noOpNames: new Set(['b-lite'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --only b: "b" is built against the retained incremental result of "a", through the retained "b-lite".
+    testGraph.localHashes.set('b', 'b-v2');
+    testGraph.operations.get('a')!.enabled = false;
+    testGraph.operations.get('b-lite')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
   it('restores a consumer of an incremental result from the build cache and trusts it as a cacheable result', async () => {
     // "a" <- "b" <- "c"
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);

From 060e7eea939428dc62bce29769469973202e1d7c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:07:54 +0000
Subject: [PATCH 041/265] [rush-lib] Test that a configuration is read again
 while only its rig.json may still be changing

Swarm integration step 26; original commit 8a1d1ee8dd (merge of swarm/r07-t93-nit at f5826544d1).
Scope: task 93 NIT.

Test-only: 7 lines in RushProjectConfiguration.test.ts, no source change. It kills ch01's task 93 mutant M13 (board 1869): with the mutant the new assertion fails, 25/1, and 18900fe380's test file lets it survive, 26/0. Full rush-lib on the cherry-pick onto b1c0c2e690: 1228/0 (board 2178). The deployed daemon files don't change, so snapshot s14 (7d0ffb955b) is unaffected.

Gate: ch01 GATE OK board 2178 (tree 09d90522de)

Commits folded into this step (1):
- f5826544d1 [rush-lib] Test that a configuration is read again while only its rig.json may still be changing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../rush-lib/src/api/test/RushProjectConfiguration.test.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
index bdb3fe6bdb..6232aa0e0d 100644
--- a/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/RushProjectConfiguration.test.ts
@@ -468,6 +468,13 @@ describe(RushProjectConfiguration.name, () => {
         expect(await loadTwiceAsync()).toBeGreaterThan(0);
         fs.utimesSync(rigFilePath, 1_000_000, 1_000_000);
         expect(await loadTwiceAsync()).toBe(0);
+
+        // The same holds when rig.json is the only file that may still be changing.
+        const rigJsonPath: string = path.join(folder, 'rigged/config/rig.json');
+        fs.utimesSync(rigJsonPath, future, future);
+        expect(await loadTwiceAsync()).toBeGreaterThan(0);
+        fs.utimesSync(rigJsonPath, 1_000_000, 1_000_000);
+        expect(await loadTwiceAsync()).toBe(0);
       });
 
       it('reports errors and warnings on every call', async () => {

From e671434a19fa0337971a77e35d199191d2746eeb Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:21:42 +0000
Subject: [PATCH 042/265] [rush-lib] The incremental guard detects an in-place
 rewrite of an output file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Swarm integration step 27; original commit 6eae8fadad (merge of swarm/r06-t106 at 641c39f120).
Scope: task 139.

Brings r06's fold-in on task 106 (board 2171), in place of b767c64dac. The output signature of an operation now records each output file's inode, size and mtime as well as the folder listing, so when another writer appends to or rewrites an output file in place, the next build runs the initial command ("its output folders changed since its last successful run") instead of an incremental run on the stale file. This closes t03's TAMPERI. A touch that changes only mtime now also costs one initial run. r06 measured about 4 µs per output file per read.

ch01 on tree 1eb87abdd2 (board 2211): rush-lib 1231/0, rush-daemon 516/0, rush-cli-client 367/0; b767c64dac's manifest fails 4 of the new tests; 10 mutants, 6 killed (N1, N3 and N6 survive; task 138 adds their tests); tamper end-to-end rows 9/9 against 2/9 before, full rows 33/33, cache-off rows 7/7. On this branch the tree is 1eb87abdd2 plus r07's test-only 8a1d1ee8dd change, byte for byte.

Gate: ch01 GATE OK board 2211 (tree 1eb87abdd2)

Commits folded into this step (1):
- 641c39f120 [rush-lib] Detect in-place rewrites of output files in the incremental guard

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../operations/OperationOutputManifest.ts     | 62 +++++++++----------
 .../IncrementalExecutionGuardPlugin.test.ts   | 14 +++++
 .../test/OperationOutputManifest.test.ts      | 23 ++++++-
 3 files changed, 63 insertions(+), 36 deletions(-)

diff --git a/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
index 99932a9350..006b1d6c05 100644
--- a/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
@@ -2,8 +2,8 @@
 // See LICENSE in the project root for license information.
 
 import { createHash, type Hash } from 'node:crypto';
-import type * as fs from 'node:fs';
-import { lstat, readdir } from 'node:fs/promises';
+import * as fs from 'node:fs';
+import { readdir } from 'node:fs/promises';
 import * as path from 'node:path';
 
 /**
@@ -11,9 +11,10 @@ import * as path from 'node:path';
  */
 export interface IOperationOutputManifest {
   /**
-   * Covers the path of every file and folder in the output folders, and the identity, modification time and status
-   * change time of every folder. It changes if an output is added, deleted or renamed, if a file is replaced by a
-   * rename (as atomic writes do), or if a folder is recreated. It does not change if a file is rewritten in place.
+   * Covers the path of every file and folder in the output folders, the identity, size and modification time of
+   * every file, and the identity, modification time and status change time of every folder. It changes if an output
+   * is added, deleted, renamed or rewritten, including in place, or if a folder is recreated. It does not change if
+   * a hard link to a file is created or removed elsewhere.
    */
   readonly signature: string;
   /**
@@ -55,27 +56,21 @@ export async function readOperationOutputManifestAsync(
 
   const readFolderAsync = async (relativeFolder: string, stats: fs.Stats): Promise<void> => {
     entries.push(`${relativeFolder}/ ${stats.ino} ${stats.mtimeMs} ${stats.ctimeMs}`);
-    const children: fs.Dirent[] = await limitAsync(() =>
-      tryReaddirAsync(path.resolve(projectFolder, relativeFolder))
-    );
+    const folderPath: string = path.resolve(projectFolder, relativeFolder);
+    const children: fs.Dirent[] = await limitAsync(() => tryReaddirAsync(folderPath));
     const subfolderPromises: Promise<void>[] = [];
     for (const child of children) {
       const relativePath: string = `${relativeFolder}/${child.name}`;
+      const childStats: fs.Stats | undefined = lstatIfExists(`${folderPath}${path.sep}${child.name}`);
       if (child.isDirectory()) {
-        subfolderPromises.push(
-          limitAsync(() => tryLstatAsync(path.resolve(projectFolder, relativePath))).then(
-            async (childStats: fs.Stats | undefined) => {
-              if (childStats?.isDirectory()) {
-                await readFolderAsync(relativePath, childStats);
-              } else {
-                // It was deleted or replaced after its parent was read.
-                entries.push(`${relativePath}/ replaced`);
-              }
-            }
-          )
-        );
+        if (childStats?.isDirectory()) {
+          subfolderPromises.push(readFolderAsync(relativePath, childStats));
+        } else {
+          // It was deleted or replaced after its parent was read.
+          entries.push(`${relativePath}/ replaced`);
+        }
       } else {
-        entries.push(relativePath);
+        entries.push(getFileEntry(relativePath, childStats));
         files.add(relativePath);
       }
     }
@@ -85,15 +80,13 @@ export async function readOperationOutputManifestAsync(
   await Promise.all(
     outputFolderNames.map(async (folderName: string) => {
       const relativePath: string = folderName.replace(/\\/g, '/').replace(/\/+$/, '');
-      const stats: fs.Stats | undefined = await limitAsync(() =>
-        tryLstatAsync(path.resolve(projectFolder, relativePath))
-      );
+      const stats: fs.Stats | undefined = lstatIfExists(path.resolve(projectFolder, relativePath));
       if (!stats) {
         entries.push(`missing ${relativePath}`);
       } else if (stats.isDirectory()) {
         await readFolderAsync(relativePath, stats);
       } else {
-        entries.push(`${relativePath} ${stats.ino} ${stats.mtimeMs} ${stats.ctimeMs} ${stats.size}`);
+        entries.push(getFileEntry(relativePath, stats));
         files.add(relativePath);
       }
     })
@@ -170,6 +163,12 @@ export function describeOutputFileChanges(
     .join(', ');
 }
 
+// The status change time of a file is left out, because it also changes when a hard link to the file is created or
+// removed elsewhere, e.g. by a tool that links outputs into another folder.
+function getFileEntry(relativePath: string, stats: fs.Stats | undefined): string {
+  return stats ? `${relativePath} ${stats.ino} ${stats.size} ${stats.mtimeMs}` : `${relativePath} deleted`;
+}
+
 function createConcurrencyLimiter(maxConcurrency: number): <T>(fn: () => Promise<T>) => Promise<T> {
   let active: number = 0;
   const waiting: (() => void)[] = [];
@@ -193,15 +192,10 @@ function createConcurrencyLimiter(maxConcurrency: number): <T>(fn: () => Promise
   };
 }
 
-async function tryLstatAsync(filePath: string): Promise<fs.Stats | undefined> {
-  try {
-    return await lstat(filePath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return undefined;
-    }
-    throw error;
-  }
+// Synchronous, because every output file is stat'ed and an lstat call takes a few microseconds, far less than a
+// round trip through the thread pool. The event loop still runs between folders, which are read asynchronously.
+function lstatIfExists(filePath: string): fs.Stats | undefined {
+  return fs.lstatSync(filePath, { throwIfNoEntry: false });
 }
 
 async function tryReaddirAsync(folderPath: string): Promise<fs.Dirent[]> {
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 02b33ea377..9e954a0013 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -567,6 +567,20 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     );
   });
 
+  it('runs the initial command if an output file was rewritten in place since the last run', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // E.g. a debugging edit through the symbolic link to the project in node_modules, which keeps the inode.
+    fs.appendFileSync(`${workspace.rootFolder}/a/lib/sub/two.js`, '\nconsole.log("debug");');
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because its output folders changed since its last successful run.'
+    );
+  });
+
   it('always runs the initial command of an operation that builds a bundle', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', isBundle: true }]);
     await workspace.executeAsync();
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
index 83582351ea..6001b6ee28 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
@@ -87,9 +87,28 @@ describe(readOperationOutputManifestAsync.name, () => {
     expect((await readAsync()).signature).toBe(manifest.signature);
   });
 
-  it('does not change if a file is rewritten in place', async () => {
+  it.each([
+    ['with the same size', (filePath: string) => fs.writeFileSync(filePath, 'utiL')],
+    ['by an append', (filePath: string) => fs.appendFileSync(filePath, ' 2')]
+  ])(
+    'changes if a file is rewritten in place %s',
+    async (description: string, rewrite: (filePath: string) => void) => {
+      const filePath: string = `${projectFolder}/lib/sub/util.js`;
+      const { ino } = fs.statSync(filePath);
+      const { signature } = await readAsync();
+      // File modification times can have a coarse resolution.
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      rewrite(filePath);
+      expect(fs.statSync(filePath).ino).toBe(ino);
+      expect((await readAsync()).signature).not.toBe(signature);
+    }
+  );
+
+  it('does not change if a hard link to a file is created elsewhere', async () => {
     const { signature } = await readAsync();
-    fs.writeFileSync(`${projectFolder}/lib/sub/util.js`, 'util 2');
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    fs.linkSync(`${projectFolder}/lib/sub/util.js`, `${projectFolder}/util.js`);
+    fs.linkSync(`${projectFolder}/tsconfig.tsbuildinfo`, `${projectFolder}/tsbuildinfo.json`);
     expect((await readAsync()).signature).toBe(signature);
   });
 

From 851e3f2c0271dbcc41f75e9e7a53586e7c9855fb Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 23:23:39 +0000
Subject: [PATCH 043/265] [rush-lib] Tests for the incremental guard's
 configuration inputs, content-hashed outputs, invalidation and skip record

Swarm integration step 28; original commit 0d30a5164c (merge of swarm/r06-t138 at dbd5d99147).
Scope: task 138 and t106d.

Brings r06's task 138 tests (board 2302) and t106d (4c9f23e650, board 2233). Only 3 test files change (+204/-18): ProductionDaemonRequestResolver.test.ts, IncrementalExecutionGuardPlugin.test.ts and OperationOutputManifest.test.ts. No product code changes, so no snapshot is needed.

ch01 on tree 45c2c5edd5 (board 2364): rush-lib 1241/0 (1 skipped); rush-daemon 516/0 with t106d. With the new tests, each of the 10 guard and manifest mutants (G9-G12, G19, G24, L1, N1, N3, N6) fails its intended test; all 10 pass the old tests. t106d's kill-switch test fails against a product mutant that drops the daemon.incrementalBuilds check at PhasedScriptAction.ts:666, and 6eae8fadad's version of it passed that mutant.

Gate: ch01 GATE OK board 2364 (tree 45c2c5edd5)

Commits folded into this step (2):
- 4c9f23e650 [rush-daemon] Make the test of daemon.incrementalBuilds: false edit a source file
- dbd5d99147 [rush-lib] Test the incremental guard's configuration inputs, content-hashed outputs, invalidation and skip record

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../ProductionDaemonRequestResolver.test.ts   |   6 +-
 .../IncrementalExecutionGuardPlugin.test.ts   | 180 ++++++++++++++++--
 .../test/OperationOutputManifest.test.ts      |  36 ++++
 3 files changed, 204 insertions(+), 18 deletions(-)

diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 03381a9d62..f307a3a75d 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1517,19 +1517,23 @@ process.exit(23);
       incrementalScript: true,
       incrementalBuilds: false
     });
+    // With incremental builds on, an edit of this source file runs the incremental script (see the next test).
+    const inputPath: string = path.join(fixture.repoRoot, 'projects/a/src/input.txt');
     try {
+      fs.mkdirSync(path.dirname(inputPath), { recursive: true });
       for (const [requestId, input] of [
         ['initial-script-1', 'one'],
         ['initial-script-2', 'two'],
         ['initial-script-3', 'three']
       ]) {
-        fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), input);
+        fs.writeFileSync(inputPath, input);
         const exchange: ITerminalExchange = await runAsync(fixture, requestId, ['build', '--only', 'a']);
         expect(exchange.terminal).toMatchObject({
           kind: 'requestResult',
           payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status: 'SUCCESS' }] }
         });
         expect(logText(exchange)).toContain('Invoking (initial): node build.cjs');
+        expect(logText(exchange)).not.toContain('Not using the incremental command');
       }
       // A watch-only incremental script can keep outputs of deleted inputs, and its output would be cached
       // under the key of the initial script that native Rush runs.
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 9e954a0013..425705774f 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -48,7 +48,7 @@ import { PassThrough } from 'node:stream';
 
 import { LookupByPath } from '@rushstack/lookup-by-path';
 import { SubprocessTerminator } from '@rushstack/node-core-library';
-import { MockWritable } from '@rushstack/terminal';
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
@@ -62,6 +62,7 @@ import {
   NATIVE_COMMAND_INVALIDATION_REASON
 } from '../IncrementalExecutionState';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import { LegacySkipPlugin } from '../LegacySkipPlugin';
 import { NullOperationRunner } from '../NullOperationRunner';
 import { Operation } from '../Operation';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
@@ -105,6 +106,10 @@ interface IProjectSpec {
    * If set, the project has a `profiles` folder, like a rig package.
    */
   readonly isRig?: boolean;
+  /**
+   * Files outside of the project that its build depends on, like `dependsOnAdditionalFiles` in rush-project.json
+   */
+  readonly additionalFiles?: ReadonlyArray<string>;
 }
 
 interface IWorkspaceOptions {
@@ -113,6 +118,10 @@ interface IWorkspaceOptions {
    * operation of its own project, which has no script and depends on the builds of the project's dependencies.
    */
   readonly hasPassThroughPhase?: boolean;
+  /**
+   * If set, applies the skip detection that Rush uses when the build cache is not enabled.
+   */
+  readonly hasLegacySkipDetection?: boolean;
 }
 
 interface ITestIteration {
@@ -204,7 +213,7 @@ function build(projectFolder: string, isBundle: boolean, isIncremental: boolean)
 
 async function createWorkspaceAsync(
   projectSpecs: ReadonlyArray<IProjectSpec>,
-  { hasPassThroughPhase }: IWorkspaceOptions = {}
+  { hasPassThroughPhase, hasLegacySkipDetection }: IWorkspaceOptions = {}
 ): Promise<ITestWorkspace> {
   const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
   workspaceFolders.push(rootFolder);
@@ -256,8 +265,17 @@ async function createWorkspaceAsync(
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
   const lookupByPath: LookupByPath<RushConfigurationProject> = new LookupByPath();
   const outputFolderByPrefix: Map<string, string> = new Map();
+  const additionalFiles: Set<string> = new Set();
   for (const spec of projectSpecs) {
-    const { name, dependencies = [], devDependencies = [], isBundle, dependsOnEnvVars, isRig } = spec;
+    const {
+      name,
+      dependencies = [],
+      devDependencies = [],
+      isBundle,
+      dependsOnEnvVars,
+      isRig,
+      additionalFiles: projectAdditionalFiles = []
+    } = spec;
     const projectFolder: string = `${rootFolder}/${name}`;
     const toVersions = (names: ReadonlyArray<string>): Record<string, string> =>
       Object.fromEntries(names.map((dependencyName: string) => [dependencyName, 'workspace:*']));
@@ -274,11 +292,17 @@ async function createWorkspaceAsync(
     if (isRig) {
       writeFile(`${name}/profiles/default/config/heft.json`, '{}');
     }
+    for (const file of projectAdditionalFiles) {
+      writeFile(file, '{}');
+      additionalFiles.add(file);
+    }
 
     const project: RushConfigurationProject = {
       packageName: name,
       projectFolder,
       projectRelativeFolder: name,
+      // Outside of the project folder, so that its files are not inputs
+      projectRushTempFolder: `${rootFolder}/common/temp/projects/${name}`,
       packageJson,
       rushConfiguration: { commonTempFolder: `${rootFolder}/common/temp` }
     } as unknown as RushConfigurationProject;
@@ -293,7 +317,10 @@ async function createWorkspaceAsync(
       getCacheDisabledReason: () => undefined
     } as unknown as RushProjectConfiguration;
     projectConfigurations.set(project, projectConfiguration);
-    projectMap.set(project, { projectConfig: projectConfiguration });
+    projectMap.set(project, {
+      projectConfig: projectConfiguration,
+      additionalFilesByOperationName: new Map([[PHASE_NAME, new Set(projectAdditionalFiles)]])
+    });
     lookupByPath.setItem(name, project);
     outputFolderByPrefix.set(name, outputFolderName);
     specByFolder.set(projectFolder, spec);
@@ -338,6 +365,13 @@ async function createWorkspaceAsync(
   const hooks: PhasedCommandHooks = new PhasedCommandHooks();
   new PhasedOperationPlugin().apply(hooks);
   new IncrementalExecutionGuardPlugin().apply(hooks);
+  if (hasLegacySkipDetection) {
+    new LegacySkipPlugin({
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      changedProjectsOnly: false,
+      isIncrementalBuildAllowed: true
+    }).apply(hooks);
+  }
   const destination: MockWritable = new MockWritable();
   const graphOperations: Set<Operation> = new Set([...operations.values(), ...passThroughOperations]);
   const graph: OperationGraph = new OperationGraph(graphOperations, {
@@ -359,12 +393,18 @@ async function createWorkspaceAsync(
   // Like `git hash-object` for each file, except the outputs, which are ignored by git.
   const createInputsSnapshot = (environment: Readonly<Record<string, string>>): InputsSnapshot => {
     const hashes: Map<string, string> = new Map();
+    const hashFile = (file: string): void => {
+      const content: Buffer = fs.readFileSync(`${rootFolder}/${file}`);
+      hashes.set(file, createHash('sha1').update(content).digest('hex'));
+    };
     for (const [prefix, outputFolderName] of outputFolderByPrefix) {
       for (const file of listFiles(`${rootFolder}/${prefix}`, new Set([outputFolderName]))) {
-        const content: Buffer = fs.readFileSync(`${rootFolder}/${prefix}/${file}`);
-        hashes.set(`${prefix}/${file}`, createHash('sha1').update(content).digest('hex'));
+        hashFile(`${prefix}/${file}`);
       }
     }
+    for (const file of additionalFiles) {
+      hashFile(file);
+    }
     return new InputsSnapshot({
       rootDir: rootFolder,
       hashes,
@@ -420,6 +460,14 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
   });
 
   interface IInputChangeCase {
+    /**
+     * The project, `{ name: 'a' }` by default
+     */
+    readonly spec?: IProjectSpec;
+    /**
+     * Runs before the first build
+     */
+    readonly prepare?: (workspace: ITestWorkspace) => void;
     readonly change: (workspace: ITestWorkspace) => void;
     readonly reason: string;
     /**
@@ -464,20 +512,63 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
         reason: 'a configuration file changed ("a/tsconfig.json")',
         sourceFile: 'a/src/one.ts'
       }
+    ],
+    [
+      'a configuration file in a subfolder changes',
+      {
+        prepare: (workspace: ITestWorkspace) => workspace.writeFile('a/test/tsconfig.json', '{}'),
+        change: (workspace: ITestWorkspace) =>
+          workspace.writeFile('a/test/tsconfig.json', '{ "compilerOptions": {} }'),
+        reason: 'a configuration file changed ("a/test/tsconfig.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file in the root folder of the project changes',
+      {
+        prepare: (workspace: ITestWorkspace) => workspace.writeFile('a/build.js', '// build'),
+        change: (workspace: ITestWorkspace) => workspace.writeFile('a/build.js', '// build 2'),
+        reason: 'a configuration file changed ("a/build.js")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file in the config folder of the project changes',
+      {
+        prepare: (workspace: ITestWorkspace) => workspace.writeFile('a/config/heft.json', '{}'),
+        change: (workspace: ITestWorkspace) =>
+          workspace.writeFile('a/config/heft.json', '{ "phasesByName": {} }'),
+        reason: 'a configuration file changed ("a/config/heft.json")',
+        sourceFile: 'a/src/one.ts'
+      }
+    ],
+    [
+      'a file outside of the project that it depends on changes',
+      {
+        spec: { name: 'a', additionalFiles: ['tools/shared/data.json'] },
+        change: (workspace: ITestWorkspace) =>
+          workspace.writeFile('tools/shared/data.json', '{ "edited": true }'),
+        reason: 'a configuration file changed ("tools/shared/data.json")',
+        sourceFile: 'a/src/one.ts'
+      }
     ]
-  ])('runs the initial command if %s', async (description: string, { change, reason, sourceFile }) => {
-    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
-    await workspace.executeAsync();
+  ])(
+    'runs the initial command if %s',
+    async (description: string, { spec = { name: 'a' }, prepare, change, reason, sourceFile }) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([spec]);
+      prepare?.(workspace);
+      await workspace.executeAsync();
 
-    change(workspace);
-    const changed: ITestIteration = await workspace.executeAsync();
-    expect(changed.commands).toEqual(['a:initial']);
-    expect(changed.output).toContain(`Not using the incremental command because ${reason}.`);
+      change(workspace);
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:initial']);
+      expect(changed.output).toContain(`Not using the incremental command because ${reason}.`);
 
-    // The result of the initial command is the new base.
-    workspace.writeFile(sourceFile, 'edited');
-    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
-  });
+      // The result of the initial command is the new base.
+      workspace.writeFile(sourceFile, 'edited');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    }
+  );
 
   it('runs the initial command if an environment variable that the operation depends on changes', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', dependsOnEnvVars: ['MODE'] }]);
@@ -616,6 +707,46 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     );
   });
 
+  it('runs the initial command after an incremental command that emitted a content-hashed file', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // Like a chunk with webpack's default hash length. Comparing the output files ignores such names.
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk_0123456789abcdef0123');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.getStatus('a')).toBe(OperationStatus.Success);
+    expect(changed.output).toContain(
+      'Running the initial command, because its outputs include the content-hashed file "lib/chunk_0123456789abcdef0123.js".'
+    );
+
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs include the content-hashed file "lib/chunk_0123456789abcdef0123.js".'
+    );
+  });
+
+  it('does not let a later command skip an operation after its incremental command', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      hasLegacySkipDetection: true
+    });
+    const packageDepsPath: string = `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(packageDepsPath)).toBe(true);
+
+    // The outputs of the incremental command can differ from those of the initial command, so a later command,
+    // e.g. one that does not use the Rush daemon, must not skip the operation.
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    expect(fs.existsSync(packageDepsPath)).toBe(false);
+
+    workspace.graph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(packageDepsPath)).toBe(true);
+  });
+
   it('runs the initial command after a failure', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
     await workspace.executeAsync();
@@ -702,4 +833,19 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     workspace.writeFile('b/src/one.ts', 'one 3');
     expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'b:initial']);
   });
+
+  it('forgets the base of an operation that is invalidated for another reason', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
+    await workspace.executeAsync();
+
+    // E.g. a client of the Rush daemon that invalidates the operation.
+    workspace.graph.invalidateOperations([workspace.operations.get('a')!], 'daemon graph invalidate');
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    workspace.writeFile('b/src/one.ts', 'one 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect([...next.commands].sort()).toEqual(['a:initial', 'b:incremental']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
index 6001b6ee28..ae29e6be3c 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
@@ -58,6 +58,8 @@ describe(describeOutputFileChanges.name, () => {
 });
 
 describe(readOperationOutputManifestAsync.name, () => {
+  // Whole seconds, so that the time is set exactly
+  const KEPT_MODIFICATION_TIME_SECONDS: number = 1_700_000_000;
   let projectFolder: string;
 
   beforeEach(() => {
@@ -112,12 +114,46 @@ describe(readOperationOutputManifestAsync.name, () => {
     expect((await readAsync()).signature).toBe(signature);
   });
 
+  // E.g. `cp -p`, `rsync -t` or `tar -x`, which give the files that they write the modification time of their source.
+  it.each([
+    [
+      'a file is rewritten in place by an append',
+      (folder: string) => fs.appendFileSync(`${folder}/lib/sub/util.js`, ' 2')
+    ],
+    [
+      'an output file that is not in a folder is replaced by a rename with the same size',
+      (folder: string) => {
+        fs.writeFileSync(`${folder}/tsconfig.tsbuildinfo.tmp`, '[]');
+        fs.renameSync(`${folder}/tsconfig.tsbuildinfo.tmp`, `${folder}/tsconfig.tsbuildinfo`);
+      }
+    ]
+  ])(
+    'changes if %s and its modification time is kept',
+    async (description: string, change: (folder: string) => void) => {
+      const files: string[] = [`${projectFolder}/lib/sub/util.js`, `${projectFolder}/tsconfig.tsbuildinfo`];
+      const keepModificationTimes = (): void => {
+        for (const file of files) {
+          fs.utimesSync(file, KEPT_MODIFICATION_TIME_SECONDS, KEPT_MODIFICATION_TIME_SECONDS);
+        }
+      };
+      keepModificationTimes();
+      const { signature } = await readAsync();
+      change(projectFolder);
+      keepModificationTimes();
+      expect((await readAsync()).signature).not.toBe(signature);
+    }
+  );
+
   it.each([
     [
       'a file is added to a subfolder',
       (folder: string) => fs.writeFileSync(`${folder}/lib/sub/new.js`, 'new')
     ],
     ['a file is deleted', (folder: string) => fs.rmSync(`${folder}/lib/sub/util.js`)],
+    [
+      'an output file that is not in a folder is rewritten in place',
+      (folder: string) => fs.appendFileSync(`${folder}/tsconfig.tsbuildinfo`, ' ')
+    ],
     [
       'a file in a subfolder is replaced by a rename',
       (folder: string) => {

From 53f3b7e07af24f2742aceab297b39f65517626fa Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 23:23:48 +0000
Subject: [PATCH 044/265] [rush-daemon] A served rushx script releases the
 lifecycle gate once it starts, so reloads don't wait for it (board 113) (and
 5 more)

Swarm integration step 29; original commit 3857bc9926 (merge of swarm/r05-stack-int at c35a77cc5c).

Brings r05's stack (board 1931):
- Task 55: a served rushx script releases the lifecycle gate once it starts, so reloads don't wait for it.
- Task 7 part 3 text: admission timeouts name the client's wait timeout and the time that isn't counted.
- Task 96: a rushx script that arrives while a restart is pending waits for the restart instead of postponing it, and admission failures in legacy output and rushx-client print the daemon's reason.
- Task 98: a request spends its wait timeout only while it waits for other requests.
- The race fix (c35a77cc5c, restacked from 9370662d5f): a client that follows a daemon restart connects to the successor that the restarting daemon launches instead of racing it.

ch01 on tree b500e451d4 (board 2429): build rc 0 with 0 warnings; rush-daemon 544/0, rush-lib 1231/0, rush-cli-client 374/0, rush-client-core 129/0 on its own (2 known flakes in the full run), protocol 166/0, transport 73/0, reporter 519/0, wire-e2e 4/0. The red checks fail as intended without each change. 36 of 43 mutants are killed; the 7 survivors are test gaps and change no claim. The end-to-end rows R55, R96 and R96A pass on the stack and fail on s14b's files.

Gate: ch01 GATE OK board 2429 (tree b500e451d4 on 6eae8fadad; 87e0e3a10f together with task 138's merge, in either order)

Commits folded into this step (6):
- c8cd36f574 [rush-daemon] A served rushx script releases the lifecycle gate once it starts, so reloads don't wait for it (board 113)
- 4a5a13bddf [rush-daemon] Name the client's wait timeout and uncounted time in admission timeouts
- cafa954eb4 [rush-daemon] A rushx script that arrives while a restart is pending waits for it instead of postponing it (task 96)
- 7ba7021ed6 [rush-cli-client] Admission failures in legacy output and rushx-client print the daemon's reason (task 96)
- 4ddb1fdbfe [rush-daemon] Spend a request's wait timeout only while it waits for other requests (task 98)
- c35a77cc5c [rush-client-core] A client that follows a daemon restart connects to the successor the restarting daemon launches instead of racing it (task 96)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  30 +-
 .../src/ClientAdmissionControls.ts            |  26 +-
 apps/rush-cli-client/src/launchClient.ts      |  20 +-
 apps/rush-cli-client/src/resultDiagnostics.ts |  20 +-
 .../src/test/ClientAdmissionControls.test.ts  |  40 +++
 .../src/test/resultDiagnostics.test.ts        |  32 +-
 ...ssion-failure-reason_2026-09-28-17-39.json |  10 +
 ...paration-wait-budget_2026-09-28-18-20.json |  10 +
 ...rt-planned-successor_2026-09-28-19-50.json |  11 +
 ...rt-planned-successor_2026-09-28-19-50.json |  11 +
 ...rt-planned-successor_2026-09-28-19-50.json |  11 +
 ...mission-timeout-text_2026-09-28-16-02.json |  10 +
 ...paration-wait-budget_2026-09-28-18-20.json |  10 +
 ...ushx-pending-restart_2026-09-28-16-45.json |  10 +
 ...-served-rushx-reload_2026-09-28-15-31.json |  10 +
 libraries/rush-client-core/README.md          |   4 +
 .../src/connectOrStartDaemon.ts               |  50 +++
 .../src/executeWithDaemonRestart.ts           |   5 +-
 .../src/test/connectOrStartDaemon.test.ts     |  97 ++++++
 .../src/test/fixtures/daemon.ts               |  51 ++-
 .../src/DaemonCommandResult.ts                |   2 +
 libraries/rush-daemon/README.md               |  31 +-
 .../rush-daemon/src/GlobalCommandRequest.ts   |   3 +-
 .../src/WorkspaceRequestAdmission.ts          | 188 +++++++----
 .../src/WorkspaceRequestLifecycle.ts          |  85 +++--
 .../src/WorkspaceRestartArbiter.ts            | 108 +++++--
 .../src/test/DaemonGraphTestFixture.ts        |   8 +-
 .../test/RequestAdmissionIntegration.test.ts  |  59 +++-
 .../src/test/RestartDrainAdmission.test.ts    | 130 +++++++-
 .../WorkspacePreparationAdmission.test.ts     | 130 ++++++++
 .../test/WorkspaceRequestAdmission.test.ts    | 155 ++++++++-
 .../src/test/WorkspaceRestartArbiter.test.ts  | 198 +++++++++++-
 .../WorkspaceServedScriptAdmission.test.ts    | 305 ++++++++++++++++++
 33 files changed, 1713 insertions(+), 157 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r05-admission-failure-reason_2026-09-28-17-39.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json
 create mode 100644 common/changes/@rushstack/rush-client-core/restart-planned-successor_2026-09-28-19-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/restart-planned-successor_2026-09-28-19-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/restart-planned-successor_2026-09-28-19-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-admission-timeout-text_2026-09-28-16-02.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-rushx-pending-restart_2026-09-28-16-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-served-rushx-reload_2026-09-28-15-31.json
 create mode 100644 libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 676cae2822..2aef793974 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -63,15 +63,16 @@ rounded down to milliseconds. These controls are mutually exclusive and are
 consumed before forwarding, never appended to a project script. Arguments after
 `--` remain literal script arguments.
 
-The queue timeout is measured from when the daemon receives the request, and only
-time spent waiting for other requests counts against it, whether it comes from
-`--wait-timeout`, `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, `daemon.queueTimeoutSeconds`
-in `rush.json`, or the built-in 30-second default. Waiting while another request
+Only time that the request spends waiting for other requests counts against the
+queue timeout, whether it comes from `--wait-timeout`,
+`RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, `daemon.queueTimeoutSeconds` in `rush.json`,
+or the built-in 30-second default. Waiting while another request
 loads or reloads the workspace graph does not count, so every build that arrives
 while the first build after startup loads the graph runs once the load finishes.
 That wait fails after 10 times the timeout (5 minutes with the default), so a load
-that never finishes does not hold other requests forever. The request's own routing
-and execution do not count either. A configured or per-invocation timeout also
+that never finishes does not hold other requests forever. The request's own work,
+such as checking its inputs, loading the graph, routing and execution, does not
+count either. A configured or per-invocation timeout also
 limits waiting for a running build that the request could not join, and waiting for
 the requests that the daemon is serving to finish before it restarts for the
 request's environment. The built-in default does not: with it, a build that arrives
@@ -80,11 +81,18 @@ instead of failing after 30 seconds, and a request that needs a restart waits fo
 the requests that were running when it arrived to finish and then runs on the
 restarted daemon. The default still limits a restart wait while the daemon runs a
 `rushx` script, such as a dev server, which may not exit until it is stopped, and
-while it serves requests that arrived later. `--no-wait` fails wherever the request
-would wait. On a timeout, the client exits with code 1 and suggests
-`--wait-timeout`. It does not suggest exporting `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`,
-because Rush versions that do not recognize a `RUSH_` environment variable fail
-every command while it is set.
+while it serves requests that arrived later. A `rushx-client` script that arrives
+while another request waits for the daemon to restart does not start on the old
+daemon, where the restart would wait for it to exit: it waits for the restart and
+then runs on the restarted daemon, and its timeout applies to that wait as it does
+to the restart wait. `--no-wait` fails wherever the request would wait. On a
+timeout, the client exits with code 1 and suggests `--wait-timeout`. It does not
+suggest exporting `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, because Rush versions that do
+not recognize a `RUSH_` environment variable fail every command while it is set.
+In legacy output and in `rushx-client`, the admission failure line
+(`rush-client: daemon admission failed (wait-timeout): …`, or `(no-wait)`) gives the
+daemon's reason, as agent mode's summary line does, so it names what the request
+waited for, such as a daemon restart.
 
 Admission controls also apply to experimental graph requests, but not
 `start|stop|restart|status|logs`. They affect daemon admission only; native fallback
diff --git a/apps/rush-cli-client/src/ClientAdmissionControls.ts b/apps/rush-cli-client/src/ClientAdmissionControls.ts
index bd3d04edeb..9be7c67b63 100644
--- a/apps/rush-cli-client/src/ClientAdmissionControls.ts
+++ b/apps/rush-cli-client/src/ClientAdmissionControls.ts
@@ -72,25 +72,39 @@ export function getConfiguredAdmission(options: IConfiguredAdmissionOptions): ID
   return options.explicit ? { waitTimeoutMs } : { waitTimeoutMs, waitTimeoutIsDefault: true };
 }
 
-/** Explains a daemon admission failure and how to wait longer. */
+// Only the per-invocation flag is offered: Rush versions that do not recognize the variable reject it.
+const WAIT_LONGER_REMEDY: string = 'To wait longer, pass --wait-timeout <seconds>.';
+
+/**
+ * Explains a daemon admission failure and how to wait longer.
+ *
+ * @remarks
+ * The daemon's reason for the failure (`daemonMessage`), when present, replaces the generic explanation,
+ * because it names what the request waited for, such as a daemon restart.
+ */
 export function formatAdmissionFailure(
   code: DaemonRequestAdmissionErrorCode,
-  admission: IDaemonRequestAdmissionOptions | undefined
+  admission: IDaemonRequestAdmissionOptions | undefined,
+  daemonMessage?: string
 ): string {
   const prefix: string = `rush-client: daemon admission failed (${code})`;
   if (code === 'no-wait') {
-    return `${prefix}: another daemon request is using this workspace and --no-wait was specified.\n`;
+    return daemonMessage
+      ? `${prefix}: ${daemonMessage}\n`
+      : `${prefix}: another daemon request is using this workspace and --no-wait was specified.\n`;
   }
   if (code === 'wait-timeout') {
+    if (daemonMessage) {
+      const remedy: string = daemonMessage.includes('--wait-timeout') ? '' : ` ${WAIT_LONGER_REMEDY}`;
+      return `${prefix}: ${daemonMessage}${remedy}\n`;
+    }
     const timeout: string =
       admission?.waitTimeoutMs === undefined
         ? ''
         : ` after its ${admission.waitTimeoutMs / 1000}s wait timeout`;
     return (
       `${prefix}: timed out${timeout} waiting for another daemon request in this workspace to finish ` +
-      '(a command that needs exclusive access, or a running build). ' +
-      // Only the per-invocation flag is offered: Rush versions that do not recognize the variable reject it.
-      'To wait longer, pass --wait-timeout <seconds>.\n'
+      `(a command that needs exclusive access, or a running build). ${WAIT_LONGER_REMEDY}\n`
     );
   }
   return `${prefix}.\n`;
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 7ff5cd2572..b2fbd46089 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -23,7 +23,7 @@ import type { DaemonVerbosity, IDaemonRequestEnvelope } from '@rushstack/rush-da
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
 import { executeDaemonCommandAsync } from './daemonCommands';
-import { formatAdmissionFailure, getConfiguredAdmission } from './ClientAdmissionControls';
+import { getConfiguredAdmission } from './ClientAdmissionControls';
 import { ClientOperationRenderer } from './ClientOperationRenderer';
 import type { AgentProgressRenderer } from './AgentProgressRenderer';
 import {
@@ -35,7 +35,7 @@ import {
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
-import { getResultDiagnostic } from './resultDiagnostics';
+import { getResultStderr } from './resultDiagnostics';
 import { getTerminalColumns } from './terminalColumns';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
@@ -269,16 +269,12 @@ export async function launchClientAsync(
     // In agent mode the summary line may already carry the complete error message; do not repeat it.
     const reportedByAgent: boolean = agentRenderer?.finish(outcome.result) ?? false;
     process.exitCode = outcome.result.exitCode;
-    const diagnostic: string | undefined = getResultDiagnostic(outcome.result);
-    if (reportedByAgent) {
-      // The summary line already explains the failure.
-    } else if (diagnostic) {
-      await writeStreamAsync(process.stderr, Buffer.from(diagnostic));
-    } else if (outcome.result.admissionErrorCode) {
-      await writeStreamAsync(
-        process.stderr,
-        Buffer.from(formatAdmissionFailure(outcome.result.admissionErrorCode, request.admission))
-      );
+    // When the agent summary line explains the failure, nothing more is printed.
+    const stderr: string | undefined = reportedByAgent
+      ? undefined
+      : getResultStderr(outcome.result, request.admission);
+    if (stderr) {
+      await writeStreamAsync(process.stderr, Buffer.from(stderr));
     }
   } else if (outcome.kind === 'rejected') {
     const message: string = `Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`;
diff --git a/apps/rush-cli-client/src/resultDiagnostics.ts b/apps/rush-cli-client/src/resultDiagnostics.ts
index e65be24364..6657102ad8 100644
--- a/apps/rush-cli-client/src/resultDiagnostics.ts
+++ b/apps/rush-cli-client/src/resultDiagnostics.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonCommandResult, IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { formatAdmissionFailure } from './ClientAdmissionControls';
 
 /**
  * Returns the stderr line that explains a failed daemon result, if any.
@@ -23,3 +25,19 @@ export function getResultDiagnostic(
   }
   return undefined;
 }
+
+/**
+ * Returns the stderr text that explains a daemon result when no agent summary line explains it, if any.
+ *
+ * @remarks
+ * An admission failure is explained with the daemon's reason when it sent one, so that the text names what
+ * the request waited for, such as a daemon restart.
+ */
+export function getResultStderr(
+  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>,
+  admission: IDaemonRequestAdmissionOptions | undefined
+): string | undefined {
+  const diagnostic: string | undefined = getResultDiagnostic(result);
+  if (diagnostic || !result.admissionErrorCode) return diagnostic;
+  return formatAdmissionFailure(result.admissionErrorCode, admission, result.errorMessage);
+}
diff --git a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
index c835699a2f..317e29401f 100644
--- a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
+++ b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
@@ -87,4 +87,44 @@ describe(formatAdmissionFailure.name, () => {
   it('explains a no-wait failure', () => {
     expect(formatAdmissionFailure('no-wait', { noWait: true })).toContain('--no-wait was specified');
   });
+
+  it("prints the daemon's reason for a wait timeout instead of the generic explanation", () => {
+    const reason: string =
+      "The rushx script was not admitted before the daemon could restart for another request's environment. " +
+      'Use --wait-timeout <seconds> to wait longer.';
+    expect(formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 }, reason)).toBe(
+      `rush-client: daemon admission failed (wait-timeout): ${reason}\n`
+    );
+  });
+
+  it("adds the way to wait longer when the daemon's reason does not name it", () => {
+    expect(
+      formatAdmissionFailure(
+        'wait-timeout',
+        { waitTimeoutMs: 5000 },
+        'The request was not admitted within 5000ms.'
+      )
+    ).toBe(
+      'rush-client: daemon admission failed (wait-timeout): The request was not admitted within 5000ms. ' +
+        'To wait longer, pass --wait-timeout <seconds>.\n'
+    );
+  });
+
+  it("prints the daemon's reason for a no-wait failure", () => {
+    const reason: string =
+      'Another request is waiting to restart the daemon for its environment; ' +
+      'the rushx script did not wait for the restart.';
+    expect(formatAdmissionFailure('no-wait', { noWait: true }, reason)).toBe(
+      `rush-client: daemon admission failed (no-wait): ${reason}\n`
+    );
+  });
+
+  it('keeps the generic explanation when the daemon sent no reason', () => {
+    expect(formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 }, '')).toBe(
+      formatAdmissionFailure('wait-timeout', { waitTimeoutMs: 5000 })
+    );
+    expect(formatAdmissionFailure('no-wait', { noWait: true }, '')).toBe(
+      formatAdmissionFailure('no-wait', { noWait: true })
+    );
+  });
 });
diff --git a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
index 46c0ad5814..f64b6e2f72 100644
--- a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
+++ b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { getResultDiagnostic } from '../resultDiagnostics';
+import { getResultDiagnostic, getResultStderr } from '../resultDiagnostics';
 
 describe(getResultDiagnostic.name, () => {
   it('prints the error message of a failed result', () => {
@@ -34,3 +34,33 @@ describe(getResultDiagnostic.name, () => {
     expect(getResultDiagnostic({ exitCode: 1 })).toBeUndefined();
   });
 });
+
+describe(getResultStderr.name, () => {
+  it("explains an admission failure with the daemon's reason", () => {
+    const reason: string =
+      "The rushx script was not admitted before the daemon could restart for another request's environment. " +
+      'Use --wait-timeout <seconds> to wait longer.';
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: reason },
+        { waitTimeoutMs: 5000 }
+      )
+    ).toBe(`rush-client: daemon admission failed (wait-timeout): ${reason}\n`);
+  });
+
+  it('falls back to the generic admission explanation without a reason', () => {
+    expect(
+      getResultStderr({ exitCode: 1, admissionErrorCode: 'wait-timeout' }, { waitTimeoutMs: 5000 })
+    ).toContain('timed out after its 5s wait timeout waiting for another daemon request');
+  });
+
+  it('keeps the diagnostic of other failures and stays silent on success', () => {
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'aborted', errorMessage: 'daemon shut down' },
+        undefined
+      )
+    ).toBe('rush-client: daemon shut down\n');
+    expect(getResultStderr({ exitCode: 0 }, undefined)).toBeUndefined();
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r05-admission-failure-reason_2026-09-28-17-39.json b/common/changes/@rushstack/rush-cli-client/swarm-r05-admission-failure-reason_2026-09-28-17-39.json
new file mode 100644
index 0000000000..89d1e864db
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r05-admission-failure-reason_2026-09-28-17-39.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In legacy output and in rushx-client, a daemon admission failure prints the daemon's reason, such as a pending daemon restart, instead of only a generic explanation.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json b/common/changes/@rushstack/rush-cli-client/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json
new file mode 100644
index 0000000000..7e1855fc2c
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "The README says that the request's own work, such as checking its inputs and loading the workspace graph, does not count against the queue timeout.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-client-core/restart-planned-successor_2026-09-28-19-50.json b/common/changes/@rushstack/rush-client-core/restart-planned-successor_2026-09-28-19-50.json
new file mode 100644
index 0000000000..15e4ba7da5
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/restart-planned-successor_2026-09-28-19-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A client that retries a request after the daemon answered it with retryAfterRestart no longer starts a daemon while the restarting daemon's process lives; it connects to the successor that daemon launches, and starts one only if that process exits without a ready successor. Previously such a client could win the startup race with its own environment.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/restart-planned-successor_2026-09-28-19-50.json b/common/changes/@rushstack/rush-daemon-protocol/restart-planned-successor_2026-09-28-19-50.json
new file mode 100644
index 0000000000..1e024d49b5
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/restart-planned-successor_2026-09-28-19-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Document that a client retrying a retryAfterRestart result must not start a daemon while the predecessor process lives, because the predecessor launches the selected successor itself.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/restart-planned-successor_2026-09-28-19-50.json b/common/changes/@rushstack/rush-daemon/restart-planned-successor_2026-09-28-19-50.json
new file mode 100644
index 0000000000..7ff52a9d3b
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/restart-planned-successor_2026-09-28-19-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Document that clients following a planned restart connect to the successor this process launches instead of starting their own.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-admission-timeout-text_2026-09-28-16-02.json b/common/changes/@rushstack/rush-daemon/swarm-r05-admission-timeout-text_2026-09-28-16-02.json
new file mode 100644
index 0000000000..f221c20ed7
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-admission-timeout-text_2026-09-28-16-02.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "An admission timeout at a later routing boundary, such as the graph-execution gate or a global command's admission, now names the wait timeout that the client asked for instead of the remaining budget, and says how long the request waited behind another request's graph load without spending its timeout. A zero wait timeout behind a graph load now reports a plain timeout instead of claiming that 10 times its timeout was reached.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json b/common/changes/@rushstack/rush-daemon/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json
new file mode 100644
index 0000000000..eb2cdb6b9d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-preparation-wait-budget_2026-09-28-18-20.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A request's wait timeout is spent only while the request waits for other requests, so its own work, such as capturing its inputs or loading the workspace graph, no longer uses up an explicit timeout before the request starts to wait.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-rushx-pending-restart_2026-09-28-16-45.json b/common/changes/@rushstack/rush-daemon/swarm-r05-rushx-pending-restart_2026-09-28-16-45.json
new file mode 100644
index 0000000000..54754e613e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-rushx-pending-restart_2026-09-28-16-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A rushx script that arrives while another request waits to restart the daemon for its environment now waits for that restart and then runs on the successor, instead of starting on the old daemon and keeping the restart waiting until the script exits.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-served-rushx-reload_2026-09-28-15-31.json b/common/changes/@rushstack/rush-daemon/swarm-r05-served-rushx-reload_2026-09-28-15-31.json
new file mode 100644
index 0000000000..36f666d5d1
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-served-rushx-reload_2026-09-28-15-31.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A served rushx script releases the workspace generation lease once it starts, so a build that needs a graph reload no longer waits for a long-running script such as a dev server. A restart, a native install or update, and daemon shutdown still wait for running scripts to exit, and a planned restart still counts a script as running work until it exits.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index b611c372fc..1af7286b24 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -32,6 +32,10 @@ on success, cancellation, disconnect and failure. No resize messages are sent.
 retries an explicit `retryAfterRestart: true` result a bounded number of times. Before
 each hand-off it captures the endpoint's PID/start identity, requires protocol 0.10,
 waits for that ownership to be released, and reconnects through the same startup mutex.
+The restarting daemon launches the successor it selected after that release, so while
+its process lives the client only connects: starting a daemon itself could win the
+startup mutex with the client's own environment instead of the one the restart was for.
+It starts one only if that process exits without a ready successor.
 Retries after the first use jittered backoff, and the backoff, the successor hand-off
 and the resubmitted request all share the request's admission deadline.
 The original immutable request and unread input are preserved. Output, events,
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index b6f0b46e4b..369ec81128 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -101,6 +101,26 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
  */
 export async function connectOrStartDaemonAsync(
   options: IConnectOrStartDaemonOptions
+): Promise<DaemonClient> {
+  return await connectOrStartAsync(options, false);
+}
+
+/**
+ * Like {@link connectOrStartDaemonAsync}, after `previousDaemon` answered a request with `retryAfterRestart`.
+ * @remarks That daemon releases its ownership and then launches the successor it selected, and its process exits
+ * only once that launch settles. A client that started a daemon meanwhile would race that launch, and if it won,
+ * the successor would have this client's environment rather than the one the restart was for. So while the
+ * previous process lives, this only connects; after it exits without a ready successor, this may start one.
+ */
+export async function connectToPlannedSuccessorAsync(
+  options: IConnectOrStartDaemonOptions & { readonly previousDaemon: DaemonOwnership }
+): Promise<DaemonClient> {
+  return await connectOrStartAsync(options, true);
+}
+
+async function connectOrStartAsync(
+  options: IConnectOrStartDaemonOptions,
+  previousStartsSuccessor: boolean
 ): Promise<DaemonClient> {
   const timeoutMs: number = options.startupTimeoutMs ?? 15000;
   if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 0x7fffffff) {
@@ -112,6 +132,14 @@ export async function connectOrStartDaemonAsync(
   await waitForPreviousDaemonAsync(options.paths, options.previousDaemon, deadline, options.abortSignal);
   const initial: DaemonClient | undefined = await tryConnectAsync(options, deadline);
   if (initial) return initial;
+  if (previousStartsSuccessor && options.previousDaemon) {
+    const successor: DaemonClient | undefined = await waitForPlannedSuccessorAsync(
+      options,
+      options.previousDaemon,
+      deadline
+    );
+    if (successor) return successor;
+  }
   const startCommand: IDaemonStartCommand | undefined =
     options.startCommand ?? (await options.resolveStartCommandAsync?.());
   if (!startCommand) {
@@ -454,6 +482,28 @@ async function tryConnectEndpointAsync(
   }
 }
 
+/** Connects to a successor while the previous daemon process lives; undefined once it has exited without one. */
+async function waitForPlannedSuccessorAsync(
+  options: IConnectOrStartDaemonOptions,
+  previous: DaemonOwnership,
+  deadline: number
+): Promise<DaemonClient | undefined> {
+  while (isOwnerProcessAlive(previous)) {
+    if (Date.now() >= deadline) {
+      throw startupError(
+        options,
+        `timed out waiting for the successor that the previous daemon (PID ${previous.pid}) is starting`
+      );
+    }
+    await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
+      signal: options.abortSignal
+    });
+    const successor: DaemonClient | undefined = await tryConnectAsync(options, deadline);
+    if (successor) return successor;
+  }
+  return undefined;
+}
+
 async function waitForHandoffAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index 87f260e61f..ed6124beb7 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -9,7 +9,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
-import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
+import { connectToPlannedSuccessorAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
 import { captureDaemonRequest } from './captureDaemonRequest';
 import type { DaemonClient, DaemonClientOutcome, IDaemonClientExecuteOptions } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
@@ -90,7 +90,8 @@ export async function executeWithDaemonRestartAsync(
         const startupTimeoutMs: number = connection.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
         // The successor handoff shares the request's admission deadline rather than starting a fresh one.
         boundedByAdmission = remainingMs !== undefined && remainingMs < startupTimeoutMs;
-        successor = await connectOrStartDaemonAsync({
+        // The restarting daemon launches the successor itself; this only connects while that process lives.
+        successor = await connectToPlannedSuccessorAsync({
           ...connection,
           startupTimeoutMs: boundedByAdmission ? Math.max(1, Math.ceil(remainingMs!)) : startupTimeoutMs,
           previousDaemon: { pid: owner.pid, startedAt: owner.startedAt },
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 324e7b01be..16f76b614f 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -25,6 +25,7 @@ import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
 import {
   connectOrStartDaemonAsync,
+  connectToPlannedSuccessorAsync,
   requestDaemonShutdownAsync,
   resolveDaemonStartupReservationAsync,
   type IConnectOrStartDaemonOptions
@@ -1064,6 +1065,102 @@ describe('detached daemon startup', () => {
     }
   });
 
+  it('lets a restarting daemon start its planned successor while the clients that follow it only connect', async () => {
+    // The old daemon launches only after both clients could have started one, so a race would always be lost.
+    fs.writeFileSync(path.join(folder, 'planned-requests'), '2');
+    fs.writeFileSync(path.join(folder, 'planned-launch-delay-ms'), '1500');
+    const planned: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-planned']
+      }
+    };
+    const clients: DaemonClient[] = [
+      await connectOrStartDaemonAsync(planned),
+      await connectOrStartDaemonAsync(planned)
+    ];
+    const { pid: restartingPid } = await clients[0].status;
+    const outcomes = await Promise.all(
+      clients.map((client, index) =>
+        executeWithDaemonRestartAsync(client, options, {
+          request: captureDaemonRequest({
+            requestId: `follower-${index}`,
+            argv: ['test'],
+            commandName: 'test',
+            commandOrigin: 'custom',
+            cwd: folder,
+            environment: {},
+            terminal: { isTTY: false, supportsColor: false }
+          })
+        })
+      )
+    );
+    await Promise.all(clients.map((client) => client.closeAsync()));
+    expect(outcomes).toMatchObject([
+      { kind: 'result', result: { exitCode: 0 } },
+      { kind: 'result', result: { exitCode: 0 } }
+    ]);
+    // The restarting daemon exits only after it attests the successor it launched.
+    await waitForTestProcessExitAsync(restartingPid!);
+    const identities: string[] = fs.readFileSync(path.join(folder, 'identities'), 'utf8').trim().split('\n');
+    expect(identities.map((line) => line.split(' ')[1])).toEqual(['client', 'planned']);
+    expect(fs.readFileSync(path.join(folder, 'planned-successor'), 'utf8')).toBe(identities[1].split(' ')[0]);
+    expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(4);
+  }, 15000);
+
+  it('connects to the successor that another process starts while the restarting predecessor lives', async () => {
+    const waiting = connectToPlannedSuccessorAsync({
+      ...options,
+      previousDaemon: { pid: process.pid, startedAt: new Date().toISOString() }
+    });
+    await delayAsync(300);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    const starter = await connectOrStartDaemonAsync(options);
+    try {
+      const follower = await waiting;
+      expect((await follower.status).pid).toBe((await starter.status).pid);
+      await follower.closeAsync();
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    } finally {
+      await starter.closeAsync();
+    }
+  });
+
+  it('never starts a daemon while the restarting predecessor lives, even when its deadline expires', async () => {
+    await expect(
+      connectToPlannedSuccessorAsync({
+        ...options,
+        previousDaemon: { pid: process.pid, startedAt: new Date().toISOString() },
+        startupTimeoutMs: 300
+      })
+    ).rejects.toThrow(`timed out waiting for the successor that the previous daemon (PID ${process.pid}) is starting`);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  });
+
+  it('starts a daemon once the restarting predecessor exits without a successor', async () => {
+    // The predecessor exits only when its stdin ends, so it provably lives during the first check.
+    const predecessor: ChildProcess = spawn(process.execPath, ['-e', 'process.stdin.resume()'], {
+      stdio: ['pipe', 'ignore', 'ignore']
+    });
+    await once(predecessor, 'spawn');
+    const exited: Promise<unknown[]> = once(predecessor, 'exit');
+    const pending = connectToPlannedSuccessorAsync({
+      ...options,
+      previousDaemon: { pid: predecessor.pid!, startedAt: new Date().toISOString() }
+    });
+    try {
+      await delayAsync(300);
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    } finally {
+      predecessor.stdin!.end();
+    }
+    await exited;
+    const client = await pending;
+    await client.closeAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+  });
+
   it('does not stop a mismatched daemon with unverifiable ownership', async () => {
     const running = await connectOrStartDaemonAsync(options);
     await running.closeAsync();
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index d4d05b7cab..ea78f0408b 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -16,6 +16,8 @@ import {
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import { connectOrStartDaemonAsync } from '../../connectOrStartDaemon';
+
 async function mainAsync(): Promise<void> {
   const paths: IDaemonPaths = JSON.parse(process.argv[2]);
   const folder: string = path.dirname(paths.lockfilePath);
@@ -25,7 +27,12 @@ async function mainAsync(): Promise<void> {
   const connections: Set<DaemonFrameConnection> = new Set();
   let closing: Promise<void> | undefined;
   let heldRequest: { connection: DaemonFrameConnection; requestId: string } | undefined;
+  let plannedRestartAnswers: number = 0;
   fs.appendFileSync(path.join(folder, 'starts'), `${process.pid}\n`);
+  fs.appendFileSync(
+    path.join(folder, 'identities'),
+    `${process.pid} ${process.env.FIXTURE_IDENTITY ?? 'client'}\n`
+  );
   fs.appendFileSync(path.join(folder, 'parents'), `${process.ppid}\n`);
   fs.writeFileSync(path.join(folder, 'runtime-base'), process.env.RUSHD_RUNTIME_DIR ?? '(unset)');
   process.stdout.write('launcher stdout\n');
@@ -114,7 +121,15 @@ async function mainAsync(): Promise<void> {
               }
             })
           });
-          if (restart && restartMode !== 'restart-held') {
+          if (restart && restartMode === 'restart-planned') {
+            // Like RushDaemonHost: answer every request, then release ownership and launch the successor itself.
+            if (++plannedRestartAnswers === readNumber(folder, 'planned-requests', 1)) {
+              void launchPlannedSuccessorAsync().catch((error: Error) => {
+                process.stderr.write(`${error.stack}\n`);
+                process.exitCode = 1;
+              });
+            }
+          } else if (restart && restartMode !== 'restart-held') {
             fs.appendFileSync(path.join(folder, 'restarted'), 'r');
             await stopAsync();
           }
@@ -168,6 +183,32 @@ async function mainAsync(): Promise<void> {
     });
   }
 
+  async function launchPlannedSuccessorAsync(): Promise<void> {
+    await stopAsync();
+    // The "planned-launch-delay-ms" file models a launch that begins well after ownership is released.
+    await new Promise((resolve) => setTimeout(resolve, readNumber(folder, 'planned-launch-delay-ms', 0)));
+    const environment: Record<string, string> = {};
+    for (const [name, value] of Object.entries(process.env)) {
+      if (value !== undefined) environment[name] = value;
+    }
+    const successor = await connectOrStartDaemonAsync({
+      paths,
+      expectedDaemonVersion: daemonVersion,
+      startCommand: {
+        command: process.execPath,
+        args: [__filename, JSON.stringify(paths), daemonVersion],
+        cwd: folder,
+        environment: { ...environment, FIXTURE_IDENTITY: 'planned' }
+      }
+    });
+    try {
+      const { pid } = await successor.status;
+      fs.writeFileSync(path.join(folder, 'planned-successor'), String(pid));
+    } finally {
+      await successor.closeAsync();
+    }
+  }
+
   async function closeOnceAsync(): Promise<void> {
     clearInterval(timer);
     const stopped: Promise<void> = listener.stopAcceptingAsync();
@@ -181,8 +222,12 @@ async function mainAsync(): Promise<void> {
 
 /** How long the daemon waits before it listens: 250 milliseconds, or the number in the "startup-delay-ms" file. */
 function readStartupDelayMs(folder: string): number {
-  const delayPath: string = path.join(folder, 'startup-delay-ms');
-  return fs.existsSync(delayPath) ? Number(fs.readFileSync(delayPath, 'utf8')) : 250;
+  return readNumber(folder, 'startup-delay-ms', 250);
+}
+
+function readNumber(folder: string, name: string, defaultValue: number): number {
+  const filePath: string = path.join(folder, name);
+  return fs.existsSync(filePath) ? Number(fs.readFileSync(filePath, 'utf8')) : defaultValue;
 }
 
 mainAsync().catch((error: Error) => {
diff --git a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
index 293776da32..4a133c4e4b 100644
--- a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
@@ -20,6 +20,8 @@ export interface IDaemonCommandResult {
    * Protocol 0.10: no execution or request IO occurred, and a successor has been selected.
    * Retry only after attested predecessor ownership release, within the request's admission deadline and a
    * small client-defined retry bound; then fall back instead of retrying. Never infer this from an error.
+   * The predecessor launches the selected successor itself after that release, and its process exits once the
+   * launch settles: until then, a retrying client connects to the successor but must not start a daemon.
    */
   readonly retryAfterRestart?: true;
   /** Whether cancellation or disconnect was observed, even if a cleanup failure determines the outcome. */
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index dc809142de..d53bb7f280 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -105,7 +105,8 @@ taken or while it executes is not kept as up to date, whether or not cache write
 it and its consumers again, even if the files were changed back in between. Operations whose build cache is
 disabled, and workspaces without a build cache, don't get this check.
 
-A generation lease spans resolution through final output. Reload also takes exclusive workspace admission and
+A generation lease spans resolution through final output; a Rushx script releases it when the script starts (see
+below). Reload also takes exclusive workspace admission and
 the native preparation lock, discards paused prepared work, and awaits old runner/plugin/watcher cleanup before
 publishing the replacement. The initiating request atomically downgrades its admission so another reload cannot
 dispose the newly selected graph before it runs. Watch requests are cancelled and drained before their generation
@@ -174,7 +175,9 @@ The default entrypoint supports the `rush.json` version, not a separate preview-
 
 Successor startup reuses `connectOrStartDaemonAsync`: acknowledged old ownership must be released after all old
 resources finish, startup is serialized with ordinary clients, and hello/ping readiness attests a different PID.
-`restartCompleted` reports completion or failure.
+`restartCompleted` reports completion or failure. Clients that retry a `retryAfterRestart: true` result do not start a
+daemon while this process lives, so the successor is the one it selected; only a client that did not follow the
+restart can still take the startup mutex first.
 
 A request whose environment needs another process does not restart the daemon while it serves other requests. It
 first waits for the requests that this process is serving to finish (the restart drain), and its queue position is the
@@ -187,6 +190,14 @@ drain, which could otherwise keep it waiting for as long as they keep arriving.
 `waitTimeoutMs` limits the whole drain, and only its remaining time carries over to the successor. When a drain times
 out, its message names the time that did not count.
 
+A restart is pending from when a request begins its restart drain until the request has planned the restart, or has
+failed or been cancelled. A rushx script that arrives while a restart is pending does not start, since the restart
+would then wait for it to exit: the script waits for the pending restart instead, and the drain does not count it. If
+the restart was planned, the script's result carries `retryAfterRestart: true` so that the client runs it on the
+successor; otherwise it runs on this process. Its queue position is the number of requests that are served or waiting
+to restart, and its wait timeout applies as it does to the drain, relative to the requests that were served when the
+script began to wait.
+
 Protocol 0.10 (`DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR`) provides bounded, typed retry authorization.
 Only a pre-execution command result may carry `retryAfterRestart: true`. During a planned restart, accepted
 queued requests drain those typed results before disconnect rather than being reduced to ambiguous connection
@@ -223,8 +234,13 @@ this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
 ```
 
 The helper returns `undefined` for a delegate without lifecycle support. Explicit `invocationKind: "rushx"`
-requests retain a generation lease but go directly to the composite resolver, without native build/mutation/graph
-interception or phased environment matching. They use exclusive global admission. The host disposes each old
+requests go directly to the composite resolver, without native build/mutation/graph interception, phased
+environment matching, or workspace admission. A script uses its generation only to resolve, so it holds its
+generation lease only until it starts: a reload that another request needs never waits for a long-running script
+such as a dev server. A restart, a native `install` or `update`, and lifecycle disposal would end a running script,
+so they still wait for every running script to exit, and a planned restart counts a script as running work until it
+exits. A script that arrives while a restart is pending waits for the restart instead of starting. The host disposes
+each old
 resolver before replacing its session, and disposes the current resolver at shutdown; the composite must forward
 its normal disposer to its owned delegates.
 
@@ -482,10 +498,13 @@ the graph does not spend its budget during that load, so every build that arrive
 loads the graph is admitted when the load finishes. That wait is limited separately, to 10 times `waitTimeoutMs`, so
 a load that never finishes does not hold the requests behind it indefinitely. The budget does run while that other
 request still waits for exclusive admission, so requests behind a reload that cannot start, for example behind a long
-build, still time out. Routing and executing an admitted request do not spend the budget either. Routing boundaries
+build, still time out. The request's own work does not spend the budget either, before or after admission: capturing
+its inputs, loading or reloading the graph, routing and execution. Routing boundaries
 such as the graph-execution gate apply the remaining budget they receive, and a request that re-enters workspace
 admission to reload the graph after its inputs changed starts again from the budget it had when it was admitted; time
-it spent at those boundaries is not charged again. The default and an explicit value differ only at the
+it spent at those boundaries is not charged again. A timeout message at any boundary names the timeout that the
+client asked for rather than the remaining budget, and says how long the request waited behind another request's
+graph load without spending it. The default and an explicit value differ only at the
 graph-execution gate and at a restart drain (see "Process restart and isolated install/update"). When the client marks
 `waitTimeoutMs` as its default (`waitTimeoutIsDefault`), a `SHARED-BUILD` request that arrives after the current batch
 has closed waits at the graph-execution gate without a deadline, because it is queued only behind running compatible
diff --git a/libraries/rush-daemon/src/GlobalCommandRequest.ts b/libraries/rush-daemon/src/GlobalCommandRequest.ts
index 0b41a05f27..bb3b1f4360 100644
--- a/libraries/rush-daemon/src/GlobalCommandRequest.ts
+++ b/libraries/rush-daemon/src/GlobalCommandRequest.ts
@@ -13,6 +13,7 @@ import type {
   IDaemonRequestAdmissionOptions
 } from '@rushstack/rush-daemon-protocol';
 
+import { freezeDaemonRequestAdmissionOptions } from './WorkspaceRequestAdmission';
 import type { IWorkspaceSession } from './WorkspaceSession';
 
 /**
@@ -100,7 +101,7 @@ export function resolveGlobalCommandRequest(
   validateDaemonRequestAdmissionOptions(options.admission);
   const cwd: string = resolveGlobalCommandWorkingDirectory(options.cwd, workspaceSession);
   const request: IResolvedGlobalCommandRequest = Object.freeze({
-    admission: options.admission ? Object.freeze({ ...options.admission }) : undefined,
+    admission: options.admission ? freezeDaemonRequestAdmissionOptions(options.admission) : undefined,
     commandName: options.commandName,
     commandOrigin: options.commandOrigin,
     cwd,
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index c5bf80e37e..7a82501c47 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -21,7 +21,11 @@ import {
 } from './RequestScheduler';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
-import type { IWorkspaceRestartTicket, WorkspaceRestartArbiter } from './WorkspaceRestartArbiter';
+import type {
+  IWorkspaceRestartDrainOptions,
+  IWorkspaceRestartTicket,
+  WorkspaceRestartArbiter
+} from './WorkspaceRestartArbiter';
 
 export interface IRequestAdmissionClient {
   readonly abortSignal: AbortSignal;
@@ -36,6 +40,21 @@ export interface IRequestAdmissionControllerOptions {
 }
 
 const REQUEST_SCHEDULER_BY_SESSION: WeakMap<IWorkspaceSession, RequestScheduler> = new WeakMap();
+
+/** What a remaining admission budget does not show about the request that it came from. */
+interface IAdmissionBudgetHistory {
+  /** The wait timeout that the client asked for. */
+  readonly waitTimeoutMs: number;
+  /** Time spent behind another request's graph load or reload, which did not count against the wait timeout. */
+  readonly pausedMs: number;
+}
+
+/**
+ * The history of each remaining budget that a controller hands to another routing boundary, so that the boundary's
+ * timeout message names the client's timeout and the time that did not count, rather than the remainder alone.
+ */
+const HISTORY_BY_REMAINING_ADMISSION: WeakMap<IDaemonRequestAdmissionOptions, IAdmissionBudgetHistory> =
+  new WeakMap();
 /** A request waits for another request's graph load or reload for up to this many times its wait timeout. */
 const GRAPH_LOAD_WAIT_FACTOR: number = 10;
 // Only the per-invocation flag is offered: Rush versions that do not recognize the environment variable reject it.
@@ -45,6 +64,22 @@ function formatSeconds(ms: number): string {
   return `${Math.round(ms / 100) / 10}s`;
 }
 
+/** Describes time that did not count against a request's wait timeout, unless it rounds to nothing. */
+function formatUncountedTime(pausedMs: number, spentWhile: string): string {
+  const seconds: string = formatSeconds(pausedMs);
+  return seconds === '0s' ? '' : `; ${seconds} spent ${spentWhile} did not count`;
+}
+
+/** Returns a frozen copy of admission options that keeps the history of a remaining budget. */
+export function freezeDaemonRequestAdmissionOptions(
+  admission: IDaemonRequestAdmissionOptions
+): IDaemonRequestAdmissionOptions {
+  const copy: IDaemonRequestAdmissionOptions = Object.freeze({ ...admission });
+  const history: IAdmissionBudgetHistory | undefined = HISTORY_BY_REMAINING_ADMISSION.get(admission);
+  if (history) HISTORY_BY_REMAINING_ADMISSION.set(copy, history);
+  return copy;
+}
+
 class WorkspaceRequestScheduler extends RequestScheduler {
   readonly #session: IWorkspaceSession;
 
@@ -208,17 +243,27 @@ export class RequestAdmissionController {
   readonly #abortFromClient: () => void;
   readonly #admission: IDaemonRequestAdmissionOptions | undefined;
   readonly #client: IRequestAdmissionClient;
-  #deadlineMs: number | undefined;
+  /** The wait timeout that the client asked for; `#admission` holds only the remainder at a later boundary. */
+  readonly #configuredWaitTimeoutMs: number | undefined;
+  /** Time spent behind another request's graph load or reload, which did not count against the wait timeout. */
+  #pausedMs: number;
+  /**
+   * The unspent wait timeout, or undefined when waiting is not limited. Only this controller's waits for other
+   * requests spend it, so the request's own work, such as capturing its inputs, loading or reloading the workspace
+   * graph, routing and execution, does not.
+   */
+  #remainingMs: number | undefined;
   readonly #writer: QueuePositionWriter | undefined;
 
   public constructor(options: IRequestAdmissionControllerOptions) {
     validateDaemonRequestAdmissionOptions(options.admission);
     this.#admission = options.admission;
+    const history: IAdmissionBudgetHistory | undefined =
+      options.admission && HISTORY_BY_REMAINING_ADMISSION.get(options.admission);
+    this.#configuredWaitTimeoutMs = history?.waitTimeoutMs ?? options.admission?.waitTimeoutMs;
+    this.#pausedMs = history?.pausedMs ?? 0;
     this.#client = options.client;
-    this.#deadlineMs =
-      options.admission?.waitTimeoutMs === undefined
-        ? undefined
-        : Date.now() + options.admission.waitTimeoutMs;
+    this.#remainingMs = options.admission?.waitTimeoutMs;
     this.#writer =
       options.client.supportsRequestAdmission === true
         ? new QueuePositionWriter(options.client, options.requestId, this.#abortController)
@@ -231,17 +276,16 @@ export class RequestAdmissionController {
     }
   }
 
-  /** Waits for workspace admission within the request's remaining admission budget. */
+  /**
+   * Waits for workspace admission within the request's remaining admission budget. A wait-timeout error says the
+   * request was waiting for `waitingFor`.
+   */
   public async acquireAsync(
     scheduler: RequestScheduler,
-    exclusivityClass: RequestExclusivityClass
+    exclusivityClass: RequestExclusivityClass,
+    waitingFor: string = 'workspace admission'
   ): Promise<IRequestLease> {
-    return await this.#acquireAsync(
-      scheduler,
-      exclusivityClass,
-      this.#getRemainingWaitTimeoutMs(),
-      'workspace admission'
-    );
+    return await this.#acquireAsync(scheduler, exclusivityClass, this.#remainingMs, waitingFor);
   }
 
   /**
@@ -259,7 +303,7 @@ export class RequestAdmissionController {
     const waitTimeoutMs: number | undefined =
       exclusivityClass === RequestExclusivityClass.SharedBuild && this.#admission?.waitTimeoutIsDefault
         ? undefined
-        : this.#getRemainingWaitTimeoutMs();
+        : this.#remainingMs;
     return await this.#acquireAsync(
       scheduler,
       exclusivityClass,
@@ -285,8 +329,8 @@ export class RequestAdmissionController {
     transition: AdmissionProgress
   ): Promise<IRequestLease> {
     const waitingFor: string = "another request's load or reload of the workspace graph";
-    const remainingMs: number | undefined = this.#getRemainingWaitTimeoutMs();
-    const waitTimeoutMs: number | undefined = this.#admission?.waitTimeoutMs;
+    const remainingMs: number | undefined = this.#remainingMs;
+    const waitTimeoutMs: number | undefined = this.#configuredWaitTimeoutMs;
     if (remainingMs === undefined || waitTimeoutMs === undefined) {
       return await this.#acquireAsync(
         scheduler,
@@ -319,42 +363,22 @@ export class RequestAdmissionController {
     } catch (error) {
       budget.stop();
       if (!exhausted.signal.aborted || this.#abortController.signal.aborted) throw error;
-      const message: string = pausedLimitReached
-        ? `The request was not admitted within ${GRAPH_LOAD_WAIT_FACTOR} times its ${waitTimeoutMs}ms wait ` +
-          `timeout because ${waitingFor} was still running after ${formatSeconds(budget.pausedMs)}.`
-        : `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ` +
-          `${waitingFor}` +
-          (budget.pausedMs > 0
-            ? `; ${formatSeconds(budget.pausedMs)} spent while that request loaded the graph did not count.`
-            : '.');
+      // A zero timeout has no paused allowance, so it fails at once without reaching a limit worth naming.
+      const message: string =
+        pausedLimitReached && waitTimeoutMs > 0
+          ? `The request was not admitted within ${GRAPH_LOAD_WAIT_FACTOR} times its ${waitTimeoutMs}ms wait ` +
+            `timeout because ${waitingFor} was still running after ${formatSeconds(budget.pausedMs)}.`
+          : `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ` +
+            `${waitingFor}` +
+            `${formatUncountedTime(this.#pausedMs + budget.pausedMs, 'while that request loaded the graph')}.`;
       throw new RequestSchedulerError(
         RequestSchedulerErrorCode.WaitTimeout,
         `${message} ${WAIT_LONGER_HINT}`
       );
     } finally {
       budget.stop();
-      this.#deadlineMs = Date.now() + budget.remainingMs;
-    }
-  }
-
-  /**
-   * Runs `action`, such as routing and executing an admitted request, without spending the request's wait timeout.
-   *
-   * @remarks
-   * Work after admission either runs or waits at a routing boundary that applies the timeout it received, such as the
-   * graph-execution gate. A request that re-enters workspace admission afterwards, for example to reload the graph
-   * after its inputs changed, therefore keeps the unspent timeout it had before `action`, whether that timeout is the
-   * client default or explicit.
-   */
-  public async runOutsideWaitBudgetAsync<T>(action: () => Promise<T>): Promise<T> {
-    const remainingMs: number | undefined = this.#getRemainingWaitTimeoutMs();
-    if (remainingMs === undefined) {
-      return await action();
-    }
-    try {
-      return await action();
-    } finally {
-      this.#deadlineMs = Date.now() + remainingMs;
+      this.#pausedMs += budget.pausedMs;
+      this.#remainingMs = budget.remainingMs;
     }
   }
 
@@ -366,6 +390,7 @@ export class RequestAdmissionController {
     abortSignal: AbortSignal = this.#abortController.signal
   ): Promise<IRequestLease> {
     const writer: QueuePositionWriter | undefined = this.#writer;
+    const startMs: number = Date.now();
     let lease: IRequestLease | undefined;
     try {
       lease = await scheduler.acquireAsync({
@@ -387,6 +412,9 @@ export class RequestAdmissionController {
       lease?.release();
       await writer?.flushAsync();
       throw this.#getReportedError(error, waitingFor);
+    } finally {
+      // A wait that the timeout does not limit does not spend it either; see `acquireGraphExecutionAsync`.
+      if (waitTimeoutMs !== undefined) this.#spend(Date.now() - startMs);
     }
   }
 
@@ -400,26 +428,53 @@ export class RequestAdmissionController {
    * still being served and no rushx script is, and that time does not count against it. The default still limits
    * the wait while a rushx script is served, since a script may not exit until it is stopped, and waiting for
    * requests that arrived later, which could otherwise keep the request waiting for as long as they keep arriving.
-   * An explicit `noWait` or `waitTimeoutMs` applies to the whole wait, using the same absolute deadline as workspace
-   * admission.
+   * An explicit `noWait` or `waitTimeoutMs` applies to the whole wait, using the same budget as workspace admission.
    */
   public async waitForRestartDrainAsync(
     arbiter: WorkspaceRestartArbiter,
     ticket: IWorkspaceRestartTicket
+  ): Promise<void> {
+    await this.#waitForRestartArbiterAsync((options: IWorkspaceRestartDrainOptions) =>
+      arbiter.waitForDrainAsync(ticket, options)
+    );
+  }
+
+  /**
+   * Waits, for a rushx script, until no other request needs to restart the daemon for its environment, so that the
+   * restart does not also wait for the script. The client is told how many requests are served or need a restart, as
+   * a queue position.
+   *
+   * @remarks
+   * The wait timeout applies as it does to the restart drain, relative to the requests served when this wait began:
+   * a client-default timeout is not spent while one of them is still being served and no rushx script is.
+   */
+  public async waitForPendingRestartAsync(
+    arbiter: WorkspaceRestartArbiter,
+    ticket: IWorkspaceRestartTicket
+  ): Promise<void> {
+    await this.#waitForRestartArbiterAsync((options: IWorkspaceRestartDrainOptions) =>
+      arbiter.waitForPendingRestartAsync(ticket, options)
+    );
+  }
+
+  async #waitForRestartArbiterAsync(
+    waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<number>
   ): Promise<void> {
     const writer: QueuePositionWriter | undefined = this.#writer;
+    const startMs: number = Date.now();
+    let waivedMs: number = 0;
     try {
       // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
-      const waivedMs: number = await arbiter.waitForDrainAsync(ticket, {
+      waivedMs = await waitAsync({
         abortSignal: this.#abortController.signal,
         noWait: this.#admission?.noWait,
-        waitTimeoutMs: this.#getRemainingWaitTimeoutMs(),
+        waitTimeoutMs: this.#remainingMs,
         waivesTimeoutForServedWork: this.#admission?.waitTimeoutIsDefault === true,
-        onServingCountChanged: writer ? (servingCount: number) => writer.enqueue(servingCount) : undefined
+        onServingCountChanged: writer ? (count: number) => writer.enqueue(count) : undefined
       });
-      if (this.#deadlineMs !== undefined) this.#deadlineMs += waivedMs;
     } finally {
       await writer?.flushAsync();
+      this.#spend(Date.now() - startMs - waivedMs);
     }
   }
 
@@ -429,17 +484,29 @@ export class RequestAdmissionController {
 
   /** Passes the remaining admission budget to another existing routing boundary. */
   public get remainingAdmission(): IDaemonRequestAdmissionOptions | undefined {
-    return this.#admission
-      ? { ...this.#admission, waitTimeoutMs: this.#getRemainingWaitTimeoutMs() }
-      : undefined;
+    if (!this.#admission) return undefined;
+    const remaining: IDaemonRequestAdmissionOptions = {
+      ...this.#admission,
+      waitTimeoutMs: this.#remainingMs
+    };
+    if (this.#configuredWaitTimeoutMs !== undefined) {
+      HISTORY_BY_REMAINING_ADMISSION.set(remaining, {
+        waitTimeoutMs: this.#configuredWaitTimeoutMs,
+        pausedMs: this.#pausedMs
+      });
+    }
+    return remaining;
   }
 
-  #getRemainingWaitTimeoutMs(): number | undefined {
-    return this.#deadlineMs === undefined ? undefined : Math.max(0, this.#deadlineMs - Date.now());
+  /** Spends `elapsedMs` of the wait timeout, if one applies. */
+  #spend(elapsedMs: number): void {
+    if (this.#remainingMs !== undefined) {
+      this.#remainingMs = Math.max(0, this.#remainingMs - Math.max(0, elapsedMs));
+    }
   }
 
   #getReportedError(error: unknown, waitingFor: string): unknown {
-    const waitTimeoutMs: number | undefined = this.#admission?.waitTimeoutMs;
+    const waitTimeoutMs: number | undefined = this.#configuredWaitTimeoutMs;
     if (
       waitTimeoutMs !== undefined &&
       error instanceof RequestSchedulerError &&
@@ -447,7 +514,8 @@ export class RequestAdmissionController {
     ) {
       return new RequestSchedulerError(
         RequestSchedulerErrorCode.WaitTimeout,
-        `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ${waitingFor}. ` +
+        `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ${waitingFor}` +
+          `${formatUncountedTime(this.#pausedMs, 'earlier while another request loaded the workspace graph')}. ` +
           WAIT_LONGER_HINT
       );
     }
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 030ec677f2..3b8a306224 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -114,6 +114,13 @@ class RestartPendingBeforeExecution extends Error {
 export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #options: IWorkspaceRequestLifecycleOptions;
   readonly #gate: RequestScheduler = new RequestScheduler();
+  /**
+   * A served rushx script needs its generation only to resolve, so once it starts it releases `#gate` and holds a
+   * shared lease here until it exits: a reload no longer waits for a dev server or watch script (#113). Whatever
+   * would end the script with this process (a restart, a native mutation, disposal) waits for this lease after
+   * taking `#gate` exclusively, when no other script can start.
+   */
+  readonly #scripts: RequestScheduler = new RequestScheduler();
   readonly #restartArbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   readonly #abortController: AbortController = new AbortController();
   readonly #observers: Set<AbortController> = new Set();
@@ -216,14 +223,16 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       client,
       requestId: envelope.requestId
     });
-    // Long-lived observers are cancelled by a transition, so they never delay a restart. A rushx script does delay
-    // one until it exits, so a client-default timeout still limits waiting for it.
+    // Long-lived observers are cancelled by a transition, so they never delay a restart. A running rushx script does
+    // delay one until it exits, so a client-default timeout still limits waiting for it; a script that arrives while a
+    // restart is pending waits for that restart instead (#prepareAsync).
     const ticket: IWorkspaceRestartTicket | undefined = observer
       ? undefined
       : this.#restartArbiter.enter({ runsScript: isRushxInvocation(envelope) });
     let generation: IPreparedGeneration | undefined;
     try {
       for (let attempt: number = 0; ; attempt++) {
+        let scriptLease: IRequestLease | undefined;
         try {
           const prepared: IPreparedGeneration = await this.#prepareAsync(
             envelope,
@@ -233,27 +242,32 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             receivedTimeMs
           );
           generation = prepared;
+          if (isRushxInvocation(envelope)) {
+            // Never waits: exclusive holders of this lease also hold `#gate` exclusively, and this request holds it.
+            scriptLease = await admission.acquireAsync(this.#scripts, RequestExclusivityClass.SharedBuild);
+          }
+          // Routing boundaries spend a copy of the remaining budget, so a retry after dispatch starts from this one.
           const requestEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
             admission: admission.remainingAdmission
           };
-          await admission.runOutsideWaitBudgetAsync(async () => {
-            if (isMutation(envelope)) {
-              await this.#executeMutationAsync(prepared, requestEnvelope, client, state, dispatchAsync);
-            } else {
-              await dispatchAsync({
-                envelope: requestEnvelope,
-                client,
-                workspaceSession: prepared.session,
-                resolver: prepared.resolver,
-                receivedTimeMs,
-                onExecutionStarting: () => {
-                  this.#assertGeneration(prepared);
-                  state.began = true;
-                }
-              });
-            }
-          });
+          if (isMutation(envelope)) {
+            await this.#executeMutationAsync(prepared, requestEnvelope, client, state, dispatchAsync);
+          } else {
+            await dispatchAsync({
+              envelope: requestEnvelope,
+              client,
+              workspaceSession: prepared.session,
+              resolver: prepared.resolver,
+              receivedTimeMs,
+              onExecutionStarting: () => {
+                this.#assertGeneration(prepared);
+                state.began = true;
+                // The script keeps its restart ticket and script lease; only reloads stop waiting for it.
+                if (scriptLease) prepared.lease.release();
+              }
+            });
+          }
           return;
         } catch (error) {
           if (
@@ -308,6 +322,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         } finally {
           generation?.lease.release();
           generation = undefined;
+          scriptLease?.release();
         }
       }
     } finally {
@@ -339,6 +354,13 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       let session: IWorkspaceSession = await this.#options.provider.getSessionAsync();
       assertWorkspaceRequestResourcesHealthy(session);
       if (isRushxInvocation(envelope)) {
+        if (ticket && this.#restartArbiter.hasPendingRestart(ticket)) {
+          // The restart would wait for the script to exit, so the script waits for the restart instead. If the restart
+          // is planned, the next attempt tells the client to run the script on the successor.
+          lease.release();
+          await admission.waitForPendingRestartAsync(this.#restartArbiter, ticket);
+          return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
+        }
         return {
           session,
           resolver: this.#resolver,
@@ -368,6 +390,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
+            await this.#waitForServedScriptsAsync(admission);
             session = await this.#options.provider.getSessionAsync();
             await this.#quiesceWarmSetAsync(session);
             const workspaceLease: IRequestLease = await admission.acquireAsync(
@@ -478,6 +501,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       fingerprint = await this.#captureAsync(session, envelope);
       tier = this.#classify(fingerprint, isMutation(envelope));
       if (tier === WorkspaceInputChangeTier.Restart) {
+        await this.#waitForServedScriptsAsync(admission);
         await this.#quiesceWarmSetAsync(session);
         const workspaceLease: IRequestLease = await admission.acquireAsync(
           getWorkspaceRequestScheduler(session),
@@ -502,6 +526,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             'Native mutations require a successor launcher. No worker was started.'
           );
         }
+        await this.#waitForServedScriptsAsync(admission);
         await this.#quiesceWarmSetAsync(session);
         return {
           session,
@@ -652,6 +677,26 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Waits, while holding `#gate` exclusively, until no served rushx script is running; none can start meanwhile.
+   * This is contention, not graph-load progress, so requests queued behind it spend their wait timeouts.
+   */
+  async #waitForServedScriptsAsync(admission: RequestAdmissionController): Promise<void> {
+    const loading: boolean = this.#transitionProgress.active;
+    this.#transitionProgress.setActive(false);
+    try {
+      (
+        await admission.acquireAsync(
+          this.#scripts,
+          RequestExclusivityClass.Exclusive,
+          'a rushx script that this daemon runs to exit'
+        )
+      ).release();
+    } finally {
+      this.#transitionProgress.setActive(loading);
+    }
+  }
+
   async #quiesceWarmSetAsync(session: IWorkspaceSession): Promise<void> {
     this.#forceReload = true;
     try {
@@ -853,6 +898,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       });
       const failures: unknown[] = [];
       try {
+        // Served scripts don't hold `#gate`; they were aborted above, so wait for them to stop.
+        (await this.#scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive })).release();
         for (const resolver of this.#ownedResolvers) {
           try {
             await resolver[Symbol.asyncDispose]?.();
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index ee76274a88..f431baf85c 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -29,11 +29,27 @@ export interface IWorkspaceRestartTicketOptions {
 }
 
 interface IMutableTicket {
+  /** The request waits for a drain or for a pending restart, so it is not counted as served. */
   waitingForDrain: boolean;
   left: boolean;
   readonly runsScript: boolean;
 }
 
+interface IWaitKind {
+  /**
+   * The request waits to restart the daemon, so {@link WorkspaceRestartArbiter.hasPendingRestart} reports its restart
+   * to other requests until it leaves.
+   */
+  readonly restarts: boolean;
+  /** Whether the request must keep waiting. */
+  readonly isBlocked: () => boolean;
+  /** How many other requests the request waits for, reported as its queue position. */
+  readonly countWaitedFor: () => number;
+  readonly noWaitMessage: string;
+  /** Begins the timeout message, which goes on to name the requests that the restart waits for. */
+  readonly timeoutPrefix: string;
+}
+
 /** Options for {@link WorkspaceRestartArbiter.waitForDrainAsync}, supplied by request admission. */
 export interface IWorkspaceRestartDrainOptions {
   readonly abortSignal: AbortSignal;
@@ -57,11 +73,15 @@ export interface IWorkspaceRestartDrainOptions {
  * Arbitrates process restarts between requests whose environments differ from the running daemon.
  * A request that needs a restart waits until every other request this process can serve has finished,
  * so a mismatched environment never preempts queued or in-flight work that matches the running process.
+ * A rushx script that arrives while a restart is pending waits for the restart instead, since it may not exit until
+ * it is stopped and the restart would otherwise wait for it.
  */
 export class WorkspaceRestartArbiter {
   readonly #listeners: Set<() => void> = new Set();
-  readonly #countListeners: Set<(servingCount: number) => void> = new Set();
+  readonly #countListeners: Set<() => void> = new Set();
   readonly #serving: Set<IMutableTicket> = new Set();
+  /** Requests that began a restart drain and have not left, so their restarts are still pending. */
+  readonly #restartCandidates: Set<IMutableTicket> = new Set();
 
   /** The number of tracked requests that are not waiting for a restart. */
   public get servingCount(): number {
@@ -82,41 +102,92 @@ export class WorkspaceRestartArbiter {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left) return;
     state.left = true;
+    this.#restartCandidates.delete(state);
     if (!state.waitingForDrain) this.#stopServing(state);
   }
 
+  /**
+   * Whether another tracked request needs to restart the daemon for its environment: it waits for the drain, or it
+   * has drained and not yet left. A request that needs a restart leaves once the restart is planned, or once it
+   * fails or is cancelled.
+   */
+  public hasPendingRestart(ticket: IWorkspaceRestartTicket): boolean {
+    return Array.from(this.#restartCandidates).some((candidate: IMutableTicket) => candidate !== ticket);
+  }
+
   /**
    * Waits until no other tracked request is still being served by this process, then counts the ticket
    * as served again so concurrent restart candidates proceed one at a time. Returns how many milliseconds of the
    * wait did not spend `waitTimeoutMs` (see {@link IWorkspaceRestartDrainOptions.waivesTimeoutForServedWork}).
+   * From when the wait begins until the ticket leaves, {@link WorkspaceRestartArbiter.hasPendingRestart} reports
+   * the restart to other requests.
    */
   public async waitForDrainAsync(
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions
+  ): Promise<number> {
+    return await this.#waitAsync(ticket, options, {
+      restarts: true,
+      isBlocked: () => this.#serving.size > 0,
+      countWaitedFor: () => this.#serving.size,
+      noWaitMessage: 'Another environment is still being served; the request did not wait for a restart.',
+      timeoutPrefix:
+        'The request was not admitted before the daemon could restart for its environment, which waits for'
+    });
+  }
+
+  /**
+   * Waits, for a request that runs a rushx script, until no other tracked request needs to restart the daemon for
+   * its environment, then counts the ticket as served again. A script may not exit until it is stopped, so it waits
+   * for a pending restart instead of starting and delaying the restart until it exits. The options apply as for
+   * {@link WorkspaceRestartArbiter.waitForDrainAsync}, and the queue position counts the requests that are served or
+   * need a restart.
+   */
+  public async waitForPendingRestartAsync(
+    ticket: IWorkspaceRestartTicket,
+    options: IWorkspaceRestartDrainOptions
+  ): Promise<number> {
+    return await this.#waitAsync(ticket, options, {
+      restarts: false,
+      isBlocked: () => this.hasPendingRestart(ticket),
+      countWaitedFor: () => new Set([...this.#serving, ...this.#restartCandidates]).size,
+      noWaitMessage:
+        'Another request is waiting to restart the daemon for its environment; the rushx script did not wait ' +
+        'for the restart.',
+      timeoutPrefix:
+        "The rushx script was not admitted before the daemon could restart for another request's environment. A " +
+        'script waits for a pending restart so that the restart does not wait for the script, and the restart ' +
+        'waits for'
+    });
+  }
+
+  async #waitAsync(
+    ticket: IWorkspaceRestartTicket,
+    options: IWorkspaceRestartDrainOptions,
+    kind: IWaitKind
   ): Promise<number> {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left || state.waitingForDrain) throw new Error('The restart ticket is not being served.');
+    if (kind.restarts) this.#restartCandidates.add(state);
     state.waitingForDrain = true;
     this.#stopServing(state);
     const waivedFor: IMutableTicket[] = options.waivesTimeoutForServedWork ? Array.from(this.#serving) : [];
     let remainingMs: number | undefined = options.waitTimeoutMs;
     let waivedMs: number = 0;
     let reported: number | undefined;
-    const report = (servingCount: number): void => {
-      if (servingCount > 0 && servingCount !== reported) {
-        reported = servingCount;
-        options.onServingCountChanged?.(servingCount);
+    const report = (): void => {
+      const count: number = kind.countWaitedFor();
+      if (count > 0 && count !== reported) {
+        reported = count;
+        options.onServingCountChanged?.(count);
       }
     };
     try {
-      while (this.#serving.size > 0) {
+      while (kind.isBlocked()) {
         if (options.noWait) {
-          throw new RequestSchedulerError(
-            RequestSchedulerErrorCode.NoWait,
-            'Another environment is still being served; the request did not wait for a restart.'
-          );
+          throw new RequestSchedulerError(RequestSchedulerErrorCode.NoWait, kind.noWaitMessage);
         }
-        report(this.#serving.size);
+        report();
         const waived: boolean =
           !this.#isServingScript() && waivedFor.some((served: IMutableTicket) => this.#serving.has(served));
         const startedAt: number = Date.now();
@@ -125,7 +196,7 @@ export class WorkspaceRestartArbiter {
           await this.#waitForChangeAsync(
             options.abortSignal,
             waived || remainingMs === undefined ? undefined : startedAt + remainingMs,
-            waivedMs
+            () => this.#createTimeoutError(kind, waivedMs)
           );
         } finally {
           this.#countListeners.delete(report);
@@ -151,9 +222,9 @@ export class WorkspaceRestartArbiter {
     this.#notifyChange();
   }
 
-  /** Reports the new count, and wakes every waiting candidate to re-check what it waits for. */
+  /** Reports the new count, and wakes every waiting request to re-check what it waits for. */
   #notifyChange(): void {
-    for (const listener of Array.from(this.#countListeners)) listener(this.#serving.size);
+    for (const listener of Array.from(this.#countListeners)) listener();
     for (const listener of Array.from(this.#listeners)) listener();
   }
 
@@ -161,12 +232,11 @@ export class WorkspaceRestartArbiter {
     return Array.from(this.#serving).some((served: IMutableTicket) => served.runsScript);
   }
 
-  #createTimeoutError(waivedMs: number): RequestSchedulerError {
+  #createTimeoutError(kind: IWaitKind, waivedMs: number): RequestSchedulerError {
     const script: boolean = this.#isServingScript();
     return new RequestSchedulerError(
       RequestSchedulerErrorCode.WaitTimeout,
-      'The request was not admitted before the daemon could restart for its environment, which waits for the ' +
-        `requests that the daemon is serving to finish${script ? SCRIPT_TIMEOUT_CLAUSE : ''}` +
+      `${kind.timeoutPrefix} the requests that the daemon is serving to finish${script ? SCRIPT_TIMEOUT_CLAUSE : ''}` +
         `${formatWaivedTime(waivedMs)}. ${script ? SCRIPT_TIMEOUT_REMEDY : TIMEOUT_REMEDY}`
     );
   }
@@ -174,7 +244,7 @@ export class WorkspaceRestartArbiter {
   #waitForChangeAsync(
     abortSignal: AbortSignal,
     deadline: number | undefined,
-    waivedMs: number
+    createTimeoutError: () => RequestSchedulerError
   ): Promise<void> {
     return new Promise<void>((resolve, reject) => {
       let timer: ReturnType<typeof setTimeout> | undefined;
@@ -201,7 +271,7 @@ export class WorkspaceRestartArbiter {
       abortSignal.addEventListener('abort', settleAborted, { once: true, signal: unsubscribe.signal });
       if (deadline !== undefined) {
         timer = setTimeout(
-          () => settle(this.#createTimeoutError(waivedMs)),
+          () => settle(createTimeoutError()),
           Math.min(MAX_TIMER_DELAY_MS, Math.max(0, deadline - Date.now()))
         );
       }
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index 844b581ed1..84f3e26eff 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -19,6 +19,7 @@ import {
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IDaemonRequestResolver } from '../DaemonRequestDispatcher';
 import { RushDaemonHost } from '../RushDaemonHost';
+import { RushDaemonRequestResolver } from '../RushDaemonRequestResolver';
 import { WorkspaceSession } from '../WorkspaceSession';
 import { getWorkspaceGenerationToken } from '../WorkspaceGeneration';
 import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
@@ -36,6 +37,8 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   public getSuccessorLaunchAsync: GetWorkspaceSuccessorLaunchAsync | undefined;
   /** Awaited before each workspace session is created, including a request's graph load or reload. */
   public beforeCreateSessionAsync: (() => Promise<void>) | undefined;
+  /** Also serves rushx package scripts, like the production host. Set it in `createAsync`'s `configure`. */
+  public servesRushx: boolean = false;
   public readonly folder: string = fs.realpathSync.native(
     fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-graph-'))
   );
@@ -141,7 +144,10 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   }
 
   private async _startAsync(): Promise<void> {
-    const resolver: IDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const production: IDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const resolver: IDaemonRequestResolver = this.servesRushx
+      ? new RushDaemonRequestResolver(production)
+      : production;
     this.host = await RushDaemonHost.startAsync({
       repoRoot: this.folder,
       rushVersion: Rush.version,
diff --git a/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts b/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts
index fb0f0e31fe..48206eda81 100644
--- a/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts
+++ b/libraries/rush-daemon/src/test/RequestAdmissionIntegration.test.ts
@@ -21,11 +21,14 @@ import {
 } from '../GlobalCommandRequestRouter';
 import type {
   GlobalCommandExecutor,
-  IGlobalCommandExecutionResult
+  IGlobalCommandExecutionResult,
+  IGlobalCommandRequestResult
 } from '../GlobalCommandRequestRouter';
 import type { IInteractiveRequestSession } from '../InteractiveRequestInputRouter';
 import { InteractiveRequestInputRouter } from '../InteractiveRequestInputRouter';
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import { type IRequestLease, RequestExclusivityClass, RequestScheduler } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -262,6 +265,60 @@ describe('request admission integration', () => {
     jest.useRealTimers();
   });
 
+  it('names the configured wait timeout when a global command times out on a remaining budget', async () => {
+    jest.useFakeTimers();
+    const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(
+      new TestWorkspaceSession(TEST_REPO_ROOT)
+    );
+    const release: { readonly promise: Promise<void>; readonly resolve: () => void } = createDeferred();
+    const activeStarted: { readonly promise: Promise<void>; readonly resolve: () => void } = createDeferred();
+    const active: Promise<IGlobalCommandRequestResult> = router.executeAsync(
+      createRequest(router, 'active', 'custom-active'),
+      createBlockingExecutor(activeStarted.resolve, release.promise),
+      new AdmissionClient()
+    );
+    await activeStarted.promise;
+    // The workspace lifecycle spends part of the client's budget waiting at its gate, then hands the remainder to the
+    // router.
+    const lifecycle: RequestAdmissionController = new RequestAdmissionController({
+      admission: { waitTimeoutMs: 100 },
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'timeout'
+    });
+    try {
+      const gate: RequestScheduler = new RequestScheduler();
+      const gateHolder: IRequestLease = await gate.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive
+      });
+      const gateLease: Promise<IRequestLease> = lifecycle.acquireAsync(gate, RequestExclusivityClass.SharedBuild);
+      await jest.advanceTimersByTimeAsync(40);
+      gateHolder.release();
+      (await gateLease).release();
+      const executor: jest.Mock<Promise<IGlobalCommandExecutionResult>, []> = jest.fn(async () => ({
+        exitCode: 0
+      }));
+      const timeoutPromise: Promise<IGlobalCommandRequestResult> = router.executeAsync(
+        createRequest(router, 'timeout', 'list', lifecycle.remainingAdmission),
+        executor,
+        new AdmissionClient()
+      );
+      await jest.advanceTimersByTimeAsync(60);
+
+      await expect(timeoutPromise).resolves.toMatchObject({
+        admissionErrorCode: 'wait-timeout',
+        errorMessage:
+          'The request was not admitted within its 100ms wait timeout while waiting for workspace admission. ' +
+          'Use --wait-timeout <seconds> to wait longer.'
+      });
+      expect(executor).not.toHaveBeenCalled();
+    } finally {
+      lifecycle.dispose();
+      release.resolve();
+      await active;
+      jest.useRealTimers();
+    }
+  });
+
   it('cancels queued work on a progress write failure without leaking admission', async () => {
     const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(
       new TestWorkspaceSession(TEST_REPO_ROOT)
diff --git a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
index a91e129d94..328356e3ac 100644
--- a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
@@ -3,7 +3,10 @@
 
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+import type {
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
 
 import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
 import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
@@ -117,6 +120,23 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     expect(arbiter.servingCount).toBe(0);
   });
 
+  it('spends an explicit timeout while it waits for the drain, but not on the work around that wait', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 10_000 });
+    // Such as capturing the request's inputs before the wait, and planning the restart after it.
+    await delayAsync(1_000);
+    const draining: Promise<void> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    await delayAsync(300);
+    arbiter.leave(serving);
+    await draining;
+    await delayAsync(1_000);
+    const remainingMs: number | undefined = admission.remainingAdmission?.waitTimeoutMs;
+    expect(remainingMs).toBeLessThanOrEqual(9_710);
+    expect(remainingMs).toBeGreaterThan(8_700);
+    arbiter.leave(ticket);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
   it('applies no-wait to the drain', async () => {
     const { admission, arbiter, serving, ticket } = createDrainTest({ noWait: true });
     const error: unknown = await admission
@@ -129,3 +149,111 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     expect(arbiter.servingCount).toBe(0);
   });
 });
+
+interface IPendingRestartTest {
+  readonly admission: RequestAdmissionController;
+  readonly arbiter: WorkspaceRestartArbiter;
+  readonly candidate: IWorkspaceRestartTicket;
+  readonly draining: Promise<number>;
+  readonly positions: number[];
+  readonly script: IWorkspaceRestartTicket;
+  readonly serving: IWorkspaceRestartTicket;
+}
+
+/** A rushx script with the given admission options, which arrives while a restart candidate drains one request. */
+function createPendingRestartTest(
+  options: IDaemonRequestAdmissionOptions,
+  servingOptions?: IWorkspaceRestartTicketOptions
+): IPendingRestartTest {
+  const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+  const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
+  const candidate: IWorkspaceRestartTicket = arbiter.enter();
+  const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, {
+    abortSignal: new AbortController().signal,
+    noWait: undefined,
+    waitTimeoutMs: undefined
+  });
+  const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+  const positions: number[] = [];
+  const admission: RequestAdmissionController = new RequestAdmissionController({
+    admission: options,
+    client: {
+      abortSignal: new AbortController().signal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync: (message: IDaemonRequestQueuePositionMessage) => {
+        positions.push(message.payload.position);
+        return Promise.resolve();
+      }
+    },
+    requestId: 'rushx-script'
+  });
+  return { admission, arbiter, candidate, draining, positions, script, serving };
+}
+
+async function finishPendingRestartTestAsync(test: IPendingRestartTest): Promise<void> {
+  test.arbiter.leave(test.serving);
+  test.arbiter.leave(test.script);
+  await test.draining;
+  test.arbiter.leave(test.candidate);
+  test.admission.dispose();
+  expect(test.arbiter.servingCount).toBe(0);
+}
+
+describe('RequestAdmissionController.waitForPendingRestartAsync', () => {
+  it('waits past a client-default timeout while the restart drains an earlier build, and reports a position', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({
+      waitTimeoutMs: 50,
+      waitTimeoutIsDefault: true
+    });
+    const waiting: Promise<void> = test.admission.waitForPendingRestartAsync(test.arbiter, test.script);
+    await delayAsync(250);
+    expect(await isSettledAsync(waiting)).toBe(false);
+    test.arbiter.leave(test.serving);
+    await test.draining;
+    test.arbiter.leave(test.candidate);
+    await waiting;
+    // The build and the candidate, then the candidate alone.
+    expect(test.positions).toEqual([2, 1]);
+    // The script is then told to run on the successor, which gets its default again.
+    expect(test.admission.remainingAdmission?.waitTimeoutMs).toBeGreaterThan(0);
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('applies a client-default timeout while a rushx script is served, and says why', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest(
+      { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
+      { runsScript: true }
+    );
+    const error: unknown = await test.admission
+      .waitForPendingRestartAsync(test.arbiter, test.script)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).toContain(
+      'A script waits for a pending restart so that the restart does not wait for the script'
+    );
+    expect((error as Error).message).toContain(
+      'including a rushx script that may not exit until it is stopped'
+    );
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('applies an explicit timeout while the restart drains an earlier build', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({ waitTimeoutMs: 50 });
+    const error: unknown = await test.admission
+      .waitForPendingRestartAsync(test.arbiter, test.script)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).not.toContain('including a rushx script');
+    await finishPendingRestartTestAsync(test);
+  });
+
+  it('applies no-wait at once', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({ noWait: true });
+    const error: unknown = await test.admission
+      .waitForPendingRestartAsync(test.arbiter, test.script)
+      .catch((caught: unknown) => caught);
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    expect(test.positions).toEqual([]);
+    await finishPendingRestartTestAsync(test);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
new file mode 100644
index 0000000000..a1d868b232
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
@@ -0,0 +1,130 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureProjectConfigurationFingerprintAsync: jest.fn(actual.captureProjectConfigurationFingerprintAsync)
+  };
+});
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import * as rushLib from '@microsoft/rush-lib';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { createDeferred, type IDeferred, type ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+/** Longer than the wait timeout, so that a request whose capture counted would have none left. */
+const CAPTURE_MS: number = 2_500;
+const WAIT_TIMEOUT_MS: number = 2_000;
+const captureMock: jest.MockedFunction<typeof rushLib.captureProjectConfigurationFingerprintAsync> =
+  jest.mocked(rushLib.captureProjectConfigurationFingerprintAsync);
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+async function createFixtureAsync(): Promise<DaemonGraphTestFixture> {
+  return await DaemonGraphTestFixture.createAsync((created) => {
+    created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
+    created.write(
+      'a/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+        "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+    );
+  });
+}
+
+/** Makes the next project configuration capture, which a warm build runs before it is routed, take `CAPTURE_MS`. */
+function slowDownNextCapture(): IDeferred<void> {
+  const captured: IDeferred<void> = createDeferred<void>();
+  const actual: typeof rushLib.captureProjectConfigurationFingerprintAsync = jest.requireActual<
+    typeof rushLib
+  >('@microsoft/rush-lib').captureProjectConfigurationFingerprintAsync;
+  captureMock.mockClear();
+  captureMock.mockImplementationOnce(async (...args) => {
+    await delayAsync(CAPTURE_MS);
+    try {
+      return await actual(...args);
+    } finally {
+      captured.resolve();
+    }
+  });
+  return captured;
+}
+
+describe('explicit wait timeouts and a request preparing to run', () => {
+  it('does not spend the timeout on capturing the request inputs, so the request can still wait', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    const releaseFile: string = path.join(fixture.folder, 'release-a');
+    try {
+      const long: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await waitForAsync(() => fixture.runs().includes('a'), 'the long build to start');
+
+      const captured: IDeferred<void> = slowDownNextCapture();
+      const behind: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A, {
+        admission: { waitTimeoutMs: WAIT_TIMEOUT_MS }
+      });
+      await captured.promise;
+      // The request now waits for the running build, which ends well within its timeout.
+      await delayAsync(200);
+      fs.writeFileSync(releaseFile, '');
+
+      expect((await long).terminal).toMatchObject({ payload: { exitCode: 0 } });
+      expect((await behind).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(captureMock).toHaveBeenCalledTimes(1);
+    } finally {
+      // A failed expectation must not leave the long build running, which would keep the fixture from shutting down.
+      fs.writeFileSync(releaseFile, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('still spends the timeout while the request waits after capturing its inputs', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    const releaseFile: string = path.join(fixture.folder, 'release-a');
+    try {
+      const long: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A);
+      await waitForAsync(() => fixture.runs().includes('a'), 'the long build to start');
+
+      const captured: IDeferred<void> = slowDownNextCapture();
+      const startedAt: number = Date.now();
+      const behind: Promise<ITerminalExchange> = fixture.runAsync(BUILD_A, {
+        admission: { waitTimeoutMs: WAIT_TIMEOUT_MS }
+      });
+      await captured.promise;
+      const timedOut: ITerminalExchange = await behind;
+      expect(Date.now() - startedAt).toBeGreaterThanOrEqual(CAPTURE_MS + WAIT_TIMEOUT_MS - 100);
+      expect(timedOut.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage:
+            `The request was not admitted within its ${WAIT_TIMEOUT_MS}ms wait timeout while waiting for the ` +
+            'running build of the workspace operation graph. Use --wait-timeout <seconds> to wait longer.'
+        }
+      });
+
+      fs.writeFileSync(releaseFile, '');
+      expect((await long).terminal).toMatchObject({ payload: { exitCode: 0 } });
+    } finally {
+      fs.writeFileSync(releaseFile, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
index 23b261466b..d88b99799f 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -12,7 +12,11 @@ import {
   RequestScheduler,
   RequestSchedulerErrorCode
 } from '../RequestScheduler';
-import { AdmissionProgress, RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import {
+  AdmissionProgress,
+  freezeDaemonRequestAdmissionOptions,
+  RequestAdmissionController
+} from '../WorkspaceRequestAdmission';
 
 const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100, waitTimeoutIsDefault: true };
 const EXPLICIT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100 };
@@ -49,6 +53,24 @@ function createController(
   return new RequestAdmissionController({ admission, client: { abortSignal }, requestId: 'request' });
 }
 
+/** Makes `controller` wait `waitMs` behind another request, on a scheduler of its own, and then be admitted. */
+async function waitBehindAnotherRequestAsync(
+  controller: RequestAdmissionController,
+  waitMs: number
+): Promise<void> {
+  const scheduler: RequestScheduler = new RequestScheduler();
+  const other: IRequestLease = await scheduler.acquireAsync({
+    exclusivityClass: RequestExclusivityClass.Exclusive
+  });
+  const waiting: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.SharedBuild));
+  await jest.advanceTimersByTimeAsync(waitMs);
+  expect(waiting.settled).toBe(false);
+  other.release();
+  await jest.advanceTimersByTimeAsync(0);
+  expect(waiting.lease).toBeDefined();
+  waiting.lease?.release();
+}
+
 describe(RequestAdmissionController.name, () => {
   let scheduler: RequestScheduler;
   let owner: IRequestLease;
@@ -111,6 +133,25 @@ describe(RequestAdmissionController.name, () => {
     }
   );
 
+  it.each(BUDGETS)(
+    'carries what is left of $kind timeout after it waits behind a transition to its later waits',
+    async ({ budget }) => {
+      const controller: RequestAdmissionController = createController(budget);
+      const behind: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+      // The transition itself waits for 30ms, which the request spends, and then loads the graph.
+      await jest.advanceTimersByTimeAsync(30);
+      transition.setActive(true);
+      await jest.advanceTimersByTimeAsync(500);
+      scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+      transition.setActive(false);
+      await jest.advanceTimersByTimeAsync(0);
+      expect(behind.error).toBeUndefined();
+      behind.lease?.release();
+      expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 70 });
+      controller.dispose();
+    }
+  );
+
   it('fails once the transition it waits behind has made progress for ten times its timeout', async () => {
     const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
     transition.setActive(true);
@@ -162,6 +203,57 @@ describe(RequestAdmissionController.name, () => {
     controller.dispose();
   });
 
+  it('reports a zero timeout behind a transition as a plain timeout, not as the paused limit', async () => {
+    const controller: RequestAdmissionController = createController({ waitTimeoutMs: 0 });
+    transition.setActive(true);
+    const waiting: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(0);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 0ms wait timeout while waiting for another request's load or " +
+        'reload of the workspace graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(scheduler.queuedRequestCount).toBe(0);
+    controller.dispose();
+  });
+
+  it('reports paused time that did not count when a later boundary times out', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    transition.setActive(true);
+    const behind: IAcquisition = track(controller.acquireBehindTransitionAsync(scheduler, transition));
+    await jest.advanceTimersByTimeAsync(500);
+    scheduler.downgradeExclusiveLease(owner, RequestExclusivityClass.SharedBuild);
+    transition.setActive(false);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(behind.error).toBeUndefined();
+    behind.lease?.release();
+    // A routing boundary receives a frozen copy of the remaining budget.
+    const remaining: IDaemonRequestAdmissionOptions | undefined = controller.remainingAdmission;
+    const boundary: RequestAdmissionController = new RequestAdmissionController({
+      admission: remaining && freezeDaemonRequestAdmissionOptions(remaining),
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'request'
+    });
+
+    const here: IAcquisition = track(controller.acquireAsync(scheduler, RequestExclusivityClass.Exclusive));
+    const there: IAcquisition = track(boundary.acquireAsync(scheduler, RequestExclusivityClass.Exclusive));
+    await jest.advanceTimersByTimeAsync(99);
+    expect(here.settled || there.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    const error: { code: RequestSchedulerErrorCode; message: string } = {
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 100ms wait timeout while waiting for workspace admission; 0.5s ' +
+        'spent earlier while another request loaded the workspace graph did not count. ' +
+        'Use --wait-timeout <seconds> to wait longer.'
+    };
+    expect(here.error).toMatchObject(error);
+    expect(there.error).toMatchObject(error);
+    boundary.dispose();
+    controller.dispose();
+  });
+
   it('reports cancellation behind a transition as an abort', async () => {
     const client: AbortController = new AbortController();
     const controller: RequestAdmissionController = createController(DEFAULT_BUDGET, client.signal);
@@ -175,15 +267,15 @@ describe(RequestAdmissionController.name, () => {
   });
 
   it.each(BUDGETS)(
-    'keeps the unspent part of $kind timeout across admitted work for a later admission wait',
+    'spends $kind timeout only while it waits, not on the work before and between its waits',
     async ({ budget }) => {
       const controller: RequestAdmissionController = createController(budget);
-      await jest.advanceTimersByTimeAsync(40);
-      const work: Promise<void> = controller.runOutsideWaitBudgetAsync(
-        () => new Promise<void>((resolve) => setTimeout(resolve, 10_000))
-      );
+      // Such as capturing the request's inputs before its first wait.
+      await jest.advanceTimersByTimeAsync(10_000);
+      expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 100 });
+      await waitBehindAnotherRequestAsync(controller, 40);
+      // Such as loading the graph, routing and execution.
       await jest.advanceTimersByTimeAsync(10_000);
-      await work;
       expect(controller.remainingAdmission).toEqual({ ...budget, waitTimeoutMs: 60 });
 
       const waiting: IAcquisition = track(
@@ -201,4 +293,53 @@ describe(RequestAdmissionController.name, () => {
       controller.dispose();
     }
   );
+
+  it('does not spend a default timeout at the graph-execution gate, which it does not limit', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    const running: IAcquisition = track(
+      controller.acquireGraphExecutionAsync(scheduler, RequestExclusivityClass.SharedBuild)
+    );
+    await jest.advanceTimersByTimeAsync(10_000);
+    expect(running.settled).toBe(false);
+    owner.release();
+    await jest.advanceTimersByTimeAsync(0);
+    running.lease?.release();
+    expect(controller.remainingAdmission).toEqual({ ...DEFAULT_BUDGET, waitTimeoutMs: 100 });
+    controller.dispose();
+  });
+
+  it('names the configured timeout, not the remainder, when a later routing boundary times out', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    await waitBehindAnotherRequestAsync(controller, 23);
+    const remaining: IDaemonRequestAdmissionOptions | undefined = controller.remainingAdmission;
+    expect(remaining).toEqual({ ...EXPLICIT_BUDGET, waitTimeoutMs: 77 });
+    const boundary: RequestAdmissionController = new RequestAdmissionController({
+      admission: remaining,
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'request'
+    });
+    await waitBehindAnotherRequestAsync(boundary, 7);
+    // A boundary that hands its own remainder on again still names the client's timeout.
+    const nested: RequestAdmissionController = new RequestAdmissionController({
+      admission: boundary.remainingAdmission,
+      client: { abortSignal: new AbortController().signal },
+      requestId: 'request'
+    });
+
+    const waiting: IAcquisition = track(
+      nested.acquireGraphExecutionAsync(scheduler, RequestExclusivityClass.SharedBuild)
+    );
+    await jest.advanceTimersByTimeAsync(69);
+    expect(waiting.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(waiting.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 100ms wait timeout while waiting for the running build of the ' +
+        'workspace operation graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    nested.dispose();
+    boundary.dispose();
+    controller.dispose();
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
index 10a86e2314..3f91594741 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
@@ -26,6 +26,12 @@ async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
   return settled;
 }
 
+function expectWaitTimeout(error: unknown): RequestSchedulerError {
+  expect(error).toBeInstanceOf(RequestSchedulerError);
+  expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+  return error as RequestSchedulerError;
+}
+
 describe(WorkspaceRestartArbiter.name, () => {
   it('proceeds immediately when no other request is being served', async () => {
     const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
@@ -143,12 +149,6 @@ describe(WorkspaceRestartArbiter.name, () => {
       waivesTimeoutForServedWork: true
     };
 
-    function expectWaitTimeout(error: unknown): RequestSchedulerError {
-      expect(error).toBeInstanceOf(RequestSchedulerError);
-      expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
-      return error as RequestSchedulerError;
-    }
-
     it('does not spend the timeout on requests served when the wait began, and returns that time', async () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
@@ -260,4 +260,190 @@ describe(WorkspaceRestartArbiter.name, () => {
       expect(arbiter.servingCount).toBe(0);
     });
   });
+
+  describe('for a rushx script while a restart is pending', () => {
+    const WAIVED: IWorkspaceRestartDrainOptions = {
+      ...WAIT,
+      waitTimeoutMs: 50,
+      waivesTimeoutForServedWork: true
+    };
+
+    it('reports a restart as pending from the start of its drain until the candidate leaves', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      expect(arbiter.hasPendingRestart(running)).toBe(false);
+      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      expect(arbiter.hasPendingRestart(running)).toBe(true);
+      expect(arbiter.hasPendingRestart(candidate)).toBe(false);
+      arbiter.leave(running);
+      await draining;
+      // After its drain, the candidate still waits for #gate and plans the restart, so a new script must not start.
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      expect(arbiter.hasPendingRestart(script)).toBe(true);
+      arbiter.leave(candidate);
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('proceeds immediately when no restart is pending', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const counts: number[] = [];
+      const waivedMs: number = await arbiter.waitForPendingRestartAsync(script, {
+        ...WAIT,
+        noWait: true,
+        onServingCountChanged: (count: number) => counts.push(count)
+      });
+      expect(waivedMs).toBe(0);
+      expect(counts).toEqual([]);
+      expect(arbiter.servingCount).toBe(2);
+      for (const served of [script, serving]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('waits until the candidate leaves, and the drain does not wait for the waiting script', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const counts: number[] = [];
+      const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, {
+        ...WAIT,
+        onServingCountChanged: (count: number) => counts.push(count)
+      });
+      // The script waits for the running script and for the candidate.
+      expect(counts).toEqual([2]);
+      arbiter.leave(running);
+      await draining;
+      expect(counts).toEqual([2, 1]);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(candidate);
+      expect(await waiting).toBe(0);
+      expect(arbiter.servingCount).toBe(1);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('waits for every pending restart', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const first: IWorkspaceRestartTicket = arbiter.enter();
+      const second: IWorkspaceRestartTicket = arbiter.enter();
+      const firstDrain: Promise<number> = arbiter.waitForDrainAsync(first, WAIT);
+      const secondDrain: Promise<number> = arbiter.waitForDrainAsync(second, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      arbiter.leave(running);
+      await firstDrain;
+      arbiter.leave(first);
+      await secondDrain;
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(second);
+      await waiting;
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it.each([
+      ['no-wait', RequestSchedulerErrorCode.NoWait, 'the rushx script did not wait for the restart.'],
+      [
+        'timeout',
+        RequestSchedulerErrorCode.WaitTimeout,
+        "The rushx script was not admitted before the daemon could restart for another request's environment. " +
+          'A script waits for a pending restart so that the restart does not wait for the script, and the ' +
+          'restart waits for the requests that the daemon is serving to finish, including a rushx script that ' +
+          'may not exit until it is stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
+      ],
+      ['abort', RequestSchedulerErrorCode.Aborted, 'The request was aborted before execution.']
+    ])(
+      'reports %s as an admission failure and counts the script as served again',
+      async (mode, code, text) => {
+        const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+        const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+        const candidate: IWorkspaceRestartTicket = arbiter.enter();
+        const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+        const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+        const abort: AbortController = new AbortController();
+        const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, {
+          abortSignal: abort.signal,
+          noWait: mode === 'no-wait' ? true : undefined,
+          waitTimeoutMs: mode === 'timeout' ? 10 : undefined
+        });
+        if (mode === 'abort') abort.abort();
+        const error: unknown = await waiting.catch((caught: unknown) => caught);
+        expect(error).toBeInstanceOf(RequestSchedulerError);
+        expect((error as RequestSchedulerError).code).toBe(code);
+        expect((error as Error).message).toContain(text);
+        expect(arbiter.servingCount).toBe(2);
+        arbiter.leave(running);
+        expect(await isSettledAsync(draining)).toBe(false);
+        arbiter.leave(script);
+        await draining;
+        arbiter.leave(candidate);
+        expect(arbiter.servingCount).toBe(0);
+      }
+    );
+
+    it('with waivesTimeoutForServedWork, does not spend the timeout while an earlier build is served', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, WAIVED);
+      await delayAsync(150);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(earlier);
+      await draining;
+      arbiter.leave(candidate);
+      expect(await waiting).toBeGreaterThanOrEqual(140);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('with waivesTimeoutForServedWork, spends the timeout once the drain ends, and names the waived time', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const outcome: Promise<unknown> = arbiter
+        .waitForPendingRestartAsync(script, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(false);
+      arbiter.leave(earlier);
+      await draining;
+      const error: RequestSchedulerError = expectWaitTimeout(await outcome);
+      expect(error.message).toMatch(/^The rushx script was not admitted before the daemon could restart/);
+      expect(error.message).toMatch(
+        /to finish; \d+(\.\d)?s spent waiting for requests that were already running did not count\. Use --wait-timeout <seconds> to wait longer\.$/
+      );
+      for (const served of [candidate, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('with waivesTimeoutForServedWork, spends the timeout while a rushx script is served', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const earlier: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const outcome: Promise<unknown> = arbiter
+        .waitForPendingRestartAsync(script, WAIVED)
+        .catch((caught: unknown) => caught);
+      await delayAsync(150);
+      expect(await isSettledAsync(outcome)).toBe(true);
+      expect(expectWaitTimeout(await outcome).message).toContain('including a rushx script');
+      for (const served of [running, earlier, script]) arbiter.leave(served);
+      await draining;
+      arbiter.leave(candidate);
+      expect(arbiter.servingCount).toBe(0);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
new file mode 100644
index 0000000000..4bff3d0a71
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -0,0 +1,305 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+const RELEASE_FILE: string = 'release-serve';
+const LATE_RELEASE_FILE: string = 'release-serve2';
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+/**
+ * Project a's `serve` and `serve2` scripts run, like dev servers, until the test creates their release files,
+ * `release-serve` and `release-serve2`.
+ */
+function createServingFixtureAsync(
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created) => {
+    created.servesRushx = true;
+    created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-*\n');
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: {
+          '_phase:compile': 'node build.cjs',
+          serve: 'node serve.cjs',
+          serve2: 'node serve.cjs serve2'
+        }
+      })
+    );
+    created.write(
+      'a/serve.cjs',
+      "const fs=require('node:fs');const n=process.argv[2]||'serve';fs.appendFileSync('../runs.txt',n+'-start\\n');" +
+        "const t=setInterval(()=>{if(fs.existsSync('../release-'+n)){clearInterval(t);" +
+        "fs.appendFileSync('../runs.txt',n+'-end\\n');}},20);"
+    );
+    configure?.(created);
+  });
+}
+
+interface IServedScript {
+  readonly exchange: Promise<ITerminalExchange>;
+  readonly settled: () => boolean;
+}
+
+async function serveAsync(fixture: DaemonGraphTestFixture): Promise<IServedScript> {
+  let settled: boolean = false;
+  const exchange: Promise<ITerminalExchange> = fixture
+    .runAsync(['serve'], {
+      commandOrigin: 'custom',
+      invocationKind: 'rushx',
+      cwd: path.join(fixture.folder, 'a')
+    })
+    .finally(() => {
+      settled = true;
+    });
+  await waitForAsync(() => fixture.runs().includes('serve-start') || settled, 'the served script to start');
+  expect(settled).toBe(false);
+  return { exchange, settled: () => settled };
+}
+
+interface IStreamedRequest {
+  readonly exchange: Promise<ITerminalExchange>;
+  /** The queue positions that the daemon has reported so far. */
+  readonly positions: ReadonlyArray<number>;
+  readonly settled: () => boolean;
+}
+
+/** Starts a request, recording its queue positions as they arrive. */
+async function startRequestAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope>
+): Promise<IStreamedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const payload: IDaemonRequestEnvelope = fixture.envelope(argv, overrides);
+  await client.sendControlAsync({ kind: 'requestStart', payload });
+  const positions: number[] = [];
+  let settled: boolean = false;
+  const readAsync = async (): Promise<ITerminalExchange> => {
+    const frames: IDaemonFrame[] = [];
+    try {
+      for (;;) {
+        const frame: IDaemonFrame = await client.readFrameAsync();
+        frames.push(frame);
+        if (frame.kind !== DaemonFrameType.controlJson) continue;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'queuePosition') positions.push(message.payload.position);
+        if (message.kind === 'requestResult' && message.payload.requestId === payload.requestId) {
+          return { frames, terminal: message };
+        }
+      }
+    } finally {
+      settled = true;
+      await client.closeAsync();
+    }
+  };
+  const exchange: Promise<ITerminalExchange> = readAsync();
+  // A failed expectation leaves the exchange unread until the fixture closes the connection.
+  exchange.catch(() => undefined);
+  return { exchange, positions, settled: () => settled };
+}
+
+function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
+  const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+  const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+}
+
+describe('workspace admission while a served rushx script runs', () => {
+  it('admits a reload-needing build at once and keeps the script running', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync();
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeProjectConfiguration(fixture);
+      // The reload used to wait for #gate until the script exited (#113).
+      expectSuccess(await fixture.runAsync(BUILD_A, { admission: { waitTimeoutMs: 3000 } }));
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect(fixture.runs().slice(-1)).toEqual(['serve-end']);
+    } finally {
+      // A failed expectation must not leave the script running, which would keep the fixture from shutting down.
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('keeps a native install waiting for the script, which would end with this process', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The install is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const install: ITerminalExchange = await fixture.runAsync(['install'], {
+        admission: { waitTimeoutMs: 500 }
+      });
+      expect(install.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage: expect.stringContaining(
+            'within its 500ms wait timeout while waiting for a rushx script that this daemon runs to exit.'
+          )
+        }
+      });
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect(fixture.runs().slice(-1)).toEqual(['serve-end']);
+      // The refused install left the workspace serving builds.
+      expectSuccess(await fixture.runAsync(BUILD_A));
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('restarts for a changed environment only after the script exits', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      let restartSettled: boolean = false;
+      const restart: Promise<ITerminalExchange> = fixture
+        .runAsync(BUILD_A, { environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' } })
+        .finally(() => {
+          restartSettled = true;
+        });
+      await delayAsync(1000);
+      // The script keeps its restart ticket after it releases #gate, so the restart still drains it (#198).
+      expect(restartSettled).toBe(false);
+      expect(script.settled()).toBe(false);
+      expect(fixture.host.workspaceStatus.lastReloadTier).not.toBe(WorkspaceInputChangeTier.Restart);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect(fixture.runs().slice(-1)).toEqual(['serve-end']);
+      expect((await restart).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      try {
+        await fixture.host.closeAsync();
+        await fixture.host.restartCompleted;
+      } finally {
+        await stopSuccessorAsync(fixture.host.paths);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  });
+
+  it('has a script that arrives while a restart is pending run on the successor, without delaying the restart', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const restart: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+      });
+      await waitForAsync(
+        () => restart.positions.length > 0 || restart.settled(),
+        'the restart to wait for the served script'
+      );
+      const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
+        commandOrigin: 'custom',
+        invocationKind: 'rushx',
+        cwd: path.join(fixture.folder, 'a')
+      });
+      await waitForAsync(
+        () => late.positions.length > 0 || late.settled() || fixture.runs().includes('serve2-start'),
+        'the later script to wait for the restart'
+      );
+      // The later script used to start and keep the restart waiting until it exited (#96).
+      expect(fixture.runs()).not.toContain('serve2-start');
+      // It waits for the served script and the restart.
+      expect(late.positions).toEqual([2]);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      // The restart does not wait for the later script, which is told to run on the successor.
+      for (const exchange of await Promise.all([restart.exchange, late.exchange])) {
+        expect(exchange.terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, retryAfterRestart: true }
+        });
+      }
+      expect(late.positions).toEqual([2, 1]);
+      expect(fixture.runs()).not.toContain('serve2-start');
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      try {
+        await fixture.host.closeAsync();
+        await fixture.host.restartCompleted;
+      } finally {
+        await stopSuccessorAsync(fixture.host.paths);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  });
+});

From 8f52b6880d0262e1a3fc432d39d9a5f1601d9272 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Mon, 28 Sep 2026 23:47:30 +0000
Subject: [PATCH 045/265] [rush-daemon] A warm-set pass takes the repository
 lock only when it has work

Swarm integration step 30; original commit a4de651852 (merge of swarm/r07-t76 at 6b32aa340e).
Scope: task 76.

Brings r07's task 76 (board 1730; o05 CONFIRMED board 1904). A warm-set maintenance pass takes the native repository lease only when it has something to evict, a watcher change to apply, or a failed observation to retry. An idle daemon no longer takes common/temp/rush#<pid>.lock every 30 s, and a native command that holds the lock no longer puts the warm set in 'native-busy'. Two commits: 40a9f8f5eb (product) and 6b32aa340e (tests for the two lease exemptions a pass relies on).

ch01 on tree fe0b6a452a (board 2511): rush-daemon 549/0 (544 + 5 new tests). The old WorkspaceWarmSet.ts fails exactly the 5 new tests. 15 of 16 WorkspaceWarmSet.ts mutants are killed; B6 (no protected check in #shouldEvict) survives and is a test NIT. E2E on ch01's own daemons: 0 lock holds in 150 s idle (5 before), 0 daemon lock attempts while native holds the lock 40 s (12 before, with 'native-busy').

Gate: ch01 GATE OK board 2511 (tree fe0b6a452a)

Commits folded into this step (2):
- 40a9f8f5eb [rush-daemon] Warm set: take the repository lock only for a maintenance pass that has work
- 6b32aa340e [rush-daemon] Warm set: test the two lease exemptions a pass relies on

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ase-only-when-needed_2026-09-28-18-45.json |  10 +
 libraries/rush-daemon/src/WorkspaceWarmSet.ts |  69 ++++--
 .../src/test/WorkspaceWarmQuiescence.test.ts  |   2 +
 .../src/test/WorkspaceWarmSet.test.ts         |  20 ++
 .../WorkspaceWarmSetMaintenanceCost.test.ts   | 202 +++++++++++++++++-
 5 files changed, 278 insertions(+), 25 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/warm-set-lease-only-when-needed_2026-09-28-18-45.json

diff --git a/common/changes/@rushstack/rush-daemon/warm-set-lease-only-when-needed_2026-09-28-18-45.json b/common/changes/@rushstack/rush-daemon/warm-set-lease-only-when-needed_2026-09-28-18-45.json
new file mode 100644
index 0000000000..984ea21e0e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/warm-set-lease-only-when-needed_2026-09-28-18-45.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Warm set: an idle maintenance pass takes the repository lock only when it releases warm resources or changes project observation, so native Rush commands no longer fail with \"Another Rush command is already running\" because of a pass that has nothing to do.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 0be59f2249..6f1bfd9527 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -288,12 +288,17 @@ export class WorkspaceWarmSet implements AsyncDisposable {
         } else if (isGraphBusy(graph)) {
           this.#deferredReason = 'graph-busy';
         } else {
-          nativeLease = await this.#options.acquireExecutionLeaseAsync();
-          if (this.#disposed) this.#deferredReason = 'disposed';
-          else if (isGraphBusy(graph)) this.#deferredReason = 'graph-busy';
-          else {
-            await this.#evictIdleAsync();
-            if (!this.#disposed) await this.#reconcileWatcherPolicyAsync();
+          const status: IWorkspaceWarmSetStatus = this.getStatus();
+          // Native Rush commands can't start while the repository lock is held, so a pass that would neither
+          // release anything nor change project observation doesn't take it.
+          if (this.#needsNativeLease(status)) {
+            nativeLease = await this.#options.acquireExecutionLeaseAsync();
+            if (this.#disposed) this.#deferredReason = 'disposed';
+            else if (isGraphBusy(graph)) this.#deferredReason = 'graph-busy';
+            else {
+              await this.#evictIdleAsync(status);
+              if (!this.#disposed) await this.#reconcileWatcherPolicyAsync();
+            }
           }
         }
       }
@@ -353,30 +358,48 @@ export class WorkspaceWarmSet implements AsyncDisposable {
     this.#diagnose(this.#watcherPolicyFailure);
   }
 
-  async #evictIdleAsync(): Promise<void> {
+  /** Whether a pass must own the repository to release resources or to apply the observation policy. */
+  #needsNativeLease(status: IWorkspaceWarmSetStatus): boolean {
+    if (this.#watcherPolicyFailure) return true;
+    const projects: IWarmProject[] = this.#rankProjects();
+    if (projects.some((project) => this.#shouldEvict(project, status))) return true;
+    const watched: ReadonlySet<string> = this.#options.watcher.watchedProjectNames;
+    // The same projects that #reconcileWatcherPolicyAsync observes or stops observing.
+    return this.#configuration.watch
+      ? projects.some((project) => !this.#cleanupFailures.has(project.key) && !watched.has(project.key))
+      : projects.some((project) => !project.protected && watched.has(project.key));
+  }
+
+  #shouldEvict(project: IWarmProject, status: IWorkspaceWarmSetStatus): boolean {
+    if (project.protected) return false;
+    const graph: IOperationGraph = this.#options.operationGraph;
+    const expired: boolean =
+      performance.now() - project.lastUsed >= this.#configuration.warmIdleTimeoutSeconds * 1000;
+    const unrequested: boolean =
+      project.frequency === 0 &&
+      project.operations.every(
+        (operation) => !graph.resultByOperation.has(operation) && !operation.runner?.isActive
+      );
+    // Idle expiry and every limit release runners and watchers, and finish an eviction that failed earlier.
+    // Otherwise the retained results of a resource-free project stay until the generation ends: they are
+    // revalidated on every request, they are what makes a warm no-op skip possible, and dropping them cannot
+    // bring daemon RSS below the budget.
+    return (
+      unrequested ||
+      (this.#mayRelease(project) && (expired || status.overMemoryBudget || status.overProjectLimit))
+    );
+  }
+
+  async #evictIdleAsync(initialStatus: IWorkspaceWarmSetStatus): Promise<void> {
     const { operationGraph: graph, watcher } = this.#options;
     // getStatus() re-ranks every project. Only an eviction attempt (which awaits) can change it during a pass, so
     // it is reused until then; recomputing it per project made a pass without evictions quadratic.
-    let currentStatus: IWorkspaceWarmSetStatus | undefined;
+    let currentStatus: IWorkspaceWarmSetStatus | undefined = initialStatus;
     // Retention and eviction use exactly the same ordering, reversed only to release the lowest value first.
     for (const project of this.#rankProjects().reverse()) {
       if (this.#disposed) break;
       if (project.protected) continue;
-      const status: IWorkspaceWarmSetStatus = (currentStatus ??= this.getStatus());
-      const expired: boolean =
-        performance.now() - project.lastUsed >= this.#configuration.warmIdleTimeoutSeconds * 1000;
-      const unrequested: boolean =
-        project.frequency === 0 &&
-        project.operations.every(
-          (operation) => !graph.resultByOperation.has(operation) && !operation.runner?.isActive
-        );
-      // Idle expiry and every limit release runners and watchers, and finish an eviction that failed earlier.
-      // Otherwise the retained results of a resource-free project stay until the generation ends: they are
-      // revalidated on every request, they are what makes a warm no-op skip possible, and dropping them cannot
-      // bring daemon RSS below the budget.
-      const release: boolean =
-        this.#mayRelease(project) && (expired || status.overMemoryBudget || status.overProjectLimit);
-      if (!unrequested && !release) continue;
+      if (!this.#shouldEvict(project, (currentStatus ??= this.getStatus()))) continue;
       try {
         await graph.closeRunnersAsync(project.operations);
         if (project.operations.some((operation) => operation.runner?.isActive)) {
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts
index ef688c54dd..a0e1a6f78e 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmQuiescence.test.ts
@@ -269,6 +269,8 @@ describe('warm-set generation barriers', () => {
     });
     await session.initializeEngineAsync(async () => engine);
     try {
+      // Observation of a project that was never requested is released, so this pass takes the native lease.
+      watcher.watchProjects(['a']);
       await warm.maintainAsync();
       expect(warm.getStatus()).toMatchObject({
         maintenanceState: 'failed',
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index 8f3d81c702..ee7c972e8e 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -393,6 +393,26 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(graph.resultByOperation.size).toBe(0);
   });
 
+  it('leaves the real repository lock to a native CLI command in a pass that has nothing to release', async () => {
+    const { fixture, warm, graph, watcher } = await startAsync();
+    const acquire = jest.spyOn(fixture.session, 'acquireExecutionLeaseAsync');
+    const gate = await createNativeScriptGateAsync(fixture.folder, 'c');
+    const native = runNativeCommandAsync(fixture.folder, ['build', '--only', 'c', '--parallelism', '3']);
+    try {
+      await gate.entered;
+      const status = await warm.maintainAsync();
+      expect(status.deferredReason).toBeUndefined();
+      expect(acquire).not.toHaveBeenCalled();
+      expect(graph.resultByOperation.size).toBe(2);
+      expect([...watcher.watchedProjectNames].sort()).toEqual(['a', 'b']);
+    } finally {
+      await gate.releaseAsync();
+      acquire.mockRestore();
+      await native;
+    }
+    expect((await native).exitCode).toBe(0);
+  });
+
   it('does not touch paused prepared records or native ownership until a plan has been discarded', async () => {
     const { fixture, warm, graph } = await startAsync();
     const admission = await getWorkspaceRequestScheduler(fixture.session).acquireAsync({
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
index b9d42c040c..f8ee0fa972 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
@@ -12,6 +12,7 @@ import type { RequestScheduler } from '../RequestScheduler';
 import type { WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
 import {
   WorkspaceWarmSet,
+  type IWorkspaceWarmSetOptions,
   type IWorkspaceWarmSetStatus,
   type WorkspaceWarmSetConfiguration
 } from '../WorkspaceWarmSet';
@@ -86,7 +87,8 @@ function createGraph(projectCount: number): ITestGraph {
 
 function attach(
   graph: IOperationGraph,
-  configuration: Partial<WorkspaceWarmSetConfiguration> = {}
+  configuration: Partial<WorkspaceWarmSetConfiguration> = {},
+  options: Partial<IWorkspaceWarmSetOptions> = {}
 ): WorkspaceWarmSet {
   return WorkspaceWarmSet.attach({
     operationGraph: graph,
@@ -97,10 +99,54 @@ function attach(
       watchedProjectNames: new Set<string>(),
       watchProjects: () => undefined,
       unwatchProjectsAsync: async () => undefined
-    } as unknown as WorkspaceSessionFileWatcher
+    } as unknown as WorkspaceSessionFileWatcher,
+    ...options
   });
 }
 
+interface ITestWatcher {
+  readonly watcher: WorkspaceSessionFileWatcher;
+  readonly watched: Set<string>;
+  readonly failNextWatch: () => void;
+}
+
+function createWatcher(): ITestWatcher {
+  const watched: Set<string> = new Set();
+  let fail: boolean = false;
+  const watcher: WorkspaceSessionFileWatcher = {
+    get watchedProjectNames(): ReadonlySet<string> {
+      return new Set(watched);
+    },
+    watchProjects: (projectNames: Iterable<string>): void => {
+      if (fail) {
+        fail = false;
+        throw new Error('watch failed');
+      }
+      for (const name of projectNames) watched.add(name);
+    },
+    unwatchProjectsAsync: async (projectNames: Iterable<string>): Promise<void> => {
+      for (const name of projectNames) watched.delete(name);
+    }
+  } as unknown as WorkspaceSessionFileWatcher;
+  return {
+    watcher,
+    watched,
+    failNextWatch: () => {
+      fail = true;
+    }
+  };
+}
+
+function createLease(): jest.Mock<Promise<AsyncDisposable>, []> {
+  return jest.fn(async () => ({ [Symbol.asyncDispose]: async () => undefined }));
+}
+
+async function settleAsync(warm: WorkspaceWarmSet): Promise<void> {
+  // Lets the passes scheduled by attachment and by a simulated request finish.
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  await warm.maintainAsync();
+}
+
 function createResidentRunner(): IOperationRunner {
   let active: boolean = true;
   return {
@@ -173,4 +219,156 @@ describe('warm-set maintenance cost', () => {
     expect(evicted.every((operation) => operation.runner?.isActive === false)).toBe(true);
     expect(graph.resultByOperation.size).toBe(38);
   });
+
+  it('takes the native repository lease only for a pass that releases resources or stops observing a project', async () => {
+    const { graph, operations, requestAll } = createGraph(10);
+    const { watcher, watched } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { warmSetMaxProjects: 3 },
+      { watcher, acquireExecutionLeaseAsync: acquire }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    acquire.mockClear();
+
+    // Retained results with nothing to release: native Rush commands can take the repository lock meanwhile.
+    const idle: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+    expect(idle.deferredReason).toBeUndefined();
+    expect(idle.retainedProjectNames).toHaveLength(10);
+
+    // With daemon.watch off, a remaining project watcher is closed under the lease.
+    watched.add('p3');
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(1);
+    expect(watched.size).toBe(0);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(1);
+
+    // Resource holders over the project cap are released under the lease.
+    for (const operation of operations.slice(0, 5)) operation.runner = createResidentRunner();
+    const evicted: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+    expect(evicted.overProjectLimit).toBe(false);
+    expect(operations.filter((operation) => operation.runner?.isActive)).toHaveLength(3);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+  });
+
+  it('takes the native repository lease to observe a requested project again and to clear an observation failure', async () => {
+    const { graph, requestAll } = createGraph(4);
+    const { watcher, watched, failNextWatch } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const diagnostics: string[] = [];
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { watch: true },
+      {
+        watcher,
+        acquireExecutionLeaseAsync: acquire,
+        onDiagnostic: (error: Error) => diagnostics.push(error.message)
+      }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    expect(watched.size).toBe(4);
+    acquire.mockClear();
+    await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+
+    watched.delete('p1');
+    failNextWatch();
+    const failed: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(1);
+    expect(failed.cleanupFailures).toEqual([expect.stringContaining('watch failed')]);
+    expect(watched.has('p1')).toBe(false);
+
+    const recovered: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+    expect(recovered.cleanupFailures).toEqual([]);
+    expect(watched.has('p1')).toBe(true);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(2);
+
+    // A request observes its projects again, but the reported failure is cleared only by a maintenance pass.
+    watched.delete('p2');
+    failNextWatch();
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(3);
+    requestAll();
+    expect(watched.size).toBe(4);
+    const cleared: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(4);
+    expect(cleared.cleanupFailures).toEqual([]);
+    await warm.maintainAsync();
+    expect(acquire).toHaveBeenCalledTimes(4);
+    expect(diagnostics).toEqual([
+      expect.stringContaining('watch failed'),
+      expect.stringContaining('watch failed')
+    ]);
+  });
+
+  it('takes no native repository lease for a project that daemon.watch leaves unobserved after its eviction failed', async () => {
+    const { graph, requestAll } = createGraph(4);
+    const { watcher, watched } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const diagnostics: string[] = [];
+    // The eviction stops observing the project, then fails to drop its results.
+    graph.deleteResults = () => {
+      throw new Error('delete failed');
+    };
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { watch: true, warmSetMaxProjects: 3 },
+      {
+        watcher,
+        acquireExecutionLeaseAsync: acquire,
+        onDiagnostic: (error: Error) => diagnostics.push(error.message)
+      }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    expect(watched.size).toBe(3);
+    expect(diagnostics).toEqual([expect.stringContaining('Could not evict warm project')]);
+    acquire.mockClear();
+
+    // daemon.watch doesn't observe a project whose eviction failed again, so a pass has nothing to apply
+    const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+    expect(status.cleanupFailures).toEqual([expect.stringContaining('delete failed')]);
+    expect(status.retainedProjectNames).toHaveLength(4);
+    expect(watched.size).toBe(3);
+    expect(diagnostics).toHaveLength(1);
+  });
+
+  it('takes no native repository lease for a protected project that stays observed with daemon.watch off', async () => {
+    const { graph, operations, requestAll } = createGraph(4);
+    const { watcher, watched } = createWatcher();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      {},
+      {
+        watcher,
+        acquireExecutionLeaseAsync: acquire,
+        getProtectedOperations: () => new Set([operations[0]])
+      }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    watched.add('p0');
+    acquire.mockClear();
+
+    // daemon.watch off stops observing only the projects that aren't protected
+    const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+    expect(acquire).not.toHaveBeenCalled();
+    expect(status.protectedProjectNames).toEqual(['p0']);
+    expect(watched.has('p0')).toBe(true);
+  });
 });

From 3821da01653e66dd053e4e56ee23ed99ebde5718 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 00:09:37 +0000
Subject: [PATCH 046/265] [node-core-library] A leftover LockFile whose pid now
 belongs to an older process is deleted

Swarm integration step 31; original commit 02087b3f11 (merge of o07/lockfile-tzrule at d5e74b1813).
Scope: task 121.

Brings o07's task 121 (board 1815, re-tipped in board 1949; t05 CONFIRMED board 1923 on faa7675fa6). A rush#<pid>.lock whose pid has been reused by a live process that started before the file was written no longer blocks every command until that process exits. The lock file keeps its holder only if the recorded start time matches the live process's start time in some real time zone, and on Linux that start time is read from /proc instead of spawning ps. Four commits: 595f8f63c7 (the time zone rule), faa7675fa6 (/proc start time for another time zone or locale), 315e1eae81 (ch04's test for a process that started after the file) and d5e74b1813 (t05's note that a clock change can make a start time fail the rule).

ch01 on tree 73696a280a (board 2566): build rc 0 with 0 warnings, rush-daemon 549/0; on b10e8c53e0 node-core-library 329/0 (318 + 11 new tests) and rush-client-core 129/0. The new tests fail 7 times on the old LockFile.ts. 21 LockFile.ts mutants, 16 killed; the 5 survivors are 4 test NITs and one equivalent. E2E with 12 live holders in other time zones and locales: all kept, with 0 ps calls after the first attempt (1.2-7 ms per attempt, against 410-520 ms before); the stale files (pid 1 at +7 min, pid 1 with a 2024 start time, a predating process at +3 min) are now deleted.

Gate: ch01 GATE OK board 2566 (tree 73696a280a)

Commits folded into this step (4):
- 595f8f63c7 [node-core-library] Keep a mismatched LockFile only if its start time is in some time zone
- faa7675fa6 [node-core-library] Read the start time from /proc for a LockFile with another time zone or locale
- 315e1eae81 [node-core-library] Test a LockFile whose PID started after the file, with a start time in another time zone
- d5e74b1813 [node-core-library] Note that a clock change can make a LockFile's start time fail the time zone check

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../lockfile-proc-start-time_2026-09-28.json  |   2 +-
 ...lockfile-start-time-locale_2026-09-28.json |   2 +-
 libraries/node-core-library/src/LockFile.ts   |  93 +++++++--
 .../src/test/LockFile.test.ts                 | 183 +++++++++++++++++-
 4 files changed, 259 insertions(+), 21 deletions(-)

diff --git a/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json b/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json
index e06b6e046b..f8abc83d11 100644
--- a/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json
+++ b/common/changes/@rushstack/node-core-library/lockfile-proc-start-time_2026-09-28.json
@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@rushstack/node-core-library",
-      "comment": "Make `LockFile` on Linux much faster when other processes hold or wait for the same lock. It now confirms that another process's lockfile is valid by reading /proc, instead of running a `ps` command for each lockfile on each attempt.",
+      "comment": "Make `LockFile` on Linux much faster when other processes hold or wait for the same lock. It now confirms that another process's lockfile is valid by reading /proc, instead of running a `ps` command for each lockfile on each attempt. This also works when the other process has a different time zone or locale.",
       "type": "patch"
     }
   ],
diff --git a/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json b/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json
index 0c02c7c84f..5901dd4255 100644
--- a/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json
+++ b/common/changes/@rushstack/node-core-library/lockfile-start-time-locale_2026-09-28.json
@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@rushstack/node-core-library",
-      "comment": "Fix `LockFile` on Linux and macOS deleting the lockfile of a running process, and granting the lock again, when that process has a different time zone or locale. A lockfile whose start time doesn't match is now kept if its process started before the lockfile was created.",
+      "comment": "Fix `LockFile` on Linux and macOS deleting the lockfile of a running process, and granting the lock again, when that process has a different time zone or locale. A lockfile whose start time doesn't match is now kept if its process started before the lockfile was created, and if the two start times differ by a time zone offset or the lockfile's start time is in the format of another locale.",
       "type": "patch"
     }
   ],
diff --git a/libraries/node-core-library/src/LockFile.ts b/libraries/node-core-library/src/LockFile.ts
index ea39a31b97..881287ff34 100644
--- a/libraries/node-core-library/src/LockFile.ts
+++ b/libraries/node-core-library/src/LockFile.ts
@@ -179,11 +179,17 @@ export function getProcessStartTimeMs(pid: number): number | undefined {
     env: { ...process.env, LC_ALL: 'C', TZ: 'UTC0' }
   });
 
-  // For example: "Sun Sep 27 17:15:08 2026"
+  return _parseLstartAsUtcMs((psResult.stdout || '').split('\n')[1] || '');
+}
+
+/**
+ * Parses a start time that "ps -o lstart" printed with the C locale, for example "Sun Sep 27 17:15:08 2026",
+ * as if it were in UTC.  Returns the time in milliseconds since the epoch, or undefined if the text has another
+ * format, such as the format of another locale.
+ */
+function _parseLstartAsUtcMs(lstart: string): number | undefined {
   const match: RegExpExecArray | null =
-    /^\s*[A-Za-z]{3} ([A-Za-z]{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})\s*$/.exec(
-      (psResult.stdout || '').split('\n')[1] || ''
-    );
+    /^\s*[A-Za-z]{3} ([A-Za-z]{3}) +(\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})\s*$/.exec(lstart);
   if (!match) {
     return undefined;
   }
@@ -233,6 +239,11 @@ export interface ILinuxProcessStartTime {
    * "ps" can't be run.
    */
   ticks: string;
+  /**
+   * The start time in milliseconds since the epoch, rounded down to a whole second like lstart.  This is what
+   * getProcessStartTimeMs() returns, and it doesn't depend on the time zone.
+   */
+  startTimeMs: number;
 }
 
 /**
@@ -267,16 +278,16 @@ export function getLinuxProcessStartTime(
   }
 
   // Like "ps", round down to a whole second and use "%a %b %e %H:%M:%S %Y" in the local time zone.
-  const date: Date = new Date(
-    (getBootTimeSeconds() + Math.floor(Number(ticks) / LINUX_CLOCK_TICKS_PER_SECOND)) * 1000
-  );
+  const startTimeMs: number =
+    (getBootTimeSeconds() + Math.floor(Number(ticks) / LINUX_CLOCK_TICKS_PER_SECOND)) * 1000;
+  const date: Date = new Date(startTimeMs);
   const twoDigits: (value: number) => string = (value: number) => (value < 10 ? `0${value}` : `${value}`);
   const lstart: string =
     `${LSTART_DAYS[date.getDay()]} ${LSTART_MONTHS[date.getMonth()]} ` +
     `${date.getDate() < 10 ? ' ' : ''}${date.getDate()} ` +
     `${twoDigits(date.getHours())}:${twoDigits(date.getMinutes())}:${twoDigits(date.getSeconds())} ` +
     `${date.getFullYear()}`;
-  return { lstart, ticks };
+  return { lstart, ticks, startTimeMs };
 }
 
 // A set of locks that currently exist in the current process, to be used when
@@ -589,6 +600,36 @@ function _tryAcquireInner(
 // seconds, and the system clock can be adjusted while a process runs.
 const START_TIME_TOLERANCE_MS: number = 5000;
 
+// Every time zone is ahead of or behind UTC by a whole number of 15-minute steps, from UTC-12 to UTC+14.
+const TIME_ZONE_OFFSET_STEP_MS: number = 15 * 60 * 1000;
+const MIN_TIME_ZONE_OFFSET_MS: number = -12 * 60 * 60 * 1000;
+const MAX_TIME_ZONE_OFFSET_MS: number = 14 * 60 * 60 * 1000;
+
+/**
+ * Returns false if the start time in a lockfile can't be what "ps -o lstart" printed for a process that started
+ * at `startTimeMs`, in any time zone.  Returns true if it can, or if the start time is in a format other than the
+ * C locale's, which can't be checked.
+ *
+ * On Linux, the start time that "ps" reports for a process moves with the system clock.  So if the clock is
+ * changed by more than START_TIME_TOLERANCE_MS while a process holds a lock, this can return false for the
+ * lockfile of that process, which is then treated as stale.
+ */
+function _isStartTimeInSomeTimeZone(lockFileStartTime: string, startTimeMs: number): boolean {
+  const lockFileStartTimeMs: number | undefined = _parseLstartAsUtcMs(lockFileStartTime);
+  if (lockFileStartTimeMs === undefined) {
+    return true;
+  }
+  const offsetMs: number = lockFileStartTimeMs - startTimeMs;
+  if (
+    offsetMs < MIN_TIME_ZONE_OFFSET_MS - START_TIME_TOLERANCE_MS ||
+    offsetMs > MAX_TIME_ZONE_OFFSET_MS + START_TIME_TOLERANCE_MS
+  ) {
+    return false;
+  }
+  const stepOffsetMs: number = Math.round(offsetMs / TIME_ZONE_OFFSET_STEP_MS) * TIME_ZONE_OFFSET_STEP_MS;
+  return Math.abs(offsetMs - stepOffsetMs) <= START_TIME_TOLERANCE_MS;
+}
+
 /**
  * Called when the start time in the lockfile of another running process differs from the start time that
  * we got for its PID.  Returns true if the lockfile still belongs to that process.
@@ -601,13 +642,19 @@ function _isLockFileOfRunningProcess(
   // "ps -o lstart" formats the start time using the time zone and locale of the process that runs it,
   // so a process whose TZ, LANG, LC_TIME or LC_ALL differs from ours wrote its start time differently.
   // If the start time differs because the lockfile's process exited and the OS gave its PID to a new
-  // process, then the new process started after the lockfile was created.  An empty lockfile is still
-  // treated as stale here, as before.
+  // process, then the new process usually started after the lockfile was created.  It can have started
+  // before, if the lockfile was copied or restored, or if a process in another PID namespace (such as a
+  // container) wrote it.  So the lockfile must also hold the process's start time in some time zone.
+  // An empty lockfile is still treated as stale here, as before.
   if (!lockFileStartTime || lockFileBirthtimeMs === undefined) {
     return false;
   }
   const startTimeMs: number | undefined = getProcessStartTimeMs(parseInt(pid, 10));
-  return startTimeMs !== undefined && startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS;
+  return (
+    startTimeMs !== undefined &&
+    startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS &&
+    _isStartTimeInSomeTimeZone(lockFileStartTime, startTimeMs)
+  );
 }
 
 /**
@@ -619,6 +666,7 @@ function _isLockFileOfRunningProcess(
 function _isLockFileOfLinuxProcess(
   pid: string,
   lockFileStartTime: string | undefined,
+  lockFileBirthtimeMs: number | undefined,
   getBootTimeSeconds: () => number
 ): boolean {
   if (process.platform !== 'linux' || !lockFileStartTime) {
@@ -631,11 +679,19 @@ function _isLockFileOfLinuxProcess(
     // For example, /proc isn't mounted, or it doesn't let us read the files of this process.
     return false;
   }
-  // These are the formats that getProcessStartTime() returns.  If the other process wrote its start time with a
-  // locale other than C, the caller runs "ps".
+  if (startTime === undefined) {
+    return false;
+  }
+  // These are the formats that getProcessStartTime() returns.
+  if (lockFileStartTime === startTime.lstart || lockFileStartTime === startTime.ticks) {
+    return true;
+  }
+  // The other process may have written its start time with another time zone or locale.  This is the check
+  // that _isLockFileOfRunningProcess() makes after running "ps" twice, with the start time from /proc.
   return (
-    startTime !== undefined &&
-    (lockFileStartTime === startTime.lstart || lockFileStartTime === startTime.ticks)
+    lockFileBirthtimeMs !== undefined &&
+    startTime.startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS &&
+    _isStartTimeInSomeTimeZone(lockFileStartTime, startTime.startTimeMs)
   );
 }
 
@@ -799,12 +855,13 @@ function _tryAcquireMacOrLinuxOnce(
         // console.log(`Other pid ${otherPid} lockfile has start time: "${otherPidOldStartTime}"`);
 
         // Actual start time of the other PID.  On Linux, /proc usually shows that the file belongs to the
-        // process with that PID, and then we don't need to run "ps", which is slow when there are many
-        // processes.  When many processes wait for the same lock, each of their attempts checks the file
-        // of every other process.
+        // process with that PID, even if that process has another time zone or locale, and then we don't need
+        // to run "ps", which is slow when there are many processes.  When many processes wait for the same
+        // lock, each of their attempts checks the file of every other process.
         const otherPidCurrentStartTime: string | undefined = _isLockFileOfLinuxProcess(
           otherPid,
           otherPidOldStartTime,
+          otherBirthtimeMs,
           getLinuxBootTime
         )
           ? otherPidOldStartTime
diff --git a/libraries/node-core-library/src/test/LockFile.test.ts b/libraries/node-core-library/src/test/LockFile.test.ts
index f9ea13aee2..bec5b86e03 100644
--- a/libraries/node-core-library/src/test/LockFile.test.ts
+++ b/libraries/node-core-library/src/test/LockFile.test.ts
@@ -687,6 +687,136 @@ describe(LockFile.name, () => {
           expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
         });
 
+        // Formats a time as "ps -o lstart" prints it with the C locale and TZ=UTC0, for example
+        // "Sun Sep 27 17:15:08 2026".
+        function formatLstartInUtc(timeMs: number): string {
+          const date: Date = new Date(timeMs);
+          const days: string[] = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+          const months: string[] = [
+            'Jan',
+            'Feb',
+            'Mar',
+            'Apr',
+            'May',
+            'Jun',
+            'Jul',
+            'Aug',
+            'Sep',
+            'Oct',
+            'Nov',
+            'Dec'
+          ];
+          const twoDigits: (value: number) => string = (value: number) => `${value}`.padStart(2, '0');
+          return (
+            `${days[date.getUTCDay()]} ${months[date.getUTCMonth()]} ${`${date.getUTCDate()}`.padStart(2, ' ')} ` +
+            `${twoDigits(date.getUTCHours())}:${twoDigits(date.getUTCMinutes())}:${twoDigits(date.getUTCSeconds())} ` +
+            `${date.getUTCFullYear()}`
+          );
+        }
+
+        // What the other process wrote if its time zone is offsetMs ahead of UTC
+        function getOtherPidStartTimeWithOffset(offsetMs: number): string {
+          const otherPidStartTimeMs: number | undefined = getProcessStartTimeMs(otherPid);
+          expect(otherPidStartTimeMs).toBeDefined();
+          return formatLstartInUtc(otherPidStartTimeMs! + offsetMs);
+        }
+
+        test.each<[string, string, number]>([
+          ['5 hours and 45 minutes ahead of UTC', '20', (5 * 60 + 45) * 60 * 1000],
+          ['12 hours behind UTC', '21', -12 * 60 * 60 * 1000],
+          ['7 hours behind UTC, printed 2 seconds off', '22', -7 * 60 * 60 * 1000 + 2000]
+        ])(
+          'cannot acquire a lock if the other process wrote its start time in a time zone %s',
+          (description: string, folderName: string, offsetMs: number) => {
+            const testFolder: string = path.join(libTestFolder, folderName);
+            const otherPidLockFileName: string = createOtherLockFile(
+              testFolder,
+              getOtherPidStartTimeWithOffset(offsetMs)
+            );
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeUndefined();
+            expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+          }
+        );
+
+        test.each<[string, string, number]>([
+          ['7 minutes after', '23', 7 * 60 * 1000],
+          ['25 hours after', '24', 25 * 60 * 60 * 1000],
+          ['13 hours before', '25', -13 * 60 * 60 * 1000]
+        ])(
+          'deletes the lockfile of a process that started before the lockfile if its start time is %s the start time of the process',
+          (description: string, folderName: string, offsetMs: number) => {
+            const testFolder: string = path.join(libTestFolder, folderName);
+            // No time zone is this far from UTC, so the lockfile was written by another process that had the same
+            // PID, for example in a container or before the lockfile was copied.
+            const otherPidLockFileName: string = createOtherLockFile(
+              testFolder,
+              getOtherPidStartTimeWithOffset(offsetMs)
+            );
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(true);
+            expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+            lock!.release();
+          }
+        );
+
+        test('deletes the lockfile of a process that started before the lockfile if its start time is from another year', () => {
+          const testFolder: string = path.join(libTestFolder, '26');
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Mon Jan  1 00:00:00 2024');
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
+        test('cannot acquire a lock if the other process wrote its start time in the format of another locale', () => {
+          const testFolder: string = path.join(libTestFolder, '27');
+          // Only the C locale's format can be compared with the start time of the process.
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Mo 28 Sep 2026 18:15:31');
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeUndefined();
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(true);
+        });
+
+        test('deletes the lockfile of a process that started after the lockfile, even if its start time is in another time zone', () => {
+          const testFolder: string = path.join(libTestFolder, '30');
+          // UTC+14, or UTC-12 if that is the local time zone
+          const otherTimeZone: string = new Date().getTimezoneOffset() === -840 ? 'XYZ+12' : 'XYZ-14';
+          const otherPidStartTime: string = child_process
+            .spawnSync('ps', ['-p', `${otherPid}`, '-o', 'lstart'], {
+              encoding: 'utf8',
+              env: { ...process.env, LC_ALL: 'C', TZ: otherTimeZone }
+            })
+            .stdout.split('\n')[1]
+            .trim();
+          const otherPidLockFileName: string = createOtherLockFile(testFolder, otherPidStartTime);
+          // The lockfile was created 1 minute before the process with its PID started.
+          const otherBirthtimeMs: number = getProcessStartTimeMs(otherPid)! - 60000;
+          const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+          jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+            return path.resolve(filePath) === otherPidLockFileName
+              ? ({ birthtime: new Date(otherBirthtimeMs) } as FileSystemStats)
+              : originalGetStatistics(filePath);
+          });
+
+          const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+          expect(lock).toBeDefined();
+          expect(lock!.dirtyWhenAcquired).toEqual(true);
+          expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+          lock!.release();
+        });
+
         test('deletes the lockfile if its PID now belongs to a process that started after the lockfile was created', () => {
           const testFolder: string = path.join(libTestFolder, '12');
           const otherPidLockFileName: string = createOtherLockFile(testFolder, 'Thu Jan  1 00:00:10 1970');
@@ -835,7 +965,8 @@ describe(LockFile.name, () => {
 
             expect(getLinuxProcessStartTime(12345, () => 1000000000)).toEqual({
               lstart: expectedLstart,
-              ticks: '250'
+              ticks: '250',
+              startTimeMs: 1000000002000
             });
             expect(expectedLstart).toMatch(/^[A-Z][a-z]{2} Sep {2}[89] \d\d:\d\d:\d\d 2001$/);
           });
@@ -966,6 +1097,56 @@ describe(LockFile.name, () => {
 
             expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
           });
+
+          test('does not run "ps" for them if they wrote their start times with other time zones or locales', () => {
+            const testFolder: string = path.join(libTestFolder, '28');
+            const otherPids: number[] = startProcesses(3);
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              (otherPid: number) => {
+                switch (otherPids.indexOf(otherPid)) {
+                  case 0:
+                    return getLstartWithCLocale(otherPid, 'XYZ-05:45');
+                  case 1:
+                    return getLstartWithCLocale(otherPid, 'XYZ+12');
+                  default:
+                    // The format of another locale
+                    return '28.09.2026 18:15:31';
+                }
+              }
+            );
+            const nativeChildProcess: typeof child_process = jest.requireActual('node:child_process');
+            const spawnSyncSpy: jest.SpyInstance = jest.spyOn(nativeChildProcess, 'spawnSync');
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            // "ps" ran only for the start time of this process.
+            expect(spawnSyncSpy).toHaveBeenCalledTimes(1);
+            expect(spawnSyncSpy.mock.calls[0][1]).toEqual(['-p', `${process.pid}`, '-o', 'lstart']);
+          });
+
+          test('runs "ps" for a lockfile whose start time is not the start time of its process in any time zone', () => {
+            const testFolder: string = path.join(libTestFolder, '29');
+            const otherPids: number[] = startProcesses(1);
+            // Another process that had the same PID wrote this lockfile.  It started 7 minutes after this process.
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              (otherPid: number) => getLstartWithCLocale(otherPid, 'XYZ-00:07')
+            );
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            // /proc never makes a lockfile stale, so "ps" decided it.
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(true);
+            expect(FileSystem.exists(otherPidLockFileNames[0])).toEqual(false);
+            lock!.release();
+          });
         });
 
         describe('when this process acquires locks again', () => {

From 1d1a2176b6889fe36478a32517fcbfa9793c324b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 00:09:42 +0000
Subject: [PATCH 047/265] [credential-cache] A credentials.json that isn't
 valid JSON no longer prints the stored SAS

Swarm integration step 32; original commit 0bef326909 (merge of swarm/r03-t143 at 92cbe2336e).
Scope: task 143.

Brings r03's task 143 (board 2316; t07 CONFIRMED board 2443 and board 2445). CredentialCache no longer rethrows JsonFile's parse error, which quoted jju's excerpt of the failing line, and in credentials.json that line holds the credential. The error now gives only the line and column and says the contents aren't shown because the file stores credentials. A missing file still gives undefined, other read errors are still wrapped as before, and schema errors are unchanged. The branch carries 08e26894e7 (task 101 part 1: compile the credentials file schema once) through r03's merge eae2fc9ad3, so tasks 101 and 143 merge in either order.

ch01 on 2c425fc4f5 (board 2576): build rc 0 with 0 warnings, credential-cache 34/0, azure plugin 10/0, http plugin 14/0, amazon-s3 plugin 52/0. The new tests fail exactly the three torn-file tests on eae2fc9ad3. 12 CredentialCache.ts mutants, 9 killed; the survivors are one equivalent and one test NIT (a read error other than ENOENT). E2E with a marker in the SAS: on the old engine a torn file printed the marker in the daemon, --no-daemon and update-cloud-credentials paths; now it is printed 0 times, and 11 of 20 outputs are byte-identical. Task 142 must land with or after this merge.

Gate: ch01 GATE OK board 2576 (tree 692db7d548 after task 121)

Commits folded into this step (2):
- 08e26894e7 [credential-cache] Compile the credentials file schema once per process
- 92cbe2336e [credential-cache] Don't quote the credentials file in its parse error (task 143)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...e-redact-parse-error_2026-09-28-22-44.json | 11 +++
 ...al-cache-schema-once_2026-09-28-21-50.json | 11 +++
 .../credential-cache/src/CredentialCache.ts   | 47 ++++++++--
 .../src/test/CredentialCache.test.ts          | 91 ++++++++++++++++++-
 4 files changed, 149 insertions(+), 11 deletions(-)
 create mode 100644 common/changes/@rushstack/credential-cache/credential-cache-redact-parse-error_2026-09-28-22-44.json
 create mode 100644 common/changes/@rushstack/credential-cache/credential-cache-schema-once_2026-09-28-21-50.json

diff --git a/common/changes/@rushstack/credential-cache/credential-cache-redact-parse-error_2026-09-28-22-44.json b/common/changes/@rushstack/credential-cache/credential-cache-redact-parse-error_2026-09-28-22-44.json
new file mode 100644
index 0000000000..8a9a25f96c
--- /dev/null
+++ b/common/changes/@rushstack/credential-cache/credential-cache-redact-parse-error_2026-09-28-22-44.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/credential-cache",
+      "comment": "When the credentials file is not valid JSON, report the line and column without quoting the file, because the quoted text can include a credential.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/credential-cache",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/credential-cache/credential-cache-schema-once_2026-09-28-21-50.json b/common/changes/@rushstack/credential-cache/credential-cache-schema-once_2026-09-28-21-50.json
new file mode 100644
index 0000000000..71788df859
--- /dev/null
+++ b/common/changes/@rushstack/credential-cache/credential-cache-schema-once_2026-09-28-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/credential-cache",
+      "comment": "Compile the JSON schema of the credentials file once per process, instead of each time the file is loaded.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/credential-cache",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/credential-cache/src/CredentialCache.ts b/libraries/credential-cache/src/CredentialCache.ts
index c7535b8187..7dc23b781d 100644
--- a/libraries/credential-cache/src/CredentialCache.ts
+++ b/libraries/credential-cache/src/CredentialCache.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { FileSystem, JsonFile, JsonSchema, LockFile, User, Objects } from '@rushstack/node-core-library';
@@ -15,6 +16,8 @@ export const RUSH_USER_FOLDER_NAME: '.rush-user' = '.rush-user';
 
 const DEFAULT_CACHE_FILENAME: 'credentials.json' = 'credentials.json';
 const LATEST_CREDENTIALS_JSON_VERSION: string = '0.1.0';
+// Shared so that the schema is compiled once, rather than on every load (about 5 ms each)
+const CREDENTIALS_JSON_SCHEMA: JsonSchema = JsonSchema.fromLoadedObject(schemaJson);
 
 interface ICredentialCacheJson {
   version: string;
@@ -29,6 +32,39 @@ interface ICacheEntryJson {
   credentialMetadata?: object;
 }
 
+/**
+ * Loads and validates the credentials file. Returns undefined if the file doesn't exist.
+ */
+async function loadCredentialsJsonAsync(cacheFilePath: string): Promise<ICredentialCacheJson | undefined> {
+  let contents: string;
+  try {
+    contents = await FileSystem.readFileAsync(cacheFilePath);
+  } catch (e) {
+    if (FileSystem.isNotExistError(e as Error)) {
+      return undefined;
+    }
+
+    throw new Error(`Error reading "${cacheFilePath}":${os.EOL}  ${(e as Error).message}`);
+  }
+
+  let credentialsJson: ICredentialCacheJson;
+  try {
+    credentialsJson = JsonFile.parseString(contents);
+  } catch (e) {
+    // Don't use the parser's message: it quotes the text around the problem, which can be a credential
+    const { row, column } = e as { row?: unknown; column?: unknown };
+    const position: string =
+      typeof row === 'number' && typeof column === 'number' ? ` (line ${row}, column ${column})` : '';
+    throw new Error(
+      `Error reading "${cacheFilePath}": the file is not valid JSON${position}. ` +
+        'Its contents are not shown because it stores credentials. Correct the file or delete it.'
+    );
+  }
+
+  CREDENTIALS_JSON_SCHEMA.validateObject(credentialsJson, cacheFilePath);
+  return credentialsJson;
+}
+
 /**
  * @public
  */
@@ -84,16 +120,7 @@ export class CredentialCache implements Disposable {
     }
     const cacheFilePath: string = `${cacheDirectory}/${cacheFileName}`;
 
-    const jsonSchema: JsonSchema = JsonSchema.fromLoadedObject(schemaJson);
-
-    let loadedJson: ICredentialCacheJson | undefined;
-    try {
-      loadedJson = await JsonFile.loadAndValidateAsync(cacheFilePath, jsonSchema);
-    } catch (e) {
-      if (!FileSystem.isErrnoException(e as Error)) {
-        throw e;
-      }
-    }
+    const loadedJson: ICredentialCacheJson | undefined = await loadCredentialsJsonAsync(cacheFilePath);
 
     let lockfile: LockFile | undefined;
     if (options.supportEditing) {
diff --git a/libraries/credential-cache/src/test/CredentialCache.test.ts b/libraries/credential-cache/src/test/CredentialCache.test.ts
index 5bdb13c49e..f8bbc6a764 100644
--- a/libraries/credential-cache/src/test/CredentialCache.test.ts
+++ b/libraries/credential-cache/src/test/CredentialCache.test.ts
@@ -2,11 +2,12 @@
 // See LICENSE in the project root for license information.
 
 import { mockGetHomeFolder } from './CredentialCache.mock';
-import { LockFile, Async, FileSystem } from '@rushstack/node-core-library';
+import { LockFile, Async, FileSystem, JsonFile, JsonSchema } from '@rushstack/node-core-library';
 import { CredentialCache, type ICredentialCacheOptions, RUSH_USER_FOLDER_NAME } from '../CredentialCache';
 
 const FAKE_HOME_FOLDER: string = 'temp';
 const FAKE_RUSH_USER_FOLDER: string = `${FAKE_HOME_FOLDER}/${RUSH_USER_FOLDER_NAME}`;
+const FAKE_SAS: string = 'sv=2025-01-05&sp=rwl&sig=FAKESIGNATURE0123';
 
 interface IPathsTestCase extends Required<Pick<ICredentialCacheOptions, 'cacheFilePath'>> {
   testCaseName: string;
@@ -392,4 +393,92 @@ describe(CredentialCache.name, () => {
       `"This instance of CredentialCache does not support editing."`
     );
   });
+
+  it('validates every load with the same schema object, so the schema is compiled once', async () => {
+    fakeFilesystem[`${FAKE_RUSH_USER_FOLDER}/credentials.json`] = JSON.stringify({
+      version: '0.1.0',
+      cacheEntries: {}
+    });
+    const validateObjectSpy: jest.SpyInstance = jest.spyOn(JsonSchema.prototype, 'validateObject');
+
+    for (let i: number = 0; i < 2; i++) {
+      const credentialCache: CredentialCache = await CredentialCache.initializeAsync({
+        supportEditing: false
+      });
+      credentialCache.dispose();
+    }
+
+    expect(validateObjectSpy).toHaveBeenCalledTimes(2);
+    expect(validateObjectSpy.mock.instances[1]).toBe(validateObjectSpy.mock.instances[0]);
+    validateObjectSpy.mockRestore();
+  });
+
+  describe('a credentials file that is not valid JSON', () => {
+    const cacheFilePath: string = `${FAKE_RUSH_USER_FOLDER}/credentials.json`;
+    const validJson: string = JSON.stringify(
+      {
+        version: '0.1.0',
+        cacheEntries: {
+          'test-credential': {
+            expires: 0,
+            credential: FAKE_SAS
+          }
+        }
+      },
+      undefined,
+      2
+    );
+    const endOfSas: number = validJson.indexOf(FAKE_SAS) + FAKE_SAS.length;
+
+    it.each([
+      {
+        name: 'cut off after the credential',
+        contents: validJson.slice(0, endOfSas + 1)
+      },
+      {
+        name: 'cut off inside the credential',
+        contents: validJson.slice(0, endOfSas - 4)
+      },
+      {
+        name: 'with an unexpected character after the credential',
+        contents: `${validJson.slice(0, endOfSas + 1)} x${validJson.slice(endOfSas + 1)}`
+      }
+    ])('reports the position without the contents when it is $name', async ({ contents }) => {
+      fakeFilesystem[cacheFilePath] = contents;
+      let parserError: (Error & { row?: number; column?: number }) | undefined;
+      try {
+        JsonFile.parseString(contents);
+      } catch (e) {
+        parserError = e as Error;
+      }
+      // The parser's own message quotes the credential
+      expect(parserError?.message).toContain('sig=FAKESIGNATURE');
+      expect(parserError?.row).toEqual(6);
+
+      const expectedError: Error = new Error(
+        `Error reading "${cacheFilePath}": the file is not valid JSON ` +
+          `(line ${parserError?.row}, column ${parserError?.column}). ` +
+          'Its contents are not shown because it stores credentials. Correct the file or delete it.'
+      );
+      for (const supportEditing of [false, true]) {
+        await expect(CredentialCache.initializeAsync({ supportEditing })).rejects.toThrow(expectedError);
+      }
+    });
+  });
+
+  it('reports a credentials file that does not match its schema without the values', async () => {
+    fakeFilesystem[`${FAKE_RUSH_USER_FOLDER}/credentials.json`] = JSON.stringify({
+      version: '0.1.0',
+      cacheEntries: {
+        'test-credential': {
+          expires: 'never',
+          credential: FAKE_SAS
+        }
+      }
+    });
+
+    await expect(CredentialCache.initializeAsync({ supportEditing: false })).rejects.toThrow(
+      /^JSON validation failed:\s+temp\/\.rush-user\/credentials\.json\s+Error: #\/cacheEntries\/test-credential\/expires\s+must be number$/
+    );
+  });
 });

From 1840241beb407f30fbfea663212e2988989b67e8 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 00:41:18 +0000
Subject: [PATCH 048/265] [rush-daemon] A failed agent-output build returns as
 soon as nothing unfinished can change its result
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Swarm integration step 33; original commit 1b51e7af08 (merge of swarm/r04-t108-int at c76de10302).
Scope: task 108 a.

Brings r04's task 108 item 2, "108(a)": 129e04f8bb on the nits 4bad455570 and item 2 2e066a7758, re-merged onto 3857bc9926 as c76de10302 (board 2133, board 2533). With agent output, a failed `build` returns as soon as nothing unfinished can change its result. Its summary line ends `· <n> independent operations continue in rushd`, and those operations finish in the daemon. The next build waits for them (`queued behind another request`) and doesn't run them again; the daemon's own install and rebuild stop the leftover, and a request that falls back in-process stops it first. Until the leftover ends, a native `rush install` or `rush-client --no-daemon` fails with "Another Rush command is already running in this repository." (o01 board 2598, board 2612), and `daemon status` doesn't count it yet (r04's output follow-up, board 2133, board 2652). Legacy output keeps the old behavior. o02 CONFIRMED item 2 with one row refuted (board 2055), which 129e04f8bb addresses; CONFIRMED by t07 (board 2183) and t05 (board 2193).

ch01 on 140b42ad50 (board 2678): build rc 0 with 0 warnings, rush-daemon 573/0, rush-cli-client 383/0, rush-client-core 129/0, rush-daemon-protocol 172/0. 31 new and changed tests fail on the old product. 27 mutants, 22 killed; F4 and Y4 are equivalent, and three are test NITs (the stop ignores the client leaving, the offer ignores a record that is already aborted, and silent operations count as continuing). E2E: a failed build returns in 0.3 s where the base takes 15.3 s, and its independent operation finishes 15.0 s later.

Gate: ch01 GATE OK board 2678 (tree 140b42ad50)

Commits folded into this step (3):
- 2e066a7758 Return a failed build's result early in agent output (task 108 item 2)
- 4bad455570 Name a failure without output sooner, and pluralize failures, in agent output (task 108 nits)
- 129e04f8bb Stop continuing work before an in-process fallback (task 108, coord board 1981 a)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  19 +-
 .../src/AgentProgressRenderer.ts              |  49 ++-
 .../src/OperationOutputExcerpt.ts             |   7 +-
 apps/rush-cli-client/src/launchClient.ts      |   2 +
 .../src/test/AgentProgressRenderer.test.ts    | 158 ++++++-
 .../src/test/OperationOutputExcerpt.test.ts   |  19 +
 .../src/test/returnEarlyOnFailure.test.ts     |  99 +++++
 .../swarm-r04-t108-nits_2026-09-28-21-10.json |  11 +
 ...04-t108-return-early_2026-09-28-20-25.json |  11 +
 ...04-t108-return-early_2026-09-28-20-25.json |  11 +
 ...rm-r04-t108-fallback_2026-09-28-21-40.json |  11 +
 ...04-t108-return-early_2026-09-28-20-25.json |  11 +
 .../reviews/api/rush-daemon-protocol.api.md   |   2 +
 common/reviews/api/rush-daemon.api.md         |   2 +
 .../src/DaemonPhasedRequest.ts                |   2 +
 .../src/DaemonRequestEnvelope.ts              |   8 +
 .../src/RequestControlValidation.ts           |   5 +-
 .../src/RequestEnvelopeValidation.ts          |  13 +-
 .../test/RequestReturnEarlyOnFailure.test.ts  |  37 ++
 .../rush-daemon/src/DaemonControlSession.ts   |  16 +-
 .../rush-daemon/src/PhasedRequestEventSink.ts |  92 +++-
 .../rush-daemon/src/PhasedRequestRouter.ts    | 202 ++++++++-
 .../src/ProductionDaemonRequestResolver.ts    |   1 +
 libraries/rush-daemon/src/RequestScheduler.ts |  82 +++-
 .../src/WorkspaceRequestLifecycle.ts          | 101 ++++-
 .../DaemonRequestWireEarlyFailure.test.ts     | 166 +++++++
 .../test/PhasedRequestEarlyFailure.test.ts    | 415 ++++++++++++++++++
 .../src/test/RequestScheduler.test.ts         | 145 ++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  | 253 +++++++++++
 29 files changed, 1890 insertions(+), 60 deletions(-)
 create mode 100644 apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nits_2026-09-28-21-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t108-return-early_2026-09-28-20-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t108-return-early_2026-09-28-20-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t108-fallback_2026-09-28-21-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t108-return-early_2026-09-28-20-25.json
 create mode 100644 libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 2aef793974..ccb39a9801 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -156,9 +156,22 @@ error count that the shown errors account for, and, when the first error shown n
 location, the lines before it. Up to three operations are reported. Two kinds are reported just
 before the summary line instead: a failed operation that wrote no output, with the error from the
 daemon's result, and, when no operation failed, the operations whose warnings failed the request
-(`warnings: …`). The summary line names up to five failed (or warning) operations. Every
-operation's full output is in its project's `rush-logs/` folder, whether or not it was printed.
-When a request falls back to in-process Rush, agent mode stops and native output follows.
+(`warnings: …`). On a pipe, a status line names a failed operation that wrote no output 1 s after
+it failed, unless the result came first. The summary line names up to five failed (or warning)
+operations. Every operation's full output is in its project's `rush-logs/` folder, whether or not
+it was printed. When a request falls back to in-process Rush, agent mode stops and native output
+follows.
+
+In agent mode a failed `rush build` doesn't wait for all of its work. Its result comes once an
+operation failed and none of the selected projects that no other selected project depends on (for
+example, the projects named by `--to`) is still waiting or running. The daemon keeps running the
+operations that the failure didn't block, so that the next build finds them done, and the summary
+line counts them (`· 2 independent operations continue in rushd`). A later `rush build` waits for
+them. `rush rebuild`, `rush install` and `rush update`, a restart of the daemon for another
+environment, and `rush-client daemon stop` stop them instead. Rushx scripts, and commands that the
+daemon doesn't run (such as `rush list` or a custom command, which run in-process), run alongside
+them, like two Rush commands at once in one checkout.
+Older daemons report the failure when all of the work has ended.
 
 Positively identified built-in `install` and `update` follow the same opt-in routing
 precedence as workspace builds and require protocol **0.10**
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 2f3dc95820..5313181609 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -26,6 +26,11 @@ const PIPE_CONNECTING_LINE_DELAY_MS: number = 10_000;
  * request from a hung one. Agent shells return partial output after 30 s. A request that ends sooner writes none.
  */
 const PIPE_STATUS_INTERVAL_MS: number = 25_000;
+/**
+ * On a pipe, a failed operation that wrote no output is reported only with the daemon's result, which carries its
+ * error. Unless that result comes first, the next status line, which names it, is written this long after it failed.
+ */
+const PIPE_UNREPORTED_FAILURE_DELAY_MS: number = 1_000;
 const SENT_PHASE: string = 'sent to rushd; preparing the workspace graph';
 const STARTING_PHASE: string = 'rushd is still starting; waiting for it';
 const FAILURE_STATUS: string = 'FAILURE';
@@ -54,9 +59,17 @@ const STATUS_LABELS: ReadonlyMap<string, string> = new Map([
   ['SKIPPED', 'up to date'],
   ['NO OP', 'up to date']
 ]);
+/** The plural of a summary label, where it differs. */
+const PLURAL_LABELS: ReadonlyMap<string, string> = new Map([['failure', 'failures']]);
 
 type Verdict = 'SUCCESS' | 'FAILURE' | 'CANCELLED';
 
+/**
+ * Statuses that a failed result reports for operations that are still unfinished: a daemon that returns a failure
+ * early lets the operations that the failure did not block run on.
+ */
+const UNFINISHED_STATUSES: ReadonlySet<string> = new Set(['WAITING', 'READY', 'QUEUED', 'EXECUTING']);
+
 /** A queue position that the daemon reported, and when. */
 interface IQueuePosition {
   readonly position: number;
@@ -83,6 +96,15 @@ export interface IAgentFinalResult {
   readonly admissionErrorCode?: DaemonRequestAdmissionErrorCode;
 }
 
+/** Says how many operations the daemon still runs after it reported the failure, if any. */
+function formatUnfinishedOperations(results: ReadonlyArray<IAgentOperationResult> | undefined): string {
+  const count: number = results?.filter(({ status }) => UNFINISHED_STATUSES.has(status)).length ?? 0;
+  if (count === 0) {
+    return '';
+  }
+  return ` · ${count} independent ${count === 1 ? 'operation continues' : 'operations continue'} in rushd`;
+}
+
 function formatNames(names: ReadonlyArray<string>, maxNames: number): string {
   const shown: string = names.slice(0, maxNames).join(', ');
   return names.length > maxNames ? `${shown} +${names.length - maxNames} more` : shown;
@@ -112,7 +134,8 @@ function getErrorDetail(lines: ReadonlyArray<string>): string[] {
  * takes longer than 10 s gets one. A wait for a daemon that is still starting also gets a line, once. Only the
  * first three failed operations are reported. Whether warnings fail the request is only known at its end, so
  * operations with warnings are reported before the summary line; so is a failed operation that wrote no output,
- * whose error only the daemon's result carries.
+ * whose error only the daemon's result carries. On a pipe, the next status line, which names that operation, is
+ * then due 1 s after it failed, so that a result that the daemon returns early can come first and make it moot.
  */
 export class AgentProgressRenderer {
   readonly #options: IAgentProgressRendererOptions;
@@ -136,6 +159,8 @@ export class AgentProgressRenderer {
   /** The first queue position, for the summary line. */
   #firstQueued: IQueuePosition | undefined;
   #stopped: boolean = false;
+  /** On a pipe: an operation that wrote no output failed, and no line has named it yet. */
+  #unnamedFailure: boolean = false;
   /** The error message that the summary line contains in full, once written. */
   #reportedErrorMessage: string | undefined;
 
@@ -285,6 +310,9 @@ export class AgentProgressRenderer {
     const emptySelection: boolean =
       verdict === 'SUCCESS' && result?.operationResults?.length === 0 && !this.#tracker.hasOperations;
     let summary: string = this.#getSummaryLine(verdict, emptySelection);
+    if (verdict === 'FAILURE') {
+      summary += formatUnfinishedOperations(result?.operationResults);
+    }
     // An admission failure says that the request waited, and why it stopped waiting.
     if (this.#firstQueued && !result?.admissionErrorCode) {
       const { position, elapsed } = this.#firstQueued;
@@ -335,7 +363,8 @@ export class AgentProgressRenderer {
   /**
    * Writes a failed operation's log file and output excerpt as soon as it fails, while the rest of the request
    * runs on. The operation's output all arrived before its status. An operation that wrote nothing is left to
-   * the failure report, which has the error from the daemon's result.
+   * the failure report, which has the error from the daemon's result; on a pipe, the next status line names it
+   * sooner.
    */
   #reportFailure(operationId: string): void {
     if (this.#stopped || this.#reported.has(operationId) || this.#reported.size >= MAX_REPORTED_OPERATIONS) {
@@ -343,6 +372,10 @@ export class AgentProgressRenderer {
     }
     const problem: IAgentProblemOperation = this.#tracker.getProblemOperation(operationId);
     if (!problem.excerpt?.lineCount) {
+      if (this.#statusTimer && !this.#unnamedFailure) {
+        this.#unnamedFailure = true;
+        this.#scheduleStatusLine();
+      }
       return;
     }
     const lines: string[] = this.#getProblemLines('failed', problem);
@@ -364,7 +397,9 @@ export class AgentProgressRenderer {
       const label: string = STATUS_LABELS.get(status) ?? status.toLowerCase();
       countsByLabel.set(label, (countsByLabel.get(label) ?? 0) + count);
     }
-    const counts: string[] = [...countsByLabel].map(([label, count]) => `${count} ${label}`);
+    const counts: string[] = [...countsByLabel].map(
+      ([label, count]) => `${count} ${(count !== 1 && PLURAL_LABELS.get(label)) || label}`
+    );
     const matchedNothing: boolean = total === 0 && done === 0 && emptySelection && !tracker.hasGlobalOutput;
     let scope: string = '';
     if (total > 0 || done > 0) {
@@ -488,7 +523,13 @@ export class AgentProgressRenderer {
 
   #scheduleStatusLine(): void {
     clearTimeout(this.#statusTimer);
-    this.#statusTimer = setTimeout(() => this.#writePipeLine(this.#getStatusLine()), PIPE_STATUS_INTERVAL_MS);
+    this.#statusTimer = setTimeout(
+      () => {
+        this.#unnamedFailure = false;
+        this.#writePipeLine(this.#getStatusLine());
+      },
+      this.#unnamedFailure ? PIPE_UNREPORTED_FAILURE_DELAY_MS : PIPE_STATUS_INTERVAL_MS
+    );
     this.#statusTimer.unref?.();
   }
 
diff --git a/apps/rush-cli-client/src/OperationOutputExcerpt.ts b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
index cb5b66d54a..b924c6a8d1 100644
--- a/apps/rush-cli-client/src/OperationOutputExcerpt.ts
+++ b/apps/rush-cli-client/src/OperationOutputExcerpt.ts
@@ -40,8 +40,11 @@ const SEVERITY_PREFIX_PATTERN: RegExp = /^(?:error|warning)\s*:\s*/i;
 const WHITESPACE_PATTERN: RegExp = /\s+/g;
 /** A tool's error count, such as Heft's `Encountered 2 errors` or tsc's `Found 1 error.` */
 const ERROR_COUNT_PATTERN: RegExp = /^(?:encountered|found) (\d+) errors?\b/i;
-/** A source location such as `src/x.ts:3:7` or `src/x.ts(3,7)`. */
-const SOURCE_LOCATION_PATTERN: RegExp = /[\w-]\.[A-Za-z]\w{0,5}(?::\d+|\(\d+,\d+\))/;
+/**
+ * A source location such as `src/x.ts:3:7` or `src/x.ts(3,7)`, with a line and a column, so that a host and port
+ * such as `registry.example.com:443` is not taken for one.
+ */
+const SOURCE_LOCATION_PATTERN: RegExp = /[\w-]\.[A-Za-z]\w{0,5}(?::\d+:\d+|\(\d+,\d+\))/;
 
 /** Lines longer than this keep their start and end, joined by an ellipsis. */
 const MAX_LINE_LENGTH: number = 300;
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index b2fbd46089..03fb79ca0c 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -108,6 +108,8 @@ export async function launchClientAsync(
     commandOrigin:
       !rushx && ['build', 'rebuild', 'install', 'update'].includes(route.commandName) ? 'built-in' : 'custom',
     invocationKind: rushx ? 'rushx' : 'rush',
+    // An agent acts on a failure as soon as it is known; the daemon finishes the independent work without it.
+    ...(agentRenderer ? { returnEarlyOnFailure: true } : {}),
     cwd,
     environment,
     terminal: {
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 9d6921e648..d6f64f22ca 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -156,6 +156,38 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('says how many operations continue in rushd after a failure that the daemon reported early', () => {
+    const operationIds: ReadonlyArray<string> = ['a (build)', 'b (build)', 'c (build)', 'd (build)'];
+    const finishWith = (unfinished: ReadonlyArray<[string, string]>, exitCode: number = 1): string[] => {
+      const { renderer, lines } = createRenderer(false);
+      for (const operationId of operationIds) renderer.onEvent(registered(operationId));
+      fail(renderer, 'b (build)', ['error']);
+      renderer.onEvent(status('a (build)', 'BLOCKED'));
+      renderer.finish({
+        exitCode,
+        operationResults: [
+          { operationId: 'a (build)', status: 'BLOCKED' },
+          { operationId: 'b (build)', status: 'FAILURE' },
+          ...unfinished.map(([operationId, value]) => ({ operationId, status: value }))
+        ]
+      });
+      return lines();
+    };
+
+    expect(finishWith([['c (build)', 'EXECUTING']]).pop()).toBe(
+      'rush build: FAILURE 2/4 operations (1 failure, 1 blocked) in 0.0s · failed: b (build)' +
+        ' · 1 independent operation continues in rushd'
+    );
+    expect(
+      finishWith([
+        ['c (build)', 'EXECUTING'],
+        ['d (build)', 'QUEUED']
+      ]).pop()
+    ).toMatch(/ · failed: b \(build\) · 2 independent operations continue in rushd$/);
+    expect(finishWith([['c (build)', 'SUCCESS']]).pop()).toMatch(/ · failed: b \(build\)$/);
+    expect(finishWith([['c (build)', 'EXECUTING']], 0).pop()).not.toContain('continue');
+  });
+
   it('keeps failure diagnostics when successful operations wrote stderr first', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onEvent(status('noisy (build)', 'EXECUTING'));
@@ -585,7 +617,7 @@ describe(AgentProgressRenderer.name, () => {
     expect(report.filter((line) => line.startsWith('  f2 '))).toHaveLength(3);
     expect(report.slice(-2)).toEqual([
       "+5 more failed operations; their logs are in each project's rush-logs folder",
-      'rush build: FAILURE 8/8 operations (8 failure) in 0.0s · failed: f0 (build), f1 (build), f2 (build), ' +
+      'rush build: FAILURE 8/8 operations (8 failures) in 0.0s · failed: f0 (build), f1 (build), f2 (build), ' +
         'f3 (build), f4 (build) +3 more'
     ]);
   });
@@ -611,7 +643,7 @@ describe(AgentProgressRenderer.name, () => {
       '  src/b.ts:1:1 - error TS2322: b',
       'failed: quiet (build)',
       '  spawn heft ENOENT',
-      'rush build: FAILURE 3/3 operations (3 failure) in 0.0s · failed: a (build), quiet (build), b (build)'
+      'rush build: FAILURE 3/3 operations (3 failures) in 0.0s · failed: a (build), quiet (build), b (build)'
     ]);
   });
 
@@ -631,7 +663,7 @@ describe(AgentProgressRenderer.name, () => {
       'failed: q1 (build)',
       '  (no output)',
       "+2 more failed operations; their logs are in each project's rush-logs folder",
-      'rush build: FAILURE 5/5 operations (5 failure) in 0.0s · ' +
+      'rush build: FAILURE 5/5 operations (5 failures) in 0.0s · ' +
         'failed: a (build), q1 (build), q2 (build), q3 (build), b (build)'
     ]);
   });
@@ -768,7 +800,10 @@ describe(AgentProgressRenderer.name, () => {
       renderer.onEvent(status('d (build)', 'EXECUTING'));
       renderer.onEvent(status('e (build)', 'EXECUTING'));
       fail(renderer, 'a (build)', ['error TS2322']);
-      advance(clock, 25_000);
+      // The failure report postpones the status line that was due at 50 s.
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(4);
+      advance(clock, 1);
       renderer.onEvent(status('b (build)', 'SUCCESS'));
       advance(clock, 25_000);
       clock.ms += 1000;
@@ -819,6 +854,104 @@ describe(AgentProgressRenderer.name, () => {
       advance(clock, 100_000);
       expect(output).toHaveLength(written);
     });
+
+    it('names a failed operation that wrote no output in a status line 1 s after it failed (#1792)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'q']) {
+        renderer.onEvent(registered(`${name} (build)`));
+        renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      }
+      advance(clock, 2000);
+      renderer.onEvent(status('q (build)', 'FAILURE', '/repo/q/rush-logs/x.log'));
+      advance(clock, 999);
+      expect(lines()).toHaveLength(1);
+      advance(clock, 1);
+      expect(lines()).toHaveLength(2);
+      // The next status line is due 25 s after that one, as usual.
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.finish({
+        exitCode: 1,
+        operationResults: [
+          { operationId: 'a (build)', status: 'SUCCESS' },
+          { operationId: 'b (build)', status: 'SUCCESS' },
+          { operationId: 'q (build)', status: 'FAILURE', errorMessage: 'Returned error code: 1' }
+        ]
+      });
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build 1/3 · 3.0s · running: a (build), b (build) · failed: q (build)',
+        'rush build 1/3 · 28.0s · running: a (build), b (build) · failed: q (build)',
+        'failed: q (build) · full log: /repo/q/rush-logs/x.log',
+        '  Returned error code: 1',
+        'rush build: FAILURE 3/3 operations (1 failure, 2 success) in 28.0s · failed: q (build)'
+      ]);
+    });
+
+    it('writes no status line for a failure without output when the result comes within 1 s', () => {
+      const { renderer, output, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      renderer.onEvent(registered('q (build)'));
+      renderer.onEvent(registered('top (build)'));
+      renderer.onEvent(status('q (build)', 'EXECUTING'));
+      renderer.onEvent(status('q (build)', 'FAILURE'));
+      renderer.onEvent(status('top (build)', 'BLOCKED'));
+      advance(clock, 999);
+      renderer.finish({
+        exitCode: 1,
+        operationResults: [
+          { operationId: 'q (build)', status: 'FAILURE', errorMessage: 'Returned error code: 1' },
+          { operationId: 'top (build)', status: 'BLOCKED' }
+        ]
+      });
+      const written: number = output.length;
+      advance(clock, 100_000);
+      expect(output).toHaveLength(written);
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'failed: q (build)',
+        '  Returned error code: 1',
+        'rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 1.0s · failed: q (build)'
+      ]);
+    });
+
+    it('names failures without output that no line named yet in one status line, however they interleave', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'q1', 'q2', 'q3']) {
+        renderer.onEvent(registered(`${name} (build)`));
+        renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      }
+      renderer.onEvent(status('q1 (build)', 'FAILURE'));
+      advance(clock, 600);
+      // A second failure without output does not postpone the line.
+      renderer.onEvent(status('q2 (build)', 'FAILURE'));
+      advance(clock, 399);
+      expect(lines()).toHaveLength(1);
+      advance(clock, 1);
+      expect(lines()[1]).toBe(
+        'rush build 2/5 · 1.0s · running: a (build), b (build), q3 (build) · failed: q1 (build), q2 (build)'
+      );
+      // A failure report does not name an earlier failure without output, so a status line follows 1 s after it.
+      advance(clock, 5000);
+      renderer.onEvent(status('q3 (build)', 'FAILURE'));
+      advance(clock, 500);
+      fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+      advance(clock, 999);
+      expect(lines()).toHaveLength(4);
+      advance(clock, 1);
+      renderer.dispose();
+      expect(lines().slice(2)).toEqual([
+        'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+        '  src/a.ts:1:1 - error TS2322: a',
+        'rush build 4/5 · 7.5s · running: b (build) · failed: q1 (build), q2 (build), q3 (build) +1 more'
+      ]);
+    });
   });
 
   it('renders at most three live rows on a TTY and clears them before the summary', () => {
@@ -873,4 +1006,21 @@ describe(AgentProgressRenderer.name, () => {
       jest.useRealTimers();
     }
   });
+
+  it('writes no status line on a TTY for a failed operation that wrote no output', () => {
+    jest.useFakeTimers();
+    try {
+      const { renderer, output } = createRenderer(true);
+      renderer.start();
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onEvent(status('a (build)', 'FAILURE'));
+      jest.advanceTimersByTime(30_000);
+      expect(output.length).toBeGreaterThan(1);
+      // Every write after the first paint repaints the live rows.
+      expect(output.slice(1).filter((text) => !text.startsWith('\x1b[3A\x1b[0J'))).toEqual([]);
+      renderer.dispose();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
 });
diff --git a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
index bc139a88fd..fb4046c2ff 100644
--- a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
+++ b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
@@ -242,6 +242,25 @@ describe(OperationOutputExcerpt.name, () => {
     expect(unlocated.getExcerpt(8)).toEqual(['src/a.ts(1,1): something unexpected', 'Build failed']);
   });
 
+  it('does not take a host and port for a source location (ch01 #1980)', () => {
+    for (const error of [
+      'npm ERR! connect ECONNREFUSED registry.example.com:443',
+      'Error: request to https://pkgs.dev.azure.com:443/x failed'
+    ]) {
+      const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+      excerpt.append('Installing @x/a from the registry\n', 'stderr');
+      excerpt.append(`${error}\n`, 'stderr');
+      expect(excerpt.getExcerpt(8)).toEqual(['Installing @x/a from the registry', error]);
+    }
+  });
+
+  it('shows a message that is repeated in another case once', () => {
+    const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
+    excerpt.append("Error: Cannot find module 'X'\n", 'stdout');
+    excerpt.append("error: cannot find module 'x'\n", 'stderr');
+    expect(excerpt.getExcerpt(8)).toEqual(["Error: Cannot find module 'X'"]);
+  });
+
   it('always keeps the last line, which usually is the tool summary', () => {
     const excerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
     for (let i: number = 0; i < 20; i++) {
diff --git a/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts b/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
new file mode 100644
index 0000000000..13d0a016b4
--- /dev/null
+++ b/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
@@ -0,0 +1,99 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+describe('returnEarlyOnFailure', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let requests: IDaemonRequestEnvelope[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-early-failure-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    requests = [];
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockResolvedValue({ closeAsync: async () => undefined } as unknown as DaemonClient);
+    jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => {
+      requests.push(options.request);
+      return {
+        kind: 'result',
+        result: { requestId: options.request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+      };
+    });
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('is requested by agent output, which reports the failure and leaves the independent work to rushd', async () => {
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: () => undefined
+    });
+    await launchClientAsync(false, renderer);
+    expect(requests).toHaveLength(1);
+    expect(requests[0].returnEarlyOnFailure).toBe(true);
+  });
+
+  it('is not requested by the default output, whose collated logs cover the whole request', async () => {
+    await launchClientAsync(false);
+    expect(requests).toHaveLength(1);
+    expect(requests[0]).not.toHaveProperty('returnEarlyOnFailure');
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nits_2026-09-28-21-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nits_2026-09-28-21-10.json
new file mode 100644
index 0000000000..28c7bdb478
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nits_2026-09-28-21-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output on a pipe, name a failed operation that wrote no output in a status line 1 s after it failed, and say \"failures\" for more than one failure in the summary line. A failure excerpt no longer takes a host and port, such as `registry.example.com:443`, for a source location, so it keeps the lines before such an error.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-return-early_2026-09-28-20-25.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-return-early_2026-09-28-20-25.json
new file mode 100644
index 0000000000..5ee20dfb56
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-return-early_2026-09-28-20-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, ask the daemon to return a failed build's result early, and say in the summary line how many independent operations continue in rushd.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t108-return-early_2026-09-28-20-25.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t108-return-early_2026-09-28-20-25.json
new file mode 100644
index 0000000000..74be47df86
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t108-return-early_2026-09-28-20-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `returnEarlyOnFailure` field to request envelopes and phased requests. A daemon that honors it writes a failed shared build's result once no unfinished target operation can change it. Older daemons ignore the field.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t108-fallback_2026-09-28-21-40.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-fallback_2026-09-28-21-40.json
new file mode 100644
index 0000000000..62a195147a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-fallback_2026-09-28-21-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Before rejecting a request that the client then runs in-process, stop the operations that a failed build continues after returning its result early, and wait until they have stopped and released the repository lock. A `list`, `check` or `scan` command and a rushx script still run alongside them. Adds `RequestScheduler.preemptLeasesAsync()`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t108-return-early_2026-09-28-20-25.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-return-early_2026-09-28-20-25.json
new file mode 100644
index 0000000000..98d102f837
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-return-early_2026-09-28-20-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Honor `returnEarlyOnFailure` for shared builds: write a failed build's result once no unfinished target operation can change it, and keep running the operations that the failure didn't block. A later build waits for them; a request that can't run alongside a build, a restart for another environment, or a daemon shutdown stops them. Adds `RequestScheduler.markLeasePreemptible()`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index c7ec3d5863..da5aff785b 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -450,6 +450,7 @@ export interface IDaemonPhasedRequest {
     readonly environment: Readonly<Record<string, string>>;
     readonly operationSelection: ReadonlyArray<IDaemonPhasedOperationSelection>;
     readonly requestId: string;
+    readonly returnEarlyOnFailure?: boolean;
     readonly terminalRequirement?: DaemonTerminalRequirement;
 }
 
@@ -533,6 +534,7 @@ export interface IDaemonRequestEnvelope {
     readonly expectedWorkspaceGeneration?: string;
     readonly invocationKind?: DaemonInvocationKind;
     readonly requestId: string;
+    readonly returnEarlyOnFailure?: boolean;
     readonly terminal: IDaemonRequestTerminal;
 }
 
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 0d30e1b2dc..1bc9b6fdba 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -724,6 +724,8 @@ export class RequestScheduler {
     acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease>;
     get activeRequestCount(): number;
     downgradeExclusiveLease(lease: IRequestLease, target: RequestExclusivityClass.SharedBuild | RequestExclusivityClass.SharedRead): void;
+    markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void;
+    preemptLeasesAsync(): Promise<void>;
     get queuedRequestCount(): number;
 }
 
diff --git a/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts b/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts
index 7dbc06d8ce..55b8eaed4c 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPhasedRequest.ts
@@ -63,6 +63,8 @@ export interface IDaemonPhasedRequest {
   readonly operationSelection: ReadonlyArray<IDaemonPhasedOperationSelection>;
   /** A client-generated identifier unique within the connection. */
   readonly requestId: string;
+  /** Copied from {@link IDaemonRequestEnvelope.returnEarlyOnFailure}; only shared builds honor it. */
+  readonly returnEarlyOnFailure?: boolean;
   /** Terminal capability needed by the resolved command. */
   readonly terminalRequirement?: DaemonTerminalRequirement;
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts b/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts
index 9db2a24707..5c74f3bb39 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestEnvelope.ts
@@ -52,6 +52,14 @@ export interface IDaemonRequestEnvelope {
   readonly invocationKind?: DaemonInvocationKind;
   /** A client-generated identifier unique within this connection. */
   readonly requestId: string;
+  /**
+   * Whether a shared build may report its failure before the rest of its work ends. Once an operation failed and
+   * no operation of the selected projects that no other selected project consumes is unfinished, the daemon
+   * writes the result, in which unfinished operations report their current status. Those keep running in the
+   * daemon, and the request stays active until they end, unless a request that cannot run alongside them, or a
+   * restart, stops them first. Older daemons ignore this field.
+   */
+  readonly returnEarlyOnFailure?: boolean;
   /** Request-local terminal capabilities. */
   readonly terminal: IDaemonRequestTerminal;
 }
diff --git a/libraries/rush-daemon-protocol/src/RequestControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestControlValidation.ts
index 5f628a2cda..5686cac294 100644
--- a/libraries/rush-daemon-protocol/src/RequestControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestControlValidation.ts
@@ -4,7 +4,7 @@
 import { isDaemonControlRecord } from './ControlRecord';
 import { validateDaemonInvocationKind, validateExpectedWorkspaceGeneration } from './DaemonInvocationKind';
 import { DaemonProtocolError } from './DaemonProtocolError';
-import { validateRequestAdmission, validateRequestTerminal } from './RequestEnvelopeValidation';
+import { validateRequestHandling } from './RequestEnvelopeValidation';
 import { validateRequestId } from './RequestIdentifierValidation';
 import { validateRequestResultFields } from './RequestResultValidation';
 
@@ -33,8 +33,7 @@ export function validateRequestStartControl(payload: Record<string, unknown>): v
   requireString(payload.cwd, 'requestStart payload.cwd');
   requireStringArray(payload.argv, 'requestStart payload.argv');
   requireStringRecord(payload.environment, 'requestStart payload.environment');
-  validateRequestTerminal(payload.terminal);
-  validateRequestAdmission(payload.admission);
+  validateRequestHandling(payload);
 }
 
 /** Validates a request-cancel payload. @internal */
diff --git a/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts b/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts
index 1bf3a7f6be..0a60e01634 100644
--- a/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestEnvelopeValidation.ts
@@ -8,8 +8,14 @@ import { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
 const FIRST_TERMINAL_COLUMN: number = 1;
 const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
 
-/** Validates request terminal fields. @internal */
-export function validateRequestTerminal(value: unknown): void {
+/** Validates the request's terminal, its admission and whether it may return early on failure. @internal */
+export function validateRequestHandling(payload: Record<string, unknown>): void {
+  validateRequestTerminal(payload.terminal);
+  validateRequestAdmission(payload.admission);
+  validateOptionalBoolean(payload.returnEarlyOnFailure, 'requestStart payload.returnEarlyOnFailure');
+}
+
+function validateRequestTerminal(value: unknown): void {
   const terminal: Record<string, unknown> = requireRecord(value, 'requestStart payload.terminal');
   requireBoolean(terminal.isTTY, 'Request terminal isTTY');
   requireBoolean(terminal.supportsColor, 'Request terminal supportsColor');
@@ -18,8 +24,7 @@ export function validateRequestTerminal(value: unknown): void {
   validateTerminalRequirement(terminal.terminalRequirement);
 }
 
-/** Validates request admission fields. @internal */
-export function validateRequestAdmission(value: unknown): void {
+function validateRequestAdmission(value: unknown): void {
   if (value === undefined) return;
   const admission: Record<string, unknown> = requireRecord(value, 'requestStart payload.admission');
   validateOptionalBoolean(admission.noWait, 'Request admission noWait');
diff --git a/libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts b/libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts
new file mode 100644
index 0000000000..449ece70f2
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/RequestReturnEarlyOnFailure.test.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { IDaemonRequestStartMessage } from '../DaemonRequestControl';
+
+const NUMBER_FLAG: number = 1;
+
+function createRequestStart(returnEarlyOnFailure: unknown): IDaemonRequestStartMessage {
+  return {
+    kind: 'requestStart',
+    payload: {
+      argv: ['build', '--to', 'project-a'],
+      commandName: 'build',
+      commandOrigin: 'built-in',
+      cwd: '/repo',
+      environment: {},
+      requestId: 'early-failure-request',
+      returnEarlyOnFailure: returnEarlyOnFailure as boolean | undefined,
+      terminal: { isTTY: false, supportsColor: false }
+    }
+  };
+}
+
+function roundTrip(message: IDaemonRequestStartMessage): unknown {
+  return decodeDaemonControlMessage(encodeDaemonControlMessage(message));
+}
+
+it.each([true, false, undefined])('round-trips returnEarlyOnFailure %p', (value: boolean | undefined) => {
+  expect(roundTrip(createRequestStart(value))).toEqual(createRequestStart(value));
+});
+
+it.each(['true', NUMBER_FLAG, null])('rejects a non-boolean returnEarlyOnFailure %p', (value: unknown) => {
+  expect(() => roundTrip(createRequestStart(value))).toThrow(
+    'requestStart payload.returnEarlyOnFailure must be a boolean.'
+  );
+});
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 51f9bff38a..4e043b4f33 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -107,6 +107,13 @@ export class DaemonControlSession {
   }
 
   public closeAsync(drainRequests: boolean = false, reason?: DaemonShutdownError): Promise<void> {
+    // Unlike a disconnect, closing the session also stops the work that a request still runs after it sent its
+    // result (a failed build that returned early). No client waits for a restart result from such a request.
+    for (const state of this.#requestById.values()) {
+      if (state.client.terminalOutcomeSent) {
+        state.abortController.abort(reason ?? new Error('The daemon control session is closing.'));
+      }
+    }
     this.#closePromise ??= this.#closeOnceAsync(drainRequests, reason);
     return this.#closePromise;
   }
@@ -448,12 +455,14 @@ export class DaemonControlSession {
     return this.#closePromise;
   }
 
-  #markClosing(reason: Error): void {
+  #markClosing(reason: Error, keepFinishedRequests: boolean = false): void {
     if (this.#isClosing) return;
     this.#isClosing = true;
     this.#interactiveConnection.close(reason);
     for (const state of this.#requestById.values()) {
-      state.abortController.abort(reason);
+      if (!keepFinishedRequests || !state.client.terminalOutcomeSent) {
+        state.abortController.abort(reason);
+      }
     }
   }
 
@@ -490,7 +499,8 @@ export class DaemonControlSession {
   async #handleConnectionClosedAsync(error: Error | undefined): Promise<void> {
     if (this.#connectionClosed) return;
     this.#connectionClosed = true;
-    this.#markClosing(error ?? new Error('The daemon client connection closed.'));
+    // A client that disconnects after its result does not stop the work that its request still runs.
+    this.#markClosing(error ?? new Error('The daemon client connection closed.'), true);
     const settlements: PromiseSettledResult<void>[] = await Promise.allSettled(
       Array.from(this.#requestById.values(), (state: IRequestState) => state.completion)
     );
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index e726b07ccb..58988b2d59 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -48,6 +48,18 @@ interface IEventOptions {
   readonly scope?: IDaemonEventScope;
 }
 
+/** How a sink reports that a request which returns early on failure can have its result; see the constructor. */
+export interface IEarlyFailureOptions {
+  /** The operations whose results decide the request's outcome. */
+  readonly targetOperationIds: ReadonlySet<string>;
+  /** Receives the number of the client's operations, not counting silent ones, that are still unfinished. */
+  readonly onSettled: (unfinishedOperations: number) => void;
+}
+
+function isFailedStatus(status: OperationStatus): boolean {
+  return status === OperationStatus.Failure || status === OperationStatus.Blocked;
+}
+
 class OrderedClientWriter {
   readonly #client: IPhasedRequestClient;
   readonly #onFailure: (error: Error) => void;
@@ -101,8 +113,13 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
   readonly #rushVersion: string;
   readonly #writer: OrderedClientWriter;
   readonly #onActiveOperationsSettled: (() => void) | undefined;
+  readonly #earlyFailure: IEarlyFailureOptions | undefined;
   readonly #pendingOperationIds: Set<string> = new Set();
+  /** The current iteration's records of this client's operations; their statuses change as the iteration runs. */
+  readonly #scheduledResults: Map<Operation, IOperationExecutionResult> = new Map();
   #completedOperations: number = 0;
+  #failed: boolean = false;
+  #earlyFailureOffered: boolean = false;
   #settled: boolean = false;
   #totalOperations: number = 0;
 
@@ -118,11 +135,18 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
      * enqueued on this sink's writer before the callback runs.
      */
     onActiveOperationsSettled?: () => void;
+    /**
+     * For a request that returns early on failure: `onSettled` is called at most once per iteration, after any
+     * operation's completion event, when one of this client's operations failed or was blocked, none was aborted,
+     * none of the targets is unfinished, and `onActiveOperationsSettled` was not called.
+     */
+    earlyFailure?: IEarlyFailureOptions;
   }) {
     this.#activeOperationIds = options.activeOperationIds;
     this.#client = options.client;
     this.#getNextSequence = options.getNextSequence;
     this.#onActiveOperationsSettled = options.onActiveOperationsSettled;
+    this.#earlyFailure = options.earlyFailure;
     this.#rushVersion = options.rushVersion;
     this.#writer = new OrderedClientWriter(options.client, options.onWriteFailure);
   }
@@ -131,6 +155,11 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     return this.#observedResults.get(operation);
   }
 
+  /** The current iteration's record of one of this client's operations, with its current status. */
+  public getScheduledResult(operation: Operation): IOperationExecutionResult | undefined {
+    return this.#scheduledResults.get(operation);
+  }
+
   public flushAsync(): Promise<void> {
     return this.#writer.flushAsync();
   }
@@ -145,12 +174,17 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     this.#completedOperations = 0;
     this.#totalOperations = 0;
     this.#pendingOperationIds.clear();
+    this.#scheduledResults.clear();
+    this.#failed = false;
+    this.#earlyFailureOffered = false;
     this.#settled = false;
     for (const record of records) {
       const operationId: string = record.operation.name;
       if (!this.#activeOperationIds.has(operationId)) {
         continue;
       }
+      this.#scheduledResults.set(record.operation, record);
+      this.#failed ||= isFailedStatus(record.status);
       if (!record.silent) {
         this.#totalOperations++;
       }
@@ -161,18 +195,9 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
   }
 
   public onOperationCompleted(result: IOperationExecutionResult): void {
-    if (!this.#pendingOperationIds.delete(result.operation.name) || this.#settled) {
-      return;
-    }
-    if (result.status === OperationStatus.Aborted) {
-      // The iteration is being aborted or failed to start; leave this client's result to the batch.
-      this.#settled = true;
-      return;
-    }
-    if (this.#pendingOperationIds.size === 0) {
-      this.#settled = true;
-      this.#onActiveOperationsSettled?.();
-    }
+    this.#settleActiveOperation(result);
+    // A failure elsewhere can block this client's operations, so any operation's completion can decide its result.
+    this.#offerEarlyFailure();
   }
 
   public onOperationStatusChanged(
@@ -187,6 +212,7 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
       executionResult: result,
       status: result.status
     });
+    this.#failed ||= isFailedStatus(result.status);
     // Summarizing clients (agent output) point at the full log of the operations that explain a failure.
     const logFilePath: string | undefined =
       result.status === OperationStatus.Failure || result.status === OperationStatus.SuccessWithWarning
@@ -257,6 +283,48 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     });
   }
 
+  #settleActiveOperation(result: IOperationExecutionResult): void {
+    if (!this.#pendingOperationIds.delete(result.operation.name) || this.#settled) {
+      return;
+    }
+    if (result.status === OperationStatus.Aborted) {
+      // The iteration is being aborted or failed to start; leave this client's result to the batch.
+      this.#settled = true;
+      return;
+    }
+    if (this.#pendingOperationIds.size === 0) {
+      this.#settled = true;
+      this.#onActiveOperationsSettled?.();
+    }
+  }
+
+  /**
+   * Offers a failed request's result once nothing that is unfinished can change it. Blocked operations emit their
+   * completion events only when the iteration ends, so this reads the records' current statuses instead.
+   */
+  #offerEarlyFailure(): void {
+    if (!this.#earlyFailure || !this.#failed || this.#settled || this.#earlyFailureOffered) {
+      return;
+    }
+    const { targetOperationIds, onSettled } = this.#earlyFailure;
+    let unfinishedOperations: number = 0;
+    for (const record of this.#scheduledResults.values()) {
+      if (record.status === OperationStatus.Aborted) {
+        return;
+      }
+      if (!TERMINAL_OPERATION_STATUSES.has(record.status)) {
+        if (targetOperationIds.has(record.operation.name)) {
+          return;
+        }
+        if (!record.silent) {
+          unfinishedOperations++;
+        }
+      }
+    }
+    this.#earlyFailureOffered = true;
+    onSettled(unfinishedOperations);
+  }
+
   #emitEvent(type: DaemonEventType, payload: unknown, options?: IEventOptions): void {
     this.#writer.writeEvent(() => ({
       eventId: randomUUID(),
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 1d2dfd9fd7..f8e59bc411 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -68,6 +68,8 @@ interface IPreparedPhasedRequest {
   readonly client: IPhasedRequestClient;
   readonly exclusivityClass: RequestExclusivityClass;
   readonly interactiveSession: IInteractiveRequestSession | undefined;
+  /** Lets requests that cannot run alongside this one preempt its workspace admission; see `#settleEntry`. */
+  readonly markAdmissionPreemptible: (onPreempted: () => void) => void;
   readonly request: IDaemonPhasedRequest;
   /** Only requests with the same settings share one graph iteration. */
   readonly requestSettings: IPhasedCommandEngineRequestSettings | undefined;
@@ -84,6 +86,12 @@ interface IBatchEntry extends IPreparedPhasedRequest {
   abortListener: (() => void) | undefined;
   abortRequested: boolean;
   completed: boolean;
+  /**
+   * Set when a failed result is published while operations of this request that the failure did not block are
+   * still unfinished. They keep running, and the request stays active until the iteration ends; see
+   * `#finishFailedEntry`.
+   */
+  continuesAfterResult: boolean;
   executionStarted: boolean;
   /**
    * Set when this entry's result starts being produced, so it is produced exactly once. An entry can finish while
@@ -95,9 +103,18 @@ interface IBatchEntry extends IPreparedPhasedRequest {
   reject: (error: unknown) => void;
   requestSink: PhasedRequestEventSink | undefined;
   resolve: (result: IDaemonPhasedRequestResult) => void;
+  /** Settles the request of an entry that continues after its result, once its iteration ended. */
+  settleAfterIteration: (() => void) | undefined;
   unsubscribe: (() => void) | undefined;
 }
 
+/**
+ * How a result reports the client's operations: after the iteration ended (`'final'`), or while it still runs,
+ * with unfinished operations reported as aborted because the client stopped waiting for them (`'abandoned'`), or
+ * with their current status because they run on after an early failure result (`'running'`).
+ */
+type OperationReport = 'final' | 'abandoned' | 'running';
+
 const ROUTING_STATE_BY_GRAPH: WeakMap<IOperationGraph, IGraphRoutingState> = new WeakMap();
 const OBSERVED_STATUS_OVERRIDES_RETAINED: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Aborted,
@@ -164,6 +181,7 @@ export class PhasedRequestRouter {
       commandName: request.commandName,
       commandOrigin: request.commandOrigin
     });
+    const workspaceScheduler: RequestScheduler = getWorkspaceRequestScheduler(this.#workspaceSession);
     let admissionController: RequestAdmissionController | undefined;
     let admissionLease: IRequestLease;
     try {
@@ -172,10 +190,7 @@ export class PhasedRequestRouter {
         client,
         requestId: request.requestId
       });
-      admissionLease = await admissionController.acquireAsync(
-        getWorkspaceRequestScheduler(this.#workspaceSession),
-        exclusivityClass
-      );
+      admissionLease = await admissionController.acquireAsync(workspaceScheduler, exclusivityClass);
     } catch (error) {
       admissionController?.dispose();
       return await finishAfterAdmissionErrorAsync(request, client, interactiveSession, error);
@@ -214,11 +229,14 @@ export class PhasedRequestRouter {
           if (client.abortSignal.aborted) {
             return await writeAbortedResultAsync(request.requestId, client, interactiveSession);
           }
+          const lease: IRequestLease = admissionLease;
           return await routingState.coordinator.enqueueAsync(
             {
               client,
               exclusivityClass,
               interactiveSession,
+              markAdmissionPreemptible: (onPreempted: () => void) =>
+                workspaceScheduler.markLeasePreemptible(lease, onPreempted),
               receivedTimeMs: receivedTimeMs ?? startTimeMs,
               request,
               requestSettings,
@@ -297,6 +315,7 @@ class PhasedRequestBatchCoordinator {
         abortListener: undefined,
         abortRequested: false,
         completed: false,
+        continuesAfterResult: false,
         executionStarted: false,
         finishPromise: undefined,
         outputError: undefined,
@@ -304,6 +323,7 @@ class PhasedRequestBatchCoordinator {
         reject,
         requestSink: undefined,
         resolve,
+        settleAfterIteration: undefined,
         unsubscribe: undefined
       };
       entry.abortListener = () => this.#deactivateEntry(entry, true);
@@ -471,6 +491,15 @@ class PhasedRequestBatchCoordinator {
           getNextSequence: () => entry.client.getNextEventSequence(),
           onWriteFailure: (error: Error) => this.#deactivateEntry(entry, false, error),
           onActiveOperationsSettled: () => this.#finishSettledEntry(entry),
+          earlyFailure:
+            entry.request.returnEarlyOnFailure === true &&
+            entry.exclusivityClass === RequestExclusivityClass.SharedBuild
+              ? {
+                  targetOperationIds: getTargetOperationIds(entry.selection.activeOperations),
+                  onSettled: (unfinishedOperations: number) =>
+                    this.#finishFailedEntry(entry, unfinishedOperations)
+                }
+              : undefined,
           rushVersion: this.#workspaceSession.metadata.rushVersion
         });
         entry.unsubscribe = this.#multiplexer.subscribe(entry.requestSink);
@@ -544,6 +573,9 @@ class PhasedRequestBatchCoordinator {
         await releaseExecutionLeaseAsync();
       } finally {
         graphLease.release();
+        for (const entry of batch) {
+          this.#settleContinuingEntry(entry);
+        }
       }
     }
   }
@@ -602,7 +634,7 @@ class PhasedRequestBatchCoordinator {
       undefined,
       [],
       undefined,
-      true
+      'abandoned'
     ).catch((error: unknown) => {
       if (!entry.completed) {
         this.#completeEntry(entry);
@@ -656,9 +688,12 @@ class PhasedRequestBatchCoordinator {
     );
   }
 
-  /** Whether a live participant still waits for the running iteration to produce its result. */
+  /**
+   * Whether a live participant still waits for the running iteration to produce its result, or has its result but
+   * continues until the iteration ends.
+   */
   #needsIteration(entry: IBatchEntry): boolean {
-    return entry.finishPromise === undefined && this.#isEntryLive(entry);
+    return (entry.finishPromise === undefined || entry.continuesAfterResult) && this.#isEntryLive(entry);
   }
 
   /**
@@ -674,31 +709,99 @@ class PhasedRequestBatchCoordinator {
    */
   #finishSettledEntry(entry: IBatchEntry): void {
     if (
-      !this.#needsIteration(entry) ||
+      entry.finishPromise !== undefined ||
+      !this.#isEntryLive(entry) ||
       !entry.participated ||
-      !this.#currentBatch?.some(
-        (candidate: IBatchEntry) => candidate !== entry && this.#needsIteration(candidate)
-      )
+      !this.#hasOtherBatchParticipant(entry)
+    ) {
+      return;
+    }
+    this.#startEarlyResult(entry, 'abandoned');
+  }
+
+  /**
+   * Publishes a failed result as soon as nothing that is unfinished can change it, for a request that asked for
+   * this (agent output): one of its operations failed or was blocked, and none of its targets is unfinished.
+   *
+   * @remarks
+   * Its operations that the failure did not block keep running, so that later requests find them done. The
+   * request stays active until the iteration ends, and `#settleContinuingEntry` then settles it. Meanwhile it keeps
+   * its admission, so exclusive requests still wait for that work, and it holds the iteration like any live
+   * participant, so another participant's departure does not abort that work. When none of its operations is
+   * unfinished and no other participant needs the iteration, the iteration is ending anyway, and the ordinary
+   * contract applies.
+   */
+  #finishFailedEntry(entry: IBatchEntry, unfinishedOperations: number): void {
+    if (
+      entry.finishPromise !== undefined ||
+      !this.#isEntryLive(entry) ||
+      !entry.participated ||
+      (unfinishedOperations === 0 && !this.#hasOtherBatchParticipant(entry))
     ) {
       return;
     }
+    entry.continuesAfterResult = unfinishedOperations > 0;
+    this.#startEarlyResult(entry, 'running');
+  }
+
+  #hasOtherBatchParticipant(entry: IBatchEntry): boolean {
+    return !!this.#currentBatch?.some(
+      (candidate: IBatchEntry) => candidate !== entry && this.#needsIteration(candidate)
+    );
+  }
+
+  #startEarlyResult(entry: IBatchEntry, report: OperationReport): void {
     entry.unsubscribe?.();
     entry.unsubscribe = undefined;
-    entry.finishPromise = this.#produceEarlyResultAsync(entry).catch((error: unknown) => {
+    entry.finishPromise = this.#produceEarlyResultAsync(entry, report).catch((error: unknown) => {
       // Unlike a batch-wide failure, an early result's failure concerns only this client.
       if (!entry.completed) {
+        this.#abandonContinuingEntry(entry);
         this.#completeEntry(entry);
-        entry.reject(error);
+        // The abandoned operations may still be stopping, so the request keeps its admission until they are.
+        this.#settleEntry(entry, () => entry.reject(error));
       }
     });
   }
 
-  async #produceEarlyResultAsync(entry: IBatchEntry): Promise<void> {
+  async #produceEarlyResultAsync(entry: IBatchEntry, report: OperationReport): Promise<void> {
     // The sink is notified from the record's `finalizeOperation()`, which synchronously precedes the close of
     // the record's StdioSummarizer and ProblemCollector. The summary reads the failure tail from the closed
     // summarizer, so yield once to let the notifying record finish closing before the summary is written.
     await Promise.resolve();
-    await this.#produceResultAsync(entry, true, undefined, [], undefined, true);
+    await this.#produceResultAsync(entry, true, undefined, [], undefined, report);
+  }
+
+  /**
+   * Stops the work that only an entry which continues after its result still holds, for example when the daemon
+   * shuts down or when that result could not be produced.
+   */
+  #abandonContinuingEntry(entry: IBatchEntry): void {
+    if (!entry.continuesAfterResult || entry.abortRequested) {
+      return;
+    }
+    entry.abortRequested = true;
+    if (!this.#currentBatch?.includes(entry)) {
+      return;
+    }
+    if (this.#hasLiveBatchParticipant()) {
+      this.#restrictBatchDemand();
+    } else if (this.#graph.hasScheduledIteration || this.#graph.status === OperationStatus.Executing) {
+      this.#requestIterationAbort();
+    }
+  }
+
+  #settleContinuingEntry(entry: IBatchEntry): void {
+    const settle: (() => void) | undefined = entry.settleAfterIteration;
+    if (!settle) {
+      return;
+    }
+    entry.settleAfterIteration = undefined;
+    if (entry.abortListener) {
+      entry.client.abortSignal.removeEventListener('abort', entry.abortListener);
+      entry.abortListener = undefined;
+    }
+    settle();
   }
 
   #requestIterationAbort(): void {
@@ -724,7 +827,7 @@ class PhasedRequestBatchCoordinator {
       executionError,
       batchCleanupErrors,
       beforeResultAsync,
-      false
+      'final'
     );
     return entry.finishPromise;
   }
@@ -735,7 +838,7 @@ class PhasedRequestBatchCoordinator {
     executionError: unknown,
     batchCleanupErrors: ReadonlyArray<unknown>,
     beforeResultAsync: (() => Promise<void>) | undefined,
-    iterationInProgress: boolean
+    report: OperationReport
   ): Promise<void> {
     if (entry.completed) {
       return;
@@ -772,7 +875,7 @@ class PhasedRequestBatchCoordinator {
           this.#graph,
           entry.requestSink,
           aborted && entry.participated,
-          iterationInProgress
+          report
         )
       : [];
     const result: IDaemonPhasedRequestResult = createPhasedCommandResult({
@@ -790,11 +893,25 @@ class PhasedRequestBatchCoordinator {
     try {
       await entry.client.writeResultAsync(result);
       this.#completeEntry(entry);
-      entry.resolve(result);
+      this.#settleEntry(entry, () => entry.resolve(result));
     } catch (error) {
       this.#completeEntry(entry);
-      entry.reject(error);
+      this.#settleEntry(entry, () => entry.reject(error));
+    }
+  }
+
+  #settleEntry(entry: IBatchEntry, settle: () => void): void {
+    if (!entry.continuesAfterResult) {
+      settle();
+      return;
     }
+    entry.settleAfterIteration = settle;
+    // The client has its result, so from now on its departure no longer matters, but the request's own abort
+    // (the daemon shutting down) still stops the work it holds.
+    entry.abortListener = () => this.#abandonContinuingEntry(entry);
+    entry.client.abortSignal.addEventListener('abort', entry.abortListener, { once: true });
+    // Nobody waits for that work, so it must not delay requests that cannot run alongside it, such as a rebuild.
+    entry.markAdmissionPreemptible(() => this.#abandonContinuingEntry(entry));
   }
 
   async #rejectEntryAsync(entry: IBatchEntry, error: unknown): Promise<void> {
@@ -806,6 +923,8 @@ class PhasedRequestBatchCoordinator {
       }
     }
     if (entry.completed) {
+      // The batch failed after this entry's early result: its iteration has ended.
+      this.#settleContinuingEntry(entry);
       return;
     }
     entry.unsubscribe?.();
@@ -919,6 +1038,9 @@ function validateRequestIdentity(request: IDaemonPhasedRequest): void {
   if (request.acceptsStdin !== undefined && typeof request.acceptsStdin !== 'boolean') {
     throw new Error('Phased request acceptsStdin must be a boolean value.');
   }
+  if (request.returnEarlyOnFailure !== undefined && typeof request.returnEarlyOnFailure !== 'boolean') {
+    throw new Error('Phased request returnEarlyOnFailure must be a boolean value.');
+  }
   if (
     request.terminalRequirement !== undefined &&
     request.terminalRequirement !== 'none' &&
@@ -1062,6 +1184,33 @@ function collectSelectionClosure(
   return Array.from(activeOperations);
 }
 
+/**
+ * The operations whose results decide a request's outcome: those of the selected projects that no other selected
+ * project consumes, such as the projects named by `--to`. The other selected operations only feed them.
+ *
+ * @remarks
+ * Projects rather than operations are compared, because an operation that nothing consumes, such as the last
+ * phase of a dependency, still only serves a consuming project's request.
+ */
+function getTargetOperationIds(activeOperations: ReadonlyArray<Operation>): ReadonlySet<string> {
+  const active: ReadonlySet<Operation> = new Set(activeOperations);
+  const consumedProjects: Set<Operation['associatedProject']> = new Set();
+  for (const consumer of activeOperations) {
+    for (const dependency of consumer.dependencies) {
+      if (active.has(dependency) && dependency.associatedProject !== consumer.associatedProject) {
+        consumedProjects.add(dependency.associatedProject);
+      }
+    }
+  }
+  const targetOperationIds: Set<string> = new Set();
+  for (const operation of activeOperations) {
+    if (!consumedProjects.has(operation.associatedProject)) {
+      targetOperationIds.add(operation.name);
+    }
+  }
+  return targetOperationIds;
+}
+
 /** Presentation/scheduling settings are request-scoped, so they are applied per iteration, not per graph. */
 function applyRequestSettings(
   graph: IOperationGraph,
@@ -1113,16 +1262,25 @@ function collectOperationOutcomes(
   graph: IOperationGraph,
   requestSink: PhasedRequestEventSink,
   fillMissingAsAborted: boolean = false,
-  iterationInProgress: boolean = false
+  report: OperationReport = 'final'
 ): ReadonlyArray<IPhasedOperationOutcome> {
   const outcomes: IPhasedOperationOutcome[] = [];
   for (const operation of [...activeOperations].sort(compareOperations)) {
     const observed: ReturnType<PhasedRequestEventSink['getObservedResult']> =
       requestSink.getObservedResult(operation);
     const retained: IOperationExecutionResult | undefined = graph.resultByOperation.get(operation);
+    const current: IOperationExecutionResult | undefined =
+      report === 'running' ? requestSink.getScheduledResult(operation) : undefined;
     let status: string | undefined;
     let errorMessage: string | undefined;
-    if (iterationInProgress && observed !== undefined) {
+    if (current !== undefined) {
+      if (current.silent && IN_PROGRESS_STATUSES.has(current.status)) {
+        // An operation that runs nothing, for example a phase that the project does not define.
+        continue;
+      }
+      status = current.status;
+      errorMessage = current.error?.message;
+    } else if (report !== 'final' && observed !== undefined) {
       // While the iteration still runs, retained results may predate this iteration, and work this client
       // stopped observing before it finished (a detached cancellation) was abandoned.
       status = IN_PROGRESS_STATUSES.has(observed.status) ? OperationStatus.Aborted : observed.status;
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 2edb24d3b7..4ac806c7d1 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -139,6 +139,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         },
         operationSelection,
         requestId: envelope.requestId,
+        returnEarlyOnFailure: envelope.returnEarlyOnFailure,
         terminalRequirement: envelope.terminal.terminalRequirement
       }
     };
diff --git a/libraries/rush-daemon/src/RequestScheduler.ts b/libraries/rush-daemon/src/RequestScheduler.ts
index b5fdab3020..eb84e15d00 100644
--- a/libraries/rush-daemon/src/RequestScheduler.ts
+++ b/libraries/rush-daemon/src/RequestScheduler.ts
@@ -93,7 +93,11 @@ interface IQueuedRequest {
 
 interface ILeaseState {
   exclusivityClass: RequestExclusivityClass;
+  onPreempted: (() => void) | undefined;
+  /** Whether `onPreempted` was called, so that the lease's owner is stopping its work. */
+  preempted: boolean;
   released: boolean;
+  readonly onReleased: (() => void)[];
 }
 
 /**
@@ -109,6 +113,7 @@ export class RequestScheduler {
   readonly #queue: IQueuedRequest[] = [];
   #activeClass: RequestExclusivityClass | undefined;
   #activeRequestCount: number = 0;
+  readonly #activeLeaseStates: Set<ILeaseState> = new Set();
   readonly #leaseStates: WeakMap<IRequestLease, ILeaseState> = new WeakMap();
 
   /**
@@ -128,6 +133,42 @@ export class RequestScheduler {
     this.#drainQueue();
   }
 
+  /**
+   * Lets requests that cannot be admitted alongside an active lease preempt it. `onPreempted` is called once, as
+   * soon as such a request waits for admission; the lease's owner should then stop its work and release the lease.
+   *
+   * @remarks
+   * For a request that no client waits for any more, such as a failed build that returned its result while its
+   * independent operations continue, so that it never delays another request.
+   */
+  public markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void {
+    const state: ILeaseState | undefined = this.#leaseStates.get(lease);
+    if (!state || state.released) {
+      throw new Error('Only an active lease from this scheduler can be marked preemptible.');
+    }
+    state.onPreempted = onPreempted;
+    this.#preemptIfContended();
+  }
+
+  /**
+   * Preempts every active lease that was marked preemptible, as a request that cannot be admitted alongside it
+   * would, and resolves once all of them are released. Other leases and queued requests are not affected.
+   *
+   * @remarks
+   * For a request that the daemon does not serve, so that the command which its client then runs in-process does
+   * not run alongside work that nobody waits for.
+   */
+  public preemptLeasesAsync(): Promise<void> {
+    const releases: Promise<void>[] = [];
+    for (const state of Array.from(this.#activeLeaseStates)) {
+      if (state.onPreempted || state.preempted) {
+        releases.push(new Promise((resolve) => state.onReleased.push(resolve)));
+        this.#preempt(state);
+      }
+    }
+    return Promise.all(releases).then(() => undefined);
+  }
+
   /**
    * The number of requests currently waiting for admission.
    */
@@ -236,7 +277,13 @@ export class RequestScheduler {
     this.#activeClass = exclusivityClass;
     this.#activeRequestCount++;
 
-    const state: ILeaseState = { exclusivityClass, released: false };
+    const state: ILeaseState = {
+      exclusivityClass,
+      onPreempted: undefined,
+      preempted: false,
+      released: false,
+      onReleased: []
+    };
     const lease: IRequestLease = {
       get exclusivityClass(): RequestExclusivityClass {
         return state.exclusivityClass;
@@ -247,14 +294,20 @@ export class RequestScheduler {
         }
 
         state.released = true;
+        state.onPreempted = undefined;
+        this.#activeLeaseStates.delete(state);
         this.#activeRequestCount--;
         if (this.#activeRequestCount === 0) {
           this.#activeClass = undefined;
         }
         this.#drainQueue();
+        for (const onReleased of state.onReleased.splice(0)) {
+          onReleased();
+        }
       }
     };
     this.#leaseStates.set(lease, state);
+    this.#activeLeaseStates.add(state);
     return lease;
   }
 
@@ -275,6 +328,33 @@ export class RequestScheduler {
     if (admittedRequest) {
       this.#notifyQueuePositions();
     }
+    this.#preemptIfContended();
+  }
+
+  #preemptIfContended(): void {
+    const head: IQueuedRequest | undefined = this.#queue[0];
+    if (!head || this.#canAdmit(head.options.exclusivityClass)) {
+      return;
+    }
+    for (const state of Array.from(this.#activeLeaseStates)) {
+      this.#preempt(state);
+    }
+  }
+
+  #preempt(state: ILeaseState): void {
+    const onPreempted: (() => void) | undefined = state.onPreempted;
+    if (!onPreempted) {
+      return;
+    }
+    state.onPreempted = undefined;
+    state.preempted = true;
+    try {
+      onPreempted();
+    } catch (error) {
+      process.emitWarning(error instanceof Error ? error : String(error), {
+        code: 'RUSH_DAEMON_LEASE_PREEMPTION_CALLBACK_ERROR'
+      });
+    }
   }
 
   #rejectQueuedRequest(request: IQueuedRequest, error: Error): void {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 3b8a306224..4f0cc8d9a0 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -56,6 +56,7 @@ import type {
   IWorkspaceSuccessorLaunch
 } from './WorkspaceProcessRestart';
 import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './WorkspaceRestartArbiter';
+import { classifyRushCommand } from './RushCommandRequestPolicy';
 import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
 
 interface IExecutionState {
@@ -212,12 +213,18 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     const state: IExecutionState = { began: false, terminalAttempted: false, resultDrained: false };
     const observer: AbortController | undefined = isGraphWatch(envelope) ? new AbortController() : undefined;
     if (observer) this.#observers.add(observer);
+    const preemption: AbortController = new AbortController();
     const signal: AbortSignal = AbortSignal.any([
       destination.abortSignal,
       this.#abortController.signal,
+      preemption.signal,
       ...(observer ? [observer.signal] : [])
     ]);
-    const client: IDaemonRequestDispatchClient = createLifecycleClient(destination, signal, state);
+    // Set while a request whose work may outlast its result (see `#yieldAfterResult`) is dispatched.
+    let onResultDrained: (() => void) | undefined;
+    const client: IDaemonRequestDispatchClient = createLifecycleClient(destination, signal, state, () =>
+      onResultDrained?.()
+    );
     const admission: RequestAdmissionController = new RequestAdmissionController({
       admission: envelope.admission,
       client,
@@ -242,6 +249,9 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             receivedTimeMs
           );
           generation = prepared;
+          if (mayContinueAfterResult(envelope)) {
+            onResultDrained = () => this.#yieldAfterResult(prepared.lease, ticket, preemption);
+          }
           if (isRushxInvocation(envelope)) {
             // Never waits: exclusive holders of this lease also hold `#gate` exclusively, and this request holds it.
             scriptLease = await admission.acquireAsync(this.#scripts, RequestExclusivityClass.SharedBuild);
@@ -318,8 +328,20 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             });
             return;
           }
+          if (
+            isFallbackRejection(error) &&
+            !state.began &&
+            !state.terminalAttempted &&
+            !mayFallBackAlongsideContinuingWork(envelope)
+          ) {
+            // The client runs this command in-process instead. Work that finished requests continue would run
+            // alongside it, like two Rush commands in one checkout.
+            generation?.lease.release();
+            await this.#stopContinuingWorkAsync(client.abortSignal);
+          }
           throw error;
         } finally {
+          onResultDrained = undefined;
           generation?.lease.release();
           generation = undefined;
           scriptLease?.release();
@@ -332,6 +354,42 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * A request that may return its result before its work ends (a failed build whose independent operations
+   * continue) must not delay other requests once its client has that result, since nobody waits for that work:
+   * a restart no longer waits for it, and a request that needs this generation exclusively stops it, as does a
+   * request that the client runs in-process instead (see `#stopContinuingWorkAsync`).
+   */
+  #yieldAfterResult(
+    lease: IRequestLease,
+    ticket: IWorkspaceRestartTicket | undefined,
+    preemption: AbortController
+  ): void {
+    if (ticket) this.#restartArbiter.leave(ticket);
+    this.#gate.markLeasePreemptible(lease, () =>
+      preemption.abort(
+        new Error('A request that cannot run alongside this finished request stopped its remaining work.')
+      )
+    );
+  }
+
+  /** Stops the work that finished requests continue (see `#yieldAfterResult`) and waits until it has stopped. */
+  async #stopContinuingWorkAsync(abortSignal: AbortSignal): Promise<void> {
+    const stopped: Promise<void> = this.#gate.preemptLeasesAsync();
+    if (abortSignal.aborted) return;
+    // A client that leaves no longer runs the command, so it need not wait any more.
+    let onAbort: () => void = () => undefined;
+    const aborted: Promise<void> = new Promise((resolve) => {
+      onAbort = resolve;
+      abortSignal.addEventListener('abort', onAbort, { once: true });
+    });
+    try {
+      await Promise.race([stopped, aborted]);
+    } finally {
+      abortSignal.removeEventListener('abort', onAbort);
+    }
+  }
+
   async #prepareAsync(
     envelope: IDaemonRequestEnvelope,
     client: IDaemonRequestDispatchClient,
@@ -958,6 +1016,36 @@ function isGraphWatch(envelope: IDaemonRequestEnvelope): boolean {
   return isGraphRequest(envelope) && envelope.argv[1] === 'graph' && envelope.argv[2] === 'watch';
 }
 
+/** Only shared builds honor `returnEarlyOnFailure`, as `PhasedRequestRouter` does. */
+function mayContinueAfterResult(envelope: IDaemonRequestEnvelope): boolean {
+  return (
+    envelope.returnEarlyOnFailure === true &&
+    classifyRushCommand({ commandName: envelope.commandName, commandOrigin: envelope.commandOrigin }) ===
+      RequestExclusivityClass.SharedBuild
+  );
+}
+
+/** A rejection after which the client runs the command in-process. */
+function isFallbackRejection(error: unknown): error is DaemonRequestDispatchError {
+  return error instanceof DaemonRequestDispatchError && error.code === 'unsupported';
+}
+
+/**
+ * Whether a command that the client runs in-process may run alongside the work that finished requests continue:
+ * a rushx script, or a built-in command that only reads the workspace, such as `rush list`.
+ *
+ * @remarks
+ * The client cannot tell a built-in command from a custom one, so it sends every command that the daemon does not
+ * serve as a custom command. command-line.json cannot reuse a built-in command's name, so the name identifies one.
+ */
+function mayFallBackAlongsideContinuingWork(envelope: IDaemonRequestEnvelope): boolean {
+  return (
+    isRushxInvocation(envelope) ||
+    classifyRushCommand({ commandName: envelope.commandName, commandOrigin: 'built-in' }) ===
+      RequestExclusivityClass.SharedRead
+  );
+}
+
 function preExecutionFailure(requestId: string, error: Error): IDaemonCommandResult {
   return { requestId, exitCode: 1, outcome: 'failure', aborted: false, errorMessage: error.message };
 }
@@ -965,7 +1053,8 @@ function preExecutionFailure(requestId: string, error: Error): IDaemonCommandRes
 function createLifecycleClient(
   client: IDaemonRequestDispatchClient,
   abortSignal: AbortSignal,
-  state: IExecutionState
+  state: IExecutionState,
+  onResultDrained: () => void
 ): IDaemonRequestDispatchClient {
   return {
     abortSignal,
@@ -994,6 +1083,14 @@ function createLifecycleClient(
       state.terminalAttempted = true;
       await client.writeResultAsync(result);
       state.resultDrained = true;
+      try {
+        onResultDrained();
+      } catch (error) {
+        // The result was delivered, so this must not turn into a failure to write it.
+        process.emitWarning(error instanceof Error ? error : String(error), {
+          code: 'RUSH_DAEMON_RESULT_DRAINED_CALLBACK_ERROR'
+        });
+      }
     }
   };
 }
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts
new file mode 100644
index 0000000000..3c862e4771
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireEarlyFailure.test.ts
@@ -0,0 +1,166 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { RushDaemonHost } from '../RushDaemonHost';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import {
+  CallbackDaemonRequestResolver,
+  DaemonRequestWireClient,
+  createDeferred,
+  createWireEnvelope
+} from './DaemonRequestWireTestUtilities';
+import type { IDeferred, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const testRepoRoots: Set<string> = new Set();
+
+afterEach(() => {
+  for (const repoRoot of testRepoRoots) fs.rmSync(repoRoot, { force: true, recursive: true });
+  testRepoRoots.clear();
+});
+
+interface IEarlyFailureHost {
+  readonly abortSpy: jest.SpyInstance;
+  readonly fixture: ITestRoutingFixture;
+  readonly host: RushDaemonHost;
+  readonly releaseC: IDeferred<void>;
+  readonly repoRoot: string;
+}
+
+/** A consumes B and C. B fails once C runs, and C runs until `releaseC` resolves. */
+async function startEarlyFailureHostAsync(): Promise<IEarlyFailureHost> {
+  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-wire-early-failure-'));
+  testRepoRoots.add(repoRoot);
+  const startedC: IDeferred<void> = createDeferred<void>();
+  const releaseC: IDeferred<void> = createDeferred<void>();
+  const fixture: ITestRoutingFixture = createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Failure, () => startedC.promise)],
+      [
+        OPERATION_C,
+        new TestOperationRunner(OPERATION_C, OperationStatus.Success, async (): Promise<void> => {
+          startedC.resolve();
+          await releaseC.promise;
+        })
+      ]
+    ]),
+    [
+      [OPERATION_A, OPERATION_B],
+      [OPERATION_A, OPERATION_C]
+    ],
+    { parallelism: 2 }
+  );
+  const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+  const host: RushDaemonHost = await RushDaemonHost.startAsync({
+    createWorkspaceSessionAsync: () => Promise.resolve(fixture.session),
+    daemonVersion: 'wire-test',
+    repoRoot,
+    requestResolver: new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+      kind: 'phased',
+      request: {
+        commandName: envelope.commandName,
+        commandOrigin: envelope.commandOrigin,
+        engineShape: TEST_ENGINE_SHAPE,
+        environment: envelope.environment,
+        operationSelection: envelope.argv
+          .slice(1)
+          .map((operationId: string) => ({ enabledState: true, operationId })),
+        requestId: envelope.requestId,
+        returnEarlyOnFailure: envelope.returnEarlyOnFailure
+      }
+    })),
+    rushVersion: '5.178.1'
+  });
+  return { abortSpy, fixture, host, releaseC, repoRoot };
+}
+
+/** Counts the aborts that the router requested; every iteration's start also calls the spy without options. */
+function countTerminatingAborts(abortSpy: jest.SpyInstance): number {
+  return abortSpy.mock.calls.filter(
+    ([options]: ReadonlyArray<{ terminateRunning?: boolean } | undefined>) =>
+      options?.terminateRunning === true
+  ).length;
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+async function buildAndDisconnectAsync({ host, repoRoot }: IEarlyFailureHost): Promise<ITerminalExchange> {
+  const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+  await client.handshakeAsync();
+  const envelope: IDaemonRequestEnvelope = createWireEnvelope('agent', 'build', repoRoot, {
+    argv: ['build', OPERATION_A],
+    commandOrigin: 'built-in',
+    returnEarlyOnFailure: true
+  });
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  const exchange: ITerminalExchange = await client.readTerminalAsync('agent');
+  await client.closeAsync();
+  await client.closed;
+  return exchange;
+}
+
+describe('daemon requests that return early on failure', () => {
+  it('keeps the work that continues after the result when the client disconnects, until the daemon closes', async () => {
+    const setup: IEarlyFailureHost = await startEarlyFailureHostAsync();
+    try {
+      const exchange: ITerminalExchange = await buildAndDisconnectAsync(setup);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure', requestId: 'agent' }
+      });
+      await settleAsync();
+      expect(setup.fixture.graph.status).toBe(OperationStatus.Executing);
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(0);
+
+      const closed: Promise<void> = setup.host.closeAsync();
+      await settleAsync();
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(1);
+      setup.releaseC.resolve();
+      await closed;
+    } finally {
+      setup.releaseC.resolve();
+      await setup.host.closeAsync();
+    }
+  });
+
+  it('lets the work that continues finish after the client disconnects', async () => {
+    const setup: IEarlyFailureHost = await startEarlyFailureHostAsync();
+    try {
+      await buildAndDisconnectAsync(setup);
+      setup.releaseC.resolve();
+      while (setup.fixture.graph.status === OperationStatus.Executing) {
+        await settleAsync();
+      }
+      await settleAsync();
+      await setup.host.closeAsync();
+
+      expect(countTerminatingAborts(setup.abortSpy)).toBe(0);
+      const retainedC: OperationStatus | undefined = [...setup.fixture.graph.resultByOperation.values()].find(
+        ({ operation }) => operation.name === OPERATION_C
+      )?.status;
+      expect(retainedC).toBe(OperationStatus.Success);
+    } finally {
+      setup.releaseC.resolve();
+      await setup.host.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
new file mode 100644
index 0000000000..f24c64d808
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -0,0 +1,415 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPhasedRequest, IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+import { OperationStatus } from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+/** A consumes B and C, so A is the only target of a request that selects A. */
+const A_CONSUMES_B_AND_C: ReadonlyArray<readonly [string, string]> = [
+  [OPERATION_A, OPERATION_B],
+  [OPERATION_A, OPERATION_C]
+];
+
+interface IDeferred {
+  readonly promise: Promise<void>;
+  readonly resolve: () => void;
+}
+
+function createDeferred(): IDeferred {
+  let resolvePromise: (() => void) | undefined;
+  const promise: Promise<void> = new Promise((resolve) => {
+    resolvePromise = resolve;
+  });
+  return { promise, resolve: () => resolvePromise?.() };
+}
+
+function createRequest(
+  requestId: string,
+  returnEarlyOnFailure: boolean,
+  ...selectedOperationIds: ReadonlyArray<string>
+): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: selectedOperationIds.map((operationId: string) => ({
+      enabledState: true,
+      operationId
+    })),
+    requestId,
+    ...(returnEarlyOnFailure ? { returnEarlyOnFailure } : {})
+  };
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+interface IEarlyFailureFixture {
+  readonly events: string[];
+  readonly fixture: ITestRoutingFixture;
+  /** Lets C, which is slow, finish. */
+  readonly releaseC: () => void;
+  readonly router: PhasedRequestRouter;
+  readonly startedC: Promise<void>;
+}
+
+/**
+ * B fails and C is slow. Unless `failBeforeCStarts` is set, B fails only once C runs, so C is executing when B's
+ * failure decides a request's result.
+ */
+function createEarlyFailureFixture(
+  dependencies: ReadonlyArray<readonly [string, string]> = A_CONSUMES_B_AND_C,
+  failBeforeCStarts: boolean = false
+): IEarlyFailureFixture {
+  const startedC: IDeferred = createDeferred();
+  const releaseC: IDeferred = createDeferred();
+  const events: string[] = [];
+  const fixture: ITestRoutingFixture = createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+      [
+        OPERATION_B,
+        new TestOperationRunner(OPERATION_B, OperationStatus.Failure, async (): Promise<void> => {
+          if (!failBeforeCStarts) {
+            await startedC.promise;
+          }
+        })
+      ],
+      [
+        OPERATION_C,
+        new TestOperationRunner(OPERATION_C, OperationStatus.Success, async (): Promise<void> => {
+          startedC.resolve();
+          await releaseC.promise;
+        })
+      ]
+    ]),
+    dependencies,
+    { parallelism: 2 }
+  );
+  fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+    events.push('acquired');
+    return {
+      [Symbol.asyncDispose]: async (): Promise<void> => {
+        events.push('released');
+      }
+    };
+  };
+  return {
+    events,
+    fixture,
+    releaseC: releaseC.resolve,
+    router: new PhasedRequestRouter(fixture.session),
+    startedC: startedC.promise
+  };
+}
+
+interface ITrackedClient {
+  readonly client: TestPhasedRequestClient;
+  /** Resolves when the client's result was written, with the graph status at that moment. */
+  readonly written: Promise<OperationStatus>;
+}
+
+function trackClient(label: string, { events, fixture }: IEarlyFailureFixture): ITrackedClient {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient(label);
+  let onWritten: (status: OperationStatus) => void = () => undefined;
+  const written: Promise<OperationStatus> = new Promise((resolve) => {
+    onWritten = resolve;
+  });
+  client.onWriteAsync = async (write: ITestClientWrite): Promise<void> => {
+    if (write.result) {
+      events.push(`wrote:${label}`);
+      onWritten(fixture.graph.status);
+    }
+  };
+  return { client, written };
+}
+
+function trackResult(
+  resultPromise: Promise<IDaemonPhasedRequestResult>,
+  label: string,
+  events: string[]
+): Promise<IDaemonPhasedRequestResult> {
+  return resultPromise.then((result: IDaemonPhasedRequestResult) => {
+    events.push(`result:${label}`);
+    return result;
+  });
+}
+
+/** Counts the aborts that the router requested; every iteration's start also calls the spy without options. */
+function countTerminatingAborts(abortSpy: jest.SpyInstance): number {
+  return abortSpy.mock.calls.filter(
+    ([options]: ReadonlyArray<{ terminateRunning?: boolean } | undefined>) =>
+      options?.terminateRunning === true
+  ).length;
+}
+
+function getRetainedStatus({ graph }: ITestRoutingFixture, operationId: string): OperationStatus | undefined {
+  return [...graph.resultByOperation.values()].find(({ operation }) => operation.name === operationId)
+    ?.status;
+}
+
+function getWrittenResults(client: TestPhasedRequestClient): ReadonlyArray<IDaemonPhasedRequestResult> {
+  return client.writes.flatMap(({ result }: ITestClientWrite) => (result ? [result] : []));
+}
+
+interface IOrdinaryCase {
+  readonly commandName: string;
+  readonly dependencies: ReadonlyArray<readonly [string, string]>;
+  readonly failBeforeCStarts: boolean;
+  readonly name: string;
+  readonly selection: ReadonlyArray<string>;
+}
+
+/** Requests that ask to return early on failure, but whose failed result can only be written at the end. */
+const ORDINARY_CASES: ReadonlyArray<IOrdinaryCase> = [
+  {
+    commandName: 'build',
+    dependencies: [[OPERATION_A, OPERATION_B]],
+    failBeforeCStarts: false,
+    name: 'a target is still running',
+    selection: [OPERATION_A, OPERATION_C]
+  },
+  {
+    commandName: 'build',
+    dependencies: [[OPERATION_A, OPERATION_B]],
+    failBeforeCStarts: true,
+    name: 'nothing else is unfinished',
+    selection: [OPERATION_A]
+  },
+  {
+    commandName: 'rebuild',
+    dependencies: A_CONSUMES_B_AND_C,
+    failBeforeCStarts: false,
+    name: 'the request is not a shared build',
+    selection: [OPERATION_A]
+  }
+];
+
+describe('phased requests that return early on failure', () => {
+  it('writes a failed result once no unfinished operation can change it, and keeps independent work running', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const { events, fixture, router } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+      'agent',
+      events
+    );
+
+    expect(await agent.written).toBe(OperationStatus.Executing);
+    await settleAsync();
+    // The request stays active, holding its admission and the execution lease, until C finishes.
+    expect(events).toEqual(['acquired', 'wrote:agent']);
+    const [early] = getWrittenResults(agent.client);
+    expect(early).toMatchObject({ aborted: false, exitCode: 1, outcome: 'failure', scheduled: true });
+    expect(early.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Blocked }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Failure }),
+      expect.objectContaining({ operationId: OPERATION_C, status: OperationStatus.Executing })
+    ]);
+
+    setup.releaseC();
+    expect(await resultPromise).toBe(early);
+    expect(events).toEqual(['acquired', 'wrote:agent', 'released', 'result:agent']);
+    expect(getWrittenResults(agent.client)).toHaveLength(1);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+    // A later build can use it, e.g. from the build cache.
+    expect(getRetainedStatus(fixture, OPERATION_C)).toBe(OperationStatus.Success);
+  });
+
+  it('keeps the ordinary contract for a request that did not ask to return early', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const tracked: ITrackedClient = trackClient('human', setup);
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      setup.router.executeAsync(createRequest('human', false, OPERATION_A), tracked.client),
+      'human',
+      setup.events
+    );
+
+    await setup.startedC;
+    await settleAsync();
+    expect(setup.events).toEqual(['acquired']);
+    setup.releaseC();
+    const result: IDaemonPhasedRequestResult = await resultPromise;
+
+    expect(setup.events).toEqual(['acquired', 'released', 'wrote:human', 'result:human']);
+    expect(result.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Blocked }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Failure }),
+      expect.objectContaining({ operationId: OPERATION_C, status: OperationStatus.Success })
+    ]);
+  });
+
+  it.each(ORDINARY_CASES)(
+    'writes the result after the iteration when $name',
+    async ({ commandName, dependencies, failBeforeCStarts, selection }: IOrdinaryCase) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture(dependencies, failBeforeCStarts);
+      const tracked: ITrackedClient = trackClient('agent', setup);
+      const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+        setup.router.executeAsync(
+          { ...createRequest('agent', true, ...selection), commandName },
+          tracked.client
+        ),
+        'agent',
+        setup.events
+      );
+
+      if (!failBeforeCStarts) {
+        await setup.startedC;
+        await settleAsync();
+        expect(setup.events).toEqual(['acquired']);
+      }
+      setup.releaseC();
+      const result: IDaemonPhasedRequestResult = await resultPromise;
+
+      expect(setup.events).toEqual(['acquired', 'released', 'wrote:agent', 'result:agent']);
+      expect(result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+    }
+  );
+
+  it('keeps work that it shares with a participant that cancels after the early result', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const { events, fixture, router } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const departing: TestPhasedRequestClient = new TestPhasedRequestClient('departing');
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+      'agent',
+      events
+    );
+    const departingPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('departing', false, OPERATION_C),
+      departing
+    );
+    await agent.written;
+    departing.abortController.abort();
+
+    expect(await departingPromise).toMatchObject({ aborted: true, outcome: 'aborted' });
+    setup.releaseC();
+    await agentPromise;
+
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+    expect(getRetainedStatus(fixture, OPERATION_C)).toBe(OperationStatus.Success);
+  });
+
+  it('lets a later build wait for the work that continues instead of stopping it', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const { events, fixture, router } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+      'agent',
+      events
+    );
+    await agent.written;
+    await settleAsync();
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      router.executeAsync(createRequest('later', false, OPERATION_C), new TestPhasedRequestClient('later')),
+      'later',
+      events
+    );
+    await settleAsync();
+
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    expect(events).toEqual(['acquired', 'wrote:agent']);
+    expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(1);
+    setup.releaseC();
+    expect(await laterPromise).toMatchObject({ exitCode: 0, outcome: 'success' });
+    await agentPromise;
+
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    expect(getRetainedStatus(fixture, OPERATION_C)).toBe(OperationStatus.Success);
+
+    // The later build ran its own iteration only after the one that continued had ended.
+    expect(events.slice(0, 3)).toEqual(['acquired', 'wrote:agent', 'released']);
+    expect(events.indexOf('result:agent')).toBeLessThan(events.indexOf('result:later'));
+    expect(events.filter((event: string) => event === 'acquired')).toHaveLength(2);
+  });
+
+  it.each(['rebuild', 'list'])(
+    'lets a %s request that cannot run alongside the work that continues stop it',
+    async (commandName: string) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+      const { events, fixture, router } = setup;
+      const agent: ITrackedClient = trackClient('agent', setup);
+      const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+
+      const agentPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+        router.executeAsync(createRequest('agent', true, OPERATION_A), agent.client),
+        'agent',
+        events
+      );
+      await agent.written;
+      await settleAsync();
+      const otherPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+        router.executeAsync(
+          { ...createRequest(commandName, false, OPERATION_C), commandName },
+          new TestPhasedRequestClient(commandName)
+        ),
+        commandName,
+        events
+      );
+      await settleAsync();
+
+      expect(countTerminatingAborts(abortSpy)).toBe(1);
+      setup.releaseC();
+      await Promise.all([agentPromise, otherPromise]);
+
+      expect(events.indexOf('result:agent')).toBeLessThan(events.indexOf(`result:${commandName}`));
+      expect(getWrittenResults(agent.client)).toHaveLength(1);
+    }
+  );
+
+  it('stops the work that continues when the request is aborted after its result', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const abortSpy: jest.SpyInstance = jest.spyOn(setup.fixture.graph, 'abortCurrentIterationAsync');
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await agent.written;
+    await settleAsync();
+    expect(countTerminatingAborts(abortSpy)).toBe(0);
+    agent.client.abortController.abort();
+
+    expect(countTerminatingAborts(abortSpy)).toBe(1);
+    setup.releaseC();
+    const result: IDaemonPhasedRequestResult = await resultPromise;
+    expect(result).toBe(getWrittenResults(agent.client)[0]);
+    expect(getWrittenResults(agent.client)).toHaveLength(1);
+  });
+
+  it('rejects a flag that is not a boolean', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    await expect(
+      setup.router.executeAsync(
+        { ...createRequest('agent', false, OPERATION_A), returnEarlyOnFailure: 'yes' as unknown as boolean },
+        new TestPhasedRequestClient('agent')
+      )
+    ).rejects.toThrow('Phased request returnEarlyOnFailure must be a boolean value.');
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RequestScheduler.test.ts b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
index e927b1f9a3..8c37d84cd4 100644
--- a/libraries/rush-daemon/src/test/RequestScheduler.test.ts
+++ b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
@@ -257,3 +257,148 @@ describe(RequestScheduler.name, () => {
     expect(scheduler.activeRequestCount).toBe(0);
   });
 });
+
+describe('preemptible leases', () => {
+  it('preempts a marked lease once a request that it blocks waits, and only once', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    // A request of the same shared class is admitted alongside it.
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    expect(onPreempted).not.toHaveBeenCalled();
+
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    const read: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead
+    });
+    leftover.release();
+    build.release();
+    expect(scheduler.queuedRequestCount).toBe(2);
+    running.release();
+    (await exclusive).release();
+    (await read).release();
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('preempts at once when a blocked request already waits', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const read: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead
+    });
+    const onPreempted: jest.Mock = jest.fn(() => leftover.release());
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    (await read).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('forgets the mark when the lease is released and rejects marking an inactive lease', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const lease: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(lease, onPreempted);
+    lease.release();
+
+    const other: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    other.release();
+    (await exclusive).release();
+
+    expect(onPreempted).not.toHaveBeenCalled();
+    expect(() => scheduler.markLeasePreemptible(lease, onPreempted)).toThrow(
+      'Only an active lease from this scheduler can be marked preemptible.'
+    );
+    expect(() => new RequestScheduler().markLeasePreemptible(other, onPreempted)).toThrow();
+  });
+
+  it('reports a failing preemption callback as a warning and keeps scheduling', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const warningSpy: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => {});
+    try {
+      const lease: IRequestLease = await scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.SharedBuild
+      });
+      scheduler.markLeasePreemptible(lease, () => {
+        throw new Error('preemption failed');
+      });
+      const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive
+      });
+
+      expect(warningSpy).toHaveBeenCalledWith(expect.objectContaining({ message: 'preemption failed' }), {
+        code: 'RUSH_DAEMON_LEASE_PREEMPTION_CALLBACK_ERROR'
+      });
+      lease.release();
+      (await exclusive).release();
+      expect(scheduler.activeRequestCount).toBe(0);
+    } finally {
+      warningSpy.mockRestore();
+    }
+  });
+
+  it('preempts marked leases on request and resolves once they are released', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+    const released: string[] = [];
+
+    void scheduler.preemptLeasesAsync().then(() => released.push('first'));
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    // A later caller also waits for the lease that is stopping, without preempting it again.
+    void scheduler.preemptLeasesAsync().then(() => released.push('second'));
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    expect(scheduler.queuedRequestCount).toBe(0);
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(released).toEqual([]);
+
+    leftover.release();
+    await new Promise((resolve) => setImmediate(resolve));
+    expect(released).toEqual(['first', 'second']);
+    // The lease that is not preemptible stays active, and with no preemptible lease the call resolves at once.
+    expect(scheduler.activeRequestCount).toBe(1);
+    await expect(scheduler.preemptLeasesAsync()).resolves.toBeUndefined();
+    running.release();
+  });
+
+  it('waits for a lease whose preemption callback releases it at once', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    scheduler.markLeasePreemptible(leftover, () => leftover.release());
+
+    await scheduler.preemptLeasesAsync();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
new file mode 100644
index 0000000000..2cda8f5ef8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -0,0 +1,253 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+
+/**
+ * b consumes a and c. a fails, and c holds its build open until the test removes the `hold` marker, so a build of b
+ * that returns early on failure leaves c running.
+ */
+function createEarlyFailureFixtureAsync(restartable: boolean = false): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
+    if (restartable) {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    }
+    created.write('hold', '');
+    created.write(
+      'b/package.json',
+      JSON.stringify({
+        name: 'b',
+        version: '1.0.0',
+        dependencies: { a: '1.0.0', c: '1.0.0' },
+        scripts: { '_phase:compile': 'node build.cjs' }
+      })
+    );
+    created.write(
+      'a/build.cjs',
+      "require('node:fs').appendFileSync('../runs.txt','a\\n');console.error('failed-a');process.exitCode=1;"
+    );
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+    );
+  });
+}
+
+function countRuns(fixture: DaemonGraphTestFixture, name: string): number {
+  return fixture.runs().filter((run: string) => run === name).length;
+}
+
+async function waitForRunsAsync(fixture: DaemonGraphTestFixture, name: string, count: number): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (countRuns(fixture, name) < count && Date.now() < deadline) await delayAsync(20);
+}
+
+/** Whether an in-process Rush command could take the Rush lock that the daemon holds while it executes. */
+function isNativeLockFree(fixture: DaemonGraphTestFixture): boolean {
+  const probe: LockFile | undefined = LockFile.tryAcquire(
+    fixture.session.rushConfiguration.commonTempFolder,
+    'rush'
+  );
+  probe?.release();
+  return probe !== undefined;
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await delayAsync(0);
+  return settled;
+}
+
+async function returnEarlyAsync(fixture: DaemonGraphTestFixture): Promise<void> {
+  const early: ITerminalExchange = await fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
+  expect(early.terminal).toMatchObject({
+    kind: 'requestResult',
+    payload: { exitCode: 1, outcome: 'failure' }
+  });
+  // The client disconnected with its result, while c still runs.
+  await waitForRunsAsync(fixture, 'c', 1);
+  expect(countRuns(fixture, 'c')).toBe(1);
+  expect(countRuns(fixture, 'b')).toBe(0);
+}
+
+describe('a failed build that returns early', () => {
+  it('lets a rebuild stop the work that continues instead of waiting for it', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const rebuild: Promise<ITerminalExchange> = fixture.runAsync([
+        'rebuild',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      // The rebuild runs c again while the first c is still held, so it did not wait for that c to finish.
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      expect(fs.existsSync(hold)).toBe(true);
+
+      fs.rmSync(hold);
+      expect((await rebuild).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a later build wait for the work that continues and find it done', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      await delayAsync(1000);
+      expect(await isSettledAsync(later)).toBe(false);
+      expect(countRuns(fixture, 'c')).toBe(1);
+
+      fs.rmSync(hold);
+      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(countRuns(fixture, 'c')).toBe(1);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('stops the work that continues before it rejects a command that the client then runs in-process', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const custom: ITerminalExchange = await fixture.runAsync(['test', '--to', 'c'], {
+        commandOrigin: 'custom'
+      });
+      expect(custom.terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+      // The held c was stopped before the rejection was sent, and the in-process command can take the Rush lock.
+      expect(fs.existsSync(hold)).toBe(true);
+      expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
+      expect(isNativeLockFree(fixture)).toBe(true);
+
+      // So a later build runs c again at once, instead of waiting for the held c.
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      fs.rmSync(hold);
+      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('leaves the work that continues running for a read-only command or a rushx script that it rejects', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      // As rush-client sends them: it marks every command that the daemon does not serve as a custom command.
+      const requests: [string[], Partial<IDaemonRequestEnvelope>][] = [
+        [['list'], { commandOrigin: 'custom' }],
+        [['start'], { commandOrigin: 'custom', invocationKind: 'rushx' }]
+      ];
+      for (const [argv, overrides] of requests) {
+        expect((await fixture.runAsync(argv, overrides)).terminal).toMatchObject({
+          kind: 'requestRejected',
+          payload: { code: 'unsupported' }
+        });
+      }
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(isNativeLockFree(fixture)).toBe(false);
+      expect(countRuns(fixture, 'c')).toBe(1);
+
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      fs.rmSync(hold);
+      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(countRuns(fixture, 'c')).toBe(1);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a restart for another environment proceed without waiting for the work that continues', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync(true);
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      const before = await pongAsync(fixture);
+      await returnEarlyAsync(fixture);
+
+      const mismatched: Promise<ITerminalExchange> = fixture.runAsync(
+        ['build', '--to', 'c', '--parallelism', '3'],
+        {
+          environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+        }
+      );
+      const restart: ITerminalExchange | undefined = await Promise.race([
+        mismatched,
+        delayAsync(20_000).then(() => undefined)
+      ]);
+      expect(fs.existsSync(hold)).toBe(true);
+      expect(restart?.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      try {
+        await fixture.host.closeAsync();
+        await fixture.host.restartCompleted;
+      } finally {
+        await stopSuccessorAsync(fixture.host.paths);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  });
+});

From 7945a0e6657105888e327ee0fd885988d0421591 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:01:59 +0000
Subject: [PATCH 049/265] [rush-daemon] A request that meets a removed or
 changed installation waits for the old daemon, then restarts it and runs

Swarm integration step 34; original commit c0e17d82ab (merge of swarm/r03-t91f at 503c9e6589).
Scope: tasks 125, 91 and 116.

Brings r03's task 125 (E1 and E2 of t05 board 1726) with task 91 (a note restarts the 25 s status timer) and task 116 (long socket paths, board 1476), re-tipped onto integration 1b51e7af08 with ch01's resolution of the 108(a) conflicts in 2 files and one test mock line (board 2697, board 2732). When the daemon's installation is removed or changes, a request waits for the running requests to drain, the daemon restarts and the request runs, and the wait line names the installation as the reason; `--wait-timeout` and `--no-wait` fail with that reason. CONFIRMED by t05 on r03-t91d (board 2154, board 2197: the daemon side of cold E2 is 19 of 19 rc 0 where s13 fails 3 of 3). r05 reviewed the drain part of the re-tip (board 2680).

ch01 on d9f459d151 (board 2756): build rc 0 with 0 warnings, rush-daemon 590/0, rush-cli-client 398/0, rush-client-core 136/0, rush-daemon-protocol 200/0, rush-daemon-transport 81/0. 33 new tests fail on the old product and 4 suites can't load. 14 mutants, 8 killed; the 6 survivors are test NITs. E2E: with the installation renamed away mid-build, the next build is rc 0 in 21.4 s where the base fails at once with `Cannot find module '@microsoft/rush-lib'`. r03's own run (board 2760): rush-cli-client 398/0, rush-daemon 590/0.

Gate: ch01 GATE OK board 2756 (tree d9f459d151)

Commits folded into this step (4):
- 29b5678225 [rush-daemon] Refuse a socket path too long to reach, and keep older daemons in their folder (task 116, board 1476)
- 08ed06de32 [rush-daemon] Restart a daemon whose installation was removed or replaced (task 91)
- 1393c18030 [rush-daemon] Answer requests with the installation restart once the running requests finish (task 125)
- c2218d0792 [rush-daemon] Wait for an installation restart in the restart drain, like a restart for an environment (task 125, aligned with task 83)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  40 +-
 .../src/AgentProgressRenderer.ts              |  17 +
 apps/rush-cli-client/src/daemonCommands.ts    |  39 +-
 apps/rush-cli-client/src/daemonGraph.ts       |   7 +-
 .../src/daemonRestartNotice.ts                | 120 +++++
 apps/rush-cli-client/src/launchClient.ts      |  17 +-
 .../src/test/AgentProgressRenderer.test.ts    |  41 ++
 .../test/daemonConnectionSelection.test.ts    |  44 +-
 .../src/test/daemonRestartNotice.test.ts      | 187 ++++++++
 .../src/test/launchClient.test.ts             |  22 +
 .../src/test/returnEarlyOnFailure.test.ts     |   7 +-
 ...3-socket-path-length_2026-09-28-19-19.json |  11 +
 ...installation-changed_2026-09-28-18-45.json |  11 +
 ...llation-restart-wait_2026-09-28-20-30.json |  11 +
 ...3-socket-path-length_2026-09-28-19-19.json |  11 +
 ...installation-changed_2026-09-28-18-45.json |  11 +
 ...llation-restart-wait_2026-09-28-20-30.json |  11 +
 ...3-socket-path-length_2026-09-28-19-19.json |  11 +
 ...installation-changed_2026-09-28-18-45.json |  11 +
 ...llation-restart-wait_2026-09-28-20-30.json |  11 +
 ...3-socket-path-length_2026-09-28-19-19.json |  11 +
 ...installation-changed_2026-09-28-18-45.json |  11 +
 ...llation-restart-wait_2026-09-28-20-30.json |  11 +
 common/reviews/api/rush-client-core.api.md    |  18 +-
 .../reviews/api/rush-daemon-protocol.api.md   |  20 +
 .../reviews/api/rush-daemon-transport.api.md  |   1 +
 common/reviews/api/rush-daemon.api.md         |  11 +-
 libraries/rush-client-core/README.md          |  17 +-
 .../rush-client-core/src/DaemonClient.ts      |  15 +-
 .../src/DaemonRequestEnvironment.ts           |  33 ++
 .../src/DaemonRuntimeFolder.ts                |  16 +-
 .../src/executeWithDaemonRestart.ts           |  28 +-
 libraries/rush-client-core/src/index.ts       |   6 +-
 .../src/test/DaemonClient.test.ts             |  79 +++
 .../src/test/connectOrStartDaemon.test.ts     |  71 ++-
 .../src/test/fixtures/daemon.ts               |  14 +-
 libraries/rush-daemon-protocol/README.md      |   4 +-
 .../src/DaemonCommandResult.ts                |   6 +-
 .../src/DaemonInstallationChange.ts           |  40 ++
 .../src/DaemonPongMessage.ts                  |   6 +
 .../src/DaemonPongValidation.ts               |   2 +
 .../src/DaemonRequestAdmission.ts             |  11 +-
 .../src/InstallationChangeValidation.ts       |  51 ++
 .../src/RequestAdmissionControlValidation.ts  |   2 +
 .../src/RequestResultValidation.ts            |   2 +
 libraries/rush-daemon-protocol/src/index.ts   |  11 +-
 .../src/test/InstallationChange.test.ts       |  72 +++
 .../src/test/QueuedRestartReason.test.ts      |  51 ++
 libraries/rush-daemon-transport/README.md     |   5 +-
 .../src/DaemonReclaim.ts                      |   5 +-
 .../src/DaemonRuntimeDir.ts                   |   9 +-
 .../src/DaemonSocketPathLength.ts             |  61 +++
 .../src/DaemonTransportError.ts               |   4 +-
 .../src/test/ListenerSuccession.test.ts       |  23 +
 .../src/test/SocketPathLength.test.ts         |  80 ++++
 .../src/test/SocketPathRefusal.test.ts        |  54 +++
 libraries/rush-daemon/README.md               |  19 +
 .../rush-daemon/src/DaemonControlSession.ts   |  17 +
 .../src/DaemonInstallationMonitor.ts          | 102 ++++
 .../rush-daemon/src/RushDaemonCommandLine.ts  |   1 +
 libraries/rush-daemon/src/RushDaemonHost.ts   |  31 +-
 .../src/SelectedDaemonBootstrap.ts            |   3 +
 .../src/WorkspaceProcessRestart.ts            |  12 +-
 .../src/WorkspaceRequestAdmission.ts          |  58 ++-
 .../src/WorkspaceRequestLifecycle.ts          | 178 ++++++-
 .../src/WorkspaceRestartArbiter.ts            |  17 +-
 libraries/rush-daemon/src/index.ts            |   1 +
 libraries/rush-daemon/src/serveRushDaemon.ts  |   8 +
 .../src/test/DaemonGraphTestFixture.ts        |   6 +
 .../src/test/DaemonInstallationChange.test.ts | 453 ++++++++++++++++++
 .../src/test/RestartDrainAdmission.test.ts    | 133 ++++-
 .../utilities/test/RushLibPathHandoff.test.ts |  40 +-
 72 files changed, 2447 insertions(+), 133 deletions(-)
 create mode 100644 apps/rush-cli-client/src/daemonRestartNotice.ts
 create mode 100644 apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
 create mode 100644 common/changes/@microsoft/rush/r03-socket-path-length_2026-09-28-19-19.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-installation-changed_2026-09-28-18-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-installation-restart-wait_2026-09-28-20-30.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-socket-path-length_2026-09-28-19-19.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-installation-changed_2026-09-28-18-45.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-installation-restart-wait_2026-09-28-20-30.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-socket-path-length_2026-09-28-19-19.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r03-installation-changed_2026-09-28-18-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r03-installation-restart-wait_2026-09-28-20-30.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r03-socket-path-length_2026-09-28-19-19.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r03-installation-changed_2026-09-28-18-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r03-installation-restart-wait_2026-09-28-20-30.json
 create mode 100644 libraries/rush-client-core/src/DaemonRequestEnvironment.ts
 create mode 100644 libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
 create mode 100644 libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts
 create mode 100644 libraries/rush-daemon/src/DaemonInstallationMonitor.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index ccb39a9801..e83a16ca03 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -259,6 +259,23 @@ only an unstarted request can receive
 the typed retry authorization. Accepted queued requests drain their typed restart
 results before the old connection closes.
 
+When the daemon's own installation was removed or replaced (for example a deleted
+snapshot folder or a reinstalled Rush release), the daemon lets its running requests
+finish, answers each other request with that typed restart once they have, and then
+exits. While a command waits, the agent progress status (or stderr: on a terminal at
+each position, on a pipe once) says why:
+`rush-client: waiting for the running requests to finish (position 1); the daemon
+(PID <pid>) then restarts, because its installation at <folder> was removed.` The
+timeout rules of a restart for the request's environment apply (see above): the
+built-in default does not limit waiting for the requests that were running when the
+command arrived, but still limits it while the daemon runs a `rushx` script, and
+`--no-wait` and an explicit `--wait-timeout` limit the whole wait. A command that
+times out exits with code 1, names the changed folder and, if a script runs, suggests
+stopping it. Otherwise the client starts a daemon from its own launcher once the wait
+ends, resubmits the request, and prints one line on stderr (or above the agent
+progress rows): `rush-client: The daemon's installation at <folder> was removed;
+restarted the daemon (PID <pid>).`
+
 When the connection is lost before a command's result, the command fails with exit code 1
 and is not retried. The diagnostic keeps "Daemon disconnected before delivering a result; the
 command was not retried." and says what happened to rushd. If its process exited (a crash, an
@@ -352,18 +369,28 @@ macOS, `/tmp/rushd-<uid>/`, whatever `TMPDIR` or `XDG_RUNTIME_DIR` a shell, job,
 sandbox sets. It holds the socket (`<key>.sock`), the ownership record
 (`<key>.pid.json`) and the launcher log. To move it, set `RUSHD_RUNTIME_DIR` to an absolute
 path for every client of that checkout; the folder becomes `$RUSHD_RUNTIME_DIR/rushd-<uid>/`,
-and its file system must support hard links. A client passes the folder to the daemon it starts.
+and its file system must support hard links. A relative `RUSHD_RUNTIME_DIR` is ignored. Clients
+that disagree about `RUSHD_RUNTIME_DIR` use different folders, so each folder gets its own daemon
+for the checkout. A client passes the folder to the daemon it starts.
+The socket path must fit in a socket address: at most 108 bytes on Linux and 104 on macOS.
+`RUSHD_RUNTIME_DIR` can therefore be at most 57 bytes on Linux and 53 on macOS, minus the
+number of digits in your uid (50 bytes on Linux for uid 1234567).
 Windows uses the named pipe `\\.\pipe\rushd-<key>` and is unchanged.
 The client refuses a runtime folder that is a symbolic link, is not a directory or belongs to
-another user: commands run in-process with that reason, and `daemon` commands exit 1. Remove
-the folder or set `RUSHD_RUNTIME_DIR`. A folder that others can open is made owner-only (`0700`).
-`TMPDIR`, `TMP`, `TEMP`, `XDG_RUNTIME_DIR` and `RUSHD_RUNTIME_DIR` never select a different
-daemon; each operation receives the requesting client's values.
+another user, and a `RUSHD_RUNTIME_DIR` too long for the socket path: commands run in-process
+with that reason, and `daemon` commands exit 1. Remove the folder or change `RUSHD_RUNTIME_DIR`.
+A folder that others can open is made owner-only (`0700`).
+Within one runtime folder, `TMPDIR`, `TMP`, `TEMP`, `XDG_RUNTIME_DIR` and `RUSHD_RUNTIME_DIR`
+never select a different daemon; each operation receives the requesting client's values.
 Clients and daemons before protocol 0.12 used `$XDG_RUNTIME_DIR/rushd-<uid>/` or the
 temporary folder instead. A daemon started there stays there, where current clients do not
 look, until it idles out or is stopped with that older client (`rush-client daemon stop`).
 An older client that starts a current engine while `XDG_RUNTIME_DIR` or `TMPDIR` is set does
 not find it and runs in-process, so upgrade `rush-cli-client` with the engine.
+When a daemon before protocol 0.12 serves a current client, for example one listening in
+`/tmp/rushd-<uid>/`, the client leaves `XDG_RUNTIME_DIR`, `TMPDIR`, `TMP` and `TEMP` out of
+its requests on Linux and macOS, because that daemon would restart into the folder they name.
+Its operations see the daemon's own values; stop it (`rush-client daemon stop`) to use yours.
 
 `rush-client daemon status` only connects and checks hello/pong. It never starts
 a process, reclaims files, or treats a PID file as evidence of readiness. Both
@@ -375,6 +402,9 @@ arguments, or startup failure returns exit code 1 with a diagnostic. When the en
 refuses connections and its ownership record (`<key>.pid.json`) names a PID that no longer
 exists, the diagnostic adds that rushd exited without shutting down (an orderly shutdown
 removes the record) and that `daemon logs` may show why.
+A daemon whose installation was removed or replaced still answers, but it restarts on
+the next command: status then prints `state: "installationChanged"` with the pong's
+`installationChange` (`change` and `folder`), a hint on stderr, and exits with code 1.
 
 A startup reservation (`<key>.pid.json.starting`) refuses another daemon launch until
 the daemon it reserved becomes ready. Status reports one that remains as
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 5313181609..faa7918fca 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -224,6 +224,23 @@ export class AgentProgressRenderer {
     }
   }
 
+  /**
+   * Writes one line. On a TTY, the live rows are redrawn below it; on a pipe, the next status line is then due 25 s
+   * later.
+   */
+  public note(line: string): void {
+    if (this.#stopped) {
+      return;
+    }
+    if (this.#options.isTTY) {
+      this.#clear();
+      this.#options.write(`${line}\n`);
+      this.#paint();
+    } else {
+      this.#writePipeLine(line);
+    }
+  }
+
   /** The request waits for admission. The status lines and the summary line say so. */
   public onQueuePosition(position: number): void {
     this.#queued = { position, elapsed: this.#elapsed() };
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index 6568b5e298..adea0f631c 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -21,7 +21,7 @@ import {
   type IDaemonLockfile,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
-import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPongMessage, IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { printDaemonLogAsync } from './daemonLogs';
@@ -102,12 +102,7 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       // Nothing to shut down: restart behaves like start.
       const started: DaemonClient = await connectOrStartDaemonAsync(connectionOptions);
       try {
-        await writeStatusAsync({
-          state: 'ready',
-          socketPath: connectionOptions.paths.socketPath,
-          ...(await started.status),
-          ...getStartupReservationStatus(connectionOptions.paths)
-        });
+        await writeReadyStatusAsync(connectionOptions.paths, await started.status);
       } finally {
         await started.closeAsync();
       }
@@ -168,12 +163,7 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
     const readyClient: DaemonClient =
       command === 'restart' ? await restartDaemonAsync(client, connectionOptions) : client;
     try {
-      await writeStatusAsync({
-        state: 'ready',
-        socketPath: connectionOptions.paths.socketPath,
-        ...(await readyClient.status),
-        ...getStartupReservationStatus(connectionOptions.paths)
-      });
+      await writeReadyStatusAsync(connectionOptions.paths, await readyClient.status);
     } finally {
       if (readyClient !== client) await readyClient.closeAsync();
     }
@@ -270,3 +260,26 @@ async function restartDaemonAsync(
 function writeStatusAsync(status: object): Promise<void> {
   return writeStreamAsync(process.stdout, Buffer.from(`${JSON.stringify(status)}\n`));
 }
+
+/** A daemon whose installation was removed or replaced still answers, but restarts on its next request. */
+async function writeReadyStatusAsync(
+  paths: IDaemonPaths,
+  status: IDaemonPongMessage['payload']
+): Promise<void> {
+  const change: IDaemonPongMessage['payload']['installationChange'] = status.installationChange;
+  await writeStatusAsync({
+    state: change ? 'installationChanged' : 'ready',
+    socketPath: paths.socketPath,
+    ...status,
+    ...getStartupReservationStatus(paths)
+  });
+  if (!change) return;
+  process.exitCode = 1;
+  await writeStreamAsync(
+    process.stderr,
+    Buffer.from(
+      `rush-client: The daemon's installation at ${change.folder} was ${change.change}. ` +
+        'The next command restarts the daemon, or run "rush-client daemon restart".\n'
+    )
+  );
+}
diff --git a/apps/rush-cli-client/src/daemonGraph.ts b/apps/rush-cli-client/src/daemonGraph.ts
index 4ff1947272..cbdd9bafac 100644
--- a/apps/rush-cli-client/src/daemonGraph.ts
+++ b/apps/rush-cli-client/src/daemonGraph.ts
@@ -116,8 +116,11 @@ async function executeGraphRequestAsync(
       sawSnapshot = true;
       await writeJsonAsync(event);
     },
-    onQueuePositionAsync: (position) =>
-      writeJsonAsync({ kind: 'queuePosition', payload: { requestId: request.requestId, position } })
+    onQueuePositionAsync: (position, restartReason) =>
+      writeJsonAsync({
+        kind: 'queuePosition',
+        payload: { requestId: request.requestId, position, ...(restartReason && { restartReason }) }
+      })
   });
   if (outcome.kind === 'fallback') {
     throw new Error(
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
new file mode 100644
index 0000000000..e5d3eafe93
--- /dev/null
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -0,0 +1,120 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRestartNotice } from '@rushstack/rush-client-core';
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
+/**
+ * Returns the line that tells the user why the daemon restarted during a command, or `undefined` for a restart
+ * that needs no explanation.
+ */
+export function formatDaemonRestartNotice(notice: IDaemonRestartNotice, rushx: boolean): string | undefined {
+  const { reason, successorPid } = notice;
+  if (reason?.kind !== 'installationChanged') return undefined;
+  const pid: string = successorPid === undefined ? '' : ` (PID ${successorPid})`;
+  return (
+    `${rushx ? 'rushx-client' : 'rush-client'}: The daemon's installation at ${reason.folder} was ` +
+    `${reason.change}; restarted the daemon${pid}.`
+  );
+}
+
+/**
+ * Where a restart line goes: the agent renderer when one is active, and otherwise stderr.
+ */
+export interface IDaemonRestartNoticeTarget {
+  readonly rushx: boolean;
+  readonly agentRenderer: { note(line: string): void } | undefined;
+  readonly writeStderrAsync: (text: string) => Promise<void>;
+}
+
+/**
+ * Creates the `onRestartAsync` callback that prints {@link formatDaemonRestartNotice}'s line.
+ */
+export function createDaemonRestartNoticeHandler(
+  target: IDaemonRestartNoticeTarget
+): (notice: IDaemonRestartNotice) => Promise<void> {
+  return async (notice: IDaemonRestartNotice): Promise<void> => {
+    const line: string | undefined = formatDaemonRestartNotice(notice, target.rushx);
+    if (!line) return;
+    if (target.agentRenderer) target.agentRenderer.note(line);
+    else await target.writeStderrAsync(`${line}\n`);
+  };
+}
+
+/** The agent phase after a request that waited for a restart follows it to the new daemon. */
+export const RESUBMITTED_PHASE: string =
+  'request resubmitted to the new daemon; preparing the workspace graph';
+
+/**
+ * Returns what a queued request waits for when the daemon answers it with a restart once the requests ahead of it
+ * finish, or `undefined` for a queue position that needs no explanation.
+ */
+export function formatDaemonRestartWait(
+  position: number,
+  reason: DaemonRestartReason | undefined,
+  daemonPid: number | undefined
+): string | undefined {
+  if (reason?.kind !== 'installationChanged') return undefined;
+  const pid: string = daemonPid === undefined ? '' : ` (PID ${daemonPid})`;
+  return (
+    `waiting for the running requests to finish (position ${position}); the daemon${pid} then restarts, ` +
+    `because its installation at ${reason.folder} was ${reason.change}`
+  );
+}
+
+/**
+ * Where a request's queue positions and restart lines go.
+ */
+export interface IDaemonRequestNoticeTarget extends IDaemonRestartNoticeTarget {
+  readonly agentRenderer:
+    | { note(line: string): void; setPhase(phase: string): void; onQueuePosition(position: number): void }
+    | undefined;
+  /** On a pipe, only the first {@link formatDaemonRestartWait} line is written, and plain positions are not. */
+  readonly stderrIsTTY: boolean;
+  /** The process ID of the daemon that serves the request first. */
+  readonly daemonPid: number | undefined;
+}
+
+/**
+ * The `onRestartAsync` and `onQueuePositionAsync` callbacks of one request.
+ */
+export interface IDaemonRequestNoticeHandlers {
+  readonly onRestartAsync: (notice: IDaemonRestartNotice) => Promise<void>;
+  readonly onQueuePositionAsync: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
+}
+
+/**
+ * Creates the callbacks that tell the user why a request waits or restarted. Queue positions name the daemon that
+ * serves the request, which changes when the request follows a restart.
+ */
+export function createDaemonRequestNoticeHandlers(
+  target: IDaemonRequestNoticeTarget
+): IDaemonRequestNoticeHandlers {
+  const { agentRenderer, stderrIsTTY } = target;
+  const writeRestartNoticeAsync: (notice: IDaemonRestartNotice) => Promise<void> =
+    createDaemonRestartNoticeHandler(target);
+  let daemonPid: number | undefined = target.daemonPid;
+  let wroteRestartWait: boolean = false;
+  return {
+    onRestartAsync: async (notice: IDaemonRestartNotice): Promise<void> => {
+      daemonPid = notice.successorPid;
+      await writeRestartNoticeAsync(notice);
+      // The phase still says that the request waits for the previous daemon.
+      if (agentRenderer && wroteRestartWait) agentRenderer.setPhase(RESUBMITTED_PHASE);
+      wroteRestartWait = false;
+    },
+    onQueuePositionAsync: async (position: number, restartReason?: DaemonRestartReason): Promise<void> => {
+      const wait: string | undefined = formatDaemonRestartWait(position, restartReason, daemonPid);
+      if (agentRenderer) {
+        wroteRestartWait ||= wait !== undefined;
+        if (wait) agentRenderer.setPhase(wait);
+        else agentRenderer.onQueuePosition(position);
+      } else if (wait && (stderrIsTTY || !wroteRestartWait)) {
+        wroteRestartWait = true;
+        await target.writeStderrAsync(`${target.rushx ? 'rushx-client' : 'rush-client'}: ${wait}.\n`);
+      } else if (!wait && stderrIsTTY) {
+        await target.writeStderrAsync(`rush-client: waiting for daemon admission (position ${position}).\n`);
+      }
+    }
+  };
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 03fb79ca0c..9bd42f0ae0 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -37,6 +37,7 @@ import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
 import { getTerminalColumns } from './terminalColumns';
+import { createDaemonRequestNoticeHandlers } from './daemonRestartNotice';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
   getBundledRushVersion,
@@ -224,15 +225,13 @@ export async function launchClientAsync(
       },
       onEventAsync: async (event) =>
         agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event),
-      onQueuePositionAsync: agentRenderer
-        ? async (position) => agentRenderer.onQueuePosition(position)
-        : process.stderr.isTTY
-        ? (position) =>
-            writeStreamAsync(
-              process.stderr,
-              Buffer.from(`rush-client: waiting for daemon admission (position ${position}).\n`)
-            )
-        : undefined,
+      ...createDaemonRequestNoticeHandlers({
+        rushx,
+        agentRenderer,
+        stderrIsTTY: !!process.stderr.isTTY,
+        daemonPid: (await client.status).pid,
+        writeStderrAsync: (text) => writeStreamAsync(process.stderr, Buffer.from(text))
+      }),
       stdin: process.stdin,
       requiresStdinEnd: !process.stdin.isTTY,
       cancelOnCtrlC: !!process.stdin.isTTY,
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index d6f64f22ca..b8cfc5f1b9 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -952,6 +952,47 @@ describe(AgentProgressRenderer.name, () => {
         'rush build 4/5 · 7.5s · running: b (build) · failed: q1 (build), q2 (build), q3 (build) +1 more'
       ]);
     });
+
+    it('writes a note like any other line, so the next status line is due 25 s after it', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 20_000);
+      renderer.note('rush-client: restarted the daemon.');
+      advance(clock, 24_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush-client: restarted the daemon.',
+        'rush build · 45.0s · sent to rushd; preparing the workspace graph'
+      ]);
+    });
+  });
+
+  it('writes a note between progress lines on a pipe', () => {
+    const { renderer, output } = createRenderer(false);
+    renderer.start();
+    renderer.onRequestSent();
+    renderer.note('rush-client: restarted the daemon.');
+    renderer.finish({ exitCode: 0 });
+    renderer.note('after the summary');
+    expect(output).toEqual([
+      'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)\n',
+      'rush-client: restarted the daemon.\n',
+      'rush build: SUCCESS up to date (no operations needed) in 0.0s\n'
+    ]);
+  });
+
+  it('writes a note above the live rows on a TTY and redraws them below it', () => {
+    const { renderer, output } = createRenderer(true);
+    renderer.start();
+    renderer.note('rush-client: restarted the daemon.');
+    expect(output.slice(1, 3)).toEqual(['\x1b[3A\x1b[0J\x1b[?25h', 'rush-client: restarted the daemon.\n']);
+    expect(output[3].startsWith('\x1b[?25l')).toBe(true);
+    expect(output[3].replace(ANSI_ESCAPE, '')).toMatch(/^. rush build · 0\.0s · connecting/);
+    renderer.dispose();
   });
 
   it('renders at most three live rows on a TTY and clears them before the summary', () => {
diff --git a/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts b/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
index 52e503a603..987c7bff2a 100644
--- a/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
+++ b/apps/rush-cli-client/src/test/daemonConnectionSelection.test.ts
@@ -11,6 +11,19 @@ import { computeDaemonWorkspaceKey, resolveDaemonPathsFromProcess } from '@rushs
 
 import { getDaemonConnectionOptions, getDaemonConnectionOptionsAsync } from '../daemonConnectionOptions';
 
+function captureErrorWithRuntimeDir(base: string, action: () => void): unknown {
+  const previous: string | undefined = process.env.RUSHD_RUNTIME_DIR;
+  process.env.RUSHD_RUNTIME_DIR = base;
+  try {
+    action();
+  } catch (error) {
+    return error;
+  } finally {
+    if (previous === undefined) delete process.env.RUSHD_RUNTIME_DIR;
+    else process.env.RUSHD_RUNTIME_DIR = previous;
+  }
+}
+
 describe('version-selected daemon connection options', () => {
   let repoRoot: string;
 
@@ -55,23 +68,32 @@ describe('version-selected daemon connection options', () => {
       const base: string = path.join(repoRoot, 'runtime');
       fs.mkdirSync(base);
       fs.symlinkSync(repoRoot, path.join(base, `rushd-${process.getuid?.()}`));
-      const previous: string | undefined = process.env.RUSHD_RUNTIME_DIR;
-      process.env.RUSHD_RUNTIME_DIR = base;
-      let error: unknown;
-      try {
-        getDaemonConnectionOptions(repoRoot, Rush.version, process.env, false);
-      } catch (thrown) {
-        error = thrown;
-      } finally {
-        if (previous === undefined) delete process.env.RUSHD_RUNTIME_DIR;
-        else process.env.RUSHD_RUNTIME_DIR = previous;
-      }
+      const error: unknown = captureErrorWithRuntimeDir(base, () =>
+        getDaemonConnectionOptions(repoRoot, Rush.version, process.env, false)
+      );
       expect(error).toBeInstanceOf(DaemonClientError);
       expect(error).toMatchObject({ code: 'startupFailed' });
       expect((error as Error).message).toContain('is unsafe: it is a symbolic link');
     }
   );
 
+  (process.platform === 'win32' ? it.skip : it)(
+    'refuses a RUSHD_RUNTIME_DIR too long for a socket path before any daemon command uses it',
+    () => {
+      // Too long on every platform: the base alone is longer than a socket address allows.
+      const base: string = path.join(repoRoot, 'r'.repeat(80));
+      const error: unknown = captureErrorWithRuntimeDir(base, () =>
+        getDaemonConnectionOptions(repoRoot, Rush.version, process.env, true)
+      );
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect(error).toMatchObject({ code: 'startupFailed' });
+      expect((error as Error).message).toMatch(
+        /^The daemon socket path .*\.sock is \d+ bytes long, but this platform allows at most 10[48]\. Set RUSHD_RUNTIME_DIR to an absolute path of at most \d+ bytes, or unset it\.$/
+      );
+      expect(fs.existsSync(base)).toBe(false);
+    }
+  );
+
   it('does not select or install a launcher for a connect-only invocation', async () => {
     const options = await getDaemonConnectionOptionsAsync(repoRoot, '5.178.1', {}, false);
     expect(options.startCommand).toBeUndefined();
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
new file mode 100644
index 0000000000..1bed6ad88f
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -0,0 +1,187 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
+import {
+  RESUBMITTED_PHASE,
+  createDaemonRequestNoticeHandlers,
+  createDaemonRestartNoticeHandler,
+  formatDaemonRestartNotice,
+  formatDaemonRestartWait,
+  type IDaemonRequestNoticeHandlers
+} from '../daemonRestartNotice';
+
+// A kind that only a newer daemon knows.
+const NEWER_REASON: DaemonRestartReason = { kind: 'environmentChanged' } as unknown as DaemonRestartReason;
+
+describe(formatDaemonRestartNotice.name, () => {
+  it('names the changed installation and the new daemon', () => {
+    expect(
+      formatDaemonRestartNotice(
+        {
+          restart: 1,
+          reason: { kind: 'installationChanged', change: 'replaced', folder: '/snapshots/s9' },
+          successorPid: 42
+        },
+        false
+      )
+    ).toBe(
+      "rush-client: The daemon's installation at /snapshots/s9 was replaced; restarted the daemon (PID 42)."
+    );
+    expect(
+      formatDaemonRestartNotice(
+        {
+          restart: 1,
+          reason: { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+          successorPid: undefined
+        },
+        true
+      )
+    ).toBe("rushx-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon.");
+  });
+
+  it('says nothing about restarts that need no explanation', () => {
+    expect(
+      formatDaemonRestartNotice({ restart: 1, reason: undefined, successorPid: 42 }, false)
+    ).toBeUndefined();
+    expect(
+      formatDaemonRestartNotice({ restart: 1, reason: NEWER_REASON, successorPid: 42 }, false)
+    ).toBeUndefined();
+  });
+});
+
+describe(createDaemonRestartNoticeHandler.name, () => {
+  const notice = {
+    restart: 1,
+    reason: { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+    successorPid: 42
+  } as const;
+  const line: string =
+    "rush-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).";
+
+  it('gives the line to the agent renderer when one is active', async () => {
+    const notes: string[] = [];
+    const written: string[] = [];
+    const handler = createDaemonRestartNoticeHandler({
+      rushx: false,
+      agentRenderer: { note: (text: string) => notes.push(text) },
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    await handler(notice);
+    expect(notes).toEqual([line]);
+    expect(written).toEqual([]);
+  });
+
+  it('writes the line to stderr without an agent renderer, and stays quiet for other restarts', async () => {
+    const written: string[] = [];
+    const handler = createDaemonRestartNoticeHandler({
+      rushx: false,
+      agentRenderer: undefined,
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    await handler(notice);
+    await handler({ restart: 2, reason: undefined, successorPid: 43 });
+    expect(written).toEqual([`${line}\n`]);
+  });
+});
+
+const REMOVED: DaemonRestartReason = {
+  kind: 'installationChanged',
+  change: 'removed',
+  folder: '/snapshots/s9'
+};
+
+describe(formatDaemonRestartWait.name, () => {
+  it('says what the request waits for, and why the daemon then restarts', () => {
+    expect(formatDaemonRestartWait(2, REMOVED, 41)).toBe(
+      'waiting for the running requests to finish (position 2); the daemon (PID 41) then restarts, because ' +
+        'its installation at /snapshots/s9 was removed'
+    );
+    expect(formatDaemonRestartWait(1, { ...REMOVED, change: 'replaced' }, undefined)).toBe(
+      'waiting for the running requests to finish (position 1); the daemon then restarts, because its ' +
+        'installation at /snapshots/s9 was replaced'
+    );
+  });
+
+  it('says nothing about plain queue positions or reasons that it does not know', () => {
+    expect(formatDaemonRestartWait(1, undefined, 41)).toBeUndefined();
+    expect(formatDaemonRestartWait(1, NEWER_REASON, 41)).toBeUndefined();
+  });
+});
+
+describe(createDaemonRequestNoticeHandlers.name, () => {
+  function createHandlers(options: { agent: boolean; stderrIsTTY: boolean; rushx?: boolean }): {
+    calls: string[];
+    handlers: IDaemonRequestNoticeHandlers;
+  } {
+    const calls: string[] = [];
+    const handlers: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
+      rushx: !!options.rushx,
+      stderrIsTTY: options.stderrIsTTY,
+      daemonPid: 41,
+      agentRenderer: options.agent
+        ? {
+            note: (line: string) => calls.push(`note: ${line}`),
+            setPhase: (phase: string) => calls.push(`phase: ${phase}`),
+            onQueuePosition: (position: number) => calls.push(`position: ${position}`)
+          }
+        : undefined,
+      writeStderrAsync: async (text: string) => {
+        calls.push(`stderr: ${text}`);
+      }
+    });
+    return { calls, handlers };
+  }
+
+  it('shows a restart wait as the agent phase, and names the new daemon after the restart', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(2);
+    await handlers.onQueuePositionAsync(1, REMOVED);
+    await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+    await handlers.onQueuePositionAsync(1, REMOVED);
+    expect(calls).toEqual([
+      'position: 2',
+      `phase: ${formatDaemonRestartWait(1, REMOVED, 41)}`,
+      "note: rush-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).",
+      `phase: ${RESUBMITTED_PHASE}`,
+      `phase: ${formatDaemonRestartWait(1, REMOVED, 42)}`
+    ]);
+  });
+
+  it('keeps the agent phase after a restart that the request did not wait for', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1);
+    await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: 42 });
+    expect(calls).toEqual(['position: 1']);
+  });
+
+  it('writes every queue position to a terminal', async () => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(2);
+    await handlers.onQueuePositionAsync(2, REMOVED);
+    await handlers.onQueuePositionAsync(1, REMOVED);
+    expect(calls).toEqual([
+      'stderr: rush-client: waiting for daemon admission (position 2).\n',
+      `stderr: rush-client: ${formatDaemonRestartWait(2, REMOVED, 41)}.\n`,
+      `stderr: rush-client: ${formatDaemonRestartWait(1, REMOVED, 41)}.\n`
+    ]);
+  });
+
+  it('writes only the first restart wait for each daemon to a pipe', async () => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx: true });
+    await handlers.onQueuePositionAsync(3);
+    await handlers.onQueuePositionAsync(2, REMOVED);
+    await handlers.onQueuePositionAsync(1, REMOVED);
+    await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: 42 });
+    await handlers.onQueuePositionAsync(1, REMOVED);
+    expect(calls).toEqual([
+      `stderr: rushx-client: ${formatDaemonRestartWait(2, REMOVED, 41)}.\n`,
+      `stderr: rushx-client: ${formatDaemonRestartWait(1, REMOVED, 42)}.\n`
+    ]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index eadfc26bdc..0e52e5a8bc 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -186,6 +186,28 @@ describe('standalone rushx fallback', () => {
     }
   }, 15000);
 
+  it('status reports a daemon whose installation was removed, with rc 1', async () => {
+    const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+    host = await RushDaemonHost.startAsync({
+      repoRoot: folder,
+      rushVersion: Rush.version,
+      daemonVersion: daemonPackage.version,
+      checkInstallation: () => ({ change: 'removed', folder: '/snapshots/gone' })
+    });
+    const result: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+    expect(result.code).toBe(1);
+    expect(JSON.parse(result.stdout)).toMatchObject({
+      state: 'installationChanged',
+      socketPath: host.paths.socketPath,
+      pid: process.pid,
+      installationChange: { change: 'removed', folder: '/snapshots/gone' }
+    });
+    expect(result.stderr).toBe(
+      "rush-client: The daemon's installation at /snapshots/gone was removed. " +
+        'The next command restarts the daemon, or run "rush-client daemon restart".\n'
+    );
+  }, 15000);
+
   it('status never starts an absent daemon or falls back to command execution', async () => {
     const result: IInvocationResult = await invokeAsync(true, true, false, ['daemon', 'status']);
     expect(result.code).toBe(1);
diff --git a/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts b/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
index 13d0a016b4..3cb0891805 100644
--- a/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
+++ b/apps/rush-cli-client/src/test/returnEarlyOnFailure.test.ts
@@ -51,9 +51,10 @@ describe('returnEarlyOnFailure', () => {
     jest.spyOn(process.stderr, 'write').mockReturnValue(true);
     jest.spyOn(process.stdout, 'write').mockReturnValue(true);
     jest.spyOn(process, 'cwd').mockReturnValue(folder);
-    jest
-      .mocked(connectOrAwaitDaemonStartupAsync)
-      .mockResolvedValue({ closeAsync: async () => undefined } as unknown as DaemonClient);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: process.pid })
+    } as unknown as DaemonClient);
     jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => {
       requests.push(options.request);
       return {
diff --git a/common/changes/@microsoft/rush/r03-socket-path-length_2026-09-28-19-19.json b/common/changes/@microsoft/rush/r03-socket-path-length_2026-09-28-19-19.json
new file mode 100644
index 0000000000..bba1834b76
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-socket-path-length_2026-09-28-19-19.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-installation-changed_2026-09-28-18-45.json b/common/changes/@rushstack/rush-cli-client/r03-installation-changed_2026-09-28-18-45.json
new file mode 100644
index 0000000000..48b6b0446e
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-installation-changed_2026-09-28-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Print one line when a command restarted the daemon because its installation was removed or replaced, and make `rush-client daemon status` report such a daemon as `installationChanged` with exit code 1.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-installation-restart-wait_2026-09-28-20-30.json b/common/changes/@rushstack/rush-cli-client/r03-installation-restart-wait_2026-09-28-20-30.json
new file mode 100644
index 0000000000..1ff943b440
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-installation-restart-wait_2026-09-28-20-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "While a command waits for the running requests to finish before a daemon whose installation changed restarts, say so in the agent progress status or on stderr, and name the daemon's PID and the changed folder.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r03-socket-path-length_2026-09-28-19-19.json b/common/changes/@rushstack/rush-cli-client/r03-socket-path-length_2026-09-28-19-19.json
new file mode 100644
index 0000000000..7d1936bca0
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-socket-path-length_2026-09-28-19-19.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Refuse a `RUSHD_RUNTIME_DIR` too long for the daemon socket path: commands run in-process with the reason, and `daemon` commands exit 1.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-installation-changed_2026-09-28-18-45.json b/common/changes/@rushstack/rush-client-core/r03-installation-changed_2026-09-28-18-45.json
new file mode 100644
index 0000000000..cdcd77cad1
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-installation-changed_2026-09-28-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add an `onRestartAsync` callback to `executeWithDaemonRestartAsync` that reports each hand-off to a successor daemon, with the restart reason that the old daemon gave.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-installation-restart-wait_2026-09-28-20-30.json b/common/changes/@rushstack/rush-client-core/r03-installation-restart-wait_2026-09-28-20-30.json
new file mode 100644
index 0000000000..869fcc8abd
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-installation-restart-wait_2026-09-28-20-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Pass a queue position's `restartReason` to `onQueuePositionAsync` as its second argument.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-socket-path-length_2026-09-28-19-19.json b/common/changes/@rushstack/rush-client-core/r03-socket-path-length_2026-09-28-19-19.json
new file mode 100644
index 0000000000..69f5de0395
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-socket-path-length_2026-09-28-19-19.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Report a socket path too long for a socket address as `startupFailed`, before a daemon is started. On POSIX, leave `XDG_RUNTIME_DIR`, `TMPDIR`, `TMP` and `TEMP` out of requests to a daemon before protocol 0.12, which would otherwise restart into a runtime folder that current clients never look in.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r03-installation-changed_2026-09-28-18-45.json b/common/changes/@rushstack/rush-daemon-protocol/r03-installation-changed_2026-09-28-18-45.json
new file mode 100644
index 0000000000..02efe6110d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r03-installation-changed_2026-09-28-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `restartReason` to restart results and an optional `installationChange` to `pong`, so that a daemon can say that its installation was removed or replaced. Older peers ignore both.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r03-installation-restart-wait_2026-09-28-20-30.json b/common/changes/@rushstack/rush-daemon-protocol/r03-installation-restart-wait_2026-09-28-20-30.json
new file mode 100644
index 0000000000..551b74d262
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r03-installation-restart-wait_2026-09-28-20-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add the optional `restartReason` to `queuePosition` control messages, for a request that the daemon answers with a restart once the requests ahead of it finish.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/r03-socket-path-length_2026-09-28-19-19.json b/common/changes/@rushstack/rush-daemon-transport/r03-socket-path-length_2026-09-28-19-19.json
new file mode 100644
index 0000000000..e6b41a1cbd
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r03-socket-path-length_2026-09-28-19-19.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Refuse a POSIX socket path longer than a socket address allows (108 bytes on Linux, 104 elsewhere) with the new `socketPathTooLong` error code, before the runtime folder is checked or created. Node.js would truncate it, so no client could reach the daemon.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r03-installation-changed_2026-09-28-18-45.json b/common/changes/@rushstack/rush-daemon/r03-installation-changed_2026-09-28-18-45.json
new file mode 100644
index 0000000000..334e482033
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r03-installation-changed_2026-09-28-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Restart instead of failing every request with `Cannot find module '@microsoft/rush-lib'` after the daemon's installation folder was removed or replaced: new and queued requests get a typed restart result that names the folder, running requests finish, and the daemon exits so that the client starts a new one. `pong` reports the change, the daemon resolves `_RUSH_LIB_PATH` once at startup, and the daemon log records every rejected request.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r03-installation-restart-wait_2026-09-28-20-30.json b/common/changes/@rushstack/rush-daemon/r03-installation-restart-wait_2026-09-28-20-30.json
new file mode 100644
index 0000000000..5a524ab6a7
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r03-installation-restart-wait_2026-09-28-20-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "After its installation was removed or replaced, the daemon answers each other request with the typed restart result only once the requests that it serves finish (the restart drain), instead of at once, so that clients do not give up waiting for it to exit while a long build still runs. As for a restart for an environment, a client-default wait timeout does not limit waiting for the requests that were already being served unless a rushx script runs, queue positions carry the restart reason, and timeouts name the changed folder. A request that fails before it begins while the installation is changed gets the restart result instead of `routingFailed`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index c28959d376..6955908922 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -4,6 +4,7 @@
 
 ```ts
 
+import { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 import { IDaemonClientCaps } from '@rushstack/rush-daemon-protocol';
 import { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
 import { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
@@ -72,7 +73,7 @@ export class DaemonStartupPendingError extends Error {
 }
 
 // @beta
-export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, execution: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
+export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, options: IExecuteWithDaemonRestartOptions): Promise<DaemonClientOutcome>;
 
 // @beta
 export function getDaemonLogFilePath(paths: IDaemonPaths): string;
@@ -132,8 +133,7 @@ export interface IDaemonClientExecuteOptions {
     readonly initialRawMode?: boolean;
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
-    // (undocumented)
-    readonly onQueuePositionAsync?: (position: number) => Promise<void>;
+    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
     // (undocumented)
     readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
     // (undocumented)
@@ -146,6 +146,13 @@ export interface IDaemonClientExecuteOptions {
     readonly stdin?: Readable;
 }
 
+// @beta
+export interface IDaemonRestartNotice {
+    readonly reason: DaemonRestartReason | undefined;
+    readonly restart: number;
+    readonly successorPid: number | undefined;
+}
+
 // @beta
 export interface IDaemonStartCommand {
     // (undocumented)
@@ -165,6 +172,11 @@ export interface IDaemonStartupReservationInfo {
     readonly path: string;
 }
 
+// @beta
+export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOptions {
+    readonly onRestartAsync?: (notice: IDaemonRestartNotice) => Promise<void>;
+}
+
 // @beta
 export function inspectDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservationInfo | undefined;
 
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index da5aff785b..3e1b962294 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -137,6 +137,9 @@ export type DaemonHandshakeOutcome = {
     readonly error: ProtocolVersionMismatchError;
 };
 
+// @beta
+export type DaemonInstallationChangeKind = 'removed' | 'replaced';
+
 // @beta
 export type DaemonInvocationKind = 'rush' | 'rushx';
 
@@ -166,6 +169,9 @@ export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-time
 // @beta
 export type DaemonRequestRejectionCode = 'invalidRequest' | 'routingFailed' | 'unsupported' | 'workspaceRecreationRequired';
 
+// @beta
+export type DaemonRestartReason = IDaemonInstallationChangedRestartReason;
+
 // @beta
 export type DaemonRushCommandOrigin = 'built-in' | 'custom';
 
@@ -244,6 +250,7 @@ export interface IDaemonCommandResult {
     readonly exitCode: number;
     readonly outcome: DaemonCommandOutcome;
     readonly requestId: string;
+    readonly restartReason?: DaemonRestartReason;
     readonly retryAfterRestart?: true;
 }
 
@@ -389,6 +396,17 @@ export interface IDaemonInitializedGraphSnapshot {
     readonly workspaceGeneration?: string;
 }
 
+// @beta
+export interface IDaemonInstallationChange {
+    readonly change: DaemonInstallationChangeKind;
+    readonly folder: string;
+}
+
+// @beta
+export interface IDaemonInstallationChangedRestartReason extends IDaemonInstallationChange {
+    readonly kind: 'installationChanged';
+}
+
 // @beta
 export interface IDaemonLogChunk {
     readonly chunk: Uint8Array;
@@ -480,6 +498,7 @@ export interface IDaemonPongMessage {
         readonly pid?: number;
         readonly residentMemoryBytes?: number;
         readonly workspace?: IDaemonWorkspaceStatus;
+        readonly installationChange?: IDaemonInstallationChange;
         readonly uptimeMs: number;
     };
 }
@@ -546,6 +565,7 @@ export interface IDaemonRequestQueuePositionMessage {
     readonly payload: {
         readonly position: number;
         readonly requestId: string;
+        readonly restartReason?: DaemonRestartReason;
     };
 }
 
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index df4aaef215..fa87bdd96d 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -59,6 +59,7 @@ export enum DaemonTransportErrorCode {
     connectionRefused = "connectionRefused",
     connectionTimeout = "connectionTimeout",
     daemonAlreadyRunning = "daemonAlreadyRunning",
+    socketPathTooLong = "socketPathTooLong",
     transportClosed = "transportClosed",
     unsafeRuntimeDirectory = "unsafeRuntimeDirectory"
 }
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 1bc9b6fdba..3dd40483e3 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -15,6 +15,7 @@ import type { GetInputsSnapshotAsyncFn } from '@microsoft/rush-lib';
 import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
 import { IDaemonConfigurationJson } from '@microsoft/rush-lib';
 import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonInstallationChange } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import type { IDaemonPhasedRequest } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
@@ -36,6 +37,12 @@ import { RushConfiguration } from '@microsoft/rush-lib';
 import type { RushConfigurationProject } from '@microsoft/rush-lib';
 import type { RushSession } from '@microsoft/rush-lib';
 
+// @beta
+export function captureDaemonInstallation(folders: ReadonlyArray<string>): CheckDaemonInstallation;
+
+// @beta
+export type CheckDaemonInstallation = () => IDaemonInstallationChange | undefined;
+
 // @beta
 export type CreateWorkspaceEngineComponentsAsync = (options: ICreateWorkspaceEngineComponentsOptions) => Promise<IWorkspaceEngineComponents>;
 
@@ -465,12 +472,14 @@ export interface IResolveGlobalCommandRequestOptions {
 
 // @beta
 export interface IRushDaemonHostOptions {
+    readonly checkInstallation?: CheckDaemonInstallation;
     readonly createWorkspaceSessionAsync?: WorkspaceSessionFactory;
     readonly daemonVersion: string;
     readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
     readonly idleTimeoutSeconds?: number;
     readonly onError?: (error: Error) => void;
     readonly onInteractiveConnection?: (connection: IDaemonInteractiveConnection) => void;
+    readonly onLog?: (message: string) => void;
     readonly repoRoot: string;
     readonly requestResolver?: IDaemonRequestResolver;
     readonly rushVersion: string;
@@ -556,7 +565,7 @@ export interface IWorkspaceProcessRestartContext {
     // (undocumented)
     readonly environment: Readonly<Record<string, string>>;
     // (undocumented)
-    readonly reason: 'hard-input-change' | 'native-mutation';
+    readonly reason: 'hard-input-change' | 'native-mutation' | 'installation-changed';
     // (undocumented)
     readonly repoRoot: string;
     // (undocumented)
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 1af7286b24..41581c27bd 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -12,7 +12,9 @@ This package has no
 capabilities and admission settings before startup. `DaemonClient.connectAsync()`
 negotiates hello, subscribes capabilities, and awaits a matching pong.
 `executeAsync()` uses one fresh connection per invocation and closes it after the
-authoritative result. Async stdout/stderr/event callbacks are awaited in wire order,
+authoritative result. On POSIX, a request to a peer before 0.12 leaves out `XDG_RUNTIME_DIR`,
+`TMPDIR`, `TMP` and `TEMP`, because such a daemon restarts into the runtime folder they name,
+where current clients never look; its operations see the daemon's own values. Async stdout/stderr/event callbacks are awaited in wire order,
 so slow destinations backpressure the transport. Log callbacks receive raw bytes
 and the protocol's operation ID. The calling client owns terminal presentation.
 
@@ -44,6 +46,14 @@ error messages. When the retry bound or the admission deadline is exhausted, it
 returns a `restartRetriesExhausted` fallback outcome so the caller can run in-process.
 Cancellation stops waiting without killing a daemon. Disabling auto-start still
 permits waiting for a host-started successor, but never lets the client spawn one.
+A result may say why the daemon restarts (`restartReason`); for `installationChanged`,
+the daemon's installation was removed or replaced, so it exits without a successor and
+the client's own `startCommand` starts one. Such a daemon answers only once the requests
+ahead of the request finish; meanwhile `onQueuePositionAsync` gets the reason as its second
+argument. After each hand-off to a ready successor,
+the optional `onRestartAsync` callback gets the restart number, the reason (`undefined`
+when the daemon gave none, as older daemons do) and the successor's PID, before the
+request is resubmitted.
 
 A connection lost before the result stays a `disconnected` `DaemonClientError`. Its message
 starts with "Daemon disconnected before delivering a result; the command was not retried."
@@ -60,8 +70,9 @@ signal fires, the error is unchanged, so the caller reports the cancellation.
 arguments, environment and cwd. It does not discover or install a Rush version.
 It adds `RUSHD_RUNTIME_DIR`, set to the base of `paths.runtimeDir`, to that environment, so the
 daemon resolves the same paths as its clients whatever environment it inherits.
-A runtime folder that is a symbolic link, is not a directory or belongs to another user is
-refused as `startupFailed` before anything in it is trusted
+A runtime folder that is a symbolic link, is not a directory or belongs to another user, or
+whose socket path is too long for a socket address (from a long `RUSHD_RUNTIME_DIR`), is
+refused as `startupFailed` before anything in it is trusted or created
 (`assertDaemonRuntimeFolderIsPrivate()`); one that others can open is made owner-only.
 It reuses transport paths/reclaim checks and node-core-library's process-identity
 aware `LockFile` for the first-start mutex, including kernel-enforced exclusive
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 2e7b2831c4..2bf2a57f1b 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -18,6 +18,7 @@ import {
   encodeDaemonControlMessage,
   encodeDaemonStdinChunk,
   type DaemonControlMessage,
+  type DaemonRestartReason,
   type IDaemonClientCaps,
   type IDaemonCommandResult,
   type IDaemonEventEnvelope,
@@ -31,6 +32,7 @@ import {
 import { connectDaemonAsync, type DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientError';
+import { adaptDaemonRequestToPeer } from './DaemonRequestEnvironment';
 
 const MAX_STDIN_CHUNK_BYTES: number = 64 * 1024;
 
@@ -49,7 +51,11 @@ export interface IDaemonClientExecuteOptions {
   readonly onStdoutAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
   readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
   readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
-  readonly onQueuePositionAsync?: (position: number) => Promise<void>;
+  /**
+   * Called with the request's one-based queue position whenever it changes. `restartReason` is set when the daemon
+   * answers the request with a restart result for that reason once the requests ahead of it finish.
+   */
+  readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
   readonly abortSignal?: AbortSignal;
   /** Protocol 0.7 input waits for stdinReady credits; older peers use the legacy raw-mode/terminal policy. */
   readonly stdin?: Readable;
@@ -273,7 +279,10 @@ export class DaemonClient {
       }
       this.#result = deferred();
       await Promise.all([
-        this.#sendControlAsync({ kind: 'requestStart', payload: options.request }),
+        this.#sendControlAsync({
+          kind: 'requestStart',
+          payload: adaptDaemonRequestToPeer(options.request, this.protocolVersion, process.platform)
+        }),
         this.#result.promise
       ]);
       return await this.#result.promise;
@@ -439,7 +448,7 @@ export class DaemonClient {
         }
         return;
       case 'queuePosition':
-        await execution.onQueuePositionAsync?.(message.payload.position);
+        await execution.onQueuePositionAsync?.(message.payload.position, message.payload.restartReason);
         return;
       default:
         throw new DaemonProtocolError(
diff --git a/libraries/rush-client-core/src/DaemonRequestEnvironment.ts b/libraries/rush-client-core/src/DaemonRequestEnvironment.ts
new file mode 100644
index 0000000000..dee83b52bc
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonRequestEnvironment.ts
@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR,
+  type IDaemonProtocolVersion,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+// Before protocol 0.12, a daemon listened in XDG_RUNTIME_DIR or else in os.tmpdir(), which reads TMPDIR, then
+// TMP, then TEMP. It restarted when a request's XDG_RUNTIME_DIR or TMPDIR differed from its own, and its
+// successor listened in the folder that the request named.
+const RUNTIME_FOLDER_VARIABLES: readonly string[] = ['XDG_RUNTIME_DIR', 'TMPDIR', 'TMP', 'TEMP'];
+
+/**
+ * Returns the request to send to a daemon that negotiated `peer`.
+ *
+ * @remarks
+ * A daemon older than protocol 0.12 would restart into a folder that current clients never look in when a
+ * request names another runtime folder, and every later client of the checkout would then wait for a daemon it
+ * cannot find. On POSIX, its requests leave those variables out, so that it serves them with its own values.
+ * Windows is unchanged: its pipe name does not depend on them, and its builds need `TMP` and `TEMP`.
+ */
+export function adaptDaemonRequestToPeer(
+  request: IDaemonRequestEnvelope,
+  peer: IDaemonProtocolVersion,
+  platform: NodeJS.Platform
+): IDaemonRequestEnvelope {
+  if (platform === 'win32' || peer.minor >= DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR) return request;
+  const environment: Record<string, string> = { ...request.environment };
+  for (const name of RUNTIME_FOLDER_VARIABLES) delete environment[name];
+  return { ...request, environment };
+}
diff --git a/libraries/rush-client-core/src/DaemonRuntimeFolder.ts b/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
index 3d5694fc55..d7583e70c3 100644
--- a/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
+++ b/libraries/rush-client-core/src/DaemonRuntimeFolder.ts
@@ -14,19 +14,25 @@ import {
 
 import { DaemonClientError } from './DaemonClientError';
 
+const RUNTIME_FOLDER_ERROR_CODES: ReadonlySet<DaemonTransportErrorCode> = new Set([
+  DaemonTransportErrorCode.unsafeRuntimeDirectory,
+  DaemonTransportErrorCode.socketPathTooLong
+]);
+
 function toClientError(error: unknown): unknown {
-  return error instanceof DaemonTransportError &&
-    error.code === DaemonTransportErrorCode.unsafeRuntimeDirectory
+  return error instanceof DaemonTransportError && RUNTIME_FOLDER_ERROR_CODES.has(error.code)
     ? new DaemonClientError('startupFailed', error.message, { cause: error })
     : error;
 }
 
 /**
  * Checks the daemon runtime folder, when it exists, before a client trusts the socket, lockfile or log inside
- * it (see `assertDaemonRuntimeDirIsPrivate` in `@rushstack/rush-daemon-transport`).
+ * it (see `assertDaemonRuntimeDirIsPrivate` in `@rushstack/rush-daemon-transport`). This includes a socket
+ * path too long to connect to, which only a long `RUSHD_RUNTIME_DIR` produces.
  *
- * @throws {@link DaemonClientError} with code `startupFailed` when the folder is unsafe, so that a caller that
- * falls back to in-process Rush for startup failures also does so here.
+ * @throws {@link DaemonClientError} with code `startupFailed` when the folder is unsafe or the socket path is
+ * too long, so that a caller that falls back to in-process Rush for startup failures also does so here, before
+ * it starts a daemon that no client could reach.
  *
  * @beta
  */
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index ed6124beb7..9d5fc8d4a2 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -5,6 +5,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import {
   DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR,
+  type DaemonRestartReason,
   type IDaemonRequestAdmissionOptions
 } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
@@ -29,6 +30,28 @@ const RETRY_JITTER_MAX_MS: number = 1000;
 /** Matches the default of {@link IConnectOrStartDaemonOptions.startupTimeoutMs}. */
 const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
 
+/**
+ * A daemon restart that a request followed.
+ * @beta
+ */
+export interface IDaemonRestartNotice {
+  /** 1 for the first restart that the request followed. */
+  readonly restart: number;
+  /** Why the previous daemon asked for the restart; `undefined` when it did not say. */
+  readonly reason: DaemonRestartReason | undefined;
+  /** The process ID of the daemon that the request is sent to next. */
+  readonly successorPid: number | undefined;
+}
+
+/**
+ * Options for {@link executeWithDaemonRestartAsync}.
+ * @beta
+ */
+export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOptions {
+  /** Called after a successor daemon is ready, before the request is sent to it. */
+  readonly onRestartAsync?: (notice: IDaemonRestartNotice) => Promise<void>;
+}
+
 /**
  * Executes on a ready client, retrying only for a typed pre-execution restart.
  * Preserves the original request, callbacks and unread input; never retries connection loss.
@@ -43,8 +66,9 @@ const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
 export async function executeWithDaemonRestartAsync(
   client: DaemonClient,
   connection: IConnectOrStartDaemonOptions,
-  execution: IDaemonClientExecuteOptions
+  options: IExecuteWithDaemonRestartOptions
 ): Promise<DaemonClientOutcome> {
+  const { onRestartAsync, ...execution } = options;
   const startedAt: number = Date.now();
   const abortSignal: AbortSignal | undefined =
     execution.abortSignal && connection.abortSignal
@@ -65,6 +89,7 @@ export async function executeWithDaemonRestartAsync(
   let previous: DaemonClient | undefined;
   try {
     for (let retry: number = 1; outcome.kind === 'result' && outcome.result.retryAfterRestart; retry++) {
+      const reason: DaemonRestartReason | undefined = outcome.result.restartReason;
       if (!owner) {
         throw new DaemonClientError(
           'startupFailed',
@@ -118,6 +143,7 @@ export async function executeWithDaemonRestartAsync(
       const remainingMs: number | undefined = getRemainingMs();
       if (isExpired(remainingMs)) return restartExhaustedOutcome(retry);
       owner = await attestOwnerAsync(successor, connection);
+      await onRestartAsync?.({ restart: retry, reason, successorPid: (await successor.status).pid });
       outcome = await executeOnDaemonAsync(successor, connection, {
         ...execution,
         abortSignal,
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index c1ae540535..32bc6691f2 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -26,7 +26,11 @@ export {
   type DaemonStartupHelperState,
   type IDaemonStartupReservationInfo
 } from './DaemonStartupReservation';
-export { executeWithDaemonRestartAsync } from './executeWithDaemonRestart';
+export {
+  executeWithDaemonRestartAsync,
+  type IDaemonRestartNotice,
+  type IExecuteWithDaemonRestartOptions
+} from './executeWithDaemonRestart';
 export {
   connectOrAwaitDaemonStartupAsync,
   DaemonStartupPendingError,
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index 9a2ccc6af8..5498a3d4ea 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -18,6 +18,7 @@ import {
 import { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { DaemonClient } from '../DaemonClient';
+import { adaptDaemonRequestToPeer } from '../DaemonRequestEnvironment';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 
 describe('DaemonClient', () => {
@@ -187,6 +188,46 @@ describe('DaemonClient', () => {
     expect(stdin.read().toString()).toBe('untouched');
   });
 
+  const RUNTIME_FOLDER_ENVIRONMENT: Readonly<Record<string, string>> = {
+    TEST: 'one',
+    XDG_RUNTIME_DIR: '/run/user/1000',
+    TMPDIR: '/scratch/tmp',
+    TMP: '/scratch/tmp',
+    TEMP: '/scratch/tmp'
+  };
+
+  (process.platform === 'win32' ? it.skip : it).each([
+    [11, ['TEST']],
+    [12, ['TEMP', 'TEST', 'TMP', 'TMPDIR', 'XDG_RUNTIME_DIR']]
+  ])('sends a protocol 0.%s daemon only the runtime folder variables it can use', async (minor, names) => {
+    peerVersion = { major: 0, minor: Number(minor) };
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId: message.payload.requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    const envelope = captureDaemonRequest({ ...request(), environment: RUNTIME_FOLDER_ENVIRONMENT });
+    expect(await client.executeAsync({ request: envelope })).toMatchObject({ kind: 'result' });
+    const start: DaemonControlMessage | undefined = controls.find(
+      (message) => message.kind === 'requestStart'
+    );
+    expect(Object.keys(start?.kind === 'requestStart' ? start.payload.environment : {}).sort()).toEqual(
+      names
+    );
+    expect(envelope.environment).toEqual(RUNTIME_FOLDER_ENVIRONMENT);
+  });
+
+  it('keeps the runtime folder variables for an older daemon on Windows', () => {
+    const envelope = captureDaemonRequest({ ...request(), environment: RUNTIME_FOLDER_ENVIRONMENT });
+    expect(adaptDaemonRequestToPeer(envelope, { major: 0, minor: 11 }, 'win32')).toBe(envelope);
+    expect(adaptDaemonRequestToPeer(envelope, { major: 0, minor: 11 }, 'darwin').environment).toEqual({
+      TEST: 'one'
+    });
+  });
+
   it.each(['output', 'event', 'stdin', 'raw-mode', 'old-peer'])(
     'does not authorize restart replay after %s',
     async (mode) => {
@@ -288,6 +329,44 @@ describe('DaemonClient', () => {
     expect(controls.filter((message) => message.kind === 'requestCancel')).toHaveLength(1);
   });
 
+  it('reports why a queued request waits when the daemon restarts after the requests ahead of it', async () => {
+    const restartReason = {
+      kind: 'installationChanged',
+      change: 'removed',
+      folder: '/snapshots/s9'
+    } as const;
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      const { requestId } = message.payload;
+      await sendAsync({ kind: 'queuePosition', payload: { position: 2, requestId } });
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId, restartReason } });
+      await sendAsync({
+        kind: 'requestResult',
+        payload: {
+          requestId,
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          retryAfterRestart: true,
+          restartReason
+        }
+      });
+    };
+    const positions: unknown[] = [];
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    const outcome = await client.executeAsync({
+      request: request(),
+      onQueuePositionAsync: async (position, reason) => {
+        positions.push([position, reason]);
+      }
+    });
+    expect(positions).toEqual([
+      [2, undefined],
+      [1, restartReason]
+    ]);
+    expect(outcome).toMatchObject({ kind: 'result', result: { retryAfterRestart: true, restartReason } });
+  });
+
   it('forwards raw stdin only after acknowledgement and restores raw mode', async () => {
     const stdin = new PassThrough();
     const rawModes: boolean[] = [];
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 16f76b614f..dca59836f5 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -30,7 +30,7 @@ import {
   resolveDaemonStartupReservationAsync,
   type IConnectOrStartDaemonOptions
 } from '../connectOrStartDaemon';
-import { executeWithDaemonRestartAsync } from '../executeWithDaemonRestart';
+import { executeWithDaemonRestartAsync, type IDaemonRestartNotice } from '../executeWithDaemonRestart';
 import { getDaemonStartupFilePath, releaseDaemonStartup, reserveDaemonStartup } from '../DaemonStartup';
 import { inspectDaemonStartupReservation } from '../DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
@@ -777,6 +777,50 @@ describe('detached daemon startup', () => {
     15000
   );
 
+  it.each([
+    ['restart-once', false],
+    ['restart-installation', true]
+  ])('tells the caller about the restart that it followed for %s', async (mode, reported) => {
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+    };
+    const client = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false }
+    });
+    const notices: IDaemonRestartNotice[] = [];
+    const outcome = await executeWithDaemonRestartAsync(client, connection, {
+      request,
+      onRestartAsync: async (notice) => {
+        // The successor has not received the request yet.
+        expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
+        notices.push(notice);
+      }
+    });
+    expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    const starts: number[] = fs
+      .readFileSync(path.join(folder, 'starts'), 'utf8')
+      .trim()
+      .split('\n')
+      .map(Number);
+    expect(starts).toHaveLength(2);
+    expect(notices).toEqual([
+      {
+        restart: 1,
+        reason: reported
+          ? { kind: 'installationChanged', change: 'removed', folder: path.join(folder, 'gone') }
+          : undefined,
+        successorPid: starts[1]
+      }
+    ]);
+  });
+
   it.each(['execution', 'connection'])(
     'cancels successor waiting using the %s signal without replay',
     async (source) => {
@@ -1246,6 +1290,31 @@ describe('detached daemon startup', () => {
     }
   );
 
+  (process.platform === 'win32' ? it.skip : it)(
+    'reports a socket path too long to connect to as a startup failure without starting a daemon',
+    async () => {
+      // Node cuts a socket path longer than sun_path (108 bytes on Linux, 104 on macOS) short, so no client
+      // could reach a daemon published there.
+      const base: string = path.join(folder, 'r'.repeat(100));
+      const runtimeDir: string = path.join(base, `rushd-${process.getuid?.()}`);
+      const failure: Promise<DaemonClient> = connectOrStartDaemonAsync({
+        ...options,
+        paths: {
+          runtimeDir,
+          socketPath: path.join(runtimeDir, 'd.sock'),
+          lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+        }
+      });
+      await expect(failure).rejects.toBeInstanceOf(DaemonClientError);
+      await expect(failure).rejects.toMatchObject({ code: 'startupFailed' });
+      await expect(failure).rejects.toThrow(
+        /^The daemon socket path .*\/d\.sock is \d+ bytes long, but this platform allows at most 10[48]\. Set RUSHD_RUNTIME_DIR to an absolute path of at most \d+ bytes, or unset it\.$/
+      );
+      expect(fs.existsSync(base)).toBe(false);
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    }
+  );
+
   (process.platform === 'win32' ? it.skip : it)(
     'refuses linked log destinations without changing their target',
     async () => {
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index ea78f0408b..faeac1e486 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -101,7 +101,8 @@ async function mainAsync(): Promise<void> {
             : 0;
           const restart: boolean =
             restartMode !== undefined &&
-            (restartMode !== 'restart-once' || restartCount < 1) &&
+            ((restartMode !== 'restart-once' && restartMode !== 'restart-installation') ||
+              restartCount < 1) &&
             (restartMode !== 'restart-twice' || restartCount < 2);
           const drainMsPath: string = path.join(folder, 'drain-ms');
           if (restart && fs.existsSync(drainMsPath)) {
@@ -117,7 +118,16 @@ async function mainAsync(): Promise<void> {
                 exitCode: restart ? 1 : 0,
                 outcome: restart ? 'failure' : 'success',
                 aborted: false,
-                ...(restart ? { retryAfterRestart: true as const } : {})
+                ...(restart ? { retryAfterRestart: true as const } : {}),
+                ...(restart && restartMode === 'restart-installation'
+                  ? {
+                      restartReason: {
+                        kind: 'installationChanged' as const,
+                        change: 'removed' as const,
+                        folder: path.join(folder, 'gone')
+                      }
+                    }
+                  : {})
               }
             })
           });
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index f88dbe9636..d95633c5db 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -25,7 +25,9 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
 - **Interactive request contracts** — request-tagged stdin frames preserve arbitrary bytes, while
   acknowledged raw-mode controls and typed terminal-policy results remain scoped to one request.
 - **Request admission contracts** — resolved no-wait and bounded-timeout options, typed admission
-  failure codes, and capability-gated one-based queue-position control messages.
+  failure codes, and capability-gated one-based queue-position control messages. A queue position
+  may carry the `restartReason` with which the daemon answers the request once the requests ahead
+  of it finish; older daemons omit it, and clients ignore reason kinds they do not know.
 - **Request lifecycle contracts** — a validated presentation-free command envelope, cancellation,
   typed routing rejection/fallback, and one authoritative terminal result control. Command parsing
   and Rush action construction remain outside the protocol.
diff --git a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
index 4a133c4e4b..b45ce88ca0 100644
--- a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { DaemonRestartReason } from './DaemonInstallationChange';
 import type { DaemonRequestAdmissionErrorCode } from './DaemonRequestAdmission';
 
 /**
@@ -17,13 +18,16 @@ export type DaemonCommandOutcome = 'success' | 'success-with-warning' | 'failure
  */
 export interface IDaemonCommandResult {
   /**
-   * Protocol 0.10: no execution or request IO occurred, and a successor has been selected.
+   * Protocol 0.10: no execution or request IO occurred, and a successor has been selected. With a
+   * `restartReason` of `installationChanged`, the daemon exits without one instead, and the client starts it.
    * Retry only after attested predecessor ownership release, within the request's admission deadline and a
    * small client-defined retry bound; then fall back instead of retrying. Never infer this from an error.
    * The predecessor launches the selected successor itself after that release, and its process exits once the
    * launch settles: until then, a retrying client connects to the successor but must not start a daemon.
    */
   readonly retryAfterRestart?: true;
+  /** Why the daemon restarts, when it says; only together with `retryAfterRestart`. Older daemons omit it. */
+  readonly restartReason?: DaemonRestartReason;
   /** Whether cancellation or disconnect was observed, even if a cleanup failure determines the outcome. */
   readonly aborted: boolean;
   /** The typed admission failure, when execution never started. */
diff --git a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
new file mode 100644
index 0000000000..0c9112e204
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * How a folder of a running daemon's installation changed after the daemon started.
+ *
+ * @beta
+ */
+export type DaemonInstallationChangeKind = 'removed' | 'replaced';
+
+/**
+ * A folder of the daemon's own installation, or of the Rush engine that it loaded, that was removed or replaced
+ * after the daemon started. Such a daemon cannot load the rest of its code, so it restarts instead of serving.
+ *
+ * @beta
+ */
+export interface IDaemonInstallationChange {
+  /** `removed` when the folder no longer exists; `replaced` when a different folder now has its path. */
+  readonly change: DaemonInstallationChangeKind;
+  /** The absolute path of the outermost folder that was removed or replaced. */
+  readonly folder: string;
+}
+
+/**
+ * The daemon's installation was removed or replaced. The daemon exits without selecting a successor, and the
+ * client starts one with its own current launcher.
+ *
+ * @beta
+ */
+export interface IDaemonInstallationChangedRestartReason extends IDaemonInstallationChange {
+  /** Identifies this reason. */
+  readonly kind: 'installationChanged';
+}
+
+/**
+ * Why a daemon asked the client to retry after a restart. Clients ignore kinds that they do not know.
+ *
+ * @beta
+ */
+export type DaemonRestartReason = IDaemonInstallationChangedRestartReason;
diff --git a/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts b/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
index e964c89de5..ddeda56bfc 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IDaemonInstallationChange } from './DaemonInstallationChange';
 import type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
 import type { IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
 
@@ -18,6 +19,11 @@ export interface IDaemonPongMessage {
     readonly residentMemoryBytes?: number;
     /** Optional generation and warm accounting; older peers may omit this snapshot. */
     readonly workspace?: IDaemonWorkspaceStatus;
+    /**
+     * Present when the daemon found its own installation removed or replaced after it started. Its next request
+     * restarts it. Older daemons omit it.
+     */
+    readonly installationChange?: IDaemonInstallationChange;
     readonly uptimeMs: number;
   };
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts b/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts
index 54fc61970e..7862c87c80 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPongValidation.ts
@@ -3,6 +3,7 @@
 
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateInstallationChange } from './InstallationChangeValidation';
 import { validateWorkspaceStatus } from './WorkspaceStatusValidation';
 
 const ZERO: number = 0;
@@ -18,6 +19,7 @@ export function validateDaemonPong(payload: Record<string, unknown>): void {
   validatePid(payload.pid);
   validateResidentMemory(payload.residentMemoryBytes);
   validateWorkspaceStatus(payload.workspace);
+  validateInstallationChange(payload.installationChange, 'pong field "installationChange"');
 }
 
 function validateDaemonVersion(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 2320840043..5ec2f64646 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { DaemonRestartReason } from './DaemonInstallationChange';
+
 /** The largest wait timeout accepted by Node.js timers. @beta */
 export const MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS: number = 0x7fffffff;
 const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
@@ -15,8 +17,8 @@ export interface IDaemonRequestAdmissionOptions {
   /**
    * True when `waitTimeoutMs` is a client default rather than an explicit user choice. A default timeout applies
    * to each daemon's workspace admission only: not to waiting behind running compatible shared builds, nor, when
-   * the daemon restarts for the request's environment, to waiting for the requests that it was already serving
-   * while it serves no rushx script.
+   * the daemon restarts for the request's environment or because its installation changed, to waiting for the
+   * requests that it was already serving while it serves no rushx script.
    */
   readonly waitTimeoutIsDefault?: boolean;
   /** Maximum queue wait in milliseconds. Omission means no timeout. */
@@ -29,6 +31,11 @@ export interface IDaemonRequestQueuePositionMessage {
   readonly payload: {
     readonly position: number;
     readonly requestId: string;
+    /**
+     * Set while the daemon holds the request until the requests ahead of it finish, and then answers it with a
+     * restart result for this reason instead of running it. Older daemons omit it; clients ignore unknown kinds.
+     */
+    readonly restartReason?: DaemonRestartReason;
   };
 }
 
diff --git a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
new file mode 100644
index 0000000000..77884d9583
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { isDaemonControlRecord } from './ControlRecord';
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const INSTALLATION_CHANGE_KINDS: ReadonlySet<unknown> = new Set(['removed', 'replaced']);
+const INSTALLATION_CHANGED: string = 'installationChanged';
+const EMPTY_LENGTH: number = 0;
+
+/** Validates an optional installation change, as reported by pong or by a restart reason. @internal */
+export function validateInstallationChange(value: unknown, field: string): void {
+  if (value === undefined) return;
+  requireRecord(value, field);
+  if (!INSTALLATION_CHANGE_KINDS.has(value.change)) fail(`${field}.change`);
+  requireFolder(value.folder, `${field}.folder`);
+}
+
+/** Validates an optional restart reason. Unknown kinds from newer daemons are accepted and ignored. @internal */
+export function validateRestartReason(payload: Record<string, unknown>): void {
+  if (payload.restartReason === undefined) return;
+  if (payload.retryAfterRestart !== true) fail('restartReason without retryAfterRestart');
+  validateReason(payload.restartReason);
+}
+
+/** Validates the optional restart reason of a queue position, which needs no retry flag. @internal */
+export function validateQueuedRestartReason(payload: Record<string, unknown>): void {
+  if (payload.restartReason !== undefined) validateReason(payload.restartReason);
+}
+
+function validateReason(reason: unknown): void {
+  requireRecord(reason, 'restartReason');
+  requireKind(reason.kind);
+  if (reason.kind === INSTALLATION_CHANGED) validateInstallationChange(reason, 'restartReason');
+}
+
+function requireRecord(value: unknown, field: string): asserts value is Record<string, unknown> {
+  if (!isDaemonControlRecord(value) || Array.isArray(value)) fail(field);
+}
+
+function requireKind(value: unknown): void {
+  if (typeof value !== 'string' || value.length === EMPTY_LENGTH) fail('restartReason.kind');
+}
+
+function requireFolder(value: unknown, field: string): void {
+  if (typeof value !== 'string' || value.length === EMPTY_LENGTH) fail(field);
+}
+
+function fail(field: string): never {
+  throw new DaemonProtocolError('malformedControlMessage', `Invalid ${field}.`);
+}
diff --git a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
index 6b0419bc07..ead34a05a6 100644
--- a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateQueuedRestartReason } from './InstallationChangeValidation';
 
 const EMPTY_STRING_LENGTH: number = 0;
 const FIRST_QUEUE_POSITION: number = 1;
@@ -20,6 +21,7 @@ export function validateRequestAdmissionCapability(payload: Record<string, unkno
 export function validateRequestQueuePositionControl(payload: Record<string, unknown>): void {
   validateRequestId(payload.requestId);
   validateQueuePosition(payload.position);
+  validateQueuedRestartReason(payload);
 }
 
 function validateRequestId(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/RequestResultValidation.ts b/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
index ff6c8e6fb7..0ed3fe24b1 100644
--- a/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
@@ -3,6 +3,7 @@
 
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateRestartReason } from './InstallationChangeValidation';
 import { validateRestartResult } from './RestartResultValidation';
 
 const ADMISSION_ERROR_CODES: ReadonlySet<unknown> = new Set(['aborted', 'no-wait', 'wait-timeout']);
@@ -14,6 +15,7 @@ export function validateRequestResultFields(payload: Record<string, unknown>): v
   validateAdmissionErrorCode(payload.admissionErrorCode);
   validatePhasedResultShape(payload);
   validateRestartResult(payload);
+  validateRestartReason(payload);
 }
 
 function validateAdmissionErrorCode(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 575a87e8e3..4e984fe8ef 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -45,12 +45,8 @@ export type { IDaemonRawModeChangedMessage, IDaemonSetRawModeMessage } from './D
 export type { IDaemonStdinEndMessage, IDaemonStdinReadyMessage } from './DaemonInteractiveControl';
 export type { IDaemonTerminalPolicyMessage } from './DaemonInteractiveControl';
 export type { IDaemonPongMessage } from './DaemonPongMessage';
-export type {
-  IDaemonWarmProjectRank,
-  IDaemonWarmSetConfiguration,
-  IDaemonWarmSetStatus
-} from './DaemonWorkspaceStatus';
-export type { IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
+export type { IDaemonWarmProjectRank, IDaemonWarmSetConfiguration } from './DaemonWorkspaceStatus';
+export type { IDaemonWarmSetStatus, IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
 export type { IDaemonShutdownAckMessage, IDaemonShutdownMessage } from './DaemonLifecycleControl';
 export { isDaemonControlRecord } from './ControlRecord';
 export { validateDaemonControlMessage } from './ControlMessageValidation';
@@ -60,6 +56,9 @@ export { createDaemonHello, createDaemonHelloAck, negotiateDaemonHello } from '.
 export type { DaemonHandshakeOutcome } from './DaemonHandshake';
 export type { DaemonJsonNull, DaemonJsonValue } from './DaemonJsonValue';
 export type { DaemonCommandOutcome, IDaemonCommandResult } from './DaemonCommandResult';
+export type { DaemonInstallationChangeKind, DaemonRestartReason } from './DaemonInstallationChange';
+export type { IDaemonInstallationChange } from './DaemonInstallationChange';
+export type { IDaemonInstallationChangedRestartReason } from './DaemonInstallationChange';
 export { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
 export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { DaemonRequestRejectionCode, IDaemonRequestCancelMessage } from './DaemonRequestControl';
diff --git a/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts b/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
new file mode 100644
index 0000000000..c9335c9c01
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { IDaemonCommandResult } from '../DaemonCommandResult';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonInstallationChange } from '../DaemonInstallationChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FAILURE_EXIT_CODE: number = 1;
+const ZERO: number = 0;
+const CHANGE: IDaemonInstallationChange = { change: 'removed', folder: '/snapshots/s9' };
+const RESULT: IDaemonCommandResult = {
+  aborted: false,
+  exitCode: FAILURE_EXIT_CODE,
+  outcome: 'failure',
+  requestId: 'installation',
+  retryAfterRestart: true,
+  restartReason: { kind: 'installationChanged', ...CHANGE }
+};
+
+function resultFrame(payload: object): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'requestResult', payload }));
+}
+
+function pongFrame(installationChange: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({ kind: 'pong', payload: { uptimeMs: ZERO, installationChange } })
+  );
+}
+
+it('round-trips a restart result that names the changed installation', () => {
+  const message: DaemonControlMessage = { kind: 'requestResult', payload: RESULT };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('accepts a restart reason kind from a newer daemon', () => {
+  const payload: object = {
+    ...RESULT,
+    restartReason: { kind: 'environmentChanged', names: ['NODE_OPTIONS'] }
+  };
+  expect(decodeDaemonControlMessage(resultFrame(payload))).toMatchObject({ payload });
+});
+
+it.each([
+  { restartReason: null },
+  { restartReason: 'installationChanged' },
+  { restartReason: [] },
+  { restartReason: { kind: '' } },
+  { restartReason: { ...CHANGE } },
+  { restartReason: { kind: 'installationChanged', change: 'moved', folder: CHANGE.folder } },
+  { restartReason: { kind: 'installationChanged', change: 'removed', folder: '' } },
+  { restartReason: { kind: 'installationChanged', change: 'removed' } },
+  { retryAfterRestart: undefined, exitCode: ZERO, outcome: 'success' }
+])('rejects a malformed restart reason %j', (override: object) => {
+  expect(() => decodeDaemonControlMessage(resultFrame({ ...RESULT, ...override }))).toThrow();
+});
+
+it.each([undefined, CHANGE, { change: 'replaced', folder: '/snapshots/s9/libraries' }])(
+  'round-trips an optional pong installation change %j',
+  (installationChange: unknown) => {
+    const frame: Uint8Array = pongFrame(installationChange);
+    expect(encodeDaemonControlMessage(decodeDaemonControlMessage(frame))).toEqual(frame);
+  }
+);
+
+it.each([null, [], {}, { change: 'moved', folder: '/x' }, { change: 'removed', folder: ZERO }])(
+  'rejects a malformed pong installation change %j',
+  (installationChange: unknown) => {
+    expect(() => decodeDaemonControlMessage(pongFrame(installationChange))).toThrow(/installationChange/);
+  }
+);
diff --git a/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
new file mode 100644
index 0000000000..05b4a02860
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { DaemonRestartReason } from '../DaemonInstallationChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FIRST_POSITION: number = 1;
+const REQUEST_ID: string = 'queued-before-restart';
+const REASON: DaemonRestartReason = {
+  kind: 'installationChanged',
+  change: 'removed',
+  folder: '/snapshots/s9'
+};
+
+function queuePositionFrame(restartReason: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({
+      kind: 'queuePosition',
+      payload: { position: FIRST_POSITION, requestId: REQUEST_ID, restartReason }
+    })
+  );
+}
+
+it('round-trips a queue position that says the daemon restarts once the requests ahead finish', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: { position: FIRST_POSITION, requestId: REQUEST_ID, restartReason: REASON }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('accepts a queued restart reason kind from a newer daemon', () => {
+  const restartReason: object = { kind: 'environmentChanged', names: ['NODE_OPTIONS'] };
+  expect(decodeDaemonControlMessage(queuePositionFrame(restartReason))).toMatchObject({
+    payload: { restartReason }
+  });
+});
+
+it.each([
+  null,
+  'installationChanged',
+  [],
+  { kind: '' },
+  { change: 'removed', folder: '/x' },
+  { kind: 'installationChanged', change: 'moved', folder: '/x' },
+  { kind: 'installationChanged', change: 'removed', folder: '' }
+])('rejects a malformed queued restart reason %j', (restartReason: unknown) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame(restartReason))).toThrow(/restartReason/);
+});
diff --git a/libraries/rush-daemon-transport/README.md b/libraries/rush-daemon-transport/README.md
index f0322bf8cf..97b51ffaba 100644
--- a/libraries/rush-daemon-transport/README.md
+++ b/libraries/rush-daemon-transport/README.md
@@ -13,7 +13,10 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
   consulted, because they differ between the shells, jobs and services of one user. A daemon
   resolves its paths with the same rule, and a client that starts one passes the folder it
   chose as `RUSHD_RUNTIME_DIR`. The folder must be a directory (not a symbolic link) that the
-  user owns; one that others can open is made owner-only (`0700`).
+  user owns; one that others can open is made owner-only (`0700`). The socket path must fit in
+  a socket address, at most 108 bytes on Linux and 104 on other POSIX platforms, because Node.js
+  silently truncates a longer one; a longer path is refused with `socketPathTooLong` before the
+  folder is checked or created.
 - **`net` listener and connector** — framed with
   [`@rushstack/rush-daemon-protocol`](https://www.npmjs.com/package/@rushstack/rush-daemon-protocol),
   with backpressure-aware writes and serialized async frame handlers for inbound flow control.
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index 779b343008..b330f4c808 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -29,8 +29,9 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
- * the reclaim lock, and with code `unsafeRuntimeDirectory` for an unsafe
- * runtime directory.
+ * the reclaim lock, with code `unsafeRuntimeDirectory` for an unsafe
+ * runtime directory, and with code `socketPathTooLong` for a socket path that
+ * no client could connect to.
  *
  * @beta
  */
diff --git a/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts b/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
index 914b5240e4..700fbd8d6c 100644
--- a/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
+++ b/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts
@@ -5,6 +5,7 @@ import * as fs from 'node:fs';
 
 import type { IDaemonPaths } from './DaemonPaths';
 import { verifyRuntimeFolder } from './DaemonRuntimeFolderCheck';
+import { assertDaemonSocketPathFits } from './DaemonSocketPathLength';
 
 const DIR_MODE: number = 0o700;
 
@@ -29,22 +30,28 @@ function tryCreateFolder(folder: string): unknown {
  * open to others is changed to mode `0700`. Otherwise another user could have created it first, for example
  * in `/tmp`, and could listen at the socket path or plant the records that reclaim acts on.
  *
- * @throws {@link DaemonTransportError} with code `unsafeRuntimeDirectory`.
+ * The socket path must also fit in a socket address (108 bytes on Linux, 104 on macOS), which only a long
+ * `RUSHD_RUNTIME_DIR` exceeds. Node would cut a longer path short, so no client could reach the daemon.
+ *
+ * @throws {@link DaemonTransportError} with code `socketPathTooLong` or `unsafeRuntimeDirectory`.
  *
  * @beta
  */
 export function assertDaemonRuntimeDirIsPrivate(paths: IDaemonPaths): void {
+  assertDaemonSocketPathFits(paths, process.platform);
   if (paths.runtimeDir !== undefined) verifyRuntimeFolder(paths.runtimeDir, getCurrentUid());
 }
 
 /**
  * Creates the per-user runtime directory (mode `0700`) when the platform has one, and checks it as
  * {@link assertDaemonRuntimeDirIsPrivate} does. Must be called before binding a POSIX socket inside it.
+ * A socket path that is too long is refused before anything is created.
  *
  * @beta
  */
 export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void {
   if (paths.runtimeDir === undefined) return;
+  assertDaemonSocketPathFits(paths, process.platform);
   const failure: unknown = tryCreateFolder(paths.runtimeDir);
   // An entry in the way (such as a file or a dangling link) is explained by the check, not by mkdir.
   verifyRuntimeFolder(paths.runtimeDir, getCurrentUid());
diff --git a/libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts b/libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts
new file mode 100644
index 0000000000..29cf3f1998
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonSocketPathLength.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from './DaemonPaths';
+import type { IDaemonPaths } from './DaemonPaths';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+// The size of sockaddr_un.sun_path. Node truncates a longer path to this many bytes when it binds or connects,
+// but a daemon publishes its socket with link(2), which does not, so clients would look for a name nobody bound.
+const LINUX_MAX_SOCKET_PATH_BYTES: number = 108;
+// macOS and the BSDs.
+const OTHER_MAX_SOCKET_PATH_BYTES: number = 104;
+const LINUX_PLATFORM: NodeJS.Platform = 'linux';
+// The shortest absolute base, `/`.
+const MIN_BASE_BYTES: number = 1;
+
+interface ISocketPathLength {
+  readonly socketPath: string;
+  readonly runtimeDir: string;
+  readonly bytes: number;
+  readonly limit: number;
+}
+
+/** The longest socket path, in bytes, that a POSIX `platform` binds and connects to without truncating it. */
+export function getMaxDaemonSocketPathBytes(platform: NodeJS.Platform): number {
+  return platform === LINUX_PLATFORM ? LINUX_MAX_SOCKET_PATH_BYTES : OTHER_MAX_SOCKET_PATH_BYTES;
+}
+
+// Paths from resolveDaemonPaths always leave room for a base; other layouts may not.
+function describeRemedy(maxBaseBytes: number): string {
+  return maxBaseBytes < MIN_BASE_BYTES
+    ? `Use a shorter runtime folder, or unset ${DAEMON_RUNTIME_DIR_ENV_VAR}.`
+    : `Set ${DAEMON_RUNTIME_DIR_ENV_VAR} to an absolute path of at most ${maxBaseBytes} bytes, or unset it.`;
+}
+
+function createTooLongError(length: ISocketPathLength): DaemonTransportError {
+  const { socketPath, runtimeDir, bytes, limit } = length;
+  // The runtime folder is `<base>/rushd-<uid>`, so everything after its parent is fixed.
+  const suffixBytes: number = bytes - Buffer.byteLength(path.posix.dirname(runtimeDir));
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.socketPathTooLong,
+    `The daemon socket path ${socketPath} is ${bytes} bytes long, but this platform allows at most ${limit}. ` +
+      describeRemedy(limit - suffixBytes)
+  );
+}
+
+/**
+ * Throws unless the POSIX socket path of `paths` fits in a socket address on `platform`. Windows named pipes
+ * (no runtime directory) are not checked.
+ *
+ * @throws {@link DaemonTransportError} with code `socketPathTooLong`.
+ */
+export function assertDaemonSocketPathFits(paths: IDaemonPaths, platform: NodeJS.Platform): void {
+  const { runtimeDir, socketPath } = paths;
+  if (runtimeDir === undefined) return;
+  const bytes: number = Buffer.byteLength(socketPath);
+  const limit: number = getMaxDaemonSocketPathBytes(platform);
+  if (bytes > limit) throw createTooLongError({ socketPath, runtimeDir, bytes, limit });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonTransportError.ts b/libraries/rush-daemon-transport/src/DaemonTransportError.ts
index 48e9dfb121..4257851d55 100644
--- a/libraries/rush-daemon-transport/src/DaemonTransportError.ts
+++ b/libraries/rush-daemon-transport/src/DaemonTransportError.ts
@@ -16,7 +16,9 @@ export enum DaemonTransportErrorCode {
   /** The transport was closed while an operation was in flight. */
   transportClosed = 'transportClosed',
   /** The per-user runtime directory is a symbolic link, is not a directory, or another user owns it. */
-  unsafeRuntimeDirectory = 'unsafeRuntimeDirectory'
+  unsafeRuntimeDirectory = 'unsafeRuntimeDirectory',
+  /** The POSIX socket path is longer than a socket address allows, so no client could connect to it. */
+  socketPathTooLong = 'socketPathTooLong'
 }
 
 /**
diff --git a/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts b/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
index abd43150e2..0290879702 100644
--- a/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
+++ b/libraries/rush-daemon-transport/src/test/ListenerSuccession.test.ts
@@ -10,6 +10,7 @@ import type { DaemonFrameConnection } from '../DaemonFrameConnection';
 import { DaemonFrameListener } from '../DaemonListener';
 import { readDaemonLockfile } from '../DaemonLockfile';
 import type { IDaemonPaths } from '../DaemonPaths';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
 
 import { createDeferred, createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
 import type { IDeferred } from './TestDaemonFixture';
@@ -17,6 +18,8 @@ import type { IDeferred } from './TestDaemonFixture';
 // A named pipe can't be deleted while its server runs, so only POSIX has a successor in this sense.
 const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
 const SUCCESSOR: string = 'successor';
+// The name that a listener binds before it publishes its socket.
+const PRIVATE_NAME_PREFIX: string = '.bind-';
 
 function listenAsync(paths: IDaemonPaths, reached?: IDeferred<string>): Promise<DaemonFrameListener> {
   return DaemonFrameListener.listenAsync(paths, {
@@ -62,6 +65,26 @@ posixIt('keeps a successor reachable after a predecessor whose runtime folder wa
   })
 );
 
+posixIt('does not replace the socket of a live listener whose lockfile was deleted', async () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const reached: IDeferred<string> = createDeferred<string>();
+  const live: DaemonFrameListener = await listenAsync(paths, reached);
+  fs.rmSync(paths.lockfilePath);
+  try {
+    const refused: DaemonTransportErrorCode = DaemonTransportErrorCode.daemonAlreadyRunning;
+    await expect(listenAsync(paths)).rejects.toMatchObject({ code: refused });
+    const names: string[] = fs.readdirSync(paths.runtimeDir ?? paths.socketPath);
+    expect(names.filter((name: string) => name.startsWith(PRIVATE_NAME_PREFIX))).toEqual([]);
+    // The refused listener must not have replaced the name, so the connection reaches the live one.
+    const client: DaemonFrameConnection = await connectDaemonAsync(paths.socketPath);
+    await expect(reached.promise).resolves.toBe(SUCCESSOR);
+    await client.closeAsync();
+  } finally {
+    await live.closeAsync();
+    removeIsolatedBase(paths);
+  }
+});
+
 posixIt('removes its own socket and lockfile when it closes', async () => {
   const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
   const listener: DaemonFrameListener = await listenAsync(paths);
diff --git a/libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts b/libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts
new file mode 100644
index 0000000000..bdbc1612ce
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SocketPathLength.test.ts
@@ -0,0 +1,80 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR, resolveDaemonPaths } from '../DaemonPaths';
+import { assertDaemonSocketPathFits, getMaxDaemonSocketPathBytes } from '../DaemonSocketPathLength';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+import { WORKSPACE_KEY_LENGTH } from '../WorkspaceKey';
+
+const UID: number = 9127721;
+const KEY: string = `rushd-${'0'.repeat(WORKSPACE_KEY_LENGTH)}`;
+// What a base gains on its way to the socket path: `/rushd-<uid>/rushd-<key>.sock`.
+const SUFFIX_BYTES: number = Buffer.byteLength(`/rushd-${UID}/${KEY}.sock`);
+const ONE: number = 1;
+// Longer than the limit of every platform.
+const LONG_NAME_BYTES: number = 160;
+// 25 two-byte characters make a 51-byte base of only 26 characters, too long for Linux by one byte.
+const TWO_BYTE_CHARACTER_COUNT: number = 25;
+const TOO_LONG: object = { code: DaemonTransportErrorCode.socketPathTooLong };
+const LINUX_LIMIT: number = 108;
+const BSD_LIMIT: number = 104;
+const LIMITS: readonly [NodeJS.Platform, number][] = [
+  ['linux', LINUX_LIMIT],
+  ['darwin', BSD_LIMIT],
+  ['freebsd', BSD_LIMIT]
+];
+
+function resolvePaths(platform: NodeJS.Platform, base: string): IDaemonPaths {
+  const env: Record<string, string> = { [DAEMON_RUNTIME_DIR_ENV_VAR]: base };
+  return resolveDaemonPaths({ platform, env, tmpdir: '/tmp', uid: UID }, KEY);
+}
+
+function createBase(bytes: number): string {
+  return `/${'a'.repeat(bytes - ONE)}`;
+}
+
+function captureMessage(paths: IDaemonPaths, platform: NodeJS.Platform): string {
+  try {
+    assertDaemonSocketPathFits(paths, platform);
+  } catch (error) {
+    expect(error).toMatchObject(TOO_LONG);
+    return (error as Error).message;
+  }
+  return '';
+}
+
+it.each(LIMITS)(
+  'allows a socket path of at most sun_path bytes on %s',
+  (platform: NodeJS.Platform, limit: number) => {
+    const maxBaseBytes: number = limit - SUFFIX_BYTES;
+    const fits: IDaemonPaths = resolvePaths(platform, createBase(maxBaseBytes));
+    expect(getMaxDaemonSocketPathBytes(platform)).toBe(limit);
+    expect(Buffer.byteLength(fits.socketPath)).toBe(limit);
+    expect(captureMessage(fits, platform)).toBe('');
+    const tooLong: IDaemonPaths = resolvePaths(platform, createBase(maxBaseBytes + ONE));
+    expect(captureMessage(tooLong, platform)).toBe(
+      `The daemon socket path ${tooLong.socketPath} is ${limit + ONE} bytes long, but this platform allows at ` +
+        `most ${limit}. Set ${DAEMON_RUNTIME_DIR_ENV_VAR} to an absolute path of at most ${maxBaseBytes} ` +
+        'bytes, or unset it.'
+    );
+  }
+);
+
+it('counts bytes, not characters', () => {
+  const paths: IDaemonPaths = resolvePaths('linux', `/${'é'.repeat(TWO_BYTE_CHARACTER_COUNT)}`);
+  expect(captureMessage(paths, 'linux')).toContain('is 109 bytes long');
+});
+
+it('names no length to aim for when a runtime folder of another layout leaves no room', () => {
+  const runtimeDir: string = createBase(LONG_NAME_BYTES);
+  const paths: IDaemonPaths = { runtimeDir, socketPath: `${runtimeDir}/d.sock`, lockfilePath: '' };
+  expect(captureMessage(paths, 'linux')).toMatch(
+    /at most 108\. Use a shorter runtime folder, or unset RUSHD_/
+  );
+});
+
+it('does not check a Windows named pipe', () => {
+  const socketPath: string = `\\\\.\\pipe\\${'p'.repeat(LONG_NAME_BYTES)}`;
+  expect(captureMessage({ runtimeDir: undefined, socketPath, lockfilePath: '' }, 'win32')).toBe('');
+});
diff --git a/libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts b/libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts
new file mode 100644
index 0000000000..c2ca10a40f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SocketPathRefusal.test.ts
@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR, resolveDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// Windows has no runtime folder: its named pipes live in the kernel's pipe namespace.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+// Longer than the limit of every platform, before the runtime folder and socket name are added.
+const LONG_NAME_BYTES: number = 110;
+const TOO_LONG: object = {
+  code: DaemonTransportErrorCode.socketPathTooLong,
+  message: expect.stringContaining(DAEMON_RUNTIME_DIR_ENV_VAR)
+};
+
+function captureError(action: () => void): unknown {
+  try {
+    action();
+  } catch (error) {
+    return error;
+  }
+}
+
+posixIt('refuses a long socket path before it creates, checks, reclaims or binds anything', async () => {
+  const isolated: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const base: string = path.join(path.dirname(isolated.runtimeDir ?? ''), 'b'.repeat(LONG_NAME_BYTES));
+  const env: Record<string, string> = { [DAEMON_RUNTIME_DIR_ENV_VAR]: base };
+  const paths: IDaemonPaths = resolveDaemonPaths(
+    { platform: process.platform, env, tmpdir: os.tmpdir(), uid: process.getuid?.() },
+    'rushd-long'
+  );
+  expect(captureError(() => assertDaemonRuntimeDirIsPrivate(paths))).toMatchObject(TOO_LONG);
+  expect(captureError(() => ensureDaemonRuntimeDir(paths))).toMatchObject(TOO_LONG);
+  await expect(reclaimStaleDaemonAsync(paths)).rejects.toMatchObject(TOO_LONG);
+  const listening: Promise<DaemonFrameListener> = DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  await expect(listening).rejects.toMatchObject(TOO_LONG);
+  expect(fs.existsSync(base)).toBe(false);
+  removeIsolatedBase(isolated);
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index d53bb7f280..24f1f68c86 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -206,6 +206,25 @@ then retries an eligible request **at most once**. Command input/output or cance
 even with the typed flag. Error text, a changed PID, or connection loss never authorizes replay.
 Ordinary shutdown and disconnect retain cancellation semantics.
 
+A daemon also restarts when its own installation changes. `serveRushDaemonAsync` records the identity (device,
+inode and birth time) of the folder it loaded the daemon from, of the Rush engine folder, and of their parents.
+Before each request it checks them. When one was removed, or another folder now has its path (a deleted snapshot,
+or a reinstalled `~/.rush` release), the daemon cannot load the rest of its code, so from then on it admits no
+more requests, and `pong` reports `installationChange`. Requests that it had already admitted finish. Each new or
+queued request, and each request that fails before it begins while the installation is changed (for example on a
+module that the daemon can no longer load), waits for them in the restart drain (see above), with queue positions
+that carry the `restartReason`. It then gets the typed `retryAfterRestart: true` result with
+`restartReason: { kind: 'installationChanged', change, folder }` instead of an early answer, so that its client
+does not wait for the old daemon to exit while a long build still runs. The drain's timeout rules are the same as
+for an environment: a client-default `waitTimeoutMs` does not limit waiting for the requests that were already
+being served when the wait began, as long as no rushx script is being served, and a timeout names the changed
+folder. A request that times out there, or that sets `noWait`, gets its admission error code and requests no
+restart. The first request that gets the result makes the daemon exit without selecting a successor, and each
+client starts one with its own launcher. Embedded hosts opt in with `checkInstallation`
+(`captureDaemonInstallation`).
+The daemon log (`onLog`) gets one line for the change and one for each rejected request, with its code, its
+message and, for an unexpected `routingFailed`, the stack.
+
 Positively identified built-in `install` and `update` requests execute in `NativeMutationWorker`, a single-shot
 native Rush parser process owned by `GlobalCommandExecutionContext`. This is not the phased warm engine.
 Native arguments, policies, hooks, stdin/EOF, output and numeric exit status are preserved. Even a failed mutation
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 4e043b4f33..d38cb8ffe3 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -21,6 +21,7 @@ import type {
   DaemonRequestRejectionCode,
   IDaemonErrorMessage,
   IDaemonFrame,
+  IDaemonInstallationChange,
   IDaemonPongMessage,
   IDaemonRequestEnvelope,
   IDaemonWorkspaceStatus
@@ -53,6 +54,10 @@ export interface IDaemonControlSessionOptions {
   /** Counts requests running on every connection, reported in the shutdown acknowledgement. */
   readonly getActiveRequestCount?: () => number;
   readonly getWorkspaceStatus?: () => IDaemonWorkspaceStatus;
+  /** Reports a removed or replaced installation in `pong`. */
+  readonly checkInstallation?: () => IDaemonInstallationChange | undefined;
+  /** Receives a message for the daemon log for each rejected request. */
+  readonly onLog?: (message: string) => void;
 }
 
 interface IRequestState {
@@ -361,6 +366,12 @@ export class DaemonControlSession {
     }
     if (dispatchError !== undefined && !state.client.terminalOutcomeSent && !this.#connectionClosed) {
       const rejection: IClassifiedRejection = classifyRejection(dispatchError);
+      // The client prints only the message; keep the rest where `rush-client daemon logs` finds it.
+      this.#options.onLog?.(
+        `rushd: rejected request ${envelope.requestId} (${rejection.code}): ${
+          rejection.code === 'routingFailed' ? describeError(dispatchError) : rejection.message
+        }`
+      );
       await state.client.writeRejectionAsync(rejection.code, rejection.message);
     }
   }
@@ -398,6 +409,7 @@ export class DaemonControlSession {
         pid: process.pid,
         residentMemoryBytes: process.memoryUsage().rss,
         workspace: this.#options.getWorkspaceStatus?.(),
+        installationChange: this.#options.checkInstallation?.(),
         uptimeMs: Date.now() - this.#options.startedAtMs
       }
     };
@@ -548,6 +560,11 @@ function classifyRejection(error: unknown): IClassifiedRejection {
   return { code: 'routingFailed', message: normalizeError(error).message };
 }
 
+function describeError(error: unknown): string {
+  const normalized: Error = normalizeError(error);
+  return normalized.stack ?? normalized.message;
+}
+
 function combineCloseErrors(
   error: Error | undefined,
   cleanupErrors: ReadonlyArray<Error>
diff --git a/libraries/rush-daemon/src/DaemonInstallationMonitor.ts b/libraries/rush-daemon/src/DaemonInstallationMonitor.ts
new file mode 100644
index 0000000000..d30f98af13
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonInstallationMonitor.ts
@@ -0,0 +1,102 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type {
+  DaemonInstallationChangeKind,
+  IDaemonInstallationChange
+} from '@rushstack/rush-daemon-protocol';
+
+/**
+ * Reports a folder of the running daemon's installation that was removed or replaced after startup, or
+ * `undefined` while the installation is intact.
+ *
+ * @beta
+ */
+export type CheckDaemonInstallation = () => IDaemonInstallationChange | undefined;
+
+interface IFolderIdentity {
+  readonly folder: string;
+  readonly dev: bigint;
+  readonly ino: bigint;
+  /** Zero where the file system does not record it; it tells a recreated folder that reused an inode. */
+  readonly birthtimeNs: bigint;
+}
+
+/**
+ * Remembers which folder each path and each of its ancestors named at startup.
+ *
+ * @remarks
+ * A check stats only the given folders. A folder keeps its identity while files inside it change, so only a
+ * removed, renamed or recreated folder is reported: the outermost ancestor that no longer exists, or that is now
+ * a different folder. Errors other than a missing path are ignored rather than reported, because restarting a
+ * daemon whose code is still in place would only lose its warm state.
+ *
+ * @beta
+ */
+export function captureDaemonInstallation(folders: ReadonlyArray<string>): CheckDaemonInstallation {
+  const chains: IFolderIdentity[][] = [];
+  for (const folder of folders) {
+    const chain: IFolderIdentity[] | undefined = captureChain(path.resolve(folder));
+    if (chain) chains.push(chain);
+  }
+  return () => {
+    for (const chain of chains) {
+      if (compareIdentity(chain[chain.length - 1]) === undefined) continue;
+      for (const identity of chain) {
+        const change: DaemonInstallationChangeKind | undefined = compareIdentity(identity);
+        if (change) return { change, folder: identity.folder };
+      }
+    }
+    return undefined;
+  };
+}
+
+/** The folders this process loaded its code from: its own package's output and the Rush engine. */
+export function getDaemonInstallationFolders(): string[] {
+  return [__dirname, path.dirname(require.resolve('@microsoft/rush-lib'))];
+}
+
+function captureChain(folder: string): IFolderIdentity[] | undefined {
+  const ancestors: string[] = [];
+  for (let current: string = folder; ; current = path.dirname(current)) {
+    ancestors.unshift(current);
+    if (path.dirname(current) === current) break;
+  }
+  const chain: IFolderIdentity[] = [];
+  for (const ancestor of ancestors) {
+    const stats: fs.BigIntStats | undefined = tryStat(ancestor);
+    if (stats)
+      chain.push({ folder: ancestor, dev: stats.dev, ino: stats.ino, birthtimeNs: stats.birthtimeNs });
+  }
+  return chain[chain.length - 1]?.folder === folder ? chain : undefined;
+}
+
+function compareIdentity(identity: IFolderIdentity): DaemonInstallationChangeKind | undefined {
+  let stats: fs.BigIntStats | undefined;
+  try {
+    stats = fs.statSync(identity.folder, { bigint: true });
+  } catch (error) {
+    return isMissing(error) ? 'removed' : undefined;
+  }
+  return stats.dev === identity.dev &&
+    stats.ino === identity.ino &&
+    stats.birthtimeNs === identity.birthtimeNs
+    ? undefined
+    : 'replaced';
+}
+
+function tryStat(folder: string): fs.BigIntStats | undefined {
+  try {
+    return fs.statSync(folder, { bigint: true });
+  } catch {
+    return undefined;
+  }
+}
+
+function isMissing(error: unknown): boolean {
+  const code: unknown = (error as NodeJS.ErrnoException | undefined)?.code;
+  return code === 'ENOENT' || code === 'ENOTDIR';
+}
diff --git a/libraries/rush-daemon/src/RushDaemonCommandLine.ts b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
index 3d4a93892e..e7715cee11 100644
--- a/libraries/rush-daemon/src/RushDaemonCommandLine.ts
+++ b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
@@ -50,6 +50,7 @@ export async function launchRushDaemonAsync(startingFolder: string = process.cwd
     requestResolver: new RushDaemonRequestResolver(new ProductionDaemonRequestResolver()),
     idleTimeoutSeconds: configuration.idleTimeoutSeconds,
     onError: (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`),
+    onLog: (message: string) => process.stderr.write(`${new Date().toISOString()} ${message}\n`),
     onReady: (host) => {
       process.stdout.write(`rushd ready at ${host.paths.socketPath}\n`);
     }
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 17ff4a7bed..52364c7886 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -14,6 +14,7 @@ import {
 import type { DaemonFrameConnection, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { DaemonControlSession } from './DaemonControlSession';
+import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
 import { DaemonIdleTimer } from './DaemonIdleTimer';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
@@ -46,6 +47,18 @@ export interface IRushDaemonHostOptions {
   readonly idleTimeoutSeconds?: number;
   /** Reports connection-level failures. */
   readonly onError?: (error: Error) => void;
+  /**
+   * Receives messages for the daemon log: one for each rejected request, with the stack when the failure was
+   * unexpected, and one for each restart that the clients must finish.
+   */
+  readonly onLog?: (message: string) => void;
+  /**
+   * Reports a folder of this daemon's installation that was removed or replaced after startup. Checked before
+   * each request: after a change, new and queued requests get a typed restart result, and once running requests
+   * finish, the host closes without a successor so that the clients start one. `pong` reports the change.
+   * Not checked when omitted.
+   */
+  readonly checkInstallation?: CheckDaemonInstallation;
   /** Resolves validated wire envelopes into existing typed phased or global requests. */
   readonly requestResolver?: IDaemonRequestResolver;
   /** Receives the request-scoped interactive broker owned by each accepted connection. */
@@ -76,10 +89,13 @@ export class RushDaemonHost {
   #notifyClosed: (() => void) | undefined;
   readonly #options: IRushDaemonHostOptions;
   readonly #startedAt: string;
-  #restartPromise: Promise<IWorkspaceProcessRestartResult> | undefined;
+  #restartPromise: Promise<IWorkspaceProcessRestartResult | undefined> | undefined;
   #resolveRestart: ((result: IWorkspaceProcessRestartResult | undefined) => void) | undefined;
   #rejectRestart: ((error: Error) => void) | undefined;
-  /** Settles after an accepted restart reaches a new ready process, or normal shutdown finishes without restarting. */
+  /**
+   * Settles after an accepted restart reaches a new ready process, or normal shutdown finishes without restarting.
+   * Resolves `undefined` when the installation changed, because the clients start the next process.
+   */
   public readonly restartCompleted: Promise<IWorkspaceProcessRestartResult | undefined>;
 
   /** Resolves after shutdown cleanup finishes. Use closeAsync() to observe cleanup failures. */
@@ -147,7 +163,9 @@ export class RushDaemonHost {
           resolver: options.requestResolver,
           rushVersion: options.rushVersion,
           getSuccessorLaunchAsync: options.getSuccessorLaunchAsync,
-          onRestartRequested: requestRestart
+          onRestartRequested: requestRestart,
+          checkInstallation: options.checkInstallation,
+          onLog: options.onLog
         });
       }
     } catch (error) {
@@ -172,6 +190,8 @@ export class RushDaemonHost {
             dispatcher: requestDispatcher,
             startedAtMs,
             getWorkspaceStatus: readWorkspaceStatus,
+            checkInstallation: options.checkInstallation,
+            onLog: options.onLog,
             onInteractiveConnection: options.onInteractiveConnection,
             onClosed: (closedSession: DaemonControlSession, error: Error | undefined) => {
               sessions.delete(closedSession);
@@ -281,8 +301,11 @@ export class RushDaemonHost {
     );
   }
 
-  async #restartOnceAsync(plan: IWorkspaceProcessRestartPlan): Promise<IWorkspaceProcessRestartResult> {
+  async #restartOnceAsync(
+    plan: IWorkspaceProcessRestartPlan
+  ): Promise<IWorkspaceProcessRestartResult | undefined> {
     await this.closeAsync(new DaemonShutdownError({ initiator: 'restart' }));
+    if (plan.reason === 'installation-changed') return undefined;
     if (plan.failure) throw plan.failure;
     if (!plan.launch) throw new Error('A successor was not selected.');
     const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
diff --git a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
index f39cbd2717..be0748b6df 100644
--- a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
+++ b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
@@ -111,6 +111,9 @@ async function mainAsync(): Promise<void> {
     onError: (error) => {
       process.stderr.write(`${error.stack ?? error.message}\n`);
     },
+    onLog: (message) => {
+      process.stderr.write(`${new Date().toISOString()} ${message}\n`);
+    },
     onReady: (host) => {
       process.stdout.write(`rushd ready at ${host.paths.socketPath} (Rush ${installation.rushVersion})\n`);
     }
diff --git a/libraries/rush-daemon/src/WorkspaceProcessRestart.ts b/libraries/rush-daemon/src/WorkspaceProcessRestart.ts
index 26897d8602..cffa348353 100644
--- a/libraries/rush-daemon/src/WorkspaceProcessRestart.ts
+++ b/libraries/rush-daemon/src/WorkspaceProcessRestart.ts
@@ -5,12 +5,20 @@ import type { IDaemonStartCommand } from '@rushstack/rush-client-core';
 
 import { selectDaemonLauncherAsync } from './VersionSelectedDaemonLauncher';
 
-/** Inputs for selecting a successor, before the old host gives up ownership. @beta */
+/**
+ * Inputs for selecting a successor, before the old host gives up ownership.
+ *
+ * @remarks
+ * For `installation-changed`, the host selects no successor: its installation was removed or replaced, so it
+ * exits once running requests finish, and each client starts a daemon with its own launcher.
+ *
+ * @beta
+ */
 export interface IWorkspaceProcessRestartContext {
   readonly repoRoot: string;
   readonly rushVersion: string;
   readonly environment: Readonly<Record<string, string>>;
-  readonly reason: 'hard-input-change' | 'native-mutation';
+  readonly reason: 'hard-input-change' | 'native-mutation' | 'installation-changed';
 }
 
 /** An explicitly selected launch command consumed by the existing core startup contract. @beta */
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 7a82501c47..a8cef149f0 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -7,6 +7,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonRequestAdmissionErrorCode,
+  DaemonRestartReason,
   IDaemonRequestAdmissionOptions,
   IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
@@ -80,6 +81,11 @@ export function freezeDaemonRequestAdmissionOptions(
   return copy;
 }
 
+/** Says why the daemon restarts, completing "the daemon could restart <cause>". */
+function formatRestartCause(restartReason: DaemonRestartReason): string {
+  return `because its installation at ${restartReason.folder} was ${restartReason.change}`;
+}
+
 class WorkspaceRequestScheduler extends RequestScheduler {
   readonly #session: IWorkspaceSession;
 
@@ -120,12 +126,12 @@ class QueuePositionWriter {
       writeQueuePositionAsync.call(client, message);
   }
 
-  public enqueue(position: number): void {
+  public enqueue(position: number, restartReason?: DaemonRestartReason): void {
     this.#tail = this.#tail
       .then(() =>
         this.#writeQueuePositionAsync({
           kind: 'queuePosition',
-          payload: { position, requestId: this.#requestId }
+          payload: { position, requestId: this.#requestId, ...(restartReason && { restartReason }) }
         })
       )
       .catch((error: unknown) => {
@@ -312,6 +318,30 @@ export class RequestAdmissionController {
     );
   }
 
+  /**
+   * After the restart drain ({@link RequestAdmissionController.waitForRestartDrainAsync}), waits until no other
+   * request holds `scheduler`, so that this request can be answered with a restart result for `restartReason`
+   * without interrupting them.
+   *
+   * @remarks
+   * Once the drain is over, only requests that the drain does not track can still hold `scheduler`, such as
+   * observers that are winding down after their cancellation, so this wait uses the request's remaining admission
+   * budget. Queue positions carry `restartReason`, and a timeout names it, so that the client can say why it waits.
+   */
+  public async acquireBeforeRestartAsync(
+    scheduler: RequestScheduler,
+    restartReason: DaemonRestartReason
+  ): Promise<IRequestLease> {
+    return await this.#acquireAsync(
+      scheduler,
+      RequestExclusivityClass.Exclusive,
+      this.#remainingMs,
+      `the running requests to finish before the daemon restarts ${formatRestartCause(restartReason)}`,
+      this.#abortController.signal,
+      restartReason
+    );
+  }
+
   /**
    * Waits for shared-build workspace admission while another request loads or reloads the workspace graph.
    *
@@ -387,7 +417,8 @@ export class RequestAdmissionController {
     exclusivityClass: RequestExclusivityClass,
     waitTimeoutMs: number | undefined,
     waitingFor: string,
-    abortSignal: AbortSignal = this.#abortController.signal
+    abortSignal: AbortSignal = this.#abortController.signal,
+    restartReason?: DaemonRestartReason
   ): Promise<IRequestLease> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
@@ -397,7 +428,9 @@ export class RequestAdmissionController {
         abortSignal,
         exclusivityClass,
         noWait: this.#admission?.noWait,
-        onQueuePositionChanged: writer ? (position: number) => writer.enqueue(position) : undefined,
+        onQueuePositionChanged: writer
+          ? (position: number) => writer.enqueue(position, restartReason)
+          : undefined,
         waitTimeoutMs
       });
       await writer?.flushAsync();
@@ -429,13 +462,18 @@ export class RequestAdmissionController {
    * the wait while a rushx script is served, since a script may not exit until it is stopped, and waiting for
    * requests that arrived later, which could otherwise keep the request waiting for as long as they keep arriving.
    * An explicit `noWait` or `waitTimeoutMs` applies to the whole wait, using the same budget as workspace admission.
+   *
+   * A `restartReason` says that the daemon restarts for that reason rather than for the request's environment. Queue
+   * positions then carry it, and admission errors name it.
    */
   public async waitForRestartDrainAsync(
     arbiter: WorkspaceRestartArbiter,
-    ticket: IWorkspaceRestartTicket
+    ticket: IWorkspaceRestartTicket,
+    restartReason?: DaemonRestartReason
   ): Promise<void> {
-    await this.#waitForRestartArbiterAsync((options: IWorkspaceRestartDrainOptions) =>
-      arbiter.waitForDrainAsync(ticket, options)
+    await this.#waitForRestartArbiterAsync(
+      (options: IWorkspaceRestartDrainOptions) => arbiter.waitForDrainAsync(ticket, options),
+      restartReason
     );
   }
 
@@ -458,7 +496,8 @@ export class RequestAdmissionController {
   }
 
   async #waitForRestartArbiterAsync(
-    waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<number>
+    waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<number>,
+    restartReason?: DaemonRestartReason
   ): Promise<void> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
@@ -470,7 +509,8 @@ export class RequestAdmissionController {
         noWait: this.#admission?.noWait,
         waitTimeoutMs: this.#remainingMs,
         waivesTimeoutForServedWork: this.#admission?.waitTimeoutIsDefault === true,
-        onServingCountChanged: writer ? (count: number) => writer.enqueue(count) : undefined
+        restartCause: restartReason && formatRestartCause(restartReason),
+        onServingCountChanged: writer ? (count: number) => writer.enqueue(count, restartReason) : undefined
       });
     } finally {
       await writer?.flushAsync();
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 4f0cc8d9a0..24f3a40d64 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -19,7 +19,12 @@ import {
 } from '@microsoft/rush-lib';
 import { LockFile } from '@rushstack/node-core-library';
 import { NoOpTerminalProvider, Terminal } from '@rushstack/terminal';
-import type { IDaemonCommandResult, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import type {
+  DaemonRestartReason,
+  IDaemonCommandResult,
+  IDaemonInstallationChange,
+  IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
 
 import {
   DaemonRequestDispatchError,
@@ -58,6 +63,7 @@ import type {
 import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './WorkspaceRestartArbiter';
 import { classifyRushCommand } from './RushCommandRequestPolicy';
 import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
+import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
 
 interface IExecutionState {
   began: boolean;
@@ -79,6 +85,10 @@ export interface IWorkspaceRequestLifecycleOptions {
   readonly rushVersion: string;
   readonly getSuccessorLaunchAsync: GetWorkspaceSuccessorLaunchAsync | undefined;
   readonly onRestartRequested: (plan: IWorkspaceProcessRestartPlan) => void;
+  /** Checked before each request; a removed or replaced installation restarts the process without a successor. */
+  readonly checkInstallation?: CheckDaemonInstallation;
+  /** Receives messages for the daemon log. */
+  readonly onLog?: (message: string) => void;
 }
 
 class RestartBeforeExecution extends Error {
@@ -108,6 +118,14 @@ class RestartPendingBeforeExecution extends Error {
   }
 }
 
+class InstallationChangedBeforeExecution extends Error {
+  public constructor(change: IDaemonInstallationChange) {
+    super(
+      `The daemon's installation at ${change.folder} was ${change.change}. No operation was scheduled or executed. Reconnect and submit a new request after restart.`
+    );
+  }
+}
+
 /**
  * Generation admission composes the existing request schedulers, native locks and session provider.
  * It never releases a resolved request onto a different session, and never replays scheduled work.
@@ -127,6 +145,12 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #observers: Set<AbortController> = new Set();
   readonly #terminal: Terminal = new Terminal(new NoOpTerminalProvider());
   readonly #runtimePaths: ReadonlyArray<string> = [__dirname, path.resolve(__dirname, '../package.json')];
+  // Resolved once: after the installation is removed, resolving it again would fail before the restart check.
+  readonly #rushLibPath: string = getRushLibPathHandoff(
+    require.resolve('@microsoft/rush-lib'),
+    process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
+  );
+  readonly #repoRoot: string;
   readonly #startupFingerprint: IWorkspaceInputFingerprint;
   readonly #runtimeCache: WorkspaceRuntimeFingerprintCache;
   // Concurrent requests share captures; each capture still starts after the requests it serves arrived.
@@ -145,6 +169,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   #closing: boolean = false;
   #restartPending: boolean = false;
   #lastReloadTier: WorkspaceInputChangeTier = WorkspaceInputChangeTier.Reuse;
+  #installationChange: IDaemonInstallationChange | undefined;
   #transitioning: boolean = false;
   /** Active while the transition owner holds the exclusive gate and loads or reloads the workspace graph. */
   readonly #transitionProgress: AdmissionProgress = new AdmissionProgress();
@@ -153,10 +178,12 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   private constructor(
     options: IWorkspaceRequestLifecycleOptions,
+    repoRoot: string,
     fingerprint: IWorkspaceInputFingerprint,
     runtimeCache: WorkspaceRuntimeFingerprintCache
   ) {
     this.#options = options;
+    this.#repoRoot = repoRoot;
     this.#startupFingerprint = this.#fingerprint = fingerprint;
     this.#resolver = options.resolver;
     this.#ownedResolvers.add(options.resolver);
@@ -174,7 +201,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       runtimePaths: [__dirname, path.resolve(__dirname, '../package.json')],
       runtimeCache
     });
-    return new WorkspaceRequestLifecycle(options, fingerprint, runtimeCache);
+    return new WorkspaceRequestLifecycle(options, session.metadata.repoRoot, fingerprint, runtimeCache);
   }
 
   /** The last applied input decision; reading status never changes or reloads the workspace. */
@@ -193,23 +220,21 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       ...request,
       environment: {
         ...request.environment,
-        [EnvironmentVariableNames._RUSH_LIB_PATH]: getRushLibPathHandoff(
-          require.resolve('@microsoft/rush-lib'),
-          process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
-        )
+        [EnvironmentVariableNames._RUSH_LIB_PATH]: this.#rushLibPath
       }
     };
+    this.#detectInstallationChange();
     if (this.#restartPending) {
       await destination.interactiveSession.finishAsync();
-      await destination.writeResultAsync({
-        ...preExecutionFailure(envelope.requestId, new RestartPendingBeforeExecution()),
-        retryAfterRestart: true
-      });
+      await destination.writeResultAsync(
+        this.#restartPendingResult(envelope.requestId, new RestartPendingBeforeExecution())
+      );
       return;
     }
     if (this.#closing)
       throw new Error('The workspace lifecycle is closing. No operation was scheduled or executed.');
-    if (this.#cleanupFailure !== undefined) throw this.#cleanupFailure;
+    // A restart for a changed installation also replaces resources that could not be cleaned up.
+    if (this.#cleanupFailure !== undefined && !this.#installationChange) throw this.#cleanupFailure;
     const state: IExecutionState = { began: false, terminalAttempted: false, resultDrained: false };
     const observer: AbortController | undefined = isGraphWatch(envelope) ? new AbortController() : undefined;
     if (observer) this.#observers.add(observer);
@@ -233,12 +258,24 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     // Long-lived observers are cancelled by a transition, so they never delay a restart. A running rushx script does
     // delay one until it exits, so a client-default timeout still limits waiting for it; a script that arrives while a
     // restart is pending waits for that restart instead (#prepareAsync).
-    const ticket: IWorkspaceRestartTicket | undefined = observer
+    let ticket: IWorkspaceRestartTicket | undefined = observer
       ? undefined
       : this.#restartArbiter.enter({ runsScript: isRushxInvocation(envelope) });
     let generation: IPreparedGeneration | undefined;
     try {
       for (let attempt: number = 0; ; attempt++) {
+        if (this.#installationChange) {
+          // An observer waits for the restart like any other request, so from here on the drain tracks it too.
+          ticket ??= this.#restartArbiter.enter();
+          await this.#restartForInstallationAsync(
+            envelope,
+            client,
+            admission,
+            ticket,
+            this.#installationChange
+          );
+          return;
+        }
         let scriptLease: IRequestLease | undefined;
         try {
           const prepared: IPreparedGeneration = await this.#prepareAsync(
@@ -310,24 +347,16 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           }
           if (error instanceof RestartPendingBeforeExecution && !state.began && !state.terminalAttempted) {
             await client.interactiveSession.finishAsync();
-            await client.writeResultAsync({
-              ...preExecutionFailure(envelope.requestId, error),
-              retryAfterRestart: true
-            });
+            await client.writeResultAsync(this.#restartPendingResult(envelope.requestId, error));
             return;
           }
           if (error instanceof RequestSchedulerError && !state.began && !state.terminalAttempted) {
-            await client.interactiveSession.finishAsync();
-            await client.writeResultAsync({
-              ...preExecutionFailure(
-                envelope.requestId,
-                getDaemonShutdownReason(client.abortSignal) ?? error
-              ),
-              aborted: client.abortSignal.aborted,
-              admissionErrorCode: getRequestAdmissionErrorCode(error)
-            });
+            await writeAdmissionFailureAsync(envelope, client, error);
             return;
           }
+          // A request that failed before it began because the installation changed under it, for example on a
+          // module that the daemon could no longer load, waits for the restart like any other request.
+          if (!state.began && !state.terminalAttempted && this.#detectInstallationChange()) continue;
           if (
             isFallbackRejection(error) &&
             !state.began &&
@@ -406,6 +435,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     let ownsTransition: boolean = false;
     try {
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      this.#throwIfInstallationChanged();
       if (this.#closing)
         throw new Error('The workspace is restarting. No operation was scheduled or executed.');
       if (this.#cleanupFailure !== undefined) throw this.#cleanupFailure;
@@ -448,6 +478,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
+            this.#throwIfInstallationChanged();
             await this.#waitForServedScriptsAsync(admission);
             session = await this.#options.provider.getSessionAsync();
             await this.#quiesceWarmSetAsync(session);
@@ -553,6 +584,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
       this.#transitionProgress.setActive(true);
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
+      this.#throwIfInstallationChanged();
       if (this.#closing)
         throw new Error('The workspace is restarting. No operation was scheduled or executed.');
       session = await this.#options.provider.getSessionAsync();
@@ -932,6 +964,89 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Returns the change when the daemon's installation was removed or replaced. Such a daemon cannot load the rest of
+   * its code, so from the first detection on it admits no more requests; each request waits in the restart drain for
+   * the requests that the daemon is serving and then gets a restart result instead.
+   */
+  #detectInstallationChange(): IDaemonInstallationChange | undefined {
+    if (this.#installationChange || this.#closing) return this.#installationChange;
+    const change: IDaemonInstallationChange | undefined = this.#options.checkInstallation?.();
+    if (!change) return undefined;
+    this.#installationChange = change;
+    this.#cancelObservers();
+    this.#options.onLog?.(
+      `rushd: the installation at ${change.folder} was ${change.change}; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon'
+    );
+    return change;
+  }
+
+  #throwIfInstallationChanged(): void {
+    const change: IDaemonInstallationChange | undefined = this.#detectInstallationChange();
+    if (change) throw new InstallationChangedBeforeExecution(change);
+  }
+
+  /**
+   * Answers a request with a restart result once the requests that the daemon is serving finish (the restart drain),
+   * so that its client does not wait for this daemon to exit while a long build still runs. The first request to get
+   * there asks the host to exit without selecting a successor; each client then starts one with its own launcher.
+   */
+  async #restartForInstallationAsync(
+    envelope: IDaemonRequestEnvelope,
+    client: IDaemonRequestDispatchClient,
+    admission: RequestAdmissionController,
+    ticket: IWorkspaceRestartTicket,
+    change: IDaemonInstallationChange
+  ): Promise<void> {
+    const restartReason: DaemonRestartReason = {
+      kind: 'installationChanged',
+      change: change.change,
+      folder: change.folder
+    };
+    let lease: IRequestLease;
+    try {
+      await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket, restartReason);
+      lease = await admission.acquireBeforeRestartAsync(this.#gate, restartReason);
+    } catch (error) {
+      if (!(error instanceof RequestSchedulerError)) throw error;
+      await writeAdmissionFailureAsync(envelope, client, error);
+      return;
+    }
+    const restarting: boolean = !this.#restartPending;
+    this.#lastReloadTier = WorkspaceInputChangeTier.Restart;
+    this.#restartPending = true;
+    this.#closing = true;
+    try {
+      await client.interactiveSession.finishAsync();
+      await client.writeResultAsync(
+        this.#restartPendingResult(envelope.requestId, new RestartPendingBeforeExecution())
+      );
+    } finally {
+      if (restarting) {
+        this.#options.onRestartRequested({
+          repoRoot: this.#repoRoot,
+          rushVersion: this.#options.rushVersion,
+          environment: Object.freeze({ ...envelope.environment }),
+          reason: 'installation-changed',
+          launch: undefined,
+          failure: undefined
+        });
+      }
+      lease.release();
+    }
+  }
+
+  #restartPendingResult(requestId: string, pending: RestartPendingBeforeExecution): IDaemonCommandResult {
+    const change: IDaemonInstallationChange | undefined = this.#installationChange;
+    if (!change) return { ...preExecutionFailure(requestId, pending), retryAfterRestart: true };
+    return {
+      ...preExecutionFailure(requestId, new InstallationChangedBeforeExecution(change)),
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: change.change, folder: change.folder }
+    };
+  }
+
   #assertGeneration(generation: IPreparedGeneration): void {
     assertWorkspaceRequestResourcesHealthy(generation.session);
     generation.session.assertActive?.();
@@ -1046,6 +1161,19 @@ function mayFallBackAlongsideContinuingWork(envelope: IDaemonRequestEnvelope): b
   );
 }
 
+async function writeAdmissionFailureAsync(
+  envelope: IDaemonRequestEnvelope,
+  client: IDaemonRequestDispatchClient,
+  error: RequestSchedulerError
+): Promise<void> {
+  await client.interactiveSession.finishAsync();
+  await client.writeResultAsync({
+    ...preExecutionFailure(envelope.requestId, getDaemonShutdownReason(client.abortSignal) ?? error),
+    aborted: client.abortSignal.aborted,
+    admissionErrorCode: getRequestAdmissionErrorCode(error)
+  });
+}
+
 function preExecutionFailure(requestId: string, error: Error): IDaemonCommandResult {
   return { requestId, exitCode: 1, outcome: 'failure', aborted: false, errorMessage: error.message };
 }
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index f431baf85c..b23c4a364c 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -4,6 +4,7 @@
 import { RequestSchedulerError, RequestSchedulerErrorCode } from './RequestScheduler';
 
 const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
+const ENVIRONMENT_RESTART_CAUSE: string = 'for its environment';
 const SCRIPT_TIMEOUT_CLAUSE: string = ', including a rushx script that may not exit until it is stopped';
 // Waiting longer may not help behind a script, such as a dev server, that runs until it is stopped.
 const SCRIPT_TIMEOUT_REMEDY: string = 'Stop the script, or use --wait-timeout <seconds> to wait longer.';
@@ -62,6 +63,12 @@ export interface IWorkspaceRestartDrainOptions {
    * request waiting for as long as they keep arriving.
    */
   readonly waivesTimeoutForServedWork?: boolean;
+  /**
+   * Why the daemon restarts, as the admission errors of {@link WorkspaceRestartArbiter.waitForDrainAsync} say it:
+   * "the daemon could restart <cause>", for example `because its installation at /x was removed`. The default is
+   * `for its environment`.
+   */
+  readonly restartCause?: string;
   /**
    * Called while the request waits with the number of other requests that it waits for, when the wait begins and
    * whenever that number changes, so that the client can report the wait as a queue position.
@@ -126,13 +133,19 @@ export class WorkspaceRestartArbiter {
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions
   ): Promise<number> {
+    const { restartCause } = options;
     return await this.#waitAsync(ticket, options, {
       restarts: true,
       isBlocked: () => this.#serving.size > 0,
       countWaitedFor: () => this.#serving.size,
-      noWaitMessage: 'Another environment is still being served; the request did not wait for a restart.',
+      noWaitMessage:
+        restartCause === undefined
+          ? 'Another environment is still being served; the request did not wait for a restart.'
+          : `The daemon is still serving other requests, which finish before it restarts ${restartCause}; ` +
+            'the request did not wait for a restart.',
       timeoutPrefix:
-        'The request was not admitted before the daemon could restart for its environment, which waits for'
+        `The request was not admitted before the daemon could restart ${restartCause ?? ENVIRONMENT_RESTART_CAUSE}, ` +
+        'which waits for'
     });
   }
 
diff --git a/libraries/rush-daemon/src/index.ts b/libraries/rush-daemon/src/index.ts
index b895226872..a075f6aba5 100644
--- a/libraries/rush-daemon/src/index.ts
+++ b/libraries/rush-daemon/src/index.ts
@@ -57,6 +57,7 @@ export {
   type IGlobalCommandRequestResult
 } from './GlobalCommandRequestRouter';
 export { RushDaemonHost, type IRushDaemonHostOptions } from './RushDaemonHost';
+export { captureDaemonInstallation, type CheckDaemonInstallation } from './DaemonInstallationMonitor';
 export {
   DaemonShutdownError,
   type DaemonShutdownInitiator,
diff --git a/libraries/rush-daemon/src/serveRushDaemon.ts b/libraries/rush-daemon/src/serveRushDaemon.ts
index 1baec925df..5568767526 100644
--- a/libraries/rush-daemon/src/serveRushDaemon.ts
+++ b/libraries/rush-daemon/src/serveRushDaemon.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { captureDaemonInstallation, getDaemonInstallationFolders } from './DaemonInstallationMonitor';
 import { DaemonShutdownError } from './DaemonShutdownError';
 import { RushDaemonHost } from './RushDaemonHost';
 import type { IRushDaemonHostOptions } from './RushDaemonHost';
@@ -21,6 +22,11 @@ export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
 /**
  * Starts a daemon host, signals readiness, and serves until shutdown is requested.
  *
+ * @remarks
+ * Unless `checkInstallation` is given, the host checks the folders that this process loaded the daemon and the
+ * Rush engine from before each request. After one of them was removed or replaced, it starts no more requests
+ * and exits once running requests finish.
+ *
  * @beta
  */
 export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Promise<void> {
@@ -31,6 +37,8 @@ export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Pr
   try {
     host = await RushDaemonHost.startAsync({
       ...options,
+      checkInstallation:
+        options.checkInstallation ?? captureDaemonInstallation(getDaemonInstallationFolders()),
       getSuccessorLaunchAsync:
         options.getSuccessorLaunchAsync ??
         (async (context) => {
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index 84f3e26eff..d1c90fb8e2 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -23,6 +23,7 @@ import { RushDaemonRequestResolver } from '../RushDaemonRequestResolver';
 import { WorkspaceSession } from '../WorkspaceSession';
 import { getWorkspaceGenerationToken } from '../WorkspaceGeneration';
 import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import type { CheckDaemonInstallation } from '../DaemonInstallationMonitor';
 import {
   createWireEnvelope,
   DaemonRequestWireClient,
@@ -35,6 +36,9 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   public session!: WorkspaceSession;
   public host!: RushDaemonHost;
   public getSuccessorLaunchAsync: GetWorkspaceSuccessorLaunchAsync | undefined;
+  public checkInstallation: CheckDaemonInstallation | undefined;
+  /** Every message the host wrote to its daemon log. */
+  public readonly logs: string[] = [];
   /** Awaited before each workspace session is created, including a request's graph load or reload. */
   public beforeCreateSessionAsync: (() => Promise<void>) | undefined;
   /** Also serves rushx package scripts, like the production host. Set it in `createAsync`'s `configure`. */
@@ -153,6 +157,8 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
       rushVersion: Rush.version,
       daemonVersion: 'graph-test',
       getSuccessorLaunchAsync: this.getSuccessorLaunchAsync,
+      checkInstallation: this.checkInstallation,
+      onLog: (message: string) => this.logs.push(message),
       requestResolver: this._lifecycle
         ? resolver
         : {
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
new file mode 100644
index 0000000000..febcf65b25
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -0,0 +1,453 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonCommandResult,
+  type IDaemonFrame,
+  type IDaemonInstallationChange,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import { captureDaemonInstallation, type CheckDaemonInstallation } from '../DaemonInstallationMonitor';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import {
+  createDeferred,
+  type DaemonRequestWireClient,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+import { assertSuccessfulNativeBuild } from './NativeBuildTestResult';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(30_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const LONG_BUILD_A: string =
+  "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+  "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('finished-a'):setTimeout(wait,20);" +
+  'wait();';
+// A script such as a dev server, which runs until it is stopped.
+const SERVE_A: string =
+  "const fs=require('node:fs');fs.appendFileSync('../runs.txt','serve\\n');" +
+  "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
+  'wait();';
+
+function queuePositions(
+  frames: ReadonlyArray<IDaemonFrame>
+): IDaemonRequestQueuePositionMessage['payload'][] {
+  return frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .filter((message: DaemonControlMessage) => message.kind === 'queuePosition')
+    .map((message: DaemonControlMessage) => (message as IDaemonRequestQueuePositionMessage).payload);
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<IDaemonFrame[]> {
+  const frames: IDaemonFrame[] = [];
+  while (queuePositions(frames).length === 0) frames.push(await client.readFrameAsync());
+  return frames;
+}
+
+async function waitForAsync(predicate: () => boolean): Promise<void> {
+  while (!predicate()) await delayAsync(20);
+}
+
+interface IInstallation {
+  readonly root: string;
+  readonly folder: string;
+  readonly lib: string;
+}
+
+function createInstallation(): IInstallation {
+  const root: string = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-installation-')));
+  const folder: string = path.join(root, 'daemon');
+  const lib: string = path.join(folder, 'lib-commonjs');
+  fs.mkdirSync(lib, { recursive: true });
+  return { root, folder, lib };
+}
+
+describe(captureDaemonInstallation.name, () => {
+  let installation: IInstallation;
+  beforeEach(() => {
+    installation = createInstallation();
+  });
+  afterEach(() => {
+    fs.rmSync(installation.root, { recursive: true, force: true });
+  });
+
+  it('ignores files that change inside the folders', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.lib]);
+    fs.writeFileSync(path.join(installation.lib, 'index.js'), '');
+    fs.mkdirSync(path.join(installation.lib, 'nested'));
+    fs.rmSync(path.join(installation.lib, 'index.js'));
+    expect(check()).toBeUndefined();
+  });
+
+  it('reports the outermost folder that was renamed away, and nothing once it is back', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.lib]);
+    fs.renameSync(installation.folder, `${installation.folder}.moved`);
+    expect(check()).toEqual({ change: 'removed', folder: installation.folder });
+    fs.renameSync(`${installation.folder}.moved`, installation.folder);
+    expect(check()).toBeUndefined();
+  });
+
+  it('reports a folder that another folder took the place of', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.lib]);
+    // The old folder stays on disk, so the new one cannot reuse its inode.
+    fs.renameSync(installation.folder, `${installation.folder}.old`);
+    fs.mkdirSync(installation.lib, { recursive: true });
+    expect(check()).toEqual({ change: 'replaced', folder: installation.folder });
+  });
+
+  it('reports only the innermost folder when its parents are intact', () => {
+    const check: CheckDaemonInstallation = captureDaemonInstallation([installation.folder, installation.lib]);
+    fs.renameSync(installation.lib, `${installation.lib}.old`);
+    fs.mkdirSync(installation.lib);
+    expect(check()).toEqual({ change: 'replaced', folder: installation.lib });
+    fs.rmSync(installation.lib, { recursive: true });
+    expect(check()).toEqual({ change: 'removed', folder: installation.lib });
+  });
+
+  it('does not watch a folder that was missing at startup', () => {
+    const missing: string = path.join(installation.root, 'missing');
+    const check: CheckDaemonInstallation = captureDaemonInstallation([missing]);
+    fs.mkdirSync(missing);
+    expect(check()).toBeUndefined();
+  });
+});
+
+describe('a daemon whose installation changed', () => {
+  let installation: IInstallation;
+  let fixture: DaemonGraphTestFixture | undefined;
+  beforeEach(() => {
+    installation = createInstallation();
+  });
+  afterEach(async () => {
+    const created: DaemonGraphTestFixture | undefined = fixture;
+    fixture = undefined;
+    await created?.[Symbol.asyncDispose]();
+    fs.rmSync(installation.root, { recursive: true, force: true });
+  });
+
+  it('asks the client to start a new daemon, exits without a successor, and says why', async () => {
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = captureDaemonInstallation([installation.lib]);
+    });
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    expect((await pongAsync(fixture)).installationChange).toBeUndefined();
+
+    fs.renameSync(installation.folder, `${installation.folder}.moved`);
+    expect((await pongAsync(fixture)).installationChange).toEqual({
+      change: 'removed',
+      folder: installation.folder
+    });
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal.kind).toBe('requestResult');
+    const result: IDaemonCommandResult = terminal.payload as IDaemonCommandResult;
+    expect(result).toMatchObject({
+      exitCode: 1,
+      outcome: 'failure',
+      aborted: false,
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+    });
+    expect(result.errorMessage).toContain(`installation at ${installation.folder} was removed`);
+
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    expect(fixture.logs).toEqual([
+      `rushd: the installation at ${installation.folder} was removed; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon'
+    ]);
+  });
+
+  it('answers a request that arrives during a running build once that build finishes', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.write('a/build.cjs', LONG_BUILD_A);
+    });
+    const running: Promise<ITerminalExchange> = fixture.buildAsync();
+    await waitForAsync(() => fixture!.runs().includes('a'));
+    current.change = { change: 'replaced', folder: installation.folder };
+
+    // The build runs for longer than a client-default wait timeout, which must not fail the request.
+    let answered: boolean = false;
+    const queued: Promise<ITerminalExchange> = fixture
+      .runAsync(BUILD_B, { admission: { waitTimeoutMs: 100, waitTimeoutIsDefault: true } })
+      .finally(() => {
+        answered = true;
+      });
+    let restarted: boolean = false;
+    void fixture.host.restartCompleted.then(() => {
+      restarted = true;
+    });
+    expect((await pongAsync(fixture)).installationChange).toEqual(current.change);
+    await delayAsync(300);
+    expect(answered).toBe(false);
+    expect(restarted).toBe(false);
+
+    fixture.write('common/temp/release.flag', '');
+    assertSuccessfulNativeBuild(await running, fixture.session.operationGraph);
+    const { frames, terminal } = await queued;
+    const restartReason: object = {
+      kind: 'installationChanged',
+      change: 'replaced',
+      folder: installation.folder
+    };
+    expect(terminal.payload).toMatchObject({ retryAfterRestart: true, restartReason });
+    expect(queuePositions(frames)).toEqual([expect.objectContaining({ position: 1, restartReason })]);
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['a', 'b']);
+    expect(fixture.logs).toHaveLength(1);
+  });
+
+  it('applies an explicit wait timeout to that wait, and restarts for a later request', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.write('a/build.cjs', LONG_BUILD_A);
+    });
+    const running: Promise<ITerminalExchange> = fixture.buildAsync();
+    await waitForAsync(() => fixture!.runs().includes('a'));
+    current.change = { change: 'removed', folder: installation.folder };
+
+    const timedOut: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+      admission: { waitTimeoutMs: 100 }
+    });
+    expect(timedOut.terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+    });
+    expect((timedOut.terminal.payload as IDaemonCommandResult).retryAfterRestart).toBeUndefined();
+    const notWaiting: ITerminalExchange = await fixture.runAsync(BUILD_B, { admission: { noWait: true } });
+    expect(notWaiting.terminal).toMatchObject({ payload: { exitCode: 1, admissionErrorCode: 'no-wait' } });
+
+    fixture.write('common/temp/release.flag', '');
+    assertSuccessfulNativeBuild(await running, fixture.session.operationGraph);
+    let restarted: boolean = false;
+    void fixture.host.restartCompleted.then(() => {
+      restarted = true;
+    });
+    await delayAsync(100);
+    expect(restarted).toBe(false);
+
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal.payload).toMatchObject({
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it('still applies a client-default timeout to that wait while a rushx script runs, and says why', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.servesRushx = true;
+      created.write(
+        'a/package.json',
+        JSON.stringify({
+          name: 'a',
+          version: '1.0.0',
+          scripts: { '_phase:compile': 'node build.cjs', serve: 'node serve.cjs' }
+        })
+      );
+      created.write('a/serve.cjs', SERVE_A);
+    });
+    const serving: Promise<ITerminalExchange> = fixture.runAsync(['serve'], {
+      invocationKind: 'rushx',
+      commandOrigin: 'custom',
+      cwd: path.join(fixture.folder, 'a')
+    });
+    await Promise.race([
+      waitForAsync(() => fixture!.runs().includes('serve')),
+      serving.then((exchange: ITerminalExchange) => {
+        throw new Error(`The script ended before it ran: ${JSON.stringify(exchange.terminal)}`);
+      })
+    ]);
+    current.change = { change: 'replaced', folder: installation.folder };
+
+    const timedOut: ITerminalExchange = await fixture.runAsync(BUILD_B, {
+      admission: { waitTimeoutMs: 100, waitTimeoutIsDefault: true }
+    });
+    expect(timedOut.terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+    });
+    const result: IDaemonCommandResult = timedOut.terminal.payload as IDaemonCommandResult;
+    expect(result.retryAfterRestart).toBeUndefined();
+    expect(result.errorMessage).toContain(
+      `could restart because its installation at ${installation.folder} was replaced, which waits for the ` +
+        'requests that the daemon is serving to finish, including a rushx script that may not exit until it is ' +
+        'stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
+    );
+
+    fixture.write('common/temp/release.flag', '');
+    expect((await serving).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal.payload).toMatchObject({
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual(['serve']);
+  });
+
+  it('answers a request that waited behind a graph load with the restart instead of running it', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+    });
+    const loadStarted: IDeferred<void> = createDeferred<void>();
+    const releaseLoad: IDeferred<void> = createDeferred<void>();
+    // Only the first build's graph load waits; the one that shuts the daemon down does not.
+    let loaded: boolean = false;
+    fixture.beforeCreateSessionAsync = async () => {
+      if (loaded) return;
+      loaded = true;
+      loadStarted.resolve();
+      await releaseLoad.promise;
+    };
+    const loading: Promise<ITerminalExchange> = fixture.buildAsync();
+    await loadStarted.promise;
+    const client: DaemonRequestWireClient = await fixture.connectAsync();
+    try {
+      const envelope: IDaemonRequestEnvelope = fixture.envelope(BUILD_B);
+      await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+      const frames: IDaemonFrame[] = await readUntilQueuedAsync(client);
+      current.change = { change: 'removed', folder: installation.folder };
+      releaseLoad.resolve();
+
+      // The load was admitted before the change, so its build runs on the code that is already loaded.
+      assertSuccessfulNativeBuild(await loading, fixture.session.operationGraph);
+      const exchange: ITerminalExchange = await client.readTerminalAsync(envelope.requestId);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          retryAfterRestart: true,
+          restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+        }
+      });
+      expect(queuePositions([...frames, ...exchange.frames])[0]).not.toHaveProperty('restartReason');
+    } finally {
+      releaseLoad.resolve();
+      await client.closeAsync();
+    }
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it('answers a request that waited to reload the graph with the restart instead of reloading', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.write('a/build.cjs', LONG_BUILD_A);
+    });
+    const running: Promise<ITerminalExchange> = fixture.buildAsync();
+    await waitForAsync(() => fixture!.runs().includes('a'));
+    const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+    const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+    const client: DaemonRequestWireClient = await fixture.connectAsync();
+    try {
+      // Needs a reload, so it waits for exclusive admission until the running build ends.
+      const envelope: IDaemonRequestEnvelope = fixture.envelope(BUILD_B);
+      await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+      await readUntilQueuedAsync(client);
+      current.change = { change: 'replaced', folder: installation.folder };
+      fixture.write('common/temp/release.flag', '');
+
+      assertSuccessfulNativeBuild(await running, fixture.session.operationGraph);
+      expect((await client.readTerminalAsync(envelope.requestId)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          retryAfterRestart: true,
+          restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+        }
+      });
+    } finally {
+      await client.closeAsync();
+    }
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it('answers a request that the change broke before it began with the restart', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+    });
+    // Only the first build's graph load fails; the one that shuts the daemon down succeeds.
+    fixture.beforeCreateSessionAsync = async () => {
+      if (current.change) return;
+      current.change = { change: 'removed', folder: installation.folder };
+      throw new Error("Cannot find module 'validate-npm-package-name'");
+    };
+    const { terminal } = await fixture.buildAsync();
+    expect(terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        retryAfterRestart: true,
+        restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+      }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.runs()).toEqual([]);
+    expect(fixture.logs).toEqual([
+      `rushd: the installation at ${installation.folder} was removed; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon'
+    ]);
+  });
+
+  it('keeps serving while its installation is intact', async () => {
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = captureDaemonInstallation([installation.lib]);
+    });
+    await fixture.buildSuccessfullyAsync();
+    fs.writeFileSync(path.join(installation.lib, 'late.js'), '');
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.logs).toEqual([]);
+  });
+});
+
+it('logs each rejected request, with the stack of an unexpected failure', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    const { terminal } = await fixture.graphAsync('pause');
+    expect(terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'routingFailed' } });
+    const { requestId, message } = terminal.payload as { requestId: string; message: string };
+    expect(fixture.logs).toHaveLength(1);
+    expect(fixture.logs[0]).toMatch(
+      new RegExp(`^rushd: rejected request ${requestId} \\(routingFailed\\): `)
+    );
+    expect(fixture.logs[0]).toContain(message);
+    expect(fixture.logs[0]).toMatch(/\n\s+at /);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
index 328356e3ac..ccdf2c637a 100644
--- a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
@@ -4,11 +4,18 @@
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import type {
+  DaemonRestartReason,
   IDaemonRequestAdmissionOptions,
   IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
 
-import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerError,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
 import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import {
   WorkspaceRestartArbiter,
@@ -16,6 +23,12 @@ import {
   type IWorkspaceRestartTicketOptions
 } from '../WorkspaceRestartArbiter';
 
+const INSTALLATION_REMOVED: DaemonRestartReason = {
+  kind: 'installationChanged',
+  change: 'removed',
+  folder: '/old/daemon'
+};
+
 interface IDrainTest {
   readonly admission: RequestAdmissionController;
   readonly arbiter: WorkspaceRestartArbiter;
@@ -23,6 +36,17 @@ interface IDrainTest {
   readonly ticket: IWorkspaceRestartTicket;
 }
 
+function createCandidate(
+  options: IDaemonRequestAdmissionOptions,
+  abortSignal: AbortSignal = new AbortController().signal
+): RequestAdmissionController {
+  return new RequestAdmissionController({
+    admission: options,
+    client: { abortSignal },
+    requestId: 'restart-candidate'
+  });
+}
+
 /** A restart candidate with the given admission options, and one other request that the daemon is serving. */
 function createDrainTest(
   options: IDaemonRequestAdmissionOptions,
@@ -31,12 +55,7 @@ function createDrainTest(
   const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
   const ticket: IWorkspaceRestartTicket = arbiter.enter();
-  const admission: RequestAdmissionController = new RequestAdmissionController({
-    admission: options,
-    client: { abortSignal: new AbortController().signal },
-    requestId: 'restart-candidate'
-  });
-  return { admission, arbiter, serving, ticket };
+  return { admission: createCandidate(options), arbiter, serving, ticket };
 }
 
 async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
@@ -148,6 +167,106 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     admission.dispose();
     expect(arbiter.servingCount).toBe(0);
   });
+
+  it('names a restart reason in its queue positions and its admission errors', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const serving: IWorkspaceRestartTicket = arbiter.enter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const restartReason: DaemonRestartReason = INSTALLATION_REMOVED;
+    const positions: IDaemonRequestQueuePositionMessage['payload'][] = [];
+    const createAdmission = (options: IDaemonRequestAdmissionOptions): RequestAdmissionController =>
+      new RequestAdmissionController({
+        admission: options,
+        client: {
+          abortSignal: new AbortController().signal,
+          supportsRequestAdmission: true,
+          writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+            positions.push(message.payload);
+          }
+        },
+        requestId: 'restart-candidate'
+      });
+
+    const notWaiting: RequestAdmissionController = createAdmission({ noWait: true });
+    const noWaitError: unknown = await notWaiting
+      .waitForRestartDrainAsync(arbiter, ticket, restartReason)
+      .catch((caught: unknown) => caught);
+    expect((noWaitError as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.NoWait);
+    expect((noWaitError as Error).message).toBe(
+      'The daemon is still serving other requests, which finish before it restarts because its installation at ' +
+        '/old/daemon was removed; the request did not wait for a restart.'
+    );
+    notWaiting.dispose();
+
+    const waiting: RequestAdmissionController = createAdmission({ waitTimeoutMs: 50 });
+    const timeoutError: unknown = await waiting
+      .waitForRestartDrainAsync(arbiter, ticket, restartReason)
+      .catch((caught: unknown) => caught);
+    expect((timeoutError as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((timeoutError as Error).message).toBe(
+      'The request was not admitted before the daemon could restart because its installation at /old/daemon was ' +
+        'removed, which waits for the requests that the daemon is serving to finish. Use --wait-timeout ' +
+        '<seconds> to wait longer.'
+    );
+    expect(positions).toEqual([{ position: 1, requestId: 'restart-candidate', restartReason }]);
+    waiting.dispose();
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    expect(arbiter.servingCount).toBe(0);
+  });
+});
+
+describe('RequestAdmissionController.acquireBeforeRestartAsync', () => {
+  let scheduler: RequestScheduler;
+  // After the drain, only requests that it does not track, such as observers that are winding down, can still
+  // hold the workspace.
+  let untracked: IRequestLease;
+
+  beforeEach(async () => {
+    scheduler = new RequestScheduler();
+    untracked = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild });
+  });
+
+  it('waits behind requests that the drain does not track, then admits the request exclusively', async () => {
+    const admission: RequestAdmissionController = createCandidate({
+      waitTimeoutMs: 5000,
+      waitTimeoutIsDefault: true
+    });
+    const acquiring: Promise<IRequestLease> = admission.acquireBeforeRestartAsync(
+      scheduler,
+      INSTALLATION_REMOVED
+    );
+    await delayAsync(50);
+    expect(await isSettledAsync(acquiring)).toBe(false);
+    untracked.release();
+    const lease: IRequestLease = await acquiring;
+    expect(lease.exclusivityClass).toBe(RequestExclusivityClass.Exclusive);
+    lease.release();
+    admission.dispose();
+  });
+
+  it('still applies a client-default timeout to that wait, and names the restart reason', async () => {
+    const abortController: AbortController = new AbortController();
+    const admission: RequestAdmissionController = createCandidate(
+      { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
+      abortController.signal
+    );
+    const acquiring: Promise<unknown> = admission
+      .acquireBeforeRestartAsync(scheduler, INSTALLATION_REMOVED)
+      .catch((caught: unknown) => caught);
+    // A wait without a deadline fails here rather than at the test timeout.
+    const error: unknown = await Promise.race([acquiring, delayAsync(1000, 'still waiting')]);
+    abortController.abort();
+    await acquiring;
+    expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
+    expect((error as Error).message).toBe(
+      'The request was not admitted within its 50ms wait timeout while waiting for the running requests to ' +
+        'finish before the daemon restarts because its installation at /old/daemon was removed. Use ' +
+        '--wait-timeout <seconds> to wait longer.'
+    );
+    untracked.release();
+    admission.dispose();
+  });
 });
 
 interface IPendingRestartTest {
diff --git a/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts b/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
index 0b3437cb10..82bc08b203 100644
--- a/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
+++ b/libraries/rush-lib/src/utilities/test/RushLibPathHandoff.test.ts
@@ -53,7 +53,10 @@ describe(getRushLibPathHandoff.name, () => {
     // A "rush deploy" layout: rush-lib is a local project folder, and each host links it.
     localRushLib = path.join(folder, 'deploy', 'libraries', 'rush-lib');
     writePackage(localRushLib, '@microsoft/rush-lib');
-    writePackage(path.join(folder, 'deploy', 'libraries', 'node-core-library'), '@rushstack/node-core-library');
+    writePackage(
+      path.join(folder, 'deploy', 'libraries', 'node-core-library'),
+      '@rushstack/node-core-library'
+    );
     link(
       path.join(folder, 'deploy', 'libraries', 'node-core-library'),
       path.join(localRushLib, 'node_modules', '@rushstack', 'node-core-library')
@@ -84,6 +87,26 @@ describe(getRushLibPathHandoff.name, () => {
     ).toEqual({ entryPoint, packageFolder: installedRushLib });
   });
 
+  it('keeps the real path of an installed rush-lib that the host script also links', () => {
+    const installedRushLib: string = path.join(folder, 'install', 'node_modules', '@microsoft', 'rush-lib');
+    writePackage(installedRushLib, '@microsoft/rush-lib');
+    const entryPoint: string = path.join(installedRushLib, ENTRY_POINT_SUBPATH);
+    // A pnpm-style host, whose own node_modules links the same installed package.
+    const linkingHostScript: string = path.join(folder, 'linking-host', 'bin', 'host');
+    fs.mkdirSync(path.dirname(linkingHostScript), { recursive: true });
+    fs.writeFileSync(linkingHostScript, '');
+    link(installedRushLib, path.join(folder, 'linking-host', 'node_modules', '@microsoft', 'rush-lib'));
+
+    expect(
+      getRushLibPathHandoff({
+        packageFolder: installedRushLib,
+        entryPoint,
+        hostScriptPaths: [linkingHostScript],
+        inheritedEntryPoint: undefined
+      })
+    ).toEqual({ entryPoint, packageFolder: installedRushLib });
+  });
+
   it('spells a local rush-lib through the node_modules link of the host script', () => {
     const handoff: IRushLibPathHandoff = getRushLibPathHandoff({
       packageFolder: localRushLib,
@@ -92,13 +115,18 @@ describe(getRushLibPathHandoff.name, () => {
       inheritedEntryPoint: undefined
     });
 
-    expect(handoff).toEqual({ entryPoint: path.join(hostLink, ENTRY_POINT_SUBPATH), packageFolder: hostLink });
+    expect(handoff).toEqual({
+      entryPoint: path.join(hostLink, ENTRY_POINT_SUBPATH),
+      packageFolder: hostLink
+    });
     // This is how plugins find rush-lib and its dependencies from _RUSH_LIB_PATH.
-    expect(fs.realpathSync.native(resolveByName('@microsoft/rush-lib/package.json', handoff.entryPoint))).toBe(
-      path.join(localRushLib, 'package.json')
-    );
     expect(
-      fs.realpathSync.native(resolveByName('@rushstack/node-core-library/package.json', handoff.packageFolder))
+      fs.realpathSync.native(resolveByName('@microsoft/rush-lib/package.json', handoff.entryPoint))
+    ).toBe(path.join(localRushLib, 'package.json'));
+    expect(
+      fs.realpathSync.native(
+        resolveByName('@rushstack/node-core-library/package.json', handoff.packageFolder)
+      )
     ).toBe(path.join(folder, 'deploy', 'libraries', 'node-core-library', 'package.json'));
   });
 

From 1f2c904bbef4ae392dba6d584afbbcaffe5b1bf2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:15:34 +0000
Subject: [PATCH 050/265] [rush-daemon] A daemon-served build logs one native
 telemetry entry per request, and the daemon keeps serving when its own PATH
 repeats an entry

Swarm integration step 35; original commit d87702c813 (merge of swarm/r02-int at c9d60eb5a4).
Scope: task 49 and the PATH fix.

Brings r02's task 49 (daemon-served builds emitted no Rush command telemetry, board 61): a long-lived engine logs one native telemetry entry per served build request, with the request id, and an iteration's requests are reported before the next iteration starts. Engine disposal waits at most 2 seconds for telemetry uploads (8eccf3a6f1, CONFIRMED by ch05 board 1987). The daemon keeps serving after a plugin adds names to process.env (80704de4e3), and keeps serving when its own startup PATH repeats an entry, where it used to turn away every build (202412e57b, board 2657, CONFIRMED by o05 board 2671; the blobs carry over byte for byte, board 2776). Re-tipped onto integration c0e17d82ab with ch01's order for the 125 conflict in WorkspaceRequestLifecycle.ts (board 2756, board 2774); 108(a)'s 'running' early result counts as early in the telemetry entry.

ch01 on b8b1dc6e2f (board 2795): build rc 0 with 0 warnings, rush-daemon 607/0, rush-lib 1249/0, rush-cli-client 398/0, rush-client-core 136/0, rush-daemon-protocol 200/0, rush-daemon-transport 81/0. Reverting the PATH fix or the 2 s flush wait each fails its test; 3 of 5 mutants killed, and the 2 survivors are test NITs for s16. E2E: the early row logs earlyResult true, and a PATH that repeats an entry keeps the same daemon where the old product falls back. r02's own run on c9d60eb5a4 (board 2777) gives the same counts. ch01's finding that ODSP_TELEMETRY_TAG restarts the daemon is pre-existing and is task 168.

Gate: ch01 GATE OK board 2795 (tree b8b1dc6e2f)

Commits folded into this step (10):
- 490b3d94f9 [rush-lib] Extract the phased telemetry entry builder from OperationGraph
- 251d987b06 [rush-lib] Let a long-lived engine log one native telemetry entry per request
- 6f62ff03f2 [rush-daemon] Log one native telemetry entry per served build request
- eb0fd9090e Add change files for per-request daemon telemetry
- 80704de4e3 [rush-daemon] Keep serving after a plugin adds names to process.env
- 6a17f4bbdc [rush-daemon] Test that an iteration's requests are reported before the next iteration starts
- e7b848d6a7 [rush-daemon] Add the request id to each served request's telemetry entry
- 8eccf3a6f1 [rush-lib] Wait at most 2 seconds for telemetry uploads when an engine is disposed
- ddff7a24ff [rush-daemon] Move the native engine test fixture into its own module
- 202412e57b [rush-daemon] Keep serving when the daemon's own PATH repeats an entry

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...on-request-telemetry_2026-09-28-13-25.json |  10 +
 ...telemetry-flush-wait_2026-09-28-19-20.json |  10 +
 ...n-plugin-environment_2026-09-28-14-10.json |  10 +
 ...-repeated-path-entry_2026-09-29-00-00.json |  10 +
 ...on-request-telemetry_2026-09-28-13-25.json |  10 +
 ...rushd-telemetry-request-id_2026-09-28.json |  11 +
 common/reviews/api/rush-daemon.api.md         |  44 +-
 common/reviews/api/rush-lib.api.md            |  28 ++
 .../src/DaemonRequestDispatcher.ts            |  29 +-
 .../rush-daemon/src/DaemonRequestTelemetry.ts | 222 +++++++++
 .../rush-daemon/src/PhasedRequestRouter.ts    | 121 +++++
 .../rush-daemon/src/PhasedRequestTelemetry.ts | 145 ++++++
 .../src/ProductionDaemonRequestResolver.ts    |  96 +++-
 .../src/WorkspaceRequestLifecycle.ts          |  20 +-
 libraries/rush-daemon/src/index.ts            |   6 +
 .../src/test/NativeEngineTestFixture.ts       | 346 +++++++++++++
 .../src/test/PhasedRequestBatching.test.ts    |   1 +
 .../src/test/PhasedRequestTelemetry.test.ts   | 454 +++++++++++++++++
 ...roductionDaemonEnvironmentIdentity.test.ts | 100 +++-
 .../ProductionDaemonRequestResolver.test.ts   | 465 ++++++------------
 .../test/WorkspacePluginEnvironment.test.ts   |  40 ++
 .../rush-lib/src/api/PhasedCommandEngine.ts   | 150 +++++-
 .../test/PhasedCommandEngineTelemetry.test.ts | 256 ++++++++++
 .../cli/scriptActions/PhasedScriptAction.ts   |  32 +-
 libraries/rush-lib/src/index.ts               |   3 +
 libraries/rush-lib/src/logic/Telemetry.ts     |  17 +-
 .../src/logic/operations/OperationGraph.ts    | 139 +-----
 .../operations/PhasedCommandTelemetry.ts      | 168 +++++++
 .../rush-lib/src/logic/test/Telemetry.test.ts |  47 +-
 29 files changed, 2501 insertions(+), 489 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/daemon-request-telemetry_2026-09-28-13-25.json
 create mode 100644 common/changes/@microsoft/rush/daemon-telemetry-flush-wait_2026-09-28-19-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-plugin-environment_2026-09-28-14-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-repeated-path-entry_2026-09-29-00-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-request-telemetry_2026-09-28-13-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-telemetry-request-id_2026-09-28.json
 create mode 100644 libraries/rush-daemon/src/DaemonRequestTelemetry.ts
 create mode 100644 libraries/rush-daemon/src/PhasedRequestTelemetry.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts
 create mode 100644 libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts

diff --git a/common/changes/@microsoft/rush/daemon-request-telemetry_2026-09-28-13-25.json b/common/changes/@microsoft/rush/daemon-request-telemetry_2026-09-28-13-25.json
new file mode 100644
index 0000000000..c5d1dc96ca
--- /dev/null
+++ b/common/changes/@microsoft/rush/daemon-request-telemetry_2026-09-28-13-25.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let a long-lived phased command engine log one native telemetry entry per request through `IPhasedCommandEngine.logTelemetry()` and `createTelemetryData()`, using the request's own parameters and a host-supplied time origin. Give every flushed telemetry file a distinct name, so entries flushed within the same millisecond no longer overwrite each other.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@microsoft/rush/daemon-telemetry-flush-wait_2026-09-28-19-20.json b/common/changes/@microsoft/rush/daemon-telemetry-flush-wait_2026-09-28-19-20.json
new file mode 100644
index 0000000000..54062a88f0
--- /dev/null
+++ b/common/changes/@microsoft/rush/daemon-telemetry-flush-wait_2026-09-28-19-20.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a long-lived phased command engine is disposed, wait at most 2 seconds for `flushTelemetry` taps that are still running, such as an upload over a stalled network. A slower tap keeps running in the background instead of holding the engine's host.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-plugin-environment_2026-09-28-14-10.json b/common/changes/@rushstack/rush-daemon/daemon-plugin-environment_2026-09-28-14-10.json
new file mode 100644
index 0000000000..e578312bc5
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-plugin-environment_2026-09-28-14-10.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep serving requests after a Rush plugin adds its own variables to the daemon's `process.env`, as native Rush keeps them for the rest of a command. A change to, or removal of, a variable the daemon started with is still rejected, now with a message that names it.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-repeated-path-entry_2026-09-29-00-00.json b/common/changes/@rushstack/rush-daemon/daemon-repeated-path-entry_2026-09-29-00-00.json
new file mode 100644
index 0000000000..ff5155a9e7
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-repeated-path-entry_2026-09-29-00-00.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep serving requests when the daemon's own `PATH` repeats an entry. The check for a change to the daemon's startup environment compared the live `PATH` with its value without repeated entries, so it rejected every build and rebuild.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-request-telemetry_2026-09-28-13-25.json b/common/changes/@rushstack/rush-daemon/daemon-request-telemetry_2026-09-28-13-25.json
new file mode 100644
index 0000000000..850f294935
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-request-telemetry_2026-09-28-13-25.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Log one native Rush telemetry entry for each served build request, including coalesced, early and no-op requests, with the request's own selection and daemon fields such as generation, reload tier, batch size, queue wait and request duration.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-telemetry-request-id_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-telemetry-request-id_2026-09-28.json
new file mode 100644
index 0000000000..a624761e19
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-telemetry-request-id_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Add the request's `requestId` to the native telemetry entry that the daemon logs for each served request, so that it can be joined with the per-operation data that plugins attribute through `getOperationRequestId`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
\ No newline at end of file
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 3dd40483e3..e9fa05e2cf 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -30,12 +30,14 @@ import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 import type { IInputsSnapshot } from '@microsoft/rush-lib';
 import { IOperationGraph } from '@microsoft/rush-lib';
 import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineTelemetryRecord } from '@microsoft/rush-lib';
 import type { ITerminal } from '@rushstack/terminal';
 import type { LockFile } from '@rushstack/node-core-library';
 import { Operation } from '@microsoft/rush-lib';
 import { RushConfiguration } from '@microsoft/rush-lib';
 import type { RushConfigurationProject } from '@microsoft/rush-lib';
 import type { RushSession } from '@microsoft/rush-lib';
+import type { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 
 // @beta
 export function captureDaemonInstallation(folders: ReadonlyArray<string>): CheckDaemonInstallation;
@@ -188,6 +190,13 @@ export interface IDaemonRequestLifecycle extends AsyncDisposable {
     dispatchAsync(envelope: IDaemonRequestEnvelope, client: IDaemonRequestDispatchClient, dispatchAsync: DispatchWorkspaceRequestAsync): Promise<void>;
 }
 
+// @beta
+export interface IDaemonRequestLifecycleInfo {
+    readonly preparedTimeMs: number;
+    readonly receivedTimeMs: number;
+    readonly reloadTier: WorkspaceInputChangeTier;
+}
+
 // @beta
 export interface IDaemonRequestResolver {
     // (undocumented)
@@ -211,9 +220,9 @@ export interface IDispatchWorkspaceRequestOptions {
     readonly client: IDaemonRequestDispatchClient;
     // (undocumented)
     readonly envelope: IDaemonRequestEnvelope;
+    readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
     // (undocumented)
     readonly onExecutionStarting?: () => void;
-    readonly receivedTimeMs?: number;
     // (undocumented)
     readonly resolver: IDaemonRequestResolver | undefined;
     // (undocumented)
@@ -387,6 +396,34 @@ export interface IPhasedRequestClient {
     writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
 }
 
+// @beta
+export interface IPhasedRequestTelemetryMeasure {
+    readonly endTimeMs: number;
+    readonly name: string;
+    readonly startTimeMs: number;
+}
+
+// @beta
+export interface IPhasedRequestTelemetryReport {
+    readonly batchSize: number;
+    readonly countRetained: number;
+    readonly earlyResult: boolean;
+    readonly executionStartTimeMs: number;
+    readonly iterationStartTimeMs: number | undefined;
+    readonly measures: ReadonlyArray<IPhasedRequestTelemetryMeasure>;
+    readonly receivedTimeMs: number;
+    readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+    readonly request: IDaemonPhasedRequest;
+    readonly result: IDaemonPhasedRequestResult;
+    readonly resultTimeMs: number;
+    readonly scheduled: boolean;
+}
+
+// @beta
+export interface IPhasedRequestTelemetrySink {
+    logRequest(report: IPhasedRequestTelemetryReport): void;
+}
+
 // @public
 export interface IRequestLease {
     // (undocumented)
@@ -409,6 +446,7 @@ export interface IResolveDaemonRequestOptions {
     readonly abortSignal: AbortSignal;
     // (undocumented)
     readonly envelope: IDaemonRequestEnvelope;
+    readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
     // (undocumented)
     readonly workspaceSession: IWorkspaceSession;
 }
@@ -429,6 +467,7 @@ export interface IResolvedDaemonPhasedRequest {
     // (undocumented)
     readonly request: IDaemonPhasedRequest;
     readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+    readonly telemetry?: IPhasedRequestTelemetrySink;
 }
 
 // @beta
@@ -701,7 +740,7 @@ export type MapWorkspaceInvalidationsToOperationsAsync = (options: IMapWorkspace
 // @beta
 export class PhasedRequestRouter {
     constructor(workspaceSession: IWorkspaceSession);
-    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings, receivedTimeMs?: number): Promise<IDaemonPhasedRequestResult>;
+    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings, telemetry?: IPhasedRequestTelemetrySink, receivedTimeMs?: number): Promise<IDaemonPhasedRequestResult>;
 }
 
 // @beta
@@ -709,6 +748,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     constructor(options?: {
         readonly preparationLock?: LockFile;
         readonly validateGraphInputsAsync?: () => Promise<void>;
+        readonly startupEnvironment?: Readonly<Record<string, string | undefined>>;
     });
     createForSession(preparationLock?: LockFile, validateGraphInputsAsync?: () => Promise<void>): ProductionDaemonRequestResolver;
     getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string>;
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 55724ef1d0..045cf759e9 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -959,6 +959,7 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
     readonly inputsSnapshot: IInputsSnapshot;
     // (undocumented)
     readonly isIncremental: boolean;
+    readonly logTelemetry?: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
     // (undocumented)
     readonly operationGraph: IOperationGraph;
     // (undocumented)
@@ -969,6 +970,11 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
     readonly rushSession: RushSession;
 }
 
+// @alpha
+export interface IPhasedCommandEngineLogTelemetryOptions {
+    readonly servedByIteration?: boolean;
+}
+
 // @alpha
 export interface IPhasedCommandEngineRequestSettings {
     // (undocumented)
@@ -977,6 +983,27 @@ export interface IPhasedCommandEngineRequestSettings {
     readonly quietMode: boolean;
 }
 
+// @alpha
+export interface IPhasedCommandEngineTelemetryOptions {
+    readonly durationInSeconds: number;
+    readonly extraData?: Readonly<Record<string, string | number | boolean>>;
+    readonly performanceEntries?: ReadonlyArray<PerformanceEntry_2>;
+    readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+    readonly succeeded: boolean;
+    readonly timeOriginMs: number;
+}
+
+// @alpha
+export interface IPhasedCommandEngineTelemetryRecord {
+    readonly nonCachedDurationMs: number | undefined;
+    readonly silent: boolean;
+    readonly status: OperationStatus;
+    readonly stopwatch: {
+        readonly startTime: number | undefined;
+        readonly endTime: number | undefined;
+    };
+}
+
 // @alpha
 export interface IPhasedCommandPlugin {
     apply(hooks: PhasedCommandHooks): void;
@@ -1531,6 +1558,7 @@ export class PhasedCommandEngine {
     // (undocumented)
     readonly commandName: string;
     createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine>;
+    createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData;
     // (undocumented)
     readonly parameterIdentity: string;
     // (undocumented)
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index 8a72ae6f9c..60aaa0c4d4 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineRequestSettings, WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 import type {
   IDaemonCommandResult,
   IDaemonEventEnvelope,
@@ -19,6 +19,7 @@ import type { IInteractiveRequestSession } from './InteractiveRequestInputRouter
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { PhasedRequestRouter } from './PhasedRequestRouter';
 import type { IGlobalCommandRequestClient } from './GlobalCommandRequestClient';
+import type { IPhasedRequestTelemetrySink } from './PhasedRequestTelemetry';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import { DaemonGraphRequestRouter } from './DaemonGraphRequestRouter';
 import { getDaemonGraphObserver } from './DaemonGraphObserver';
@@ -35,6 +36,8 @@ export interface IResolvedDaemonPhasedRequest {
   readonly exactSelection?: boolean;
   /** Verbosity and parallelism for this request; applied to the shared graph before its iteration. */
   readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+  /** Receives the request's telemetry report once it has taken part in a graph iteration or no-op check. */
+  readonly telemetry?: IPhasedRequestTelemetrySink;
 }
 
 /** A resolver outcome that uses the existing isolated global executor contract. @beta */
@@ -43,11 +46,23 @@ export interface IResolvedDaemonGlobalRequest {
   readonly kind: 'global';
 }
 
+/** How the host lifecycle admitted one request, for request-scoped telemetry. @beta */
+export interface IDaemonRequestLifecycleInfo {
+  /** The `performance.now()` timestamp at which the lifecycle received the request. */
+  readonly receivedTimeMs: number;
+  /** The `performance.now()` timestamp at which the lifecycle had prepared the request's workspace generation. */
+  readonly preparedTimeMs: number;
+  /** How the lifecycle reconciled the workspace inputs for this request. */
+  readonly reloadTier: WorkspaceInputChangeTier;
+}
+
 /** Context supplied to an integration-owned request resolver. @beta */
 export interface IResolveDaemonRequestOptions {
   /** Aborts when the request is cancelled, disconnected, or the host shuts down. */
   readonly abortSignal: AbortSignal;
   readonly envelope: IDaemonRequestEnvelope;
+  /** Present when a host lifecycle admitted the request. */
+  readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
   readonly workspaceSession: IWorkspaceSession;
 }
 
@@ -95,10 +110,10 @@ export interface IDispatchWorkspaceRequestOptions {
   readonly resolver: IDaemonRequestResolver | undefined;
   readonly onExecutionStarting?: () => void;
   /**
-   * The `performance.now()` timestamp at which the daemon received the request. A phased request can join a batch
-   * whose input reconcile started after this time; see {@link PhasedRequestRouter.executeAsync}.
+   * Present when a host lifecycle admitted the request. Its `receivedTimeMs` also decides whether a phased request
+   * can join a batch whose input reconcile has started; see {@link PhasedRequestRouter.executeAsync}.
    */
-  readonly receivedTimeMs?: number;
+  readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
 }
 
 /** Executes an already admitted workspace generation without resolving against another session. @beta */
@@ -163,7 +178,7 @@ export class DaemonRequestDispatcher implements AsyncDisposable {
 async function dispatchWorkspaceRequestAsync(
   options: IDispatchWorkspaceRequestOptions
 ): Promise<IDaemonCommandResult | undefined> {
-  const { envelope, client, workspaceSession, resolver, onExecutionStarting, receivedTimeMs } = options;
+  const { envelope, client, workspaceSession, resolver, onExecutionStarting, lifecycleInfo } = options;
   workspaceSession.assertActive?.();
   if (
     !isRushxInvocation(envelope) &&
@@ -183,6 +198,7 @@ async function dispatchWorkspaceRequestAsync(
   const resolved: ResolvedDaemonRequest = await resolver.resolveRequestAsync({
     abortSignal: client.abortSignal,
     envelope,
+    lifecycleInfo,
     workspaceSession
   });
   workspaceSession.assertActive?.();
@@ -197,7 +213,8 @@ async function dispatchWorkspaceRequestAsync(
       resolved.exactSelection,
       onExecutionStarting,
       resolved.requestSettings,
-      receivedTimeMs
+      resolved.telemetry,
+      lifecycleInfo?.receivedTimeMs
     );
   }
   const globalRouter: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(workspaceSession);
diff --git a/libraries/rush-daemon/src/DaemonRequestTelemetry.ts b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
new file mode 100644
index 0000000000..728d1a6a88
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
@@ -0,0 +1,222 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { PerformanceEntry } from 'node:perf_hooks';
+
+import { PackageJsonLookup } from '@rushstack/node-core-library';
+import type {
+  IPhasedCommandEngineLogTelemetryOptions,
+  ITelemetryData,
+  PhasedCommandEngine
+} from '@microsoft/rush-lib';
+
+import type { IDaemonRequestLifecycleInfo } from './DaemonRequestDispatcher';
+import type {
+  IPhasedRequestTelemetryMeasure,
+  IPhasedRequestTelemetryReport,
+  IPhasedRequestTelemetrySink
+} from './PhasedRequestTelemetry';
+import { getWorkspaceGenerationToken } from './WorkspaceGeneration';
+import type { IWorkspaceSession } from './WorkspaceSession';
+
+const DAEMON_PACKAGE_VERSION: string = PackageJsonLookup.loadOwnPackageJson(__dirname).version;
+const MILLISECONDS_PER_SECOND: number = 1000;
+const GENERATION_TOKEN_PREFIX_LENGTH: number = 8;
+const NATIVE_ITERATION_MEASURE_PREFIX: string = 'rush:executionManager:';
+const DAEMON_MEASURE_PREFIX: string = 'rush:daemon:';
+const RUSH_MEASURE_PREFIX: string = 'rush:';
+
+/**
+ * Request environment variables that attribute an entry to its caller. They are read from the request, never from
+ * the daemon's own environment, and are not part of the daemon's environment identity. Native Rush rejects unknown
+ * `RUSH_` variables, so the tag variable does not use that prefix.
+ */
+const ATTRIBUTION_VARIABLES: Readonly<Record<string, string>> = {
+  agentSessionId: 'COPILOT_AGENT_SESSION_ID',
+  telemetryTag: 'ODSP_TELEMETRY_TAG'
+};
+
+/** When the warm engine was created, as `performance.now()` values. */
+export interface IDaemonEngineCreationTiming {
+  readonly startTimeMs: number;
+  readonly endTimeMs: number;
+}
+
+/** What the production resolver knows about one resolved request. */
+export interface IDaemonRequestTelemetryContext {
+  /** The request's own parsed command. */
+  readonly command: Pick<PhasedCommandEngine, 'createTelemetryData'>;
+  readonly logTelemetry: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
+  readonly workspaceSession: IWorkspaceSession;
+  readonly lifecycleInfo: IDaemonRequestLifecycleInfo | undefined;
+  readonly resolveStartTimeMs: number;
+  readonly resolveEndTimeMs: number;
+  /** Set only for the request whose handling created the warm engine. */
+  readonly engineCreation: IDaemonEngineCreationTiming | undefined;
+  /** Returns the 1-based position of the entry among those the warm engine logged. */
+  readonly getRequestIndex: () => number;
+}
+
+/**
+ * Creates the sink that logs one native telemetry entry for a request served by the warm engine.
+ */
+export function createDaemonRequestTelemetrySink(
+  context: IDaemonRequestTelemetryContext
+): IPhasedRequestTelemetrySink {
+  return {
+    logRequest: (report: IPhasedRequestTelemetryReport) => {
+      try {
+        context.logTelemetry(createDaemonRequestTelemetryData(context, report), {
+          servedByIteration: report.scheduled
+        });
+      } catch (error) {
+        process.stderr.write(
+          `Unable to log telemetry for request ${report.request.requestId}: ${(error as Error).message}\n`
+        );
+      }
+    }
+  };
+}
+
+/**
+ * Builds the native telemetry entry for one request.
+ *
+ * @remarks
+ * Times are relative to the moment the daemon received the request, as a native command's are relative to its
+ * process start. `durationInSeconds` has the native meaning: it starts when the graph iteration was scheduled, or,
+ * for a request that needed no iteration, when its batch began handling it. `bootDurationSeconds` and
+ * `totalDurationSeconds` also start at the daemon's receipt of the request, so they exclude the client's own
+ * startup and connection time.
+ */
+export function createDaemonRequestTelemetryData(
+  context: IDaemonRequestTelemetryContext,
+  report: IPhasedRequestTelemetryReport
+): ITelemetryData {
+  const timeOriginMs: number = context.lifecycleInfo?.receivedTimeMs ?? context.resolveStartTimeMs;
+  const durationStartTimeMs: number = report.iterationStartTimeMs ?? report.executionStartTimeMs;
+  return context.command.createTelemetryData({
+    records: report.records,
+    succeeded: report.result.exitCode === 0,
+    durationInSeconds: toSeconds(report.resultTimeMs - durationStartTimeMs),
+    timeOriginMs,
+    extraData: {
+      ...getDaemonExtraData(context, report),
+      durationBasis: report.iterationStartTimeMs === undefined ? 'batch' : 'iteration',
+      bootDurationSeconds: toSeconds(durationStartTimeMs - timeOriginMs),
+      totalDurationSeconds: toSeconds(report.resultTimeMs - timeOriginMs),
+      ...getRequestAttribution(report.request.environment)
+    },
+    performanceEntries: [
+      ...getLifecycleEntries(context),
+      ...report.measures.map(createMeasureEntry),
+      ...getNativeEntries(context, report, durationStartTimeMs)
+    ]
+  });
+}
+
+function getDaemonExtraData(
+  context: IDaemonRequestTelemetryContext,
+  report: IPhasedRequestTelemetryReport
+): Record<string, string | number | boolean> {
+  const { lifecycleInfo, workspaceSession } = context;
+  const queueWait: IPhasedRequestTelemetryMeasure | undefined = report.measures.find(
+    (measure: IPhasedRequestTelemetryMeasure) => measure.name === `${DAEMON_MEASURE_PREFIX}queueWait`
+  );
+  const generation: number | undefined = workspaceSession.metadata.generation;
+  return {
+    daemon: true,
+    daemonVersion: DAEMON_PACKAGE_VERSION,
+    daemonPid: process.pid,
+    requestId: report.request.requestId,
+    ...(generation === undefined ? {} : { generation }),
+    generationToken: getWorkspaceGenerationToken(workspaceSession).slice(0, GENERATION_TOKEN_PREFIX_LENGTH),
+    ...(lifecycleInfo === undefined ? {} : { reloadTier: lifecycleInfo.reloadTier }),
+    requestIndex: context.getRequestIndex(),
+    batchSize: report.batchSize,
+    queueWaitSeconds: queueWait ? toSeconds(queueWait.endTimeMs - queueWait.startTimeMs) : 0,
+    graphWasInitialized: context.engineCreation === undefined,
+    persistentIpcRunners: workspaceSession.rushConfiguration.daemon.usePersistentIpcRunners,
+    scheduled: report.scheduled,
+    earlyResult: report.earlyResult,
+    countRetained: report.countRetained,
+    exitCode: report.result.exitCode,
+    outcome: report.result.outcome
+  };
+}
+
+function getRequestAttribution(
+  environment: Readonly<Record<string, string>>
+): Record<string, string | number | boolean> {
+  const attribution: Record<string, string> = {};
+  for (const [field, variable] of Object.entries(ATTRIBUTION_VARIABLES)) {
+    const value: string | undefined = environment[variable];
+    if (value) attribution[field] = value;
+  }
+  return attribution;
+}
+
+function getLifecycleEntries(context: IDaemonRequestTelemetryContext): PerformanceEntry[] {
+  const { engineCreation, lifecycleInfo } = context;
+  const measures: IPhasedRequestTelemetryMeasure[] = [];
+  if (lifecycleInfo) {
+    measures.push({
+      name: `${DAEMON_MEASURE_PREFIX}prepareWorkspace`,
+      startTimeMs: lifecycleInfo.receivedTimeMs,
+      endTimeMs: lifecycleInfo.preparedTimeMs
+    });
+  }
+  if (engineCreation) {
+    measures.push({ name: `${DAEMON_MEASURE_PREFIX}createEngine`, ...engineCreation });
+  }
+  measures.push({
+    name: `${DAEMON_MEASURE_PREFIX}resolve`,
+    startTimeMs: context.resolveStartTimeMs,
+    endTimeMs: context.resolveEndTimeMs
+  });
+  return measures.map(createMeasureEntry);
+}
+
+/**
+ * The native measures recorded while serving this request: engine creation for the request that created the
+ * engine, and the graph iteration's own measures under their native names. One daemon serves one workspace and
+ * runs one iteration at a time, so the time windows attribute the measures to this request.
+ */
+function getNativeEntries(
+  context: IDaemonRequestTelemetryContext,
+  report: IPhasedRequestTelemetryReport,
+  durationStartTimeMs: number
+): PerformanceEntry[] {
+  const { engineCreation } = context;
+  return performance.getEntriesByType('measure').filter((entry: PerformanceEntry) => {
+    const endTime: number = entry.startTime + entry.duration;
+    if (entry.name.startsWith(DAEMON_MEASURE_PREFIX)) {
+      return false;
+    }
+    if (entry.name.startsWith(NATIVE_ITERATION_MEASURE_PREFIX)) {
+      return report.scheduled && entry.startTime >= durationStartTimeMs && endTime <= report.resultTimeMs;
+    }
+    return (
+      engineCreation !== undefined &&
+      entry.name.startsWith(RUSH_MEASURE_PREFIX) &&
+      entry.startTime >= engineCreation.startTimeMs &&
+      endTime <= engineCreation.endTimeMs
+    );
+  });
+}
+
+function createMeasureEntry(measure: IPhasedRequestTelemetryMeasure): PerformanceEntry {
+  const { name, startTimeMs: startTime } = measure;
+  const duration: number = measure.endTimeMs - startTime;
+  return {
+    name,
+    entryType: 'measure',
+    startTime,
+    duration,
+    detail: undefined,
+    toJSON: () => ({ name, entryType: 'measure', startTime, duration })
+  };
+}
+
+function toSeconds(milliseconds: number): number {
+  return milliseconds / MILLISECONDS_PER_SECOND;
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index f8e59bc411..cf783fec90 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -46,6 +46,12 @@ import {
   type IPhasedOperationOutcome,
   parseWarningsAllowedByEnvironment
 } from './CommandResultPolicy';
+import {
+  collectPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryMeasure,
+  type IPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetrySink
+} from './PhasedRequestTelemetry';
 
 interface IDualEmitOperationGraph extends IOperationGraph {
   eventSink: _IOperationGraphEventSink | undefined;
@@ -65,6 +71,8 @@ interface IGraphRoutingState {
 
 interface IPreparedPhasedRequest {
   readonly onExecutionStarting: (() => void) | undefined;
+  /** The `performance.now()` timestamp at which the request was admitted. */
+  readonly admittedTimeMs: number;
   readonly client: IPhasedRequestClient;
   readonly exclusivityClass: RequestExclusivityClass;
   readonly interactiveSession: IInteractiveRequestSession | undefined;
@@ -79,12 +87,28 @@ interface IPreparedPhasedRequest {
   readonly receivedTimeMs: number;
   /** The `performance.now()` timestamp at which the router received the request. */
   readonly startTimeMs: number;
+  readonly telemetry: IPhasedRequestTelemetrySink | undefined;
   readonly warningsAllowedByEnvironment: boolean;
 }
 
+/** `performance.now()` timestamps of one batch's handling, shared by its participants' telemetry. */
+interface IBatchTimings {
+  readonly startTimeMs: number;
+  batchSize: number;
+  leasesAcquiredTimeMs: number | undefined;
+  reconciledTimeMs: number | undefined;
+  selectionsAppliedTimeMs: number | undefined;
+  /** The start of `scheduleIterationAsync`, which is where a native iteration's duration starts. */
+  scheduleStartTimeMs: number | undefined;
+  scheduledTimeMs: number | undefined;
+  executionStartTimeMs: number | undefined;
+  iterationEndTimeMs: number | undefined;
+}
+
 interface IBatchEntry extends IPreparedPhasedRequest {
   abortListener: (() => void) | undefined;
   abortRequested: boolean;
+  batchTimings: IBatchTimings | undefined;
   completed: boolean;
   /**
    * Set when a failed result is published while operations of this request that the failure did not block are
@@ -98,6 +122,8 @@ interface IBatchEntry extends IPreparedPhasedRequest {
    * its batch's iteration is still running for other participants; see `#finishSettledEntry`.
    */
   finishPromise: Promise<void> | undefined;
+  /** The `performance.now()` timestamp at which the entry was taken into a batch. */
+  joinedTimeMs: number | undefined;
   outputError: unknown;
   participated: boolean;
   reject: (error: unknown) => void;
@@ -149,6 +175,9 @@ export class PhasedRequestRouter {
    * Validates and executes one resolved phased request against the warm graph.
    *
    * @remarks
+   * If `telemetry` is provided, it receives this request's report once the request has taken part in a graph
+   * iteration or a no-op check, before the result is written to the client.
+   *
    * `receivedTimeMs` is the `performance.now()` timestamp at which the daemon received the request. The request can
    * join a batch whose input reconcile started after this time. It defaults to the time of this call.
    */
@@ -158,6 +187,7 @@ export class PhasedRequestRouter {
     exactSelection: boolean = false,
     onExecutionStarting?: () => void,
     requestSettings?: IPhasedCommandEngineRequestSettings,
+    telemetry?: IPhasedRequestTelemetrySink,
     receivedTimeMs?: number
   ): Promise<IDaemonPhasedRequestResult> {
     const startTimeMs: number = performance.now();
@@ -195,6 +225,7 @@ export class PhasedRequestRouter {
       admissionController?.dispose();
       return await finishAfterAdmissionErrorAsync(request, client, interactiveSession, error);
     }
+    const admittedTimeMs: number = performance.now();
 
     try {
       let inputAttachment: Disposable | undefined;
@@ -232,6 +263,7 @@ export class PhasedRequestRouter {
           const lease: IRequestLease = admissionLease;
           return await routingState.coordinator.enqueueAsync(
             {
+              admittedTimeMs,
               client,
               exclusivityClass,
               interactiveSession,
@@ -243,6 +275,7 @@ export class PhasedRequestRouter {
               requestSettingsKey: JSON.stringify(requestSettings ?? null),
               selection,
               startTimeMs,
+              telemetry,
               warningsAllowedByEnvironment,
               onExecutionStarting
             },
@@ -314,10 +347,12 @@ class PhasedRequestBatchCoordinator {
         ...request,
         abortListener: undefined,
         abortRequested: false,
+        batchTimings: undefined,
         completed: false,
         continuesAfterResult: false,
         executionStarted: false,
         finishPromise: undefined,
+        joinedTimeMs: undefined,
         outputError: undefined,
         participated: false,
         reject,
@@ -368,8 +403,10 @@ class PhasedRequestBatchCoordinator {
         this.#currentBatch = batch;
         this.#acceptingCurrentBatch = first.exclusivityClass === RequestExclusivityClass.SharedBuild;
         this.#reconcileStartTimeMs = undefined;
+        const joinedTimeMs: number = performance.now();
         for (const entry of batch) {
           entry.executionStarted = true;
+          entry.joinedTimeMs ??= joinedTimeMs;
         }
         try {
           await this.#executeBatchAsync(batch);
@@ -415,6 +452,7 @@ class PhasedRequestBatchCoordinator {
       ) {
         this.#pending.splice(index, 1);
         entry.executionStarted = true;
+        entry.joinedTimeMs = performance.now();
         batch.push(entry);
       } else {
         index++;
@@ -423,6 +461,17 @@ class PhasedRequestBatchCoordinator {
   }
 
   async #executeBatchAsync(batch: IBatchEntry[]): Promise<void> {
+    const timings: IBatchTimings = {
+      startTimeMs: performance.now(),
+      batchSize: 0,
+      leasesAcquiredTimeMs: undefined,
+      reconciledTimeMs: undefined,
+      selectionsAppliedTimeMs: undefined,
+      scheduleStartTimeMs: undefined,
+      scheduledTimeMs: undefined,
+      executionStartTimeMs: undefined,
+      iterationEndTimeMs: undefined
+    };
     const graphLeasePromise: Promise<IRequestLease> =
       this.#nextGraphLeasePromise ??
       this.#graphExecutionScheduler.acquireAsync({
@@ -443,10 +492,12 @@ class PhasedRequestBatchCoordinator {
         throw new Error('The warm workspace operation graph is not idle.');
       }
       executionLease = await this.#workspaceSession.acquireExecutionLeaseAsync?.();
+      timings.leasesAcquiredTimeMs = performance.now();
       // Requests received before this point made their changes before the reconcile reads the inputs, so they can
       // still join while it runs. Requests received later wait for the next batch, which reconciles again.
       this.#reconcileStartTimeMs = performance.now();
       await this.#workspaceSession.reconcileInvalidationsAsync();
+      timings.reconciledTimeMs = performance.now();
 
       if (batch[0].exclusivityClass === RequestExclusivityClass.SharedBuild) {
         this.#takeCompatiblePending(batch);
@@ -471,6 +522,8 @@ class PhasedRequestBatchCoordinator {
         this.#graph,
         participants.map((entry: IBatchEntry) => entry.selection)
       );
+      timings.selectionsAppliedTimeMs = performance.now();
+      timings.batchSize = participants.length;
       for (const entry of batch) {
         if (!participants.includes(entry)) {
           // Clients that cancelled before execution must not wait for the participants' work.
@@ -482,6 +535,7 @@ class PhasedRequestBatchCoordinator {
       const unsubscribeDemand: () => void = this.#multiplexer.subscribe(demand);
       for (const entry of participants) {
         entry.participated = true;
+        entry.batchTimings = timings;
         const activeOperationIds: ReadonlySet<string> = new Set(
           entry.selection.activeOperations.map((operation: Operation) => operation.name)
         );
@@ -512,10 +566,12 @@ class PhasedRequestBatchCoordinator {
       const iterationCleanupErrors: unknown[] = [];
       try {
         for (const entry of participants) entry.onExecutionStarting?.();
+        timings.scheduleStartTimeMs = performance.now();
         scheduled = await this.#graph.scheduleIterationAsync({
           inputsSnapshot: this.#workspaceSession.inputsSnapshot,
           getOperationEnvironment: createOperationEnvironmentLookup(participants)
         });
+        timings.scheduledTimeMs = performance.now();
         if (scheduled) {
           await Promise.all(
             participants.map(async (entry: IBatchEntry) => {
@@ -526,6 +582,7 @@ class PhasedRequestBatchCoordinator {
               }
             })
           );
+          timings.executionStartTimeMs = performance.now();
           const executionPromise: Promise<boolean> = this.#graph.executeScheduledIterationAsync();
           if (!participants.some((entry: IBatchEntry) => this.#needsIteration(entry)) || demand.abandoned) {
             // Let executeScheduledIterationAsync promote the scheduled iteration before aborting it.
@@ -534,6 +591,7 @@ class PhasedRequestBatchCoordinator {
             await this.#abortTail;
           }
           await executionPromise;
+          timings.iterationEndTimeMs = performance.now();
         }
       } catch (error) {
         executionError = error;
@@ -890,6 +948,9 @@ class PhasedRequestBatchCoordinator {
       scheduled: entry.participated && batchScheduled,
       warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
     });
+    if (entry.participated) {
+      this.#logTelemetry(entry, result, batchScheduled, report !== 'final');
+    }
     try {
       await entry.client.writeResultAsync(result);
       this.#completeEntry(entry);
@@ -900,6 +961,44 @@ class PhasedRequestBatchCoordinator {
     }
   }
 
+  #logTelemetry(
+    entry: IBatchEntry,
+    result: IDaemonPhasedRequestResult,
+    batchScheduled: boolean,
+    iterationInProgress: boolean
+  ): void {
+    const { batchTimings: timings, requestSink, telemetry } = entry;
+    if (!telemetry || !requestSink || !timings) {
+      return;
+    }
+    try {
+      const resultTimeMs: number = performance.now();
+      const executionStartTimeMs: number = Math.max(timings.startTimeMs, entry.joinedTimeMs ?? 0);
+      const { records, countRetained }: IPhasedRequestTelemetryRecords = collectPhasedRequestTelemetryRecords({
+        activeOperations: entry.selection.activeOperations,
+        graph: this.#graph,
+        observations: requestSink,
+        upToDateTimeMs: executionStartTimeMs
+      });
+      telemetry.logRequest({
+        request: entry.request,
+        result,
+        records,
+        countRetained,
+        batchSize: timings.batchSize,
+        scheduled: batchScheduled,
+        earlyResult: iterationInProgress,
+        receivedTimeMs: entry.startTimeMs,
+        executionStartTimeMs,
+        iterationStartTimeMs: batchScheduled ? timings.scheduleStartTimeMs : undefined,
+        resultTimeMs,
+        measures: createTelemetryMeasures(entry, timings, executionStartTimeMs, resultTimeMs)
+      });
+    } catch {
+      // Telemetry never changes a request's result.
+    }
+  }
+
   #settleEntry(entry: IBatchEntry, settle: () => void): void {
     if (!entry.continuesAfterResult) {
       settle();
@@ -950,6 +1049,28 @@ class PhasedRequestBatchCoordinator {
   }
 }
 
+function createTelemetryMeasures(
+  entry: IBatchEntry,
+  timings: IBatchTimings,
+  executionStartTimeMs: number,
+  resultTimeMs: number
+): IPhasedRequestTelemetryMeasure[] {
+  const measures: IPhasedRequestTelemetryMeasure[] = [];
+  function addMeasure(name: string, startTimeMs: number | undefined, endTimeMs: number | undefined): void {
+    if (startTimeMs !== undefined && endTimeMs !== undefined) {
+      measures.push({ name: `rush:daemon:${name}`, startTimeMs, endTimeMs });
+    }
+  }
+  addMeasure('admission', entry.startTimeMs, entry.admittedTimeMs);
+  addMeasure('queueWait', entry.admittedTimeMs, executionStartTimeMs);
+  addMeasure('acquireExecutionLease', timings.startTimeMs, timings.leasesAcquiredTimeMs);
+  addMeasure('reconcileInvalidations', timings.leasesAcquiredTimeMs, timings.reconciledTimeMs);
+  addMeasure('applySelections', timings.reconciledTimeMs, timings.selectionsAppliedTimeMs);
+  addMeasure('scheduleIteration', timings.scheduleStartTimeMs, timings.scheduledTimeMs);
+  addMeasure('executeIteration', timings.executionStartTimeMs, timings.iterationEndTimeMs ?? resultTimeMs);
+  return measures;
+}
+
 function createBatchReleaseBarrier(
   batch: ReadonlyArray<IBatchEntry>,
   releaseAsync: () => Promise<void>
diff --git a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
new file mode 100644
index 0000000000..aa1240dc21
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
@@ -0,0 +1,145 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IOperationExecutionResult,
+  IOperationGraph,
+  IPhasedCommandEngineTelemetryRecord,
+  Operation
+} from '@microsoft/rush-lib';
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonPhasedRequest, IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+
+/** One phase of a phased request's handling, with `performance.now()` times. @beta */
+export interface IPhasedRequestTelemetryMeasure {
+  /** The measure name, such as `rush:daemon:queueWait`. */
+  readonly name: string;
+  /** A `performance.now()` value. */
+  readonly startTimeMs: number;
+  /** A `performance.now()` value. */
+  readonly endTimeMs: number;
+}
+
+/**
+ * The outcome and timing of one phased request that took part in a graph iteration or no-op check.
+ *
+ * @remarks
+ * All times are `performance.now()` values of the daemon process.
+ *
+ * @beta
+ */
+export interface IPhasedRequestTelemetryReport {
+  /** The request as the router executed it. */
+  readonly request: IDaemonPhasedRequest;
+  /** The result sent to the client. */
+  readonly result: IDaemonPhasedRequestResult;
+  /**
+   * The request's non-silent selected operations. Operations that this request did not need to run, because
+   * the warm graph had them up to date, are reported as `Skipped` with a zero-length stopwatch.
+   */
+  readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+  /** How many of `records` were already up to date. */
+  readonly countRetained: number;
+  /** How many requests took part in the same graph iteration or no-op check. */
+  readonly batchSize: number;
+  /** Whether the graph scheduled an iteration for the batch. */
+  readonly scheduled: boolean;
+  /** Whether the result was produced while the shared iteration was still running for other requests. */
+  readonly earlyResult: boolean;
+  /** When the router received the request. */
+  readonly receivedTimeMs: number;
+  /** When this request's batch began handling it. */
+  readonly executionStartTimeMs: number;
+  /** When the graph iteration began executing operations, if one was scheduled. */
+  readonly iterationStartTimeMs: number | undefined;
+  /** When the request's result was produced. */
+  readonly resultTimeMs: number;
+  /** The router's handling phases for this request, in order. */
+  readonly measures: ReadonlyArray<IPhasedRequestTelemetryMeasure>;
+}
+
+/**
+ * Receives one report for each phased request that took part in a graph iteration or no-op check.
+ *
+ * @remarks
+ * The router invokes the sink before it writes the request's result. The sink must not throw; the router ignores
+ * its errors so that telemetry never changes a result.
+ *
+ * @beta
+ */
+export interface IPhasedRequestTelemetrySink {
+  /** Called once, before the result is written to the client. Errors are ignored. */
+  logRequest(report: IPhasedRequestTelemetryReport): void;
+}
+
+/** The subset of a request event sink used to collect a request's telemetry records. */
+export interface IPhasedRequestTelemetryObservations {
+  getObservedResult(operation: Operation): { readonly executionResult: IOperationExecutionResult } | undefined;
+}
+
+export interface ICollectPhasedRequestTelemetryRecordsOptions {
+  readonly activeOperations: ReadonlyArray<Operation>;
+  readonly graph: IOperationGraph;
+  readonly observations: IPhasedRequestTelemetryObservations;
+  /** The timestamp given to operations that the request did not need to run. */
+  readonly upToDateTimeMs: number;
+}
+
+export interface IPhasedRequestTelemetryRecords {
+  readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+  readonly countRetained: number;
+}
+
+const UNFINISHED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Waiting,
+  OperationStatus.Ready,
+  OperationStatus.Queued,
+  OperationStatus.Executing
+]);
+
+/**
+ * Collects the telemetry records of one request's selection, matching the request's own end-of-run summary.
+ */
+export function collectPhasedRequestTelemetryRecords(
+  options: ICollectPhasedRequestTelemetryRecordsOptions
+): IPhasedRequestTelemetryRecords {
+  const { activeOperations, graph, observations, upToDateTimeMs } = options;
+  const active: ReadonlySet<Operation> = new Set(activeOperations);
+  const records: Map<Operation, IPhasedCommandEngineTelemetryRecord> = new Map();
+  let countRetained: number = 0;
+  // Iterate the graph so that entries list operations in the same order as native entries.
+  for (const operation of graph.operations) {
+    if (!active.has(operation) || operation.runner?.silent !== false) {
+      continue;
+    }
+    const observed: IOperationExecutionResult | undefined =
+      observations.getObservedResult(operation)?.executionResult;
+    if (observed && !observed.silent) {
+      records.set(
+        operation,
+        UNFINISHED_STATUSES.has(observed.status) ? createAbortedRecord(observed) : observed
+      );
+    } else if (observed ?? graph.resultByOperation.get(operation)) {
+      // A silent observed record belongs to an operation the graph disabled because it was already up to date.
+      // Its retained stopwatch describes an earlier request, so it is not reported again.
+      records.set(operation, {
+        status: OperationStatus.Skipped,
+        silent: false,
+        stopwatch: { startTime: upToDateTimeMs, endTime: upToDateTimeMs },
+        nonCachedDurationMs: undefined
+      });
+      countRetained++;
+    }
+  }
+  return { records, countRetained };
+}
+
+function createAbortedRecord(observed: IOperationExecutionResult): IPhasedCommandEngineTelemetryRecord {
+  // The client stopped observing before this operation finished.
+  return {
+    status: OperationStatus.Aborted,
+    silent: false,
+    stopwatch: observed.stopwatch,
+    nonCachedDurationMs: undefined
+  };
+}
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 4ac806c7d1..27f5e135e5 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -13,8 +13,10 @@ import {
   PhasedCommandEngineConfigurationChangedError,
   PhasedCommandEngineProjectConfigurationError,
   type IPhasedCommandEngine,
+  type IPhasedCommandEngineLogTelemetryOptions,
   type IInputsSnapshot,
   type IOperationGraph,
+  type ITelemetryData,
   type Operation,
   type OperationEnabledState
 } from '@microsoft/rush-lib';
@@ -38,6 +40,7 @@ import { EngineTerminalProvider } from './EngineTerminalProvider';
 import { OperationOutputFingerprints } from './OperationOutputFingerprints';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { createDaemonRequestTelemetrySink, type IDaemonEngineCreationTiming } from './DaemonRequestTelemetry';
 
 /**
  * Binds the standalone host to a real native build/rebuild graph on its first request.
@@ -54,30 +57,47 @@ import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
  */
 export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   #binding: Promise<void> | undefined;
+  /** The request whose handling created the warm engine, and when it did. */
+  #engineCreation: (IDaemonEngineCreationTiming & { readonly requestId: string }) | undefined;
+  #logTelemetry: EngineLogTelemetry | undefined;
+  #loggedRequestCount: number = 0;
   #parameterIdentity: string | undefined;
   #workspaceSession: IWorkspaceSession | undefined;
-  readonly #environmentIdentity: string = environmentIdentity(process.env);
+  readonly #environmentIdentity: string;
   readonly #preparationLock: LockFile | undefined;
+  /** The daemon's environment when it started. Replacement sessions keep it; see `createForSession`. */
+  readonly #startupEnvironment: Readonly<Record<string, string | undefined>>;
   readonly #validateGraphInputsAsync: (() => Promise<void>) | undefined;
 
   public constructor(options?: {
     readonly preparationLock?: LockFile;
     readonly validateGraphInputsAsync?: () => Promise<void>;
+    /** The environment that requests must match. Defaults to a copy of `process.env`. */
+    readonly startupEnvironment?: Readonly<Record<string, string | undefined>>;
   }) {
     this.#preparationLock = options?.preparationLock;
     this.#validateGraphInputsAsync = options?.validateGraphInputsAsync;
+    this.#startupEnvironment = options?.startupEnvironment ?? { ...process.env };
+    this.#environmentIdentity = environmentIdentity(this.#startupEnvironment);
   }
 
   public get workspaceLifecycle(): IWorkspaceResolverLifecycle {
     return this;
   }
 
-  /** Creates an unbound resolver for a replacement session without carrying old runner definitions. */
+  /**
+   * Creates an unbound resolver for a replacement session without carrying old runner definitions.
+   * It keeps the startup environment, because a plugin may have added names to `process.env` since then.
+   */
   public createForSession(
     preparationLock?: LockFile,
     validateGraphInputsAsync?: () => Promise<void>
   ): ProductionDaemonRequestResolver {
-    return new ProductionDaemonRequestResolver({ preparationLock, validateGraphInputsAsync });
+    return new ProductionDaemonRequestResolver({
+      preparationLock,
+      validateGraphInputsAsync,
+      startupEnvironment: this.#startupEnvironment
+    });
   }
 
   /** Inspects the native command shape without constructing or executing an operation graph. */
@@ -86,9 +106,11 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   }
 
   public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
+    const resolveStartTimeMs: number = performance.now();
     const { envelope, workspaceSession } = options;
     const terminal: EngineTerminalProvider = new EngineTerminalProvider();
     const command: PhasedCommandEngine = await this.#parseCommandAsync(options, terminal);
+    let bindingStartTimeMs: number | undefined;
     if (this.#binding) {
       if (
         this.#parameterIdentity !== command.parameterIdentity ||
@@ -99,6 +121,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     } else {
       this.#parameterIdentity = command.parameterIdentity;
       this.#workspaceSession = workspaceSession;
+      bindingStartTimeMs = performance.now();
       const binding: Promise<void> = this.#bindAsync(command, terminal, workspaceSession);
       this.#binding = binding;
       void binding.catch((error: unknown) => {
@@ -110,6 +133,13 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       });
     }
     await this.#binding;
+    if (bindingStartTimeMs !== undefined) {
+      this.#engineCreation = {
+        requestId: envelope.requestId,
+        startTimeMs: bindingStartTimeMs,
+        endTimeMs: performance.now()
+      };
+    }
     const graph: IOperationGraph | undefined = workspaceSession.operationGraph;
     const shape: IWorkspaceEngineShape | undefined = workspaceSession.engineShape;
     if (!graph || !shape) throw new Error('Native engine initialization did not bind a workspace graph.');
@@ -123,10 +153,26 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     for (const [operation, enabledState] of selection) {
       if (enabledState !== false) operationSelection.push({ operationId: operation.name, enabledState });
     }
+    const logTelemetry: EngineLogTelemetry | undefined = this.#logTelemetry;
+    // A workspace lifecycle may bind the engine with this request before it dispatches the request.
+    const engineCreation: IDaemonEngineCreationTiming | undefined =
+      this.#engineCreation?.requestId === envelope.requestId ? this.#engineCreation : undefined;
     return {
       kind: 'phased',
       exactSelection: true,
       requestSettings: command.requestSettings,
+      telemetry: logTelemetry
+        ? createDaemonRequestTelemetrySink({
+            command,
+            logTelemetry,
+            workspaceSession,
+            lifecycleInfo: options.lifecycleInfo,
+            resolveStartTimeMs,
+            resolveEndTimeMs: performance.now(),
+            engineCreation,
+            getRequestIndex: () => ++this.#loggedRequestCount
+          })
+        : undefined,
       request: {
         admission: envelope.admission,
         commandName: envelope.commandName,
@@ -156,15 +202,20 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         'The production daemon requires an explicitly identified native build/rebuild request. Ambiguous custom/rushx requests require --no-daemon.'
       );
     }
-    if (
-      environmentIdentity(envelope.environment) !== this.#environmentIdentity ||
-      environmentIdentity(process.env) !== this.#environmentIdentity
-    ) {
+    if (environmentIdentity(envelope.environment) !== this.#environmentIdentity) {
       throw new DaemonRequestDispatchError(
         'unsupported',
         'The request environment differs from the daemon startup environment. Restart the daemon from this environment or use --no-daemon.'
       );
     }
+    const changedNames: string[] = this.#getChangedStartupNames();
+    if (changedNames.length > 0) {
+      throw new DaemonRequestDispatchError(
+        'unsupported',
+        `The daemon's own environment changed after it started (${changedNames.join(', ')}); a Rush plugin ` +
+          'may have changed process.env. Restart the daemon or use --no-daemon.'
+      );
+    }
     let command: PhasedCommandEngine;
     try {
       command = await PhasedCommandEngine.parseAsync({
@@ -192,6 +243,26 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     return command;
   }
 
+  /**
+   * The names of the startup environment whose value in `process.env` changed or was removed since startup.
+   *
+   * @remarks
+   * Engine code runs in this process, and a plugin may add its own names to `process.env`, for example to pass
+   * a session ID to its operations. Native Rush keeps such names for the rest of the command, so they are not
+   * a difference from the client's environment, and are not reported here. Otherwise every request after the
+   * plugin's first write would fall back to in-process Rush. A request whose own environment sets an added name
+   * still differs from the startup environment.
+   *
+   * Both values are compared as the workspace fingerprint records them. The startup entries drop repeated PATH
+   * entries, so a raw live PATH that repeats an entry would otherwise count as changed on every request.
+   */
+  #getChangedStartupNames(): string[] {
+    const liveEnvironment: NodeJS.ProcessEnv = process.env;
+    return getWorkspaceFingerprintEnvironmentEntries(this.#startupEnvironment)
+      .filter(([name, value]) => getFingerprintValue(name, liveEnvironment[name]) !== value)
+      .map(([name]) => name);
+  }
+
   async #bindAsync(
     command: PhasedCommandEngine,
     terminal: EngineTerminalProvider,
@@ -217,6 +288,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         throw new Error(terminal.describeError(error), { cause: error });
       }
       try {
+        this.#logTelemetry = engine.logTelemetry;
         terminal.attach(engine.operationGraph);
         const outputFingerprints: OperationOutputFingerprints = new OperationOutputFingerprints(
           engine.operationGraph
@@ -261,6 +333,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           }
         };
       } catch (error) {
+        this.#logTelemetry = undefined;
         try {
           await engine[Symbol.asyncDispose]();
         } catch (cleanupError) {
@@ -301,10 +374,19 @@ function createProjectConfigurationFallback(
   );
 }
 
+type EngineLogTelemetry = (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
+
 function environmentIdentity(environment: Readonly<Record<string, string | undefined>>): string {
   return JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment));
 }
 
+/** The value of one variable as {@link getWorkspaceFingerprintEnvironmentEntries} records it, if it is set. */
+function getFingerprintValue(name: string, value: string | undefined): string | undefined {
+  return value === undefined
+    ? undefined
+    : getWorkspaceFingerprintEnvironmentEntries({ [name]: value })[0]?.[1];
+}
+
 function getChangedOperations(options: IMapWorkspaceInvalidationsOptions): Iterable<Operation> {
   const { currentInputsSnapshot: current, nextInputsSnapshot: next, operationGraph } = options;
   return Array.from(operationGraph.operations).filter(
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 24f3a40d64..dc25a53b33 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -151,6 +151,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     process.env[EnvironmentVariableNames._RUSH_LIB_PATH]
   );
   readonly #repoRoot: string;
+  /** The daemon's environment before any engine ran. A plugin may add names to `process.env` later. */
+  readonly #startupEnvironment: Record<string, string> = Object.fromEntries(
+    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+  );
   readonly #startupFingerprint: IWorkspaceInputFingerprint;
   readonly #runtimeCache: WorkspaceRuntimeFingerprintCache;
   // Concurrent requests share captures; each capture still starts after the requests it serves arrived.
@@ -212,9 +216,18 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   public async dispatchAsync(
     request: IDaemonRequestEnvelope,
     destination: IDaemonRequestDispatchClient,
-    dispatchAsync: DispatchWorkspaceRequestAsync
+    dispatchWorkspaceRequestAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
     const receivedTimeMs: number = performance.now();
+    const dispatchAsync: DispatchWorkspaceRequestAsync = (options) =>
+      dispatchWorkspaceRequestAsync({
+        ...options,
+        lifecycleInfo: {
+          receivedTimeMs,
+          preparedTimeMs: performance.now(),
+          reloadTier: this.#lastReloadTier
+        }
+      });
     // Native Rush owns its SDK handoff; a foreign client's bundled engine must not override this one.
     const envelope: IDaemonRequestEnvelope = {
       ...request,
@@ -306,7 +319,6 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
               client,
               workspaceSession: prepared.session,
               resolver: prepared.resolver,
-              receivedTimeMs,
               onExecutionStarting: () => {
                 this.#assertGeneration(prepared);
                 state.began = true;
@@ -463,9 +475,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           // Graph control environment flags are not a request to change the retained engine environment.
           const controlEnvelope: IDaemonRequestEnvelope = {
             ...envelope,
-            environment: Object.fromEntries(
-              Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
-            )
+            environment: { ...this.#startupEnvironment }
           };
           const current: IWorkspaceInputFingerprint = await this.#captureAsync(session, controlEnvelope);
           const currentTier: WorkspaceInputChangeTier = this.#classify(current, false);
diff --git a/libraries/rush-daemon/src/index.ts b/libraries/rush-daemon/src/index.ts
index a075f6aba5..282d9a6f75 100644
--- a/libraries/rush-daemon/src/index.ts
+++ b/libraries/rush-daemon/src/index.ts
@@ -10,6 +10,7 @@ export {
   type IDaemonRequestDispatchClient,
   type IDaemonRequestResolver,
   type IDaemonRequestLifecycle,
+  type IDaemonRequestLifecycleInfo,
   type IDispatchWorkspaceRequestOptions,
   type DispatchWorkspaceRequestAsync,
   type IResolvedDaemonGlobalRequest,
@@ -95,6 +96,11 @@ export {
 } from './WorkspaceInvalidationTracker';
 export { type IPhasedRequestClient } from './PhasedRequestClient';
 export { PhasedRequestRouter } from './PhasedRequestRouter';
+export type {
+  IPhasedRequestTelemetryMeasure,
+  IPhasedRequestTelemetryReport,
+  IPhasedRequestTelemetrySink
+} from './PhasedRequestTelemetry';
 export { ProductionDaemonRequestResolver } from './ProductionDaemonRequestResolver';
 export { getWorkspaceGenerationToken } from './WorkspaceGeneration';
 export { RushDaemonRequestResolver } from './RushDaemonRequestResolver';
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
new file mode 100644
index 0000000000..30eb93eb2a
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -0,0 +1,346 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+import { Rush, RushUserConfiguration } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonLogChunk,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import { RushDaemonHost } from '../RushDaemonHost';
+import { WorkspaceSession } from '../WorkspaceSession';
+import { removeTestFolderAsync } from './TestProcessExit';
+import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import type {
+  IDaemonRequestResolver,
+  IResolveDaemonRequestOptions,
+  ResolvedDaemonRequest
+} from '../DaemonRequestDispatcher';
+import {
+  isRushxInvocation,
+  wrapWorkspaceResolverLifecycle,
+  type IWorkspaceResolverLifecycle
+} from '../WorkspaceResolverLifecycle';
+import {
+  DaemonRequestWireClient,
+  createWireEnvelope,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+
+const RUSH_VERSION: string = Rush.version;
+
+export interface IFixture extends AsyncDisposable {
+  readonly repoRoot: string;
+  readonly host: RushDaemonHost;
+  readonly session: WorkspaceSession;
+  readonly client: DaemonRequestWireClient;
+}
+
+export interface IFixtureOptions {
+  readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
+  readonly onSessionCreated?: (session: WorkspaceSession) => void;
+  readonly resolver?: IDaemonRequestResolver;
+  /** Adds the `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
+  readonly incrementalScript?: boolean;
+  /** Sets `daemon.incrementalBuilds` in rush.json. */
+  readonly incrementalBuilds?: boolean;
+  /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
+  readonly pnpm?: boolean;
+  readonly telemetryEnabled?: boolean;
+}
+
+export class DecoratedTestResolver implements IDaemonRequestResolver {
+  public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
+  private readonly _inner: IDaemonRequestResolver;
+  private readonly _events: string[];
+  private readonly _id: number;
+  private _disposed: boolean = false;
+
+  public constructor(inner: IDaemonRequestResolver, events: string[]) {
+    this._inner = inner;
+    this._events = events;
+    this._id = events.filter((event) => event.startsWith('created')).length;
+    events.push(`created:${this._id}`);
+    this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
+      inner,
+      (replacement) => new DecoratedTestResolver(replacement, events)
+    );
+  }
+
+  public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
+    if (this._disposed) throw new Error('A disposed resolver was invoked.');
+    if (isRushxInvocation(options.envelope)) {
+      this._events.push(`isolated:${this._id}`);
+      throw new Error('Explicit isolated invocation reached the decorated resolver.');
+    }
+    return await this._inner.resolveRequestAsync(options);
+  }
+
+  public async [Symbol.asyncDispose](): Promise<void> {
+    if (this._disposed) throw new Error('A resolver was disposed twice.');
+    this._disposed = true;
+    this._events.push(`disposed:${this._id}`);
+    await this._inner[Symbol.asyncDispose]?.();
+  }
+}
+
+/** Creates a Git repository with the projects a, b and c (b depends on a), and a daemon host that serves it. */
+export async function createFixtureAsync(
+  cache: boolean = false,
+  configurationKind: 'direct' | 'rig' | 'inherited' = 'direct',
+  options: IFixtureOptions = {}
+): Promise<IFixture> {
+  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-native-engine-'));
+  const cacheNamespace: string = path.basename(repoRoot);
+  const userConfiguration: RushUserConfiguration = await RushUserConfiguration.initializeAsync();
+  const cacheFolder: string = path.join(
+    userConfiguration.buildCacheFolder ?? path.join(repoRoot, 'common/temp/build-cache'),
+    cacheNamespace
+  );
+  const write: (name: string, text: string) => void = (name, text) => {
+    const filename: string = path.join(repoRoot, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, text);
+  };
+  write(
+    'rush.json',
+    JSON.stringify({
+      rushVersion: RUSH_VERSION,
+      ...(options.pnpm ? { pnpmVersion: '9.15.9' } : { npmVersion: '10.0.0' }),
+      // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
+      daemon: {
+        warmMemoryBudgetMB: 100_000,
+        ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds })
+      },
+      ...(options.telemetryEnabled ? { telemetryEnabled: true } : {}),
+      projectFolderMinDepth: 2,
+      projectFolderMaxDepth: 2,
+      projects: ['a', 'b', 'c'].map((name) => ({
+        packageName: name,
+        projectFolder: `projects/${name}`
+      }))
+    })
+  );
+  write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\n**/lib/\n**/node_modules/\nruns.txt\n');
+  write('common/temp/last-link.flag', '{}');
+  if (options.pnpm) {
+    write('common/config/rush/pnpm-lock.yaml', "lockfileVersion: '9.0'\n");
+  } else {
+    write('common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
+  }
+  write(
+    'common/config/rush/command-line.json',
+    JSON.stringify({
+      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        }
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'Production build',
+          associatedCommands: ['build'],
+          associatedPhases: ['_phase:compile']
+        }
+      ]
+    })
+  );
+  if (cache) {
+    write(
+      'common/config/rush/build-cache.json',
+      JSON.stringify({
+        buildCacheEnabled: true,
+        cacheProvider: 'local-only',
+        cacheEntryNamePattern: `${cacheNamespace}/[hash]`
+      })
+    );
+  }
+  for (const name of ['a', 'b', 'c']) {
+    write(
+      `projects/${name}/package.json`,
+      JSON.stringify({
+        name,
+        version: '1.0.0',
+        scripts: {
+          '_phase:compile': 'node build.cjs',
+          ...(options.incrementalScript
+            ? { '_phase:compile:incremental': 'node build.cjs --incremental' }
+            : {})
+        },
+        dependencies: name === 'b' ? { a: '1.0.0' } : {}
+      })
+    );
+    write(
+      `projects/${name}/config/rush-project.json`,
+      JSON.stringify({
+        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+      })
+    );
+    write(`projects/${name}/input.txt`, 'one');
+    if (options.pnpm) write(`projects/${name}/.rush/temp/shrinkwrap-deps.json`, '{}');
+    write(
+      `projects/${name}/build.cjs`,
+      `
+const fs = require('node:fs');
+const path = require('node:path');
+const name = require('./package.json').name;
+const input = fs.readFileSync(fs.existsSync('src/input.txt') ? 'src/input.txt' : 'input.txt', 'utf8');
+(async () => {
+const gateFile = path.resolve('../../common/temp/gate-' + name + '.json');
+if (fs.existsSync(gateFile)) {
+  const { port } = JSON.parse(fs.readFileSync(gateFile, 'utf8'));
+  await new Promise((resolve, reject) => {
+    const socket = require('node:net').connect(port, '127.0.0.1');
+    socket.once('error', reject);
+    socket.once('data', () => { socket.end(); resolve(); });
+  });
+}
+fs.appendFileSync('../../runs.txt', name + ':' + input + ':' + process.argv.slice(2).join(' ') + '\\n');
+const environmentFile = path.resolve('../../common/temp/operation-environment.txt');
+if (fs.existsSync(environmentFile)) {
+  const { COPILOT_AGENT_SESSION_ID = null, RUSH_INVOKED_FOLDER = null } = process.env;
+  fs.appendFileSync(environmentFile, JSON.stringify([name, COPILOT_AGENT_SESSION_ID, RUSH_INVOKED_FOLDER]) + '\\n');
+}
+fs.mkdirSync('lib', { recursive: true });
+fs.writeFileSync('lib/output.txt', input);
+console.log('built-' + name + '-' + input);
+if (input === 'warning') console.error('warning-' + name);
+if (input === 'failure') process.exitCode = 7;
+})().catch((error) => { console.error(error); process.exitCode = 1; });
+`
+    );
+  }
+  if (configurationKind === 'rig') {
+    fs.rmSync(path.join(repoRoot, 'projects/a/config/rush-project.json'));
+    write('projects/a/config/rig.json', '{"rigPackageName":"fixture-rig"}');
+    write('projects/a/node_modules/fixture-rig/package.json', '{"name":"fixture-rig","version":"1.0.0"}');
+    write(
+      'projects/a/node_modules/fixture-rig/profiles/default/config/rush-project.json',
+      JSON.stringify({
+        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+      })
+    );
+  } else if (configurationKind === 'inherited') {
+    write(
+      'common/temp/inherited-rush-project.json',
+      JSON.stringify({
+        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+      })
+    );
+    write(
+      'projects/a/config/rush-project.json',
+      JSON.stringify({
+        extends: '../../../common/temp/inherited-rush-project.json',
+        incrementalBuildIgnoredGlobs: ['ignored.txt']
+      })
+    );
+  }
+  execFileSync('git', ['init', '--quiet'], { cwd: repoRoot });
+  execFileSync('git', ['config', '--local', 'core.autocrlf', 'false'], { cwd: repoRoot });
+  execFileSync('git', ['add', '.'], { cwd: repoRoot });
+  execFileSync(
+    'git',
+    [
+      '-c',
+      'user.name=Engine Test',
+      '-c',
+      'user.email=engine@example.invalid',
+      'commit',
+      '--quiet',
+      '-m',
+      'fixture'
+    ],
+    { cwd: repoRoot }
+  );
+  let session: WorkspaceSession | undefined;
+  let host: RushDaemonHost | undefined;
+  try {
+    host = await RushDaemonHost.startAsync({
+      repoRoot,
+      rushVersion: RUSH_VERSION,
+      daemonVersion: 'native-engine-test',
+      requestResolver: options.resolver ?? new ProductionDaemonRequestResolver(),
+      getSuccessorLaunchAsync: options.getSuccessorLaunchAsync,
+      createWorkspaceSessionAsync: async (sessionOptions) => {
+        session = await WorkspaceSession.createAsync(sessionOptions);
+        options.onSessionCreated?.(session);
+        return session;
+      }
+    });
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    const runningHost: RushDaemonHost = host;
+    return {
+      repoRoot,
+      host,
+      get session(): WorkspaceSession {
+        return session!;
+      },
+      client,
+      [Symbol.asyncDispose]: async () => {
+        await client.closeAsync().finally(() => runningHost.closeAsync());
+        if (cache) await removeTestFolderAsync(cacheFolder, true);
+        await removeTestFolderAsync(repoRoot, true);
+      }
+    };
+  } catch (error) {
+    await host?.closeAsync();
+    if (cache) await removeTestFolderAsync(cacheFolder, true);
+    await removeTestFolderAsync(repoRoot, true);
+    throw error;
+  }
+}
+
+export async function runAsync(
+  fixture: IFixture,
+  requestId: string,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope> = {}
+): Promise<ITerminalExchange> {
+  const environment: Record<string, string> = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined) environment[name] = value;
+  }
+  await fixture.client.sendControlAsync({
+    kind: 'requestStart',
+    payload: createWireEnvelope(requestId, argv[0], fixture.repoRoot, {
+      argv,
+      environment,
+      commandOrigin: 'built-in',
+      ...overrides
+    })
+  });
+  return await fixture.client.readTerminalAsync(requestId);
+}
+
+export function runs(fixture: IFixture): string[] {
+  const filename: string = path.join(fixture.repoRoot, 'runs.txt');
+  return fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8').trim().split('\n') : [];
+}
+
+export function logText(exchange: ITerminalExchange): string {
+  return exchange.frames
+    .filter((frame) => frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr)
+    .map((frame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
+    .join('');
+}
+
+export function requestEnvironment(): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+  );
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index 6333cea8d6..dea724566b 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -794,6 +794,7 @@ describe('shared phased request batching', () => {
       false,
       undefined,
       undefined,
+      undefined,
       secondReceivedTimeMs
     );
     await settleAsync();
diff --git a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
new file mode 100644
index 0000000000..ead18ae7b1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
@@ -0,0 +1,454 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPhasedRequest } from '@rushstack/rush-daemon-protocol';
+import {
+  OperationStatus,
+  type IPhasedCommandEngineTelemetryOptions,
+  type IPhasedCommandEngineTelemetryRecord,
+  type ITelemetryData,
+  type Operation
+} from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
+import {
+  createDaemonRequestTelemetryData,
+  createDaemonRequestTelemetrySink,
+  type IDaemonRequestTelemetryContext
+} from '../DaemonRequestTelemetry';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+
+const DAEMON_MEASURES: ReadonlyArray<string> = [
+  'rush:daemon:admission',
+  'rush:daemon:queueWait',
+  'rush:daemon:acquireExecutionLease',
+  'rush:daemon:reconcileInvalidations',
+  'rush:daemon:applySelections',
+  'rush:daemon:scheduleIteration',
+  'rush:daemon:executeIteration'
+];
+
+function createRequest(requestId: string, ...operationIds: ReadonlyArray<string>): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: operationIds.map((operationId: string) => ({ enabledState: true, operationId })),
+    requestId
+  };
+}
+
+function createFixture(statusesA: ReadonlyArray<OperationStatus> = []): ITestRoutingFixture {
+  const pendingStatusesA: OperationStatus[] = [...statusesA];
+  return createRoutingFixture(
+    new Map([
+      [
+        OPERATION_A,
+        new TestOperationRunner(OPERATION_A, OperationStatus.Success, async () => pendingStatusesA.shift())
+      ],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B)]
+    ]),
+    [[OPERATION_B, OPERATION_A]]
+  );
+}
+
+class RecordingTelemetrySink implements IPhasedRequestTelemetrySink {
+  public readonly reports: IPhasedRequestTelemetryReport[] = [];
+  public readonly resultsWrittenBeforeReport: boolean[] = [];
+  readonly #client: TestPhasedRequestClient;
+
+  public constructor(client: TestPhasedRequestClient) {
+    this.#client = client;
+  }
+
+  public logRequest(report: IPhasedRequestTelemetryReport): void {
+    this.resultsWrittenBeforeReport.push(this.#client.writes.some(({ result }) => result !== undefined));
+    this.reports.push(report);
+  }
+}
+
+function getStatuses(report: IPhasedRequestTelemetryReport): Record<string, OperationStatus> {
+  const statuses: Record<string, OperationStatus> = {};
+  for (const [operation, record] of report.records) {
+    statuses[operation.name] = record.status;
+  }
+  return statuses;
+}
+
+async function executeAsync(
+  router: PhasedRequestRouter,
+  request: IDaemonPhasedRequest
+): Promise<RecordingTelemetrySink> {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient(request.requestId);
+  const sink: RecordingTelemetrySink = new RecordingTelemetrySink(client);
+  await router.executeAsync(request, client, false, undefined, undefined, sink);
+  return sink;
+}
+
+describe('phased request telemetry', () => {
+  it('reports each coalesced request once, with its own selection, before its result is written', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const [dependency, consumer] = await Promise.all([
+        executeAsync(router, createRequest('dependency', OPERATION_A)),
+        executeAsync(router, createRequest('consumer', OPERATION_B))
+      ]);
+
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      for (const sink of [dependency, consumer]) {
+        expect(sink.reports).toHaveLength(1);
+        expect(sink.resultsWrittenBeforeReport).toEqual([false]);
+        const [report] = sink.reports;
+        expect(report).toMatchObject({ batchSize: 2, scheduled: true, countRetained: 0 });
+        expect(report.result).toMatchObject({ exitCode: 0, outcome: 'success' });
+        expect(report.measures.map(({ name }) => name)).toEqual(DAEMON_MEASURES);
+        for (const { startTimeMs, endTimeMs } of report.measures) {
+          expect(endTimeMs).toBeGreaterThanOrEqual(startTimeMs);
+        }
+        expect(report.receivedTimeMs).toBeLessThanOrEqual(report.executionStartTimeMs);
+        expect(report.executionStartTimeMs).toBeLessThanOrEqual(report.iterationStartTimeMs!);
+        expect(report.iterationStartTimeMs!).toBeLessThanOrEqual(report.resultTimeMs);
+      }
+      expect(dependency.reports[0].request.requestId).toBe('dependency');
+      expect(getStatuses(dependency.reports[0])).toEqual({ [OPERATION_A]: OperationStatus.Success });
+      expect(getStatuses(consumer.reports[0])).toEqual({
+        [OPERATION_A]: OperationStatus.Success,
+        [OPERATION_B]: OperationStatus.Success
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports every request of an iteration before the next queued iteration starts', async () => {
+    const OPERATION_C: string = 'project-c (_phase:test)';
+    let resolveStarted: () => void = () => undefined;
+    let resolveRelease: () => void = () => undefined;
+    const consumerStarted: Promise<void> = new Promise((resolve) => (resolveStarted = resolve));
+    const releaseConsumer: Promise<void> = new Promise((resolve) => (resolveRelease = resolve));
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+        [
+          OPERATION_B,
+          new TestOperationRunner(OPERATION_B, OperationStatus.Success, async () => {
+            resolveStarted();
+            await releaseConsumer;
+          })
+        ],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ]),
+      [[OPERATION_B, OPERATION_A]]
+    );
+    // Like a telemetry plugin that starts a new session for each iteration and reads it in beforeLog.
+    let iteration: number = 0;
+    const events: string[] = [];
+    fixture.graph.hooks.beforeExecuteIterationAsync.tap('iteration session', () => {
+      events.push(`iteration ${++iteration}`);
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    async function executeRecordedAsync(requestId: string, operationId: string): Promise<void> {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient(requestId);
+      // A slow reader spreads each request's final flush, which precedes its report, over several event loop turns.
+      client.onWriteAsync = async (): Promise<void> => {
+        await new Promise<void>((resolve) => setImmediate(resolve));
+      };
+      await router.executeAsync(createRequest(requestId, operationId), client, false, undefined, undefined, {
+        logRequest: ({ batchSize, earlyResult }: IPhasedRequestTelemetryReport) => {
+          events.push(`log ${requestId} in iteration ${iteration} (batch ${batchSize}, early ${earlyResult})`);
+        }
+      });
+    }
+    try {
+      const firstBatch: Promise<unknown> = Promise.all([
+        executeRecordedAsync('dependency', OPERATION_A),
+        executeRecordedAsync('consumer', OPERATION_B)
+      ]);
+      await consumerStarted;
+      const queued: Promise<void> = executeRecordedAsync('queued', OPERATION_C);
+      await new Promise<void>((resolve) => setTimeout(resolve, 20));
+      expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(0);
+      resolveRelease();
+      await Promise.all([firstBatch, queued]);
+
+      expect(events).toEqual([
+        'iteration 1',
+        'log dependency in iteration 1 (batch 2, early true)',
+        'log consumer in iteration 1 (batch 2, early false)',
+        'iteration 2',
+        'log queued in iteration 2 (batch 1, early false)'
+      ]);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports the operations of a request with no work as retained and skipped', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    let iteration: number = 0;
+    fixture.graph.hooks.configureIteration.tap('warm no-op', (records, previousResults) => {
+      if (iteration++ === 0) {
+        return;
+      }
+      for (const record of records.values()) {
+        if (previousResults.has(record.operation)) {
+          record.enabled = false;
+        }
+      }
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      await executeAsync(router, createRequest('initial', OPERATION_B));
+      const sink: RecordingTelemetrySink = await executeAsync(router, createRequest('repeat', OPERATION_B));
+
+      expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+      expect(sink.reports).toHaveLength(1);
+      const [report] = sink.reports;
+      expect(report).toMatchObject({ batchSize: 1, scheduled: false, countRetained: 2 });
+      expect(report.result).toMatchObject({ exitCode: 0, scheduled: false });
+      expect(report.iterationStartTimeMs).toBeUndefined();
+      expect(getStatuses(report)).toEqual({
+        [OPERATION_A]: OperationStatus.Skipped,
+        [OPERATION_B]: OperationStatus.Skipped
+      });
+      for (const record of report.records.values()) {
+        expect(record.stopwatch).toEqual({
+          startTime: report.executionStartTimeMs,
+          endTime: report.executionStartTimeMs
+        });
+      }
+      expect(report.measures.map(({ name }) => name)).not.toContain('rush:daemon:executeIteration');
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports a failed request and a later passing request separately', async () => {
+    const fixture: ITestRoutingFixture = createFixture([OperationStatus.Failure]);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const failed: RecordingTelemetrySink = await executeAsync(router, createRequest('failed', OPERATION_B));
+      const passed: RecordingTelemetrySink = await executeAsync(router, createRequest('passed', OPERATION_B));
+
+      expect(failed.reports[0].result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      expect(getStatuses(failed.reports[0])).toEqual({
+        [OPERATION_A]: OperationStatus.Failure,
+        [OPERATION_B]: OperationStatus.Blocked
+      });
+      expect(passed.reports[0].result).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(getStatuses(passed.reports[0])).toEqual({
+        [OPERATION_A]: OperationStatus.Success,
+        [OPERATION_B]: OperationStatus.Success
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('does not report a request rejected before execution, and ignores sink errors', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const rejectedSink: jest.Mocked<IPhasedRequestTelemetrySink> = { logRequest: jest.fn() };
+      await expect(
+        router.executeAsync(
+          createRequest('rejected', 'missing (_phase:test)'),
+          new TestPhasedRequestClient(),
+          false,
+          undefined,
+          undefined,
+          rejectedSink
+        )
+      ).rejects.toThrow();
+      expect(rejectedSink.logRequest).not.toHaveBeenCalled();
+
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      await expect(
+        router.executeAsync(createRequest('accepted', OPERATION_A), client, false, undefined, undefined, {
+          logRequest: () => {
+            throw new Error('telemetry failure');
+          }
+        })
+      ).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(client.writes.some(({ result }) => result?.exitCode === 0)).toBe(true);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
+
+describe(createDaemonRequestTelemetryData.name, () => {
+  // Other suites' graph iterations record native measures in the same process-wide timeline.
+  beforeEach(() => performance.clearMeasures());
+  afterEach(() => performance.clearMeasures());
+
+  function createContext(
+    overrides: Partial<IDaemonRequestTelemetryContext> = {}
+  ): IDaemonRequestTelemetryContext & { readonly calls: IPhasedCommandEngineTelemetryOptions[] } {
+    const fixture: ITestRoutingFixture = createFixture();
+    const calls: IPhasedCommandEngineTelemetryOptions[] = [];
+    return {
+      calls,
+      command: {
+        createTelemetryData: (options: IPhasedCommandEngineTelemetryOptions): ITelemetryData => {
+          calls.push(options);
+          return { name: 'build', durationInSeconds: options.durationInSeconds, result: 'Succeeded' };
+        }
+      },
+      logTelemetry: jest.fn(),
+      workspaceSession: fixture.session,
+      lifecycleInfo: { receivedTimeMs: 100, preparedTimeMs: 150, reloadTier: 1 },
+      resolveStartTimeMs: 150,
+      resolveEndTimeMs: 200,
+      engineCreation: undefined,
+      getRequestIndex: () => 4,
+      ...overrides
+    };
+  }
+
+  function createReport(overrides: Partial<IPhasedRequestTelemetryReport> = {}): IPhasedRequestTelemetryReport {
+    const records: Map<Operation, IPhasedCommandEngineTelemetryRecord> = new Map();
+    return {
+      request: {
+        ...createRequest('request', OPERATION_A),
+        environment: { COPILOT_AGENT_SESSION_ID: 'agent-1', ODSP_TELEMETRY_TAG: 'tag-1' }
+      },
+      result: {
+        aborted: false,
+        exitCode: 0,
+        operationResults: [],
+        outcome: 'success',
+        scheduled: true
+      } as unknown as IPhasedRequestTelemetryReport['result'],
+      records,
+      countRetained: 0,
+      batchSize: 2,
+      scheduled: true,
+      earlyResult: false,
+      receivedTimeMs: 210,
+      executionStartTimeMs: 250,
+      iterationStartTimeMs: 300,
+      resultTimeMs: 1300,
+      measures: [{ name: 'rush:daemon:queueWait', startTimeMs: 220, endTimeMs: 250 }],
+      ...overrides
+    };
+  }
+
+  it('measures the iteration as a native command does and adds the daemon fields', () => {
+    const context: ReturnType<typeof createContext> = createContext();
+    createDaemonRequestTelemetryData(context, createReport());
+
+    const [options] = context.calls;
+    expect(options).toMatchObject({ succeeded: true, durationInSeconds: 1, timeOriginMs: 100 });
+    expect(options.extraData).toMatchObject({
+      daemon: true,
+      daemonPid: process.pid,
+      requestId: 'request',
+      reloadTier: 1,
+      requestIndex: 4,
+      batchSize: 2,
+      queueWaitSeconds: 0.03,
+      graphWasInitialized: true,
+      scheduled: true,
+      earlyResult: false,
+      countRetained: 0,
+      exitCode: 0,
+      outcome: 'success',
+      durationBasis: 'iteration',
+      bootDurationSeconds: 0.2,
+      totalDurationSeconds: 1.2,
+      agentSessionId: 'agent-1',
+      telemetryTag: 'tag-1'
+    });
+    expect(typeof options.extraData?.daemonVersion).toBe('string');
+    expect(options.extraData?.generationToken).toHaveLength(8);
+    expect(options.performanceEntries?.map(({ name, startTime, duration }) => [name, startTime, duration])).toEqual([
+      ['rush:daemon:prepareWorkspace', 100, 50],
+      ['rush:daemon:resolve', 150, 50],
+      ['rush:daemon:queueWait', 220, 30]
+    ]);
+  });
+
+  it('attributes engine creation and its native measures to the request that created the engine', () => {
+    performance.measure('rush:test:beforeEngine', { start: 110, end: 115 });
+    performance.measure('rush:test:createEngine', { start: 160, end: 170 });
+    performance.measure('rush:executionManager:test', { start: 400, end: 900 });
+    performance.measure('rush:executionManager:afterResult', { start: 400, end: 1400 });
+    const context: ReturnType<typeof createContext> = createContext({
+      engineCreation: { startTimeMs: 155, endTimeMs: 180 }
+    });
+    createDaemonRequestTelemetryData(context, createReport());
+
+    const [options] = context.calls;
+    expect(options.extraData).toMatchObject({ graphWasInitialized: false });
+    expect(options.performanceEntries?.map(({ name }) => name)).toEqual([
+      'rush:daemon:prepareWorkspace',
+      'rush:daemon:createEngine',
+      'rush:daemon:resolve',
+      'rush:daemon:queueWait',
+      'rush:test:createEngine',
+      'rush:executionManager:test'
+    ]);
+  });
+
+  it('measures a request that needed no iteration from when its batch began handling it', () => {
+    const context: ReturnType<typeof createContext> = createContext({ lifecycleInfo: undefined });
+    createDaemonRequestTelemetryData(
+      context,
+      createReport({
+        scheduled: false,
+        iterationStartTimeMs: undefined,
+        resultTimeMs: 350,
+        result: { exitCode: 1, outcome: 'failure' } as unknown as IPhasedRequestTelemetryReport['result']
+      })
+    );
+
+    const [options] = context.calls;
+    expect(options).toMatchObject({ succeeded: false, durationInSeconds: 0.1, timeOriginMs: 150 });
+    expect(options.extraData).toMatchObject({ durationBasis: 'batch', exitCode: 1, outcome: 'failure' });
+    expect(options.extraData).not.toHaveProperty('reloadTier');
+    expect(options.performanceEntries?.map(({ name }) => name)).toEqual([
+      'rush:daemon:resolve',
+      'rush:daemon:queueWait'
+    ]);
+  });
+
+  it('runs beforeLog taps only for entries that an iteration served', () => {
+    const logTelemetry: jest.Mock = jest.fn();
+    const sink: IPhasedRequestTelemetrySink = createDaemonRequestTelemetrySink(createContext({ logTelemetry }));
+    sink.logRequest(createReport());
+    sink.logRequest(createReport({ scheduled: false, iterationStartTimeMs: undefined }));
+
+    expect(logTelemetry.mock.calls.map(([, options]) => options)).toEqual([
+      { servedByIteration: true },
+      { servedByIteration: false }
+    ]);
+  });
+
+  it('logs through the engine and reports a logging failure without throwing', () => {
+    const context: ReturnType<typeof createContext> = createContext({
+      logTelemetry: () => {
+        throw new Error('disk full');
+      }
+    });
+    const stderrSpy: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    try {
+      expect(() => createDaemonRequestTelemetrySink(context).logRequest(createReport())).not.toThrow();
+      expect(stderrSpy).toHaveBeenCalledWith(expect.stringContaining('disk full'));
+    } finally {
+      stderrSpy.mockRestore();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
index 3425fd4dc9..645709e596 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
@@ -1,20 +1,111 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as path from 'node:path';
+
 import { PhasedCommandEngine } from '@microsoft/rush-lib';
 
+import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IWorkspaceSession } from '../WorkspaceSession';
 import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
 
 describe('ProductionDaemonRequestResolver environment identity', () => {
-  it('ignores insertion order for distinct environment names with identical locale collation', async () => {
-    const names: string[] = ['RUSHD_TEST_\u00e9', 'RUSHD_TEST_e\u0301'];
-    const original: (string | undefined)[] = names.map((name) => process.env[name]);
-    const parse = jest.spyOn(PhasedCommandEngine, 'parseAsync').mockResolvedValue({
+  const ADDED_NAME: string = 'RUSHD_TEST_PLUGIN_ADDED';
+  const STARTUP_NAME: string = 'RUSHD_TEST_STARTUP';
+  let parse: jest.SpyInstance;
+  beforeEach(() => {
+    parse = jest.spyOn(PhasedCommandEngine, 'parseAsync').mockResolvedValue({
       commandName: 'build',
       parameterIdentity: 'parameters'
     } as PhasedCommandEngine);
+  });
+  afterEach(() => {
+    parse.mockRestore();
+    delete process.env[ADDED_NAME];
+    delete process.env[STARTUP_NAME];
+  });
+
+  function getEnvironment(): Record<string, string> {
+    return Object.fromEntries(
+      Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+    );
+  }
+  function createOptions(environment: Record<string, string>): IResolveDaemonRequestOptions {
+    return {
+      abortSignal: new AbortController().signal,
+      envelope: createWireEnvelope('identity', 'build', process.cwd(), {
+        commandOrigin: 'built-in',
+        environment
+      }),
+      workspaceSession: { rushConfiguration: {} } as IWorkspaceSession
+    };
+  }
+
+  it('ignores names that the daemon process added after startup, as a plugin does', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const startupEnvironment: Record<string, string> = getEnvironment();
+    // A plugin that records its iteration id in process.env, in every iteration.
+    process.env[ADDED_NAME] = 'iteration-1';
+    await expect(
+      resolver.getCommandParameterIdentityAsync(createOptions(startupEnvironment))
+    ).resolves.toBe('parameters');
+    process.env[ADDED_NAME] = 'iteration-2';
+    await expect(
+      resolver.getCommandParameterIdentityAsync(createOptions(startupEnvironment))
+    ).resolves.toBe('parameters');
+    // A client that sets the added name is still a different environment.
+    await expect(
+      resolver.getCommandParameterIdentityAsync(createOptions({ ...startupEnvironment, [ADDED_NAME]: 'x' }))
+    ).rejects.toThrow('differs from the daemon startup environment');
+  });
+
+  it('still rejects a live change to, or removal of, a startup name, and names it', async () => {
+    process.env[STARTUP_NAME] = 'startup';
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
+    const message: string = `The daemon's own environment changed after it started (${STARTUP_NAME})`;
+    process.env[STARTUP_NAME] = 'changed';
+    await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toThrow(message);
+    delete process.env[STARTUP_NAME];
+    await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toThrow(message);
+    process.env[STARTUP_NAME] = 'startup';
+    await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+  });
+
+  it('keeps serving with a startup PATH that repeats an entry, and still names a changed PATH', async () => {
+    const originalPath: string | undefined = process.env.PATH;
+    const repeatedEntry: string = path.resolve('/rushd-test-repeated-path-entry');
+    const otherEntries: string[] = originalPath === undefined ? [] : [originalPath];
+    try {
+      process.env.PATH = [repeatedEntry, repeatedEntry, ...otherEntries].join(path.delimiter);
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      // Only the repeated entry differs, so the fingerprint is the same.
+      process.env.PATH = [repeatedEntry, ...otherEntries].join(path.delimiter);
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      process.env.PATH = otherEntries.join(path.delimiter);
+      await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toThrow(
+        "The daemon's own environment changed after it started (PATH)"
+      );
+    } finally {
+      if (originalPath === undefined) delete process.env.PATH;
+      else process.env.PATH = originalPath;
+    }
+  });
+
+  it('keeps the startup environment for a replacement session', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
+    process.env[ADDED_NAME] = 'iteration-1';
+    const replacement: ProductionDaemonRequestResolver = resolver.createForSession();
+    await expect(replacement.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+  });
+
+  it('ignores insertion order for distinct environment names with identical locale collation', async () => {
+    const names: string[] = ['RUSHD_TEST_\u00e9', 'RUSHD_TEST_e\u0301'];
+    const original: (string | undefined)[] = names.map((name) => process.env[name]);
     try {
       process.env[names[0]] = 'composed';
       process.env[names[1]] = 'decomposed';
@@ -38,7 +129,6 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
         'differs from the daemon startup environment'
       );
     } finally {
-      parse.mockRestore();
       names.forEach((name, index) => {
         if (original[index] === undefined) delete process.env[name];
         else process.env[name] = original[index];
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index f307a3a75d..3a8426c049 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -7,44 +7,33 @@ import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
 
 import {
-  Rush,
+  PhasedCommandEngine,
   RushProjectConfiguration,
-  RushUserConfiguration,
   type IOperationGraph,
+  type IPhasedCommandEngine,
+  type ITelemetryData,
   type Operation,
   type RushConfigurationProject
 } from '@microsoft/rush-lib';
+import type { LockFile } from '@rushstack/node-core-library';
 import {
   DaemonFrameType,
   decodeDaemonEventFrame,
-  decodeDaemonLogChunk,
-  type IDaemonPhasedRequestResult,
-  type IDaemonRequestEnvelope
+  type IDaemonPhasedRequestResult
 } from '@rushstack/rush-daemon-protocol';
 import { NoOpTerminalProvider, Terminal, TerminalProviderSeverity } from '@rushstack/terminal';
 import { StandardScriptUpdater } from '@microsoft/rush-lib/lib/logic/StandardScriptUpdater';
 import { RushConfiguration as InternalRushConfiguration } from '@microsoft/rush-lib/lib/api/RushConfiguration';
 
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
-import { RushDaemonHost } from '../RushDaemonHost';
-import { WorkspaceSession } from '../WorkspaceSession';
+import type { WorkspaceSession } from '../WorkspaceSession';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
-import { removeTestFolderAsync } from './TestProcessExit';
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 import { EngineTerminalProvider } from '../EngineTerminalProvider';
 import { DaemonShutdownError } from '../DaemonShutdownError';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import type {
-  GetWorkspaceSuccessorLaunchAsync,
-  IWorkspaceProcessRestartResult
-} from '../WorkspaceProcessRestart';
+import type { IWorkspaceProcessRestartResult } from '../WorkspaceProcessRestart';
 import type { IResolveDaemonRequestOptions, ResolvedDaemonRequest } from '../DaemonRequestDispatcher';
-import type { IDaemonRequestResolver } from '../DaemonRequestDispatcher';
-import {
-  isRushxInvocation,
-  wrapWorkspaceResolverLifecycle,
-  type IWorkspaceResolverLifecycle
-} from '../WorkspaceResolverLifecycle';
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import type { IRequestLease } from '../RequestScheduler';
 import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
@@ -62,314 +51,24 @@ import {
   type IDeferred,
   type ITerminalExchange
 } from './DaemonRequestWireTestUtilities';
+import {
+  createFixtureAsync,
+  DecoratedTestResolver,
+  logText,
+  requestEnvironment,
+  runAsync,
+  runs,
+  type IFixture
+} from './NativeEngineTestFixture';
 
-const RUSH_VERSION: string = Rush.version;
 jest.setTimeout(30_000);
 
-interface IFixture extends AsyncDisposable {
-  readonly repoRoot: string;
-  readonly host: RushDaemonHost;
-  readonly session: WorkspaceSession;
-  readonly client: DaemonRequestWireClient;
-}
-
-interface IFixtureOptions {
-  readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
-  readonly onSessionCreated?: (session: WorkspaceSession) => void;
-  readonly resolver?: IDaemonRequestResolver;
-  /** Adds the `_phase:compile:incremental` script, which passes `--incremental` to build.cjs. */
-  readonly incrementalScript?: boolean;
-  /** Sets `daemon.incrementalBuilds` in rush.json. */
-  readonly incrementalBuilds?: boolean;
-  /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
-  readonly pnpm?: boolean;
-}
-
-class DecoratedTestResolver implements IDaemonRequestResolver {
-  public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
-  private readonly _inner: IDaemonRequestResolver;
-  private readonly _events: string[];
-  private readonly _id: number;
-  private _disposed: boolean = false;
-
-  public constructor(inner: IDaemonRequestResolver, events: string[]) {
-    this._inner = inner;
-    this._events = events;
-    this._id = events.filter((event) => event.startsWith('created')).length;
-    events.push(`created:${this._id}`);
-    this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
-      inner,
-      (replacement) => new DecoratedTestResolver(replacement, events)
-    );
-  }
-
-  public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
-    if (this._disposed) throw new Error('A disposed resolver was invoked.');
-    if (isRushxInvocation(options.envelope)) {
-      this._events.push(`isolated:${this._id}`);
-      throw new Error('Explicit isolated invocation reached the decorated resolver.');
-    }
-    return await this._inner.resolveRequestAsync(options);
-  }
-
-  public async [Symbol.asyncDispose](): Promise<void> {
-    if (this._disposed) throw new Error('A resolver was disposed twice.');
-    this._disposed = true;
-    this._events.push(`disposed:${this._id}`);
-    await this._inner[Symbol.asyncDispose]?.();
-  }
-}
-
-async function createFixtureAsync(
-  cache: boolean = false,
-  configurationKind: 'direct' | 'rig' | 'inherited' = 'direct',
-  options: IFixtureOptions = {}
-): Promise<IFixture> {
-  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-native-engine-'));
-  const cacheNamespace: string = path.basename(repoRoot);
-  const userConfiguration: RushUserConfiguration = await RushUserConfiguration.initializeAsync();
-  const cacheFolder: string = path.join(
-    userConfiguration.buildCacheFolder ?? path.join(repoRoot, 'common/temp/build-cache'),
-    cacheNamespace
-  );
-  const write: (name: string, text: string) => void = (name, text) => {
-    const filename: string = path.join(repoRoot, name);
-    fs.mkdirSync(path.dirname(filename), { recursive: true });
-    fs.writeFileSync(filename, text);
-  };
-  write(
-    'rush.json',
-    JSON.stringify({
-      rushVersion: RUSH_VERSION,
-      ...(options.pnpm ? { pnpmVersion: '9.15.9' } : { npmVersion: '10.0.0' }),
-      // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
-      daemon: {
-        warmMemoryBudgetMB: 100_000,
-        ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds })
-      },
-      projectFolderMinDepth: 2,
-      projectFolderMaxDepth: 2,
-      projects: ['a', 'b', 'c'].map((name) => ({
-        packageName: name,
-        projectFolder: `projects/${name}`
-      }))
-    })
-  );
-  write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\n**/lib/\n**/node_modules/\nruns.txt\n');
-  write('common/temp/last-link.flag', '{}');
-  if (options.pnpm) {
-    write('common/config/rush/pnpm-lock.yaml', "lockfileVersion: '9.0'\n");
-  } else {
-    write('common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
-  }
-  write(
-    'common/config/rush/command-line.json',
-    JSON.stringify({
-      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
-      commands: [
-        {
-          commandKind: 'phased',
-          name: 'build',
-          phases: ['_phase:compile'],
-          incremental: true,
-          enableParallelism: true
-        }
-      ],
-      parameters: [
-        {
-          parameterKind: 'flag',
-          longName: '--production',
-          description: 'Production build',
-          associatedCommands: ['build'],
-          associatedPhases: ['_phase:compile']
-        }
-      ]
-    })
-  );
-  if (cache) {
-    write(
-      'common/config/rush/build-cache.json',
-      JSON.stringify({
-        buildCacheEnabled: true,
-        cacheProvider: 'local-only',
-        cacheEntryNamePattern: `${cacheNamespace}/[hash]`
-      })
-    );
-  }
-  for (const name of ['a', 'b', 'c']) {
-    write(
-      `projects/${name}/package.json`,
-      JSON.stringify({
-        name,
-        version: '1.0.0',
-        scripts: {
-          '_phase:compile': 'node build.cjs',
-          ...(options.incrementalScript
-            ? { '_phase:compile:incremental': 'node build.cjs --incremental' }
-            : {})
-        },
-        dependencies: name === 'b' ? { a: '1.0.0' } : {}
-      })
-    );
-    write(
-      `projects/${name}/config/rush-project.json`,
-      JSON.stringify({
-        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
-      })
-    );
-    write(`projects/${name}/input.txt`, 'one');
-    if (options.pnpm) write(`projects/${name}/.rush/temp/shrinkwrap-deps.json`, '{}');
-    write(
-      `projects/${name}/build.cjs`,
-      `
-const fs = require('node:fs');
-const path = require('node:path');
-const name = require('./package.json').name;
-const input = fs.readFileSync(fs.existsSync('src/input.txt') ? 'src/input.txt' : 'input.txt', 'utf8');
-(async () => {
-const gateFile = path.resolve('../../common/temp/gate-' + name + '.json');
-if (fs.existsSync(gateFile)) {
-  const { port } = JSON.parse(fs.readFileSync(gateFile, 'utf8'));
-  await new Promise((resolve, reject) => {
-    const socket = require('node:net').connect(port, '127.0.0.1');
-    socket.once('error', reject);
-    socket.once('data', () => { socket.end(); resolve(); });
-  });
-}
-fs.appendFileSync('../../runs.txt', name + ':' + input + ':' + process.argv.slice(2).join(' ') + '\\n');
-const environmentFile = path.resolve('../../common/temp/operation-environment.txt');
-if (fs.existsSync(environmentFile)) {
-  const { COPILOT_AGENT_SESSION_ID = null, RUSH_INVOKED_FOLDER = null } = process.env;
-  fs.appendFileSync(environmentFile, JSON.stringify([name, COPILOT_AGENT_SESSION_ID, RUSH_INVOKED_FOLDER]) + '\\n');
-}
-fs.mkdirSync('lib', { recursive: true });
-fs.writeFileSync('lib/output.txt', input);
-console.log('built-' + name + '-' + input);
-if (input === 'warning') console.error('warning-' + name);
-if (input === 'failure') process.exitCode = 7;
-})().catch((error) => { console.error(error); process.exitCode = 1; });
-`
-    );
-  }
-  if (configurationKind === 'rig') {
-    fs.rmSync(path.join(repoRoot, 'projects/a/config/rush-project.json'));
-    write('projects/a/config/rig.json', '{"rigPackageName":"fixture-rig"}');
-    write('projects/a/node_modules/fixture-rig/package.json', '{"name":"fixture-rig","version":"1.0.0"}');
-    write(
-      'projects/a/node_modules/fixture-rig/profiles/default/config/rush-project.json',
-      JSON.stringify({
-        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
-      })
-    );
-  } else if (configurationKind === 'inherited') {
-    write(
-      'common/temp/inherited-rush-project.json',
-      JSON.stringify({
-        operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
-      })
-    );
-    write(
-      'projects/a/config/rush-project.json',
-      JSON.stringify({
-        extends: '../../../common/temp/inherited-rush-project.json',
-        incrementalBuildIgnoredGlobs: ['ignored.txt']
-      })
-    );
-  }
-  execFileSync('git', ['init', '--quiet'], { cwd: repoRoot });
-  execFileSync('git', ['config', '--local', 'core.autocrlf', 'false'], { cwd: repoRoot });
-  execFileSync('git', ['add', '.'], { cwd: repoRoot });
-  execFileSync(
-    'git',
-    [
-      '-c',
-      'user.name=Engine Test',
-      '-c',
-      'user.email=engine@example.invalid',
-      'commit',
-      '--quiet',
-      '-m',
-      'fixture'
-    ],
-    { cwd: repoRoot }
-  );
-  let session: WorkspaceSession | undefined;
-  let host: RushDaemonHost | undefined;
-  try {
-    host = await RushDaemonHost.startAsync({
-      repoRoot,
-      rushVersion: RUSH_VERSION,
-      daemonVersion: 'native-engine-test',
-      requestResolver: options.resolver ?? new ProductionDaemonRequestResolver(),
-      getSuccessorLaunchAsync: options.getSuccessorLaunchAsync,
-      createWorkspaceSessionAsync: async (sessionOptions) => {
-        session = await WorkspaceSession.createAsync(sessionOptions);
-        options.onSessionCreated?.(session);
-        return session;
-      }
-    });
-    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
-    await client.handshakeAsync();
-    const runningHost: RushDaemonHost = host;
-    return {
-      repoRoot,
-      host,
-      get session(): WorkspaceSession {
-        return session!;
-      },
-      client,
-      [Symbol.asyncDispose]: async () => {
-        await client.closeAsync().finally(() => runningHost.closeAsync());
-        if (cache) await removeTestFolderAsync(cacheFolder, true);
-        await removeTestFolderAsync(repoRoot, true);
-      }
-    };
-  } catch (error) {
-    await host?.closeAsync();
-    if (cache) await removeTestFolderAsync(cacheFolder, true);
-    await removeTestFolderAsync(repoRoot, true);
-    throw error;
-  }
-}
-
-async function runAsync(
-  fixture: IFixture,
-  requestId: string,
-  argv: string[],
-  overrides: Partial<IDaemonRequestEnvelope> = {}
-): Promise<ITerminalExchange> {
-  const environment: Record<string, string> = {};
-  for (const [name, value] of Object.entries(process.env)) {
-    if (value !== undefined) environment[name] = value;
-  }
-  await fixture.client.sendControlAsync({
-    kind: 'requestStart',
-    payload: createWireEnvelope(requestId, argv[0], fixture.repoRoot, {
-      argv,
-      environment,
-      commandOrigin: 'built-in',
-      ...overrides
-    })
-  });
-  return await fixture.client.readTerminalAsync(requestId);
-}
-
-function runs(fixture: IFixture): string[] {
-  const filename: string = path.join(fixture.repoRoot, 'runs.txt');
-  return fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8').trim().split('\n') : [];
-}
-
-function logText(exchange: ITerminalExchange): string {
-  return exchange.frames
-    .filter((frame) => frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr)
-    .map((frame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
-    .join('');
-}
-
-function requestEnvironment(): Record<string, string> {
-  return Object.fromEntries(
-    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
-  );
+function readTelemetryEntries(repoRoot: string): ITelemetryData[] {
+  const folder: string = path.join(repoRoot, 'common/temp/telemetry');
+  return fs
+    .readdirSync(folder)
+    .sort()
+    .flatMap((name: string) => JSON.parse(fs.readFileSync(path.join(folder, name), 'utf8')));
 }
 
 describe('native production daemon engine', () => {
@@ -1970,4 +1669,124 @@ process.exit(23);
       await fixture[Symbol.asyncDispose]();
     }
   });
+
+  it('logs one native telemetry entry for each build request served by the warm engine', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
+    try {
+      const beforeLogIndexes: unknown[] = [];
+      for (const [requestId, argv] of [
+        ['initial', ['build', '--only', 'a']],
+        ['repeat', ['build', '--only', 'a']],
+        ['consumer', ['build', '--to', 'b']]
+      ] as const) {
+        expect((await runAsync(fixture, requestId, [...argv])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0 }
+        });
+        if (requestId === 'initial') {
+          fixture.session.operationGraph!.hooks.beforeLog.tap('test', (data: ITelemetryData) => {
+            beforeLogIndexes.push(data.extraData?.requestIndex);
+          });
+        }
+      }
+      const entries: ITelemetryData[] = readTelemetryEntries(fixture.repoRoot);
+
+      expect(entries).toHaveLength(3);
+      expect(entries.map(({ name, result }) => [name, result])).toEqual([
+        ['build', 'Succeeded'],
+        ['build', 'Succeeded'],
+        ['build', 'Succeeded']
+      ]);
+      expect(entries[0].extraData).toMatchObject({
+        daemon: true,
+        requestIndex: 1,
+        graphWasInitialized: false,
+        scheduled: true,
+        durationBasis: 'iteration',
+        isInitial: true,
+        isWatch: false,
+        command_only: 'true',
+        '--only': 'a',
+        countAll: 1,
+        countSuccess: 1
+      });
+      expect(entries[1].extraData).toMatchObject({
+        requestIndex: 2,
+        graphWasInitialized: true,
+        scheduled: false,
+        durationBasis: 'batch',
+        countAll: 1,
+        countSkipped: 1,
+        countRetained: 1
+      });
+      expect(entries[2].extraData).toMatchObject({
+        requestIndex: 3,
+        scheduled: true,
+        command_only: 'false',
+        command_to: 'true',
+        '--to': 'b',
+        countAll: 2,
+        countSuccess: 1,
+        countSkipped: 1,
+        countRetained: 1
+      });
+      for (const entry of entries) {
+        const totalSeconds: number = entry.extraData!.totalDurationSeconds as number;
+        const requestMs: number = totalSeconds * 1000;
+        expect(entry.durationInSeconds).toBeLessThanOrEqual(totalSeconds);
+        expect(entry.extraData!.bootDurationSeconds).toBeLessThanOrEqual(totalSeconds);
+        for (const { startTimestampMs, endTimestampMs } of Object.values(entry.operationResults!)) {
+          expect(startTimestampMs).toBeGreaterThanOrEqual(0);
+          expect(endTimestampMs).toBeLessThanOrEqual(requestMs);
+        }
+        expect(entry.performanceEntries?.map(({ name }) => name)).toContain('rush:daemon:resolve');
+      }
+      // The repeated request needed no iteration, so iteration-scoped beforeLog taps do not see its entry.
+      expect(beforeLogIndexes).toEqual([3]);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('releases the lockfile within seconds when a flushTelemetry tap never settles', async () => {
+    const stalledUploads: string[] = [];
+    const createEngineAsync = PhasedCommandEngine.prototype.createEngineAsync;
+    const createEngineSpy: jest.SpyInstance = jest
+      .spyOn(PhasedCommandEngine.prototype, 'createEngineAsync')
+      .mockImplementation(async function (
+        this: PhasedCommandEngine,
+        lock?: LockFile
+      ): Promise<IPhasedCommandEngine> {
+        const engine: IPhasedCommandEngine = await createEngineAsync.call(this, lock);
+        // Like an upload to a server that accepts the connection and never answers.
+        engine.rushSession.hooks.flushTelemetry.tapPromise('StalledUpload', (data) => {
+          stalledUploads.push(...data.map(({ name }) => name));
+          return new Promise<void>(() => undefined);
+        });
+        return engine;
+      });
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
+    try {
+      expect((await runAsync(fixture, 'initial', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect(stalledUploads).toEqual(['build']);
+
+      const startMs: number = Date.now();
+      await fixture.host.closeAsync();
+      const elapsedMs: number = Date.now() - startMs;
+
+      // The engine gives the upload 2 seconds, then the host releases its lockfile and socket, well before a
+      // waiting client gives up on the handoff and falls back to in-process Rush.
+      expect(elapsedMs).toBeGreaterThanOrEqual(1900);
+      expect(elapsedMs).toBeLessThan(8000);
+      expect(readDaemonLockfile(fixture.host.paths.lockfilePath)).toBeUndefined();
+      expect(fs.existsSync(fixture.host.paths.socketPath)).toBe(false);
+    } finally {
+      createEngineSpy.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts b/libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts
new file mode 100644
index 0000000000..6f6cb6ff1c
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspacePluginEnvironment.test.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(30_000);
+
+// Engine code runs in the daemon process, and a Rush plugin may add its own names to process.env there.
+const ADDED_NAME: string = 'RUSHD_TEST_PLUGIN_ADDED';
+
+afterEach(() => {
+  delete process.env[ADDED_NAME];
+});
+
+it('keeps serving the warm generation after a plugin adds a name to process.env', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => setDaemonPolicy(created, {}));
+  try {
+    await fixture.buildSuccessfullyAsync();
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reuse);
+    const generation: number = fixture.host.workspaceGeneration;
+    const graph = fixture.session.operationGraph;
+    process.env[ADDED_NAME] = 'iteration-1';
+
+    expect((await fixture.graphAsync('invalidate', '--project', 'a')).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    process.env[ADDED_NAME] = 'iteration-2';
+    await fixture.buildSuccessfullyAsync();
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reuse);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.session.operationGraph).toBe(graph);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 56940a44ca..8172ff36c0 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import * as path from 'node:path';
+import type { PerformanceEntry } from 'node:perf_hooks';
 
 import { FileSystem, LockFile } from '@rushstack/node-core-library';
 import { Terminal, type ITerminalProvider } from '@rushstack/terminal';
@@ -12,14 +13,20 @@ import { PhasedScriptAction } from '../cli/scriptActions/PhasedScriptAction';
 import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from '../logic/incremental/InputsSnapshot';
 import type { IOperationGraph } from '../logic/operations/IOperationGraph';
 import type { Operation, OperationEnabledState } from '../logic/operations/Operation';
+import type { OperationStatus } from '../logic/operations/OperationStatus';
 import type { Parallelism } from '../logic/operations/ParseParallelism';
 import { PhasedCommandEngineExecution } from '../logic/operations/PhasedCommandEngineExecution';
+import { createPhasedTelemetryData } from '../logic/operations/PhasedCommandTelemetry';
+import { type ITelemetryData, Telemetry } from '../logic/Telemetry';
 import type { RushSession } from '../pluginFramework/RushSession';
 import type { RushConfiguration } from './RushConfiguration';
 import { RushUserConfiguration } from './RushUserConfiguration';
 import { PhasedCommandEngineBusyError } from './PhasedCommandEngineBusyError';
 import { resolvePhasedCommandCwdAsync } from '../utilities/resolvePhasedCommandCwd';
 
+/** How long disposing an engine waits for `flushTelemetry` taps that are still running. */
+const TELEMETRY_FLUSH_WAIT_MS: number = 2000;
+
 /**
  * A native phased command graph prepared without executing an iteration.
  * @alpha
@@ -35,6 +42,65 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
   readonly phaseNames: ReadonlyArray<string>;
   readonly pluginNames: ReadonlyArray<string>;
   readonly isIncremental: boolean;
+  /**
+   * Logs one request's telemetry entry the way a native iteration logs its own: `beforeLog` taps run first, then
+   * the entry is saved under `common/temp/telemetry` and passed to `flushTelemetry` taps. Disposing the engine waits
+   * up to 2 seconds for taps that are still running; a tap that takes longer, such as an upload over a stalled
+   * network, keeps running in the background, so that it cannot hold the host. Saving does nothing when telemetry
+   * is disabled for the repository.
+   *
+   * @remarks
+   * `beforeLog` taps describe the latest iteration, so a host logs an iteration's entries before it starts the
+   * next iteration.
+   */
+  readonly logTelemetry?: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => void;
+}
+
+/**
+ * Options for `IPhasedCommandEngine.logTelemetry`.
+ * @alpha
+ */
+export interface IPhasedCommandEngineLogTelemetryOptions {
+  /**
+   * Whether a graph iteration served the request. If `false`, as for a request that the warm graph answered
+   * without an iteration, `beforeLog` taps are skipped, because they would describe an earlier iteration.
+   * Defaults to `true`.
+   */
+  readonly servedByIteration?: boolean;
+}
+
+/**
+ * One operation's result in a request-scoped telemetry entry.
+ * @alpha
+ */
+export interface IPhasedCommandEngineTelemetryRecord {
+  /** The operation's status in this request. */
+  readonly status: OperationStatus;
+  /** Whether the operation's runner is silent. Silent operations are omitted from the entry. */
+  readonly silent: boolean;
+  /** `performance.now()` values for when the operation started and ended in this request. */
+  readonly stopwatch: { readonly startTime: number | undefined; readonly endTime: number | undefined };
+  /** How long the operation would have taken without the build cache. */
+  readonly nonCachedDurationMs: number | undefined;
+}
+
+/**
+ * The results of one request served by a long-lived engine.
+ * @alpha
+ */
+export interface IPhasedCommandEngineTelemetryOptions {
+  /** The results of the request's selected operations. Silent operations are omitted from the entry. */
+  readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
+  /** Whether the request succeeded. As for a native command, only a `Success` status counts as success. */
+  readonly succeeded: boolean;
+  /** How long the request's graph iteration took, in seconds. */
+  readonly durationInSeconds: number;
+  /** A `performance.now()` value. Operation and performance entry times are reported relative to it. */
+  readonly timeOriginMs: number;
+  /** Host-specific fields, added after the native fields. */
+  readonly extraData?: Readonly<Record<string, string | number | boolean>>;
+  /** The request's performance entries, with `performance.now()` start times. */
+  readonly performanceEntries?: ReadonlyArray<PerformanceEntry>;
 }
 
 /** Options for parsing a command for a long-lived engine host. @alpha */
@@ -187,10 +253,25 @@ export class PhasedCommandEngine {
         engine,
         this._parser.rushConfiguration.commonTempFolder
       );
+      const { operationGraph } = engine;
+      const telemetry: Telemetry = new Telemetry(this._parser.rushConfiguration, this._parser.rushSession);
       return {
         ...engine,
         acquireExecutionLeaseAsync: () => execution.acquireExecutionLeaseAsync(),
-        [Symbol.asyncDispose]: () => execution[Symbol.asyncDispose]()
+        logTelemetry: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => {
+          if (options?.servedByIteration !== false) {
+            operationGraph.hooks.beforeLog.call(data);
+          }
+          telemetry.log(data);
+          telemetry.flush();
+        },
+        [Symbol.asyncDispose]: async () => {
+          try {
+            await execution[Symbol.asyncDispose]();
+          } finally {
+            await waitForTelemetryFlushAsync(telemetry.ensureFlushedAsync(), TELEMETRY_FLUSH_WAIT_MS);
+          }
+        }
       };
     } catch (error) {
       const cleanupErrors: unknown[] = [];
@@ -229,4 +310,71 @@ export class PhasedCommandEngine {
   public get requestSettings(): IPhasedCommandEngineRequestSettings {
     return this._action.getEngineRequestSettings();
   }
+
+  /**
+   * Builds the native telemetry entry for one request that this command made of a long-lived engine.
+   *
+   * @remarks
+   * The entry carries this command's own parameters, not those of the command that created the engine, and reports
+   * one initial, non-watch execution, as the native command's entry would.
+   */
+  public createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData {
+    const { timeOriginMs } = options;
+    const data: ITelemetryData = createPhasedTelemetryData({
+      ...this._action.getTelemetryFields(),
+      isWatch: false,
+      isInitial: true,
+      durationInSeconds: options.durationInSeconds,
+      succeeded: options.succeeded,
+      records: options.records,
+      timeOriginMs
+    });
+    return {
+      ...data,
+      extraData: { ...data.extraData, ...options.extraData },
+      performanceEntries: (options.performanceEntries ?? []).map((entry: PerformanceEntry) =>
+        rebasePerformanceEntry(entry, timeOriginMs)
+      )
+    };
+  }
+}
+
+function rebasePerformanceEntry(entry: PerformanceEntry, timeOriginMs: number): PerformanceEntry {
+  const { name, entryType, duration, detail } = entry;
+  const startTime: number = entry.startTime - timeOriginMs;
+  return {
+    name,
+    entryType,
+    startTime,
+    duration,
+    detail,
+    toJSON: () => ({ name, entryType, startTime, duration, detail })
+  };
+}
+
+/**
+ * Waits for pending `flushTelemetry` taps, but no longer than `timeoutMs`. As in the native CLI, a failed tap does
+ * not fail the command.
+ *
+ * @returns `true` if the taps settled in time, or `false` if they are still running.
+ */
+export async function waitForTelemetryFlushAsync(
+  flushPromise: Promise<void>,
+  timeoutMs: number
+): Promise<boolean> {
+  let timeout: NodeJS.Timeout | undefined;
+  const expiredPromise: Promise<false> = new Promise((resolve) => {
+    timeout = setTimeout(() => resolve(false), timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      flushPromise.then(
+        () => true,
+        () => true
+      ),
+      expiredPromise
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
 }
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
new file mode 100644
index 0000000000..3e9931220d
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
@@ -0,0 +1,256 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import type { PerformanceEntry } from 'node:perf_hooks';
+
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import {
+  PhasedCommandEngine,
+  waitForTelemetryFlushAsync,
+  type IPhasedCommandEngineTelemetryOptions,
+  type IPhasedCommandEngineTelemetryRecord
+} from '../PhasedCommandEngine';
+import { RushConfiguration } from '../RushConfiguration';
+import { Rush } from '../Rush';
+import type { IPhase } from '../CommandLineConfiguration';
+import type { ITelemetryData } from '../../logic/Telemetry';
+import { Operation } from '../../logic/operations/Operation';
+import { OperationStatus } from '../../logic/operations/OperationStatus';
+import { MockOperationRunner } from '../../logic/operations/test/MockOperationRunner';
+
+describe(`${PhasedCommandEngine.name} telemetry`, () => {
+  let folder: string;
+  let rushConfiguration: RushConfiguration;
+  let operationA: Operation;
+  let operationB: Operation;
+
+  function write(name: string, value: unknown): void {
+    const filename: string = path.join(folder, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, JSON.stringify(value));
+  }
+
+  async function parseAsync(...argv: string[]): Promise<PhasedCommandEngine> {
+    return await PhasedCommandEngine.parseAsync({
+      argv,
+      cwd: folder,
+      rushConfiguration,
+      terminalProvider: new NoOpTerminalProvider()
+    });
+  }
+
+  function createRecord(
+    status: OperationStatus,
+    startTime: number | undefined,
+    endTime: number | undefined
+  ): IPhasedCommandEngineTelemetryRecord {
+    return { status, silent: false, stopwatch: { startTime, endTime }, nonCachedDurationMs: undefined };
+  }
+
+  function createOptions(
+    overrides: Partial<IPhasedCommandEngineTelemetryOptions> = {}
+  ): IPhasedCommandEngineTelemetryOptions {
+    return {
+      records: new Map([
+        [operationB, createRecord(OperationStatus.Skipped, 1500, 1500)],
+        [operationA, createRecord(OperationStatus.Success, 1600, 1900)]
+      ]),
+      succeeded: true,
+      durationInSeconds: 0.4,
+      timeOriginMs: 1000,
+      ...overrides
+    };
+  }
+
+  beforeAll(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-telemetry-')));
+    write('rush.json', {
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: [
+        { packageName: 'a', projectFolder: 'a' },
+        { packageName: 'b', projectFolder: 'b' }
+      ]
+    });
+    write('a/package.json', {
+      name: 'a',
+      version: '1.0.0',
+      dependencies: { b: 'workspace:*' },
+      scripts: { '_phase:compile': 'node -v' }
+    });
+    write('b/package.json', { name: 'b', version: '1.0.0', scripts: { '_phase:compile': 'node -v' } });
+    write('common/config/rush/command-line.json', {
+      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          summary: 'Build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        }
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'A graph-affecting custom parameter',
+          associatedCommands: ['build'],
+          associatedPhases: ['_phase:compile']
+        }
+      ]
+    });
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+    const phase: IPhase = { name: '_phase:compile' } as IPhase;
+    operationB = new Operation({
+      phase,
+      project: rushConfiguration.getProjectByName('b')!,
+      runner: new MockOperationRunner('b (compile)'),
+      logFilenameIdentifier: 'b_compile'
+    });
+    operationA = new Operation({
+      phase,
+      project: rushConfiguration.getProjectByName('a')!,
+      runner: new MockOperationRunner('a (compile)'),
+      logFilenameIdentifier: 'a_compile'
+    });
+    operationA.addDependency(operationB);
+  });
+
+  afterAll(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it("reports the request's own parameters as one initial, non-watch execution", async () => {
+    const first: PhasedCommandEngine = await parseAsync('build', '--to', 'a', '--production');
+    const second: PhasedCommandEngine = await parseAsync('build', '--only', 'b');
+    const firstData: ITelemetryData = first.createTelemetryData(createOptions());
+    const secondData: ITelemetryData = second.createTelemetryData(createOptions());
+
+    expect(firstData).toMatchObject({
+      name: 'build',
+      result: 'Succeeded',
+      durationInSeconds: 0.4,
+      extraData: {
+        isWatch: false,
+        isInitial: true,
+        command_to: 'true',
+        command_only: 'false',
+        '--to': 'a',
+        '--production': 'true',
+        '--changed-projects-only': false,
+        countAll: 2,
+        countSuccess: 1,
+        countSkipped: 1
+      }
+    });
+    expect(secondData.extraData).toMatchObject({
+      command_to: 'false',
+      command_only: 'true',
+      '--only': 'b',
+      '--production': 'false'
+    });
+  });
+
+  it('reports operation and performance entry times relative to the time origin', async () => {
+    const engine: PhasedCommandEngine = await parseAsync('build');
+    const data: ITelemetryData = engine.createTelemetryData(
+      createOptions({
+        records: new Map([
+          [operationB, createRecord(OperationStatus.Aborted, 1500, undefined)],
+          [operationA, createRecord(OperationStatus.Failure, 1600, 1900)]
+        ]),
+        succeeded: false,
+        performanceEntries: [
+          createMeasure('rush:daemon:queueWait', 1010, 5),
+          createMeasure('rush:executionManager:executeOperations', 1600, 300)
+        ]
+      })
+    );
+
+    expect(data.result).toBe('Failed');
+    expect(data.operationResults).toEqual({
+      'b (compile)': {
+        startTimestampMs: 500,
+        endTimestampMs: undefined,
+        nonCachedDurationMs: undefined,
+        wasExecutedOnThisMachine: true,
+        result: OperationStatus.Aborted,
+        dependencies: []
+      },
+      'a (compile)': {
+        startTimestampMs: 600,
+        endTimestampMs: 900,
+        nonCachedDurationMs: undefined,
+        wasExecutedOnThisMachine: true,
+        result: OperationStatus.Failure,
+        dependencies: ['b (compile)']
+      }
+    });
+    expect(JSON.parse(JSON.stringify(data.performanceEntries))).toEqual([
+      { name: 'rush:daemon:queueWait', entryType: 'measure', startTime: 10, duration: 5, detail: null },
+      {
+        name: 'rush:executionManager:executeOperations',
+        entryType: 'measure',
+        startTime: 600,
+        duration: 300,
+        detail: null
+      }
+    ]);
+  });
+
+  it('adds host fields after the native fields and never falls back to process-wide entries', async () => {
+    const engine: PhasedCommandEngine = await parseAsync('build');
+    const data: ITelemetryData = engine.createTelemetryData(
+      createOptions({ extraData: { daemon: true, requestIndex: 3, countAll: 99 } })
+    );
+
+    expect(data.extraData).toMatchObject({ daemon: true, requestIndex: 3, countAll: 99, countSuccess: 1 });
+    expect(data.performanceEntries).toEqual([]);
+  });
+});
+
+describe(waitForTelemetryFlushAsync.name, () => {
+  it('waits for taps that settle before the timeout', async () => {
+    let settled: boolean = false;
+    const flushPromise: Promise<void> = new Promise((resolve) => {
+      setTimeout(() => {
+        settled = true;
+        resolve();
+      }, 20);
+    });
+
+    await expect(waitForTelemetryFlushAsync(flushPromise, 60_000)).resolves.toBe(true);
+    expect(settled).toBe(true);
+  });
+
+  it('treats a failed tap as settled', async () => {
+    await expect(waitForTelemetryFlushAsync(Promise.reject(new Error('upload failed')), 60_000)).resolves.toBe(
+      true
+    );
+  });
+
+  it('stops waiting for taps that never settle, such as an upload over a stalled network', async () => {
+    const startMs: number = Date.now();
+
+    await expect(waitForTelemetryFlushAsync(new Promise(() => undefined), 50)).resolves.toBe(false);
+    expect(Date.now() - startMs).toBeGreaterThanOrEqual(45);
+  });
+});
+
+function createMeasure(name: string, startTime: number, duration: number): PerformanceEntry {
+  return {
+    name,
+    entryType: 'measure',
+    startTime,
+    duration,
+    detail: null,
+    toJSON: () => ({ name, entryType: 'measure', startTime, duration, detail: null })
+  } as PerformanceEntry;
+}
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index da402638e6..3d084b3973 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -43,6 +43,7 @@ import { Stopwatch } from '../../utilities/Stopwatch';
 import { BaseScriptAction, type IBaseScriptActionOptions } from './BaseScriptAction';
 import type { IOperationGraphOptions, IOperationGraphTelemetry } from '../../logic/operations/OperationGraph';
 import { OperationGraph } from '../../logic/operations/OperationGraph';
+import type { IPhasedCommandTelemetryFields } from '../../logic/operations/PhasedCommandTelemetry';
 import { RushConstants } from '../../logic/RushConstants';
 import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
 import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
@@ -481,6 +482,23 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     return selected;
   }
 
+  /** The command-scoped fields of this command's phased telemetry entries. */
+  public getTelemetryFields(): IPhasedCommandTelemetryFields {
+    const changedProjectsOnlyParameter: CommandLineFlagParameter | undefined =
+      this.#changedProjectsOnlyParameter;
+    return {
+      changedProjectsOnlyKey:
+        changedProjectsOnlyParameter?.scopedLongName ?? changedProjectsOnlyParameter?.longName,
+      changedProjectsOnly: !!changedProjectsOnlyParameter?.value,
+      initialExtraData: {
+        // Fields preserved across the command invocation
+        ...this.#selectionParameters.getTelemetry(),
+        ...this.getParameterStringMap()
+      },
+      nameForLog: this.actionName
+    };
+  }
+
   public async createEngineAsync(): Promise<IPhasedCommandEngine> {
     this.validateEngineCommand();
     await this.initializePluginsAsync();
@@ -813,17 +831,11 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
       let executionTelemetryHandler: IOperationGraphTelemetry | undefined;
       const { telemetry: parserTelemetry } = this.parser;
       if (parserTelemetry) {
-        const changedProjectsOnlyParameter: CommandLineFlagParameter | undefined =
-          this.#changedProjectsOnlyParameter;
+        const { changedProjectsOnlyKey, initialExtraData, nameForLog } = this.getTelemetryFields();
         executionTelemetryHandler = {
-          changedProjectsOnlyKey:
-            changedProjectsOnlyParameter?.scopedLongName ?? changedProjectsOnlyParameter?.longName,
-          initialExtraData: {
-            // Fields preserved across the command invocation
-            ...this.#selectionParameters.getTelemetry(),
-            ...this.getParameterStringMap()
-          },
-          nameForLog: this.actionName,
+          changedProjectsOnlyKey,
+          initialExtraData,
+          nameForLog,
           log: (logEntry: ITelemetryData) => {
             parserTelemetry.log(logEntry);
             parserTelemetry.flush();
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index b45248e94f..7abdab3c2b 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -179,6 +179,9 @@ export {
   PhasedCommandEngine,
   type IPhasedCommandEngine,
   type IPhasedCommandEngineRequestSettings,
+  type IPhasedCommandEngineLogTelemetryOptions,
+  type IPhasedCommandEngineTelemetryOptions,
+  type IPhasedCommandEngineTelemetryRecord,
   type IParsePhasedCommandOptions
 } from './api/PhasedCommandEngine';
 export { PhasedCommandEngineConfigurationChangedError } from './api/PhasedCommandEngineConfigurationChangedError';
diff --git a/libraries/rush-lib/src/logic/Telemetry.ts b/libraries/rush-lib/src/logic/Telemetry.ts
index 8c6ac3fab7..c8adc46bdc 100644
--- a/libraries/rush-lib/src/logic/Telemetry.ts
+++ b/libraries/rush-lib/src/logic/Telemetry.ts
@@ -163,6 +163,7 @@ export class Telemetry {
   #rushSession: RushSession;
   readonly #flushAsyncTasks: Set<Promise<void>> = new Set();
   #telemetryStartTime: number = 0;
+  #lastFileTimeMs: number = 0;
 
   public constructor(rushConfiguration: RushConfiguration, rushSession: RushSession) {
     this.#rushConfiguration = rushConfiguration;
@@ -296,8 +297,18 @@ export class Telemetry {
   }
 
   #getFilePath(): string {
-    let fileName: string = `telemetry_${new Date().toISOString()}`;
-    fileName = fileName.replace(/[\-\:\.]/g, '_') + '.json';
-    return path.join(this.#dataFolder, fileName);
+    // A long-lived host can flush several entries within one millisecond, so keep every file name distinct.
+    let timeMs: number = Math.max(Date.now(), this.#lastFileTimeMs + 1);
+    let fullPath: string = path.join(this.#dataFolder, getFileName(timeMs));
+    while (FileSystem.exists(fullPath)) {
+      timeMs++;
+      fullPath = path.join(this.#dataFolder, getFileName(timeMs));
+    }
+    this.#lastFileTimeMs = timeMs;
+    return fullPath;
   }
 }
+
+function getFileName(timeMs: number): string {
+  return `telemetry_${new Date(timeMs).toISOString()}`.replace(/[\-\:\.]/g, '_') + '.json';
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index b0408511bb..c78fcf862a 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -29,7 +29,8 @@ import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperat
 import { OperationGraphHooks } from '../../pluginFramework/OperationGraphHooks';
 import { type Parallelism, coerceParallelism, getNumberOfCores } from './ParseParallelism';
 import { measureAsyncFn, measureFn } from '../../utilities/performance';
-import type { ITelemetryData, ITelemetryOperationResult } from '../Telemetry';
+import type { ITelemetryData } from '../Telemetry';
+import { createPhasedTelemetryData } from './PhasedCommandTelemetry';
 
 export interface IOperationGraphTelemetry {
   initialExtraData: Record<string, unknown>;
@@ -117,25 +118,6 @@ class OperationRunnerCloseError extends Error {
   }
 }
 
-/**
- * Telemetry data for a phased execution
- */
-interface IPhasedExecutionTelemetry {
-  [key: string]: string | number | boolean;
-  isInitial: boolean;
-  isWatch: boolean;
-
-  countAll: number;
-  countSuccess: number;
-  countSuccessWithWarnings: number;
-  countFailure: number;
-  countBlocked: number;
-  countFromCache: number;
-  countSkipped: number;
-  countNoOp: number;
-  countAborted: number;
-}
-
 const PERF_PREFIX: 'rush:executionManager' = 'rush:executionManager';
 
 /**
@@ -1115,28 +1097,6 @@ export class OperationGraph implements IOperationGraph {
     const telemetry: IOperationGraphTelemetry | undefined = this.#telemetry;
     if (telemetry) {
       const logEntry: ITelemetryData = measureFn(`${PERF_PREFIX}:prepareTelemetry`, () => {
-        const isWatch: boolean = this.#isWatch;
-        const jsonOperationResults: Record<string, ITelemetryOperationResult> = {};
-
-        const durationInSeconds: number = (performance.now() - (iterationContext.startTime ?? 0)) / 1000;
-
-        const extraData: IPhasedExecutionTelemetry = {
-          ...telemetry.initialExtraData,
-          isWatch,
-          // Fields specific to the current operation set
-          isInitial,
-
-          countAll: 0,
-          countSuccess: 0,
-          countSuccessWithWarnings: 0,
-          countFailure: 0,
-          countBlocked: 0,
-          countFromCache: 0,
-          countSkipped: 0,
-          countNoOp: 0,
-          countAborted: 0
-        };
-
         let changedProjectsOnly: boolean = false;
         for (const operation of executionRecords.keys()) {
           if (operation.enabled === 'ignore-dependency-changes') {
@@ -1145,90 +1105,17 @@ export class OperationGraph implements IOperationGraph {
           }
         }
 
-        if (telemetry.changedProjectsOnlyKey) {
-          // Overwrite this value since we allow changing it at runtime.
-          extraData[telemetry.changedProjectsOnlyKey] = changedProjectsOnly;
-        }
-
-        const nonSilentDependenciesByOperation: Map<Operation, Set<string>> = new Map();
-        function getNonSilentDependencies(operation: Operation): ReadonlySet<string> {
-          let realDependencies: Set<string> | undefined = nonSilentDependenciesByOperation.get(operation);
-          if (!realDependencies) {
-            realDependencies = new Set();
-            nonSilentDependenciesByOperation.set(operation, realDependencies);
-            for (const dependency of operation.dependencies) {
-              const dependencyRecord: OperationExecutionRecord | undefined = executionRecords.get(dependency);
-              if (dependencyRecord?.silent) {
-                for (const deepDependency of getNonSilentDependencies(dependency)) {
-                  realDependencies.add(deepDependency);
-                }
-              } else {
-                realDependencies.add(dependency.name!);
-              }
-            }
-          }
-          return realDependencies;
-        }
-
-        for (const [operation, operationResult] of executionRecords) {
-          if (operationResult.silent) {
-            // Architectural operation. Ignore.
-            continue;
-          }
-
-          const { _operationMetadataManager: operationMetadataManager } = operationResult;
-
-          const { startTime, endTime } = operationResult.stopwatch;
-          jsonOperationResults[operation.name!] = {
-            startTimestampMs: startTime,
-            endTimestampMs: endTime,
-            nonCachedDurationMs: operationResult.nonCachedDurationMs,
-            wasExecutedOnThisMachine: operationMetadataManager?.wasCobuilt !== true,
-            result: operationResult.status,
-            dependencies: Array.from(getNonSilentDependencies(operation)).sort()
-          };
-
-          extraData.countAll++;
-          switch (operationResult.status) {
-            case OperationStatus.Success:
-              extraData.countSuccess++;
-              break;
-            case OperationStatus.SuccessWithWarning:
-              extraData.countSuccessWithWarnings++;
-              break;
-            case OperationStatus.Failure:
-              extraData.countFailure++;
-              break;
-            case OperationStatus.Blocked:
-              extraData.countBlocked++;
-              break;
-            case OperationStatus.FromCache:
-              extraData.countFromCache++;
-              break;
-            case OperationStatus.Skipped:
-              extraData.countSkipped++;
-              break;
-            case OperationStatus.NoOp:
-              extraData.countNoOp++;
-              break;
-            case OperationStatus.Aborted:
-              extraData.countAborted++;
-              break;
-            default:
-              // Do nothing.
-              break;
-          }
-        }
-
-        const innerLogEntry: ITelemetryData = {
-          name: telemetry.nameForLog,
-          durationInSeconds,
-          result: status === OperationStatus.Success ? 'Succeeded' : 'Failed',
-          extraData,
-          operationResults: jsonOperationResults
-        };
-
-        return innerLogEntry;
+        return createPhasedTelemetryData({
+          nameForLog: telemetry.nameForLog,
+          initialExtraData: telemetry.initialExtraData,
+          changedProjectsOnlyKey: telemetry.changedProjectsOnlyKey,
+          changedProjectsOnly,
+          isWatch: this.#isWatch,
+          isInitial,
+          durationInSeconds: (performance.now() - (iterationContext.startTime ?? 0)) / 1000,
+          succeeded: status === OperationStatus.Success,
+          records: executionRecords
+        });
       });
 
       measureFn(`${PERF_PREFIX}:beforeLog`, () => this.hooks.beforeLog.call(logEntry));
diff --git a/libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts b/libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts
new file mode 100644
index 0000000000..d3f0e5d24d
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/PhasedCommandTelemetry.ts
@@ -0,0 +1,168 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ITelemetryData, ITelemetryOperationResult } from '../Telemetry';
+import type { IStopwatchResult } from '../../utilities/Stopwatch';
+import type { Operation } from './Operation';
+import { OperationStatus } from './OperationStatus';
+
+/**
+ * Telemetry data for a phased execution
+ */
+export interface IPhasedExecutionTelemetry {
+  [key: string]: string | number | boolean;
+  isInitial: boolean;
+  isWatch: boolean;
+
+  countAll: number;
+  countSuccess: number;
+  countSuccessWithWarnings: number;
+  countFailure: number;
+  countBlocked: number;
+  countFromCache: number;
+  countSkipped: number;
+  countNoOp: number;
+  countAborted: number;
+}
+
+/**
+ * The fields of an operation's execution record that phased command telemetry reports.
+ */
+export interface IPhasedTelemetryOperationRecord {
+  readonly status: OperationStatus;
+  readonly silent: boolean;
+  readonly stopwatch: Pick<IStopwatchResult, 'startTime' | 'endTime'>;
+  readonly nonCachedDurationMs: number | undefined;
+  readonly _operationMetadataManager?: { readonly wasCobuilt: boolean } | undefined;
+}
+
+/**
+ * The command-scoped fields of a phased command's telemetry entries.
+ */
+export interface IPhasedCommandTelemetryFields {
+  readonly nameForLog: string;
+  readonly initialExtraData: Record<string, unknown>;
+  readonly changedProjectsOnlyKey: string | undefined;
+  readonly changedProjectsOnly: boolean;
+}
+
+export interface ICreatePhasedTelemetryDataOptions extends IPhasedCommandTelemetryFields {
+  readonly isWatch: boolean;
+  readonly isInitial: boolean;
+  readonly durationInSeconds: number;
+  readonly succeeded: boolean;
+  readonly records: ReadonlyMap<Operation, IPhasedTelemetryOperationRecord>;
+  /**
+   * A `performance.now()` value subtracted from every operation timestamp. Long-lived hosts use it to report
+   * timestamps relative to the request, as a native process reports them relative to its own start.
+   */
+  readonly timeOriginMs?: number;
+}
+
+/**
+ * Builds the telemetry entry that a phased command logs for one set of operation results.
+ */
+export function createPhasedTelemetryData(options: ICreatePhasedTelemetryDataOptions): ITelemetryData {
+  const { records, timeOriginMs = 0 } = options;
+  const jsonOperationResults: Record<string, ITelemetryOperationResult> = {};
+
+  const extraData: IPhasedExecutionTelemetry = {
+    ...options.initialExtraData,
+    isWatch: options.isWatch,
+    // Fields specific to the current operation set
+    isInitial: options.isInitial,
+
+    countAll: 0,
+    countSuccess: 0,
+    countSuccessWithWarnings: 0,
+    countFailure: 0,
+    countBlocked: 0,
+    countFromCache: 0,
+    countSkipped: 0,
+    countNoOp: 0,
+    countAborted: 0
+  };
+
+  if (options.changedProjectsOnlyKey) {
+    // Overwrite this value since we allow changing it at runtime.
+    extraData[options.changedProjectsOnlyKey] = options.changedProjectsOnly;
+  }
+
+  const nonSilentDependenciesByOperation: Map<Operation, Set<string>> = new Map();
+  function getNonSilentDependencies(operation: Operation): ReadonlySet<string> {
+    let realDependencies: Set<string> | undefined = nonSilentDependenciesByOperation.get(operation);
+    if (!realDependencies) {
+      realDependencies = new Set();
+      nonSilentDependenciesByOperation.set(operation, realDependencies);
+      for (const dependency of operation.dependencies) {
+        const dependencyRecord: IPhasedTelemetryOperationRecord | undefined = records.get(dependency);
+        if (dependencyRecord?.silent) {
+          for (const deepDependency of getNonSilentDependencies(dependency)) {
+            realDependencies.add(deepDependency);
+          }
+        } else {
+          realDependencies.add(dependency.name!);
+        }
+      }
+    }
+    return realDependencies;
+  }
+
+  for (const [operation, operationResult] of records) {
+    if (operationResult.silent) {
+      // Architectural operation. Ignore.
+      continue;
+    }
+
+    const { _operationMetadataManager: operationMetadataManager } = operationResult;
+
+    const { startTime, endTime } = operationResult.stopwatch;
+    jsonOperationResults[operation.name!] = {
+      startTimestampMs: startTime === undefined ? undefined : startTime - timeOriginMs,
+      endTimestampMs: endTime === undefined ? undefined : endTime - timeOriginMs,
+      nonCachedDurationMs: operationResult.nonCachedDurationMs,
+      wasExecutedOnThisMachine: operationMetadataManager?.wasCobuilt !== true,
+      result: operationResult.status,
+      dependencies: Array.from(getNonSilentDependencies(operation)).sort()
+    };
+
+    extraData.countAll++;
+    switch (operationResult.status) {
+      case OperationStatus.Success:
+        extraData.countSuccess++;
+        break;
+      case OperationStatus.SuccessWithWarning:
+        extraData.countSuccessWithWarnings++;
+        break;
+      case OperationStatus.Failure:
+        extraData.countFailure++;
+        break;
+      case OperationStatus.Blocked:
+        extraData.countBlocked++;
+        break;
+      case OperationStatus.FromCache:
+        extraData.countFromCache++;
+        break;
+      case OperationStatus.Skipped:
+        extraData.countSkipped++;
+        break;
+      case OperationStatus.NoOp:
+        extraData.countNoOp++;
+        break;
+      case OperationStatus.Aborted:
+        extraData.countAborted++;
+        break;
+      default:
+        // Do nothing.
+        break;
+    }
+  }
+
+  return {
+    name: options.nameForLog,
+    durationInSeconds: options.durationInSeconds,
+    result: options.succeeded ? 'Succeeded' : 'Failed',
+    extraData,
+    operationResults: jsonOperationResults
+  };
+}
diff --git a/libraries/rush-lib/src/logic/test/Telemetry.test.ts b/libraries/rush-lib/src/logic/test/Telemetry.test.ts
index 977d3b9d3c..92d53f927b 100644
--- a/libraries/rush-lib/src/logic/test/Telemetry.test.ts
+++ b/libraries/rush-lib/src/logic/test/Telemetry.test.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { JsonFile } from '@rushstack/node-core-library';
+import * as path from 'node:path';
+
+import { FileSystem, JsonFile } from '@rushstack/node-core-library';
 import type { IReporterEmitEventInput, IReporterEventSink } from '@rushstack/rush-reporter';
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
@@ -131,6 +133,49 @@ describe(Telemetry.name, () => {
     expect(telemetry.store).toEqual([]);
   });
 
+  it('gives entries flushed within one millisecond distinct file names', () => {
+    const filename: string = `${__dirname}/telemetry/telemetryEnabled.json`;
+    const rushConfig: RushConfiguration = RushConfiguration.loadFromConfigurationFile(filename);
+    const rushSession: RushSession = new RushSession({
+      terminalProvider: new ConsoleTerminalProvider(),
+      getIsDebugMode: () => false
+    });
+    const telemetry: Telemetry = new Telemetry(rushConfig, rushSession);
+    const nowMs: number = Date.UTC(2026, 8, 28, 13, 0, 0, 5);
+    const dateNowSpy: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(nowMs);
+    const existingPaths: Set<string> = new Set();
+    const existsSpy: jest.SpyInstance = jest
+      .spyOn(FileSystem, 'exists')
+      .mockImplementation((filePath: string) => existingPaths.has(path.basename(filePath)));
+    existingPaths.add('telemetry_2026_09_28T13_00_00_007Z.json');
+    const logData: ITelemetryData = {
+      name: 'testData1',
+      durationInSeconds: 1,
+      result: 'Succeeded',
+      timestampMs: nowMs,
+      platform: process.platform,
+      rushVersion: Rush.version,
+      machineInfo: {} as ITelemetryMachineInfo,
+      performanceEntries: []
+    };
+
+    try {
+      for (let i: number = 0; i < 3; i++) {
+        telemetry.log(logData);
+        telemetry.flush();
+      }
+    } finally {
+      dateNowSpy.mockRestore();
+      existsSpy.mockRestore();
+    }
+
+    expect(mockedJsonFileSave.mock.calls.map((call) => path.basename(call[1]))).toEqual([
+      'telemetry_2026_09_28T13_00_00_005Z.json',
+      'telemetry_2026_09_28T13_00_00_006Z.json',
+      'telemetry_2026_09_28T13_00_00_008Z.json'
+    ]);
+  });
+
   it('populates default fields', () => {
     const filename: string = `${__dirname}/telemetry/telemetryEnabled.json`;
     const rushConfig: RushConfiguration = RushConfiguration.loadFromConfigurationFile(filename);

From c97c702aa8492652d7f7615361a20cf043631237 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:51:44 +0000
Subject: [PATCH 051/265] [rush-daemon] A stuck request no longer keeps a
 stopped daemon alive

Swarm integration step 36; original commit 372742afe7 (merge of swarm/r01-t147-int at a40a901822).
Scope: tasks 115 and 147.

Brings r01's task 115 (`daemon stop` and the first SIGTERM never ended a daemon whose request was stuck in an await that ignores cancellation) and task 147 (after a clean stop, a ref'd timer or handle kept the process alive after it released its socket and pid.json; t05 board 2199, o04 board 2269), re-tipped onto integration (board 2779, board 2793). The daemon now shuts down within a 10 s deadline, returns a typed result to the running request and releases its socket, lockfile and repository lock. CONFIRMED: 115 by ch05 board 2247 and o04 board 2266; 147 by t05 board 2608 and o04 board 2632.

s16 batch A, item 1 of 5. ch01 on the batch (board 2867): build rc 0 with 0 warnings; rush-daemon 628/0, rush-lib 1252/0, rush-cli-client 398/0 on items 1-4; 45 of 48 mutants killed; in the e2e the daemon is gone 10.46 s after `daemon stop`, where s15's tree lingers 39.15 s.

Gate: ch01 GATE OK board 2867 (tree 24fc1e6446)

Commits folded into this step (2):
- fe430fe236 rushd: a shutdown stuck on an await that ignores cancellation no longer hangs the daemon process (task 115)
- 444107370d rushd: a daemon process that something else keeps running exits 2 s after the daemon stops (task 147)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...01-shutdown-deadline_2026-09-28-21-50.json |  11 +
 .../r01-exit-after-stop_2026-09-28-23-45.json |  11 +
 ...01-shutdown-deadline_2026-09-28-21-50.json |  11 +
 .../reviews/api/rush-daemon-transport.api.md  |   1 +
 common/reviews/api/rush-daemon.api.md         |  23 ++
 .../src/DaemonExitRelease.ts                  |  28 +++
 .../src/DaemonListener.ts                     |   6 +
 .../src/DaemonListenerLifetime.ts             |  29 ++-
 .../src/test/ExitReleaseGroup.test.ts         |  43 ++++
 .../src/test/ListenerExitRelease.test.ts      |  90 ++++++++
 .../rush-daemon/src/DaemonControlSession.ts   |  75 ++++++-
 .../rush-daemon/src/DaemonShutdownDeadline.ts |  76 +++++++
 .../src/DaemonShutdownDeadlineError.ts        |  90 ++++++++
 .../rush-daemon/src/DaemonShutdownSignals.ts  |  58 +++++
 libraries/rush-daemon/src/RushDaemonHost.ts   |  81 ++++++-
 libraries/rush-daemon/src/index.ts            |   5 +
 libraries/rush-daemon/src/serveRushDaemon.ts  | 152 +++++++++++--
 .../src/test/DaemonProcessExit.test.ts        | 178 +++++++++++++++
 .../src/test/DaemonShutdownDeadline.test.ts   | 204 ++++++++++++++++++
 .../src/test/DaemonShutdownProcess.test.ts    | 186 ++++++++++++++++
 .../src/test/DaemonShutdownSignals.test.ts    |  64 ++++++
 .../src/test/TemporaryRepoWorkspaceSession.ts |  31 +++
 .../src/test/fixtures/LingeringDaemon.ts      |  70 ++++++
 .../src/test/fixtures/StuckShutdownDaemon.ts  |  74 +++++++
 24 files changed, 1565 insertions(+), 32 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r01-shutdown-deadline_2026-09-28-21-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r01-shutdown-deadline_2026-09-28-21-50.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonExitRelease.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts
 create mode 100644 libraries/rush-daemon/src/DaemonShutdownDeadline.ts
 create mode 100644 libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
 create mode 100644 libraries/rush-daemon/src/DaemonShutdownSignals.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts
 create mode 100644 libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts
 create mode 100644 libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
 create mode 100644 libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/r01-shutdown-deadline_2026-09-28-21-50.json b/common/changes/@rushstack/rush-daemon-transport/r01-shutdown-deadline_2026-09-28-21-50.json
new file mode 100644
index 0000000000..10c2417fcd
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r01-shutdown-deadline_2026-09-28-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add `DaemonFrameListener.releaseForExit()`, which removes the listener's own socket and lockfile for a daemon process that exits before its shutdown finished, unless the daemon still has child processes that a successor must reap.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json b/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json
new file mode 100644
index 0000000000..9596f945ac
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A daemon that owns its process now exits 2 seconds after it stops if something else, such as a timer that a plugin left behind, keeps the process running after the daemon released its socket and lockfile. It reports the active resources that Node.js lists and keeps `process.exitCode`. Reports that come right before the daemon exits are now written synchronously when no `onError` callback is given.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r01-shutdown-deadline_2026-09-28-21-50.json b/common/changes/@rushstack/rush-daemon/r01-shutdown-deadline_2026-09-28-21-50.json
new file mode 100644
index 0000000000..cdd4ec6047
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r01-shutdown-deadline_2026-09-28-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A daemon that owns its process no longer hangs in `daemon stop` or on SIGTERM when a request ignores cancellation, for example while it waits for a lock that another process holds. Each request that is still running after the 5 second drain gets a typed result that names the shutdown's reason. After 10 seconds (`shutdownDeadlineMs`), or on a second SIGINT or SIGTERM, the daemon reports a `DaemonShutdownDeadlineError` naming the stage and the unfinished requests, releases its socket, lockfile and repository lock when no child process is left to reap, and exits with code 1.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index fa87bdd96d..ad9b1e2f86 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -37,6 +37,7 @@ export class DaemonFrameConnection {
 export class DaemonFrameListener {
     closeAsync(): Promise<void>;
     static listenAsync(paths: IDaemonPaths, options: IDaemonListenerOptions): Promise<DaemonFrameListener>;
+    releaseForExit(): boolean;
     stopAcceptingAsync(): Promise<void>;
 }
 
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index e9fa05e2cf..f9003bbbdf 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -77,6 +77,15 @@ export class DaemonRequiresInProcessError extends Error {
     readonly policy: IDaemonTerminalPolicyResult;
 }
 
+// @beta
+export class DaemonShutdownDeadlineError extends Error {
+    constructor(options: IDaemonShutdownDeadlineErrorOptions);
+    readonly elapsedMs: number;
+    readonly forcedBy: string | undefined;
+    readonly stage: DaemonShutdownStage;
+    readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
 // @beta
 export class DaemonShutdownError extends Error {
     constructor(options: IDaemonShutdownErrorOptions);
@@ -89,6 +98,9 @@ export class DaemonShutdownError extends Error {
 // @beta
 export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
 
+// @beta
+export type DaemonShutdownStage = 'requests' | 'workspaceMaintenance' | 'requestDispatcher' | 'workspaceSession' | 'listener';
+
 // @beta
 export type DispatchWorkspaceRequestAsync = (options: IDispatchWorkspaceRequestOptions) => Promise<IDaemonCommandResult | undefined>;
 
@@ -207,6 +219,14 @@ export interface IDaemonRequestResolver {
     readonly workspaceLifecycle?: IWorkspaceResolverLifecycle;
 }
 
+// @beta
+export interface IDaemonShutdownDeadlineErrorOptions {
+    readonly elapsedMs: number;
+    readonly forcedBy?: string;
+    readonly stage: DaemonShutdownStage;
+    readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
 // @beta
 export interface IDaemonShutdownErrorOptions {
     // (undocumented)
@@ -522,6 +542,7 @@ export interface IRushDaemonHostOptions {
     readonly repoRoot: string;
     readonly requestResolver?: IDaemonRequestResolver;
     readonly rushVersion: string;
+    readonly shutdownDeadlineMs?: number;
     readonly startupOptions?: Readonly<Record<string, unknown>>;
 }
 
@@ -802,9 +823,11 @@ export type ResolvedDaemonRequest = IResolvedDaemonPhasedRequest | IResolvedDaem
 export class RushDaemonHost {
     closeAsync(reason?: DaemonShutdownError): Promise<void>;
     readonly closed: Promise<void>;
+    expireShutdownDeadline(forcedBy: string): void;
     getWorkspaceSessionAsync(): Promise<IWorkspaceSession>;
     // (undocumented)
     readonly paths: IDaemonPaths;
+    releaseForExit(): boolean;
     readonly restartCompleted: Promise<IWorkspaceProcessRestartResult | undefined>;
     static startAsync(options: IRushDaemonHostOptions): Promise<RushDaemonHost>;
     get workspaceGeneration(): number;
diff --git a/libraries/rush-daemon-transport/src/DaemonExitRelease.ts b/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
new file mode 100644
index 0000000000..5250fea764
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
@@ -0,0 +1,28 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsFolder, readOperationGroupRecords } from './DaemonOperationGroups';
+import type { IDaemonPaths } from './DaemonPaths';
+import { listLiveGroupMembers } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+
+const NO_RECORDS: number = 0;
+
+function isOtherProcess(stat: IProcessStat): boolean {
+  return stat.pid !== process.pid;
+}
+
+/**
+ * Whether this daemon process has children that a successor must reap if it exits without joining them: a
+ * recorded operation group that still runs, or another live member of the daemon's own process group.
+ *
+ * @remarks
+ * Linux only, like the records it reads. Elsewhere it finds none.
+ */
+export function hasProcessesToReap(paths: IDaemonPaths): boolean {
+  const folder: string = getOperationGroupsFolder(paths.lockfilePath, process.pid);
+  return (
+    readOperationGroupRecords(folder).length > NO_RECORDS ||
+    listLiveGroupMembers(process.pid).some(isOtherProcess)
+  );
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonListener.ts b/libraries/rush-daemon-transport/src/DaemonListener.ts
index 6a8e18b76c..f131fafae8 100644
--- a/libraries/rush-daemon-transport/src/DaemonListener.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListener.ts
@@ -73,6 +73,12 @@ export class DaemonFrameListener {
   public stopAcceptingAsync(): Promise<void> {
     return this.#lifetime.stopAcceptingAsync();
   }
+  /** For a daemon process that exits before its shutdown finished: releases the socket/pipe and lockfile,
+   * unless the daemon still has children that a successor must reap. Then both stay, as after a crash.
+   * @returns Whether they were released. */
+  public releaseForExit(): boolean {
+    return this.#lifetime.releaseForExit();
+  }
 }
 
 function writeListenerLockfile(paths: IDaemonPaths, options: IDaemonListenerOptions): IDaemonFileIdentity {
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
index a7a81b2493..f3604f6f04 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
@@ -3,6 +3,7 @@
 
 import type * as net from 'node:net';
 
+import { hasProcessesToReap } from './DaemonExitRelease';
 import { removeOwnFile } from './DaemonFileIdentity';
 import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import type { StopOperationGroupRecording } from './DaemonOperationGroupRecorder';
@@ -25,6 +26,9 @@ export class DaemonListenerLifetime {
   readonly #stopRecording: StopOperationGroupRecording;
   #closePromise: Promise<void> | undefined;
   #stopPromise: Promise<void> | undefined;
+  // `removeOwnFile` releases the pinned identity, so each file is released once.
+  #socketReleased: boolean = false;
+  #lockfileReleased: boolean = false;
 
   public constructor(
     server: net.Server,
@@ -48,15 +52,38 @@ export class DaemonListenerLifetime {
     return this.#closePromise;
   }
 
+  /**
+   * Releases the socket and the lockfile for a process that exits without closing the listener, unless it has
+   * children that a successor must reap first. Then both stay, as after a crash. Returns whether it released them.
+   */
+  public releaseForExit(): boolean {
+    if (hasProcessesToReap(this.#paths)) return false;
+    this.#releaseSocket();
+    this.#releaseLockfile();
+    return true;
+  }
+
   #stopOnceAsync(): Promise<void> {
     // Unlink before closing, as libuv does for the path it bound, but only this listener's own socket: the
     // name may belong to a successor by now.
-    removeOwnFile(this.#paths.socketPath, this.#files.socket);
+    this.#releaseSocket();
     return new Promise<void>((resolve: () => void) => this.#server.close(() => resolve()));
   }
 
   async #closeOnceAsync(): Promise<void> {
     await this.stopAcceptingAsync();
+    this.#releaseLockfile();
+  }
+
+  #releaseSocket(): void {
+    if (this.#socketReleased) return;
+    this.#socketReleased = true;
+    removeOwnFile(this.#paths.socketPath, this.#files.socket);
+  }
+
+  #releaseLockfile(): void {
+    if (this.#lockfileReleased) return;
+    this.#lockfileReleased = true;
     this.#stopRecording();
     removeOwnFile(this.#paths.lockfilePath, this.#files.lockfile);
   }
diff --git a/libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts b/libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts
new file mode 100644
index 0000000000..a7061d1861
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ExitReleaseGroup.test.ts
@@ -0,0 +1,43 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A detached process leads its own group, as a daemon that rush-client started does. It checks for children to
+// reap before, while and after a child that it spawned into its own group runs.
+const GROUP_LEADER_OPTIONS: SpawnOptions = { detached: true, stdio: ['ignore', 'pipe', 'ignore'] };
+const GROUP_LEADER_SCRIPT: string = `
+const { hasProcessesToReap } = require(process.argv[1]);
+const paths = { lockfilePath: process.argv[2] };
+const before = hasProcessesToReap(paths);
+const child = require('node:child_process').spawn('sleep', ['30'], { stdio: 'ignore' });
+child.once('spawn', () => {
+  const during = hasProcessesToReap(paths);
+  child.once('exit', () => process.stdout.write(JSON.stringify([before, during, hasProcessesToReap(paths)])));
+  child.kill('SIGKILL');
+});`;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+linuxIt('finds a child that runs in the daemon process group', async () => {
+  const modulePath: string = path.join(__dirname, '..', 'DaemonExitRelease.js');
+  const args: string[] = ['-e', GROUP_LEADER_SCRIPT, modulePath, createTestDaemonPaths().lockfilePath];
+  const leader: ChildProcess = spawn(process.execPath, args, GROUP_LEADER_OPTIONS);
+  await once(leader, 'spawn');
+  started = identifyStarted([Number(leader.pid)]);
+  const [chunk] = (await once(leader.stdout as Readable, 'data')) as [Buffer];
+  expect(JSON.parse(chunk.toString())).toEqual([false, true, false]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts b/libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts
new file mode 100644
index 0000000000..7a2a5f3f7c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerExitRelease.test.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import { readDaemonLockfile } from '../DaemonLockfile';
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { identifyStarted, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+// SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX, which gives the operation a group of its own.
+const DETACHED: SpawnOptions = { detached: true, stdio: 'ignore' };
+const NO_RECORDS: number = 0;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+function listenAsync(paths: IDaemonPaths): Promise<DaemonFrameListener> {
+  return DaemonFrameListener.listenAsync(paths, {
+    onConnection: () => undefined,
+    protocolVersion: DAEMON_PROTOCOL_VERSION
+  });
+}
+
+function countRecords(paths: IDaemonPaths): number {
+  return readOperationGroupRecords(getOperationGroupsFolder(paths.lockfilePath, process.pid)).length;
+}
+
+it('releases the lockfile for exit when the daemon has no children', async () => {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const listener: DaemonFrameListener = await listenAsync(paths);
+  try {
+    expect(listener.releaseForExit()).toBe(true);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  } finally {
+    await listener.closeAsync();
+  }
+});
+
+posixIt('releases the socket for exit, and a later close leaves a successor alone', async () => {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const released: DaemonFrameListener = await listenAsync(paths);
+  expect(released.releaseForExit()).toBe(true);
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+  const successor: DaemonFrameListener = await listenAsync(paths);
+  try {
+    await released.closeAsync();
+    expect(readDaemonLockfile(paths.lockfilePath)?.pid).toBe(process.pid);
+    expect(fs.existsSync(paths.socketPath)).toBe(true);
+  } finally {
+    await successor.closeAsync();
+  }
+  expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+});
+
+linuxIt('keeps the socket and the lockfile for a successor while a recorded operation runs', async () => {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const listener: DaemonFrameListener = await listenAsync(paths);
+  try {
+    const operation: ChildProcess = spawn(process.execPath, SLEEP_ARGS, DETACHED);
+    await once(operation, 'spawn');
+    started = identifyStarted([Number(operation.pid)]);
+    expect(await waitUntilAsync(() => countRecords(paths) > NO_RECORDS)).toBe(true);
+    expect(listener.releaseForExit()).toBe(false);
+    expect(readDaemonLockfile(paths.lockfilePath)?.pid).toBe(process.pid);
+    expect(fs.existsSync(paths.socketPath)).toBe(true);
+    operation.kill('SIGKILL');
+    expect(await waitUntilAsync(() => countRecords(paths) === NO_RECORDS)).toBe(true);
+    expect(listener.releaseForExit()).toBe(true);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  } finally {
+    await listener.closeAsync();
+  }
+});
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index d38cb8ffe3..a6995237c1 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -28,12 +28,13 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import type { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
+import { createGlobalCommandResult } from './CommandResultPolicy';
 import { DaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
 import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
 import type { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
-import type { DaemonShutdownError } from './DaemonShutdownError';
+import { DaemonShutdownError } from './DaemonShutdownError';
 import { DaemonWireRequestClient } from './DaemonWireRequestClient';
 import {
   InteractiveInputRoutingError,
@@ -64,6 +65,9 @@ interface IRequestState {
   readonly abortController: AbortController;
   readonly client: DaemonWireRequestClient;
   completion: Promise<void>;
+  /** The quoted command line, for reports about requests that did not finish. */
+  readonly description: string;
+  readonly startedAtMs: number;
 }
 
 interface IClassifiedRejection {
@@ -72,6 +76,11 @@ interface IClassifiedRejection {
 }
 
 const CLOSE_DRAIN_TIMEOUT_MS: number = 5000;
+// How long the typed results for requests that did not stop get to reach their clients before the connection is
+// aborted.
+const SHUTDOWN_RESULT_SEND_TIMEOUT_MS: number = 1000;
+const MAX_REQUEST_DESCRIPTION_LENGTH: number = 100;
+const MS_PER_SECOND: number = 1000;
 
 export class DaemonControlSession {
   readonly #connection: DaemonFrameConnection;
@@ -127,6 +136,15 @@ export class DaemonControlSession {
     return this.#requestById.size;
   }
 
+  /** Describes each request that has not finished, such as `"build -t a" (running for 12.3 s)`. */
+  public describeActiveRequests(): string[] {
+    const nowMs: number = Date.now();
+    return Array.from(this.#requestById.values(), (state: IRequestState) => {
+      const runningSeconds: string = ((nowMs - state.startedAtMs) / MS_PER_SECOND).toFixed(1);
+      return `${state.description} (running for ${runningSeconds} s)`;
+    });
+  }
+
   async #handleFrameSafelyAsync(frame: IDaemonFrame): Promise<void> {
     try {
       await this.#onFrameAsync(frame);
@@ -316,7 +334,13 @@ export class DaemonControlSession {
       sessionId,
       supportsRequestAdmission: this.#peerSupportsRequestAdmission
     });
-    const state: IRequestState = { abortController, client, completion: Promise.resolve() };
+    const state: IRequestState = {
+      abortController,
+      client,
+      completion: Promise.resolve(),
+      description: describeRequest(envelope),
+      startedAtMs: Date.now()
+    };
     this.#requestById.set(requestId, state);
     const releaseActivity: (() => void) | undefined = this.#options.onRequestStarted?.();
     state.completion = Promise.resolve()
@@ -491,7 +515,7 @@ export class DaemonControlSession {
           CLOSE_DRAIN_TIMEOUT_MS
         ))
       ) {
-        this.#connection.abort(closeReason);
+        await this.#abortConnectionAsync(closeReason);
       }
       await pending;
     }
@@ -501,13 +525,34 @@ export class DaemonControlSession {
       this.#sendQueue
     ]).then(() => undefined);
     if (!(await settlesWithinAsync(drainPromise, CLOSE_DRAIN_TIMEOUT_MS))) {
-      this.#connection.abort(closeReason);
+      await this.#abortConnectionAsync(closeReason);
     }
     await drainPromise;
     if (!this.#connectionClosed) await this.#connection.closeAsync();
     await this.#closedPromise;
   }
 
+  /**
+   * Aborts a connection whose requests did not finish in time. When the daemon is shutting down, each request that
+   * has no terminal outcome yet first gets a typed result that carries the shutdown's reason, so that its client
+   * reports that instead of a lost connection. The request's own late result is then refused.
+   */
+  async #abortConnectionAsync(reason: Error): Promise<void> {
+    if (reason instanceof DaemonShutdownError && !this.#connectionClosed) {
+      const writes: Promise<void>[] = [];
+      for (const [requestId, state] of this.#requestById) {
+        if (!state.client.terminalOutcomeSent) {
+          writes.push(writeShutdownResultAsync(requestId, state, reason));
+        }
+      }
+      await settlesWithinAsync(
+        Promise.allSettled(writes).then(() => undefined),
+        SHUTDOWN_RESULT_SEND_TIMEOUT_MS
+      );
+    }
+    this.#connection.abort(reason);
+  }
+
   async #handleConnectionClosedAsync(error: Error | undefined): Promise<void> {
     if (this.#connectionClosed) return;
     this.#connectionClosed = true;
@@ -534,6 +579,28 @@ function createDeferred(): { promise: Promise<void>; resolve: () => void } {
   return { promise, resolve: resolvePromise };
 }
 
+function describeRequest(envelope: IDaemonRequestEnvelope): string {
+  const command: string = envelope.argv.length > 0 ? envelope.argv.join(' ') : envelope.commandName;
+  return command.length > MAX_REQUEST_DESCRIPTION_LENGTH
+    ? `"${command.slice(0, MAX_REQUEST_DESCRIPTION_LENGTH - 1)}…"`
+    : `"${command}"`;
+}
+
+function writeShutdownResultAsync(
+  requestId: string,
+  state: IRequestState,
+  reason: DaemonShutdownError
+): Promise<void> {
+  try {
+    // The result that a router writes for a request that the shutdown aborted.
+    return state.client.writeResultAsync(
+      createGlobalCommandResult({ aborted: true, error: reason, exitCode: undefined, requestId })
+    );
+  } catch (error) {
+    return Promise.reject(error);
+  }
+}
+
 function normalizeProtocolError(error: unknown): DaemonProtocolError {
   if (error instanceof DaemonProtocolError) return error;
   return new DaemonProtocolError('malformedControlMessage', normalizeError(error).message, {
diff --git a/libraries/rush-daemon/src/DaemonShutdownDeadline.ts b/libraries/rush-daemon/src/DaemonShutdownDeadline.ts
new file mode 100644
index 0000000000..ad36f71690
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownDeadline.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonShutdownDeadlineError, type DaemonShutdownStage } from './DaemonShutdownDeadlineError';
+
+/** Where a shutdown is when it is cut short. */
+export interface IDaemonShutdownProgress {
+  readonly stage: DaemonShutdownStage;
+  readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
+/** Options for {@link DaemonShutdownDeadline}. */
+export interface IDaemonShutdownDeadlineOptions {
+  /** How long a shutdown may take. Without it, only {@link DaemonShutdownDeadline.expire} cuts one short. */
+  readonly timeoutMs: number | undefined;
+  readonly getProgress: () => IDaemonShutdownProgress;
+  /** Reports a failure of cleanup that finished after the shutdown was cut short. */
+  readonly onLateFailure: (error: Error) => void;
+}
+
+/**
+ * Races a shutdown's cleanup against its deadline, so that an await that ignores cancellation cannot keep the
+ * daemon from exiting.
+ */
+export class DaemonShutdownDeadline {
+  readonly #options: IDaemonShutdownDeadlineOptions;
+  #forcedBy: string | undefined;
+  #cutShort: ((forcedBy: string | undefined) => void) | undefined;
+
+  public constructor(options: IDaemonShutdownDeadlineOptions) {
+    this.#options = options;
+  }
+
+  /**
+   * Settles as the cleanup does, unless the deadline passes or {@link DaemonShutdownDeadline.expire} is called
+   * first. Then it rejects with {@link DaemonShutdownDeadlineError}, and the cleanup goes on in the background.
+   */
+  public async raceAsync(cleanup: Promise<void>): Promise<void> {
+    const startedAtMs: number = Date.now();
+    let timer: NodeJS.Timeout | undefined;
+    const cutShort: Promise<void> = new Promise<void>((resolve, reject) => {
+      this.#cutShort = (forcedBy: string | undefined) =>
+        reject(
+          new DaemonShutdownDeadlineError({
+            ...this.#options.getProgress(),
+            elapsedMs: Date.now() - startedAtMs,
+            forcedBy
+          })
+        );
+    });
+    if (this.#forcedBy !== undefined) {
+      this.#cutShort?.(this.#forcedBy);
+    } else if (this.#options.timeoutMs !== undefined) {
+      timer = setTimeout(() => this.#cutShort?.(undefined), this.#options.timeoutMs);
+    }
+    try {
+      await Promise.race([cleanup, cutShort]);
+    } catch (error) {
+      if (error instanceof DaemonShutdownDeadlineError) {
+        cleanup.catch((lateError: unknown) =>
+          this.#options.onLateFailure(lateError instanceof Error ? lateError : new Error(String(lateError)))
+        );
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      this.#cutShort = undefined;
+    }
+  }
+
+  /** Cuts the running shutdown short now. A shutdown that has not started yet is cut short when it starts. */
+  public expire(forcedBy: string): void {
+    this.#forcedBy ??= forcedBy;
+    this.#cutShort?.(forcedBy);
+  }
+}
diff --git a/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts b/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
new file mode 100644
index 0000000000..61c8cc111f
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The step of a daemon shutdown that was still running when it was cut short.
+ *
+ * @beta
+ */
+export type DaemonShutdownStage =
+  | 'requests'
+  | 'workspaceMaintenance'
+  | 'requestDispatcher'
+  | 'workspaceSession'
+  | 'listener';
+
+/**
+ * Options for {@link DaemonShutdownDeadlineError}.
+ *
+ * @beta
+ */
+export interface IDaemonShutdownDeadlineErrorOptions {
+  /** How long the shutdown had been running. */
+  readonly elapsedMs: number;
+  /** What cut the shutdown short before its deadline, such as "a second SIGTERM". Omitted when the deadline did. */
+  readonly forcedBy?: string;
+  /** The step that was still running. */
+  readonly stage: DaemonShutdownStage;
+  /** A description of each request that had not finished. */
+  readonly unfinishedRequests: ReadonlyArray<string>;
+}
+
+/**
+ * Reports a daemon shutdown that was cut short, by its deadline or by a second signal, before its cleanup
+ * finished. The cleanup may still be running.
+ *
+ * @remarks
+ * A daemon process that gets it releases what it safely can and exits, instead of waiting forever for an await
+ * that ignores cancellation, such as a lock that another process holds.
+ *
+ * @beta
+ */
+export class DaemonShutdownDeadlineError extends Error {
+  /** How long the shutdown had been running when it was cut short. */
+  public readonly elapsedMs: number;
+  /** What cut the shutdown short before its deadline, such as "a second SIGTERM". Undefined when the deadline did. */
+  public readonly forcedBy: string | undefined;
+  /** The step that was still running. */
+  public readonly stage: DaemonShutdownStage;
+  /** A description of each request that had not finished, such as `"build -t a" (running for 12.3 s)`. */
+  public readonly unfinishedRequests: ReadonlyArray<string>;
+
+  public constructor(options: IDaemonShutdownDeadlineErrorOptions) {
+    super(formatMessage(options));
+    this.name = 'DaemonShutdownDeadlineError';
+    this.elapsedMs = options.elapsedMs;
+    this.forcedBy = options.forcedBy;
+    this.stage = options.stage;
+    this.unfinishedRequests = options.unfinishedRequests;
+  }
+}
+
+const MS_PER_SECOND: number = 1000;
+
+function formatMessage(options: IDaemonShutdownDeadlineErrorOptions): string {
+  const elapsed: string = `${(options.elapsedMs / MS_PER_SECOND).toFixed(1)} s`;
+  const ending: string =
+    options.forcedBy === undefined
+      ? `did not finish within ${elapsed}`
+      : `was cut short by ${options.forcedBy} after ${elapsed}`;
+  const requests: string =
+    options.unfinishedRequests.length > 0
+      ? ` Unfinished requests: ${options.unfinishedRequests.join('; ')}.`
+      : '';
+  return `The Rush daemon's shutdown ${ending}, while ${describeStage(options.stage)}.${requests}`;
+}
+
+function describeStage(stage: DaemonShutdownStage): string {
+  switch (stage) {
+    case 'requests':
+      return 'waiting for requests to finish';
+    case 'workspaceMaintenance':
+      return 'stopping workspace maintenance';
+    case 'requestDispatcher':
+      return 'disposing the request dispatcher';
+    case 'workspaceSession':
+      return 'disposing the workspace session';
+    case 'listener':
+      return 'closing the listener';
+  }
+}
diff --git a/libraries/rush-daemon/src/DaemonShutdownSignals.ts b/libraries/rush-daemon/src/DaemonShutdownSignals.ts
new file mode 100644
index 0000000000..e26b6bad2f
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonShutdownSignals.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonShutdownError } from './DaemonShutdownError';
+
+/** The part of `process` that {@link listenForShutdownSignals} uses. */
+export interface IShutdownSignalEmitter {
+  on(event: NodeJS.Signals, listener: (signal: NodeJS.Signals) => void): unknown;
+  off(event: NodeJS.Signals, listener: (signal: NodeJS.Signals) => void): unknown;
+}
+
+/** Options for {@link listenForShutdownSignals}. */
+export interface IShutdownSignalsOptions {
+  readonly emitter: IShutdownSignalEmitter;
+  /** Called for each termination signal after the first one, such as a second Ctrl+C. */
+  readonly onForce: (signal: NodeJS.Signals) => void;
+  readonly getNowMs?: () => number;
+}
+
+/** The shutdown signal of a daemon that owns its process. */
+export interface IShutdownSignals {
+  /** Aborted by the first SIGINT or SIGTERM, with a {@link DaemonShutdownError}. */
+  readonly signal: AbortSignal;
+  readonly dispose: () => void;
+}
+
+const SHUTDOWN_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM'];
+// SubprocessTerminator's listener kills the tracked child processes, removes itself and sends the first signal to
+// this process again, which arrives within a moment. That copy does not ask to force the shutdown.
+const RELAY_WINDOW_MS: number = 1000;
+
+/**
+ * Listens for SIGINT and SIGTERM until disposed. The first one requests a clean shutdown. Each later one calls
+ * `onForce`, so that the daemon can exit even when its shutdown does not finish, except for one copy of the first
+ * signal that arrives within a second, which SubprocessTerminator sends.
+ */
+export function listenForShutdownSignals(options: IShutdownSignalsOptions): IShutdownSignals {
+  const { emitter, onForce, getNowMs = Date.now } = options;
+  const controller: AbortController = new AbortController();
+  let relay: { readonly signal: NodeJS.Signals; readonly deadlineMs: number } | undefined;
+  const onSignal: (signal: NodeJS.Signals) => void = (signal: NodeJS.Signals) => {
+    if (!controller.signal.aborted) {
+      relay = { signal, deadlineMs: getNowMs() + RELAY_WINDOW_MS };
+      controller.abort(new DaemonShutdownError({ initiator: 'signal', signal }));
+      return;
+    }
+    const isRelay: boolean = relay?.signal === signal && getNowMs() <= relay.deadlineMs;
+    relay = undefined;
+    if (!isRelay) onForce(signal);
+  };
+  for (const name of SHUTDOWN_SIGNALS) emitter.on(name, onSignal);
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      for (const name of SHUTDOWN_SIGNALS) emitter.off(name, onSignal);
+    }
+  };
+}
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 52364c7886..d6f3f8a002 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -1,8 +1,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import { realpath } from 'node:fs/promises';
 
+import { LockFile } from '@rushstack/node-core-library';
 import { connectOrStartDaemonAsync, type DaemonClient } from '@rushstack/rush-client-core';
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
@@ -19,6 +21,8 @@ import { DaemonIdleTimer } from './DaemonIdleTimer';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
 import type { IDaemonRequestResolver } from './DaemonRequestDispatcher';
+import { DaemonShutdownDeadline } from './DaemonShutdownDeadline';
+import { DaemonShutdownDeadlineError, type DaemonShutdownStage } from './DaemonShutdownDeadlineError';
 import { DaemonShutdownError, type DaemonShutdownInitiator } from './DaemonShutdownError';
 import { WorkspaceSession } from './WorkspaceSession';
 import type { IWorkspaceSession, WorkspaceSessionFactory } from './WorkspaceSession';
@@ -45,6 +49,13 @@ export interface IRushDaemonHostOptions {
   readonly daemonVersion: string;
   /** Shuts down after this many seconds without pending requests. Disabled when omitted. */
   readonly idleTimeoutSeconds?: number;
+  /**
+   * How long {@link RushDaemonHost.closeAsync} waits for shutdown cleanup before it rejects with
+   * {@link DaemonShutdownDeadlineError}, so that an await that ignores cancellation cannot keep the daemon from
+   * exiting. The cleanup goes on in the background. No deadline when omitted, except that
+   * {@link serveRushDaemonAsync} defaults it for a daemon that owns its process.
+   */
+  readonly shutdownDeadlineMs?: number;
   /** Reports connection-level failures. */
   readonly onError?: (error: Error) => void;
   /**
@@ -86,7 +97,9 @@ export class RushDaemonHost {
   readonly #requestDispatcher: DaemonRequestDispatcher;
   public readonly paths: IDaemonPaths;
   #closePromise: Promise<void> | undefined;
+  #closeStage: DaemonShutdownStage = 'requests';
   #notifyClosed: (() => void) | undefined;
+  readonly #shutdownDeadline: DaemonShutdownDeadline;
   readonly #options: IRushDaemonHostOptions;
   readonly #startedAt: string;
   #restartPromise: Promise<IWorkspaceProcessRestartResult | undefined> | undefined;
@@ -98,7 +111,10 @@ export class RushDaemonHost {
    */
   public readonly restartCompleted: Promise<IWorkspaceProcessRestartResult | undefined>;
 
-  /** Resolves after shutdown cleanup finishes. Use closeAsync() to observe cleanup failures. */
+  /**
+   * Resolves after shutdown cleanup finishes, fails, or is cut short by its deadline. Use closeAsync() to observe
+   * cleanup failures.
+   */
   public readonly closed: Promise<void>;
 
   private constructor(
@@ -126,6 +142,16 @@ export class RushDaemonHost {
     this.#idleTimer = idleTimer;
     this.#options = options;
     this.#startedAt = startedAt;
+    this.#shutdownDeadline = new DaemonShutdownDeadline({
+      timeoutMs: options.shutdownDeadlineMs,
+      getProgress: () => ({
+        stage: this.#closeStage,
+        unfinishedRequests: Array.from(this.#sessions, (session: DaemonControlSession) =>
+          session.describeActiveRequests()
+        ).flat()
+      }),
+      onLateFailure: (error: Error) => this.#reportError(error)
+    });
     this.restartCompleted = new Promise((resolve, reject) => {
       this.#resolveRestart = resolve;
       this.#rejectRestart = reject;
@@ -251,8 +277,8 @@ export class RushDaemonHost {
     }
     function requestShutdown(initiator: DaemonShutdownInitiator): void {
       void host.closeAsync(new DaemonShutdownError({ initiator })).catch((error: Error) => {
-        if (options.onError) options.onError(error);
-        else process.emitWarning(error);
+        // The host's owner sees a shutdown cut short through closeAsync(), and decides whether to exit.
+        if (!(error instanceof DaemonShutdownDeadlineError)) host.#reportError(error);
       });
     }
     idleTimer.start(() => requestShutdown('idleTimeout'));
@@ -277,16 +303,55 @@ export class RushDaemonHost {
   /**
    * Closes active connections, stops listening, and removes transport artifacts.
    *
+   * @remarks
+   * Rejects with {@link DaemonShutdownDeadlineError} when the cleanup does not finish within
+   * {@link IRushDaemonHostOptions.shutdownDeadlineMs}, or when {@link RushDaemonHost.expireShutdownDeadline} is
+   * called first. The listener then keeps its socket and lockfile; see {@link RushDaemonHost.releaseForExit}.
+   *
    * @param reason - Delivered to requests that are still running; only the first close call's reason is used.
    */
   public closeAsync(reason?: DaemonShutdownError): Promise<void> {
-    this.#closePromise ??= this.#closeOnceAsync(reason).finally(() => {
+    this.#closePromise ??= this.#shutdownDeadline.raceAsync(this.#closeOnceAsync(reason)).finally(() => {
       this.#notifyClosed?.();
       if (!this.#restartPromise) this.#resolveRestart?.(undefined);
     });
     return this.#closePromise;
   }
 
+  /**
+   * Cuts the shutdown short, for example on a second termination signal: a running or later
+   * {@link RushDaemonHost.closeAsync} rejects with {@link DaemonShutdownDeadlineError} at once.
+   *
+   * @param forcedBy - What cut the shutdown short, such as "a second SIGTERM", for the error message.
+   */
+  public expireShutdownDeadline(forcedBy: string): void {
+    this.#shutdownDeadline.expire(forcedBy);
+  }
+
+  /**
+   * For a daemon process that exits after its shutdown was cut short: removes the socket, the lockfile and this
+   * process's repository lock (`common/temp/rush#<pid>.lock`), unless the daemon still has child processes. Then
+   * they all stay, as after a crash, so that the next daemon reaps those processes when it reclaims the socket.
+   *
+   * @returns Whether they were removed.
+   */
+  public releaseForExit(): boolean {
+    if (!this.#listener.releaseForExit()) return false;
+    const session: IWorkspaceSession | undefined = this.#workspaceSessionProvider.currentSession;
+    // On Windows the lock is an open handle that the exit releases.
+    if (session && process.platform !== 'win32') {
+      fs.rmSync(LockFile.getLockFilePath(session.rushConfiguration.commonTempFolder, 'rush'), {
+        force: true
+      });
+    }
+    return true;
+  }
+
+  #reportError(error: Error): void {
+    if (this.#options.onError) this.#options.onError(error);
+    else process.emitWarning(error);
+  }
+
   #requestRestart(plan: IWorkspaceProcessRestartPlan): void {
     if (this.#restartPromise || this.#closePromise) return;
     this.#restartPromise = Promise.resolve().then(() => this.#restartOnceAsync(plan));
@@ -295,8 +360,7 @@ export class RushDaemonHost {
       (error: unknown) => {
         const failure: Error = error instanceof Error ? error : new Error(String(error));
         this.#rejectRestart?.(failure);
-        if (this.#options.onError) this.#options.onError(failure);
-        else process.emitWarning(failure);
+        this.#reportError(failure);
       }
     );
   }
@@ -336,6 +400,7 @@ export class RushDaemonHost {
     const errors: unknown[] = [];
     // Refuse new sessions but keep the listener's live ownership until every resource join succeeds.
     // A failed standalone host must not exit naturally and become reclaimable over unjoined children.
+    this.#closeStage = 'requests';
     const sessionSettlements: PromiseSettledResult<void>[] = await Promise.allSettled(
       Array.from(this.#sessions, (session: DaemonControlSession) =>
         session.closeAsync(!!this.#restartPromise, reason ?? new DaemonShutdownError({ initiator: 'host' }))
@@ -346,17 +411,20 @@ export class RushDaemonHost {
         errors.push(settlement.reason);
       }
     }
+    this.#closeStage = 'workspaceMaintenance';
     try {
       const workspace: IWorkspaceSession = await this.#workspaceSessionProvider.getSessionAsync();
       await workspace.quiesceWarmSetAsync?.();
     } catch (error) {
       throw new AggregateError([...errors, error], 'Could not quiesce workspace maintenance for shutdown.');
     }
+    this.#closeStage = 'requestDispatcher';
     try {
       await this.#requestDispatcher[Symbol.asyncDispose]();
     } catch (error) {
       errors.push(error);
     }
+    this.#closeStage = 'workspaceSession';
     try {
       await this.#workspaceSessionProvider[Symbol.asyncDispose]();
     } catch (error) {
@@ -364,6 +432,7 @@ export class RushDaemonHost {
     }
 
     if (errors.length === 0) {
+      this.#closeStage = 'listener';
       try {
         await this.#listener.closeAsync();
       } catch (error) {
diff --git a/libraries/rush-daemon/src/index.ts b/libraries/rush-daemon/src/index.ts
index 282d9a6f75..319866c7c6 100644
--- a/libraries/rush-daemon/src/index.ts
+++ b/libraries/rush-daemon/src/index.ts
@@ -64,6 +64,11 @@ export {
   type DaemonShutdownInitiator,
   type IDaemonShutdownErrorOptions
 } from './DaemonShutdownError';
+export {
+  DaemonShutdownDeadlineError,
+  type DaemonShutdownStage,
+  type IDaemonShutdownDeadlineErrorOptions
+} from './DaemonShutdownDeadlineError';
 export { serveRushDaemonAsync, type IRushDaemonServeOptions } from './serveRushDaemon';
 export {
   WorkspaceEngineComponentFactory,
diff --git a/libraries/rush-daemon/src/serveRushDaemon.ts b/libraries/rush-daemon/src/serveRushDaemon.ts
index 5568767526..f47ff7c194 100644
--- a/libraries/rush-daemon/src/serveRushDaemon.ts
+++ b/libraries/rush-daemon/src/serveRushDaemon.ts
@@ -1,8 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
+
 import { captureDaemonInstallation, getDaemonInstallationFolders } from './DaemonInstallationMonitor';
+import { DaemonShutdownDeadlineError } from './DaemonShutdownDeadlineError';
 import { DaemonShutdownError } from './DaemonShutdownError';
+import { listenForShutdownSignals } from './DaemonShutdownSignals';
 import { RushDaemonHost } from './RushDaemonHost';
 import type { IRushDaemonHostOptions } from './RushDaemonHost';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from './WorkspaceProcessRestart';
@@ -15,10 +19,29 @@ import { getInstalledWorkspaceSuccessorLaunchAsync } from './WorkspaceProcessRes
 export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
   /** Called after the listener is bound and the lockfile is available. */
   readonly onReady?: (host: RushDaemonHost) => void | Promise<void>;
-  /** Requests a clean shutdown. Process signals are used when omitted. */
+  /**
+   * Requests a clean shutdown. When omitted, the daemon owns its process: the first SIGINT or SIGTERM requests a
+   * clean shutdown, and {@link IRushDaemonHostOptions.shutdownDeadlineMs} defaults to 10 seconds. If the shutdown
+   * does not finish by then, or another signal arrives first, the daemon reports why, releases what it safely can
+   * and exits the process with code 1. Once it stops, if something else keeps the process running for 2 seconds,
+   * it reports the active resources that Node.js lists and exits the process, keeping `process.exitCode`.
+   */
   readonly shutdownSignal?: AbortSignal;
 }
 
+/**
+ * How long a daemon that owns its process waits for its shutdown to finish before it exits anyway. It covers the
+ * 5 seconds for which a closing connection waits for its requests.
+ */
+export const DEFAULT_SHUTDOWN_DEADLINE_MS: number = 10000;
+
+/**
+ * How long a daemon that owns its process waits, after it stops serving, for the process to end by itself before it
+ * exits anyway. By then it has released its socket and lockfile, so `daemon status` and `daemon stop` can no longer
+ * see it; a timer or handle that something else left behind (a plugin, a tool, an SDK) must not keep it running.
+ */
+const EXIT_AFTER_STOP_MS: number = 2000;
+
 /**
  * Starts a daemon host, signals readiness, and serves until shutdown is requested.
  *
@@ -30,9 +53,38 @@ export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
  * @beta
  */
 export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Promise<void> {
-  const signalRegistration: IShutdownSignalRegistration = options.shutdownSignal
-    ? { signal: options.shutdownSignal, dispose: () => undefined }
-    : createProcessShutdownSignal();
+  if (options.shutdownSignal) {
+    await serveUntilClosedAsync(options, { signal: options.shutdownSignal, dispose: () => undefined });
+    return;
+  }
+  let host: RushDaemonHost | undefined;
+  const signalRegistration: IShutdownSignalRegistration = listenForShutdownSignals({
+    emitter: process,
+    onForce: (signal: NodeJS.Signals) => {
+      // Nothing to release before the host has started.
+      if (host) host.expireShutdownDeadline(`a second ${signal}`);
+      else process.exit(1);
+    }
+  });
+  try {
+    await serveUntilClosedAsync(
+      { ...options, shutdownDeadlineMs: options.shutdownDeadlineMs ?? DEFAULT_SHUTDOWN_DEADLINE_MS },
+      signalRegistration,
+      (startedHost: RushDaemonHost) => (host = startedHost)
+    );
+  } catch (error) {
+    if (host && error instanceof DaemonShutdownDeadlineError) exitAfterShutdownDeadline(host, error, options);
+    throw error;
+  } finally {
+    exitIfStillRunning(options);
+  }
+}
+
+async function serveUntilClosedAsync(
+  options: IRushDaemonServeOptions,
+  signalRegistration: IShutdownSignalRegistration,
+  onStarted?: (host: RushDaemonHost) => void
+): Promise<void> {
   let host: RushDaemonHost | undefined;
   try {
     host = await RushDaemonHost.startAsync({
@@ -48,13 +100,86 @@ export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Pr
           return await getInstalledWorkspaceSuccessorLaunchAsync(context);
         })
     });
+    onStarted?.(host);
     await options.onReady?.(host);
     await waitForShutdownAsync(host, signalRegistration.signal);
     await host.closeAsync(getShutdownReason(signalRegistration.signal));
     await host.restartCompleted;
   } finally {
-    signalRegistration.dispose();
-    await host?.closeAsync();
+    try {
+      await host?.closeAsync();
+    } finally {
+      signalRegistration.dispose();
+    }
+  }
+}
+
+/**
+ * Exits a daemon process whose shutdown was cut short. The requests that did not finish already have their typed
+ * results. The 'exit' hook of SubprocessTerminator kills the child processes that it tracks.
+ */
+function exitAfterShutdownDeadline(
+  host: RushDaemonHost,
+  error: DaemonShutdownDeadlineError,
+  options: IRushDaemonServeOptions
+): never {
+  let outcome: string;
+  try {
+    outcome = host.releaseForExit()
+      ? 'The daemon released its socket, lockfile and repository lock, and exits.'
+      : 'The daemon exits and leaves its socket and lockfile to the next daemon, which reaps its child processes.';
+  } catch (releaseError) {
+    outcome = `The daemon exits; it could not release its socket and lockfile: ${String(releaseError)}`;
+  }
+  const report: Error = new Error(`${error.message} ${outcome}`, { cause: error });
+  reportBeforeExit(report, options);
+  process.exit(1);
+}
+
+/**
+ * Exits the process {@link EXIT_AFTER_STOP_MS} after the daemon stopped serving, if it is still running then, and
+ * reports what kept it running. The timer does not keep the process running itself. `process.exit()` keeps an exit
+ * code that the caller set, and the 'exit' hook of SubprocessTerminator kills the child processes that it still
+ * tracks. A successor daemon is not one of them: it is started detached and untracked.
+ */
+function exitIfStillRunning(options: IRushDaemonServeOptions): void {
+  setTimeout(() => {
+    reportBeforeExit(
+      new Error(
+        `The Rush daemon stopped, but something kept its process running for ${EXIT_AFTER_STOP_MS / 1000} s, ` +
+          `so it exits now. Active resources that Node.js reports: ${describeActiveResources()}.`
+      ),
+      options
+    );
+    process.exit();
+  }, EXIT_AFTER_STOP_MS).unref();
+}
+
+function describeActiveResources(): string {
+  const counts: Map<string, number> = new Map();
+  for (const resource of process.getActiveResourcesInfo()) {
+    counts.set(resource, (counts.get(resource) ?? 0) + 1);
+  }
+  const resources: string[] = [];
+  for (const [resource, count] of counts) {
+    resources.push(count > 1 ? `${resource} (${count})` : resource);
+  }
+  return resources.length > 0 ? resources.join(', ') : 'none';
+}
+
+/**
+ * Reports an error right before `process.exit()`. The report must be written synchronously: `process.emitWarning`
+ * prints on the next tick, which never comes.
+ */
+function reportBeforeExit(report: Error, options: IRushDaemonServeOptions): void {
+  if (options.onError) {
+    options.onError(report);
+    return;
+  }
+  try {
+    fs.writeSync(process.stderr.fd, `${report.stack ?? report.message}\n`);
+  } catch {
+    // The process exits either way.
   }
 }
 
@@ -70,21 +195,6 @@ interface IShutdownSignalRegistration {
   readonly dispose: () => void;
 }
 
-function createProcessShutdownSignal(): IShutdownSignalRegistration {
-  const controller: AbortController = new AbortController();
-  const onSignal: (signal: NodeJS.Signals) => void = (signal: NodeJS.Signals) =>
-    controller.abort(new DaemonShutdownError({ initiator: 'signal', signal }));
-  process.once('SIGINT', onSignal);
-  process.once('SIGTERM', onSignal);
-  return {
-    signal: controller.signal,
-    dispose: () => {
-      process.off('SIGINT', onSignal);
-      process.off('SIGTERM', onSignal);
-    }
-  };
-}
-
 function waitForShutdownAsync(host: RushDaemonHost, signal: AbortSignal): Promise<void> {
   if (signal.aborted) {
     return Promise.resolve();
diff --git a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
new file mode 100644
index 0000000000..f05a509f7f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
@@ -0,0 +1,178 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import type { LeftBehind, Reporter } from './fixtures/LingeringDaemon';
+import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
+
+const FIXTURE_PATH: string = path.join(__dirname, 'fixtures', 'LingeringDaemon.js');
+const POLL_INTERVAL_MS: number = 20;
+const START_TIMEOUT_MS: number = 15000;
+// Far beyond the 2 s after which the daemon exits anyway, and far below the test's timeout.
+const EXIT_TIMEOUT_MS: number = 8000;
+const LINGER_REPORT: RegExp =
+  /The Rush daemon stopped, but something kept its process running for 2 s, so it exits now\. Active resources that Node\.js reports: [^\n]*\bTimeout\b/;
+
+interface IProcessExit {
+  readonly code: number | undefined;
+  readonly signal: NodeJS.Signals | undefined;
+}
+
+interface IFixtureDaemon {
+  readonly process: ChildProcess;
+  readonly exited: Promise<IProcessExit>;
+  readonly getStderr: () => string;
+}
+
+type StopRoute = 'daemon stop' | 'SIGTERM';
+
+(process.platform === 'win32' ? describe.skip : describe)('a daemon process after the daemon stops', () => {
+  let folder: string;
+  let repoRoot: string;
+  let controlFolder: string;
+  let daemon: IFixtureDaemon | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-process-exit-'));
+    repoRoot = path.join(folder, 'repo');
+    controlFolder = path.join(folder, 'control');
+    createTemporaryRepo(repoRoot);
+    fs.mkdirSync(controlFolder);
+    fs.mkdirSync(path.join(folder, 'runtime'), { mode: 0o700 });
+  });
+
+  afterEach(async () => {
+    const startedDaemon: IFixtureDaemon | undefined = daemon;
+    daemon = undefined;
+    // Only the fixture process that this test started, if a failed test left it running.
+    if (
+      startedDaemon &&
+      startedDaemon.process.exitCode === null &&
+      startedDaemon.process.signalCode === null
+    ) {
+      startedDaemon.process.kill('SIGKILL');
+      await startedDaemon.exited;
+    }
+    fs.rmSync(folder, { force: true, recursive: true });
+  });
+
+  function startDaemon(leftBehind: LeftBehind, reporter: Reporter): IFixtureDaemon {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [FIXTURE_PATH, repoRoot, controlFolder, leftBehind, reporter],
+      {
+        // Like a daemon that rush-client launches: the leader of its own process group.
+        detached: true,
+        env: { ...process.env, RUSHD_RUNTIME_DIR: path.join(folder, 'runtime'), RUSH_TEMP_FOLDER: undefined },
+        stdio: ['ignore', 'ignore', 'pipe']
+      }
+    );
+    let stderr: string = '';
+    child.stderr?.setEncoding('utf8').on('data', (chunk: string) => (stderr += chunk));
+    const exited: Promise<IProcessExit> = new Promise((resolve) => {
+      child.once('exit', (code, signal) => resolve({ code: code ?? undefined, signal: signal ?? undefined }));
+    });
+    daemon = { process: child, exited, getStderr: () => stderr };
+    return daemon;
+  }
+
+  async function waitForJsonAsync<T>(fixture: IFixtureDaemon, name: string): Promise<T> {
+    const filename: string = path.join(controlFolder, name);
+    const deadlineMs: number = Date.now() + START_TIMEOUT_MS;
+    while (!fs.existsSync(filename)) {
+      if (fixture.process.exitCode !== null || Date.now() > deadlineMs) {
+        throw new Error(`The fixture did not write ${name}. Its stderr:\n${fixture.getStderr()}`);
+      }
+      await delayAsync(POLL_INTERVAL_MS);
+    }
+    return JSON.parse(fs.readFileSync(filename, 'utf8'));
+  }
+
+  async function stopAsync(fixture: IFixtureDaemon, paths: IDaemonPaths, route: StopRoute): Promise<void> {
+    if (route === 'SIGTERM') {
+      fixture.process.kill('SIGTERM');
+      return;
+    }
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(paths.socketPath);
+    try {
+      await client.handshakeAsync();
+      await client.sendControlAsync({ kind: 'shutdown', payload: {} });
+      expect(await client.readControlAsync()).toEqual({
+        kind: 'shutdownAck',
+        payload: { activeRequests: 0 }
+      });
+      await client.closed;
+    } finally {
+      await client.closeAsync();
+    }
+  }
+
+  /** Resolves with the exit and how long after the daemon stopped it came. */
+  async function waitForExitAsync(fixture: IFixtureDaemon): Promise<IProcessExit & { afterStopMs: number }> {
+    const { stoppedAtMs } = await waitForJsonAsync<{ stoppedAtMs: number }>(fixture, 'stopped.json');
+    const timeout: AbortController = new AbortController();
+    const exit: IProcessExit | undefined = await Promise.race([
+      fixture.exited,
+      delayAsync(EXIT_TIMEOUT_MS, undefined, { signal: timeout.signal }).catch(() => undefined)
+    ]);
+    timeout.abort();
+    if (!exit) {
+      throw new Error(
+        `The fixture process was still running ${EXIT_TIMEOUT_MS} ms after the daemon stopped. ` +
+          `Its stderr:\n${fixture.getStderr()}`
+      );
+    }
+    return { ...exit, afterStopMs: Date.now() - stoppedAtMs };
+  }
+
+  it.each<[StopRoute, Reporter]>([
+    ['daemon stop', 'onError'],
+    ['SIGTERM', 'default']
+  ])(
+    'exits 2 s after %s if a timer that it did not start keeps it running, and reports that through %s',
+    async (route: StopRoute, reporter: Reporter) => {
+      const fixture: IFixtureDaemon = startDaemon('timer', reporter);
+      const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+      await stopAsync(fixture, paths, route);
+
+      const { code, signal, afterStopMs } = await waitForExitAsync(fixture);
+      expect({ code, signal }).toEqual({ code: 0, signal: undefined });
+      expect(afterStopMs).toBeGreaterThanOrEqual(1900);
+      expect(afterStopMs).toBeLessThan(3000);
+      expect(fixture.getStderr()).toMatch(LINGER_REPORT);
+      expect(fs.existsSync(paths.socketPath)).toBe(false);
+      expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+    },
+    30000
+  );
+
+  it('keeps the exit code that its caller set when it failed', async () => {
+    const fixture: IFixtureDaemon = startDaemon('failing', 'onError');
+
+    const { code, signal, afterStopMs } = await waitForExitAsync(fixture);
+    expect({ code, signal }).toEqual({ code: 1, signal: undefined });
+    expect(afterStopMs).toBeGreaterThanOrEqual(1900);
+    expect(fixture.getStderr()).toMatch(/The fixture failed after it started\./);
+    expect(fixture.getStderr()).toMatch(LINGER_REPORT);
+  }, 30000);
+
+  it('exits as soon as it stops if nothing keeps it running', async () => {
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'onError');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    await stopAsync(fixture, paths, 'daemon stop');
+
+    const { code, signal } = await waitForExitAsync(fixture);
+    expect({ code, signal }).toEqual({ code: 0, signal: undefined });
+    expect(fixture.getStderr()).not.toMatch(/kept its process running/);
+    expect(fs.existsSync(paths.socketPath)).toBe(false);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
+  }, 30000);
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
new file mode 100644
index 0000000000..b870a8b76e
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
@@ -0,0 +1,204 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { LockFile } from '@rushstack/node-core-library';
+import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+
+import { DaemonShutdownDeadline } from '../DaemonShutdownDeadline';
+import { DaemonShutdownDeadlineError } from '../DaemonShutdownDeadlineError';
+import { DaemonShutdownError } from '../DaemonShutdownError';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import {
+  CallbackDaemonRequestResolver,
+  createDeferred,
+  createWireEnvelope,
+  DaemonRequestWireClient
+} from './DaemonRequestWireTestUtilities';
+import { captureTestDaemonListenerAsync } from './TestDaemonListener';
+import { createTemporaryRepo, TemporaryRepoWorkspaceSession } from './TemporaryRepoWorkspaceSession';
+
+const REQUEST_ID: string = 'waits-for-lock';
+
+describe('daemon shutdown deadline', () => {
+  let repoRoot: string;
+  let commonTempFolder: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-deadline-'));
+    commonTempFolder = createTemporaryRepo(repoRoot);
+  });
+  afterEach(() => fs.rmSync(repoRoot, { force: true, recursive: true }));
+
+  function createOptions(overrides: Partial<IRushDaemonHostOptions> = {}): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+      daemonVersion: 'deadline-test',
+      repoRoot,
+      rushVersion: '5.178.1',
+      // Like a request that waits for a lock that another process holds, it ignores its abort signal.
+      requestResolver: new CallbackDaemonRequestResolver(() => new Promise(() => undefined)),
+      ...overrides
+    };
+  }
+
+  async function startRequestAsync(host: RushDaemonHost): Promise<DaemonRequestWireClient> {
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    await client.sendControlAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope(REQUEST_ID, 'build', repoRoot, { argv: ['build', '-t', 'mini-a'] })
+    });
+    // The daemon handles a connection's frames in order, so the request has started once the pong arrives.
+    await client.sendControlAsync({ kind: 'ping', payload: {} });
+    while ((await client.readControlAsync()).kind !== 'pong') {
+      // Skip the request's own messages.
+    }
+    return client;
+  }
+
+  async function stopAsync(host: RushDaemonHost): Promise<void> {
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    await client.sendControlAsync({ kind: 'shutdown', payload: {} });
+    expect(await client.readControlAsync()).toEqual({ kind: 'shutdownAck', payload: { activeRequests: 1 } });
+  }
+
+  it('cuts a stopped daemon short, gives the request a typed result and releases on exit', async () => {
+    const onError: jest.Mock = jest.fn();
+    const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+      RushDaemonHost.startAsync(createOptions({ onError, shutdownDeadlineMs: 300 }))
+    );
+    const client: DaemonRequestWireClient = await startRequestAsync(host);
+    // The lock that the stuck request would hold.
+    const repoLock: LockFile | undefined = LockFile.tryAcquire(commonTempFolder, 'rush');
+    try {
+      expect(repoLock).toBeDefined();
+      await stopAsync(host);
+      await host.closed;
+      const error: unknown = await host.closeAsync().catch((closeError: unknown) => closeError);
+      expect(error).toBeInstanceOf(DaemonShutdownDeadlineError);
+      expect(error).toMatchObject({ forcedBy: undefined, stage: 'requests' });
+      expect((error as DaemonShutdownDeadlineError).unfinishedRequests).toEqual([
+        expect.stringMatching(/^"build -t mini-a" \(running for \d+\.\d s\)$/)
+      ]);
+      expect((error as Error).message).toMatch(
+        /^The Rush daemon's shutdown did not finish within \d+\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a" \(running for \d+\.\d s\)\.$/
+      );
+      expect(onError).not.toHaveBeenCalled();
+      // The shutdown was cut short, so the daemon still owns its endpoint and the repository lock.
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+      if (process.platform !== 'win32') expect(fs.existsSync(host.paths.socketPath)).toBe(true);
+
+      // The request never finishes, so its connection's drain times out and the client gets a typed result.
+      expect((await client.readTerminalAsync(REQUEST_ID)).terminal).toEqual({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was running; re-run the command.',
+          exitCode: 1,
+          outcome: 'failure',
+          requestId: REQUEST_ID
+        }
+      });
+      await client.closed;
+
+      expect(host.releaseForExit()).toBe(true);
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+      if (process.platform !== 'win32') {
+        expect(fs.existsSync(host.paths.socketPath)).toBe(false);
+        expect(fs.existsSync(LockFile.getLockFilePath(commonTempFolder, 'rush'))).toBe(false);
+      }
+    } finally {
+      repoLock?.release();
+      await client.closeAsync();
+      await listener.closeAsync();
+    }
+  }, 20000);
+
+  it('cuts a running shutdown short when it is expired, as a second signal does', async () => {
+    const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+      RushDaemonHost.startAsync(createOptions())
+    );
+    const client: DaemonRequestWireClient = await startRequestAsync(host);
+    try {
+      const closing: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })
+      );
+      host.expireShutdownDeadline('a second SIGTERM');
+      await expect(closing).rejects.toThrow(
+        /^The Rush daemon's shutdown was cut short by a second SIGTERM after \d+\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a"/
+      );
+      await expect(closing).rejects.toMatchObject({ forcedBy: 'a second SIGTERM', stage: 'requests' });
+    } finally {
+      await client.closeAsync();
+      await listener.closeAsync();
+    }
+  });
+
+  it('does not change a shutdown that finishes in time', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(
+      createOptions({ shutdownDeadlineMs: 10000 })
+    );
+    await host.closeAsync();
+    await host.closed;
+    expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+  });
+});
+
+describe(DaemonShutdownDeadline.name, () => {
+  function createDeadline(
+    timeoutMs: number | undefined,
+    onLateFailure: jest.Mock = jest.fn()
+  ): DaemonShutdownDeadline {
+    return new DaemonShutdownDeadline({
+      timeoutMs,
+      getProgress: () => ({ stage: 'workspaceSession', unfinishedRequests: [] }),
+      onLateFailure
+    });
+  }
+
+  it('settles as the cleanup does when it finishes in time', async () => {
+    await expect(createDeadline(10000).raceAsync(Promise.resolve())).resolves.toBeUndefined();
+    const failure: Error = new Error('cleanup failed');
+    await expect(createDeadline(10000).raceAsync(Promise.reject(failure))).rejects.toBe(failure);
+  });
+
+  it('rejects at the deadline and reports a cleanup that fails later', async () => {
+    const onLateFailure: jest.Mock = jest.fn();
+    const cleanup = createDeferred<void>();
+    const failing: Promise<void> = cleanup.promise.then(() => {
+      throw new Error('late failure');
+    });
+    await expect(createDeadline(10, onLateFailure).raceAsync(failing)).rejects.toMatchObject({
+      forcedBy: undefined,
+      stage: 'workspaceSession',
+      message: expect.stringMatching(
+        /^The Rush daemon's shutdown did not finish within \d+\.\d s, while disposing the workspace session\.$/
+      )
+    });
+    cleanup.resolve();
+    await failing.catch(() => undefined);
+    expect(onLateFailure).toHaveBeenCalledWith(new Error('late failure'));
+  });
+
+  it('is cut short by expire(), also when that comes before the shutdown starts', async () => {
+    const running: DaemonShutdownDeadline = createDeadline(undefined);
+    const racing: Promise<void> = running.raceAsync(new Promise(() => undefined));
+    running.expire('a second SIGINT');
+    await expect(racing).rejects.toMatchObject({ forcedBy: 'a second SIGINT' });
+
+    const early: DaemonShutdownDeadline = createDeadline(undefined);
+    early.expire('a second SIGTERM');
+    early.expire('a third SIGTERM');
+    await expect(early.raceAsync(new Promise(() => undefined))).rejects.toMatchObject({
+      forcedBy: 'a second SIGTERM'
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
new file mode 100644
index 0000000000..f388017848
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
@@ -0,0 +1,186 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { LockFile } from '@rushstack/node-core-library';
+import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { createWireEnvelope, DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
+import {
+  captureTestProcessIdentity,
+  isTestProcessRunning,
+  type ITestProcessIdentity
+} from './TestProcessExit';
+
+const FIXTURE_PATH: string = path.join(__dirname, 'fixtures', 'StuckShutdownDaemon.js');
+const REQUEST_ID: string = 'stuck-request';
+const POLL_INTERVAL_MS: number = 20;
+const START_TIMEOUT_MS: number = 15000;
+
+interface IProcessExit {
+  readonly code: number | undefined;
+  readonly signal: NodeJS.Signals | undefined;
+}
+
+interface IStuckDaemon {
+  readonly process: ChildProcess;
+  readonly pid: number;
+  readonly exited: Promise<IProcessExit>;
+  readonly getStderr: () => string;
+}
+
+interface IStuckRequest {
+  readonly client: DaemonRequestWireClient;
+  readonly paths: IDaemonPaths;
+  readonly operation: ITestProcessIdentity;
+  readonly repoLockPath: string;
+}
+
+// A daemon process whose request ignores its abort signal, as one that waits for another process's lock does.
+(process.platform === 'win32' ? describe.skip : describe)('a daemon process whose shutdown is stuck', () => {
+  let folder: string;
+  let repoRoot: string;
+  let commonTempFolder: string;
+  let controlFolder: string;
+  let daemon: IStuckDaemon | undefined;
+  let client: DaemonRequestWireClient | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-stuck-shutdown-'));
+    repoRoot = path.join(folder, 'repo');
+    controlFolder = path.join(folder, 'control');
+    commonTempFolder = createTemporaryRepo(repoRoot);
+    fs.mkdirSync(controlFolder);
+    fs.mkdirSync(path.join(folder, 'runtime'), { mode: 0o700 });
+  });
+
+  afterEach(async () => {
+    const openClient: DaemonRequestWireClient | undefined = client;
+    const startedDaemon: IStuckDaemon | undefined = daemon;
+    client = undefined;
+    daemon = undefined;
+    await openClient?.closeAsync();
+    // Only the fixture process that this test started, if a failed test left it running.
+    if (
+      startedDaemon &&
+      startedDaemon.process.exitCode === null &&
+      startedDaemon.process.signalCode === null
+    ) {
+      startedDaemon.process.kill('SIGKILL');
+      await startedDaemon.exited;
+    }
+    fs.rmSync(folder, { force: true, recursive: true });
+  });
+
+  async function waitForJsonAsync<T>(stuckDaemon: IStuckDaemon, name: string): Promise<T> {
+    const filename: string = path.join(controlFolder, name);
+    const deadlineMs: number = Date.now() + START_TIMEOUT_MS;
+    while (!fs.existsSync(filename)) {
+      if (stuckDaemon.process.exitCode !== null || Date.now() > deadlineMs) {
+        throw new Error(`The fixture did not write ${name}. Its stderr:\n${stuckDaemon.getStderr()}`);
+      }
+      await delayAsync(POLL_INTERVAL_MS);
+    }
+    return JSON.parse(fs.readFileSync(filename, 'utf8'));
+  }
+
+  function startDaemon(shutdownDeadlineMs: number): IStuckDaemon {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [FIXTURE_PATH, repoRoot, controlFolder, String(shutdownDeadlineMs)],
+      {
+        // Like a daemon that rush-client launches: the leader of its own process group.
+        detached: true,
+        env: { ...process.env, RUSHD_RUNTIME_DIR: path.join(folder, 'runtime'), RUSH_TEMP_FOLDER: undefined },
+        stdio: ['ignore', 'ignore', 'pipe']
+      }
+    );
+    let stderr: string = '';
+    child.stderr?.setEncoding('utf8').on('data', (chunk: string) => (stderr += chunk));
+    const exited: Promise<IProcessExit> = new Promise((resolve) => {
+      child.once('exit', (code, signal) => resolve({ code: code ?? undefined, signal: signal ?? undefined }));
+    });
+    if (child.pid === undefined) throw new Error('The fixture did not start.');
+    daemon = { process: child, pid: child.pid, exited, getStderr: () => stderr };
+    return daemon;
+  }
+
+  async function startStuckRequestAsync(stuckDaemon: IStuckDaemon): Promise<IStuckRequest> {
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(stuckDaemon, 'ready.json');
+    const requestClient: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(
+      paths.socketPath
+    );
+    client = requestClient;
+    await requestClient.handshakeAsync();
+    await requestClient.sendControlAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope(REQUEST_ID, 'build', repoRoot, { argv: ['build', '-t', 'mini-a'] })
+    });
+    const { operationPid } = await waitForJsonAsync<{ operationPid: number }>(stuckDaemon, 'request.json');
+    const repoLockPath: string = LockFile.getLockFilePath(commonTempFolder, 'rush', stuckDaemon.pid);
+    expect(fs.existsSync(repoLockPath)).toBe(true);
+    return {
+      client: requestClient,
+      paths,
+      operation: captureTestProcessIdentity(operationPid),
+      repoLockPath
+    };
+  }
+
+  function expectReleased(request: IStuckRequest): void {
+    // SubprocessTerminator killed the operation on the first signal, so there was nothing left to reap.
+    expect(isTestProcessRunning(request.operation)).toBe(false);
+    expect(fs.existsSync(request.paths.socketPath)).toBe(false);
+    expect(readDaemonLockfile(request.paths.lockfilePath)).toBeUndefined();
+    expect(fs.existsSync(request.repoLockPath)).toBe(false);
+  }
+
+  it('exits at its deadline, after its request gets a typed result, and releases what it owned', async () => {
+    const stuckDaemon: IStuckDaemon = startDaemon(6000);
+    const request: IStuckRequest = await startStuckRequestAsync(stuckDaemon);
+    const signaledAtMs: number = Date.now();
+    // SubprocessTerminator sends this signal to the daemon again; that copy must not force the exit.
+    stuckDaemon.process.kill('SIGTERM');
+
+    expect((await request.client.readTerminalAsync(REQUEST_ID)).terminal).toEqual({
+      kind: 'requestResult',
+      payload: {
+        aborted: true,
+        errorMessage:
+          'The Rush daemon was shut down (the daemon process received SIGTERM) while this request was ' +
+          'running; re-run the command.',
+        exitCode: 1,
+        outcome: 'failure',
+        requestId: REQUEST_ID
+      }
+    });
+    expect(await stuckDaemon.exited).toEqual({ code: 1, signal: undefined });
+    expect(Date.now() - signaledAtMs).toBeGreaterThanOrEqual(5900);
+    expect(stuckDaemon.getStderr()).toMatch(
+      /The Rush daemon's shutdown did not finish within 6\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a" \(running for \d+\.\d s\)\. The daemon released its socket, lockfile and repository lock, and exits\./
+    );
+    expectReleased(request);
+  }, 30000);
+
+  it('exits at once on a second signal', async () => {
+    // Far beyond the test's timeout, so only the second signal can end the shutdown in time.
+    const stuckDaemon: IStuckDaemon = startDaemon(60000);
+    const request: IStuckRequest = await startStuckRequestAsync(stuckDaemon);
+    stuckDaemon.process.kill('SIGTERM');
+    await delayAsync(1500);
+    stuckDaemon.process.kill('SIGTERM');
+
+    expect(await stuckDaemon.exited).toEqual({ code: 1, signal: undefined });
+    expect(stuckDaemon.getStderr()).toMatch(
+      /The Rush daemon's shutdown was cut short by a second SIGTERM after \d+\.\d s, while waiting for requests to finish\. Unfinished requests: "build -t mini-a" \(running for \d+\.\d s\)\. The daemon released its socket, lockfile and repository lock, and exits\./
+    );
+    await request.client.closed;
+    expectReleased(request);
+  }, 30000);
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts
new file mode 100644
index 0000000000..4d8bcc7ec2
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownSignals.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { EventEmitter } from 'node:events';
+
+import { DaemonShutdownError } from '../DaemonShutdownError';
+import { listenForShutdownSignals, type IShutdownSignals } from '../DaemonShutdownSignals';
+
+describe(listenForShutdownSignals.name, () => {
+  let emitter: EventEmitter;
+  let nowMs: number;
+  let onForce: jest.Mock;
+  let signals: IShutdownSignals;
+
+  beforeEach(() => {
+    emitter = new EventEmitter();
+    nowMs = 1000;
+    onForce = jest.fn();
+    signals = listenForShutdownSignals({ emitter, onForce, getNowMs: () => nowMs });
+  });
+  afterEach(() => signals.dispose());
+
+  function send(signal: NodeJS.Signals, afterMs: number = 0): void {
+    nowMs += afterMs;
+    emitter.emit(signal, signal);
+  }
+
+  it('requests a clean shutdown on the first signal', () => {
+    expect(signals.signal.aborted).toBe(false);
+    send('SIGTERM');
+    expect(signals.signal.reason).toBeInstanceOf(DaemonShutdownError);
+    expect(signals.signal.reason).toMatchObject({ initiator: 'signal', signal: 'SIGTERM' });
+    expect(onForce).not.toHaveBeenCalled();
+  });
+
+  it("ignores SubprocessTerminator's relay of the first signal, and forces on the next one", () => {
+    send('SIGTERM');
+    send('SIGTERM', 5);
+    expect(onForce).not.toHaveBeenCalled();
+    send('SIGTERM', 5);
+    expect(onForce).toHaveBeenCalledWith('SIGTERM');
+  });
+
+  it('forces on a different signal, or on the same one after a moment', () => {
+    send('SIGTERM');
+    send('SIGINT', 5);
+    expect(onForce).toHaveBeenLastCalledWith('SIGINT');
+
+    signals.dispose();
+    onForce = jest.fn();
+    signals = listenForShutdownSignals({ emitter, onForce, getNowMs: () => nowMs });
+    send('SIGINT');
+    send('SIGINT', 1500);
+    expect(onForce).toHaveBeenCalledWith('SIGINT');
+  });
+
+  it('stops listening when disposed', () => {
+    expect(emitter.listenerCount('SIGINT')).toBe(1);
+    expect(emitter.listenerCount('SIGTERM')).toBe(1);
+    signals.dispose();
+    expect(emitter.listenerCount('SIGINT')).toBe(0);
+    expect(emitter.listenerCount('SIGTERM')).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts b/libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts
new file mode 100644
index 0000000000..e7d917b761
--- /dev/null
+++ b/libraries/rush-daemon/src/test/TemporaryRepoWorkspaceSession.ts
@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { RushConfiguration } from '@microsoft/rush-lib';
+
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+/** Creates an empty Rush repository in the folder, and returns its common/temp folder. */
+export function createTemporaryRepo(repoRoot: string): string {
+  const commonTempFolder: string = path.join(repoRoot, 'common', 'temp');
+  fs.mkdirSync(path.join(repoRoot, 'common', 'config', 'rush'), { recursive: true });
+  fs.mkdirSync(commonTempFolder, { recursive: true });
+  fs.writeFileSync(
+    path.join(repoRoot, 'rush.json'),
+    JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '8.14.0', projects: [] })
+  );
+  return commonTempFolder;
+}
+
+/** A workspace in a repository of its own, from {@link createTemporaryRepo}, whose lock a test can hold. */
+export class TemporaryRepoWorkspaceSession extends TestWorkspaceSession {
+  public override readonly rushConfiguration: RushConfiguration;
+
+  public constructor(repoRoot: string) {
+    super(repoRoot);
+    this.rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(repoRoot, 'rush.json'));
+  }
+}
diff --git a/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts b/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
new file mode 100644
index 0000000000..5da51032d0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { serveRushDaemonAsync, type IRushDaemonServeOptions } from '../../serveRushDaemon';
+import { TemporaryRepoWorkspaceSession } from '../TemporaryRepoWorkspaceSession';
+
+/**
+ * - `timer`: a timer that the daemon did not start keeps the process running after the daemon stops.
+ * - `failing`: the same, and the daemon fails right after it starts, so its caller sets exit code 1.
+ * - `nothing`: nothing keeps the process running.
+ */
+export type LeftBehind = 'timer' | 'failing' | 'nothing';
+
+/**
+ * - `onError`: reports through `onError`, as the Rush daemon's own entry points do.
+ * - `default`: no `onError`.
+ */
+export type Reporter = 'onError' | 'default';
+
+function writeJson(filename: string, value: unknown): void {
+  fs.writeFileSync(`${filename}.tmp`, JSON.stringify(value));
+  fs.renameSync(`${filename}.tmp`, filename);
+}
+
+function onReady(leftBehind: LeftBehind, controlFolder: string): IRushDaemonServeOptions['onReady'] {
+  return (host) => {
+    if (leftBehind !== 'nothing') {
+      // Like a plugin or an SDK client that polls and is never stopped. Its first poll would come long after
+      // the test ends, so it only keeps the process running.
+      setInterval(() => undefined, 600000);
+    }
+    if (leftBehind === 'failing') throw new Error('The fixture failed after it started.');
+    writeJson(path.join(controlFolder, 'ready.json'), { paths: host.paths });
+  };
+}
+
+async function runAsync(): Promise<void> {
+  const [repoRoot, controlFolder, leftBehind, reporter] = process.argv.slice(2);
+  if (!repoRoot || !controlFolder || !leftBehind || !reporter) {
+    throw new Error(
+      'The fixture needs a repository folder, a control folder, what it leaves behind and a reporter.'
+    );
+  }
+  try {
+    // Process mode: no shutdownSignal, so the daemon handles SIGINT and SIGTERM itself.
+    await serveRushDaemonAsync({
+      repoRoot,
+      rushVersion: '5.178.1',
+      daemonVersion: 'lingering-fixture',
+      createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+      onReady: onReady(leftBehind as LeftBehind, controlFolder),
+      onError:
+        (reporter as Reporter) === 'onError'
+          ? (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`)
+          : undefined
+    });
+  } finally {
+    writeJson(path.join(controlFolder, 'stopped.json'), { stoppedAtMs: Date.now() });
+  }
+}
+
+if (require.main === module) {
+  void runAsync().catch((error: unknown) => {
+    process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}
diff --git a/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts b/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
new file mode 100644
index 0000000000..50e197440b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
@@ -0,0 +1,74 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { LockFile, SubprocessTerminator } from '@rushstack/node-core-library';
+
+import type { IResolveDaemonRequestOptions } from '../../DaemonRequestDispatcher';
+import { serveRushDaemonAsync } from '../../serveRushDaemon';
+import { CallbackDaemonRequestResolver } from '../DaemonRequestWireTestUtilities';
+import { TemporaryRepoWorkspaceSession } from '../TemporaryRepoWorkspaceSession';
+
+// Outlives the test, but ends by itself if a failed test leaves it behind.
+const OPERATION_SCRIPT: string = 'setTimeout(() => undefined, 60000);';
+
+function writeJson(filename: string, value: unknown): void {
+  fs.writeFileSync(`${filename}.tmp`, JSON.stringify(value));
+  fs.renameSync(`${filename}.tmp`, filename);
+}
+
+/**
+ * Like a request that holds the repository lock and runs an operation, and then waits for a lock that another
+ * process holds: it ignores its abort signal and never settles.
+ */
+async function runStuckRequestAsync(
+  options: IResolveDaemonRequestOptions,
+  controlFolder: string
+): Promise<never> {
+  const repoLock: LockFile | undefined = LockFile.tryAcquire(
+    options.workspaceSession.rushConfiguration.commonTempFolder,
+    'rush'
+  );
+  if (!repoLock) throw new Error('The repository lock is taken.');
+  const operation: ChildProcess = spawn(process.execPath, ['-e', OPERATION_SCRIPT], {
+    ...SubprocessTerminator.RECOMMENDED_OPTIONS,
+    stdio: 'ignore'
+  });
+  SubprocessTerminator.killProcessTreeOnExit(operation, SubprocessTerminator.RECOMMENDED_OPTIONS);
+  await new Promise<void>((resolve, reject) => {
+    operation.once('spawn', resolve);
+    operation.once('error', reject);
+  });
+  writeJson(path.join(controlFolder, 'request.json'), { operationPid: operation.pid });
+  return await new Promise<never>(() => undefined);
+}
+
+async function runAsync(): Promise<void> {
+  const [repoRoot, controlFolder, shutdownDeadlineMs] = process.argv.slice(2);
+  if (!repoRoot || !controlFolder || !shutdownDeadlineMs) {
+    throw new Error('The fixture needs a repository folder, a control folder and a shutdown deadline.');
+  }
+  // Process mode: no shutdownSignal, so the daemon handles SIGINT and SIGTERM itself.
+  await serveRushDaemonAsync({
+    repoRoot,
+    rushVersion: '5.178.1',
+    daemonVersion: 'stuck-shutdown-fixture',
+    shutdownDeadlineMs: Number(shutdownDeadlineMs),
+    createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+    requestResolver: new CallbackDaemonRequestResolver((options: IResolveDaemonRequestOptions) =>
+      runStuckRequestAsync(options, controlFolder)
+    ),
+    onReady: (host) => writeJson(path.join(controlFolder, 'ready.json'), { paths: host.paths }),
+    onError: (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`)
+  });
+}
+
+if (require.main === module) {
+  void runAsync().catch((error: unknown) => {
+    process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}

From ce12b8c91765ff2c76ae709f27e8e19c982a15ba Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:51:44 +0000
Subject: [PATCH 052/265] [rush-daemon] A hot request reuses the latest input
 capture that started after it was received

Swarm integration step 37; original commit 7ab68d689d (merge of r05 at a5e20e7c20).
Scope: task 137.

Brings r05's task 137: in a hot burst each request ran its own full-workspace project-config capture (about 0.09 s each), so n=32 ran 32 of them back to back and held the event loop for 3.1-3.3 s (board 2101). A request now reuses the latest capture that started after the request was received. CONFIRMED by t01 board 2303.

s16 batch A, item 2 of 5 (ch01 board 2867; the suites and mutants are in item 1's message).

Gate: ch01 GATE OK board 2867 (tree 3b55869396)

Commits folded into this step (1):
- a5e20e7c20 [rush-daemon] Reuse the latest input capture that started after a request was received

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...in-succeeded-capture_2026-09-28-22-05.json |  10 ++
 .../rush-daemon/src/FreshCaptureCoalescer.ts  |  38 ++++-
 .../src/test/FreshCaptureCoalescer.test.ts    | 147 +++++++++++++++++-
 .../test/WorkspaceInputCaptureReceipt.test.ts |  44 ++++++
 4 files changed, 226 insertions(+), 13 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-retain-succeeded-capture_2026-09-28-22-05.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-retain-succeeded-capture_2026-09-28-22-05.json b/common/changes/@rushstack/rush-daemon/swarm-r05-retain-succeeded-capture_2026-09-28-22-05.json
new file mode 100644
index 0000000000..18b21e640e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-retain-succeeded-capture_2026-09-28-22-05.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Concurrent hot build requests share one project configuration capture again: a request now also reuses the latest capture that succeeded if it started after the daemon received the request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/FreshCaptureCoalescer.ts b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
index a9f4865264..efef5bfdad 100644
--- a/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
+++ b/libraries/rush-daemon/src/FreshCaptureCoalescer.ts
@@ -7,6 +7,11 @@ interface ICapture<TValue> {
   next: Promise<TValue> | undefined;
 }
 
+interface ISucceededCapture<TValue> {
+  readonly startTimeMs: number;
+  readonly result: Promise<TValue>;
+}
+
 /**
  * Options for {@link FreshCaptureCoalescer}.
  */
@@ -28,16 +33,21 @@ function ignore(): void {}
  * before a later caller arrived. A caller that finds a capture running therefore waits for the next capture,
  * which starts when the running one settles and is shared by every caller that arrived in the meantime.
  * Concurrent callers cost at most two captures instead of one each, and every caller receives a result that is
- * at least as fresh as a capture it started itself. Nothing is retained once a capture settles.
+ * at least as fresh as a capture it started itself.
  *
  * A caller that knows an earlier time after which every change it depends on was made, such as the time at which
  * the daemon received its request, can pass that time as `notBeforeMs`. It then shares a running capture that
- * started at or after that time instead of waiting for the next one.
+ * started at or after that time instead of waiting for the next one. It also receives the latest capture that
+ * succeeded, if that capture started at or after that time: a capture can finish before such a caller asks for
+ * it, for example when it awaits no I/O and so holds the event loop until it returns. The coalescer retains that
+ * one result for each scope and key until a capture that started later succeeds. A caller that does not pass
+ * `notBeforeMs` never receives a capture that has settled.
  *
  * Callers that pass the same scope and key must request the same capture.
  */
 export class FreshCaptureCoalescer<TScope extends object, TValue> {
   readonly #captures: WeakMap<TScope, Map<string, ICapture<TValue>>> = new WeakMap();
+  readonly #succeeded: WeakMap<TScope, Map<string, ISucceededCapture<TValue>>> = new WeakMap();
   readonly #now: () => number;
 
   public constructor(options: IFreshCaptureCoalescerOptions = {}) {
@@ -50,8 +60,9 @@ export class FreshCaptureCoalescer<TScope extends object, TValue> {
    * @param scope - Captures are shared only within a scope.
    * @param key - Identifies the capture within the scope.
    * @param captureAsync - Starts a capture when the caller cannot share one.
-   * @param notBeforeMs - A time on this coalescer's clock. A running capture that started at or after this time is
-   * shared with the caller. If it is not specified, the caller shares only a capture that starts after this call.
+   * @param notBeforeMs - A time on this coalescer's clock. A running capture, or the latest capture that succeeded,
+   * is shared with the caller if it started at or after this time. If it is not specified, the caller shares only a
+   * capture that starts after this call.
    */
   public captureAsync(
     scope: TScope,
@@ -59,6 +70,10 @@ export class FreshCaptureCoalescer<TScope extends object, TValue> {
     captureAsync: () => Promise<TValue>,
     notBeforeMs?: number
   ): Promise<TValue> {
+    if (notBeforeMs !== undefined) {
+      const succeeded: ISucceededCapture<TValue> | undefined = this.#succeeded.get(scope)?.get(key);
+      if (succeeded && succeeded.startTimeMs >= notBeforeMs) return succeeded.result;
+    }
     const capture: ICapture<TValue> | undefined = this.#captures.get(scope)?.get(key);
     if (!capture) return this.#start(scope, key, captureAsync);
     if (notBeforeMs !== undefined && capture.startTimeMs >= notBeforeMs) return capture.running;
@@ -79,7 +94,20 @@ export class FreshCaptureCoalescer<TScope extends object, TValue> {
     const forget: () => void = () => {
       if (captures.get(key) === capture) captures.delete(key);
     };
-    running.then(forget, forget);
+    const retain: () => void = () => {
+      let succeeded: Map<string, ISucceededCapture<TValue>> | undefined = this.#succeeded.get(scope);
+      if (!succeeded) {
+        succeeded = new Map();
+        this.#succeeded.set(scope, succeeded);
+      }
+      // Captures of one key can overlap, so one that started earlier can succeed later.
+      const latest: ISucceededCapture<TValue> | undefined = succeeded.get(key);
+      if (!latest || latest.startTimeMs <= startTimeMs) succeeded.set(key, { startTimeMs, result: running });
+    };
+    running.then(() => {
+      retain();
+      forget();
+    }, forget);
     return running;
   }
 }
diff --git a/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
index fe2dbb66f6..3f58530c38 100644
--- a/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
+++ b/libraries/rush-daemon/src/test/FreshCaptureCoalescer.test.ts
@@ -5,33 +5,40 @@ import { FreshCaptureCoalescer } from '../FreshCaptureCoalescer';
 
 interface IStartedCapture {
   readonly index: number;
+  readonly startTimeMs: number;
   readonly resolve: (value: string) => void;
   readonly reject: (error: Error) => void;
 }
 
+/** A clock that moves only when the test says so. */
+class ManualClock {
+  public nowMs: number = 0;
+  public readonly now = (): number => this.nowMs;
+}
+
 /** Captures that start in order and settle only when the test says so. */
 class ControlledCaptures {
   public readonly started: IStartedCapture[] = [];
+  readonly #clock: ManualClock | undefined;
+
+  public constructor(clock?: ManualClock) {
+    this.#clock = clock;
+  }
 
   public readonly captureAsync = (): Promise<string> => {
     return new Promise<string>((resolve, reject) => {
-      this.started.push({ index: this.started.length, resolve, reject });
+      const startTimeMs: number = this.#clock?.nowMs ?? Number.NaN;
+      this.started.push({ index: this.started.length, startTimeMs, resolve, reject });
     });
   };
 }
 
-/** A clock that moves only when the test says so. */
-class ManualClock {
-  public nowMs: number = 0;
-  public readonly now = (): number => this.nowMs;
-}
-
 async function flushAsync(): Promise<void> {
   await new Promise((resolve) => setImmediate(resolve));
 }
 
 describe(FreshCaptureCoalescer.name, () => {
-  it('starts a capture for a caller when none is running and retains nothing once it settles', async () => {
+  it('starts a new capture for a caller without notBeforeMs once the previous capture settled', async () => {
     const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
     const scope: object = {};
     const captures: ControlledCaptures = new ControlledCaptures();
@@ -252,6 +259,121 @@ describe(FreshCaptureCoalescer.name, () => {
     expect(captures.started).toHaveLength(1);
   });
 
+  it('gives a caller the latest capture that succeeded if it started at or after the caller\'s notBeforeMs', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+
+    // Callers received before the capture started that ask only after it settled, as they do when it held the
+    // event loop from start to end.
+    clock.nowMs = 20;
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 10)).resolves.toBe('started at 10');
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 5)).resolves.toBe('started at 10');
+    expect(captures.started).toHaveLength(1);
+
+    const receivedAfterItStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      11
+    );
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('started at 20');
+    await expect(receivedAfterItStarted).resolves.toBe('started at 20');
+
+    // A capture that started later replaces the retained one.
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 11)).resolves.toBe('started at 20');
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 5)).resolves.toBe('started at 20');
+    expect(captures.started).toHaveLength(2);
+  });
+
+  it('never gives a caller without notBeforeMs a capture that has settled', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+
+    clock.nowMs = 20;
+    const strict: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    expect(captures.started).toHaveLength(2);
+    captures.started[1].resolve('started at 20');
+    await expect(strict).resolves.toBe('started at 20');
+  });
+
+  it('gives a caller the retained capture while a later one runs, and never retains a capture that failed', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({ now: clock.now });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures();
+
+    clock.nowMs = 10;
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync, 10);
+    captures.started[0].resolve('started at 10');
+    await expect(first).resolves.toBe('started at 10');
+
+    clock.nowMs = 20;
+    const failed: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    // A caller received before the retained capture started doesn't wait for the running one.
+    await expect(coalescer.captureAsync(scope, 'key', captures.captureAsync, 5)).resolves.toBe('started at 10');
+    captures.started[1].reject(new Error('a configuration file is being rewritten'));
+    await expect(failed).rejects.toThrow('a configuration file is being rewritten');
+
+    // The failed capture started at 20, but a caller received at 15 must not receive its failure.
+    clock.nowMs = 30;
+    const receivedAfterTheRetainedOneStarted: Promise<string> = coalescer.captureAsync(
+      scope,
+      'key',
+      captures.captureAsync,
+      15
+    );
+    expect(captures.started).toHaveLength(3);
+    captures.started[2].resolve('started at 30');
+    await expect(receivedAfterTheRetainedOneStarted).resolves.toBe('started at 30');
+  });
+
+  it('retains the capture that started last when overlapping captures succeed in the opposite order', async () => {
+    const clock: ManualClock = new ManualClock();
+    const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer({
+      now: () => (clock.nowMs += 10)
+    });
+    const scope: object = {};
+    const captures: ControlledCaptures = new ControlledCaptures(clock);
+
+    const first: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    const queued: Promise<string> = coalescer.captureAsync(scope, 'key', captures.captureAsync);
+    // A caller that asks as soon as the first capture settles starts a capture before the queued one starts.
+    const asksOnSettle: Promise<string> = first.then(() =>
+      coalescer.captureAsync(scope, 'key', captures.captureAsync)
+    );
+    captures.started[0].resolve('first');
+    await flushAsync();
+    expect(captures.started).toHaveLength(3);
+
+    const [earlier, later] = captures.started.slice(1).sort((a, b) => a.startTimeMs - b.startTimeMs);
+    expect(earlier.startTimeMs).toBeLessThan(later.startTimeMs);
+    later.resolve(`started at ${later.startTimeMs}`);
+    await flushAsync();
+    earlier.resolve(`started at ${earlier.startTimeMs}`);
+    const results: string[] = await Promise.all([queued, asksOnSettle]);
+    expect(results.sort()).toEqual([`started at ${earlier.startTimeMs}`, `started at ${later.startTimeMs}`]);
+
+    await expect(
+      coalescer.captureAsync(scope, 'key', captures.captureAsync, later.startTimeMs)
+    ).resolves.toBe(`started at ${later.startTimeMs}`);
+    expect(captures.started).toHaveLength(3);
+  });
+
   it('compares notBeforeMs with performance.now() by default', async () => {
     const coalescer: FreshCaptureCoalescer<object, string> = new FreshCaptureCoalescer();
     const scope: object = {};
@@ -290,5 +412,14 @@ describe(FreshCaptureCoalescer.name, () => {
     expect(captures.started).toHaveLength(3);
     for (const capture of captures.started) capture.resolve(String(capture.index));
     await expect(Promise.all(results)).resolves.toEqual(['0', '1', '2']);
+
+    // Retained captures are not shared across scopes or keys either.
+    const retained: Promise<string>[] = [
+      coalescer.captureAsync(firstScope, 'c', captures.captureAsync, 0),
+      coalescer.captureAsync(secondScope, 'b', captures.captureAsync, 0)
+    ];
+    expect(captures.started).toHaveLength(5);
+    for (const capture of captures.started.slice(3)) capture.resolve(String(capture.index));
+    await expect(Promise.all(retained)).resolves.toEqual(['3', '4']);
   });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
index 93132421a0..3b6fc4f616 100644
--- a/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceInputCaptureReceipt.test.ts
@@ -80,6 +80,33 @@ function holdWorkspaceRequests(requests: jest.SpyInstance, count: number): void
   });
 }
 
+/**
+ * Makes the first `count` project configuration requests wait until all of them have arrived, and then makes them
+ * one at a time, each after the previous request's capture settled. A capture that awaits no I/O holds the event
+ * loop from start to end, so requests received together reach the coalescer in this order.
+ */
+function serializeProjectRequests(requests: jest.SpyInstance, count: number): void {
+  const waiting: (() => Promise<unknown>)[] = [];
+  requests.mockImplementation(function (
+    this: FreshCaptureCoalescer<object, unknown>,
+    ...request: CaptureRequest
+  ): Promise<unknown> {
+    if (waiting.length === count || !isProjectRequest(request)) return originalCaptureAsync.apply(this, request);
+    return new Promise((resolve, reject) => {
+      waiting.push(() => {
+        const result: Promise<unknown> = originalCaptureAsync.apply(this, request);
+        result.then(resolve, reject);
+        return result;
+      });
+      if (waiting.length === count) {
+        void (async () => {
+          for (const ask of waiting) await ask().catch(() => undefined);
+        })();
+      }
+    });
+  });
+}
+
 function gateNextCapture<TArgs extends unknown[], TResult>(
   mock: jest.MockedFunction<(...args: TArgs) => Promise<TResult>>,
   actual: (...args: TArgs) => Promise<TResult>
@@ -172,6 +199,23 @@ describe('workspace input captures shared from the time a request was received',
     expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
   });
 
+  it('gives warm builds the project configuration capture that started after they were received, even once it finished', async () => {
+    fixture = await createWarmFixtureAsync();
+    const warm: DaemonGraphTestFixture = fixture;
+    const generation: number = warm.host.workspaceGeneration;
+    const spy: jest.SpyInstance = spyOnRequests();
+    serializeProjectRequests(spy, 3);
+    projectCaptureMock.mockClear();
+
+    const builds: BuildExchange[] = [warm.buildAsync(), warm.buildAsync(), warm.buildAsync()];
+    await expectSuccessfulBuildsAsync(builds);
+    expect(countRequests(spy, 'project')).toBe(3);
+    // Each build asked after the previous capture had finished; all of them were received before it started.
+    expect(projectCaptureMock).toHaveBeenCalledTimes(1);
+    expect(warm.host.workspaceGeneration).toBe(generation);
+    expect(warm.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+  });
+
   it('never shares a capture that started before a build was received', async () => {
     fixture = await createWarmFixtureAsync();
     const warm: DaemonGraphTestFixture = fixture;

From d5b3f82acd68bfed9eb8f7b9141004e6007fbe5a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:51:44 +0000
Subject: [PATCH 053/265] [rush-azure-storage-build-cache-plugin] The Azure
 build cache picks up a credential written after the daemon's first cloud read

Swarm integration step 38; original commit 0f5e259316 (merge of swarm/r03-t101 at f4a425ada3).
Scope: task 101.

Brings r03's task 101: the Azure storage build cache provider kept its first container client for the daemon's lifetime, so a credential written later was never used (ch05 board 1202, ch02 board 1229). It now uses the credential cached after the first cloud request. CONFIRMED by ch05 board 2290.

s16 batch A, item 3 of 5 (ch01 board 2867).

Gate: ch01 GATE OK board 2867 (tree 38dd18ec39)

Commits folded into this step (1):
- f4a425ada3 [rush-azure-storage-build-cache-plugin] Use a credential that is cached after the first cloud request (task 101)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...e-credential-refresh_2026-09-28-21-50.json |  11 +
 .../src/AzureStorageBuildCacheProvider.ts     | 107 +++++--
 .../AzureStorageBuildCacheProvider.test.ts    | 265 +++++++++++++++++-
 3 files changed, 353 insertions(+), 30 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/azure-cache-credential-refresh_2026-09-28-21-50.json

diff --git a/common/changes/@microsoft/rush/azure-cache-credential-refresh_2026-09-28-21-50.json b/common/changes/@microsoft/rush/azure-cache-credential-refresh_2026-09-28-21-50.json
new file mode 100644
index 0000000000..7da2e2585a
--- /dev/null
+++ b/common/changes/@microsoft/rush/azure-cache-credential-refresh_2026-09-28-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where the Azure Storage build cache plugin kept the client from its first cloud cache request for the life of the process, so that a long-lived process such as the Rush daemon did not use a credential that was cached later. An anonymous client is now used only until a credential is cached, and a client whose credential Azure Storage rejects with status 401 or 403 is replaced on the next request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts
index c31205778e..18186b9e73 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageBuildCacheProvider.ts
@@ -42,6 +42,11 @@ interface IBlobError extends Error {
   };
 }
 
+interface IKeptContainerClient {
+  client: ContainerClient;
+  isAnonymous: boolean;
+}
+
 export class AzureStorageBuildCacheProvider
   extends AzureStorageAuthentication
   implements ICloudBuildCacheProvider
@@ -54,7 +59,10 @@ export class AzureStorageBuildCacheProvider
     return EnvironmentConfiguration.buildCacheWriteAllowed ?? this._isCacheWriteAllowedByConfiguration;
   }
 
-  #containerClient: ContainerClient | undefined;
+  // A long-lived process, such as the Rush daemon, keeps this provider across builds. So a client made
+  // from a credential is kept only until Azure Storage rejects it, and an anonymous client only until
+  // a credential is cached.
+  #keptContainerClient: IKeptContainerClient | undefined;
 
   public constructor(options: IAzureStorageBuildCacheProviderOptions) {
     super({
@@ -131,7 +139,8 @@ export class AzureStorageBuildCacheProvider
     cacheId: string,
     getBlobDataAsync: (blobClient: BlobClient) => Promise<T>
   ): Promise<T | undefined> {
-    const blobClient: BlobClient = await this.#getBlobClientForCacheIdAsync(cacheId, terminal);
+    const containerClient: ContainerClient = await this.#getContainerClientAsync(terminal);
+    const blobClient: BlobClient = this.#getBlobClient(containerClient, cacheId);
 
     try {
       const blobExists: boolean = await blobClient.exists();
@@ -142,6 +151,7 @@ export class AzureStorageBuildCacheProvider
       }
     } catch (err) {
       this.#logBlobError(terminal, err, 'Error getting cache entry from Azure Storage: ');
+      this.#forgetRejectedClient(containerClient, err);
       return undefined;
     }
   }
@@ -163,7 +173,8 @@ export class AzureStorageBuildCacheProvider
       return false;
     }
 
-    const blobClient: BlobClient = await this.#getBlobClientForCacheIdAsync(cacheId, terminal);
+    const containerClient: ContainerClient = await this.#getContainerClientAsync(terminal);
+    const blobClient: BlobClient = this.#getBlobClient(containerClient, cacheId);
     const blockBlobClient: BlockBlobClient = blobClient.getBlockBlobClient();
     let blobAlreadyExists: boolean = false;
 
@@ -183,6 +194,7 @@ export class AzureStorageBuildCacheProvider
           .join(' ');
 
       terminal.writeWarningLine(errorMessage);
+      this.#forgetRejectedClient(containerClient, err);
     }
 
     if (blobAlreadyExists) {
@@ -204,16 +216,32 @@ export class AzureStorageBuildCacheProvider
           return true;
         } else {
           terminal.writeWarningLine(`Error uploading cache entry to Azure Storage: ${e}`);
+          this.#forgetRejectedClient(containerClient, e);
           return false;
         }
       }
     }
   }
 
-  async #getBlobClientForCacheIdAsync(cacheId: string, terminal: ITerminal): Promise<BlobClient> {
-    const client: ContainerClient = await this.#getContainerClientAsync(terminal);
+  #getBlobClient(containerClient: ContainerClient, cacheId: string): BlobClient {
     const blobName: string = this.#blobPrefix ? `${this.#blobPrefix}/${cacheId}` : cacheId;
-    return client.getBlobClient(blobName);
+    return containerClient.getBlobClient(blobName);
+  }
+
+  /**
+   * Azure Storage answers 401 or 403 when it rejects a credential, for example once it has expired.
+   * Forget the client that was made from it, so that the next request reads the cached credential again.
+   */
+  #forgetRejectedClient(containerClient: ContainerClient, error: unknown): void {
+    const statusCode: number | undefined = (error as IBlobError | undefined)?.statusCode;
+    const keptClient: IKeptContainerClient | undefined = this.#keptContainerClient;
+    if (
+      (statusCode === 401 || statusCode === 403) &&
+      keptClient?.client === containerClient &&
+      !keptClient.isAnonymous
+    ) {
+      this.#keptContainerClient = undefined;
+    }
   }
 
   #logBlobError(terminal: ITerminal, err: unknown, prefix: string): void {
@@ -253,37 +281,58 @@ export class AzureStorageBuildCacheProvider
   }
 
   async #getContainerClientAsync(terminal: ITerminal): Promise<ContainerClient> {
-    if (!this.#containerClient) {
-      let sasString: string | undefined = this.#environmentCredential;
-      if (!sasString) {
-        const credentialEntry: ICredentialCacheEntry | undefined = await this.tryGetCachedCredentialAsync({
+    const keptClient: IKeptContainerClient | undefined = this.#keptContainerClient;
+    if (keptClient && !keptClient.isAnonymous) {
+      return keptClient.client;
+    }
+
+    let sasString: string | undefined = this.#environmentCredential;
+    if (!sasString) {
+      let credentialEntry: ICredentialCacheEntry | undefined;
+      if (keptClient) {
+        // While the kept client is anonymous, look for a credential on each request, and don't repeat
+        // the warning about an expired one. If the file can't be read, for example while it is being
+        // written, keep using the anonymous client rather than failing the request.
+        try {
+          credentialEntry = await this.tryGetCachedCredentialAsync({ expiredCredentialBehavior: 'ignore' });
+        } catch {
+          terminal.writeVerboseLine(
+            "Couldn't read the cached Azure Storage credentials. Using the build cache without them."
+          );
+        }
+      } else {
+        credentialEntry = await this.tryGetCachedCredentialAsync({
           expiredCredentialBehavior: 'logWarning',
           terminal
         });
-
-        sasString = credentialEntry?.credential;
       }
 
-      let blobServiceClient: BlobServiceClient;
-      if (sasString) {
-        const connectionString: string = this.#getConnectionString(sasString);
-        blobServiceClient = BlobServiceClient.fromConnectionString(connectionString);
-      } else if (!this.#readRequiresAuthentication && !this._isCacheWriteAllowedByConfiguration) {
-        // If we don't have a credential and read doesn't require authentication, we can still read from the cache.
-        blobServiceClient = new BlobServiceClient(this._storageAccountUrl);
-      } else {
-        throw new Error(
-          "An Azure Storage SAS credential hasn't been provided, or has expired. " +
-            `Update the credentials by running "rush ${RushConstants.updateCloudCredentialsCommandName}", ` +
-            `or provide a SAS in the ` +
-            `${EnvironmentVariableNames.RUSH_BUILD_CACHE_CREDENTIAL} environment variable`
-        );
-      }
+      sasString = credentialEntry?.credential;
+    }
+
+    if (keptClient && !sasString) {
+      return keptClient.client;
+    }
 
-      this.#containerClient = blobServiceClient.getContainerClient(this._storageContainerName);
+    let blobServiceClient: BlobServiceClient;
+    if (sasString) {
+      const connectionString: string = this.#getConnectionString(sasString);
+      blobServiceClient = BlobServiceClient.fromConnectionString(connectionString);
+    } else if (!this.#readRequiresAuthentication && !this._isCacheWriteAllowedByConfiguration) {
+      // If we don't have a credential and read doesn't require authentication, we can still read from the cache.
+      blobServiceClient = new BlobServiceClient(this._storageAccountUrl);
+    } else {
+      throw new Error(
+        "An Azure Storage SAS credential hasn't been provided, or has expired. " +
+          `Update the credentials by running "rush ${RushConstants.updateCloudCredentialsCommandName}", ` +
+          `or provide a SAS in the ` +
+          `${EnvironmentVariableNames.RUSH_BUILD_CACHE_CREDENTIAL} environment variable`
+      );
     }
 
-    return this.#containerClient;
+    const containerClient: ContainerClient = blobServiceClient.getContainerClient(this._storageContainerName);
+    this.#keptContainerClient = { client: containerClient, isAnonymous: !sasString };
+    return containerClient;
   }
 
   #getConnectionString(sasString: string | undefined): string {
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
index 25cb7d50bc..3b5e5e0b28 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
@@ -1,7 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { CredentialCache } from '@rushstack/credential-cache';
+import { BlobServiceClient, type BlockBlobClient, type ContainerClient } from '@azure/storage-blob';
+
+import { CredentialCache, type ICredentialCacheEntry } from '@rushstack/credential-cache';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 import { EnvironmentConfiguration, RushUserConfiguration } from '@rushstack/rush-sdk';
 
@@ -133,4 +135,265 @@ describe(AzureStorageBuildCacheProvider.name, () => {
   it('Has an expected cached credential name (write allowed)', async () => {
     await testCredentialCache(true);
   });
+
+  describe('a credential that changes while the provider is in use', () => {
+    const FIRST_SAS: string = 'sv=2025-01-05&sp=rcw&sig=first-secret-signature';
+    const SECOND_SAS: string = 'sv=2025-01-05&sp=rcw&sig=second-secret-signature';
+    const SECRETS: string[] = ['first-secret-signature', 'second-secret-signature'];
+
+    type BlobOperation = 'exists' | 'download' | 'upload';
+    // 'hit' and 'miss' answer an existence check; a number is the status code of an error
+    type FakeResponse = 'hit' | 'miss' | 'ok' | number;
+
+    let cachedCredential: ICredentialCacheEntry | undefined;
+    let credentialReads: number;
+    let requests: string[];
+    let respond: (credentialName: string, operation: BlobOperation) => FakeResponse | Promise<FakeResponse>;
+    let terminalProvider: StringBufferTerminalProvider;
+    let terminal: Terminal;
+
+    function getCredentialName(sasString: string | undefined): string {
+      return sasString === FIRST_SAS ? 'first' : sasString === SECOND_SAS ? 'second' : 'anonymous';
+    }
+
+    function createBlobError(statusCode: number): Error {
+      const errorCode: string = `Status${statusCode}ErrorCode`;
+      return Object.assign(new Error(`The request failed with status ${statusCode}.`), {
+        name: 'RestError',
+        statusCode,
+        code: errorCode,
+        response: { status: statusCode, parsedHeaders: { errorCode } }
+      });
+    }
+
+    function createFakeContainerClient(sasString: string | undefined): ContainerClient {
+      const credentialName: string = getCredentialName(sasString);
+      async function requestAsync(operation: BlobOperation): Promise<FakeResponse> {
+        requests.push(`${operation} ${credentialName}`);
+        const response: FakeResponse = await respond(credentialName, operation);
+        if (typeof response === 'number') {
+          throw createBlobError(response);
+        }
+        return response;
+      }
+
+      const blobClient: Partial<BlockBlobClient> = {
+        exists: () => requestAsync('exists').then((response: FakeResponse) => response === 'hit'),
+        downloadToBuffer: (async () => {
+          await requestAsync('download');
+          return Buffer.from(`read with ${credentialName}`);
+        }) as BlockBlobClient['downloadToBuffer'],
+        upload: (async () => {
+          await requestAsync('upload');
+        }) as unknown as BlockBlobClient['upload'],
+        getBlockBlobClient: () => blobClient as BlockBlobClient
+      };
+      return { getBlobClient: () => blobClient } as unknown as ContainerClient;
+    }
+
+    function createSubject(isCacheWriteAllowed: boolean = false): AzureStorageBuildCacheProvider {
+      return new AzureStorageBuildCacheProvider({
+        storageAccountName: 'storage-account',
+        storageContainerName: 'container-name',
+        isCacheWriteAllowed
+      });
+    }
+
+    beforeEach(() => {
+      cachedCredential = undefined;
+      credentialReads = 0;
+      requests = [];
+      terminalProvider = new StringBufferTerminalProvider();
+      terminal = new Terminal(terminalProvider);
+
+      jest.spyOn(CredentialCache, 'usingAsync').mockImplementation(async (options, doActionAsync) => {
+        credentialReads++;
+        await doActionAsync({ tryGetCacheEntry: () => cachedCredential } as unknown as CredentialCache);
+      });
+      jest.spyOn(BlobServiceClient, 'fromConnectionString').mockImplementation(
+        (connectionString: string) =>
+          ({
+            getContainerClient: () =>
+              createFakeContainerClient(connectionString.split('SharedAccessSignature=')[1])
+          }) as unknown as BlobServiceClient
+      );
+      jest
+        .spyOn(BlobServiceClient.prototype, 'getContainerClient')
+        .mockImplementation(() => createFakeContainerClient(undefined));
+    });
+
+    afterEach(() => {
+      const allOutput: string = JSON.stringify(terminalProvider.getAllOutput());
+      for (const secret of SECRETS) {
+        expect(allOutput).not.toContain(secret);
+      }
+
+      jest.restoreAllMocks();
+    });
+
+    it.each([
+      { anonymousResult: 'a miss', anonymousResponse: 'miss' as const },
+      { anonymousResult: '401', anonymousResponse: 401 }
+    ])(
+      'uses a credential that was cached after an anonymous read got $anonymousResult',
+      async ({ anonymousResponse }) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject();
+        respond = (credentialName: string) => (credentialName === 'anonymous' ? anonymousResponse : 'hit');
+
+        expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+        cachedCredential = { credential: FIRST_SAS };
+        const entry: Buffer | undefined = await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+        expect(entry?.toString()).toBe('read with first');
+        expect(requests).toEqual(['exists anonymous', 'exists first', 'download first']);
+        expect(credentialReads).toBe(2);
+      }
+    );
+
+    it.each([
+      { anonymousResult: 'a miss', anonymousResponse: 'miss' as const },
+      { anonymousResult: '401', anonymousResponse: 401 }
+    ])(
+      'reuses the anonymous client and warns once about an expired credential when reads get $anonymousResult',
+      async ({ anonymousResponse }) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject();
+        respond = () => anonymousResponse;
+        cachedCredential = { credential: FIRST_SAS, expires: new Date(Date.now() - 60_000) };
+
+        await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+        await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+        expect(requests).toEqual(['exists anonymous', 'exists anonymous']);
+        expect(credentialReads).toBe(2);
+        expect(BlobServiceClient.prototype.getContainerClient).toHaveBeenCalledTimes(1);
+        expect(terminalProvider.getWarningOutput().match(/have expired/g)).toHaveLength(1);
+      }
+    );
+
+    it("keeps using the anonymous client when the cached credentials can't be read", async () => {
+      const subject: AzureStorageBuildCacheProvider = createSubject();
+      respond = () => 'miss';
+
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+      jest.mocked(CredentialCache.usingAsync).mockRejectedValueOnce(new Error('Unexpected end of input'));
+      expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+      cachedCredential = { credential: FIRST_SAS };
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+      expect(requests).toEqual(['exists anonymous', 'exists anonymous', 'exists first']);
+      expect(BlobServiceClient.prototype.getContainerClient).toHaveBeenCalledTimes(1);
+      expect(terminalProvider.getWarningOutput()).toBe('');
+      expect(terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('keeps a newer client when an older one is rejected late', async () => {
+      const subject: AzureStorageBuildCacheProvider = createSubject();
+      let onLateRequest!: () => void;
+      const lateRequestSent: Promise<void> = new Promise<void>((resolve) => {
+        onLateRequest = resolve;
+      });
+      let answerLateRequest!: () => void;
+      const lateResponse: Promise<FakeResponse> = new Promise<FakeResponse>((resolve) => {
+        answerLateRequest = () => resolve(403);
+      });
+      let firstRequests: number = 0;
+      respond = (credentialName: string) => {
+        if (credentialName !== 'first') {
+          return 'hit';
+        } else if (firstRequests++ === 0) {
+          onLateRequest();
+          return lateResponse;
+        } else {
+          return 403;
+        }
+      };
+      cachedCredential = { credential: FIRST_SAS };
+
+      const lateRead: Promise<Buffer | undefined> = subject.tryGetCacheEntryBufferByIdAsync(
+        terminal,
+        'cache-id'
+      );
+      await lateRequestSent;
+      expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+      cachedCredential = { credential: SECOND_SAS };
+      expect((await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id'))?.toString()).toBe(
+        'read with second'
+      );
+      answerLateRequest();
+      expect(await lateRead).toBeUndefined();
+      expect((await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id'))?.toString()).toBe(
+        'read with second'
+      );
+
+      expect(credentialReads).toBe(2);
+    });
+
+    it('keeps a client made from a credential while Azure Storage accepts it, or fails with another status', async () => {
+      const subject: AzureStorageBuildCacheProvider = createSubject();
+      let failNextRequest: boolean = false;
+      respond = () => (failNextRequest ? 500 : 'hit');
+      cachedCredential = { credential: FIRST_SAS };
+
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+      failNextRequest = true;
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+      failNextRequest = false;
+      cachedCredential = { credential: SECOND_SAS };
+      await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+      expect(requests).toEqual([
+        'exists first',
+        'download first',
+        'exists first',
+        'exists first',
+        'download first'
+      ]);
+      expect(credentialReads).toBe(1);
+    });
+
+    it.each([401, 403])(
+      'reads the cached credential again after a read was rejected with %i',
+      async (statusCode: number) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject();
+        respond = (credentialName: string) => (credentialName === 'first' ? statusCode : 'hit');
+        cachedCredential = { credential: FIRST_SAS };
+
+        expect(await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id')).toBeUndefined();
+        cachedCredential = { credential: SECOND_SAS };
+        const entry: Buffer | undefined = await subject.tryGetCacheEntryBufferByIdAsync(terminal, 'cache-id');
+
+        expect(entry?.toString()).toBe('read with second');
+        expect(requests).toEqual(['exists first', 'exists second', 'download second']);
+        expect(credentialReads).toBe(2);
+      }
+    );
+
+    it.each([
+      { rejectedOperation: 'upload' as const, expectedResult: false },
+      { rejectedOperation: 'exists' as const, expectedResult: true }
+    ])(
+      'reads the cached credential again after the $rejectedOperation request of a write was rejected',
+      async ({ rejectedOperation, expectedResult }) => {
+        const subject: AzureStorageBuildCacheProvider = createSubject(true);
+        respond = (credentialName: string, operation: BlobOperation) =>
+          credentialName === 'first' && operation === rejectedOperation
+            ? 403
+            : operation === 'exists'
+              ? 'miss'
+              : 'ok';
+        cachedCredential = { credential: FIRST_SAS };
+
+        expect(await subject.trySetCacheEntryBufferAsync(terminal, 'cache-id', Buffer.from('entry'))).toBe(
+          expectedResult
+        );
+        cachedCredential = { credential: SECOND_SAS };
+        expect(await subject.trySetCacheEntryBufferAsync(terminal, 'cache-id', Buffer.from('entry'))).toBe(
+          true
+        );
+
+        expect(requests).toEqual(['exists first', 'upload first', 'exists second', 'upload second']);
+        expect(credentialReads).toBe(2);
+      }
+    );
+  });
 });

From 02e9125d1497319a0ce980df3d0c3e9a7df74a20 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:51:44 +0000
Subject: [PATCH 054/265] [rush-lib] build-cache.json accepts
 azureBlobStorageConfiguration.storageEndpoint

Swarm integration step 39; original commit ac2e51d2d2 (merge of swarm/r03-t144 at 04c7af3fbb).
Scope: task 144.

Brings r03's task 144: rush-lib's build-cache.schema.json rejected azureBlobStorageConfiguration.storageEndpoint, which the Azure plugin has read since microsoft/rushstack PR 5664. CONFIRMED by ch05 board 2396.

s16 batch A, item 4 of 5 (ch01 board 2867).

Gate: ch01 GATE OK board 2867 (tree 0fbdb27c44)

Commits folded into this step (1):
- 04c7af3fbb [rush-lib] Allow storageEndpoint in build-cache.json's azureBlobStorageConfiguration (task 144)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rage-endpoint-schema_2026-09-28-22-28.json |  11 ++
 .../common/config/rush/build-cache.json       |   7 ++
 .../api/test/BuildCacheConfiguration.test.ts  | 102 ++++++++++++++++++
 .../src/schemas/build-cache.schema.json       |   5 +
 4 files changed, 125 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/azure-storage-endpoint-schema_2026-09-28-22-28.json
 create mode 100644 libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts

diff --git a/common/changes/@microsoft/rush/azure-storage-endpoint-schema_2026-09-28-22-28.json b/common/changes/@microsoft/rush/azure-storage-endpoint-schema_2026-09-28-22-28.json
new file mode 100644
index 0000000000..14abd8d0f7
--- /dev/null
+++ b/common/changes/@microsoft/rush/azure-storage-endpoint-schema_2026-09-28-22-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Allow `storageEndpoint` in the `azureBlobStorageConfiguration` section of build-cache.json. The Azure Storage build cache plugin reads this setting, but the build-cache.json schema rejected it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json b/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
index 072e9f7d49..b9bed9937c 100644
--- a/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
+++ b/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
@@ -60,6 +60,13 @@
      */
     // "azureEnvironment": "AzurePublicCloud",
 
+    /**
+     * An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite,
+     * private endpoints, or storage emulators. When specified, this overrides the default endpoint derived
+     * from "storageAccountName".
+     */
+    // "storageEndpoint": "http://127.0.0.1:10000/devstoreaccount1",
+
     /**
      * An optional prefix for cache item blob names.
      */
diff --git a/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts b/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
new file mode 100644
index 0000000000..189a1747d8
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
@@ -0,0 +1,102 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { BuildCacheConfiguration } from '../BuildCacheConfiguration';
+import { EnvironmentConfiguration, EnvironmentVariableNames } from '../EnvironmentConfiguration';
+import { RushConfiguration } from '../RushConfiguration';
+import { RushSession, type CloudBuildCacheProviderFactory } from '../../pluginFramework/RushSession';
+import type { ICloudBuildCacheProvider } from '../../logic/buildCache/ICloudBuildCacheProvider';
+
+type FactoryMock = jest.Mock<
+  ReturnType<CloudBuildCacheProviderFactory>,
+  Parameters<CloudBuildCacheProviderFactory>
+>;
+
+const OVERRIDE_JSON_VARIABLE: string = EnvironmentVariableNames.RUSH_BUILD_CACHE_OVERRIDE_JSON;
+const AZURE_CACHE_PROVIDER: string = 'azure-blob-storage';
+const STORAGE_ENDPOINT: string = 'http://127.0.0.1:10000/devstoreaccount1';
+
+describe(BuildCacheConfiguration.name, () => {
+  const originalOverrideJson: string | undefined = process.env[OVERRIDE_JSON_VARIABLE];
+  let rushConfiguration: RushConfiguration;
+  let factory: FactoryMock;
+
+  beforeAll(() => {
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(`${__dirname}/repo/rush-npm.json`);
+  });
+
+  beforeEach(() => {
+    const cloudCacheProvider: ICloudBuildCacheProvider = {} as ICloudBuildCacheProvider;
+    factory = jest.fn<ReturnType<CloudBuildCacheProviderFactory>, Parameters<CloudBuildCacheProviderFactory>>(
+      () => cloudCacheProvider
+    );
+  });
+
+  afterEach(() => {
+    if (originalOverrideJson === undefined) {
+      delete process.env[OVERRIDE_JSON_VARIABLE];
+    } else {
+      process.env[OVERRIDE_JSON_VARIABLE] = originalOverrideJson;
+    }
+    EnvironmentConfiguration.reset();
+  });
+
+  async function tryLoadAzureConfigurationAsync(
+    azureBlobStorageConfiguration: Record<string, unknown>
+  ): Promise<BuildCacheConfiguration | undefined> {
+    process.env[OVERRIDE_JSON_VARIABLE] = JSON.stringify({
+      buildCacheEnabled: true,
+      cacheProvider: AZURE_CACHE_PROVIDER,
+      azureBlobStorageConfiguration
+    });
+    EnvironmentConfiguration.reset();
+
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const rushSession: RushSession = new RushSession({ terminalProvider, getIsDebugMode: () => false });
+    rushSession.registerCloudBuildCacheProviderFactory(AZURE_CACHE_PROVIDER, factory);
+
+    return await BuildCacheConfiguration.tryLoadAsync(
+      new Terminal(terminalProvider),
+      rushConfiguration,
+      rushSession
+    );
+  }
+
+  it('passes azureBlobStorageConfiguration.storageEndpoint to the cloud cache provider', async () => {
+    const configuration: BuildCacheConfiguration | undefined = await tryLoadAzureConfigurationAsync({
+      storageAccountName: 'example',
+      storageContainerName: 'build-cache',
+      storageEndpoint: STORAGE_ENDPOINT
+    });
+
+    expect(configuration?.buildCacheEnabled).toBe(true);
+    expect(factory).toHaveBeenCalledTimes(1);
+    expect(factory.mock.calls[0][0]).toMatchObject({
+      azureBlobStorageConfiguration: { storageEndpoint: STORAGE_ENDPOINT }
+    });
+  });
+
+  it('rejects a property that azureBlobStorageConfiguration does not define', async () => {
+    await expect(
+      tryLoadAzureConfigurationAsync({
+        storageAccountName: 'example',
+        storageContainerName: 'build-cache',
+        storageEndpointUrl: STORAGE_ENDPOINT
+      })
+    ).rejects.toThrow(/must NOT have additional properties: storageEndpointUrl/);
+    expect(factory).not.toHaveBeenCalled();
+  });
+
+  it('rejects a storageEndpoint that is not a URI', async () => {
+    await expect(
+      tryLoadAzureConfigurationAsync({
+        storageAccountName: 'example',
+        storageContainerName: 'build-cache',
+        storageEndpoint: '127.0.0.1 port 10000'
+      })
+    ).rejects.toThrow(/#\/azureBlobStorageConfiguration\/storageEndpoint\s+must match format "uri"/);
+    expect(factory).not.toHaveBeenCalled();
+  });
+});
diff --git a/libraries/rush-lib/src/schemas/build-cache.schema.json b/libraries/rush-lib/src/schemas/build-cache.schema.json
index 2c7e8fd696..8029a685a6 100644
--- a/libraries/rush-lib/src/schemas/build-cache.schema.json
+++ b/libraries/rush-lib/src/schemas/build-cache.schema.json
@@ -71,6 +71,11 @@
               "description": "The Azure environment the storage account exists in. Defaults to AzurePublicCloud.",
               "enum": ["AzurePublicCloud", "AzureChina", "AzureGermany", "AzureGovernment"]
             },
+            "storageEndpoint": {
+              "type": "string",
+              "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
+              "format": "uri"
+            },
             "loginFlow": {
               "$ref": "#/definitions/entraLoginFlow"
             },

From 3c0d3d993651f97d1330fa6ca69ac1d91565032d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 01:51:44 +0000
Subject: [PATCH 055/265] [rush-daemon] A lingering daemon logs its PID and
 stop time, without a stack

Swarm integration step 40; original commit 86fc1ff37e (merge of swarm/r01-t147-nit at 7a76edd6ef).
Scope: task 147 NITs.

Brings r01's fix for the NITs in t05 board 2608 and o04 board 2632 (board 2814): the report is a timestamped log line through onLog, not an error with frames. t05 read the delta (board 2832), and r01's run through the real entry point is board 2851. ch01 on the final tree: build rc 0 with 0 warnings, rush-daemon 629/0, 7 of 7 mutants killed.

s16 batch A, item 5 of 5 (ch01 board 2867).

Gate: ch01 GATE OK board 2867 (tree d3a1eb9dbc)

Commits folded into this step (1):
- 7a76edd6ef rushd: a lingering daemon logs its PID and stop time, without a stack (task 147 NITs)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../r01-exit-after-stop_2026-09-28-23-45.json |  2 +-
 libraries/rush-daemon/src/serveRushDaemon.ts  | 36 ++++++---
 .../src/test/DaemonProcessExit.test.ts        | 77 ++++++++++++++-----
 .../src/test/fixtures/LingeringDaemon.ts      | 35 ++++++---
 4 files changed, 109 insertions(+), 41 deletions(-)

diff --git a/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json b/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json
index 9596f945ac..3439a48aaf 100644
--- a/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json
+++ b/common/changes/@rushstack/rush-daemon/r01-exit-after-stop_2026-09-28-23-45.json
@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@rushstack/rush-daemon",
-      "comment": "A daemon that owns its process now exits 2 seconds after it stops if something else, such as a timer that a plugin left behind, keeps the process running after the daemon released its socket and lockfile. It reports the active resources that Node.js lists and keeps `process.exitCode`. Reports that come right before the daemon exits are now written synchronously when no `onError` callback is given.",
+      "comment": "A daemon that owns its process now exits 2 seconds after it stops if something else, such as a timer that a plugin left behind, keeps the process running after the daemon released its socket and lockfile. It writes its PID, the time it stopped and the active resources that Node.js lists to the daemon log (`onLog`), and keeps `process.exitCode`. It does not wait for uploads that a plugin's `flushTelemetry` hook started, so an upload that is still running then is cut off. An embedded daemon (`shutdownSignal`) never exits the process. Messages that come right before the daemon exits are now written synchronously when no `onError` or `onLog` callback is given.",
       "type": "patch"
     }
   ],
diff --git a/libraries/rush-daemon/src/serveRushDaemon.ts b/libraries/rush-daemon/src/serveRushDaemon.ts
index f47ff7c194..bc3e2d4781 100644
--- a/libraries/rush-daemon/src/serveRushDaemon.ts
+++ b/libraries/rush-daemon/src/serveRushDaemon.ts
@@ -24,7 +24,9 @@ export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
    * clean shutdown, and {@link IRushDaemonHostOptions.shutdownDeadlineMs} defaults to 10 seconds. If the shutdown
    * does not finish by then, or another signal arrives first, the daemon reports why, releases what it safely can
    * and exits the process with code 1. Once it stops, if something else keeps the process running for 2 seconds,
-   * it reports the active resources that Node.js lists and exits the process, keeping `process.exitCode`.
+   * it writes its PID, when it stopped and the active resources that Node.js lists to the daemon log
+   * ({@link IRushDaemonHostOptions.onLog}, or stderr without it) and exits the process, keeping
+   * `process.exitCode`. An embedded daemon never exits the process.
    */
   readonly shutdownSignal?: AbortSignal;
 }
@@ -138,17 +140,18 @@ function exitAfterShutdownDeadline(
 
 /**
  * Exits the process {@link EXIT_AFTER_STOP_MS} after the daemon stopped serving, if it is still running then, and
- * reports what kept it running. The timer does not keep the process running itself. `process.exit()` keeps an exit
+ * logs what kept it running. The timer does not keep the process running itself. `process.exit()` keeps an exit
  * code that the caller set, and the 'exit' hook of SubprocessTerminator kills the child processes that it still
  * tracks. A successor daemon is not one of them: it is started detached and untracked.
  */
 function exitIfStillRunning(options: IRushDaemonServeOptions): void {
+  const stoppedAt: string = new Date().toISOString();
   setTimeout(() => {
-    reportBeforeExit(
-      new Error(
-        `The Rush daemon stopped, but something kept its process running for ${EXIT_AFTER_STOP_MS / 1000} s, ` +
-          `so it exits now. Active resources that Node.js reports: ${describeActiveResources()}.`
-      ),
+    // Not a failure, so no stack. The log is shared by every daemon of the workspace, hence the PID and the time.
+    logBeforeExit(
+      `rushd (PID ${process.pid}) stopped at ${stoppedAt}, but something kept its process running for ` +
+        `${EXIT_AFTER_STOP_MS / 1000} s, so it exits now. Active resources that Node.js reports: ` +
+        `${describeActiveResources()}.`,
       options
     );
     process.exit();
@@ -168,16 +171,29 @@ function describeActiveResources(): string {
 }
 
 /**
- * Reports an error right before `process.exit()`. The report must be written synchronously: `process.emitWarning`
- * prints on the next tick, which never comes.
+ * Reports an error right before `process.exit()`. Without `onError`, the report is written synchronously:
+ * `process.emitWarning` prints on the next tick, which never comes.
  */
 function reportBeforeExit(report: Error, options: IRushDaemonServeOptions): void {
   if (options.onError) {
     options.onError(report);
     return;
   }
+  writeToStderrBeforeExit(report.stack ?? report.message);
+}
+
+/** Writes a message for the daemon log right before `process.exit()`, synchronously without `onLog`. */
+function logBeforeExit(message: string, options: IRushDaemonServeOptions): void {
+  if (options.onLog) {
+    options.onLog(message);
+    return;
+  }
+  writeToStderrBeforeExit(message);
+}
+
+function writeToStderrBeforeExit(text: string): void {
   try {
-    fs.writeSync(process.stderr.fd, `${report.stack ?? report.message}\n`);
+    fs.writeSync(process.stderr.fd, `${text}\n`);
   } catch {
     // The process exits either way.
   }
diff --git a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
index f05a509f7f..4e8a61ade3 100644
--- a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
@@ -10,7 +10,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
-import type { LeftBehind, Reporter } from './fixtures/LingeringDaemon';
+import type { LeftBehind, Ownership, Reporter } from './fixtures/LingeringDaemon';
 import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
 
 const FIXTURE_PATH: string = path.join(__dirname, 'fixtures', 'LingeringDaemon.js');
@@ -18,8 +18,10 @@ const POLL_INTERVAL_MS: number = 20;
 const START_TIMEOUT_MS: number = 15000;
 // Far beyond the 2 s after which the daemon exits anyway, and far below the test's timeout.
 const EXIT_TIMEOUT_MS: number = 8000;
+// Well past the 2 s after which a daemon that owns its process exits it.
+const EMBEDDED_WAIT_MS: number = 3000;
 const LINGER_REPORT: RegExp =
-  /The Rush daemon stopped, but something kept its process running for 2 s, so it exits now\. Active resources that Node\.js reports: [^\n]*\bTimeout\b/;
+  /rushd \(PID (\d+)\) stopped at (\S+), but something kept its process running for 2 s, so it exits now\. Active resources that Node\.js reports: [^\n]*\bTimeout\b/;
 
 interface IProcessExit {
   readonly code: number | undefined;
@@ -64,10 +66,10 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
     fs.rmSync(folder, { force: true, recursive: true });
   });
 
-  function startDaemon(leftBehind: LeftBehind, reporter: Reporter): IFixtureDaemon {
+  function startDaemon(leftBehind: LeftBehind, reporter: Reporter, ownership: Ownership): IFixtureDaemon {
     const child: ChildProcess = spawn(
       process.execPath,
-      [FIXTURE_PATH, repoRoot, controlFolder, leftBehind, reporter],
+      [FIXTURE_PATH, repoRoot, controlFolder, leftBehind, reporter, ownership],
       {
         // Like a daemon that rush-client launches: the leader of its own process group.
         detached: true,
@@ -115,8 +117,10 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
     }
   }
 
-  /** Resolves with the exit and how long after the daemon stopped it came. */
-  async function waitForExitAsync(fixture: IFixtureDaemon): Promise<IProcessExit & { afterStopMs: number }> {
+  /** Resolves with the exit, when the daemon stopped and how long after that the exit came. */
+  async function waitForExitAsync(
+    fixture: IFixtureDaemon
+  ): Promise<IProcessExit & { stoppedAtMs: number; afterStopMs: number }> {
     const { stoppedAtMs } = await waitForJsonAsync<{ stoppedAtMs: number }>(fixture, 'stopped.json');
     const timeout: AbortController = new AbortController();
     const exit: IProcessExit | undefined = await Promise.race([
@@ -130,24 +134,42 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
           `Its stderr:\n${fixture.getStderr()}`
       );
     }
-    return { ...exit, afterStopMs: Date.now() - stoppedAtMs };
+    return { ...exit, stoppedAtMs, afterStopMs: Date.now() - stoppedAtMs };
   }
 
-  it.each<[StopRoute, Reporter]>([
-    ['daemon stop', 'onError'],
-    ['SIGTERM', 'default']
+  /** Checks the report of what kept the process running: its PID, and the time the daemon stopped. */
+  function expectLingerReport(fixture: IFixtureDaemon, stoppedAtMs: number): void {
+    const match: RegExpExecArray | null = LINGER_REPORT.exec(fixture.getStderr());
+    if (!match) {
+      throw new Error(`The fixture did not report what kept it running. Its stderr:\n${fixture.getStderr()}`);
+    }
+    expect(Number(match[1])).toBe(fixture.process.pid);
+    // The daemon stopped, and then the fixture wrote stopped.json.
+    const reportedStopMs: number = Date.parse(match[2]);
+    expect(new Date(reportedStopMs).toISOString()).toBe(match[2]);
+    expect(reportedStopMs).toBeLessThanOrEqual(stoppedAtMs);
+    expect(stoppedAtMs - reportedStopMs).toBeLessThan(1000);
+  }
+
+  it.each<[StopRoute, Reporter, RegExp]>([
+    ['daemon stop', 'callbacks', /^fixture log: rushd \(PID /m],
+    ['SIGTERM', 'default', /^rushd \(PID /m]
   ])(
-    'exits 2 s after %s if a timer that it did not start keeps it running, and reports that through %s',
-    async (route: StopRoute, reporter: Reporter) => {
-      const fixture: IFixtureDaemon = startDaemon('timer', reporter);
+    'exits 2 s after %s if a timer that it did not start keeps it running, and logs that (%s)',
+    async (route: StopRoute, reporter: Reporter, reportLine: RegExp) => {
+      const fixture: IFixtureDaemon = startDaemon('timer', reporter, 'process');
       const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
       await stopAsync(fixture, paths, route);
 
-      const { code, signal, afterStopMs } = await waitForExitAsync(fixture);
+      const { code, signal, stoppedAtMs, afterStopMs } = await waitForExitAsync(fixture);
       expect({ code, signal }).toEqual({ code: 0, signal: undefined });
       expect(afterStopMs).toBeGreaterThanOrEqual(1900);
       expect(afterStopMs).toBeLessThan(3000);
-      expect(fixture.getStderr()).toMatch(LINGER_REPORT);
+      expectLingerReport(fixture, stoppedAtMs);
+      // A message for the daemon log, through onLog when there is one: not an error, and no stack.
+      expect(fixture.getStderr()).toMatch(reportLine);
+      expect(fixture.getStderr().match(/rushd \(PID /g)).toHaveLength(1);
+      expect(fixture.getStderr()).not.toMatch(/fixture error: |Error: rushd|^\s+at /m);
       expect(fs.existsSync(paths.socketPath)).toBe(false);
       expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
     },
@@ -155,17 +177,34 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
   );
 
   it('keeps the exit code that its caller set when it failed', async () => {
-    const fixture: IFixtureDaemon = startDaemon('failing', 'onError');
+    const fixture: IFixtureDaemon = startDaemon('failing', 'callbacks', 'process');
 
-    const { code, signal, afterStopMs } = await waitForExitAsync(fixture);
+    const { code, signal, stoppedAtMs, afterStopMs } = await waitForExitAsync(fixture);
     expect({ code, signal }).toEqual({ code: 1, signal: undefined });
     expect(afterStopMs).toBeGreaterThanOrEqual(1900);
     expect(fixture.getStderr()).toMatch(/The fixture failed after it started\./);
-    expect(fixture.getStderr()).toMatch(LINGER_REPORT);
+    expectLingerReport(fixture, stoppedAtMs);
+  }, 30000);
+
+  it('never exits the process when it is embedded, even if a timer keeps the process running', async () => {
+    const fixture: IFixtureDaemon = startDaemon('timer', 'callbacks', 'embedded');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    await stopAsync(fixture, paths, 'daemon stop');
+    await waitForJsonAsync<{ stoppedAtMs: number }>(fixture, 'stopped.json');
+
+    await delayAsync(EMBEDDED_WAIT_MS);
+    // afterEach ends the fixture process, which only its own timer keeps running now.
+    expect({ code: fixture.process.exitCode, signal: fixture.process.signalCode }).toEqual({
+      code: null,
+      signal: null
+    });
+    expect(fixture.getStderr()).not.toMatch(/kept its process running/);
+    expect(fs.existsSync(paths.socketPath)).toBe(false);
+    expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
   }, 30000);
 
   it('exits as soon as it stops if nothing keeps it running', async () => {
-    const fixture: IFixtureDaemon = startDaemon('nothing', 'onError');
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'callbacks', 'process');
     const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
     await stopAsync(fixture, paths, 'daemon stop');
 
diff --git a/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts b/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
index 5da51032d0..ef8ddd62b5 100644
--- a/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
+++ b/libraries/rush-daemon/src/test/fixtures/LingeringDaemon.ts
@@ -15,10 +15,18 @@ import { TemporaryRepoWorkspaceSession } from '../TemporaryRepoWorkspaceSession'
 export type LeftBehind = 'timer' | 'failing' | 'nothing';
 
 /**
- * - `onError`: reports through `onError`, as the Rush daemon's own entry points do.
- * - `default`: no `onError`.
+ * - `callbacks`: passes `onError` and `onLog`, as the Rush daemon's own entry points do. Each one writes with its
+ *   own prefix, `fixture error: ` or `fixture log: `, so that a test can tell the paths apart.
+ * - `default`: neither.
  */
-export type Reporter = 'onError' | 'default';
+export type Reporter = 'callbacks' | 'default';
+
+/**
+ * - `process`: no `shutdownSignal`, so the daemon owns its process and handles SIGINT and SIGTERM itself.
+ * - `embedded`: the fixture passes a `shutdownSignal` that it never aborts. It owns the process, and the daemon
+ *   stops only when a client stops it.
+ */
+export type Ownership = 'process' | 'embedded';
 
 function writeJson(filename: string, value: unknown): void {
   fs.writeFileSync(`${filename}.tmp`, JSON.stringify(value));
@@ -37,25 +45,30 @@ function onReady(leftBehind: LeftBehind, controlFolder: string): IRushDaemonServ
   };
 }
 
+function getReporterOptions(reporter: Reporter): Pick<IRushDaemonServeOptions, 'onError' | 'onLog'> {
+  if (reporter === 'default') return {};
+  return {
+    onError: (error: Error) => process.stderr.write(`fixture error: ${error.stack ?? error.message}\n`),
+    onLog: (message: string) => process.stderr.write(`fixture log: ${message}\n`)
+  };
+}
+
 async function runAsync(): Promise<void> {
-  const [repoRoot, controlFolder, leftBehind, reporter] = process.argv.slice(2);
-  if (!repoRoot || !controlFolder || !leftBehind || !reporter) {
+  const [repoRoot, controlFolder, leftBehind, reporter, ownership] = process.argv.slice(2);
+  if (!repoRoot || !controlFolder || !leftBehind || !reporter || !ownership) {
     throw new Error(
-      'The fixture needs a repository folder, a control folder, what it leaves behind and a reporter.'
+      'The fixture needs a repository, a control folder, what it leaves behind, a reporter and an owner.'
     );
   }
   try {
-    // Process mode: no shutdownSignal, so the daemon handles SIGINT and SIGTERM itself.
     await serveRushDaemonAsync({
       repoRoot,
       rushVersion: '5.178.1',
       daemonVersion: 'lingering-fixture',
       createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
       onReady: onReady(leftBehind as LeftBehind, controlFolder),
-      onError:
-        (reporter as Reporter) === 'onError'
-          ? (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`)
-          : undefined
+      ...getReporterOptions(reporter as Reporter),
+      shutdownSignal: (ownership as Ownership) === 'embedded' ? new AbortController().signal : undefined
     });
   } finally {
     writeJson(path.join(controlFolder, 'stopped.json'), { stoppedAtMs: Date.now() });

From 7c93aea35098163476ee8cc19d996582ff80c2ba Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 02:37:43 +0000
Subject: [PATCH 056/265] [rush-cli-client] The client prints a cancelling line
 at once, agent output shows an operation's error after its own output, and a
 cancelled request reports never-started operations as not run

Swarm integration step 41; original commit cba3c1f17b (merge of swarm/r04-t132-153-int at 4b495d5f81).
Scope: tasks 132, 142 and 153.

Brings r04's tasks 132 (after Ctrl-C, SIGTERM or SIGHUP during a daemon request the client prints one line at once, plus a notice when the daemon doesn't confirm), 142 (agent output prints a failed operation's error even when the operation wrote output first) and 153 (a cancelled request no longer reports never-started operations with an earlier request's result), re-tipped on d87702c813. Second agents: t05 board 2323 (132), t07 board 2623 (142), t05 board 2524 (153). ch01's e2e on ch01-sB: the cancelling line and the unconfirmed notice appear, and c is reported aborted, not SUCCESS.

s16 batch B, item 1 of 5 (ch01 board 2984).

Gate: ch01 GATE OK board 2984 (tree 6453dd938e)

Commits folded into this step (3):
- 85ed03e693 Say at once that a cancelled request waits for rushd to stop it (task 132)
- 892c1592eb Print a failed operation's error even after its output in agent output (task 142)
- 52b9d3fe3b Report never-started operations of a cancelled request as aborted (task 153)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  14 +-
 .../src/AgentProgressRenderer.ts              | 122 ++++++++--
 .../rush-cli-client/src/clientCancellation.ts |  21 +-
 apps/rush-cli-client/src/launchClient.ts      |  36 ++-
 .../src/test/AgentProgressRenderer.test.ts    | 175 +++++++++++++++
 .../src/test/cancellationNotice.test.ts       | 212 ++++++++++++++++++
 .../test/persistentIpcCancellation.test.ts    |   8 +-
 ...4-t132-cancel-notice_2026-09-28-22-10.json |  11 +
 ...t142-operation-error_2026-09-28-22-50.json |  11 +
 ...4-t132-cancel-notice_2026-09-28-22-10.json |  11 +
 ...-t153-cancel-results_2026-09-28-23-20.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   1 +
 .../rush-client-core/src/DaemonClient.ts      |  10 +-
 .../src/test/DaemonClient.test.ts             |  56 ++++-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  24 +-
 .../test/PhasedRequestCancellation.test.ts    | 203 ++++++++++++++++-
 16 files changed, 871 insertions(+), 55 deletions(-)
 create mode 100644 apps/rush-cli-client/src/test/cancellationNotice.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t142-operation-error_2026-09-28-22-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t153-cancel-results_2026-09-28-23-20.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index e83a16ca03..12c589e650 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -156,11 +156,15 @@ error count that the shown errors account for, and, when the first error shown n
 location, the lines before it. Up to three operations are reported. Two kinds are reported just
 before the summary line instead: a failed operation that wrote no output, with the error from the
 daemon's result, and, when no operation failed, the operations whose warnings failed the request
-(`warnings: …`). On a pipe, a status line names a failed operation that wrote no output 1 s after
-it failed, unless the result came first. The summary line names up to five failed (or warning)
-operations. Every operation's full output is in its project's `rush-logs/` folder, whether or not
-it was printed. When a request falls back to in-process Rush, agent mode stops and native output
-follows.
+(`warnings: …`). The error of a reported operation that wrote output is printed too, unless its
+excerpt shows it or it only gives the exit code (`Returned error code: 1`): for example an error
+thrown while the operation's build cache entry was restored. Only the daemon's result carries it,
+so for an operation reported as it failed it comes just before the summary line, as an
+`error: <operation>` line followed by the error. On a pipe, a status line names a failed
+operation that wrote no output 1 s after it failed, unless the result came first. The summary
+line names up to five failed (or warning) operations. Every operation's full output is in its
+project's `rush-logs/` folder, whether or not it was printed. When a request falls back to
+in-process Rush, agent mode stops and native output follows.
 
 In agent mode a failed `rush build` doesn't wait for all of its work. Its result comes once an
 operation failed and none of the selected projects that no other selected project depends on (for
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index faa7918fca..d73665441f 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -33,6 +33,8 @@ const PIPE_STATUS_INTERVAL_MS: number = 25_000;
 const PIPE_UNREPORTED_FAILURE_DELAY_MS: number = 1_000;
 const SENT_PHASE: string = 'sent to rushd; preparing the workspace graph';
 const STARTING_PHASE: string = 'rushd is still starting; waiting for it';
+/** Ends the summary line of a cancelled request when the client stopped waiting before rushd confirmed the stop. */
+const UNCONFIRMED_STOP: string = 'rushd did not confirm that the request stopped; it may still be stopping';
 const FAILURE_STATUS: string = 'FAILURE';
 const TTY_INTERVAL_MS: number = 100;
 /** The most failed (or warning) operations whose output excerpt is printed. */
@@ -51,6 +53,14 @@ const MAX_MESSAGE_LENGTH: number = 300;
  */
 const ERROR_DETAIL_HEAD_LINES: number = 2;
 const ERROR_DETAIL_TAIL_LINES: number = 5;
+/**
+ * The error of an operation whose process exited with a nonzero code. It says nothing that the operation's output
+ * does not, so it is printed only for an operation that wrote no output.
+ */
+const EXIT_CODE_ERROR_PATTERN: RegExp = /^Returned error code: \d+$/;
+/** How much of an operation error's first line is looked for in the output shown for it, which clips long lines. */
+const SHOWN_ERROR_KEY_LENGTH: number = 100;
+const WHITESPACE_PATTERN: RegExp = /\s+/g;
 /**
  * Summary labels that differ from the native status name. A daemon reports an operation that is unchanged since
  * it last ran as `NO OP` (when no operation in the iteration had to run) or as `SKIPPED`; both mean up to date.
@@ -90,6 +100,11 @@ export interface IAgentFinalResult {
   readonly errorMessage?: string;
   /** Whether the command was cancelled (for example with Ctrl+C); reported as `CANCELLED`, not `FAILURE`. */
   readonly cancelled?: boolean;
+  /**
+   * For a cancelled command: the client stopped waiting before rushd confirmed that the request stopped, so it may
+   * still be stopping.
+   */
+  readonly stopUnconfirmed?: boolean;
   /** The daemon's final operation results, which may report statuses that no event carried. */
   readonly operationResults?: ReadonlyArray<IAgentOperationResult>;
   /** Why the daemon did not admit the request, if it did not. */
@@ -122,6 +137,37 @@ function getErrorDetail(lines: ReadonlyArray<string>): string[] {
   ];
 }
 
+function getMatchKey(line: string): string {
+  return line.replace(WHITESPACE_PATTERN, ' ').trim().toLowerCase();
+}
+
+/**
+ * The lines that report a failed operation's error from the daemon's result, given the lines already shown for
+ * the operation: its first line, then its further lines as for a request's error. None when the lines shown
+ * include the error's first line, or when the error only gives the exit code of a process that wrote output.
+ */
+function getOperationErrorLines(
+  errorMessage: string | undefined,
+  shownLines: ReadonlyArray<string>
+): string[] {
+  const [firstLine, ...detail] = (errorMessage ?? '')
+    .split('\n')
+    .map((line) => line.trimEnd())
+    .filter((line) => line.trim());
+  if (firstLine === undefined) {
+    return [];
+  }
+  const message: string = firstLine.trim();
+  const key: string = getMatchKey(message).slice(0, SHOWN_ERROR_KEY_LENGTH);
+  if (
+    (shownLines.length && EXIT_CODE_ERROR_PATTERN.test(message)) ||
+    shownLines.some((line) => getMatchKey(line).includes(key))
+  ) {
+    return [];
+  }
+  return [message, ...getErrorDetail(detail)].map((line) => clipLine(line, MAX_MESSAGE_LENGTH));
+}
+
 /**
  * Compact progress for agents on the daemon path: at most three live rows (TTY) or one line when the request is
  * sent (pipes), each failed operation's log file and a short excerpt of its output as soon as it fails, and a
@@ -131,11 +177,14 @@ function getErrorDetail(lines: ReadonlyArray<string>): string[] {
  * On a pipe, a request that takes less than 25 s writes the line that says it was sent, its failures and its
  * summary line, and nothing else. Status lines keep a longer request from looking hung: whenever nothing was
  * written for 25 s, a status line with the counts and the running operations follows, and a connection that
- * takes longer than 10 s gets one. A wait for a daemon that is still starting also gets a line, once. Only the
- * first three failed operations are reported. Whether warnings fail the request is only known at its end, so
- * operations with warnings are reported before the summary line; so is a failed operation that wrote no output,
- * whose error only the daemon's result carries. On a pipe, the next status line, which names that operation, is
- * then due 1 s after it failed, so that a result that the daemon returns early can come first and make it moot.
+ * takes longer than 10 s gets one. A wait for a daemon that is still starting also gets a line, once, and so
+ * does a cancellation, as soon as the client asks rushd to stop the request. Only the first three failed
+ * operations are reported. Whether warnings fail the request is only known at its end, so operations with
+ * warnings are reported before the summary line; so is a failed operation that wrote no output, whose error
+ * only the daemon's result carries. On a pipe, the next status line, which names that operation, is then due
+ * 1 s after it failed, so that a result that the daemon returns early can come first and make it moot. An error
+ * that the output shown for a reported operation leaves out, for example one thrown while its build cache entry
+ * was restored, is written before the summary line too, as `error: <operation>` and the error.
  */
 export class AgentProgressRenderer {
   readonly #options: IAgentProgressRendererOptions;
@@ -143,8 +192,8 @@ export class AgentProgressRenderer {
   readonly #startTimeMs: number;
   readonly #tracker: AgentOperationTracker = new AgentOperationTracker();
   readonly #notices: AgentNotices = new AgentNotices();
-  /** The operations whose log file and excerpt were written, in that order. */
-  readonly #reported: Set<string> = new Set();
+  /** The operations whose log file and excerpt were written, in that order, with the output lines shown for each. */
+  readonly #reported: Map<string, ReadonlyArray<string>> = new Map();
   #lastActivity: string = '';
   #phase: string = 'connecting to rushd (auto-starts if needed)';
   #painted: number = 0;
@@ -159,6 +208,8 @@ export class AgentProgressRenderer {
   /** The first queue position, for the summary line. */
   #firstQueued: IQueuePosition | undefined;
   #stopped: boolean = false;
+  /** The client asked rushd to cancel the request; the progress line says so until the end. */
+  #cancelling: boolean = false;
   /** On a pipe: an operation that wrote no output failed, and no line has named it yet. */
   #unnamedFailure: boolean = false;
   /** The error message that the summary line contains in full, once written. */
@@ -190,7 +241,7 @@ export class AgentProgressRenderer {
   }
 
   public setPhase(phase: string): void {
-    if (phase === this.#phase) {
+    if (phase === this.#phase || this.#cancelling) {
       return;
     }
     this.#phase = phase;
@@ -248,6 +299,22 @@ export class AgentProgressRenderer {
     this.setPhase(`queued behind another request (position ${position})`);
   }
 
+  /**
+   * The client asked rushd to cancel the request, and waits up to `timeoutMs` for rushd to stop it, which can take
+   * seconds while rushd prepares the workspace graph. Says so at once, and on a TTY until the end; on a pipe, in one
+   * line.
+   */
+  public onCancelRequested(timeoutMs: number): void {
+    if (this.#cancelling) {
+      return;
+    }
+    this.setPhase(`cancelling; waiting up to ${Math.round(timeoutMs / 1000)}s for rushd to stop the request`);
+    this.#cancelling = true;
+    if (!this.#options.isTTY) {
+      this.#writePipeLine(this.#rows()[0]);
+    }
+  }
+
   public onEvent(event: IDaemonEventEnvelope): void {
     if (this.#stopped) {
       return;
@@ -277,8 +344,7 @@ export class AgentProgressRenderer {
         this.#notices.add(payload, event.scope?.operationId);
         if (typeof payload.text === 'string' && payload.text.trim()) {
           this.#lastActivity = payload.text.trim().split('\n')[0];
-          this.#phase = 'running';
-          this.#queued = undefined;
+          this.#onRunning();
         }
         break;
       }
@@ -329,6 +395,8 @@ export class AgentProgressRenderer {
     let summary: string = this.#getSummaryLine(verdict, emptySelection);
     if (verdict === 'FAILURE') {
       summary += formatUnfinishedOperations(result?.operationResults);
+    } else if (verdict === 'CANCELLED' && result?.stopUnconfirmed) {
+      summary += ` · ${UNCONFIRMED_STOP}`;
     }
     // An admission failure says that the request waited, and why it stopped waiting.
     if (this.#firstQueued && !result?.admissionErrorCode) {
@@ -370,18 +438,25 @@ export class AgentProgressRenderer {
       status,
       logFilePath: typeof logFilePath === 'string' ? logFilePath : undefined
     });
-    this.#phase = 'running';
-    this.#queued = undefined;
+    this.#onRunning();
     if (status === FAILURE_STATUS) {
       this.#reportFailure(operationId);
     }
   }
 
+  /** The request runs, so it no longer waits in a queue. The phase says so, unless the request is being cancelled. */
+  #onRunning(): void {
+    if (!this.#cancelling) {
+      this.#phase = 'running';
+    }
+    this.#queued = undefined;
+  }
+
   /**
    * Writes a failed operation's log file and output excerpt as soon as it fails, while the rest of the request
    * runs on. The operation's output all arrived before its status. An operation that wrote nothing is left to
    * the failure report, which has the error from the daemon's result; on a pipe, the next status line names it
-   * sooner.
+   * sooner. The error of an operation reported here follows with the failure report, if the excerpt lacks it.
    */
   #reportFailure(operationId: string): void {
     if (this.#stopped || this.#reported.has(operationId) || this.#reported.size >= MAX_REPORTED_OPERATIONS) {
@@ -442,7 +517,8 @@ export class AgentProgressRenderer {
    * The log file and output excerpt of each failed operation not yet reported. Without failed operations:
    * operations with warnings (they fail a build unless the command allows warnings), or else output that belongs
    * to no operation. A cancelled command reports only failed operations. At most three operations are reported
-   * in all, with the operations reported as they failed.
+   * in all, with the operations reported as they failed. The daemon's result carries the error of each failed
+   * operation, so an operation reported as it failed gets its error here, unless the output shown for it had it.
    */
   #getFailureReport(verdict: Verdict): string[] {
     const tracker: AgentOperationTracker = this.#tracker;
@@ -457,7 +533,12 @@ export class AgentProgressRenderer {
     const lines: string[] = [];
     let hidden: number = 0;
     for (const problem of problems) {
-      if (this.#reported.has(problem.operationId)) {
+      const shownLines: ReadonlyArray<string> | undefined = this.#reported.get(problem.operationId);
+      if (shownLines) {
+        const errorLines: string[] = getOperationErrorLines(problem.errorMessage, shownLines);
+        if (errorLines.length) {
+          lines.push(`error: ${problem.operationId}`, ...errorLines.map((line) => `  ${line}`));
+        }
         continue;
       }
       if (this.#reported.size < MAX_REPORTED_OPERATIONS) {
@@ -475,21 +556,20 @@ export class AgentProgressRenderer {
 
   /**
    * An operation's report: its log file, then its output excerpt, which is longer for the first reported
-   * operation (most often the root cause). Records that the operation was reported.
+   * operation (most often the root cause), then its error from the daemon's result, if known and not shown
+   * already. Records that the operation was reported, and the lines shown for it.
    */
   #getProblemLines(label: string, problem: IAgentProblemOperation): string[] {
     const maxLines: number = this.#reported.size
       ? OTHER_OPERATION_EXCERPT_LINES
       : FIRST_OPERATION_EXCERPT_LINES;
-    this.#reported.add(problem.operationId);
     const excerpt: string[] = problem.excerpt?.getExcerpt(maxLines) ?? [];
-    if (!excerpt.length && problem.errorMessage) {
-      excerpt.push(clipLine(problem.errorMessage.trim().split('\n')[0], MAX_MESSAGE_LENGTH));
-    }
+    const shownLines: string[] = [...excerpt, ...getOperationErrorLines(problem.errorMessage, excerpt)];
+    this.#reported.set(problem.operationId, shownLines);
     const logFile: string = problem.logFilePath ? ` · full log: ${problem.logFilePath}` : '';
     return [
       `${label}: ${problem.operationId}${logFile}`,
-      ...(excerpt.length ? excerpt : ['(no output)']).map((line) => `  ${line}`)
+      ...(shownLines.length ? shownLines : ['(no output)']).map((line) => `  ${line}`)
     ];
   }
 
diff --git a/apps/rush-cli-client/src/clientCancellation.ts b/apps/rush-cli-client/src/clientCancellation.ts
index f3a2102bff..3cd5648516 100644
--- a/apps/rush-cli-client/src/clientCancellation.ts
+++ b/apps/rush-cli-client/src/clientCancellation.ts
@@ -18,9 +18,24 @@ export function getSignalExitCode(signal: NodeJS.Signals): number {
   return SIGNAL_EXIT_CODE_BASE + (os.constants.signals[signal] ?? os.constants.signals.SIGINT);
 }
 
-/** Formats the notice printed when a daemon-routed command is cancelled. */
-export function formatCancellationMessage(commandName: string): string {
-  return `rush-client: ${commandName} cancelled.\n`;
+/**
+ * Formats the notice printed as soon as the client asks the daemon to cancel a daemon-routed command, which can take
+ * the daemon seconds, for example while it prepares the workspace graph.
+ */
+export function formatCancellingMessage(commandName: string, timeoutMs: number): string {
+  const seconds: number = Math.round(timeoutMs / 1000);
+  return `rush-client: cancelling ${commandName}; waiting up to ${seconds} s for rushd to stop the request.\n`;
+}
+
+/**
+ * Formats the notice printed when a daemon-routed command is cancelled. `stopUnconfirmed` says that the client
+ * stopped waiting before the daemon confirmed that the request stopped.
+ */
+export function formatCancellationMessage(commandName: string, stopUnconfirmed: boolean = false): string {
+  return stopUnconfirmed
+    ? `rush-client: ${commandName} cancelled, but rushd did not confirm that the request stopped; ` +
+        'it may still be stopping.\n'
+    : `rush-client: ${commandName} cancelled.\n`;
 }
 
 /**
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 9bd42f0ae0..095ea16714 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -29,6 +29,7 @@ import type { AgentProgressRenderer } from './AgentProgressRenderer';
 import {
   CANCELLATION_SIGNALS,
   formatCancellationMessage,
+  formatCancellingMessage,
   getSignalExitCode,
   isCancelledOutcome
 } from './clientCancellation';
@@ -173,12 +174,27 @@ export async function launchClientAsync(
     return;
   }
   const abort: AbortController = new AbortController();
+  const commandName: string = route.commandName;
   let cancellationSignal: NodeJS.Signals | undefined;
+  // Whether the client asked the daemon to cancel the request: after a signal, or a raw Ctrl+C, which raises none.
+  let cancelRequested: boolean = false;
   // Windows test harnesses emit signals without a name; treat those as Ctrl+C.
   const onSignal = (signal?: NodeJS.Signals): void => {
     cancellationSignal ??= signal ?? 'SIGINT';
     abort.abort();
   };
+  const onCancelRequested = (timeoutMs: number): void => {
+    cancelRequested = true;
+    if (agentRenderer) {
+      agentRenderer.onCancelRequested(timeoutMs);
+      return;
+    }
+    // After SIGHUP the terminal may be gone.
+    writeStreamAsync(process.stderr, Buffer.from(formatCancellingMessage(commandName, timeoutMs))).catch(
+      () => undefined
+    );
+  };
+  const isCancelled = (): boolean => abort.signal.aborted || cancelRequested;
   for (const signal of CANCELLATION_SIGNALS) process.on(signal, onSignal);
   const renderer: ClientOperationRenderer = new ClientOperationRenderer({
     requestId: request.requestId,
@@ -235,6 +251,7 @@ export async function launchClientAsync(
       stdin: process.stdin,
       requiresStdinEnd: !process.stdin.isTTY,
       cancelOnCtrlC: !!process.stdin.isTTY,
+      onCancelRequested,
       initialRawMode: !!process.stdin.isRaw,
       setRawMode: process.stdin.isTTY
         ? (enabled) => {
@@ -244,7 +261,7 @@ export async function launchClientAsync(
     });
   } catch (error) {
     // After cancellation, a transport failure (e.g. the cancellation deadline) still means "cancelled".
-    if (!abort.signal.aborted || !(error instanceof DaemonClientError)) throw error;
+    if (!isCancelled() || !(error instanceof DaemonClientError)) throw error;
     outcome = undefined;
   } finally {
     for (const signal of CANCELLATION_SIGNALS) process.removeListener(signal, onSignal);
@@ -254,18 +271,23 @@ export async function launchClientAsync(
       await client.closeAsync();
     }
   }
-  if (outcome === undefined || isCancelledOutcome(outcome, abort.signal.aborted)) {
+  if (outcome === undefined || isCancelledOutcome(outcome, isCancelled())) {
     const exitCode: number = getSignalExitCode(cancellationSignal ?? 'SIGINT');
+    // The client stopped waiting (at the cancellation deadline, or when the connection closed) before the daemon
+    // confirmed that the request stopped. The daemon also cancels a request whose client disconnects.
+    const stopUnconfirmed: boolean = outcome === undefined && cancelRequested;
     agentRenderer?.finish(
       outcome?.kind === 'result'
         ? { ...outcome.result, exitCode, cancelled: true }
-        : { exitCode, cancelled: true }
+        : { exitCode, cancelled: true, stopUnconfirmed }
     );
     process.exitCode = exitCode;
-    // After SIGHUP the terminal may be gone; the exit code is what matters.
-    await writeStreamAsync(process.stderr, Buffer.from(formatCancellationMessage(route.commandName))).catch(
-      () => undefined
-    );
+    // After SIGHUP the terminal may be gone; the exit code is what matters. Agent output's summary line already
+    // says whether the daemon confirmed the stop.
+    await writeStreamAsync(
+      process.stderr,
+      Buffer.from(formatCancellationMessage(commandName, stopUnconfirmed && !agentRenderer))
+    ).catch(() => undefined);
   } else if (outcome.kind === 'result') {
     // In agent mode the summary line may already carry the complete error message; do not repeat it.
     const reportedByAgent: boolean = agentRenderer?.finish(outcome.result) ?? false;
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index b8cfc5f1b9..9531de11f5 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -253,6 +253,61 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('says at once that it waits for rushd to stop a cancelled request, and whether rushd confirmed (task 132)', () => {
+    const confirmed: ITestRenderer = createRenderer(false);
+    confirmed.renderer.onEvent(registered('a (build)'));
+    confirmed.renderer.onEvent(status('a (build)', 'EXECUTING'));
+    confirmed.clock.ms = 7_600;
+    confirmed.renderer.onCancelRequested(5_000);
+    expect(confirmed.lines()).toEqual([
+      'rush build 0/1 · 7.6s · cancelling; waiting up to 5s for rushd to stop the request'
+    ]);
+    // Written once, and the operations that rushd stops do not make the request look as if it runs on.
+    confirmed.renderer.onCancelRequested(5_000);
+    confirmed.renderer.onEvent(status('a (build)', 'ABORTED'));
+    confirmed.clock.ms = 8_100;
+    confirmed.renderer.finish({ exitCode: 130, cancelled: true });
+    expect(confirmed.lines()).toEqual([
+      'rush build 0/1 · 7.6s · cancelling; waiting up to 5s for rushd to stop the request',
+      'rush build: CANCELLED 1/1 operations (1 aborted) in 8.1s'
+    ]);
+
+    const unconfirmed: ITestRenderer = createRenderer(false);
+    unconfirmed.renderer.onCancelRequested(5_000);
+    unconfirmed.clock.ms = 5_000;
+    unconfirmed.renderer.finish({ exitCode: 130, cancelled: true, stopUnconfirmed: true });
+    expect(unconfirmed.lines()).toEqual([
+      'rush build · 0.0s · cancelling; waiting up to 5s for rushd to stop the request',
+      'rush build: CANCELLED in 5.0s · rushd did not confirm that the request stopped; it may still be stopping'
+    ]);
+  });
+
+  it('keeps showing on a TTY that it cancels', () => {
+    jest.useFakeTimers();
+    try {
+      const { renderer, output } = createRenderer(true, 'build', 120);
+      const firstRow = (): string => output[output.length - 1].replace(ANSI_ESCAPE, '').split('\n')[0];
+      renderer.start();
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onCancelRequested(5_000);
+      // Repainted at once, rather than on the next tick of the timer.
+      expect(firstRow()).toBe(
+        '⠙ rush build 0/1 · 0.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      );
+      renderer.onEvent(status('a (build)', 'ABORTED'));
+      renderer.onQueuePosition(1);
+      jest.advanceTimersByTime(100);
+      // Neither the operation that rushd stopped nor a queue position makes the request look as if it runs on.
+      expect(firstRow()).toBe(
+        '⠹ rush build 1/1 · 0.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      );
+      renderer.dispose();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
   it('applies final statuses from the daemon result that no event reported', () => {
     const { renderer, lines } = createRenderer(false);
     const reason: string =
@@ -647,6 +702,126 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('prints the error of an operation reported as it failed, when its output lacks the error (task 142)', () => {
+    const { renderer, lines } = createRenderer(false);
+    const querying: string =
+      'This project was not found in the local build cache. Querying the cloud build cache.';
+    const sasError: string =
+      "An Azure Storage SAS credential hasn't been provided, or has expired. Update the credentials by " +
+      'running "rush update-cloud-credentials", or provide a SAS in the RUSH_BUILD_CACHE_CREDENTIAL ' +
+      'environment variable';
+    renderer.onEvent(registered('mini-a (build)'));
+    renderer.onEvent(registered('mini-b (build)'));
+    renderer.onEvent(status('mini-a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from(`${querying}\n`), 'mini-a (build)', 'stdout');
+    renderer.onEvent(status('mini-a (build)', 'FAILURE'));
+    renderer.onEvent(status('mini-b (build)', 'BLOCKED'));
+    expect(lines()).toEqual(['failed: mini-a (build)', `  ${querying}`]);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'mini-a (build)', status: 'FAILURE', errorMessage: `${sasError}\n` },
+        { operationId: 'mini-b (build)', status: 'BLOCKED' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: mini-a (build)',
+      `  ${querying}`,
+      'error: mini-a (build)',
+      `  ${sasError}`,
+      'rush build: FAILURE 2/2 operations (1 failure, 1 blocked) in 0.0s · failed: mini-a (build)'
+    ]);
+  });
+
+  it("prints a failed operation's error after its excerpt, with the further lines of a multi-line error", () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(registered('a (build)'));
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Restoring from the build cache\n'), 'a (build)', 'stdout');
+    const detail: string[] = Array.from({ length: 9 }, (unused, i) => `  detail ${i}`);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        {
+          operationId: 'a (build)',
+          status: 'FAILURE',
+          errorMessage: ['  Could not read the cache entry', ...detail].join('\r\n')
+        }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build)',
+      '  Restoring from the build cache',
+      '  Could not read the cache entry',
+      '    detail 0',
+      '    detail 1',
+      '  … 2 more lines …',
+      '    detail 4',
+      '    detail 5',
+      '    detail 6',
+      '    detail 7',
+      '    detail 8',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it("does not repeat a failed operation's error that its output shows, or the exit code of a process that wrote output", () => {
+    const { renderer, lines } = createRenderer(false);
+    const readiness: string = 'The explicit daemon Node tool exited without completing IPC readiness.';
+    fail(renderer, 'a (build)', ['src/a.ts:1:1 - error TS2322: a']);
+    fail(renderer, 'b (build)', [
+      `  The  explicit daemon node tool exited without completing IPC readiness.`
+    ]);
+    renderer.onEvent(status('c (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('c output\n'), 'c (build)', 'stderr');
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'a (build)', status: 'FAILURE', errorMessage: 'Returned error code: 2' },
+        { operationId: 'b (build)', status: 'FAILURE', errorMessage: readiness },
+        { operationId: 'c (build)', status: 'FAILURE', errorMessage: 'Returned error code: 127' }
+      ]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/x.log',
+      '  src/a.ts:1:1 - error TS2322: a',
+      'failed: b (build) · full log: /repo/b/rush-logs/x.log',
+      '  The  explicit daemon node tool exited without completing IPC readiness.',
+      'failed: c (build)',
+      '  c output',
+      'rush build: FAILURE 3/3 operations (3 failures) in 0.0s · failed: a (build), b (build), c (build)'
+    ]);
+  });
+
+  it('prints the signal that ended an operation, and clips a long error unless the output shows its start', () => {
+    const { renderer, lines } = createRenderer(false);
+    const long: string = `Cache entry rejected: ${'x'.repeat(400)}`;
+    const other: string = `Cache entry rejected: ${'y'.repeat(400)}`;
+    fail(renderer, 'a (build)', ['a output']);
+    fail(renderer, 'b (build)', [long]);
+    fail(renderer, 'c (build)', ['c output']);
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [
+        { operationId: 'a (build)', status: 'FAILURE', errorMessage: 'Terminated by signal: SIGKILL' },
+        { operationId: 'b (build)', status: 'FAILURE', errorMessage: long },
+        { operationId: 'c (build)', status: 'FAILURE', errorMessage: other }
+      ]
+    });
+    expect(lines()).toHaveLength(11);
+    expect(lines()[3]).toMatch(/^ {2}Cache entry rejected: x+…x+$/);
+    expect(lines().slice(6, 9)).toEqual([
+      'error: a (build)',
+      '  Terminated by signal: SIGKILL',
+      'error: c (build)'
+    ]);
+    expect(lines()[9]).toMatch(/^ {2}Cache entry rejected: y+…y+$/);
+    expect(lines()[9]).toHaveLength(2 + 300);
+    expect(lines()[10]).toBe(
+      'rush build: FAILURE 3/3 operations (3 failures) in 0.0s · failed: a (build), b (build), c (build)'
+    );
+  });
+
   it('reports at most three operations in all, as they failed or before the summary line', () => {
     const { renderer, lines } = createRenderer(false);
     fail(renderer, 'a (build)', ['a error']);
diff --git a/apps/rush-cli-client/src/test/cancellationNotice.test.ts b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
new file mode 100644
index 0000000000..aea86c74d0
--- /dev/null
+++ b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
@@ -0,0 +1,212 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient,
+  type DaemonClientOutcome,
+  type IDaemonClientExecuteOptions
+} from '@rushstack/rush-client-core';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+const CANCELLING: string =
+  'rush-client: cancelling build; waiting up to 5 s for rushd to stop the request.\n';
+const CANCELLED: string = 'rush-client: build cancelled.\n';
+const UNCONFIRMED: string =
+  'rush-client: build cancelled, but rushd did not confirm that the request stopped; it may still be stopping.\n';
+
+type Execution = (options: IDaemonClientExecuteOptions) => Promise<DaemonClientOutcome>;
+
+describe('the cancellation of a daemon request (task 132)', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let listenersBefore: Map<NodeJS.Signals, unknown[]>;
+  let stderr: string[];
+  /** What the client had written to stderr when the daemon heard of the cancellation. */
+  let stderrAtCancel: string[] | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-cancellation-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    listenersBefore = new Map(
+      (['SIGINT', 'SIGTERM'] as const).map((signal) => [signal, process.listeners(signal)])
+    );
+    stderr = [];
+    stderrAtCancel = undefined;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      stderr.push(Buffer.from(chunk).toString());
+      (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+      return true;
+    }) as typeof process.stderr.write);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: process.pid })
+    } as unknown as DaemonClient);
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  /** Delivers a signal to the listener that the client installed, without signalling the test process. */
+  function deliverSignal(name: 'SIGINT' | 'SIGTERM'): void {
+    const installed: unknown[] = process
+      .listeners(name)
+      .filter((listener) => !listenersBefore.get(name)!.includes(listener));
+    expect(installed).toHaveLength(1);
+    (installed[0] as (signal: NodeJS.Signals) => void)(name);
+  }
+
+  /** Runs the request on a daemon that `execute` plays, as `DaemonClient` reports it to the client. */
+  function execute(execution: Execution): void {
+    jest
+      .mocked(executeWithDaemonRestartAsync)
+      .mockImplementation((client, connection, options) => execution(options));
+  }
+
+  /** The daemon hears of the cancellation, with the default deadline of `DaemonClient`. */
+  function requestCancel(options: IDaemonClientExecuteOptions): void {
+    options.onCancelRequested!(5000);
+    stderrAtCancel = [...stderr];
+  }
+
+  function aborted(options: IDaemonClientExecuteOptions): DaemonClientOutcome {
+    return {
+      kind: 'result',
+      result: { requestId: options.request.requestId, exitCode: 130, outcome: 'aborted', aborted: true }
+    };
+  }
+
+  function cancellationDeadline(): DaemonClientError {
+    return new DaemonClientError(
+      'timeout',
+      'Daemon did not finish cancellation; disconnected without retrying the command.'
+    );
+  }
+
+  it('says at once that it waits for rushd, and keeps the final line when rushd confirms the stop', async () => {
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      expect(options.abortSignal!.aborted).toBe(true);
+      requestCancel(options);
+      return aborted(options);
+    });
+    await launchClientAsync(false);
+    expect(stderrAtCancel).toEqual([CANCELLING]);
+    expect(stderr).toEqual([CANCELLING, CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('says so when rushd does not confirm the stop before the cancellation deadline', async () => {
+    execute(async (options) => {
+      deliverSignal('SIGTERM');
+      requestCancel(options);
+      throw cancellationDeadline();
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLING, UNCONFIRMED]);
+    expect(process.exitCode).toBe(143);
+  });
+
+  it('reports a raw Ctrl+C, which raises no signal, like SIGINT', async () => {
+    execute(async (options) => {
+      requestCancel(options);
+      expect(options.abortSignal!.aborted).toBe(false);
+      throw cancellationDeadline();
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLING, UNCONFIRMED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('adds nothing when the request never reached rushd, which has nothing to stop', async () => {
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      return aborted(options);
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
+  it('writes both notices in the agent output, once', async () => {
+    const output: string[] = [];
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: (text: string) => output.push(text)
+    });
+    let outputAtCancel: string[] | undefined;
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      requestCancel(options);
+      outputAtCancel = [...output];
+      throw cancellationDeadline();
+    });
+    await launchClientAsync(false, renderer);
+    const lines: string[] = output.join('').split('\n').slice(0, -1);
+    expect(outputAtCancel).toHaveLength(2);
+    expect(lines).toEqual([
+      expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
+      expect.stringMatching(
+        /^rush build · \d+\.\ds · cancelling; waiting up to 5s for rushd to stop the request$/
+      ),
+      expect.stringMatching(
+        /^rush build: CANCELLED in \d+\.\ds · rushd did not confirm that the request stopped; it may still be stopping$/
+      )
+    ]);
+    // The summary line says whether rushd confirmed the stop, so the legacy notices add nothing to it.
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts b/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
index 883d2f83ab..1ba423e27e 100644
--- a/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
+++ b/apps/rush-cli-client/src/test/persistentIpcCancellation.test.ts
@@ -57,7 +57,13 @@ describe('public-client cancellation of an admitted Node operation', () => {
         else client.kill('SIGINT');
         // Cancellation terminates the client like a native signal (128 + SIGINT).
         expect(await closed).toEqual([130, null]);
-        expect(stderr).toContain('rush-client: build cancelled.');
+        // The client says at once that it waits for rushd, which then confirms the stop in time.
+        const cancelling: number = stderr.indexOf(
+          'rush-client: cancelling build; waiting up to 5 s for rushd'
+        );
+        expect(cancelling).toBeGreaterThanOrEqual(0);
+        expect(stderr.indexOf('rush-client: build cancelled.')).toBeGreaterThan(cancelling);
+        expect(stderr).not.toContain('did not confirm');
         expect(stderr).not.toMatch(/using in-process|not retried|timed out/i);
         expect(fixture.events().filter((event) => event.kind === 'ready')).toHaveLength(1);
         expect(fixture.events().filter((event) => event.kind === 'complete')).toHaveLength(2);
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json
new file mode 100644
index 0000000000..412a9b9374
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When a daemon-routed command is cancelled (SIGINT, SIGTERM, SIGHUP, or a raw Ctrl+C in watch mode), say at once that the client waits for rushd to stop the request, and for how long, in both legacy and agent output. If rushd does not confirm the stop in that time, the final line says so. A raw Ctrl+C is now reported like SIGINT, with exit code 130.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t142-operation-error_2026-09-28-22-50.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t142-operation-error_2026-09-28-22-50.json
new file mode 100644
index 0000000000..96c2b0d51c
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t142-operation-error_2026-09-28-22-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, print a failed operation's error from the daemon's result even when the operation wrote output first, unless the output shows it or it only gives the exit code; for example an error thrown while the operation's build cache entry was restored. An operation reported as it failed gets an `error: <operation>` line and the error just before the summary line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json
new file mode 100644
index 0000000000..5cc468838e
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t132-cancel-notice_2026-09-28-22-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `IDaemonClientExecuteOptions.onCancelRequested`. The client calls it once, synchronously, when it asks the daemon to cancel a request (after the abort signal, or a raw Ctrl+C with `cancelOnCtrlC`), and passes the time it waits for the daemon to finish cancelling.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t153-cancel-results_2026-09-28-23-20.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t153-cancel-results_2026-09-28-23-20.json
new file mode 100644
index 0000000000..baaab8e31a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t153-cancel-results_2026-09-28-23-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A cancelled phased request reports each operation as it ended in the request's own iteration, and an operation that the cancel kept from starting as aborted, instead of with the result that an earlier request left for it (for example a failure that the change being built had fixed).",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 6955908922..48c0cafbdb 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -131,6 +131,7 @@ export interface IDaemonClientExecuteOptions {
     readonly cancelOnCtrlC?: boolean;
     // (undocumented)
     readonly initialRawMode?: boolean;
+    readonly onCancelRequested?: (timeoutMs: number) => void;
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
     readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 2bf2a57f1b..ec2c66af68 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -67,6 +67,12 @@ export interface IDaemonClientExecuteOptions {
   readonly cancelOnCtrlC?: boolean;
   /** Time allowed to finish cancellation. Defaults to 5000 milliseconds. */
   readonly cancellationTimeoutMs?: number;
+  /**
+   * Called once, synchronously, when the client asks the daemon to cancel the request: after `abortSignal` aborts,
+   * or on a raw Ctrl+C with `cancelOnCtrlC`. The daemon then has `timeoutMs` to deliver its final result; after
+   * that, the client disconnects without it. Not called for a request that was never sent.
+   */
+  readonly onCancelRequested?: (timeoutMs: number) => void;
 }
 
 /** Only explicit, pre-execution rejections permit in-process fallback. @beta */
@@ -307,6 +313,7 @@ export class DaemonClient {
     if (this.#cancelSent || this.#finished || !this.#execution) return;
     this.#cancelSent = true;
     this.#stopInput();
+    const timeoutMs: number = this.#execution.cancellationTimeoutMs ?? 5000;
     this.#cancelTimer = setTimeout(() => {
       this.#connection.abort(
         new DaemonClientError(
@@ -314,11 +321,12 @@ export class DaemonClient {
           'Daemon did not finish cancellation; disconnected without retrying the command.'
         )
       );
-    }, this.#execution.cancellationTimeoutMs ?? 5000);
+    }, timeoutMs);
     void this.#sendControlAsync({
       kind: 'requestCancel',
       payload: { requestId: this.#execution.request.requestId }
     }).catch((error: Error) => this.#fail(error));
+    this.#execution.onCancelRequested?.(timeoutMs);
   }
 
   async #onFrameAsync(frame: IDaemonFrame): Promise<void> {
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index 5498a3d4ea..a9b8ea38ec 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -312,9 +312,12 @@ describe('DaemonClient', () => {
   it('cancels on abort and waits for the authoritative result', async () => {
     const abort = new AbortController();
     const envelope = request();
+    const cancelRequests: number[] = [];
+    let cancelRequestsBeforeCancel: number | undefined;
     onRequest = async (message) => {
       if (message.kind === 'requestStart') abort.abort();
       if (message.kind === 'requestCancel') {
+        cancelRequestsBeforeCancel = cancelRequests.length;
         await sendAsync({
           kind: 'requestResult',
           payload: { requestId: envelope.requestId, exitCode: 130, aborted: true, outcome: 'aborted' }
@@ -322,11 +325,42 @@ describe('DaemonClient', () => {
       }
     };
     const client = await DaemonClient.connectAsync({ socketPath: address });
-    expect(await client.executeAsync({ request: envelope, abortSignal: abort.signal })).toMatchObject({
+    expect(
+      await client.executeAsync({
+        request: envelope,
+        abortSignal: abort.signal,
+        onCancelRequested: (timeoutMs) => cancelRequests.push(timeoutMs)
+      })
+    ).toMatchObject({
       kind: 'result',
       result: { exitCode: 130 }
     });
     expect(controls.filter((message) => message.kind === 'requestCancel')).toHaveLength(1);
+    // The caller hears of the cancellation, and its default deadline, before the daemon does.
+    expect(cancelRequests).toEqual([5000]);
+    expect(cancelRequestsBeforeCancel).toBe(1);
+  });
+
+  it('disconnects without a result when the daemon does not finish cancellation in time', async () => {
+    const abort = new AbortController();
+    const cancelRequests: number[] = [];
+    onRequest = async (message) => {
+      if (message.kind === 'requestStart') abort.abort();
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await expect(
+      client.executeAsync({
+        request: request(),
+        abortSignal: abort.signal,
+        cancellationTimeoutMs: 50,
+        onCancelRequested: (timeoutMs) => cancelRequests.push(timeoutMs)
+      })
+    ).rejects.toMatchObject({
+      code: 'timeout',
+      message: expect.stringContaining('did not finish cancellation')
+    });
+    expect(cancelRequests).toEqual([50]);
+    expect(controls.filter((message) => message.kind === 'requestCancel')).toHaveLength(1);
   });
 
   it('reports why a queued request waits when the daemon restarts after the requests ahead of it', async () => {
@@ -647,13 +681,15 @@ describe('DaemonClient', () => {
 
   it('does not send an already cancelled request or leak a rejected completion promise', async () => {
     const client = await DaemonClient.connectAsync({ socketPath: address });
-    expect(await client.executeAsync({ request: request(), abortSignal: AbortSignal.abort() })).toMatchObject(
-      {
-        kind: 'result',
-        result: { exitCode: 130, aborted: true }
-      }
-    );
+    const onCancelRequested: jest.Mock = jest.fn();
+    expect(
+      await client.executeAsync({ request: request(), abortSignal: AbortSignal.abort(), onCancelRequested })
+    ).toMatchObject({
+      kind: 'result',
+      result: { exitCode: 130, aborted: true }
+    });
     expect(controls.some((message) => message.kind === 'requestStart')).toBe(false);
+    expect(onCancelRequested).not.toHaveBeenCalled();
   });
 
   it('turns raw Ctrl+C into cancellation when enabled by the CLI', async () => {
@@ -672,14 +708,18 @@ describe('DaemonClient', () => {
       }
     };
     const client = await DaemonClient.connectAsync({ socketPath: address });
+    const cancelRequests: number[] = [];
     expect(
       await client.executeAsync({
         request: envelope,
         stdin,
         cancelOnCtrlC: true,
-        setRawMode: () => {}
+        setRawMode: () => {},
+        onCancelRequested: (timeoutMs) => cancelRequests.push(timeoutMs)
       })
     ).toMatchObject({ kind: 'result', result: { exitCode: 130 } });
+    // A raw Ctrl+C raises no signal, so only the client can say that it cancels.
+    expect(cancelRequests).toEqual([5000]);
   });
 });
 
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index cf783fec90..27a9299eb7 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -1378,20 +1378,34 @@ function applySelections(graph: IOperationGraph, selections: ReadonlyArray<IReso
   graph.setEnabledStates(effectiveIgnoreDependencyOperations, 'ignore-dependency-changes', 'unsafe');
 }
 
+/**
+ * Reports the outcome of each of a client's operations for its result.
+ *
+ * @remarks
+ * `aborted` means that the client cancelled the request, or the daemon shut down, after the request joined an
+ * iteration. Such a request never reports a result that an earlier iteration left, which would report an operation
+ * that the cancel kept from starting as failed or succeeded. Once the iteration has ended, the request reports each
+ * operation's record in it, which holds the operation's final status in that iteration. The graph keeps that record
+ * only for an operation that ran, and an earlier iteration's record for one that was aborted or skipped.
+ */
 function collectOperationOutcomes(
   activeOperations: ReadonlyArray<Operation>,
   graph: IOperationGraph,
   requestSink: PhasedRequestEventSink,
-  fillMissingAsAborted: boolean = false,
+  aborted: boolean = false,
   report: OperationReport = 'final'
 ): ReadonlyArray<IPhasedOperationOutcome> {
   const outcomes: IPhasedOperationOutcome[] = [];
   for (const operation of [...activeOperations].sort(compareOperations)) {
     const observed: ReturnType<PhasedRequestEventSink['getObservedResult']> =
       requestSink.getObservedResult(operation);
-    const retained: IOperationExecutionResult | undefined = graph.resultByOperation.get(operation);
+    const retained: IOperationExecutionResult | undefined = aborted
+      ? undefined
+      : graph.resultByOperation.get(operation);
     const current: IOperationExecutionResult | undefined =
-      report === 'running' ? requestSink.getScheduledResult(operation) : undefined;
+      report === 'running' || (aborted && report === 'final')
+        ? requestSink.getScheduledResult(operation)
+        : undefined;
     let status: string | undefined;
     let errorMessage: string | undefined;
     if (current !== undefined) {
@@ -1416,8 +1430,8 @@ function collectOperationOutcomes(
       status = retained?.status ?? observed?.status;
       errorMessage = retained?.error?.message ?? observed?.executionResult.error?.message;
     }
-    status ??= fillMissingAsAborted ? OperationStatus.Aborted : undefined;
-    if (fillMissingAsAborted && status !== undefined && IN_PROGRESS_STATUSES.has(status)) {
+    status ??= aborted ? OperationStatus.Aborted : undefined;
+    if (aborted && status !== undefined && IN_PROGRESS_STATUSES.has(status)) {
       // The client stopped observing before this operation finished, e.g. because it was terminated.
       status = OperationStatus.Aborted;
     }
diff --git a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
index 7941f76a7f..7664b94116 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
@@ -17,6 +17,7 @@ import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
 const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_D: string = 'project-d (_phase:test)';
 const PROMPT_CANCELLATION_MS: number = 1000;
 const TIMED_OUT: 'timed out' = 'timed out';
 
@@ -55,8 +56,11 @@ interface IHangingOperation {
   readonly release: () => void;
 }
 
-/** An operation that only finishes when released, or when its hard-abort signal fires (like a killed process). */
-function createHangingOperation(): {
+/**
+ * An operation that only finishes when released, or when its hard-abort signal fires (like a killed process), unless
+ * it ignores that signal.
+ */
+function createHangingOperation(ignoresTermination: boolean = false): {
   hanging: IHangingOperation;
   actionAsync: (terminal: ITerminal, context: IOperationRunnerContext) => Promise<OperationStatus | void>;
 } {
@@ -82,8 +86,8 @@ function createHangingOperation(): {
     const aborted: Promise<void> = new Promise<void>((resolve) =>
       abortSignal.addEventListener('abort', () => resolve(), { once: true })
     );
-    await Promise.race([aborted, released]);
-    if (abortSignal.aborted) {
+    await (ignoresTermination ? released : Promise.race([aborted, released]));
+    if (abortSignal.aborted && !ignoresTermination) {
       onTerminated();
       return OperationStatus.Aborted;
     }
@@ -104,6 +108,66 @@ function createFixture(
   );
 }
 
+interface IUpstreamFixFixture {
+  readonly fixture: ITestRoutingFixture;
+  readonly hanging: IHangingOperation;
+  /** Changes A, which then runs until it is released, or terminated unless it ignores that. C stays up to date. */
+  readonly changeA: () => void;
+}
+
+/**
+ * B and D depend on A, and D also depends on C. B fails until A is changed, like a downstream error that is fixed
+ * in the upstream project. After `changeA()`, the warm graph skips C as unchanged.
+ */
+function createUpstreamFixFixture(ignoresTermination: boolean = false): IUpstreamFixFixture {
+  const { hanging, actionAsync: hangingActionAsync } = createHangingOperation(ignoresTermination);
+  let changed: boolean = false;
+  const fixture: ITestRoutingFixture = createRoutingFixture(
+    new Map([
+      [
+        OPERATION_A,
+        new TestOperationRunner(OPERATION_A, OperationStatus.Success, async (terminal, context) =>
+          changed ? await hangingActionAsync(terminal, context) : undefined
+        )
+      ],
+      [
+        OPERATION_B,
+        new TestOperationRunner(OPERATION_B, OperationStatus.Success, async () =>
+          changed ? undefined : OperationStatus.Failure
+        )
+      ],
+      [OPERATION_C, new TestOperationRunner(OPERATION_C)],
+      [OPERATION_D, new TestOperationRunner(OPERATION_D)]
+    ]),
+    [
+      [OPERATION_B, OPERATION_A],
+      [OPERATION_D, OPERATION_A],
+      [OPERATION_D, OPERATION_C]
+    ],
+    { supportsTerminateRunning: true }
+  );
+  // A and C start together, so C is skipped while A runs.
+  fixture.graph.parallelism = 2;
+  fixture.graph.hooks.configureIteration.tap('unchanged C', (records) => {
+    for (const record of records.values()) {
+      if (changed && record.operation.name === OPERATION_C) {
+        record.enabled = false;
+      }
+    }
+  });
+  const changeA = (): void => {
+    changed = true;
+    fixture.session.operationGraph.invalidateOperations([fixture.operations.get(OPERATION_A)!], 'changed');
+  };
+  return { fixture, hanging, changeA };
+}
+
+function getStatuses(result: IDaemonPhasedRequestResult): Record<string, string> {
+  return Object.fromEntries(
+    result.operationResults.map(({ operationId, status }) => [operationId, status] as const)
+  );
+}
+
 describe('phased request client cancellation', () => {
   it('terminates running operations when the last client cancels and releases the graph promptly', async () => {
     const { hanging, actionAsync } = createHangingOperation();
@@ -353,4 +417,135 @@ describe('phased request client cancellation', () => {
     expect(orphan.signals.map((signal: AbortSignal) => signal.aborted)).toEqual([true]);
     await orphan.terminated;
   });
+
+  function createUpstreamFixRequest(requestId: string): IDaemonPhasedRequest {
+    return {
+      ...createRequest(requestId, OPERATION_B),
+      operationSelection: [
+        { enabledState: true, operationId: OPERATION_B },
+        { enabledState: true, operationId: OPERATION_D }
+      ]
+    };
+  }
+
+  it('reports operations that a cancel kept from starting as aborted, not with the results of an earlier request', async () => {
+    const { fixture, hanging, changeA } = createUpstreamFixFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first: IDaemonPhasedRequestResult = await router.executeAsync(
+      createUpstreamFixRequest('first'),
+      new TestPhasedRequestClient('one')
+    );
+    expect(getStatuses(first)).toEqual({
+      [OPERATION_A]: OperationStatus.Success,
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Success,
+      [OPERATION_D]: OperationStatus.Success
+    });
+
+    // The fix goes into A, and the build is cancelled while A runs, before B and D can start.
+    changeA();
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      client
+    );
+    await hanging.started;
+    client.abortController.abort();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+
+    await hanging.terminated;
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Aborted,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Skipped,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(result.operationResults.every(({ errorMessage }) => errorMessage === undefined)).toBe(true);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+    expect(fixture.runners.get(OPERATION_D)?.runCount).toBe(1);
+  });
+
+  it('reports an operation that finished in the iteration of a cancelled request with that result', async () => {
+    // A ignores termination, so it finishes after the cancel, and its result is this request's.
+    const { fixture, hanging, changeA } = createUpstreamFixFixture(true);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    await router.executeAsync(createUpstreamFixRequest('first'), new TestPhasedRequestClient('one'));
+
+    changeA();
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      client
+    );
+    await hanging.started;
+    client.abortController.abort();
+    hanging.release();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Success,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Skipped,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+  });
+
+  it('reports operations that a detached cancelling client never saw start as aborted, not with earlier results', async () => {
+    const { fixture, hanging, changeA } = createUpstreamFixFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    await router.executeAsync(createUpstreamFixRequest('first'), new TestPhasedRequestClient('one'));
+
+    changeA();
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_A),
+      new TestPhasedRequestClient('three')
+    );
+    await hanging.started;
+    cancelledClient.abortController.abort();
+    const result: IDaemonPhasedRequestResult = await cancelled;
+    hanging.release();
+
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Aborted,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Skipped,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(getStatuses(await continuing)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+  });
+
+  it('reports every operation as aborted when the cancel comes while the iteration is being scheduled', async () => {
+    const { fixture, changeA } = createUpstreamFixFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    await router.executeAsync(createUpstreamFixRequest('first'), new TestPhasedRequestClient('one'));
+
+    changeA();
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    fixture.graph.hooks.configureIteration.tap('cancel while scheduling', () => {
+      client.abortController.abort();
+    });
+    const result: IDaemonPhasedRequestResult = await router.executeAsync(
+      createUpstreamFixRequest('cancelled'),
+      client
+    );
+
+    expect(result).toMatchObject({ aborted: true, outcome: 'aborted' });
+    expect(getStatuses(result)).toEqual({
+      [OPERATION_A]: OperationStatus.Aborted,
+      [OPERATION_B]: OperationStatus.Aborted,
+      [OPERATION_C]: OperationStatus.Aborted,
+      [OPERATION_D]: OperationStatus.Aborted
+    });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
 });

From 147473350669608e0ef3baf1171eb6741686bb82 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 02:37:43 +0000
Subject: [PATCH 057/265] [rush-daemon] Tests for a cancel while continuing
 work, and for the early failure offer

Swarm integration step 42; original commit c4693204c1 (merge of swarm/r04-t108-nits-int at 97e473c08e).
Scope: task 108(a) NITs.

Brings r04's tests for the three gate NITs of task 108(a) (ch01 board 2678). Tests only; they pass on the old product, and ch01's mutants show they're live.

s16 batch B, item 2 of 5 (ch01 board 2984).

Gate: ch01 GATE OK board 2984 (tree b21b6b1f0b)

Commits folded into this step (1):
- 97e473c08e Test the three gate NITs of task 108 (a): a cancel while continuing work stops, and the early failure offer's silent and aborted operations (ch01 board 2678)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...m-r04-t108-gate-nits_2026-09-29-01-10.json | 11 +++
 .../test/PhasedRequestEarlyFailure.test.ts    | 34 +++++--
 .../src/test/PhasedRequestEventSink.test.ts   | 71 +++++++++++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  | 90 +++++++++++++++++--
 4 files changed, 192 insertions(+), 14 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t108-gate-nits_2026-09-29-01-10.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t108-gate-nits_2026-09-29-01-10.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-gate-nits_2026-09-29-01-10.json
new file mode 100644
index 0000000000..c84e7ddfc6
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-gate-nits_2026-09-29-01-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a client which cancels while the work that continues is stopping gets its answer at once, and that the early failure offer ignores silent operations and gives up once an operation was aborted.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
index f24c64d808..4daab514cb 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -69,13 +69,19 @@ interface IEarlyFailureFixture {
   readonly startedC: Promise<void>;
 }
 
+/** Runs nothing that the user sees, like a phase that the project does not define. */
+class SilentTestOperationRunner extends TestOperationRunner {
+  public override readonly silent: boolean = true;
+}
+
 /**
  * B fails and C is slow. Unless `failBeforeCStarts` is set, B fails only once C runs, so C is executing when B's
  * failure decides a request's result.
  */
 function createEarlyFailureFixture(
   dependencies: ReadonlyArray<readonly [string, string]> = A_CONSUMES_B_AND_C,
-  failBeforeCStarts: boolean = false
+  failBeforeCStarts: boolean = false,
+  silentC: boolean = false
 ): IEarlyFailureFixture {
   const startedC: IDeferred = createDeferred();
   const releaseC: IDeferred = createDeferred();
@@ -93,10 +99,14 @@ function createEarlyFailureFixture(
       ],
       [
         OPERATION_C,
-        new TestOperationRunner(OPERATION_C, OperationStatus.Success, async (): Promise<void> => {
-          startedC.resolve();
-          await releaseC.promise;
-        })
+        new (silentC ? SilentTestOperationRunner : TestOperationRunner)(
+          OPERATION_C,
+          OperationStatus.Success,
+          async (): Promise<void> => {
+            startedC.resolve();
+            await releaseC.promise;
+          }
+        )
       ]
     ]),
     dependencies,
@@ -174,6 +184,7 @@ interface IOrdinaryCase {
   readonly failBeforeCStarts: boolean;
   readonly name: string;
   readonly selection: ReadonlyArray<string>;
+  readonly silentC?: boolean;
 }
 
 /** Requests that ask to return early on failure, but whose failed result can only be written at the end. */
@@ -198,6 +209,15 @@ const ORDINARY_CASES: ReadonlyArray<IOrdinaryCase> = [
     failBeforeCStarts: false,
     name: 'the request is not a shared build',
     selection: [OPERATION_A]
+  },
+  {
+    // An early result would not list C, so it could not say that C continues.
+    commandName: 'build',
+    dependencies: A_CONSUMES_B_AND_C,
+    failBeforeCStarts: false,
+    name: 'only a silent operation is unfinished',
+    selection: [OPERATION_A],
+    silentC: true
   }
 ];
 
@@ -259,8 +279,8 @@ describe('phased requests that return early on failure', () => {
 
   it.each(ORDINARY_CASES)(
     'writes the result after the iteration when $name',
-    async ({ commandName, dependencies, failBeforeCStarts, selection }: IOrdinaryCase) => {
-      const setup: IEarlyFailureFixture = createEarlyFailureFixture(dependencies, failBeforeCStarts);
+    async ({ commandName, dependencies, failBeforeCStarts, selection, silentC }: IOrdinaryCase) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture(dependencies, failBeforeCStarts, silentC);
       const tracked: ITrackedClient = trackClient('agent', setup);
       const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
         setup.router.executeAsync(
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
index 78c41e666a..84eb6ab80b 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
@@ -134,3 +134,74 @@ it('points at the full log of failed operations and operations with warnings, an
     { operationId: ACTIVE_OPERATION, previousStatus: 'READY', status: 'SUCCESS' }
   ]);
 });
+
+const TARGET_OPERATION: string = 'project-a (_phase:test)';
+const FAILED_OPERATION: string = 'project-b (_phase:test)';
+const RUNNING_OPERATION: string = 'project-c (_phase:test)';
+const QUEUED_OPERATION: string = 'project-d (_phase:test)';
+
+function createEarlyFailureSink(onSettled: (unfinishedOperations: number) => void): PhasedRequestEventSink {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  return new PhasedRequestEventSink({
+    activeOperationIds: new Set([TARGET_OPERATION, FAILED_OPERATION, RUNNING_OPERATION, QUEUED_OPERATION]),
+    client,
+    getNextSequence: () => client.getNextEventSequence(),
+    onWriteFailure: () => undefined,
+    rushVersion: '5.178.1',
+    earlyFailure: { targetOperationIds: new Set([TARGET_OPERATION]), onSettled }
+  });
+}
+
+function setStatus(record: IOperationExecutionResult, status: OperationStatus): void {
+  (record as { status: OperationStatus }).status = status;
+}
+
+/** Schedules the records, then fails FAILED_OPERATION, which blocks the target while RUNNING_OPERATION runs. */
+function failWhileRunning(
+  sink: PhasedRequestEventSink,
+  queued: IOperationExecutionResult,
+  beforeFailure?: () => void
+): void {
+  const target: IOperationExecutionResult = createRecord(TARGET_OPERATION, OperationStatus.Waiting);
+  const failed: IOperationExecutionResult = createRecord(FAILED_OPERATION, OperationStatus.Executing);
+  sink.onIterationScheduled([
+    target,
+    failed,
+    createRecord(RUNNING_OPERATION, OperationStatus.Executing),
+    queued
+  ]);
+  beforeFailure?.();
+  setStatus(failed, OperationStatus.Failure);
+  sink.onOperationStatusChanged(failed, OperationStatus.Executing);
+  // Blocked operations complete only when the iteration ends.
+  setStatus(target, OperationStatus.Blocked);
+  sink.onOperationCompleted(failed);
+}
+
+describe('the early failure offer', () => {
+  it('counts the unfinished operations that are not silent', () => {
+    const onSettled: jest.Mock = jest.fn();
+    // Like a phase that the project does not define: the result does not list it while it is unfinished.
+    const silent: IOperationExecutionResult = {
+      ...createRecord(QUEUED_OPERATION, OperationStatus.Ready),
+      silent: true
+    } as IOperationExecutionResult;
+
+    failWhileRunning(createEarlyFailureSink(onSettled), silent);
+
+    expect(onSettled.mock.calls).toEqual([[1]]);
+  });
+
+  it('offers nothing once one of its operations was aborted, even before that operation completed', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const queued: IOperationExecutionResult = createRecord(QUEUED_OPERATION, OperationStatus.Ready);
+
+    // An aborted iteration marks the queued operations that it skips as aborted at once, but they complete only
+    // when the iteration ends, after the operations that were already running.
+    failWhileRunning(createEarlyFailureSink(onSettled), queued, () =>
+      setStatus(queued, OperationStatus.Aborted)
+    );
+
+    expect(onSettled).not.toHaveBeenCalled();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index 2cda8f5ef8..b5b2443584 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -11,7 +11,7 @@ import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
-import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 
@@ -19,11 +19,29 @@ jest.setTimeout(60_000);
 
 const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
 
+interface IEarlyFailureFixtureOptions {
+  readonly restartable?: boolean;
+  readonly slowToStop?: boolean;
+}
+
+/** Keeps the output that it inherits open until the test removes the `hold` marker. */
+const HOLD_OUTPUT_SCRIPT: string =
+  "const fs=require('node:fs');const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);";
+
 /**
  * b consumes a and c. a fails, and c holds its build open until the test removes the `hold` marker, so a build of b
- * that returns early on failure leaves c running.
+ * that returns early on failure leaves c running. With `slowToStop`, c first starts a detached process that shares
+ * its output, like a stray watcher: stopping c kills c's process group but not that process, so c's operation ends
+ * only when the test removes the marker.
  */
-function createEarlyFailureFixtureAsync(restartable: boolean = false): Promise<DaemonGraphTestFixture> {
+function createEarlyFailureFixtureAsync({
+  restartable = false,
+  slowToStop = false
+}: IEarlyFailureFixtureOptions = {}): Promise<DaemonGraphTestFixture> {
+  const startOutputHolder: string = slowToStop
+    ? `require('node:child_process').spawn(process.execPath,['-e',${JSON.stringify(HOLD_OUTPUT_SCRIPT)}],` +
+      "{detached:true,stdio:['ignore','inherit','inherit']}).unref();"
+    : '';
   return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
     if (restartable) {
       setDaemonPolicy(created, {});
@@ -45,7 +63,9 @@ function createEarlyFailureFixtureAsync(restartable: boolean = false): Promise<D
     );
     created.write(
       'c/build.cjs',
-      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+      "const fs=require('node:fs');" +
+        startOutputHolder +
+        "fs.appendFileSync('../runs.txt','c\\n');" +
         "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
     );
   });
@@ -55,9 +75,21 @@ function countRuns(fixture: DaemonGraphTestFixture, name: string): number {
   return fixture.runs().filter((run: string) => run === name).length;
 }
 
-async function waitForRunsAsync(fixture: DaemonGraphTestFixture, name: string, count: number): Promise<void> {
+async function waitUntilAsync(condition: () => boolean): Promise<void> {
   const deadline: number = Date.now() + 30_000;
-  while (countRuns(fixture, name) < count && Date.now() < deadline) await delayAsync(20);
+  while (!condition() && Date.now() < deadline) await delayAsync(20);
+}
+
+async function waitForRunsAsync(fixture: DaemonGraphTestFixture, name: string, count: number): Promise<void> {
+  await waitUntilAsync(() => countRuns(fixture, name) >= count);
+}
+
+/** Counts the stops that the daemon requested; every iteration's start also aborts, without options. */
+function countTerminatingAborts(abortSpy: jest.SpyInstance): number {
+  return abortSpy.mock.calls.filter(
+    ([options]: ReadonlyArray<{ terminateRunning?: boolean } | undefined>) =>
+      options?.terminateRunning === true
+  ).length;
 }
 
 /** Whether an in-process Rush command could take the Rush lock that the daemon holds while it executes. */
@@ -178,6 +210,50 @@ describe('a failed build that returns early', () => {
     }
   });
 
+  it('answers a client that cancels while the work that continues is stopping, without waiting for it to stop', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ slowToStop: true });
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+      const abortSpy: jest.SpyInstance = jest.spyOn(
+        fixture.session.operationGraph!,
+        'abortCurrentIterationAsync'
+      );
+      const client: DaemonRequestWireClient = await fixture.connectAsync();
+      try {
+        const custom: IDaemonRequestEnvelope = fixture.envelope(['test', '--to', 'c'], {
+          commandOrigin: 'custom'
+        });
+        await client.sendControlAsync({ kind: 'requestStart', payload: custom });
+        // Before it rejects `test`, the daemon stops c, which takes until the test removes the marker.
+        await waitUntilAsync(() => countTerminatingAborts(abortSpy) > 0);
+        expect(countTerminatingAborts(abortSpy)).toBe(1);
+        const answer: Promise<ITerminalExchange> = client.readTerminalAsync(custom.requestId);
+        expect(await Promise.race([answer, delayAsync(500).then(() => undefined)])).toBeUndefined();
+
+        // rush-client cancels on Ctrl+C, and gives up on the daemon if it does not answer within 5 seconds.
+        await client.sendControlAsync({ kind: 'requestCancel', payload: { requestId: custom.requestId } });
+        const cancelled: ITerminalExchange | undefined = await Promise.race([
+          answer,
+          delayAsync(3_000).then(() => undefined)
+        ]);
+        expect(cancelled?.terminal).toMatchObject({
+          kind: 'requestRejected',
+          payload: { code: 'unsupported' }
+        });
+        // c is still stopping, so the client must not run `test` in-process now; rush-client reports a command
+        // that it cancelled as cancelled instead.
+        expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+        expect(isNativeLockFree(fixture)).toBe(false);
+      } finally {
+        await client.closeAsync();
+      }
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('leaves the work that continues running for a read-only command or a rushx script that it rejects', async () => {
     const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
     const hold: string = path.join(fixture.folder, 'hold');
@@ -216,7 +292,7 @@ describe('a failed build that returns early', () => {
   });
 
   it('lets a restart for another environment proceed without waiting for the work that continues', async () => {
-    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync(true);
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ restartable: true });
     const hold: string = path.join(fixture.folder, 'hold');
     try {
       const before = await pongAsync(fixture);

From e178316649e3423792ab0a018758f443634302d4 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 02:37:43 +0000
Subject: [PATCH 058/265] [rush-client-core] The client relaunches the daemon
 after a startup helper exited, once its relaunch time passed

Swarm integration step 43; original commit e073bd0f4b (merge of swarm/r03-t126 at da64013877).
Scope: task 126.

Brings r03's task 126: a client takes over a startup reservation whose helper is provably gone and whose daemon never became ready, instead of running in-process until `daemon stop --force` (t05 board 1574 and board 1652, row 13a). Second agent: t07 board 2751. ch01's e2e: the reservation is taken over after the relaunch time.

s16 batch B, item 3 of 5 (ch01 board 2984).

Gate: ch01 GATE OK board 2984 (tree a7707a430e)

Commits folded into this step (1):
- da64013877 rush-client-core: relaunch the daemon after a startup helper exited, once its relaunch time passed (task 126)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  15 +-
 apps/rush-cli-client/src/daemonCommands.ts    |   5 +-
 .../src/test/launchClient.test.ts             |  13 +-
 ...reservation-relaunch_2026-09-28-23-50.json |  11 +
 ...reservation-relaunch_2026-09-28-23-50.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   1 +
 libraries/rush-client-core/README.md          |  36 ++-
 .../rush-client-core/src/DaemonOwnership.ts   |   7 +-
 .../rush-client-core/src/DaemonStartup.ts     |  12 +-
 .../src/DaemonStartupReservation.ts           |  62 ++++-
 .../src/connectOrStartDaemon.ts               |  56 +++-
 .../src/test/DaemonStartup.test.ts            | 141 ++++++++++
 .../test/connectOrAwaitDaemonStartup.test.ts  |   5 +-
 .../src/test/connectOrStartDaemon.test.ts     | 244 +++++++++++++++++-
 .../src/test/fixtures/daemon.ts               |  12 +-
 15 files changed, 573 insertions(+), 58 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json
 create mode 100644 libraries/rush-client-core/src/test/DaemonStartup.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 12c589e650..75f5aa6bda 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -413,12 +413,16 @@ the next command: status then prints `state: "installationChanged"` with the pon
 A startup reservation (`<key>.pid.json.starting`) refuses another daemon launch until
 the daemon it reserved becomes ready. Status reports one that remains as
 `startupReservation` with its `path`, the startup helper's `helperPid` when recorded, and
-`helperState`: `running` (the helper still waits for readiness), `exited` (nothing else will
+`helperState`: `running` (the helper still waits for readiness), `exited` (the helper will not
 release it), or `unknown` (written by an older client). Status never removes it. Next to a
 ready daemon, the next command that uses, stops or restarts that daemon removes it; when status
-cannot connect, its diagnostic explains the reservation. After an `exited` helper, every automatic start is
-refused at once unless that daemon still becomes ready: check `daemon logs`, and if the daemon
-failed to start, run `daemon stop --force`.
+cannot connect, its diagnostic explains the reservation. After an `exited` helper, status also
+reports `relaunchAfter`, 15 seconds after that helper was launched. Until then every automatic
+start is refused at once (the command runs in-process), so that a daemon that fails the same way
+each time, for example because of a configuration error, is not launched by every command. The
+first command after it that finds nothing listening at the endpoint takes the reservation over
+and starts the daemon again, and `daemon logs` shows a line saying so. `daemon logs` may also show
+why the daemon did not become ready.
 
 The optional workspace snapshot reports the provider generation/token, graph existence,
 and available warm accounting without initializing a graph. Missing fields are unknown,
@@ -478,7 +482,8 @@ started/reused successor must pass hello/ping before reporting `state: "ready"`.
 When nothing listens at the endpoint, restart starts a daemon exactly like `daemon start`.
 
 Automatic and explicit startup reclaim stale artifacts only when that is provably
-safe: while holding the start mutex with no `.starting` reservation, a socket
+safe: while holding the start mutex with no `.starting` reservation (or after taking over
+one whose helper exited, as described above), a socket
 without an ownership record, or an unreadable/corrupt record, is removed only after
 a connection attempt is refused (so no listener exists). On Linux, a record whose
 PID now belongs to a process that started after the record's `startedAt` (PID reuse)
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index adea0f631c..a81d671168 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -217,7 +217,8 @@ function explainExitedDaemon(error: unknown, paths: IDaemonPaths): unknown {
 /**
  * Reports a startup reservation, which refuses another daemon launch until it is resolved. Clients resolve it
  * once the daemon it reserved is ready, so the next command that uses, stops or restarts a ready daemon resolves
- * a remaining one; status only reports it.
+ * a remaining one. Once its helper exited, a command that starts the daemon after `relaunchAfter` takes it over.
+ * Status only reports it.
  */
 function getStartupReservationStatus(paths: IDaemonPaths): {
   startupReservation?: IDaemonStartupReservationInfo;
@@ -238,7 +239,7 @@ function explainStartupReservation(error: unknown, paths: IDaemonPaths): unknown
       explanation = `A daemon is starting: ${helper} is still waiting for it to become ready; retry shortly.`;
       break;
     case 'exited':
-      explanation = `The startup reservation at ${reservation.path} remains, but ${helper} exited before the daemon became ready, so the reservation refuses every automatic start unless that daemon still becomes ready. Check "rush-client daemon logs"; if the daemon failed to start, run "rush-client daemon stop --force" to remove it.`;
+      explanation = `The startup reservation at ${reservation.path} remains, but ${helper} exited before the daemon became ready. A command that starts the daemon after ${reservation.relaunchAfter} takes the reservation over and launches the daemon again, provided that nothing listens at ${paths.socketPath} then. "rush-client daemon logs" may show why the daemon did not become ready.`;
       break;
     default:
       explanation = `The startup reservation at ${reservation.path} refuses another daemon launch. Check "rush-client daemon logs"; if no daemon is starting, run "rush-client daemon stop --force" to remove it.`;
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index 0e52e5a8bc..e7e0a2a7e7 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -400,16 +400,18 @@ describe('standalone rushx fallback', () => {
         await once(exited, 'close');
         helperPid = exited.pid!;
       }
+      const helperStartedAt: Date = new Date();
       fs.writeFileSync(
         reservation,
-        JSON.stringify({ token: 'fixture', helperPid, helperStartedAt: new Date().toISOString() })
+        JSON.stringify({ token: 'fixture', helperPid, helperStartedAt: helperStartedAt.toISOString() })
       );
+      const relaunchAfter: string = new Date(helperStartedAt.getTime() + 15000).toISOString();
       const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
       expect(status).toMatchObject({ code: 1, stdout: '' });
       expect(status.stderr).toContain('Could not connect to daemon');
       expect(status.stderr).toContain(
         helperState === 'exited'
-          ? `its startup helper (PID ${helperPid}) exited before the daemon became ready, so the reservation refuses every automatic start unless that daemon still becomes ready. Check "rush-client daemon logs"; if the daemon failed to start, run "rush-client daemon stop --force" to remove it.`
+          ? `its startup helper (PID ${helperPid}) exited before the daemon became ready. A command that starts the daemon after ${relaunchAfter} takes the reservation over and launches the daemon again, provided that nothing listens at ${paths.socketPath} then. "rush-client daemon logs" may show why the daemon did not become ready.`
           : `A daemon is starting: its startup helper (PID ${helperPid}) is still waiting for it to become ready; retry shortly.`
       );
       const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop']);
@@ -417,7 +419,12 @@ describe('standalone rushx fallback', () => {
       expect(JSON.parse(stopped.stdout)).toEqual({
         state: 'notRunning',
         socketPath: paths.socketPath,
-        startupReservation: { path: reservation, helperPid, helperState }
+        startupReservation: {
+          path: reservation,
+          helperPid,
+          helperState,
+          ...(helperState === 'exited' ? { relaunchAfter } : {})
+        }
       });
       const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
       expect(reset).toMatchObject({ code: 0, stderr: '' });
diff --git a/common/changes/@rushstack/rush-cli-client/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json b/common/changes/@rushstack/rush-cli-client/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json
new file mode 100644
index 0000000000..f9c2f5bdbd
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "After a daemon failed to start, the first command 15 seconds or more later starts it again instead of running in-process until `rush-client daemon stop --force`. `daemon status` and `daemon stop` report the `relaunchAfter` time of such a startup reservation.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json b/common/changes/@rushstack/rush-client-core/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json
new file mode 100644
index 0000000000..042ae2be96
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-abandoned-reservation-relaunch_2026-09-28-23-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Take over a daemon startup reservation whose helper exited once 15 seconds have passed since that launch and nothing listens at the endpoint, and start the daemon again, instead of refusing every automatic start until `resetDaemonArtifactsAsync()`. Until then another launch is still refused at once. The startup helper now also releases its reservation for a daemon that another launch published while its own launcher exited. `inspectDaemonStartupReservation()` reports the `relaunchAfter` time.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 48c0cafbdb..76e0bf211f 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -171,6 +171,7 @@ export interface IDaemonStartupReservationInfo {
     readonly helperPid?: number;
     readonly helperState: DaemonStartupHelperState;
     readonly path: string;
+    readonly relaunchAfter?: string;
 }
 
 // @beta
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 41581c27bd..6461b1db0e 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -86,8 +86,8 @@ at least 120 seconds, even when the requesting client's own deadline is shorter,
 first start (for example while Windows scans newly installed files) is still handed off to
 later clients instead of leaving an abandoned reservation. Clients still await
 hello/pong under bounded backoff. Stdout/stderr go to `<lockfilePath>.log`. No PID
-is killed. While holding the mutex with no startup reservation, stale leftovers are
-reclaimed only when provably safe: a socket without an ownership record, or a corrupt
+is killed. While holding the mutex with no startup reservation (or after taking over an
+abandoned one, see below), stale leftovers are reclaimed only when provably safe: a socket without an ownership record, or a corrupt
 record, once a connection attempt is refused (no listener exists); and, on Linux, a
 record whose PID now belongs to a process that started after the record's `startedAt`
 (PID reuse, detected from `/proc`). Any other live PID with an unreachable socket fails
@@ -96,14 +96,23 @@ which removes the record, socket and reservation after the same no-listener/no-l
 The helper uses a stable tool cwd, and the starting client awaits its exit after
 readiness. The explicit launcher's cwd is unchanged.
 
-An unresolved startup reservation is never automatically reclaimed based on PID
-liveness or elapsed time. If the helper cannot establish readiness, subsequent starts
-fail closed instead of risking a second detached daemon. Only a known spawn failure
-(no executable started) releases the reservation immediately. An arbitrary launcher
-can spawn descendants, so its exit is not proof that another launch is safe.
-Recovery of an abandoned reservation requires operator confirmation that the original
-startup cannot still publish an endpoint; normal successful startup releases it
-automatically. Cancellation stops the client waiting, not the detached handoff.
+While its helper runs, a startup reservation is never taken over, however long startup
+takes. Only a known spawn failure (no executable started) releases the reservation
+immediately. If the helper cannot establish readiness (its launcher exited, or it timed
+out), it exits and leaves the reservation. An arbitrary launcher can spawn descendants, so
+neither exit proves that no daemon can still publish an endpoint. A reservation whose helper
+is provably gone is therefore taken over only once its relaunch time has passed (15 seconds
+after the helper was launched) and while nothing listens at the endpoint; the starting client
+logs that it took the reservation over and launches the daemon again. This is safe even if a
+daemon of the gone helper is still starting: a daemon listens before it publishes the endpoint,
+publishes it only with link(2) (or as the first instance of a named pipe), and reclaims it
+only from a dead owner that does not accept a connection. So of two such daemons, the one
+that publishes second finds the other and exits, and the readiness of either releases the new
+reservation. Before the relaunch time, clients refuse another launch at once, so that a
+daemon that fails the same way each time (for example because of a configuration error) is
+not launched by every client, and their callers can run without it. Normal successful startup
+releases the reservation automatically. Cancellation stops the client waiting, not the
+detached handoff.
 
 A client resolves a reservation on the same evidence the helper waits for, so a daemon
 that became ready after its helper stopped waiting (for example a first start slower than
@@ -114,8 +123,11 @@ Reservations written by older clients, without a helper, are resolved the same w
 The recorded helper decides how long a refused launch waits: while it is alive, a starting
 client waits for it until the client's own deadline; once it is provably gone (its PID
 no longer exists or was reused), nothing else can release the reservation, so clients
-refuse another launch at once. `inspectDaemonStartupReservation(paths)` reports the
-reservation and its helper's state without changing it (`rush-client daemon status`), and
+refuse another launch at once until the relaunch time, and then take the reservation over
+as described above (while something listens at the endpoint, they wait for it until their
+deadline instead). `inspectDaemonStartupReservation(paths)` reports the reservation, its
+helper's state and, once the helper exited, the relaunch time (`relaunchAfter`) without
+changing it (`rush-client daemon status`), and
 `requestDaemonShutdownAsync()` resolves a reservation for the attested daemon before it
 sends shutdown, so that its successor can start. `resolveDaemonStartupReservationAsync(client,
 paths)` does the same for a caller that stops the daemon without replacing it (`rush-client
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index c48949b75f..108d46712c 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -94,9 +94,10 @@ export function isOwnerProcessAlive(owner: { readonly pid: number; readonly star
 }
 
 /**
- * Makes stale ownership reclaimable when that is provably safe. The caller must hold the start mutex and
- * have observed no startup reservation, so no legitimate daemon can be between bind and record publication;
- * a refused connection then proves no listener exists.
+ * Makes stale ownership reclaimable when that is provably safe. The caller must hold the start mutex and have
+ * observed no startup reservation, or taken over one whose helper is gone. A daemon publishes its endpoint only
+ * after it listens, so a refused connection then proves no listener exists. A daemon that a gone helper
+ * launched may still publish later; of two daemons that publish, the second finds the first and exits.
  */
 export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promise<void> {
   const state: OwnershipState = inspectOwnership(paths.lockfilePath);
diff --git a/libraries/rush-client-core/src/DaemonStartup.ts b/libraries/rush-client-core/src/DaemonStartup.ts
index 56b01abdd4..db21e00d76 100644
--- a/libraries/rush-client-core/src/DaemonStartup.ts
+++ b/libraries/rush-client-core/src/DaemonStartup.ts
@@ -153,9 +153,9 @@ function isNotFound(error: unknown): boolean {
 /**
  * Runs independently of the requesting client. Once spawn succeeds, only protocol readiness releases
  * the reservation: an arbitrary launcher may outlive its parent or spawn descendants.
- * Failure before readiness deliberately leaves a durable reservation instead of guessing that a PID is safe.
- * The reservation records this helper, so once it exits, later clients report the retained reservation at once
- * instead of waiting for a release that cannot happen.
+ * Failure before readiness deliberately leaves the reservation instead of guessing that a PID is safe.
+ * The reservation records this helper, so once it exits, the next client that starts the daemon takes the
+ * reservation over instead of waiting for a release that cannot happen.
  */
 export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Promise<void> {
   const { paths, startCommand: start, token, timeoutMs } = options;
@@ -183,6 +183,10 @@ export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Pro
   const deadline: number = Date.now() + timeoutMs;
   let backoffMs: number = 50;
   while (Date.now() < deadline) {
+    // Sampled before connecting: a launcher can exit because another daemon published this endpoint first (for
+    // example one that an abandoned reservation's helper launched before a client took the reservation over).
+    // That daemon already listens by then, so the attempt below finds it.
+    const launcherExited: boolean = child.exitCode !== null || child.signalCode !== null;
     let client: DaemonClient | undefined;
     try {
       client = await DaemonClient.connectAsync({
@@ -209,7 +213,7 @@ export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Pro
       }
       return;
     }
-    if (child.exitCode !== null || child.signalCode !== null) {
+    if (launcherExited) {
       await closed;
       throw new DaemonClientError(
         'startupFailed',
diff --git a/libraries/rush-client-core/src/DaemonStartupReservation.ts b/libraries/rush-client-core/src/DaemonStartupReservation.ts
index 301a21cff6..79d0a327ee 100644
--- a/libraries/rush-client-core/src/DaemonStartupReservation.ts
+++ b/libraries/rush-client-core/src/DaemonStartupReservation.ts
@@ -8,7 +8,7 @@ import {
 } from '@rushstack/rush-daemon-transport';
 
 import type { DaemonClient } from './DaemonClient';
-import { isDaemonOwnership, isOwnerProcessAlive } from './DaemonOwnership';
+import { isDaemonOwnership, isEndpointUnboundAsync, isOwnerProcessAlive } from './DaemonOwnership';
 import {
   getDaemonStartupFilePath,
   readDaemonStartupReservation,
@@ -18,11 +18,20 @@ import {
 } from './DaemonStartup';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
+/**
+ * How long after a launch a client that starts the daemon may take over its reservation once the helper exited.
+ * It matches the default startup timeout. A daemon that fails to start the same way each time, for example
+ * because of a configuration error, is then launched at most once per interval however many clients start it;
+ * the others are refused at once and can run without it.
+ */
+const ABANDONED_STARTUP_RELAUNCH_DELAY_MS: number = 15000;
+
 /**
  * What a startup reservation's recorded helper can still do. `running`: it may still release the reservation.
- * `exited`: it is provably gone, so only a client that finds the daemon ready, or
- * `resetDaemonArtifactsAsync()`, removes the reservation. `unknown`: the reservation records no helper,
- * for example because an older client wrote it.
+ * `exited`: it is provably gone, so it never will. A client that finds the daemon ready removes the reservation,
+ * and so does a client that starts the daemon after `relaunchAfter` while nothing listens at the endpoint (it
+ * takes the reservation over). `unknown`: the reservation records no helper, for example because an older client
+ * wrote it.
  * @beta
  */
 export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
@@ -35,6 +44,11 @@ export interface IDaemonStartupReservationInfo {
   readonly helperPid?: number;
   /** Whether the helper can still release the reservation. */
   readonly helperState: DaemonStartupHelperState;
+  /**
+   * When the helper exited: the time (ISO 8601) after which a client that starts the daemon takes the reservation
+   * over and launches the daemon again, provided that nothing listens at the endpoint then.
+   */
+  readonly relaunchAfter?: string;
 }
 
 /**
@@ -48,10 +62,14 @@ export function inspectDaemonStartupReservation(
   const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
   if (!reservation) return undefined;
   const { helper } = reservation;
+  const helperState: DaemonStartupHelperState = getStartupHelperState(reservation);
   return {
     path: getDaemonStartupFilePath(paths),
     ...(helper ? { helperPid: helper.pid } : {}),
-    helperState: getStartupHelperState(reservation)
+    helperState,
+    ...(helper && helperState === 'exited'
+      ? { relaunchAfter: new Date(getStartupRelaunchTime(helper)).toISOString() }
+      : {})
   };
 }
 
@@ -60,6 +78,14 @@ export function getStartupHelperState(reservation: IDaemonStartupReservation): D
   return isStartupHelperAlive(reservation.helper) ? 'running' : 'exited';
 }
 
+/**
+ * The time (milliseconds since the epoch) after which a client that starts the daemon may take over a reservation
+ * of `helper` once that helper exited. The helper was recorded when it was launched.
+ */
+export function getStartupRelaunchTime(helper: IDaemonStartupHelper): number {
+  return Date.parse(helper.startedAt) + ABANDONED_STARTUP_RELAUNCH_DELAY_MS;
+}
+
 function isStartupHelperAlive(helper: IDaemonStartupHelper): boolean {
   try {
     return isOwnerProcessAlive(helper);
@@ -86,6 +112,32 @@ export function resolveStartupReservationForReadyDaemon(
   return removeDaemonStartupIfUnchanged(paths, reservation);
 }
 
+/**
+ * Removes a reservation whose helper is provably gone, once its relaunch time has passed and while nothing listens
+ * at the endpoint, so that the caller can launch the daemon again. Only the helper releases a reservation, so this
+ * one would otherwise refuse every automatic start. The caller must hold the start mutex, which keeps other clients
+ * from taking it over or from reserving startup at the same time.
+ * @remarks A daemon that the gone helper launched may still be starting. Launching another is still safe: a daemon
+ * publishes the endpoint only with link(2), or as the first instance of a named pipe, and only after it listens,
+ * and it reclaims the endpoint only from an owner that is dead and does not accept a connection. So whichever
+ * daemon publishes second finds the other and exits, and a helper releases its reservation once either daemon
+ * completes hello/ping.
+ * @returns true when this call removed `reservation`.
+ */
+export async function tryTakeOverAbandonedStartupReservationAsync(
+  paths: IDaemonPaths,
+  reservation: IDaemonStartupReservation
+): Promise<boolean> {
+  const { helper } = reservation;
+  if (!helper || getStartupHelperState(reservation) !== 'exited') return false;
+  if (Date.now() < getStartupRelaunchTime(helper)) return false;
+  if (!(await isEndpointUnboundAsync(paths.socketPath))) return false;
+  // The helper may have released its reservation just before it exited.
+  const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(paths);
+  if (!current || current.contents !== reservation.contents) return false;
+  return removeDaemonStartupIfUnchanged(paths, current);
+}
+
 /**
  * {@link resolveStartupReservationForReadyDaemon} for a connected client, taking the start mutex without waiting.
  * Returns false, keeping the reservation, while another client or this process holds the mutex.
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 369ec81128..3d0dfadc6a 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -38,13 +38,16 @@ import {
   getDaemonStartupFilePath,
   readDaemonStartupReservation,
   reserveDaemonStartup,
+  type IDaemonStartupHelper,
   type IDaemonStartupOptions,
   type IDaemonStartupReservation
 } from './DaemonStartup';
 import {
   getStartupHelperState,
+  getStartupRelaunchTime,
   resolveStartupReservationForReadyDaemon,
   tryResolveStartupReservationAsync,
+  tryTakeOverAbandonedStartupReservationAsync,
   type DaemonStartupHelperState
 } from './DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
@@ -180,7 +183,10 @@ async function startDaemonAsync(
   }
   if (!lock) throw startupError(options, 'timed out waiting for another starting client');
   try {
-    await waitForStartupReservationAsync(options, deadline);
+    const abandonedHelper: IDaemonStartupHelper | undefined = await waitForStartupReservationAsync(
+      options,
+      deadline
+    );
     const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
     if (ready) return ready;
     const replacement: DaemonClient | undefined = await replaceMismatchedDaemonAsync(options, deadline);
@@ -192,7 +198,7 @@ async function startDaemonAsync(
     await reclaimStaleDaemonAsync(options.paths);
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before spawn');
     options.abortSignal?.throwIfAborted();
-    const helper: IStartupHelper = await spawnDetachedAsync(options, deadline);
+    const helper: IStartupHelper = await spawnDetachedAsync(options, deadline, abandonedHelper);
     const { child } = helper;
     backoffMs = 50;
     while (Date.now() < deadline) {
@@ -229,24 +235,37 @@ async function startDaemonAsync(
 /**
  * Holding the start mutex, waits until no startup reservation remains. The helper releases its reservation once
  * the daemon completes hello/ping, and this client resolves it on the same evidence, so a daemon that became
- * ready after its helper stopped waiting is still used. Another launch is refused while the reservation remains:
- * at once when its helper exited, since nothing else will release it, and otherwise at the deadline.
+ * ready after its helper stopped waiting is still used. Once the helper is provably gone, nothing else will
+ * release the reservation: this client refuses another launch at once until the reservation's relaunch time, and
+ * then takes the reservation over as soon as nothing listens at the endpoint. Otherwise another launch is refused
+ * at the deadline.
+ * @returns the helper of a reservation that this client took over, if any.
  */
 async function waitForStartupReservationAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
-): Promise<void> {
+): Promise<IDaemonStartupHelper | undefined> {
   while (true) {
     options.abortSignal?.throwIfAborted();
     const reservation: IDaemonStartupReservation | undefined = readDaemonStartupReservation(options.paths);
-    if (!reservation) return;
+    if (!reservation) return undefined;
     if (await tryResolveForReadyDaemonAsync(options, deadline)) continue;
+    if (await tryTakeOverAbandonedStartupReservationAsync(options.paths, reservation))
+      return reservation.helper;
     const helperState: DaemonStartupHelperState = getStartupHelperState(reservation);
-    if (helperState === 'exited' || Date.now() >= deadline) {
-      // The helper may have released its reservation just before it exited.
+    const now: number = Date.now();
+    const relaunchTime: number | undefined =
+      helperState === 'exited' ? getStartupRelaunchTime(reservation.helper!) : undefined;
+    const pendingRelaunchTime: number | undefined =
+      relaunchTime !== undefined && now < relaunchTime ? relaunchTime : undefined;
+    if (now >= deadline || pendingRelaunchTime !== undefined) {
+      // The helper may have released its reservation just before it exited or before the deadline.
       const current: IDaemonStartupReservation | undefined = readDaemonStartupReservation(options.paths);
       if (!current || current.contents !== reservation.contents) continue;
-      throw startupError(options, describeUnresolvedReservation(options.paths, reservation, helperState));
+      throw startupError(
+        options,
+        describeUnresolvedReservation(options.paths, reservation, helperState, pendingRelaunchTime)
+      );
     }
     await delayAsync(Math.min(100, Math.max(1, deadline - Date.now())), undefined, {
       signal: options.abortSignal
@@ -279,16 +298,20 @@ async function tryResolveForReadyDaemonAsync(
   }
 }
 
+/** `pendingRelaunchTime` is the relaunch time of a helper that exited, while that time has not passed yet. */
 function describeUnresolvedReservation(
   paths: IDaemonPaths,
   reservation: IDaemonStartupReservation,
-  helperState: DaemonStartupHelperState
+  helperState: DaemonStartupHelperState,
+  pendingRelaunchTime: number | undefined
 ): string {
   const prefix: string = `has an unresolved startup handoff at ${getDaemonStartupFilePath(paths)}`;
   const helperPid: number | undefined = reservation.helper?.pid;
   switch (helperState) {
     case 'exited':
-      return `${prefix}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch. ${DAEMON_RESET_HINT}`;
+      return pendingRelaunchTime !== undefined
+        ? `${prefix}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch until ${new Date(pendingRelaunchTime).toISOString()}, so that a daemon that cannot start is not launched by every command.`
+        : `${prefix}: its startup helper (PID ${helperPid}) exited before the daemon became ready, but a process still accepts connections at ${paths.socketPath}; refusing another launch. ${DAEMON_RESET_HINT}`;
     case 'running':
       return `${prefix}: its startup helper (PID ${helperPid}) is still waiting for the daemon to become ready; refusing another launch`;
     default:
@@ -604,7 +627,8 @@ async function waitForPreviousDaemonAsync(
 
 async function spawnDetachedAsync(
   options: IConnectOrStartDaemonOptions,
-  deadline: number
+  deadline: number,
+  abandonedHelper: IDaemonStartupHelper | undefined
 ): Promise<IStartupHelper> {
   const start: IDaemonStartCommand = {
     ...options.startCommand!,
@@ -633,6 +657,14 @@ async function spawnDetachedAsync(
       }
       fs.fchmodSync(logFd, 0o600);
     }
+    if (abandonedHelper) {
+      fs.writeSync(
+        logFd,
+        `${new Date().toISOString()} rush-client (PID ${process.pid}): took over the startup reservation of ` +
+          `startup helper PID ${abandonedHelper.pid} (started ${abandonedHelper.startedAt}), which exited ` +
+          'before the daemon became ready; starting the daemon again.\n'
+      );
+    }
     let helper: IStartupHelper | undefined;
     try {
       const child: ChildProcess = spawn(process.execPath, [path.join(__dirname, 'runDaemonStartup.js')], {
diff --git a/libraries/rush-client-core/src/test/DaemonStartup.test.ts b/libraries/rush-client-core/src/test/DaemonStartup.test.ts
new file mode 100644
index 0000000000..15d5eba954
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonStartup.test.ts
@@ -0,0 +1,141 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage,
+  type DaemonControlMessage
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameConnection, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { getDaemonStartupFilePath, reserveDaemonStartup, runDaemonStartupAsync } from '../DaemonStartup';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(5);
+  }
+}
+
+function isProcessGone(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ESRCH') return true;
+    throw error;
+  }
+}
+
+describe(runDaemonStartupAsync.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-startup-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    await removeTestFolderAsync(folder);
+  });
+
+  it('releases its reservation for a ready daemon although its own launcher exited during the last attempt', async () => {
+    // Like a daemon that another launch published while this helper's launcher found it and exited: the launcher
+    // exits while a connection attempt is pending, that attempt fails, and the next one finds a ready daemon.
+    const pending: DaemonFrameConnection[] = [];
+    const closedConnections: Set<DaemonFrameConnection> = new Set();
+    let answering: boolean = false;
+    const sockets: Set<net.Socket> = new Set();
+    const server: net.Server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+      const connection: DaemonFrameConnection = new DaemonFrameConnection(socket);
+      connection.onClosed(() => closedConnections.add(connection));
+      connection.onFrame(async (frame) => {
+        if (frame.kind !== DaemonFrameType.controlJson) return;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        let reply: DaemonControlMessage | undefined;
+        if (message.kind === 'hello') {
+          if (!answering) {
+            pending.push(connection);
+            return;
+          }
+          reply = {
+            kind: 'helloAck',
+            payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'test' }
+          };
+        } else if (message.kind === 'ping') {
+          reply = { kind: 'pong', payload: { uptimeMs: 1, daemonVersion: 'test' } };
+        }
+        if (reply) {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage(reply)
+          });
+        }
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(paths.socketPath, resolve));
+    try {
+      const token: string = reserveDaemonStartup(paths, {
+        pid: process.pid,
+        startedAt: new Date().toISOString()
+      });
+      const launcherPidPath: string = path.join(folder, 'launcher-pid');
+      const exitNowPath: string = path.join(folder, 'exit-now');
+      const launcher: string = [
+        "const fs = require('fs');",
+        `fs.writeFileSync(${JSON.stringify(launcherPidPath)}, String(process.pid));`,
+        `setInterval(() => { if (fs.existsSync(${JSON.stringify(exitNowPath)})) process.exit(1); }, 5);`
+      ].join('\n');
+      const outcome: Promise<string> = runDaemonStartupAsync({
+        paths,
+        token,
+        timeoutMs: 10000,
+        startCommand: {
+          command: process.execPath,
+          args: ['-e', launcher],
+          cwd: folder,
+          environment: { PATH: process.env.PATH ?? '', SystemRoot: process.env.SystemRoot ?? '' }
+        }
+      }).then(
+        () => 'resolved',
+        (error: Error) => error.message
+      );
+
+      await waitUntilAsync(() => pending.length > 0 && fs.existsSync(launcherPidPath), 'the first attempt');
+      const attempt: DaemonFrameConnection = pending[pending.length - 1];
+      const launcherPid: number = Number(fs.readFileSync(launcherPidPath, 'utf8'));
+      fs.writeFileSync(exitNowPath, '');
+      // This process spawned the launcher, so once its PID is gone, the helper has observed its exit.
+      await waitUntilAsync(() => isProcessGone(launcherPid), 'the launcher is reaped');
+      expect(closedConnections.has(attempt)).toBe(false);
+      answering = true;
+      await attempt.closeAsync();
+
+      expect(await outcome).toBe('resolved');
+      expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
index c120d3416b..94fedd12f7 100644
--- a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
@@ -294,7 +294,10 @@ describe('connectOrAwaitDaemonStartupAsync', () => {
       (error: unknown) => error
     );
     expect(refusal).toBeInstanceOf(DaemonClientError);
-    expect((refusal as Error).message).toContain('exited before the daemon became ready');
+    // Until the relaunch time, the refusal is at once, so that the caller can run without the daemon.
+    expect((refusal as Error).message).toContain(
+      'exited before the daemon became ready; refusing another launch until '
+    );
     expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
     expect(onAwaitStartup).not.toHaveBeenCalled();
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index dca59836f5..f7159c3594 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -8,6 +8,7 @@ import * as fs from 'node:fs';
 import * as net from 'node:net';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { FileSystem } from '@rushstack/node-core-library';
@@ -28,7 +29,8 @@ import {
   connectToPlannedSuccessorAsync,
   requestDaemonShutdownAsync,
   resolveDaemonStartupReservationAsync,
-  type IConnectOrStartDaemonOptions
+  type IConnectOrStartDaemonOptions,
+  type IDaemonStartCommand
 } from '../connectOrStartDaemon';
 import { executeWithDaemonRestartAsync, type IDaemonRestartNotice } from '../executeWithDaemonRestart';
 import { getDaemonStartupFilePath, releaseDaemonStartup, reserveDaemonStartup } from '../DaemonStartup';
@@ -36,6 +38,13 @@ import { inspectDaemonStartupReservation } from '../DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
+/** How long after a launch a client may take over its reservation once the helper exited. */
+const RELAUNCH_DELAY_MS: number = 15000;
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
 describe('detached daemon startup', () => {
   let folder: string;
   let paths: IDaemonPaths;
@@ -88,6 +97,8 @@ describe('detached daemon startup', () => {
       await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
       expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
     }
+    // A test that expects a fixture daemon to fail checks and removes this record.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
     if (fs.existsSync(path.join(folder, 'parents'))) {
       const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
       await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
@@ -157,6 +168,89 @@ describe('detached daemon startup', () => {
     return contents;
   }
 
+  /** Records the reservation's launch as one relaunch delay earlier, so that its relaunch time has passed. */
+  function ageReservation(): string {
+    const record: { helperStartedAt: string } = JSON.parse(
+      fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')
+    );
+    const helperStartedAt: string = new Date(
+      Date.parse(record.helperStartedAt) - RELAUNCH_DELAY_MS
+    ).toISOString();
+    const contents: string = JSON.stringify({ ...record, helperStartedAt });
+    fs.writeFileSync(getDaemonStartupFilePath(paths), contents);
+    return helperStartedAt;
+  }
+
+  function readTakeOverLines(): string[] {
+    return readIfPresent(getDaemonLogFilePath(paths))
+      .split('\n')
+      .filter((line) => line.includes('took over the startup reservation'));
+  }
+
+  /** Unlike waitForTestProcessExitAsync, a zombie does not count: until it is reaped, its PID looks alive. */
+  async function waitForProcessGoneAsync(pid: number): Promise<void> {
+    const deadline: number = Date.now() + 5000;
+    while (true) {
+      try {
+        process.kill(pid, 0);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ESRCH') return;
+        throw error;
+      }
+      if (Date.now() >= deadline) throw new Error(`Process ${pid} was not reaped in time.`);
+      await delayAsync(10);
+    }
+  }
+
+  async function waitForFileAsync(filePath: string): Promise<string> {
+    const deadline: number = Date.now() + 5000;
+    while (!fs.existsSync(filePath) && Date.now() < deadline) await delayAsync(20);
+    return fs.readFileSync(filePath, 'utf8');
+  }
+
+  /**
+   * Leaves a daemon held before it listens, whose startup helper was killed after its client gave up, and a
+   * reservation whose relaunch time has passed.
+   */
+  async function abandonStartupBeforeBindAsync(): Promise<{ daemonPid: number; helperPid: number }> {
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 1000 })).rejects.toThrow(
+      'timed out awaiting hello/ping readiness'
+    );
+    const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+    const { helperPid } = JSON.parse(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8'));
+    expect(fs.readFileSync(path.join(folder, 'parents'), 'utf8')).toBe(`${helperPid}\n`);
+    // This test started the helper (through connectOrStartDaemonAsync), so it may signal that PID.
+    process.kill(helperPid, 'SIGKILL');
+    await waitForProcessGoneAsync(helperPid);
+    expect(inspectDaemonStartupReservation(paths)).toMatchObject({ helperPid, helperState: 'exited' });
+    ageReservation();
+    return { daemonPid, helperPid };
+  }
+
+  /** The start command of a second fixture daemon, which waits before it listens while "hold-prebind-b" exists. */
+  function getSecondDaemonOptions(): IConnectOrStartDaemonOptions {
+    const startCommand: IDaemonStartCommand = options.startCommand!;
+    return {
+      ...options,
+      startCommand: {
+        ...startCommand,
+        environment: { ...startCommand.environment, FIXTURE_HOLD_PREBIND: 'hold-prebind-b' }
+      }
+    };
+  }
+
+  /** Waits for the fixture daemon that lost the race for the endpoint to exit, and checks why it failed. */
+  async function expectLostEndpointRaceAsync(loserPid: number, winnerPid: number): Promise<void> {
+    await waitForTestProcessExitAsync(loserPid);
+    const failuresPath: string = path.join(folder, 'failures');
+    expect(readIfPresent(failuresPath)).toMatch(
+      new RegExp(`^${loserPid} (Daemon process ${winnerPid} still owns |A live daemon already listens at )`)
+    );
+    expect(readIfPresent(failuresPath).trim().split('\n')).toHaveLength(1);
+    fs.unlinkSync(failuresPath);
+  }
+
   async function startFixtureDaemonAsync(): Promise<number> {
     const client: DaemonClient = await connectOrStartDaemonAsync(options);
     const { pid } = await client.status;
@@ -249,7 +343,7 @@ describe('detached daemon startup', () => {
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
   });
 
-  it('refuses another launch at once when the startup helper exited without releasing its reservation', async () => {
+  it('refuses another launch at once after the startup helper exited, until the relaunch time', async () => {
     const startupPath: string = getDaemonStartupFilePath(paths);
     const failing: IConnectOrStartDaemonOptions = {
       ...options,
@@ -257,11 +351,13 @@ describe('detached daemon startup', () => {
     };
     await expect(connectOrStartDaemonAsync(failing)).rejects.toThrow('Unable to start');
     const contents: string = fs.readFileSync(startupPath, 'utf8');
-    const { helperPid } = JSON.parse(contents);
+    const { helperPid, helperStartedAt } = JSON.parse(contents);
+    const relaunchAfter: string = new Date(Date.parse(helperStartedAt) + RELAUNCH_DELAY_MS).toISOString();
     expect(inspectDaemonStartupReservation(paths)).toEqual({
       path: startupPath,
       helperPid,
-      helperState: 'exited'
+      helperState: 'exited',
+      relaunchAfter
     });
     const started: number = Date.now();
     const error: Error = await connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 20000 }).then(
@@ -270,14 +366,144 @@ describe('detached daemon startup', () => {
     );
     expect(Date.now() - started).toBeLessThan(3000);
     expect(error.message).toContain(
-      `unresolved startup handoff at ${startupPath}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch.`
+      `unresolved startup handoff at ${startupPath}: its startup helper (PID ${helperPid}) exited before the daemon became ready; refusing another launch until ${relaunchAfter}, so that a daemon that cannot start is not launched by every command.`
     );
-    expect(error.message).toContain('daemon stop --force');
     expect(error.message).not.toContain('..');
     expect(fs.readFileSync(startupPath, 'utf8')).toBe(contents);
     expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    expect(readTakeOverLines()).toEqual([]);
+
+    // Once the relaunch time has passed, the next client takes the reservation over and starts the daemon.
+    const agedStartedAt: string = ageReservation();
+    const daemonPid: number = await startFixtureDaemonAsync();
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    const takeOvers: string[] = readTakeOverLines();
+    expect(takeOvers).toHaveLength(1);
+    expect(takeOvers[0]).toMatch(/^\d{4}-\d\d-\d\dT[\d:.]+Z rush-client /);
+    expect(takeOvers[0]).toContain(
+      `rush-client (PID ${process.pid}): took over the startup reservation of startup helper PID ${helperPid} (started ${agedStartedAt}), which exited before the daemon became ready; starting the daemon again.`
+    );
+  });
+
+  it('refuses a relaunch while a process accepts connections at the endpoint', async () => {
+    const sockets: Set<net.Socket> = new Set();
+    // Accepts connections but never completes hello, like a daemon that listens but is not ready.
+    const server: net.Server = net.createServer((socket) => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+    });
+    await new Promise<void>((resolve) => server.listen(paths.socketPath, resolve));
+    try {
+      const helperPid: number = await getExitedPidAsync();
+      const contents: string = writeReservation(
+        helperPid,
+        new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString()
+      );
+      const started: number = Date.now();
+      const error: Error = await connectOrStartDaemonAsync({
+        ...options,
+        startupTimeoutMs: 1500,
+        timeoutMs: 200
+      }).then(
+        () => new Error('Expected startup to be refused.'),
+        (refusal: Error) => refusal
+      );
+      // It keeps checking until the deadline, since that process may still become ready.
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1400);
+      expect(error.message).toContain(
+        `its startup helper (PID ${helperPid}) exited before the daemon became ready, but a process still accepts connections at ${paths.socketPath}; refusing another launch.`
+      );
+      expect(error.message).toContain('daemon stop --force');
+      expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+      expect(readTakeOverLines()).toEqual([]);
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
   });
 
+  it('never takes over a reservation whose startup helper still runs, however old', async () => {
+    // Recorded when this process started, so the reservation names this process, which still runs.
+    const helperStartedAt: number = performance.timeOrigin;
+    const age: number = Date.now() - helperStartedAt;
+    if (age <= RELAUNCH_DELAY_MS + 1000) await delayAsync(RELAUNCH_DELAY_MS + 1000 - age);
+    const contents: string = writeReservation(process.pid, new Date(helperStartedAt).toISOString());
+    expect(inspectDaemonStartupReservation(paths)).toMatchObject({ helperState: 'running' });
+    await expect(connectOrStartDaemonAsync({ ...options, startupTimeoutMs: 500 })).rejects.toThrow(
+      `its startup helper (PID ${process.pid}) is still waiting for the daemon to become ready; refusing another launch`
+    );
+    expect(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8')).toBe(contents);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    expect(readTakeOverLines()).toEqual([]);
+  }, 30000);
+
+  it('lets exactly one of several clients take over a reservation whose helper exited', async () => {
+    const helperPid: number = await getExitedPidAsync();
+    writeReservation(helperPid, new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString());
+    const results = await Promise.all(Array.from({ length: 4 }, () => startClient().result));
+    expect(results).toEqual(Array.from({ length: 4 }, () => ({ code: 0, stderr: '' })));
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    const takeOvers: string[] = readTakeOverLines();
+    expect(takeOvers).toHaveLength(1);
+    expect(takeOvers[0]).toContain(`took over the startup reservation of startup helper PID ${helperPid} `);
+  }, 15000);
+
+  it('keeps one daemon when a relaunch outpaces the daemon of a killed startup helper', async () => {
+    const { daemonPid, helperPid } = await abandonStartupBeforeBindAsync();
+    const client: DaemonClient = await connectOrStartDaemonAsync(getSecondDaemonOptions());
+    let successorPid: number;
+    try {
+      successorPid = (await client.status).pid!;
+    } finally {
+      await client.closeAsync();
+    }
+    expect(successorPid).not.toBe(daemonPid);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n${successorPid}\n`);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+    expect(readTakeOverLines()).toHaveLength(1);
+    expect(readTakeOverLines()[0]).toContain(`startup helper PID ${helperPid} `);
+
+    // The first daemon finds the successor at the endpoint and exits.
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    await expectLostEndpointRaceAsync(daemonPid, successorPid);
+    const next: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await next.status).pid).toBe(successorPid);
+    } finally {
+      await next.closeAsync();
+    }
+  }, 20000);
+
+  it('keeps one daemon when the daemon of a killed startup helper outpaces the relaunch', async () => {
+    const { daemonPid } = await abandonStartupBeforeBindAsync();
+    fs.writeFileSync(path.join(folder, 'hold-prebind-b'), '');
+    const relaunch: Promise<DaemonClient> = connectOrStartDaemonAsync(getSecondDaemonOptions());
+    const successorPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind-b')));
+    expect(successorPid).not.toBe(daemonPid);
+
+    // The first daemon publishes the endpoint first, so the relaunch's helper finds it ready.
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    const client: DaemonClient = await relaunch;
+    try {
+      expect((await client.status).pid).toBe(daemonPid);
+    } finally {
+      await client.closeAsync();
+    }
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+
+    fs.unlinkSync(path.join(folder, 'hold-prebind-b'));
+    await expectLostEndpointRaceAsync(successorPid, daemonPid);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n${successorPid}\n`);
+    const next: DaemonClient = await connectOrStartDaemonAsync(options);
+    try {
+      expect((await next.status).pid).toBe(daemonPid);
+    } finally {
+      await next.closeAsync();
+    }
+  }, 20000);
+
   it.each(['legacy', 'exited helper', 'no auto-start'])(
     'uses and resolves a ready daemon next to a retained startup reservation (%s)',
     async (kind) => {
@@ -430,11 +656,13 @@ describe('detached daemon startup', () => {
       helperState: 'running'
     });
     const exitedPid: number = await getExitedPidAsync();
-    writeReservation(exitedPid);
+    const helperStartedAt: Date = new Date();
+    writeReservation(exitedPid, helperStartedAt.toISOString());
     expect(inspectDaemonStartupReservation(paths)).toEqual({
       path: startupPath,
       helperPid: exitedPid,
-      helperState: 'exited'
+      helperState: 'exited',
+      relaunchAfter: new Date(helperStartedAt.getTime() + RELAUNCH_DELAY_MS).toISOString()
     });
     if (process.platform === 'linux') {
       // This process started after the recorded helper, so it merely reuses the PID.
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index faeac1e486..5b8f10234b 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -24,6 +24,8 @@ async function mainAsync(): Promise<void> {
   const daemonVersion: string = process.argv[3] ?? 'fixture';
   const mode: string | undefined = process.argv[4];
   const restartMode: string | undefined = mode?.startsWith('restart-') ? mode : undefined;
+  // While this file exists, the daemon waits before it listens. It writes its PID to the file named without "hold-".
+  const holdPrebindName: string = process.env.FIXTURE_HOLD_PREBIND ?? 'hold-prebind';
   const connections: Set<DaemonFrameConnection> = new Set();
   let closing: Promise<void> | undefined;
   let heldRequest: { connection: DaemonFrameConnection; requestId: string } | undefined;
@@ -37,11 +39,11 @@ async function mainAsync(): Promise<void> {
   fs.writeFileSync(path.join(folder, 'runtime-base'), process.env.RUSHD_RUNTIME_DIR ?? '(unset)');
   process.stdout.write('launcher stdout\n');
   process.stderr.write('launcher stderr\n');
-  if (fs.existsSync(path.join(folder, 'hold-prebind'))) {
+  if (fs.existsSync(path.join(folder, holdPrebindName))) {
     const marker: string = path.join(folder, `prebind-${process.pid}.tmp`);
     fs.writeFileSync(marker, String(process.pid));
-    fs.renameSync(marker, path.join(folder, 'prebind'));
-    while (fs.existsSync(path.join(folder, 'hold-prebind'))) {
+    fs.renameSync(marker, path.join(folder, holdPrebindName.replace(/^hold-/, '')));
+    while (fs.existsSync(path.join(folder, holdPrebindName))) {
       if (fs.existsSync(path.join(folder, 'stop'))) {
         fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
         return;
@@ -241,6 +243,10 @@ function readNumber(folder: string, name: string, defaultValue: number): number
 }
 
 mainAsync().catch((error: Error) => {
+  // For example, the daemon found another one at the endpoint. The test expects this exit, so it counts as stopped.
+  const folder: string = path.dirname((JSON.parse(process.argv[2]) as IDaemonPaths).lockfilePath);
+  fs.appendFileSync(path.join(folder, 'failures'), `${process.pid} ${error.message}\n`);
+  fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
   process.stderr.write(`${error.stack}\n`);
   process.exitCode = 1;
 });

From 2ace16d6e37bf78aaf971ab7cf2b3b691fc431e8 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 02:37:43 +0000
Subject: [PATCH 059/265] [rush-client-core] After a daemon crash the client
 reaps its orphaned operations before it returns

Swarm integration step 44; original commit 80219e0892 (merge of swarm/r06-t154-int2 at 25c7f0135c).
Scope: task 154.

Brings r06's task 154 (board 2382), re-tipped on c0e17d82ab (board 2747): after a daemon crash, the client reaps the orphaned operations before returning, and before `--no-daemon` runs. Second agent: t05 board 2689 on 14baba4338. ch01's e2e: the orphan is reaped after a crash.

s16 batch B, item 4 of 5 (ch01 board 2984).

Gate: ch01 GATE OK board 2984 (tree 2453314813)

Commits folded into this step (2):
- e79486fa37 [rush-client-core] Stop a crashed daemon's operations before reporting the crash (task 154)
- 14baba4338 [rush-cli-client] Reclaim a crashed daemon before Rush runs in-process (task 154)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  10 +-
 .../src/daemonConnectionOptions.ts            |  11 +-
 apps/rush-cli-client/src/launchClient.ts      |  32 ++-
 .../src/test/nativeBuild.test.ts              |  63 +++++-
 ...54-inprocess-reclaim_2026-09-28-23-56.json |  11 +
 ...54-inprocess-reclaim_2026-09-28-23-56.json |  11 +
 ...-reclaim-after-crash_2026-09-28-23-50.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   3 +
 libraries/rush-client-core/README.md          |  17 ++
 .../rush-client-core/src/DaemonDisconnect.ts  |   9 +-
 .../src/ExitedDaemonReclaim.ts                | 101 +++++++++
 libraries/rush-client-core/src/index.ts       |   1 +
 .../src/test/DaemonDisconnect.test.ts         | 196 ++++++++++++++++--
 .../src/test/ExitedDaemonReclaim.test.ts      | 136 ++++++++++++
 .../src/test/OrphanedOperation.ts             |  90 ++++++++
 15 files changed, 678 insertions(+), 24 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t154-reclaim-after-crash_2026-09-28-23-50.json
 create mode 100644 libraries/rush-client-core/src/ExitedDaemonReclaim.ts
 create mode 100644 libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
 create mode 100644 libraries/rush-client-core/src/test/OrphanedOperation.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 75f5aa6bda..1f4dc9e3f7 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -285,8 +285,14 @@ and is not retried. The diagnostic keeps "Daemon disconnected before delivering
 command was not retried." and says what happened to rushd. If its process exited (a crash, an
 out-of-memory kill or a signal), it names the PID, points to `rush-client daemon logs` and, if
 the daemon exits again, to `--no-daemon` (`rushx-client --no-daemon` for Rushx), and quotes on a
-second line the fatal error that the launcher log recorded after the command was sent. If
-rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
+second line the fatal error that the launcher log recorded after the command was sent. Before it
+prints that, the client stops the operations that the exited daemon left running and removes its
+ownership record and socket, as the next daemon start would, so a rerun, with or without
+`--no-daemon`, does not race them. A `RUSH_DAEMON_ORPHANS_REAPED` warning says what it stopped.
+Rush run in-process, with `--no-daemon` or as a fallback, first does the same when the ownership
+record names a daemon that no longer runs, for example when the client that ran the command was
+killed along with the daemon.
+If rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
 or `daemon restart` still end a command as cancelled (exit code 130).
 
 Piped input uses protocol 0.7's negotiated stdin admission and EOF. The client does
diff --git a/apps/rush-cli-client/src/daemonConnectionOptions.ts b/apps/rush-cli-client/src/daemonConnectionOptions.ts
index 26f7158a9d..d088352dde 100644
--- a/apps/rush-cli-client/src/daemonConnectionOptions.ts
+++ b/apps/rush-cli-client/src/daemonConnectionOptions.ts
@@ -33,9 +33,7 @@ export function getDaemonConnectionOptions(
       'The synchronous launcher only supports its installed engine; use asynchronous version selection.'
     );
   }
-  const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
-    computeDaemonWorkspaceKey({ canonicalRepoRoot, rushVersion })
-  );
+  const paths: IDaemonPaths = getDaemonPaths(canonicalRepoRoot, rushVersion);
   // Every daemon command trusts files in this folder: the socket, the lockfile, the log and the reservation.
   assertDaemonRuntimeFolderIsPrivate(paths);
   return {
@@ -87,3 +85,10 @@ export async function getDaemonConnectionOptionsAsync(
     });
   return { ...options, expectedDaemonVersion: launch.daemonVersion, startCommand: launch.startCommand };
 }
+
+/** The runtime files of the workspace's daemon for this Rush version: its socket and ownership record. */
+export function getDaemonPaths(repoRoot: string, rushVersion: string): IDaemonPaths {
+  return resolveDaemonPathsFromProcess(
+    computeDaemonWorkspaceKey({ canonicalRepoRoot: fs.realpathSync.native(repoRoot), rushVersion })
+  );
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 095ea16714..308dba115b 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -15,11 +15,13 @@ import {
   captureDaemonRequest,
   connectOrAwaitDaemonStartupAsync,
   executeWithDaemonRestartAsync,
+  reclaimCrashedDaemonAsync,
   type DaemonClient,
   type DaemonClientOutcome,
   type IConnectOrStartDaemonOptions
 } from '@rushstack/rush-client-core';
 import type { DaemonVerbosity, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
 import { executeDaemonCommandAsync } from './daemonCommands';
@@ -33,7 +35,7 @@ import {
   getSignalExitCode,
   isCancelledOutcome
 } from './clientCancellation';
-import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
+import { getDaemonConnectionOptionsAsync, getDaemonPaths } from './daemonConnectionOptions';
 import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
@@ -93,7 +95,7 @@ export async function launchClientAsync(
   }
   if (!route.daemon || !rushJsonPath || route.commandName === undefined) {
     agentRenderer?.dispose();
-    launchInProcess(route.argv, rushx, selectedVersion);
+    await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
     return;
   }
   const terminal: ConsoleTerminalProvider = new ConsoleTerminalProvider();
@@ -170,7 +172,7 @@ export async function launchClientAsync(
       throw error;
     agentRenderer?.dispose();
     process.stderr.write(`rush-client: ${error.message} Using in-process Rush.\n`);
-    launchInProcess(route.argv, rushx, selectedVersion);
+    await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
     return;
   }
   const abort: AbortController = new AbortController();
@@ -306,10 +308,32 @@ export async function launchClientAsync(
   } else {
     agentRenderer?.dispose();
     process.stderr.write(`rush-client: ${outcome.message ?? outcome.reason}; using in-process Rush.\n`);
-    launchInProcess(route.argv, rushx, selectedVersion);
+    await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
   }
 }
 
+/**
+ * Runs Rush in-process. A daemon that crashed while it ran a command can leave its operations running, and
+ * they could overwrite this command's outputs, so they are stopped first, as the next daemon start would.
+ */
+async function launchInProcessAsync(
+  argv: ReadonlyArray<string>,
+  rushx: boolean,
+  selectedVersion: string,
+  rushJsonPath: string | undefined
+): Promise<void> {
+  if (rushJsonPath) {
+    let paths: IDaemonPaths | undefined;
+    try {
+      paths = getDaemonPaths(path.dirname(rushJsonPath), selectedVersion);
+    } catch {
+      // Without the daemon's folder there is nothing to reclaim; Rush reports a workspace problem itself.
+    }
+    if (paths) await reclaimCrashedDaemonAsync(paths);
+  }
+  launchInProcess(argv, rushx, selectedVersion);
+}
+
 function launchInProcess(argv: ReadonlyArray<string>, rushx: boolean, selectedVersion: string): void {
   const executable: string = rushx ? 'rushx' : 'rush';
   const rushFolder: string = path.dirname(require.resolve('@microsoft/rush/package.json'));
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index 2703d68a41..efcbf6154a 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -1,14 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { spawn } from 'node:child_process';
+import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { Rush } from '@microsoft/rush-lib';
 import { DaemonClient } from '@rushstack/rush-client-core';
-import { RUSHD_GRAPH_SNAPSHOT } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_PROTOCOL_VERSION, RUSHD_GRAPH_SNAPSHOT } from '@rushstack/rush-daemon-protocol';
+import { writeDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import {
   createNativeBuildTestFixture,
   type INativeBuildTestFixture,
@@ -17,6 +18,43 @@ import {
 
 // A pending CLI startup can take 15s; allow its join plus daemon stop/drain and fixture removal.
 const NATIVE_FIXTURE_CLEANUP_TIMEOUT_MS: number = 35_000;
+// An operation process that a stand-in daemon starts; it exits by itself after a minute.
+const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+// A stand-in daemon: like a phased operation, its operation process shares the daemon's process group.
+const STAND_IN_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process')" +
+  `.spawn(process.execPath,['-e','${OPERATION_SCRIPT}'],{stdio:'ignore'});` +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+
+/** Records a stand-in daemon as the workspace's daemon, then SIGKILLs only it, so its operation keeps running. */
+async function startCrashedDaemonAsync(
+  paths: IDaemonPaths
+): Promise<{ daemonPid: number; operationPid: number }> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', STAND_IN_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const [chunk] = (await once(daemon.stdout!, 'data')) as [Buffer];
+  daemon.stdout!.destroy();
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: daemon.pid!,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  return { daemonPid: daemon.pid!, operationPid: Number(chunk.toString().trim()) };
+}
+
+/** False once the operation process has exited, even before it is reaped: a zombie's command line is empty. */
+function isOperationRunning(pid: number): boolean {
+  try {
+    return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').includes(OPERATION_SCRIPT);
+  } catch {
+    return false;
+  }
+}
 
 describe('native build through the standalone client', () => {
   let fixture: INativeBuildTestFixture | undefined;
@@ -334,4 +372,25 @@ describe('native build through the standalone client', () => {
       45000
     );
   });
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a crashed daemon left running before it builds without the daemon',
+    () =>
+      runWithFixtureAsync(async ({ folder, paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          expect(isOperationRunning(operationPid)).toBe(true);
+          const native: IResult = await invokeAsync(['--no-daemon', 'build']);
+          expect(native.code).toBe(0);
+          expect(native.stderr).toContain(`Reclaimed dead daemon ${daemonPid}:`);
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+          expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
+        } finally {
+          // Only the operation process that this test started, not a process that reused its PID.
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json b/common/changes/@rushstack/rush-cli-client/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json
new file mode 100644
index 0000000000..c8949b4ec2
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Before Rush runs in-process, with `--no-daemon` or as a fallback, stop the operations that a crashed daemon left running, so that they cannot overwrite the command's outputs.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json
new file mode 100644
index 0000000000..289ae9a1b1
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t154-inprocess-reclaim_2026-09-28-23-56.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `reclaimCrashedDaemonAsync()`, which stops the operations that a crashed daemon left running, and removes its stale files, before a caller runs Rush in-process.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t154-reclaim-after-crash_2026-09-28-23-50.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t154-reclaim-after-crash_2026-09-28-23-50.json
new file mode 100644
index 0000000000..e1f5e55160
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t154-reclaim-after-crash_2026-09-28-23-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When the daemon exits while it runs a request, the client now stops the operations that the daemon left running and removes its stale files before it reports the exit, as the next daemon start would, so rerunning the command with --no-daemon no longer races them.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 76e0bf211f..0b57acf773 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -182,6 +182,9 @@ export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOp
 // @beta
 export function inspectDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservationInfo | undefined;
 
+// @beta
+export function reclaimCrashedDaemonAsync(paths: IDaemonPaths): Promise<void>;
+
 // @beta
 export function requestDaemonShutdownAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<Pick<IDaemonLockfile, 'pid' | 'startedAt'>>;
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 6461b1db0e..57ae16f689 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -63,6 +63,14 @@ an exited process that is not reaped yet counts), the message names the PID, `ru
 daemon logs` and `--no-daemon` (`rushx-client` for Rushx requests), and adds a second line
 with the first fatal error that `<lockfilePath>.log` gained after the request was sent: a
 Node.js uncaught-exception report or a V8 `FATAL ERROR:` line, clipped to one printable line.
+Before it returns that error, it reclaims the exited daemon as the next daemon start would, so
+running the command again, with or without the daemon, does not race the operations the daemon
+left running. While the ownership record names that process, it takes the start mutex and, unless
+a startup is reserved, calls `reclaimStaleDaemonAsync()`, which terminates the orphaned operation
+process groups (each reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning) and removes the
+ownership record and socket. It waits up to 5 seconds while another client holds the start mutex,
+or while the exited process is not reaped yet. If the reclaim fails or times out, the message is
+the same, and the next daemon start reclaims the daemon instead.
 If the process still runs, the message says that only the connection closed. After the abort
 signal fires, the error is unchanged, so the caller reports the cancellation.
 
@@ -161,6 +169,15 @@ only after binding. Other errors, such as `versionMismatch`, pass through unchan
 waiting, it calls the optional `onAwaitStartup(owner, waitMs)` once, with the live process and the
 remaining wait, so that the caller can say why the command has not started yet.
 
+`reclaimCrashedDaemonAsync(paths)` is for a caller that is about to run Rush in-process, as the CLI
+client does for `--no-daemon` and for each fallback. A daemon that crashed or was killed while it ran
+a command leaves its operations running, and they could overwrite the in-process command's outputs.
+When the ownership record names a PID that no longer exists (on Linux, also an exited process that is
+not reaped yet), it reclaims that daemon as described above for a lost connection: under the start
+mutex, only when no startup is reserved, and waiting up to 5 seconds. It does nothing when there is no
+record, when a process with the recorded PID runs, or when the runtime folder is not private, and it
+never throws.
+
 `getDaemonLogFilePath(paths)` is the shared stable path used by both the launcher
 and the CLI's local `daemon logs` reader. Child stdout/stderr are appended across
 restarts, including startup failures; the parent always closes its descriptor
diff --git a/libraries/rush-client-core/src/DaemonDisconnect.ts b/libraries/rush-client-core/src/DaemonDisconnect.ts
index 14ad575411..fb40328d77 100644
--- a/libraries/rush-client-core/src/DaemonDisconnect.ts
+++ b/libraries/rush-client-core/src/DaemonDisconnect.ts
@@ -17,6 +17,7 @@ import type { DaemonClient } from './DaemonClient';
 import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientError';
 import { getDaemonLogFilePath } from './DaemonLogFile';
 import { isOwnerProcessAlive } from './DaemonOwnership';
+import { reclaimExitedDaemonAsync } from './ExitedDaemonReclaim';
 import { isProcessDefunct } from './ProcessStartTime';
 
 /** A process closes its connections while it exits, so it can briefly outlive them. */
@@ -41,6 +42,8 @@ export interface IServingDaemon {
   readonly startedAt: string | undefined;
   readonly logFilePath: string;
   readonly logOffset: number | undefined;
+  /** The workspace's daemon files, which are reclaimed if the process exits. */
+  readonly paths: IDaemonPaths;
 }
 
 /** Identifies the daemon behind a ready client, or returns undefined for a peer that does not report its PID. */
@@ -56,7 +59,8 @@ export async function observeServingDaemonAsync(
     pid,
     startedAt: owner?.pid === pid ? owner.startedAt : undefined,
     logFilePath,
-    logOffset: tryGetFileSize(logFilePath)
+    logOffset: tryGetFileSize(logFilePath),
+    paths
   };
 }
 
@@ -64,6 +68,8 @@ export async function observeServingDaemonAsync(
  * Explains a connection lost before a request's result by what happened to the daemon process: whether it
  * exited, the fatal error its launcher log recorded, and how to recover. The request is never replayed.
  * Other errors are returned unchanged.
+ * @remarks If the daemon exited, this first reclaims it as the next daemon start would, so that running the
+ * command again, with or without the daemon, cannot race the operations the daemon left running.
  */
 export async function explainLostConnectionAsync(
   error: unknown,
@@ -81,6 +87,7 @@ export async function explainLostConnectionAsync(
     );
   }
   const loggedError: string | undefined = readLoggedFatalError(daemon);
+  await reclaimExitedDaemonAsync(daemon);
   const client: string = request.invocationKind === 'rushx' ? 'rushx-client' : 'rush-client';
   const message: string =
     `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${daemon.pid}) exited while it ran the command; ` +
diff --git a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
new file mode 100644
index 0000000000..807cae4029
--- /dev/null
+++ b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
@@ -0,0 +1,101 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  assertDaemonRuntimeDirIsPrivate,
+  readDaemonLockfile,
+  reclaimStaleDaemonAsync,
+  type IDaemonLockfile,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { isProcessAlive } from './DaemonOwnership';
+import { readDaemonStartupReservation } from './DaemonStartup';
+import { isProcessDefunct } from './ProcessStartTime';
+import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+
+/**
+ * How long to wait while another client reclaims the exited daemon, or while its exited process is not reaped
+ * yet. A reclaim sends SIGTERM to orphaned operations, then SIGKILL to those still running 2 seconds later.
+ */
+const RECLAIM_WAIT_MS: number = 5000;
+const RECLAIM_POLL_INTERVAL_MS: number = 50;
+
+/** A daemon process that has exited, and the workspace files that may still name it. */
+export interface IExitedDaemon {
+  readonly pid: number;
+  /** The ownership record's start time when known; a record with another start time names another process. */
+  readonly startedAt: string | undefined;
+  readonly paths: IDaemonPaths;
+}
+
+/**
+ * Reclaims the workspace's daemon when its ownership record names a process that no longer runs, such as a
+ * daemon that crashed or was killed while it ran a command. This stops the operations that the daemon left
+ * running, so that they cannot overwrite the outputs of a command that then runs without the daemon.
+ *
+ * @remarks
+ * Call it before Rush runs in-process. Like the next daemon start, it terminates the daemon's orphaned
+ * operation process groups (each reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning) and removes the
+ * ownership record and socket. It does so only under the start mutex and when no startup is reserved, and it
+ * waits up to 5 seconds while another client holds the mutex or while the exited process is not reaped yet.
+ * It does nothing when there is no record, when a process with the recorded PID runs, or when the runtime
+ * folder is not private, and it never throws.
+ *
+ * @beta
+ */
+export async function reclaimCrashedDaemonAsync(paths: IDaemonPaths): Promise<void> {
+  let owner: IDaemonLockfile | undefined;
+  try {
+    // Every daemon command checks the folder before it trusts the records in it.
+    assertDaemonRuntimeDirIsPrivate(paths);
+    owner = readDaemonLockfile(paths.lockfilePath);
+    // The reclaim refuses a PID that still exists, except that an exited process may not be reaped yet.
+    if (!owner || (isProcessAlive(owner.pid) && !isProcessDefunct(owner.pid))) return;
+  } catch {
+    // For example EPERM: the PID exists but cannot be inspected.
+    return;
+  }
+  await reclaimExitedDaemonAsync({ pid: owner.pid, startedAt: owner.startedAt, paths });
+}
+
+/**
+ * Stops the operations that an exited daemon left running, and removes its ownership record and socket, as
+ * the next daemon start would (`RUSH_DAEMON_ORPHANS_REAPED` warnings say what was stopped). Best effort: it
+ * acts only while the ownership record names that daemon, under the start mutex, and when no startup is
+ * reserved. While another client holds the mutex, for example to reclaim the same daemon, it waits.
+ */
+export async function reclaimExitedDaemonAsync(daemon: IExitedDaemon): Promise<void> {
+  const deadline: number = Date.now() + RECLAIM_WAIT_MS;
+  try {
+    while (isRecordedOwner(daemon)) {
+      // The reclaim refuses a PID that still exists, which includes an exited process that is not reaped yet.
+      if (!isProcessDefunct(daemon.pid)) {
+        const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(daemon.paths);
+        if (lock) {
+          try {
+            if (isRecordedOwner(daemon) && !readDaemonStartupReservation(daemon.paths)) {
+              await reclaimStaleDaemonAsync(daemon.paths);
+            }
+          } finally {
+            await lock.releaseAsync();
+          }
+          return;
+        }
+      }
+      if (Date.now() >= deadline) return;
+      await delayAsync(RECLAIM_POLL_INTERVAL_MS);
+    }
+  } catch {
+    // For example, the PID was reused, or another process holds the reclaim's mutex; the next start retries.
+  }
+}
+
+function isRecordedOwner(daemon: IExitedDaemon): boolean {
+  const owner: IDaemonLockfile | undefined = readDaemonLockfile(daemon.paths.lockfilePath);
+  return (
+    owner?.pid === daemon.pid && (daemon.startedAt === undefined || owner.startedAt === daemon.startedAt)
+  );
+}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index 32bc6691f2..b6234ca642 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -26,6 +26,7 @@ export {
   type DaemonStartupHelperState,
   type IDaemonStartupReservationInfo
 } from './DaemonStartupReservation';
+export { reclaimCrashedDaemonAsync } from './ExitedDaemonReclaim';
 export {
   executeWithDaemonRestartAsync,
   type IDaemonRestartNotice,
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
index 39d6bde652..69bfd1f157 100644
--- a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -2,17 +2,30 @@
 // See LICENSE in the project root for license information.
 
 import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
-import { DaemonTransportError, DaemonTransportErrorCode } from '@rushstack/rush-daemon-transport';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
 
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
 import { explainLostConnectionAsync, findLoggedFatalError, type IServingDaemon } from '../DaemonDisconnect';
+import { reserveDaemonStartup } from '../DaemonStartup';
 import { isProcessDefunct } from '../ProcessStartTime';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  isRunning,
+  recordDaemonOwner,
+  startOrphanedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
 import { withUnreapedChildAsync } from './UnreapedChildProcess';
 
 const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
@@ -82,14 +95,38 @@ describe(explainLostConnectionAsync.name, () => {
     environment: {},
     terminal: { isTTY: false, supportsColor: false }
   });
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
 
-  function getServingDaemon(pid: number): IServingDaemon {
-    return {
-      pid,
-      startedAt: undefined,
-      logFilePath: path.join(os.tmpdir(), 'missing.log'),
-      logOffset: undefined
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-disconnect-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
     };
+    operationPids = [];
+  });
+
+  afterEach(async () => {
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  function getServingDaemon(pid: number, startedAt?: string): IServingDaemon {
+    return { pid, startedAt, logFilePath: path.join(folder, 'missing.log'), logOffset: undefined, paths };
+  }
+
+  function getLostConnection(): DaemonTransportError {
+    return new DaemonTransportError(
+      DaemonTransportErrorCode.transportClosed,
+      'The daemon connection closed.'
+    );
+  }
+
+  function getExitMessage(pid: number): string {
+    return `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while it ran the command; "rush-client daemon logs" may show why. Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".`;
   }
 
   it('returns other failures, and failures without a known daemon, unchanged', async () => {
@@ -103,10 +140,7 @@ describe(explainLostConnectionAsync.name, () => {
     await withUnreapedChildAsync(async (child) => {
       const deadline: number = Date.now() + 5000;
       while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
-      const closed: DaemonTransportError = new DaemonTransportError(
-        DaemonTransportErrorCode.transportClosed,
-        'The daemon connection closed.'
-      );
+      const closed: DaemonTransportError = getLostConnection();
       const startedAt: number = Date.now();
       const explained: unknown = await explainLostConnectionAsync(closed, getServingDaemon(child), request);
       expect(Date.now() - startedAt).toBeLessThan(500);
@@ -114,8 +148,146 @@ describe(explainLostConnectionAsync.name, () => {
       expect(explained).toMatchObject({
         code: 'disconnected',
         cause: closed,
-        message: `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${child}) exited while it ran the command; "rush-client daemon logs" may show why. Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".`
+        message: getExitMessage(child)
       });
     });
   });
+
+  linuxIt(
+    'stops the operations that an exited daemon left running, and removes its files, first',
+    async () => {
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      try {
+        const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+        recordDaemonOwner(paths, daemonPid);
+        const explained: unknown = await explainLostConnectionAsync(
+          getLostConnection(),
+          getServingDaemon(daemonPid),
+          request
+        );
+        expect(explained).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+        expect(isRunning(operationPid)).toBe(false);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+        expect(warning).toHaveBeenCalledWith(
+          expect.stringContaining(`Reclaimed dead daemon ${daemonPid}:`),
+          expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+        );
+      } finally {
+        warning.mockRestore();
+      }
+    }
+  );
+
+  linuxIt('reclaims an exited daemon that is not reaped yet once it is reaped', async () => {
+    await withUnreapedChildAsync(async (child, parentPid) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      recordDaemonOwner(paths, child);
+      let settled: boolean = false;
+      const explained: Promise<unknown> = explainLostConnectionAsync(
+        getLostConnection(),
+        getServingDaemon(child),
+        request
+      ).finally(() => {
+        settled = true;
+      });
+      await delayAsync(300);
+      expect(settled).toBe(false);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      // Once its parent exits, init or a subreaper reaps it.
+      process.kill(parentPid, 'SIGTERM');
+      expect(await explained).toMatchObject({ message: getExitMessage(child) });
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    });
+  });
+
+  linuxIt('waits while another client holds the start mutex, and leaves the reclaim to it', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+    expect(lock).toBeDefined();
+    let settled: boolean = false;
+    const explained: Promise<unknown> = explainLostConnectionAsync(
+      getLostConnection(),
+      getServingDaemon(daemonPid),
+      request
+    ).finally(() => {
+      settled = true;
+    });
+    await delayAsync(300);
+    expect(settled).toBe(false);
+    // The other client's reclaim ends by removing the ownership record.
+    fs.unlinkSync(paths.lockfilePath);
+    await lock!.releaseAsync();
+    expect(await explained).toMatchObject({ message: getExitMessage(daemonPid) });
+    expect(isRunning(operationPid)).toBe(true);
+  });
+
+  linuxIt(
+    'gives up after a few seconds while another client keeps the start mutex',
+    async () => {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      expect(lock).toBeDefined();
+      try {
+        const startedAt: number = Date.now();
+        expect(
+          await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+        ).toMatchObject({ message: getExitMessage(daemonPid) });
+        expect(Date.now() - startedAt).toBeGreaterThanOrEqual(4500);
+        expect(Date.now() - startedAt).toBeLessThan(10000);
+        expect(isRunning(operationPid)).toBe(true);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      } finally {
+        await lock!.releaseAsync();
+      }
+    },
+    20000
+  );
+
+  linuxIt('leaves an exited daemon to the startup that is reserved', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    reserveDaemonStartup(paths, { pid: process.pid, startedAt: new Date().toISOString() });
+    const startedAt: number = Date.now();
+    expect(
+      await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+    ).toMatchObject({ message: getExitMessage(daemonPid) });
+    expect(Date.now() - startedAt).toBeLessThan(1000);
+    expect(isRunning(operationPid)).toBe(true);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+  });
+
+  linuxIt('leaves the files alone when the ownership record names another daemon', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    // A process that has exited, which the record does not name.
+    const otherPid: number = spawnSync(process.execPath, ['-e', '']).pid!;
+    // The same PID, but a record written for another process.
+    for (const daemon of [
+      getServingDaemon(otherPid),
+      getServingDaemon(daemonPid, '2000-01-01T00:00:00.000Z')
+    ]) {
+      expect(await explainLostConnectionAsync(getLostConnection(), daemon, request)).toMatchObject({
+        message: getExitMessage(daemon.pid)
+      });
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    }
+  });
+
+  linuxIt('still explains the exit when the reclaim fails', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    // Another process, such as a starting daemon, holds the reclaim's own mutex, so the reclaim throws.
+    fs.writeFileSync(`${paths.lockfilePath}.reclaim`, JSON.stringify({ mutexPid: process.pid }));
+    expect(
+      await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+    ).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+    expect(isRunning(operationPid)).toBe(true);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+  });
 });
diff --git a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
new file mode 100644
index 0000000000..424fd8c612
--- /dev/null
+++ b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
@@ -0,0 +1,136 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { reclaimCrashedDaemonAsync } from '../ExitedDaemonReclaim';
+import { isProcessDefunct } from '../ProcessStartTime';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  isRunning,
+  recordDaemonOwner,
+  startOrphanedOperationAsync,
+  startStandInDaemonAsync,
+  stopOperationIfRunning,
+  type IStandInDaemon
+} from './OrphanedOperation';
+import { withUnreapedChildAsync } from './UnreapedChildProcess';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+function getDaemonPaths(runtimeDir: string): IDaemonPaths {
+  return {
+    runtimeDir,
+    socketPath: path.join(runtimeDir, 'd.sock'),
+    lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+  };
+}
+
+describe(reclaimCrashedDaemonAsync.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+  let warning: jest.SpyInstance;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-crash-reclaim-'));
+    paths = getDaemonPaths(folder);
+    operationPids = [];
+    warning = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  });
+
+  afterEach(async () => {
+    warning.mockRestore();
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  it('does nothing, and creates no runtime folder, when there is no ownership record', async () => {
+    const runtimeDir: string = path.join(folder, 'runtime');
+    await reclaimCrashedDaemonAsync(getDaemonPaths(runtimeDir));
+    expect(fs.existsSync(runtimeDir)).toBe(false);
+    expect(warning).not.toHaveBeenCalled();
+  });
+
+  linuxIt('stops the operations that a crashed daemon left running, and removes its files', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    await reclaimCrashedDaemonAsync(paths);
+    expect(isRunning(operationPid)).toBe(false);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(warning).toHaveBeenCalledWith(
+      expect.stringContaining(`Reclaimed dead daemon ${daemonPid}:`),
+      expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+    );
+  });
+
+  linuxIt(
+    'leaves a running daemon alone, without waiting while another client holds the start mutex',
+    async () => {
+      const { daemon, operationPid }: IStandInDaemon = await startStandInDaemonAsync(operationPids);
+      // For example, a client that starts or replaces the daemon.
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      try {
+        expect(lock).toBeDefined();
+        recordDaemonOwner(paths, daemon.pid!);
+        const startedAt: number = Date.now();
+        await reclaimCrashedDaemonAsync(paths);
+        expect(Date.now() - startedAt).toBeLessThan(1000);
+        expect(isRunning(daemon.pid!)).toBe(true);
+        expect(isRunning(operationPid)).toBe(true);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+        expect(warning).not.toHaveBeenCalled();
+      } finally {
+        await lock?.releaseAsync();
+        daemon.kill('SIGKILL');
+      }
+    }
+  );
+
+  linuxIt('reclaims a crashed daemon that is not reaped yet once it is reaped', async () => {
+    await withUnreapedChildAsync(async (child, parentPid) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      recordDaemonOwner(paths, child);
+      let settled: boolean = false;
+      const reclaimed: Promise<void> = reclaimCrashedDaemonAsync(paths).finally(() => {
+        settled = true;
+      });
+      await delayAsync(300);
+      expect(settled).toBe(false);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      // Once its parent exits, init or a subreaper reaps it.
+      process.kill(parentPid, 'SIGTERM');
+      await reclaimed;
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    });
+  });
+
+  linuxIt('does not act on the records in a runtime folder that is not private', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    // Another user could have created a link like this one, for example in /tmp.
+    const link: string = path.join(os.tmpdir(), `${path.basename(folder)}-link`);
+    fs.symlinkSync(folder, link);
+    const linkPaths: IDaemonPaths = getDaemonPaths(link);
+    // It does not even wait for the start mutex there.
+    const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(linkPaths);
+    try {
+      expect(lock).toBeDefined();
+      const startedAt: number = Date.now();
+      await reclaimCrashedDaemonAsync(linkPaths);
+      expect(Date.now() - startedAt).toBeLessThan(1000);
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      expect(warning).not.toHaveBeenCalled();
+    } finally {
+      await lock?.releaseAsync();
+      fs.unlinkSync(link);
+    }
+  });
+});
diff --git a/libraries/rush-client-core/src/test/OrphanedOperation.ts b/libraries/rush-client-core/src/test/OrphanedOperation.ts
new file mode 100644
index 0000000000..561ec1fa7a
--- /dev/null
+++ b/libraries/rush-client-core/src/test/OrphanedOperation.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Readable } from 'node:stream';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import {
+  isDaemonProcessAlive,
+  writeDaemonLockfile,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { isProcessDefunct } from '../ProcessStartTime';
+
+// An operation process that a stand-in daemon starts; it exits by itself after a minute.
+const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+// A stand-in daemon: like a phased operation, which is spawned without `detached`, its operation process
+// inherits the daemon's process group. It prints that process's PID.
+const FAKE_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process')" +
+  `.spawn(process.execPath,['-e','${OPERATION_SCRIPT}'],{stdio:'ignore'});` +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+
+/** A stand-in daemon that this test process started, and the operation process that it started. */
+export interface IStandInDaemon {
+  readonly daemon: ChildProcess;
+  readonly operationPid: number;
+}
+
+/**
+ * Starts a stand-in daemon in its own process group, and waits for its operation process. The operation's PID
+ * is added to `operationPids` first, so that {@link stopOperationIfRunning} can clean it up. POSIX only.
+ */
+export async function startStandInDaemonAsync(operationPids: number[]): Promise<IStandInDaemon> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', FAKE_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const stdout: Readable = daemon.stdout!;
+  const [chunk] = (await once(stdout, 'data')) as [Buffer];
+  stdout.destroy();
+  const operationPid: number = Number(chunk.toString().trim());
+  operationPids.push(operationPid);
+  return { daemon, operationPid };
+}
+
+/** Starts a stand-in daemon and SIGKILLs only it, so its operation process keeps running. POSIX only. */
+export async function startOrphanedOperationAsync(
+  operationPids: number[]
+): Promise<{ daemonPid: number; operationPid: number }> {
+  const { daemon, operationPid } = await startStandInDaemonAsync(operationPids);
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  if (!isRunning(operationPid)) throw new Error(`The orphaned operation ${operationPid} is not running.`);
+  return { daemonPid: daemon.pid!, operationPid };
+}
+
+/** Writes the ownership record that a daemon with this PID would write. */
+export function recordDaemonOwner(
+  paths: IDaemonPaths,
+  pid: number,
+  startedAt: string = new Date().toISOString()
+): void {
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt,
+    socketPath: paths.socketPath
+  });
+}
+
+/** True while the process exists and has not exited. */
+export function isRunning(pid: number): boolean {
+  return isDaemonProcessAlive(pid) && !isProcessDefunct(pid);
+}
+
+/** SIGKILLs an operation process that a stand-in daemon started, unless it has exited. Linux only. */
+export function stopOperationIfRunning(pid: number): void {
+  try {
+    // Only the operation process that this test started, not a process that reused its PID.
+    if (fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').includes(OPERATION_SCRIPT)) {
+      process.kill(pid, 'SIGKILL');
+    }
+  } catch {
+    // It has exited.
+  }
+}

From 62fc563aa1e92dcba21ae73e9f6e020578415dfa Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 02:37:43 +0000
Subject: [PATCH 060/265] [rush-daemon] Test that an expired protected project
 takes no warm-set lease

Swarm integration step 45; original commit 1b18fcc3eb (merge of swarm/r07-t76-nit at 6c6f638a2e).
Scope: task 76 NIT.

Brings r07's test for the task 76 NIT. Test only.

s16 batch B, item 5 of 5 (ch01 board 2984).

Gate: ch01 GATE OK board 2984 (tree 104ca5f27d)

Commits folded into this step (1):
- 6c6f638a2e [rush-daemon] Warm set: test that an expired protected project takes no lease

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rotected-expiry-test_2026-09-29-01-45.json | 11 ++++++++
 .../WorkspaceWarmSetMaintenanceCost.test.ts   | 25 +++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/warm-set-protected-expiry-test_2026-09-29-01-45.json

diff --git a/common/changes/@rushstack/rush-daemon/warm-set-protected-expiry-test_2026-09-29-01-45.json b/common/changes/@rushstack/rush-daemon/warm-set-protected-expiry-test_2026-09-29-01-45.json
new file mode 100644
index 0000000000..5a9f7775c4
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/warm-set-protected-expiry-test_2026-09-29-01-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a maintenance pass takes no native repository lock for a protected project that has expired while it holds resources.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
index f8ee0fa972..d6933f23cb 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
@@ -371,4 +371,29 @@ describe('warm-set maintenance cost', () => {
     expect(status.protectedProjectNames).toEqual(['p0']);
     expect(watched.has('p0')).toBe(true);
   });
+
+  it('takes no native repository lease for an expired protected project that holds resources, pass after pass', async () => {
+    const { graph, operations, requestAll } = createGraph(4);
+    operations[0].runner = createResidentRunner();
+    const acquire: jest.Mock<Promise<AsyncDisposable>, []> = createLease();
+    const warm: WorkspaceWarmSet = attach(
+      graph,
+      { warmIdleTimeoutSeconds: 0.001 },
+      { acquireExecutionLeaseAsync: acquire, getProtectedOperations: () => new Set([operations[0]]) }
+    );
+    disposables.push(warm);
+    requestAll();
+    await settleAsync(warm);
+    acquire.mockClear();
+
+    // Expiry never evicts a protected project, so no pass needs to own the repository for it
+    for (let pass: number = 0; pass < 2; pass++) {
+      const status: IWorkspaceWarmSetStatus = await warm.maintainAsync();
+      expect(status.protectedProjectNames).toEqual(['p0']);
+      expect(status.deferredReason).toBeUndefined();
+    }
+    expect(acquire).not.toHaveBeenCalled();
+    expect(operations[0].runner?.isActive).toBe(true);
+    expect(graph.resultByOperation.size).toBe(4);
+  });
 });

From 0b978371eaf30e5da00307b338e233d50d936e41 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:15 +0000
Subject: [PATCH 061/265] [package-deps-hash] A hot request with no file change
 since the previous one skips the repo-state work

Swarm integration step 46; original commit a9e930338f (merge of swarm/r07-t114-int at e883c78766).
Scope: task 114.

Brings r07's task 114 (daemon L3b, D20.3): RepoStateCache keeps the last repo-state capture, and a hot request whose files haven't changed since reuses it instead of running git status, ls-tree, the inputs snapshot and each operation's own-state hash again. It also moves assertCompatibleInputs and isGraphDefinitionPath into WorkspaceInputsComparison.ts with the same path list. Second agents: m01 board 2842 and t04 board 2897 on d0f571a420 (t114verify: 0 STALE rows, board 2829); addenda t04 board 3042 and m01 board 3031. ch01's e2e on ch01-sC: 30 of 30 steps equal to --no-daemon, 0 STALE.

s16 batch C, item 1 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree 8299cd3e10)

Commits folded into this step (4):
- 5fbb206eb3 [package-deps-hash] Add RepoStateCache for processes that read the state of a repository repeatedly
- b7904dd6d6 [rush-lib] Keep the state of the repository and reuse unchanged inputs snapshots in long-lived hosts
- 7cb4c46d89 [rush-daemon] Skip comparing unchanged inputs snapshots on each request
- d0f571a420 [package-deps-hash] Copy the index again when the sizes, attributes, configuration or filter change

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...unchanged-repo-state_2026-09-28-21-15.json |  11 +
 .../repo-state-cache_2026-09-28-21-15.json    |  11 +
 ...ed-inputs-comparison_2026-09-28-21-15.json |  11 +
 common/reviews/api/package-deps-hash.api.md   |  14 +
 common/reviews/api/rush-lib.api.md            |   1 +
 libraries/package-deps-hash/README.md         |  13 +
 libraries/package-deps-hash/src/FileStamp.ts  |  33 +
 .../package-deps-hash/src/GitIndexFile.ts     | 147 +++
 .../package-deps-hash/src/RepoStateCache.ts   | 859 +++++++++++++++++
 .../package-deps-hash/src/getRepoState.ts     | 180 +++-
 libraries/package-deps-hash/src/index.ts      |   1 +
 .../src/test/GitIndexFile.test.ts             | 228 +++++
 .../src/test/RepoStateCache.test.ts           | 912 ++++++++++++++++++
 .../src/test/getRepoState.test.ts             |  45 +-
 .../src/ProductionDaemonRequestResolver.ts    |  40 +-
 .../src/WorkspaceInputsComparison.ts          |  72 ++
 .../test/WorkspaceInputsComparison.test.ts    | 156 +++
 .../cli/scriptActions/PhasedScriptAction.ts   |   8 +-
 .../src/logic/ProjectChangeAnalyzer.ts        | 123 ++-
 .../logic/test/ProjectChangeAnalyzer.test.ts  | 203 +++-
 20 files changed, 2971 insertions(+), 97 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/reuse-unchanged-repo-state_2026-09-28-21-15.json
 create mode 100644 common/changes/@rushstack/package-deps-hash/repo-state-cache_2026-09-28-21-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon/skip-unchanged-inputs-comparison_2026-09-28-21-15.json
 create mode 100644 libraries/package-deps-hash/src/FileStamp.ts
 create mode 100644 libraries/package-deps-hash/src/GitIndexFile.ts
 create mode 100644 libraries/package-deps-hash/src/RepoStateCache.ts
 create mode 100644 libraries/package-deps-hash/src/test/GitIndexFile.test.ts
 create mode 100644 libraries/package-deps-hash/src/test/RepoStateCache.test.ts
 create mode 100644 libraries/rush-daemon/src/WorkspaceInputsComparison.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts

diff --git a/common/changes/@microsoft/rush/reuse-unchanged-repo-state_2026-09-28-21-15.json b/common/changes/@microsoft/rush/reuse-unchanged-repo-state_2026-09-28-21-15.json
new file mode 100644
index 0000000000..9c2ac4d92c
--- /dev/null
+++ b/common/changes/@microsoft/rush/reuse-unchanged-repo-state_2026-09-28-21-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Long-lived hosts such as the Rush daemon now keep the state of the Git repository between requests, using the new `RepoStateCache` from `@rushstack/package-deps-hash`, and reuse the previous inputs snapshot while the repository state, the additional files and the environment are unchanged.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/package-deps-hash/repo-state-cache_2026-09-28-21-15.json b/common/changes/@rushstack/package-deps-hash/repo-state-cache_2026-09-28-21-15.json
new file mode 100644
index 0000000000..c17aaeb7a6
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/repo-state-cache_2026-09-28-21-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Add a (beta) `RepoStateCache` class for long-lived processes. It returns the same result as `getDetailedRepoStateAsync`, apart from rare cases that its documentation lists, but runs `git status` against a private copy of the Git index, which it copies again when the files that the index records or their recorded sizes change, when the Git configuration or attributes change, or when the filter changes. It runs `git ls-files` only when the files that the index records change, reuses the hash of a file while neither the file nor the `.gitattributes` files in the folders that contain it have changed since they settled, and returns the same object while nothing changes. It falls back to `getDetailedRepoStateAsync` when it fails.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/skip-unchanged-inputs-comparison_2026-09-28-21-15.json b/common/changes/@rushstack/rush-daemon/skip-unchanged-inputs-comparison_2026-09-28-21-15.json
new file mode 100644
index 0000000000..32d10a1664
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/skip-unchanged-inputs-comparison_2026-09-28-21-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Skip comparing the inputs of a request with those of the engine when the snapshot or its file hashes are the same objects, so an unchanged workspace no longer compares every file and operation hash on each request.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/package-deps-hash.api.md b/common/reviews/api/package-deps-hash.api.md
index 1de2d1b706..67a8ebd6e7 100644
--- a/common/reviews/api/package-deps-hash.api.md
+++ b/common/reviews/api/package-deps-hash.api.md
@@ -48,4 +48,18 @@ export interface IFileDiffStatus {
     status: 'A' | 'D' | 'M';
 }
 
+// @beta
+export interface IRepoStateCacheOptions {
+    gitPath?: string;
+    rootDirectory: string;
+    temporaryFolderPath?: string;
+}
+
+// @beta
+export class RepoStateCache {
+    constructor(options: IRepoStateCacheOptions);
+    dispose(): void;
+    getDetailedRepoStateAsync(additionalRelativePathsToHash?: ReadonlyArray<string>, filterPath?: ReadonlyArray<string>): Promise<IDetailedRepoState>;
+}
+
 ```
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 045cf759e9..f96c5f2059 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1663,6 +1663,7 @@ export class ProjectChangeAnalyzer {
     // @internal
     _tryGetSnapshotProviderAsync(projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>, terminal: ITerminal, projectSelection?: ReadonlySet<RushConfigurationProject>, options?: {
         readonly throwOnMissingProjectShrinkwrapFile?: boolean;
+        readonly reuseUnchangedInputs?: boolean;
     }): Promise<GetInputsSnapshotAsyncFn | undefined>;
 }
 
diff --git a/libraries/package-deps-hash/README.md b/libraries/package-deps-hash/README.md
index 5386749d7a..53a4479465 100644
--- a/libraries/package-deps-hash/README.md
+++ b/libraries/package-deps-hash/README.md
@@ -29,6 +29,19 @@ if (_.isEqual(deps, existingDeps)) {
 }
 ```
 
+A long-lived process that reads the state of the same repository repeatedly can use a `RepoStateCache` (beta).
+It returns the same result as `getDetailedRepoStateAsync()`, but keeps a private copy of the Git index and the
+hashes of files that haven't changed between calls, and returns the same object while nothing changes:
+
+```ts
+import { RepoStateCache } from '@rushstack/package-deps-hash';
+
+const cache = new RepoStateCache({ rootDirectory: '/path/to/repo' });
+const state = await cache.getDetailedRepoStateAsync();
+// ...
+cache.dispose();
+```
+
 ## Links
 
 - [CHANGELOG.md](
diff --git a/libraries/package-deps-hash/src/FileStamp.ts b/libraries/package-deps-hash/src/FileStamp.ts
new file mode 100644
index 0000000000..aa3b0c68bd
--- /dev/null
+++ b/libraries/package-deps-hash/src/FileStamp.ts
@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+/**
+ * A file whose ctime or mtime is newer than this many milliseconds must not be memoized by its stamp.
+ *
+ * @remarks
+ * Every write updates a file's ctime, and userspace can't set it. A stamp recorded for a file whose last change
+ * was already this old can't hide a later write, because that write gets a newer ctime even on a filesystem
+ * whose timestamps have a coarse granularity (a jiffy on Linux, 2 seconds on FAT). The argument assumes that the
+ * filesystem's clock agrees with this process's clock to within this margin, as a local filesystem's does.
+ */
+export const SETTLED_FILE_AGE_MS: number = 3000;
+
+/**
+ * The ctime and mtime a file must be older than for its stamp to be memoized. Take it before examining any of
+ * the files, so that a write made after a file's examination gets a later ctime.
+ */
+export function getSettledBeforeNs(): bigint {
+  return BigInt(Date.now() - SETTLED_FILE_AGE_MS) * BigInt(1e6);
+}
+
+/** Identifies a file's content by the identity, size, nanosecond mtime and ctime of the file. */
+export function getFileStamp(stats: fs.BigIntStats): string {
+  return `${stats.dev}:${stats.ino}:${stats.size}:${stats.mtimeNs}:${stats.ctimeNs}`;
+}
+
+/** Whether a file examined after `settledBeforeNs` was taken may be memoized by its stamp. */
+export function isFileStatSettled(stats: fs.BigIntStats, settledBeforeNs: bigint): boolean {
+  return stats.ctimeNs < settledBeforeNs && stats.mtimeNs < settledBeforeNs;
+}
diff --git a/libraries/package-deps-hash/src/GitIndexFile.ts b/libraries/package-deps-hash/src/GitIndexFile.ts
new file mode 100644
index 0000000000..4f600b9ce7
--- /dev/null
+++ b/libraries/package-deps-hash/src/GitIndexFile.ts
@@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// The index format packs flags into bits
+/* eslint-disable no-bitwise */
+
+import { createHash } from 'node:crypto';
+
+// The format is described in https://git-scm.com/docs/index-format
+const INDEX_SIGNATURE: string = 'DIRC';
+const HEADER_LENGTH: number = 12;
+// ctime, mtime, dev, ino, mode, uid, gid and size, 4 bytes each except the 8-byte times
+const ENTRY_STAT_LENGTH: number = 40;
+const ENTRY_MODE_OFFSET: number = 24;
+const ENTRY_MODE_LENGTH: number = 4;
+const ENTRY_SIZE_OFFSET: number = 36;
+const ENTRY_SIZE_LENGTH: number = 4;
+const ENTRY_FLAGS_LENGTH: number = 2;
+const ENTRY_EXTENDED_FLAG: number = 0x4000;
+const EXTENSION_HEADER_LENGTH: number = 8;
+const SPLIT_INDEX_EXTENSION_SIGNATURE: string = 'link';
+
+/**
+ * A summary of a Git index file.
+ */
+export interface IGitIndexSummary {
+  readonly entryCount: number;
+  /**
+   * A digest of the header and of every entry's mode, object ID, flags and path. It omits the file system data
+   * (times, device, inode, owner and size) that refreshing the index updates, and the extensions, such as the
+   * untracked cache and the file system monitor's token. Two indexes with the same digest describe the same files.
+   */
+  readonly entriesDigest: string;
+  /**
+   * A digest of the size that the index records for each entry. Git considers a file modified, without examining
+   * its content, if the recorded size is not 0 and differs from the size of the file. So two indexes with the same
+   * entries digest may still disagree about which files are modified, unless their sizes digests are the same too.
+   */
+  readonly sizesDigest: string;
+  /**
+   * Whether the index is split: its entries are then completed by a shared index file.
+   */
+  readonly isSplit: boolean;
+}
+
+/**
+ * Returns the number of entries that the header of a Git index file declares, or `undefined` if the data doesn't
+ * start with the header of a Git index file.
+ */
+export function tryGetGitIndexEntryCount(header: Buffer): number | undefined {
+  if (
+    header.length < HEADER_LENGTH ||
+    header.toString('latin1', 0, INDEX_SIGNATURE.length) !== INDEX_SIGNATURE
+  ) {
+    return undefined;
+  }
+
+  return header.readUInt32BE(8);
+}
+
+/**
+ * Summarizes the content of a Git index file of version 2, 3 or 4.
+ *
+ * @param content - The content of the index file
+ * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
+ */
+export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGitIndexSummary {
+  const entryCount: number | undefined = tryGetGitIndexEntryCount(content);
+  if (entryCount === undefined) {
+    throw new Error('The file is not a Git index');
+  }
+
+  const version: number = content.readUInt32BE(4);
+  if (version < 2 || version > 4) {
+    throw new Error(`Unsupported Git index version ${version}`);
+  }
+
+  const checksumOffset: number = content.length - objectIdLength;
+  // Each entry has at least its file system data, object ID and flags, and a NUL after its path
+  if (
+    HEADER_LENGTH + entryCount * (ENTRY_STAT_LENGTH + objectIdLength + ENTRY_FLAGS_LENGTH + 1) >
+    checksumOffset
+  ) {
+    throw new Error('The Git index ends within an entry');
+  }
+
+  // A copy of the entries in which the file system data of each entry is cleared, except for the mode
+  const entries: Buffer = Buffer.from(content.subarray(0, checksumOffset));
+  const sizes: Buffer = Buffer.alloc(entryCount * ENTRY_SIZE_LENGTH);
+  let offset: number = HEADER_LENGTH;
+  for (let i: number = 0; i < entryCount; i++) {
+    const flagsOffset: number = offset + ENTRY_STAT_LENGTH + objectIdLength;
+    if (flagsOffset + ENTRY_FLAGS_LENGTH > checksumOffset) {
+      throw new Error('The Git index ends within an entry');
+    }
+
+    sizes.writeUInt32BE(content.readUInt32BE(offset + ENTRY_SIZE_OFFSET), i * ENTRY_SIZE_LENGTH);
+    entries.fill(0, offset, offset + ENTRY_MODE_OFFSET);
+    entries.fill(0, offset + ENTRY_MODE_OFFSET + ENTRY_MODE_LENGTH, offset + ENTRY_STAT_LENGTH);
+
+    const flags: number = content.readUInt16BE(flagsOffset);
+    let pathOffset: number = flagsOffset + ENTRY_FLAGS_LENGTH;
+    if (flags & ENTRY_EXTENDED_FLAG) {
+      // Extended flags follow, for example "skip-worktree" and "intent-to-add"
+      pathOffset += ENTRY_FLAGS_LENGTH;
+    }
+
+    if (version === 4) {
+      // The path is prefix-compressed: a variable-length integer, then the rest of the path and a NUL
+      while (pathOffset < checksumOffset && content[pathOffset] & 0x80) {
+        pathOffset++;
+      }
+      pathOffset++;
+    }
+
+    const pathEnd: number = content.indexOf(0, pathOffset);
+    if (pathEnd < 0 || pathEnd >= checksumOffset) {
+      throw new Error('The Git index ends within an entry');
+    }
+
+    // Before version 4, each entry is padded with 1-8 NULs to a multiple of 8 bytes
+    offset = version === 4 ? pathEnd + 1 : offset + ((pathEnd - offset + 8) & ~7);
+  }
+
+  const entriesDigest: string = createHash('sha1').update(entries.subarray(4, offset)).digest('hex');
+  const sizesDigest: string = createHash('sha1').update(sizes).digest('hex');
+
+  let isSplit: boolean = false;
+  while (offset + EXTENSION_HEADER_LENGTH <= checksumOffset) {
+    const signature: string = content.toString('latin1', offset, offset + 4);
+    if (signature === SPLIT_INDEX_EXTENSION_SIGNATURE) {
+      isSplit = true;
+    }
+    offset += EXTENSION_HEADER_LENGTH + content.readUInt32BE(offset + 4);
+  }
+
+  if (offset !== checksumOffset) {
+    throw new Error('The extensions of the Git index are malformed');
+  }
+
+  return {
+    entryCount,
+    entriesDigest,
+    sizesDigest,
+    isSplit
+  };
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
new file mode 100644
index 0000000000..2ff67fd0b3
--- /dev/null
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -0,0 +1,859 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library/lib/FileSystem';
+
+import { getFileStamp, getSettledBeforeNs, isFileStatSettled } from './FileStamp';
+import { type IGitIndexSummary, summarizeGitIndex, tryGetGitIndexEntryCount } from './GitIndexFile';
+import {
+  classifyLocallyModifiedFiles,
+  getCleanGitEnvironment,
+  getDetailedRepoStateAsync,
+  getGitLsFilesArgs,
+  getGitStatusArgs,
+  hashFilesAsync,
+  type IDetailedRepoState,
+  type IGitTreeState,
+  type ILocallyModifiedFiles,
+  parseGitLsTree,
+  parseGitStatus,
+  spawnGitAsync,
+  STANDARD_GIT_OPTIONS
+} from './getRepoState';
+
+/**
+ * Options for {@link RepoStateCache}.
+ * @beta
+ */
+export interface IRepoStateCacheOptions {
+  /**
+   * The root directory of the Git repository.
+   */
+  rootDirectory: string;
+  /**
+   * The path to the Git executable.
+   */
+  gitPath?: string;
+  /**
+   * The folder in which to create the folder that holds the copy of the Git index.
+   * @defaultValue The temporary folder of the operating system
+   */
+  temporaryFolderPath?: string;
+}
+
+// After this many consecutive failures, stop trying to use the cache
+const MAX_CONSECUTIVE_FAILURES: number = 3;
+const SHA256_OBJECT_ID_LENGTH: number = 32;
+const SHA1_OBJECT_ID_LENGTH: number = 20;
+const INDEX_HEADER_LENGTH: number = 12;
+const NANOSECONDS_PER_SECOND: bigint = BigInt(1e9);
+const PRIVATE_FOLDER_PREFIX: string = 'package-deps-hash-';
+const PRIVATE_INDEX_NAME: string = 'index';
+const ATTRIBUTES_FILE_NAME: string = '.gitattributes';
+
+// Unlike the other commands, "git status" doesn't pass "--no-optional-locks", so that it can save its refreshed
+// copy of the index and the next "git status" doesn't need to examine the files that haven't changed since.
+const PRIVATE_INDEX_STATUS_OPTIONS: readonly string[] = [
+  // Ensure that commands don't run automatic maintenance, since performance of the command itself is paramount
+  '-c',
+  'maintenance.auto=false',
+  // Git only keeps an untracked cache that matches this setting, and "git status -u" lists all untracked files
+  '-c',
+  'status.showUntrackedFiles=all',
+  // Git would save the shared part of a split index in the Git folder of the repository
+  '-c',
+  'core.splitIndex=false'
+];
+
+interface IGitPaths {
+  readonly indexPath: string;
+  readonly objectIdLength: number;
+  /**
+   * The configuration and attributes files that the hashes of files may depend on.
+   */
+  readonly configurationPaths: ReadonlyArray<string>;
+}
+
+interface IPrivateIndex {
+  readonly path: string;
+  readonly entryCount: number;
+  readonly entriesDigest: string;
+  readonly sizesDigest: string;
+  /**
+   * Identifies the filter of the calls that use the copy. "git status" only refreshes the files within the filter,
+   * and only lists the attributes files within it.
+   */
+  readonly filterKey: string;
+  realIndexStamp: string;
+  isRealIndexStampSettled: boolean;
+  /**
+   * Identifies the attributes files under which the first "git status" refreshed the copy, once it ran.
+   */
+  attributesFingerprint: string | undefined;
+  /**
+   * Whether the attributes files changed since the first "git status", so that the index must be copied again.
+   */
+  hasAttributesChanged: boolean;
+}
+
+interface ITree {
+  readonly filterKey: string;
+  readonly state: IGitTreeState;
+}
+
+interface IFileHash {
+  readonly stamp: string;
+  readonly hash: string;
+}
+
+interface IResult {
+  readonly tree: ITree;
+  readonly additionalPaths: ReadonlyArray<string>;
+  readonly statusOutput: string;
+  readonly additionalHashes: ReadonlyMap<string, string>;
+  readonly modifiedHashes: ReadonlyMap<string, string>;
+  readonly state: IDetailedRepoState;
+}
+
+function noop(): void {}
+
+/**
+ * Computes the same state of a Git repository as {@link getDetailedRepoStateAsync}, but faster when a process
+ * computes it repeatedly.
+ *
+ * @remarks
+ * The commands that {@link getDetailedRepoStateAsync} runs must not update the Git index, so `git status`
+ * examines every file each time. This class keeps a private copy of the index that `git status` updates, so that
+ * each call only examines the files that changed since the previous call. It copies the index again when the
+ * files that the index records, or the sizes that it records for them, change, but not when Git merely refreshes
+ * the index. While the files that the index records don't change, it also reuses the list of files in the index.
+ * It reuses the hash of a file while the identity, size and times of the file and of the `.gitattributes` files in
+ * the folders that contain it don't change, and returns the same state as the previous call if nothing changed.
+ *
+ * A call may return the same state as an earlier call, so the state must not be modified.
+ *
+ * The state also depends on the attributes and configuration of Git, under which `git status` refreshed the copy.
+ * The index is copied again, and the files hashed again, when the repository's configuration or `info/attributes`
+ * file changes, or when the user's `.gitconfig` file or the Git configuration or attributes file in the user's
+ * configuration folder changes. The index is copied again when a `.gitattributes` file changes that `git status`
+ * lists as modified or untracked, or that is in a folder that contains a filter path; the call that detects the
+ * change computes the state without the cache. The index is also copied again when the filter changes. Changes to
+ * the system configuration, to a configuration file included by another, to a custom `core.attributesFile`, or to
+ * an ignored `.gitattributes` file that applies to files that the index records aren't detected. In rare cases,
+ * the state reports uncommitted changes that {@link getDetailedRepoStateAsync} doesn't: when a file whose recorded
+ * size Git refreshed in the copy but not in the index is rewritten with content that Git converts to the same
+ * object, for example with other line endings.
+ *
+ * Repositories with submodules or a split index fall back to {@link getDetailedRepoStateAsync}, as does a cache
+ * that fails repeatedly.
+ * @beta
+ */
+export class RepoStateCache {
+  readonly #rootDirectory: string;
+  readonly #gitPath: string | undefined;
+  readonly #temporaryFolderPath: string;
+  // Calls run one at a time, in order
+  #queue: Promise<void> = Promise.resolve();
+  #isDisabled: boolean = false;
+  #consecutiveFailureCount: number = 0;
+  #privateFolderPath: string | undefined;
+  #gitPaths: IGitPaths | undefined;
+  #privateIndex: IPrivateIndex | undefined;
+  #tree: ITree | undefined;
+  #previousResult: IResult | undefined;
+  #configurationFingerprint: string = '';
+  #unsettledFingerprintCount: number = 0;
+  readonly #fileHashes: Map<string, IFileHash> = new Map();
+
+  public constructor(options: IRepoStateCacheOptions) {
+    const { rootDirectory, gitPath, temporaryFolderPath = os.tmpdir() } = options;
+    this.#rootDirectory = rootDirectory;
+    this.#gitPath = gitPath;
+    this.#temporaryFolderPath = temporaryFolderPath;
+  }
+
+  /**
+   * Gets the object hashes for all files in the Git repo, combining the current commit with working tree state.
+   * Returns the same result as {@link getDetailedRepoStateAsync}.
+   *
+   * @param additionalRelativePathsToHash - Root-relative file paths to have Git hash and include in the results
+   * @param filterPath - The paths to which to limit the results
+   * @returns The state of the repository. It may be the same object that an earlier call returned, so it must not
+   * be modified.
+   */
+  public async getDetailedRepoStateAsync(
+    additionalRelativePathsToHash: ReadonlyArray<string> = [],
+    filterPath?: ReadonlyArray<string>
+  ): Promise<IDetailedRepoState> {
+    const resultPromise: Promise<IDetailedRepoState> = this.#queue.then(() =>
+      this.#getStateAsync(additionalRelativePathsToHash, filterPath)
+    );
+    this.#queue = resultPromise.then(noop, noop);
+    return await resultPromise;
+  }
+
+  /**
+   * Deletes the copy of the Git index. Later calls compute the state without the cache.
+   */
+  public dispose(): void {
+    this.#disable();
+  }
+
+  async #getStateAsync(
+    additionalPaths: ReadonlyArray<string>,
+    filterPath: ReadonlyArray<string> | undefined
+  ): Promise<IDetailedRepoState> {
+    if (!this.#isDisabled) {
+      let state: IDetailedRepoState | undefined;
+      try {
+        state = await this.#tryGetCachedStateAsync(additionalPaths, filterPath);
+      } catch {
+        this.#reset();
+        // If the state can't be computed without the cache either, report that error instead
+        state = await this.#getUncachedStateAsync(additionalPaths, filterPath);
+        if (++this.#consecutiveFailureCount >= MAX_CONSECUTIVE_FAILURES) {
+          this.#disable();
+        }
+
+        return state;
+      }
+
+      if (state) {
+        this.#consecutiveFailureCount = 0;
+        return state;
+      }
+    }
+
+    return await this.#getUncachedStateAsync(additionalPaths, filterPath);
+  }
+
+  async #getUncachedStateAsync(
+    additionalPaths: ReadonlyArray<string>,
+    filterPath: ReadonlyArray<string> | undefined
+  ): Promise<IDetailedRepoState> {
+    return await getDetailedRepoStateAsync(
+      this.#rootDirectory,
+      Array.from(additionalPaths),
+      this.#gitPath,
+      filterPath && Array.from(filterPath)
+    );
+  }
+
+  /**
+   * Returns `undefined` if the cache can't compute the state of this repository.
+   */
+  async #tryGetCachedStateAsync(
+    additionalPaths: ReadonlyArray<string>,
+    filterPath: ReadonlyArray<string> | undefined
+  ): Promise<IDetailedRepoState | undefined> {
+    const settledBeforeNs: bigint = getSettledBeforeNs();
+    const gitPaths: IGitPaths = await this.#getGitPathsAsync();
+    const filterKey: string = JSON.stringify(filterPath ?? []);
+    const configurationFingerprint: string = this.#getFingerprint(
+      gitPaths.configurationPaths,
+      settledBeforeNs
+    );
+    const hasConfigurationChanged: boolean = configurationFingerprint !== this.#configurationFingerprint;
+    if (hasConfigurationChanged) {
+      this.#configurationFingerprint = configurationFingerprint;
+      this.#fileHashes.clear();
+    }
+
+    // Git refreshed the copy of the index under the previous configuration, so it could trust the recorded data of
+    // a file that the new configuration converts differently
+    const privateIndex: IPrivateIndex | undefined = await this.#tryUpdatePrivateIndexAsync(
+      gitPaths,
+      settledBeforeNs,
+      filterKey,
+      hasConfigurationChanged
+    );
+    if (!privateIndex) {
+      return undefined;
+    }
+
+    const environment: NodeJS.ProcessEnv = {
+      ...getCleanGitEnvironment(),
+      GIT_INDEX_FILE: privateIndex.path
+    };
+    // No other process uses the copy of the index, so "git status" may always save it
+    delete environment.GIT_OPTIONAL_LOCKS;
+    // The stamps of the attributes files in the folders that contain the files to hash
+    const attributesStamps: Map<string, string | undefined> = new Map();
+    // Hash the additional files while Git reads the index. Wait for both even if one fails, so that no command
+    // still uses the copy of the index after this call.
+    const [[tree, statusOutput], additionalHashes] = await waitForBothAsync(
+      this.#getTreeAndStatusAsync(privateIndex, filterPath, filterKey, environment),
+      this.#hashFilesAsync(additionalPaths, settledBeforeNs, attributesStamps)
+    );
+    if (!tree) {
+      return undefined;
+    }
+
+    // "git status" and "git ls-files" silently treat a missing index as an empty one
+    if (tryReadGitIndexEntryCount(privateIndex.path) !== privateIndex.entryCount) {
+      throw new Error(`The copy of the Git index at "${privateIndex.path}" was modified by another process`);
+    }
+
+    const locallyModified: Map<string, boolean> = parseGitStatus(statusOutput);
+    const attributesFingerprint: string = this.#getFingerprint(
+      getAttributesFilePaths(this.#rootDirectory, locallyModified.keys(), filterPath),
+      settledBeforeNs
+    );
+    if (privateIndex.attributesFingerprint === undefined) {
+      privateIndex.attributesFingerprint = attributesFingerprint;
+    } else if (attributesFingerprint !== privateIndex.attributesFingerprint) {
+      // Git refreshed the copy under the previous attributes, so it could trust the recorded data of a file that
+      // the new attributes convert differently. The next call copies the index again.
+      privateIndex.hasAttributesChanged = true;
+      return undefined;
+    }
+
+    const { filesToHash, filesToRemove }: ILocallyModifiedFiles = classifyLocallyModifiedFiles(
+      locallyModified,
+      tree.state.symlinks
+    );
+    const modifiedHashes: Map<string, string> = await this.#hashFilesAsync(
+      filesToHash,
+      settledBeforeNs,
+      attributesStamps
+    );
+
+    const previousResult: IResult | undefined = this.#previousResult;
+    if (
+      previousResult &&
+      previousResult.tree === tree &&
+      previousResult.statusOutput === statusOutput &&
+      areArraysEqual(previousResult.additionalPaths, additionalPaths) &&
+      areMapsEqual(previousResult.additionalHashes, additionalHashes) &&
+      areMapsEqual(previousResult.modifiedHashes, modifiedHashes)
+    ) {
+      return previousResult.state;
+    }
+
+    const files: Map<string, string> = new Map(tree.state.files);
+    const symlinks: Map<string, string> = new Map(tree.state.symlinks);
+    for (const filePath of filesToRemove) {
+      files.delete(filePath);
+      symlinks.delete(filePath);
+    }
+
+    for (const [filePath, hash] of additionalHashes) {
+      files.set(filePath, hash);
+    }
+
+    for (const [filePath, hash] of modifiedHashes) {
+      files.set(filePath, hash);
+    }
+
+    const state: IDetailedRepoState = {
+      hasSubmodules: false,
+      hasUncommittedChanges: locallyModified.size > 0,
+      files,
+      symlinks
+    };
+    this.#previousResult = {
+      tree,
+      additionalPaths: Array.from(additionalPaths),
+      statusOutput,
+      additionalHashes,
+      modifiedHashes,
+      state
+    };
+    return state;
+  }
+
+  /**
+   * Runs `git status` and, unless the list from an earlier call is still current, lists the files in the index.
+   * Returns an undefined tree if the repository has submodules.
+   */
+  async #getTreeAndStatusAsync(
+    privateIndex: IPrivateIndex,
+    filterPath: ReadonlyArray<string> | undefined,
+    filterKey: string,
+    environment: NodeJS.ProcessEnv
+  ): Promise<[ITree | undefined, string]> {
+    const currentTree: ITree | undefined = this.#tree;
+    let treePromise: Promise<ITree>;
+    // An interrupted "git status" may have left its lock file behind, which would stop the next one from saving
+    await fs.promises.rm(`${privateIndex.path}.lock`, { force: true });
+    if (currentTree?.filterKey === filterKey) {
+      treePromise = Promise.resolve(currentTree);
+    } else {
+      this.#tree = undefined;
+      // "git status" may save its refreshed copy of the index while this reads it. Git replaces the file rather
+      // than writing to it, and a refresh changes only what the index records about the files, not which files
+      // it records, so this lists the same files from either version.
+      treePromise = spawnGitAsync(
+        this.#gitPath,
+        STANDARD_GIT_OPTIONS.concat(getGitLsFilesArgs(filterPath)),
+        this.#rootDirectory,
+        undefined,
+        environment
+      ).then((lsFilesOutput: string): ITree => {
+        this.#tree = { filterKey, state: parseGitLsTree(lsFilesOutput) };
+        return this.#tree;
+      });
+    }
+
+    const statusPromise: Promise<string> = spawnGitAsync(
+      this.#gitPath,
+      PRIVATE_INDEX_STATUS_OPTIONS.concat(getGitStatusArgs(filterPath)),
+      this.#rootDirectory,
+      undefined,
+      environment
+    );
+    const [tree, statusOutput] = await waitForBothAsync(treePromise, statusPromise);
+    if (tree.state.submodules.size > 0 && FileSystem.exists(`${this.#rootDirectory}/.gitmodules`)) {
+      this.#disable();
+      return [undefined, ''];
+    }
+
+    return [tree, statusOutput];
+  }
+
+  async #getGitPathsAsync(): Promise<IGitPaths> {
+    if (!this.#gitPaths) {
+      const output: string = await spawnGitAsync(
+        this.#gitPath,
+        STANDARD_GIT_OPTIONS.concat([
+          'rev-parse',
+          '--show-object-format',
+          '--git-path',
+          'index',
+          '--git-path',
+          'info/attributes',
+          '--git-path',
+          'config',
+          '--git-path',
+          'config.worktree'
+        ]),
+        this.#rootDirectory
+      );
+      const [objectFormat, indexPath, ...repositoryConfigurationPaths] = output.trimEnd().split('\n');
+      const homeFolderPath: string = os.homedir();
+      const userConfigurationFolderPath: string =
+        process.env.XDG_CONFIG_HOME || path.join(homeFolderPath, '.config');
+      this.#gitPaths = {
+        indexPath: path.resolve(this.#rootDirectory, indexPath),
+        objectIdLength: objectFormat === 'sha256' ? SHA256_OBJECT_ID_LENGTH : SHA1_OBJECT_ID_LENGTH,
+        configurationPaths: [
+          ...repositoryConfigurationPaths.map((relativePath: string) =>
+            path.resolve(this.#rootDirectory, relativePath)
+          ),
+          path.join(homeFolderPath, '.gitconfig'),
+          path.join(userConfigurationFolderPath, 'git', 'config'),
+          path.join(userConfigurationFolderPath, 'git', 'attributes')
+        ]
+      };
+    }
+
+    return this.#gitPaths;
+  }
+
+  /**
+   * Ensures that the private copy of the index records the same files, with the same sizes, as the index of the
+   * repository, and that Git refreshed it under the current configuration and attributes, and for the same filter.
+   * Returns `undefined` if the repository has no index, or a split index.
+   */
+  async #tryUpdatePrivateIndexAsync(
+    gitPaths: IGitPaths,
+    settledBeforeNs: bigint,
+    filterKey: string,
+    mustCopy: boolean
+  ): Promise<IPrivateIndex | undefined> {
+    let handle: fs.promises.FileHandle;
+    try {
+      handle = await fs.promises.open(gitPaths.indexPath, 'r');
+    } catch (error) {
+      if (FileSystem.isNotExistError(error as Error)) {
+        return undefined;
+      }
+
+      throw error;
+    }
+
+    try {
+      const stats: fs.BigIntStats = await handle.stat({ bigint: true });
+      const stamp: string = getFileStamp(stats);
+      const privateIndex: IPrivateIndex | undefined = this.#privateIndex;
+      const isCopyCurrent: boolean =
+        privateIndex !== undefined &&
+        !mustCopy &&
+        !privateIndex.hasAttributesChanged &&
+        privateIndex.filterKey === filterKey &&
+        tryReadGitIndexEntryCount(privateIndex.path) === privateIndex.entryCount;
+      // A stamp recorded before the index settled could also match a later version of the index
+      if (isCopyCurrent && privateIndex?.isRealIndexStampSettled && privateIndex.realIndexStamp === stamp) {
+        return privateIndex;
+      }
+
+      // Git replaces the index rather than writing to it, so the open file doesn't change
+      const content: Buffer = await handle.readFile();
+      const summary: IGitIndexSummary = summarizeGitIndex(content, gitPaths.objectIdLength);
+      if (summary.isSplit) {
+        this.#disable();
+        return undefined;
+      }
+
+      const isRealIndexStampSettled: boolean = isFileStatSettled(stats, settledBeforeNs);
+      if (privateIndex?.entriesDigest === summary.entriesDigest) {
+        // Refreshing the index, as "git status" does, changes the stamp. It changes the recorded sizes only of files
+        // whose content Git examined, such as a file that was rewritten with other line endings.
+        if (isCopyCurrent && privateIndex.sizesDigest === summary.sizesDigest) {
+          privateIndex.realIndexStamp = stamp;
+          privateIndex.isRealIndexStampSettled = isRealIndexStampSettled;
+          return privateIndex;
+        }
+      } else {
+        // The hashes of files don't depend on the index: "git hash-object" doesn't read it, not even for a
+        // ".gitattributes" file that is missing from the working tree
+        this.#tree = undefined;
+      }
+
+      return await this.#writePrivateIndexAsync(content, stats, summary, filterKey, isRealIndexStampSettled);
+    } finally {
+      await handle.close();
+    }
+  }
+
+  async #writePrivateIndexAsync(
+    content: Buffer,
+    stats: fs.BigIntStats,
+    summary: IGitIndexSummary,
+    filterKey: string,
+    isRealIndexStampSettled: boolean
+  ): Promise<IPrivateIndex> {
+    this.#privateIndex = undefined;
+
+    const folderPath: string = this.#getPrivateFolderPath();
+    const indexPath: string = path.join(folderPath, PRIVATE_INDEX_NAME);
+    const temporaryPath: string = `${indexPath}.new`;
+    await fs.promises.writeFile(temporaryPath, content);
+    // Git doesn't trust the recorded times and size of a file that changed in the same second as the index was
+    // written, because the file may have changed again after it was recorded. Make the copy older than the index,
+    // so that Git doesn't trust any file in the copy that it wouldn't trust in the index.
+    const timeInSeconds: number = Number(stats.mtimeNs / NANOSECONDS_PER_SECOND) - 1;
+    await fs.promises.utimes(temporaryPath, timeInSeconds, timeInSeconds);
+    await fs.promises.rename(temporaryPath, indexPath);
+
+    const privateIndex: IPrivateIndex = {
+      path: indexPath,
+      entryCount: summary.entryCount,
+      entriesDigest: summary.entriesDigest,
+      sizesDigest: summary.sizesDigest,
+      filterKey,
+      realIndexStamp: getFileStamp(stats),
+      isRealIndexStampSettled,
+      attributesFingerprint: undefined,
+      hasAttributesChanged: false
+    };
+    this.#privateIndex = privateIndex;
+    return privateIndex;
+  }
+
+  /**
+   * Hashes the files with `git hash-object`, except those whose stamps match the stamps they had when they were
+   * hashed before. The hashes are in the same order as the files.
+   */
+  async #hashFilesAsync(
+    filePaths: ReadonlyArray<string>,
+    settledBeforeNs: bigint,
+    attributesStamps: Map<string, string | undefined>
+  ): Promise<Map<string, string>> {
+    const hashes: Map<string, string> = new Map();
+    if (filePaths.length === 0) {
+      return hashes;
+    }
+
+    const statsList: (fs.BigIntStats | undefined)[] = await Promise.all(
+      filePaths.map(async (filePath: string) => {
+        try {
+          return await fs.promises.lstat(path.resolve(this.#rootDirectory, filePath), { bigint: true });
+        } catch {
+          // "git hash-object" reports the error
+          return undefined;
+        }
+      })
+    );
+
+    const filesToHash: string[] = [];
+    const stampsToRecord: Map<string, string | undefined> = new Map();
+    for (let i: number = 0; i < filePaths.length; i++) {
+      const filePath: string = filePaths[i];
+      const stats: fs.BigIntStats | undefined = statsList[i];
+      // A symbolic link, or a folder, is hashed afresh each time. The hash of a file also depends on the attributes
+      // files in the folders that contain it, including ignored ones, which "git status" doesn't list.
+      let stamp: string | undefined;
+      if (stats?.isFile()) {
+        const attributesStamp: string | undefined = this.#getAttributesStamp(
+          getParentFolderPath(filePath),
+          settledBeforeNs,
+          attributesStamps
+        );
+        if (attributesStamp !== undefined) {
+          stamp = `${getFileStamp(stats)}\n${attributesStamp}`;
+        }
+      }
+
+      const fileHash: IFileHash | undefined = this.#fileHashes.get(filePath);
+      if (stamp !== undefined && fileHash?.stamp === stamp) {
+        hashes.set(filePath, fileHash.hash);
+      } else {
+        // Reserve the position of the file
+        hashes.set(filePath, '');
+        filesToHash.push(filePath);
+        stampsToRecord.set(filePath, stats && isFileStatSettled(stats, settledBeforeNs) ? stamp : undefined);
+      }
+    }
+
+    if (filesToHash.length > 0) {
+      for (const [filePath, hash] of await hashFilesAsync(this.#rootDirectory, filesToHash, this.#gitPath)) {
+        hashes.set(filePath, hash);
+        // The file was examined before it was hashed, so a later change gives it a different stamp
+        const stamp: string | undefined = stampsToRecord.get(filePath);
+        if (stamp === undefined) {
+          this.#fileHashes.delete(filePath);
+        } else {
+          this.#fileHashes.set(filePath, { stamp, hash });
+        }
+      }
+    }
+
+    return hashes;
+  }
+
+  /**
+   * Identifies the versions of the attributes files in the folder and in the folders that contain it, whether or not
+   * they exist. Returns `undefined` if one of them changed recently.
+   */
+  #getAttributesStamp(
+    folderPath: string,
+    settledBeforeNs: bigint,
+    attributesStamps: Map<string, string | undefined>
+  ): string | undefined {
+    if (attributesStamps.has(folderPath)) {
+      return attributesStamps.get(folderPath);
+    }
+
+    let stamp: string | undefined = this.#getAttributesFileStamp(folderPath, settledBeforeNs);
+    if (stamp !== undefined && folderPath) {
+      const parentStamp: string | undefined = this.#getAttributesStamp(
+        getParentFolderPath(folderPath),
+        settledBeforeNs,
+        attributesStamps
+      );
+      stamp = parentStamp === undefined ? undefined : `${parentStamp}/${stamp}`;
+    }
+
+    attributesStamps.set(folderPath, stamp);
+    return stamp;
+  }
+
+  #getAttributesFileStamp(folderPath: string, settledBeforeNs: bigint): string | undefined {
+    let stats: fs.BigIntStats | undefined;
+    try {
+      stats = fs.lstatSync(path.resolve(this.#rootDirectory, folderPath, ATTRIBUTES_FILE_NAME), {
+        bigint: true,
+        throwIfNoEntry: false
+      });
+    } catch (error) {
+      // For example, a file in place of a folder
+      return `!${(error as NodeJS.ErrnoException).code}`;
+    }
+
+    if (!stats) {
+      return '';
+    }
+
+    return isFileStatSettled(stats, settledBeforeNs) ? getFileStamp(stats) : undefined;
+  }
+
+  /**
+   * Identifies the versions of the files. A file that changed recently gets a fingerprint that matches no other.
+   */
+  #getFingerprint(filePaths: Iterable<string>, settledBeforeNs: bigint): string {
+    let fingerprint: string = '';
+    for (const filePath of filePaths) {
+      let stats: fs.BigIntStats | undefined;
+      try {
+        stats = fs.statSync(filePath, { bigint: true });
+      } catch (error) {
+        fingerprint += `${filePath}\0${(error as NodeJS.ErrnoException).code}\n`;
+        continue;
+      }
+
+      if (!isFileStatSettled(stats, settledBeforeNs)) {
+        // The file may change again without changing its stamp
+        return `${++this.#unsettledFingerprintCount}`;
+      }
+
+      fingerprint += `${filePath}\0${getFileStamp(stats)}\n`;
+    }
+
+    return fingerprint;
+  }
+
+  #getPrivateFolderPath(): string {
+    if (this.#isDisabled) {
+      throw new Error('The cache is disabled');
+    }
+
+    if (!this.#privateFolderPath) {
+      fs.mkdirSync(this.#temporaryFolderPath, { recursive: true });
+      this.#privateFolderPath = fs.mkdtempSync(path.join(this.#temporaryFolderPath, PRIVATE_FOLDER_PREFIX));
+      addPrivateFolder(this.#privateFolderPath);
+    }
+
+    return this.#privateFolderPath;
+  }
+
+  #reset(): void {
+    this.#privateIndex = undefined;
+    this.#tree = undefined;
+    this.#previousResult = undefined;
+    this.#configurationFingerprint = '';
+    this.#fileHashes.clear();
+    // Start over in a new folder, in case something deleted this one
+    if (this.#privateFolderPath) {
+      deletePrivateFolder(this.#privateFolderPath);
+      this.#privateFolderPath = undefined;
+    }
+  }
+
+  #disable(): void {
+    this.#isDisabled = true;
+    this.#reset();
+  }
+}
+
+// The folders of all caches share one listener, which is registered while any folder exists
+const privateFolderPaths: Set<string> = new Set();
+
+function addPrivateFolder(folderPath: string): void {
+  if (privateFolderPaths.size === 0) {
+    process.on('exit', deletePrivateFolders);
+  }
+
+  privateFolderPaths.add(folderPath);
+}
+
+function deletePrivateFolder(folderPath: string): void {
+  privateFolderPaths.delete(folderPath);
+  if (privateFolderPaths.size === 0) {
+    process.off('exit', deletePrivateFolders);
+  }
+
+  fs.rmSync(folderPath, { recursive: true, force: true });
+}
+
+function deletePrivateFolders(): void {
+  for (const folderPath of privateFolderPaths) {
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Reads the number of entries from the header of a Git index file, or returns `undefined` if the file doesn't
+ * exist or isn't a Git index.
+ */
+function tryReadGitIndexEntryCount(indexPath: string): number | undefined {
+  let fileDescriptor: number;
+  try {
+    fileDescriptor = fs.openSync(indexPath, 'r');
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) {
+      return undefined;
+    }
+
+    throw error;
+  }
+
+  try {
+    const header: Buffer = Buffer.alloc(INDEX_HEADER_LENGTH);
+    const bytesRead: number = fs.readSync(fileDescriptor, header, 0, INDEX_HEADER_LENGTH, 0);
+    return tryGetGitIndexEntryCount(header.subarray(0, bytesRead));
+  } finally {
+    fs.closeSync(fileDescriptor);
+  }
+}
+
+/**
+ * Returns the path of the folder that contains the file or folder, or '' for the root folder of the repository.
+ */
+function getParentFolderPath(relativePath: string): string {
+  const separatorIndex: number = Math.max(relativePath.lastIndexOf('/'), relativePath.lastIndexOf('\\'));
+  return separatorIndex < 0 ? '' : relativePath.slice(0, separatorIndex);
+}
+
+/**
+ * Lists the attributes files that affect how "git status" refreshes the files within the filter: those that it
+ * lists as modified or untracked, and those in the folders that contain the filter paths, which it doesn't list.
+ */
+function* getAttributesFilePaths(
+  rootDirectory: string,
+  modifiedFilePaths: Iterable<string>,
+  filterPath: ReadonlyArray<string> | undefined
+): IterableIterator<string> {
+  for (const filePath of modifiedFilePaths) {
+    if (filePath === ATTRIBUTES_FILE_NAME || filePath.endsWith(`/${ATTRIBUTES_FILE_NAME}`)) {
+      yield path.resolve(rootDirectory, filePath);
+    }
+  }
+
+  const rootPath: string = path.resolve(rootDirectory);
+  const folderPaths: Set<string> = new Set();
+  for (const filterEntry of filterPath ?? []) {
+    let folderPath: string = path.resolve(rootPath, filterEntry);
+    while (!folderPaths.has(folderPath)) {
+      folderPaths.add(folderPath);
+      const parentFolderPath: string = path.dirname(folderPath);
+      if (folderPath === rootPath || parentFolderPath === folderPath) {
+        break;
+      }
+
+      folderPath = parentFolderPath;
+    }
+  }
+
+  for (const folderPath of folderPaths) {
+    yield path.join(folderPath, ATTRIBUTES_FILE_NAME);
+  }
+}
+
+/**
+ * Waits for both promises to settle, then fails with the first error, if any.
+ */
+async function waitForBothAsync<T1, T2>(promise1: Promise<T1>, promise2: Promise<T2>): Promise<[T1, T2]> {
+  const [result1, result2] = await Promise.allSettled([promise1, promise2]);
+  if (result1.status === 'rejected') {
+    throw result1.reason;
+  }
+
+  if (result2.status === 'rejected') {
+    throw result2.reason;
+  }
+
+  return [result1.value, result2.value];
+}
+
+function areArraysEqual(a: ReadonlyArray<string>, b: ReadonlyArray<string>): boolean {
+  return a.length === b.length && a.every((value: string, i: number) => value === b[i]);
+}
+
+function areMapsEqual(a: ReadonlyMap<string, string>, b: ReadonlyMap<string, string>): boolean {
+  if (a.size !== b.size) {
+    return false;
+  }
+
+  for (const [key, value] of a) {
+    if (b.get(key) !== value) {
+      return false;
+    }
+  }
+
+  return true;
+}
diff --git a/libraries/package-deps-hash/src/getRepoState.ts b/libraries/package-deps-hash/src/getRepoState.ts
index e88cf1900c..348a3ecf47 100644
--- a/libraries/package-deps-hash/src/getRepoState.ts
+++ b/libraries/package-deps-hash/src/getRepoState.ts
@@ -20,7 +20,11 @@ const MINIMUM_GIT_VERSION: IGitVersion = {
   patch: 0
 };
 
-const STANDARD_GIT_OPTIONS: readonly string[] = [
+/**
+ * The options for every read-only Git command.
+ * @internal
+ */
+export const STANDARD_GIT_OPTIONS: readonly string[] = [
   // Don't request any optional file locks
   '--no-optional-locks',
   // Ensure that commands don't run automatic maintenance, since performance of the command itself is paramount
@@ -79,7 +83,10 @@ const OBJECTMODE_FILE_EXECUTABLE: '100755' = '100755';
 // e.g. 10644 blob <hash>\t<path>
 const GIT_LSTREE_FORMAT: string = '%(objectmode) type %(objectname)%x09%(path)';
 
-interface IGitTreeState {
+/**
+ * @internal
+ */
+export interface IGitTreeState {
   files: Map<string, string>; // type "blob"
   symlinks: Map<string, string>; // type "link"
   submodules: Map<string, string>; // type "commit"
@@ -273,8 +280,12 @@ export function parseGitStatus(output: string): Map<string, boolean> {
 
 const repoRootCache: Map<string, string> = new Map();
 
-// Strip GIT_DIR/GIT_WORK_TREE: git hooks in linked worktrees set GIT_DIR to the per-worktree metadata dir, causing rev-parse --show-toplevel to return CWD instead of the worktree root.
-function getCleanGitEnvironment(): NodeJS.ProcessEnv {
+/**
+ * Strip GIT_DIR/GIT_WORK_TREE: git hooks in linked worktrees set GIT_DIR to the per-worktree metadata dir, causing
+ * rev-parse --show-toplevel to return CWD instead of the worktree root.
+ * @internal
+ */
+export function getCleanGitEnvironment(): NodeJS.ProcessEnv {
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
   const { GIT_DIR, GIT_WORK_TREE, ...trimmedEnv } = process.env;
   return trimmedEnv;
@@ -323,17 +334,20 @@ export function getRepoRoot(currentWorkingDirectory: string, gitPath?: string):
  * @param args - The process arguments
  * @param currentWorkingDirectory - The working directory. Should be the repository root.
  * @param stdin - An optional Readable stream to use as stdin to the process.
+ * @param environment - The environment of the process. Defaults to {@link getCleanGitEnvironment}.
+ * @internal
  */
-async function spawnGitAsync(
+export async function spawnGitAsync(
   gitPath: string | undefined,
   args: string[],
   currentWorkingDirectory: string,
-  stdin?: Readable
+  stdin?: Readable,
+  environment: NodeJS.ProcessEnv = getCleanGitEnvironment()
 ): Promise<string> {
   const spawnOptions: IExecutableSpawnOptions = {
     currentWorkingDirectory,
     stdio: ['pipe', 'pipe', 'pipe'],
-    environment: getCleanGitEnvironment()
+    environment
   };
 
   let stdout: string = '';
@@ -363,14 +377,29 @@ async function spawnGitAsync(
   if (status !== 0) {
     ensureGitMinimumVersion(gitPath);
 
-    // Name the git command itself, not the first of the STANDARD_GIT_OPTIONS in front of it
-    const command: string | undefined = args.find((arg: string) => !STANDARD_GIT_OPTIONS.includes(arg));
-    throw new Error(`git ${command} exited with code ${status}:\n${stderr}`);
+    throw new Error(`git ${getGitCommandName(args)} exited with code ${status}:\n${stderr}`);
   }
 
   return stdout;
 }
 
+/**
+ * Returns the Git command in the arguments, rather than the first of the options in front of it.
+ */
+function getGitCommandName(args: ReadonlyArray<string>): string | undefined {
+  for (let i: number = 0; i < args.length; i++) {
+    const arg: string = args[i];
+    if (arg === '-c') {
+      // Skip the value of a configuration option
+      i++;
+    } else if (!arg.startsWith('-')) {
+      return arg;
+    }
+  }
+
+  return undefined;
+}
+
 function isIterable<T>(value: Iterable<T> | AsyncIterable<T>): value is Iterable<T> {
   return Symbol.iterator in value;
 }
@@ -426,6 +455,87 @@ export async function hashFilesAsync(
   return parseGitHashObject(hashObjectResult, hashPaths);
 }
 
+/**
+ * The arguments of the `git ls-files` command that lists the files in the index in the format of `git ls-tree`.
+ * @internal
+ */
+export function getGitLsFilesArgs(filterPath: ReadonlyArray<string> | undefined): string[] {
+  return [
+    'ls-files',
+    // Read from the index only
+    '--cached',
+    // Use NUL as the separator
+    '-z',
+    // Specify the full path to files relative to the root
+    '--full-name',
+    // Match the format of "git ls-tree". The %(objecttype) placeholder requires git 2.51.0+, so not using yet.
+    `--format=${GIT_LSTREE_FORMAT}`,
+    '--',
+    ...(filterPath ?? [])
+  ];
+}
+
+/**
+ * The arguments of the `git status` command that lists the files that differ from the index or from HEAD, and the
+ * untracked files. Its output is parsed by {@link parseGitStatus}.
+ * @internal
+ */
+export function getGitStatusArgs(filterPath: ReadonlyArray<string> | undefined): string[] {
+  return [
+    'status',
+    // Use NUL as the separator
+    '-z',
+    // Include untracked files
+    '-u',
+    // Disable rename detection so that renames show up as add + delete
+    '--no-renames',
+    // Don't process submodules with this command; they'll be handled individually
+    '--ignore-submodules',
+    // Don't compare against the remote
+    '--no-ahead-behind',
+    '--',
+    ...(filterPath ?? [])
+  ];
+}
+
+/**
+ * The locally modified files that `git status` reports, split into those to hash with `git hash-object` and those
+ * to remove from the state of the repository.
+ * @internal
+ */
+export interface ILocallyModifiedFiles {
+  filesToHash: string[];
+  filesToRemove: string[];
+}
+
+/**
+ * Splits the locally modified files that `git status` reports into those to hash and those to remove from the
+ * state of the repository: the deleted files and the files that the index records as symbolic links.
+ * @internal
+ */
+export function classifyLocallyModifiedFiles(
+  locallyModified: ReadonlyMap<string, boolean>,
+  symlinks: ReadonlyMap<string, string>
+): ILocallyModifiedFiles {
+  const filesToHash: string[] = [];
+  const filesToRemove: string[] = [];
+  const isWindows: boolean = process.platform === 'win32';
+  for (const [filePath, exists] of locallyModified) {
+    if (exists && !symlinks.has(filePath)) {
+      // Skip Windows reserved device names. `git hash-object` cannot open them and would abort
+      // the entire repo-state computation. These are almost always stray artifacts (e.g. a `nul`
+      // file produced by a misdirected shell redirect) rather than meaningful inputs.
+      if (!isWindows || !isWindowsReservedPath(filePath)) {
+        filesToHash.push(filePath);
+      }
+    } else {
+      filesToRemove.push(filePath);
+    }
+  }
+
+  return { filesToHash, filesToRemove };
+}
+
 /**
  * Gets the object hashes for all files in the Git repo, combining the current commit with working tree state.
  * Uses async operations and runs all primary Git calls in parallel.
@@ -489,38 +599,12 @@ export async function getDetailedRepoStateAsync(
 ): Promise<IDetailedRepoState> {
   const statePromise: Promise<IGitTreeState> = spawnGitAsync(
     gitPath,
-    STANDARD_GIT_OPTIONS.concat([
-      'ls-files',
-      // Read from the index only
-      '--cached',
-      // Use NUL as the separator
-      '-z',
-      // Specify the full path to files relative to the root
-      '--full-name',
-      // Match the format of "git ls-tree". The %(objecttype) placeholder requires git 2.51.0+, so not using yet.
-      `--format=${GIT_LSTREE_FORMAT}`,
-      '--',
-      ...(filterPath ?? [])
-    ]),
+    STANDARD_GIT_OPTIONS.concat(getGitLsFilesArgs(filterPath)),
     rootDirectory
   ).then(parseGitLsTree);
   const locallyModifiedPromise: Promise<Map<string, boolean>> = spawnGitAsync(
     gitPath,
-    STANDARD_GIT_OPTIONS.concat([
-      'status',
-      // Use NUL as the separator
-      '-z',
-      // Include untracked files
-      '-u',
-      // Disable rename detection so that renames show up as add + delete
-      '--no-renames',
-      // Don't process submodules with this command; they'll be handled individually
-      '--ignore-submodules',
-      // Don't compare against the remote
-      '--no-ahead-behind',
-      '--',
-      ...(filterPath ?? [])
-    ]),
+    STANDARD_GIT_OPTIONS.concat(getGitStatusArgs(filterPath)),
     rootDirectory
   ).then(parseGitStatus);
 
@@ -533,21 +617,13 @@ export async function getDetailedRepoStateAsync(
 
     const [{ files, symlinks }, locallyModified] = await Promise.all([statePromise, locallyModifiedPromise]);
 
-    const isWindows: boolean = process.platform === 'win32';
-    for (const [filePath, exists] of locallyModified) {
-      if (exists && !symlinks.has(filePath)) {
-        // Skip Windows reserved device names. `git hash-object` cannot open them and would abort
-        // the entire repo-state computation. These are almost always stray artifacts (e.g. a `nul`
-        // file produced by a misdirected shell redirect) rather than meaningful inputs.
-        if (isWindows && isWindowsReservedPath(filePath)) {
-          continue;
-        }
-        yield filePath;
-      } else {
-        files.delete(filePath);
-        symlinks.delete(filePath);
-      }
+    const { filesToHash, filesToRemove } = classifyLocallyModifiedFiles(locallyModified, symlinks);
+    for (const filePath of filesToRemove) {
+      files.delete(filePath);
+      symlinks.delete(filePath);
     }
+
+    yield* filesToHash;
   }
 
   const hashObjectPromise: Promise<Iterable<[string, string]>> = hashFilesAsync(
diff --git a/libraries/package-deps-hash/src/index.ts b/libraries/package-deps-hash/src/index.ts
index 8558d210a4..4d54497791 100644
--- a/libraries/package-deps-hash/src/index.ts
+++ b/libraries/package-deps-hash/src/index.ts
@@ -24,3 +24,4 @@ export {
   ensureGitMinimumVersion,
   hashFilesAsync
 } from './getRepoState';
+export { type IRepoStateCacheOptions, RepoStateCache } from './RepoStateCache';
diff --git a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
new file mode 100644
index 0000000000..b55b0f34e5
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
@@ -0,0 +1,228 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { type IGitIndexSummary, summarizeGitIndex, tryGetGitIndexEntryCount } from '../GitIndexFile';
+
+const SHA1_OBJECT_ID_LENGTH: number = 20;
+const SHA256_OBJECT_ID_LENGTH: number = 32;
+const LONG_FILE_PATH: string = `dir/sub/${'long-name-'.repeat(12)}.txt`;
+
+function getGitEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...process.env };
+  delete environment.GIT_DIR;
+  delete environment.GIT_WORK_TREE;
+  delete environment.GIT_INDEX_FILE;
+  // Let "git status" save the index that it refreshes
+  delete environment.GIT_OPTIONAL_LOCKS;
+  return environment;
+}
+
+describe(summarizeGitIndex.name, () => {
+  let repoPath: string;
+
+  function runGit(...args: string[]): string {
+    return execFileSync('git', args, { cwd: repoPath, env: getGitEnvironment(), encoding: 'utf8' });
+  }
+
+  function writeFile(relativePath: string, content: string): void {
+    const filePath: string = path.join(repoPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  function readIndex(): Buffer {
+    return fs.readFileSync(path.join(repoPath, '.git', 'index'));
+  }
+
+  function summarize(objectIdLength: number = SHA1_OBJECT_ID_LENGTH): IGitIndexSummary {
+    return summarizeGitIndex(readIndex(), objectIdLength);
+  }
+
+  function createRepo(...initArgs: string[]): void {
+    runGit('init', '--quiet', ...initArgs);
+    runGit('config', 'core.fsmonitor', 'false');
+    runGit('config', 'core.untrackedCache', 'true');
+    runGit('config', 'index.skipHash', 'false');
+    writeFile('a.txt', 'a\n');
+    writeFile('dir/b.txt', 'b\n');
+    writeFile('dir/sub/c.txt', 'c\n');
+    writeFile(LONG_FILE_PATH, 'd\n');
+    runGit('add', '.');
+  }
+
+  // Git writes a version 3 index only if an entry has extended flags, and writes a version 2 index otherwise
+  function setIndexVersion(version: number): void {
+    if (version === 3) {
+      runGit('update-index', '--skip-worktree', LONG_FILE_PATH);
+    }
+
+    runGit('update-index', `--index-version=${version}`);
+    expect(readIndex().readUInt32BE(4)).toBe(version);
+  }
+
+  beforeEach(() => {
+    repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'git-index-file-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(repoPath, { recursive: true, force: true });
+  });
+
+  it.each([2, 3, 4])('summarizes a version %i index', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+
+    const summary: IGitIndexSummary = summarize();
+    expect(summary.entryCount).toBe(4);
+    expect(summary.entriesDigest).toMatch(/^[0-9a-f]{40}$/);
+    expect(summary.isSplit).toBe(false);
+  });
+
+  it('summarizes the index of a SHA-256 repository', () => {
+    createRepo('--object-format=sha256');
+    runGit('update-index', '--index-version=4');
+
+    const summary: IGitIndexSummary = summarize(SHA256_OBJECT_ID_LENGTH);
+    expect(summary.entryCount).toBe(4);
+    expect(() => summarize(SHA1_OBJECT_ID_LENGTH)).toThrow();
+  });
+
+  it.each([2, 3, 4])('ignores what refreshing a version %i index changes', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+    runGit('-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Initial');
+    const initialIndex: Buffer = readIndex();
+    const initialSummary: IGitIndexSummary = summarize();
+
+    // Change the recorded times of a file, and the untracked cache
+    const time: number = Math.floor(Date.now() / 1000) - 100;
+    fs.utimesSync(path.join(repoPath, 'a.txt'), time, time);
+    writeFile('untracked.txt', 'untracked\n');
+    runGit('status', '--porcelain');
+
+    expect(readIndex().equals(initialIndex)).toBe(false);
+    expect(summarize()).toEqual(initialSummary);
+  });
+
+  it.each([2, 3, 4])('changes when the entries of a version %i index change', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+    const initialDigest: string = summarize().entriesDigest;
+    const digests: Set<string> = new Set([initialDigest]);
+
+    runGit('update-index', '--assume-unchanged', 'a.txt');
+    digests.add(summarize().entriesDigest);
+    runGit('update-index', '--no-assume-unchanged', 'a.txt');
+    expect(summarize().entriesDigest).toBe(initialDigest);
+
+    // Extended flags
+    runGit('update-index', '--skip-worktree', 'dir/b.txt');
+    digests.add(summarize().entriesDigest);
+    runGit('update-index', '--no-skip-worktree', 'dir/b.txt');
+    expect(summarize().entriesDigest).toBe(initialDigest);
+
+    runGit('update-index', '--chmod=+x', 'a.txt');
+    digests.add(summarize().entriesDigest);
+    runGit('update-index', '--chmod=-x', 'a.txt');
+    expect(summarize().entriesDigest).toBe(initialDigest);
+
+    writeFile('a.txt', 'changed\n');
+    runGit('add', 'a.txt');
+    digests.add(summarize().entriesDigest);
+
+    runGit('rm', '--cached', '--quiet', 'dir/sub/c.txt');
+    const summary: IGitIndexSummary = summarize();
+    expect(summary.entryCount).toBe(3);
+    digests.add(summary.entriesDigest);
+
+    expect(digests.size).toBe(6);
+  });
+
+  it.each([2, 3, 4])('digests the recorded sizes of a version %i index separately', (version: number) => {
+    createRepo();
+    setIndexVersion(version);
+    runGit('-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Initial');
+    const initialSummary: IGitIndexSummary = summarize();
+    expect(initialSummary.sizesDigest).toMatch(/^[0-9a-f]{40}$/);
+
+    // Git writes the file with other line endings, and records its new size
+    runGit('config', 'core.autocrlf', 'true');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    expect(fs.readFileSync(path.join(repoPath, 'a.txt'), 'utf8')).toBe('a\r\n');
+    let summary: IGitIndexSummary = summarize();
+    expect(summary.entriesDigest).toBe(initialSummary.entriesDigest);
+    expect(summary.sizesDigest).not.toBe(initialSummary.sizesDigest);
+
+    runGit('config', 'core.autocrlf', 'false');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    summary = summarize();
+    expect(summary.entriesDigest).toBe(initialSummary.entriesDigest);
+    expect(summary.sizesDigest).toBe(initialSummary.sizesDigest);
+  });
+
+  it('detects a split index', () => {
+    createRepo();
+    runGit('update-index', '--split-index');
+    expect(summarize().isSplit).toBe(true);
+
+    runGit('update-index', '--no-split-index');
+    const summary: IGitIndexSummary = summarize();
+    expect(summary.isSplit).toBe(false);
+    expect(summary.entryCount).toBe(4);
+  });
+
+  it('rejects data that is not a supported index', () => {
+    createRepo();
+    const index: Buffer = readIndex();
+    expect(() => summarizeGitIndex(Buffer.from('not an index'), SHA1_OBJECT_ID_LENGTH)).toThrow(
+      'The file is not a Git index'
+    );
+    expect(() => summarizeGitIndex(index.subarray(0, index.length - 30), SHA1_OBJECT_ID_LENGTH)).toThrow();
+
+    const unsupportedIndex: Buffer = Buffer.from(index);
+    unsupportedIndex.writeUInt32BE(5, 4);
+    expect(() => summarizeGitIndex(unsupportedIndex, SHA1_OBJECT_ID_LENGTH)).toThrow(
+      'Unsupported Git index version 5'
+    );
+  });
+
+  it('rejects an entry count that the index is too short to hold, before allocating memory for it', () => {
+    createRepo();
+    const index: Buffer = readIndex();
+    index.writeUInt32BE(0xffffffff, 8);
+    const allocSpy: jest.SpyInstance = jest.spyOn(Buffer, 'alloc').mockImplementation(() => {
+      throw new Error('Unexpected allocation');
+    });
+    try {
+      expect(() => summarizeGitIndex(index, SHA1_OBJECT_ID_LENGTH)).toThrow(
+        'The Git index ends within an entry'
+      );
+      expect(allocSpy).not.toHaveBeenCalled();
+    } finally {
+      allocSpy.mockRestore();
+    }
+  });
+});
+
+describe(tryGetGitIndexEntryCount.name, () => {
+  it('reads the entry count from the header of an index', () => {
+    const header: Buffer = Buffer.alloc(12);
+    header.write('DIRC', 0, 'latin1');
+    header.writeUInt32BE(2, 4);
+    header.writeUInt32BE(236074, 8);
+    expect(tryGetGitIndexEntryCount(header)).toBe(236074);
+  });
+
+  it('returns undefined for data that is not the header of an index', () => {
+    expect(tryGetGitIndexEntryCount(Buffer.alloc(0))).toBeUndefined();
+    expect(tryGetGitIndexEntryCount(Buffer.from('DIRC'))).toBeUndefined();
+    expect(tryGetGitIndexEntryCount(Buffer.from('PACK\0\0\0\x02\0\0\0\x01'))).toBeUndefined();
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
new file mode 100644
index 0000000000..162c7ac7a9
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -0,0 +1,912 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { type ChildProcess, execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { Executable, type IExecutableSpawnOptions } from '@rushstack/node-core-library';
+
+import * as GitIndexFile from '../GitIndexFile';
+import { getDetailedRepoStateAsync, type IDetailedRepoState } from '../getRepoState';
+import { RepoStateCache } from '../RepoStateCache';
+
+const originalDateNow: () => number = Date.now;
+const originalSpawn: typeof Executable.spawn = Executable.spawn;
+
+function getGitEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...process.env };
+  delete environment.GIT_DIR;
+  delete environment.GIT_WORK_TREE;
+  delete environment.GIT_INDEX_FILE;
+  // Let "git status" save the index that it refreshes
+  delete environment.GIT_OPTIONAL_LOCKS;
+  return environment;
+}
+
+interface IComparableState {
+  hasSubmodules: boolean;
+  hasUncommittedChanges: boolean;
+  files: [string, string][];
+  symlinks: [string, string][];
+}
+
+function toComparable(state: IDetailedRepoState): IComparableState {
+  return {
+    hasSubmodules: state.hasSubmodules,
+    hasUncommittedChanges: state.hasUncommittedChanges,
+    files: Array.from(state.files),
+    symlinks: Array.from(state.symlinks)
+  };
+}
+
+interface IGitCommand {
+  command: string | undefined;
+  usesPrivateIndex: boolean;
+}
+
+function getGitCommand(
+  args: ReadonlyArray<string>,
+  options: IExecutableSpawnOptions | undefined
+): IGitCommand {
+  let command: string | undefined;
+  for (let i: number = 0; i < args.length && !command; i++) {
+    if (args[i] === '-c') {
+      // Skip the value of a configuration option
+      i++;
+    } else if (!args[i].startsWith('-')) {
+      command = args[i];
+    }
+  }
+
+  return { command, usesPrivateIndex: !!options?.environment?.GIT_INDEX_FILE };
+}
+
+describe(RepoStateCache.name, () => {
+  let repoPath: string;
+  let temporaryFolderPath: string;
+  let cache: RepoStateCache;
+  let gitCommands: IGitCommand[];
+  let isRecordingGitCommands: boolean;
+  let beforeSpawn: ((gitCommand: IGitCommand) => void) | undefined;
+  let afterSpawn: ((gitCommand: IGitCommand, childProcess: ChildProcess) => void) | undefined;
+
+  function runGit(...args: string[]): string {
+    return execFileSync('git', args, { cwd: repoPath, env: getGitEnvironment(), encoding: 'utf8' });
+  }
+
+  function writeFile(relativePath: string, content: string): void {
+    const filePath: string = path.join(repoPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  function commit(): void {
+    runGit('add', '--all');
+    runGit('commit', '--quiet', '--allow-empty', '-m', 'Commit');
+  }
+
+  function getPrivateIndexPath(): string {
+    const [folderName] = fs.readdirSync(temporaryFolderPath);
+    return path.join(temporaryFolderPath, folderName, 'index');
+  }
+
+  // Treat every file as settled, so that the cache memoizes the hashes of files that just changed
+  function settleFiles(): void {
+    jest.spyOn(Date, 'now').mockImplementation(() => originalDateNow() + 10000);
+  }
+
+  // Treat every file as changed recently, however slowly the test runs
+  function unsettleFiles(): void {
+    jest.spyOn(Date, 'now').mockImplementation(() => originalDateNow() - 60000);
+  }
+
+  // Changes the recorded times of a file, but not its content, so that "git status" saves the refreshed index
+  function touchSettledFile(relativePath: string): void {
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    fs.utimesSync(path.join(repoPath, relativePath), time, time);
+  }
+
+  function takeGitCommands(): IGitCommand[] {
+    const commands: IGitCommand[] = gitCommands;
+    gitCommands = [];
+    return commands;
+  }
+
+  // The commands that the cache ran, sorted, since some run concurrently
+  function takeGitCommandNames(): (string | undefined)[] {
+    return takeGitCommands()
+      .map(({ command }: IGitCommand) => command)
+      .sort();
+  }
+
+  function takeUsesPrivateIndex(): boolean {
+    return takeGitCommands().some(({ usesPrivateIndex }: IGitCommand) => usesPrivateIndex);
+  }
+
+  async function getStateAsync(
+    additionalRelativePathsToHash?: string[],
+    filterPath?: string[]
+  ): Promise<IDetailedRepoState> {
+    return await cache.getDetailedRepoStateAsync(additionalRelativePathsToHash, filterPath);
+  }
+
+  async function expectUncachedStateAsync(
+    state: IDetailedRepoState,
+    additionalRelativePathsToHash?: string[],
+    filterPath?: string[]
+  ): Promise<void> {
+    isRecordingGitCommands = false;
+    try {
+      const expected: IDetailedRepoState = await getDetailedRepoStateAsync(
+        repoPath,
+        additionalRelativePathsToHash,
+        undefined,
+        filterPath
+      );
+      expect(toComparable(state)).toEqual(toComparable(expected));
+    } finally {
+      isRecordingGitCommands = true;
+    }
+  }
+
+  beforeEach(() => {
+    repoPath = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'repo-state-cache-test-')));
+    temporaryFolderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-state-cache-private-'));
+    runGit('init', '--quiet');
+    runGit('config', 'user.name', 'Test');
+    runGit('config', 'user.email', 'test@example.com');
+    runGit('config', 'commit.gpgSign', 'false');
+    runGit('config', 'core.fsmonitor', 'false');
+    runGit('config', 'core.untrackedCache', 'true');
+    runGit('config', 'maintenance.auto', 'false');
+    writeFile('a.txt', 'a\n');
+    writeFile('b.txt', 'b\n');
+    writeFile('dir/c.txt', 'c\n');
+    commit();
+
+    cache = new RepoStateCache({ rootDirectory: repoPath, temporaryFolderPath });
+    gitCommands = [];
+    isRecordingGitCommands = true;
+    beforeSpawn = undefined;
+    afterSpawn = undefined;
+    jest
+      .spyOn(Executable, 'spawn')
+      .mockImplementation((filename: string, args: string[], options?: IExecutableSpawnOptions) => {
+        const gitCommand: IGitCommand = getGitCommand(args, options);
+        beforeSpawn?.(gitCommand);
+        if (isRecordingGitCommands) {
+          gitCommands.push(gitCommand);
+        }
+
+        const childProcess: ChildProcess = originalSpawn.call(Executable, filename, args, options);
+        afterSpawn?.(gitCommand, childProcess);
+        return childProcess;
+      });
+  });
+
+  afterEach(() => {
+    cache.dispose();
+    jest.restoreAllMocks();
+    fs.rmSync(repoPath, { recursive: true, force: true });
+    fs.rmSync(temporaryFolderPath, { recursive: true, force: true });
+  });
+
+  it('returns the same state as getDetailedRepoStateAsync, and the same object while nothing changes', async () => {
+    writeFile('a.txt', 'modified\n');
+    writeFile('untracked.txt', 'untracked\n');
+    settleFiles();
+
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(
+      takeGitCommands()
+        .map(({ command, usesPrivateIndex }: IGitCommand) => `${command} ${usesPrivateIndex}`)
+        .sort()
+    ).toEqual(['hash-object false', 'hash-object false', 'ls-files true', 'rev-parse false', 'status true']);
+    await expectUncachedStateAsync(state, ['untracked.txt']);
+    expect(state.hasUncommittedChanges).toBe(true);
+
+    await expect(getStateAsync(['untracked.txt'])).resolves.toBe(state);
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('follows changes to the working tree', async () => {
+    let previousState: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(previousState);
+    expect(previousState.hasUncommittedChanges).toBe(false);
+
+    const changes: (() => void)[] = [
+      () => writeFile('a.txt', 'modified\n'),
+      () => writeFile('a.txt', 'modified again\n'),
+      () => writeFile('new.txt', 'new\n'),
+      () => fs.unlinkSync(path.join(repoPath, 'b.txt')),
+      () => runGit('checkout', '--', 'b.txt'),
+      () => fs.unlinkSync(path.join(repoPath, 'new.txt')),
+      () => runGit('checkout', '--', 'a.txt')
+    ];
+    for (const change of changes) {
+      change();
+      const state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state).not.toBe(previousState);
+      previousState = state;
+    }
+
+    expect(previousState.hasUncommittedChanges).toBe(false);
+  });
+
+  it('hashes a file that changed recently each time', async () => {
+    unsettleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    takeGitCommands();
+
+    // The file may change again without changing its stamp
+    await getStateAsync();
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('hashes a settled file only while its stamp changes', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    writeFile('untracked.txt', 'untracked\n');
+    await getStateAsync(['untracked.txt']);
+    takeGitCommands();
+
+    await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['status']);
+
+    writeFile('untracked.txt', 'untracked and modified\n');
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+    await expectUncachedStateAsync(state, ['untracked.txt']);
+  });
+
+  it('hashes a file that changed recently again even when its stamp stays the same', async () => {
+    settleFiles();
+    writeFile('untracked.txt', 'one\n');
+    const filePath: string = path.join(repoPath, 'untracked.txt');
+    // Only this file changed recently. Its stamp stays the same when it changes again, as it can when the file
+    // changes twice within the granularity of the file times.
+    const recentTimeNs: bigint = BigInt(Date.now()) * BigInt(1e6);
+    const recentStats: fs.BigIntStats = Object.create(fs.lstatSync(filePath, { bigint: true }), {
+      mtimeNs: { value: recentTimeNs },
+      ctimeNs: { value: recentTimeNs }
+    });
+    const lstatAsync: typeof fs.promises.lstat = fs.promises.lstat;
+    jest
+      .spyOn(fs.promises, 'lstat')
+      .mockImplementation(async (lstatPath: fs.PathLike, options?: fs.StatOptions) =>
+        lstatPath === filePath ? recentStats : await lstatAsync(lstatPath, options)
+      );
+    await getStateAsync(['untracked.txt']);
+
+    writeFile('untracked.txt', 'two\n');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'hash-object', 'status']);
+    expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
+  });
+
+  it('copies the index again when the files that it records change', async () => {
+    settleFiles();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    await getStateAsync();
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+
+    writeFile('a.txt', 'modified\n');
+    runGit('add', 'a.txt');
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(takeGitCommandNames()).toContain('ls-files');
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+
+    // Committing doesn't change the files that the index records
+    runGit('commit', '--quiet', '-m', 'Modify');
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+
+    runGit('rm', '--cached', '--quiet', 'b.txt');
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('lists the files in the copy of the index while "git status" refreshes it', async () => {
+    await getStateAsync();
+    writeFile('a.txt', 'modified\n');
+    runGit('add', 'a.txt');
+    const events: string[] = [];
+    afterSpawn = ({ command }: IGitCommand, childProcess: ChildProcess) => {
+      if (command === 'ls-files' || command === 'status') {
+        events.push(`start ${command}`);
+        childProcess.once('exit', () => events.push(`exit ${command}`));
+      }
+    };
+
+    const state: IDetailedRepoState = await getStateAsync();
+    afterSpawn = undefined;
+    await expectUncachedStateAsync(state);
+    // Both commands start before either one exits
+    expect(events.slice(0, 2).sort()).toEqual(['start ls-files', 'start status']);
+    expect(events.slice(2).sort()).toEqual(['exit ls-files', 'exit status']);
+  });
+
+  it('keeps the copy of the index when Git only refreshes the index', async () => {
+    settleFiles();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    await getStateAsync();
+
+    const indexPath: string = path.join(repoPath, '.git', 'index');
+    const indexInode: number = fs.statSync(indexPath).ino;
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    fs.utimesSync(path.join(repoPath, 'a.txt'), time, time);
+    runGit('status', '--porcelain');
+    // Git replaced the index
+    expect(fs.statSync(indexPath).ino).not.toBe(indexInode);
+
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(takeGitCommandNames()).toEqual(['status']);
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('detects a change that the recorded times and size of a file cannot reveal', async () => {
+    // Git then compares only the whole seconds of the modification time, and the size
+    runGit('config', 'core.trustctime', 'false');
+    runGit('config', 'core.checkStat', 'minimal');
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    const filePath: string = path.join(repoPath, 'a.txt');
+    fs.utimesSync(filePath, time, time);
+    runGit('update-index', '--refresh');
+    // The index was saved in the same second as the file changed, so Git must not trust the recorded times
+    fs.utimesSync(path.join(repoPath, '.git', 'index'), time, time);
+    fs.writeFileSync(filePath, 'A\n');
+    fs.utimesSync(filePath, time, time);
+
+    const state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(runGit('hash-object', 'a.txt').trim());
+  });
+
+  it('detects a change that the recorded times and size of a file cannot reveal, even where Git trusts them', async () => {
+    runGit('config', 'core.trustctime', 'false');
+    runGit('config', 'core.checkStat', 'minimal');
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    const filePath: string = path.join(repoPath, 'a.txt');
+    fs.utimesSync(filePath, time, time);
+    runGit('update-index', '--refresh');
+    // The index was saved a second after the file changed, so Git trusts the recorded times and size, and
+    // getDetailedRepoStateAsync misses the change. The copy of the index is older.
+    fs.utimesSync(path.join(repoPath, '.git', 'index'), time + 1, time + 1);
+    fs.writeFileSync(filePath, 'A\n');
+    fs.utimesSync(filePath, time, time);
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('a.txt')).toBe(runGit('hash-object', 'a.txt').trim());
+  });
+
+  it('copies the index again when the recorded size of a file changes', async () => {
+    settleFiles();
+    runGit('config', 'core.autocrlf', 'true');
+    const additionalPaths: string[] = ['b.txt'];
+    await getStateAsync(additionalPaths);
+    writeFile('a.txt', 'modified\n');
+    await expectUncachedStateAsync(await getStateAsync(additionalPaths), additionalPaths);
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git writes the file with other line endings, and records its new size in the index but not in the copy
+    runGit('checkout', '--', 'a.txt');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    // The files that the index records didn't change, so the list of files and the hashes are reused
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('copies the index again when the configuration of the repository changes', async () => {
+    settleFiles();
+    runGit('config', 'core.autocrlf', 'true');
+    // Git writes the file with CRLF line endings
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    await getStateAsync();
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('a.txt');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git no longer converts the line endings, so the file no longer matches the index
+    runGit('config', 'core.autocrlf', 'false');
+    takeGitCommands();
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('a\r\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('copies the index again when a .gitattributes file changes, after computing the state without the cache', async () => {
+    settleFiles();
+    writeFile('crlf.txt', 'a\r\n');
+    commit();
+    await getStateAsync();
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('crlf.txt');
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git now converts the line endings of the file, so it no longer matches the index
+    writeFile('.gitattributes', '*.txt text eol=lf\n');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('crlf.txt')).toBe(hashText('a\n'));
+    expect(writeFileSpy).not.toHaveBeenCalled();
+
+    takeGitCommands();
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('copies the index again when a .gitattributes file in a folder that contains the filter changes', async () => {
+    settleFiles();
+    writeFile('sub/.gitattributes', '*.txt -text\n');
+    writeFile('sub/dir/crlf.txt', 'a\r\n');
+    writeFile('sub/dir/modified.txt', 'm\n');
+    commit();
+    const filterPath: string[] = ['sub/dir'];
+    await getStateAsync([], filterPath);
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('sub/dir/crlf.txt');
+    writeFile('sub/dir/modified.txt', 'modified\r\n');
+    let state: IDetailedRepoState = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+
+    // "git status" doesn't list the file, which is outside the filter
+    writeFile('sub/.gitattributes', '*.txt text eol=lf\n');
+    state = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+    expect(state.files.get('sub/dir/crlf.txt')).toBe(hashText('a\n'));
+    expect(state.files.get('sub/dir/modified.txt')).toBe(hashText('modified\n'));
+
+    takeGitCommands();
+    state = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+    expect(takeUsesPrivateIndex()).toBe(true);
+  });
+
+  it('copies the index again when the filter changes, instead of computing the state without the cache', async () => {
+    settleFiles();
+    writeFile('dir/crlf.txt', 'a\r\n');
+    commit();
+    await getStateAsync();
+    touchSettledFile('dir/crlf.txt');
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // An untracked file outside the filter, which "git status" doesn't list
+    writeFile('.gitattributes', '*.txt text eol=lf\n');
+    const state: IDetailedRepoState = await getStateAsync([], ['dir']);
+    await expectUncachedStateAsync(state, [], ['dir']);
+    expect(state.files.get('dir/crlf.txt')).toBe(hashText('a\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('hashes a file again when an ignored .gitattributes file in a folder that contains it changes', async () => {
+    settleFiles();
+    writeFile('.gitignore', 'ignored/\n');
+    commit();
+    writeFile('ignored/dir/crlf.txt', 'a\r\n');
+    const additionalPaths: string[] = ['ignored/dir/crlf.txt'];
+    let state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('ignored/dir/crlf.txt')).toBe(hashText('a\r\n'));
+
+    // "git status" doesn't list the ignored file
+    writeFile('ignored/.gitattributes', '*.txt text eol=lf\n');
+    takeGitCommands();
+    state = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('ignored/dir/crlf.txt')).toBe(hashText('a\n'));
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+
+    await getStateAsync(additionalPaths);
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('hashes a file each time while a .gitattributes file in a folder that contains it may still change', async () => {
+    settleFiles();
+    writeFile('.gitignore', 'ignored/\n');
+    writeFile('.gitattributes', '*.txt -text\n');
+    commit();
+    writeFile('ignored/crlf.txt', 'a\r\n');
+    // The attributes file changes after the calls start, but "git status" doesn't list it
+    const time: number = Math.floor(originalDateNow() / 1000) + 60;
+    fs.utimesSync(path.join(repoPath, '.gitattributes'), time, time);
+    const additionalPaths: string[] = ['ignored/crlf.txt'];
+    await getStateAsync(additionalPaths);
+    takeGitCommands();
+
+    await getStateAsync(additionalPaths);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('hashes files again when a modified .gitattributes file changes', async () => {
+    settleFiles();
+    writeFile('.gitattributes', '# No attributes\n');
+    // "git status" doesn't report an ignored file, so only the additional files include it
+    writeFile('.gitignore', 'ignored.txt\n');
+    commit();
+    writeFile('a.txt', 'modified\r\n');
+    writeFile('untracked.txt', 'untracked\r\n');
+    writeFile('ignored.txt', 'ignored\r\n');
+    const additionalPaths: string[] = ['untracked.txt', 'ignored.txt'];
+    await expectUncachedStateAsync(await getStateAsync(additionalPaths), additionalPaths);
+
+    writeFile('.gitattributes', '*.txt text eol=lf\n');
+    let state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
+    expect(state.files.get('ignored.txt')).toBe(hashText('ignored\n'));
+
+    runGit('checkout', '--', '.gitattributes');
+    state = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\r\n'));
+    expect(state.files.get('ignored.txt')).toBe(hashText('ignored\r\n'));
+  });
+
+  it('hashes files again when the configuration of the repository changes', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\r\n');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\r\n'));
+
+    runGit('config', 'core.autocrlf', 'true');
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
+  });
+
+  it('reads the index again while its stamp may still change', async () => {
+    settleFiles();
+    const summarizeSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'summarizeGitIndex');
+    // The index changes after the calls start, but the configuration doesn't
+    const indexPath: string = path.join(repoPath, '.git', 'index');
+    const futureTime: number = Math.floor(originalDateNow() / 1000) + 60;
+    fs.utimesSync(indexPath, futureTime, futureTime);
+    await getStateAsync();
+    await getStateAsync();
+    expect(summarizeSpy).toHaveBeenCalledTimes(2);
+
+    const pastTime: number = Math.floor(originalDateNow() / 1000) - 100;
+    fs.utimesSync(indexPath, pastTime, pastTime);
+    await getStateAsync();
+    expect(summarizeSpy).toHaveBeenCalledTimes(3);
+    await getStateAsync();
+    expect(summarizeSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('reuses the hashes of files when the files that the index records change', async () => {
+    settleFiles();
+    const additionalPaths: string[] = ['b.txt'];
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync(additionalPaths);
+
+    runGit('add', 'a.txt');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    // "git status" still lists the staged file
+    expect(takeGitCommandNames()).toEqual(['ls-files', 'status']);
+  });
+
+  it('reuses the hash of a file when only the index has the .gitattributes file that applies to it', async () => {
+    settleFiles();
+    writeFile('.gitignore', 'ignored/\n');
+    writeFile('.gitattributes', '*.txt -text\n');
+    commit();
+    writeFile('ignored/crlf.txt', 'a\r\n');
+    fs.unlinkSync(path.join(repoPath, '.gitattributes'));
+    const additionalPaths: string[] = ['ignored/crlf.txt'];
+    await getStateAsync(additionalPaths);
+
+    // "git status" uses the version in the index in place of the missing file, but "git hash-object" doesn't
+    writeFile('attributes.tmp', '*.txt text eol=lf\n');
+    const objectId: string = runGit('hash-object', '-w', 'attributes.tmp').trim();
+    fs.unlinkSync(path.join(repoPath, 'attributes.tmp'));
+    runGit('update-index', '--cacheinfo', `100644,${objectId},.gitattributes`);
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    await expectUncachedStateAsync(state, additionalPaths);
+    expect(state.files.get('ignored/crlf.txt')).toBe(hashText('a\r\n'));
+    expect(takeGitCommandNames()).toEqual(['ls-files', 'status']);
+  });
+
+  it('copies the index again when its copy is deleted or emptied', async () => {
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    await getStateAsync();
+
+    fs.unlinkSync(getPrivateIndexPath());
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+
+    runGit('rm', '--cached', '--quiet', '-r', '.');
+    fs.copyFileSync(path.join(repoPath, '.git', 'index'), getPrivateIndexPath());
+    runGit('reset', '--quiet');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('copies the index to a new folder when its folder is deleted', async () => {
+    await getStateAsync();
+    fs.rmSync(path.dirname(getPrivateIndexPath()), { recursive: true });
+
+    takeGitCommands();
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeUsesPrivateIndex()).toBe(true);
+    expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
+  });
+
+  it('creates the temporary folder', async () => {
+    fs.rmSync(temporaryFolderPath, { recursive: true });
+    await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(true);
+    expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
+  });
+
+  it('falls back to getDetailedRepoStateAsync when the copy of the index disappears while Git reads it', async () => {
+    await getStateAsync();
+    let isPrivateIndexDeleted: boolean = false;
+    beforeSpawn = ({ command, usesPrivateIndex }: IGitCommand) => {
+      if (command === 'status' && usesPrivateIndex && !isPrivateIndexDeleted) {
+        isPrivateIndexDeleted = true;
+        fs.rmSync(getPrivateIndexPath());
+      }
+    };
+
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(isPrivateIndexDeleted).toBe(true);
+    takeGitCommands();
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeUsesPrivateIndex()).toBe(true);
+  });
+
+  it('removes a lock file that an interrupted "git status" left behind', async () => {
+    await getStateAsync();
+    const privateIndexContent: Buffer = fs.readFileSync(getPrivateIndexPath());
+    const lockPath: string = `${getPrivateIndexPath()}.lock`;
+    fs.writeFileSync(lockPath, '');
+    touchSettledFile('a.txt');
+
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(fs.existsSync(lockPath)).toBe(false);
+    expect(fs.readFileSync(getPrivateIndexPath())).not.toEqual(privateIndexContent);
+  });
+
+  it('lets "git status" save the copy of the index when the environment disables optional locks', async () => {
+    const optionalLocks: string | undefined = process.env.GIT_OPTIONAL_LOCKS;
+    process.env.GIT_OPTIONAL_LOCKS = '0';
+    try {
+      await getStateAsync();
+      const privateIndexContent: Buffer = fs.readFileSync(getPrivateIndexPath());
+      touchSettledFile('a.txt');
+
+      await expectUncachedStateAsync(await getStateAsync());
+      expect(fs.readFileSync(getPrivateIndexPath())).not.toEqual(privateIndexContent);
+    } finally {
+      if (optionalLocks === undefined) {
+        delete process.env.GIT_OPTIONAL_LOCKS;
+      } else {
+        process.env.GIT_OPTIONAL_LOCKS = optionalLocks;
+      }
+    }
+  });
+
+  it('limits the state to the filter', async () => {
+    settleFiles();
+    writeFile('dir/d.txt', 'd\n');
+    writeFile('e.txt', 'e\n');
+    const state: IDetailedRepoState = await getStateAsync([], ['dir/']);
+    takeGitCommands();
+    await expectUncachedStateAsync(state, [], ['dir/']);
+    expect(Array.from(state.files.keys())).toEqual(['dir/c.txt', 'dir/d.txt']);
+
+    await expect(getStateAsync([], ['dir/'])).resolves.toBe(state);
+    expect(takeGitCommandNames()).toEqual(['status']);
+
+    // The files outside the filter
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'ls-files', 'status']);
+
+    await expectUncachedStateAsync(await getStateAsync([], ['dir/']), [], ['dir/']);
+    expect(takeGitCommandNames()).toEqual(['ls-files', 'status']);
+  });
+
+  it('computes the state of a repository without an index', async () => {
+    fs.unlinkSync(path.join(repoPath, '.git', 'index'));
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(state);
+
+    runGit('reset', '--quiet');
+    state = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(true);
+    await expectUncachedStateAsync(state);
+  });
+
+  it('stops using the cache for a split index', async () => {
+    await getStateAsync();
+    runGit('update-index', '--split-index');
+    writeFile('a.txt', 'modified\n');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+
+    runGit('update-index', '--no-split-index');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(state);
+  });
+
+  it('stops using the cache for a repository with submodules', async () => {
+    const submodulePath: string = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-state-cache-submodule-'));
+    try {
+      execFileSync('git', ['init', '--quiet'], { cwd: submodulePath, env: getGitEnvironment() });
+      fs.writeFileSync(path.join(submodulePath, 'inner.txt'), 'inner\n');
+      execFileSync('git', ['add', '--all'], { cwd: submodulePath, env: getGitEnvironment() });
+      execFileSync(
+        'git',
+        ['-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Inner'],
+        { cwd: submodulePath, env: getGitEnvironment() }
+      );
+      runGit('-c', 'protocol.file.allow=always', 'submodule', '--quiet', 'add', submodulePath, 'sub');
+      commit();
+
+      const state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.hasSubmodules).toBe(true);
+      expect(state.files.has('sub/inner.txt')).toBe(true);
+      expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+    } finally {
+      fs.rmSync(submodulePath, { recursive: true, force: true });
+    }
+  });
+
+  it('falls back to getDetailedRepoStateAsync when it fails, and stops after repeated failures', async () => {
+    // Read the index on every call
+    unsettleFiles();
+    const summarizeSpy: jest.SpyInstance = jest
+      .spyOn(GitIndexFile, 'summarizeGitIndex')
+      .mockImplementation(() => {
+        throw new Error('Test failure');
+      });
+    writeFile('a.txt', 'modified\n');
+    await expectUncachedStateAsync(await getStateAsync());
+    await expectUncachedStateAsync(await getStateAsync());
+
+    // A success resets the count
+    summarizeSpy.mockRestore();
+    await getStateAsync();
+    jest.spyOn(GitIndexFile, 'summarizeGitIndex').mockImplementation(() => {
+      throw new Error('Test failure');
+    });
+    await expectUncachedStateAsync(await getStateAsync());
+    await expectUncachedStateAsync(await getStateAsync());
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(GitIndexFile.summarizeGitIndex).toHaveBeenCalledTimes(3);
+
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(GitIndexFile.summarizeGitIndex).toHaveBeenCalledTimes(3);
+    expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+  });
+
+  it('reports the error of getDetailedRepoStateAsync, without counting it as a failure of the cache', async () => {
+    const expectedError: Error = await getDetailedRepoStateAsync(repoPath, ['missing.txt']).then(
+      () => new Error('Expected an error'),
+      (error: Error) => error
+    );
+    expect(expectedError.message).toMatch(/^git hash-object exited with code/);
+
+    for (let i: number = 0; i < 4; i++) {
+      await expect(getStateAsync(['missing.txt'])).rejects.toThrow(expectedError.message);
+    }
+
+    takeGitCommands();
+    await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(true);
+  });
+
+  it('computes the state without the cache after it is disposed', async () => {
+    const exitListenerCount: number = process.listenerCount('exit');
+    await getStateAsync();
+    expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
+    expect(process.listenerCount('exit')).toBe(exitListenerCount + 1);
+
+    cache.dispose();
+    expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+    expect(process.listenerCount('exit')).toBe(exitListenerCount);
+
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(takeUsesPrivateIndex()).toBe(false);
+    await expectUncachedStateAsync(state);
+  });
+
+  it('shares one exit listener between caches', async () => {
+    const exitListeners: NodeJS.ExitListener[] = process.listeners('exit');
+    const otherCache: RepoStateCache = new RepoStateCache({ rootDirectory: repoPath, temporaryFolderPath });
+    try {
+      await getStateAsync();
+      await otherCache.getDetailedRepoStateAsync();
+      expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(2);
+      const addedExitListeners: NodeJS.ExitListener[] = process
+        .listeners('exit')
+        .filter((listener: NodeJS.ExitListener) => !exitListeners.includes(listener));
+      expect(addedExitListeners).toHaveLength(1);
+
+      addedExitListeners[0](0);
+      expect(fs.readdirSync(temporaryFolderPath)).toEqual([]);
+
+      cache.dispose();
+      expect(process.listenerCount('exit')).toBe(exitListeners.length + 1);
+    } finally {
+      otherCache.dispose();
+    }
+
+    expect(process.listenerCount('exit')).toBe(exitListeners.length);
+  });
+
+  it('runs one call at a time', async () => {
+    writeFile('a.txt', 'modified\n');
+    const states: IDetailedRepoState[] = await Promise.all([
+      getStateAsync(),
+      getStateAsync(),
+      getStateAsync()
+    ]);
+    await expectUncachedStateAsync(states[0]);
+    expect(states[1]).toBe(states[0]);
+    expect(states[2]).toBe(states[0]);
+  });
+
+  if (process.platform !== 'win32') {
+    it('removes a symbolic link that was replaced by a file', async () => {
+      fs.symlinkSync('a.txt', path.join(repoPath, 'link'));
+      commit();
+      let state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.symlinks.has('link')).toBe(true);
+
+      fs.unlinkSync(path.join(repoPath, 'link'));
+      writeFile('link', 'not a link\n');
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.symlinks.has('link')).toBe(false);
+    });
+  }
+
+  function hashText(text: string): string {
+    return execFileSync('git', ['hash-object', '--stdin', '--no-filters'], {
+      cwd: repoPath,
+      env: getGitEnvironment(),
+      input: text,
+      encoding: 'utf8'
+    }).trim();
+  }
+});
diff --git a/libraries/package-deps-hash/src/test/getRepoState.test.ts b/libraries/package-deps-hash/src/test/getRepoState.test.ts
index 573657feb3..227898b5c0 100644
--- a/libraries/package-deps-hash/src/test/getRepoState.test.ts
+++ b/libraries/package-deps-hash/src/test/getRepoState.test.ts
@@ -1,7 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { isWindowsReservedPath, parseGitStatus, parseGitVersion } from '../getRepoState';
+import {
+  classifyLocallyModifiedFiles,
+  isWindowsReservedPath,
+  parseGitStatus,
+  parseGitVersion
+} from '../getRepoState';
 
 describe(parseGitVersion.name, () => {
   it('Can parse valid git version responses', () => {
@@ -116,3 +121,41 @@ describe(isWindowsReservedPath.name, () => {
     expect(isWindowsReservedPath('packages/nul-suffix/index.ts')).toBe(false);
   });
 });
+
+describe(classifyLocallyModifiedFiles.name, () => {
+  const platformDescriptor: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+
+  // "nul" is a reserved name on Windows
+  const locallyModified: ReadonlyMap<string, boolean> = new Map([
+    ['modified.txt', true],
+    ['deleted.txt', false],
+    ['link', true],
+    ['deleted-link', false],
+    ['apps/nul', true],
+    ['apps/con.txt', false]
+  ]);
+  const symlinks: ReadonlyMap<string, string> = new Map([
+    ['link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391'],
+    ['deleted-link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391']
+  ]);
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', platformDescriptor);
+  });
+
+  it('hashes the files that exist, and removes the deleted files and the symbolic links', () => {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: 'linux' });
+    expect(classifyLocallyModifiedFiles(locallyModified, symlinks)).toEqual({
+      filesToHash: ['modified.txt', 'apps/nul'],
+      filesToRemove: ['deleted.txt', 'link', 'deleted-link', 'apps/con.txt']
+    });
+  });
+
+  it('neither hashes nor removes a file with a reserved name on Windows', () => {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: 'win32' });
+    expect(classifyLocallyModifiedFiles(locallyModified, symlinks)).toEqual({
+      filesToHash: ['modified.txt'],
+      filesToRemove: ['deleted.txt', 'link', 'deleted-link', 'apps/con.txt']
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 27f5e135e5..f58300645d 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -1,8 +1,6 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import * as path from 'node:path';
-
 import { AlreadyReportedError } from '@rushstack/node-core-library';
 import type { LockFile } from '@rushstack/node-core-library';
 import {
@@ -31,7 +29,6 @@ import {
 import {
   WorkspaceEngineComponentFactory,
   WorkspaceEngineRecreationRequiredError,
-  type IMapWorkspaceInvalidationsOptions,
   type IWorkspaceEngineShape,
   type IWorkspaceInvalidationReconciliation
 } from './WorkspaceEngineComponentFactory';
@@ -40,6 +37,7 @@ import { EngineTerminalProvider } from './EngineTerminalProvider';
 import { OperationOutputFingerprints } from './OperationOutputFingerprints';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { createInputsCompatibilityCheck, getOperationsWithChangedInputs } from './WorkspaceInputsComparison';
 import { createDaemonRequestTelemetrySink, type IDaemonEngineCreationTiming } from './DaemonRequestTelemetry';
 
 /**
@@ -293,6 +291,9 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         const outputFingerprints: OperationOutputFingerprints = new OperationOutputFingerprints(
           engine.operationGraph
         );
+        const checkInputsCompatibility: (snapshot: IInputsSnapshot) => void = createInputsCompatibilityCheck(
+          engine.inputsSnapshot
+        );
         const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
           createEngineComponentsAsync: async () => ({
             ...engine,
@@ -306,8 +307,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
                 }
                 throw error;
               }
-              if (snapshot && !this.#validateGraphInputsAsync)
-                assertCompatibleInputs(engine.inputsSnapshot, snapshot);
+              if (snapshot && !this.#validateGraphInputsAsync) checkInputsCompatibility(snapshot);
               return snapshot;
             }
           }),
@@ -315,7 +315,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           refreshInputsOnEveryRequest: true,
           validateGraphInputsAsync: this.#validateGraphInputsAsync,
           mapInvalidationsToOperationsAsync: async (invalidationOptions) => [
-            ...getChangedOperations(invalidationOptions),
+            ...getOperationsWithChangedInputs(invalidationOptions),
             // Outputs are git-ignored and absent from state hashes, so check them separately.
             ...outputFingerprints.getOperationsWithChangedOutputs()
           ]
@@ -386,31 +386,3 @@ function getFingerprintValue(name: string, value: string | undefined): string |
     ? undefined
     : getWorkspaceFingerprintEnvironmentEntries({ [name]: value })[0]?.[1];
 }
-
-function getChangedOperations(options: IMapWorkspaceInvalidationsOptions): Iterable<Operation> {
-  const { currentInputsSnapshot: current, nextInputsSnapshot: next, operationGraph } = options;
-  return Array.from(operationGraph.operations).filter(
-    (operation) =>
-      current.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name) !==
-      next.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name)
-  );
-}
-
-function assertCompatibleInputs(current: IInputsSnapshot, next: IInputsSnapshot): void {
-  const paths: Set<string> = new Set([...current.hashes.keys(), ...next.hashes.keys()]);
-  for (const filePath of paths) {
-    if (isGraphDefinitionPath(filePath) && current.hashes.get(filePath) !== next.hashes.get(filePath)) {
-      throw new WorkspaceEngineRecreationRequiredError();
-    }
-  }
-}
-
-function isGraphDefinitionPath(filePath: string): boolean {
-  const normalized: string = filePath.replace(/\\/g, '/');
-  return (
-    /(^|\/)config\//.test(normalized) ||
-    ['rush.json', 'package.json', '.gitignore', '.npmrc', '.env', 'pnpm-lock.yaml'].includes(
-      path.basename(filePath)
-    )
-  );
-}
diff --git a/libraries/rush-daemon/src/WorkspaceInputsComparison.ts b/libraries/rush-daemon/src/WorkspaceInputsComparison.ts
new file mode 100644
index 0000000000..c2545d155c
--- /dev/null
+++ b/libraries/rush-daemon/src/WorkspaceInputsComparison.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import type { IInputsSnapshot, Operation } from '@microsoft/rush-lib';
+
+import {
+  WorkspaceEngineRecreationRequiredError,
+  type IMapWorkspaceInvalidationsOptions
+} from './WorkspaceEngineComponentFactory';
+
+/**
+ * Returns the operations whose own state hashes differ between the current and the next inputs snapshots.
+ */
+export function getOperationsWithChangedInputs(options: IMapWorkspaceInvalidationsOptions): Operation[] {
+  const { currentInputsSnapshot: current, nextInputsSnapshot: next, operationGraph } = options;
+  if (current === next) {
+    // A snapshot computes the same hashes each time
+    return [];
+  }
+
+  return Array.from(operationGraph.operations).filter(
+    (operation) =>
+      current.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name) !==
+      next.getOperationOwnStateHash(operation.associatedProject, operation.associatedPhase.name)
+  );
+}
+
+/**
+ * Returns a function that checks that an inputs snapshot is compatible with the snapshot that an engine was
+ * created from, as {@link assertCompatibleInputs} does. It checks a snapshot only if it differs from the last
+ * compatible one.
+ */
+export function createInputsCompatibilityCheck(
+  initialSnapshot: IInputsSnapshot
+): (snapshot: IInputsSnapshot) => void {
+  let compatibleSnapshot: IInputsSnapshot = initialSnapshot;
+  return (snapshot: IInputsSnapshot): void => {
+    if (snapshot !== compatibleSnapshot) {
+      assertCompatibleInputs(initialSnapshot, snapshot);
+      compatibleSnapshot = snapshot;
+    }
+  };
+}
+
+/**
+ * Throws {@link WorkspaceEngineRecreationRequiredError} if a file that may define the operation graph has
+ * different hashes in the two snapshots.
+ */
+export function assertCompatibleInputs(current: IInputsSnapshot, next: IInputsSnapshot): void {
+  if (current.hashes === next.hashes) {
+    return;
+  }
+
+  const paths: Set<string> = new Set([...current.hashes.keys(), ...next.hashes.keys()]);
+  for (const filePath of paths) {
+    if (isGraphDefinitionPath(filePath) && current.hashes.get(filePath) !== next.hashes.get(filePath)) {
+      throw new WorkspaceEngineRecreationRequiredError();
+    }
+  }
+}
+
+function isGraphDefinitionPath(filePath: string): boolean {
+  const normalized: string = filePath.replace(/\\/g, '/');
+  return (
+    /(^|\/)config\//.test(normalized) ||
+    ['rush.json', 'package.json', '.gitignore', '.npmrc', '.env', 'pnpm-lock.yaml'].includes(
+      path.basename(filePath)
+    )
+  );
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts b/libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts
new file mode 100644
index 0000000000..6718f3c8cf
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceInputsComparison.test.ts
@@ -0,0 +1,156 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IInputsSnapshot, IOperationGraph, Operation } from '@microsoft/rush-lib';
+
+import { WorkspaceEngineRecreationRequiredError } from '../WorkspaceEngineComponentFactory';
+import {
+  assertCompatibleInputs,
+  createInputsCompatibilityCheck,
+  getOperationsWithChangedInputs
+} from '../WorkspaceInputsComparison';
+
+const PHASE_NAME: string = '_phase:build';
+
+function createOperation(packageName: string): Operation {
+  return {
+    associatedPhase: { name: PHASE_NAME },
+    associatedProject: { packageName }
+  } as unknown as Operation;
+}
+
+function createInputsSnapshot(
+  hashes: ReadonlyMap<string, string>,
+  stateHashByPackageName: Readonly<Record<string, string>> = {}
+): IInputsSnapshot {
+  return {
+    getOperationOwnStateHash: jest.fn((project: unknown, phaseName?: string) => {
+      const { packageName } = project as { packageName: string };
+      return `${phaseName}:${stateHashByPackageName[packageName]}`;
+    }),
+    getTrackedFileHashesForOperation: () => hashes,
+    hasUncommittedChanges: false,
+    hashes,
+    rootDirectory: '/repo'
+  };
+}
+
+// Hashes that report whether they were read
+function createObservedHashes(entries: [string, string][]): Map<string, string> {
+  const hashes: Map<string, string> = new Map(entries);
+  jest.spyOn(hashes, 'keys');
+  jest.spyOn(hashes, 'get');
+  return hashes;
+}
+
+function wereRead(hashes: Map<string, string>): boolean {
+  return (hashes.keys as jest.Mock).mock.calls.length > 0 || (hashes.get as jest.Mock).mock.calls.length > 0;
+}
+
+const INITIAL_HASHES: [string, string][] = [
+  ['common/config/rush/experiments.json', 'experiments'],
+  ['a/package.json', 'a-package'],
+  ['a/src/index.ts', 'a-index'],
+  ['b/src/index.ts', 'b-index']
+];
+
+describe(getOperationsWithChangedInputs.name, () => {
+  const operationA: Operation = createOperation('a');
+  const operationB: Operation = createOperation('b');
+  const operationGraph: IOperationGraph = {
+    operations: new Set([operationA, operationB])
+  } as unknown as IOperationGraph;
+
+  it('returns the operations whose own state hashes differ', () => {
+    const hashes: Map<string, string> = new Map(INITIAL_HASHES);
+    expect(
+      getOperationsWithChangedInputs({
+        changedPaths: [],
+        currentInputsSnapshot: createInputsSnapshot(hashes, { a: '1', b: '2' }),
+        nextInputsSnapshot: createInputsSnapshot(hashes, { a: '1', b: '3' }),
+        operationGraph
+      })
+    ).toEqual([operationB]);
+  });
+
+  it('computes no hashes to compare a snapshot with itself', () => {
+    const snapshot: IInputsSnapshot = createInputsSnapshot(new Map(INITIAL_HASHES), { a: '1', b: '2' });
+    expect(
+      getOperationsWithChangedInputs({
+        changedPaths: ['a/src/index.ts'],
+        currentInputsSnapshot: snapshot,
+        nextInputsSnapshot: snapshot,
+        operationGraph
+      })
+    ).toEqual([]);
+    expect(snapshot.getOperationOwnStateHash).not.toHaveBeenCalled();
+  });
+});
+
+describe(assertCompatibleInputs.name, () => {
+  it('accepts snapshots that differ only in files that do not define the graph', () => {
+    const current: IInputsSnapshot = createInputsSnapshot(new Map(INITIAL_HASHES));
+    const next: IInputsSnapshot = createInputsSnapshot(
+      new Map([...INITIAL_HASHES, ['a/src/index.ts', 'a-index-2'], ['b/src/new.ts', 'b-new']])
+    );
+    expect(() => assertCompatibleInputs(current, next)).not.toThrow();
+  });
+
+  it.each([
+    ['a changed', ['a/package.json', 'a-package-2']],
+    ['an added', ['c/package.json', 'c-package']]
+  ])('requires a new engine for %s file that may define the graph', (name: string, entry: string[]) => {
+    const current: IInputsSnapshot = createInputsSnapshot(new Map(INITIAL_HASHES));
+    const next: IInputsSnapshot = createInputsSnapshot(
+      new Map([...INITIAL_HASHES, entry as [string, string]])
+    );
+    expect(() => assertCompatibleInputs(current, next)).toThrow(WorkspaceEngineRecreationRequiredError);
+    expect(() => assertCompatibleInputs(next, current)).toThrow(WorkspaceEngineRecreationRequiredError);
+  });
+
+  it('reads no hashes of snapshots that share them', () => {
+    const hashes: Map<string, string> = createObservedHashes(INITIAL_HASHES);
+    assertCompatibleInputs(createInputsSnapshot(hashes), createInputsSnapshot(hashes));
+    expect(wereRead(hashes)).toBe(false);
+  });
+});
+
+describe(createInputsCompatibilityCheck.name, () => {
+  it('compares each snapshot with the initial snapshot, unless it was the last compatible one', () => {
+    const initialHashes: Map<string, string> = createObservedHashes(INITIAL_HASHES);
+    const initialSnapshot: IInputsSnapshot = createInputsSnapshot(initialHashes);
+    const checkInputsCompatibility: (snapshot: IInputsSnapshot) => void =
+      createInputsCompatibilityCheck(initialSnapshot);
+
+    checkInputsCompatibility(initialSnapshot);
+    expect(wereRead(initialHashes)).toBe(false);
+
+    const compatibleHashes: Map<string, string> = createObservedHashes([
+      ...INITIAL_HASHES,
+      ['a/src/index.ts', 'a-index-2']
+    ]);
+    const compatibleSnapshot: IInputsSnapshot = createInputsSnapshot(compatibleHashes);
+    checkInputsCompatibility(compatibleSnapshot);
+    expect(wereRead(compatibleHashes)).toBe(true);
+
+    jest.clearAllMocks();
+    checkInputsCompatibility(compatibleSnapshot);
+    expect(wereRead(compatibleHashes)).toBe(false);
+
+    const incompatibleSnapshot: IInputsSnapshot = createInputsSnapshot(
+      new Map([...INITIAL_HASHES, ['a/package.json', 'a-package-2']])
+    );
+    expect(() => checkInputsCompatibility(incompatibleSnapshot)).toThrow(
+      WorkspaceEngineRecreationRequiredError
+    );
+    expect(() => checkInputsCompatibility(incompatibleSnapshot)).toThrow(
+      WorkspaceEngineRecreationRequiredError
+    );
+
+    // Only the last compatible snapshot is skipped
+    checkInputsCompatibility(initialSnapshot);
+    jest.clearAllMocks();
+    checkInputsCompatibility(compatibleSnapshot);
+    expect(wereRead(compatibleHashes)).toBe(true);
+  });
+});
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 3d084b3973..605c5ef016 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -814,8 +814,12 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
               terminal,
               // We need to include all dependencies, otherwise build cache id calculation will be incorrect
               relevantProjects,
-              // An engine cannot continue without a snapshot, so it reports why none could be taken.
-              { throwOnMissingProjectShrinkwrapFile: !!onEngine }
+              {
+                // An engine cannot continue without a snapshot, so it reports why none could be taken.
+                throwOnMissingProjectShrinkwrapFile: !!onEngine,
+                // An engine takes a snapshot for each request
+                reuseUnchangedInputs: !!onEngine
+              }
             );
           const innerInitialSnapshot: IInputsSnapshot | undefined = innerGetInputsSnapshotAsync
             ? await innerGetInputsSnapshotAsync()
diff --git a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
index ed5353620a..1c00206dc4 100644
--- a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
+++ b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
@@ -21,7 +21,9 @@ import {
   getRepoRoot,
   getDetailedRepoStateAsync,
   hashFilesAsync,
-  type IFileDiffStatus
+  type IDetailedRepoState,
+  type IFileDiffStatus,
+  RepoStateCache
 } from '@rushstack/package-deps-hash';
 import type { ITerminal } from '@rushstack/terminal';
 
@@ -334,13 +336,20 @@ export class ProjectChangeAnalyzer {
    * `throwOnMissingProjectShrinkwrapFile`, a missing project dependency file (shrinkwrap-deps.json) instead
    * throws its error, whether it is detected when the provider is created or when a snapshot fails. A host that
    * cannot continue without a snapshot can then report that actionable cause.
+   *
+   * With `reuseUnchangedInputs`, the provider keeps the state of the Git repository between snapshots, and
+   * returns its previous snapshot while the inputs are unchanged. This suits a long-lived host, such as the Rush
+   * daemon, that takes a snapshot for each request.
    * @internal
    */
   public async _tryGetSnapshotProviderAsync(
     projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration>,
     terminal: ITerminal,
     projectSelection?: ReadonlySet<RushConfigurationProject>,
-    options?: { readonly throwOnMissingProjectShrinkwrapFile?: boolean }
+    options?: {
+      readonly throwOnMissingProjectShrinkwrapFile?: boolean;
+      readonly reuseUnchangedInputs?: boolean;
+    }
   ): Promise<GetInputsSnapshotAsyncFn | undefined> {
     const throwOnMissingProjectShrinkwrapFile: boolean = !!options?.throwOnMissingProjectShrinkwrapFile;
     try {
@@ -444,12 +453,19 @@ export class ProjectChangeAnalyzer {
         filterPath = Array.from(projectSelection, ({ projectFolder }) => projectFolder);
       }
 
+      const repoStateCache: RepoStateCache | undefined = options?.reuseUnchangedInputs
+        ? getRepoStateCache(rootDirectory, gitPath, rushConfiguration.commonTempFolder)
+        : undefined;
+      let previousSnapshot: IReusableInputsSnapshot | undefined;
+
       return async function tryGetSnapshotAsync(): Promise<IInputsSnapshot | undefined> {
         // Recorded before Git reads the working tree: a file saved after this may be newer than its hash.
         const workingTreeReadStartTimeMs: number = Date.now();
         try {
-          const [{ files: hashes, symlinks, hasUncommittedChanges }, additionalFiles] = await Promise.all([
-            getDetailedRepoStateAsync(rootDirectory, additionalRelativePathsToHash, gitPath, filterPath),
+          const [repoState, additionalFiles] = await Promise.all([
+            repoStateCache
+              ? repoStateCache.getDetailedRepoStateAsync(additionalRelativePathsToHash, filterPath)
+              : getDetailedRepoStateAsync(rootDirectory, additionalRelativePathsToHash, gitPath, filterPath),
             getAdditionalFilesFromRushProjectConfigurationAsync(
               additionalGlobs,
               lookupByPath,
@@ -457,6 +473,7 @@ export class ProjectChangeAnalyzer {
               terminal
             )
           ]);
+          const { files: hashes, symlinks, hasUncommittedChanges } = repoState;
 
           if (symlinks.size > 0) {
             terminal.writeWarningLine(
@@ -472,11 +489,27 @@ export class ProjectChangeAnalyzer {
           }
 
           const additionalHashes: Map<string, string> = new Map(
-            await hashFilesAsync(rootDirectory, additionalFiles, gitPath)
+            additionalFiles.size > 0 ? await hashFilesAsync(rootDirectory, additionalFiles, gitPath) : []
           );
+          const environment: Record<string, string | undefined> = { ...process.env };
+          // The files that each operation depends on accumulate across snapshots
+          const operationAdditionalFileCount: number = countOperationAdditionalFiles(projectMap);
+
+          if (
+            previousSnapshot &&
+            previousSnapshot.repoState === repoState &&
+            previousSnapshot.operationAdditionalFileCount === operationAdditionalFileCount &&
+            areMapsEqual(previousSnapshot.additionalHashes, additionalHashes) &&
+            areEnvironmentsEqual(previousSnapshot.environment, environment)
+          ) {
+            // Every hash that a new snapshot would compute is the same. The previous snapshot began reading the
+            // working tree earlier, which only widens the window in which a saved file may be newer than its hash.
+            return previousSnapshot.snapshot;
+          }
 
-          return new InputsSnapshot({
+          const snapshot: IInputsSnapshot = new InputsSnapshot({
             additionalHashes,
+            environment,
             globalAdditionalFiles,
             hashes,
             hasUncommittedChanges,
@@ -485,6 +518,17 @@ export class ProjectChangeAnalyzer {
             rootDir: rootDirectory,
             workingTreeReadStartTimeMs
           });
+          if (repoStateCache) {
+            previousSnapshot = {
+              additionalHashes,
+              environment,
+              operationAdditionalFileCount,
+              repoState,
+              snapshot
+            };
+          }
+
+          return snapshot;
         } catch (e) {
           // The files were checked once, when this provider was created. A file removed since then fails
           // "git hash-object" with an obscure message, so check them again, only after a failure.
@@ -761,6 +805,73 @@ interface IAdditionalGlob {
   pattern: string;
 }
 
+/**
+ * A snapshot, and the inputs that it was computed from.
+ */
+interface IReusableInputsSnapshot {
+  readonly additionalHashes: ReadonlyMap<string, string>;
+  readonly environment: Readonly<Record<string, string | undefined>>;
+  readonly operationAdditionalFileCount: number;
+  readonly repoState: IDetailedRepoState;
+  readonly snapshot: IInputsSnapshot;
+}
+
+/**
+ * The caches of the state of each Git repository, by the path of Git and the root of the repository. They outlive
+ * the snapshot providers, so that a long-lived host, such as the Rush daemon, keeps using a cache when it creates
+ * a provider again.
+ */
+const repoStateCacheByRepository: Map<string, RepoStateCache> = new Map();
+
+function getRepoStateCache(
+  rootDirectory: string,
+  gitPath: string,
+  temporaryFolderPath: string
+): RepoStateCache {
+  const key: string = `${gitPath}\0${rootDirectory}`;
+  let repoStateCache: RepoStateCache | undefined = repoStateCacheByRepository.get(key);
+  if (!repoStateCache) {
+    repoStateCache = new RepoStateCache({ rootDirectory, gitPath, temporaryFolderPath });
+    repoStateCacheByRepository.set(key, repoStateCache);
+  }
+
+  return repoStateCache;
+}
+
+function countOperationAdditionalFiles(
+  projectMap: ReadonlyMap<RushConfigurationProject, IInputsSnapshotProjectMetadata>
+): number {
+  let count: number = 0;
+  for (const { additionalFilesByOperationName } of projectMap.values()) {
+    for (const additionalFiles of additionalFilesByOperationName?.values() ?? []) {
+      count += additionalFiles.size;
+    }
+  }
+
+  return count;
+}
+
+function areMapsEqual<TValue>(a: ReadonlyMap<string, TValue>, b: ReadonlyMap<string, TValue>): boolean {
+  if (a.size !== b.size) {
+    return false;
+  }
+
+  for (const [key, value] of a) {
+    if (b.get(key) !== value || !b.has(key)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function areEnvironmentsEqual(
+  a: Readonly<Record<string, string | undefined>>,
+  b: Readonly<Record<string, string | undefined>>
+): boolean {
+  return areMapsEqual(new Map(Object.entries(a)), new Map(Object.entries(b)));
+}
+
 async function getAdditionalFilesFromRushProjectConfigurationAsync(
   additionalGlobs: IAdditionalGlob[],
   rootRelativeLookupByPath: IReadonlyLookupByPath<RushConfigurationProject>,
diff --git a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
index 5d85cffa1d..a6e9e6c5a9 100644
--- a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
+++ b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
@@ -26,6 +26,15 @@ const mockHashes: Map<string, string> = new Map([
 const mockGetRepoChanges: jest.MockedFunction<typeof import('@rushstack/package-deps-hash').getRepoChanges> =
   jest.fn();
 const mockOnGetDetailedRepoState: jest.Mock<void, []> = jest.fn();
+const mockHashFilesAsync: jest.Mock<ReadonlyMap<string, string>, [string, Iterable<string>]> = jest.fn(
+  (rootDirectory: string, filePaths: Iterable<string>) =>
+    new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]))
+);
+const mockCreateRepoStateCache: jest.Mock<void, [IRepoStateCacheOptions]> = jest.fn();
+const mockGetCachedRepoStateAsync: jest.Mock<
+  Promise<IDetailedRepoState>,
+  [ReadonlyArray<string> | undefined, ReadonlyArray<string> | undefined]
+> = jest.fn();
 
 jest.mock(`@rushstack/package-deps-hash`, () => {
   return {
@@ -48,7 +57,19 @@ jest.mock(`@rushstack/package-deps-hash`, () => {
       return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
     },
     hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): ReadonlyMap<string, string> {
-      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+      return mockHashFilesAsync(rootDirectory, filePaths);
+    },
+    RepoStateCache: class MockRepoStateCache {
+      public constructor(options: IRepoStateCacheOptions) {
+        mockCreateRepoStateCache(options);
+      }
+
+      public async getDetailedRepoStateAsync(
+        additionalRelativePathsToHash?: ReadonlyArray<string>,
+        filterPath?: ReadonlyArray<string>
+      ): Promise<IDetailedRepoState> {
+        return await mockGetCachedRepoStateAsync(additionalRelativePathsToHash, filterPath);
+      }
     },
     getRepoChanges(
       currentWorkingDirectory: string,
@@ -117,7 +138,11 @@ jest.mock('../incremental/InputsSnapshot', () => {
 import * as fs from 'node:fs';
 import { resolve } from 'node:path';
 
-import type { IDetailedRepoState, IFileDiffStatus } from '@rushstack/package-deps-hash';
+import type {
+  IDetailedRepoState,
+  IFileDiffStatus,
+  IRepoStateCacheOptions
+} from '@rushstack/package-deps-hash';
 import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import {
@@ -127,6 +152,8 @@ import {
   tryGetMissingProjectShrinkwrapFileErrorAsync
 } from '../ProjectChangeAnalyzer';
 import { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import type { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
 import type {
   IInputsSnapshot,
   GetInputsSnapshotAsyncFn,
@@ -268,6 +295,178 @@ describe(ProjectChangeAnalyzer.name, () => {
         expect(terminalProvider.getWarningOutput()).toContain('git hash-object failed');
       });
 
+      describe('when reusing unchanged inputs', () => {
+        const reuseOptions: { reuseUnchangedInputs: boolean } = { reuseUnchangedInputs: true };
+        let stateCount: number;
+
+        function createRepoState(): IDetailedRepoState {
+          stateCount++;
+          return {
+            hasSubmodules: false,
+            hasUncommittedChanges: false,
+            files: new Map([['a/package.json', `hash${stateCount}`]]),
+            symlinks: new Map()
+          };
+        }
+
+        function getProjectConfigurations(
+          dependsOnAdditionalFiles: string[]
+        ): Map<RushConfigurationProject, RushProjectConfiguration> {
+          const projectConfiguration: RushProjectConfiguration = {
+            operationSettingsByOperationName: new Map([
+              ['_phase:build', { operationName: '_phase:build', dependsOnAdditionalFiles }]
+            ])
+          } as unknown as RushProjectConfiguration;
+          return new Map([[rushConfiguration.getProjectByName('a')!, projectConfiguration]]);
+        }
+
+        beforeEach(() => {
+          stateCount = 0;
+          mockSnapshot.mockImplementation(() => ({}));
+          mockGetCachedRepoStateAsync.mockResolvedValue(createRepoState());
+        });
+
+        afterEach(() => {
+          mockGetCachedRepoStateAsync.mockReset();
+          delete process.env.PROJECT_CHANGE_ANALYZER_TEST;
+        });
+
+        it('returns the previous snapshot while its inputs are unchanged', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          expect(snapshot).toBeDefined();
+          await expect(provider!()).resolves.toBe(snapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(1);
+          expect(mockOnGetDetailedRepoState).not.toHaveBeenCalled();
+          expect(mockGetCachedRepoStateAsync).toHaveBeenCalledTimes(2);
+          const [additionalRelativePathsToHash, filterPath] = mockGetCachedRepoStateAsync.mock.calls[1];
+          expect(Array.from(additionalRelativePathsToHash!).sort()).toEqual([
+            'a/.rush/temp/shrinkwrap-deps.json',
+            'b/.rush/temp/shrinkwrap-deps.json'
+          ]);
+          expect(filterPath).toEqual([]);
+          // There are no additional files to hash
+          expect(mockHashFilesAsync).not.toHaveBeenCalled();
+
+          // The state of the repository changed
+          mockGetCachedRepoStateAsync.mockResolvedValue(createRepoState());
+          const nextSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(nextSnapshot).not.toBe(snapshot);
+          await expect(provider!()).resolves.toBe(nextSnapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(2);
+          expect(mockSnapshot.mock.calls[1][0].hashes).toBe(
+            (await mockGetCachedRepoStateAsync.mock.results[2].value).files
+          );
+        });
+
+        it('takes a new snapshot when the environment changes', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          expect(mockSnapshot.mock.calls[0][0].environment).toEqual(process.env);
+
+          process.env.PROJECT_CHANGE_ANALYZER_TEST = '1';
+          const nextSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(nextSnapshot).not.toBe(snapshot);
+          expect(mockSnapshot.mock.calls[1][0].environment).toEqual(process.env);
+          await expect(provider!()).resolves.toBe(nextSnapshot);
+
+          process.env.PROJECT_CHANGE_ANALYZER_TEST = '2';
+          await expect(provider!()).resolves.not.toBe(nextSnapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(3);
+        });
+
+        it('takes a new snapshot when the additional files or their hashes change', async () => {
+          fs.writeFileSync(resolve(folder, 'a/extra.txt'), 'extra');
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            getProjectConfigurations(['*.txt']),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          expect(mockSnapshot.mock.calls[0][0].additionalHashes).toEqual(
+            new Map([['a/extra.txt', 'a/extra.txt']])
+          );
+          await expect(provider!()).resolves.toBe(snapshot);
+
+          mockHashFilesAsync.mockImplementationOnce(() => new Map([['a/extra.txt', 'changed']]));
+          const changedHashSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(changedHashSnapshot).not.toBe(snapshot);
+
+          fs.writeFileSync(resolve(folder, 'a/other.txt'), 'other');
+          const addedFileSnapshot: IInputsSnapshot | undefined = await provider!();
+          expect(addedFileSnapshot).not.toBe(changedHashSnapshot);
+          await expect(provider!()).resolves.toBe(addedFileSnapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(3);
+        });
+
+        it('takes a new snapshot when an operation depends on another tracked file', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            getProjectConfigurations(['*.md']),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+
+          // A tracked file is hashed with the rest of the repository, not as an additional file
+          fs.writeFileSync(resolve(folder, 'a/README.md'), 'readme');
+          mockGetCachedRepoStateAsync.mockImplementation(async () => {
+            const state: IDetailedRepoState = await mockGetCachedRepoStateAsync.mock.results[0].value;
+            state.files.set('a/README.md', 'readme');
+            return state;
+          });
+          await expect(provider!()).resolves.not.toBe(snapshot);
+          expect(mockHashFilesAsync).not.toHaveBeenCalled();
+          expect(mockSnapshot).toHaveBeenCalledTimes(2);
+        });
+
+        it('shares the cache of the repository between providers', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          await analyzer._tryGetSnapshotProviderAsync(new Map(), terminal, undefined, reuseOptions);
+          await new ProjectChangeAnalyzer(rushConfiguration)._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal,
+            undefined,
+            reuseOptions
+          );
+          expect(mockCreateRepoStateCache).toHaveBeenCalledTimes(1);
+          expect(mockCreateRepoStateCache).toHaveBeenCalledWith({
+            rootDirectory: folder,
+            gitPath: expect.any(String),
+            temporaryFolderPath: rushConfiguration.commonTempFolder
+          });
+        });
+
+        it('takes a new snapshot each time without the option', async () => {
+          const analyzer: ProjectChangeAnalyzer = new ProjectChangeAnalyzer(rushConfiguration);
+          const provider: GetInputsSnapshotAsyncFn | undefined = await analyzer._tryGetSnapshotProviderAsync(
+            new Map(),
+            terminal
+          );
+          const snapshot: IInputsSnapshot | undefined = await provider!();
+          await expect(provider!()).resolves.not.toBe(snapshot);
+          expect(mockSnapshot).toHaveBeenCalledTimes(2);
+          expect(mockOnGetDetailedRepoState).toHaveBeenCalledTimes(2);
+          expect(mockGetCachedRepoStateAsync).not.toHaveBeenCalled();
+          expect(mockCreateRepoStateCache).not.toHaveBeenCalled();
+        });
+      });
+
       it('finds the first missing file in project order', async () => {
         await expect(
           tryGetMissingProjectShrinkwrapFileErrorAsync(rushConfiguration)

From 071dc6587233b93ac5a6069702d1c5c56e66ff2e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:15 +0000
Subject: [PATCH 062/265] [rush-daemon] An invalid build command line fails
 with native Rush's error and exit code instead of running in-process

Swarm integration step 47; original commit f84ce3a3cb (merge of swarm/r04-t78-int at cf5921e40f).
Scope: task 78.

Brings r04's task 78: when a warm daemon's parser rejects a build command line, the client prints the daemon's parse error once and exits 2, where it used to fall back in-process and print about 29 lines. Second agent: o04 board 2801. ch01's e2e on ch01-sC: a warm `build --nope` with agent output returns rc 2, 2 lines, in 0.16 s, answered by the daemon.

s16 batch C, item 2 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree d80d2a2ccb)

Commits folded into this step (1):
- cf5921e40f Fail an invalid build command line with native Rush's error and exit code instead of running it in-process (task 78)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-r04-t78-usage-error_2026-09-29-00-14.json | 11 ++++
 ...-r04-t78-usage-error_2026-09-29-00-14.json | 11 ++++
 common/reviews/api/rush-lib.api.md            |  7 ++-
 .../rush-daemon/src/DaemonControlSession.ts   | 12 ++++
 .../src/DaemonRequestUsageError.ts            | 17 ++++++
 .../src/ProductionDaemonRequestResolver.ts    |  6 ++
 .../src/WorkspaceRequestLifecycle.ts          | 45 ++++++++++----
 .../src/test/DaemonRequestUsageError.test.ts  | 61 +++++++++++++++++++
 .../rush-lib/src/api/PhasedCommandEngine.ts   | 17 +++++-
 .../src/api/PhasedCommandEngineUsageError.ts  | 19 ++++++
 .../src/api/test/PhasedCommandEngine.test.ts  | 20 ++++++
 libraries/rush-lib/src/index.ts               |  1 +
 12 files changed, 214 insertions(+), 13 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r04-t78-usage-error_2026-09-29-00-14.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t78-usage-error_2026-09-29-00-14.json
 create mode 100644 libraries/rush-daemon/src/DaemonRequestUsageError.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
 create mode 100644 libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts

diff --git a/common/changes/@microsoft/rush/swarm-r04-t78-usage-error_2026-09-29-00-14.json b/common/changes/@microsoft/rush/swarm-r04-t78-usage-error_2026-09-29-00-14.json
new file mode 100644
index 0000000000..a10aa44110
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r04-t78-usage-error_2026-09-29-00-14.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `PhasedCommandEngineUsageError` (alpha). `PhasedCommandEngine.parseAsync` throws it with native Rush's message and exit code for a command line that native Rush rejects as invalid, such as an unknown parameter, so that a host can report the error instead of running the command in-process.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t78-usage-error_2026-09-29-00-14.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-usage-error_2026-09-29-00-14.json
new file mode 100644
index 0000000000..af618148ec
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-usage-error_2026-09-29-00-14.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A build or rebuild request whose command line native Rush rejects as invalid (for example `rush-client build --nope`) now fails with native Rush's error message and exit code 2, instead of a rejection that made the client run the same command line in-process only to print the usage and the same error. If the workspace configuration changed since the daemon loaded it, the client still runs the command in-process, which parses it with the new configuration.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index f96c5f2059..10cbe380ac 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1561,7 +1561,6 @@ export class PhasedCommandEngine {
     createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData;
     // (undocumented)
     readonly parameterIdentity: string;
-    // (undocumented)
     static parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine>;
     get requestSettings(): IPhasedCommandEngineRequestSettings;
     selectOperationsAsync(graph: IOperationGraph): Promise<ReadonlyMap<Operation, OperationEnabledState>>;
@@ -1584,6 +1583,12 @@ export class PhasedCommandEngineProjectConfigurationError extends Error {
     readonly projectName: string;
 }
 
+// @alpha
+export class PhasedCommandEngineUsageError extends Error {
+    constructor(message: string, exitCode: number, options?: ErrorOptions);
+    readonly exitCode: number;
+}
+
 // @alpha
 export class PhasedCommandHooks {
     readonly createOperationsAsync: AsyncSeriesWaterfallHook<[
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index a6995237c1..296a3b3410 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -33,6 +33,7 @@ import { DaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
 import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
+import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import type { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
 import { DaemonShutdownError } from './DaemonShutdownError';
 import { DaemonWireRequestClient } from './DaemonWireRequestClient';
@@ -389,6 +390,17 @@ export class DaemonControlSession {
       dispatchError = combineErrors(dispatchError, cleanupError);
     }
     if (dispatchError !== undefined && !state.client.terminalOutcomeSent && !this.#connectionClosed) {
+      if (dispatchError instanceof DaemonRequestUsageError) {
+        // Native Rush reports an invalid command line and exits, so the client must not run it in-process.
+        await state.client.writeResultAsync({
+          requestId: envelope.requestId,
+          exitCode: dispatchError.exitCode,
+          outcome: 'failure',
+          aborted: state.abortController.signal.aborted,
+          errorMessage: dispatchError.message
+        });
+        return;
+      }
       const rejection: IClassifiedRejection = classifyRejection(dispatchError);
       // The client prints only the message; keep the rest where `rush-client daemon logs` finds it.
       this.#options.onLog?.(
diff --git a/libraries/rush-daemon/src/DaemonRequestUsageError.ts b/libraries/rush-daemon/src/DaemonRequestUsageError.ts
new file mode 100644
index 0000000000..8b5eecbcaf
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonRequestUsageError.ts
@@ -0,0 +1,17 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * A command line that native Rush rejects as invalid. The request fails with native Rush's exit code, and the
+ * client does not run the command in-process, which would only report the same error again.
+ */
+export class DaemonRequestUsageError extends Error {
+  /** The exit code of native Rush for this command line. */
+  public readonly exitCode: number;
+
+  public constructor(message: string, exitCode: number, options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'DaemonRequestUsageError';
+    this.exitCode = exitCode;
+  }
+}
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index f58300645d..30affd7246 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -10,6 +10,7 @@ import {
   PhasedCommandEngineBusyError,
   PhasedCommandEngineConfigurationChangedError,
   PhasedCommandEngineProjectConfigurationError,
+  PhasedCommandEngineUsageError,
   type IPhasedCommandEngine,
   type IPhasedCommandEngineLogTelemetryOptions,
   type IInputsSnapshot,
@@ -26,6 +27,7 @@ import {
   type IResolveDaemonRequestOptions,
   type ResolvedDaemonRequest
 } from './DaemonRequestDispatcher';
+import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import {
   WorkspaceEngineComponentFactory,
   WorkspaceEngineRecreationRequiredError,
@@ -224,6 +226,10 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         terminalProvider: terminal
       });
     } catch (error) {
+      // Answer only for a command line of the requested command; in-process Rush reports any other one.
+      if (error instanceof PhasedCommandEngineUsageError && envelope.argv[0] === envelope.commandName) {
+        throw new DaemonRequestUsageError(terminal.describeError(error), error.exitCode, { cause: error });
+      }
       throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
     }
     if (command.commandName !== envelope.commandName) {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index dc25a53b33..156664e949 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -31,8 +31,10 @@ import {
   type DispatchWorkspaceRequestAsync,
   type IDaemonRequestDispatchClient,
   type IDaemonRequestLifecycle,
-  type IDaemonRequestResolver
+  type IDaemonRequestResolver,
+  type IResolveDaemonRequestOptions
 } from './DaemonRequestDispatcher';
+import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import { createNativeMutationResolver } from './NativeMutationRequest';
 import { parseDaemonGraphRequest, type IDaemonGraphRequest } from './DaemonGraphRequest';
 import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
@@ -546,11 +548,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       let commandIdentity: string | undefined;
       let projectFingerprint: string | undefined;
       if (tier !== WorkspaceInputChangeTier.Restart && !isMutation(envelope)) {
-        commandIdentity = await getResolverLifecycle(this.#resolver).getCommandParameterIdentityAsync({
-          envelope,
-          workspaceSession: session,
-          abortSignal: client.abortSignal
-        });
+        commandIdentity = await getCommandParameterIdentityAsync(
+          this.#resolver,
+          { envelope, workspaceSession: session, abortSignal: client.abortSignal },
+          tier
+        );
         if (tier === WorkspaceInputChangeTier.Reuse) {
           projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session, receivedTimeMs);
           if (
@@ -637,11 +639,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         };
       }
 
-      commandIdentity = await getResolverLifecycle(this.#resolver).getCommandParameterIdentityAsync({
-        envelope,
-        workspaceSession: session,
-        abortSignal: client.abortSignal
-      });
+      commandIdentity = await getCommandParameterIdentityAsync(
+        this.#resolver,
+        { envelope, workspaceSession: session, abortSignal: client.abortSignal },
+        tier
+      );
       if (
         this.#boundSession === session &&
         this.#commandIdentity === commandIdentity &&
@@ -1125,6 +1127,27 @@ function getResolverLifecycle(resolver: IDaemonRequestResolver): IWorkspaceResol
   return resolver.workspaceLifecycle;
 }
 
+/**
+ * Parses the command with the session's configuration. A command line that this configuration rejects fails as
+ * native Rush would, unless the configuration changed since the session loaded it (`tier` is not
+ * `WorkspaceInputChangeTier.Reuse`): native Rush might accept the command line then, so the client runs it
+ * in-process instead.
+ */
+async function getCommandParameterIdentityAsync(
+  resolver: IDaemonRequestResolver,
+  options: IResolveDaemonRequestOptions,
+  tier: WorkspaceInputChangeTier
+): Promise<string> {
+  try {
+    return await getResolverLifecycle(resolver).getCommandParameterIdentityAsync(options);
+  } catch (error) {
+    if (error instanceof DaemonRequestUsageError && tier !== WorkspaceInputChangeTier.Reuse) {
+      throw new DaemonRequestDispatchError('unsupported', error.message, { cause: error });
+    }
+    throw error;
+  }
+}
+
 /** A request rejected as invalid after the resolver bound a graph to the session: its selection failed. */
 function isSelectionRejection(
   error: unknown,
diff --git a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
new file mode 100644
index 0000000000..1c2966e172
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+
+// These cases start real hosts and run Git/build subprocesses rather than mocked unit work.
+jest.setTimeout(30_000);
+
+const message: string = 'rush build: error: Unrecognized arguments: --nope.';
+const invalid: string[] = ['build', '--to', 'b', '--nope'];
+const usageFailure: object = {
+  kind: 'requestResult',
+  payload: { exitCode: 2, outcome: 'failure', aborted: false, errorMessage: message }
+};
+const inProcess: object = { kind: 'requestRejected', payload: { code: 'unsupported', message } };
+const success: object = { kind: 'requestResult', payload: { exitCode: 0 } };
+
+it('fails an invalid command line with the exit code of native Rush instead of handing it to in-process Rush', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    const generation: number = fixture.host.workspaceGeneration;
+    const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+    expect(fixture.session.operationGraph).toBe(graph);
+    // The daemon answers only for a command line that starts with the requested command.
+    const globalFlag: string[] = ['--debug', ...invalid];
+    expect((await fixture.runAsync(globalFlag, { commandName: 'build' })).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect(fixture.session.operationGraph).toBe(graph);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
+it('hands an invalid command line to in-process Rush after a configuration change, which parses it again', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    // The warm session's configuration may be stale, for example without a parameter that experiments.json adds.
+    fixture.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        scripts: { '_phase:compile': 'node build.cjs --changed' }
+      })
+    );
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    expect(fixture.runs()).toEqual(['a', 'b', 'a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 8172ff36c0..66b56080ed 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -7,6 +7,8 @@ import type { PerformanceEntry } from 'node:perf_hooks';
 import { FileSystem, LockFile } from '@rushstack/node-core-library';
 import { Terminal, type ITerminalProvider } from '@rushstack/terminal';
 import type { CommandLineAction } from '@rushstack/ts-command-line';
+// The package does not export the error that its parsers throw for an invalid command line.
+import { CommandLineParserExitError } from '@rushstack/ts-command-line/lib/providers/CommandLineParserExitError';
 
 import { RushCommandLineParser } from '../cli/RushCommandLineParser';
 import { PhasedScriptAction } from '../cli/scriptActions/PhasedScriptAction';
@@ -22,6 +24,7 @@ import type { RushSession } from '../pluginFramework/RushSession';
 import type { RushConfiguration } from './RushConfiguration';
 import { RushUserConfiguration } from './RushUserConfiguration';
 import { PhasedCommandEngineBusyError } from './PhasedCommandEngineBusyError';
+import { PhasedCommandEngineUsageError } from './PhasedCommandEngineUsageError';
 import { resolvePhasedCommandCwdAsync } from '../utilities/resolvePhasedCommandCwd';
 
 /** How long disposing an engine waits for `flushTelemetry` taps that are still running. */
@@ -167,6 +170,10 @@ export class PhasedCommandEngine {
     this.unmatchedCompatiblePluginNames = unmatchedCompatiblePluginNames;
   }
 
+  /**
+   * Parses a native build or rebuild command line. Throws a {@link PhasedCommandEngineUsageError} for a command
+   * line that native Rush rejects as invalid.
+   */
   public static async parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine> {
     const { rushConfiguration, terminalProvider, cwd, argv, environment = process.env } = options;
     const resolvedCwd: string = await resolvePhasedCommandCwdAsync(cwd, rushConfiguration.rushJsonFolder);
@@ -182,7 +189,15 @@ export class PhasedCommandEngine {
       cwd: resolvedCwd,
       engine: { rushConfiguration, terminalProvider, environment }
     });
-    await parser.executeWithoutErrorHandlingAsync([...argv]);
+    try {
+      await parser.executeWithoutErrorHandlingAsync([...argv]);
+    } catch (error) {
+      // Native Rush prints this message and exits with this exit code.
+      if (error instanceof CommandLineParserExitError && error.exitCode !== 0) {
+        throw new PhasedCommandEngineUsageError(error.message.trim(), error.exitCode, { cause: error });
+      }
+      throw error;
+    }
     const action: CommandLineAction | undefined = parser.selectedAction;
     if (!(action instanceof PhasedScriptAction) || !['build', 'rebuild'].includes(action.actionName)) {
       throw new Error('The production daemon engine currently supports native build and rebuild only.');
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
new file mode 100644
index 0000000000..51a8afa15e
--- /dev/null
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
@@ -0,0 +1,19 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The command line is not valid for the command, for example because it names an unknown parameter.
+ * Native Rush prints the message and exits with {@link PhasedCommandEngineUsageError.exitCode}.
+ * No engine preparation has begun.
+ * @alpha
+ */
+export class PhasedCommandEngineUsageError extends Error {
+  /** The exit code of native Rush for this command line. */
+  public readonly exitCode: number;
+
+  public constructor(message: string, exitCode: number, options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'PhasedCommandEngineUsageError';
+    this.exitCode = exitCode;
+  }
+}
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index 8b3f371b9b..acef36cc56 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -8,6 +8,7 @@ import * as path from 'node:path';
 import { NoOpTerminalProvider, StringBufferTerminalProvider } from '@rushstack/terminal';
 
 import { PhasedCommandEngine } from '../PhasedCommandEngine';
+import { PhasedCommandEngineUsageError } from '../PhasedCommandEngineUsageError';
 import { RushConfiguration } from '../RushConfiguration';
 
 const PACKAGE_NAME: string = '@example/rush-example-plugin';
@@ -186,6 +187,25 @@ describe(PhasedCommandEngine.name, () => {
     expect(command.commandName).toBe('build');
   });
 
+  it('reports an invalid command line as a usage error with the exit code of native Rush', async () => {
+    const folder: string = createTestRepo({ associatedCommands: [] });
+    // The parser also prints the usage, as native Rush does.
+    const stderrWrite: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    try {
+      for (const [argv, message] of [
+        [['build', '--nope'], 'rush build: error: Unrecognized arguments: --nope.'],
+        [['rebuild', '--to'], 'rush rebuild: error: argument "-t/--to": Expected one argument. null']
+      ] as const) {
+        const error: unknown = await parseBuildAsync(folder, [...argv]).catch((e: unknown) => e);
+        expect(error).toBeInstanceOf(PhasedCommandEngineUsageError);
+        const { message: actualMessage, exitCode } = error as PhasedCommandEngineUsageError;
+        expect({ message: actualMessage, exitCode }).toEqual({ message, exitCode: 2 });
+      }
+    } finally {
+      stderrWrite.mockRestore();
+    }
+  });
+
   it('rejects an unassociated plugin, which Rush initializes for every command', async () => {
     const folder: string = createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON });
     await expect(parseBuildAsync(folder)).rejects.toThrow(
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index 7abdab3c2b..431949409e 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -187,6 +187,7 @@ export {
 export { PhasedCommandEngineConfigurationChangedError } from './api/PhasedCommandEngineConfigurationChangedError';
 export { PhasedCommandEngineProjectConfigurationError } from './api/PhasedCommandEngineProjectConfigurationError';
 export { PhasedCommandEngineBusyError } from './api/PhasedCommandEngineBusyError';
+export { PhasedCommandEngineUsageError } from './api/PhasedCommandEngineUsageError';
 export {
   captureWorkspaceInputFingerprintAsync,
   captureProjectConfigurationFingerprintAsync,

From 4388b98bae19cd5595475158fa380a991f3b316a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:15 +0000
Subject: [PATCH 063/265] [rush-daemon] Coalesced requests run with each
 requester's environment, and each gets its own telemetry key

Swarm integration step 48; original commit b572eb50a0 (merge of swarm/r06-t90-int2 at 4b9a258212).
Scope: tasks 81, 89 and 90.

Brings r06's tasks 81 (coalesced requests no longer run once with the first requester's environment when an operation hashes an ignored variable they differ on), 89 (operations see process.env writes made by the same iteration's beforeExecuteIterationAsync, through a lazy per-participant environment) and 90 (a per-request telemetry key for operations in a coalesced batch), re-tipped on 1b51e7af08 (board 2747). Second agents: o04 board 783 and board 906, o05 board 1020, m03 board 1091 on adcb6f6e0f. It lands after r02's e7b848d6a7 (board 1166), which integration has. ch01's e2e on ch01-sC: two queued requests that differ in WT_SESSION run [ax, ay, c], as --no-daemon does.

s16 batch C, item 3 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree 8a64bfc100)

Commits folded into this step (6):
- 5565ff57ce [rush-daemon] Don't coalesce requests that disagree on a hashed per-session variable
- 56ef144e1b [rush-lib] Pass getOperationEnvironment to the before/after iteration hooks
- e4d4e90711 [rush-daemon] Let requests share a run when a hashed variable is unset in one and empty in the other
- aec3ac8433 [rush-daemon] Start each operation from process.env as it is when the operation starts
- 36d9a3a16f [rush-lib] Add getOperationRequestId to the operation graph's iteration options
- 3099d5945f [rush-daemon] Give each operation the request id of the request whose environment it gets

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rushd-operation-request-id_2026-09-28.json |  11 +
 ...ushd-coalesced-request-env_2026-09-28.json |  11 +
 .../rushd-lazy-op-env_2026-09-28.json         |  11 +
 ...rushd-operation-request-id_2026-09-28.json |  11 +
 common/reviews/api/rush-lib.api.md            |   1 +
 libraries/rush-daemon/README.md               |  22 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    | 115 ++++++-
 .../src/test/PhasedRequestBatching.test.ts    | 323 +++++++++++++++++-
 .../src/logic/operations/IOperationGraph.ts   |  12 +
 .../src/logic/operations/OperationGraph.ts    |  12 +-
 ...OperationGraphOperationEnvironment.test.ts |  29 ++
 11 files changed, 530 insertions(+), 28 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-operation-request-id_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-coalesced-request-env_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-lazy-op-env_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-operation-request-id_2026-09-28.json

diff --git a/common/changes/@microsoft/rush/rushd-operation-request-id_2026-09-28.json b/common/changes/@microsoft/rush/rushd-operation-request-id_2026-09-28.json
new file mode 100644
index 0000000000..775de7bf45
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-operation-request-id_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `getOperationRequestId` to the iteration options of an operation graph, so that a host that serves several requests in one iteration can tell `configureIteration`, `beforeExecuteIterationAsync` and `afterExecuteIterationAsync` which request each operation was run for.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-coalesced-request-env_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-coalesced-request-env_2026-09-28.json
new file mode 100644
index 0000000000..baa6e161ca
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-coalesced-request-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Give queued phased requests separate iterations when they disagree on a per-session variable, such as `WT_SESSION`, that an operation lists in `dependsOnEnvVars`. Previously they shared one iteration, so the shared operation ran only with the first request's value and every other requester was told it succeeded.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
\ No newline at end of file
diff --git a/common/changes/@rushstack/rush-daemon/rushd-lazy-op-env_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-lazy-op-env_2026-09-28.json
new file mode 100644
index 0000000000..b121793292
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-lazy-op-env_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Start each phased operation from the daemon's `process.env` as it is when the operation starts, so it sees the variables that a plugin sets, changes or deletes in the same iteration's `beforeExecuteIterationAsync`. Previously the router copied `process.env` when it scheduled the iteration, so operations saw the values from the previous request's hooks.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
\ No newline at end of file
diff --git a/common/changes/@rushstack/rush-daemon/rushd-operation-request-id_2026-09-28.json b/common/changes/@rushstack/rush-daemon/rushd-operation-request-id_2026-09-28.json
new file mode 100644
index 0000000000..148431ca0e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-operation-request-id_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Give the iteration hooks of a phased request the `requestId` of the request whose environment each operation gets, through `getOperationRequestId`, so that a plugin can join per-operation telemetry with the telemetry of the request that selected the operation.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
\ No newline at end of file
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 10cbe380ac..8fa1c09a04 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -778,6 +778,7 @@ export interface _IOperationGraphEventSink {
 // @alpha
 export interface IOperationGraphIterationOptions {
     getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
+    getOperationRequestId?: (operation: Operation) => string | undefined;
     // (undocumented)
     inputsSnapshot?: IInputsSnapshot;
     startTime?: number;
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 24f1f68c86..5179afee7e 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -93,11 +93,15 @@ comparisons (the tier-2 fingerprint and the production resolver's startup-enviro
 `getWorkspaceFingerprintEnvironmentEntries()`, which omits `workspaceFingerprintIgnoredEnvironmentVariables`:
 volatile per-shell, terminal, session and client-routing variables such as `PWD`, `OLDPWD`, `SHLVL`, `_`,
 `TERM`, `COLUMNS`, `WSL_INTEROP`, `SSH_*`, `INIT_CWD`, `RUSH_DAEMON`, `RUSH_DAEMON_AUTO_START` and
-`RUSH_DAEMON_EXPERIMENTAL`. Rush does not read these to configure the engine, build the graph or hash operations,
+`RUSH_DAEMON_EXPERIMENTAL`. Rush does not read these to configure the engine or build the graph,
 so running a command from a project subfolder or another shell reuses the warm workspace. All other environment
 inputs, including every other `RUSH_*` variable, `NODE_*`, npm/pnpm configuration, `PATH` and `HOME`, remain
-unchanged and are checked normally. Phased operation processes inherit the daemon's own environment, so they
-see the daemon's startup values for the ignored variables rather than the submitting shell's values.
+unchanged and are checked normally. Each phased operation process takes the ignored variables from the request
+that selected it (`getWorkspaceRequestOperationEnvironment()`) and hashes its `dependsOnEnvVars` from that
+environment, so it sees the submitting shell's values, as a native command would. The rest of that environment is
+the daemon's `process.env` when the operation starts, so it includes variables that a plugin sets in the same
+iteration's `beforeExecuteIterationAsync`; state hashes use the values from when the iteration was scheduled, before
+those hooks run, as native Rush does.
 Compatible selections reuse the same graph and records. An unchanged successful build schedules no work; rebuild
 still invalidates the graph on each request. Every execution refreshes operation inputs under its native lease.
 With the build cache enabled, a cacheable operation whose tracked input files change while the inputs snapshot is
@@ -535,9 +539,15 @@ drains. The result translates only that client's operation subset to Rush's succ
 semantics. Warning-only builds honor the operation's configured `allowWarningsInSuccessfulBuild` state plus the
 request's immutable `RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD` environment override without mutating `process.env`.
 Compatible phased `SHARED-BUILD` requests admitted before the next graph iteration starts are coalesced at a
-deterministic event-loop-turn boundary. The router reconciles retained invalidations once, unions the clients' enabled
-dependency closures, and schedules one iteration. Shared operations execute once, while each client subscribes only
-to its own closure and derives its final result only from that subset. A client does not wait for the other clients'
+deterministic event-loop-turn boundary. Requests are compatible when they have the same request settings and the same
+value of every environment variable that an operation of the graph lists in `dependsOnEnvVars` (an unset variable and
+an empty one hash alike, so they count as the same value), because
+a shared operation runs once, in the environment of the first request that selected it. Iteration hooks get the
+same attribution: `getOperationRequestId` returns the `requestId` of the request whose environment
+`getOperationEnvironment` returns for an operation. The router reconciles
+retained invalidations once, unions the clients' enabled dependency closures, and schedules one iteration. Shared
+operations execute once, while each client subscribes only to its own closure and derives its final result only from
+that subset. A client does not wait for the other clients'
 larger selections: once every operation of its own closure that the iteration scheduled has completed and its output
 has drained, its result is published while the iteration, graph lease, and native execution lease continue for the
 remaining clients. The last client that still needs the iteration receives its result after iteration end and lease
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 27a9299eb7..e7bb86417b 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -4,6 +4,7 @@
 import type {
   IOperationExecutionResult,
   IOperationGraph,
+  IOperationGraphIterationOptions,
   IPhasedCommandEngineRequestSettings,
   Operation,
   _IOperationGraphEventSink
@@ -79,8 +80,12 @@ interface IPreparedPhasedRequest {
   /** Lets requests that cannot run alongside this one preempt its workspace admission; see `#settleEntry`. */
   readonly markAdmissionPreemptible: (onPreempted: () => void) => void;
   readonly request: IDaemonPhasedRequest;
-  /** Only requests with the same settings share one graph iteration. */
+  /** The settings that the request's iteration applies to the graph. */
   readonly requestSettings: IPhasedCommandEngineRequestSettings | undefined;
+  /**
+   * Only requests with the same settings, and the same values for every variable that the graph's operations hash,
+   * share one graph iteration.
+   */
   readonly requestSettingsKey: string;
   readonly selection: IResolvedSelection;
   /** The `performance.now()` timestamp at which the daemon received the request; see `#canJoinCurrentBatch`. */
@@ -272,7 +277,7 @@ export class PhasedRequestRouter {
               receivedTimeMs: receivedTimeMs ?? startTimeMs,
               request,
               requestSettings,
-              requestSettingsKey: JSON.stringify(requestSettings ?? null),
+              requestSettingsKey: getRequestSettingsKey(graph, request, requestSettings),
               selection,
               startTimeMs,
               telemetry,
@@ -569,7 +574,7 @@ class PhasedRequestBatchCoordinator {
         timings.scheduleStartTimeMs = performance.now();
         scheduled = await this.#graph.scheduleIterationAsync({
           inputsSnapshot: this.#workspaceSession.inputsSnapshot,
-          getOperationEnvironment: createOperationEnvironmentLookup(participants)
+          ...createOperationParticipantLookups(participants)
         });
         timings.scheduledTimeMs = performance.now();
         if (scheduled) {
@@ -1176,28 +1181,102 @@ function validateRequestIdentity(request: IDaemonPhasedRequest): void {
 }
 
 /**
- * Gives each operation of an iteration the environment of the first participant that selected it, as a native
- * command would run it in its invoker's environment. An operation that several participants share runs once, in
- * the first participant's environment.
+ * Returns the key that decides which requests can share one graph iteration.
+ *
+ * @remarks
+ * An operation that several participants select runs once, in the first participant's environment, and hashes its
+ * `dependsOnEnvVars` from that environment. Variables that do not select a daemon, such as `WT_SESSION`, reach the
+ * operation from each request, so the key includes this request's value of every variable that an operation of the
+ * graph lists in `dependsOnEnvVars`. Requests that disagree on one of them get separate iterations, and each
+ * operation runs and is hashed as it would be for its own requester. The key takes each value as the operation hashes
+ * it, so an unset variable and an empty one are the same value.
+ */
+function getRequestSettingsKey(
+  graph: IOperationGraph,
+  request: IDaemonPhasedRequest,
+  requestSettings: IPhasedCommandEngineRequestSettings | undefined
+): string {
+  const names: ReadonlyArray<string> = getGraphDependsOnEnvVars(graph);
+  const environment: Readonly<Record<string, string>> =
+    names.length > 0 ? getWorkspaceRequestOperationEnvironment(process.env, request.environment) : {};
+  // InputsSnapshot hashes `environment[name] || ''`.
+  const values: ReadonlyArray<readonly [string, string]> = names.map((name: string) => [
+    name,
+    environment[name] || ''
+  ]);
+  return JSON.stringify([requestSettings ?? null, values]);
+}
+
+/** Returns the names of the environment variables that the graph's operations hash, sorted. */
+function getGraphDependsOnEnvVars(graph: IOperationGraph): ReadonlyArray<string> {
+  const names: Set<string> = new Set();
+  for (const operation of graph.operations) {
+    for (const name of operation.settings?.dependsOnEnvVars ?? []) {
+      names.add(name);
+    }
+  }
+  return Array.from(names).sort(Sort.compareByValue);
+}
+
+/**
+ * The lookups that attribute each operation of an iteration to one of its participants.
  */
-function createOperationEnvironmentLookup(
+type IOperationParticipantLookups = Required<
+  Pick<IOperationGraphIterationOptions, 'getOperationEnvironment' | 'getOperationRequestId'>
+>;
+
+/**
+ * Attributes each operation of an iteration to the first participant that selected it, as a native command would
+ * run it for its invoker, or to the first participant if no participant selected it. `getOperationEnvironment`
+ * returns that participant's environment and `getOperationRequestId` its request id, so a plugin can attribute the
+ * operation to the request whose environment it ran in. An operation that several participants share runs once, in
+ * the first participant's environment; the participants agree on the hashed value of every variable that an
+ * operation hashes (see `getRequestSettingsKey`).
+ *
+ * @remarks
+ * Each environment is a copy of the daemon's `process.env` in which the variables that do not select a daemon take
+ * the participant's values. The copy is taken when it is asked for, so an operation starts from `process.env` as it
+ * is when the operation starts, as a native command's operation does. That includes the variables that a plugin
+ * sets, changes or deletes in the same iteration's `beforeExecuteIterationAsync`. Reading `process.env` is slow, and
+ * the graph hashes every operation while it schedules an iteration, so the calls made before the next microtask
+ * share one copy for each participant.
+ */
+function createOperationParticipantLookups(
   participants: ReadonlyArray<IBatchEntry>
-): (operation: Operation) => Readonly<Record<string, string | undefined>> {
-  const environmentByOperation: Map<Operation, Readonly<Record<string, string>>> = new Map();
-  let firstEnvironment: Readonly<Record<string, string>> | undefined;
+): IOperationParticipantLookups {
+  const entryByOperation: Map<Operation, IBatchEntry> = new Map();
   for (const entry of participants) {
-    const environment: Readonly<Record<string, string>> = getWorkspaceRequestOperationEnvironment(
-      process.env,
-      entry.request.environment
-    );
-    firstEnvironment ??= environment;
     for (const operation of entry.selection.activeOperations) {
-      if (!environmentByOperation.has(operation)) {
-        environmentByOperation.set(operation, environment);
+      if (!entryByOperation.has(operation)) {
+        entryByOperation.set(operation, entry);
       }
     }
   }
-  return (operation: Operation) => environmentByOperation.get(operation) ?? firstEnvironment ?? process.env;
+  const firstEntry: IBatchEntry | undefined = participants[0];
+  const getEntry = (operation: Operation): IBatchEntry | undefined =>
+    entryByOperation.get(operation) ?? firstEntry;
+  let environmentByEntry: Map<IBatchEntry, Readonly<Record<string, string>>> | undefined;
+  return {
+    getOperationEnvironment: (operation: Operation) => {
+      const entry: IBatchEntry | undefined = getEntry(operation);
+      if (!entry) {
+        return process.env;
+      }
+      if (!environmentByEntry) {
+        environmentByEntry = new Map();
+        queueMicrotask(() => {
+          environmentByEntry = undefined;
+        });
+      }
+      let environment: Readonly<Record<string, string>> | undefined = environmentByEntry.get(entry);
+      if (!environment) {
+        environment = getWorkspaceRequestOperationEnvironment(process.env, entry.request.environment);
+        environmentByEntry.set(entry, environment);
+      }
+      return environment;
+    },
+    getOperationRequestId: (operation: Operation) => getEntry(operation)?.request.requestId
+  };
 }
 
 function validateNonemptyName(value: string, kind: string): void {
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index dea724566b..5e4b77751a 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -10,7 +10,12 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import { RUSHD_OPERATION_HEADER, RUSHD_OPERATION_STREAM_CLOSED } from '@rushstack/rush-daemon-protocol';
 import { OperationStatus } from '@microsoft/rush-lib';
-import type { IOperationRunnerContext, IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import type {
+  IInputsSnapshot,
+  IOperationRunnerContext,
+  IPhasedCommandEngineRequestSettings,
+  IRushConfigurationProjectForSnapshot
+} from '@microsoft/rush-lib';
 
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import {
@@ -20,6 +25,7 @@ import {
   createRoutingFixture
 } from './PhasedRequestRouterTestUtilities';
 import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import { TEST_REPO_ROOT } from './TestWorkspaceSession';
 
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
@@ -275,6 +281,321 @@ describe('shared phased request batching', () => {
     );
   });
 
+  it('gives each operation the request id of the request whose environment it gets', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const iterations: string[][] = [];
+    fixture.graph.hooks.beforeExecuteIterationAsync.tap('test plugin', (records, options) => {
+      const lines: string[] = [];
+      for (const operation of records.keys()) {
+        const session: string | undefined = options.getOperationEnvironment?.(operation)[SESSION_VARIABLE];
+        lines.push(`${operation.name}: ${options.getOperationRequestId?.(operation)} ${session}`);
+      }
+      iterations.push(lines.sort());
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const withSession = (request: IDaemonPhasedRequest, session: string): IDaemonPhasedRequest => ({
+      ...request,
+      environment: { [SESSION_VARIABLE]: session }
+    });
+
+    await Promise.all([
+      router.executeAsync(
+        withSession(createRequest('x', OPERATION_A, OPERATION_C), 'session-X'),
+        new TestPhasedRequestClient('x')
+      ),
+      router.executeAsync(
+        withSession(createRequest('y', OPERATION_B), 'session-Y'),
+        new TestPhasedRequestClient('y')
+      )
+    ]);
+    await router.executeAsync(
+      withSession(createRequest('z', OPERATION_A), 'session-Z'),
+      new TestPhasedRequestClient('z')
+    );
+
+    // An operation that no participant selected gets the first participant's environment and request id.
+    expect(iterations).toEqual([
+      [`${OPERATION_A}: x session-X`, `${OPERATION_B}: y session-Y`, `${OPERATION_C}: x session-X`],
+      [`${OPERATION_A}: z session-Z`, `${OPERATION_B}: z session-Z`, `${OPERATION_C}: z session-Z`]
+    ]);
+  });
+
+  describe('with a plugin that changes process.env in beforeExecuteIterationAsync', () => {
+    const ADDED_VARIABLE: string = 'RUSHD_TEST_ADDED';
+    const CHANGED_VARIABLE: string = 'RUSHD_TEST_CHANGED';
+    const REMOVED_VARIABLE: string = 'RUSHD_TEST_REMOVED';
+    const NAMES: ReadonlyArray<string> = [
+      SESSION_VARIABLE,
+      ADDED_VARIABLE,
+      CHANGED_VARIABLE,
+      REMOVED_VARIABLE
+    ];
+    let savedValues: ReadonlyArray<string | undefined> = [];
+
+    beforeEach(() => {
+      savedValues = NAMES.map((name: string) => process.env[name]);
+      process.env[SESSION_VARIABLE] = 'daemon';
+      delete process.env[ADDED_VARIABLE];
+      process.env[CHANGED_VARIABLE] = 'original';
+      process.env[REMOVED_VARIABLE] = 'original';
+    });
+
+    afterEach(() => {
+      NAMES.forEach((name: string, index: number) => {
+        const value: string | undefined = savedValues[index];
+        if (value === undefined) delete process.env[name];
+        else process.env[name] = value;
+      });
+    });
+
+    function createFixtureWithPlugin(options?: Parameters<typeof createFixture>[0]): ITestRoutingFixture {
+      const fixture: ITestRoutingFixture = createFixture(options);
+      let iteration: number = 0;
+      fixture.graph.hooks.beforeExecuteIterationAsync.tap('test plugin', () => {
+        iteration++;
+        process.env[ADDED_VARIABLE] = `added-${iteration}`;
+        process.env[CHANGED_VARIABLE] = `changed-${iteration}`;
+        delete process.env[REMOVED_VARIABLE];
+      });
+      return fixture;
+    }
+
+    function withSession(request: IDaemonPhasedRequest, session: string): IDaemonPhasedRequest {
+      return { ...request, environment: { [SESSION_VARIABLE]: session } };
+    }
+
+    function recordEnvironment(seen: string[], operationId: string): TestOperationAction {
+      return async (terminal: ITerminal, context: IOperationRunnerContext): Promise<void> => {
+        const values: string[] = NAMES.map((name: string) => context.environment?.[name] ?? '<unset>');
+        seen.push(`${operationId}: ${values.join(' ')}`);
+      };
+    }
+
+    it("starts each operation from what the same iteration's hook set, changed and deleted, with its requester's session", async () => {
+      const seen: string[] = [];
+      const fixture: ITestRoutingFixture = createFixtureWithPlugin({
+        actionAAsync: recordEnvironment(seen, OPERATION_A),
+        actionCAsync: recordEnvironment(seen, OPERATION_C)
+      });
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(
+          withSession(createRequest('a', OPERATION_A), 'session-A'),
+          new TestPhasedRequestClient('a')
+        ),
+        router.executeAsync(
+          withSession(createRequest('c', OPERATION_C), 'session-C'),
+          new TestPhasedRequestClient('c')
+        )
+      ]);
+      await router.executeAsync(
+        withSession(createRequest('a-again', OPERATION_A), 'session-A-again'),
+        new TestPhasedRequestClient('a-again')
+      );
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(2);
+      expect([...seen].sort()).toEqual([
+        `${OPERATION_A}: session-A added-1 changed-1 <unset>`,
+        `${OPERATION_A}: session-A-again added-2 changed-2 <unset>`,
+        `${OPERATION_C}: session-C added-1 changed-1 <unset>`
+      ]);
+    });
+
+    it('hashes from one copy of each requester environment while scheduling and starts from a copy taken after the hook', async () => {
+      const hashedEnvironments: Map<
+        IRushConfigurationProjectForSnapshot,
+        Readonly<Record<string, string | undefined>> | undefined
+      > = new Map();
+      const seen: string[] = [];
+      const fixture: ITestRoutingFixture = createFixtureWithPlugin({
+        actionAAsync: recordEnvironment(seen, OPERATION_A),
+        actionBAsync: recordEnvironment(seen, OPERATION_B),
+        actionCAsync: recordEnvironment(seen, OPERATION_C)
+      });
+      const inputsSnapshot: IInputsSnapshot = {
+        getOperationOwnStateHash: (
+          project: IRushConfigurationProjectForSnapshot,
+          operationName?: string,
+          environment?: Readonly<Record<string, string | undefined>>
+        ): string => {
+          hashedEnvironments.set(project, environment);
+          return 'hash';
+        },
+        getTrackedFileHashesForOperation: () => new Map(),
+        hasUncommittedChanges: false,
+        hashes: new Map(),
+        rootDirectory: TEST_REPO_ROOT
+      };
+      Object.assign(fixture.session, { inputsSnapshot });
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(
+          withSession(createRequest('x', OPERATION_A, OPERATION_C), 'session-X'),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          withSession(createRequest('y', OPERATION_B), 'session-Y'),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+
+      const [hashedA, hashedB, hashedC] = [OPERATION_A, OPERATION_B, OPERATION_C].map((operationId: string) =>
+        hashedEnvironments.get(fixture.operations.get(operationId)!.associatedProject)
+      );
+      expect(hashedA?.[SESSION_VARIABLE]).toBe('session-X');
+      expect(hashedB?.[SESSION_VARIABLE]).toBe('session-Y');
+      expect(hashedC).toBe(hashedA);
+      expect(hashedA?.[CHANGED_VARIABLE]).toBe('original');
+      expect([...seen].sort()).toEqual([
+        `${OPERATION_A}: session-X added-1 changed-1 <unset>`,
+        `${OPERATION_B}: session-Y added-1 changed-1 <unset>`,
+        `${OPERATION_C}: session-X added-1 changed-1 <unset>`
+      ]);
+    });
+  });
+
+  describe('with an operation that hashes a variable that does not select a daemon', () => {
+    const TERMINAL_VARIABLE: string = 'WT_SESSION';
+    const HOST_VARIABLE: string = 'RUSHD_TEST_HOST_VARIABLE';
+
+    interface IHashedVariableFixture {
+      readonly fixture: ITestRoutingFixture;
+      readonly router: PhasedRequestRouter;
+      readonly runs: ReadonlyArray<string | undefined>;
+      readonly scheduleSpy: jest.SpyInstance;
+    }
+
+    function createHashedVariableFixture(
+      dependsOnEnvVars: string[],
+      actionCAsync?: TestOperationAction
+    ): IHashedVariableFixture {
+      const runs: (string | undefined)[] = [];
+      const fixture: ITestRoutingFixture = createFixture({
+        actionAAsync: async (terminal: ITerminal, context: IOperationRunnerContext): Promise<void> => {
+          runs.push(context.environment?.[TERMINAL_VARIABLE]);
+        },
+        actionCAsync
+      });
+      fixture.operations.get(OPERATION_A)!.settings = { operationName: '_phase:test', dependsOnEnvVars };
+      return {
+        fixture,
+        router: new PhasedRequestRouter(fixture.session),
+        runs,
+        scheduleSpy: jest.spyOn(fixture.graph, 'scheduleIterationAsync')
+      };
+    }
+
+    function createRequestWithEnvironment(
+      requestId: string,
+      environment: Record<string, string>,
+      operationId: string
+    ): IDaemonPhasedRequest {
+      return { ...createRequest(requestId, operationId), environment };
+    }
+
+    it('schedules separate iterations for queued requests that disagree on its value', async () => {
+      const occupierStarted: IDeferred = createDeferred();
+      const releaseOccupier: IDeferred = createDeferred();
+      const { fixture, router, runs, scheduleSpy } = createHashedVariableFixture(
+        [TERMINAL_VARIABLE],
+        async (): Promise<void> => {
+          occupierStarted.resolve();
+          await releaseOccupier.promise;
+        }
+      );
+      const occupier: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        createRequest('occupier', OPERATION_C),
+        new TestPhasedRequestClient('occupier')
+      );
+      await occupierStarted.promise;
+      const results: Promise<IDaemonPhasedRequestResult[]> = Promise.all([
+        router.executeAsync(
+          createRequestWithEnvironment('x', { [TERMINAL_VARIABLE]: 'wt-X' }, OPERATION_A),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          createRequestWithEnvironment('y', { [TERMINAL_VARIABLE]: 'wt-Y' }, OPERATION_A),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+      releaseOccupier.resolve();
+      await occupier;
+      const [x, y] = await results;
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(3);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(2);
+      expect(runs).toEqual(['wt-X', 'wt-Y']);
+      expect(x).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(y).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(getResultOperationIds(x)).toEqual([OPERATION_A]);
+      expect(getResultOperationIds(y)).toEqual([OPERATION_A]);
+    });
+
+    it('shares one iteration for requests that agree on its value', async () => {
+      const { fixture, router, runs, scheduleSpy } = createHashedVariableFixture([TERMINAL_VARIABLE]);
+
+      await Promise.all([
+        router.executeAsync(
+          createRequestWithEnvironment(
+            'x',
+            { [TERMINAL_VARIABLE]: 'wt-X', [SESSION_VARIABLE]: 'session-X' },
+            OPERATION_A
+          ),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          createRequestWithEnvironment(
+            'y',
+            { [TERMINAL_VARIABLE]: 'wt-X', [SESSION_VARIABLE]: 'session-Y' },
+            OPERATION_A
+          ),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(runs).toEqual(['wt-X']);
+    });
+
+    it('shares one iteration for an unset value and an empty one, which operations hash alike', async () => {
+      const { fixture, router, runs, scheduleSpy } = createHashedVariableFixture([TERMINAL_VARIABLE]);
+
+      await Promise.all([
+        router.executeAsync(createRequest('unset', OPERATION_A), new TestPhasedRequestClient('unset')),
+        router.executeAsync(
+          createRequestWithEnvironment('empty', { [TERMINAL_VARIABLE]: '' }, OPERATION_A),
+          new TestPhasedRequestClient('empty')
+        )
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(runs).toEqual([undefined]);
+    });
+
+    it('keeps sharing one iteration when requests differ only in a variable that operations take from the daemon', async () => {
+      const { fixture, router, scheduleSpy } = createHashedVariableFixture([HOST_VARIABLE]);
+
+      await Promise.all([
+        router.executeAsync(
+          createRequestWithEnvironment('x', { [HOST_VARIABLE]: 'x' }, OPERATION_A),
+          new TestPhasedRequestClient('x')
+        ),
+        router.executeAsync(
+          createRequestWithEnvironment('y', { [HOST_VARIABLE]: 'y' }, OPERATION_A),
+          new TestPhasedRequestClient('y')
+        )
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    });
+  });
+
   it('shares one iteration for disjoint selections while isolating streams, events, and results', async () => {
     const fixture: ITestRoutingFixture = createFixture({
       actionAAsync: async (terminal: ITerminal): Promise<void> => terminal.writeLine('only-a'),
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index 7da9225e19..9d78c3bede 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -33,6 +33,18 @@ export interface IOperationGraphIterationOptions {
    * (see `getWorkspaceRequestOperationEnvironment`).
    */
   getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
+
+  /**
+   * Returns the identifier of the request whose environment `getOperationEnvironment` returns for an operation of
+   * this iteration, or `undefined` if there is no such request. When omitted, the iteration serves no identified
+   * request.
+   *
+   * @remarks
+   * A long-lived host can serve several requests in one iteration. A plugin can use this identifier to attribute
+   * each operation to the request that selected it, for example to join per-operation telemetry with that
+   * request's own telemetry entry.
+   */
+  getOperationRequestId?: (operation: Operation) => string | undefined;
 }
 
 /**
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index c78fcf862a..3983c886b1 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -97,6 +97,8 @@ interface IExecutionIterationContext extends IOperationExecutionRecordContext {
 
   startTime?: number;
 
+  getOperationRequestId?: (operation: Operation) => string | undefined;
+
   completedOperations: number;
   totalOperations: number;
 }
@@ -676,12 +678,14 @@ export class OperationGraph implements IOperationGraph {
     const {
       startTime = performance.now(),
       inputsSnapshot = await getInputsSnapshotAsync?.(),
-      getOperationEnvironment
+      getOperationEnvironment,
+      getOperationRequestId
     } = iterationOptions;
     const iterationOptionsForCallbacks: IOperationGraphIterationOptions = {
       startTime,
       inputsSnapshot,
-      getOperationEnvironment
+      getOperationEnvironment,
+      getOperationRequestId
     };
 
     const { hooks } = this;
@@ -731,6 +735,7 @@ export class OperationGraph implements IOperationGraph {
       onOperationStateChanged: undefined,
       createEnvironment: createEnvironmentForOperation,
       getOperationEnvironment,
+      getOperationRequestId,
       invalidate: graph.invalidateOperations.bind(graph),
       get debugMode(): boolean {
         return graph.debugMode;
@@ -893,7 +898,8 @@ export class OperationGraph implements IOperationGraph {
     const iterationOptions: IOperationGraphIterationOptions = {
       inputsSnapshot: iterationContext.inputsSnapshot,
       startTime: iterationContext.startTime,
-      getOperationEnvironment: iterationContext.getOperationEnvironment
+      getOperationEnvironment: iterationContext.getOperationEnvironment,
+      getOperationRequestId: iterationContext.getOperationRequestId
     };
 
     const executionQueue: AsyncOperationQueue = new AsyncOperationQueue(
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
index 061de0a2b8..1cd94685df 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphOperationEnvironment.test.ts
@@ -196,4 +196,33 @@ describe('OperationGraph operation environment', () => {
       ['afterExecuteIterationAsync', undefined]
     ]);
   });
+
+  it('gives every iteration hook the request id lookup that the iteration was scheduled with', async () => {
+    const graph: OperationGraph = createGraph([new EnvironmentRecordingRunner('operation')]);
+    type GetOperationRequestId = IOperationGraphIterationOptions['getOperationRequestId'];
+    const received: [string, GetOperationRequestId][] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastResults, options) => {
+      received.push(['configureIteration', options.getOperationRequestId]);
+    });
+    graph.hooks.beforeExecuteIterationAsync.tapPromise('test', async (records, options) => {
+      received.push(['beforeExecuteIterationAsync', options.getOperationRequestId]);
+    });
+    graph.hooks.afterExecuteIterationAsync.tapPromise('test', async (status, records, options) => {
+      received.push(['afterExecuteIterationAsync', options.getOperationRequestId]);
+      return status;
+    });
+    const getOperationRequestId: GetOperationRequestId = () => 'request-A';
+
+    expect((await graph.executeAsync({ getOperationRequestId })).status).toBe(OperationStatus.Success);
+    expect((await graph.executeAsync({})).status).toBe(OperationStatus.Success);
+
+    expect(received).toEqual([
+      ['configureIteration', getOperationRequestId],
+      ['beforeExecuteIterationAsync', getOperationRequestId],
+      ['afterExecuteIterationAsync', getOperationRequestId],
+      ['configureIteration', undefined],
+      ['beforeExecuteIterationAsync', undefined],
+      ['afterExecuteIterationAsync', undefined]
+    ]);
+  });
 });

From 0f2d00c1c690752a10b92db8d2267d97e8761db9 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:16 +0000
Subject: [PATCH 064/265] [rush-lib] A build-cache hit no longer restores an
 earlier failing run's stderr

Swarm integration step 49; original commit c3f9fa2ac7 (merge of swarm/o03-t157 at 5b2a400f29).
Scope: task 157.

Brings o03's task 157: a cache hit no longer writes an older failing run's stderr into rush-logs/<name>.error.log, so a cache entry written after a failure isn't poisoned (ch02 board 2284, t05 board 2456). Second agent: t05 board 2704. ch01's e2e on ch01-sC: no error.log after either hit in the OK, ERR, OK sequence, and none in any cache entry.

s16 batch C, item 4 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree 09d5eabe82)

Commits folded into this step (1):
- 5b2a400f29 Keep cache hits from restoring an earlier run's stderr (task 157)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-cache-hit-error-log_2026-09-29-00-20.json |  11 ++
 .../operations/OperationMetadataManager.ts    |  80 +++++++--
 .../test/OperationMetadataManager.test.ts     | 162 +++++++++++++++++-
 3 files changed, 241 insertions(+), 12 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-o03-t157-cache-hit-error-log_2026-09-29-00-20.json

diff --git a/common/changes/@microsoft/rush/swarm-o03-t157-cache-hit-error-log_2026-09-29-00-20.json b/common/changes/@microsoft/rush/swarm-o03-t157-cache-hit-error-log_2026-09-29-00-20.json
new file mode 100644
index 0000000000..dcc65945a8
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-o03-t157-cache-hit-error-log_2026-09-29-00-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "A build cache hit no longer writes the stderr of an earlier failed run to the operation's error log in rush-logs. When an operation runs without writing to stderr, Rush deletes the error log that an earlier run left in the operation's metadata folder, so later cache entries don't store it. On a cache hit, Rush writes the error log from the entry's log chunks, or deletes it when they hold no stderr, so entries saved by earlier versions can't restore a stale error log either.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts b/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts
index 51007b65a6..b8ece54487 100644
--- a/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationMetadataManager.ts
@@ -3,11 +3,18 @@
 
 import * as fs from 'node:fs';
 
-import { Async, FileSystem, type IFileSystemCopyFileOptions } from '@rushstack/node-core-library';
+import {
+  Async,
+  FileSystem,
+  type IFileSystemCopyFileOptions,
+  NewlineKind
+} from '@rushstack/node-core-library';
 import {
   type ITerminalChunk,
   TerminalChunkKind,
   TerminalProviderSeverity,
+  TerminalWritable,
+  TextRewriterTransform,
   type ITerminal,
   type ITerminalProvider
 } from '@rushstack/terminal';
@@ -125,6 +132,10 @@ export class OperationMetadataManager {
         if (!FileSystem.isNotExistError(e)) {
           throw e;
         }
+
+        // This run didn't write the file (a run that writes nothing to stderr has no error log), so delete
+        // the copy an earlier run left. The metadata folder is a cached output and must describe only this run.
+        await FileSystem.deleteFileAsync(options.destinationPath);
       }
     });
   }
@@ -149,6 +160,7 @@ export class OperationMetadataManager {
       this.stateFile.state?.cobuildContextId === cobuildContextId &&
       this.stateFile.state?.cobuildRunnerId !== cobuildRunnerId;
 
+    let errorLogText: string | undefined;
     try {
       const rawLogChunks: string = await FileSystem.readFileAsync(this.#logChunksPath);
       const chunks: ITerminalChunk[] = [];
@@ -164,6 +176,7 @@ export class OperationMetadataManager {
           terminalProvider.write(text, TerminalProviderSeverity.log);
         }
       }
+      errorLogText = getErrorLogText(chunks);
     } catch (e) {
       if (FileSystem.isNotExistError(e)) {
         // Log chunks file doesn't exist, try to restore log file
@@ -173,15 +186,29 @@ export class OperationMetadataManager {
       }
     }
 
-    // Try to restore cached error log as error log file
-    try {
-      await FileSystem.copyFileAsync({
-        sourcePath: this.#errorLogPath,
-        destinationPath: errorLogPath
-      });
-    } catch (e) {
-      if (!FileSystem.isNotExistError(e)) {
-        throw e;
+    // The error log file shows the stderr of the run that produced the cache entry. When the entry has log
+    // chunks, write it from them rather than copying the cached error log: an entry saved before saveAsync
+    // deleted stale files can hold the error log of an earlier run that failed.
+    if (errorLogText !== undefined) {
+      if (errorLogText) {
+        await FileSystem.writeFileAsync(errorLogPath, errorLogText, { ensureFolderExists: true });
+      } else {
+        await FileSystem.deleteFileAsync(errorLogPath);
+      }
+    } else {
+      // Try to restore cached error log as error log file
+      try {
+        await FileSystem.copyFileAsync({
+          sourcePath: this.#errorLogPath,
+          destinationPath: errorLogPath
+        });
+      } catch (e) {
+        if (!FileSystem.isNotExistError(e)) {
+          throw e;
+        }
+
+        // The entry has no error log, so don't leave the one from the last run that executed.
+        await FileSystem.deleteFileAsync(errorLogPath);
       }
     }
   }
@@ -199,6 +226,39 @@ export class OperationMetadataManager {
   }
 }
 
+/**
+ * Collects the text of the stderr chunks written to it.
+ */
+class StderrTextWritable extends TerminalWritable {
+  public text: string = '';
+
+  protected onWriteChunk(chunk: ITerminalChunk): void {
+    if (chunk.kind === TerminalChunkKind.Stderr) {
+      this.text += chunk.text;
+    }
+  }
+}
+
+/**
+ * Returns the error log file text for an operation's log chunks: the stderr chunks, rewritten the same way
+ * as the error log that `initializeProjectLogFilesAsync` writes when the operation runs.
+ */
+function getErrorLogText(chunks: ReadonlyArray<ITerminalChunk>): string {
+  const stderrText: StderrTextWritable = new StderrTextWritable();
+  const textRewriter: TextRewriterTransform = new TextRewriterTransform({
+    destination: stderrText,
+    removeColors: true,
+    normalizeNewlines: NewlineKind.OsDefault
+  });
+  for (const chunk of chunks) {
+    if (chunk.kind === TerminalChunkKind.Stderr) {
+      textRewriter.writeChunk(chunk);
+    }
+  }
+  textRewriter.close();
+  return stderrText.text;
+}
+
 async function restoreFromLogFile(terminal: ITerminal, path: string): Promise<void> {
   let logReadStream: fs.ReadStream | undefined;
 
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts
index 6443e873d6..19025b7040 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationMetadataManager.test.ts
@@ -7,10 +7,10 @@ jest.mock('node:fs');
 import { MockWritable, StringBufferTerminalProvider, Terminal, TerminalChunkKind } from '@rushstack/terminal';
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
-import { OperationMetadataManager } from '../OperationMetadataManager';
+import { type IOperationMetaData, OperationMetadataManager } from '../OperationMetadataManager';
 import { CollatedTerminalProvider } from '../../../utilities/CollatedTerminalProvider';
 import { CollatedTerminal } from '@rushstack/stream-collator';
-import { FileSystem } from '@rushstack/node-core-library';
+import { FileSystem, type IFileSystemCopyFileOptions, NewlineKind, Text } from '@rushstack/node-core-library';
 import * as fs from 'node:fs';
 import { Readable } from 'node:stream';
 import { Operation } from '../Operation';
@@ -32,11 +32,24 @@ const manager: OperationMetadataManager = new OperationMetadataManager({
   operation
 });
 
+const cachedErrorLogPath: string = '/path/to/project/.rush/temp/operation/identifier/error.log';
+
+function createNotExistError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('ENOENT: no such file or directory'), {
+    code: 'ENOENT',
+    errno: -2,
+    syscall: 'copyfile',
+    path: '/path/to/file'
+  });
+}
+
 describe(OperationMetadataManager.name, () => {
   let mockTerminalProvider: StringBufferTerminalProvider;
   beforeEach(() => {
     mockTerminalProvider = new StringBufferTerminalProvider(false);
     jest.spyOn(FileSystem, 'copyFileAsync').mockResolvedValue();
+    jest.spyOn(FileSystem, 'deleteFileAsync').mockResolvedValue();
+    jest.spyOn(FileSystem, 'writeFileAsync').mockResolvedValue();
   });
 
   function toJsonLines(data: object[]): string {
@@ -134,4 +147,149 @@ describe(OperationMetadataManager.name, () => {
     expect(mockClose).toHaveBeenCalledTimes(1);
     expect(mockWritable.chunks).toMatchSnapshot();
   });
+
+  it('should write the error log from the stderr chunks instead of copying the cached error log', async () => {
+    const data = [
+      {
+        text: 'logged to stdout\n',
+        kind: TerminalChunkKind.Stdout
+      },
+      {
+        text: '\u001b[31merror TS2345: first\u001b[39m\r\n',
+        kind: TerminalChunkKind.Stderr
+      },
+      {
+        text: 'more stdout\n',
+        kind: TerminalChunkKind.Stdout
+      },
+      {
+        text: 'error TS2304: second\n',
+        kind: TerminalChunkKind.Stderr
+      }
+    ];
+
+    jest.spyOn(FileSystem, 'readFileAsync').mockResolvedValue(toJsonLines(data));
+
+    await manager.tryRestoreAsync({
+      terminal: mockTerminal,
+      terminalProvider: mockTerminalProvider,
+      errorLogPath: '/path/to/errorLog'
+    });
+
+    expect(FileSystem.writeFileAsync).toHaveBeenCalledTimes(1);
+    expect(FileSystem.writeFileAsync).toHaveBeenCalledWith(
+      '/path/to/errorLog',
+      Text.convertTo('error TS2345: first\nerror TS2304: second\n', NewlineKind.OsDefault),
+      { ensureFolderExists: true }
+    );
+    expect(FileSystem.copyFileAsync).not.toHaveBeenCalled();
+    expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+  });
+
+  it('should delete the error log when the chunks have no stderr, even if the cache entry has an error log', async () => {
+    // An entry saved after a failed run could hold that run's error log, even though its own run wrote no stderr
+    const data = [
+      {
+        text: 'built without errors\n',
+        kind: TerminalChunkKind.Stdout
+      }
+    ];
+
+    jest.spyOn(FileSystem, 'readFileAsync').mockResolvedValue(toJsonLines(data));
+
+    await manager.tryRestoreAsync({
+      terminal: mockTerminal,
+      terminalProvider: mockTerminalProvider,
+      errorLogPath: '/path/to/errorLog'
+    });
+
+    expect(FileSystem.deleteFileAsync).toHaveBeenCalledTimes(1);
+    expect(FileSystem.deleteFileAsync).toHaveBeenCalledWith('/path/to/errorLog');
+    expect(FileSystem.copyFileAsync).not.toHaveBeenCalled();
+    expect(FileSystem.writeFileAsync).not.toHaveBeenCalled();
+  });
+
+  describe('without log chunks', () => {
+    beforeEach(() => {
+      jest.spyOn(FileSystem, 'readFileAsync').mockRejectedValue(createNotExistError());
+      const mockReadStream: fs.ReadStream = Readable.from([]) as fs.ReadStream;
+      mockReadStream.close = jest.fn();
+      jest.spyOn(fs, 'createReadStream').mockReturnValue(mockReadStream);
+    });
+
+    it('should copy the cached error log', async () => {
+      await manager.tryRestoreAsync({
+        terminal: mockTerminal,
+        terminalProvider: mockTerminalProvider,
+        errorLogPath: '/path/to/errorLog'
+      });
+
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledTimes(1);
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledWith({
+        sourcePath: cachedErrorLogPath,
+        destinationPath: '/path/to/errorLog'
+      });
+      expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+      expect(FileSystem.writeFileAsync).not.toHaveBeenCalled();
+    });
+
+    it('should delete the error log when the cache entry has none', async () => {
+      jest.spyOn(FileSystem, 'copyFileAsync').mockRejectedValue(createNotExistError());
+
+      await manager.tryRestoreAsync({
+        terminal: mockTerminal,
+        terminalProvider: mockTerminalProvider,
+        errorLogPath: '/path/to/errorLog'
+      });
+
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledTimes(1);
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledWith('/path/to/errorLog');
+    });
+  });
+
+  describe('saveAsync', () => {
+    const metadata: IOperationMetaData = {
+      durationInSeconds: 1,
+      cobuildContextId: undefined,
+      cobuildRunnerId: undefined,
+      logPath: '/path/to/rush-logs/project.identifier.log',
+      errorLogPath: '/path/to/rush-logs/project.identifier.error.log',
+      logChunksPath: '/path/to/project/.rush/temp/chunked-rush-logs/project.identifier.chunks.jsonl'
+    };
+
+    it('should copy the log files of the run', async () => {
+      await manager.saveAsync(metadata);
+
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledTimes(3);
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledWith({
+        sourcePath: metadata.errorLogPath,
+        destinationPath: cachedErrorLogPath
+      });
+      expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+    });
+
+    it('should delete the copy an earlier run left when the run did not write an error log', async () => {
+      jest
+        .spyOn(FileSystem, 'copyFileAsync')
+        .mockImplementation(async ({ sourcePath }: IFileSystemCopyFileOptions) => {
+          if (sourcePath === metadata.errorLogPath) {
+            throw createNotExistError();
+          }
+        });
+
+      await manager.saveAsync(metadata);
+
+      expect(FileSystem.copyFileAsync).toHaveBeenCalledTimes(3);
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledTimes(1);
+      expect(FileSystem.deleteFileAsync).toHaveBeenCalledWith(cachedErrorLogPath);
+    });
+
+    it('should rethrow other errors', async () => {
+      const error: Error = new Error('EACCES: permission denied');
+      jest.spyOn(FileSystem, 'copyFileAsync').mockRejectedValue(error);
+
+      await expect(manager.saveAsync(metadata)).rejects.toThrow(error);
+      expect(FileSystem.deleteFileAsync).not.toHaveBeenCalled();
+    });
+  });
 });

From 08ad2aca97a97f3b4ec83978d22baee471a58d42 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:16 +0000
Subject: [PATCH 065/265] [rush-lib] An iteration checks an operation's
 build-cache inputs only when it needs them

Swarm integration step 50; original commit 633640c81c (merge of swarm/r07-t152 at 7e98034976).
Scope: task 152.

Brings r07's task 152: an executed iteration no longer computes the build-cache disabled reason for all of the all-project graph's operations (about 0.7 s at odsp-web) or splices finished records out of the queue one at a time (about 0.1 s). Second agent: m01 board 2727. ch01's e2e on ch01-sC: the cache arm's hits and misses equal --no-daemon.

s16 batch C, item 5 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree 86cb10cdf4)

Commits folded into this step (1):
- 7e98034976 [rush-lib] Check the build cache inputs of an operation only when it's needed

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ache-disabled-reason_2026-09-28-23-08.json | 11 +++
 .../logic/operations/AsyncOperationQueue.ts   | 11 ++-
 .../operations/CacheableOperationPlugin.ts    | 42 +++++++++--
 .../test/AsyncOperationQueue.test.ts          | 46 ++++++++++++
 .../test/CacheableOperationPlugin.test.ts     | 71 ++++++++++++++++++-
 5 files changed, 170 insertions(+), 11 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/lazy-cache-disabled-reason_2026-09-28-23-08.json

diff --git a/common/changes/@microsoft/rush/lazy-cache-disabled-reason_2026-09-28-23-08.json b/common/changes/@microsoft/rush/lazy-cache-disabled-reason_2026-09-28-23-08.json
new file mode 100644
index 0000000000..97a438445b
--- /dev/null
+++ b/common/changes/@microsoft/rush/lazy-cache-disabled-reason_2026-09-28-23-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Only check the tracked files of an operation for the build cache when the operation executes, or when cobuilds need to cluster the operations, and stop scanning the execution queue once it has found an operation for each waiting iterator. This speeds up builds of long-lived operation graphs such as the Rush daemon in large workspaces when only a few operations need to run.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
index 035eb53395..bc0add0f9c 100644
--- a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
+++ b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
@@ -108,8 +108,14 @@ export class AsyncOperationQueue
 
     const readyOperations: OperationExecutionRecord[] = [];
 
+    // Operations that were never assigned are assigned first, in the order in which they are found, so the
+    // scan can stop once it has found one for each waiting iterator. This method runs each time an operation
+    // is requested, completes or becomes ready, and the queue of a long-lived graph (such as the Rush
+    // daemon's) can hold thousands of operations, so scanning all of them each time would be quadratic.
+    let untriedReadyCount: number = 0;
+
     // By iterating in reverse order we do less array shuffling when removing operations
-    for (let i: number = queue.length - 1; waitingIterators.length > 0 && i >= 0; i--) {
+    for (let i: number = queue.length - 1; untriedReadyCount < waitingIterators.length && i >= 0; i--) {
       const record: OperationExecutionRecord = queue[i];
 
       if (
@@ -137,6 +143,9 @@ export class AsyncOperationQueue
         throw new Error(`Unexpected status "${record.status}" for queued operation: ${record.name}`);
       } else {
         readyOperations.push(record);
+        if (!timesQueued.has(record)) {
+          untriedReadyCount++;
+        }
       }
       // Otherwise operation is still waiting
     }
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 0a5de47256..485ff10710 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -68,7 +68,8 @@ export interface IOperationBuildCacheContext {
   isCacheReadAllowed: boolean;
 
   operationBuildCache: OperationBuildCache | undefined;
-  cacheDisabledReason: string | undefined;
+  // Computed when first read. See the beforeExecuteIterationAsync tap.
+  readonly cacheDisabledReason: string | undefined;
   outputFolderNames: ReadonlyArray<string>;
 
   cobuildLock: CobuildLock | undefined;
@@ -268,10 +269,23 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             const fileHashes: ReadonlyMap<string, string> | undefined =
               inputsSnapshot.getTrackedFileHashesForOperation(associatedProject, phaseName);
 
-            const cacheDisabledReason: string | undefined = projectConfiguration
-              ? projectConfiguration.getCacheDisabledReason(fileHashes.keys(), phaseName, operation.isNoOp)
-              : `Project does not have a ${RushConstants.rushProjectConfigFilename} configuration file, ` +
-                'or one provided by a rig, so it does not support caching.';
+            // Computing the reason checks each tracked file of the project, and an iteration of a long-lived graph
+            // (e.g. the Rush daemon) holds every operation of the workspace. It is only read for the operations
+            // that execute and for cobuild clustering, so it is computed once, when it is first read.
+            let cacheDisabledReason: string | undefined;
+            let isCacheDisabledReasonComputed: boolean = false;
+            const getCacheDisabledReason = (): string | undefined => {
+              if (!isCacheDisabledReasonComputed) {
+                cacheDisabledReason = getCacheDisabledReasonForOperation(
+                  projectConfiguration,
+                  fileHashes,
+                  phaseName,
+                  operation.isNoOp
+                );
+                isCacheDisabledReasonComputed = true;
+              }
+              return cacheDisabledReason;
+            };
 
             const outputFolderNames: string[] = [record.metadataFolderPath];
             const configuredOutputFolderNames: string[] | undefined = operationSettings?.outputFolderNames;
@@ -286,7 +300,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             // Captured even if cache writes are disabled, since a long-lived graph (e.g. the Rush daemon) must not
             // retain outputs that were built from input files that changed during the iteration.
             const inputFilesState: IInputFilesState | undefined =
-              !cacheDisabledReason && record.enabled
+              record.enabled && !getCacheDisabledReason()
                 ? captureInputFilesState(
                     inputsSnapshot.rootDirectory,
                     fileHashes.keys(),
@@ -301,7 +315,9 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               isCacheReadAllowed: isIncrementalBuildAllowed,
               operationBuildCache: undefined,
               outputFolderNames,
-              cacheDisabledReason,
+              get cacheDisabledReason(): string | undefined {
+                return getCacheDisabledReason();
+              },
               cobuildLock: undefined,
               cobuildClusterId: undefined,
               buildCacheTerminal: undefined,
@@ -1065,3 +1081,15 @@ export function clusterOperations(
     }
   }
 }
+
+function getCacheDisabledReasonForOperation(
+  projectConfiguration: RushProjectConfiguration | undefined,
+  fileHashes: ReadonlyMap<string, string>,
+  phaseName: string,
+  isNoOp: boolean
+): string | undefined {
+  return projectConfiguration
+    ? projectConfiguration.getCacheDisabledReason(fileHashes.keys(), phaseName, isNoOp)
+    : `Project does not have a ${RushConstants.rushProjectConfigFilename} configuration file, ` +
+        'or one provided by a rig, so it does not support caching.';
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
index e93441a49f..c9aab3e37f 100644
--- a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
@@ -238,4 +238,50 @@ describe(AsyncOperationQueue.name, () => {
     const rEnd: IteratorResult<OperationExecutionRecord> = await queue.next();
     expect(rEnd.done).toBe(true);
   });
+
+  it('keeps the order of the remaining operations when it removes finished operations', async () => {
+    const operations: OperationExecutionRecord[] = [];
+    for (let i: number = 0; i < 10; i++) {
+      operations.push(createRecord(`r${i}`));
+    }
+    const queue: AsyncOperationQueue = new AsyncOperationQueue(operations, nullSort);
+    for (let i: number = 1; i < operations.length; i += 2) {
+      operations[i].status = OperationStatus.Skipped;
+    }
+
+    const actualOrder: string[] = [];
+    for await (const operation of queue) {
+      actualOrder.push(operation.name);
+      operation.status = OperationStatus.Success;
+      queue.complete(operation);
+    }
+
+    // Without a preference, the ready operations are assigned from the end of the queue
+    expect(actualOrder).toEqual(['r8', 'r6', 'r4', 'r2', 'r0']);
+  });
+
+  it('stops scanning the queue once it has found a new operation for each waiting iterator', async () => {
+    const a: OperationExecutionRecord = createRecord('a');
+    const b: OperationExecutionRecord = createRecord('b');
+    const queue: AsyncOperationQueue = new AsyncOperationQueue([a, b], nullSort);
+
+    // The queue is scanned from its end, so "b" is found before "a"
+    let status: OperationStatus = a.status;
+    let isStatusRead: boolean = false;
+    Object.defineProperty(a, 'status', {
+      get: () => {
+        isStatusRead = true;
+        return status;
+      },
+      set: (value: OperationStatus) => {
+        status = value;
+      }
+    });
+
+    expect((await queue.next()).value).toBe(b);
+    expect(isStatusRead).toBe(false);
+
+    expect((await queue.next()).value).toBe(a);
+    expect(isStatusRead).toBe(true);
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index b0d532c5c8..9a2281d00b 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -60,6 +60,7 @@ import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { CobuildConfiguration } from '../../../api/CobuildConfiguration';
 import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
 import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
 import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
@@ -117,6 +118,10 @@ interface ITestGraph {
   localHashes: Map<string, string>;
   // The tracked input file hashes of each operation in the inputs snapshot, by name
   trackedFileHashes: Map<string, Map<string, string>>;
+  // The reason that caching is disabled for each operation, by name. Undefined if caching is allowed.
+  cacheDisabledReasons: Map<string, string>;
+  // The names of the operations whose reason that caching is disabled was computed, in order
+  cacheDisabledReasonComputations: string[];
   executions: string[];
   cacheWrites: string[];
   // Called when an operation executes, e.g. to save one of its input files while it executes
@@ -130,12 +135,15 @@ interface ITestGraph {
 async function createTestGraphAsync(
   names: string[],
   rootDirectory: string = '/repo',
-  cacheWriteEnabled: boolean = true
+  cacheWriteEnabled: boolean = true,
+  cobuildConfiguration: CobuildConfiguration | undefined = undefined
 ): Promise<ITestGraph> {
   const executions: string[] = [];
   const cacheWrites: string[] = [];
   const localHashes: Map<string, string> = new Map();
   const trackedFileHashes: Map<string, Map<string, string>> = new Map();
+  const cacheDisabledReasons: Map<string, string> = new Map();
+  const cacheDisabledReasonComputations: string[] = [];
   const operations: Map<string, Operation> = new Map();
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
   let onExecute: ((name: string) => void) | undefined;
@@ -147,7 +155,10 @@ async function createTestGraphAsync(
       projectFolder: `${rootDirectory}/${name}`
     } as unknown as RushConfigurationProject;
     projectConfigurations.set(project, {
-      getCacheDisabledReason: () => undefined
+      getCacheDisabledReason: () => {
+        cacheDisabledReasonComputations.push(name);
+        return cacheDisabledReasons.get(name);
+      }
     } as unknown as RushProjectConfiguration);
     const operation: Operation = new Operation({
       runner: new CacheableMockRunner(name, executions, (executedName: string) => onExecute?.(executedName)),
@@ -183,7 +194,7 @@ async function createTestGraphAsync(
       buildCacheEnabled: true,
       cacheWriteEnabled
     } as unknown as BuildCacheConfiguration,
-    cobuildConfiguration: undefined,
+    cobuildConfiguration,
     terminal,
     excludeAppleDoubleFiles: false,
     useDirectFileTransfersForBuildCache: false
@@ -207,6 +218,8 @@ async function createTestGraphAsync(
     operations,
     localHashes,
     trackedFileHashes,
+    cacheDisabledReasons,
+    cacheDisabledReasonComputations,
     executions,
     cacheWrites,
     get onExecute(): ((name: string) => void) | undefined {
@@ -218,6 +231,7 @@ async function createTestGraphAsync(
     executeAsync: async (workingTreeReadStartTimeMs?: number) => {
       executions.length = 0;
       cacheWrites.length = 0;
+      cacheDisabledReasonComputations.length = 0;
       const inputsSnapshot: IInputsSnapshot = {
         hashes: new Map(),
         rootDirectory,
@@ -507,4 +521,55 @@ describe(CacheableOperationPlugin.name, () => {
       }
     );
   });
+
+  describe('reason that caching is disabled', () => {
+    const cacheDisabledReason: string = 'Caching has been disabled for this project.';
+
+    it('is only computed for the operations that execute', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+      await testGraph.executeAsync();
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['a', 'b', 'c']);
+
+      testGraph.localHashes.set('c', 'c-v2');
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
+      expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
+      expect(testGraph.executions).toEqual(['c']);
+      expect(testGraph.cacheWrites).toEqual(['c']);
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['c']);
+    });
+
+    it('is computed once for each operation that executes', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+      testGraph.cacheDisabledReasons.set('b', cacheDisabledReason);
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(result.status).toBe(OperationStatus.Success);
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'c']);
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['a', 'b', 'c']);
+    });
+
+    it('is computed for every operation if cobuilds are enabled, to cluster the operations', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c'], '/repo', true, {
+        cobuildFeatureEnabled: true,
+        cobuildContextId: undefined
+      } as unknown as CobuildConfiguration);
+      // Without a build cache, an operation does not acquire a cobuild lock
+      for (const name of ['a', 'b', 'c']) {
+        testGraph.cacheDisabledReasons.set(name, cacheDisabledReason);
+      }
+      await testGraph.executeAsync();
+
+      testGraph.localHashes.set('c', 'c-v2');
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
+      expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
+      expect(testGraph.executions).toEqual(['c']);
+      expect([...testGraph.cacheDisabledReasonComputations].sort()).toEqual(['a', 'b', 'c']);
+    });
+  });
 });

From a3d3e65a1a9ec12c832f5d05e18de045ea308349 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:16 +0000
Subject: [PATCH 066/265] [rush-lib] A public beta API lets a plugin runner run
 :incremental under task 106's guard

Swarm integration step 51; original commit e39062a035 (merge of swarm/r06-t131-int2 at 52c86b3174).
Scope: task 131.

Brings r06's task 131: rush-lib exposes a @beta API so that a plugin runner such as rush-fstrace-plugin can run an `:incremental` phase under task 106's L1a guard, re-tipped on 1b51e7af08 (board 2747). Second agent: o03 board 2360 on cb0891d79d. The test-file conflict in 7b8e8c665b keeps both sides.

s16 batch C, item 6 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree 07ac5f0139)

Commits folded into this step (1):
- cb0891d79d [rush-lib] Let operation runners from plugins use the incremental execution guard

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...incremental-plugin-runners_2026-09-28.json |  11 ++
 common/reviews/api/rush-lib.api.md            |  14 ++
 docs/rush/plugin-migration-guide.md           |   2 +
 libraries/rush-lib/src/index.ts               |   4 +
 .../src/logic/operations/IOperationRunner.ts  |  33 ++++
 .../operations/IncrementalExecutionState.ts   |  14 +-
 .../operations/OperationExecutionRecord.ts    |  20 +++
 .../IncrementalExecutionGuardPlugin.test.ts   | 158 ++++++++++++++++--
 .../test/OperationExecutionRecord.test.ts     |  38 +++++
 9 files changed, 280 insertions(+), 14 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-incremental-plugin-runners_2026-09-28.json

diff --git a/common/changes/@microsoft/rush/rushd-incremental-plugin-runners_2026-09-28.json b/common/changes/@microsoft/rush/rushd-incremental-plugin-runners_2026-09-28.json
new file mode 100644
index 0000000000..66df6fac25
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-incremental-plugin-runners_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `IOperationRunnerContext.getIncrementalExecutionGuard()` and `IOperationRunnerContext.reportCommandExecution()` (beta), so that an operation runner from a Rush plugin can run its incremental command in the Rush daemon under the same guard as `<phase>:incremental` scripts. Results that it reports as incremental are never written to the build cache.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 8fa1c09a04..2a09f55a8f 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -618,6 +618,12 @@ export interface IGlobalCommand extends IRushCommand {
     setHandled(): void;
 }
 
+// @beta
+export interface IIncrementalExecutionGuard {
+    getBlockReasonAsync(): Promise<string | undefined>;
+    verifyIncrementalResultAsync(): Promise<string | undefined>;
+}
+
 // @public
 export interface IIndividualVersionJson extends IVersionPolicyJson {
     // (undocumented)
@@ -714,6 +720,12 @@ export interface _IOperationChildProcessReporter {
     readonly stdio: child_process.StdioOptions;
 }
 
+// @beta
+export interface IOperationCommandExecution {
+    readonly hasIncrementalCommand: boolean;
+    readonly kind: 'initial' | 'incremental';
+}
+
 // @alpha
 export interface IOperationExecutionResult extends IBaseOperationExecutionResult, IOperationLastState {
     readonly enabled: boolean;
@@ -845,10 +857,12 @@ export interface IOperationRunnerContext {
     debugMode: boolean;
     environment: IEnvironment | undefined;
     error?: Error;
+    getIncrementalExecutionGuard?(): IIncrementalExecutionGuard | undefined;
     getInvalidateCallback(): (reason: string) => void;
     // @internal
     _operationMetadataManager: _OperationMetadataManager;
     quietMode: boolean;
+    reportCommandExecution?(execution: IOperationCommandExecution): void;
     runWithTerminalAsync<T>(callback: (terminal: ITerminal, terminalProvider: ITerminalProvider, structuredChildOutputTerminalProvider: ITerminalProvider) => Promise<T>, options: {
         createLogFile: boolean;
         logFileSuffix?: string;
diff --git a/docs/rush/plugin-migration-guide.md b/docs/rush/plugin-migration-guide.md
index 5ea09366bb..961a2432f2 100644
--- a/docs/rush/plugin-migration-guide.md
+++ b/docs/rush/plugin-migration-guide.md
@@ -322,6 +322,8 @@ class MyRunner implements IOperationRunner {
 
 This is how `ShellOperationRunner` selects between the `initialCommand` and `incrementalCommand` scripts defined in `rush-project.json`.
 
+Outside watch mode, the Rush daemon can also give a runner a `lastState`, but `ShellOperationRunner` runs the incremental command there only when the operation's incremental execution guard allows it. A custom runner can use the same guard through `context.getIncrementalExecutionGuard?.()` and `context.reportCommandExecution?.()` (beta); the documentation of `getIncrementalExecutionGuard` gives the steps. Rush treats the outputs of a runner that doesn't report its commands as the outputs of its initial command, and may write them to the build cache, so such a runner must not run its incremental command outside watch mode.
+
 > **Note:** `lastState` is only populated if the operation reached a completed terminal state (`Success`, `SuccessWithWarning`, `Failure`, `FromCache`, or `NoOp`) in a prior iteration. If the previous iteration was aborted before the operation began executing, or if the operation was `Skipped` or `Blocked`, `lastState` will still be `undefined` on the next call. Runners must not assume that a non-`undefined` `lastState` means the previous run succeeded — check `lastState.status` if the prior outcome matters for your incremental logic.
 >
 > To request re-execution from a long-lived runner, use `context.getInvalidateCallback()` on the `IOperationRunnerContext` to obtain a `(reason: string) => void` callback. This is available from the very first call to `executeAsync`, regardless of whether a previous result exists.
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index 431949409e..f9fa44afde 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -164,6 +164,10 @@ export type {
   IOperationRunnerContext,
   IOperationLastState
 } from './logic/operations/IOperationRunner';
+export type {
+  IIncrementalExecutionGuard,
+  IOperationCommandExecution
+} from './logic/operations/IncrementalExecutionState';
 export type {
   IConfigurableOperation,
   IBaseOperationExecutionResult,
diff --git a/libraries/rush-lib/src/logic/operations/IOperationRunner.ts b/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
index f422083d85..b880671778 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationRunner.ts
@@ -9,6 +9,7 @@ import type { OperationMetadataManager } from './OperationMetadataManager';
 import type { IStopwatchResult } from '../../utilities/Stopwatch';
 import type { IEnvironment } from '../../utilities/Utilities';
 import type { IOperationChildProcessReporter } from './OperationEventSink';
+import type { IIncrementalExecutionGuard, IOperationCommandExecution } from './IncrementalExecutionState';
 
 /**
  * A snapshot of a previous operation execution, passed to runners to inform incremental behavior.
@@ -90,6 +91,38 @@ export interface IOperationRunnerContext {
    */
   getInvalidateCallback(): (reason: string) => void;
 
+  /**
+   * Returns the guard that decides whether this operation may run its incremental command outside watch mode, or
+   * `undefined` if nothing guards incremental commands in this process, for example outside the Rush daemon.
+   *
+   * @remarks
+   * It is optional because older versions of Rush do not have it. A runner that has an incremental command and runs
+   * outside watch mode follows the same steps as Rush's own shell command runner:
+   *
+   * 1. If it has no last state, or there is no guard, it runs its initial command.
+   *
+   * 2. If `getBlockReasonAsync()` returns a reason, it writes
+   * `Not using the incremental command because <reason>.` and runs its initial command.
+   *
+   * 3. Otherwise it runs its incremental command. If that succeeds and `verifyIncrementalResultAsync()` returns a
+   * reason, it writes `Running the initial command, because <reason>.` and runs its initial command.
+   *
+   * If either method rejects, the runner treats the error like a reason. Before it starts each command, the runner
+   * calls {@link IOperationRunnerContext.reportCommandExecution}. The guard never allows the incremental command of an
+   * operation whose runner did not report the command of its last successful run.
+   */
+  getIncrementalExecutionGuard?(): IIncrementalExecutionGuard | undefined;
+
+  /**
+   * Records which command the runner is about to execute for this operation. Call it before starting each command,
+   * so that the outputs of a command that fails or is aborted are attributed to it too.
+   *
+   * @remarks
+   * It is optional because older versions of Rush do not have it. The outputs of an incremental command, and of
+   * operations built against them, are never written to the build cache.
+   */
+  reportCommandExecution?(execution: IOperationCommandExecution): void;
+
   /**
    * Allocates a negotiated reporter channel for a child process, when enabled.
    *
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
index 76e0520809..dea5f04106 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
@@ -20,7 +20,10 @@ export const NATIVE_COMMAND_INVALIDATION_REASON: 'native-command-completed' = 'n
 
 /**
  * Decides whether an operation may run its `:incremental` command outside watch mode.
- * Registered per execution record by {@link IncrementalExecutionGuardPlugin}.
+ * The Rush daemon registers one for each execution record. Runners get it from
+ * {@link IOperationRunnerContext.getIncrementalExecutionGuard}.
+ *
+ * @beta
  */
 export interface IIncrementalExecutionGuard {
   /**
@@ -35,10 +38,17 @@ export interface IIncrementalExecutionGuard {
   verifyIncrementalResultAsync(): Promise<string | undefined>;
 }
 
+/**
+ * The name that rush-lib's own runners and plugins use for {@link IOperationCommandExecution}.
+ */
+export type ICommandExecution = IOperationCommandExecution;
+
 /**
  * Which command an operation runner executed for an operation in one iteration.
+ *
+ * @beta
  */
-export interface ICommandExecution {
+export interface IOperationCommandExecution {
   /**
    * The command that produced the final outputs.
    */
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index f786b97113..310c99c409 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -39,6 +39,12 @@ import {
   type ILogFilePaths,
   initializeProjectLogFilesAsync
 } from './ProjectLogWritable';
+import {
+  getIncrementalExecutionGuard,
+  setCommandExecution,
+  type IIncrementalExecutionGuard,
+  type IOperationCommandExecution
+} from './IncrementalExecutionState';
 
 /**
  * @internal
@@ -307,6 +313,20 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     return this.#context.eventSink?.createChildProcessReporter?.(this.name, this.iterationId);
   }
 
+  /**
+   * {@inheritdoc IOperationRunnerContext.getIncrementalExecutionGuard}
+   */
+  public getIncrementalExecutionGuard(): IIncrementalExecutionGuard | undefined {
+    return getIncrementalExecutionGuard(this);
+  }
+
+  /**
+   * {@inheritdoc IOperationRunnerContext.reportCommandExecution}
+   */
+  public reportCommandExecution({ kind, hasIncrementalCommand }: IOperationCommandExecution): void {
+    setCommandExecution(this, { kind, hasIncrementalCommand });
+  }
+
   public get silent(): boolean {
     return !this.enabled || this.runner.silent;
   }
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 425705774f..a843903840 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -48,18 +48,26 @@ import { PassThrough } from 'node:stream';
 
 import { LookupByPath } from '@rushstack/lookup-by-path';
 import { SubprocessTerminator } from '@rushstack/node-core-library';
-import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { type ITerminal, MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { IOperationSettings, RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import type {
+  IIncrementalExecutionGuard,
+  IOperationCommandExecution,
+  IOperationLastState,
+  IOperationRunner,
+  IOperationRunnerContext
+} from '../../../index';
 import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
 import { Utilities } from '../../../utilities/Utilities';
 import { InputsSnapshot, type IInputsSnapshotProjectMetadata } from '../../incremental/InputsSnapshot';
 import { IncrementalExecutionGuardPlugin } from '../IncrementalExecutionGuardPlugin';
 import {
   INPUTS_CHANGED_INVALIDATION_REASON,
-  NATIVE_COMMAND_INVALIDATION_REASON
+  NATIVE_COMMAND_INVALIDATION_REASON,
+  wasExecutedIncrementally
 } from '../IncrementalExecutionState';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import { LegacySkipPlugin } from '../LegacySkipPlugin';
@@ -110,6 +118,11 @@ interface IProjectSpec {
    * Files outside of the project that its build depends on, like `dependsOnAdditionalFiles` in rush-project.json
    */
   readonly additionalFiles?: ReadonlyArray<string>;
+  /**
+   * If set, the operation runs in a runner like that of a Rush plugin, which uses only the public API of Rush and runs
+   * the build itself. An `unreported` runner asks the guard, but never reports which command it runs.
+   */
+  readonly pluginRunner?: 'reported' | 'unreported';
 }
 
 interface IWorkspaceOptions {
@@ -211,6 +224,73 @@ function build(projectFolder: string, isBundle: boolean, isIncremental: boolean)
   return 0;
 }
 
+/**
+ * Runs the build itself, like the runner of a Rush plugin, and uses only the public API of Rush. It follows the steps
+ * that the documentation of `IOperationRunnerContext.getIncrementalExecutionGuard` describes.
+ */
+class PluginOperationRunner implements IOperationRunner {
+  public readonly name: string;
+  public readonly cacheable: boolean = true;
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly warningsAreAllowed: boolean = false;
+  readonly #runBuild: (kind: IOperationCommandExecution['kind']) => number | undefined;
+  readonly #reportsCommandExecutions: boolean;
+
+  public constructor(
+    name: string,
+    runBuild: (kind: IOperationCommandExecution['kind']) => number | undefined,
+    reportsCommandExecutions: boolean
+  ) {
+    this.name = name;
+    this.#runBuild = runBuild;
+    this.#reportsCommandExecutions = reportsCommandExecutions;
+  }
+
+  public async executeAsync(
+    context: IOperationRunnerContext,
+    lastState?: IOperationLastState
+  ): Promise<OperationStatus> {
+    return await context.runWithTerminalAsync(
+      async (terminal: ITerminal): Promise<OperationStatus> => {
+        const guard: IIncrementalExecutionGuard | undefined = lastState
+          ? context.getIncrementalExecutionGuard?.()
+          : undefined;
+        if (!guard) {
+          return this.#run(context, 'initial');
+        }
+        const blockReason: string | undefined = await guard.getBlockReasonAsync();
+        if (blockReason !== undefined) {
+          terminal.writeLine(`Not using the incremental command because ${blockReason}.`);
+          return this.#run(context, 'initial');
+        }
+        const status: OperationStatus = this.#run(context, 'incremental');
+        if (status !== OperationStatus.Success) {
+          return status;
+        }
+        const rerunReason: string | undefined = await guard.verifyIncrementalResultAsync();
+        if (rerunReason === undefined) {
+          return status;
+        }
+        terminal.writeLine(`Running the initial command, because ${rerunReason}.`);
+        return this.#run(context, 'initial');
+      },
+      { createLogFile: false }
+    );
+  }
+
+  public getConfigHash(): string {
+    return INITIAL_COMMAND;
+  }
+
+  #run(context: IOperationRunnerContext, kind: IOperationCommandExecution['kind']): OperationStatus {
+    if (this.#reportsCommandExecutions) {
+      context.reportCommandExecution?.({ kind, hasIncrementalCommand: true });
+    }
+    return this.#runBuild(kind) === 0 ? OperationStatus.Success : OperationStatus.Failure;
+  }
+}
+
 async function createWorkspaceAsync(
   projectSpecs: ReadonlyArray<IProjectSpec>,
   { hasPassThroughPhase, hasLegacySkipDetection }: IWorkspaceOptions = {}
@@ -325,21 +405,27 @@ async function createWorkspaceAsync(
     outputFolderByPrefix.set(name, outputFolderName);
     specByFolder.set(projectFolder, spec);
 
+    const runBuild = (kind: IOperationCommandExecution['kind']): number | undefined => {
+      commands.push(`${name}:${kind}`);
+      return build(projectFolder, !!isBundle, kind === 'incremental');
+    };
     const operation: Operation = new Operation({
       phase: buildPhase,
       project,
       settings,
       logFilenameIdentifier: '_phase_build',
-      runner: new ShellOperationRunner({
-        phase: buildPhase,
-        rushProject: project,
-        displayName: name,
-        initialCommand: INITIAL_COMMAND,
-        incrementalCommand: INCREMENTAL_COMMAND,
-        incrementalCommandRequiresGuard: true,
-        commandForHash: INITIAL_COMMAND,
-        ignoredParameterValues: []
-      })
+      runner: spec.pluginRunner
+        ? new PluginOperationRunner(name, runBuild, spec.pluginRunner === 'reported')
+        : new ShellOperationRunner({
+            phase: buildPhase,
+            rushProject: project,
+            displayName: name,
+            initialCommand: INITIAL_COMMAND,
+            incrementalCommand: INCREMENTAL_COMMAND,
+            incrementalCommandRequiresGuard: true,
+            commandForHash: INITIAL_COMMAND,
+            ignoredParameterValues: []
+          })
     });
     let dependent: Operation = operation;
     if (hasPassThroughPhase) {
@@ -848,4 +934,52 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
       'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
     );
   });
+
+  describe('with a runner that uses the public API, like that of a Rush plugin', () => {
+    const wasIterationIncremental = (workspace: ITestWorkspace, iteration: ITestIteration): boolean =>
+      wasExecutedIncrementally(iteration.result.operationResults.get(workspace.operations.get('a')!)!);
+
+    it('runs its incremental command when the guard allows it, and its initial command otherwise', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', pluginRunner: 'reported' }]);
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const edited: ITestIteration = await workspace.executeAsync();
+      expect(edited.commands).toEqual(['a:incremental']);
+      expect(edited.getStatus('a')).toBe(OperationStatus.Success);
+      // So the build cache and legacy skip detection ignore its outputs.
+      expect(wasIterationIncremental(workspace, edited)).toBe(true);
+
+      workspace.writeFile('a/src/three.ts', 'three');
+      const added: ITestIteration = await workspace.executeAsync();
+      expect(added.commands).toEqual(['a:initial']);
+      expect(added.output).toContain(
+        'Not using the incremental command because input files were added, deleted or renamed ("a/src/three.ts").'
+      );
+      expect(wasIterationIncremental(workspace, added)).toBe(false);
+
+      workspace.writeFile('a/src/one.ts', 'one emit:chunk');
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+      expect(changed.output).toContain(
+        'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").'
+      );
+      expect(wasIterationIncremental(workspace, changed)).toBe(false);
+    });
+
+    it('never runs its incremental command if it does not report which command it runs', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([
+        { name: 'a', pluginRunner: 'unreported' }
+      ]);
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const edited: ITestIteration = await workspace.executeAsync();
+      expect(edited.commands).toEqual(['a:initial']);
+      expect(edited.output).toContain(
+        'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+      );
+      expect(wasIterationIncremental(workspace, edited)).toBe(false);
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
index 6919cc704b..25d66cf0c7 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
@@ -6,6 +6,12 @@ import type { RushConfigurationProject } from '../../../api/RushConfigurationPro
 import type { IOperationSettings } from '../../../api/RushProjectConfiguration';
 import { Operation } from '../Operation';
 import { type IOperationExecutionRecordContext, OperationExecutionRecord } from '../OperationExecutionRecord';
+import {
+  getCommandExecution,
+  setIncrementalExecutionGuard,
+  wasExecutedIncrementally,
+  type IIncrementalExecutionGuard
+} from '../IncrementalExecutionState';
 import { MockOperationRunner } from './MockOperationRunner';
 
 const MOCK_PHASE: IPhase = {
@@ -125,4 +131,36 @@ describe(OperationExecutionRecord.name, () => {
       expect(record.weight).toBe(2);
     });
   });
+
+  describe('incremental execution', () => {
+    it('returns the incremental execution guard that a plugin registered for the record', () => {
+      const operation: Operation = createOperation({ project: createProject('project-guarded') });
+      const record: OperationExecutionRecord = createRecord(operation);
+      expect(record.getIncrementalExecutionGuard()).toBeUndefined();
+
+      const guard: IIncrementalExecutionGuard = {
+        getBlockReasonAsync: async () => undefined,
+        verifyIncrementalResultAsync: async () => undefined
+      };
+      setIncrementalExecutionGuard(record, guard);
+      expect(record.getIncrementalExecutionGuard()).toBe(guard);
+      // The guard belongs to the record of one iteration, not to the operation.
+      expect(createRecord(operation).getIncrementalExecutionGuard()).toBeUndefined();
+    });
+
+    it('records the command execution that the runner reports', () => {
+      const record: OperationExecutionRecord = createRecord(
+        createOperation({ project: createProject('project-reported') })
+      );
+      expect(getCommandExecution(record)).toBeUndefined();
+
+      record.reportCommandExecution({ kind: 'incremental', hasIncrementalCommand: true });
+      expect(getCommandExecution(record)).toEqual({ kind: 'incremental', hasIncrementalCommand: true });
+      expect(wasExecutedIncrementally(record)).toBe(true);
+
+      // The last report counts, e.g. when the guard made the runner run its initial command after the incremental one.
+      record.reportCommandExecution({ kind: 'initial', hasIncrementalCommand: true });
+      expect(wasExecutedIncrementally(record)).toBe(false);
+    });
+  });
 });

From 8e8621dbcda155918a9779cfa1dc199294616b1b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:06:16 +0000
Subject: [PATCH 067/265] [rush-daemon] Answer a usage error only from a
 session that a build bound and checked

Swarm integration step 52; original commit e12c8f3632 (merge of swarm/r04-t78-nit1 at 86a46e1d75).
Scope: task 78 NIT 1.

Brings r04's fix for o04's NIT 1 on task 78 (board 2801): the daemon answers a usage error only from a session that a build bound and checked. Second agent: o04 board 2948.

s16 batch C, item 7 of 7 (ch01 board 3099).

Gate: ch01 GATE OK board 3099 (tree 1af262606d)

Commits folded into this step (1):
- 86a46e1d75 Answer a usage error only from a session that a build bound and checked (task 78 follow-up, o04 board 2801 NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...tartup-configuration_2026-09-29-01-40.json | 11 +++++
 .../src/WorkspaceRequestLifecycle.ts          | 22 ++++++---
 .../src/test/DaemonGraphTestFixture.ts        |  3 ++
 .../src/test/DaemonRequestUsageError.test.ts  | 48 ++++++++++++++++++-
 4 files changed, 77 insertions(+), 7 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t78-startup-configuration_2026-09-29-01-40.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t78-startup-configuration_2026-09-29-01-40.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-startup-configuration_2026-09-29-01-40.json
new file mode 100644
index 0000000000..2aa6af259f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-startup-configuration_2026-09-29-01-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "An invalid build or rebuild command line that reaches the daemon before its first build now runs in-process, as it does after a configuration change. The configuration that the daemon loads when it starts can miss an edit made while it starts, for example to experiments.json, so only a build checks it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 156664e949..a0e615a4e8 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -551,7 +551,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         commandIdentity = await getCommandParameterIdentityAsync(
           this.#resolver,
           { envelope, workspaceSession: session, abortSignal: client.abortSignal },
-          tier
+          this.#isConfigurationCurrent(session, tier)
         );
         if (tier === WorkspaceInputChangeTier.Reuse) {
           projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session, receivedTimeMs);
@@ -642,7 +642,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       commandIdentity = await getCommandParameterIdentityAsync(
         this.#resolver,
         { envelope, workspaceSession: session, abortSignal: client.abortSignal },
-        tier
+        this.#isConfigurationCurrent(session, tier)
       );
       if (
         this.#boundSession === session &&
@@ -809,6 +809,16 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Whether the session's configuration is known to match the workspace inputs: a reload bound this session after
+   * checking that its inputs did not change while it loaded, and they have not changed since. The session that the
+   * daemon loads at startup is not checked that way. An edit made after it loaded, while the startup capture runs,
+   * is in the startup fingerprint but not in the session.
+   */
+  #isConfigurationCurrent(session: IWorkspaceSession, tier: WorkspaceInputChangeTier): boolean {
+    return tier === WorkspaceInputChangeTier.Reuse && this.#boundSession === session && !this.#forceReload;
+  }
+
   #captureAsync(
     session: IWorkspaceSession,
     envelope: IDaemonRequestEnvelope,
@@ -1129,19 +1139,19 @@ function getResolverLifecycle(resolver: IDaemonRequestResolver): IWorkspaceResol
 
 /**
  * Parses the command with the session's configuration. A command line that this configuration rejects fails as
- * native Rush would, unless the configuration changed since the session loaded it (`tier` is not
- * `WorkspaceInputChangeTier.Reuse`): native Rush might accept the command line then, so the client runs it
+ * native Rush would only if the configuration is current (`isConfigurationCurrent`). Otherwise native Rush might
+ * accept the command line, for example with a parameter that experiments.json adds, so the client runs it
  * in-process instead.
  */
 async function getCommandParameterIdentityAsync(
   resolver: IDaemonRequestResolver,
   options: IResolveDaemonRequestOptions,
-  tier: WorkspaceInputChangeTier
+  isConfigurationCurrent: boolean
 ): Promise<string> {
   try {
     return await getResolverLifecycle(resolver).getCommandParameterIdentityAsync(options);
   } catch (error) {
-    if (error instanceof DaemonRequestUsageError && tier !== WorkspaceInputChangeTier.Reuse) {
+    if (error instanceof DaemonRequestUsageError && !isConfigurationCurrent) {
       throw new DaemonRequestDispatchError('unsupported', error.message, { cause: error });
     }
     throw error;
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index d1c90fb8e2..bd78e3072a 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -41,6 +41,8 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   public readonly logs: string[] = [];
   /** Awaited before each workspace session is created, including a request's graph load or reload. */
   public beforeCreateSessionAsync: (() => Promise<void>) | undefined;
+  /** Awaited after each workspace session is created, before the host or the request that created it uses it. */
+  public afterCreateSessionAsync: (() => Promise<void>) | undefined;
   /** Also serves rushx package scripts, like the production host. Set it in `createAsync`'s `configure`. */
   public servesRushx: boolean = false;
   public readonly folder: string = fs.realpathSync.native(
@@ -170,6 +172,7 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
       createWorkspaceSessionAsync: async (options) => {
         await this.beforeCreateSessionAsync?.();
         this.session = await WorkspaceSession.createAsync(options);
+        await this.afterCreateSessionAsync?.();
         return this.session;
       }
     });
diff --git a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
index 1c2966e172..c333f2b618 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
@@ -17,10 +17,15 @@ const usageFailure: object = {
 const inProcess: object = { kind: 'requestRejected', payload: { code: 'unsupported', message } };
 const success: object = { kind: 'requestResult', payload: { exitCode: 0 } };
 
+function experimentsJson(useIPCScriptsInWatchMode: boolean): string {
+  return JSON.stringify({ useIPCScriptsInWatchMode });
+}
+
 it('fails an invalid command line with the exit code of native Rush instead of handing it to in-process Rush', async () => {
   const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
   try {
-    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    // Until a build binds a session, the daemon has not checked the configuration that it loaded at startup.
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(inProcess);
     expect((await fixture.buildAsync()).terminal).toMatchObject(success);
     const generation: number = fixture.host.workspaceGeneration;
     const graph: IOperationGraph | undefined = fixture.session.operationGraph;
@@ -59,3 +64,44 @@ it('hands an invalid command line to in-process Rush after a configuration chang
     await fixture[Symbol.asyncDispose]();
   }
 });
+
+it('hands an invalid command line to in-process Rush when the configuration changed while the daemon started', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
+    // A build that has watch phases gets --no-ipc when experiments.json turns on useIPCScriptsInWatchMode.
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: [
+          {
+            commandKind: 'phased',
+            name: 'build',
+            phases: ['_phase:compile'],
+            incremental: true,
+            enableParallelism: true,
+            watchOptions: { alwaysWatch: false, watchPhases: ['_phase:compile'] }
+          }
+        ]
+      })
+    );
+    created.write('common/config/rush/experiments.json', experimentsJson(false));
+    created.afterCreateSessionAsync = async () => {
+      created.afterCreateSessionAsync = undefined;
+      // The startup capture reads this edit, but the session that the daemon loaded read experiments.json before it.
+      created.write('common/config/rush/experiments.json', experimentsJson(true));
+    };
+  });
+  try {
+    const noIpc: string[] = ['build', '--to', 'b', '--no-ipc'];
+    expect((await fixture.runAsync(noIpc)).terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { code: 'unsupported', message: 'rush build: error: Unrecognized arguments: --no-ipc.' }
+    });
+    // The first build binds a session that reads the edited experiments.json.
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(noIpc)).terminal).toMatchObject(success);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});

From f5290071ccbbef5512db1af217802e0faaf5c191 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:05 +0000
Subject: [PATCH 068/265] [node-core-library] Test the edges of LockFile's time
 zone check

Swarm integration step 53; original commit b122243826 (merge of o07/lockfile-tzrule-nits at 48fbc7ee88).
Scope: task 121 NITs.

Brings o07's fixes for ch01's 4 test NITs on task 121 (board 2972): tests, one doc sentence and a type-none change file. The branch is in <swarm path>, fetched read-only for this merge.

s17 batch D1, item 1 of 10 (ch01 board 3310). Gate: ch01 GATE OK board 3104 and board 3310 (tree 20d42b41b6)

Commits folded into this step (1):
- 48fbc7ee88 [node-core-library] Test the edges of LockFile's time zone check

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../lockfile-time-zone-tests_2026-09-29.json  | 10 +++++++
 libraries/node-core-library/src/LockFile.ts   |  4 +++
 .../src/test/LockFile.test.ts                 | 28 ++++++++++++++++++-
 3 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/node-core-library/lockfile-time-zone-tests_2026-09-29.json

diff --git a/common/changes/@rushstack/node-core-library/lockfile-time-zone-tests_2026-09-29.json b/common/changes/@rushstack/node-core-library/lockfile-time-zone-tests_2026-09-29.json
new file mode 100644
index 0000000000..abd6bb1749
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/lockfile-time-zone-tests_2026-09-29.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}
diff --git a/libraries/node-core-library/src/LockFile.ts b/libraries/node-core-library/src/LockFile.ts
index 881287ff34..bb113c8f91 100644
--- a/libraries/node-core-library/src/LockFile.ts
+++ b/libraries/node-core-library/src/LockFile.ts
@@ -613,6 +613,10 @@ const MAX_TIME_ZONE_OFFSET_MS: number = 14 * 60 * 60 * 1000;
  * On Linux, the start time that "ps" reports for a process moves with the system clock.  So if the clock is
  * changed by more than START_TIME_TOLERANCE_MS while a process holds a lock, this can return false for the
  * lockfile of that process, which is then treated as stale.
+ *
+ * A custom POSIX TZ string can set an offset that no time zone has, such as TZ=XYZ-5:07.  This returns false
+ * for a start time written with such an offset, so a process with another time zone treats that lockfile as
+ * stale.
  */
 function _isStartTimeInSomeTimeZone(lockFileStartTime: string, startTimeMs: number): boolean {
   const lockFileStartTimeMs: number | undefined = _parseLstartAsUtcMs(lockFileStartTime);
diff --git a/libraries/node-core-library/src/test/LockFile.test.ts b/libraries/node-core-library/src/test/LockFile.test.ts
index bec5b86e03..1925c93e27 100644
--- a/libraries/node-core-library/src/test/LockFile.test.ts
+++ b/libraries/node-core-library/src/test/LockFile.test.ts
@@ -724,7 +724,10 @@ describe(LockFile.name, () => {
         test.each<[string, string, number]>([
           ['5 hours and 45 minutes ahead of UTC', '20', (5 * 60 + 45) * 60 * 1000],
           ['12 hours behind UTC', '21', -12 * 60 * 60 * 1000],
-          ['7 hours behind UTC, printed 2 seconds off', '22', -7 * 60 * 60 * 1000 + 2000]
+          ['7 hours behind UTC, printed 2 seconds off', '22', -7 * 60 * 60 * 1000 + 2000],
+          ['7 hours behind UTC, printed 2 seconds early', '31', -7 * 60 * 60 * 1000 - 2000],
+          ['14 hours ahead of UTC, printed 3 seconds late', '32', 14 * 60 * 60 * 1000 + 3000],
+          ['12 hours behind UTC, printed 3 seconds early', '33', -12 * 60 * 60 * 1000 - 3000]
         ])(
           'cannot acquire a lock if the other process wrote its start time in a time zone %s',
           (description: string, folderName: string, offsetMs: number) => {
@@ -743,6 +746,7 @@ describe(LockFile.name, () => {
 
         test.each<[string, string, number]>([
           ['7 minutes after', '23', 7 * 60 * 1000],
+          ['15 hours after', '34', 15 * 60 * 60 * 1000],
           ['25 hours after', '24', 25 * 60 * 60 * 1000],
           ['13 hours before', '25', -13 * 60 * 60 * 1000]
         ])(
@@ -1098,6 +1102,28 @@ describe(LockFile.name, () => {
             expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
           });
 
+          test('keeps a lockfile with a start time from another time zone if /proc/[pid]/stat cannot be read', () => {
+            const testFolder: string = path.join(libTestFolder, '35');
+            const otherPids: number[] = startProcesses(1);
+            // UTC+5:45, or UTC-12 if that is the local time zone
+            const otherTimeZone: string = new Date().getTimezoneOffset() === -345 ? 'XYZ+12' : 'XYZ-05:45';
+            const otherPidStartTime: string = getLstartWithCLocale(otherPids[0], otherTimeZone);
+            const otherPidLockFileNames: string[] = createNewerLockFiles(
+              testFolder,
+              otherPids,
+              () => otherPidStartTime
+            );
+            mockReadFile(`/proc/${otherPids[0]}/stat`, createEaccesError());
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndKeep(testFolder, otherPidLockFileNames);
+
+            // "ps" printed another start time for it, so the time zone check kept the lockfile.
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
+            expect(getStartTimeSpy.mock.results[1].value).not.toEqual(otherPidStartTime);
+          });
+
           test('does not run "ps" for them if they wrote their start times with other time zones or locales', () => {
             const testFolder: string = path.join(libTestFolder, '28');
             const otherPids: number[] = startProcesses(3);

From ef98cd239ab7c922df905c0499c50cc9f07648b0 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:05 +0000
Subject: [PATCH 069/265] [rush-daemon-protocol] Name the variables when a
 command's environment restarted the daemon

Swarm integration step 54; original commit 898ff4dba1 (merge of swarm/r06-t88 at 04c6fb9d5a).
Scope: task 88.

Brings r06's fix for task 88 (board 2886): when a request restarts the daemon, or follows a restarted one, the client prints one line naming the differing variables (names only). Second agent: t07 board 2961.

s17 batch D1, item 2 of 10. Gate: ch01 GATE OK board 3310 (tree ad9aa75f8c)

Commits folded into this step (3):
- ffbe43c152 [rush-daemon-protocol] Add the environmentChanged restart reason (task 88)
- 8afd905246 [rush-daemon] Name the variables when the daemon restarts for an environment (task 88)
- 04c6fb9d5a [rush-cli-client] Name the variables when a command's environment restarted the daemon (task 88)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   9 ++
 .../src/daemonRestartNotice.ts                |  35 ++++-
 .../src/test/daemonRestartNotice.test.ts      |  32 ++++-
 .../src/test/nativeBuild.test.ts              |   9 +-
 ...nment-restart-reason_2026-09-29-01-35.json |  11 ++
 ...nment-restart-reason_2026-09-29-01-15.json |  11 ++
 ...nment-restart-reason_2026-09-29-01-30.json |  11 ++
 .../reviews/api/rush-daemon-protocol.api.md   |   8 +-
 libraries/rush-daemon-protocol/README.md      |   3 +
 .../src/DaemonEnvironmentChange.ts            |  19 +++
 .../src/DaemonInstallationChange.ts           |   6 +-
 .../src/EnvironmentChangeValidation.ts        |  18 +++
 .../src/InstallationChangeValidation.ts       |   3 +
 libraries/rush-daemon-protocol/src/index.ts   |   1 +
 .../src/test/EnvironmentChange.test.ts        |  78 +++++++++++
 .../src/test/InstallationChange.test.ts       |   2 +-
 .../src/test/QueuedRestartReason.test.ts      |   2 +-
 libraries/rush-daemon/README.md               |   8 ++
 .../src/EnvironmentRestartReason.ts           |  39 ++++++
 .../src/WorkspaceRequestAdmission.ts          |   4 +-
 .../src/WorkspaceRequestLifecycle.ts          |  55 ++++++--
 .../src/test/EnvironmentRestartReason.test.ts |  62 +++++++++
 .../WorkspaceEnvironmentRestartReason.test.ts | 127 ++++++++++++++++++
 23 files changed, 533 insertions(+), 20 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/r06-t88-environment-restart-reason_2026-09-29-01-35.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r06-t88-environment-restart-reason_2026-09-29-01-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t88-environment-restart-reason_2026-09-29-01-30.json
 create mode 100644 libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
 create mode 100644 libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts
 create mode 100644 libraries/rush-daemon/src/EnvironmentRestartReason.ts
 create mode 100644 libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 1f4dc9e3f7..8082733f1c 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -280,6 +280,15 @@ ends, resubmits the request, and prints one line on stderr (or above the agent
 progress rows): `rush-client: The daemon's installation at <folder> was removed;
 restarted the daemon (PID <pid>).`
 
+When the daemon restarts for a command's environment, the client prints a line of the
+same kind that names the variables that differed, never their values:
+`rush-client: A command's environment differed from the daemon's in NODE_OPTIONS;
+restarted the daemon (PID <pid>).` It names at most four variables and then says how
+many more differed (`A, B, C, D and 2 more`). A command that was waiting when another
+command's environment restarted the daemon prints that command's variables, because the
+successor starts with that command's environment. A daemon that does not name the
+variables gets no line.
+
 When the connection is lost before a command's result, the command fails with exit code 1
 and is not retried. The diagnostic keeps "Daemon disconnected before delivering a result; the
 command was not retried." and says what happened to rushd. If its process exited (a crash, an
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index e5d3eafe93..e1e7cd643a 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -4,18 +4,43 @@
 import type { IDaemonRestartNotice } from '@rushstack/rush-client-core';
 import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 
+/** The most variables that a restart line names before it says how many more differed. */
+const MAX_NAMED_VARIABLES: number = 4;
+
+/** Lists names as `A`, `A and B`, `A, B and C`, or `A, B, C, D and 2 more`. */
+function formatVariableNames(names: readonly string[]): string {
+  const items: string[] = names.slice(0, MAX_NAMED_VARIABLES);
+  if (names.length > items.length) items.push(`${names.length - items.length} more`);
+  const last: string | undefined = items.pop();
+  return items.length === 0 ? (last ?? '') : `${items.join(', ')} and ${last}`;
+}
+
+/** Says why the daemon restarted, or returns `undefined` for a reason that this client does not know. */
+function formatRestartedCause(reason: DaemonRestartReason | undefined): string | undefined {
+  switch (reason?.kind) {
+    case 'installationChanged':
+      return `The daemon's installation at ${reason.folder} was ${reason.change}`;
+    case 'environmentChanged': {
+      // Names only: a value, such as NODE_OPTIONS's, can hold a secret.
+      const { variableNames } = reason;
+      const names: string = variableNames.length === 0 ? '' : ` in ${formatVariableNames(variableNames)}`;
+      return `A command's environment differed from the daemon's${names}`;
+    }
+    default:
+      return undefined;
+  }
+}
+
 /**
  * Returns the line that tells the user why the daemon restarted during a command, or `undefined` for a restart
  * that needs no explanation.
  */
 export function formatDaemonRestartNotice(notice: IDaemonRestartNotice, rushx: boolean): string | undefined {
   const { reason, successorPid } = notice;
-  if (reason?.kind !== 'installationChanged') return undefined;
+  const cause: string | undefined = formatRestartedCause(reason);
+  if (cause === undefined) return undefined;
   const pid: string = successorPid === undefined ? '' : ` (PID ${successorPid})`;
-  return (
-    `${rushx ? 'rushx-client' : 'rush-client'}: The daemon's installation at ${reason.folder} was ` +
-    `${reason.change}; restarted the daemon${pid}.`
-  );
+  return `${rushx ? 'rushx-client' : 'rush-client'}: ${cause}; restarted the daemon${pid}.`;
 }
 
 /**
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index 1bed6ad88f..4ca8860fe3 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -13,7 +13,10 @@ import {
 } from '../daemonRestartNotice';
 
 // A kind that only a newer daemon knows.
-const NEWER_REASON: DaemonRestartReason = { kind: 'environmentChanged' } as unknown as DaemonRestartReason;
+const NEWER_REASON: DaemonRestartReason = {
+  kind: 'newerReason',
+  detail: ['NODE_OPTIONS']
+} as unknown as DaemonRestartReason;
 
 describe(formatDaemonRestartNotice.name, () => {
   it('names the changed installation and the new daemon', () => {
@@ -41,6 +44,33 @@ describe(formatDaemonRestartNotice.name, () => {
     ).toBe("rushx-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon.");
   });
 
+  it("names the variables in which a command's environment differed, at most four of them", () => {
+    const format = (
+      variableNames: string[],
+      successorPid: number | undefined,
+      rushx: boolean
+    ): string | undefined =>
+      formatDaemonRestartNotice(
+        { restart: 1, reason: { kind: 'environmentChanged', variableNames }, successorPid },
+        rushx
+      );
+    expect(format(['NODE_OPTIONS'], 42, false)).toBe(
+      "rush-client: A command's environment differed from the daemon's in NODE_OPTIONS; " +
+        'restarted the daemon (PID 42).'
+    );
+    expect(format(['FOO', 'NODE_OPTIONS'], undefined, true)).toBe(
+      "rushx-client: A command's environment differed from the daemon's in FOO and NODE_OPTIONS; " +
+        'restarted the daemon.'
+    );
+    expect(format(['A', 'B', 'C', 'D'], 42, false)).toContain("the daemon's in A, B, C and D; restarted");
+    expect(format(['A', 'B', 'C', 'D', 'E', 'F'], 42, false)).toContain(
+      "the daemon's in A, B, C, D and 2 more; restarted"
+    );
+    expect(format([], 42, false)).toBe(
+      "rush-client: A command's environment differed from the daemon's; restarted the daemon (PID 42)."
+    );
+  });
+
   it('says nothing about restarts that need no explanation', () => {
     expect(
       formatDaemonRestartNotice({ restart: 1, reason: undefined, successorPid: 42 }, false)
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index efcbf6154a..2f02fe76b6 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -360,10 +360,17 @@ describe('native build through the standalone client', () => {
           fs.writeFileSync(path.join(folder, 'a/input.txt'), 'two');
           const changed: IResult = await invokeAsync(argv);
           expect(changed.code).toBe(0);
-          expect(changed.stderr).not.toMatch(/using in-process|restart/i);
+          expect(changed.stderr).not.toMatch(/using in-process/i);
           expect(changed.stdout).toContain('built-a-two');
           const after = JSON.parse((await invokeAsync(['daemon', 'status'])).stdout);
           expect(after.pid).not.toBe(previousPid);
+          // One line names the variable that differed, never its value.
+          expect(changed.stderr).toContain(
+            "rush-client: A command's environment differed from the daemon's in RUSHD_TEST_RESTART_VALUE; " +
+              `restarted the daemon (PID ${after.pid}).\n`
+          );
+          expect(changed.stderr.match(/restarted the daemon/g)).toHaveLength(1);
+          expect(changed.stderr).not.toContain('new-process-environment');
           expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\na:two\nb:one\n');
           expect((await invokeAsync(argv)).code).toBe(0);
           expect(JSON.parse((await invokeAsync(['daemon', 'status'])).stdout).pid).toBe(after.pid);
diff --git a/common/changes/@rushstack/rush-cli-client/r06-t88-environment-restart-reason_2026-09-29-01-35.json b/common/changes/@rushstack/rush-cli-client/r06-t88-environment-restart-reason_2026-09-29-01-35.json
new file mode 100644
index 0000000000..23d8a8eaad
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r06-t88-environment-restart-reason_2026-09-29-01-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Print one line that names the environment variables, never their values, when a command restarted the daemon because its environment differed from the daemon's.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r06-t88-environment-restart-reason_2026-09-29-01-15.json b/common/changes/@rushstack/rush-daemon-protocol/r06-t88-environment-restart-reason_2026-09-29-01-15.json
new file mode 100644
index 0000000000..eb5ee6032c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r06-t88-environment-restart-reason_2026-09-29-01-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add the `environmentChanged` restart reason, which names the environment variables that differ between a request and the daemon, never their values. Older clients ignore it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r06-t88-environment-restart-reason_2026-09-29-01-30.json b/common/changes/@rushstack/rush-daemon/r06-t88-environment-restart-reason_2026-09-29-01-30.json
new file mode 100644
index 0000000000..600081f64f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t88-environment-restart-reason_2026-09-29-01-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a request's environment differs from the daemon's, the restart result, each result answered while that restart is pending, and the daemon log now name the variables that differ, never their values.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 3e1b962294..ecca06700b 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -170,7 +170,7 @@ export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-time
 export type DaemonRequestRejectionCode = 'invalidRequest' | 'routingFailed' | 'unsupported' | 'workspaceRecreationRequired';
 
 // @beta
-export type DaemonRestartReason = IDaemonInstallationChangedRestartReason;
+export type DaemonRestartReason = IDaemonInstallationChangedRestartReason | IDaemonEnvironmentChangedRestartReason;
 
 // @beta
 export type DaemonRushCommandOrigin = 'built-in' | 'custom';
@@ -260,6 +260,12 @@ export interface IDaemonDiagnosticPayload {
     readonly severity: DaemonDiagnosticSeverity;
 }
 
+// @beta
+export interface IDaemonEnvironmentChangedRestartReason {
+    readonly kind: 'environmentChanged';
+    readonly variableNames: readonly string[];
+}
+
 // @beta
 export interface IDaemonErrorMessage {
     // (undocumented)
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index d95633c5db..d4d5f8e435 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -58,6 +58,9 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   with cancellation, admission errors or operation results. Clients may retry once
   after attested predecessor ownership release, never on transport loss or an error
   string. The ordinary mutation result has no retry flag and drains before restart.
+  A retry result may say why in `restartReason`: `installationChanged` names the folder that
+  was removed or replaced, and `environmentChanged` names the environment variables that
+  differ from the daemon's, never their values. Clients ignore kinds they do not know.
 - **Read-only workspace status** - optional `pong.payload.workspace` reports the provider generation,
   installed session token, graph existence and real warm accounting. An absent token means no session is
   installed; an absent `warmSet` means no controller is attached, not zero memory. Warm status includes
diff --git a/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
new file mode 100644
index 0000000000..7fb66ec2b5
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
@@ -0,0 +1,19 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The request's environment differs from the one that the daemon started with, in variables that the daemon cannot
+ * take from each request. The daemon restarts with the request's environment.
+ *
+ * @beta
+ */
+export interface IDaemonEnvironmentChangedRestartReason {
+  /** Identifies this reason. */
+  readonly kind: 'environmentChanged';
+  /**
+   * The sorted names of the variables that differ: those that only one of the two environments sets, and those that
+   * they set to different values. Values are never sent, because a variable such as `NODE_OPTIONS` can carry a
+   * secret. A daemon may send an empty list.
+   */
+  readonly variableNames: readonly string[];
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
index 0c9112e204..b97e4f2787 100644
--- a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
+
 /**
  * How a folder of a running daemon's installation changed after the daemon started.
  *
@@ -37,4 +39,6 @@ export interface IDaemonInstallationChangedRestartReason extends IDaemonInstalla
  *
  * @beta
  */
-export type DaemonRestartReason = IDaemonInstallationChangedRestartReason;
+export type DaemonRestartReason =
+  | IDaemonInstallationChangedRestartReason
+  | IDaemonEnvironmentChangedRestartReason;
diff --git a/libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts b/libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts
new file mode 100644
index 0000000000..246445b086
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/EnvironmentChangeValidation.ts
@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const EMPTY_LENGTH: number = 0;
+
+/** Validates the variable names of an `environmentChanged` restart reason. @internal */
+export function validateEnvironmentChange(reason: Record<string, unknown>): void {
+  const { variableNames } = reason;
+  if (!Array.isArray(variableNames) || !variableNames.every(isVariableName)) {
+    throw new DaemonProtocolError('malformedControlMessage', 'Invalid restartReason.variableNames.');
+  }
+}
+
+function isVariableName(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_LENGTH;
+}
diff --git a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
index 77884d9583..afaf7d90af 100644
--- a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
+++ b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
@@ -3,9 +3,11 @@
 
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
+import { validateEnvironmentChange } from './EnvironmentChangeValidation';
 
 const INSTALLATION_CHANGE_KINDS: ReadonlySet<unknown> = new Set(['removed', 'replaced']);
 const INSTALLATION_CHANGED: string = 'installationChanged';
+const ENVIRONMENT_CHANGED: string = 'environmentChanged';
 const EMPTY_LENGTH: number = 0;
 
 /** Validates an optional installation change, as reported by pong or by a restart reason. @internal */
@@ -32,6 +34,7 @@ function validateReason(reason: unknown): void {
   requireRecord(reason, 'restartReason');
   requireKind(reason.kind);
   if (reason.kind === INSTALLATION_CHANGED) validateInstallationChange(reason, 'restartReason');
+  if (reason.kind === ENVIRONMENT_CHANGED) validateEnvironmentChange(reason);
 }
 
 function requireRecord(value: unknown, field: string): asserts value is Record<string, unknown> {
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 4e984fe8ef..c90228393b 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -59,6 +59,7 @@ export type { DaemonCommandOutcome, IDaemonCommandResult } from './DaemonCommand
 export type { DaemonInstallationChangeKind, DaemonRestartReason } from './DaemonInstallationChange';
 export type { IDaemonInstallationChange } from './DaemonInstallationChange';
 export type { IDaemonInstallationChangedRestartReason } from './DaemonInstallationChange';
+export type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
 export { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
 export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { DaemonRequestRejectionCode, IDaemonRequestCancelMessage } from './DaemonRequestControl';
diff --git a/libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts b/libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts
new file mode 100644
index 0000000000..775d594509
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/EnvironmentChange.test.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { IDaemonCommandResult } from '../DaemonCommandResult';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonEnvironmentChangedRestartReason } from '../DaemonEnvironmentChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FAILURE_EXIT_CODE: number = 1;
+const FIRST_POSITION: number = 1;
+const NOT_A_NAME: number = 7;
+const QUEUED_REQUEST_ID: string = 'queued-before-restart';
+const REASON: IDaemonEnvironmentChangedRestartReason = {
+  kind: 'environmentChanged',
+  variableNames: ['FOO', 'NODE_OPTIONS']
+};
+const RESULT: IDaemonCommandResult = {
+  aborted: false,
+  exitCode: FAILURE_EXIT_CODE,
+  outcome: 'failure',
+  requestId: 'environment',
+  retryAfterRestart: true,
+  restartReason: REASON
+};
+
+function resultFrame(restartReason: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({ kind: 'requestResult', payload: { ...RESULT, restartReason } })
+  );
+}
+
+function queuePositionFrame(restartReason: unknown): Uint8Array {
+  return WIRE_TEXT_ENCODER.encode(
+    JSON.stringify({
+      kind: 'queuePosition',
+      payload: { position: FIRST_POSITION, requestId: QUEUED_REQUEST_ID, restartReason }
+    })
+  );
+}
+
+it('round-trips a restart result that names the variables that differ', () => {
+  const message: DaemonControlMessage = { kind: 'requestResult', payload: RESULT };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('round-trips a queue position whose restart is for an environment', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: { position: FIRST_POSITION, requestId: QUEUED_REQUEST_ID, restartReason: REASON }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('accepts an environment reason that names no variables', () => {
+  const restartReason: object = { kind: 'environmentChanged', variableNames: [] };
+  expect(decodeDaemonControlMessage(resultFrame(restartReason))).toMatchObject({
+    payload: { restartReason }
+  });
+});
+
+const MALFORMED_REASONS: object[] = [
+  { kind: 'environmentChanged' },
+  { kind: 'environmentChanged', variableNames: null },
+  { kind: 'environmentChanged', variableNames: 'NODE_OPTIONS' },
+  { kind: 'environmentChanged', variableNames: [''] },
+  { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS', NOT_A_NAME] }
+];
+
+it.each(MALFORMED_REASONS)('rejects a restart result whose environment reason is %j', (reason: object) => {
+  expect(() => decodeDaemonControlMessage(resultFrame(reason))).toThrow(/restartReason\.variableNames/);
+});
+
+it.each(MALFORMED_REASONS)('rejects a queue position whose environment reason is %j', (reason: object) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame(reason))).toThrow(
+    /restartReason\.variableNames/
+  );
+});
diff --git a/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts b/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
index c9335c9c01..380b8d09f7 100644
--- a/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/InstallationChange.test.ts
@@ -37,7 +37,7 @@ it('round-trips a restart result that names the changed installation', () => {
 it('accepts a restart reason kind from a newer daemon', () => {
   const payload: object = {
     ...RESULT,
-    restartReason: { kind: 'environmentChanged', names: ['NODE_OPTIONS'] }
+    restartReason: { kind: 'newerReason', detail: ['NODE_OPTIONS'] }
   };
   expect(decodeDaemonControlMessage(resultFrame(payload))).toMatchObject({ payload });
 });
diff --git a/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
index 05b4a02860..b694c303a5 100644
--- a/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/QueuedRestartReason.test.ts
@@ -32,7 +32,7 @@ it('round-trips a queue position that says the daemon restarts once the requests
 });
 
 it('accepts a queued restart reason kind from a newer daemon', () => {
-  const restartReason: object = { kind: 'environmentChanged', names: ['NODE_OPTIONS'] };
+  const restartReason: object = { kind: 'newerReason', detail: ['NODE_OPTIONS'] };
   expect(decodeDaemonControlMessage(queuePositionFrame(restartReason))).toMatchObject({
     payload: { restartReason }
   });
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 5179afee7e..383e4b6676 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -202,6 +202,14 @@ successor; otherwise it runs on this process. Its queue position is the number o
 to restart, and its wait timeout applies as it does to the drain, relative to the requests that were served when the
 script began to wait.
 
+The `retryAfterRestart: true` result of the request that restarts the daemon for its environment carries
+`restartReason: { kind: 'environmentChanged', variableNames }`: the sorted names of the variables that are set in only
+one of the two environments, or set to different values, compared as the fingerprint's `environmentHash` compares them
+(without the variables that it ignores, and with repeated `PATH` entries removed). Values are never sent, since a
+variable such as `NODE_OPTIONS` can hold a secret. Each request that is answered while that restart is pending gets
+the same reason, because the successor starts with the restarting request's environment, not its own. The daemon log
+(`onLog`) names the request and the variables.
+
 Protocol 0.10 (`DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR`) provides bounded, typed retry authorization.
 Only a pre-execution command result may carry `retryAfterRestart: true`. During a planned restart, accepted
 queued requests drain those typed results before disconnect rather than being reduced to ambiguous connection
diff --git a/libraries/rush-daemon/src/EnvironmentRestartReason.ts b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
new file mode 100644
index 0000000000..1c205b3ea3
--- /dev/null
+++ b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getWorkspaceFingerprintEnvironmentEntries } from '@microsoft/rush-lib';
+import type { IDaemonEnvironmentChangedRestartReason } from '@rushstack/rush-daemon-protocol';
+
+/**
+ * The variables of an environment that a daemon's identity includes, by name, with the values that the workspace
+ * input fingerprint hashes: without the variables that it ignores, and with repeated `PATH` entries removed.
+ */
+export type EnvironmentIdentityEntries = ReadonlyMap<string, string>;
+
+/** Returns the variables of `environment` that a daemon's identity includes. */
+export function getEnvironmentIdentityEntries(
+  environment: Readonly<Record<string, string | undefined>>
+): EnvironmentIdentityEntries {
+  return new Map(getWorkspaceFingerprintEnvironmentEntries(environment));
+}
+
+/**
+ * Says why a daemon that started with `startupEntries` restarts for a request with `environment`: the sorted names
+ * of the variables that are set in only one of them or set to different values, never the values. Returns
+ * `undefined` when the environments do not differ, which is when their fingerprint `environmentHash` is the same.
+ */
+export function getEnvironmentRestartReason(
+  startupEntries: EnvironmentIdentityEntries,
+  environment: Readonly<Record<string, string | undefined>>
+): IDaemonEnvironmentChangedRestartReason | undefined {
+  const requestEntries: EnvironmentIdentityEntries = getEnvironmentIdentityEntries(environment);
+  const variableNames: Set<string> = new Set();
+  for (const [name, value] of startupEntries) {
+    if (requestEntries.get(name) !== value) variableNames.add(name);
+  }
+  for (const name of requestEntries.keys()) {
+    if (!startupEntries.has(name)) variableNames.add(name);
+  }
+  if (variableNames.size === 0) return undefined;
+  return { kind: 'environmentChanged', variableNames: Array.from(variableNames).sort() };
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index a8cef149f0..b73e4a0233 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -83,7 +83,9 @@ export function freezeDaemonRequestAdmissionOptions(
 
 /** Says why the daemon restarts, completing "the daemon could restart <cause>". */
 function formatRestartCause(restartReason: DaemonRestartReason): string {
-  return `because its installation at ${restartReason.folder} was ${restartReason.change}`;
+  return restartReason.kind === 'environmentChanged'
+    ? `because a command's environment differs from its own in ${restartReason.variableNames.join(', ')}`
+    : `because its installation at ${restartReason.folder} was ${restartReason.change}`;
 }
 
 class WorkspaceRequestScheduler extends RequestScheduler {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index a0e615a4e8..ba7dec3e31 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -22,6 +22,7 @@ import { NoOpTerminalProvider, Terminal } from '@rushstack/terminal';
 import type {
   DaemonRestartReason,
   IDaemonCommandResult,
+  IDaemonEnvironmentChangedRestartReason,
   IDaemonInstallationChange,
   IDaemonRequestEnvelope
 } from '@rushstack/rush-daemon-protocol';
@@ -66,6 +67,11 @@ import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './Workspa
 import { classifyRushCommand } from './RushCommandRequestPolicy';
 import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
 import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
+import {
+  getEnvironmentIdentityEntries,
+  getEnvironmentRestartReason,
+  type EnvironmentIdentityEntries
+} from './EnvironmentRestartReason';
 
 interface IExecutionState {
   began: boolean;
@@ -154,9 +160,9 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   );
   readonly #repoRoot: string;
   /** The daemon's environment before any engine ran. A plugin may add names to `process.env` later. */
-  readonly #startupEnvironment: Record<string, string> = Object.fromEntries(
-    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
-  );
+  readonly #startupEnvironment: Record<string, string>;
+  /** The variables of `#startupEnvironment` that the startup fingerprint's `environmentHash` includes. */
+  readonly #startupEnvironmentEntries: EnvironmentIdentityEntries;
   readonly #startupFingerprint: IWorkspaceInputFingerprint;
   readonly #runtimeCache: WorkspaceRuntimeFingerprintCache;
   // Concurrent requests share captures; each capture still starts after the requests it serves arrived.
@@ -174,6 +180,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   #forceReload: boolean = false;
   #closing: boolean = false;
   #restartPending: boolean = false;
+  /** Why the pending restart happens, when the request that it is for has a different environment. */
+  #restartReason: IDaemonEnvironmentChangedRestartReason | undefined;
   #lastReloadTier: WorkspaceInputChangeTier = WorkspaceInputChangeTier.Reuse;
   #installationChange: IDaemonInstallationChange | undefined;
   #transitioning: boolean = false;
@@ -186,7 +194,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     options: IWorkspaceRequestLifecycleOptions,
     repoRoot: string,
     fingerprint: IWorkspaceInputFingerprint,
-    runtimeCache: WorkspaceRuntimeFingerprintCache
+    runtimeCache: WorkspaceRuntimeFingerprintCache,
+    startupEnvironment: Record<string, string>
   ) {
     this.#options = options;
     this.#repoRoot = repoRoot;
@@ -194,6 +203,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     this.#resolver = options.resolver;
     this.#ownedResolvers.add(options.resolver);
     this.#runtimeCache = runtimeCache;
+    this.#startupEnvironment = startupEnvironment;
+    this.#startupEnvironmentEntries = getEnvironmentIdentityEntries(startupEnvironment);
   }
 
   public static async createAsync(
@@ -201,13 +212,23 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   ): Promise<WorkspaceRequestLifecycle> {
     const session: IWorkspaceSession = await options.provider.getSessionAsync();
     const runtimeCache: WorkspaceRuntimeFingerprintCache = new WorkspaceRuntimeFingerprintCache();
+    // The startup fingerprint hashes this copy, so that a restart for another environment can name what differs.
+    const startupEnvironment: Record<string, string> = Object.fromEntries(
+      Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+    );
     const fingerprint: IWorkspaceInputFingerprint = await captureWorkspaceInputFingerprintAsync({
       rushConfiguration: session.rushConfiguration,
-      environment: process.env,
+      environment: startupEnvironment,
       runtimePaths: [__dirname, path.resolve(__dirname, '../package.json')],
       runtimeCache
     });
-    return new WorkspaceRequestLifecycle(options, session.metadata.repoRoot, fingerprint, runtimeCache);
+    return new WorkspaceRequestLifecycle(
+      options,
+      session.metadata.repoRoot,
+      fingerprint,
+      runtimeCache,
+      startupEnvironment
+    );
   }
 
   /** The last applied input decision; reading status never changes or reloads the workspace. */
@@ -342,16 +363,27 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             continue;
           }
           if (error instanceof RestartBeforeExecution && !state.began && !state.terminalAttempted) {
+            // The request, and each request that is answered while the restart is pending, learns why it happens.
+            const restartReason: IDaemonEnvironmentChangedRestartReason | undefined =
+              getEnvironmentRestartReason(this.#startupEnvironmentEntries, error.plan.environment);
             try {
               await client.interactiveSession.finishAsync();
               await client.writeResultAsync({
                 ...preExecutionFailure(envelope.requestId, error),
-                retryAfterRestart: true
+                retryAfterRestart: true,
+                ...(restartReason && { restartReason })
               });
               error.session.retire?.();
               this.#lastReloadTier = WorkspaceInputChangeTier.Restart;
+              this.#restartReason = restartReason;
               this.#restartPending = true;
               this.#closing = true;
+              if (restartReason) {
+                this.#options.onLog?.(
+                  `rushd: restarting for request ${envelope.requestId}, whose environment differs from this ` +
+                    `daemon's in ${restartReason.variableNames.join(', ')}`
+                );
+              }
               this.#options.onRestartRequested(error.plan);
             } finally {
               error.workspaceLease.release();
@@ -1061,7 +1093,14 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   #restartPendingResult(requestId: string, pending: RestartPendingBeforeExecution): IDaemonCommandResult {
     const change: IDaemonInstallationChange | undefined = this.#installationChange;
-    if (!change) return { ...preExecutionFailure(requestId, pending), retryAfterRestart: true };
+    if (!change) {
+      const restartReason: IDaemonEnvironmentChangedRestartReason | undefined = this.#restartReason;
+      return {
+        ...preExecutionFailure(requestId, pending),
+        retryAfterRestart: true,
+        ...(restartReason && { restartReason })
+      };
+    }
     return {
       ...preExecutionFailure(requestId, new InstallationChangedBeforeExecution(change)),
       retryAfterRestart: true,
diff --git a/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
new file mode 100644
index 0000000000..fcbf765054
--- /dev/null
+++ b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { getEnvironmentIdentityEntries, getEnvironmentRestartReason } from '../EnvironmentRestartReason';
+
+const STARTUP: Record<string, string> = {
+  HOME: '/home/agent',
+  NODE_OPTIONS: '--max-old-space-size=8192',
+  PATH: ['/usr/local/bin', '/usr/bin'].join(path.delimiter),
+  TERM: 'xterm-256color'
+};
+
+describe(getEnvironmentRestartReason.name, () => {
+  const startupEntries = getEnvironmentIdentityEntries(STARTUP);
+
+  it('returns undefined when only variables that the fingerprint ignores or normalizes differ', () => {
+    expect(getEnvironmentRestartReason(startupEntries, { ...STARTUP })).toBeUndefined();
+    expect(
+      getEnvironmentRestartReason(startupEntries, {
+        TERM: 'dumb',
+        PWD: '/elsewhere',
+        PATH: [STARTUP.PATH, '/usr/bin'].join(path.delimiter),
+        NODE_OPTIONS: STARTUP.NODE_OPTIONS,
+        HOME: STARTUP.HOME,
+        UNSET: undefined
+      })
+    ).toBeUndefined();
+  });
+
+  it('names each variable that is changed, added or removed, sorted, and never a value', () => {
+    const requested: Record<string, string | undefined> = {
+      ...STARTUP,
+      NODE_OPTIONS: '--inspect',
+      FOO: 'bar'
+    };
+    delete requested.HOME;
+    const reason = getEnvironmentRestartReason(startupEntries, requested);
+    expect(reason).toEqual({ kind: 'environmentChanged', variableNames: ['FOO', 'HOME', 'NODE_OPTIONS'] });
+    expect(JSON.stringify(reason)).not.toMatch(/bar|inspect|agent/);
+  });
+
+  it('names PATH when its entries differ, not only their repetition', () => {
+    expect(
+      getEnvironmentRestartReason(startupEntries, {
+        ...STARTUP,
+        PATH: ['/usr/bin', '/usr/local/bin'].join(path.delimiter)
+      })
+    ).toEqual({ kind: 'environmentChanged', variableNames: ['PATH'] });
+  });
+
+  it('treats a variable that is set to an empty string as set', () => {
+    expect(getEnvironmentRestartReason(startupEntries, { ...STARTUP, NODE_OPTIONS: '' })).toEqual({
+      kind: 'environmentChanged',
+      variableNames: ['NODE_OPTIONS']
+    });
+    expect(
+      getEnvironmentRestartReason(getEnvironmentIdentityEntries({ ...STARTUP, EMPTY: '' }), STARTUP)
+    ).toEqual({ kind: 'environmentChanged', variableNames: ['EMPTY'] });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
new file mode 100644
index 0000000000..003777a529
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
@@ -0,0 +1,127 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+jest.setTimeout(60_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const BUILD_C: string[] = ['build', '--to', 'c', '--parallelism', '3'];
+
+interface IQueuedRequest {
+  readonly client: DaemonRequestWireClient;
+  readonly envelope: IDaemonRequestEnvelope;
+}
+
+function isQueuePosition(frame: IDaemonFrame): boolean {
+  return (
+    frame.kind === DaemonFrameType.controlJson &&
+    decodeDaemonControlMessage(frame.payload).kind === 'queuePosition'
+  );
+}
+
+/** Starts a request and returns once the daemon reports that it waits. */
+async function startQueuedAsync(
+  fixture: DaemonGraphTestFixture,
+  environment: Record<string, string>,
+  clients: DaemonRequestWireClient[]
+): Promise<IQueuedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  clients.push(client);
+  const envelope: IDaemonRequestEnvelope = fixture.envelope(BUILD_B, { environment });
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  while (!isQueuePosition(await client.readFrameAsync()));
+  return { client, envelope };
+}
+
+it('tells the request that restarts the daemon for its environment, and each request answered while that restart is pending, which variables differ', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => {
+    setDaemonPolicy(created, {});
+    created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    // Project c holds its build open until the test removes the marker.
+    created.write('hold', '');
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+    );
+  });
+  const clients: DaemonRequestWireClient[] = [];
+  try {
+    const before = await pongAsync(fixture);
+    const held: Promise<ITerminalExchange> = fixture.runAsync(BUILD_C);
+    const deadline: number = Date.now() + 30_000;
+    while (!fixture.runs().includes('c') && Date.now() < deadline) await delayAsync(20);
+    expect(fixture.runs()).toContain('c');
+
+    // Each request differs from the daemon in its own variable. Either one may restart the daemon; the other is
+    // answered while that restart is pending.
+    const requests: IQueuedRequest[] = [];
+    for (const [name, value] of [
+      ['RUSHD_RESTART_REASON_FIRST', 'first-value'],
+      ['RUSHD_RESTART_REASON_SECOND', 'second-value']
+    ]) {
+      requests.push(await startQueuedAsync(fixture, { ...fixture.environment, [name]: value }, clients));
+    }
+    fs.rmSync(path.join(fixture.folder, 'hold'));
+    expect((await held).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    const exchanges: ITerminalExchange[] = await Promise.all(
+      requests.map(({ client, envelope }: IQueuedRequest) => client.readTerminalAsync(envelope.requestId))
+    );
+
+    const restartLines: string[] = fixture.logs.filter((line: string) =>
+      line.startsWith('rushd: restarting for request ')
+    );
+    expect(restartLines).toHaveLength(1);
+    const restarter: number = requests.findIndex(({ envelope }: IQueuedRequest) =>
+      restartLines[0].includes(`request ${envelope.requestId},`)
+    );
+    expect(restarter).not.toBe(-1);
+    const variableName: string =
+      restarter === 0 ? 'RUSHD_RESTART_REASON_FIRST' : 'RUSHD_RESTART_REASON_SECOND';
+    expect(restartLines[0]).toBe(
+      `rushd: restarting for request ${requests[restarter].envelope.requestId}, whose environment differs ` +
+        `from this daemon's in ${variableName}`
+    );
+    // The request that was answered while the restart was pending learns the restart's reason, not its own.
+    for (const { terminal } of exchanges) {
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          retryAfterRestart: true,
+          restartReason: { kind: 'environmentChanged', variableNames: [variableName] }
+        }
+      });
+    }
+    expect(fixture.logs.join('\n')).not.toMatch(/first-value|second-value/);
+    const restarted = await fixture.host.restartCompleted;
+    expect(restarted?.pid).not.toBe(before.pid);
+    expect(fixture.runs()).toEqual(['c']);
+  } finally {
+    fs.rmSync(path.join(fixture.folder, 'hold'), { force: true });
+    await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted;
+    } finally {
+      await stopSuccessorAsync(fixture.host.paths);
+      await fixture[Symbol.asyncDispose]();
+    }
+  }
+});

From ec6d7b80776791ef560df387b25b426f1117123d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:05 +0000
Subject: [PATCH 070/265] [rush-daemon] A restart drain's waiter rechecks its
 tier

Swarm integration step 55; original commit 075d2130b2 (merge of swarm/r05-t127-int at 236c184d94).
Scope: task 127.

Brings r05's task 127 follow-up (board 2436, re-tipped onto d87702c813 in board 2858): a Restart-tier change that is reverted under load no longer fails its waiter at 30 s. Second agent: o05 board 2552.

s17 batch D1, item 3 of 10. Gate: ch01 GATE OK board 3310 (tree bdfad6af20)

Commits folded into this step (2):
- 961f007cae [rush-daemon] A request that waits for a restart drain rechecks whether it still needs the restart (task 127)
- 0b1585667a [rush-daemon] Requests that wait for a restart drain share one recheck capture a second (task 127)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...estart-drain-recheck_2026-09-28-21-05.json |  10 +
 libraries/rush-daemon/README.md               |  22 +-
 .../src/WorkspaceRequestAdmission.ts          |  22 +-
 .../src/WorkspaceRequestLifecycle.ts          |  77 +++++-
 .../src/WorkspaceRestartArbiter.ts            | 112 +++++++-
 .../src/test/RestartDrainAdmission.test.ts    |  35 ++-
 .../src/test/WorkspaceRestartArbiter.test.ts  | 186 +++++++++++--
 .../WorkspaceServedScriptAdmission.test.ts    | 251 +++++++++++++++++-
 8 files changed, 650 insertions(+), 65 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-restart-drain-recheck_2026-09-28-21-05.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-restart-drain-recheck_2026-09-28-21-05.json b/common/changes/@rushstack/rush-daemon/swarm-r05-restart-drain-recheck_2026-09-28-21-05.json
new file mode 100644
index 0000000000..df2364e5f3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-restart-drain-recheck_2026-09-28-21-05.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A request that waits for a restart drain rechecks its inputs every second, sharing one capture a second with the other requests that wait, and is admitted on the running daemon as if it had just arrived once the change that needed the restart is reverted.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 383e4b6676..04d65fa115 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -194,13 +194,21 @@ drain, which could otherwise keep it waiting for as long as they keep arriving.
 `waitTimeoutMs` limits the whole drain, and only its remaining time carries over to the successor. When a drain times
 out, its message names the time that did not count.
 
-A restart is pending from when a request begins its restart drain until the request has planned the restart, or has
-failed or been cancelled. A rushx script that arrives while a restart is pending does not start, since the restart
-would then wait for it to exit: the script waits for the pending restart instead, and the drain does not count it. If
-the restart was planned, the script's result carries `retryAfterRestart: true` so that the client runs it on the
-successor; otherwise it runs on this process. Its queue position is the number of requests that are served or waiting
-to restart, and its wait timeout applies as it does to the drain, relative to the requests that were served when the
-script began to wait.
+The change that needs a restart may be reverted during the drain, while requests that do not need one keep the drain
+from finishing for as long as they keep arriving. A request that waits for the drain therefore captures its inputs
+again every second, and once they no longer need a restart it stops waiting and is admitted as if it had just
+arrived, on this process. The requests that wait share these captures: a request reuses the latest one until it is a
+second old, so the drain costs one capture a second however many requests wait, and each request still sees a revert
+within about two seconds. A request that needs a restart only for its environment does not capture again, since its
+environment cannot change.
+
+A restart is pending from when a request begins its restart drain until the request has planned the restart, has found
+that it no longer needs it, or has failed or been cancelled. A rushx script that arrives while a restart is pending
+does not start, since the restart would then wait for it to exit: the script waits for the pending restart instead,
+and the drain does not count it. If the restart was planned, the script's result carries `retryAfterRestart: true` so
+that the client runs it on the successor; otherwise it runs on this process. Its queue position is the number of
+requests that are served or waiting to restart, and its wait timeout applies as it does to the drain, relative to the
+requests that were served when the script began to wait.
 
 The `retryAfterRestart: true` result of the request that restarts the daemon for its environment carries
 `restartReason: { kind: 'environmentChanged', variableNames }`: the sorted names of the variables that are set in only
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index b73e4a0233..54b4964d4f 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -24,7 +24,9 @@ import type { IWorkspaceSession } from './WorkspaceSession';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
 import type {
   IWorkspaceRestartDrainOptions,
+  IWorkspaceRestartRecheck,
   IWorkspaceRestartTicket,
+  IWorkspaceRestartWaitResult,
   WorkspaceRestartArbiter
 } from './WorkspaceRestartArbiter';
 
@@ -467,16 +469,20 @@ export class RequestAdmissionController {
    *
    * A `restartReason` says that the daemon restarts for that reason rather than for the request's environment. Queue
    * positions then carry it, and admission errors name it.
+   *
+   * @returns true once the drain finishes, or false if `recheck` found that the request no longer needs the restart.
    */
   public async waitForRestartDrainAsync(
     arbiter: WorkspaceRestartArbiter,
     ticket: IWorkspaceRestartTicket,
-    restartReason?: DaemonRestartReason
-  ): Promise<void> {
-    await this.#waitForRestartArbiterAsync(
-      (options: IWorkspaceRestartDrainOptions) => arbiter.waitForDrainAsync(ticket, options),
+    restartReason?: DaemonRestartReason,
+    recheck?: IWorkspaceRestartRecheck
+  ): Promise<boolean> {
+    const result: IWorkspaceRestartWaitResult = await this.#waitForRestartArbiterAsync(
+      (options: IWorkspaceRestartDrainOptions) => arbiter.waitForDrainAsync(ticket, options, recheck),
       restartReason
     );
+    return !result.restartWithdrawn;
   }
 
   /**
@@ -498,15 +504,15 @@ export class RequestAdmissionController {
   }
 
   async #waitForRestartArbiterAsync(
-    waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<number>,
+    waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<IWorkspaceRestartWaitResult>,
     restartReason?: DaemonRestartReason
-  ): Promise<void> {
+  ): Promise<IWorkspaceRestartWaitResult> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
     let waivedMs: number = 0;
     try {
       // The arbiter reports its own admission errors, so this does not depend on the scheduler error mapping.
-      waivedMs = await waitAsync({
+      const result: IWorkspaceRestartWaitResult = await waitAsync({
         abortSignal: this.#abortController.signal,
         noWait: this.#admission?.noWait,
         waitTimeoutMs: this.#remainingMs,
@@ -514,6 +520,8 @@ export class RequestAdmissionController {
         restartCause: restartReason && formatRestartCause(restartReason),
         onServingCountChanged: writer ? (count: number) => writer.enqueue(count, restartReason) : undefined
       });
+      waivedMs = result.waivedMs;
+      return result;
     } finally {
       await writer?.flushAsync();
       this.#spend(Date.now() - startMs - waivedMs);
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index ba7dec3e31..fb2909f8f2 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -63,7 +63,11 @@ import type {
   IWorkspaceProcessRestartPlan,
   IWorkspaceSuccessorLaunch
 } from './WorkspaceProcessRestart';
-import { WorkspaceRestartArbiter, type IWorkspaceRestartTicket } from './WorkspaceRestartArbiter';
+import {
+  WorkspaceRestartArbiter,
+  type IWorkspaceRestartRecheck,
+  type IWorkspaceRestartTicket
+} from './WorkspaceRestartArbiter';
 import { classifyRushCommand } from './RushCommandRequestPolicy';
 import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
 import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
@@ -73,6 +77,15 @@ import {
   type EnvironmentIdentityEntries
 } from './EnvironmentRestartReason';
 
+/** How often a request that waits for a restart drain checks whether it still needs the restart. */
+const RESTART_RECHECK_INTERVAL_MS: number = 1000;
+
+interface IRecheckCapture {
+  /** On the clock of `performance.now()`. */
+  readonly startTimeMs: number;
+  readonly fingerprint: Promise<IWorkspaceInputFingerprint>;
+}
+
 interface IExecutionState {
   began: boolean;
   terminalAttempted: boolean;
@@ -171,6 +184,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     new FreshCaptureCoalescer();
   readonly #projectFingerprintCaptures: FreshCaptureCoalescer<RushConfiguration, string> =
     new FreshCaptureCoalescer();
+  /** The latest capture that a request waiting for a restart drain started, for each workspace configuration. */
+  readonly #recheckCaptures: WeakMap<RushConfiguration, IRecheckCapture> = new WeakMap();
   #fingerprint: IWorkspaceInputFingerprint;
   #projectFingerprint: string | undefined;
   #commandIdentity: string | undefined;
@@ -517,8 +532,14 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             lease.release();
             if (ticket) {
               // Like build requests, a graph-control restart must not preempt requests this process can serve.
-              await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket);
+              const drained: boolean = await admission.waitForRestartDrainAsync(
+                this.#restartArbiter,
+                ticket,
+                undefined,
+                this.#createRestartRecheck(session, controlEnvelope, current, false)
+              );
               if (this.#restartPending) throw new RestartPendingBeforeExecution();
+              if (!drained) return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
             }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
@@ -613,8 +634,15 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       lease.release();
       if (tier === WorkspaceInputChangeTier.Restart && ticket) {
         // Serve every queued or in-flight request that matches this process before restarting for another one.
-        await admission.waitForRestartDrainAsync(this.#restartArbiter, ticket);
+        const drained: boolean = await admission.waitForRestartDrainAsync(
+          this.#restartArbiter,
+          ticket,
+          undefined,
+          this.#createRestartRecheck(session, envelope, fingerprint, isMutation(envelope))
+        );
         if (this.#restartPending) throw new RestartPendingBeforeExecution();
+        // The request no longer needs the restart, so it is admitted as it would be if it arrived now.
+        if (!drained) return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
       }
       if (this.#transitioning) {
         const shared: IRequestLease = await admission.acquireBehindTransitionAsync(
@@ -653,6 +681,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           throw error;
         }
       }
+      // A request that drained for a restart it no longer needs must not keep rushx scripts waiting for the restart.
+      if (ticket) this.#restartArbiter.withdrawRestart(ticket);
       if (isMutation(envelope)) {
         if (!this.#options.getSuccessorLaunchAsync) {
           throw new DaemonRequestDispatchError(
@@ -904,6 +934,47 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * The change that needs a restart may be reverted while the request waits for the restart drain, and requests that
+   * do not need a restart can keep the drain from finishing for as long as they keep arriving. The request therefore
+   * captures its inputs again while it waits, and stops waiting once they no longer need a restart. A request's
+   * environment does not change, so a request that needs a restart for its environment does not capture again.
+   */
+  #createRestartRecheck(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    fingerprint: IWorkspaceInputFingerprint,
+    mutation: boolean
+  ): IWorkspaceRestartRecheck | undefined {
+    if (fingerprint.environmentHash !== this.#startupFingerprint.environmentHash) return undefined;
+    return {
+      intervalMs: RESTART_RECHECK_INTERVAL_MS,
+      stillNeedsRestartAsync: async () =>
+        this.#classify(await this.#recheckCaptureAsync(session, envelope), mutation) ===
+        WorkspaceInputChangeTier.Restart
+    };
+  }
+
+  /**
+   * Every request that waits for a restart drain checks its inputs once per interval, so the waiters share the
+   * latest check's capture, whether it still runs or has settled, until it is one interval old. The checks then cost
+   * one capture per interval however many requests wait, and each waiter still sees a change within about two
+   * intervals. Only requests whose environments match this process's environment check again (see
+   * `#createRestartRecheck`), so every waiter of one workspace configuration requests the same capture.
+   */
+  #recheckCaptureAsync(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope
+  ): Promise<IWorkspaceInputFingerprint> {
+    const { rushConfiguration } = session;
+    const nowMs: number = performance.now();
+    const latest: IRecheckCapture | undefined = this.#recheckCaptures.get(rushConfiguration);
+    if (latest && nowMs - latest.startTimeMs < RESTART_RECHECK_INTERVAL_MS) return latest.fingerprint;
+    const fingerprint: Promise<IWorkspaceInputFingerprint> = this.#captureAsync(session, envelope);
+    this.#recheckCaptures.set(rushConfiguration, { startTimeMs: nowMs, fingerprint });
+    return fingerprint;
+  }
+
   #classify(fingerprint: IWorkspaceInputFingerprint, mutation: boolean): WorkspaceInputChangeTier {
     if (
       fingerprint.selectedRushVersion !== Rush.version ||
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index b23c4a364c..aa5a96975e 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -46,6 +46,8 @@ interface IWaitKind {
   readonly isBlocked: () => boolean;
   /** How many other requests the request waits for, reported as its queue position. */
   readonly countWaitedFor: () => number;
+  /** Lets a request that waits to restart find that it no longer needs to. */
+  readonly recheck: IWorkspaceRestartRecheck | undefined;
   readonly noWaitMessage: string;
   /** Begins the timeout message, which goes on to name the requests that the restart waits for. */
   readonly timeoutPrefix: string;
@@ -76,10 +78,83 @@ export interface IWorkspaceRestartDrainOptions {
   readonly onServingCountChanged?: (servingCount: number) => void;
 }
 
+/**
+ * Lets a request that waits for a restart drain find that it no longer needs the restart. The change that needed it
+ * may be reverted during the drain, while requests that do not need a restart keep the drain from finishing.
+ */
+export interface IWorkspaceRestartRecheck {
+  /**
+   * Resolves whether the request still needs the restart. It is called every `intervalMs` while the request waits,
+   * each time after the previous call settles. A call that rejects counts as true.
+   */
+  readonly stillNeedsRestartAsync: () => Promise<boolean>;
+  readonly intervalMs: number;
+}
+
+/** How a wait for a restart drain or a pending restart ended. */
+export interface IWorkspaceRestartWaitResult {
+  /**
+   * How many milliseconds of the wait did not spend `waitTimeoutMs`
+   * (see {@link IWorkspaceRestartDrainOptions.waivesTimeoutForServedWork}).
+   */
+  readonly waivedMs: number;
+  /**
+   * The wait ended because {@link IWorkspaceRestartRecheck.stillNeedsRestartAsync} resolved false, so the request no
+   * longer counts as a pending restart. Otherwise the wait ended because the request no longer had to wait.
+   */
+  readonly restartWithdrawn: boolean;
+}
+
+/** Calls {@link IWorkspaceRestartRecheck.stillNeedsRestartAsync} while a restart candidate waits. */
+class RestartRecheck {
+  /** A call resolved false. */
+  public withdrawn: boolean = false;
+  readonly #recheck: IWorkspaceRestartRecheck;
+  readonly #onWithdrawn: () => void;
+  #timer: ReturnType<typeof setTimeout> | undefined;
+  #stopped: boolean = false;
+
+  public constructor(recheck: IWorkspaceRestartRecheck, onWithdrawn: () => void) {
+    this.#recheck = recheck;
+    this.#onWithdrawn = onWithdrawn;
+    this.#schedule();
+  }
+
+  /** Ignores a call that is still running, and makes no more. */
+  public stop(): void {
+    this.#stopped = true;
+    clearTimeout(this.#timer);
+  }
+
+  #schedule(): void {
+    this.#timer = setTimeout(() => {
+      void this.#recheckAsync();
+    }, this.#recheck.intervalMs);
+  }
+
+  async #recheckAsync(): Promise<void> {
+    let stillNeeded: boolean = true;
+    try {
+      stillNeeded = await this.#recheck.stillNeedsRestartAsync();
+    } catch {
+      // For example, a file that the capture reads was being rewritten. The next call tries again.
+    }
+    if (this.#stopped) return;
+    if (stillNeeded) {
+      this.#schedule();
+    } else {
+      this.withdrawn = true;
+      this.#onWithdrawn();
+    }
+  }
+}
+
 /**
  * Arbitrates process restarts between requests whose environments differ from the running daemon.
  * A request that needs a restart waits until every other request this process can serve has finished,
  * so a mismatched environment never preempts queued or in-flight work that matches the running process.
+ * A request that finds during or after the drain that it no longer needs the restart, since the change that needed it
+ * was reverted, withdraws the restart.
  * A rushx script that arrives while a restart is pending waits for the restart instead, since it may not exit until
  * it is stopped and the restart would otherwise wait for it.
  */
@@ -116,28 +191,37 @@ export class WorkspaceRestartArbiter {
   /**
    * Whether another tracked request needs to restart the daemon for its environment: it waits for the drain, or it
    * has drained and not yet left. A request that needs a restart leaves once the restart is planned, or once it
-   * fails or is cancelled.
+   * fails or is cancelled. A request that finds it no longer needs one withdraws its restart.
    */
   public hasPendingRestart(ticket: IWorkspaceRestartTicket): boolean {
     return Array.from(this.#restartCandidates).some((candidate: IMutableTicket) => candidate !== ticket);
   }
 
+  /**
+   * Records that a request which drained for a restart no longer needs one, for example because the change was
+   * reverted, so that requests waiting for its restart stop waiting. Does nothing for other requests.
+   */
+  public withdrawRestart(ticket: IWorkspaceRestartTicket): void {
+    if (this.#restartCandidates.delete(ticket as IMutableTicket)) this.#notifyChange();
+  }
+
   /**
    * Waits until no other tracked request is still being served by this process, then counts the ticket
-   * as served again so concurrent restart candidates proceed one at a time. Returns how many milliseconds of the
-   * wait did not spend `waitTimeoutMs` (see {@link IWorkspaceRestartDrainOptions.waivesTimeoutForServedWork}).
-   * From when the wait begins until the ticket leaves, {@link WorkspaceRestartArbiter.hasPendingRestart} reports
-   * the restart to other requests.
+   * as served again so concurrent restart candidates proceed one at a time. From when the wait begins until the
+   * ticket leaves, {@link WorkspaceRestartArbiter.hasPendingRestart} reports the restart to other requests. If
+   * `recheck` finds that the request no longer needs the restart, the wait ends then and the restart is withdrawn.
    */
   public async waitForDrainAsync(
     ticket: IWorkspaceRestartTicket,
-    options: IWorkspaceRestartDrainOptions
-  ): Promise<number> {
+    options: IWorkspaceRestartDrainOptions,
+    recheck?: IWorkspaceRestartRecheck
+  ): Promise<IWorkspaceRestartWaitResult> {
     const { restartCause } = options;
     return await this.#waitAsync(ticket, options, {
       restarts: true,
       isBlocked: () => this.#serving.size > 0,
       countWaitedFor: () => this.#serving.size,
+      recheck,
       noWaitMessage:
         restartCause === undefined
           ? 'Another environment is still being served; the request did not wait for a restart.'
@@ -159,11 +243,12 @@ export class WorkspaceRestartArbiter {
   public async waitForPendingRestartAsync(
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions
-  ): Promise<number> {
+  ): Promise<IWorkspaceRestartWaitResult> {
     return await this.#waitAsync(ticket, options, {
       restarts: false,
       isBlocked: () => this.hasPendingRestart(ticket),
       countWaitedFor: () => new Set([...this.#serving, ...this.#restartCandidates]).size,
+      recheck: undefined,
       noWaitMessage:
         'Another request is waiting to restart the daemon for its environment; the rushx script did not wait ' +
         'for the restart.',
@@ -178,7 +263,7 @@ export class WorkspaceRestartArbiter {
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions,
     kind: IWaitKind
-  ): Promise<number> {
+  ): Promise<IWorkspaceRestartWaitResult> {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left || state.waitingForDrain) throw new Error('The restart ticket is not being served.');
     if (kind.restarts) this.#restartCandidates.add(state);
@@ -195,8 +280,12 @@ export class WorkspaceRestartArbiter {
         options.onServingCountChanged?.(count);
       }
     };
+    // The ticket is a restart candidate for as long as the wait lasts, so withdrawing its restart wakes the wait.
+    const recheck: RestartRecheck | undefined = kind.recheck
+      ? new RestartRecheck(kind.recheck, () => this.withdrawRestart(ticket))
+      : undefined;
     try {
-      while (kind.isBlocked()) {
+      while (!recheck?.withdrawn && kind.isBlocked()) {
         if (options.noWait) {
           throw new RequestSchedulerError(RequestSchedulerErrorCode.NoWait, kind.noWaitMessage);
         }
@@ -218,8 +307,9 @@ export class WorkspaceRestartArbiter {
           else if (remainingMs !== undefined) remainingMs -= elapsedMs;
         }
       }
-      return waivedMs;
+      return { waivedMs, restartWithdrawn: recheck?.withdrawn === true };
     } finally {
+      recheck?.stop();
       state.waitingForDrain = false;
       this.#serve(state);
     }
diff --git a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
index ccdf2c637a..5780afed79 100644
--- a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
@@ -20,7 +20,8 @@ import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import {
   WorkspaceRestartArbiter,
   type IWorkspaceRestartTicket,
-  type IWorkspaceRestartTicketOptions
+  type IWorkspaceRestartTicketOptions,
+  type IWorkspaceRestartWaitResult
 } from '../WorkspaceRestartArbiter';
 
 const INSTALLATION_REMOVED: DaemonRestartReason = {
@@ -74,11 +75,11 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
       waitTimeoutMs: 50,
       waitTimeoutIsDefault: true
     });
-    const draining: Promise<void> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket);
     await delayAsync(250);
     expect(await isSettledAsync(draining)).toBe(false);
     arbiter.leave(serving);
-    await draining;
+    expect(await draining).toBe(true);
     // The later admission steps keep what was left of the default when the drain began.
     expect(admission.remainingAdmission).toMatchObject({ waitTimeoutIsDefault: true });
     expect(admission.remainingAdmission?.waitTimeoutMs).toBeGreaterThan(0);
@@ -110,7 +111,7 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
       waitTimeoutMs: 50,
       waitTimeoutIsDefault: true
     });
-    const draining: Promise<void> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket);
     const late: IWorkspaceRestartTicket = arbiter.enter();
     await delayAsync(150);
     expect(await isSettledAsync(draining)).toBe(false);
@@ -143,7 +144,7 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 10_000 });
     // Such as capturing the request's inputs before the wait, and planning the restart after it.
     await delayAsync(1_000);
-    const draining: Promise<void> = admission.waitForRestartDrainAsync(arbiter, ticket);
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket);
     await delayAsync(300);
     arbiter.leave(serving);
     await draining;
@@ -156,6 +157,26 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     expect(arbiter.servingCount).toBe(0);
   });
 
+  it('ends the drain once a recheck finds that the restart is no longer needed, and spends the time waited', async () => {
+    const { admission, arbiter, serving, ticket } = createDrainTest({ waitTimeoutMs: 10_000 });
+    const answers: boolean[] = [true, false];
+    let calls: number = 0;
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket, undefined, {
+      intervalMs: 100,
+      stillNeedsRestartAsync: async () => answers[calls++]
+    });
+    // The other request is still being served.
+    expect(await draining).toBe(false);
+    expect(calls).toBe(2);
+    const remainingMs: number | undefined = admission.remainingAdmission?.waitTimeoutMs;
+    expect(remainingMs).toBeLessThanOrEqual(9_810);
+    expect(remainingMs).toBeGreaterThan(9_000);
+    arbiter.leave(ticket);
+    arbiter.leave(serving);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
+
   it('applies no-wait to the drain', async () => {
     const { admission, arbiter, serving, ticket } = createDrainTest({ noWait: true });
     const error: unknown = await admission
@@ -273,7 +294,7 @@ interface IPendingRestartTest {
   readonly admission: RequestAdmissionController;
   readonly arbiter: WorkspaceRestartArbiter;
   readonly candidate: IWorkspaceRestartTicket;
-  readonly draining: Promise<number>;
+  readonly draining: Promise<IWorkspaceRestartWaitResult>;
   readonly positions: number[];
   readonly script: IWorkspaceRestartTicket;
   readonly serving: IWorkspaceRestartTicket;
@@ -287,7 +308,7 @@ function createPendingRestartTest(
   const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
   const candidate: IWorkspaceRestartTicket = arbiter.enter();
-  const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, {
+  const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
     abortSignal: new AbortController().signal,
     noWait: undefined,
     waitTimeoutMs: undefined
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
index 3f91594741..74da42a9d0 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
@@ -7,7 +7,9 @@ import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestSche
 import {
   WorkspaceRestartArbiter,
   type IWorkspaceRestartDrainOptions,
-  type IWorkspaceRestartTicket
+  type IWorkspaceRestartRecheck,
+  type IWorkspaceRestartTicket,
+  type IWorkspaceRestartWaitResult
 } from '../WorkspaceRestartArbiter';
 
 const WAIT: { abortSignal: AbortSignal; noWait: undefined; waitTimeoutMs: undefined } = {
@@ -26,6 +28,23 @@ async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
   return settled;
 }
 
+/** Answers each recheck from a list, repeating the last answer. An `Error` answer rejects. */
+class ScriptedRecheck implements IWorkspaceRestartRecheck {
+  public readonly intervalMs: number = 20;
+  public calls: number = 0;
+  readonly #answers: ReadonlyArray<boolean | Error>;
+
+  public constructor(answers: ReadonlyArray<boolean | Error>) {
+    this.#answers = answers;
+  }
+
+  public readonly stillNeedsRestartAsync: () => Promise<boolean> = async () => {
+    const answer: boolean | Error = this.#answers[Math.min(this.calls++, this.#answers.length - 1)];
+    if (answer instanceof Error) throw answer;
+    return answer;
+  };
+}
+
 function expectWaitTimeout(error: unknown): RequestSchedulerError {
   expect(error).toBeInstanceOf(RequestSchedulerError);
   expect((error as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
@@ -47,8 +66,8 @@ describe(WorkspaceRestartArbiter.name, () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const first: IWorkspaceRestartTicket = arbiter.enter();
     const second: IWorkspaceRestartTicket = arbiter.enter();
-    const firstWait: Promise<number> = arbiter.waitForDrainAsync(first, WAIT);
-    const secondWait: Promise<number> = arbiter.waitForDrainAsync(second, WAIT);
+    const firstWait: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(first, WAIT);
+    const secondWait: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(second, WAIT);
     const late: IWorkspaceRestartTicket = arbiter.enter();
     arbiter.leave(serving);
     expect(await isSettledAsync(firstWait)).toBe(false);
@@ -70,7 +89,7 @@ describe(WorkspaceRestartArbiter.name, () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const ticket: IWorkspaceRestartTicket = arbiter.enter();
     const abort: AbortController = new AbortController();
-    const waiting: Promise<number> = arbiter.waitForDrainAsync(ticket, {
+    const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(ticket, {
       abortSignal: abort.signal,
       noWait: mode === 'no-wait' ? true : undefined,
       waitTimeoutMs: mode === 'timeout' ? 10 : undefined
@@ -91,7 +110,7 @@ describe(WorkspaceRestartArbiter.name, () => {
     const second: IWorkspaceRestartTicket = arbiter.enter();
     const candidate: IWorkspaceRestartTicket = arbiter.enter();
     const counts: number[] = [];
-    const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, {
+    const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
       ...WAIT,
       onServingCountChanged: (count: number) => counts.push(count)
     });
@@ -103,7 +122,7 @@ describe(WorkspaceRestartArbiter.name, () => {
     // Another restart candidate stops counting once it waits too; it then waits for the first candidate.
     const other: IWorkspaceRestartTicket = arbiter.enter();
     const otherCounts: number[] = [];
-    const otherWaiting: Promise<number> = arbiter.waitForDrainAsync(other, {
+    const otherWaiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(other, {
       ...WAIT,
       onServingCountChanged: (count: number) => otherCounts.push(count)
     });
@@ -153,11 +172,11 @@ describe(WorkspaceRestartArbiter.name, () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIVED);
       await delayAsync(150);
       expect(await isSettledAsync(waiting)).toBe(false);
       arbiter.leave(earlier);
-      expect(await waiting).toBeGreaterThanOrEqual(140);
+      expect((await waiting).waivedMs).toBeGreaterThanOrEqual(140);
       arbiter.leave(candidate);
       expect(arbiter.servingCount).toBe(0);
     });
@@ -166,7 +185,7 @@ describe(WorkspaceRestartArbiter.name, () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIVED);
       const late: IWorkspaceRestartTicket = arbiter.enter();
       await delayAsync(150);
       expect(await isSettledAsync(waiting)).toBe(false);
@@ -216,12 +235,12 @@ describe(WorkspaceRestartArbiter.name, () => {
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIVED);
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIVED);
       arbiter.leave(script);
       await delayAsync(150);
       expect(await isSettledAsync(waiting)).toBe(false);
       arbiter.leave(earlier);
-      expect(await waiting).toBeGreaterThanOrEqual(140);
+      expect((await waiting).waivedMs).toBeGreaterThanOrEqual(140);
       arbiter.leave(candidate);
       expect(arbiter.servingCount).toBe(0);
     });
@@ -249,13 +268,13 @@ describe(WorkspaceRestartArbiter.name, () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const waiting: Promise<number> = arbiter.waitForDrainAsync(candidate, {
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
         ...WAIT,
         waitTimeoutMs: 5_000
       });
       await delayAsync(20);
       arbiter.leave(earlier);
-      expect(await waiting).toBe(0);
+      expect((await waiting).waivedMs).toBe(0);
       arbiter.leave(candidate);
       expect(arbiter.servingCount).toBe(0);
     });
@@ -273,7 +292,7 @@ describe(WorkspaceRestartArbiter.name, () => {
       const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
       expect(arbiter.hasPendingRestart(running)).toBe(false);
-      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
       expect(arbiter.hasPendingRestart(running)).toBe(true);
       expect(arbiter.hasPendingRestart(candidate)).toBe(false);
       arbiter.leave(running);
@@ -292,7 +311,7 @@ describe(WorkspaceRestartArbiter.name, () => {
       const serving: IWorkspaceRestartTicket = arbiter.enter();
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const counts: number[] = [];
-      const waivedMs: number = await arbiter.waitForPendingRestartAsync(script, {
+      const { waivedMs } = await arbiter.waitForPendingRestartAsync(script, {
         ...WAIT,
         noWait: true,
         onServingCountChanged: (count: number) => counts.push(count)
@@ -308,10 +327,10 @@ describe(WorkspaceRestartArbiter.name, () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const counts: number[] = [];
-      const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, {
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, {
         ...WAIT,
         onServingCountChanged: (count: number) => counts.push(count)
       });
@@ -322,7 +341,7 @@ describe(WorkspaceRestartArbiter.name, () => {
       expect(counts).toEqual([2, 1]);
       expect(await isSettledAsync(waiting)).toBe(false);
       arbiter.leave(candidate);
-      expect(await waiting).toBe(0);
+      expect((await waiting).waivedMs).toBe(0);
       expect(arbiter.servingCount).toBe(1);
       arbiter.leave(script);
       expect(arbiter.servingCount).toBe(0);
@@ -333,10 +352,10 @@ describe(WorkspaceRestartArbiter.name, () => {
       const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const first: IWorkspaceRestartTicket = arbiter.enter();
       const second: IWorkspaceRestartTicket = arbiter.enter();
-      const firstDrain: Promise<number> = arbiter.waitForDrainAsync(first, WAIT);
-      const secondDrain: Promise<number> = arbiter.waitForDrainAsync(second, WAIT);
+      const firstDrain: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(first, WAIT);
+      const secondDrain: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(second, WAIT);
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
-      const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIT);
       arbiter.leave(running);
       await firstDrain;
       arbiter.leave(first);
@@ -365,10 +384,10 @@ describe(WorkspaceRestartArbiter.name, () => {
         const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
         const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
         const candidate: IWorkspaceRestartTicket = arbiter.enter();
-        const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+        const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
         const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
         const abort: AbortController = new AbortController();
-        const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, {
+        const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, {
           abortSignal: abort.signal,
           noWait: mode === 'no-wait' ? true : undefined,
           waitTimeoutMs: mode === 'timeout' ? 10 : undefined
@@ -392,15 +411,15 @@ describe(WorkspaceRestartArbiter.name, () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
-      const waiting: Promise<number> = arbiter.waitForPendingRestartAsync(script, WAIVED);
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIVED);
       await delayAsync(150);
       expect(await isSettledAsync(waiting)).toBe(false);
       arbiter.leave(earlier);
       await draining;
       arbiter.leave(candidate);
-      expect(await waiting).toBeGreaterThanOrEqual(140);
+      expect((await waiting).waivedMs).toBeGreaterThanOrEqual(140);
       arbiter.leave(script);
       expect(arbiter.servingCount).toBe(0);
     });
@@ -409,7 +428,7 @@ describe(WorkspaceRestartArbiter.name, () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const outcome: Promise<unknown> = arbiter
         .waitForPendingRestartAsync(script, WAIVED)
@@ -432,7 +451,7 @@ describe(WorkspaceRestartArbiter.name, () => {
       const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const earlier: IWorkspaceRestartTicket = arbiter.enter();
       const candidate: IWorkspaceRestartTicket = arbiter.enter();
-      const draining: Promise<number> = arbiter.waitForDrainAsync(candidate, WAIT);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT);
       const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
       const outcome: Promise<unknown> = arbiter
         .waitForPendingRestartAsync(script, WAIVED)
@@ -446,4 +465,115 @@ describe(WorkspaceRestartArbiter.name, () => {
       expect(arbiter.servingCount).toBe(0);
     });
   });
+
+  describe('rechecks while a restart candidate drains', () => {
+    it('withdraws the restart once it is no longer needed, while other requests are served, and wakes scripts', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const recheck: ScriptedRecheck = new ScriptedRecheck([true, false]);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT, recheck);
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      expect(arbiter.hasPendingRestart(script)).toBe(true);
+      expect(await draining).toEqual({ waivedMs: 0, restartWithdrawn: true });
+      expect(recheck.calls).toBe(2);
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      await waiting;
+      expect(arbiter.servingCount).toBe(3);
+      for (const served of [serving, candidate, script]) arbiter.leave(served);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('keeps waiting while the restart is still needed, and stops rechecking once the drain ends', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const recheck: ScriptedRecheck = new ScriptedRecheck([true]);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT, recheck);
+      await delayAsync(150);
+      expect(await isSettledAsync(draining)).toBe(false);
+      expect(recheck.calls).toBeGreaterThanOrEqual(2);
+      arbiter.leave(serving);
+      expect(await draining).toEqual({ waivedMs: 0, restartWithdrawn: false });
+      const calls: number = recheck.calls;
+      await delayAsync(100);
+      expect(recheck.calls).toBe(calls);
+      // The restart stays pending until the candidate plans it and leaves.
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      expect(arbiter.hasPendingRestart(script)).toBe(true);
+      arbiter.leave(candidate);
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it('counts a recheck that fails as still needing the restart, and tries again', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const serving: IWorkspaceRestartTicket = arbiter.enter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      const recheck: ScriptedRecheck = new ScriptedRecheck([new Error('rush.json was being rewritten'), false]);
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, WAIT, recheck);
+      expect(await draining).toEqual({ waivedMs: 0, restartWithdrawn: true });
+      expect(recheck.calls).toBe(2);
+      arbiter.leave(candidate);
+      arbiter.leave(serving);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
+    it.each(['timeout', 'abort'])(
+      'still reports a %s while a recheck runs, and ignores the recheck once the wait has failed',
+      async (mode) => {
+        const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+        const serving: IWorkspaceRestartTicket = arbiter.enter();
+        const candidate: IWorkspaceRestartTicket = arbiter.enter();
+        let finishRecheck: ((stillNeeded: boolean) => void) | undefined;
+        const recheck: IWorkspaceRestartRecheck = {
+          intervalMs: 10,
+          stillNeedsRestartAsync: () =>
+            new Promise<boolean>((resolve) => {
+              finishRecheck = resolve;
+            })
+        };
+        const abort: AbortController = new AbortController();
+        const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(
+          candidate,
+          { ...WAIT, abortSignal: abort.signal, waitTimeoutMs: mode === 'timeout' ? 100 : undefined },
+          recheck
+        );
+        await delayAsync(50);
+        expect(finishRecheck).toBeDefined();
+        if (mode === 'abort') abort.abort();
+        const error: unknown = await waiting.catch((caught: unknown) => caught);
+        expect((error as RequestSchedulerError).code).toBe(
+          mode === 'timeout' ? RequestSchedulerErrorCode.WaitTimeout : RequestSchedulerErrorCode.Aborted
+        );
+        finishRecheck!(false);
+        await delayAsync(50);
+        // The request fails and leaves; until then, its restart is still pending.
+        const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+        expect(arbiter.hasPendingRestart(script)).toBe(true);
+        for (const served of [candidate, serving, script]) arbiter.leave(served);
+        expect(arbiter.servingCount).toBe(0);
+      }
+    );
+
+    it('lets a request that drained withdraw its restart, which wakes scripts that wait for it', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const candidate: IWorkspaceRestartTicket = arbiter.enter();
+      expect(await arbiter.waitForDrainAsync(candidate, WAIT)).toEqual({ waivedMs: 0, restartWithdrawn: false });
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, WAIT);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      // Only a restart candidate has a restart to withdraw.
+      arbiter.withdrawRestart(script);
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.withdrawRestart(candidate);
+      expect(await waiting).toEqual({ waivedMs: 0, restartWithdrawn: false });
+      expect(arbiter.hasPendingRestart(script)).toBe(false);
+      arbiter.leave(candidate);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index 4bff3d0a71..1e8ffdf642 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -1,10 +1,18 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync)
+  };
+});
+
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import { captureWorkspaceInputFingerprintAsync, WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 import {
   DaemonFrameType,
   decodeDaemonControlMessage,
@@ -14,7 +22,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, responseSnapshot } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
@@ -24,6 +32,9 @@ jest.setTimeout(60_000);
 const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
 const RELEASE_FILE: string = 'release-serve';
 const LATE_RELEASE_FILE: string = 'release-serve2';
+const inputCaptureMock: jest.MockedFunction<typeof captureWorkspaceInputFingerprintAsync> = jest.mocked(
+  captureWorkspaceInputFingerprintAsync
+);
 
 function delayAsync(ms: number): Promise<void> {
   return new Promise<void>((resolve) => setTimeout(resolve, ms));
@@ -137,6 +148,27 @@ async function startRequestAsync(
   return { exchange, positions, settled: () => settled };
 }
 
+/**
+ * Changes an input that only a new daemon process picks up, as an install does, and returns a function that
+ * restores its content.
+ */
+function changeInstallation(fixture: DaemonGraphTestFixture): () => void {
+  const filePath: string = path.join(fixture.folder, 'common/config/rush/npm-shrinkwrap.json');
+  const original: string = fs.readFileSync(filePath, 'utf8');
+  fs.writeFileSync(filePath, `${original}\n`);
+  return () => fs.writeFileSync(filePath, original);
+}
+
+async function closeRestartingFixtureAsync(fixture: DaemonGraphTestFixture): Promise<void> {
+  try {
+    await fixture.host.closeAsync();
+    await fixture.host.restartCompleted;
+  } finally {
+    await stopSuccessorAsync(fixture.host.paths);
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
 function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
   const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
   const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
@@ -303,3 +335,218 @@ describe('workspace admission while a served rushx script runs', () => {
     }
   });
 });
+
+describe('a restart drain whose change is reverted', () => {
+  const SERVE2: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom', invocationKind: 'rushx' };
+
+  it('serves the request on this process, while the script that holds the drain still runs', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      // A transition would cancel the watcher, and a request that arrives when nothing needs one does not transition.
+      const watch: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'watch'], {});
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the build to wait for the drain');
+      const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
+        ...SERVE2,
+        cwd: path.join(fixture.folder, 'a')
+      });
+      await waitForAsync(() => late.positions.length > 0 || late.settled(), 'the script to wait for the restart');
+      // Several rechecks find that the change is still there.
+      await delayAsync(2500);
+      expect(build.settled()).toBe(false);
+      expect(fixture.runs()).not.toContain('serve2-start');
+
+      const revertedAt: number = Date.now();
+      revert();
+      // The build used to wait for the script to exit, which a dev server never does (#127).
+      expectSuccess(await build.exchange);
+      expect(Date.now() - revertedAt).toBeLessThan(5000);
+      expect(script.settled()).toBe(false);
+      // The later script no longer waits for a restart either.
+      await waitForAsync(() => fixture.runs().includes('serve2-start'), 'the later script to start');
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+      expect(fixture.host.workspaceStatus.lastReloadTier).not.toBe(WorkspaceInputChangeTier.Restart);
+      expect(watch.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expectSuccess(await late.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('serves a graph control request on this process', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const pause: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'pause'], {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => pause.positions.length > 0 || pause.settled(), 'the request to wait for the drain');
+      await delayAsync(1500);
+      expect(pause.settled()).toBe(false);
+
+      const revertedAt: number = Date.now();
+      revert();
+      expect(responseSnapshot(await pause.exchange)).toMatchObject({ pauseNextIteration: true });
+      expect(Date.now() - revertedAt).toBeLessThan(5000);
+      expect(script.settled()).toBe(false);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('still restarts after the drain when the change stays', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeInstallation(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the build to wait for the drain');
+      await delayAsync(2500);
+      expect(build.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect((await build.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('does not keep scripts waiting when the request finds after its drain that it no longer needs the restart', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      // Project c builds until the test creates release-build.
+      created.write(
+        'c/build.cjs',
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c-start\\n');" +
+          "const t=setInterval(()=>{if(fs.existsSync('../release-build')){clearInterval(t);" +
+          "fs.appendFileSync('../runs.txt','c-end\\n');}},20);"
+      );
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, ['build', '--to', 'c'], {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the build to wait for the drain');
+      const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
+        ...SERVE2,
+        cwd: path.join(fixture.folder, 'a')
+      });
+      await waitForAsync(() => late.positions.length > 0 || late.settled(), 'the script to wait for the restart');
+
+      // The drain ends as the script exits, so the build most likely finds the revert only after the drain.
+      revert();
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      await waitForAsync(() => fixture.runs().includes('c-start'), 'the build to start');
+      // The later script used to wait for the build to finish, since its restart stayed pending.
+      await waitForAsync(() => fixture.runs().includes('serve2-start'), 'the later script to start');
+      expect(fixture.runs()).not.toContain('c-end');
+
+      fixture.write('release-build', '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      expectSuccess(await build.exchange);
+      expectSuccess(await late.exchange);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      fixture.write('release-build', '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+
+  it('shares one capture a second between the requests that wait for the drain', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const builds: IStreamedRequest[] = [];
+      // The requests arrive over about a second, so each one's checks would start at another time.
+      for (let i: number = 0; i < 16; i++) {
+        builds.push(await startRequestAsync(fixture, BUILD_A, { admission: { waitTimeoutMs: 20_000 } }));
+        await delayAsync(60);
+      }
+      await waitForAsync(
+        () => builds.every((build) => build.positions.length > 0 || build.settled()),
+        'every build to wait for the drain'
+      );
+      inputCaptureMock.mockClear();
+      await delayAsync(3000);
+      // Each waiting request used to capture its inputs once a second, 16 captures a second in all (#2239).
+      const captures: number = inputCaptureMock.mock.calls.length;
+      expect(captures).toBeGreaterThanOrEqual(2);
+      expect(captures).toBeLessThanOrEqual(5);
+      expect(builds.some((build) => build.settled())).toBe(false);
+
+      const revertedAt: number = Date.now();
+      revert();
+      for (const build of builds) {
+        expectSuccess(await build.exchange);
+      }
+      expect(Date.now() - revertedAt).toBeLessThan(10_000);
+      expect(script.settled()).toBe(false);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
+});

From 1b715309390f321776b6f0d4b943a202adeca9df Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:05 +0000
Subject: [PATCH 071/265] [rush-daemon] ODSP_TELEMETRY_TAG no longer restarts
 the daemon

Swarm integration step 56; original commit 442af4ed14 (merge of swarm/r02-t168-int at b9b7f9dedd).
Scope: task 168.

Brings r02's task 168 (board 2939, re-tipped onto batch B in board 3030): setting, changing or unsetting ODSP_TELEMETRY_TAG keeps the warm daemon. Second agents: t07 board 3004 and m03 board 2975.

s17 batch D1, item 4 of 10. Gate: ch01 GATE OK board 3310 (tree eadadd0318)

Commits folded into this step (3):
- 4a2af75d2b [rush-lib] [rush-daemon] Keep the warm daemon when a request's telemetry tag changes (task 168)
- efb14d246a [rush-daemon] Log an early failed result's telemetry once its continuing work settles (task 168)
- c888d079b3 [rush-lib] Test that the telemetry flush wait clears its timer (task 168)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...try-tag-keeps-daemon_2026-09-29-01-38.json |  10 +
 ...lt-telemetry-settles_2026-09-29-01-54.json |  10 +
 ...try-tag-keeps-daemon_2026-09-29-01-38.json |  10 +
 .../rush-daemon/src/DaemonRequestTelemetry.ts |   6 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  97 +++++++---
 .../rush-daemon/src/PhasedRequestTelemetry.ts |  21 +-
 .../test/PhasedRequestEarlyFailure.test.ts    | 183 +++++++++++++++---
 .../ProductionDaemonRequestResolver.test.ts   |  45 +++++
 .../VersionSelectedDaemonLauncher.test.ts     |   1 +
 .../test/WorkspaceReloadTierStatus.test.ts    |   2 +
 .../src/api/WorkspaceInputFingerprint.ts      |  11 +-
 .../test/PhasedCommandEngineTelemetry.test.ts |  10 +
 .../test/WorkspaceInputFingerprint.test.ts    |   5 +
 13 files changed, 346 insertions(+), 65 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/telemetry-tag-keeps-daemon_2026-09-29-01-38.json
 create mode 100644 common/changes/@rushstack/rush-daemon/early-result-telemetry-settles_2026-09-29-01-54.json
 create mode 100644 common/changes/@rushstack/rush-daemon/telemetry-tag-keeps-daemon_2026-09-29-01-38.json

diff --git a/common/changes/@microsoft/rush/telemetry-tag-keeps-daemon_2026-09-29-01-38.json b/common/changes/@microsoft/rush/telemetry-tag-keeps-daemon_2026-09-29-01-38.json
new file mode 100644
index 0000000000..f0d7724c01
--- /dev/null
+++ b/common/changes/@microsoft/rush/telemetry-tag-keeps-daemon_2026-09-29-01-38.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `ODSP_TELEMETRY_TAG` to `workspaceFingerprintIgnoredEnvironmentVariables` and `workspaceRequestScopedEnvironmentVariables`, so a request that sets, changes or unsets its telemetry tag keeps the warm Rush daemon instead of restarting it, and the daemon no longer inherits the tag of the client that started it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/early-result-telemetry-settles_2026-09-29-01-54.json b/common/changes/@rushstack/rush-daemon/early-result-telemetry-settles_2026-09-29-01-54.json
new file mode 100644
index 0000000000..76de199743
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/early-result-telemetry-settles_2026-09-29-01-54.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a failed build returns early while some of its operations still run, log its telemetry entry once the iteration ends, so those operations have their final status instead of `Aborted`. The entry keeps the durations and exit code of the result that the client received.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/telemetry-tag-keeps-daemon_2026-09-29-01-38.json b/common/changes/@rushstack/rush-daemon/telemetry-tag-keeps-daemon_2026-09-29-01-38.json
new file mode 100644
index 0000000000..0a002c9007
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/telemetry-tag-keeps-daemon_2026-09-29-01-38.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that requests that set, change or unset `ODSP_TELEMETRY_TAG` keep the warm daemon, and that each telemetry entry carries its own request's tag.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/DaemonRequestTelemetry.ts b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
index 728d1a6a88..d3b5d8f4f5 100644
--- a/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
+++ b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
@@ -28,8 +28,10 @@ const RUSH_MEASURE_PREFIX: string = 'rush:';
 
 /**
  * Request environment variables that attribute an entry to its caller. They are read from the request, never from
- * the daemon's own environment, and are not part of the daemon's environment identity. Native Rush rejects unknown
- * `RUSH_` variables, so the tag variable does not use that prefix.
+ * the daemon's own environment. Each is in `workspaceFingerprintIgnoredEnvironmentVariables` and
+ * `workspaceRequestScopedEnvironmentVariables`, so a request that sets, changes or unsets one keeps the warm
+ * daemon, and the daemon's own `process.env` never has them. Native Rush rejects unknown `RUSH_` variables, so the
+ * tag variable does not use that prefix.
  */
 const ATTRIBUTION_VARIABLES: Readonly<Record<string, string>> = {
   agentSessionId: 'COPILOT_AGENT_SESSION_ID',
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index e7bb86417b..852beef9ed 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -50,6 +50,7 @@ import {
 import {
   collectPhasedRequestTelemetryRecords,
   type IPhasedRequestTelemetryMeasure,
+  type IPhasedRequestTelemetryObservations,
   type IPhasedRequestTelemetryRecords,
   type IPhasedRequestTelemetrySink
 } from './PhasedRequestTelemetry';
@@ -129,6 +130,8 @@ interface IBatchEntry extends IPreparedPhasedRequest {
   finishPromise: Promise<void> | undefined;
   /** The `performance.now()` timestamp at which the entry was taken into a batch. */
   joinedTimeMs: number | undefined;
+  /** Logs the telemetry entry of an entry that continues after its result, once its iteration ended. */
+  logTelemetryAfterIteration: (() => void) | undefined;
   outputError: unknown;
   participated: boolean;
   reject: (error: unknown) => void;
@@ -358,6 +361,7 @@ class PhasedRequestBatchCoordinator {
         executionStarted: false,
         finishPromise: undefined,
         joinedTimeMs: undefined,
+        logTelemetryAfterIteration: undefined,
         outputError: undefined,
         participated: false,
         reject,
@@ -855,6 +859,9 @@ class PhasedRequestBatchCoordinator {
   }
 
   #settleContinuingEntry(entry: IBatchEntry): void {
+    const logTelemetry: (() => void) | undefined = entry.logTelemetryAfterIteration;
+    entry.logTelemetryAfterIteration = undefined;
+    logTelemetry?.();
     const settle: (() => void) | undefined = entry.settleAfterIteration;
     if (!settle) {
       return;
@@ -966,41 +973,64 @@ class PhasedRequestBatchCoordinator {
     }
   }
 
+  /**
+   * Reports the request to its telemetry sink, with the timing of the result that the client receives.
+   *
+   * @remarks
+   * For an entry that continues after its result, the operations that its failure did not block still run, so
+   * the report waits until the iteration ended, and `#settleContinuingEntry` sends it with their final
+   * statuses.
+   */
   #logTelemetry(
     entry: IBatchEntry,
     result: IDaemonPhasedRequestResult,
     batchScheduled: boolean,
-    iterationInProgress: boolean
+    earlyResult: boolean
   ): void {
     const { batchTimings: timings, requestSink, telemetry } = entry;
     if (!telemetry || !requestSink || !timings) {
       return;
     }
-    try {
-      const resultTimeMs: number = performance.now();
-      const executionStartTimeMs: number = Math.max(timings.startTimeMs, entry.joinedTimeMs ?? 0);
-      const { records, countRetained }: IPhasedRequestTelemetryRecords = collectPhasedRequestTelemetryRecords({
-        activeOperations: entry.selection.activeOperations,
-        graph: this.#graph,
-        observations: requestSink,
-        upToDateTimeMs: executionStartTimeMs
-      });
-      telemetry.logRequest({
-        request: entry.request,
-        result,
-        records,
-        countRetained,
-        batchSize: timings.batchSize,
-        scheduled: batchScheduled,
-        earlyResult: iterationInProgress,
-        receivedTimeMs: entry.startTimeMs,
-        executionStartTimeMs,
-        iterationStartTimeMs: batchScheduled ? timings.scheduleStartTimeMs : undefined,
-        resultTimeMs,
-        measures: createTelemetryMeasures(entry, timings, executionStartTimeMs, resultTimeMs)
-      });
-    } catch {
-      // Telemetry never changes a request's result.
+    const resultTimeMs: number = performance.now();
+    const executionStartTimeMs: number = Math.max(timings.startTimeMs, entry.joinedTimeMs ?? 0);
+    // Measured now, because the batch timings go on changing until the iteration ends.
+    const measures: IPhasedRequestTelemetryMeasure[] = createTelemetryMeasures(
+      entry,
+      timings,
+      executionStartTimeMs,
+      resultTimeMs
+    );
+    const logRequest = (observations: IPhasedRequestTelemetryObservations): void => {
+      try {
+        const { records, countRetained }: IPhasedRequestTelemetryRecords =
+          collectPhasedRequestTelemetryRecords({
+            activeOperations: entry.selection.activeOperations,
+            graph: this.#graph,
+            observations,
+            upToDateTimeMs: executionStartTimeMs
+          });
+        telemetry.logRequest({
+          request: entry.request,
+          result,
+          records,
+          countRetained,
+          batchSize: timings.batchSize,
+          scheduled: batchScheduled,
+          earlyResult,
+          receivedTimeMs: entry.startTimeMs,
+          executionStartTimeMs,
+          iterationStartTimeMs: batchScheduled ? timings.scheduleStartTimeMs : undefined,
+          resultTimeMs,
+          measures
+        });
+      } catch {
+        // Telemetry never changes a request's result.
+      }
+    };
+    if (entry.continuesAfterResult) {
+      entry.logTelemetryAfterIteration = () => logRequest(getIterationObservations(requestSink));
+    } else {
+      logRequest(requestSink);
     }
   }
 
@@ -1076,6 +1106,21 @@ function createTelemetryMeasures(
   return measures;
 }
 
+/**
+ * The request's operations as the iteration's own records have them. The request's sink stops observing the
+ * iteration when it publishes an early result, so it has not seen what happened to them since. Once the
+ * iteration ended, these records have their final statuses.
+ */
+function getIterationObservations(requestSink: PhasedRequestEventSink): IPhasedRequestTelemetryObservations {
+  return {
+    getObservedResult: (operation: Operation) => {
+      const executionResult: IOperationExecutionResult | undefined =
+        requestSink.getScheduledResult(operation);
+      return executionResult ? { executionResult } : requestSink.getObservedResult(operation);
+    }
+  };
+}
+
 function createBatchReleaseBarrier(
   batch: ReadonlyArray<IBatchEntry>,
   releaseAsync: () => Promise<void>
diff --git a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
index aa1240dc21..64734b1891 100644
--- a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
+++ b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
@@ -35,7 +35,9 @@ export interface IPhasedRequestTelemetryReport {
   readonly result: IDaemonPhasedRequestResult;
   /**
    * The request's non-silent selected operations. Operations that this request did not need to run, because
-   * the warm graph had them up to date, are reported as `Skipped` with a zero-length stopwatch.
+   * the warm graph had them up to date, are reported as `Skipped` with a zero-length stopwatch. For a failed
+   * result that was published while operations of the request still ran, the records are collected once the
+   * iteration ended, so those operations have their final statuses.
    */
   readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
   /** How many of `records` were already up to date. */
@@ -44,7 +46,10 @@ export interface IPhasedRequestTelemetryReport {
   readonly batchSize: number;
   /** Whether the graph scheduled an iteration for the batch. */
   readonly scheduled: boolean;
-  /** Whether the result was produced while the shared iteration was still running for other requests. */
+  /**
+   * Whether the result was produced while the graph iteration was still running, for other requests or for
+   * operations of this request that its failure did not block.
+   */
   readonly earlyResult: boolean;
   /** When the router received the request. */
   readonly receivedTimeMs: number;
@@ -62,13 +67,19 @@ export interface IPhasedRequestTelemetryReport {
  * Receives one report for each phased request that took part in a graph iteration or no-op check.
  *
  * @remarks
- * The router invokes the sink before it writes the request's result. The sink must not throw; the router ignores
- * its errors so that telemetry never changes a result.
+ * The router invokes the sink before it writes the request's result, except for a failed result that it
+ * publishes while operations of the request that the failure did not block still run: that request is reported
+ * once the iteration ended, so that those operations have their final statuses. The report still has the timing
+ * of the result that the client received. The sink must not throw; the router ignores its errors so that telemetry
+ * never changes a result.
  *
  * @beta
  */
 export interface IPhasedRequestTelemetrySink {
-  /** Called once, before the result is written to the client. Errors are ignored. */
+  /**
+   * Called once for each request, before its result is written to the client, or once the iteration ended for a
+   * failed result that was published while operations of the request still ran. Errors are ignored.
+   */
   logRequest(report: IPhasedRequestTelemetryReport): void;
 }
 
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
index 4daab514cb..800d4049b0 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -2,9 +2,11 @@
 // See LICENSE in the project root for license information.
 
 import type { IDaemonPhasedRequest, IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
-import { OperationStatus } from '@microsoft/rush-lib';
+import { type IOperationRunnerContext, OperationStatus } from '@microsoft/rush-lib';
+import type { ITerminal } from '@rushstack/terminal';
 
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -16,6 +18,7 @@ import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRoute
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
 const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_D: string = 'project-d (_phase:test)';
 /** A consumes B and C, so A is the only target of a request that selects A. */
 const A_CONSUMES_B_AND_C: ReadonlyArray<readonly [string, string]> = [
   [OPERATION_A, OPERATION_B],
@@ -76,42 +79,54 @@ class SilentTestOperationRunner extends TestOperationRunner {
 
 /**
  * B fails and C is slow. Unless `failBeforeCStarts` is set, B fails only once C runs, so C is executing when B's
- * failure decides a request's result.
+ * failure decides a request's result. If `silentC` is set, C is silent. If `terminable` is set, the graph can
+ * terminate running operations, and C stops with `Aborted` when it does, as a runner that kills its process does.
+ * If `dependencies` names D, D succeeds as soon as it runs.
  */
 function createEarlyFailureFixture(
   dependencies: ReadonlyArray<readonly [string, string]> = A_CONSUMES_B_AND_C,
   failBeforeCStarts: boolean = false,
-  silentC: boolean = false
+  silentC: boolean = false,
+  terminable: boolean = false
 ): IEarlyFailureFixture {
   const startedC: IDeferred = createDeferred();
   const releaseC: IDeferred = createDeferred();
   const events: string[] = [];
-  const fixture: ITestRoutingFixture = createRoutingFixture(
-    new Map([
-      [OPERATION_A, new TestOperationRunner(OPERATION_A)],
-      [
-        OPERATION_B,
-        new TestOperationRunner(OPERATION_B, OperationStatus.Failure, async (): Promise<void> => {
-          if (!failBeforeCStarts) {
-            await startedC.promise;
-          }
-        })
-      ],
-      [
+  const runners: Map<string, TestOperationRunner> = new Map([
+    [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+    [
+      OPERATION_B,
+      new TestOperationRunner(OPERATION_B, OperationStatus.Failure, async (): Promise<void> => {
+        if (!failBeforeCStarts) {
+          await startedC.promise;
+        }
+      })
+    ],
+    [
+      OPERATION_C,
+      new (silentC ? SilentTestOperationRunner : TestOperationRunner)(
         OPERATION_C,
-        new (silentC ? SilentTestOperationRunner : TestOperationRunner)(
-          OPERATION_C,
-          OperationStatus.Success,
-          async (): Promise<void> => {
-            startedC.resolve();
-            await releaseC.promise;
-          }
-        )
-      ]
-    ]),
-    dependencies,
-    { parallelism: 2 }
-  );
+        OperationStatus.Success,
+        async (
+          terminal: ITerminal,
+          { abortSignal }: IOperationRunnerContext
+        ): Promise<void | OperationStatus> => {
+          startedC.resolve();
+          const terminated: Promise<OperationStatus> = new Promise((resolve) => {
+            abortSignal?.addEventListener('abort', () => resolve(OperationStatus.Aborted), { once: true });
+          });
+          return await Promise.race([releaseC.promise, terminated]);
+        }
+      )
+    ]
+  ]);
+  if (dependencies.some((pair: readonly [string, string]) => pair.includes(OPERATION_D))) {
+    runners.set(OPERATION_D, new TestOperationRunner(OPERATION_D));
+  }
+  const fixture: ITestRoutingFixture = createRoutingFixture(runners, dependencies, {
+    parallelism: 2,
+    supportsTerminateRunning: terminable
+  });
   fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
     events.push('acquired');
     return {
@@ -178,6 +193,28 @@ function getWrittenResults(client: TestPhasedRequestClient): ReadonlyArray<IDaem
   return client.writes.flatMap(({ result }: ITestClientWrite) => (result ? [result] : []));
 }
 
+/** Records the telemetry reports of a request, and when each was logged. */
+function recordTelemetry(
+  label: string,
+  events: string[],
+  reports: IPhasedRequestTelemetryReport[]
+): IPhasedRequestTelemetrySink {
+  return {
+    logRequest: (report: IPhasedRequestTelemetryReport): void => {
+      events.push(`logged:${label}`);
+      reports.push(report);
+    }
+  };
+}
+
+function getRecordedStatuses(report: IPhasedRequestTelemetryReport): Record<string, OperationStatus> {
+  const statuses: Record<string, OperationStatus> = {};
+  for (const [operation, record] of report.records) {
+    statuses[operation.name] = record.status;
+  }
+  return statuses;
+}
+
 interface IOrdinaryCase {
   readonly commandName: string;
   readonly dependencies: ReadonlyArray<readonly [string, string]>;
@@ -423,6 +460,96 @@ describe('phased requests that return early on failure', () => {
     expect(getWrittenResults(agent.client)).toHaveLength(1);
   });
 
+  it("logs a request that returned early once the work that continues settled, with that work's final status", async () => {
+    // A consumes B and D, and D consumes C, so D starts only after the request has its result.
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture([
+      [OPERATION_A, OPERATION_B],
+      [OPERATION_A, OPERATION_D],
+      [OPERATION_D, OPERATION_C]
+    ]);
+    const { events } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const reports: IPhasedRequestTelemetryReport[] = [];
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client,
+        false,
+        undefined,
+        undefined,
+        recordTelemetry('agent', events, reports)
+      ),
+      'agent',
+      events
+    );
+    await agent.written;
+    await settleAsync();
+    // C and D still run for this request, so its entry waits for them.
+    expect(events).toEqual(['acquired', 'wrote:agent']);
+    const [early] = getWrittenResults(agent.client);
+    expect(early.operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Blocked }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Failure }),
+      expect.objectContaining({ operationId: OPERATION_C, status: OperationStatus.Executing }),
+      expect.objectContaining({ operationId: OPERATION_D, status: OperationStatus.Waiting })
+    ]);
+
+    setup.releaseC();
+    expect(await resultPromise).toBe(early);
+    expect(events).toEqual(['acquired', 'wrote:agent', 'released', 'logged:agent', 'result:agent']);
+    expect(reports).toHaveLength(1);
+    const [report] = reports;
+    // The entry describes the result that the client received while C and D still ran.
+    expect(report.result).toBe(early);
+    expect(report).toMatchObject({ countRetained: 0, earlyResult: true, scheduled: true });
+    expect(getRecordedStatuses(report)).toEqual({
+      [OPERATION_A]: OperationStatus.Blocked,
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Success,
+      [OPERATION_D]: OperationStatus.Success
+    });
+    for (const [operation, record] of report.records) {
+      if (operation.name === OPERATION_C || operation.name === OPERATION_D) {
+        expect(record.stopwatch.endTime).toBeGreaterThan(report.resultTimeMs);
+      }
+    }
+  });
+
+  it('logs the work that continues as aborted when the request is aborted after its result and stops it', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(A_CONSUMES_B_AND_C, false, false, true);
+    const { events } = setup;
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const reports: IPhasedRequestTelemetryReport[] = [];
+
+    const resultPromise: Promise<IDaemonPhasedRequestResult> = trackResult(
+      setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client,
+        false,
+        undefined,
+        undefined,
+        recordTelemetry('agent', events, reports)
+      ),
+      'agent',
+      events
+    );
+    await agent.written;
+    await settleAsync();
+    // The daemon stops C, which nobody waits for any more.
+    agent.client.abortController.abort();
+    await resultPromise;
+
+    expect(events).toEqual(['acquired', 'wrote:agent', 'released', 'logged:agent', 'result:agent']);
+    expect(reports).toHaveLength(1);
+    expect(reports[0].earlyResult).toBe(true);
+    expect(getRecordedStatuses(reports[0])).toEqual({
+      [OPERATION_A]: OperationStatus.Blocked,
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Aborted
+    });
+  });
+
   it('rejects a flag that is not a boolean', async () => {
     const setup: IEarlyFailureFixture = createEarlyFailureFixture();
     await expect(
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 3a8426c049..b481de5dcf 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1749,6 +1749,51 @@ process.exit(23);
     }
   });
 
+  it("keeps serving when a request sets, changes or unsets its telemetry tag, and logs each request's own tag", async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
+    try {
+      const tags: ReadonlyArray<readonly [string, string | undefined]> = [
+        ['untagged', undefined],
+        ['tagged', 'nightly-7'],
+        ['retagged', 'nightly-8'],
+        ['untagged-again', undefined]
+      ];
+      let session: WorkspaceSession | undefined;
+      let graph: IOperationGraph | undefined;
+      for (const [requestId, tag] of tags) {
+        const environment: Record<string, string> = requestEnvironment();
+        delete environment.ODSP_TELEMETRY_TAG;
+        if (tag !== undefined) environment.ODSP_TELEMETRY_TAG = tag;
+        expect(
+          (await runAsync(fixture, requestId, ['build', '--only', 'a'], { environment })).terminal
+        ).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        session ??= fixture.session;
+        graph ??= fixture.session.operationGraph;
+        expect(fixture.session).toBe(session);
+        expect(fixture.session.operationGraph).toBe(graph);
+        expect(readDaemonLockfile(fixture.host.paths.lockfilePath)?.pid).toBe(process.pid);
+      }
+
+      const entries: ITelemetryData[] = readTelemetryEntries(fixture.repoRoot);
+      expect(
+        entries.map(({ extraData }) => [
+          extraData?.requestId,
+          extraData?.requestIndex,
+          extraData?.graphWasInitialized,
+          extraData?.telemetryTag
+        ])
+      ).toEqual([
+        ['untagged', 1, false, undefined],
+        ['tagged', 2, true, 'nightly-7'],
+        ['retagged', 3, true, 'nightly-8'],
+        ['untagged-again', 4, true, undefined]
+      ]);
+      expect(runs(fixture)).toEqual(['a:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('releases the lockfile within seconds when a flushTelemetry tap never settles', async () => {
     const stalledUploads: string[] = [];
     const createEngineAsync = PhasedCommandEngine.prototype.createEngineAsync;
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 5458cc0ad3..4b8554b5d4 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -98,6 +98,7 @@ describe('version-selected daemon launcher', () => {
         HOME: '/home/user',
         RUSH_PARALLELISM: '48',
         COPILOT_AGENT_SESSION_ID: 'session-1',
+        ODSP_TELEMETRY_TAG: 'tag-1',
         RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
         RUSHD_OUTPUT: 'agent',
         // The first client's session folders may disappear while the daemon lives on.
diff --git a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
index b8d770ac40..ae0b3cc932 100644
--- a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
@@ -97,6 +97,8 @@ it('reuses the warm generation when only volatile per-shell environment variable
         COPILOT_AGENT_SESSION_ID: 'another-session',
         VSCODE_IPC_HOOK_CLI: '/run/vscode-ipc.sock'
       },
+      telemetryTag: { ...fixture.environment, ODSP_TELEMETRY_TAG: 'nightly-7' },
+      anotherTelemetryTag: { ...fixture.environment, ODSP_TELEMETRY_TAG: 'nightly-8' },
       repeatedPath: {
         ...fixture.environment,
         PATH: [fixture.environment.PATH, fixture.environment.PATH].join(path.delimiter)
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 47d5df524c..4530644a53 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -65,6 +65,7 @@ export interface IWorkspaceInputFingerprintOptions {
  *   `VSCODE_GIT_ASKPASS_EXTRA_ARGS`, `VSCODE_INJECTION`, `VSCODE_NONCE`, `GIT_ASKPASS`, `SSH_ASKPASS`
  * - coding agent session markers: `COPILOT_CLI`, `COPILOT_AGENT_SESSION_ID`, `COPILOT_LOADER_PID`,
  *   `COPILOT_CLI_BINARY_VERSION`, `COPILOT_CLI_RESOLVED_DIST_DIR`, `CLAUDECODE`, `CLAUDE_CODE_ENTRYPOINT`
+ * - `ODSP_TELEMETRY_TAG`, which tags the telemetry entry of one command with its caller's label
  * - `INIT_CWD`, which Rush removes from every lifecycle script environment and sets explicitly where needed,
  *   and `RUSH_INVOKED_FOLDER`, which Rush assigns for each invocation
  * - client routing and presentation: `RUSH_DAEMON` and `RUSH_DAEMON_AUTO_START` only select and start a daemon,
@@ -142,6 +143,7 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'COPILOT_CLI_RESOLVED_DIST_DIR',
   'CLAUDECODE',
   'CLAUDE_CODE_ENTRYPOINT',
+  'ODSP_TELEMETRY_TAG',
   'INIT_CWD',
   'RUSH_INVOKED_FOLDER',
   'RUSH_DAEMON',
@@ -163,10 +165,10 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
  * @remarks
  * A long-lived host must not inherit these variables from the client that started it: it applies
  * `RUSH_PARALLELISM` from each request's own environment, and code running inside the host that reads a session
- * identifier such as `COPILOT_AGENT_SESSION_ID` from `process.env` would otherwise attribute every later session's
- * work to the first one. Likewise, the first client's `TMPDIR` or `XDG_RUNTIME_DIR` may be removed when that
- * client's session or job ends, while the host lives on. (`TMP` and `TEMP` stay, because Windows has no usable
- * default for them.)
+ * identifier such as `COPILOT_AGENT_SESSION_ID` or a telemetry label such as `ODSP_TELEMETRY_TAG` from
+ * `process.env` would otherwise attribute every later session's work to the first one. Likewise, the first
+ * client's `TMPDIR` or `XDG_RUNTIME_DIR` may be removed when that client's session or job ends, while the host
+ * lives on. (`TMP` and `TEMP` stay, because Windows has no usable default for them.)
  * On Windows, names are matched case-insensitively.
  *
  * @alpha
@@ -174,6 +176,7 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
 export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string> = new Set([
   'RUSH_PARALLELISM',
   'COPILOT_AGENT_SESSION_ID',
+  'ODSP_TELEMETRY_TAG',
   'TMPDIR',
   'XDG_RUNTIME_DIR'
 ]);
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
index 3e9931220d..c304182674 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
@@ -236,6 +236,16 @@ describe(waitForTelemetryFlushAsync.name, () => {
     );
   });
 
+  it('clears its timer when the taps settle first, so that the timer does not keep the process alive', async () => {
+    jest.useFakeTimers();
+    try {
+      await expect(waitForTelemetryFlushAsync(Promise.resolve(), 60_000)).resolves.toBe(true);
+      expect(jest.getTimerCount()).toBe(0);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
   it('stops waiting for taps that never settle, such as an upload over a stalled network', async () => {
     const startMs: number = Date.now();
 
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index f31d382118..203d82216f 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -220,6 +220,7 @@ describe('workspace input fingerprints', () => {
           COPILOT_LOADER_PID: '77',
           WT_SESSION: 'w'
         },
+        { ODSP_TELEMETRY_TAG: 'nightly-7' },
         { PATH: `${base.PATH}${path.delimiter}${base.PATH}` },
         { TERM: undefined, PWD: undefined },
         { TMPDIR: '/scratch/job-1', XDG_RUNTIME_DIR: '/run/user/1000' },
@@ -262,6 +263,7 @@ describe('workspace input fingerprints', () => {
       HOME: '/home/user',
       RUSH_PARALLELISM: '48',
       COPILOT_AGENT_SESSION_ID: 'session-1',
+      ODSP_TELEMETRY_TAG: 'tag-1',
       RUSHD_OUTPUT: 'agent',
       RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
       TMPDIR: '/scratch/job-1',
@@ -288,6 +290,7 @@ describe('workspace input fingerprints', () => {
       PATH: '/usr/bin',
       NODE_OPTIONS: '--max-old-space-size=8192',
       COPILOT_AGENT_SESSION_ID: 'session-A',
+      ODSP_TELEMETRY_TAG: 'tag-A',
       COPILOT_CLI: '1',
       GIT_ASKPASS: '/window-A/askpass.sh',
       WT_SESSION: 'wt-A',
@@ -297,6 +300,7 @@ describe('workspace input fingerprints', () => {
       HOME: '/home/other',
       PATH: '/other/bin',
       COPILOT_AGENT_SESSION_ID: 'session-B',
+      ODSP_TELEMETRY_TAG: 'tag-B',
       RUSH_PARALLELISM: '2',
       WT_SESSION: 'wt-B',
       RUSH_INVOKED_FOLDER: '/repo/apps/b',
@@ -307,6 +311,7 @@ describe('workspace input fingerprints', () => {
       PATH: '/usr/bin',
       NODE_OPTIONS: '--max-old-space-size=8192',
       COPILOT_AGENT_SESSION_ID: 'session-B',
+      ODSP_TELEMETRY_TAG: 'tag-B',
       RUSH_PARALLELISM: '2',
       WT_SESSION: 'wt-B',
       RUSH_INVOKED_FOLDER: '/repo/apps/b'

From c40f21d324c9c131051518186b9e9d61e78e1be3 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:05 +0000
Subject: [PATCH 072/265] [rush-daemon] The daemon's failure summary names the
 error, not the first buffered warning

Swarm integration step 57; original commit edbe3f9065 (merge of swarm/r04-t170-int at 6219ed8e65).
Scope: task 170.

Brings r04's task 170 (board 2953) with its NIT fix 9630e0bd88 (board 3036), re-tipped onto batch B. Second agent: t01 board 2966 and board 3045.

s17 batch D1, item 5 of 10. Gate: ch01 GATE OK board 3310 (tree cbdb7a5bb7)

Commits folded into this step (3):
- 781d08b278 Give the error first in a rejected request's message, not a warning written before it (task 170)
- f1d8a34c90 Put the in-process fallback on the first line of the reason (task 170)
- 9630e0bd88 Drop a colon that ends the fallback reason's first line (task 170, t01 NIT)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/src/inProcessFallback.ts | 16 ++++++
 apps/rush-cli-client/src/launchClient.ts      |  3 +-
 .../src/test/inProcessFallback.test.ts        | 49 +++++++++++++++++++
 ...4-t170-fallback-line_2026-09-29-02-10.json | 11 +++++
 ...r04-t170-error-first_2026-09-29-02-05.json | 11 +++++
 .../rush-daemon/src/EngineTerminalProvider.ts | 21 +++++---
 .../src/test/EngineTerminalProvider.test.ts   | 29 +++++++++--
 .../src/test/NativeEngineTestFixture.ts       |  5 +-
 .../ProductionDaemonRequestResolver.test.ts   | 29 ++++++++++-
 9 files changed, 161 insertions(+), 13 deletions(-)
 create mode 100644 apps/rush-cli-client/src/inProcessFallback.ts
 create mode 100644 apps/rush-cli-client/src/test/inProcessFallback.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t170-fallback-line_2026-09-29-02-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t170-error-first_2026-09-29-02-05.json

diff --git a/apps/rush-cli-client/src/inProcessFallback.ts b/apps/rush-cli-client/src/inProcessFallback.ts
new file mode 100644
index 0000000000..e39f130268
--- /dev/null
+++ b/apps/rush-cli-client/src/inProcessFallback.ts
@@ -0,0 +1,16 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Formats the stderr lines that say why the client runs a command in-process instead of on the daemon. The first
+ * line of the reason is the fallback line, which starts with `rush-client:` and ends with `using in-process Rush.`
+ * The other lines of a multi-line reason, such as a warning that the daemon wrote before its error, follow it as
+ * detail lines.
+ */
+export function formatInProcessFallbackMessage(reason: string): string {
+  const [firstLine = '', ...details] = reason.split(/\r?\n/).filter((line) => line.trim());
+  // A reason is usually a sentence, or a line that introduces the lines after it; "; using" follows it without the
+  // period or the colon.
+  const fallbackLine: string = `rush-client: ${firstLine.replace(/[.:]$/, '')}; using in-process Rush.`;
+  return [fallbackLine, ...details.map((line) => `  ${line}`)].map((line) => `${line}\n`).join('');
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 308dba115b..e50e7f0355 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -41,6 +41,7 @@ import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
 import { getTerminalColumns } from './terminalColumns';
 import { createDaemonRequestNoticeHandlers } from './daemonRestartNotice';
+import { formatInProcessFallbackMessage } from './inProcessFallback';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
   getBundledRushVersion,
@@ -307,7 +308,7 @@ export async function launchClientAsync(
     throw new Error(message);
   } else {
     agentRenderer?.dispose();
-    process.stderr.write(`rush-client: ${outcome.message ?? outcome.reason}; using in-process Rush.\n`);
+    process.stderr.write(formatInProcessFallbackMessage(outcome.message ?? outcome.reason));
     await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
   }
 }
diff --git a/apps/rush-cli-client/src/test/inProcessFallback.test.ts b/apps/rush-cli-client/src/test/inProcessFallback.test.ts
new file mode 100644
index 0000000000..128f86b5a1
--- /dev/null
+++ b/apps/rush-cli-client/src/test/inProcessFallback.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatInProcessFallbackMessage } from '../inProcessFallback';
+
+describe(formatInProcessFallbackMessage.name, () => {
+  it('ends the reason with the fallback, without a period before the semicolon', () => {
+    expect(
+      formatInProcessFallbackMessage(
+        'The daemon does not support explicit Rushx invocations; no request was sent.'
+      )
+    ).toBe(
+      'rush-client: The daemon does not support explicit Rushx invocations; no request was sent; ' +
+        'using in-process Rush.\n'
+    );
+    expect(formatInProcessFallbackMessage('controllingTerminalRequired')).toBe(
+      'rush-client: controllingTerminalRequired; using in-process Rush.\n'
+    );
+  });
+
+  it('gives the first line of a multi-line reason on the fallback line and the other lines as details', () => {
+    expect(
+      formatInProcessFallbackMessage(
+        'Plugins must be declared daemon-compatible. Use --no-daemon.\n\n' +
+          'The compatible plugin list names plugins that are not configured: "p".\n'
+      )
+    ).toBe(
+      'rush-client: Plugins must be declared daemon-compatible. Use --no-daemon; using in-process Rush.\n' +
+        '  The compatible plugin list names plugins that are not configured: "p".\n'
+    );
+  });
+
+  it('drops the colon of a first line that introduces the lines after it', () => {
+    expect(
+      formatInProcessFallbackMessage(
+        'Error reading "/repo/common/config/rush/command-line.json":\n  Unexpected token } at 3:1\n}\n^'
+      )
+    ).toBe(
+      'rush-client: Error reading "/repo/common/config/rush/command-line.json"; using in-process Rush.\n' +
+        '    Unexpected token } at 3:1\n' +
+        '  }\n' +
+        '  ^\n'
+    );
+    // JsonFile ends the line with os.EOL.
+    expect(formatInProcessFallbackMessage('Error reading "x.json":\r\n  Unexpected token')).toBe(
+      'rush-client: Error reading "x.json"; using in-process Rush.\n    Unexpected token\n'
+    );
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t170-fallback-line_2026-09-29-02-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t170-fallback-line_2026-09-29-02-10.json
new file mode 100644
index 0000000000..f1e23d3f42
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t170-fallback-line_2026-09-29-02-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the daemon can't serve a request, the line that says the client uses in-process Rush now carries the first line of the reason, and further lines of the reason follow it, indented. The reason's final period or colon no longer comes before \"; using in-process Rush.\"",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t170-error-first_2026-09-29-02-05.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t170-error-first_2026-09-29-02-05.json
new file mode 100644
index 0000000000..a56b58b37b
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t170-error-first_2026-09-29-02-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When the daemon rejects a request, the error now comes first in the message, so that the client gives it as the reason. Warnings written before the error, such as one about the compatible plugin list, follow it instead of taking its place in the summary line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/EngineTerminalProvider.ts b/libraries/rush-daemon/src/EngineTerminalProvider.ts
index 403a5c51b8..8b42edaf82 100644
--- a/libraries/rush-daemon/src/EngineTerminalProvider.ts
+++ b/libraries/rush-daemon/src/EngineTerminalProvider.ts
@@ -25,21 +25,30 @@ export class EngineTerminalProvider implements ITerminalProvider {
    * Drains buffered diagnostics into the failure description, so that they belong to the failing request
    * and are never replayed into a later request. Like the request output, the description omits verbose and
    * debug messages unless the graph runs in debug mode: loading a large workspace writes thousands of them.
+   *
+   * The error comes first, because clients give the first line as the reason for the failure. The other
+   * diagnostics follow in the order they were written: a warning written while parsing the command line, such
+   * as one about the compatible plugin list, is not the reason for an error that selecting operations throws.
    */
   public describeError(error: unknown): string {
     const lines: string[] = [];
-    let hasErrorLine: boolean = false;
+    let firstErrorLineIndex: number = -1;
     for (const { text, severity } of this.#messages.splice(0)) {
       const line: string = text.replace(/\r?\n$/, '');
       if (this.#isHidden(severity) || !line.trim()) continue;
-      hasErrorLine ||= severity === TerminalProviderSeverity.error;
+      if (firstErrorLineIndex < 0 && severity === TerminalProviderSeverity.error) {
+        firstErrorLineIndex = lines.length;
+      }
       lines.push(line);
     }
     // An AlreadyReportedError only says "An error occurred."; the error lines written before it are the report.
-    if (!(hasErrorLine && error instanceof Error && error instanceof AlreadyReportedError)) {
-      lines.push(error instanceof Error ? error.message : String(error));
-    }
-    return lines.join('\n');
+    const reason: string =
+      firstErrorLineIndex >= 0 && error instanceof Error && error instanceof AlreadyReportedError
+        ? lines.splice(firstErrorLineIndex, 1)[0]
+        : error instanceof Error
+          ? error.message
+          : String(error);
+    return [reason, ...lines].join('\n');
   }
 
   public get hasBufferedMessages(): boolean {
diff --git a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
index 549b8dd99c..ea9f908169 100644
--- a/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
+++ b/libraries/rush-daemon/src/test/EngineTerminalProvider.test.ts
@@ -12,7 +12,7 @@ describe(EngineTerminalProvider.name, () => {
     const terminal: EngineTerminalProvider = new EngineTerminalProvider();
     terminal.write('Permission denied', TerminalProviderSeverity.error);
     expect(terminal.hasBufferedMessages).toBe(true);
-    expect(terminal.describeError(new Error('snapshot failed'))).toBe('Permission denied\nsnapshot failed');
+    expect(terminal.describeError(new Error('snapshot failed'))).toBe('snapshot failed\nPermission denied');
     expect(terminal.hasBufferedMessages).toBe(false);
     expect(terminal.describeError(new Error('next request'))).toBe('next request');
   });
@@ -35,7 +35,7 @@ describe(EngineTerminalProvider.name, () => {
         throw failure;
       })
     ).rejects.toBe(failure);
-    expect(failure.message).toBe('binding request diagnostic\nPermission denied\ncould not capture');
+    expect(failure.message).toBe('could not capture\nbinding request diagnostic\nPermission denied');
 
     terminal.write('stale', TerminalProviderSeverity.warning);
     await expect(terminal.reconcileWithRequestDiagnosticsAsync(async () => 'ok')).resolves.toBe('ok');
@@ -54,7 +54,7 @@ describe(EngineTerminalProvider.name, () => {
     terminal.write('\n', TerminalProviderSeverity.log);
     terminal.write('Project "a" has no "build" script.\n', TerminalProviderSeverity.warning);
     expect(terminal.describeError(new Error('selection failed'))).toBe(
-      'Project "a" has no "build" script.\nselection failed'
+      'selection failed\nProject "a" has no "build" script.'
     );
   });
 
@@ -71,10 +71,31 @@ describe(EngineTerminalProvider.name, () => {
 
     terminal.write('No error line was written.\n', TerminalProviderSeverity.warning);
     expect(terminal.describeError(new AlreadyReportedError())).toBe(
-      'No error line was written.\nAn error occurred.'
+      'An error occurred.\nNo error line was written.'
     );
   });
 
+  it('gives the error first, since clients give the first line as the reason, and the other lines in order', () => {
+    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+    const warning: string =
+      `The daemon's compatible plugin list names plugins that are not configured in rush-plugins.json: ` +
+      `"no-such-plugin".`;
+    const unknownProject: string = 'The project name "@x/nope" passed to "--to" does not exist in rush.json.';
+    terminal.write(`${warning}\n`, TerminalProviderSeverity.warning);
+    terminal.write(`${unknownProject}\n`, TerminalProviderSeverity.error);
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(`${unknownProject}\n${warning}`);
+
+    terminal.write(`${warning}\n`, TerminalProviderSeverity.warning);
+    expect(terminal.describeError(new Error('Plugins must be daemon-compatible.'))).toBe(
+      `Plugins must be daemon-compatible.\n${warning}`
+    );
+
+    terminal.write(`${warning}\n`, TerminalProviderSeverity.warning);
+    terminal.write('first error\n', TerminalProviderSeverity.error);
+    terminal.write('second error\n', TerminalProviderSeverity.error);
+    expect(terminal.describeError(new AlreadyReportedError())).toBe(`first error\n${warning}\nsecond error`);
+  });
+
   it('drops diagnostics when the engine must be recreated', async () => {
     const terminal: EngineTerminalProvider = new EngineTerminalProvider();
     const recreate: WorkspaceEngineRecreationRequiredError = new WorkspaceEngineRecreationRequiredError();
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
index 30eb93eb2a..5013e5cfdd 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -54,6 +54,8 @@ export interface IFixtureOptions {
   /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
   readonly pnpm?: boolean;
   readonly telemetryEnabled?: boolean;
+  /** Sets `daemon.compatiblePlugins` in rush.json. */
+  readonly compatiblePlugins?: ReadonlyArray<string>;
 }
 
 export class DecoratedTestResolver implements IDaemonRequestResolver {
@@ -117,7 +119,8 @@ export async function createFixtureAsync(
       // Retention assertions must not depend on the surrounding Jest worker's accumulated RSS.
       daemon: {
         warmMemoryBudgetMB: 100_000,
-        ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds })
+        ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds }),
+        ...(options.compatiblePlugins === undefined ? {} : { compatiblePlugins: options.compatiblePlugins })
       },
       ...(options.telemetryEnabled ? { telemetryEnabled: true } : {}),
       projectFolderMinDepth: 2,
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index b481de5dcf..49cccacad6 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -191,6 +191,33 @@ describe('native production daemon engine', () => {
     }
   });
 
+  it('gives the error as the reason for an invalid selection, before a warning that the parse wrote', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', {
+      compatiblePlugins: ['no-such-plugin']
+    });
+    // The binding request also writes the warning to the daemon's own stderr, which is the launcher log.
+    const stderr: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    try {
+      const rejection: { kind: string; payload: { code: string; message: string } } = {
+        kind: 'requestRejected',
+        payload: {
+          code: 'invalidRequest',
+          message:
+            'The project name "nope" passed to "--to" does not exist in rush.json.\n' +
+            `The daemon's compatible plugin list (rush.json "daemon.compatiblePlugins" or ` +
+            'RUSH_DAEMON_COMPATIBLE_PLUGINS) names plugins that are not configured in rush-plugins.json: ' +
+            `"no-such-plugin". Check that each entry is the plugin's "pluginName".`
+        }
+      };
+      expect((await runAsync(fixture, 'cold', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      expect((await runAsync(fixture, 'warm', ['build', '--to', 'nope'])).terminal).toMatchObject(rejection);
+      expect(runs(fixture)).toEqual([]);
+    } finally {
+      stderr.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('keeps tier0 session and graph identity for unchanged content, including metadata touches', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
@@ -1622,7 +1649,7 @@ process.exit(23);
           kind: 'requestRejected',
           payload: {
             message: expect.stringMatching(
-              /Permission denied[\s\S]*Rush could not capture the next workspace inputs snapshot\./
+              /^Rush could not capture the next workspace inputs snapshot\.\n[\s\S]*Permission denied/
             )
           }
         });

From 4484f46654c2f8082a513dcf6217848571b41dd7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:06 +0000
Subject: [PATCH 073/265] [rush-daemon] Check the installation again after a
 restart's waits

Swarm integration step 58; original commit 13c4debd1f (merge of swarm/r03-t91g at b512743133).
Scope: task 167.

Brings r03's task 167 (board 2919): tests for ch01's surviving mutants on tasks 91 and 125, and rush-daemon checks the installation again after a restart's waits, before planning a successor. Second agent: t05 board 3064.

s17 batch D1, item 6 of 10. Gate: ch01 GATE OK board 3310 (tree 6caa39900a)

Commits folded into this step (1):
- b512743133 rush-daemon: check the installation again after a restart's waits, before planning a successor (task 167)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...n-restart-late-check_2026-09-29-01-45.json |  11 ++
 libraries/rush-daemon/README.md               |   4 +-
 .../src/WorkspaceRequestLifecycle.ts          |   5 +-
 .../src/test/DaemonInstallationChange.test.ts |  70 ++++++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  | 129 +++++++++++++++++-
 5 files changed, 216 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/r03-installation-restart-late-check_2026-09-29-01-45.json

diff --git a/common/changes/@rushstack/rush-daemon/r03-installation-restart-late-check_2026-09-29-01-45.json b/common/changes/@rushstack/rush-daemon/r03-installation-restart-late-check_2026-09-29-01-45.json
new file mode 100644
index 0000000000..5ccde590bb
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r03-installation-restart-late-check_2026-09-29-01-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A build or graph control request that restarts the daemon for its inputs checks the daemon's installation again after its waits end, just before it plans a successor. If the installation was removed or replaced during those waits, the request now gets the typed restart result for that change, and the daemon exits without a successor, as it does for every other request, instead of starting one with its own launcher.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 04d65fa115..48030e4ef6 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -240,7 +240,9 @@ for an environment: a client-default `waitTimeoutMs` does not limit waiting for
 being served when the wait began, as long as no rushx script is being served, and a timeout names the changed
 folder. A request that times out there, or that sets `noWait`, gets its admission error code and requests no
 restart. The first request that gets the result makes the daemon exit without selecting a successor, and each
-client starts one with its own launcher. Embedded hosts opt in with `checkInstallation`
+client starts one with its own launcher. A build or graph control request that waits to restart the daemon for its
+inputs checks the installation again once those waits end, just before it would select a successor, so a change
+during them gets the same result. Embedded hosts opt in with `checkInstallation`
 (`captureDaemonInstallation`).
 The daemon log (`onLog`) gets one line for the change and one for each rejected request, with its code, its
 message and, for an unexpected `routingFailed`, the stack.
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index fb2909f8f2..b028c0ea08 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -543,7 +543,6 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
-            this.#throwIfInstallationChanged();
             await this.#waitForServedScriptsAsync(admission);
             session = await this.#options.provider.getSessionAsync();
             await this.#quiesceWarmSetAsync(session);
@@ -552,6 +551,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
               RequestExclusivityClass.Exclusive
             );
             try {
+              // After every wait: a daemon whose installation changed leaves selecting a successor to its clients.
+              this.#throwIfInstallationChanged();
               const plan: IWorkspaceProcessRestartPlan = await this.#restartPlanAsync(
                 session,
                 controlEnvelope,
@@ -670,6 +671,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           RequestExclusivityClass.Exclusive
         );
         try {
+          // After every wait: a daemon whose installation changed leaves selecting a successor to its clients.
+          this.#throwIfInstallationChanged();
           const plan: IWorkspaceProcessRestartPlan = await this.#restartPlanAsync(
             session,
             envelope,
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
index febcf65b25..c03a3f920f 100644
--- a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -18,6 +18,8 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import { captureDaemonInstallation, type CheckDaemonInstallation } from '../DaemonInstallationMonitor';
+import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import type { WorkspaceSession } from '../WorkspaceSession';
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
 import {
   createDeferred,
@@ -27,6 +29,7 @@ import {
 } from './DaemonRequestWireTestUtilities';
 import { assertSuccessfulNativeBuild } from './NativeBuildTestResult';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 
 jest.setTimeout(30_000);
 
@@ -423,6 +426,73 @@ describe('a daemon whose installation changed', () => {
     ]);
   });
 
+  it('answers a graph watch that arrives after the change with the restart, like any other request', async () => {
+    const current: { change?: IDaemonInstallationChange } = {};
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+    });
+    await fixture.buildSuccessfullyAsync();
+    current.change = { change: 'removed', folder: installation.folder };
+
+    // A watch has no restart ticket, since a restart cancels it, until it waits for this restart itself.
+    const { terminal } = await fixture.graphAsync('watch');
+    expect(terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        retryAfterRestart: true,
+        restartReason: { kind: 'installationChanged', change: 'removed', folder: installation.folder }
+      }
+    });
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  });
+
+  it.each([
+    { kind: 'a graph control request', argv: ['daemon', 'graph', 'pause'] },
+    { kind: 'a build', argv: BUILD_B }
+  ])(
+    'answers $kind that waited to restart the daemon for its inputs with the restart for a change during that wait',
+    async ({ argv }: { argv: string[] }) => {
+      const current: { change?: IDaemonInstallationChange } = {};
+      const created: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((configured) => {
+        setDaemonPolicy(configured, {});
+        configured.checkInstallation = () => current.change;
+        configured.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      });
+      fixture = created;
+      try {
+        await created.buildSuccessfullyAsync();
+        // Another install state needs a new daemon process, so the request would select a successor.
+        created.write('common/temp/last-install.flag', '{}');
+        // The installation changes after the request's last check before its waits end, while the warm set stops.
+        const session: WorkspaceSession = created.session;
+        const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+        jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementation(async () => {
+          current.change ??= { change: 'replaced', folder: installation.folder };
+          await quiesceAsync();
+        });
+
+        const { terminal } = await created.runAsync(argv);
+        expect(terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: {
+            retryAfterRestart: true,
+            restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+          }
+        });
+        // The daemon exits without a successor, which each client then starts with its own launcher.
+        await expect(created.host.restartCompleted).resolves.toBeUndefined();
+        expect(created.runs()).toEqual(['a', 'b']);
+      } finally {
+        jest.restoreAllMocks();
+        await created.host.closeAsync();
+        await created.host.restartCompleted;
+        await stopSuccessorAsync(created.host.paths);
+      }
+    }
+  );
+
   it('keeps serving while its installation is intact', async () => {
     fixture = await DaemonGraphTestFixture.createAsync((created) => {
       setDaemonPolicy(created, {});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index b5b2443584..b924f9480a 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -7,8 +7,18 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { OperationStatus } from '@microsoft/rush-lib';
 import { LockFile } from '@rushstack/node-core-library';
-import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonInstallationChange,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
 
+import type { IResolveDaemonRequestOptions, ResolvedDaemonRequest } from '../DaemonRequestDispatcher';
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
@@ -17,6 +27,9 @@ import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 
 jest.setTimeout(60_000);
 
+/** What the daemon's check of its own installation reports; each test that sets it clears it again. */
+let installationChange: IDaemonInstallationChange | undefined;
+
 const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
 
 interface IEarlyFailureFixtureOptions {
@@ -48,6 +61,7 @@ function createEarlyFailureFixtureAsync({
       created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
     }
     created.write('hold', '');
+    created.checkInstallation = () => installationChange;
     created.write(
       'b/package.json',
       JSON.stringify({
@@ -112,6 +126,22 @@ async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
   return settled;
 }
 
+function queuePositions(
+  frames: ReadonlyArray<IDaemonFrame>
+): IDaemonRequestQueuePositionMessage['payload'][] {
+  return frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .filter((message: DaemonControlMessage) => message.kind === 'queuePosition')
+    .map((message: DaemonControlMessage) => (message as IDaemonRequestQueuePositionMessage).payload);
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<IDaemonFrame[]> {
+  const frames: IDaemonFrame[] = [];
+  while (queuePositions(frames).length === 0) frames.push(await client.readFrameAsync());
+  return frames;
+}
+
 async function returnEarlyAsync(fixture: DaemonGraphTestFixture): Promise<void> {
   const early: ITerminalExchange = await fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
   expect(early.terminal).toMatchObject({
@@ -326,4 +356,101 @@ describe('a failed build that returns early', () => {
       }
     }
   });
+
+  it('stops the work that continues before it answers with the restart for a changed installation', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+      const change: IDaemonInstallationChange = {
+        change: 'replaced',
+        folder: path.join(fixture.folder, 'daemon')
+      };
+      installationChange = change;
+
+      const { frames, terminal } = await fixture.runAsync(['build', '--to', 'c', '--parallelism', '3']);
+      const restartReason: object = { kind: 'installationChanged', ...change };
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true, restartReason }
+      });
+      // It waited only while the held c stopped, and it said why it waited.
+      expect(queuePositions(frames)).toEqual([expect.objectContaining({ position: 1, restartReason })]);
+      expect(fs.existsSync(hold)).toBe(true);
+      expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
+      expect(isNativeLockFree(fixture)).toBe(true);
+      await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    } finally {
+      installationChange = undefined;
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('answers a command that it rejects with the restart once the installation changed, and leaves the work that continues running', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let later: DaemonRequestWireClient | undefined;
+    let rejected: DaemonRequestWireClient | undefined;
+    try {
+      await returnEarlyAsync(fixture);
+      // A later build waits for the held c, so the daemon serves it until that c finishes.
+      later = await fixture.connectAsync();
+      const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c', '--parallelism', '3']);
+      await later.sendControlAsync({ kind: 'requestStart', payload: build });
+      await readUntilQueuedAsync(later);
+
+      // The installation changes while the daemon rejects a command that the client would run in-process.
+      const change: IDaemonInstallationChange = {
+        change: 'replaced',
+        folder: path.join(fixture.folder, 'daemon')
+      };
+      const custom: IDaemonRequestEnvelope = fixture.envelope(['test', '--to', 'c'], {
+        commandOrigin: 'custom'
+      });
+      const resolveAsync: ProductionDaemonRequestResolver['resolveRequestAsync'] =
+        ProductionDaemonRequestResolver.prototype.resolveRequestAsync;
+      jest
+        .spyOn(ProductionDaemonRequestResolver.prototype, 'resolveRequestAsync')
+        .mockImplementation(async function (
+          this: ProductionDaemonRequestResolver,
+          options: IResolveDaemonRequestOptions
+        ) {
+          if (options.envelope.requestId === custom.requestId) installationChange = change;
+          const resolved: ResolvedDaemonRequest = await resolveAsync.call(this, options);
+          return resolved;
+        });
+      rejected = await fixture.connectAsync();
+      await rejected.sendControlAsync({ kind: 'requestStart', payload: custom });
+
+      // So the client restarts the daemon instead of running the command in-process, and the restart waits for
+      // the later build, which still waits for the held c.
+      const restartReason: object = { kind: 'installationChanged', ...change };
+      expect(queuePositions(await readUntilQueuedAsync(rejected))).toEqual([
+        expect.objectContaining({ position: 1, restartReason })
+      ]);
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(countRuns(fixture, 'c')).toBe(1);
+
+      fs.rmSync(hold);
+      expect((await later.readTerminalAsync(build.requestId)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect((await rejected.readTerminalAsync(custom.requestId)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true, restartReason }
+      });
+      // The held c finished, and the later build found it done.
+      expect(countRuns(fixture, 'c')).toBe(1);
+      await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    } finally {
+      installationChange = undefined;
+      jest.restoreAllMocks();
+      fs.rmSync(hold, { force: true });
+      await later?.closeAsync();
+      await rejected?.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
 });

From fe18240a4eee33dc4d9be940b4df08602beedfc3 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:06 +0000
Subject: [PATCH 074/265] [rush-lib] A parameter whose short name the tool also
 defines can be used by its long name

Swarm integration step 59; original commit 49695c5d00 (merge of swarm/r03-t172 at 4526357153).
Scope: task 172.

Brings r03's task 172 (board 3008): rush update-cloud-credentials --delete no longer fails with an ambiguous -d. Second agent: o03 board 3054.

s17 batch D1, item 7 of 10. Gate: ch01 GATE OK board 3310 (tree 29b72dd480)

Commits folded into this step (1):
- 4526357153 [ts-command-line] A parameter whose short name the tool also defines can be used by its long name (task 172)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...03-parent-short-name_2026-09-29-02-40.json |  11 ++
 ...03-parent-short-name_2026-09-29-02-40.json |  11 ++
 .../cli/test/RushCommandLineParser.test.ts    |  59 +++++++
 .../CommandLineHelp.test.ts.snap              |   5 +-
 .../common/config/rush/command-line.json      |  14 ++
 .../providers/CommandLineParameterProvider.ts |  21 ++-
 .../test/AmbiguousCommandLineParser.test.ts   | 165 ++++++++++++++++++
 7 files changed, 277 insertions(+), 9 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/r03-parent-short-name_2026-09-29-02-40.json
 create mode 100644 common/changes/@rushstack/ts-command-line/r03-parent-short-name_2026-09-29-02-40.json

diff --git a/common/changes/@microsoft/rush/r03-parent-short-name_2026-09-29-02-40.json b/common/changes/@microsoft/rush/r03-parent-short-name_2026-09-29-02-40.json
new file mode 100644
index 0000000000..33a8818a74
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-parent-short-name_2026-09-29-02-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where `rush update-cloud-credentials --delete` failed with `Ambiguous option: \"-d\"`, and where a custom command parameter whose short name is `-d` or `-q` couldn't be used by its long name either. After the command name, `-d` and `-q` are still ambiguous with the global `--debug` and `--quiet` parameters.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/ts-command-line/r03-parent-short-name_2026-09-29-02-40.json b/common/changes/@rushstack/ts-command-line/r03-parent-short-name_2026-09-29-02-40.json
new file mode 100644
index 0000000000..13671b14f6
--- /dev/null
+++ b/common/changes/@rushstack/ts-command-line/r03-parent-short-name_2026-09-29-02-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "comment": "Fix an issue where an action parameter couldn't be used at all, not even by its long name, if the tool or a parent action also defines its short name. Now only the short name is ambiguous, and the action's help no longer shows it.",
+      "type": "patch",
+      "packageName": "@rushstack/ts-command-line"
+    }
+  ],
+  "packageName": "@rushstack/ts-command-line",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
index 6a7920715e..e1427b708f 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
@@ -32,6 +32,7 @@ import type { SpawnOptions } from 'node:child_process';
 import { FileSystem, JsonFile, LockFile, Path } from '@rushstack/node-core-library';
 import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
 import type { IReporterEmitEventInput, IReporterEventSink } from '@rushstack/rush-reporter';
+import type { CommandLineAction } from '@rushstack/ts-command-line';
 import { Autoinstaller } from '../../logic/Autoinstaller';
 import type { ITelemetryData } from '../../logic/Telemetry';
 import {
@@ -296,6 +297,64 @@ describe('RushCommandLineParser', () => {
         });
       });
 
+      describe("'custom-short-name' action", () => {
+        it('accepts a custom parameter by its long name when its short name is also the global -d', async () => {
+          const { parser, repoPath } = await getCommandLineParserInstanceAsync(
+            'basicAndRunBuildActionRepo',
+            'custom-short-name'
+          );
+          process.argv.push('--stale-after-days', '3');
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(JsonFile.load(`${repoPath}/custom-output-args.json`)).toEqual(['--stale-after-days', '3']);
+        });
+      });
+
+      describe("'update-cloud-credentials' action", () => {
+        it('accepts --delete, whose short name -d is also the global --debug parameter', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync(
+            'basicAndRunBuildActionRepo',
+            'update-cloud-credentials'
+          );
+          process.argv.push('--delete');
+          const action: CommandLineAction = parser.getAction('update-cloud-credentials');
+          // Stop before the action loads the build cache configuration, which this repo doesn't have
+          const runSpy: jest.SpyInstance = jest
+            .spyOn(action as unknown as { runAsync(): Promise<void> }, 'runAsync')
+            .mockResolvedValue(undefined);
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(runSpy).toHaveBeenCalledTimes(1);
+          expect(action.getFlagParameter('--delete').value).toBe(true);
+          expect(parser.getFlagParameter('--debug').value).toBe(false);
+        });
+
+        it('reports -d after the action name as ambiguous', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync(
+            'basicAndRunBuildActionRepo',
+            'update-cloud-credentials'
+          );
+          process.argv.push('-d');
+          const originalExitCode: string | number | undefined = process.exitCode;
+          const errorSpy: jest.SpyInstance = jest.spyOn(console, 'error').mockImplementation(() => undefined);
+          const logSpy: jest.SpyInstance = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+          try {
+            await expect(parser.executeAsync()).resolves.toEqual(false);
+
+            expect(process.exitCode).toBe(1);
+            expect(errorSpy).toHaveBeenCalledWith(
+              'Error: rush update-cloud-credentials: error: Ambiguous option: "-d".\n'
+            );
+          } finally {
+            errorSpy.mockRestore();
+            logSpy.mockRestore();
+            process.exitCode = originalExitCode;
+          }
+        });
+      });
+
       describe("'rebuild' action", () => {
         it(`executes the package's 'build' script`, async () => {
           const repoName: string = 'basicAndRunRebuildActionRepo';
diff --git a/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap b/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap
index efe3e717b7..bed4fdd30a 100644
--- a/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap
+++ b/libraries/rush-lib/src/cli/test/__snapshots__/CommandLineHelp.test.ts.snap
@@ -1445,7 +1445,8 @@ Optional arguments:
 
 exports[`CommandLineHelp prints the help for each action: update-cloud-credentials 1`] = `
 "usage: rush update-cloud-credentials [-h] [-i]
-                                     [--credential CREDENTIAL_STRING] [-d]
+                                     [--credential CREDENTIAL_STRING]
+                                     [--delete]
                                      
 
 (EXPERIMENTAL) If the build caching feature is configured, this command 
@@ -1457,7 +1458,7 @@ Optional arguments:
                         mode, if supported by the provider.
   --credential CREDENTIAL_STRING
                         A static credential, to be cached.
-  -d, --delete          If specified, delete stored credentials.
+  --delete              If specified, delete stored credentials.
 "
 `;
 
diff --git a/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json b/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json
index c7d4e88c76..b73ec58834 100644
--- a/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json
+++ b/libraries/rush-lib/src/cli/test/basicAndRunBuildActionRepo/common/config/rush/command-line.json
@@ -5,6 +5,12 @@
       "name": "custom-output",
       "summary": "Exercises custom parameters that overlap reporter controls.",
       "shellCommand": "node custom-output.js"
+    },
+    {
+      "commandKind": "global",
+      "name": "custom-short-name",
+      "summary": "Exercises a custom parameter whose short name is also a global parameter's short name.",
+      "shellCommand": "node custom-output.js"
     }
   ],
   "parameters": [
@@ -34,6 +40,14 @@
       "longName": "--verbose",
       "description": "Custom verbose flag.",
       "associatedCommands": ["custom-output"]
+    },
+    {
+      "parameterKind": "integer",
+      "longName": "--stale-after-days",
+      "shortName": "-d",
+      "argumentName": "DAYS",
+      "description": "Custom parameter whose short name is also the short name of the global --debug parameter.",
+      "associatedCommands": ["custom-short-name"]
     }
   ]
 }
diff --git a/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts b/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts
index 2fe89023a3..e19e4c3a82 100644
--- a/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts
+++ b/libraries/ts-command-line/src/providers/CommandLineParameterProvider.ts
@@ -525,10 +525,13 @@ export abstract class CommandLineParameterProvider {
 
     // First, loop through all parameters with short names. If there are any duplicates, disable the short names
     // since we can't prefix scopes to short names in order to deduplicate them. The duplicate short names will
-    // be reported as errors if the user attempts to use them.
+    // be reported as errors if the user attempts to use them. A short name that the parent action or tool also
+    // defines is a duplicate too. Disabling it here gives it its own parser key, so the parameter can still be
+    // used by its long name.
+    const { parentParameterNames } = state;
     const parametersWithDuplicateShortNames: Set<CommandLineParameterBase> = new Set();
     for (const [shortName, shortNameParameters] of this.#parametersByShortName.entries()) {
-      if (shortNameParameters.length > 1) {
+      if (shortNameParameters.length > 1 || parentParameterNames.has(shortName)) {
         for (const parameter of shortNameParameters) {
           this._defineAmbiguousParameter(shortName);
           parametersWithDuplicateShortNames.add(parameter);
@@ -559,7 +562,6 @@ export abstract class CommandLineParameterProvider {
 
     // Register the existing parameters as ambiguous parameters. These are generally provided by the
     // parent action.
-    const { parentParameterNames } = state;
     for (const parentParameterName of parentParameterNames) {
       this._defineAmbiguousParameter(parentParameterName);
     }
@@ -631,16 +633,21 @@ export abstract class CommandLineParameterProvider {
     // Search for any ambiguous parameters and throw an error if any are found
     for (const [parameterName, parserKey] of this._ambiguousParameterParserKeysByName) {
       if (data[parserKey]) {
+        const duplicateShortNameParameters: CommandLineParameterBase[] | undefined =
+          this.#parametersByShortName.get(parameterName);
+
         // When the parser key matches the actually registered parameter, we know that this is an ambiguous
-        // parameter sourced from the parent action or tool
-        if (this._registeredParameterParserKeysByName.get(parameterName) === parserKey) {
+        // parameter sourced from the parent action or tool. The same is true for a short name that only one
+        // parameter here uses, since one parameter can't make its own short name ambiguous.
+        if (
+          this._registeredParameterParserKeysByName.get(parameterName) === parserKey ||
+          duplicateShortNameParameters?.length === 1
+        ) {
           this.#throwParserExitError(parserOptions, data, 1, `Ambiguous option: "${parameterName}".`);
         }
 
         // Determine if the ambiguous parameter is a short name or a long name, since the process of finding
         // the non-ambiguous name is different for each.
-        const duplicateShortNameParameters: CommandLineParameterBase[] | undefined =
-          this.#parametersByShortName.get(parameterName);
         if (duplicateShortNameParameters) {
           // We also need to make sure we get the non-ambiguous long name for the parameter, since it is
           // possible for that the long name is ambiguous as well.
diff --git a/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts b/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts
index c6445201fc..1aeb6d734b 100644
--- a/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts
+++ b/libraries/ts-command-line/src/test/AmbiguousCommandLineParser.test.ts
@@ -102,6 +102,37 @@ class AbbreviationAction extends CommandLineAction {
   }
 }
 
+class ShortNameAction extends CommandLineAction {
+  public done: boolean = false;
+  public deleteFlag: CommandLineFlagParameter;
+
+  public constructor() {
+    super({
+      actionName: 'do:the-job',
+      summary: 'does the job',
+      documentation: 'a longer description'
+    });
+
+    this.deleteFlag = this.defineFlagParameter({
+      parameterLongName: '--delete',
+      parameterShortName: '-d',
+      description: 'A flag whose short name the tool also declares'
+    });
+  }
+
+  protected override async onExecuteAsync(): Promise<void> {
+    this.done = true;
+  }
+}
+
+function defineToolDebugFlag(commandLineParser: CommandLineParser): CommandLineFlagParameter {
+  return commandLineParser.defineFlagParameter({
+    parameterLongName: '--debug',
+    parameterShortName: '-d',
+    description: 'A flag whose short name the action also declares'
+  });
+}
+
 class AliasAction extends AliasCommandLineAction {
   public constructor(targetActionClass: new () => CommandLineAction) {
     super({
@@ -250,6 +281,38 @@ class AbbreviationScopedAction extends ScopedCommandLineAction {
   }
 }
 
+class ShortNameScopedAction extends ScopedCommandLineAction {
+  public done: boolean = false;
+  public deleteFlag: CommandLineFlagParameter | undefined;
+
+  public constructor() {
+    super({
+      actionName: 'scoped-action',
+      summary: 'does the scoped action',
+      documentation: 'a longer description'
+    });
+
+    // At least one scoping parameter is required to be defined on a scoped action
+    this.defineFlagParameter({
+      parameterLongName: '--scoping',
+      description: 'The scoping parameter',
+      parameterGroup: SCOPING_PARAMETER_GROUP
+    });
+  }
+
+  protected override async onExecuteAsync(): Promise<void> {
+    this.done = true;
+  }
+
+  protected onDefineScopedParameters(scopedParameterProvider: CommandLineParameterProvider): void {
+    this.deleteFlag = scopedParameterProvider.defineFlagParameter({
+      parameterLongName: '--delete',
+      parameterShortName: '-d',
+      description: 'A flag whose short name the tool also declares'
+    });
+  }
+}
+
 describe(`Ambiguous ${CommandLineParser.name}`, () => {
   it('renders help text', () => {
     const commandLineParser: GenericCommandLine = new GenericCommandLine(
@@ -357,6 +420,47 @@ describe(`Ambiguous ${CommandLineParser.name}`, () => {
     expect(action.abbreviationFlag.value).toBe(true);
     expect(toolAbbreviationFlag.value).toBe(false);
   });
+
+  it('can execute a parameter by its long name when the tool also declares its short name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameAction);
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+
+    await commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job', '--delete']);
+
+    expect(commandLineParser.selectedAction).toBeDefined();
+    expect(commandLineParser.selectedAction!.actionName).toEqual('do:the-job');
+
+    const action: ShortNameAction = commandLineParser.selectedAction as ShortNameAction;
+    expect(action.done).toBe(true);
+    expect(action.deleteFlag.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(false);
+
+    // The action's help doesn't offer the short name, since it can't be used after the action name
+    const helpText: string = action.renderHelpText();
+    expect(helpText).toContain('  --delete ');
+    expect(helpText).not.toContain('-d, --delete');
+  });
+
+  it('can use a short name declared in both the tool and the action before the action name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameAction);
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+
+    await commandLineParser.executeWithoutErrorHandlingAsync(['-d', 'do:the-job', '--delete']);
+
+    const action: ShortNameAction = commandLineParser.selectedAction as ShortNameAction;
+    expect(action.done).toBe(true);
+    expect(action.deleteFlag.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(true);
+  });
+
+  it('fails when providing a short name to an action that was also declared in the tool', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameAction);
+    defineToolDebugFlag(commandLineParser);
+
+    await expect(commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job', '-d'])).rejects.toThrow(
+      'Error: example do:the-job: error: Ambiguous option: "-d".\n'
+    );
+  });
 });
 
 describe(`Ambiguous aliased ${CommandLineParser.name}`, () => {
@@ -478,6 +582,37 @@ describe(`Ambiguous aliased ${CommandLineParser.name}`, () => {
     expect(action.abbreviationFlag.value).toBe(true);
     expect(toolAbbreviationFlag.value).toBe(false);
   });
+
+  it('can execute a parameter by its long name when the tool also declares its short name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(AliasAction, ShortNameAction);
+    commandLineParser.addAction(
+      (commandLineParser.getAction('do:the-job-alias')! as AliasAction).targetAction
+    );
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+
+    await commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job-alias', '--delete']);
+
+    expect(commandLineParser.selectedAction).toBeDefined();
+    expect(commandLineParser.selectedAction!.actionName).toEqual('do:the-job-alias');
+
+    const action: ShortNameAction = (commandLineParser.selectedAction as AliasAction)
+      .targetAction as ShortNameAction;
+    expect(action.done).toBe(true);
+    expect(action.deleteFlag.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(false);
+  });
+
+  it('fails when providing a short name to an action that was also declared in the tool', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(AliasAction, ShortNameAction);
+    commandLineParser.addAction(
+      (commandLineParser.getAction('do:the-job-alias')! as AliasAction).targetAction
+    );
+    defineToolDebugFlag(commandLineParser);
+
+    await expect(
+      commandLineParser.executeWithoutErrorHandlingAsync(['do:the-job-alias', '-d'])
+    ).rejects.toThrow('Error: example do:the-job-alias: error: Ambiguous option: "-d".\n');
+  });
 });
 
 describe(`Ambiguous scoping ${CommandLineParser.name}`, () => {
@@ -676,4 +811,34 @@ describe(`Ambiguous scoping ${CommandLineParser.name}`, () => {
     expect(targetAction.scopedAbbreviationFlag?.value).toBe(true);
     expect(targetAction.unscopedAbbreviationFlag?.value).toBe(false);
   });
+
+  it('can execute a scoped parameter by its long name when the tool also declares its short name', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameScopedAction);
+    const toolDebugFlag: CommandLineFlagParameter = defineToolDebugFlag(commandLineParser);
+    const targetAction: ShortNameScopedAction = commandLineParser.getAction(
+      'scoped-action'
+    ) as ShortNameScopedAction;
+
+    await commandLineParser.executeWithoutErrorHandlingAsync([
+      'scoped-action',
+      '--scoping',
+      '--',
+      '--delete'
+    ]);
+
+    expect(commandLineParser.selectedAction).toBeDefined();
+    expect(commandLineParser.selectedAction!.actionName).toEqual('scoped-action');
+    expect(targetAction.done).toBe(true);
+    expect(targetAction.deleteFlag?.value).toBe(true);
+    expect(toolDebugFlag.value).toBe(false);
+  });
+
+  it('fails when providing a short name to a scoped action that was also declared in the tool', async () => {
+    const commandLineParser: GenericCommandLine = new GenericCommandLine(ShortNameScopedAction);
+    defineToolDebugFlag(commandLineParser);
+
+    await expect(
+      commandLineParser.executeWithoutErrorHandlingAsync(['scoped-action', '--scoping', '--', '-d'])
+    ).rejects.toThrow('Error: example scoped-action --scoping --: error: Ambiguous option: "-d".\n');
+  });
 });

From 2f235bcb83c390c79417da7bbb6e364873f17e7b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:06 +0000
Subject: [PATCH 075/265] [rush-azure-storage-build-cache-plugin] Cache Azure
 credentials per storage endpoint

Swarm integration step 60; original commit d950fba8d3 (merge of swarm/r03-t144b-x101 at 5e91eed724).
Scope: task 164.

Brings r03's task 164 (board 2765), merged with task 101: the Azure build cache keys a saved credential by its storage endpoint, and the schema says that http endpoints need a SAS. Second agent: ch05 board 2940.

s17 batch D1, item 8 of 10. Gate: ch01 GATE OK board 3310 (tree b0ee664f20)

Commits folded into this step (1):
- 2a744907c2 [rush-azure-storage-build-cache-plugin] Save credentials per storageEndpoint, and require an http or https storageEndpoint (task 164)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-endpoint-credential_2026-09-29-00-29.json | 11 +++
 .../common/config/rush/build-cache.json       |  8 +-
 .../api/test/BuildCacheConfiguration.test.ts  | 30 +++++++-
 .../src/schemas/build-cache.schema.json       |  5 +-
 .../src/AzureStorageAuthentication.ts         | 12 ++-
 .../src/RushAzureStorageBuildCachePlugin.ts   |  7 ++
 .../azure-blob-storage-config.schema.json     |  5 +-
 .../AzureStorageBuildCacheProvider.test.ts    | 76 +++++++++++++++++++
 8 files changed, 147 insertions(+), 7 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json

diff --git a/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json b/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json
new file mode 100644
index 0000000000..33f72bb77e
--- /dev/null
+++ b/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "The Azure Storage build cache plugin now saves credentials for each `storageEndpoint`, so a credential saved for one endpoint is never sent to another. build-cache.json now rejects a `storageEndpoint` that doesn't start with `http://` or `https://`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json b/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
index b9bed9937c..bd030586f4 100644
--- a/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
+++ b/libraries/rush-lib/assets/rush-init/common/config/rush/build-cache.json
@@ -63,7 +63,13 @@
     /**
      * An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite,
      * private endpoints, or storage emulators. When specified, this overrides the default endpoint derived
-     * from "storageAccountName".
+     * from "storageAccountName". The URL must start with "http://" or "https://".
+     *
+     * A credential saved by "rush update-cloud-credentials" is used only with the endpoint that it was
+     * saved for. An Azure login ("rush update-cloud-credentials --interactive") needs an "https://"
+     * endpoint. For an "http://" endpoint, such as Azurite, provide a SAS token with
+     * "rush update-cloud-credentials --credential" or the RUSH_BUILD_CACHE_CREDENTIAL environment
+     * variable, or read without a credential.
      */
     // "storageEndpoint": "http://127.0.0.1:10000/devstoreaccount1",
 
diff --git a/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts b/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
index 189a1747d8..912d253167 100644
--- a/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/BuildCacheConfiguration.test.ts
@@ -94,9 +94,37 @@ describe(BuildCacheConfiguration.name, () => {
       tryLoadAzureConfigurationAsync({
         storageAccountName: 'example',
         storageContainerName: 'build-cache',
-        storageEndpoint: '127.0.0.1 port 10000'
+        storageEndpoint: 'http://127.0.0.1 port 10000'
       })
     ).rejects.toThrow(/#\/azureBlobStorageConfiguration\/storageEndpoint\s+must match format "uri"/);
     expect(factory).not.toHaveBeenCalled();
   });
+
+  it('rejects a storageEndpoint without an http or https scheme', async () => {
+    // "localhost:" parses as a URI scheme, so only the pattern catches this common mistake.
+    await expect(
+      tryLoadAzureConfigurationAsync({
+        storageAccountName: 'example',
+        storageContainerName: 'build-cache',
+        storageEndpoint: 'localhost:10000/devstoreaccount1'
+      })
+    ).rejects.toThrow(
+      /#\/azureBlobStorageConfiguration\/storageEndpoint\s+must match pattern "\^\[Hh\]\[Tt\]\[Tt\]\[Pp\]\[Ss\]\?:\/\/"/
+    );
+    expect(factory).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    { kind: 'an https storageEndpoint', storageEndpoint: 'https://my-proxy.example.com/devstoreaccount1' },
+    // URI schemes are case-insensitive, and Rush accepted this before the pattern existed.
+    { kind: 'a storageEndpoint with an uppercase scheme', storageEndpoint: 'HTTP://127.0.0.1:10000/x' }
+  ])('accepts $kind', async ({ storageEndpoint }: { storageEndpoint: string }) => {
+    await tryLoadAzureConfigurationAsync({
+      storageAccountName: 'example',
+      storageContainerName: 'build-cache',
+      storageEndpoint
+    });
+    expect(factory).toHaveBeenCalledTimes(1);
+    expect(factory.mock.calls[0][0]).toMatchObject({ azureBlobStorageConfiguration: { storageEndpoint } });
+  });
 });
diff --git a/libraries/rush-lib/src/schemas/build-cache.schema.json b/libraries/rush-lib/src/schemas/build-cache.schema.json
index 8029a685a6..6eb4fe0855 100644
--- a/libraries/rush-lib/src/schemas/build-cache.schema.json
+++ b/libraries/rush-lib/src/schemas/build-cache.schema.json
@@ -73,8 +73,9 @@
             },
             "storageEndpoint": {
               "type": "string",
-              "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
-              "format": "uri"
+              "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. The URL must start with \"http://\" or \"https://\". A credential saved by \"rush update-cloud-credentials\" is used only with the endpoint that it was saved for. An Azure login (\"rush update-cloud-credentials --interactive\") needs an \"https://\" endpoint. For an \"http://\" endpoint, such as Azurite, provide a SAS token with \"rush update-cloud-credentials --credential\" or the RUSH_BUILD_CACHE_CREDENTIAL environment variable, or read without a credential. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
+              "format": "uri",
+              "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://"
             },
             "loginFlow": {
               "$ref": "#/definitions/entraLoginFlow"
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts
index 892cb0897b..62008d89a6 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/AzureStorageAuthentication.ts
@@ -30,6 +30,10 @@ export interface IAzureStorageAuthenticationOptions extends IAzureAuthentication
 
 const SAS_TTL_MILLISECONDS: number = 7 * 24 * 60 * 60 * 1000; // Seven days
 
+function getDefaultStorageAccountUrl(storageAccountName: string): string {
+  return `https://${storageAccountName}.blob.core.windows.net/`;
+}
+
 /**
  * @public
  */
@@ -52,12 +56,18 @@ export class AzureStorageAuthentication extends AzureAuthenticationBase {
       ? storageEndpoint.endsWith('/')
         ? storageEndpoint
         : storageEndpoint + '/'
-      : `https://${storageAccountName}.blob.core.windows.net/`;
+      : getDefaultStorageAccountUrl(storageAccountName);
   }
 
   protected _getCacheIdParts(): string[] {
     const cacheIdParts: string[] = [this._storageAccountName, this._storageContainerName];
 
+    // A saved credential is sent to the endpoint that it was saved for, and to no other. The default
+    // endpoint keeps the ID that it had before storageEndpoint existed.
+    if (this._storageAccountUrl !== getDefaultStorageAccountUrl(this._storageAccountName)) {
+      cacheIdParts.push(this._storageAccountUrl);
+    }
+
     if (this._isCacheWriteAllowedByConfiguration) {
       cacheIdParts.push('cacheWriteAllowed');
     }
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts
index 4955f96f27..298483de09 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/RushAzureStorageBuildCachePlugin.ts
@@ -41,6 +41,13 @@ interface IAzureBlobStorageConfigurationJson {
    * An optional custom endpoint URL for the Azure Blob Storage account.
    * Use this to connect to Azurite, private endpoints, or storage emulators.
    * Overrides the default endpoint derived from storageAccountName.
+   *
+   * @remarks
+   * A credential saved by `rush update-cloud-credentials` is used only with the endpoint that it was
+   * saved for. An Azure login (`rush update-cloud-credentials --interactive`) needs an `https://` endpoint.
+   * For an `http://` endpoint, such as Azurite, provide a SAS token with
+   * `rush update-cloud-credentials --credential` or the `RUSH_BUILD_CACHE_CREDENTIAL` environment variable,
+   * or read without a credential.
    */
   readonly storageEndpoint?: string;
 
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json b/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json
index 2ffcd58e4b..4d8efdc56d 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/schemas/azure-blob-storage-config.schema.json
@@ -97,8 +97,9 @@
 
     "storageEndpoint": {
       "type": "string",
-      "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
-      "format": "uri"
+      "description": "An optional custom endpoint URL for the Azure Blob Storage account. Use this to connect to Azurite, private endpoints, or storage emulators. When specified, this overrides the default endpoint derived from storageAccountName. The URL must start with \"http://\" or \"https://\". A credential saved by \"rush update-cloud-credentials\" is used only with the endpoint that it was saved for. An Azure login (\"rush update-cloud-credentials --interactive\") needs an \"https://\" endpoint. For an \"http://\" endpoint, such as Azurite, provide a SAS token with \"rush update-cloud-credentials --credential\" or the RUSH_BUILD_CACHE_CREDENTIAL environment variable, or read without a credential. Example: \"http://127.0.0.1:10000/devstoreaccount1\" or \"https://my-proxy.example.com/devstoreaccount1\"",
+      "format": "uri",
+      "pattern": "^[Hh][Tt][Tt][Pp][Ss]?://"
     },
 
     "isCacheWriteAllowed": {
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
index 3b5e5e0b28..6dc03c12f7 100644
--- a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureStorageBuildCacheProvider.test.ts
@@ -1,6 +1,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
 import { BlobServiceClient, type BlockBlobClient, type ContainerClient } from '@azure/storage-blob';
 
 import { CredentialCache, type ICredentialCacheEntry } from '@rushstack/credential-cache';
@@ -67,6 +71,78 @@ describe(AzureStorageBuildCacheProvider.name, () => {
     });
   });
 
+  describe('a saved credential', () => {
+    const EMULATOR_ENDPOINT: string = 'http://127.0.0.1:10000/devstoreaccount1';
+    const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+    let cacheFolder: string;
+
+    beforeEach(() => {
+      cacheFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'azure-storage-credentials-'));
+      const usingAsync: typeof CredentialCache.usingAsync = CredentialCache.usingAsync.bind(CredentialCache);
+      jest
+        .spyOn(CredentialCache, 'usingAsync')
+        .mockImplementation((options, doActionAsync) =>
+          usingAsync({ ...options, cacheFilePath: `${cacheFolder}/credentials.json` }, doActionAsync)
+        );
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+      fs.rmSync(cacheFolder, { recursive: true, force: true });
+    });
+
+    function createProvider(storageEndpoint?: string): AzureStorageBuildCacheProvider {
+      return new AzureStorageBuildCacheProvider({
+        storageAccountName: 'storage-account',
+        storageContainerName: 'container-name',
+        storageEndpoint,
+        isCacheWriteAllowed: true
+      });
+    }
+
+    async function tryGetSavedCredentialAsync(storageEndpoint?: string): Promise<string | undefined> {
+      return (await createProvider(storageEndpoint).tryGetCachedCredentialAsync())?.credential;
+    }
+
+    it('is used only with the endpoint that it was saved for', async () => {
+      await createProvider().updateCachedCredentialAsync(terminal, 'account-sas');
+      expect(await tryGetSavedCredentialAsync()).toBe('account-sas');
+      expect(await tryGetSavedCredentialAsync(EMULATOR_ENDPOINT)).toBeUndefined();
+
+      await createProvider(EMULATOR_ENDPOINT).updateCachedCredentialAsync(terminal, 'emulator-sas');
+      expect(await tryGetSavedCredentialAsync(EMULATOR_ENDPOINT)).toBe('emulator-sas');
+      expect(await tryGetSavedCredentialAsync(`${EMULATOR_ENDPOINT}/`)).toBe('emulator-sas');
+      expect(await tryGetSavedCredentialAsync('https://proxy.example.com/devstoreaccount1')).toBeUndefined();
+      expect(await tryGetSavedCredentialAsync()).toBe('account-sas');
+
+      const savedJson: { cacheEntries: Record<string, unknown> } = JSON.parse(
+        fs.readFileSync(`${cacheFolder}/credentials.json`, 'utf8')
+      );
+      expect(Object.keys(savedJson.cacheEntries).sort()).toEqual([
+        'azure-blob-storage|AzurePublicCloud|storage-account|container-name|cacheWriteAllowed',
+        `azure-blob-storage|AzurePublicCloud|storage-account|container-name|${EMULATOR_ENDPOINT}/|cacheWriteAllowed`
+      ]);
+    });
+
+    it("is shared with a storageEndpoint that names the account's default endpoint", async () => {
+      await createProvider().updateCachedCredentialAsync(terminal, 'account-sas');
+      expect(await tryGetSavedCredentialAsync('https://storage-account.blob.core.windows.net')).toBe(
+        'account-sas'
+      );
+      expect(await tryGetSavedCredentialAsync('https://storage-account.blob.core.windows.net/')).toBe(
+        'account-sas'
+      );
+    });
+
+    it('is deleted only for the configured endpoint', async () => {
+      await createProvider().updateCachedCredentialAsync(terminal, 'account-sas');
+      await createProvider(EMULATOR_ENDPOINT).updateCachedCredentialAsync(terminal, 'emulator-sas');
+      await createProvider(EMULATOR_ENDPOINT).deleteCachedCredentialsAsync(terminal);
+      expect(await tryGetSavedCredentialAsync(EMULATOR_ENDPOINT)).toBeUndefined();
+      expect(await tryGetSavedCredentialAsync()).toBe('account-sas');
+    });
+  });
+
   describe('isCacheWriteAllowed', () => {
     function prepareSubject(
       optionValue: boolean,

From c8e43c1a53d6007c1afac7fc8b49e76030bd018a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:06 +0000
Subject: [PATCH 076/265] [rush-cli-client] Test the cancellation notice when
 the client never asked rushd to stop

Swarm integration step 61; original commit 4d06054101 (merge of swarm/r04-t132-nit1 at 8f0016995a).
Scope: task 132 NIT 1.

Brings r04's fix for ch01's NIT 1 on task 132 (board 3094). Second agent: t05 board 3172.

s17 batch D1, item 9 of 10. Gate: ch01 GATE OK board 3310 (tree 7e80f904a2)

Commits folded into this step (1):
- 8f0016995a Test the cancellation notice when the client never asked rushd to stop the request (task 132 NIT 1, ch01 board 2984)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/cancellationNotice.test.ts       | 41 +++++++++++++++++++
 .../swarm-r04-t132-nit1_2026-09-29-03-10.json | 11 +++++
 2 files changed, 52 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t132-nit1_2026-09-29-03-10.json

diff --git a/apps/rush-cli-client/src/test/cancellationNotice.test.ts b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
index aea86c74d0..c48e0c09a2 100644
--- a/apps/rush-cli-client/src/test/cancellationNotice.test.ts
+++ b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
@@ -133,6 +133,13 @@ describe('the cancellation of a daemon request (task 132)', () => {
     );
   }
 
+  function disconnected(): DaemonClientError {
+    return new DaemonClientError(
+      'disconnected',
+      'Daemon disconnected before delivering a result; the command was not retried.'
+    );
+  }
+
   it('says at once that it waits for rushd, and keeps the final line when rushd confirms the stop', async () => {
     execute(async (options) => {
       deliverSignal('SIGINT');
@@ -178,6 +185,18 @@ describe('the cancellation of a daemon request (task 132)', () => {
     expect(process.exitCode).toBe(130);
   });
 
+  it('adds nothing when the connection fails before the client asked rushd to stop the request', async () => {
+    // For example, a signal while the client waits for a restarted daemon, whose connection then fails.
+    execute(async (options) => {
+      deliverSignal('SIGINT');
+      expect(options.abortSignal!.aborted).toBe(true);
+      throw disconnected();
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
+
   it('writes both notices in the agent output, once', async () => {
     const output: string[] = [];
     const renderer: AgentProgressRenderer = new AgentProgressRenderer({
@@ -209,4 +228,26 @@ describe('the cancellation of a daemon request (task 132)', () => {
     expect(stderr).toEqual([CANCELLED]);
     expect(process.exitCode).toBe(130);
   });
+
+  it('ends the agent summary line without a stop to confirm when the client never asked rushd to stop', async () => {
+    const output: string[] = [];
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: (text: string) => output.push(text)
+    });
+    execute(async () => {
+      deliverSignal('SIGINT');
+      throw disconnected();
+    });
+    await launchClientAsync(false, renderer);
+    const lines: string[] = output.join('').split('\n').slice(0, -1);
+    expect(lines).toEqual([
+      expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
+      expect.stringMatching(/^rush build: CANCELLED in \d+\.\ds$/)
+    ]);
+    expect(stderr).toEqual([CANCELLED]);
+    expect(process.exitCode).toBe(130);
+  });
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t132-nit1_2026-09-29-03-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t132-nit1_2026-09-29-03-10.json
new file mode 100644
index 0000000000..a667d24642
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t132-nit1_2026-09-29-03-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test that a cancelled request whose connection fails before the client asked rushd to stop it is reported as cancelled, without saying that rushd did not confirm the stop.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 4602af13d5be50844abdda8fbdcddad67ce05a7e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 04:12:06 +0000
Subject: [PATCH 077/265] [rush-client-core] Test that a takeover keeps a
 reservation that replaced the abandoned one

Swarm integration step 62; original commit d06e2ded5e (merge of swarm/r03-t126-nit2 at 40ca8cd335).
Scope: task 126 NIT 2.

Brings r03's fix for ch01's NIT 2 on task 126 (board 2984, board 3089). ch01 checked it with mutant K126 in the gate.

s17 batch D1, item 10 of 10. Gate: ch01 GATE OK board 3310 (tree 8061bc8677)

Commits folded into this step (1):
- 40ca8cd335 [rush-client-core] Test that a takeover keeps a reservation that replaced the abandoned one (task 126, ch01 NIT 2)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...akeover-recheck-test_2026-09-29-02-55.json | 11 +++++++
 .../src/test/connectOrStartDaemon.test.ts     | 29 +++++++++++++++++--
 2 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/r03-reservation-takeover-recheck-test_2026-09-29-02-55.json

diff --git a/common/changes/@rushstack/rush-client-core/r03-reservation-takeover-recheck-test_2026-09-29-02-55.json b/common/changes/@rushstack/rush-client-core/r03-reservation-takeover-recheck-test_2026-09-29-02-55.json
new file mode 100644
index 0000000000..8e3f2a8416
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r03-reservation-takeover-recheck-test_2026-09-29-02-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Test that a client takes over only the startup reservation that it found abandoned, not one that replaced it since.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index f7159c3594..54533aa132 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -33,8 +33,17 @@ import {
   type IDaemonStartCommand
 } from '../connectOrStartDaemon';
 import { executeWithDaemonRestartAsync, type IDaemonRestartNotice } from '../executeWithDaemonRestart';
-import { getDaemonStartupFilePath, releaseDaemonStartup, reserveDaemonStartup } from '../DaemonStartup';
-import { inspectDaemonStartupReservation } from '../DaemonStartupReservation';
+import {
+  getDaemonStartupFilePath,
+  readDaemonStartupReservation,
+  releaseDaemonStartup,
+  reserveDaemonStartup,
+  type IDaemonStartupReservation
+} from '../DaemonStartup';
+import {
+  inspectDaemonStartupReservation,
+  tryTakeOverAbandonedStartupReservationAsync
+} from '../DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
@@ -438,6 +447,22 @@ describe('detached daemon startup', () => {
     expect(readTakeOverLines()).toEqual([]);
   }, 30000);
 
+  it('takes over only the reservation that it found abandoned, not one that replaced it since', async () => {
+    const startupPath: string = getDaemonStartupFilePath(paths);
+    writeReservation(await getExitedPidAsync(), new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString());
+    const abandoned: IDaemonStartupReservation = readDaemonStartupReservation(paths)!;
+    // After the caller read it, the reservation was replaced by one whose helper still runs.
+    const replacement: string = writeReservation(process.pid);
+    expect(await tryTakeOverAbandonedStartupReservationAsync(paths, abandoned)).toBe(false);
+    expect(fs.readFileSync(startupPath, 'utf8')).toBe(replacement);
+
+    // Unchanged, the same reservation is taken over.
+    fs.writeFileSync(startupPath, abandoned.contents!);
+    expect(await tryTakeOverAbandonedStartupReservationAsync(paths, abandoned)).toBe(true);
+    expect(fs.existsSync(startupPath)).toBe(false);
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+  });
+
   it('lets exactly one of several clients take over a reservation whose helper exited', async () => {
     const helperPid: number = await getExitedPidAsync();
     writeReservation(helperPid, new Date(Date.now() - 2 * RELAUNCH_DELAY_MS).toISOString());

From a4b4900f01358898e9c1163e885ad650dcc59a9f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:04:01 +0000
Subject: [PATCH 078/265] [rush-lib] Type PhasedCommandEngineUsageError's
 options without ErrorOptions

Swarm integration step 63; original commit f6d03bcffd (merge of swarm/r04-t78-erroropts at 17c6dacf70).
Scope: task 196.

Brings r04's fix for ch01's BUG board 3247 (board 3285): the constructor takes `options?: { cause?: unknown }` instead of `ErrorOptions`, so consumers of the rush-lib typings compiled with an older lib, such as the three es2017 build-tests projects, build again. Second agent: o04 board 3354.

s17 batch D2, item 1 of 6. Gate: ch01 GATE OK board 3514 (tree 813312a4d4)

Commits folded into this step (1):
- 17c6dacf70 Type PhasedCommandEngineUsageError's options without ErrorOptions, so that consumers of the rush-lib typings with an older lib compile (task 78 fix, ch01 board 3247)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../swarm-r04-t78-erroropts_2026-09-29-03-57.json     | 11 +++++++++++
 common/reviews/api/rush-lib.api.md                    |  4 +++-
 .../rush-lib/src/api/PhasedCommandEngineUsageError.ts |  3 ++-
 3 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r04-t78-erroropts_2026-09-29-03-57.json

diff --git a/common/changes/@microsoft/rush/swarm-r04-t78-erroropts_2026-09-29-03-57.json b/common/changes/@microsoft/rush/swarm-r04-t78-erroropts_2026-09-29-03-57.json
new file mode 100644
index 0000000000..b1abe0d517
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r04-t78-erroropts_2026-09-29-03-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "The constructor of `PhasedCommandEngineUsageError` (alpha) takes `options?: { cause?: unknown }` instead of `ErrorOptions`, so that projects that compile against the rush-lib or rush-sdk typings with a `lib` older than es2022 no longer fail with TS2304 \"Cannot find name 'ErrorOptions'\".",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 2a09f55a8f..3555800b90 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1600,7 +1600,9 @@ export class PhasedCommandEngineProjectConfigurationError extends Error {
 
 // @alpha
 export class PhasedCommandEngineUsageError extends Error {
-    constructor(message: string, exitCode: number, options?: ErrorOptions);
+    constructor(message: string, exitCode: number, options?: {
+        cause?: unknown;
+    });
     readonly exitCode: number;
 }
 
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
index 51a8afa15e..f487c58c1a 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
@@ -11,7 +11,8 @@ export class PhasedCommandEngineUsageError extends Error {
   /** The exit code of native Rush for this command line. */
   public readonly exitCode: number;
 
-  public constructor(message: string, exitCode: number, options?: ErrorOptions) {
+  // The shape of ErrorOptions, which needs lib es2022. Consumers of these typings may use an older lib.
+  public constructor(message: string, exitCode: number, options?: { cause?: unknown }) {
     super(message, options);
     this.name = 'PhasedCommandEngineUsageError';
     this.exitCode = exitCode;

From 6121a8288bbe33e66ace39b72d89f7f464afd4a8 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:04:01 +0000
Subject: [PATCH 079/265] [rush-cli-client] A request that waits for a daemon
 restart says why

Swarm integration step 64; original commit 12732cc337 (merge of swarm/r05-t166-int3 at 218ab4f8c3).
Scope: task 166.

Brings r05's task 166 (board 3041, board 3112), re-tipped with 170-int for batch D2 (board 3271): a request that waits for a daemon restart says why and what it waits for, within 0.5 s and every 25 s after that, and a waiting rushx-client says so with its own prefix. Errors name the real cause instead of "its environment". Second agent: o05 board 3168.

s17 batch D2, item 2 of 6. Gate: ch01 GATE OK board 3514 (tree 17650f1da7)

Commits folded into this step (6):
- 2a0b2adb63 rush-daemon-protocol: a workspaceInputsChanged restart reason, and restart-wait details on queue positions (task 166)
- a0c391d2ac rush-lib: WorkspaceRuntimeFingerprintCache.changedInstallationPaths (task 166)
- 282d202be7 rush-client-core: name daemon restart causes and report restart waits and input admission (task 166)
- b90a73b279 rush-daemon: say why a request waits for a daemon restart, in its queue positions and admission errors (task 166)
- 20f173e57e rush-cli-client: say why and for what a request waits for a daemon restart, on pipes too, and repeat it every 25 s (task 166)
- 2e3c61e239 rush-cli-client: no restart wait line once a cancellation is requested (task 166 with 132)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  44 ++-
 .../src/AgentProgressRenderer.ts              |  17 +
 .../src/ClientAdmissionControls.ts            |   8 +-
 .../src/daemonRestartNotice.ts                | 213 +++++++++++--
 apps/rush-cli-client/src/launchClient.ts      |  34 +-
 apps/rush-cli-client/src/resultDiagnostics.ts |  14 +-
 .../src/test/AgentProgressRenderer.test.ts    |  57 ++++
 .../src/test/cancellationNotice.test.ts       |  24 ++
 .../src/test/daemonRestartNotice.test.ts      | 299 +++++++++++++++---
 .../src/test/resultDiagnostics.test.ts        |  23 ++
 ...restart-wait-reasons_2026-09-29-02-05.json |  11 +
 ...restart-wait-reasons_2026-09-29-02-05.json |  11 +
 ...restart-wait-reasons_2026-09-29-02-05.json |  11 +
 ...restart-wait-reasons_2026-09-29-02-05.json |  11 +
 ...restart-wait-reasons_2026-09-29-02-05.json |  11 +
 common/reviews/api/rush-client-core.api.md    |  15 +-
 .../reviews/api/rush-daemon-protocol.api.md   |  12 +-
 common/reviews/api/rush-lib.api.md            |   3 +
 libraries/rush-client-core/README.md          |  13 +-
 .../rush-client-core/src/DaemonClient.ts      |  38 ++-
 .../src/DaemonRestartCause.ts                 |  79 +++++
 libraries/rush-client-core/src/index.ts       |   4 +-
 .../src/test/DaemonClient.test.ts             |  57 +++-
 .../src/test/DaemonRestartCause.test.ts       |  89 ++++++
 libraries/rush-daemon-protocol/README.md      |   8 +-
 .../src/DaemonInstallationChange.ts           |   7 +-
 .../src/DaemonRequestAdmission.ts             |   9 +-
 .../src/DaemonWorkspaceInputsChange.ts        |  27 ++
 .../src/InstallationChangeValidation.ts       |  14 +-
 .../src/RequestAdmissionControlValidation.ts  |  19 ++
 .../src/WorkspaceInputsChangeValidation.ts    |  33 ++
 libraries/rush-daemon-protocol/src/index.ts   |   4 +-
 .../test/WorkspaceInputsRestartReason.test.ts |  82 +++++
 libraries/rush-daemon/README.md               |   9 +-
 .../src/WorkspaceRequestAdmission.ts          |  59 ++--
 .../src/WorkspaceRequestLifecycle.ts          |  51 ++-
 .../src/WorkspaceRestartArbiter.ts            | 122 ++++---
 .../src/test/DaemonInstallationChange.test.ts |   2 +-
 .../src/test/RestartDrainAdmission.test.ts    | 127 ++++++--
 .../src/test/WorkspaceRestartArbiter.test.ts  | 138 ++++++++
 .../WorkspaceServedScriptAdmission.test.ts    | 165 +++++++++-
 .../src/api/WorkspaceInputFingerprint.ts      |  59 +++-
 .../test/WorkspaceInputFingerprint.test.ts    |   8 +
 43 files changed, 1805 insertions(+), 236 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
 create mode 100644 libraries/rush-client-core/src/DaemonRestartCause.ts
 create mode 100644 libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
 create mode 100644 libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts
 create mode 100644 libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 8082733f1c..c3d3cf8ba8 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -90,14 +90,16 @@ timeout, the client exits with code 1 and suggests `--wait-timeout`. It does not
 suggest exporting `RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS`, because Rush versions that do
 not recognize a `RUSH_` environment variable fail every command while it is set.
 In legacy output and in `rushx-client`, the admission failure line
-(`rush-client: daemon admission failed (wait-timeout): …`, or `(no-wait)`) gives the
-daemon's reason, as agent mode's summary line does, so it names what the request
-waited for, such as a daemon restart.
+(`rush-client: daemon admission failed (wait-timeout): …`, or `(no-wait)`; in
+`rushx-client` it begins with `rushx-client:`) gives the daemon's reason, as agent
+mode's summary line does, so it names what the request waited for, such as a daemon
+restart, and why the daemon restarts.
 
 Admission controls also apply to experimental graph requests, but not
 `start|stop|restart|status|logs`. They affect daemon admission only; native fallback
 retains native command behavior. Waiting positions are shown on interactive stderr,
-and admission failures report their typed reason and a nonzero exit code.
+and a wait for a daemon restart on a pipe too (see below). Admission failures report
+their typed reason and a nonzero exit code.
 
 Explicit reporter/output/log-level controls (`--reporter`, `--output`, `--log-level`,
 `RUSH_REPORTER` other than `legacy`, or `RUSH_LOG_LEVEL`) retain the native frontend
@@ -266,20 +268,38 @@ results before the old connection closes.
 When the daemon's own installation was removed or replaced (for example a deleted
 snapshot folder or a reinstalled Rush release), the daemon lets its running requests
 finish, answers each other request with that typed restart once they have, and then
-exits. While a command waits, the agent progress status (or stderr: on a terminal at
-each position, on a pipe once) says why:
-`rush-client: waiting for the running requests to finish (position 1); the daemon
-(PID <pid>) then restarts, because its installation at <folder> was removed.` The
-timeout rules of a restart for the request's environment apply (see above): the
-built-in default does not limit waiting for the requests that were running when the
-command arrived, but still limits it while the daemon runs a `rushx` script, and
-`--no-wait` and an explicit `--wait-timeout` limit the whole wait. A command that
+exits. The timeout rules of a restart for the request's environment apply (see
+above): the built-in default does not limit waiting for the requests that were running
+when the command arrived, but still limits it while the daemon runs a `rushx` script,
+and `--no-wait` and an explicit `--wait-timeout` limit the whole wait. A command that
 times out exits with code 1, names the changed folder and, if a script runs, suggests
 stopping it. Otherwise the client starts a daemon from its own launcher once the wait
 ends, resubmits the request, and prints one line on stderr (or above the agent
 progress rows): `rush-client: The daemon's installation at <folder> was removed;
 restarted the daemon (PID <pid>).`
 
+While a command waits for a daemon restart, for its installation, the command's
+environment or the workspace's inputs, the agent progress status (or stderr, on a
+terminal and on a pipe) says what it waits for and why the daemon restarts, as soon as
+the daemon reports the wait: `rush-client: waiting for 2 running requests to finish,
+including 1 rushx script; the daemon (PID <pid>) then restarts, because
+common/config/rush/pnpm-lock.yaml changed.` After `because`, the cause is `its
+installation at <folder> was removed` (or `replaced`), `this request's environment
+differs from the daemon's in NODE_OPTIONS` (variable names, never their values),
+`<files> changed` for the workspace's installation, `the code of Rush or a Rush plugin
+changed (<files>)`, or `this request selects Rush <version>`. The count names `rushx`
+scripts, because a script such as a dev server may run until it is stopped. A
+`rushx-client` script that waits for another request's restart prints `rushx-client:
+waiting for the daemon (PID <pid>) to restart for another request (2 requests ahead),
+because <cause>.` The line goes to the stderr that the script writes to, which is a
+pipe, because a `rushx-client` with a terminal runs the script in-process. A terminal
+gets a line whenever the wait changes, and a pipe when the wait begins or its cause
+changes. Both get the line again with the time waited (`still waiting after 25s for
+…`) whenever 25 seconds pass without one, until the command follows the restart,
+starts, or ends. Once the client asks rushd to cancel the command (Ctrl+C) and says so,
+it writes no more wait lines. In agent mode, the progress phase says it, and on a pipe
+a status line is written at once when the wait begins or its cause changes.
+
 When the daemon restarts for a command's environment, the client prints a line of the
 same kind that names the variables that differed, never their values:
 `rush-client: A command's environment differed from the daemon's in NODE_OPTIONS;
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index d73665441f..f72c577f90 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -299,6 +299,23 @@ export class AgentProgressRenderer {
     this.setPhase(`queued behind another request (position ${position})`);
   }
 
+  /**
+   * The request waits for a daemon restart, and `wait` says why and for what. The phase and the status lines say
+   * that instead of a queue position. On a pipe, `announce` writes a status line at once, so that the wait and its
+   * cause are known when the wait begins or its cause changes, rather than at the next status line. Once the client
+   * asked rushd to cancel the request, the cancelling phase stays, and nothing is written.
+   */
+  public onRestartWait(wait: string, announce: boolean): void {
+    if (this.#cancelling) {
+      return;
+    }
+    this.#queued = undefined;
+    this.setPhase(wait);
+    if (announce && !this.#options.isTTY) {
+      this.#writePipeLine(this.#getStatusLine());
+    }
+  }
+
   /**
    * The client asked rushd to cancel the request, and waits up to `timeoutMs` for rushd to stop it, which can take
    * seconds while rushd prepares the workspace graph. Says so at once, and on a TTY until the end; on a pipe, in one
diff --git a/apps/rush-cli-client/src/ClientAdmissionControls.ts b/apps/rush-cli-client/src/ClientAdmissionControls.ts
index 9be7c67b63..cbb6ce7d63 100644
--- a/apps/rush-cli-client/src/ClientAdmissionControls.ts
+++ b/apps/rush-cli-client/src/ClientAdmissionControls.ts
@@ -75,6 +75,9 @@ export function getConfiguredAdmission(options: IConfiguredAdmissionOptions): ID
 // Only the per-invocation flag is offered: Rush versions that do not recognize the variable reject it.
 const WAIT_LONGER_REMEDY: string = 'To wait longer, pass --wait-timeout <seconds>.';
 
+/** The client that writes a line, which begins with its name. */
+export type ClientName = 'rush-client' | 'rushx-client';
+
 /**
  * Explains a daemon admission failure and how to wait longer.
  *
@@ -85,9 +88,10 @@ const WAIT_LONGER_REMEDY: string = 'To wait longer, pass --wait-timeout <seconds
 export function formatAdmissionFailure(
   code: DaemonRequestAdmissionErrorCode,
   admission: IDaemonRequestAdmissionOptions | undefined,
-  daemonMessage?: string
+  daemonMessage?: string,
+  clientName: ClientName = 'rush-client'
 ): string {
-  const prefix: string = `rush-client: daemon admission failed (${code})`;
+  const prefix: string = `${clientName}: daemon admission failed (${code})`;
   if (code === 'no-wait') {
     return daemonMessage
       ? `${prefix}: ${daemonMessage}\n`
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index e1e7cd643a..860175a0a7 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -1,7 +1,11 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonRestartNotice } from '@rushstack/rush-client-core';
+import {
+  formatDaemonRestartCause,
+  type IDaemonRestartNotice,
+  type IDaemonRestartWaitDetails
+} from '@rushstack/rush-client-core';
 import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 
 /** The most variables that a restart line names before it says how many more differed. */
@@ -70,76 +74,217 @@ export function createDaemonRestartNoticeHandler(
 export const RESUBMITTED_PHASE: string =
   'request resubmitted to the new daemon; preparing the workspace graph';
 
+/** A request that waits for a daemon restart says so again when it has written nothing about the wait for this long. */
+export const RESTART_WAIT_REPEAT_MS: number = 25_000;
+
+/** What a queue position says about a wait for a daemon restart. */
+export interface IDaemonRestartWait {
+  /**
+   * How many requests the wait counts: those that the daemon serves, and for a rushx script that waits for another
+   * request's restart, also those that wait to restart the daemon.
+   */
+  readonly position: number;
+  readonly reason: DaemonRestartReason;
+  readonly details: IDaemonRestartWaitDetails;
+}
+
+/** Options for {@link formatDaemonRestartWait}. */
+export interface IDaemonRestartWaitLineOptions extends IDaemonRestartWait {
+  /** The process ID of the daemon that restarts. */
+  readonly daemonPid: number | undefined;
+  /** How long the request has waited. From a second on, the line says so. */
+  readonly elapsedMs?: number;
+}
+
+function formatCount(count: number, noun: string): string {
+  return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+
+function formatIncludedScripts(scriptCount: number): string {
+  return scriptCount > 0 ? `, including ${formatCount(scriptCount, 'rushx script')}` : '';
+}
+
 /**
- * Returns what a queued request waits for when the daemon answers it with a restart once the requests ahead of it
- * finish, or `undefined` for a queue position that needs no explanation.
+ * Says what a request that waits for a daemon restart waits for and why the daemon restarts, for example
+ * "waiting for 2 running requests to finish, including 1 rushx script; the daemon (PID 41) then restarts, because
+ * common/config/rush/pnpm-lock.yaml changed". A rushx script that waits for another request's restart gets
+ * "waiting for the daemon (PID 41) to restart for another request (2 requests ahead), because ...". The line names
+ * environment variables, never their values, and leaves out a cause that this client cannot word.
  */
-export function formatDaemonRestartWait(
-  position: number,
-  reason: DaemonRestartReason | undefined,
-  daemonPid: number | undefined
-): string | undefined {
-  if (reason?.kind !== 'installationChanged') return undefined;
+export function formatDaemonRestartWait(options: IDaemonRestartWaitLineOptions): string {
+  const { position, reason, details, daemonPid, elapsedMs = 0 } = options;
+  const anotherRequest: boolean = !!details.restartsForAnotherRequest;
+  const cause: string | undefined = formatDaemonRestartCause(
+    reason,
+    anotherRequest ? 'anotherRequest' : 'thisRequest'
+  );
+  const because: string = cause === undefined ? '' : `, ${cause}`;
   const pid: string = daemonPid === undefined ? '' : ` (PID ${daemonPid})`;
-  return (
-    `waiting for the running requests to finish (position ${position}); the daemon${pid} then restarts, ` +
-    `because its installation at ${reason.folder} was ${reason.change}`
+  const waiting: string =
+    elapsedMs < 1000 ? 'waiting' : `still waiting after ${Math.round(elapsedMs / 1000)}s`;
+  const scriptCount: number = details.scriptCount ?? 0;
+  if (anotherRequest) {
+    const ahead: string = `${formatCount(position, 'request')} ahead${formatIncludedScripts(scriptCount)}`;
+    return `${waiting} for the daemon${pid} to restart for another request (${ahead})${because}`;
+  }
+  // Scripts are named, since a script such as a dev server may run until it is stopped.
+  const allScripts: boolean = scriptCount >= position;
+  const running: string = formatCount(position, allScripts ? 'running rushx script' : 'running request');
+  const scripts: string = allScripts ? '' : formatIncludedScripts(scriptCount);
+  return `${waiting} for ${running} to finish${scripts}; the daemon${pid} then restarts${because}`;
+}
+
+/** The part of a restart wait that a pipe gets a line for at once when it changes: whose restart, and why. */
+function getRestartWaitCause(wait: IDaemonRestartWait): string {
+  const anotherRequest: boolean = !!wait.details.restartsForAnotherRequest;
+  const cause: string | undefined = formatDaemonRestartCause(
+    wait.reason,
+    anotherRequest ? 'anotherRequest' : 'thisRequest'
   );
+  return `${anotherRequest}:${cause ?? wait.reason.kind}`;
+}
+
+/** The agent renderer methods that tell an agent why a request waits or restarted. */
+export interface IAgentRequestNoticeRenderer {
+  note(line: string): void;
+  setPhase(phase: string): void;
+  onQueuePosition(position: number): void;
+  /** See `AgentProgressRenderer.onRestartWait`. */
+  onRestartWait(wait: string, announce: boolean): void;
 }
 
 /**
  * Where a request's queue positions and restart lines go.
  */
 export interface IDaemonRequestNoticeTarget extends IDaemonRestartNoticeTarget {
-  readonly agentRenderer:
-    | { note(line: string): void; setPhase(phase: string): void; onQueuePosition(position: number): void }
-    | undefined;
-  /** On a pipe, only the first {@link formatDaemonRestartWait} line is written, and plain positions are not. */
+  readonly agentRenderer: IAgentRequestNoticeRenderer | undefined;
+  /**
+   * Without an agent renderer, a terminal gets a line for every change of a restart wait and every queue position,
+   * and a pipe gets a line when a restart wait begins or its cause changes. Both get the restart wait line again
+   * with the time waited when {@link RESTART_WAIT_REPEAT_MS} passes without one.
+   */
   readonly stderrIsTTY: boolean;
   /** The process ID of the daemon that serves the request first. */
   readonly daemonPid: number | undefined;
+  /** Returns the current time in milliseconds. Defaults to `Date.now`. */
+  readonly now?: () => number;
 }
 
 /**
- * The `onRestartAsync` and `onQueuePositionAsync` callbacks of one request.
+ * The callbacks of one request that tell the user why it waits or restarted.
  */
 export interface IDaemonRequestNoticeHandlers {
   readonly onRestartAsync: (notice: IDaemonRestartNotice) => Promise<void>;
-  readonly onQueuePositionAsync: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
+  readonly onQueuePositionAsync: (
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails
+  ) => Promise<void>;
+  /** The daemon admitted the request's input, so a rushx script starts, and no longer waits. */
+  readonly onInputAdmittedAsync: () => Promise<void>;
+  /** The request's output or an event arrived, so it no longer waits. */
+  readonly onRequestProgress: () => void;
+  /**
+   * The request ended, or the client asked rushd to cancel it: stops repeating the restart wait line, and ignores
+   * later queue positions.
+   */
+  readonly dispose: () => void;
+}
+
+interface IRestartWaitState {
+  readonly startedAtMs: number;
+  wait: IDaemonRestartWait;
+  /** The cause of the last restart wait that was announced; see {@link getRestartWaitCause}. */
+  announcedCause: string | undefined;
+  /** The last restart wait line without the time waited, so that a terminal gets a line for each change. */
+  line: string | undefined;
+  timer: ReturnType<typeof setTimeout> | undefined;
 }
 
 /**
- * Creates the callbacks that tell the user why a request waits or restarted. Queue positions name the daemon that
- * serves the request, which changes when the request follows a restart.
+ * Creates the callbacks that tell the user why a request waits or restarted. The lines name the daemon that serves
+ * the request, which changes when the request follows a restart. A restart wait line is repeated until the request
+ * restarts, gets input, output or an event, or waits for plain admission instead. Once the request ends or the
+ * client asks rushd to cancel it (see `dispose`), nothing more is written.
  */
 export function createDaemonRequestNoticeHandlers(
   target: IDaemonRequestNoticeTarget
 ): IDaemonRequestNoticeHandlers {
-  const { agentRenderer, stderrIsTTY } = target;
+  const { agentRenderer, stderrIsTTY, now = Date.now } = target;
+  const prefix: string = target.rushx ? 'rushx-client' : 'rush-client';
   const writeRestartNoticeAsync: (notice: IDaemonRestartNotice) => Promise<void> =
     createDaemonRestartNoticeHandler(target);
   let daemonPid: number | undefined = target.daemonPid;
-  let wroteRestartWait: boolean = false;
+  let restartWait: IRestartWaitState | undefined;
+  let showedRestartWait: boolean = false;
+  let disposed: boolean = false;
+
+  const endRestartWait = (): void => {
+    clearTimeout(restartWait?.timer);
+    restartWait = undefined;
+  };
+  const writeRestartWaitAsync = async (state: IRestartWaitState): Promise<void> => {
+    clearTimeout(state.timer);
+    state.timer = setTimeout(() => {
+      if (restartWait === state) writeRestartWaitAsync(state).catch(() => undefined);
+    }, RESTART_WAIT_REPEAT_MS);
+    state.timer.unref?.();
+    const elapsedMs: number = now() - state.startedAtMs;
+    const line: string = formatDaemonRestartWait({ ...state.wait, daemonPid, elapsedMs });
+    await target.writeStderrAsync(`${prefix}: ${line}.\n`);
+  };
+
   return {
     onRestartAsync: async (notice: IDaemonRestartNotice): Promise<void> => {
+      endRestartWait();
       daemonPid = notice.successorPid;
       await writeRestartNoticeAsync(notice);
       // The phase still says that the request waits for the previous daemon.
-      if (agentRenderer && wroteRestartWait) agentRenderer.setPhase(RESUBMITTED_PHASE);
-      wroteRestartWait = false;
+      if (agentRenderer && showedRestartWait) agentRenderer.setPhase(RESUBMITTED_PHASE);
+      showedRestartWait = false;
     },
-    onQueuePositionAsync: async (position: number, restartReason?: DaemonRestartReason): Promise<void> => {
-      const wait: string | undefined = formatDaemonRestartWait(position, restartReason, daemonPid);
+    onQueuePositionAsync: async (
+      position: number,
+      restartReason?: DaemonRestartReason,
+      details: IDaemonRestartWaitDetails = {}
+    ): Promise<void> => {
+      if (disposed) return;
+      if (!restartReason) {
+        endRestartWait();
+        if (agentRenderer) agentRenderer.onQueuePosition(position);
+        else if (stderrIsTTY) {
+          await target.writeStderrAsync(`${prefix}: waiting for daemon admission (position ${position}).\n`);
+        }
+        return;
+      }
+      const wait: IDaemonRestartWait = { position, reason: restartReason, details };
+      const state: IRestartWaitState = (restartWait ??= {
+        startedAtMs: now(),
+        wait,
+        announcedCause: undefined,
+        line: undefined,
+        timer: undefined
+      });
+      state.wait = wait;
+      const cause: string = getRestartWaitCause(wait);
+      const announce: boolean = cause !== state.announcedCause;
+      state.announcedCause = cause;
+      const line: string = formatDaemonRestartWait({ ...wait, daemonPid });
+      const changed: boolean = line !== state.line;
+      state.line = line;
       if (agentRenderer) {
-        wroteRestartWait ||= wait !== undefined;
-        if (wait) agentRenderer.setPhase(wait);
-        else agentRenderer.onQueuePosition(position);
-      } else if (wait && (stderrIsTTY || !wroteRestartWait)) {
-        wroteRestartWait = true;
-        await target.writeStderrAsync(`${target.rushx ? 'rushx-client' : 'rush-client'}: ${wait}.\n`);
-      } else if (!wait && stderrIsTTY) {
-        await target.writeStderrAsync(`rush-client: waiting for daemon admission (position ${position}).\n`);
+        showedRestartWait = true;
+        // The agent renderer's own status lines repeat the phase.
+        agentRenderer.onRestartWait(line, announce);
+      } else if (announce || (stderrIsTTY && changed)) {
+        await writeRestartWaitAsync(state);
       }
+    },
+    onInputAdmittedAsync: async (): Promise<void> => endRestartWait(),
+    onRequestProgress: endRestartWait,
+    dispose: (): void => {
+      disposed = true;
+      endRestartWait();
     }
   };
 }
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index e50e7f0355..485d03ccad 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -40,7 +40,7 @@ import { readUseRushReporter } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
 import { getTerminalColumns } from './terminalColumns';
-import { createDaemonRequestNoticeHandlers } from './daemonRestartNotice';
+import { createDaemonRequestNoticeHandlers, type IDaemonRequestNoticeHandlers } from './daemonRestartNotice';
 import { formatInProcessFallbackMessage } from './inProcessFallback';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
@@ -186,8 +186,11 @@ export async function launchClientAsync(
     cancellationSignal ??= signal ?? 'SIGINT';
     abort.abort();
   };
+  let notices: IDaemonRequestNoticeHandlers | undefined;
   const onCancelRequested = (timeoutMs: number): void => {
     cancelRequested = true;
+    // A line that the request still waits for a daemon restart would contradict the cancelling line.
+    notices?.dispose();
     if (agentRenderer) {
       agentRenderer.onCancelRequested(timeoutMs);
       return;
@@ -229,28 +232,36 @@ export async function launchClientAsync(
     }
     await renderer.initializeAsync();
     agentRenderer?.onRequestSent();
+    const requestNotices: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
+      rushx,
+      agentRenderer,
+      stderrIsTTY: !!process.stderr.isTTY,
+      daemonPid: (await client.status).pid,
+      writeStderrAsync: (text) => writeStreamAsync(process.stderr, Buffer.from(text))
+    });
+    notices = requestNotices;
     outcome = await executeWithDaemonRestartAsync(client, connection, {
       request,
       abortSignal: abort.signal,
       onStdoutAsync: async (bytes, operationId) => {
+        requestNotices.onRequestProgress();
         if (agentRenderer) return agentRenderer.onLog(bytes, operationId, 'stdout');
         await writeDiscoveryAsync();
         await renderer.writeLogAsync(bytes, operationId, 'stdout');
       },
       onStderrAsync: async (bytes, operationId) => {
+        requestNotices.onRequestProgress();
         if (agentRenderer) return agentRenderer.onLog(bytes, operationId, 'stderr');
         await writeDiscoveryAsync();
         await renderer.writeLogAsync(bytes, operationId, 'stderr');
       },
-      onEventAsync: async (event) =>
-        agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event),
-      ...createDaemonRequestNoticeHandlers({
-        rushx,
-        agentRenderer,
-        stderrIsTTY: !!process.stderr.isTTY,
-        daemonPid: (await client.status).pid,
-        writeStderrAsync: (text) => writeStreamAsync(process.stderr, Buffer.from(text))
-      }),
+      onEventAsync: async (event) => {
+        requestNotices.onRequestProgress();
+        return agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event);
+      },
+      onRestartAsync: requestNotices.onRestartAsync,
+      onQueuePositionAsync: requestNotices.onQueuePositionAsync,
+      onInputAdmittedAsync: requestNotices.onInputAdmittedAsync,
       stdin: process.stdin,
       requiresStdinEnd: !process.stdin.isTTY,
       cancelOnCtrlC: !!process.stdin.isTTY,
@@ -267,6 +278,7 @@ export async function launchClientAsync(
     if (!isCancelled() || !(error instanceof DaemonClientError)) throw error;
     outcome = undefined;
   } finally {
+    notices?.dispose();
     for (const signal of CANCELLATION_SIGNALS) process.removeListener(signal, onSignal);
     try {
       await renderer.closeAsync();
@@ -298,7 +310,7 @@ export async function launchClientAsync(
     // When the agent summary line explains the failure, nothing more is printed.
     const stderr: string | undefined = reportedByAgent
       ? undefined
-      : getResultStderr(outcome.result, request.admission);
+      : getResultStderr(outcome.result, request.admission, rushx ? 'rushx-client' : 'rush-client');
     if (stderr) {
       await writeStreamAsync(process.stderr, Buffer.from(stderr));
     }
diff --git a/apps/rush-cli-client/src/resultDiagnostics.ts b/apps/rush-cli-client/src/resultDiagnostics.ts
index 6657102ad8..9a012c5309 100644
--- a/apps/rush-cli-client/src/resultDiagnostics.ts
+++ b/apps/rush-cli-client/src/resultDiagnostics.ts
@@ -3,7 +3,7 @@
 
 import type { IDaemonCommandResult, IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 
-import { formatAdmissionFailure } from './ClientAdmissionControls';
+import { formatAdmissionFailure, type ClientName } from './ClientAdmissionControls';
 
 /**
  * Returns the stderr line that explains a failed daemon result, if any.
@@ -15,13 +15,14 @@ import { formatAdmissionFailure } from './ClientAdmissionControls';
  * explains.
  */
 export function getResultDiagnostic(
-  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>
+  result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>,
+  clientName: ClientName = 'rush-client'
 ): string | undefined {
   // A request aborted while waiting for admission carries the reason (such as a daemon shutdown) in its
   // error message; other admission failures are explained by `formatAdmissionFailure`.
   if (result.admissionErrorCode !== undefined && result.admissionErrorCode !== 'aborted') return undefined;
   if (result.exitCode !== 0 && result.errorMessage) {
-    return `rush-client: ${result.errorMessage}\n`;
+    return `${clientName}: ${result.errorMessage}\n`;
   }
   return undefined;
 }
@@ -35,9 +36,10 @@ export function getResultDiagnostic(
  */
 export function getResultStderr(
   result: Pick<IDaemonCommandResult, 'admissionErrorCode' | 'errorMessage' | 'exitCode'>,
-  admission: IDaemonRequestAdmissionOptions | undefined
+  admission: IDaemonRequestAdmissionOptions | undefined,
+  clientName: ClientName = 'rush-client'
 ): string | undefined {
-  const diagnostic: string | undefined = getResultDiagnostic(result);
+  const diagnostic: string | undefined = getResultDiagnostic(result, clientName);
   if (diagnostic || !result.admissionErrorCode) return diagnostic;
-  return formatAdmissionFailure(result.admissionErrorCode, admission, result.errorMessage);
+  return formatAdmissionFailure(result.admissionErrorCode, admission, result.errorMessage, clientName);
 }
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 9531de11f5..bd93567469 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1128,6 +1128,49 @@ describe(AgentProgressRenderer.name, () => {
       ]);
     });
 
+    it('writes a restart wait at once when it is announced, and then in place of the queue position (task 166)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const wait = (count: string): string =>
+        `waiting for ${count} to finish; the daemon (PID 41) then restarts, because x changed`;
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 400);
+      renderer.onQueuePosition(1);
+      advance(clock, 600);
+      renderer.onRestartWait(wait('2 running requests'), true);
+      advance(clock, 1000);
+      renderer.onRestartWait(wait('1 running request'), false);
+      advance(clock, 23_999);
+      expect(lines()).toHaveLength(2);
+      advance(clock, 1);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        `rush build · 1.0s · ${wait('2 running requests')}`,
+        `rush build · 26.0s · ${wait('1 running request')}`
+      ]);
+    });
+
+    it('writes no restart wait once the client asked rushd to cancel the request (tasks 166 and 132)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const wait: string =
+        'waiting for 1 running request to finish; the daemon (PID 41) then restarts, because x changed';
+      renderer.start();
+      renderer.onRequestSent();
+      renderer.onRestartWait(wait, true);
+      advance(clock, 2000);
+      renderer.onCancelRequested(5_000);
+      renderer.onRestartWait(`${wait} again`, true);
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        `rush build · 0.0s · ${wait}`,
+        'rush build · 2.0s · cancelling; waiting up to 5s for rushd to stop the request',
+        'rush build · 27.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      ]);
+    });
+
     it('writes a note like any other line, so the next status line is due 25 s after it', () => {
       const { renderer, clock, lines } = createRenderer(false);
       renderer.start();
@@ -1160,6 +1203,20 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('shows a restart wait as the phase of the live rows on a TTY, and writes no line for it', () => {
+    const { renderer, output } = createRenderer(true, 'build', 200);
+    renderer.start();
+    renderer.onRestartWait(
+      'waiting for 1 running request to finish; the daemon (PID 41) then restarts',
+      true
+    );
+    expect(output).toHaveLength(2);
+    expect(output[1].replace(ANSI_ESCAPE, '')).toMatch(
+      /^. rush build · 0\.0s · waiting for 1 running request to finish; the daemon \(PID 41\) then restarts\n/
+    );
+    renderer.dispose();
+  });
+
   it('writes a note above the live rows on a TTY and redraws them below it', () => {
     const { renderer, output } = createRenderer(true);
     renderer.start();
diff --git a/apps/rush-cli-client/src/test/cancellationNotice.test.ts b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
index c48e0c09a2..77b0588ee4 100644
--- a/apps/rush-cli-client/src/test/cancellationNotice.test.ts
+++ b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
@@ -20,6 +20,7 @@ import {
   type DaemonClientOutcome,
   type IDaemonClientExecuteOptions
 } from '@rushstack/rush-client-core';
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 
 import { AgentProgressRenderer } from '../AgentProgressRenderer';
 import * as connectionOptions from '../daemonConnectionOptions';
@@ -153,6 +154,29 @@ describe('the cancellation of a daemon request (task 132)', () => {
     expect(process.exitCode).toBe(130);
   });
 
+  it('writes no restart wait line once it asks rushd to cancel (task 166)', async () => {
+    const lockfile: DaemonRestartReason = {
+      kind: 'workspaceInputsChanged',
+      installationFiles: ['common/config/rush/pnpm-lock.yaml']
+    };
+    const environment: DaemonRestartReason = { kind: 'environmentChanged', variableNames: ['FOO'] };
+    execute(async (options) => {
+      await options.onQueuePositionAsync!(1, lockfile, { scriptCount: 1 });
+      deliverSignal('SIGINT');
+      requestCancel(options);
+      // A new cause would get a line at once on a pipe.
+      await options.onQueuePositionAsync!(1, environment, { scriptCount: 1 });
+      return aborted(options);
+    });
+    await launchClientAsync(false);
+    expect(stderr).toEqual([
+      `rush-client: waiting for 1 running rushx script to finish; the daemon (PID ${process.pid}) then restarts, ` +
+        'because common/config/rush/pnpm-lock.yaml changed.\n',
+      CANCELLING,
+      CANCELLED
+    ]);
+  });
+
   it('says so when rushd does not confirm the stop before the cancellation deadline', async () => {
     execute(async (options) => {
       deliverSignal('SIGTERM');
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index 4ca8860fe3..09732dc527 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -1,9 +1,11 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
 import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 
 import {
+  RESTART_WAIT_REPEAT_MS,
   RESUBMITTED_PHASE,
   createDaemonRequestNoticeHandlers,
   createDaemonRestartNoticeHandler,
@@ -125,26 +127,120 @@ const REMOVED: DaemonRestartReason = {
   change: 'removed',
   folder: '/snapshots/s9'
 };
+const LOCKFILE: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const PLUGIN_CODE: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  implementationFiles: ['common/autoinstallers/p/node_modules/q/lib/x.js']
+};
+const ANOTHER: IDaemonRestartWaitDetails = { restartsForAnotherRequest: true };
+
+// One case for each reason that a daemon gives for a restart, and how a waiting request and a waiting rushx script
+// word it.
+const REASONS: [string, DaemonRestartReason, string, string][] = [
+  [
+    'a removed installation',
+    REMOVED,
+    'because its installation at /snapshots/s9 was removed',
+    "because the daemon's installation at /snapshots/s9 was removed"
+  ],
+  [
+    'an environment',
+    { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS', 'RUSH_X'] },
+    "because this request's environment differs from the daemon's in NODE_OPTIONS and RUSH_X",
+    "because its environment differs from the daemon's in NODE_OPTIONS and RUSH_X"
+  ],
+  [
+    'a lockfile',
+    LOCKFILE,
+    'because common/config/rush/pnpm-lock.yaml changed',
+    'because common/config/rush/pnpm-lock.yaml changed'
+  ],
+  [
+    'plugin code',
+    PLUGIN_CODE,
+    'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/node_modules/q/lib/x.js)',
+    'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/node_modules/q/lib/x.js)'
+  ],
+  [
+    'a Rush version',
+    { kind: 'workspaceInputsChanged', selectedRushVersion: '5.180.0' },
+    'because this request selects Rush 5.180.0',
+    'because it selects Rush 5.180.0'
+  ]
+];
 
 describe(formatDaemonRestartWait.name, () => {
-  it('says what the request waits for, and why the daemon then restarts', () => {
-    expect(formatDaemonRestartWait(2, REMOVED, 41)).toBe(
-      'waiting for the running requests to finish (position 2); the daemon (PID 41) then restarts, because ' +
-        'its installation at /snapshots/s9 was removed'
+  it.each(REASONS)('says why the daemon restarts for %s', (name, reason, cause, anotherCause) => {
+    expect(formatDaemonRestartWait({ position: 1, reason, details: {}, daemonPid: 41 })).toBe(
+      `waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${cause}`
     );
-    expect(formatDaemonRestartWait(1, { ...REMOVED, change: 'replaced' }, undefined)).toBe(
-      'waiting for the running requests to finish (position 1); the daemon then restarts, because its ' +
-        'installation at /snapshots/s9 was replaced'
+    expect(formatDaemonRestartWait({ position: 2, reason, details: ANOTHER, daemonPid: 41 })).toBe(
+      `waiting for the daemon (PID 41) to restart for another request (2 requests ahead), ${anotherCause}`
     );
   });
 
-  it('says nothing about plain queue positions or reasons that it does not know', () => {
-    expect(formatDaemonRestartWait(1, undefined, 41)).toBeUndefined();
-    expect(formatDaemonRestartWait(1, NEWER_REASON, 41)).toBeUndefined();
+  it('says how many of the requests that it waits for run a rushx script', () => {
+    const format = (position: number, details: IDaemonRestartWaitDetails): string =>
+      formatDaemonRestartWait({ position, reason: LOCKFILE, details, daemonPid: undefined });
+    expect(format(3, { scriptCount: 1 })).toBe(
+      'waiting for 3 running requests to finish, including 1 rushx script; the daemon then restarts, because ' +
+        'common/config/rush/pnpm-lock.yaml changed'
+    );
+    expect(format(3, { scriptCount: 2 })).toMatch(
+      /^waiting for 3 running requests to finish, including 2 rushx scripts;/
+    );
+    expect(format(1, { scriptCount: 1 })).toMatch(
+      /^waiting for 1 running rushx script to finish; the daemon then/
+    );
+    expect(format(2, { scriptCount: 2 })).toMatch(/^waiting for 2 running rushx scripts to finish;/);
+    expect(format(2, { scriptCount: 0 })).toMatch(/^waiting for 2 running requests to finish;/);
+    expect(format(1, { ...ANOTHER, scriptCount: 0 })).toMatch(
+      /restart for another request \(1 request ahead\), /
+    );
+    expect(format(3, { ...ANOTHER, scriptCount: 1 })).toMatch(
+      /^waiting for the daemon to restart for another request \(3 requests ahead, including 1 rushx script\), /
+    );
+  });
+
+  it('says how long the request has waited, from a second on', () => {
+    const format = (elapsedMs: number, details: IDaemonRestartWaitDetails): string =>
+      formatDaemonRestartWait({ position: 1, reason: LOCKFILE, details, daemonPid: 41, elapsedMs });
+    expect(format(999, {})).toMatch(/^waiting for 1 running request/);
+    expect(format(25_400, {})).toMatch(
+      /^still waiting after 25s for 1 running request to finish; the daemon/
+    );
+    expect(format(50_000, ANOTHER)).toMatch(
+      /^still waiting after 50s for the daemon \(PID 41\) to restart for/
+    );
+  });
+
+  it('leaves out a cause that it cannot word', () => {
+    expect(formatDaemonRestartWait({ position: 2, reason: NEWER_REASON, details: {}, daemonPid: 41 })).toBe(
+      'waiting for 2 running requests to finish; the daemon (PID 41) then restarts'
+    );
+    expect(
+      formatDaemonRestartWait({ position: 2, reason: NEWER_REASON, details: ANOTHER, daemonPid: 41 })
+    ).toBe('waiting for the daemon (PID 41) to restart for another request (2 requests ahead)');
   });
 });
 
 describe(createDaemonRequestNoticeHandlers.name, () => {
+  let clock: number;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    clock = 0;
+  });
+  afterEach(() => jest.useRealTimers());
+
+  function advance(ms: number): void {
+    clock += ms;
+    jest.advanceTimersByTime(ms);
+  }
+
   function createHandlers(options: { agent: boolean; stderrIsTTY: boolean; rushx?: boolean }): {
     calls: string[];
     handlers: IDaemonRequestNoticeHandlers;
@@ -154,11 +250,14 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       rushx: !!options.rushx,
       stderrIsTTY: options.stderrIsTTY,
       daemonPid: 41,
+      now: () => clock,
       agentRenderer: options.agent
         ? {
             note: (line: string) => calls.push(`note: ${line}`),
             setPhase: (phase: string) => calls.push(`phase: ${phase}`),
-            onQueuePosition: (position: number) => calls.push(`position: ${position}`)
+            onQueuePosition: (position: number) => calls.push(`position: ${position}`),
+            onRestartWait: (wait: string, announce: boolean) =>
+              calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`)
           }
         : undefined,
       writeStderrAsync: async (text: string) => {
@@ -168,18 +267,158 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     return { calls, handlers };
   }
 
-  it('shows a restart wait as the agent phase, and names the new daemon after the restart', async () => {
+  const LOCKFILE_WAIT: string =
+    'the daemon (PID 41) then restarts, because common/config/rush/pnpm-lock.yaml changed';
+
+  describe.each([
+    ['rush-client', false],
+    ['rushx-client', true]
+  ])('%s without an agent renderer', (client: string, rushx: boolean) => {
+    it.each(REASONS)(
+      'writes the first line of a wait for %s at once, on a pipe and a terminal',
+      async (name, reason, cause) => {
+        for (const stderrIsTTY of [false, true]) {
+          const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+          await handlers.onQueuePositionAsync(1, reason, { scriptCount: 0 });
+          handlers.dispose();
+          expect(calls).toEqual([
+            `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${cause}.\n`
+          ]);
+        }
+      }
+    );
+
+    it('repeats the line with the time waited when 25 s pass without one, until the restart', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      advance(3000);
+      await handlers.onQueuePositionAsync(2, LOCKFILE, { scriptCount: 1 });
+      advance(10_000);
+      // On a pipe, a new count waits for the next line.
+      await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+      advance(RESTART_WAIT_REPEAT_MS - 10_001);
+      expect(calls).toHaveLength(1);
+      advance(1);
+      advance(RESTART_WAIT_REPEAT_MS);
+      await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: 42 });
+      advance(RESTART_WAIT_REPEAT_MS * 4);
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for 2 running requests to finish, including 1 rushx script; ${LOCKFILE_WAIT}.\n`,
+        `stderr: ${client}: still waiting after 25s for 1 running request to finish; ${LOCKFILE_WAIT}.\n`,
+        `stderr: ${client}: still waiting after 50s for 1 running request to finish; ${LOCKFILE_WAIT}.\n`
+      ]);
+    });
+
+    it('writes a line on a pipe at once when the cause changes, and every change on a terminal', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        advance(500);
+        await handlers.onQueuePositionAsync(2, LOCKFILE, ANOTHER);
+        await handlers.onQueuePositionAsync(2, LOCKFILE, ANOTHER);
+        advance(1500);
+        // Another cause of the same kind.
+        await handlers.onQueuePositionAsync(2, PLUGIN_CODE, ANOTHER);
+        advance(1000);
+        await handlers.onQueuePositionAsync(2, REMOVED, ANOTHER);
+        handlers.dispose();
+        const another: string = 'for the daemon (PID 41) to restart for another request';
+        const lockfile: string = 'because common/config/rush/pnpm-lock.yaml changed';
+        expect(calls).toEqual([
+          `stderr: ${client}: waiting ${another} (1 request ahead), ${lockfile}.\n`,
+          ...(stderrIsTTY
+            ? [`stderr: ${client}: waiting ${another} (2 requests ahead), ${lockfile}.\n`]
+            : []),
+          `stderr: ${client}: still waiting after 2s ${another} (2 requests ahead), because the code of Rush or a ` +
+            'Rush plugin changed (common/autoinstallers/p/node_modules/q/lib/x.js).\n',
+          `stderr: ${client}: still waiting after 3s ${another} (2 requests ahead), because the daemon's ` +
+            'installation at /snapshots/s9 was removed.\n'
+        ]);
+      }
+    });
+
+    it('writes a line on a pipe when whose restart the request waits for changes, even for the same cause', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+      await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+      handlers.dispose();
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for 1 running request to finish; ${LOCKFILE_WAIT}.\n`,
+        `stderr: ${client}: waiting for the daemon (PID 41) to restart for another request (1 request ahead), ` +
+          'because common/config/rush/pnpm-lock.yaml changed.\n'
+      ]);
+    });
+
+    it('stops when the request gets input, output or an event, or waits for plain admission', async () => {
+      const stops: [string, (handlers: IDaemonRequestNoticeHandlers) => Promise<void> | void][] = [
+        ['input', (handlers) => handlers.onInputAdmittedAsync()],
+        ['progress', (handlers) => handlers.onRequestProgress()],
+        ['plain position', (handlers) => handlers.onQueuePositionAsync(1)]
+      ];
+      for (const [, stop] of stops) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        await stop(handlers);
+        advance(RESTART_WAIT_REPEAT_MS * 3);
+        expect(calls).toHaveLength(1);
+        // A later wait is a new one.
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        handlers.dispose();
+        expect(calls).toHaveLength(2);
+        expect(calls[1]).toBe(calls[0]);
+      }
+    });
+
+    it('writes nothing more once the request ends or the client asks rushd to cancel it', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, ANOTHER);
+        handlers.dispose();
+        advance(RESTART_WAIT_REPEAT_MS * 3);
+        await handlers.onQueuePositionAsync(1, REMOVED, ANOTHER);
+        await handlers.onQueuePositionAsync(2);
+        expect(calls).toHaveLength(1);
+      }
+    });
+
+    it('names the new daemon after a restart, and writes plain positions only to a terminal', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(3);
+        await handlers.onQueuePositionAsync(1, REMOVED, {});
+        await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+        handlers.dispose();
+        expect(calls).toEqual([
+          ...(stderrIsTTY ? [`stderr: ${client}: waiting for daemon admission (position 3).\n`] : []),
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, because ` +
+            'its installation at /snapshots/s9 was removed.\n',
+          `stderr: ${client}: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).\n`,
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 42) then restarts, because ` +
+            'common/config/rush/pnpm-lock.yaml changed.\n'
+        ]);
+      }
+    });
+  });
+
+  it('shows a restart wait as the agent phase, announces each cause, and names the new daemon after the restart', async () => {
     const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
     await handlers.onQueuePositionAsync(2);
-    await handlers.onQueuePositionAsync(1, REMOVED);
+    await handlers.onQueuePositionAsync(2, LOCKFILE, { scriptCount: 1 });
+    await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+    advance(RESTART_WAIT_REPEAT_MS * 2);
+    await handlers.onQueuePositionAsync(1, REMOVED, {});
     await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
-    await handlers.onQueuePositionAsync(1, REMOVED);
+    await handlers.onQueuePositionAsync(1, REMOVED, {});
+    handlers.dispose();
+    const removed: string = 'because its installation at /snapshots/s9 was removed';
     expect(calls).toEqual([
       'position: 2',
-      `phase: ${formatDaemonRestartWait(1, REMOVED, 41)}`,
+      `announce: waiting for 2 running requests to finish, including 1 rushx script; ${LOCKFILE_WAIT}`,
+      `wait: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`,
+      `announce: waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${removed}`,
       "note: rush-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).",
       `phase: ${RESUBMITTED_PHASE}`,
-      `phase: ${formatDaemonRestartWait(1, REMOVED, 42)}`
+      `announce: waiting for 1 running request to finish; the daemon (PID 42) then restarts, ${removed}`
     ]);
   });
 
@@ -190,28 +429,12 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     expect(calls).toEqual(['position: 1']);
   });
 
-  it('writes every queue position to a terminal', async () => {
-    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
+  it('gives the agent renderer no more positions once the request ends or the client asks rushd to cancel it', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+    handlers.dispose();
+    await handlers.onQueuePositionAsync(1, REMOVED, {});
     await handlers.onQueuePositionAsync(2);
-    await handlers.onQueuePositionAsync(2, REMOVED);
-    await handlers.onQueuePositionAsync(1, REMOVED);
-    expect(calls).toEqual([
-      'stderr: rush-client: waiting for daemon admission (position 2).\n',
-      `stderr: rush-client: ${formatDaemonRestartWait(2, REMOVED, 41)}.\n`,
-      `stderr: rush-client: ${formatDaemonRestartWait(1, REMOVED, 41)}.\n`
-    ]);
-  });
-
-  it('writes only the first restart wait for each daemon to a pipe', async () => {
-    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx: true });
-    await handlers.onQueuePositionAsync(3);
-    await handlers.onQueuePositionAsync(2, REMOVED);
-    await handlers.onQueuePositionAsync(1, REMOVED);
-    await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: 42 });
-    await handlers.onQueuePositionAsync(1, REMOVED);
-    expect(calls).toEqual([
-      `stderr: rushx-client: ${formatDaemonRestartWait(2, REMOVED, 41)}.\n`,
-      `stderr: rushx-client: ${formatDaemonRestartWait(1, REMOVED, 42)}.\n`
-    ]);
+    expect(calls).toEqual([`announce: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`]);
   });
 });
diff --git a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
index f64b6e2f72..95ec573665 100644
--- a/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
+++ b/apps/rush-cli-client/src/test/resultDiagnostics.test.ts
@@ -63,4 +63,27 @@ describe(getResultStderr.name, () => {
     ).toBe('rush-client: daemon shut down\n');
     expect(getResultStderr({ exitCode: 0 }, undefined)).toBeUndefined();
   });
+
+  it('begins with rushx-client for a rushx script (task 166)', () => {
+    const reason: string =
+      'The rushx script was not admitted before the daemon could restart for another request, because ' +
+      'common/config/rush/pnpm-lock.yaml changed. Use --wait-timeout <seconds> to wait longer.';
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'wait-timeout', errorMessage: reason },
+        { waitTimeoutMs: 5000 },
+        'rushx-client'
+      )
+    ).toBe(`rushx-client: daemon admission failed (wait-timeout): ${reason}\n`);
+    expect(
+      getResultStderr({ exitCode: 1, admissionErrorCode: 'no-wait' }, { noWait: true }, 'rushx-client')
+    ).toMatch(/^rushx-client: daemon admission failed \(no-wait\): another daemon request/);
+    expect(
+      getResultStderr(
+        { exitCode: 1, admissionErrorCode: 'aborted', errorMessage: 'daemon shut down' },
+        undefined,
+        'rushx-client'
+      )
+    ).toBe('rushx-client: daemon shut down\n');
+  });
 });
diff --git a/common/changes/@microsoft/rush/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json b/common/changes/@microsoft/rush/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
new file mode 100644
index 0000000000..3034a4de88
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "WorkspaceRuntimeFingerprintCache.changedInstallationPaths names the installation files, such as lockfiles, whose content or existence differs from the first capture, as changedPaths does for the files of Rush and its plugins.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json b/common/changes/@rushstack/rush-cli-client/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
new file mode 100644
index 0000000000..27facc6dbb
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "A command that waits for a daemon restart now says what it waits for and why the daemon restarts, for every reason and on a pipe too, and repeats the line with the time waited every 25 seconds. A rushx script that waits for another request's restart says so, and the lines and admission failures of rushx-client begin with \"rushx-client:\". Once the command asks rushd to cancel the request, it no longer writes that the request waits.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json b/common/changes/@rushstack/rush-client-core/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
new file mode 100644
index 0000000000..9b4efb8d2a
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "formatDaemonRestartCause says why the daemon restarts for each restart reason kind, for the waiting request or for a rushx script that waits for another request's restart. onQueuePositionAsync also gets the restart wait details (scriptCount, restartsForAnotherRequest), and onInputAdmittedAsync reports when the daemon first admits a request's input, which for a rushx script is when the script starts.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
new file mode 100644
index 0000000000..028bdb3874
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "A queue position that waits for a daemon restart can say how many of the requests that it counts run a rushx script (scriptCount), and whether a rushx script waits for another request's restart (restartsForAnotherRequest). The new workspaceInputsChanged restart reason names the installation files or the files of Rush and its plugins that changed since the daemon started, or the Rush version that the request selects.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json b/common/changes/@rushstack/rush-daemon/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
new file mode 100644
index 0000000000..3a54cef4d1
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-t166-restart-wait-reasons_2026-09-29-02-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A request that waits for a daemon restart, and a rushx script that waits for another request's restart, now say why in their queue positions and admission errors: the environment variables that differ, the installation files or the files of Rush and its plugins that changed, or the Rush version that the request selects. The queue positions also say how many of the requests that they count run a rushx script.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 0b57acf773..73420c612c 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -64,6 +64,9 @@ export type DaemonClientOutcome = {
     readonly rejection: IDaemonRequestRejectedMessage['payload'];
 };
 
+// @beta
+export type DaemonRestartRequester = 'thisRequest' | 'anotherRequest';
+
 // @beta
 export type DaemonStartupHelperState = 'running' | 'exited' | 'unknown';
 
@@ -75,6 +78,9 @@ export class DaemonStartupPendingError extends Error {
 // @beta
 export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, options: IExecuteWithDaemonRestartOptions): Promise<DaemonClientOutcome>;
 
+// @beta
+export function formatDaemonRestartCause(reason: DaemonRestartReason, requester: DaemonRestartRequester): string | undefined;
+
 // @beta
 export function getDaemonLogFilePath(paths: IDaemonPaths): string;
 
@@ -134,7 +140,8 @@ export interface IDaemonClientExecuteOptions {
     readonly onCancelRequested?: (timeoutMs: number) => void;
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
-    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
+    readonly onInputAdmittedAsync?: () => Promise<void>;
+    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails) => Promise<void>;
     // (undocumented)
     readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
     // (undocumented)
@@ -154,6 +161,12 @@ export interface IDaemonRestartNotice {
     readonly successorPid: number | undefined;
 }
 
+// @beta
+export interface IDaemonRestartWaitDetails {
+    readonly restartsForAnotherRequest?: boolean;
+    readonly scriptCount?: number;
+}
+
 // @beta
 export interface IDaemonStartCommand {
     // (undocumented)
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index ecca06700b..8869716e27 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -170,7 +170,7 @@ export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-time
 export type DaemonRequestRejectionCode = 'invalidRequest' | 'routingFailed' | 'unsupported' | 'workspaceRecreationRequired';
 
 // @beta
-export type DaemonRestartReason = IDaemonInstallationChangedRestartReason | IDaemonEnvironmentChangedRestartReason;
+export type DaemonRestartReason = IDaemonInstallationChangedRestartReason | IDaemonEnvironmentChangedRestartReason | IDaemonWorkspaceInputsChangedRestartReason;
 
 // @beta
 export type DaemonRushCommandOrigin = 'built-in' | 'custom';
@@ -572,6 +572,8 @@ export interface IDaemonRequestQueuePositionMessage {
         readonly position: number;
         readonly requestId: string;
         readonly restartReason?: DaemonRestartReason;
+        readonly scriptCount?: number;
+        readonly restartsForAnotherRequest?: boolean;
     };
 }
 
@@ -761,6 +763,14 @@ export interface IDaemonWarmSetStatus {
     readonly watchedProjectNames: ReadonlyArray<string>;
 }
 
+// @beta
+export interface IDaemonWorkspaceInputsChangedRestartReason {
+    readonly implementationFiles?: ReadonlyArray<string>;
+    readonly installationFiles?: ReadonlyArray<string>;
+    readonly kind: 'workspaceInputsChanged';
+    readonly selectedRushVersion?: string;
+}
+
 // @beta
 export interface IDaemonWorkspaceStatus {
     // (undocumented)
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 3555800b90..675d2b98ba 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -2202,9 +2202,12 @@ export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string>;
 
 // @alpha
 export class WorkspaceRuntimeFingerprintCache {
+    get changedInstallationPaths(): ReadonlyArray<string>;
     get changedPaths(): ReadonlyArray<string>;
     // @internal
     _hashInputFilesAsync(filenames: Iterable<string>): Promise<string>;
+    // @internal
+    _hashInstallationFilesAsync(filenames: Iterable<string>): Promise<string>;
     // @internal (undocumented)
     _hashPaths(paths: ReadonlyArray<string>): string;
 }
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 57ae16f689..ae677fd118 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -50,10 +50,15 @@ A result may say why the daemon restarts (`restartReason`); for `installationCha
 the daemon's installation was removed or replaced, so it exits without a successor and
 the client's own `startCommand` starts one. Such a daemon answers only once the requests
 ahead of the request finish; meanwhile `onQueuePositionAsync` gets the reason as its second
-argument. After each hand-off to a ready successor,
-the optional `onRestartAsync` callback gets the restart number, the reason (`undefined`
-when the daemon gave none, as older daemons do) and the successor's PID, before the
-request is resubmitted.
+argument. It does so for each request that waits for a restart, with the wait's details as its
+third argument: `scriptCount`, how many of the requests ahead run a rushx script, and
+`restartsForAnotherRequest`, set for a rushx script that waits for another request's restart.
+`formatDaemonRestartCause` words a reason as the end of "the daemon restarts ...", for the
+request or for such a script, and `onInputAdmittedAsync` reports when the daemon first admits
+the request's input, which for a rushx script is when the script starts. After each hand-off
+to a ready successor, the optional `onRestartAsync` callback gets the restart number, the
+reason (`undefined` when the daemon gave none, as older daemons do) and the successor's PID,
+before the request is resubmitted.
 
 A connection lost before the result stays a `disconnected` `DaemonClientError`. Its message
 starts with "Daemon disconnected before delivering a result; the command was not retried."
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index ec2c66af68..b79995055f 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -45,6 +45,19 @@ export interface IDaemonClientConnectOptions {
   readonly timeoutMs?: number;
 }
 
+/**
+ * What a request that waits for a daemon restart waits for, as its queue position reports it. Older daemons omit
+ * these fields.
+ *
+ * @beta
+ */
+export interface IDaemonRestartWaitDetails {
+  /** How many of the requests that the queue position counts run a rushx script. */
+  readonly scriptCount?: number;
+  /** The request, a rushx script, waits for another request's restart rather than its own. */
+  readonly restartsForAnotherRequest?: boolean;
+}
+
 /** One request's backpressured destinations. Callback order is wire order. @beta */
 export interface IDaemonClientExecuteOptions {
   readonly request: IDaemonRequestEnvelope;
@@ -52,10 +65,19 @@ export interface IDaemonClientExecuteOptions {
   readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
   readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
   /**
-   * Called with the request's one-based queue position whenever it changes. `restartReason` is set when the daemon
-   * answers the request with a restart result for that reason once the requests ahead of it finish.
+   * Called with the request's one-based queue position whenever it changes. `restartReason` is set while the request
+   * waits for a daemon restart for that reason, and `restartWait` then says more about the wait.
    */
-  readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason) => Promise<void>;
+  readonly onQueuePositionAsync?: (
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails
+  ) => Promise<void>;
+  /**
+   * Called once, when the daemon first admits the request's input. For a rushx script, that is when the script
+   * starts. Only daemons that negotiate the input lifecycle admit input.
+   */
+  readonly onInputAdmittedAsync?: () => Promise<void>;
   readonly abortSignal?: AbortSignal;
   /** Protocol 0.7 input waits for stdinReady credits; older peers use the legacy raw-mode/terminal policy. */
   readonly stdin?: Readable;
@@ -447,6 +469,7 @@ export class DaemonClient {
         if (!this.#inputAdmitted) {
           this.#inputAdmitted = true;
           this.#startInput();
+          await execution.onInputAdmittedAsync?.();
         } else if (this.#inputAcknowledgement) {
           const acknowledgement: IDeferred<void> = this.#inputAcknowledgement;
           this.#inputAcknowledgement = undefined;
@@ -455,9 +478,14 @@ export class DaemonClient {
           throw new DaemonProtocolError('malformedControlMessage', 'Unexpected stdin write acknowledgement.');
         }
         return;
-      case 'queuePosition':
-        await execution.onQueuePositionAsync?.(message.payload.position, message.payload.restartReason);
+      case 'queuePosition': {
+        const { position, restartReason, scriptCount, restartsForAnotherRequest } = message.payload;
+        await execution.onQueuePositionAsync?.(position, restartReason, {
+          scriptCount,
+          restartsForAnotherRequest
+        });
         return;
+      }
       default:
         throw new DaemonProtocolError(
           'malformedControlMessage',
diff --git a/libraries/rush-client-core/src/DaemonRestartCause.ts b/libraries/rush-client-core/src/DaemonRestartCause.ts
new file mode 100644
index 0000000000..6b248c8500
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonRestartCause.ts
@@ -0,0 +1,79 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  DaemonRestartReason,
+  IDaemonWorkspaceInputsChangedRestartReason
+} from '@rushstack/rush-daemon-protocol';
+
+/** A list names at most this many items, then says how many more there are. */
+const MAX_LISTED_NAMES: number = 4;
+
+/**
+ * Which request needs the restart that a cause explains: the request that waits for it, or another request that a
+ * rushx script waits for, so that the restart does not wait for the script.
+ *
+ * @beta
+ */
+export type DaemonRestartRequester = 'thisRequest' | 'anotherRequest';
+
+/**
+ * Says why the daemon restarts, completing "the daemon restarts <cause>", for example
+ * `because common/config/rush/pnpm-lock.yaml changed`. Names environment variables, never their values.
+ *
+ * @returns `undefined` for a reason kind that this version does not know.
+ * @beta
+ */
+export function formatDaemonRestartCause(
+  reason: DaemonRestartReason,
+  requester: DaemonRestartRequester
+): string | undefined {
+  const anotherRequest: boolean = requester === 'anotherRequest';
+  switch (reason.kind) {
+    case 'installationChanged':
+      return (
+        `because ${anotherRequest ? "the daemon's" : 'its'} installation at ${reason.folder} was ` +
+        `${reason.change}`
+      );
+    case 'environmentChanged': {
+      const names: string = reason.variableNames.length ? ` in ${formatList(reason.variableNames)}` : '';
+      return `because ${anotherRequest ? 'its' : "this request's"} environment differs from the daemon's${names}`;
+    }
+    case 'workspaceInputsChanged':
+      return `because ${formatList(getWorkspaceInputClauses(reason, anotherRequest), Infinity)}`;
+    default:
+      return undefined;
+  }
+}
+
+function getWorkspaceInputClauses(
+  reason: IDaemonWorkspaceInputsChangedRestartReason,
+  anotherRequest: boolean
+): string[] {
+  const { installationFiles, implementationFiles, selectedRushVersion } = reason;
+  const clauses: string[] = [];
+  if (installationFiles) {
+    clauses.push(
+      installationFiles.length
+        ? `${formatList(installationFiles)} changed`
+        : "the workspace's installation changed"
+    );
+  }
+  if (implementationFiles) {
+    const files: string = implementationFiles.length ? ` (${formatList(implementationFiles)})` : '';
+    clauses.push(`the code of Rush or a Rush plugin changed${files}`);
+  }
+  if (selectedRushVersion !== undefined) {
+    clauses.push(`${anotherRequest ? 'it' : 'this request'} selects Rush ${selectedRushVersion}`);
+  }
+  if (!clauses.length) clauses.push('the inputs that the daemon started with changed');
+  return clauses;
+}
+
+/** Joins items as "a", "a and b" or "a, b and c", naming at most `maxListed` of them. */
+function formatList(items: ReadonlyArray<string>, maxListed: number = MAX_LISTED_NAMES): string {
+  const listed: string[] = items.slice(0, maxListed);
+  const more: number = items.length - listed.length;
+  if (more > 0) listed.push(`${more} more`);
+  return listed.length > 1 ? `${listed.slice(0, -1).join(', ')} and ${listed[listed.length - 1]}` : listed[0];
+}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index b6234ca642..fc7fff117e 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -11,8 +11,10 @@ export {
   DaemonClient,
   type DaemonClientOutcome,
   type IDaemonClientConnectOptions,
-  type IDaemonClientExecuteOptions
+  type IDaemonClientExecuteOptions,
+  type IDaemonRestartWaitDetails
 } from './DaemonClient';
+export { formatDaemonRestartCause, type DaemonRestartRequester } from './DaemonRestartCause';
 export { DaemonClientError, type DaemonClientErrorCode } from './DaemonClientError';
 export { getDaemonLogFilePath } from './DaemonLogFile';
 export {
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index a9b8ea38ec..fa4c521fa4 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -369,10 +369,22 @@ describe('DaemonClient', () => {
       change: 'removed',
       folder: '/snapshots/s9'
     } as const;
+    const inputsReason = {
+      kind: 'workspaceInputsChanged',
+      installationFiles: ['common/config/rush/pnpm-lock.yaml']
+    } as const;
     onRequest = async (message) => {
       if (message.kind !== 'requestStart') return;
       const { requestId } = message.payload;
       await sendAsync({ kind: 'queuePosition', payload: { position: 2, requestId } });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 2, requestId, restartReason: inputsReason, scriptCount: 1 }
+      });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, restartReason: inputsReason, restartsForAnotherRequest: true }
+      });
       await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId, restartReason } });
       await sendAsync({
         kind: 'requestResult',
@@ -390,17 +402,54 @@ describe('DaemonClient', () => {
     const client = await DaemonClient.connectAsync({ socketPath: address });
     const outcome = await client.executeAsync({
       request: request(),
-      onQueuePositionAsync: async (position, reason) => {
-        positions.push([position, reason]);
+      onQueuePositionAsync: async (position, reason, wait) => {
+        positions.push([position, reason, wait]);
       }
     });
     expect(positions).toEqual([
-      [2, undefined],
-      [1, restartReason]
+      [2, undefined, {}],
+      [2, inputsReason, { scriptCount: 1 }],
+      [1, inputsReason, { restartsForAnotherRequest: true }],
+      [1, restartReason, {}]
     ]);
     expect(outcome).toMatchObject({ kind: 'result', result: { retryAfterRestart: true, restartReason } });
   });
 
+  it('reports once, before any input is forwarded, that the daemon admitted input', async () => {
+    const stdin = new PassThrough();
+    const seen: string[] = [];
+    const envelope = { ...request(), terminal: { ...request().terminal, acceptsStdin: true } };
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId: envelope.requestId } });
+      await sendAsync({ kind: 'stdinReady', payload: { requestId: envelope.requestId } });
+    };
+    onStdin = async (bytes) => {
+      seen.push(`stdin ${Buffer.from(bytes)}`);
+      if (seen.filter((entry) => entry.startsWith('stdin')).length < 2) return;
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId: envelope.requestId, exitCode: 0, aborted: false, outcome: 'success' }
+      });
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    const execution = client.executeAsync({
+      request: envelope,
+      stdin,
+      onQueuePositionAsync: async () => {
+        seen.push('queued');
+      },
+      onInputAdmittedAsync: async () => {
+        seen.push('admitted');
+        // Written only after admission, so the second chunk needs the first chunk's acknowledgement.
+        stdin.write('a');
+        setTimeout(() => stdin.write('b'), 10);
+      }
+    });
+    await execution;
+    expect(seen).toEqual(['queued', 'admitted', 'stdin a', 'stdin b']);
+  });
+
   it('forwards raw stdin only after acknowledgement and restores raw mode', async () => {
     const stdin = new PassThrough();
     const rawModes: boolean[] = [];
diff --git a/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts b/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
new file mode 100644
index 0000000000..e2a1e46be3
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
@@ -0,0 +1,89 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
+import { formatDaemonRestartCause } from '../DaemonRestartCause';
+
+describe(formatDaemonRestartCause.name, () => {
+  it.each<[DaemonRestartReason, string, string]>([
+    [
+      { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+      'because its installation at /snapshots/s9 was removed',
+      "because the daemon's installation at /snapshots/s9 was removed"
+    ],
+    [
+      { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS'] },
+      "because this request's environment differs from the daemon's in NODE_OPTIONS",
+      "because its environment differs from the daemon's in NODE_OPTIONS"
+    ],
+    [
+      { kind: 'environmentChanged', variableNames: [] },
+      "because this request's environment differs from the daemon's",
+      "because its environment differs from the daemon's"
+    ],
+    [
+      { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/pnpm-lock.yaml'] },
+      'because common/config/rush/pnpm-lock.yaml changed',
+      'because common/config/rush/pnpm-lock.yaml changed'
+    ],
+    [
+      { kind: 'workspaceInputsChanged', installationFiles: [] },
+      "because the workspace's installation changed",
+      "because the workspace's installation changed"
+    ],
+    [
+      { kind: 'workspaceInputsChanged', implementationFiles: ['common/autoinstallers/p/lib/index.js'] },
+      'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/lib/index.js)',
+      'because the code of Rush or a Rush plugin changed (common/autoinstallers/p/lib/index.js)'
+    ],
+    [
+      { kind: 'workspaceInputsChanged', implementationFiles: [] },
+      'because the code of Rush or a Rush plugin changed',
+      'because the code of Rush or a Rush plugin changed'
+    ],
+    [
+      { kind: 'workspaceInputsChanged', selectedRushVersion: '5.180.0' },
+      'because this request selects Rush 5.180.0',
+      'because it selects Rush 5.180.0'
+    ],
+    [
+      { kind: 'workspaceInputsChanged' },
+      'because the inputs that the daemon started with changed',
+      'because the inputs that the daemon started with changed'
+    ]
+  ])('explains %j', (reason, forThisRequest, forAnotherRequest) => {
+    expect(formatDaemonRestartCause(reason, 'thisRequest')).toBe(forThisRequest);
+    expect(formatDaemonRestartCause(reason, 'anotherRequest')).toBe(forAnotherRequest);
+  });
+
+  it('joins every changed input, and lists at most four names of each', () => {
+    expect(
+      formatDaemonRestartCause(
+        {
+          kind: 'workspaceInputsChanged',
+          installationFiles: ['a', 'b'],
+          implementationFiles: ['c'],
+          selectedRushVersion: '5.180.0'
+        },
+        'thisRequest'
+      )
+    ).toBe(
+      'because a and b changed, the code of Rush or a Rush plugin changed (c) and this request selects Rush 5.180.0'
+    );
+    expect(
+      formatDaemonRestartCause(
+        { kind: 'environmentChanged', variableNames: ['A', 'B', 'C', 'D', 'E', 'F'] },
+        'thisRequest'
+      )
+    ).toBe("because this request's environment differs from the daemon's in A, B, C, D and 2 more");
+    expect(
+      formatDaemonRestartCause({ kind: 'environmentChanged', variableNames: ['A', 'B', 'C'] }, 'thisRequest')
+    ).toBe("because this request's environment differs from the daemon's in A, B and C");
+  });
+
+  it('does not explain a reason kind that it does not know', () => {
+    const reason: unknown = { kind: 'futureInputsChanged' };
+    expect(formatDaemonRestartCause(reason as DaemonRestartReason, 'thisRequest')).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index d4d5f8e435..66f554ecbe 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -26,8 +26,12 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   acknowledged raw-mode controls and typed terminal-policy results remain scoped to one request.
 - **Request admission contracts** — resolved no-wait and bounded-timeout options, typed admission
   failure codes, and capability-gated one-based queue-position control messages. A queue position
-  may carry the `restartReason` with which the daemon answers the request once the requests ahead
-  of it finish; older daemons omit it, and clients ignore reason kinds they do not know.
+  may carry the `restartReason` for which the daemon restarts once the requests that the position
+  counts finish, with `scriptCount`, how many of those requests run a rushx script, and
+  `restartsForAnotherRequest`, set for a rushx script that waits for another request's restart.
+  `workspaceInputsChanged` names the installation files or the files of Rush and its plugins that
+  changed since the daemon started, or the Rush version that the request selects. Older daemons
+  omit these fields, and clients ignore reason kinds they do not know.
 - **Request lifecycle contracts** — a validated presentation-free command envelope, cancellation,
   typed routing rejection/fallback, and one authoritative terminal result control. Command parsing
   and Rush action construction remain outside the protocol.
diff --git a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
index b97e4f2787..1e2596dba7 100644
--- a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
+import type { IDaemonWorkspaceInputsChangedRestartReason } from './DaemonWorkspaceInputsChange';
 
 /**
  * How a folder of a running daemon's installation changed after the daemon started.
@@ -35,10 +36,12 @@ export interface IDaemonInstallationChangedRestartReason extends IDaemonInstalla
 }
 
 /**
- * Why a daemon asked the client to retry after a restart. Clients ignore kinds that they do not know.
+ * Why a daemon asked the client to retry after a restart, or why a queued request waits for a restart. Clients ignore
+ * kinds that they do not know.
  *
  * @beta
  */
 export type DaemonRestartReason =
   | IDaemonInstallationChangedRestartReason
-  | IDaemonEnvironmentChangedRestartReason;
+  | IDaemonEnvironmentChangedRestartReason
+  | IDaemonWorkspaceInputsChangedRestartReason;
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 5ec2f64646..fda7815f30 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -32,10 +32,15 @@ export interface IDaemonRequestQueuePositionMessage {
     readonly position: number;
     readonly requestId: string;
     /**
-     * Set while the daemon holds the request until the requests ahead of it finish, and then answers it with a
-     * restart result for this reason instead of running it. Older daemons omit it; clients ignore unknown kinds.
+     * Set while the request waits for the requests that `position` counts to finish, since the daemon then
+     * restarts for this reason, and the request runs after the restart. Older daemons omit it; clients ignore
+     * unknown kinds.
      */
     readonly restartReason?: DaemonRestartReason;
+    /** Set with `restartReason` if any of the requests that `position` counts run a rushx script: how many. */
+    readonly scriptCount?: number;
+    /** Set with `restartReason` for a rushx script that waits for another request's restart, not its own. */
+    readonly restartsForAnotherRequest?: boolean;
   };
 }
 
diff --git a/libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts b/libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts
new file mode 100644
index 0000000000..201f08f3d4
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonWorkspaceInputsChange.ts
@@ -0,0 +1,27 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Workspace inputs that bind a daemon process differ from the ones that it started with, so the daemon restarts to
+ * serve a request that needs them. Each field is set only when that kind of input differs, and a list is empty when
+ * the daemon could not tell which files changed. A request whose environment differs is described by
+ * `environmentChanged` instead, whatever else differs.
+ *
+ * @beta
+ */
+export interface IDaemonWorkspaceInputsChangedRestartReason {
+  /** Identifies this reason. */
+  readonly kind: 'workspaceInputsChanged';
+  /**
+   * The installation files that changed since the daemon started, such as the lockfile, relative to the workspace
+   * root when they are inside it.
+   */
+  readonly installationFiles?: ReadonlyArray<string>;
+  /**
+   * Some of the files of Rush or of a Rush plugin whose code changed since the daemon started, relative to the
+   * workspace root when they are inside it.
+   */
+  readonly implementationFiles?: ReadonlyArray<string>;
+  /** The Rush version that the request selects, which the daemon does not run. */
+  readonly selectedRushVersion?: string;
+}
diff --git a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
index afaf7d90af..436bdcd26b 100644
--- a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
+++ b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
@@ -4,11 +4,22 @@
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
 import { validateEnvironmentChange } from './EnvironmentChangeValidation';
+import { validateWorkspaceInputsChange } from './WorkspaceInputsChangeValidation';
 
 const INSTALLATION_CHANGE_KINDS: ReadonlySet<unknown> = new Set(['removed', 'replaced']);
 const INSTALLATION_CHANGED: string = 'installationChanged';
 const ENVIRONMENT_CHANGED: string = 'environmentChanged';
+const WORKSPACE_INPUTS_CHANGED: string = 'workspaceInputsChanged';
 const EMPTY_LENGTH: number = 0;
+/** Validates the fields of each known restart reason kind; unknown kinds are accepted. */
+const REASON_VALIDATORS: ReadonlyMap<unknown, (reason: Record<string, unknown>) => void> = new Map([
+  [
+    INSTALLATION_CHANGED,
+    (reason: Record<string, unknown>) => validateInstallationChange(reason, 'restartReason')
+  ],
+  [ENVIRONMENT_CHANGED, validateEnvironmentChange],
+  [WORKSPACE_INPUTS_CHANGED, validateWorkspaceInputsChange]
+]);
 
 /** Validates an optional installation change, as reported by pong or by a restart reason. @internal */
 export function validateInstallationChange(value: unknown, field: string): void {
@@ -33,8 +44,7 @@ export function validateQueuedRestartReason(payload: Record<string, unknown>): v
 function validateReason(reason: unknown): void {
   requireRecord(reason, 'restartReason');
   requireKind(reason.kind);
-  if (reason.kind === INSTALLATION_CHANGED) validateInstallationChange(reason, 'restartReason');
-  if (reason.kind === ENVIRONMENT_CHANGED) validateEnvironmentChange(reason);
+  REASON_VALIDATORS.get(reason.kind)?.(reason);
 }
 
 function requireRecord(value: unknown, field: string): asserts value is Record<string, unknown> {
diff --git a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
index ead34a05a6..357b57f0fd 100644
--- a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
@@ -6,6 +6,7 @@ import { validateQueuedRestartReason } from './InstallationChangeValidation';
 
 const EMPTY_STRING_LENGTH: number = 0;
 const FIRST_QUEUE_POSITION: number = 1;
+const NO_SCRIPTS: number = 0;
 
 /** Validates optional request-admission capability negotiation. @internal */
 export function validateRequestAdmissionCapability(payload: Record<string, unknown>): void {
@@ -22,6 +23,24 @@ export function validateRequestQueuePositionControl(payload: Record<string, unkn
   validateRequestId(payload.requestId);
   validateQueuePosition(payload.position);
   validateQueuedRestartReason(payload);
+  validateScriptCount(payload.scriptCount);
+  validateRestartsForAnotherRequest(payload.restartsForAnotherRequest);
+}
+
+function validateRestartsForAnotherRequest(value: unknown): void {
+  if (value !== undefined && typeof value !== 'boolean') {
+    fail('Queue position payload.restartsForAnotherRequest must be a boolean.');
+  }
+}
+
+function validateScriptCount(value: unknown): void {
+  if (value !== undefined && !isScriptCount(value)) {
+    fail('Queue position payload.scriptCount must be a nonnegative safe integer.');
+  }
+}
+
+function isScriptCount(value: unknown): boolean {
+  return Number.isSafeInteger(value) && (value as number) >= NO_SCRIPTS;
 }
 
 function validateRequestId(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts b/libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts
new file mode 100644
index 0000000000..a8b2dcbc46
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/WorkspaceInputsChangeValidation.ts
@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const FILE_LIST_FIELDS: ReadonlyArray<string> = ['installationFiles', 'implementationFiles'];
+const EMPTY_LENGTH: number = 0;
+
+/** Validates the optional fields of a `workspaceInputsChanged` restart reason. @internal */
+export function validateWorkspaceInputsChange(reason: Record<string, unknown>): void {
+  for (const field of FILE_LIST_FIELDS) validateOptionalNames(reason[field], field);
+  validateOptionalVersion(reason.selectedRushVersion);
+}
+
+function validateOptionalVersion(value: unknown): void {
+  if (value !== undefined && !isNonEmptyString(value)) fail('selectedRushVersion');
+}
+
+function validateOptionalNames(value: unknown, field: string): void {
+  if (value !== undefined && !isNameList(value)) fail(field);
+}
+
+function isNameList(value: unknown): boolean {
+  return Array.isArray(value) && value.every(isNonEmptyString);
+}
+
+function isNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_LENGTH;
+}
+
+function fail(field: string): never {
+  throw new DaemonProtocolError('malformedControlMessage', `Invalid restartReason.${field}.`);
+}
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index c90228393b..648d0cf50a 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -38,9 +38,8 @@ export { DAEMON_CONTROL_MESSAGE_KINDS, isDaemonControlMessageKind } from './Daem
 export type { DaemonControlMessageKind } from './DaemonControlKinds';
 export type { DaemonControlMessage, DaemonEmptyPayload } from './DaemonControlMessage';
 export type { IDaemonErrorMessage, IDaemonHelloAckMessage } from './DaemonControlMessage';
-export type { IDaemonHelloMessage } from './DaemonControlMessage';
+export type { IDaemonHelloMessage, IDaemonUnsubscribeMessage } from './DaemonControlMessage';
 export type { IDaemonPingMessage, IDaemonSubscribeMessage } from './DaemonControlMessage';
-export type { IDaemonUnsubscribeMessage } from './DaemonControlMessage';
 export type { IDaemonRawModeChangedMessage, IDaemonSetRawModeMessage } from './DaemonInteractiveControl';
 export type { IDaemonStdinEndMessage, IDaemonStdinReadyMessage } from './DaemonInteractiveControl';
 export type { IDaemonTerminalPolicyMessage } from './DaemonInteractiveControl';
@@ -60,6 +59,7 @@ export type { DaemonInstallationChangeKind, DaemonRestartReason } from './Daemon
 export type { IDaemonInstallationChange } from './DaemonInstallationChange';
 export type { IDaemonInstallationChangedRestartReason } from './DaemonInstallationChange';
 export type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
+export type { IDaemonWorkspaceInputsChangedRestartReason } from './DaemonWorkspaceInputsChange';
 export { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
 export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { DaemonRequestRejectionCode, IDaemonRequestCancelMessage } from './DaemonRequestControl';
diff --git a/libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts
new file mode 100644
index 0000000000..d74fc3d8cd
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/WorkspaceInputsRestartReason.test.ts
@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+import type { IDaemonWorkspaceInputsChangedRestartReason } from '../DaemonWorkspaceInputsChange';
+
+const FAILURE_EXIT_CODE: number = 1;
+const POSITION: number = 2;
+const SCRIPT_COUNT: number = 1;
+const NO_SCRIPTS: number = 0;
+const FRACTIONAL_COUNT: number = 1.5;
+const NEGATIVE_COUNT: number = -1;
+const REQUEST_ID: string = 'waits-for-inputs';
+const REASON: IDaemonWorkspaceInputsChangedRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml'],
+  implementationFiles: ['common/autoinstallers/plugins/node_modules/p/lib/index.js'],
+  selectedRushVersion: '5.180.0'
+};
+
+function roundTrip(message: DaemonControlMessage): unknown {
+  return decodeDaemonControlMessage(encodeDaemonControlMessage(message));
+}
+
+function queuePositionFrame(fields: object): Uint8Array {
+  const payload: object = { position: POSITION, requestId: REQUEST_ID, ...fields };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+it('round-trips a queue position that waits for a restart for changed workspace inputs', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: { position: POSITION, requestId: REQUEST_ID, restartReason: REASON, scriptCount: SCRIPT_COUNT }
+  };
+  expect(roundTrip(message)).toEqual(message);
+});
+
+it('round-trips a rushx script that waits for another request restart', () => {
+  const restartReason: IDaemonWorkspaceInputsChangedRestartReason = { kind: 'workspaceInputsChanged' };
+  const payload: object = { restartReason, restartsForAnotherRequest: true, scriptCount: NO_SCRIPTS };
+  expect(decodeDaemonControlMessage(queuePositionFrame(payload))).toMatchObject({ payload });
+});
+
+it('round-trips a restart result for changed workspace inputs', () => {
+  const message: DaemonControlMessage = {
+    kind: 'requestResult',
+    payload: {
+      aborted: false,
+      exitCode: FAILURE_EXIT_CODE,
+      outcome: 'failure',
+      requestId: REQUEST_ID,
+      restartReason: REASON,
+      retryAfterRestart: true
+    }
+  };
+  expect(roundTrip(message)).toEqual(message);
+});
+
+it.each([
+  { installationFiles: 'common/config/rush/pnpm-lock.yaml' },
+  { implementationFiles: [''] },
+  { installationFiles: [FAILURE_EXIT_CODE] },
+  { implementationFiles: null },
+  { selectedRushVersion: '' },
+  { selectedRushVersion: [] }
+])('rejects a malformed workspace inputs reason %j', (fields: object) => {
+  const restartReason: object = { kind: 'workspaceInputsChanged', ...fields };
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ restartReason }))).toThrow(/restartReason/);
+});
+
+it.each([
+  { scriptCount: NEGATIVE_COUNT },
+  { scriptCount: FRACTIONAL_COUNT },
+  { scriptCount: '1' },
+  { restartsForAnotherRequest: 'yes' }
+])('rejects a malformed restart wait %j', (fields: object) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ restartReason: REASON, ...fields }))).toThrow(
+    /scriptCount|restartsForAnotherRequest/
+  );
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 48030e4ef6..5161262ddc 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -185,7 +185,11 @@ restart can still take the startup mutex first.
 
 A request whose environment needs another process does not restart the daemon while it serves other requests. It
 first waits for the requests that this process is serving to finish (the restart drain), and its queue position is the
-number of those requests. Like the graph-execution gate, waiting for the requests that were already being served when
+number of those requests. The queue positions also say why the daemon restarts (`restartReason`): `environmentChanged`
+names the variables that differ (see below), and `workspaceInputsChanged` names the installation files and the files
+of Rush or its plugins that changed since the daemon started, as the latest capture found them, or the Rush version
+that the request selects. They say how many of those requests run a rushx script (`scriptCount`), and the drain's
+admission errors name the same reason. Like the graph-execution gate, waiting for the requests that were already being served when
 the drain began is progress rather than contention: while one of them is still being served and no rushx script is, a
 client-default `waitTimeoutMs` (`waitTimeoutIsDefault`) does not limit the drain and is not spent, and the client
 sends the request to the successor with its default again. The default still limits the drain while a rushx script is
@@ -207,7 +211,8 @@ that it no longer needs it, or has failed or been cancelled. A rushx script that
 does not start, since the restart would then wait for it to exit: the script waits for the pending restart instead,
 and the drain does not count it. If the restart was planned, the script's result carries `retryAfterRestart: true` so
 that the client runs it on the successor; otherwise it runs on this process. Its queue position is the number of
-requests that are served or waiting to restart, and its wait timeout applies as it does to the drain, relative to the
+requests that are served or waiting to restart, with the reason of the first request that waits to restart and
+`restartsForAnotherRequest: true`, and its wait timeout applies as it does to the drain, relative to the
 requests that were served when the script began to wait.
 
 The `retryAfterRestart: true` result of the request that restarts the daemon for its environment carries
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 54b4964d4f..6f53ed75e2 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -11,6 +11,7 @@ import type {
   IDaemonRequestAdmissionOptions,
   IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
+import { formatDaemonRestartCause, type IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
 
 import {
   type IRequestLease,
@@ -26,6 +27,7 @@ import type {
   IWorkspaceRestartDrainOptions,
   IWorkspaceRestartRecheck,
   IWorkspaceRestartTicket,
+  IWorkspaceRestartWaitReport,
   IWorkspaceRestartWaitResult,
   WorkspaceRestartArbiter
 } from './WorkspaceRestartArbiter';
@@ -83,13 +85,6 @@ export function freezeDaemonRequestAdmissionOptions(
   return copy;
 }
 
-/** Says why the daemon restarts, completing "the daemon could restart <cause>". */
-function formatRestartCause(restartReason: DaemonRestartReason): string {
-  return restartReason.kind === 'environmentChanged'
-    ? `because a command's environment differs from its own in ${restartReason.variableNames.join(', ')}`
-    : `because its installation at ${restartReason.folder} was ${restartReason.change}`;
-}
-
 class WorkspaceRequestScheduler extends RequestScheduler {
   readonly #session: IWorkspaceSession;
 
@@ -130,12 +125,25 @@ class QueuePositionWriter {
       writeQueuePositionAsync.call(client, message);
   }
 
-  public enqueue(position: number, restartReason?: DaemonRestartReason): void {
+  public enqueue(
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails
+  ): void {
+    const { scriptCount, restartsForAnotherRequest } = restartWait ?? {};
     this.#tail = this.#tail
       .then(() =>
         this.#writeQueuePositionAsync({
           kind: 'queuePosition',
-          payload: { position, requestId: this.#requestId, ...(restartReason && { restartReason }) }
+          payload: {
+            position,
+            requestId: this.#requestId,
+            ...(restartReason && {
+              restartReason,
+              ...(scriptCount ? { scriptCount } : undefined),
+              ...(restartsForAnotherRequest && { restartsForAnotherRequest })
+            })
+          }
         })
       )
       .catch((error: unknown) => {
@@ -340,7 +348,8 @@ export class RequestAdmissionController {
       scheduler,
       RequestExclusivityClass.Exclusive,
       this.#remainingMs,
-      `the running requests to finish before the daemon restarts ${formatRestartCause(restartReason)}`,
+      'the running requests to finish before the daemon restarts ' +
+        (formatDaemonRestartCause(restartReason, 'thisRequest') ?? 'for its environment'),
       this.#abortController.signal,
       restartReason
     );
@@ -467,8 +476,9 @@ export class RequestAdmissionController {
    * requests that arrived later, which could otherwise keep the request waiting for as long as they keep arriving.
    * An explicit `noWait` or `waitTimeoutMs` applies to the whole wait, using the same budget as workspace admission.
    *
-   * A `restartReason` says that the daemon restarts for that reason rather than for the request's environment. Queue
-   * positions then carry it, and admission errors name it.
+   * A `restartReason` says why the request needs the restart. Queue positions carry it, as do those of rushx scripts
+   * that wait for the restart, and admission errors name it. Without it, they say that the daemon restarts for the
+   * request's environment. Queue positions also say how many of the requests that they count run a rushx script.
    *
    * @returns true once the drain finishes, or false if `recheck` found that the request no longer needs the restart.
    */
@@ -486,9 +496,9 @@ export class RequestAdmissionController {
   }
 
   /**
-   * Waits, for a rushx script, until no other request needs to restart the daemon for its environment, so that the
-   * restart does not also wait for the script. The client is told how many requests are served or need a restart, as
-   * a queue position.
+   * Waits, for a rushx script, until no other request needs to restart the daemon, so that the restart does not also
+   * wait for the script. The client is told how many requests are served or need a restart, as a queue position,
+   * and why the first request that needs a restart needs it.
    *
    * @remarks
    * The wait timeout applies as it does to the restart drain, relative to the requests served when this wait began:
@@ -498,14 +508,17 @@ export class RequestAdmissionController {
     arbiter: WorkspaceRestartArbiter,
     ticket: IWorkspaceRestartTicket
   ): Promise<void> {
-    await this.#waitForRestartArbiterAsync((options: IWorkspaceRestartDrainOptions) =>
-      arbiter.waitForPendingRestartAsync(ticket, options)
+    await this.#waitForRestartArbiterAsync(
+      (options: IWorkspaceRestartDrainOptions) => arbiter.waitForPendingRestartAsync(ticket, options),
+      undefined,
+      true
     );
   }
 
   async #waitForRestartArbiterAsync(
     waitAsync: (options: IWorkspaceRestartDrainOptions) => Promise<IWorkspaceRestartWaitResult>,
-    restartReason?: DaemonRestartReason
+    restartReason?: DaemonRestartReason,
+    restartsForAnotherRequest?: boolean
   ): Promise<IWorkspaceRestartWaitResult> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
@@ -517,8 +530,14 @@ export class RequestAdmissionController {
         noWait: this.#admission?.noWait,
         waitTimeoutMs: this.#remainingMs,
         waivesTimeoutForServedWork: this.#admission?.waitTimeoutIsDefault === true,
-        restartCause: restartReason && formatRestartCause(restartReason),
-        onServingCountChanged: writer ? (count: number) => writer.enqueue(count, restartReason) : undefined
+        restartReason,
+        onServingCountChanged: writer
+          ? (count: number, report: IWorkspaceRestartWaitReport) =>
+              writer.enqueue(count, report.restartReason, {
+                scriptCount: report.scriptCount,
+                restartsForAnotherRequest
+              })
+          : undefined
       });
       waivedMs = result.waivedMs;
       return result;
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index b028c0ea08..e9e4fd9223 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -79,6 +79,8 @@ import {
 
 /** How often a request that waits for a restart drain checks whether it still needs the restart. */
 const RESTART_RECHECK_INTERVAL_MS: number = 1000;
+/** A restart reason names at most this many of the changed files of Rush and its plugins. */
+const MAX_REASON_IMPLEMENTATION_FILES: number = 3;
 
 interface IRecheckCapture {
   /** On the clock of `performance.now()`. */
@@ -535,7 +537,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
               const drained: boolean = await admission.waitForRestartDrainAsync(
                 this.#restartArbiter,
                 ticket,
-                undefined,
+                this.#getRestartReason(current, controlEnvelope.environment, false),
                 this.#createRestartRecheck(session, controlEnvelope, current, false)
               );
               if (this.#restartPending) throw new RestartPendingBeforeExecution();
@@ -638,7 +640,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         const drained: boolean = await admission.waitForRestartDrainAsync(
           this.#restartArbiter,
           ticket,
-          undefined,
+          this.#getRestartReason(fingerprint, envelope.environment, isMutation(envelope)),
           this.#createRestartRecheck(session, envelope, fingerprint, isMutation(envelope))
         );
         if (this.#restartPending) throw new RestartPendingBeforeExecution();
@@ -978,6 +980,51 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     return fingerprint;
   }
 
+  /**
+   * Says why a request whose inputs need a restart (see `#classify`) needs it, for the request and for rushx scripts
+   * that wait for the restart. A request whose environment differs from the daemon's gets the names of the variables
+   * that differ, whatever else differs. Otherwise the reason names the files that changed, as the latest capture
+   * found them, and the Rush version that the request selects if the daemon does not run it.
+   */
+  #getRestartReason(
+    fingerprint: IWorkspaceInputFingerprint,
+    environment: Readonly<Record<string, string | undefined>>,
+    mutation: boolean
+  ): DaemonRestartReason {
+    const environmentReason: DaemonRestartReason | undefined = getEnvironmentRestartReason(
+      this.#startupEnvironmentEntries,
+      environment
+    );
+    if (environmentReason) return environmentReason;
+    const startup: IWorkspaceInputFingerprint = this.#startupFingerprint;
+    const { selectedRushVersion } = fingerprint;
+    return {
+      kind: 'workspaceInputsChanged',
+      ...(!mutation &&
+        fingerprint.installationHash !== startup.installationHash && {
+          installationFiles: this.#toWorkspacePaths(this.#runtimeCache.changedInstallationPaths)
+        }),
+      ...(fingerprint.runtimeHash !== startup.runtimeHash && {
+        implementationFiles: this.#toWorkspacePaths(
+          this.#runtimeCache.changedPaths.slice(0, MAX_REASON_IMPLEMENTATION_FILES)
+        )
+      }),
+      ...((selectedRushVersion !== Rush.version || selectedRushVersion !== this.#options.rushVersion) && {
+        selectedRushVersion
+      })
+    };
+  }
+
+  /** Makes the paths inside the workspace relative to its root, with forward slashes. */
+  #toWorkspacePaths(filePaths: ReadonlyArray<string>): string[] {
+    return filePaths.map((filePath: string) => {
+      const relativePath: string = path.relative(this.#repoRoot, filePath);
+      return relativePath && !relativePath.startsWith('..') && !path.isAbsolute(relativePath)
+        ? relativePath.split(path.sep).join('/')
+        : filePath;
+    });
+  }
+
   #classify(fingerprint: IWorkspaceInputFingerprint, mutation: boolean): WorkspaceInputChangeTier {
     if (
       fingerprint.selectedRushVersion !== Rush.version ||
diff --git a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
index aa5a96975e..5979ec14dd 100644
--- a/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
+++ b/libraries/rush-daemon/src/WorkspaceRestartArbiter.ts
@@ -1,6 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+import { formatDaemonRestartCause, type DaemonRestartRequester } from '@rushstack/rush-client-core';
+
 import { RequestSchedulerError, RequestSchedulerErrorCode } from './RequestScheduler';
 
 const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
@@ -10,6 +13,14 @@ const SCRIPT_TIMEOUT_CLAUSE: string = ', including a rushx script that may not e
 const SCRIPT_TIMEOUT_REMEDY: string = 'Stop the script, or use --wait-timeout <seconds> to wait longer.';
 const TIMEOUT_REMEDY: string = 'Use --wait-timeout <seconds> to wait longer.';
 
+/** Says why the daemon restarts, as the end of "the daemon restarts <cause>", if the reason is known. */
+function formatCause(
+  restartReason: DaemonRestartReason | undefined,
+  requester: DaemonRestartRequester
+): string | undefined {
+  return restartReason && formatDaemonRestartCause(restartReason, requester);
+}
+
 /** Names the waived time, since a drain that waived time times out that much later than the wait timeout. */
 function formatWaivedTime(waivedMs: number): string {
   const seconds: number = Math.round(waivedMs / 100) / 10;
@@ -34,6 +45,8 @@ interface IMutableTicket {
   waitingForDrain: boolean;
   left: boolean;
   readonly runsScript: boolean;
+  /** Why the request needs a restart, while it is a restart candidate. */
+  restartReason: DaemonRestartReason | undefined;
 }
 
 interface IWaitKind {
@@ -44,13 +57,26 @@ interface IWaitKind {
   readonly restarts: boolean;
   /** Whether the request must keep waiting. */
   readonly isBlocked: () => boolean;
-  /** How many other requests the request waits for, reported as its queue position. */
-  readonly countWaitedFor: () => number;
+  /** The other requests that the request waits for. Their number is reported as its queue position. */
+  readonly getWaitedFor: () => ReadonlySet<IMutableTicket>;
+  /** Why the daemon restarts, if that is known. */
+  readonly getRestartReason: () => DaemonRestartReason | undefined;
   /** Lets a request that waits to restart find that it no longer needs to. */
   readonly recheck: IWorkspaceRestartRecheck | undefined;
-  readonly noWaitMessage: string;
+  readonly getNoWaitMessage: () => string;
   /** Begins the timeout message, which goes on to name the requests that the restart waits for. */
-  readonly timeoutPrefix: string;
+  readonly getTimeoutPrefix: () => string;
+}
+
+/** What a request that waits for a restart waits for, besides how many requests. */
+export interface IWorkspaceRestartWaitReport {
+  /** How many of the requests that the request waits for run a rushx script. */
+  readonly scriptCount: number;
+  /**
+   * Why the daemon restarts: for a restart drain, the request's own reason, and for a rushx script that waits for a
+   * pending restart, the reason of the first request that needs one. Undefined if that request gave no reason.
+   */
+  readonly restartReason: DaemonRestartReason | undefined;
 }
 
 /** Options for {@link WorkspaceRestartArbiter.waitForDrainAsync}, supplied by request admission. */
@@ -66,16 +92,16 @@ export interface IWorkspaceRestartDrainOptions {
    */
   readonly waivesTimeoutForServedWork?: boolean;
   /**
-   * Why the daemon restarts, as the admission errors of {@link WorkspaceRestartArbiter.waitForDrainAsync} say it:
-   * "the daemon could restart <cause>", for example `because its installation at /x was removed`. The default is
-   * `for its environment`.
+   * Why the request needs the restart that {@link WorkspaceRestartArbiter.waitForDrainAsync} waits for. The admission
+   * errors of the drain name it, as do those of rushx scripts that wait for the restart, and their reports. Without
+   * it, they say that the daemon restarts for the request's environment.
    */
-  readonly restartCause?: string;
+  readonly restartReason?: DaemonRestartReason;
   /**
    * Called while the request waits with the number of other requests that it waits for, when the wait begins and
-   * whenever that number changes, so that the client can report the wait as a queue position.
+   * whenever that number or the report changes, so that the client can report the wait as a queue position.
    */
-  readonly onServingCountChanged?: (servingCount: number) => void;
+  readonly onServingCountChanged?: (servingCount: number, report: IWorkspaceRestartWaitReport) => void;
 }
 
 /**
@@ -174,7 +200,8 @@ export class WorkspaceRestartArbiter {
     const ticket: IMutableTicket = {
       waitingForDrain: false,
       left: false,
-      runsScript: options?.runsScript === true
+      runsScript: options?.runsScript === true,
+      restartReason: undefined
     };
     this.#serve(ticket);
     return ticket;
@@ -216,20 +243,22 @@ export class WorkspaceRestartArbiter {
     options: IWorkspaceRestartDrainOptions,
     recheck?: IWorkspaceRestartRecheck
   ): Promise<IWorkspaceRestartWaitResult> {
-    const { restartCause } = options;
+    const cause: string | undefined = formatCause(options.restartReason, 'thisRequest');
     return await this.#waitAsync(ticket, options, {
       restarts: true,
       isBlocked: () => this.#serving.size > 0,
-      countWaitedFor: () => this.#serving.size,
+      getWaitedFor: () => this.#serving,
+      getRestartReason: () => options.restartReason,
       recheck,
-      noWaitMessage:
-        restartCause === undefined
+      getNoWaitMessage: () =>
+        cause === undefined
           ? 'Another environment is still being served; the request did not wait for a restart.'
-          : `The daemon is still serving other requests, which finish before it restarts ${restartCause}; ` +
+          : `The daemon is still serving other requests, which finish before it restarts ${cause}; ` +
             'the request did not wait for a restart.',
-      timeoutPrefix:
-        `The request was not admitted before the daemon could restart ${restartCause ?? ENVIRONMENT_RESTART_CAUSE}, ` +
-        'which waits for'
+      getTimeoutPrefix: () =>
+        cause === undefined
+          ? `The request was not admitted before the daemon could restart ${ENVIRONMENT_RESTART_CAUSE}, which waits for`
+          : `The request was not admitted before the daemon could restart ${cause}. The restart waits for`
     });
   }
 
@@ -244,18 +273,29 @@ export class WorkspaceRestartArbiter {
     ticket: IWorkspaceRestartTicket,
     options: IWorkspaceRestartDrainOptions
   ): Promise<IWorkspaceRestartWaitResult> {
+    const getRestartReason = (): DaemonRestartReason | undefined =>
+      Array.from(this.#restartCandidates).find((candidate: IMutableTicket) => candidate !== ticket)
+        ?.restartReason;
     return await this.#waitAsync(ticket, options, {
       restarts: false,
       isBlocked: () => this.hasPendingRestart(ticket),
-      countWaitedFor: () => new Set([...this.#serving, ...this.#restartCandidates]).size,
+      getWaitedFor: () => new Set([...this.#serving, ...this.#restartCandidates]),
+      getRestartReason,
       recheck: undefined,
-      noWaitMessage:
-        'Another request is waiting to restart the daemon for its environment; the rushx script did not wait ' +
-        'for the restart.',
-      timeoutPrefix:
-        "The rushx script was not admitted before the daemon could restart for another request's environment. A " +
-        'script waits for a pending restart so that the restart does not wait for the script, and the restart ' +
-        'waits for'
+      getNoWaitMessage: () => {
+        const cause: string = formatCause(getRestartReason(), 'anotherRequest') ?? ENVIRONMENT_RESTART_CAUSE;
+        return `Another request is waiting to restart the daemon ${cause}; the rushx script did not wait for the restart.`;
+      },
+      getTimeoutPrefix: () => {
+        const cause: string | undefined = formatCause(getRestartReason(), 'anotherRequest');
+        return (
+          (cause === undefined
+            ? "The rushx script was not admitted before the daemon could restart for another request's environment."
+            : `The rushx script was not admitted before the daemon could restart for another request, ${cause}.`) +
+          ' A script waits for a pending restart so that the restart does not wait for the script, and the ' +
+          'restart waits for'
+        );
+      }
     });
   }
 
@@ -266,18 +306,27 @@ export class WorkspaceRestartArbiter {
   ): Promise<IWorkspaceRestartWaitResult> {
     const state: IMutableTicket = ticket as IMutableTicket;
     if (state.left || state.waitingForDrain) throw new Error('The restart ticket is not being served.');
-    if (kind.restarts) this.#restartCandidates.add(state);
+    if (kind.restarts) {
+      state.restartReason = options.restartReason;
+      this.#restartCandidates.add(state);
+    }
     state.waitingForDrain = true;
     this.#stopServing(state);
     const waivedFor: IMutableTicket[] = options.waivesTimeoutForServedWork ? Array.from(this.#serving) : [];
     let remainingMs: number | undefined = options.waitTimeoutMs;
     let waivedMs: number = 0;
-    let reported: number | undefined;
+    let reported: string | undefined;
     const report = (): void => {
-      const count: number = kind.countWaitedFor();
-      if (count > 0 && count !== reported) {
-        reported = count;
-        options.onServingCountChanged?.(count);
+      const waitedFor: ReadonlySet<IMutableTicket> = kind.getWaitedFor();
+      if (waitedFor.size === 0) return;
+      const waitReport: IWorkspaceRestartWaitReport = {
+        scriptCount: Array.from(waitedFor).filter((waited: IMutableTicket) => waited.runsScript).length,
+        restartReason: kind.getRestartReason()
+      };
+      const key: string = JSON.stringify([waitedFor.size, waitReport.scriptCount, waitReport.restartReason]);
+      if (key !== reported) {
+        reported = key;
+        options.onServingCountChanged?.(waitedFor.size, waitReport);
       }
     };
     // The ticket is a restart candidate for as long as the wait lasts, so withdrawing its restart wakes the wait.
@@ -287,7 +336,7 @@ export class WorkspaceRestartArbiter {
     try {
       while (!recheck?.withdrawn && kind.isBlocked()) {
         if (options.noWait) {
-          throw new RequestSchedulerError(RequestSchedulerErrorCode.NoWait, kind.noWaitMessage);
+          throw new RequestSchedulerError(RequestSchedulerErrorCode.NoWait, kind.getNoWaitMessage());
         }
         report();
         const waived: boolean =
@@ -339,8 +388,9 @@ export class WorkspaceRestartArbiter {
     const script: boolean = this.#isServingScript();
     return new RequestSchedulerError(
       RequestSchedulerErrorCode.WaitTimeout,
-      `${kind.timeoutPrefix} the requests that the daemon is serving to finish${script ? SCRIPT_TIMEOUT_CLAUSE : ''}` +
-        `${formatWaivedTime(waivedMs)}. ${script ? SCRIPT_TIMEOUT_REMEDY : TIMEOUT_REMEDY}`
+      `${kind.getTimeoutPrefix()} the requests that the daemon is serving to finish` +
+        `${script ? SCRIPT_TIMEOUT_CLAUSE : ''}${formatWaivedTime(waivedMs)}. ` +
+        (script ? SCRIPT_TIMEOUT_REMEDY : TIMEOUT_REMEDY)
     );
   }
 
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
index c03a3f920f..ea3c9f482c 100644
--- a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -299,7 +299,7 @@ describe('a daemon whose installation changed', () => {
     const result: IDaemonCommandResult = timedOut.terminal.payload as IDaemonCommandResult;
     expect(result.retryAfterRestart).toBeUndefined();
     expect(result.errorMessage).toContain(
-      `could restart because its installation at ${installation.folder} was replaced, which waits for the ` +
+      `could restart because its installation at ${installation.folder} was replaced. The restart waits for the ` +
         'requests that the daemon is serving to finish, including a rushx script that may not exit until it is ' +
         'stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
     );
diff --git a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
index 5780afed79..e122bba3b4 100644
--- a/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/RestartDrainAdmission.test.ts
@@ -29,6 +29,12 @@ const INSTALLATION_REMOVED: DaemonRestartReason = {
   change: 'removed',
   folder: '/old/daemon'
 };
+const LOCKFILE_CHANGED: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+
+type QueuePosition = IDaemonRequestQueuePositionMessage['payload'];
 
 interface IDrainTest {
   readonly admission: RequestAdmissionController;
@@ -48,6 +54,25 @@ function createCandidate(
   });
 }
 
+/** A request whose client supports request admission and records its queue positions. */
+function createReportingAdmission(
+  options: IDaemonRequestAdmissionOptions,
+  requestId: string,
+  positions: QueuePosition[]
+): RequestAdmissionController {
+  return new RequestAdmissionController({
+    admission: options,
+    client: {
+      abortSignal: new AbortController().signal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+        positions.push(message.payload);
+      }
+    },
+    requestId
+  });
+}
+
 /** A restart candidate with the given admission options, and one other request that the daemon is serving. */
 function createDrainTest(
   options: IDaemonRequestAdmissionOptions,
@@ -194,19 +219,9 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     const serving: IWorkspaceRestartTicket = arbiter.enter();
     const ticket: IWorkspaceRestartTicket = arbiter.enter();
     const restartReason: DaemonRestartReason = INSTALLATION_REMOVED;
-    const positions: IDaemonRequestQueuePositionMessage['payload'][] = [];
+    const positions: QueuePosition[] = [];
     const createAdmission = (options: IDaemonRequestAdmissionOptions): RequestAdmissionController =>
-      new RequestAdmissionController({
-        admission: options,
-        client: {
-          abortSignal: new AbortController().signal,
-          supportsRequestAdmission: true,
-          writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
-            positions.push(message.payload);
-          }
-        },
-        requestId: 'restart-candidate'
-      });
+      createReportingAdmission(options, 'restart-candidate', positions);
 
     const notWaiting: RequestAdmissionController = createAdmission({ noWait: true });
     const noWaitError: unknown = await notWaiting
@@ -226,7 +241,7 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     expect((timeoutError as RequestSchedulerError).code).toBe(RequestSchedulerErrorCode.WaitTimeout);
     expect((timeoutError as Error).message).toBe(
       'The request was not admitted before the daemon could restart because its installation at /old/daemon was ' +
-        'removed, which waits for the requests that the daemon is serving to finish. Use --wait-timeout ' +
+        'removed. The restart waits for the requests that the daemon is serving to finish. Use --wait-timeout ' +
         '<seconds> to wait longer.'
     );
     expect(positions).toEqual([{ position: 1, requestId: 'restart-candidate', restartReason }]);
@@ -235,6 +250,31 @@ describe('RequestAdmissionController.waitForRestartDrainAsync', () => {
     arbiter.leave(serving);
     expect(arbiter.servingCount).toBe(0);
   });
+
+  it('says in its queue positions how many of the requests that it waits for run a rushx script', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+    const build: IWorkspaceRestartTicket = arbiter.enter();
+    const ticket: IWorkspaceRestartTicket = arbiter.enter();
+    const positions: QueuePosition[] = [];
+    const admission: RequestAdmissionController = createReportingAdmission(
+      {},
+      'restart-candidate',
+      positions
+    );
+    const draining: Promise<boolean> = admission.waitForRestartDrainAsync(arbiter, ticket, LOCKFILE_CHANGED);
+    arbiter.leave(script);
+    arbiter.leave(build);
+    expect(await draining).toBe(true);
+    await delayAsync(0);
+    expect(positions).toEqual([
+      { position: 2, requestId: 'restart-candidate', restartReason: LOCKFILE_CHANGED, scriptCount: 1 },
+      { position: 1, requestId: 'restart-candidate', restartReason: LOCKFILE_CHANGED }
+    ]);
+    arbiter.leave(ticket);
+    admission.dispose();
+    expect(arbiter.servingCount).toBe(0);
+  });
 });
 
 describe('RequestAdmissionController.acquireBeforeRestartAsync', () => {
@@ -295,15 +335,19 @@ interface IPendingRestartTest {
   readonly arbiter: WorkspaceRestartArbiter;
   readonly candidate: IWorkspaceRestartTicket;
   readonly draining: Promise<IWorkspaceRestartWaitResult>;
-  readonly positions: number[];
+  readonly positions: QueuePosition[];
   readonly script: IWorkspaceRestartTicket;
   readonly serving: IWorkspaceRestartTicket;
 }
 
-/** A rushx script with the given admission options, which arrives while a restart candidate drains one request. */
+/**
+ * A rushx script with the given admission options, which arrives while a restart candidate, which gives the
+ * restart reason if any, drains one request.
+ */
 function createPendingRestartTest(
   options: IDaemonRequestAdmissionOptions,
-  servingOptions?: IWorkspaceRestartTicketOptions
+  servingOptions?: IWorkspaceRestartTicketOptions,
+  restartReason?: DaemonRestartReason
 ): IPendingRestartTest {
   const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   const serving: IWorkspaceRestartTicket = arbiter.enter(servingOptions);
@@ -311,22 +355,12 @@ function createPendingRestartTest(
   const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
     abortSignal: new AbortController().signal,
     noWait: undefined,
-    waitTimeoutMs: undefined
+    waitTimeoutMs: undefined,
+    restartReason
   });
   const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
-  const positions: number[] = [];
-  const admission: RequestAdmissionController = new RequestAdmissionController({
-    admission: options,
-    client: {
-      abortSignal: new AbortController().signal,
-      supportsRequestAdmission: true,
-      writeQueuePositionAsync: (message: IDaemonRequestQueuePositionMessage) => {
-        positions.push(message.payload.position);
-        return Promise.resolve();
-      }
-    },
-    requestId: 'rushx-script'
-  });
+  const positions: QueuePosition[] = [];
+  const admission: RequestAdmissionController = createReportingAdmission(options, 'rushx-script', positions);
   return { admission, arbiter, candidate, draining, positions, script, serving };
 }
 
@@ -352,13 +386,42 @@ describe('RequestAdmissionController.waitForPendingRestartAsync', () => {
     await test.draining;
     test.arbiter.leave(test.candidate);
     await waiting;
-    // The build and the candidate, then the candidate alone.
-    expect(test.positions).toEqual([2, 1]);
+    // The build and the candidate, then the candidate alone. The candidate gave no reason for its restart.
+    expect(test.positions).toEqual([
+      { position: 2, requestId: 'rushx-script' },
+      { position: 1, requestId: 'rushx-script' }
+    ]);
     // The script is then told to run on the successor, which gets its default again.
     expect(test.admission.remainingAdmission?.waitTimeoutMs).toBeGreaterThan(0);
     await finishPendingRestartTestAsync(test);
   });
 
+  it('says in its queue positions why the daemon restarts for another request, and how many scripts it waits for', async () => {
+    const test: IPendingRestartTest = createPendingRestartTest({}, { runsScript: true }, LOCKFILE_CHANGED);
+    const waiting: Promise<void> = test.admission.waitForPendingRestartAsync(test.arbiter, test.script);
+    test.arbiter.leave(test.serving);
+    await test.draining;
+    test.arbiter.leave(test.candidate);
+    await waiting;
+    await delayAsync(0);
+    expect(test.positions).toEqual([
+      {
+        position: 2,
+        requestId: 'rushx-script',
+        restartReason: LOCKFILE_CHANGED,
+        scriptCount: 1,
+        restartsForAnotherRequest: true
+      },
+      {
+        position: 1,
+        requestId: 'rushx-script',
+        restartReason: LOCKFILE_CHANGED,
+        restartsForAnotherRequest: true
+      }
+    ]);
+    await finishPendingRestartTestAsync(test);
+  });
+
   it('applies a client-default timeout while a rushx script is served, and says why', async () => {
     const test: IPendingRestartTest = createPendingRestartTest(
       { waitTimeoutMs: 50, waitTimeoutIsDefault: true },
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
index 74da42a9d0..ead5608628 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbiter.test.ts
@@ -3,12 +3,15 @@
 
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
+import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+
 import { RequestSchedulerError, RequestSchedulerErrorCode } from '../RequestScheduler';
 import {
   WorkspaceRestartArbiter,
   type IWorkspaceRestartDrainOptions,
   type IWorkspaceRestartRecheck,
   type IWorkspaceRestartTicket,
+  type IWorkspaceRestartWaitReport,
   type IWorkspaceRestartWaitResult
 } from '../WorkspaceRestartArbiter';
 
@@ -18,6 +21,21 @@ const WAIT: { abortSignal: AbortSignal; noWait: undefined; waitTimeoutMs: undefi
   waitTimeoutMs: undefined
 };
 
+const LOCKFILE_CHANGED: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const ENVIRONMENT_CHANGED: DaemonRestartReason = {
+  kind: 'environmentChanged',
+  variableNames: ['NODE_OPTIONS', 'RUSH_BUILD_CACHE_ENABLED']
+};
+const VERSION_SELECTED: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  selectedRushVersion: '5.180.0'
+};
+
+type WaitReports = [number, IWorkspaceRestartWaitReport][];
+
 async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
   let settled: boolean = false;
   void promise.then(
@@ -138,6 +156,91 @@ describe(WorkspaceRestartArbiter.name, () => {
     expect(arbiter.servingCount).toBe(0);
   });
 
+  it('reports how many of the requests that a restart candidate waits for run a rushx script, and its reason', async () => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+    const build: IWorkspaceRestartTicket = arbiter.enter();
+    const candidate: IWorkspaceRestartTicket = arbiter.enter();
+    const reports: WaitReports = [];
+    const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+      ...WAIT,
+      restartReason: LOCKFILE_CHANGED,
+      onServingCountChanged: (count: number, report: IWorkspaceRestartWaitReport) =>
+        reports.push([count, report])
+    });
+    arbiter.leave(script);
+    arbiter.leave(build);
+    await waiting;
+    expect(reports).toEqual([
+      [2, { scriptCount: 1, restartReason: LOCKFILE_CHANGED }],
+      [1, { scriptCount: 0, restartReason: LOCKFILE_CHANGED }]
+    ]);
+    arbiter.leave(candidate);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
+  it.each([
+    [
+      'drain',
+      'no-wait',
+      LOCKFILE_CHANGED,
+      'The daemon is still serving other requests, which finish before it restarts because ' +
+        'common/config/rush/pnpm-lock.yaml changed; the request did not wait for a restart.'
+    ],
+    [
+      'drain',
+      'timeout',
+      ENVIRONMENT_CHANGED,
+      "The request was not admitted before the daemon could restart because this request's environment differs " +
+        "from the daemon's in NODE_OPTIONS and RUSH_BUILD_CACHE_ENABLED. The restart waits for the requests that " +
+        'the daemon is serving to finish. Use --wait-timeout <seconds> to wait longer.'
+    ],
+    [
+      'pending restart',
+      'no-wait',
+      ENVIRONMENT_CHANGED,
+      "Another request is waiting to restart the daemon because its environment differs from the daemon's in " +
+        'NODE_OPTIONS and RUSH_BUILD_CACHE_ENABLED; the rushx script did not wait for the restart.'
+    ],
+    [
+      'pending restart',
+      'timeout',
+      VERSION_SELECTED,
+      'The rushx script was not admitted before the daemon could restart for another request, because it selects ' +
+        'Rush 5.180.0. A script waits for a pending restart so that the restart does not wait for the script, and ' +
+        'the restart waits for the requests that the daemon is serving to finish. Use --wait-timeout <seconds> to ' +
+        'wait longer.'
+    ]
+  ])('names the restart reason when a %s wait fails with %s', async (wait, mode, restartReason, message) => {
+    const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+    const build: IWorkspaceRestartTicket = arbiter.enter();
+    const candidate: IWorkspaceRestartTicket = arbiter.enter();
+    const options: IWorkspaceRestartDrainOptions = {
+      ...WAIT,
+      noWait: mode === 'no-wait' ? true : undefined,
+      waitTimeoutMs: mode === 'timeout' ? 10 : undefined
+    };
+    let error: unknown;
+    if (wait === 'drain') {
+      error = await arbiter
+        .waitForDrainAsync(candidate, { ...options, restartReason })
+        .catch((caught: unknown) => caught);
+    } else {
+      const draining: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(candidate, {
+        ...WAIT,
+        restartReason
+      });
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      error = await arbiter.waitForPendingRestartAsync(script, options).catch((caught: unknown) => caught);
+      arbiter.leave(script);
+      arbiter.leave(build);
+      await draining;
+    }
+    expect((error as Error).message).toBe(message);
+    for (const ticket of [build, candidate]) arbiter.leave(ticket);
+    expect(arbiter.servingCount).toBe(0);
+  });
+
   it('reports no count for a candidate that does not wait', async () => {
     const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
     const ticket: IWorkspaceRestartTicket = arbiter.enter();
@@ -347,6 +450,41 @@ describe(WorkspaceRestartArbiter.name, () => {
       expect(arbiter.servingCount).toBe(0);
     });
 
+    it('tells the script why the daemon restarts, and again when another request then needs the restart', async () => {
+      const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
+      const first: IWorkspaceRestartTicket = arbiter.enter();
+      await arbiter.waitForDrainAsync(first, { ...WAIT, restartReason: LOCKFILE_CHANGED });
+      const build: IWorkspaceRestartTicket = arbiter.enter();
+      const second: IWorkspaceRestartTicket = arbiter.enter();
+      const secondDrain: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForDrainAsync(second, {
+        ...WAIT,
+        restartReason: ENVIRONMENT_CHANGED
+      });
+      const script: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
+      const reports: WaitReports = [];
+      const waiting: Promise<IWorkspaceRestartWaitResult> = arbiter.waitForPendingRestartAsync(script, {
+        ...WAIT,
+        onServingCountChanged: (count: number, report: IWorkspaceRestartWaitReport) =>
+          reports.push([count, report])
+      });
+      // The first candidate finds after its drain that it no longer needs the restart; it is still served.
+      arbiter.withdrawRestart(first);
+      arbiter.leave(first);
+      arbiter.leave(build);
+      await secondDrain;
+      expect(await isSettledAsync(waiting)).toBe(false);
+      arbiter.leave(second);
+      await waiting;
+      expect(reports).toEqual([
+        [3, { scriptCount: 0, restartReason: LOCKFILE_CHANGED }],
+        [3, { scriptCount: 0, restartReason: ENVIRONMENT_CHANGED }],
+        [2, { scriptCount: 0, restartReason: ENVIRONMENT_CHANGED }],
+        [1, { scriptCount: 0, restartReason: ENVIRONMENT_CHANGED }]
+      ]);
+      arbiter.leave(script);
+      expect(arbiter.servingCount).toBe(0);
+    });
+
     it('waits for every pending restart', async () => {
       const arbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
       const running: IWorkspaceRestartTicket = arbiter.enter({ runsScript: true });
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index 1e8ffdf642..b9ff7653b3 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -12,13 +12,20 @@ jest.mock('@microsoft/rush-lib', () => {
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { captureWorkspaceInputFingerprintAsync, WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import {
+  captureWorkspaceInputFingerprintAsync,
+  type IWorkspaceInputFingerprint,
+  WorkspaceInputChangeTier
+} from '@microsoft/rush-lib';
 import {
   DaemonFrameType,
   decodeDaemonControlMessage,
   type DaemonControlMessage,
+  type DaemonRestartReason,
+  type IDaemonCommandResult,
   type IDaemonFrame,
-  type IDaemonRequestEnvelope
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
@@ -108,8 +115,11 @@ async function serveAsync(fixture: DaemonGraphTestFixture): Promise<IServedScrip
 
 interface IStreamedRequest {
   readonly exchange: Promise<ITerminalExchange>;
+  readonly requestId: string;
   /** The queue positions that the daemon has reported so far. */
   readonly positions: ReadonlyArray<number>;
+  /** The payloads of those queue position messages. */
+  readonly positionPayloads: ReadonlyArray<IDaemonRequestQueuePositionMessage['payload']>;
   readonly settled: () => boolean;
 }
 
@@ -123,6 +133,7 @@ async function startRequestAsync(
   const payload: IDaemonRequestEnvelope = fixture.envelope(argv, overrides);
   await client.sendControlAsync({ kind: 'requestStart', payload });
   const positions: number[] = [];
+  const positionPayloads: IDaemonRequestQueuePositionMessage['payload'][] = [];
   let settled: boolean = false;
   const readAsync = async (): Promise<ITerminalExchange> => {
     const frames: IDaemonFrame[] = [];
@@ -132,7 +143,10 @@ async function startRequestAsync(
         frames.push(frame);
         if (frame.kind !== DaemonFrameType.controlJson) continue;
         const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
-        if (message.kind === 'queuePosition') positions.push(message.payload.position);
+        if (message.kind === 'queuePosition') {
+          positions.push(message.payload.position);
+          positionPayloads.push(message.payload);
+        }
         if (message.kind === 'requestResult' && message.payload.requestId === payload.requestId) {
           return { frames, terminal: message };
         }
@@ -145,7 +159,7 @@ async function startRequestAsync(
   const exchange: Promise<ITerminalExchange> = readAsync();
   // A failed expectation leaves the exchange unread until the fixture closes the connection.
   exchange.catch(() => undefined);
-  return { exchange, positions, settled: () => settled };
+  return { exchange, requestId: payload.requestId, positions, positionPayloads, settled: () => settled };
 }
 
 /**
@@ -308,6 +322,29 @@ describe('workspace admission while a served rushx script runs', () => {
       expect(fixture.runs()).not.toContain('serve2-start');
       // It waits for the served script and the restart.
       expect(late.positions).toEqual([2]);
+      const restartReason: DaemonRestartReason = {
+        kind: 'environmentChanged',
+        variableNames: ['RUSHD_RELOAD_TIER_TEST']
+      };
+      await waitForAsync(
+        () => restart.positionPayloads.length >= 3 || restart.settled(),
+        'the restart to stop counting the later script'
+      );
+      expect(restart.positionPayloads).toEqual([
+        { position: 1, requestId: restart.requestId, restartReason, scriptCount: 1 },
+        // The later script counts until it finds that a restart is pending.
+        { position: 2, requestId: restart.requestId, restartReason, scriptCount: 2 },
+        { position: 1, requestId: restart.requestId, restartReason, scriptCount: 1 }
+      ]);
+      expect(late.positionPayloads).toEqual([
+        {
+          position: 2,
+          requestId: late.requestId,
+          restartReason,
+          scriptCount: 1,
+          restartsForAnotherRequest: true
+        }
+      ]);
 
       fixture.write(RELEASE_FILE, '');
       expectSuccess(await script.exchange);
@@ -319,6 +356,12 @@ describe('workspace admission while a served rushx script runs', () => {
         });
       }
       expect(late.positions).toEqual([2, 1]);
+      expect(late.positionPayloads[1]).toEqual({
+        position: 1,
+        requestId: late.requestId,
+        restartReason,
+        restartsForAnotherRequest: true
+      });
       expect(fixture.runs()).not.toContain('serve2-start');
       const restarted = await fixture.host.restartCompleted;
       expect(restarted?.pid).not.toBe(before.pid);
@@ -406,6 +449,16 @@ describe('a restart drain whose change is reverted', () => {
       await waitForAsync(() => pause.positions.length > 0 || pause.settled(), 'the request to wait for the drain');
       await delayAsync(1500);
       expect(pause.settled()).toBe(false);
+      // Like a build, the request is told why it waits (task 166).
+      expect(pause.positionPayloads[0]).toEqual({
+        position: 1,
+        requestId: pause.requestId,
+        restartReason: {
+          kind: 'workspaceInputsChanged',
+          installationFiles: ['common/config/rush/npm-shrinkwrap.json']
+        },
+        scriptCount: 1
+      });
 
       const revertedAt: number = Date.now();
       revert();
@@ -550,3 +603,107 @@ describe('a restart drain whose change is reverted', () => {
     }
   });
 });
+
+describe('the reason for a restart that waits for a served rushx script', () => {
+  const actualCaptureAsync: typeof captureWorkspaceInputFingerprintAsync =
+    jest.requireActual<typeof import('@microsoft/rush-lib')>(
+      '@microsoft/rush-lib'
+    ).captureWorkspaceInputFingerprintAsync;
+
+  /** Makes every later capture of the workspace inputs report the given change. */
+  function changeCapturedInputs(change: Partial<IWorkspaceInputFingerprint>): void {
+    inputCaptureMock.mockImplementation(async (options) => ({
+      ...(await actualCaptureAsync(options)),
+      ...change
+    }));
+  }
+
+  afterEach(() => {
+    inputCaptureMock.mockImplementation(actualCaptureAsync);
+  });
+
+  it.each<
+    [
+      string,
+      (fixture: DaemonGraphTestFixture) => Partial<IDaemonRequestEnvelope>,
+      DaemonRestartReason,
+      string
+    ]
+  >([
+    [
+      'a changed installation file',
+      (fixture: DaemonGraphTestFixture) => {
+        changeInstallation(fixture);
+        return {};
+      },
+      { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/npm-shrinkwrap.json'] },
+      'because common/config/rush/npm-shrinkwrap.json changed'
+    ],
+    [
+      'changed code of Rush or a Rush plugin',
+      () => {
+        changeCapturedInputs({ runtimeHash: 'changed' });
+        return {};
+      },
+      // The capture found no changed file, since the test only changed its hash.
+      { kind: 'workspaceInputsChanged', implementationFiles: [] },
+      'because the code of Rush or a Rush plugin changed'
+    ],
+    [
+      'another Rush version',
+      () => {
+        changeCapturedInputs({ selectedRushVersion: '9.9.9' });
+        return {};
+      },
+      { kind: 'workspaceInputsChanged', selectedRushVersion: '9.9.9' },
+      'because this request selects Rush 9.9.9'
+    ],
+    [
+      'a changed environment',
+      (fixture: DaemonGraphTestFixture) => ({
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' }
+      }),
+      { kind: 'environmentChanged', variableNames: ['RUSHD_RELOAD_TIER_TEST'] },
+      "because this request's environment differs from the daemon's in RUSHD_RELOAD_TIER_TEST"
+    ]
+  ])(
+    'names %s in the queue positions and the admission error of a build',
+    async (inputs, change, reason, cause) => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        // The build is never admitted, so no successor is launched.
+        created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+      });
+      try {
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+
+        const overrides: Partial<IDaemonRequestEnvelope> = change(fixture);
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          ...overrides,
+          admission: { waitTimeoutMs: 1500 }
+        });
+        const { terminal } = await build.exchange;
+        expect(terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+        });
+        expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+          `The request was not admitted before the daemon could restart ${cause}. The restart waits for the ` +
+            'requests that the daemon is serving to finish, including a rushx script that may not exit until it ' +
+            'is stopped. Stop the script, or use --wait-timeout <seconds> to wait longer.'
+        );
+        expect(build.positionPayloads).toEqual([
+          { position: 1, requestId: build.requestId, restartReason: reason, scriptCount: 1 }
+        ]);
+        expect(script.settled()).toBe(false);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+      } finally {
+        inputCaptureMock.mockImplementation(actualCaptureAsync);
+        fixture.write(RELEASE_FILE, '');
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+});
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 4530644a53..1a1cbf7e44 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -271,8 +271,9 @@ interface IFileDigest {
  * @remarks
  * Embedding hosts create one cache per workspace lifetime and pass it to
  * {@link captureWorkspaceInputFingerprintAsync} through `runtimeCache`. The capture function
- * updates the cache; hosts can inspect {@link WorkspaceRuntimeFingerprintCache.changedPaths}
- * when reporting why a process restart is required.
+ * updates the cache; hosts can inspect {@link WorkspaceRuntimeFingerprintCache.changedPaths} and
+ * {@link WorkspaceRuntimeFingerprintCache.changedInstallationPaths} when reporting why a process restart
+ * is required.
  *
  * The cache also memoizes the digests of workspace definition and installation files, which users edit while
  * a host is running. Such a digest is recorded only if the file's ctime and mtime were at least 3 seconds old
@@ -292,6 +293,8 @@ export class WorkspaceRuntimeFingerprintCache {
   private readonly _inputFiles: Map<string, IFileDigest> = new Map();
   private _baseline: ReadonlyMap<string, string> | undefined;
   private _changedPaths: ReadonlyArray<string> = [];
+  private _installationBaseline: ReadonlyMap<string, string> | undefined;
+  private _changedInstallationPaths: ReadonlyArray<string> = [];
 
   /**
    * Implementation paths whose content or existence differs from the first capture using this cache.
@@ -301,6 +304,15 @@ export class WorkspaceRuntimeFingerprintCache {
     return this._changedPaths;
   }
 
+  /**
+   * Installation files, such as lockfiles and the flags that an install writes, whose content or existence
+   * differs from the first capture using this cache. Updated by each capture; metadata-only changes do not
+   * appear in this list.
+   */
+  public get changedInstallationPaths(): ReadonlyArray<string> {
+    return this._changedInstallationPaths;
+  }
+
   /** @internal */
   public _hashPaths(paths: ReadonlyArray<string>): string {
     const filenames: Set<string> = new Set();
@@ -334,13 +346,9 @@ export class WorkspaceRuntimeFingerprintCache {
         entries.push([filename, 'missing']);
       }
     }
-    const current: ReadonlyMap<string, string> = new Map(
-      entries.map((entry) => [entry[0], JSON.stringify(entry)])
-    );
+    const current: ReadonlyMap<string, string> = getEntryMap(entries);
     this._baseline ??= current;
-    this._changedPaths = Array.from(new Set([...this._baseline.keys(), ...current.keys()])).filter(
-      (filename) => this._baseline!.get(filename) !== current.get(filename)
-    );
+    this._changedPaths = getChangedPaths(this._baseline, current);
     return hashText(JSON.stringify(entries));
   }
 
@@ -350,6 +358,23 @@ export class WorkspaceRuntimeFingerprintCache {
    * @internal
    */
   public async _hashInputFilesAsync(filenames: Iterable<string>): Promise<string> {
+    return hashText(JSON.stringify(await this._getInputFileEntriesAsync(filenames)));
+  }
+
+  /**
+   * Hashes installation files as {@link WorkspaceRuntimeFingerprintCache._hashInputFilesAsync} does, and
+   * updates {@link WorkspaceRuntimeFingerprintCache.changedInstallationPaths}.
+   * @internal
+   */
+  public async _hashInstallationFilesAsync(filenames: Iterable<string>): Promise<string> {
+    const entries: ReadonlyArray<string>[] = await this._getInputFileEntriesAsync(filenames);
+    const current: ReadonlyMap<string, string> = getEntryMap(entries);
+    this._installationBaseline ??= current;
+    this._changedInstallationPaths = getChangedPaths(this._installationBaseline, current);
+    return hashText(JSON.stringify(entries));
+  }
+
+  private async _getInputFileEntriesAsync(filenames: Iterable<string>): Promise<ReadonlyArray<string>[]> {
     const settledBeforeNs: bigint = getSettledBeforeNs();
     const sortedFilenames: string[] = Array.from(filenames).sort();
     const entries: ReadonlyArray<string>[] = new Array(sortedFilenames.length);
@@ -393,10 +418,24 @@ export class WorkspaceRuntimeFingerprintCache {
       },
       { concurrency: 3 }
     );
-    return hashText(JSON.stringify(entries));
+    return entries;
   }
 }
 
+function getEntryMap(entries: ReadonlyArray<ReadonlyArray<string>>): ReadonlyMap<string, string> {
+  return new Map(entries.map((entry) => [entry[0], JSON.stringify(entry)]));
+}
+
+/** Returns the paths whose entries differ between two captures, including paths that only one of them has. */
+function getChangedPaths(
+  baseline: ReadonlyMap<string, string>,
+  current: ReadonlyMap<string, string>
+): string[] {
+  return Array.from(new Set([...baseline.keys(), ...current.keys()])).filter(
+    (filename) => baseline.get(filename) !== current.get(filename)
+  );
+}
+
 /** The strongest action required by a workspace input change. @alpha */
 export enum WorkspaceInputChangeTier {
   Reuse = 0,
@@ -502,7 +541,7 @@ export async function captureWorkspaceInputFingerprintAsync(
   return {
     configurationHash: await cache._hashInputFilesAsync(definitions),
     environmentHash: hashText(JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment))),
-    installationHash: await cache._hashInputFilesAsync(installation),
+    installationHash: await cache._hashInstallationFilesAsync(installation),
     runtimeHash: hashText(JSON.stringify([process.execPath, process.version, runtimeHash])),
     selectedRushVersion: environment.RUSH_PREVIEW_VERSION ?? rushJson.rushVersion
   };
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 203d82216f..2f2638fe4a 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -527,10 +527,18 @@ describe('workspace input fingerprints', () => {
       expect(classifyWorkspaceInputChange(retargeted, removed)).toBe(WorkspaceInputChangeTier.Reload);
       write('a/package.json', '{"name":"a","version":"1.0.1"}');
       expect(await captureAsync()).toEqual([retargeted, 1]);
+      expect(runtimeCache.changedInstallationPaths).toEqual([]);
       // An installation file
       write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 10');
       const [installed] = await captureAsync();
       expect(classifyWorkspaceInputChange(retargeted, installed)).toBe(WorkspaceInputChangeTier.Restart);
+      const lockfilePath: string = path.join(rushConfiguration.commonRushConfigFolder, 'pnpm-lock.yaml');
+      expect(runtimeCache.changedInstallationPaths).toEqual([lockfilePath]);
+      // Content, not the edit, identifies the installation.
+      write('common/config/rush/pnpm-lock.yaml', 'lockfileVersion: 1');
+      const [restored] = await captureAsync();
+      expect(restored.installationHash).toBe(first.installationHash);
+      expect(runtimeCache.changedInstallationPaths).toEqual([]);
     } finally {
       jest.restoreAllMocks();
       fs.rmSync(folder, { recursive: true, force: true });

From 23c3e882588bc5eedf5dac1048a2979f23d60edc Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:04:01 +0000
Subject: [PATCH 080/265] [rush-lib] A warm daemon request parses its command
 line once

Swarm integration step 65; original commit a15fb1c70a (merge of swarm/r05-t146-int3 at d46b1047e7).
Scope: task 146.

Brings r05's task 146 (board 2739, re-tipped in board 3163 and board 3403): a warm request parses its command line once instead of twice, and re-derives a JSON configuration file only when the file's text changed. 146-int3 adds 170-int and the one-line test fix that ch01's BLOCK board 3328 asked for. Second agent: t01 board 2912.

s17 batch D2, item 3 of 6. Gate: ch01 GATE OK board 3514 (tree 0e2dfdba29)

Commits folded into this step (3):
- 475db85a16 [rush-lib] An engine host parses each JSON configuration file again only if its text changed (task 146)
- 4937fb600d [rush-daemon] Parse the command line of a warm request once, not twice (task 146)
- d46b1047e7 rush-daemon: expect the error before the reused parse's diagnostics, as task 170 orders them (task 146, ch01 board 3328)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...gine-json-load-cache_2026-09-28-23-50.json |  10 +
 ...identity-parse-reuse_2026-09-29-00-22.json |  10 +
 .../src/ProductionDaemonRequestResolver.ts    |  83 ++++++--
 .../test/ProductionDaemonRequestParse.test.ts | 195 ++++++++++++++++++
 .../ProductionDaemonRequestResolver.test.ts   |  17 ++
 .../src/api/CommandLineConfiguration.ts       |  68 +++---
 .../src/api/test/PhasedCommandEngine.test.ts  | 185 +++++++++++++++++
 .../rush-lib/src/cli/RushCommandLineParser.ts |  15 +-
 .../cli/scriptActions/GlobalScriptAction.ts   |  14 +-
 .../PluginLoader/PluginLoaderBase.ts          |  18 +-
 .../src/pluginFramework/PluginManager.ts      |   9 +-
 .../src/utilities/JsonFileLoadCache.ts        |  78 +++++++
 .../utilities/test/JsonFileLoadCache.test.ts  | 147 +++++++++++++
 13 files changed, 790 insertions(+), 59 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r05-engine-json-load-cache_2026-09-28-23-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-identity-parse-reuse_2026-09-29-00-22.json
 create mode 100644 libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
 create mode 100644 libraries/rush-lib/src/utilities/JsonFileLoadCache.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-r05-engine-json-load-cache_2026-09-28-23-50.json b/common/changes/@microsoft/rush/swarm-r05-engine-json-load-cache_2026-09-28-23-50.json
new file mode 100644
index 0000000000..55b3fff124
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r05-engine-json-load-cache_2026-09-28-23-50.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "A long-lived engine host parses and validates command-line.json, plugin manifests and plugin command-line.json files, and autoinstaller package.json files again only if their text changed since the host's last parse.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-identity-parse-reuse_2026-09-29-00-22.json b/common/changes/@rushstack/rush-daemon/swarm-r05-identity-parse-reuse_2026-09-29-00-22.json
new file mode 100644
index 0000000000..6c0f329cc7
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-identity-parse-reuse_2026-09-29-00-22.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The production resolver parses the command line of a warm request once instead of twice. It resolves the request with the parse from the request's identity check, and parses again if the request's command line, environment or session changed.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 30affd7246..2fbcf08eee 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -19,7 +19,7 @@ import {
   type Operation,
   type OperationEnabledState
 } from '@microsoft/rush-lib';
-import type { IDaemonPhasedOperationSelection } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPhasedOperationSelection, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
 import {
   DaemonRequestDispatchError,
@@ -42,6 +42,14 @@ import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
 import { createInputsCompatibilityCheck, getOperationsWithChangedInputs } from './WorkspaceInputsComparison';
 import { createDaemonRequestTelemetrySink, type IDaemonEngineCreationTiming } from './DaemonRequestTelemetry';
 
+/** A native parse of the command line of a request. */
+interface IParsedCommand {
+  readonly command: PhasedCommandEngine;
+  readonly terminal: EngineTerminalProvider;
+  readonly envelope: IDaemonRequestEnvelope;
+  readonly workspaceSession: IWorkspaceSession;
+}
+
 /**
  * Binds the standalone host to a real native build/rebuild graph on its first request.
  *
@@ -68,6 +76,9 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   /** The daemon's environment when it started. Replacement sessions keep it; see `createForSession`. */
   readonly #startupEnvironment: Readonly<Record<string, string | undefined>>;
   readonly #validateGraphInputsAsync: (() => Promise<void>) | undefined;
+  // The workspace lifecycle checks the command identity of a request, and then resolves the request under the same
+  // admission lease. Keyed by the abort signal of the request, a parse is kept only as long as its request.
+  readonly #identityParses: WeakMap<AbortSignal, IParsedCommand> = new WeakMap();
 
   public constructor(options?: {
     readonly preparationLock?: LockFile;
@@ -102,14 +113,19 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
 
   /** Inspects the native command shape without constructing or executing an operation graph. */
   public async getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string> {
-    return (await this.#parseCommandAsync(options, new EngineTerminalProvider())).parameterIdentity;
+    const parsed: IParsedCommand = await this.#parseCommandAsync(options);
+    // Resolving the same request uses this parse instead of parsing the same command line again.
+    this.#identityParses.set(options.abortSignal, parsed);
+    return parsed.command.parameterIdentity;
   }
 
   public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
     const resolveStartTimeMs: number = performance.now();
     const { envelope, workspaceSession } = options;
-    const terminal: EngineTerminalProvider = new EngineTerminalProvider();
-    const command: PhasedCommandEngine = await this.#parseCommandAsync(options, terminal);
+    const { command, terminal }: IParsedCommand = await this.#parseCommandAsync(
+      options,
+      this.#takeIdentityParse(options)
+    );
     let bindingStartTimeMs: number | undefined;
     if (this.#binding) {
       if (
@@ -191,10 +207,17 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     };
   }
 
+  /** Returns the parse of the identity check of this request, if its command line and session are unchanged. */
+  #takeIdentityParse(options: IResolveDaemonRequestOptions): IParsedCommand | undefined {
+    const parsed: IParsedCommand | undefined = this.#identityParses.get(options.abortSignal);
+    this.#identityParses.delete(options.abortSignal);
+    return parsed && isSameCommandLine(parsed, options) ? parsed : undefined;
+  }
+
   async #parseCommandAsync(
     options: IResolveDaemonRequestOptions,
-    terminal: EngineTerminalProvider
-  ): Promise<PhasedCommandEngine> {
+    identityParse?: IParsedCommand
+  ): Promise<IParsedCommand> {
     const { envelope, workspaceSession, abortSignal } = options;
     if (!['build', 'rebuild'].includes(envelope.commandName) || envelope.commandOrigin !== 'built-in') {
       throw new DaemonRequestDispatchError(
@@ -216,23 +239,27 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           'may have changed process.env. Restart the daemon or use --no-daemon.'
       );
     }
-    let command: PhasedCommandEngine;
-    try {
-      command = await PhasedCommandEngine.parseAsync({
-        argv: envelope.argv,
-        cwd: envelope.cwd,
-        environment: envelope.environment,
-        rushConfiguration: workspaceSession.rushConfiguration,
-        terminalProvider: terminal
-      });
-    } catch (error) {
-      // Answer only for a command line of the requested command; in-process Rush reports any other one.
-      if (error instanceof PhasedCommandEngineUsageError && envelope.argv[0] === envelope.commandName) {
-        throw new DaemonRequestUsageError(terminal.describeError(error), error.exitCode, { cause: error });
+    let parsed: IParsedCommand | undefined = identityParse;
+    if (!parsed) {
+      const terminal: EngineTerminalProvider = new EngineTerminalProvider();
+      try {
+        const command: PhasedCommandEngine = await PhasedCommandEngine.parseAsync({
+          argv: envelope.argv,
+          cwd: envelope.cwd,
+          environment: envelope.environment,
+          rushConfiguration: workspaceSession.rushConfiguration,
+          terminalProvider: terminal
+        });
+        parsed = { command, terminal, envelope, workspaceSession };
+      } catch (error) {
+        // Answer only for a command line of the requested command; in-process Rush reports any other one.
+        if (error instanceof PhasedCommandEngineUsageError && envelope.argv[0] === envelope.commandName) {
+          throw new DaemonRequestUsageError(terminal.describeError(error), error.exitCode, { cause: error });
+        }
+        throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
       }
-      throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
     }
-    if (command.commandName !== envelope.commandName) {
+    if (parsed.command.commandName !== envelope.commandName) {
       throw new DaemonRequestDispatchError(
         'invalidRequest',
         'The command name does not match the native parsed argv.'
@@ -244,7 +271,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         getDaemonShutdownReason(abortSignal)?.message ??
           'The request was cancelled before engine initialization.'
       );
-    return command;
+    return parsed;
   }
 
   /**
@@ -386,6 +413,18 @@ function environmentIdentity(environment: Readonly<Record<string, string | undef
   return JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment));
 }
 
+/** Whether a parse has exactly the inputs that parsing the command line of this request would have. */
+function isSameCommandLine(parsed: IParsedCommand, options: IResolveDaemonRequestOptions): boolean {
+  const { envelope, workspaceSession } = options;
+  return (
+    parsed.workspaceSession === workspaceSession &&
+    parsed.envelope.requestId === envelope.requestId &&
+    parsed.envelope.argv === envelope.argv &&
+    parsed.envelope.cwd === envelope.cwd &&
+    parsed.envelope.environment === envelope.environment
+  );
+}
+
 /** The value of one variable as {@link getWorkspaceFingerprintEnvironmentEntries} records it, if it is set. */
 function getFingerprintValue(name: string, value: string | undefined): string | undefined {
   return value === undefined
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
new file mode 100644
index 0000000000..65fa44b3c0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
@@ -0,0 +1,195 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+import * as v8 from 'node:v8';
+import * as vm from 'node:vm';
+
+import { PhasedCommandEngine, type IParsePhasedCommandOptions } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import { TerminalProviderSeverity } from '@rushstack/terminal';
+
+import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import type { IWorkspaceSession } from '../WorkspaceSession';
+import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+
+function createSession(): IWorkspaceSession {
+  // The native engine is already bound, so that a resolution only parses and selects operations.
+  return {
+    rushConfiguration: {},
+    operationGraph: {},
+    engineShape: {},
+    initializeEngineAsync: async () => undefined
+  } as unknown as IWorkspaceSession;
+}
+
+function createOptions(
+  workspaceSession: IWorkspaceSession,
+  abortController: AbortController = new AbortController()
+): IResolveDaemonRequestOptions {
+  return {
+    abortSignal: abortController.signal,
+    envelope: createWireEnvelope('request', 'build', process.cwd(), {
+      commandOrigin: 'built-in',
+      environment: Object.fromEntries(
+        Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
+      )
+    }),
+    workspaceSession
+  };
+}
+
+/** Checks the identity of a request, which is unreachable when this returns. */
+async function checkIdentityAsync(
+  resolver: ProductionDaemonRequestResolver,
+  session: IWorkspaceSession
+): Promise<void> {
+  await resolver.getCommandParameterIdentityAsync(createOptions(session));
+}
+
+/** The workspace lifecycle resolves a request with a copy of the envelope of its identity check. */
+function dispatched(options: IResolveDaemonRequestOptions): IResolveDaemonRequestOptions {
+  return { ...options, envelope: { ...options.envelope, admission: { waitTimeoutMs: 1000 } } };
+}
+
+describe('ProductionDaemonRequestResolver command line parsing', () => {
+  let parses: number;
+  let selectionError: Error | undefined;
+  let commands: WeakRef<PhasedCommandEngine>[];
+  let parse: jest.SpyInstance;
+
+  beforeEach(() => {
+    parses = 0;
+    selectionError = undefined;
+    commands = [];
+    parse = jest
+      .spyOn(PhasedCommandEngine, 'parseAsync')
+      .mockImplementation(async ({ terminalProvider }: IParsePhasedCommandOptions) => {
+        terminalProvider.write(`Warning from parse ${++parses}\n`, TerminalProviderSeverity.warning);
+        const command: PhasedCommandEngine = {
+          commandName: 'build',
+          parameterIdentity: 'parameters',
+          requestSettings: {},
+          unmatchedCompatiblePluginNames: [],
+          selectOperationsAsync: async () => {
+            if (selectionError) throw selectionError;
+            return new Map();
+          }
+        } as unknown as PhasedCommandEngine;
+        commands.push(new WeakRef(command));
+        return command;
+      });
+  });
+
+  afterEach(() => {
+    parse.mockRestore();
+  });
+
+  it('resolves a request with the parse of its identity check', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+    await expect(resolver.resolveRequestAsync(dispatched(options))).resolves.toMatchObject({
+      kind: 'phased',
+      request: { requestId: 'request' }
+    });
+    expect(parses).toBe(1);
+  });
+
+  it('reports the diagnostics of the parse that it reused with a selection error', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const session: IWorkspaceSession = createSession();
+    await resolver.resolveRequestAsync(createOptions(session));
+    const options: IResolveDaemonRequestOptions = createOptions(session);
+    await resolver.getCommandParameterIdentityAsync(options);
+    selectionError = new Error('The project name "nope" does not exist.');
+    await expect(resolver.resolveRequestAsync(dispatched(options))).rejects.toMatchObject({
+      code: 'invalidRequest',
+      message: 'The project name "nope" does not exist.\nWarning from parse 2'
+    });
+    expect(parses).toBe(2);
+  });
+
+  it.each<[string, (envelope: IDaemonRequestEnvelope) => Partial<IDaemonRequestEnvelope>]>([
+    ['another request', () => ({ requestId: 'another' })],
+    ['another argv', ({ argv }) => ({ argv: [...argv] })],
+    ['another working folder', ({ cwd }) => ({ cwd: path.dirname(cwd) })],
+    ['another environment', ({ environment }) => ({ environment: { ...environment } })]
+  ])('parses again to resolve %s', async (name, change) => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.resolveRequestAsync({
+      ...options,
+      envelope: { ...options.envelope, ...change(options.envelope) }
+    });
+    expect(parses).toBe(2);
+  });
+
+  it('parses again to resolve a request for another session, or with another resolver', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.resolveRequestAsync({ ...options, workspaceSession: createSession() });
+    expect(parses).toBe(2);
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.createForSession().resolveRequestAsync(dispatched(options));
+    expect(parses).toBe(4);
+  });
+
+  it('uses the parse of an identity check for only one resolution', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession());
+    await resolver.getCommandParameterIdentityAsync(options);
+    await resolver.resolveRequestAsync(dispatched(options));
+    await resolver.resolveRequestAsync(dispatched(options));
+    expect(parses).toBe(2);
+  });
+
+  it('rejects a request that was cancelled after its identity check', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const abortController: AbortController = new AbortController();
+    const options: IResolveDaemonRequestOptions = createOptions(createSession(), abortController);
+    await resolver.getCommandParameterIdentityAsync(options);
+    abortController.abort();
+    await expect(resolver.resolveRequestAsync(dispatched(options))).rejects.toMatchObject({
+      code: 'routingFailed',
+      message: 'The request was cancelled before engine initialization.'
+    });
+    expect(parses).toBe(1);
+  });
+
+  it('rejects a request if the daemon environment changed after its identity check', async () => {
+    // A name that a plugin adds to the daemon's environment is not a change, so this changes a startup name.
+    process.env.RUSHD_TEST_REQUEST_PARSE = 'startup';
+    try {
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const options: IResolveDaemonRequestOptions = createOptions(createSession());
+      await resolver.getCommandParameterIdentityAsync(options);
+      process.env.RUSHD_TEST_REQUEST_PARSE = 'changed';
+      await expect(resolver.resolveRequestAsync(dispatched(options))).rejects.toMatchObject({
+        code: 'unsupported',
+        message: expect.stringContaining(
+          "The daemon's own environment changed after it started (RUSHD_TEST_REQUEST_PARSE)"
+        )
+      });
+      expect(parses).toBe(1);
+    } finally {
+      delete process.env.RUSHD_TEST_REQUEST_PARSE;
+    }
+  });
+
+  it('keeps the parse of an identity check only as long as its request', async () => {
+    v8.setFlagsFromString('--expose-gc');
+    const collectGarbage: () => void = vm.runInNewContext('gc');
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    await checkIdentityAsync(resolver, createSession());
+    parse.mockClear();
+    // A WeakRef keeps its target until the current job ends.
+    await new Promise((resolve) => setImmediate(resolve));
+    collectGarbage();
+    expect(commands).toHaveLength(1);
+    expect(commands[0].deref()).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 49cccacad6..d98b5f0340 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -238,6 +238,23 @@ describe('native production daemon engine', () => {
     }
   });
 
+  it('parses the command line of a warm request once, for its identity check and its resolution', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const parse: jest.SpyInstance = jest.spyOn(PhasedCommandEngine, 'parseAsync');
+    try {
+      await runAsync(fixture, 'cold-parse', ['build', '--only', 'a']);
+      parse.mockClear();
+      expect((await runAsync(fixture, 'warm-parse', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(parse).toHaveBeenCalledTimes(1);
+    } finally {
+      parse.mockRestore();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('serves client output and request-scoped settings in the same generation instead of restarting', async () => {
     const fixture: IFixture = await createFixtureAsync();
     try {
diff --git a/libraries/rush-lib/src/api/CommandLineConfiguration.ts b/libraries/rush-lib/src/api/CommandLineConfiguration.ts
index 8ec4b5a3de..7423e3cf95 100644
--- a/libraries/rush-lib/src/api/CommandLineConfiguration.ts
+++ b/libraries/rush-lib/src/api/CommandLineConfiguration.ts
@@ -1,10 +1,11 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { JsonFile, JsonSchema, FileSystem } from '@rushstack/node-core-library';
+import { JsonSchema, FileSystem } from '@rushstack/node-core-library';
 import type { CommandLineParameter } from '@rushstack/ts-command-line';
 
 import { RushConstants } from '../logic/RushConstants';
+import { type JsonFileLoadCache, loadJsonFile } from '../utilities/JsonFileLoadCache';
 import type {
   CommandJson,
   ICommandLineJson,
@@ -635,11 +636,19 @@ export class CommandLineConfiguration {
    * use {@see loadFromFileOrDefault} instead.
    *
    * If the file does not exist, this function returns `undefined`
+   *
+   * @param jsonFileLoadCache - The cache of a long-lived engine host, which parses the file again only if it changed.
    */
-  public static tryLoadFromFile(jsonFilePath: string): CommandLineConfiguration | undefined {
+  public static tryLoadFromFile(
+    jsonFilePath: string,
+    jsonFileLoadCache?: JsonFileLoadCache
+  ): CommandLineConfiguration | undefined {
     let commandLineJson: ICommandLineJson | undefined;
     try {
-      commandLineJson = JsonFile.loadAndValidate(jsonFilePath, _jsonSchema);
+      commandLineJson = loadJsonFile(jsonFileLoadCache, jsonFilePath, (json) => {
+        _jsonSchema.validateObject(json, jsonFilePath);
+        return json as ICommandLineJson;
+      });
     } catch (e) {
       if (!FileSystem.isNotExistError(e as Error)) {
         throw e;
@@ -667,39 +676,25 @@ export class CommandLineConfiguration {
    * Loads the configuration from the specified file and applies any omitted default build
    * settings.  If the file does not exist, then a default instance is returned.
    * If the file contains errors, then an exception is thrown.
+   *
+   * @param jsonFileLoadCache - The cache of a long-lived engine host, which parses the file again only if it changed.
    */
   public static loadFromFileOrDefault(
     jsonFilePath?: string,
-    doNotIncludeDefaultBuildCommands?: boolean
+    doNotIncludeDefaultBuildCommands?: boolean,
+    jsonFileLoadCache?: JsonFileLoadCache
   ): CommandLineConfiguration {
     let commandLineJson: ICommandLineJson | undefined = undefined;
     if (jsonFilePath) {
       try {
-        commandLineJson = JsonFile.load(jsonFilePath);
+        commandLineJson = loadJsonFile(jsonFileLoadCache, jsonFilePath, (json) =>
+          _prepareRepoCommandLineJson(json as ICommandLineJson, jsonFilePath)
+        );
       } catch (e) {
         if (!FileSystem.isNotExistError(e as Error)) {
           throw e;
         }
       }
-
-      // merge commands specified in command-line.json and default (re)build settings
-      // Ensure both build commands are included and preserve any other commands specified
-      if (commandLineJson?.commands) {
-        _applyBuildCommandDefaults(commandLineJson);
-
-        _jsonSchema.validateObject(commandLineJson, jsonFilePath);
-
-        // Validate that globalPlugin commands are not used in the repo's command-line.json
-        for (const { commandKind, name } of commandLineJson.commands) {
-          if (commandKind === RushConstants.globalPluginCommandKind) {
-            throw new Error(
-              `${RushConstants.commandLineFilename} defines a command "${name}" using ` +
-                `the command kind "${RushConstants.globalPluginCommandKind}". This command kind can only ` +
-                `be used in command-line.json files provided by Rush plugins.`
-            );
-          }
-        }
-      }
     }
 
     return new CommandLineConfiguration(commandLineJson, { doNotIncludeDefaultBuildCommands });
@@ -751,6 +746,31 @@ export class CommandLineConfiguration {
   }
 }
 
+function _prepareRepoCommandLineJson(
+  commandLineJson: ICommandLineJson,
+  jsonFilePath: string
+): ICommandLineJson {
+  // merge commands specified in command-line.json and default (re)build settings
+  // Ensure both build commands are included and preserve any other commands specified
+  if (commandLineJson?.commands) {
+    _applyBuildCommandDefaults(commandLineJson);
+
+    _jsonSchema.validateObject(commandLineJson, jsonFilePath);
+
+    // Validate that globalPlugin commands are not used in the repo's command-line.json
+    for (const { commandKind, name } of commandLineJson.commands) {
+      if (commandKind === RushConstants.globalPluginCommandKind) {
+        throw new Error(
+          `${RushConstants.commandLineFilename} defines a command "${name}" using ` +
+            `the command kind "${RushConstants.globalPluginCommandKind}". This command kind can only ` +
+            `be used in command-line.json files provided by Rush plugins.`
+        );
+      }
+    }
+  }
+  return commandLineJson;
+}
+
 function _applyBuildCommandDefaults(commandLineJson: ICommandLineJson): void {
   // merge commands specified in command-line.json and default (re)build settings
   // Ensure both build commands are included and preserve any other commands specified
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index acef36cc56..82669036fb 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -5,11 +5,15 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { FileSystem, JsonFile } from '@rushstack/node-core-library';
 import { NoOpTerminalProvider, StringBufferTerminalProvider } from '@rushstack/terminal';
 
 import { PhasedCommandEngine } from '../PhasedCommandEngine';
 import { PhasedCommandEngineUsageError } from '../PhasedCommandEngineUsageError';
 import { RushConfiguration } from '../RushConfiguration';
+import { EnvironmentConfiguration } from '../EnvironmentConfiguration';
+import { RushCommandLineParser } from '../../cli/RushCommandLineParser';
+import { JsonFileLoadCache } from '../../utilities/JsonFileLoadCache';
 
 const PACKAGE_NAME: string = '@example/rush-example-plugin';
 const PLUGIN_NAME: string = 'rush-example-plugin';
@@ -402,4 +406,185 @@ describe(PhasedCommandEngine.name, () => {
       );
     });
   });
+
+  describe('JSON configuration files of parses that share a workspace configuration', () => {
+    const REPO_COMMAND_LINE_PATH: string = 'common/config/rush/command-line.json';
+    const AUTOINSTALLER_PACKAGE_JSON_PATH: string = 'common/autoinstallers/plugins/package.json';
+    const PLUGIN_STORE_FOLDER: string = `common/autoinstallers/plugins/rush-plugins/${PACKAGE_NAME}`;
+    const MANIFEST_PATH: string = `${PLUGIN_STORE_FOLDER}/rush-plugin-manifest.json`;
+    const PLUGIN_COMMAND_LINE_PATH: string = `${PLUGIN_STORE_FOLDER}/${PLUGIN_NAME}/command-line.json`;
+    const EXAMPLE_MODE_PARAMETER: object = {
+      parameterKind: 'choice',
+      longName: '--example-mode',
+      description: 'An example mode.',
+      associatedCommands: ['build'],
+      alternatives: [
+        { name: 'on', description: 'On.' },
+        { name: 'off', description: 'Off.' }
+      ],
+      defaultValue: 'on'
+    };
+    // A global command whose autoinstaller's package.json Rush reads while it parses any command line.
+    const GLOBAL_COMMAND_LINE_JSON: object = {
+      ...REPO_COMMAND_LINE_JSON,
+      commands: [
+        ...(REPO_COMMAND_LINE_JSON as { commands: object[] }).commands,
+        {
+          commandKind: 'global',
+          name: 'example-global',
+          summary: 'An example.',
+          shellCommand: 'node example.js',
+          autoinstallerName: 'plugins'
+        }
+      ]
+    };
+
+    interface IManifestJson {
+      plugins: { associatedCommands: string[] }[];
+    }
+
+    function createSharedConfigurationRepo(): RushConfiguration {
+      const folder: string = createTestRepo(
+        { associatedCommands: [PLUGIN_COMMAND], commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON },
+        { commandLineJson: GLOBAL_COMMAND_LINE_JSON }
+      );
+      return RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+    }
+
+    function editJson<T>(rushConfiguration: RushConfiguration, relativePath: string, edit: (json: T) => void): void {
+      const filePath: string = path.join(rushConfiguration.rushJsonFolder, relativePath);
+      const json: T = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      edit(json);
+      fs.writeFileSync(filePath, JSON.stringify(json));
+    }
+
+    async function parseAsync(
+      rushConfiguration: RushConfiguration,
+      argv: string[] = ['build']
+    ): Promise<PhasedCommandEngine> {
+      return await PhasedCommandEngine.parseAsync({
+        argv,
+        cwd: rushConfiguration.rushJsonFolder,
+        rushConfiguration,
+        terminalProvider: new NoOpTerminalProvider()
+      });
+    }
+
+    async function getParseErrorAsync(rushConfiguration: RushConfiguration): Promise<Error | undefined> {
+      return await parseAsync(rushConfiguration).then(
+        () => undefined,
+        (error: Error) => error
+      );
+    }
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+
+    it('sees each change to the repository command-line.json', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await expect(parseAsync(rushConfiguration, ['build', '--example-mode', 'off'])).rejects.toThrow(
+        '--example-mode'
+      );
+
+      editJson<{ parameters?: object[] }>(rushConfiguration, REPO_COMMAND_LINE_PATH, (json) => {
+        json.parameters = [EXAMPLE_MODE_PARAMETER];
+      });
+      const offIdentity: string = (await parseAsync(rushConfiguration, ['build', '--example-mode', 'off']))
+        .parameterIdentity;
+      expect((await parseAsync(rushConfiguration)).parameterIdentity).not.toBe(offIdentity);
+    });
+
+    it('reports an invalid repository command-line.json for every parse, as a parse without the cache does', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await parseAsync(rushConfiguration);
+
+      editJson<{ unknownSetting?: boolean }>(rushConfiguration, REPO_COMMAND_LINE_PATH, (json) => {
+        json.unknownSetting = true;
+      });
+      const error: Error | undefined = await getParseErrorAsync(rushConfiguration);
+      expect(error?.message).toMatch(/command-line\.json/);
+      expect((await getParseErrorAsync(rushConfiguration))?.message).toBe(error?.message);
+      await expect(parseBuildAsync(rushConfiguration.rushJsonFolder)).rejects.toThrow(error?.message);
+
+      editJson<{ unknownSetting?: boolean }>(rushConfiguration, REPO_COMMAND_LINE_PATH, (json) => {
+        delete json.unknownSetting;
+      });
+      await expect(parseAsync(rushConfiguration)).resolves.toBeInstanceOf(PhasedCommandEngine);
+    });
+
+    it("sees each change to a plugin's manifest and command-line.json", async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await expect(parseAsync(rushConfiguration)).resolves.toBeInstanceOf(PhasedCommandEngine);
+
+      editJson<IManifestJson>(rushConfiguration, MANIFEST_PATH, (manifest) => {
+        manifest.plugins[0].associatedCommands.push('build');
+      });
+      await expect(parseAsync(rushConfiguration)).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) is associated with "build"`
+      );
+
+      editJson<IManifestJson>(rushConfiguration, MANIFEST_PATH, (manifest) => {
+        manifest.plugins[0].associatedCommands.pop();
+      });
+      fs.writeFileSync(
+        path.join(rushConfiguration.rushJsonFolder, PLUGIN_COMMAND_LINE_PATH),
+        JSON.stringify(PHASE_SHAPING_COMMAND_LINE_JSON)
+      );
+      await expect(parseAsync(rushConfiguration)).rejects.toThrow(
+        `"${PLUGIN_NAME}" (${PACKAGE_NAME}) associates "--example-flag" with the "_phase:build" phase`
+      );
+    });
+
+    it("sees each change to the package.json of a global command's autoinstaller", async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      await expect(parseAsync(rushConfiguration)).resolves.toBeInstanceOf(PhasedCommandEngine);
+
+      editJson<{ name: string }>(rushConfiguration, AUTOINSTALLER_PACKAGE_JSON_PATH, (packageJson) => {
+        packageJson.name = 'other';
+      });
+      await expect(parseAsync(rushConfiguration)).rejects.toThrow(
+        `specifies an "autoinstallerName" setting, but the package.json file's "name" field is not "plugins"`
+      );
+    });
+
+    it('reads each file for every parse, but parses it only if it changed', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      const filePaths: string[] = [
+        REPO_COMMAND_LINE_PATH,
+        AUTOINSTALLER_PACKAGE_JSON_PATH,
+        MANIFEST_PATH,
+        PLUGIN_COMMAND_LINE_PATH
+      ].map((relativePath) => path.join(rushConfiguration.rushJsonFolder, relativePath));
+      const texts: string[] = filePaths.map((filePath) => fs.readFileSync(filePath, 'utf8'));
+      await parseAsync(rushConfiguration);
+
+      const readFileSpy: jest.SpyInstance = jest.spyOn(FileSystem, 'readFile');
+      const loadSpy: jest.SpyInstance = jest.spyOn(JsonFile, 'load');
+      const parseStringSpy: jest.SpyInstance = jest.spyOn(JsonFile, 'parseString');
+      await parseAsync(rushConfiguration);
+
+      const readFilePaths: Set<string> = new Set(readFileSpy.mock.calls.map(([filePath]) => filePath));
+      expect(filePaths.filter((filePath) => !readFilePaths.has(filePath))).toEqual([]);
+      expect(loadSpy.mock.calls.filter(([filePath]) => filePaths.includes(filePath))).toEqual([]);
+      expect(parseStringSpy.mock.calls.filter(([text]) => texts.includes(text))).toEqual([]);
+    });
+
+    it('does not cache the files for a native command line', async () => {
+      const rushConfiguration: RushConfiguration = createSharedConfigurationRepo();
+      const cacheLoadSpy: jest.SpyInstance = jest.spyOn(JsonFileLoadCache.prototype, 'load');
+      const loadSpy: jest.SpyInstance = jest.spyOn(JsonFile, 'load');
+      // Engine parses in this process validated the environment, and a native parser must load .env files first.
+      EnvironmentConfiguration.reset();
+
+      const parser: RushCommandLineParser = new RushCommandLineParser({ cwd: rushConfiguration.rushJsonFolder });
+      expect(parser.getAction('example-global')).toBeDefined();
+      expect(cacheLoadSpy).not.toHaveBeenCalled();
+      const loadedFilePaths: Set<string> = new Set(loadSpy.mock.calls.map(([filePath]) => filePath));
+      expect(loadedFilePaths).toContain(path.join(rushConfiguration.rushJsonFolder, REPO_COMMAND_LINE_PATH));
+      expect(loadedFilePaths).toContain(
+        path.join(rushConfiguration.rushJsonFolder, AUTOINSTALLER_PACKAGE_JSON_PATH)
+      );
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/cli/RushCommandLineParser.ts b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
index 5c6cd6521e..70bbe7d2c8 100644
--- a/libraries/rush-lib/src/cli/RushCommandLineParser.ts
+++ b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
@@ -71,6 +71,7 @@ import { type IRushSessionReporterOptions, RushSession } from '../pluginFramewor
 import type { IBuiltInPluginConfiguration } from '../pluginFramework/PluginLoader/BuiltInPluginLoader';
 import { InitSubspaceAction } from './actions/InitSubspaceAction';
 import { RushAlerts } from '../utilities/RushAlerts';
+import { getEngineJsonFileLoadCache, type JsonFileLoadCache } from '../utilities/JsonFileLoadCache';
 import { initializeDotEnv } from '../logic/dotenv';
 import { measureAsyncFn } from '../utilities/performance';
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
@@ -187,6 +188,8 @@ export class RushCommandLineParser extends CommandLineParser {
   readonly #quietParameter: CommandLineFlagParameter;
   readonly #restrictConsoleOutput: boolean = RushCommandLineParser.shouldRestrictConsoleOutput();
   readonly #rushOptions: IRushCommandLineParserOptions;
+  /** For a parser that serves a long-lived engine host, the cache through which it reads JSON configuration files. */
+  readonly #jsonFileLoadCache: JsonFileLoadCache | undefined;
   readonly #terminalProvider: ITerminalProvider;
   readonly #terminal: Terminal;
   readonly #autocreateBuildCommand: boolean;
@@ -243,6 +246,9 @@ export class RushCommandLineParser extends CommandLineParser {
 
     this.#rushOptions = this.#normalizeOptions(options || {});
     const { cwd, alreadyReportedNodeTooNewError, builtInPluginConfigurations, reporter } = this.#rushOptions;
+    this.#jsonFileLoadCache = this.#rushOptions.engine
+      ? getEngineJsonFileLoadCache(this.#rushOptions.engine.rushConfiguration)
+      : undefined;
     const reporterTerminalProvider: ReporterTerminalProvider | undefined = reporter?.operationStreamEnabled
       ? new ReporterTerminalProvider()
       : undefined;
@@ -296,7 +302,8 @@ export class RushCommandLineParser extends CommandLineParser {
       terminal,
       builtInPluginConfigurations,
       restrictConsoleOutput: this.#restrictConsoleOutput,
-      rushGlobalFolder: this.rushGlobalFolder
+      rushGlobalFolder: this.rushGlobalFolder,
+      jsonFileLoadCache: this.#jsonFileLoadCache
     });
     if (this.#initializationFailed) {
       this.#autocreateBuildCommand = true;
@@ -583,7 +590,8 @@ export class RushCommandLineParser extends CommandLineParser {
 
     const commandLineConfiguration: CommandLineConfiguration = CommandLineConfiguration.loadFromFileOrDefault(
       commandLineConfigFilePath,
-      doNotIncludeDefaultBuildCommands
+      doNotIncludeDefaultBuildCommands,
+      this.#jsonFileLoadCache
     );
     this.#addCommandLineConfigActions(commandLineConfiguration);
   }
@@ -661,7 +669,8 @@ export class RushCommandLineParser extends CommandLineParser {
 
         shellCommand,
         autoinstallerName,
-        providedByPlugin
+        providedByPlugin,
+        jsonFileLoadCache: this.#jsonFileLoadCache
       })
     );
   }
diff --git a/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts
index 421bd5adea..ad541948cc 100644
--- a/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/GlobalScriptAction.ts
@@ -9,7 +9,6 @@ import type { CommandLineParameter } from '@rushstack/ts-command-line';
 import {
   FileSystem,
   type IPackageJson,
-  JsonFile,
   AlreadyReportedError,
 } from '@rushstack/node-core-library';
 import { Colorize } from '@rushstack/terminal';
@@ -22,6 +21,7 @@ import { Autoinstaller } from '../../logic/Autoinstaller';
 import { RushConstants } from '../../logic/RushConstants';
 import type { IGlobalCommandConfig, IShellCommandTokenContext } from '../../api/CommandLineConfiguration';
 import { measureAsyncFn } from '../../utilities/performance';
+import { type JsonFileLoadCache, loadJsonFile } from '../../utilities/JsonFileLoadCache';
 
 /**
  * Constructor parameters for GlobalScriptAction.
@@ -30,6 +30,8 @@ export interface IGlobalScriptActionOptions extends IBaseScriptActionOptions<IGl
   shellCommand: string;
   autoinstallerName: string | undefined;
   providedByPlugin: boolean;
+  /** The cache of a long-lived engine host, through which the action reads its autoinstaller's package.json. */
+  jsonFileLoadCache?: JsonFileLoadCache;
 }
 
 /**
@@ -53,7 +55,7 @@ export class GlobalScriptAction extends BaseScriptAction<IGlobalCommandConfig> {
 
   public constructor(options: IGlobalScriptActionOptions) {
     super(options);
-    const { shellCommand, providedByPlugin, autoinstallerName = '' } = options;
+    const { shellCommand, providedByPlugin, autoinstallerName = '', jsonFileLoadCache } = options;
     this.#shellCommand = shellCommand;
     this.#providedByPlugin = providedByPlugin;
     this.#autoinstallerName = autoinstallerName;
@@ -85,9 +87,13 @@ export class GlobalScriptAction extends BaseScriptAction<IGlobalCommandConfig> {
         );
       }
 
-      const packageJson: IPackageJson = JsonFile.load(packageJsonPath);
+      const packageName: string | undefined = loadJsonFile(
+        jsonFileLoadCache,
+        packageJsonPath,
+        (packageJson) => (packageJson as IPackageJson).name
+      );
 
-      if (packageJson.name !== this.#autoinstallerName) {
+      if (packageName !== this.#autoinstallerName) {
         throw new Error(
           `The custom command "${this.actionName}" specifies an "autoinstallerName" setting,` +
             ` but the package.json file's "name" field is not "${this.#autoinstallerName}": ` +
diff --git a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
index 4c26791a62..a5c36b6bec 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
@@ -18,6 +18,7 @@ import { CommandLineConfiguration } from '../../api/CommandLineConfiguration';
 import type { RushConfiguration } from '../../api/RushConfiguration';
 import type { IRushPluginConfigurationBase } from '../../api/RushPluginsConfiguration';
 import { RushConstants } from '../../logic/RushConstants';
+import { type JsonFileLoadCache, loadJsonFile } from '../../utilities/JsonFileLoadCache';
 import type { IRushPlugin } from '../IRushPlugin';
 import { RushSdk } from './RushSdk';
 import schemaJson from '../../schemas/rush-plugin-manifest.schema.json';
@@ -42,6 +43,8 @@ export interface IPluginLoaderOptions<TPluginConfiguration extends IRushPluginCo
   pluginConfiguration: TPluginConfiguration;
   rushConfiguration: RushConfiguration;
   terminal: ITerminal;
+  /** The cache of a long-lived engine host, through which the loader reads the plugin's JSON files. */
+  jsonFileLoadCache?: JsonFileLoadCache;
 }
 
 export abstract class PluginLoaderBase<
@@ -56,6 +59,7 @@ export abstract class PluginLoaderBase<
 
   protected _manifestCache: Readonly<IRushPluginManifest> | undefined;
   #packageVersionCache: string | undefined;
+  readonly #jsonFileLoadCache: JsonFileLoadCache | undefined;
 
   /**
    * The folder that should be used for resolving the plugin's NPM package.
@@ -65,12 +69,14 @@ export abstract class PluginLoaderBase<
   public constructor({
     pluginConfiguration,
     rushConfiguration,
-    terminal
+    terminal,
+    jsonFileLoadCache
   }: IPluginLoaderOptions<TPluginConfiguration>) {
     this.packageName = pluginConfiguration.packageName;
     this.pluginName = pluginConfiguration.pluginName;
     this._rushConfiguration = rushConfiguration;
     this._terminal = terminal;
+    this.#jsonFileLoadCache = jsonFileLoadCache;
   }
 
   public load(): IRushPlugin | undefined {
@@ -109,7 +115,7 @@ export abstract class PluginLoaderBase<
       return undefined;
     }
     const commandLineConfiguration: CommandLineConfiguration | undefined =
-      CommandLineConfiguration.tryLoadFromFile(commandLineJsonFilePath);
+      CommandLineConfiguration.tryLoadFromFile(commandLineJsonFilePath, this.#jsonFileLoadCache);
     if (!commandLineConfiguration) {
       return undefined;
     }
@@ -230,9 +236,13 @@ export abstract class PluginLoaderBase<
         );
       }
 
-      const rushPluginManifestJson: IRushPluginManifestJson = JsonFile.loadAndValidate(
+      const rushPluginManifestJson: IRushPluginManifestJson = loadJsonFile(
+        this.#jsonFileLoadCache,
         manifestPath,
-        PluginLoaderBase._jsonSchema
+        (json) => {
+          PluginLoaderBase._jsonSchema.validateObject(json, manifestPath);
+          return json as IRushPluginManifestJson;
+        }
       );
 
       const pluginManifest: IRushPluginManifest | undefined = rushPluginManifestJson.plugins.find(
diff --git a/libraries/rush-lib/src/pluginFramework/PluginManager.ts b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
index e5c2223cdc..715742f15b 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginManager.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
@@ -15,6 +15,7 @@ import { Rush } from '../api/Rush';
 import type { RushGlobalFolder } from '../api/RushGlobalFolder';
 import { findNodeModulesPackageFolder } from '../utilities/RushLibPathHandoff';
 import { rushLibPathHandoff } from '../utilities/SetRushLibPath';
+import type { JsonFileLoadCache } from '../utilities/JsonFileLoadCache';
 
 export interface IPluginManagerOptions {
   terminal: ITerminal;
@@ -23,6 +24,8 @@ export interface IPluginManagerOptions {
   builtInPluginConfigurations: IBuiltInPluginConfiguration[];
   restrictConsoleOutput: boolean;
   rushGlobalFolder: RushGlobalFolder;
+  /** The cache of a long-lived engine host, through which plugin loaders read the plugins' JSON files. */
+  jsonFileLoadCache?: JsonFileLoadCache;
 }
 
 export interface ICustomCommandLineConfigurationInfo {
@@ -114,7 +117,8 @@ export class PluginManager {
       return new BuiltInPluginLoader({
         pluginConfiguration,
         rushConfiguration: this.#rushConfiguration,
-        terminal: this.#terminal
+        terminal: this.#terminal,
+        jsonFileLoadCache: options.jsonFileLoadCache
       });
     });
 
@@ -126,7 +130,8 @@ export class PluginManager {
         rushConfiguration: this.#rushConfiguration,
         terminal: this.#terminal,
         restrictConsoleOutput: this.#restrictConsoleOutput,
-        rushGlobalFolder: this.#rushGlobalFolder
+        rushGlobalFolder: this.#rushGlobalFolder,
+        jsonFileLoadCache: options.jsonFileLoadCache
       });
     });
   }
diff --git a/libraries/rush-lib/src/utilities/JsonFileLoadCache.ts b/libraries/rush-lib/src/utilities/JsonFileLoadCache.ts
new file mode 100644
index 0000000000..75814c86a2
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/JsonFileLoadCache.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { FileSystem, JsonFile, type JsonObject } from '@rushstack/node-core-library';
+
+import type { RushConfiguration } from '../api/RushConfiguration';
+
+interface ICacheEntry {
+  readonly text: string;
+  readonly value: unknown;
+}
+
+/**
+ * Memoizes what a long-lived engine host derives from each JSON configuration file, keyed by the file's text.
+ *
+ * @remarks
+ * The host parses a command line for every request, and each parse loads the same files: command-line.json, each
+ * plugin's manifest and command-line.json, and the package.json of each autoinstaller that a command names. Parsing
+ * and validating them costs several times what reading them does. A load through this cache still reads the file,
+ * so it sees the file as it is now, but it parses the text and derives the value again only if the text differs from
+ * the text of the file's last successful load. Each load returns its own copy of the value.
+ */
+export class JsonFileLoadCache {
+  readonly #entries: Map<string, ICacheEntry> = new Map();
+
+  /**
+   * Returns `deriveValue(JsonFile.load(filePath))`, and throws the errors that it would throw.
+   *
+   * @param deriveValue - Validates and transforms the file's contents. Its result must depend only on its argument
+   * (and on values that never change, such as the file path), and it must not keep a reference to its result.
+   */
+  public load<T>(filePath: string, deriveValue: (json: JsonObject) => T): T {
+    let text: string;
+    let value: T;
+    try {
+      text = FileSystem.readFile(filePath);
+      const entry: ICacheEntry | undefined = this.#entries.get(filePath);
+      if (entry?.text === text) {
+        return structuredClone(entry.value) as T;
+      }
+      value = deriveValue(JsonFile.parseString(text));
+    } catch (error) {
+      if (FileSystem.isNotExistError(error as Error)) {
+        // JsonFile.load throws this error as it is.
+        throw error;
+      }
+      // Load the file as a caller without this cache does, so that the error and its message are the same.
+      return deriveValue(JsonFile.load(filePath));
+    }
+    this.#entries.set(filePath, { text, value: structuredClone(value) });
+    return value;
+  }
+}
+
+/**
+ * Returns `deriveValue(JsonFile.load(filePath))`, through the cache if there is one.
+ */
+export function loadJsonFile<T>(
+  cache: JsonFileLoadCache | undefined,
+  filePath: string,
+  deriveValue: (json: JsonObject) => T
+): T {
+  return cache ? cache.load(filePath, deriveValue) : deriveValue(JsonFile.load(filePath));
+}
+
+const cachesByRushConfiguration: WeakMap<RushConfiguration, JsonFileLoadCache> = new WeakMap();
+
+/**
+ * The cache that every command line which a long-lived engine host parses for one workspace configuration shares.
+ */
+export function getEngineJsonFileLoadCache(rushConfiguration: RushConfiguration): JsonFileLoadCache {
+  let cache: JsonFileLoadCache | undefined = cachesByRushConfiguration.get(rushConfiguration);
+  if (!cache) {
+    cache = new JsonFileLoadCache();
+    cachesByRushConfiguration.set(rushConfiguration, cache);
+  }
+  return cache;
+}
diff --git a/libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts b/libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts
new file mode 100644
index 0000000000..e45310d501
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/JsonFileLoadCache.test.ts
@@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { FileSystem, JsonFile, type JsonObject } from '@rushstack/node-core-library';
+
+import type { RushConfiguration } from '../../api/RushConfiguration';
+import { getEngineJsonFileLoadCache, JsonFileLoadCache, loadJsonFile } from '../JsonFileLoadCache';
+
+interface IExample {
+  items: number[];
+}
+
+function deriveExample(json: JsonObject): IExample {
+  if (!Array.isArray(json.items)) {
+    throw new Error('"items" must be an array');
+  }
+  return { items: json.items };
+}
+
+function getError(fn: () => unknown): Error {
+  try {
+    fn();
+  } catch (error) {
+    return error as Error;
+  }
+  throw new Error('Expected an error');
+}
+
+describe(JsonFileLoadCache.name, () => {
+  let folder: string;
+  let filePath: string;
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-json-file-load-cache-'));
+    filePath = path.join(folder, 'example.json');
+  });
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+    jest.restoreAllMocks();
+  });
+
+  it('derives the value once while the text is unchanged, and returns a copy for each load', () => {
+    fs.writeFileSync(filePath, '{ "items": [1, 2] }');
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+    const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+
+    const first: IExample = cache.load(filePath, derive);
+    first.items.push(3);
+    const second: IExample = cache.load(filePath, derive);
+    second.items.push(4);
+
+    expect(cache.load(filePath, derive)).toEqual({ items: [1, 2] });
+    expect(second).not.toBe(first);
+    expect(derive).toHaveBeenCalledTimes(1);
+  });
+
+  it('reads the file for every load, and derives the value again when the text changes', () => {
+    fs.writeFileSync(filePath, '{ "items": [1] }');
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+    const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+    const { mtime } = fs.statSync(filePath);
+
+    expect(cache.load(filePath, derive)).toEqual({ items: [1] });
+    // The same size and modification time, which a cache keyed by file stamps could miss.
+    fs.writeFileSync(filePath, '{ "items": [2] }');
+    fs.utimesSync(filePath, mtime, mtime);
+    expect(cache.load(filePath, derive)).toEqual({ items: [2] });
+    expect(derive).toHaveBeenCalledTimes(2);
+  });
+
+  it('throws the errors that JsonFile.load and the derivation throw, and caches no failed load', () => {
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+
+    const expectedMissingError: Error = getError(() => JsonFile.load(filePath));
+    const readFileSpy: jest.SpyInstance = jest.spyOn(FileSystem, 'readFile');
+    const missingError: Error = getError(() => cache.load(filePath, deriveExample));
+    expect(FileSystem.isNotExistError(missingError)).toBe(true);
+    expect(missingError.message).toBe(expectedMissingError.message);
+    // The cache does not read a missing file twice.
+    expect(readFileSpy).toHaveBeenCalledTimes(1);
+
+    const expectedFolderError: Error = getError(() => JsonFile.load(folder));
+    expect(expectedFolderError.message).toContain('Error reading');
+    expect(() => cache.load(folder, deriveExample)).toThrow(expectedFolderError.message);
+
+    fs.writeFileSync(filePath, '{ "items": [1] ');
+    const expectedParseError: Error = getError(() => JsonFile.load(filePath));
+    expect(expectedParseError.message).toContain('Error reading');
+    expect(() => cache.load(filePath, deriveExample)).toThrow(expectedParseError.message);
+
+    fs.writeFileSync(filePath, '{ "items": 1 }');
+    for (let i: number = 0; i < 2; i++) {
+      expect(() => cache.load(filePath, deriveExample)).toThrow('"items" must be an array');
+    }
+
+    fs.writeFileSync(filePath, '{ "items": [1] }');
+    expect(cache.load(filePath, deriveExample)).toEqual({ items: [1] });
+  });
+
+  it('keeps an entry for each file', () => {
+    const otherFilePath: string = path.join(folder, 'other.json');
+    fs.writeFileSync(filePath, '{ "items": [1] }');
+    fs.writeFileSync(otherFilePath, '{ "items": [2] }');
+    const cache: JsonFileLoadCache = new JsonFileLoadCache();
+    const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+
+    for (let i: number = 0; i < 2; i++) {
+      expect(cache.load(filePath, derive)).toEqual({ items: [1] });
+      expect(cache.load(otherFilePath, derive)).toEqual({ items: [2] });
+    }
+    expect(derive).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe(loadJsonFile.name, () => {
+  it('loads and derives the value for every call without a cache', () => {
+    const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-json-file-load-cache-'));
+    try {
+      const filePath: string = path.join(folder, 'example.json');
+      fs.writeFileSync(filePath, '{ "items": [1] }');
+      const derive: jest.Mock<IExample, [JsonObject]> = jest.fn(deriveExample);
+      expect(loadJsonFile(undefined, filePath, derive)).toEqual({ items: [1] });
+      expect(loadJsonFile(undefined, filePath, derive)).toEqual({ items: [1] });
+      expect(derive).toHaveBeenCalledTimes(2);
+
+      const cache: JsonFileLoadCache = new JsonFileLoadCache();
+      expect(loadJsonFile(cache, filePath, derive)).toEqual({ items: [1] });
+      expect(loadJsonFile(cache, filePath, derive)).toEqual({ items: [1] });
+      expect(derive).toHaveBeenCalledTimes(3);
+    } finally {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+});
+
+describe(getEngineJsonFileLoadCache.name, () => {
+  it('shares one cache for each workspace configuration', () => {
+    const configuration: RushConfiguration = {} as RushConfiguration;
+    const otherConfiguration: RushConfiguration = {} as RushConfiguration;
+    const cache: JsonFileLoadCache = getEngineJsonFileLoadCache(configuration);
+    expect(getEngineJsonFileLoadCache(configuration)).toBe(cache);
+    expect(getEngineJsonFileLoadCache(otherConfiguration)).not.toBe(cache);
+  });
+});

From 810f077e8412700ec7727cfc28ab26863a5eabb5 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:04:02 +0000
Subject: [PATCH 081/265] [package-deps-hash] Keep the untracked cache and
 fsmonitor token when RepoStateCache copies the index again

Swarm integration step 66; original commit 4c28b44283 (merge of swarm/r07-t169 at effeec5b44).
Scope: task 169.

Brings r07's task 169 (board 3170): when the copied index records the same paths, the new copy keeps the old copy's untracked cache and fsmonitor token. The daemon's first git status after git add, restore --staged, reset --hard or checkout -- drops from 0.94-1.44 s to 0.28-0.45 s. Second agents: t04 board 3334 and m01 board 3440.

s17 batch D2, item 4 of 6. Gate: ch01 GATE OK board 3514 (tree d362c9d055)

Commits folded into this step (1):
- effeec5b44 Keep the untracked cache and file system monitor state when RepoStateCache copies the index again

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...dex-caches-on-recopy_2026-09-29-02-37.json |  11 +
 .../package-deps-hash/src/GitIndexFile.ts     | 492 +++++++++++++-
 .../package-deps-hash/src/RepoStateCache.ts   |  85 ++-
 .../src/test/FsmonitorHook.ts                 |  45 ++
 .../src/test/GitIndexFile.test.ts             | 632 +++++++++++++++++-
 .../src/test/RepoStateCache.test.ts           | 248 +++++++
 6 files changed, 1448 insertions(+), 65 deletions(-)
 create mode 100644 common/changes/@rushstack/package-deps-hash/keep-index-caches-on-recopy_2026-09-29-02-37.json
 create mode 100644 libraries/package-deps-hash/src/test/FsmonitorHook.ts

diff --git a/common/changes/@rushstack/package-deps-hash/keep-index-caches-on-recopy_2026-09-29-02-37.json b/common/changes/@rushstack/package-deps-hash/keep-index-caches-on-recopy_2026-09-29-02-37.json
new file mode 100644
index 0000000000..bd37d3432c
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/keep-index-caches-on-recopy_2026-09-29-02-37.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "When `RepoStateCache` copies the Git index again and the index records the same paths as the previous copy, for example after `git add`, the new copy keeps the untracked cache and the file system monitor's state of the previous copy, so that `git status` doesn't read every folder and file again.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/GitIndexFile.ts b/libraries/package-deps-hash/src/GitIndexFile.ts
index 4f600b9ce7..f5826d8d4c 100644
--- a/libraries/package-deps-hash/src/GitIndexFile.ts
+++ b/libraries/package-deps-hash/src/GitIndexFile.ts
@@ -4,21 +4,58 @@
 // The index format packs flags into bits
 /* eslint-disable no-bitwise */
 
-import { createHash } from 'node:crypto';
+import { createHash, type Hash } from 'node:crypto';
 
 // The format is described in https://git-scm.com/docs/index-format
 const INDEX_SIGNATURE: string = 'DIRC';
 const HEADER_LENGTH: number = 12;
+const MAX_INDEX_LENGTH: number = 2 ** 32 - 1;
 // ctime, mtime, dev, ino, mode, uid, gid and size, 4 bytes each except the 8-byte times
 const ENTRY_STAT_LENGTH: number = 40;
 const ENTRY_MODE_OFFSET: number = 24;
 const ENTRY_MODE_LENGTH: number = 4;
+// The object type bits of the mode: a regular file, a symbolic link or a gitlink
+const ENTRY_MODE_TYPE_SHIFT: number = 12;
 const ENTRY_SIZE_OFFSET: number = 36;
 const ENTRY_SIZE_LENGTH: number = 4;
 const ENTRY_FLAGS_LENGTH: number = 2;
 const ENTRY_EXTENDED_FLAG: number = 0x4000;
+const ENTRY_STAGE_MASK: number = 0x3000;
 const EXTENSION_HEADER_LENGTH: number = 8;
 const SPLIT_INDEX_EXTENSION_SIGNATURE: string = 'link';
+const UNTRACKED_CACHE_EXTENSION_SIGNATURE: string = 'UNTR';
+const FSMONITOR_EXTENSION_SIGNATURE: string = 'FSMN';
+// Git ignores an extension whose signature starts with an uppercase letter if it doesn't understand it
+const FIRST_OPTIONAL_SIGNATURE_CHARACTER_CODE: number = 0x41;
+const LAST_OPTIONAL_SIGNATURE_CHARACTER_CODE: number = 0x5a;
+// A new copy of the index takes the untracked cache and the file system monitor's state from the previous copy. It
+// drops "EOIE", which describes the extensions that follow the entries, since those change, and so also "IEOT", which
+// lets Git read the entries with several threads, since Git only finds it through "EOIE".
+const REPLACED_EXTENSION_SIGNATURES: ReadonlySet<string> = new Set([
+  'EOIE',
+  'IEOT',
+  UNTRACKED_CACHE_EXTENSION_SIGNATURE,
+  FSMONITOR_EXTENSION_SIGNATURE
+]);
+const FSMONITOR_VERSION_1: number = 1;
+const FSMONITOR_VERSION_2: number = 2;
+const FSMONITOR_VERSION_LENGTH: number = 4;
+// Version 1 identifies the state of the file system monitor with a time, and version 2 with a NUL-terminated token
+const FSMONITOR_VERSION_1_TIME_LENGTH: number = 8;
+const FSMONITOR_BITMAP_SIZE_LENGTH: number = 4;
+const SHA256_OBJECT_ID_LENGTH: number = 32;
+
+// An EWAH bitmap is a sequence of 64-bit words, stored as two 32-bit halves in big-endian order. Each "marker" word
+// has the value of a run of identical words (bit 0), the length of the run (bits 1-32) and the number of literal
+// words that follow the marker (bits 33-63). See ewah/ewok_rlw.h in the Git source code.
+const EWAH_HEADER_LENGTH: number = 8;
+const EWAH_WORD_LENGTH: number = 8;
+const EWAH_HALF_WORD_LENGTH: number = 4;
+const EWAH_MARKER_POSITION_LENGTH: number = 4;
+const BITS_PER_EWAH_WORD: number = 64;
+const BITS_PER_EWAH_HALF_WORD: number = 32;
+const MAX_EWAH_RUN_LENGTH: number = 2 ** 32 - 1;
+const MAX_EWAH_LITERAL_WORD_COUNT: number = 2 ** 31 - 1;
 
 /**
  * A summary of a Git index file.
@@ -43,6 +80,47 @@ export interface IGitIndexSummary {
   readonly isSplit: boolean;
 }
 
+/**
+ * The location of an extension in a Git index file.
+ */
+export interface IGitIndexExtension {
+  readonly signature: string;
+  /**
+   * The offset of the extension's header.
+   */
+  readonly start: number;
+  /**
+   * The offset after the extension's data.
+   */
+  readonly end: number;
+}
+
+/**
+ * The locations of the parts of a Git index file.
+ */
+export interface IGitIndexLayout {
+  readonly version: number;
+  readonly entryCount: number;
+  /**
+   * The offset of each entry, followed by the offset after the last entry.
+   */
+  readonly entryOffsets: Uint32Array;
+  /**
+   * The offset of each entry's path. In a version 4 index, the path starts with the number of characters to remove
+   * from the end of the previous entry's path.
+   */
+  readonly pathOffsets: Uint32Array;
+  /**
+   * The offset of the NUL that ends each entry's path.
+   */
+  readonly pathEndOffsets: Uint32Array;
+  readonly extensions: ReadonlyArray<IGitIndexExtension>;
+  /**
+   * The offset of the checksum, which ends the file.
+   */
+  readonly checksumOffset: number;
+}
+
 /**
  * Returns the number of entries that the header of a Git index file declares, or `undefined` if the data doesn't
  * start with the header of a Git index file.
@@ -59,12 +137,12 @@ export function tryGetGitIndexEntryCount(header: Buffer): number | undefined {
 }
 
 /**
- * Summarizes the content of a Git index file of version 2, 3 or 4.
+ * Locates the entries and extensions of a Git index file of version 2, 3 or 4.
  *
  * @param content - The content of the index file
  * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
  */
-export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGitIndexSummary {
+export function parseGitIndexLayout(content: Buffer, objectIdLength: number): IGitIndexLayout {
   const entryCount: number | undefined = tryGetGitIndexEntryCount(content);
   if (entryCount === undefined) {
     throw new Error('The file is not a Git index');
@@ -75,6 +153,11 @@ export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGit
     throw new Error(`Unsupported Git index version ${version}`);
   }
 
+  // The offsets are stored in 32 bits
+  if (content.length > MAX_INDEX_LENGTH) {
+    throw new Error('The Git index is too large');
+  }
+
   const checksumOffset: number = content.length - objectIdLength;
   // Each entry has at least its file system data, object ID and flags, and a NUL after its path
   if (
@@ -84,20 +167,17 @@ export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGit
     throw new Error('The Git index ends within an entry');
   }
 
-  // A copy of the entries in which the file system data of each entry is cleared, except for the mode
-  const entries: Buffer = Buffer.from(content.subarray(0, checksumOffset));
-  const sizes: Buffer = Buffer.alloc(entryCount * ENTRY_SIZE_LENGTH);
+  const entryOffsets: Uint32Array = new Uint32Array(entryCount + 1);
+  const pathOffsets: Uint32Array = new Uint32Array(entryCount);
+  const pathEndOffsets: Uint32Array = new Uint32Array(entryCount);
   let offset: number = HEADER_LENGTH;
   for (let i: number = 0; i < entryCount; i++) {
+    entryOffsets[i] = offset;
     const flagsOffset: number = offset + ENTRY_STAT_LENGTH + objectIdLength;
     if (flagsOffset + ENTRY_FLAGS_LENGTH > checksumOffset) {
       throw new Error('The Git index ends within an entry');
     }
 
-    sizes.writeUInt32BE(content.readUInt32BE(offset + ENTRY_SIZE_OFFSET), i * ENTRY_SIZE_LENGTH);
-    entries.fill(0, offset, offset + ENTRY_MODE_OFFSET);
-    entries.fill(0, offset + ENTRY_MODE_OFFSET + ENTRY_MODE_LENGTH, offset + ENTRY_STAT_LENGTH);
-
     const flags: number = content.readUInt16BE(flagsOffset);
     let pathOffset: number = flagsOffset + ENTRY_FLAGS_LENGTH;
     if (flags & ENTRY_EXTENDED_FLAG) {
@@ -105,6 +185,7 @@ export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGit
       pathOffset += ENTRY_FLAGS_LENGTH;
     }
 
+    pathOffsets[i] = pathOffset;
     if (version === 4) {
       // The path is prefix-compressed: a variable-length integer, then the rest of the path and a NUL
       while (pathOffset < checksumOffset && content[pathOffset] & 0x80) {
@@ -118,30 +199,399 @@ export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGit
       throw new Error('The Git index ends within an entry');
     }
 
+    pathEndOffsets[i] = pathEnd;
     // Before version 4, each entry is padded with 1-8 NULs to a multiple of 8 bytes
     offset = version === 4 ? pathEnd + 1 : offset + ((pathEnd - offset + 8) & ~7);
   }
 
-  const entriesDigest: string = createHash('sha1').update(entries.subarray(4, offset)).digest('hex');
-  const sizesDigest: string = createHash('sha1').update(sizes).digest('hex');
-
-  let isSplit: boolean = false;
+  entryOffsets[entryCount] = offset;
+  const extensions: IGitIndexExtension[] = [];
   while (offset + EXTENSION_HEADER_LENGTH <= checksumOffset) {
-    const signature: string = content.toString('latin1', offset, offset + 4);
-    if (signature === SPLIT_INDEX_EXTENSION_SIGNATURE) {
-      isSplit = true;
-    }
+    const start: number = offset;
     offset += EXTENSION_HEADER_LENGTH + content.readUInt32BE(offset + 4);
+    extensions.push({ signature: content.toString('latin1', start, start + 4), start, end: offset });
   }
 
   if (offset !== checksumOffset) {
     throw new Error('The extensions of the Git index are malformed');
   }
 
+  return { version, entryCount, entryOffsets, pathOffsets, pathEndOffsets, extensions, checksumOffset };
+}
+
+/**
+ * Summarizes the content of a Git index file of version 2, 3 or 4.
+ *
+ * @param content - The content of the index file
+ * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
+ */
+export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGitIndexSummary {
+  const { entryCount, entryOffsets, extensions }: IGitIndexLayout = parseGitIndexLayout(
+    content,
+    objectIdLength
+  );
+  const entriesEnd: number = entryOffsets[entryCount];
+  // A copy of the entries in which the file system data of each entry is cleared, except for the mode
+  const entries: Buffer = Buffer.from(content.subarray(0, entriesEnd));
+  const sizes: Buffer = Buffer.alloc(entryCount * ENTRY_SIZE_LENGTH);
+  for (let i: number = 0; i < entryCount; i++) {
+    const offset: number = entryOffsets[i];
+    sizes.writeUInt32BE(content.readUInt32BE(offset + ENTRY_SIZE_OFFSET), i * ENTRY_SIZE_LENGTH);
+    entries.fill(0, offset, offset + ENTRY_MODE_OFFSET);
+    entries.fill(0, offset + ENTRY_MODE_OFFSET + ENTRY_MODE_LENGTH, offset + ENTRY_STAT_LENGTH);
+  }
+
   return {
     entryCount,
-    entriesDigest,
-    sizesDigest,
-    isSplit
+    entriesDigest: createHash('sha1').update(entries.subarray(4, entriesEnd)).digest('hex'),
+    sizesDigest: createHash('sha1').update(sizes).digest('hex'),
+    isSplit: extensions.some(
+      ({ signature }: IGitIndexExtension) => signature === SPLIT_INDEX_EXTENSION_SIGNATURE
+    )
   };
 }
+
+/**
+ * Builds a new copy of a Git index that keeps the untracked cache and the state of the file system monitor of the
+ * previous copy, so that `git status` doesn't examine the folders and files that didn't change since it last
+ * examined the previous copy. The new copy has the header, entries and other extensions of the index.
+ *
+ * @remarks
+ * The untracked cache lists the untracked files in each folder, which depends on which paths the index records.
+ * So the copy keeps it only if the index records the same paths, with the same stages and object types, as the
+ * previous copy. The file system monitor's state says which entries Git needn't examine, because they didn't
+ * change since the monitor's token: the copy marks the entries that differ from those in the previous copy as
+ * changed, and keeps the token of the previous copy, which matches its untracked cache.
+ *
+ * @param content - The content of the index
+ * @param previousContent - The content of the previous copy of the index
+ * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
+ * @returns The content of the new copy, or `undefined` if it can't keep the state of the previous copy: when the
+ * index and the previous copy record different paths, have different versions, or have an extension that Git
+ * requires to understand, such as that of a split or sparse index, or when the previous copy has no untracked
+ * cache.
+ */
+export function tryCarryOverGitIndexCaches(
+  content: Buffer,
+  previousContent: Buffer,
+  objectIdLength: number
+): Buffer | undefined {
+  const layout: IGitIndexLayout = parseGitIndexLayout(content, objectIdLength);
+  const previousLayout: IGitIndexLayout = parseGitIndexLayout(previousContent, objectIdLength);
+  const untrackedCache: IGitIndexExtension | undefined = findExtension(
+    previousLayout,
+    UNTRACKED_CACHE_EXTENSION_SIGNATURE
+  );
+  if (
+    !untrackedCache ||
+    layout.version !== previousLayout.version ||
+    layout.entryCount !== previousLayout.entryCount ||
+    hasRequiredExtension(layout) ||
+    hasRequiredExtension(previousLayout)
+  ) {
+    return undefined;
+  }
+
+  const changedEntries: Uint8Array | undefined = tryFindChangedEntries(
+    content,
+    layout,
+    previousContent,
+    previousLayout,
+    objectIdLength
+  );
+  if (!changedEntries) {
+    return undefined;
+  }
+
+  const parts: Buffer[] = [content.subarray(0, layout.entryOffsets[layout.entryCount])];
+  for (const { signature, start, end } of layout.extensions) {
+    if (!REPLACED_EXTENSION_SIGNATURES.has(signature)) {
+      parts.push(content.subarray(start, end));
+    }
+  }
+
+  parts.push(previousContent.subarray(untrackedCache.start, untrackedCache.end));
+  const fsmonitor: IGitIndexExtension | undefined = findExtension(
+    previousLayout,
+    FSMONITOR_EXTENSION_SIGNATURE
+  );
+  if (fsmonitor) {
+    const fsmonitorExtension: Buffer | undefined = tryUpdateFsmonitorExtension(
+      previousContent.subarray(fsmonitor.start, fsmonitor.end),
+      changedEntries
+    );
+    if (!fsmonitorExtension) {
+      return undefined;
+    }
+
+    parts.push(fsmonitorExtension);
+  }
+
+  // With "index.skipHash", Git writes zeros instead of the checksum
+  const checksum: Buffer = Buffer.alloc(objectIdLength);
+  if (content.subarray(layout.checksumOffset).some((byte: number) => byte !== 0)) {
+    const hash: Hash = createHash(objectIdLength === SHA256_OBJECT_ID_LENGTH ? 'sha256' : 'sha1');
+    for (const part of parts) {
+      hash.update(part);
+    }
+
+    hash.digest().copy(checksum);
+  }
+
+  parts.push(checksum);
+  return Buffer.concat(parts);
+}
+
+function findExtension(layout: IGitIndexLayout, signature: string): IGitIndexExtension | undefined {
+  return layout.extensions.find((extension: IGitIndexExtension) => extension.signature === signature);
+}
+
+function hasRequiredExtension(layout: IGitIndexLayout): boolean {
+  return layout.extensions.some(({ signature }: IGitIndexExtension) => {
+    const characterCode: number = signature.charCodeAt(0);
+    return (
+      characterCode < FIRST_OPTIONAL_SIGNATURE_CHARACTER_CODE ||
+      characterCode > LAST_OPTIONAL_SIGNATURE_CHARACTER_CODE
+    );
+  });
+}
+
+/**
+ * Returns a flag for each entry, which is 1 if the entry differs from the one in the previous copy, or `undefined`
+ * if an entry has a different path, stage or object type.
+ */
+function tryFindChangedEntries(
+  content: Buffer,
+  layout: IGitIndexLayout,
+  previousContent: Buffer,
+  previousLayout: IGitIndexLayout,
+  objectIdLength: number
+): Uint8Array | undefined {
+  const changedEntries: Uint8Array = new Uint8Array(layout.entryCount);
+  for (let i: number = 0; i < layout.entryCount; i++) {
+    const start: number = layout.entryOffsets[i];
+    const previousStart: number = previousLayout.entryOffsets[i];
+    if (
+      content.compare(
+        previousContent,
+        previousStart,
+        previousLayout.entryOffsets[i + 1],
+        start,
+        layout.entryOffsets[i + 1]
+      ) === 0
+    ) {
+      continue;
+    }
+
+    // All previous paths are the same, so in a version 4 index, the same path is compressed the same way
+    const flagsOffset: number = ENTRY_STAT_LENGTH + objectIdLength;
+    if (
+      (content.readUInt16BE(start + flagsOffset) & ENTRY_STAGE_MASK) !==
+        (previousContent.readUInt16BE(previousStart + flagsOffset) & ENTRY_STAGE_MASK) ||
+      content.readUInt32BE(start + ENTRY_MODE_OFFSET) >>> ENTRY_MODE_TYPE_SHIFT !==
+        previousContent.readUInt32BE(previousStart + ENTRY_MODE_OFFSET) >>> ENTRY_MODE_TYPE_SHIFT ||
+      content.compare(
+        previousContent,
+        previousLayout.pathOffsets[i],
+        previousLayout.pathEndOffsets[i],
+        layout.pathOffsets[i],
+        layout.pathEndOffsets[i]
+      ) !== 0
+    ) {
+      return undefined;
+    }
+
+    changedEntries[i] = 1;
+  }
+
+  return changedEntries;
+}
+
+/**
+ * Builds a file system monitor extension with the token of the given one, in which the changed entries are also
+ * marked as changed. Returns `undefined` if the extension is malformed.
+ */
+function tryUpdateFsmonitorExtension(extension: Buffer, changedEntries: Uint8Array): Buffer | undefined {
+  const data: Buffer = extension.subarray(EXTENSION_HEADER_LENGTH);
+  if (data.length < FSMONITOR_VERSION_LENGTH) {
+    return undefined;
+  }
+
+  let bitmapSizeOffset: number;
+  switch (data.readUInt32BE(0)) {
+    case FSMONITOR_VERSION_1:
+      bitmapSizeOffset = FSMONITOR_VERSION_LENGTH + FSMONITOR_VERSION_1_TIME_LENGTH;
+      break;
+    case FSMONITOR_VERSION_2:
+      bitmapSizeOffset = data.indexOf(0, FSMONITOR_VERSION_LENGTH) + 1;
+      if (bitmapSizeOffset === 0) {
+        return undefined;
+      }
+      break;
+    default:
+      return undefined;
+  }
+
+  const bitmapOffset: number = bitmapSizeOffset + FSMONITOR_BITMAP_SIZE_LENGTH;
+  if (bitmapOffset > data.length) {
+    return undefined;
+  }
+
+  const bitmapEnd: number = bitmapOffset + data.readUInt32BE(bitmapSizeOffset);
+  const changedEntriesOfPreviousCopy: Uint8Array | undefined =
+    bitmapEnd <= data.length
+      ? tryReadEwahBitmap(data.subarray(bitmapOffset, bitmapEnd), changedEntries.length)
+      : undefined;
+  if (!changedEntriesOfPreviousCopy) {
+    return undefined;
+  }
+
+  for (let i: number = 0; i < changedEntries.length; i++) {
+    changedEntriesOfPreviousCopy[i] |= changedEntries[i];
+  }
+
+  const bitmap: Buffer = writeEwahBitmap(changedEntriesOfPreviousCopy);
+  const header: Buffer = Buffer.from(extension.subarray(0, EXTENSION_HEADER_LENGTH + bitmapSizeOffset));
+  header.writeUInt32BE(bitmapOffset + bitmap.length, 4);
+  const bitmapSize: Buffer = Buffer.alloc(FSMONITOR_BITMAP_SIZE_LENGTH);
+  bitmapSize.writeUInt32BE(bitmap.length);
+  return Buffer.concat([header, bitmapSize, bitmap]);
+}
+
+/**
+ * Reads an EWAH bitmap, as Git serializes it, into a flag for each bit. Returns `undefined` if the bitmap is
+ * malformed, or has a bit at or beyond the given count.
+ */
+export function tryReadEwahBitmap(data: Buffer, bitCount: number): Uint8Array | undefined {
+  if (data.length < EWAH_HEADER_LENGTH) {
+    return undefined;
+  }
+
+  const bitSize: number = data.readUInt32BE(0);
+  const wordCount: number = data.readUInt32BE(4);
+  if (
+    bitSize > bitCount ||
+    data.length !== EWAH_HEADER_LENGTH + wordCount * EWAH_WORD_LENGTH + EWAH_MARKER_POSITION_LENGTH
+  ) {
+    return undefined;
+  }
+
+  const bits: Uint8Array = new Uint8Array(bitCount);
+  let position: number = 0;
+  let wordIndex: number = 0;
+  while (wordIndex < wordCount) {
+    const markerOffset: number = EWAH_HEADER_LENGTH + wordIndex * EWAH_WORD_LENGTH;
+    const markerHigh: number = data.readUInt32BE(markerOffset);
+    const markerLow: number = data.readUInt32BE(markerOffset + EWAH_HALF_WORD_LENGTH);
+    const runBitCount: number =
+      ((markerLow >>> 1) + (markerHigh & 1) * 2 ** (BITS_PER_EWAH_HALF_WORD - 1)) * BITS_PER_EWAH_WORD;
+    const literalWordCount: number = markerHigh >>> 1;
+    if (markerLow & 1) {
+      if (position + runBitCount > bitSize) {
+        return undefined;
+      }
+
+      bits.fill(1, position, position + runBitCount);
+    }
+
+    position += runBitCount;
+    wordIndex++;
+    if (wordIndex + literalWordCount > wordCount) {
+      return undefined;
+    }
+
+    for (let i: number = 0; i < literalWordCount; i++, wordIndex++) {
+      const wordOffset: number = EWAH_HEADER_LENGTH + wordIndex * EWAH_WORD_LENGTH;
+      if (
+        !trySetBits(bits, data.readUInt32BE(wordOffset + EWAH_HALF_WORD_LENGTH), position, bitSize) ||
+        !trySetBits(bits, data.readUInt32BE(wordOffset), position + BITS_PER_EWAH_HALF_WORD, bitSize)
+      ) {
+        return undefined;
+      }
+
+      position += BITS_PER_EWAH_WORD;
+    }
+  }
+
+  return bits;
+}
+
+function trySetBits(bits: Uint8Array, halfWord: number, position: number, bitSize: number): boolean {
+  for (let bit: number = position; halfWord !== 0; bit++, halfWord >>>= 1) {
+    if (halfWord & 1) {
+      if (bit >= bitSize) {
+        return false;
+      }
+
+      bits[bit] = 1;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Serializes a flag for each bit as an EWAH bitmap, as Git does. The bitmap ends at the last bit that is set.
+ */
+export function writeEwahBitmap(bits: Uint8Array): Buffer {
+  const bitSize: number = bits.lastIndexOf(1) + 1;
+  const literalWordCount: number = Math.ceil(bitSize / BITS_PER_EWAH_WORD);
+  const lowHalves: Uint32Array = new Uint32Array(literalWordCount);
+  const highHalves: Uint32Array = new Uint32Array(literalWordCount);
+  for (let bit: number = 0; bit < bitSize; bit++) {
+    if (bits[bit]) {
+      const halves: Uint32Array = bit % BITS_PER_EWAH_WORD < BITS_PER_EWAH_HALF_WORD ? lowHalves : highHalves;
+      halves[Math.floor(bit / BITS_PER_EWAH_WORD)] |= 1 << bit % BITS_PER_EWAH_HALF_WORD;
+    }
+  }
+
+  // Each marker word is followed by the literal words that it counts. Only runs of words that are 0 are
+  // compressed, so the bitmap has no bit beyond its size. An empty bitmap is one marker word that is 0.
+  const words: number[] = [];
+  let lastMarkerIndex: number = 0;
+  let wordIndex: number = 0;
+  do {
+    const runStart: number = wordIndex;
+    while (
+      wordIndex < literalWordCount &&
+      lowHalves[wordIndex] === 0 &&
+      highHalves[wordIndex] === 0 &&
+      wordIndex - runStart < MAX_EWAH_RUN_LENGTH
+    ) {
+      wordIndex++;
+    }
+
+    const runLength: number = wordIndex - runStart;
+    const literalStart: number = wordIndex;
+    while (
+      wordIndex < literalWordCount &&
+      (lowHalves[wordIndex] !== 0 || highHalves[wordIndex] !== 0) &&
+      wordIndex - literalStart < MAX_EWAH_LITERAL_WORD_COUNT
+    ) {
+      wordIndex++;
+    }
+
+    lastMarkerIndex = words.length / 2;
+    const runLengthHigh: number = Math.floor(runLength / 2 ** (BITS_PER_EWAH_HALF_WORD - 1));
+    words.push(
+      ((wordIndex - literalStart) * 2 + runLengthHigh) >>> 0,
+      ((runLength % 2 ** (BITS_PER_EWAH_HALF_WORD - 1)) * 2) >>> 0
+    );
+    for (let i: number = literalStart; i < wordIndex; i++) {
+      words.push(highHalves[i], lowHalves[i]);
+    }
+  } while (wordIndex < literalWordCount);
+
+  const wordCount: number = words.length / 2;
+  const data: Buffer = Buffer.alloc(
+    EWAH_HEADER_LENGTH + wordCount * EWAH_WORD_LENGTH + EWAH_MARKER_POSITION_LENGTH
+  );
+  data.writeUInt32BE(bitSize, 0);
+  data.writeUInt32BE(wordCount, 4);
+  for (let i: number = 0; i < words.length; i++) {
+    data.writeUInt32BE(words[i], EWAH_HEADER_LENGTH + i * EWAH_HALF_WORD_LENGTH);
+  }
+
+  data.writeUInt32BE(lastMarkerIndex, EWAH_HEADER_LENGTH + wordCount * EWAH_WORD_LENGTH);
+  return data;
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index 2ff67fd0b3..987422c033 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -8,7 +8,12 @@ import * as path from 'node:path';
 import { FileSystem } from '@rushstack/node-core-library/lib/FileSystem';
 
 import { getFileStamp, getSettledBeforeNs, isFileStatSettled } from './FileStamp';
-import { type IGitIndexSummary, summarizeGitIndex, tryGetGitIndexEntryCount } from './GitIndexFile';
+import {
+  type IGitIndexSummary,
+  summarizeGitIndex,
+  tryCarryOverGitIndexCaches,
+  tryGetGitIndexEntryCount
+} from './GitIndexFile';
 import {
   classifyLocallyModifiedFiles,
   getCleanGitEnvironment,
@@ -105,6 +110,14 @@ interface ITree {
   readonly state: IGitTreeState;
 }
 
+interface ICarriedOverCopy {
+  readonly content: Buffer;
+  /**
+   * The modification time of the previous copy.
+   */
+  readonly previousTimeNs: bigint;
+}
+
 interface IFileHash {
   readonly stamp: string;
   readonly hash: string;
@@ -130,7 +143,10 @@ function noop(): void {}
  * examines every file each time. This class keeps a private copy of the index that `git status` updates, so that
  * each call only examines the files that changed since the previous call. It copies the index again when the
  * files that the index records, or the sizes that it records for them, change, but not when Git merely refreshes
- * the index. While the files that the index records don't change, it also reuses the list of files in the index.
+ * the index. While the index records the same paths, a new copy keeps the untracked cache and the file system
+ * monitor's state of the previous copy, so that `git status` doesn't examine every folder and file again after
+ * `git add`, for example. While the files that the index records don't change, it also reuses the list of files in
+ * the index.
  * It reuses the hash of a file while the identity, size and times of the file and of the `.gitattributes` files in
  * the folders that contain it don't change, and returns the same state as the previous call if nothing changed.
  *
@@ -514,7 +530,16 @@ export class RepoStateCache {
         this.#tree = undefined;
       }
 
-      return await this.#writePrivateIndexAsync(content, stats, summary, filterKey, isRealIndexStampSettled);
+      return await this.#writePrivateIndexAsync(
+        content,
+        stats,
+        summary,
+        filterKey,
+        isRealIndexStampSettled,
+        // Git updated the current copy under the current configuration, and for the same filter
+        isCopyCurrent ? privateIndex : undefined,
+        gitPaths.objectIdLength
+      );
     } finally {
       await handle.close();
     }
@@ -525,18 +550,31 @@ export class RepoStateCache {
     stats: fs.BigIntStats,
     summary: IGitIndexSummary,
     filterKey: string,
-    isRealIndexStampSettled: boolean
+    isRealIndexStampSettled: boolean,
+    previousIndex: IPrivateIndex | undefined,
+    objectIdLength: number
   ): Promise<IPrivateIndex> {
     this.#privateIndex = undefined;
 
+    // If the index records the same paths as the previous copy, the new copy keeps the untracked cache and the file
+    // system monitor's state of the previous copy, so that "git status" doesn't examine every folder again
+    const carriedOverCopy: ICarriedOverCopy | undefined =
+      previousIndex && (await tryCarryOverCachesAsync(previousIndex.path, content, objectIdLength));
     const folderPath: string = this.#getPrivateFolderPath();
     const indexPath: string = path.join(folderPath, PRIVATE_INDEX_NAME);
     const temporaryPath: string = `${indexPath}.new`;
-    await fs.promises.writeFile(temporaryPath, content);
+    await fs.promises.writeFile(temporaryPath, carriedOverCopy?.content ?? content);
     // Git doesn't trust the recorded times and size of a file that changed in the same second as the index was
     // written, because the file may have changed again after it was recorded. Make the copy older than the index,
-    // so that Git doesn't trust any file in the copy that it wouldn't trust in the index.
-    const timeInSeconds: number = Number(stats.mtimeNs / NANOSECONDS_PER_SECOND) - 1;
+    // so that Git doesn't trust any file in the copy that it wouldn't trust in the index. Git trusts the recorded
+    // times of a folder in the untracked cache by the same rule, so a copy that keeps the untracked cache of the
+    // previous copy must be older than that too.
+    let timeNs: bigint = stats.mtimeNs;
+    if (carriedOverCopy && carriedOverCopy.previousTimeNs < timeNs) {
+      timeNs = carriedOverCopy.previousTimeNs;
+    }
+
+    const timeInSeconds: number = Number(timeNs / NANOSECONDS_PER_SECOND) - 1;
     await fs.promises.utimes(temporaryPath, timeInSeconds, timeInSeconds);
     await fs.promises.rename(temporaryPath, indexPath);
 
@@ -548,7 +586,9 @@ export class RepoStateCache {
       filterKey,
       realIndexStamp: getFileStamp(stats),
       isRealIndexStampSettled,
-      attributesFingerprint: undefined,
+      // The file system monitor's state that the new copy keeps says which files Git found unchanged under the
+      // attributes of the previous copy, so the next call must detect a change since then
+      attributesFingerprint: carriedOverCopy ? previousIndex?.attributesFingerprint : undefined,
       hasAttributesChanged: false
     };
     this.#privateIndex = privateIndex;
@@ -756,6 +796,35 @@ function deletePrivateFolders(): void {
   }
 }
 
+/**
+ * Builds a new copy of the index that keeps the untracked cache and the file system monitor's state of the previous
+ * copy. Returns `undefined` if the index records other paths than the previous copy, or if the previous copy can't
+ * be read, in which case the index is copied as it is.
+ */
+async function tryCarryOverCachesAsync(
+  previousPath: string,
+  content: Buffer,
+  objectIdLength: number
+): Promise<ICarriedOverCopy | undefined> {
+  try {
+    const handle: fs.promises.FileHandle = await fs.promises.open(previousPath, 'r');
+    try {
+      const previousStats: fs.BigIntStats = await handle.stat({ bigint: true });
+      const previousContent: Buffer = await handle.readFile();
+      const newContent: Buffer | undefined = tryCarryOverGitIndexCaches(
+        content,
+        previousContent,
+        objectIdLength
+      );
+      return newContent && { content: newContent, previousTimeNs: previousStats.mtimeNs };
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Reads the number of entries from the header of a Git index file, or returns `undefined` if the file doesn't
  * exist or isn't a Git index.
diff --git a/libraries/package-deps-hash/src/test/FsmonitorHook.ts b/libraries/package-deps-hash/src/test/FsmonitorHook.ts
new file mode 100644
index 0000000000..1693cd4437
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/FsmonitorHook.ts
@@ -0,0 +1,45 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/**
+ * A file system monitor hook for Git, which reports the paths that a test logs.
+ */
+export interface IFsmonitorHook {
+  /**
+   * The path of the hook, the value of Git's `core.fsmonitor` setting.
+   */
+  readonly hookPath: string;
+  /**
+   * Logs a path that changed, which the hook then reports to Git.
+   */
+  logChange(relativePath: string): void;
+}
+
+/**
+ * Creates a file system monitor hook in the given folder. Its token is the number of paths that were logged when Git
+ * queried it, and it reports every path as changed for a token that it didn't create.
+ */
+export function createFsmonitorHook(folderPath: string): IFsmonitorHook {
+  const hookPath: string = path.join(folderPath, 'fsmonitor-hook');
+  const logPath: string = path.join(folderPath, 'fsmonitor-hook.log');
+  fs.writeFileSync(logPath, '');
+  const script: string = [
+    '#!/bin/sh',
+    `log='${logPath}'`,
+    `count=$(wc -l < "$log" | tr -d ' ')`,
+    `printf 't:%s\\0' "$count"`,
+    'case "$2" in',
+    `  t:*) tail -n "+$((\${2#t:} + 1))" "$log" | tr '\\n' '\\0' ;;`,
+    `  *) printf '/\\0' ;;`,
+    'esac',
+    ''
+  ].join('\n');
+  fs.writeFileSync(hookPath, script, { mode: 0o755 });
+  return {
+    hookPath,
+    logChange: (relativePath: string) => fs.appendFileSync(logPath, `${relativePath}\n`)
+  };
+}
diff --git a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
index b55b0f34e5..64f14f77db 100644
--- a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
+++ b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
@@ -2,11 +2,22 @@
 // See LICENSE in the project root for license information.
 
 import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
-import { type IGitIndexSummary, summarizeGitIndex, tryGetGitIndexEntryCount } from '../GitIndexFile';
+import {
+  type IGitIndexExtension,
+  type IGitIndexSummary,
+  parseGitIndexLayout,
+  summarizeGitIndex,
+  tryCarryOverGitIndexCaches,
+  tryGetGitIndexEntryCount,
+  tryReadEwahBitmap,
+  writeEwahBitmap
+} from '../GitIndexFile';
+import { createFsmonitorHook, type IFsmonitorHook } from './FsmonitorHook';
 
 const SHA1_OBJECT_ID_LENGTH: number = 20;
 const SHA256_OBJECT_ID_LENGTH: number = 32;
@@ -22,47 +33,63 @@ function getGitEnvironment(): NodeJS.ProcessEnv {
   return environment;
 }
 
-describe(summarizeGitIndex.name, () => {
-  let repoPath: string;
+let repoPath: string;
 
-  function runGit(...args: string[]): string {
-    return execFileSync('git', args, { cwd: repoPath, env: getGitEnvironment(), encoding: 'utf8' });
-  }
+function runGit(...args: string[]): string {
+  return execFileSync('git', args, { cwd: repoPath, env: getGitEnvironment(), encoding: 'utf8' });
+}
 
-  function writeFile(relativePath: string, content: string): void {
-    const filePath: string = path.join(repoPath, relativePath);
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, content);
-  }
+function runGitWithIndex(indexPath: string, ...args: string[]): string {
+  return execFileSync('git', args, {
+    cwd: repoPath,
+    env: { ...getGitEnvironment(), GIT_INDEX_FILE: indexPath },
+    encoding: 'utf8'
+  });
+}
 
-  function readIndex(): Buffer {
-    return fs.readFileSync(path.join(repoPath, '.git', 'index'));
-  }
+function writeFile(relativePath: string, content: string): void {
+  const filePath: string = path.join(repoPath, relativePath);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content);
+}
 
-  function summarize(objectIdLength: number = SHA1_OBJECT_ID_LENGTH): IGitIndexSummary {
-    return summarizeGitIndex(readIndex(), objectIdLength);
-  }
+function getIndexPath(): string {
+  return path.join(repoPath, '.git', 'index');
+}
+
+function readIndex(): Buffer {
+  return fs.readFileSync(getIndexPath());
+}
+
+function createRepo(...initArgs: string[]): void {
+  runGit('init', '--quiet', ...initArgs);
+  runGit('config', 'core.fsmonitor', 'false');
+  runGit('config', 'core.untrackedCache', 'true');
+  runGit('config', 'index.skipHash', 'false');
+  writeFile('a.txt', 'a\n');
+  writeFile('dir/b.txt', 'b\n');
+  writeFile('dir/sub/c.txt', 'c\n');
+  writeFile(LONG_FILE_PATH, 'd\n');
+  runGit('add', '.');
+}
 
-  function createRepo(...initArgs: string[]): void {
-    runGit('init', '--quiet', ...initArgs);
-    runGit('config', 'core.fsmonitor', 'false');
-    runGit('config', 'core.untrackedCache', 'true');
-    runGit('config', 'index.skipHash', 'false');
-    writeFile('a.txt', 'a\n');
-    writeFile('dir/b.txt', 'b\n');
-    writeFile('dir/sub/c.txt', 'c\n');
-    writeFile(LONG_FILE_PATH, 'd\n');
-    runGit('add', '.');
+function commit(): void {
+  runGit('-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Commit');
+}
+
+// Git writes a version 3 index only if an entry has extended flags, and writes a version 2 index otherwise
+function setIndexVersion(version: number): void {
+  if (version === 3) {
+    runGit('update-index', '--skip-worktree', LONG_FILE_PATH);
   }
 
-  // Git writes a version 3 index only if an entry has extended flags, and writes a version 2 index otherwise
-  function setIndexVersion(version: number): void {
-    if (version === 3) {
-      runGit('update-index', '--skip-worktree', LONG_FILE_PATH);
-    }
+  runGit('update-index', `--index-version=${version}`);
+  expect(readIndex().readUInt32BE(4)).toBe(version);
+}
 
-    runGit('update-index', `--index-version=${version}`);
-    expect(readIndex().readUInt32BE(4)).toBe(version);
+describe(summarizeGitIndex.name, () => {
+  function summarize(objectIdLength: number = SHA1_OBJECT_ID_LENGTH): IGitIndexSummary {
+    return summarizeGitIndex(readIndex(), objectIdLength);
   }
 
   beforeEach(() => {
@@ -95,7 +122,7 @@ describe(summarizeGitIndex.name, () => {
   it.each([2, 3, 4])('ignores what refreshing a version %i index changes', (version: number) => {
     createRepo();
     setIndexVersion(version);
-    runGit('-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Initial');
+    commit();
     const initialIndex: Buffer = readIndex();
     const initialSummary: IGitIndexSummary = summarize();
 
@@ -146,7 +173,7 @@ describe(summarizeGitIndex.name, () => {
   it.each([2, 3, 4])('digests the recorded sizes of a version %i index separately', (version: number) => {
     createRepo();
     setIndexVersion(version);
-    runGit('-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '--quiet', '-m', 'Initial');
+    commit();
     const initialSummary: IGitIndexSummary = summarize();
     expect(initialSummary.sizesDigest).toMatch(/^[0-9a-f]{40}$/);
 
@@ -226,3 +253,536 @@ describe(tryGetGitIndexEntryCount.name, () => {
     expect(tryGetGitIndexEntryCount(Buffer.from('PACK\0\0\0\x02\0\0\0\x01'))).toBeUndefined();
   });
 });
+
+interface ITrace2Event {
+  category?: string;
+  key?: string;
+  value?: string;
+}
+
+interface IFsmonitorState {
+  token: string;
+  changedEntries: number[];
+}
+
+function getSetBits(bits: Uint8Array): number[] {
+  const setBits: number[] = [];
+  bits.forEach((bit: number, index: number) => {
+    if (bit) {
+      setBits.push(index);
+    }
+  });
+  return setBits;
+}
+
+function createBits(bitCount: number, setBits: ReadonlyArray<number>): Uint8Array {
+  const bits: Uint8Array = new Uint8Array(bitCount);
+  for (const bit of setBits) {
+    bits[bit] = 1;
+  }
+
+  return bits;
+}
+
+function getRange(start: number, end: number): number[] {
+  const range: number[] = [];
+  for (let i: number = start; i < end; i++) {
+    range.push(i);
+  }
+
+  return range;
+}
+
+describe(tryCarryOverGitIndexCaches.name, () => {
+  const replacedSignatures: ReadonlySet<string> = new Set(['EOIE', 'IEOT', 'UNTR', 'FSMN']);
+  let copyPath: string;
+  let newCopyPath: string;
+
+  function getExtension(
+    content: Buffer,
+    signature: string,
+    objectIdLength: number = SHA1_OBJECT_ID_LENGTH
+  ): Buffer | undefined {
+    const extension: IGitIndexExtension | undefined = parseGitIndexLayout(
+      content,
+      objectIdLength
+    ).extensions.find((candidate: IGitIndexExtension) => candidate.signature === signature);
+    return extension && content.subarray(extension.start, extension.end);
+  }
+
+  function getRequiredExtension(content: Buffer, signature: string): Buffer {
+    const extension: Buffer | undefined = getExtension(content, signature);
+    if (!extension) {
+      throw new Error(`The index has no "${signature}" extension`);
+    }
+
+    return extension;
+  }
+
+  function getSignatures(content: Buffer): string[] {
+    return parseGitIndexLayout(content, SHA1_OBJECT_ID_LENGTH).extensions.map(
+      ({ signature }: IGitIndexExtension) => signature
+    );
+  }
+
+  // Inserts an extension before the checksum, without updating the checksum
+  function insertExtension(content: Buffer, signature: string, data: Buffer): Buffer {
+    const header: Buffer = Buffer.alloc(8);
+    header.write(signature, 0, 'latin1');
+    header.writeUInt32BE(data.length, 4);
+    const checksumOffset: number = content.length - SHA1_OBJECT_ID_LENGTH;
+    return Buffer.concat([
+      content.subarray(0, checksumOffset),
+      header,
+      data,
+      content.subarray(checksumOffset)
+    ]);
+  }
+
+  // Git doesn't trust the recorded times of a file or folder that changed in the same second as the index was saved
+  function settleWorkingTree(folderPath: string, time: number): void {
+    for (const entry of fs.readdirSync(folderPath, { withFileTypes: true })) {
+      if (entry.name !== '.git') {
+        const entryPath: string = path.join(folderPath, entry.name);
+        if (entry.isDirectory()) {
+          settleWorkingTree(entryPath, time);
+        }
+
+        fs.utimesSync(entryPath, time, time);
+      }
+    }
+
+    fs.utimesSync(folderPath, time, time);
+  }
+
+  // Creates a repository with untracked files, and a copy of its index in which Git saved the untracked cache
+  function createRepoWithCopy(version: number, objectIdLength: number = SHA1_OBJECT_ID_LENGTH): void {
+    createRepo(...(objectIdLength === SHA256_OBJECT_ID_LENGTH ? ['--object-format=sha256'] : []));
+    // Git then saves the "EOIE" extension
+    runGit('config', 'index.threads', 'true');
+    setIndexVersion(version);
+    writeFile('untracked.txt', 'untracked\n');
+    writeFile('dir/untracked.txt', 'untracked\n');
+    settleWorkingTree(repoPath, Math.floor(Date.now() / 1000) - 100);
+    runGit('update-index', '--refresh');
+    commit();
+    fs.copyFileSync(getIndexPath(), copyPath);
+    runGitWithIndex(copyPath, 'status', '--porcelain');
+    expect(getExtension(fs.readFileSync(copyPath), 'UNTR', objectIdLength)).toBeDefined();
+  }
+
+  function stageModifiedFile(): void {
+    writeFile('a.txt', 'modified\n');
+    runGit('add', 'a.txt');
+  }
+
+  function carryOver(objectIdLength: number = SHA1_OBJECT_ID_LENGTH): Buffer {
+    const content: Buffer | undefined = tryCarryOverGitIndexCaches(
+      readIndex(),
+      fs.readFileSync(copyPath),
+      objectIdLength
+    );
+    if (!content) {
+      throw new Error('The new copy did not keep the caches of the previous copy');
+    }
+
+    fs.writeFileSync(newCopyPath, content);
+    return content;
+  }
+
+  // Runs "git status", and counts the folders that it read rather than finding their untracked files in the cache
+  function getStatus(indexPath: string, ...configArgs: string[]): [string, number[]] {
+    const tracePath: string = path.join(repoPath, '.git', 'trace2.json');
+    const output: string = execFileSync('git', [...configArgs, 'status', '--porcelain'], {
+      cwd: repoPath,
+      env: {
+        ...getGitEnvironment(),
+        GIT_INDEX_FILE: indexPath,
+        GIT_TRACE2_EVENT: tracePath,
+        // Git reports the statistics of the untracked cache in a nested region
+        GIT_TRACE2_EVENT_NESTING: '10'
+      },
+      encoding: 'utf8'
+    });
+    const events: ITrace2Event[] = fs
+      .readFileSync(tracePath, 'utf8')
+      .split('\n')
+      .filter((line: string) => line)
+      .map((line: string) => JSON.parse(line));
+    fs.unlinkSync(tracePath);
+    const openedFolderCounts: number[] = events
+      .filter(({ category, key }: ITrace2Event) => category === 'read_directory' && key === 'opendir')
+      .map(({ value }: ITrace2Event) => Number(value));
+    return [output, openedFolderCounts];
+  }
+
+  beforeEach(() => {
+    repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'git-index-file-test-'));
+    copyPath = path.join(repoPath, '.git', 'copy');
+    newCopyPath = path.join(repoPath, '.git', 'new-copy');
+  });
+
+  afterEach(() => {
+    fs.rmSync(repoPath, { recursive: true, force: true });
+  });
+
+  it.each([2, 3, 4])(
+    'keeps the untracked cache of the previous copy of a version %i index',
+    (version: number) => {
+      createRepoWithCopy(version);
+      stageModifiedFile();
+      writeFile('dir/b.txt', 'modified\n');
+      const index: Buffer = readIndex();
+      expect(getSignatures(index)).toContain('EOIE');
+
+      const content: Buffer = carryOver();
+      expect(getSignatures(content)).toEqual([
+        ...getSignatures(index).filter((signature: string) => !replacedSignatures.has(signature)),
+        'UNTR'
+      ]);
+      expect(getExtension(content, 'UNTR')).toEqual(getExtension(fs.readFileSync(copyPath), 'UNTR'));
+      expect(content.subarray(-SHA1_OBJECT_ID_LENGTH)).toEqual(
+        createHash('sha1').update(content.subarray(0, -SHA1_OBJECT_ID_LENGTH)).digest()
+      );
+      expect(runGitWithIndex(newCopyPath, 'ls-files', '--stage', '--debug')).toBe(
+        runGit('ls-files', '--stage', '--debug')
+      );
+      const [output, openedFolderCounts] = getStatus(newCopyPath);
+      expect(openedFolderCounts).toEqual([0]);
+      expect(output).toBe(runGit('status', '--porcelain'));
+      expect(output).toBe('M  a.txt\n M dir/b.txt\n?? dir/untracked.txt\n?? untracked.txt\n');
+    }
+  );
+
+  it('keeps the untracked cache of the previous copy of the index of a SHA-256 repository', () => {
+    createRepoWithCopy(4, SHA256_OBJECT_ID_LENGTH);
+    stageModifiedFile();
+
+    const content: Buffer = carryOver(SHA256_OBJECT_ID_LENGTH);
+    expect(getExtension(content, 'UNTR', SHA256_OBJECT_ID_LENGTH)).toEqual(
+      getExtension(fs.readFileSync(copyPath), 'UNTR', SHA256_OBJECT_ID_LENGTH)
+    );
+    expect(content.subarray(-SHA256_OBJECT_ID_LENGTH)).toEqual(
+      createHash('sha256').update(content.subarray(0, -SHA256_OBJECT_ID_LENGTH)).digest()
+    );
+    expect(getStatus(newCopyPath)).toEqual([runGit('status', '--porcelain'), [0]]);
+  });
+
+  it('writes no checksum when Git writes none', () => {
+    createRepoWithCopy(4);
+    runGit('config', 'index.skipHash', 'true');
+    stageModifiedFile();
+    expect(readIndex().subarray(-SHA1_OBJECT_ID_LENGTH)).toEqual(Buffer.alloc(SHA1_OBJECT_ID_LENGTH));
+
+    const content: Buffer = carryOver();
+    expect(content.subarray(-SHA1_OBJECT_ID_LENGTH)).toEqual(Buffer.alloc(SHA1_OBJECT_ID_LENGTH));
+    expect(getStatus(newCopyPath)).toEqual([runGit('status', '--porcelain'), [0]]);
+  });
+
+  it.each<[string, () => void, number]>([
+    ['adds a file', () => runGit('add', 'untracked.txt'), 5],
+    ['removes a file', () => runGit('rm', '--cached', '--quiet', 'a.txt'), 3],
+    ['renames a file', () => runGit('mv', 'a.txt', 'e.txt'), 4],
+    [
+      'records another file in place of one',
+      () => {
+        runGit('rm', '--cached', '--quiet', 'a.txt');
+        runGit('add', 'dir/untracked.txt');
+      },
+      4
+    ],
+    [
+      'records a symbolic link in place of a file',
+      () => {
+        const objectId: string = runGit('rev-parse', 'HEAD:a.txt').trim();
+        runGit('update-index', '--cacheinfo', `120000,${objectId},a.txt`);
+      },
+      4
+    ],
+    [
+      'records a conflict in place of a file',
+      () => {
+        const objectId: string = runGit('rev-parse', 'HEAD:a.txt').trim();
+        execFileSync('git', ['update-index', '--index-info'], {
+          cwd: repoPath,
+          env: getGitEnvironment(),
+          input: `0 ${'0'.repeat(40)}\ta.txt\n100644 ${objectId} 1\ta.txt\n`
+        });
+      },
+      4
+    ]
+  ])('returns undefined when the index %s', (description: string, change: () => void, entryCount: number) => {
+    createRepoWithCopy(4);
+    change();
+    expect(tryGetGitIndexEntryCount(readIndex())).toBe(entryCount);
+    expect(
+      tryCarryOverGitIndexCaches(readIndex(), fs.readFileSync(copyPath), SHA1_OBJECT_ID_LENGTH)
+    ).toBeUndefined();
+  });
+
+  it('returns undefined when the index and the previous copy have different versions', () => {
+    createRepoWithCopy(4);
+    runGit('update-index', '--index-version=2');
+    expect(
+      tryCarryOverGitIndexCaches(readIndex(), fs.readFileSync(copyPath), SHA1_OBJECT_ID_LENGTH)
+    ).toBeUndefined();
+  });
+
+  it('returns undefined when the previous copy has no untracked cache', () => {
+    createRepoWithCopy(4);
+    runGitWithIndex(copyPath, '-c', 'core.untrackedCache=false', 'status', '--porcelain');
+    const previousContent: Buffer = fs.readFileSync(copyPath);
+    expect(getExtension(previousContent, 'UNTR')).toBeUndefined();
+    stageModifiedFile();
+    expect(tryCarryOverGitIndexCaches(readIndex(), previousContent, SHA1_OBJECT_ID_LENGTH)).toBeUndefined();
+  });
+
+  it('keeps the extensions of the index that Git may ignore, but not those that it must understand', () => {
+    createRepoWithCopy(4);
+    stageModifiedFile();
+    const index: Buffer = insertExtension(readIndex(), 'ZZZZ', Buffer.from('data'));
+    const previousContent: Buffer = fs.readFileSync(copyPath);
+    const content: Buffer | undefined = tryCarryOverGitIndexCaches(
+      index,
+      previousContent,
+      SHA1_OBJECT_ID_LENGTH
+    );
+    expect(content && getSignatures(content)).toEqual(['TREE', 'ZZZZ', 'UNTR']);
+    expect(content && getExtension(content, 'ZZZZ')).toEqual(getExtension(index, 'ZZZZ'));
+
+    // The extensions of a split index and of a sparse index
+    for (const signature of ['link', 'sdir']) {
+      const extensionData: Buffer = Buffer.alloc(signature === 'link' ? SHA1_OBJECT_ID_LENGTH : 0);
+      expect(
+        tryCarryOverGitIndexCaches(
+          insertExtension(index, signature, extensionData),
+          previousContent,
+          SHA1_OBJECT_ID_LENGTH
+        )
+      ).toBeUndefined();
+      expect(
+        tryCarryOverGitIndexCaches(
+          index,
+          insertExtension(previousContent, signature, extensionData),
+          SHA1_OBJECT_ID_LENGTH
+        )
+      ).toBeUndefined();
+    }
+  });
+
+  it('throws when the previous copy is not an index', () => {
+    createRepoWithCopy(4);
+    const previousContent: Buffer = fs.readFileSync(copyPath);
+    expect(() =>
+      tryCarryOverGitIndexCaches(readIndex(), previousContent.subarray(0, 100), SHA1_OBJECT_ID_LENGTH)
+    ).toThrow('The Git index ends within an entry');
+  });
+
+  if (process.platform !== 'win32') {
+    describe('with a file system monitor', () => {
+      let hook: IFsmonitorHook;
+
+      function runGitWithFsmonitor(indexPath: string, ...args: string[]): string {
+        return runGitWithIndex(indexPath, '-c', `core.fsmonitor=${hook.hookPath}`, ...args);
+      }
+
+      function readFsmonitorState(content: Buffer): IFsmonitorState {
+        const data: Buffer = getRequiredExtension(content, 'FSMN').subarray(8);
+        expect(data.readUInt32BE(0)).toBe(2);
+        const tokenEnd: number = data.indexOf(0, 4);
+        const bitmap: Buffer = data.subarray(tokenEnd + 5);
+        expect(bitmap.length).toBe(data.readUInt32BE(tokenEnd + 1));
+        const bits: Uint8Array | undefined = tryReadEwahBitmap(bitmap, content.readUInt32BE(8));
+        return {
+          token: data.toString('latin1', 4, tokenEnd),
+          changedEntries: bits ? getSetBits(bits) : []
+        };
+      }
+
+      function modifyFile(relativePath: string): void {
+        writeFile(relativePath, 'modified\n');
+        hook.logChange(relativePath);
+      }
+
+      it('keeps the token of the previous copy, and marks the entries that differ from it as changed', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        // Git asks the hook for every change, since the copy has no token, and then saves the token of the hook
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        runGitWithFsmonitor(copyPath, 'update-index', '--no-fsmonitor-valid', 'dir/b.txt');
+        expect(readFsmonitorState(fs.readFileSync(copyPath))).toEqual({ token: 't:0', changedEntries: [1] });
+
+        modifyFile('a.txt');
+        runGit('add', 'a.txt');
+        const content: Buffer = carryOver();
+        expect(readFsmonitorState(content)).toEqual({ token: 't:0', changedEntries: [0, 1] });
+        // Git lists the entries that the file system monitor considers unchanged in lowercase
+        expect(runGitWithFsmonitor(newCopyPath, 'ls-files', '-f')).toBe(
+          `H a.txt\nH dir/b.txt\nh dir/sub/c.txt\nh ${LONG_FILE_PATH}\n`
+        );
+        expect(getStatus(newCopyPath, '-c', `core.fsmonitor=${hook.hookPath}`)[0]).toBe(
+          runGit('status', '--porcelain')
+        );
+      });
+
+      it('reads and writes runs of entries that are all marked as changed', () => {
+        const filePaths: string[] = getRange(0, 200).map(
+          (index: number) => `f/${String(index).padStart(3, '0')}`
+        );
+        for (const filePath of filePaths) {
+          writeFile(filePath, `${filePath}\n`);
+        }
+
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        runGitWithFsmonitor(copyPath, 'update-index', '--no-fsmonitor-valid', ...filePaths);
+        const previousContent: Buffer = fs.readFileSync(copyPath);
+        const previousState: IFsmonitorState = readFsmonitorState(previousContent);
+        expect(previousState).toEqual({ token: 't:0', changedEntries: getRange(4, 204) });
+
+        modifyFile('a.txt');
+        runGit('add', 'a.txt');
+        const content: Buffer = carryOver();
+        const state: IFsmonitorState = readFsmonitorState(content);
+        expect(state).toEqual({ token: 't:0', changedEntries: [0, ...getRange(4, 204)] });
+        // Git compresses runs of words whose bits are all set, but the new copy doesn't
+        expect(getRequiredExtension(content, 'FSMN').length).toBeGreaterThan(
+          getRequiredExtension(previousContent, 'FSMN').length
+        );
+        expect(runGitWithFsmonitor(newCopyPath, 'ls-files', '-f')).toBe(
+          [
+            'H a.txt',
+            'h dir/b.txt',
+            'h dir/sub/c.txt',
+            `h ${LONG_FILE_PATH}`,
+            ...filePaths.map((filePath: string) => `H ${filePath}`),
+            ''
+          ].join('\n')
+        );
+      });
+
+      it('keeps the token of the previous copy rather than that of the index', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        // Git saves the index with a later token, after the untracked file was created
+        writeFile('dir/new.txt', 'new\n');
+        hook.logChange('dir/new.txt');
+        runGitWithFsmonitor(getIndexPath(), 'status', '--porcelain');
+        modifyFile('a.txt');
+        runGitWithFsmonitor(getIndexPath(), 'add', 'a.txt');
+        expect(readFsmonitorState(readIndex()).token).toBe('t:2');
+
+        const content: Buffer = carryOver();
+        expect(readFsmonitorState(content).token).toBe('t:0');
+        const [output] = getStatus(newCopyPath, '-c', `core.fsmonitor=${hook.hookPath}`);
+        expect(output).toBe(runGitWithFsmonitor(getIndexPath(), 'status', '--porcelain'));
+        expect(output).toContain('?? dir/new.txt\n');
+      });
+
+      it('drops the state of the file system monitor of the index', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        modifyFile('a.txt');
+        runGitWithFsmonitor(getIndexPath(), 'add', 'a.txt');
+        expect(getExtension(readIndex(), 'FSMN')).toBeDefined();
+
+        expect(getExtension(carryOver(), 'FSMN')).toBeUndefined();
+      });
+
+      it('returns undefined when the state of the file system monitor of the previous copy is malformed', () => {
+        createRepoWithCopy(4);
+        hook = createFsmonitorHook(path.join(repoPath, '.git'));
+        runGitWithFsmonitor(copyPath, 'status', '--porcelain');
+        stageModifiedFile();
+        const previousContent: Buffer = fs.readFileSync(copyPath);
+        expect(tryCarryOverGitIndexCaches(readIndex(), previousContent, SHA1_OBJECT_ID_LENGTH)).toBeDefined();
+
+        // An unknown version
+        const malformedContent: Buffer = Buffer.from(previousContent);
+        const extensionOffset: number = previousContent.indexOf(
+          getRequiredExtension(previousContent, 'FSMN')
+        );
+        malformedContent.writeUInt32BE(3, extensionOffset + 8);
+        expect(
+          tryCarryOverGitIndexCaches(readIndex(), malformedContent, SHA1_OBJECT_ID_LENGTH)
+        ).toBeUndefined();
+      });
+    });
+  }
+});
+
+describe(writeEwahBitmap.name, () => {
+  it('writes an empty bitmap as Git does', () => {
+    expect(writeEwahBitmap(new Uint8Array(3)).toString('hex')).toBe(
+      ['00000000', '00000001', '0000000000000000', '00000000'].join('')
+    );
+  });
+
+  it('writes a bitmap as Git does', () => {
+    // As Git saved it for an index of 4 entries, in which it marked the second entry as changed
+    expect(writeEwahBitmap(createBits(4, [1])).toString('hex')).toBe(
+      ['00000002', '00000002', '0000000200000000', '0000000000000002', '00000000'].join('')
+    );
+  });
+
+  it('compresses runs of words that are 0', () => {
+    const bits: Uint8Array = createBits(100000, [5, 99999]);
+    const data: Buffer = writeEwahBitmap(bits);
+    // A marker and a literal word, then a marker for the run and a literal word
+    expect(data.length).toBe(8 + 4 * 8 + 4);
+    expect(tryReadEwahBitmap(data, bits.length)).toEqual(bits);
+  });
+
+  it('writes bitmaps that it reads back', () => {
+    let seed: number = 1;
+    for (const bitCount of [1, 31, 32, 63, 64, 65, 200, 5000]) {
+      for (const density of [0, 0.01, 0.5, 0.99, 1]) {
+        const bits: Uint8Array = new Uint8Array(bitCount);
+        for (let i: number = 0; i < bitCount; i++) {
+          seed = (seed * 1103515245 + 12345) % 2 ** 31;
+          bits[i] = seed / 2 ** 31 < density ? 1 : 0;
+        }
+
+        expect(tryReadEwahBitmap(writeEwahBitmap(bits), bitCount)).toEqual(bits);
+      }
+    }
+  });
+});
+
+describe(tryReadEwahBitmap.name, () => {
+  it('reads runs of words whose bits are all set', () => {
+    // As Git saved it for an index of 132 entries, in which it marked every entry as changed
+    const data: Buffer = Buffer.from(
+      ['00000084', '00000002', '0000000200000005', '000000000000000f', '00000000'].join(''),
+      'hex'
+    );
+    expect(tryReadEwahBitmap(data, 132)).toEqual(new Uint8Array(132).fill(1));
+    expect(tryReadEwahBitmap(data, 131)).toBeUndefined();
+  });
+
+  it('rejects a malformed bitmap', () => {
+    const data: Buffer = writeEwahBitmap(createBits(4, [1]));
+    expect(tryReadEwahBitmap(data, 4)).toEqual(createBits(4, [1]));
+    expect(tryReadEwahBitmap(data.subarray(0, 4), 4)).toBeUndefined();
+    expect(tryReadEwahBitmap(data.subarray(0, data.length - 1), 4)).toBeUndefined();
+
+    // A bit beyond the size of the bitmap
+    const bitBeyondSize: Buffer = Buffer.from(data);
+    bitBeyondSize.writeUInt32BE(1, 0);
+    expect(tryReadEwahBitmap(bitBeyondSize, 4)).toBeUndefined();
+
+    // More literal words than the bitmap has
+    const missingLiteralWord: Buffer = Buffer.from(data);
+    missingLiteralWord.writeUInt32BE(4, 8);
+    expect(tryReadEwahBitmap(missingLiteralWord, 4)).toBeUndefined();
+
+    // A run of words whose bits are all set, beyond the size of the bitmap
+    const runBeyondSize: Buffer = Buffer.from(
+      ['00000004', '00000001', '0000000000000003', '00000000'].join(''),
+      'hex'
+    );
+    expect(tryReadEwahBitmap(runBeyondSize, 64)).toBeUndefined();
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
index 162c7ac7a9..a971b1866f 100644
--- a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -11,6 +11,7 @@ import { Executable, type IExecutableSpawnOptions } from '@rushstack/node-core-l
 import * as GitIndexFile from '../GitIndexFile';
 import { getDetailedRepoStateAsync, type IDetailedRepoState } from '../getRepoState';
 import { RepoStateCache } from '../RepoStateCache';
+import { createFsmonitorHook, type IFsmonitorHook } from './FsmonitorHook';
 
 const originalDateNow: () => number = Date.now;
 const originalSpawn: typeof Executable.spawn = Executable.spawn;
@@ -46,6 +47,38 @@ interface IGitCommand {
   usesPrivateIndex: boolean;
 }
 
+interface ITrace2Event {
+  category?: string;
+  key?: string;
+  value?: string;
+}
+
+function getExtension(content: Buffer, signature: string): Buffer | undefined {
+  const extension: GitIndexFile.IGitIndexExtension | undefined = GitIndexFile.parseGitIndexLayout(
+    content,
+    20
+  ).extensions.find((candidate: GitIndexFile.IGitIndexExtension) => candidate.signature === signature);
+  return extension && content.subarray(extension.start, extension.end);
+}
+
+// Sets environment variables, and returns a function that restores their previous values
+function setEnvironmentVariables(variables: Record<string, string>): () => void {
+  const previousValues: [string, string | undefined][] = Object.keys(variables).map((name: string) => [
+    name,
+    process.env[name]
+  ]);
+  Object.assign(process.env, variables);
+  return () => {
+    for (const [name, value] of previousValues) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
+    }
+  };
+}
+
 function getGitCommand(
   args: ReadonlyArray<string>,
   options: IExecutableSpawnOptions | undefined
@@ -901,6 +934,221 @@ describe(RepoStateCache.name, () => {
     });
   }
 
+  describe('when the index records the same paths as the copy', () => {
+    // Git doesn't trust the recorded times of a folder that changed in the same second as the index was saved
+    function settleFolders(...relativePaths: string[]): void {
+      const time: number = Math.floor(originalDateNow() / 1000) - 100;
+      for (const relativePath of relativePaths) {
+        fs.utimesSync(path.join(repoPath, relativePath), time, time);
+      }
+    }
+
+    // Returns the state, and the numbers of folders that "git status" read rather than finding their untracked
+    // files in the untracked cache
+    async function getStateAndOpenedFolderCountsAsync(): Promise<[IDetailedRepoState, number[]]> {
+      const tracePath: string = path.join(repoPath, '.git', 'trace2.json');
+      const restoreEnvironment: () => void = setEnvironmentVariables({
+        GIT_TRACE2_EVENT: tracePath,
+        // Git reports the statistics of the untracked cache in a nested region
+        GIT_TRACE2_EVENT_NESTING: '10'
+      });
+      let state: IDetailedRepoState;
+      try {
+        state = await getStateAsync();
+      } finally {
+        restoreEnvironment();
+      }
+
+      const events: ITrace2Event[] = fs
+        .readFileSync(tracePath, 'utf8')
+        .split('\n')
+        .filter((line: string) => line)
+        .map((line: string) => JSON.parse(line));
+      fs.unlinkSync(tracePath);
+      const openedFolderCounts: number[] = events
+        .filter(({ category, key }: ITrace2Event) => category === 'read_directory' && key === 'opendir')
+        .map(({ value }: ITrace2Event) => Number(value));
+      return [state, openedFolderCounts];
+    }
+
+    beforeEach(() => {
+      // Otherwise the configuration files may still change, and the cache copies the index as it is
+      settleFiles();
+    });
+
+    it('keeps the untracked cache of the previous copy', async () => {
+      writeFile('untracked.txt', 'untracked\n');
+      writeFile('dir/untracked.txt', 'untracked\n');
+      settleFolders('.', 'dir');
+      await getStateAsync();
+      const previousPath: string = getPrivateIndexPath();
+      const previousContent: Buffer = fs.readFileSync(previousPath);
+      expect(getExtension(previousContent, 'UNTR')).toBeDefined();
+      // Git saved the copy after the index
+      const previousTime: number = Math.floor(originalDateNow() / 1000) - 50;
+      fs.utimesSync(previousPath, previousTime, previousTime);
+
+      writeFile('a.txt', 'modified\n');
+      runGit('add', 'a.txt');
+      const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+      const utimesSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'utimes');
+      const [state, openedFolderCounts] = await getStateAndOpenedFolderCountsAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('dir/untracked.txt')).toBe(hashText('untracked\n'));
+      expect(openedFolderCounts).toEqual([0]);
+      expect(writeFileSpy).toHaveBeenCalledTimes(1);
+      expect(getExtension(writeFileSpy.mock.calls[0][1], 'UNTR')).toEqual(
+        getExtension(previousContent, 'UNTR')
+      );
+      // The new copy is older than the previous copy, so that Git doesn't trust the recorded times of any folder
+      // that it didn't trust in the previous copy
+      expect(utimesSpy).toHaveBeenCalledWith(expect.any(String), previousTime - 1, previousTime - 1);
+    });
+
+    it('finds the untracked files that changed since the previous copy', async () => {
+      writeFile('untracked.txt', 'untracked\n');
+      settleFolders('.', 'dir');
+      await getStateAsync();
+
+      writeFile('dir/untracked.txt', 'untracked\n');
+      fs.unlinkSync(path.join(repoPath, 'untracked.txt'));
+      writeFile('a.txt', 'modified\n');
+      runGit('add', 'a.txt');
+      const [state, openedFolderCounts] = await getStateAndOpenedFolderCountsAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('dir/untracked.txt')).toBe(hashText('untracked\n'));
+      expect(state.files.has('untracked.txt')).toBe(false);
+      expect(openedFolderCounts).toEqual([2]);
+    });
+
+    it('copies the index as it is when the index records other paths', async () => {
+      writeFile('untracked.txt', 'untracked\n');
+      settleFolders('.', 'dir');
+      await getStateAsync();
+
+      // The index records as many files as the copy
+      runGit('rm', '--cached', '--quiet', 'b.txt');
+      runGit('add', 'untracked.txt');
+      const carryOverSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'tryCarryOverGitIndexCaches');
+      const state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('b.txt')).toBe(hashText('b\n'));
+      expect(carryOverSpy.mock.results).toEqual([{ type: 'return', value: undefined }]);
+    });
+
+    it('returns the same state as getDetailedRepoStateAsync after each command', async () => {
+      const carryOverSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'tryCarryOverGitIndexCaches');
+      const commands: (() => void)[] = [
+        () => writeFile('untracked.txt', 'untracked\n'),
+        () => writeFile('a.txt', 'modified\n'),
+        () => runGit('add', 'a.txt'),
+        () => runGit('restore', '--staged', 'a.txt'),
+        () => runGit('stash', '--quiet'),
+        () => runGit('stash', 'pop', '--quiet'),
+        () => runGit('checkout', '--', 'a.txt'),
+        () => writeFile('dir/sub/untracked.txt', 'untracked\n'),
+        () => runGit('add', 'dir/sub/untracked.txt'),
+        () => fs.unlinkSync(path.join(repoPath, 'untracked.txt')),
+        () => runGit('rm', '--cached', '--quiet', 'b.txt'),
+        () => runGit('mv', 'dir/c.txt', 'dir/d.txt'),
+        () => writeFile('dir/d.txt', 'modified\n'),
+        () => runGit('add', '--all')
+      ];
+      await getStateAsync();
+      for (const command of commands) {
+        command();
+        await expectUncachedStateAsync(await getStateAsync());
+      }
+
+      expect(
+        carryOverSpy.mock.results.filter(({ value }: jest.MockResult<Buffer | undefined>) => value)
+      ).not.toHaveLength(0);
+    });
+
+    it('computes the state without the cache when the attributes changed since the previous copy', async () => {
+      writeFile('crlf.txt', 'a\r\n');
+      commit();
+      await getStateAsync();
+      const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+      writeFile('.gitattributes', '*.txt text eol=lf\n');
+      writeFile('a.txt', 'modified\n');
+      runGit('add', 'a.txt');
+      takeGitCommands();
+      let state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(writeFileSpy).toHaveBeenCalledTimes(1);
+      // The cache ran "git status" on the new copy, and then computed the state without it
+      expect(takeGitCommands().some(({ usesPrivateIndex }: IGitCommand) => !usesPrivateIndex)).toBe(true);
+
+      takeGitCommands();
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(writeFileSpy).toHaveBeenCalledTimes(2);
+      expect(takeUsesPrivateIndex()).toBe(true);
+    });
+
+    if (process.platform !== 'win32') {
+      describe('with a file system monitor', () => {
+        let hook: IFsmonitorHook;
+        let restoreEnvironment: () => void;
+
+        function modifyFile(relativePath: string): void {
+          writeFile(relativePath, 'modified\n');
+          hook.logChange(relativePath);
+        }
+
+        beforeEach(() => {
+          hook = createFsmonitorHook(path.join(repoPath, '.git'));
+          // Git applies the configuration in the environment after that of the repository
+          const count: number = Number(process.env.GIT_CONFIG_COUNT || 0);
+          restoreEnvironment = setEnvironmentVariables({
+            [`GIT_CONFIG_KEY_${count}`]: 'core.fsmonitor',
+            [`GIT_CONFIG_VALUE_${count}`]: hook.hookPath,
+            GIT_CONFIG_COUNT: String(count + 1)
+          });
+        });
+
+        afterEach(() => {
+          restoreEnvironment();
+        });
+
+        it('marks the files whose entries changed as changed', async () => {
+          const carryOverSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'tryCarryOverGitIndexCaches');
+          await getStateAsync();
+          modifyFile('a.txt');
+          await expectUncachedStateAsync(await getStateAsync());
+          runGit('add', 'a.txt');
+          await expectUncachedStateAsync(await getStateAsync());
+          // Git found the file unchanged since it was added, but the index no longer records its content
+          expect(runGit('ls-files', '-f', 'a.txt')).toBe('H a.txt\n');
+          runGit('restore', '--staged', 'a.txt');
+
+          const state: IDetailedRepoState = await getStateAsync();
+          await expectUncachedStateAsync(state);
+          expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
+          expect(
+            carryOverSpy.mock.results.map(({ value }: jest.MockResult<Buffer | undefined>) => !!value)
+          ).toEqual([true, true]);
+        });
+
+        it('keeps the token of the previous copy rather than that of the index', async () => {
+          await getStateAsync();
+          // Git saves the index with a later token, after the untracked file was created
+          writeFile('dir/new.txt', 'new\n');
+          hook.logChange('dir/new.txt');
+          runGit('status', '--porcelain');
+          modifyFile('b.txt');
+          runGit('add', 'b.txt');
+
+          const state: IDetailedRepoState = await getStateAsync();
+          await expectUncachedStateAsync(state);
+          expect(state.files.get('dir/new.txt')).toBe(hashText('new\n'));
+        });
+      });
+    }
+  });
+
   function hashText(text: string): string {
     return execFileSync('git', ['hash-object', '--stdin', '--no-filters'], {
       cwd: repoPath,

From 73968539150d17fcf6b60f0ca9dad97450cff451 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:04:02 +0000
Subject: [PATCH 082/265] [rush-daemon] Test that a usage error goes to
 in-process Rush while a reload is pending

Swarm integration step 67; original commit 3ff87ea4b8 (merge of swarm/r04-t78-nit7 at aae9f29de0).
Scope: task 78 NIT 7.

Brings r04's fix for ch01's NIT 7 on task 78 (board 3099, board 3160): a new test pins the `!#forceReload` conjunct. No behavior change. Second agent: o04 board 3188.

s17 batch D2, item 5 of 6. Gate: ch01 GATE OK board 3514 (tree 2fcaab2166)

Commits folded into this step (1):
- aae9f29de0 Test that a usage error goes to in-process Rush while a reload is pending (task 78 follow-up, ch01 board 3099 NIT 7)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../swarm-r04-t78-nit7_2026-09-29-03-45.json  | 11 +++++++
 .../src/WorkspaceRequestLifecycle.ts          |  3 +-
 .../src/test/DaemonRequestUsageError.test.ts  | 29 +++++++++++++++++++
 3 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit7_2026-09-29-03-45.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit7_2026-09-29-03-45.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit7_2026-09-29-03-45.json
new file mode 100644
index 0000000000..166f004f7f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit7_2026-09-29-03-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index e9e4fd9223..29ab445144 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -880,7 +880,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
    * Whether the session's configuration is known to match the workspace inputs: a reload bound this session after
    * checking that its inputs did not change while it loaded, and they have not changed since. The session that the
    * daemon loads at startup is not checked that way. An edit made after it loaded, while the startup capture runs,
-   * is in the startup fingerprint but not in the session.
+   * is in the startup fingerprint but not in the session. Nor does a session count while a reload is pending, for
+   * example after a reload found the Rush lock busy; until a build reloads, a usage error goes to in-process Rush.
    */
   #isConfigurationCurrent(session: IWorkspaceSession, tier: WorkspaceInputChangeTier): boolean {
     return tier === WorkspaceInputChangeTier.Reuse && this.#boundSession === session && !this.#forceReload;
diff --git a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
index c333f2b618..4b21f9946d 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import type { IOperationGraph } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
 
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
 
@@ -65,6 +66,34 @@ it('hands an invalid command line to in-process Rush after a configuration chang
   }
 });
 
+it('hands an invalid command line to in-process Rush while the warm set waits for a reload that found the Rush lock busy', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+    // Other parameters need a reload. It stops the warm set before it takes the Rush lock, which this test holds.
+    const native: LockFile | undefined = LockFile.tryAcquire(
+      fixture.session.rushConfiguration.commonTempFolder,
+      'rush'
+    );
+    expect(native).toBeDefined();
+    try {
+      expect((await fixture.runAsync(['build', '--to', 'b', '--ignore-hooks'])).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { message: expect.stringContaining('Another Rush command') }
+      });
+    } finally {
+      native?.release();
+    }
+    // The inputs did not change, but the daemon answers again only after a build reloads.
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(inProcess);
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
 it('hands an invalid command line to in-process Rush when the configuration changed while the daemon started', async () => {
   const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
     // A build that has watch phases gets --no-ipc when experiments.json turns on useIPCScriptsInWatchMode.

From d719e2dc2b7fc3d0010a7e0978f7e63ab8601eec Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 05:04:02 +0000
Subject: [PATCH 083/265] [package-deps-hash] Test more RepoStateCache changes

Swarm integration step 68; original commit ddf37c86ed (merge of swarm/r07-t114-nits at c4b24fad18).
Scope: task 114 NITs 1-4.

Brings r07's test-only fix for ch01's NITs 1-4 on task 114 (board 3099, board 3169): more RepoStateCache tests in package-deps-hash. No source changes. ch01 checked them with mutants P114N (4 of 4 killed) in the gate.

s17 batch D2, item 6 of 6. Gate: ch01 GATE OK board 3514 (tree 0466deb3dd)

Commits folded into this step (1):
- c4b24fad18 [package-deps-hash] Test more RepoStateCache changes that only the file list, the change time or a new configuration reveal

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ate-cache-more-tests_2026-09-29-03-15.json | 11 +++
 .../src/test/RepoStateCache.test.ts           | 97 +++++++++++++++++++
 2 files changed, 108 insertions(+)
 create mode 100644 common/changes/@rushstack/package-deps-hash/repo-state-cache-more-tests_2026-09-29-03-15.json

diff --git a/common/changes/@rushstack/package-deps-hash/repo-state-cache-more-tests_2026-09-29-03-15.json b/common/changes/@rushstack/package-deps-hash/repo-state-cache-more-tests_2026-09-29-03-15.json
new file mode 100644
index 0000000000..0765baefd2
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/repo-state-cache-more-tests_2026-09-29-03-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Test that `RepoStateCache` follows a checkout between commits whose files have the same sizes, a rewrite that only the change time of a file reveals, and each change to the configuration while it may still change.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
index a971b1866f..6f7799802d 100644
--- a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -322,6 +322,50 @@ describe(RepoStateCache.name, () => {
     expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
   });
 
+  it('hashes a file that changed recently again even when only its change time is recent', async () => {
+    settleFiles();
+    writeFile('untracked.txt', 'one\n');
+    const filePath: string = path.join(repoPath, 'untracked.txt');
+    // As after a write that put back the modification time of the file. The stamp stays the same when the file
+    // changes again within the granularity of the file times.
+    const recentTimeNs: bigint = BigInt(Date.now()) * BigInt(1e6);
+    const oldTimeNs: bigint = BigInt(originalDateNow() - 100000) * BigInt(1e6);
+    const recentStats: fs.BigIntStats = Object.create(fs.lstatSync(filePath, { bigint: true }), {
+      mtimeNs: { value: oldTimeNs },
+      ctimeNs: { value: recentTimeNs }
+    });
+    const lstatAsync: typeof fs.promises.lstat = fs.promises.lstat;
+    jest
+      .spyOn(fs.promises, 'lstat')
+      .mockImplementation(async (lstatPath: fs.PathLike, options?: fs.StatOptions) =>
+        lstatPath === filePath ? recentStats : await lstatAsync(lstatPath, options)
+      );
+    await getStateAsync(['untracked.txt']);
+
+    writeFile('untracked.txt', 'two\n');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'hash-object', 'status']);
+    expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
+  });
+
+  it('hashes a settled file again when it changes at the same size and its modification time is put back', async () => {
+    settleFiles();
+    const filePath: string = path.join(repoPath, 'untracked.txt');
+    const time: number = Math.floor(originalDateNow() / 1000) - 100;
+    writeFile('untracked.txt', 'one\n');
+    fs.utimesSync(filePath, time, time);
+    await getStateAsync(['untracked.txt']);
+
+    // Only the change time of the file reveals the change, since userspace can't set it
+    writeFile('untracked.txt', 'two\n');
+    fs.utimesSync(filePath, time, time);
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync(['untracked.txt']);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+    expect(state.files.get('untracked.txt')).toBe(hashText('two\n'));
+  });
+
   it('copies the index again when the files that it records change', async () => {
     settleFiles();
     const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
@@ -348,6 +392,30 @@ describe(RepoStateCache.name, () => {
     expect(writeFileSpy).toHaveBeenCalledTimes(3);
   });
 
+  it('follows a checkout between commits that record the same files with the same sizes', async () => {
+    settleFiles();
+    const firstCommit: string = runGit('rev-parse', 'HEAD').trim();
+    writeFile('a.txt', 'A\n');
+    commit();
+    const secondCommit: string = runGit('rev-parse', 'HEAD').trim();
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('a.txt')).toBe(hashText('A\n'));
+
+    // The working tree stays clean, so "git status" reports the same output each time. Only the list of the
+    // files in the index tells the states apart.
+    runGit('reset', '--quiet', '--hard', firstCommit);
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(state.files.get('a.txt')).toBe(hashText('a\n'));
+
+    runGit('checkout', '--quiet', secondCommit);
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.hasUncommittedChanges).toBe(false);
+    expect(state.files.get('a.txt')).toBe(hashText('A\n'));
+  });
+
   it('lists the files in the copy of the index while "git status" refreshes it', async () => {
     await getStateAsync();
     writeFile('a.txt', 'modified\n');
@@ -467,6 +535,35 @@ describe(RepoStateCache.name, () => {
     expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
   });
 
+  it('copies the index again on each call while the configuration of the repository may still change', async () => {
+    runGit('config', 'core.autocrlf', 'true');
+    // Git writes the file with CRLF line endings
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+    runGit('checkout', '--', 'a.txt');
+    // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+    touchSettledFile('a.txt');
+    // The configuration may change again without changing its stamp
+    unsettleFiles();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    let state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('a\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+
+    const changes: [string, string][] = [
+      ['false', 'a\r\n'],
+      ['true', 'a\n']
+    ];
+    for (const [autocrlf, content] of changes) {
+      runGit('config', 'core.autocrlf', autocrlf);
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('a.txt')).toBe(hashText(content));
+    }
+
+    expect(writeFileSpy).toHaveBeenCalledTimes(3);
+  });
+
   it('copies the index again when a .gitattributes file changes, after computing the state without the cache', async () => {
     settleFiles();
     writeFile('crlf.txt', 'a\r\n');

From 26f85bab59cc92f55f496d2dd1bdee88f6a4aa86 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:45 +0000
Subject: [PATCH 084/265] [rush-lib] The daemon can keep warm heft run-watch
 workers for incremental builds, off by default

Swarm integration step 69; original commit 053872af71 (merge of o07/l1b-on-c at 7088556062).
Scope: task 107.

Brings o07's task 107, L1b stage 1 (board 2762; landing candidate board 3259): with `daemon.warmWorkers` (or RUSH_DAEMON_WARM_WORKERS=1) and `daemon.incrementalBuilds`, the daemon keeps a `heft run-watch` worker alive for each operation whose rush-project.json settings set `allowDaemonWarmWorker`, and sends it the next incremental run, as rush start does. It is off by default, and swarm-dogfood sets none of these. 7088556062 is dd57043877 (board 3166) plus two commits for the verdicts' NITs. Second agent: t03 CONFIRMED board 2898.

s17 batch D3, item 1 of 8. Gate: ch01 GATE OK board 3747 (tree 7bdb42fe64)

Commits folded into this step (16):
- cc3ad016da [heft-lint-plugin] Add a lintInWatchMode option
- 6e403a9135 [rush-lib] Let incremental guard callers accept bundled outputs and skip build cache reads
- 45565a0c3e [rush-lib] Keep warm workers alive between Rush daemon builds
- 1a651f544b [rush-lib] Require an opt-in for Rush daemon warm workers
- cfd3107c10 [rush-lib] Run the initial command after a failed run on a reused warm worker
- 7cca36dd3a [heft-typescript-plugin] Never throw from the realpath function for missing paths
- 2f8fd2cca0 [rush-lib] Report why a warm worker closed if the build cache restores its operation
- 565e84c5bb [rush-lib] Say when a warm worker was closed between builds
- e6bc0d81a5 [rush-lib] Drop an unreachable exception from the incremental guard's initial-only marks
- 7a89294333 [rush-lib] Start warm workers with a TypeScript file watcher that sees replaced files
- 26c35d188d [rush-lib] Compare content-hashed bundles when checking a warm worker's outputs
- 31182e0002 [rush-lib] Stop using a warm worker after it renamed a content-hashed output
- 89d541e9ab [rush-lib] Run the initial command after a warm worker's input folder was recreated
- c2b58c25ad Document two more costs of Rush daemon warm workers
- 085e3a6e69 Name only the top recreated input folders in the guard's reason
- 7088556062 Document warm runs that succeed after a missing file, and what Heft's watchers miss

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   1 +
 .../rush/rushd-warm-workers_2026-09-28.json   |  11 +
 .../lint-in-watch-mode_2026-09-28.json        |  10 +
 .../realpath-missing-paths_2026-09-28.json    |  10 +
 .../rushd-warm-workers_2026-09-28.json        |  11 +
 common/reviews/api/rush-lib.api.md            |  13 +-
 docs/rush/dogfooding-rush-daemon.md           |  73 +-
 docs/rush/environment-variables.md            |   1 +
 .../heft-lint-plugin/src/LintPlugin.ts        |  28 +-
 .../src/schemas/heft-lint-plugin.schema.json  |   6 +
 .../src/test/LintPlugin.test.ts               | 245 +++++
 .../src/loadTypeScriptTool.ts                 |   4 +-
 .../rush-lib/src/api/DaemonConfiguration.ts   |  13 +-
 .../src/api/EnvironmentConfiguration.ts       |   3 +
 .../src/api/RushProjectConfiguration.ts       |  13 +
 .../src/api/test/DaemonConfiguration.test.ts  |  19 +-
 .../RushProjectConfiguration.test.ts.snap     |   1 +
 .../api/test/jsonFiles/rush-project-base.json |   3 +-
 .../cli/scriptActions/PhasedScriptAction.ts   |  11 +-
 libraries/rush-lib/src/index.ts               |   1 +
 .../operations/CacheableOperationPlugin.ts    |   9 +-
 .../operations/DaemonWarmWorkerPlugin.ts      | 127 +++
 .../IncrementalExecutionGuardPlugin.ts        | 173 +++-
 .../operations/IncrementalExecutionState.ts   |  46 +-
 .../operations/OperationExecutionRecord.ts    |   8 +-
 .../operations/OperationOutputManifest.ts     |  48 +-
 .../logic/operations/ShellOperationRunner.ts  |  34 +-
 .../operations/WarmWorkerOperationRunner.ts   | 753 ++++++++++++++
 ...ableOperationPluginRetainedResults.test.ts |  32 +-
 .../IncrementalExecutionGuardPlugin.test.ts   | 211 +++-
 .../test/OperationExecutionRecord.test.ts     |  16 +
 .../test/OperationOutputManifest.test.ts      |  28 +
 .../test/WarmWorkerOperationRunner.test.ts    | 936 ++++++++++++++++++
 .../src/schemas/rush-project.schema.json      |   5 +
 .../rush-lib/src/schemas/rush.schema.json     |   5 +
 35 files changed, 2848 insertions(+), 60 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-warm-workers_2026-09-28.json
 create mode 100644 common/changes/@rushstack/heft-lint-plugin/lint-in-watch-mode_2026-09-28.json
 create mode 100644 common/changes/@rushstack/heft-typescript-plugin/realpath-missing-paths_2026-09-28.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/rushd-warm-workers_2026-09-28.json
 create mode 100644 heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index c3d3cf8ba8..aad50dc10e 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -359,6 +359,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `watch` | `RUSH_DAEMON_WATCH` | false | Persistent host observation of requested warm projects; false keeps root/config guards only. Never schedules builds |
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
 | `incrementalBuilds` | `RUSH_DAEMON_INCREMENTAL_BUILDS` | true | Runs an operation's `<phase>:incremental` script instead of its initial script when only files it builds were edited since its last successful run in the daemon and its output folders are unchanged. Additions, deletions, renames, configuration, tool, environment and command-line changes, bundled outputs, cache restores and native Rush commands run the initial script. Incremental results are never written to the build cache |
+| `warmWorkers` | `RUSH_DAEMON_WARM_WORKERS` | false | With `incrementalBuilds`, keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run. Opt in only if that script runs every task and check that the initial script runs, for Heft including lint and API Extractor. When an incremental run is not allowed, the worker is closed and the initial script runs. Workers count toward `warmMemoryBudgetMB` and `warmSetMaxProjects`, so raise both to keep them alive |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
 | `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
 | `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
diff --git a/common/changes/@microsoft/rush/rushd-warm-workers_2026-09-28.json b/common/changes/@microsoft/rush/rushd-warm-workers_2026-09-28.json
new file mode 100644
index 0000000000..786e12971c
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-warm-workers_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `daemon.warmWorkers` (or `RUSH_DAEMON_WARM_WORKERS=1`), off by default: with `daemon.incrementalBuilds`, the Rush daemon runs the incremental builds of an operation whose project defines a `<phase>:incremental:ipc` script, and whose rush-project.json operation settings set the new `allowDaemonWarmWorker` field, in a worker started from that script. It keeps the worker alive between builds, so that the next build sends it another run instead of starting the build tool again. Opt in only if that script runs every task and check that the initial script runs; for Heft, that means heft-lint-plugin's `lintInWatchMode` and API Extractor's `runInWatchMode`. When the initial script must run, the worker is closed first, and the initial script runs in a shell, or in a new worker if the project defines `<phase>:ipc`. If a run on a reused worker fails, or a worker exits during a run, the worker is closed and the initial script runs in the same build, so state that a worker kept from its earlier runs cannot fail an operation that the initial script passes. A worker is also closed after its operation fails. If a run on a worker changes which output files exist, the initial script runs after it; if the run added or removed a file with a content hash in its name, as a bundler does when a chunk's content changes, the operation runs only its initial script until the daemon replaces its engine. A worker starts with `TSC_WATCHFILE=UseFsEventsOnParentDirectory` unless the operation's environment sets `TSC_WATCHFILE`, because TypeScript's default file watcher can lose track of a file that Git replaced, and the worker would then miss later edits to it. For the same reason, the initial script runs if a folder that held the operation's input files was deleted or recreated since the last run on its worker, e.g. by a branch switch, even if the files kept their content. The build cache is not read for a run on a live worker, and results of incremental runs are never written to it. A worker is closed after 25 runs or once its memory doubles, and workers count toward the warm set's memory and project limits.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/heft-lint-plugin/lint-in-watch-mode_2026-09-28.json b/common/changes/@rushstack/heft-lint-plugin/lint-in-watch-mode_2026-09-28.json
new file mode 100644
index 0000000000..3cde9768fa
--- /dev/null
+++ b/common/changes/@rushstack/heft-lint-plugin/lint-in-watch-mode_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-lint-plugin",
+      "comment": "Add a `lintInWatchMode` option. When it is set, each run in watch mode lints the files that changed and the files that had lint failures, as a run that is not in watch mode does.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/heft-lint-plugin"
+}
diff --git a/common/changes/@rushstack/heft-typescript-plugin/realpath-missing-paths_2026-09-28.json b/common/changes/@rushstack/heft-typescript-plugin/realpath-missing-paths_2026-09-28.json
new file mode 100644
index 0000000000..26e268297d
--- /dev/null
+++ b/common/changes/@rushstack/heft-typescript-plugin/realpath-missing-paths_2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-typescript-plugin",
+      "comment": "Fix an issue where, with `onlyResolveSymlinksInNodeModules`, every build in watch mode failed with an ENOENT error after the `package.json` file of a dependency was rewritten, for example by Git.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-typescript-plugin"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/rushd-warm-workers_2026-09-28.json b/common/changes/@rushstack/rush-cli-client/rushd-warm-workers_2026-09-28.json
new file mode 100644
index 0000000000..4c19502788
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/rushd-warm-workers_2026-09-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the `warmWorkers` daemon setting and `RUSH_DAEMON_WARM_WORKERS`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 675d2b98ba..0891385d4b 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -322,6 +322,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_WATCH: "RUSH_DAEMON_WATCH";
     readonly RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: "RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS";
     readonly RUSH_DAEMON_INCREMENTAL_BUILDS: "RUSH_DAEMON_INCREMENTAL_BUILDS";
+    readonly RUSH_DAEMON_WARM_WORKERS: "RUSH_DAEMON_WARM_WORKERS";
     readonly RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: "RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS: "RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
@@ -535,6 +536,7 @@ export interface IDaemonConfigurationJson {
     readonly warmIdleTimeoutSeconds?: number;
     readonly warmMemoryBudgetMB?: number;
     readonly warmSetMaxProjects?: number;
+    readonly warmWorkers?: boolean;
     readonly watch?: boolean;
 }
 
@@ -620,8 +622,13 @@ export interface IGlobalCommand extends IRushCommand {
 
 // @beta
 export interface IIncrementalExecutionGuard {
-    getBlockReasonAsync(): Promise<string | undefined>;
-    verifyIncrementalResultAsync(): Promise<string | undefined>;
+    getBlockReasonAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
+    verifyIncrementalResultAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
+}
+
+// @beta
+export interface IIncrementalExecutionGuardOptions {
+    readonly outputsMayBeBundles?: boolean;
 }
 
 // @public
@@ -724,6 +731,7 @@ export interface _IOperationChildProcessReporter {
 export interface IOperationCommandExecution {
     readonly hasIncrementalCommand: boolean;
     readonly kind: 'initial' | 'incremental';
+    readonly watchesInputs?: boolean;
 }
 
 // @alpha
@@ -875,6 +883,7 @@ export interface IOperationRunnerContext {
 // @alpha (undocumented)
 export interface IOperationSettings {
     allowCobuildWithoutCache?: boolean;
+    allowDaemonWarmWorker?: boolean;
     daemonIpc?: IDaemonIpcConfiguration;
     dependsOnAdditionalFiles?: string[];
     dependsOnEnvVars?: string[];
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index ef9af40482..c674e6a78e 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -188,9 +188,10 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   `--watch`, `--install`, `--variant`, and `--node-diagnostic-dir` stay native, as do build event-hook
   scripts and reporter controls such as `--output`. Keep using ordinary Rush for `install`, `update`, and
   other commands. `rushx-client` keeps scripts attached to a TTY in-process.
-- **No persistent Heft or TypeScript workers.** Each operation still starts its Heft process; the daemon
-  saves Rush startup and graph construction, not compilation. The `usePersistentIpcRunners`/`daemonIpc`
-  mode requires a bundled, self-contained worker entry point, and Heft is not packaged that way.
+- **No persistent Heft or TypeScript workers by default.** Each operation still starts its Heft process; the
+  daemon saves Rush startup and graph construction, not compilation. The `usePersistentIpcRunners`/`daemonIpc`
+  mode requires a bundled, self-contained worker entry point, and Heft is not packaged that way. See
+  `daemon.warmWorkers` below for Heft workers that stay alive between builds.
 - **`:incremental` scripts.** With `daemon.incrementalBuilds` (on by default), an operation whose project
   defines a `_phase:<name>:incremental` script runs it instead of the initial script when only files that the
   operation builds were edited since its last successful run in the daemon. The operation log then says
@@ -199,6 +200,72 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   command make it run the initial script, and the log says why (`Not using the incremental command because
   ...`). Incremental results are never written to the build cache, and neither are the results of operations
   built against them. Set `RUSH_DAEMON_INCREMENTAL_BUILDS=0` to always run the initial script.
+- **Warm workers.** With `daemon.warmWorkers` (or `RUSH_DAEMON_WARM_WORKERS=1`, off by default) and
+  `incrementalBuilds`, an operation whose project defines a `_phase:<name>:incremental:ipc` script (for Heft,
+  `heft run-watch --only <phase> --`) and whose `rush-project.json` operation settings set
+  `"allowDaemonWarmWorker": true` runs its incremental builds in a worker started from that script. Set it only
+  if the script, run in watch mode, runs every task and check that the initial script runs: the daemon reports
+  a run on the worker as if the initial script had run, and `rush start` may run the same script with fewer
+  tasks on purpose. Heft skips lint and API Extractor in watch mode unless the lint task sets heft-lint-plugin's
+  `lintInWatchMode` option and `config/api-extractor-task.json` sets `runInWatchMode`; without them, a lint
+  error does not fail the build, and consumers read a stale `.d.ts` rollup. A rig can set all three for its
+  projects. The worker stays alive between builds and keeps its last build in memory, so the next build sends
+  it another run instead of starting Heft again. The operation log says `Invoking (incremental): ...`, followed
+  by `Starting a warm worker for it.` or `Sending run <n> to the warm worker (pid <pid>).`. When the rules above
+  require the initial script, the worker is closed first (`Closing the warm worker (pid <pid>), because ...`),
+  and that line is written even if the build cache then restores the operation. The initial script then runs
+  as usual, or in a new worker if the project defines `_phase:<name>:ipc` (for Heft,
+  `heft run-watch --only <phase> -- --clean`). A worker also accepts bundled outputs, because it keeps its
+  bundler state in memory; if a run changes which output files exist, the initial script runs after it. If the
+  run added or removed a file with a content hash in its name, as a bundler does when a chunk's content changes,
+  the operation runs only its initial script from then on, until a request replaces the engine, because each
+  later edit would rename the chunk again and leave the old one behind.
+  A worker starts with `TSC_WATCHFILE=UseFsEventsOnParentDirectory` unless the operation's environment sets
+  `TSC_WATCHFILE`. On Linux and macOS, TypeScript's default file watcher follows each file's inode, and after Git
+  replaces a file it can lose track of that file for the life of the process, so the worker would miss every later
+  edit to the file and keep its stale outputs, with no error. TypeScript reads the variable only if
+  `tsconfig.json` does not set `watchOptions.watchFile`. The variable's watcher fails loudly instead: on Linux,
+  if a source file is missing when a run on the worker updates the TypeScript program, for example because a
+  checkout deleted it during the build and then restored it, TypeScript never finds that file again in the
+  process. The run usually fails with error `TS6053` (file not found), or with `ENOENT` if a whole folder was
+  missing, and like any failed run it closes the worker (see below), so it costs a failed run but leaves no stale
+  outputs. But if Heft sees the change while the run is in progress, it runs its tasks again, and the last pass
+  decides the result. The run can then succeed with warnings, which fails the build unless the phase sets
+  `allowWarningsOnSuccess`, but nothing runs again and the worker stays alive. The next build does not reuse that
+  worker if a folder that held the operation's input files was recreated (see below), or if the build cache is
+  enabled for the operation, because input files that changed while an operation ran make its result
+  unverifiable. A single file that is deleted and restored keeps its folder, so neither check applies to it, but
+  a program that still misses the file reports `TS6053` again in the next run on the worker, which then fails
+  and closes the worker as above.
+  A watcher of a folder can also miss every later change in it once the folder is deleted and created again, for
+  example by a branch switch that removed the folder and then restored it. So the next build runs the initial
+  script if a folder that held the operation's input files was deleted or recreated since the last run on the
+  worker (`Not using the incremental command because folders that held its input files were deleted or
+  recreated since its last run (...)`), even if the files kept their content. The daemon compares each folder's
+  inode and creation time; a file that an editor saves by renaming a new file over it does not count. The
+  message names only the top folder of a recreated tree.
+  A worker's outputs are only as current as Heft's watchers. A change that a watcher misses is not built, and
+  because the run still succeeds, later builds report the operation as up to date and keep the stale outputs
+  until the file is edited again. The checks above cover the cases found in testing: a file that Git replaces, a
+  folder that is recreated, and a file that is missing while a run updates TypeScript. A case that none of them
+  covers would leave stale outputs without an error.
+  A reused worker can fail where the initial script passes, for example after Git rewrites the `package.json` of
+  a dependency, because some tools keep state between runs. So if a run on a reused worker fails, or the worker
+  exits during a run, the worker is closed and the initial script runs in the same build
+  (`Running the initial command, because the run on the warm worker failed.`), and the operation fails only if
+  the initial script fails too. A genuine error then costs an extra run of the initial script. The failed first
+  run of a new worker is reported as it stands, because that run had no earlier state. The build cache is not
+  read for a run on a live worker. A worker is closed after its operation fails, because the next build runs the
+  initial script, and after 25 runs or once its memory doubles. Builds that follow each other within seconds can
+  double a worker's memory in a few runs without a leak, because V8 collects each run's garbage later, while the
+  worker is idle: with API Extractor in watch mode, a small package's worker grew by 120 to 180 MB per run and was
+  replaced every 4 or 5 runs, but with 20 seconds between builds it stayed flat. Workers count toward
+  `warmMemoryBudgetMB` and `warmSetMaxProjects`. Over either limit, or once no build has included a project for
+  `warmIdleTimeoutSeconds`, the warm set closes the project's workers and drops its last results, so its next
+  build runs the initial script (`The warm worker (pid <pid>) was closed after the operation last ran.`). The
+  default budget, 512 MiB, includes the daemon itself and leaves room for few workers, so raise both limits when
+  you turn workers on. A request that replaces the engine, e.g. a `rebuild` after a `build`, closes every worker
+  without a note, and each operation's next build runs the initial script.
 - **Plugins.** This repository's only configured plugin, `@rushstack/rush-published-versions-json-plugin`,
   is associated only with `record-published-versions` and is inert for builds. A plugin without
   `associatedCommands`, a plugin associated with `build` or `rebuild`, or a plugin command-line that defines
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 09e141ae94..e89f8206d5 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -28,6 +28,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_WATCH` | `0` | Observe requested warm projects between requests. Never schedules builds and does not enable `--watch` mode. Root/config guards and request-time input reconciliation remain active when disabled. Overrides `watch`. |
 | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | `0` | Enable explicitly configured `operationSettings[].daemonIpc` Node workers for supported incremental daemon builds. Does not convert arbitrary shell scripts into persistent workers. Overrides `usePersistentIpcRunners`. |
 | `RUSH_DAEMON_INCREMENTAL_BUILDS` | `1` | Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. `0` always runs the initial script. Incremental results are never written to the build cache. Overrides `incrementalBuilds`. |
+| `RUSH_DAEMON_WARM_WORKERS` | `0` | With `RUSH_DAEMON_INCREMENTAL_BUILDS`, keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and send it the next incremental run. The worker keeps its last build in memory, so it rebuilds only what changed. When an incremental run is not allowed, the worker is closed and the initial script runs, in a new worker if the project defines `<phase>:ipc`. Workers count toward `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` and `RUSH_DAEMON_WARM_SET_MAX_PROJECTS`. Over either limit the daemon closes them and drops their projects' last results, so raise both for the workers to stay alive. Overrides `warmWorkers`. |
 | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
 | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
diff --git a/heft-plugins/heft-lint-plugin/src/LintPlugin.ts b/heft-plugins/heft-lint-plugin/src/LintPlugin.ts
index b62d6afcea..b1b4c82551 100644
--- a/heft-plugins/heft-lint-plugin/src/LintPlugin.ts
+++ b/heft-plugins/heft-lint-plugin/src/LintPlugin.ts
@@ -32,6 +32,7 @@ const FIX_PARAMETER_NAME: string = '--fix';
 
 interface ILintPluginOptions {
   alwaysFix?: boolean;
+  lintInWatchMode?: boolean;
   sarifLogPath?: string;
 }
 
@@ -64,6 +65,10 @@ function checkFix(taskSession: IHeftTaskSession, pluginOptions?: ILintPluginOpti
   return fix;
 }
 
+function getConfigFilePath(tsProgram: IExtendedProgram): string | undefined {
+  return tsProgram.getCompilerOptions().configFilePath as string | undefined;
+}
+
 function getSarifLogPath(
   heftConfiguration: HeftConfiguration,
   pluginOptions?: ILintPluginOptions
@@ -87,9 +92,10 @@ export default class LintPlugin implements IHeftTaskPlugin<ILintPluginOptions> {
     heftConfiguration: HeftConfiguration,
     pluginOptions?: ILintPluginOptions
   ): void {
-    // Disable linting in watch mode. Some lint rules require the context of multiple files, which
-    // may not be available in watch mode.
-    if (taskSession.parameters.watch) {
+    // Unless the "lintInWatchMode" option is set, disable linting in watch mode. Some lint rules require the
+    // context of multiple files, which may not be available in watch mode.
+    const { watch } = taskSession.parameters;
+    if (watch && !pluginOptions?.lintInWatchMode) {
       let warningPrinted: boolean = false;
       taskSession.hooks.run.tapPromise(PLUGIN_NAME, async () => {
         if (warningPrinted) {
@@ -111,6 +117,10 @@ export default class LintPlugin implements IHeftTaskPlugin<ILintPluginOptions> {
 
     // Use the changed files hook to collect the files and programs from TypeScript
     let typescriptChangedFiles: [IExtendedProgram, ReadonlySet<IExtendedSourceFile>][] = [];
+    // In watch mode, TypeScript reports a program only in the runs in which it emits that program. The latest
+    // program of each tsconfig file is linted again in the other runs, so that files with lint failures are
+    // reported again, as they would be by a run that is not in watch mode.
+    const lastProgramByConfigFilePath: Map<string | undefined, IExtendedProgram> = new Map();
     taskSession.requestAccessToPluginByName(
       TYPESCRIPT_PLUGIN_PACKAGE_NAME,
       TYPESCRIPT_PLUGIN_NAME,
@@ -137,6 +147,18 @@ export default class LintPlugin implements IHeftTaskPlugin<ILintPluginOptions> {
           taskSession
         );
         typescriptChangedFiles.push([tsProgram, new Set(tsProgram.getSourceFiles())]);
+      } else if (watch) {
+        const reportedConfigFilePaths: Set<string | undefined> = new Set(
+          typescriptChangedFiles.map(([tsProgram]) => getConfigFilePath(tsProgram))
+        );
+        for (const [configFilePath, tsProgram] of lastProgramByConfigFilePath) {
+          if (!reportedConfigFilePaths.has(configFilePath)) {
+            typescriptChangedFiles.push([tsProgram, new Set()]);
+          }
+        }
+        for (const [tsProgram] of typescriptChangedFiles) {
+          lastProgramByConfigFilePath.set(getConfigFilePath(tsProgram), tsProgram);
+        }
       }
 
       // Run the linters to completion. Linters emit errors and warnings to the logger.
diff --git a/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json b/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json
index 072d2c70df..1304e3edc3 100644
--- a/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json
+++ b/heft-plugins/heft-lint-plugin/src/schemas/heft-lint-plugin.schema.json
@@ -13,6 +13,12 @@
       "type": "boolean"
     },
 
+    "lintInWatchMode": {
+      "title": "Lint In Watch Mode",
+      "description": "If set to true, lint in watch mode too. Each run lints the files that TypeScript reports as changed and the files that had lint failures, as a run that is not in watch mode does. Defaults to false, which skips linting in watch mode.",
+      "type": "boolean"
+    },
+
     "sarifLogPath": {
       "title": "SARIF Log Path",
       "description": "If specified and using ESLint, a log describing the lint configuration and all messages (suppressed or not) will be emitted in the Static Analysis Results Interchange Format (https://sarifweb.azurewebsites.net/) at the provided path, relative to the project root.",
diff --git a/heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts b/heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts
new file mode 100644
index 0000000000..6fd9168142
--- /dev/null
+++ b/heft-plugins/heft-lint-plugin/src/test/LintPlugin.test.ts
@@ -0,0 +1,245 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// ESLint 9 loads its configuration with a dynamic import, which Jest doesn't support without
+// --experimental-vm-modules. This linter reports every file that contains "debugger" instead, and it keeps the
+// real LinterBase, which decides which files to lint.
+jest.mock('../Eslint', () => {
+  const { LinterBase } = jest.requireActual<{ LinterBase: typeof LinterBaseType }>('../LinterBase');
+
+  class MockEslint extends LinterBase<string> {
+    public constructor(options: ILinterBaseOptions) {
+      super('eslint', options);
+    }
+
+    public static async resolveEslintConfigFilePathAsync(
+      heftConfiguration: HeftConfiguration
+    ): Promise<string> {
+      return `${heftConfiguration.buildFolderPath}/eslint.config.js`;
+    }
+
+    public static async initializeAsync(options: ILinterBaseOptions): Promise<MockEslint> {
+      return new MockEslint(options);
+    }
+
+    public printVersionHeader(): void {
+      // Nothing to print
+    }
+
+    protected async getCacheVersionAsync(): Promise<string> {
+      return 'mock';
+    }
+
+    protected async lintFileAsync(sourceFile: IExtendedSourceFile | ISourceFileToLint): Promise<string[]> {
+      return sourceFile.text.includes('debugger') ? [sourceFile.fileName] : [];
+    }
+
+    protected async lintingFinishedAsync(lintResults: string[]): Promise<void> {
+      for (const fileName of lintResults) {
+        this._scopedLogger.emitError(new Error(`(no-debugger) ${fileName}`));
+      }
+    }
+
+    protected hasLintFailures(lintResults: string[]): boolean {
+      return lintResults.length > 0;
+    }
+
+    protected async isFileExcludedAsync(): Promise<boolean> {
+      return false;
+    }
+  }
+
+  return { Eslint: MockEslint };
+});
+
+import path from 'node:path';
+
+import * as ts from 'typescript';
+
+import type {
+  HeftConfiguration,
+  IHeftTaskRunHookOptions,
+  IHeftTaskSession,
+  IScopedLogger
+} from '@rushstack/heft';
+import type { IChangedFilesHookOptions, ITypeScriptPluginAccessor } from '@rushstack/heft-typescript-plugin';
+import { AlreadyReportedError, FileSystem } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import LintPlugin from '../LintPlugin';
+import type { ILinterBaseOptions, ISourceFileToLint, LinterBase as LinterBaseType } from '../LinterBase';
+import type { IExtendedProgram, IExtendedSourceFile } from '../internalTypings/TypeScriptInternals';
+
+const PROJECT_FOLDER: string = path.resolve(__dirname, '../..');
+const FIXTURE_FOLDER: string = `${PROJECT_FOLDER}/temp/test/lint-plugin-watch`;
+const FAILING_SOURCE: string = 'export function a() {\n  debugger;\n}\n';
+const PASSING_SOURCE: string = 'export function a() {\n  return;\n}\n';
+
+interface IWatchSession {
+  readonly taskSession: IHeftTaskSession;
+  readonly heftConfiguration: HeftConfiguration;
+  readonly terminalProvider: StringBufferTerminalProvider;
+  readonly errors: Error[];
+  readonly requestedPluginNames: string[];
+  reportProgram(program: IExtendedProgram, changedFileNames: string[]): void;
+  runAsync(): Promise<void>;
+}
+
+function createWatchSession(): IWatchSession {
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const terminal: Terminal = new Terminal(terminalProvider);
+  const errors: Error[] = [];
+  const logger: Partial<IScopedLogger> = {
+    terminal,
+    get hasErrors(): boolean {
+      return errors.length > 0;
+    },
+    emitError: (error: Error) => errors.push(error),
+    emitWarning: () => undefined,
+    resetErrorsAndWarnings: () => {
+      errors.length = 0;
+    }
+  };
+
+  const runHooks: ((options: IHeftTaskRunHookOptions) => Promise<void>)[] = [];
+  const changedFilesListeners: ((options: IChangedFilesHookOptions) => void)[] = [];
+  const requestedPluginNames: string[] = [];
+  const taskSession: Partial<IHeftTaskSession> = {
+    logger: logger as IScopedLogger,
+    tempFolderPath: `${FIXTURE_FOLDER}/temp/lint`,
+    parameters: {
+      watch: true,
+      production: false,
+      getFlagParameter: () => ({ value: false })
+    } as unknown as IHeftTaskSession['parameters'],
+    hooks: {
+      run: {
+        tapPromise: (name: string, fn: (options: IHeftTaskRunHookOptions) => Promise<void>) => {
+          runHooks.push(fn);
+        }
+      }
+    } as unknown as IHeftTaskSession['hooks'],
+    requestAccessToPluginByName: ((
+      pluginPackageName: string,
+      pluginName: string,
+      callback: (accessor: ITypeScriptPluginAccessor) => void
+    ) => {
+      requestedPluginNames.push(pluginName);
+      callback({
+        onChangedFilesHook: {
+          tap: (name: string, fn: (options: IChangedFilesHookOptions) => void) => {
+            changedFilesListeners.push(fn);
+          }
+        }
+      } as unknown as ITypeScriptPluginAccessor);
+    }) as IHeftTaskSession['requestAccessToPluginByName']
+  };
+
+  const heftConfiguration: Partial<HeftConfiguration> = {
+    buildFolderPath: FIXTURE_FOLDER,
+    rigPackageResolver: {
+      resolvePackageAsync: async (packageName: string) => `${FIXTURE_FOLDER}/node_modules/${packageName}`
+    } as unknown as HeftConfiguration['rigPackageResolver']
+  };
+
+  return {
+    taskSession: taskSession as IHeftTaskSession,
+    heftConfiguration: heftConfiguration as HeftConfiguration,
+    terminalProvider,
+    errors,
+    requestedPluginNames,
+    reportProgram: (program: IExtendedProgram, changedFileNames: string[]) => {
+      const changedFiles: Set<ts.SourceFile> = new Set(
+        changedFileNames.map((fileName: string) => program.getSourceFile(fileName)!)
+      );
+      for (const listener of changedFilesListeners) {
+        listener({ program, changedFiles } as IChangedFilesHookOptions);
+      }
+    },
+    // Like Heft's task runner: reset the logger, then run the task's run hooks.
+    runAsync: async () => {
+      logger.resetErrorsAndWarnings!();
+      const options: IHeftTaskRunHookOptions = {
+        abortSignal: new AbortController().signal
+      } as IHeftTaskRunHookOptions;
+      await Promise.all(runHooks.map((runHook) => runHook(options)));
+    }
+  };
+}
+
+function writeSourceFile(name: string, text: string): string {
+  const filePath: string = `${FIXTURE_FOLDER}/src/${name}`;
+  FileSystem.writeFile(filePath, text, { ensureFolderExists: true });
+  return filePath;
+}
+
+function createProgram(rootNames: string[]): IExtendedProgram {
+  return ts.createProgram({
+    rootNames,
+    options: {
+      configFilePath: `${FIXTURE_FOLDER}/tsconfig.json`,
+      noEmit: true,
+      types: []
+    }
+  }) as IExtendedProgram;
+}
+
+function getLintedFileCounts(verboseOutput: string): number[] {
+  return Array.from(verboseOutput.matchAll(/Lint: [\d.]+ms \((\d+) files\)/g), (match) => Number(match[1]));
+}
+
+describe('LintPlugin in watch mode', () => {
+  beforeEach(() => {
+    FileSystem.ensureEmptyFolder(FIXTURE_FOLDER);
+  });
+
+  it('does not lint unless the lintInWatchMode option is set', async () => {
+    const session: IWatchSession = createWatchSession();
+    new LintPlugin().apply(session.taskSession, session.heftConfiguration, {});
+
+    await session.runAsync();
+    await session.runAsync();
+
+    expect(session.requestedPluginNames).toEqual([]);
+    expect(session.terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false })).toBe(
+      "Linting isn't currently supported in watch mode\n"
+    );
+  });
+
+  it('with the lintInWatchMode option, reports lint failures in every run until they are fixed', async () => {
+    const session: IWatchSession = createWatchSession();
+    new LintPlugin().apply(session.taskSession, session.heftConfiguration, { lintInWatchMode: true });
+    expect(session.requestedPluginNames).toEqual(['typescript-plugin']);
+
+    const aPath: string = writeSourceFile('a.ts', FAILING_SOURCE);
+    const bPath: string = writeSourceFile('b.ts', 'export const b = 1;\n');
+
+    // The first run lints the files that TypeScript emitted.
+    session.reportProgram(createProgram([aPath, bPath]), [aPath, bPath]);
+    await expect(session.runAsync()).rejects.toBeInstanceOf(AlreadyReportedError);
+    expect(session.errors.map(String)).toEqual([expect.stringContaining('(no-debugger)')]);
+
+    // TypeScript emits nothing, e.g. because only a file that it doesn't compile changed. The file with the
+    // lint failure is linted again, and the failure is reported again.
+    let verboseOutputLength: number = session.terminalProvider.getVerboseOutput().length;
+    await expect(session.runAsync()).rejects.toBeInstanceOf(AlreadyReportedError);
+    expect(session.errors.map(String)).toEqual([expect.stringContaining('(no-debugger)')]);
+    expect(
+      getLintedFileCounts(session.terminalProvider.getVerboseOutput().slice(verboseOutputLength))
+    ).toEqual([1]);
+
+    // Fixing the failure makes the next run pass.
+    writeSourceFile('a.ts', PASSING_SOURCE);
+    session.reportProgram(createProgram([aPath, bPath]), [aPath]);
+    await session.runAsync();
+    expect(session.errors).toEqual([]);
+
+    // Now every file is in the linter's cache, so a run in which TypeScript emits nothing lints no files.
+    verboseOutputLength = session.terminalProvider.getVerboseOutput().length;
+    await session.runAsync();
+    expect(session.errors).toEqual([]);
+    expect(
+      getLintedFileCounts(session.terminalProvider.getVerboseOutput().slice(verboseOutputLength))
+    ).toEqual([0]);
+  }, 60_000);
+});
diff --git a/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts b/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts
index 5fb9ad86fb..60d02a63ae 100644
--- a/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts
+++ b/heft-plugins/heft-typescript-plugin/src/loadTypeScriptTool.ts
@@ -128,7 +128,9 @@ export async function loadTypeScriptToolAsync(
 
   let realpath: typeof ts.sys.realpath = ts.sys.realpath;
   if (onlyResolveSymlinksInNodeModules) {
-    const resolver: RealNodeModulePathResolver = new RealNodeModulePathResolver();
+    // Like `ts.sys.realpath`, which returns the input for a path that does not exist, it must not throw: in watch
+    // mode, TypeScript also asks for the real path of module resolution lookups that failed.
+    const resolver: RealNodeModulePathResolver = new RealNodeModulePathResolver({ ignoreMissingPaths: true });
     realpath = resolver.realNodeModulePath;
   }
 
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 8edf596f7e..8bf935d082 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -20,6 +20,13 @@ export interface IDaemonConfigurationJson {
    * incremental script are not written to the build cache. Defaults to true.
    */
   readonly incrementalBuilds?: boolean;
+  /**
+   * Keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation
+   * whose rush-project.json operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run
+   * when `incrementalBuilds` allows one. Otherwise the worker is closed and the initial script runs. Requires
+   * `incrementalBuilds`. Defaults to false.
+   */
+  readonly warmWorkers?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
   /**
@@ -53,6 +60,7 @@ const defaults: Required<IDaemonConfigurationJson> = {
   watch: false,
   usePersistentIpcRunners: false,
   incrementalBuilds: true,
+  warmWorkers: false,
   queueTimeoutSeconds: 30,
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
@@ -70,6 +78,7 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     watch: 'RUSH_DAEMON_WATCH',
     usePersistentIpcRunners: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
     incrementalBuilds: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
+    warmWorkers: 'RUSH_DAEMON_WARM_WORKERS',
     queueTimeoutSeconds: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
@@ -113,6 +122,7 @@ export function resolveDaemonConfiguration(
     watch: booleanOption('watch', json, environment),
     usePersistentIpcRunners: booleanOption('usePersistentIpcRunners', json, environment),
     incrementalBuilds: booleanOption('incrementalBuilds', json, environment),
+    warmWorkers: booleanOption('warmWorkers', json, environment),
     autoWarmByTelemetry: booleanOption('autoWarmByTelemetry', json, environment),
     idleTimeoutSeconds: numberOption('idleTimeoutSeconds', json, environment),
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
@@ -159,7 +169,8 @@ function booleanOption(
     | 'watch'
     | 'autoWarmByTelemetry'
     | 'usePersistentIpcRunners'
-    | 'incrementalBuilds',
+    | 'incrementalBuilds'
+    | 'warmWorkers',
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): boolean {
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index 926237dd35..723591e0f7 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -278,6 +278,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
   /** Lets daemon builds run an operation's guarded `:incremental` script outside watch mode. */
   RUSH_DAEMON_INCREMENTAL_BUILDS: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
+  /** Keeps `:incremental:ipc` watch-mode workers alive between daemon builds. */
+  RUSH_DAEMON_WARM_WORKERS: 'RUSH_DAEMON_WARM_WORKERS',
   /** Overrides the request admission queue timeout. */
   RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   /** Overrides idle eviction in an attached daemon warm set. */
@@ -697,6 +699,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_WATCH:
           case EnvironmentVariableNames.RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS:
           case EnvironmentVariableNames.RUSH_DAEMON_INCREMENTAL_BUILDS:
+          case EnvironmentVariableNames.RUSH_DAEMON_WARM_WORKERS:
           case EnvironmentVariableNames.RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
diff --git a/libraries/rush-lib/src/api/RushProjectConfiguration.ts b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
index 17dc406e30..d8c539c21e 100644
--- a/libraries/rush-lib/src/api/RushProjectConfiguration.ts
+++ b/libraries/rush-lib/src/api/RushProjectConfiguration.ts
@@ -127,6 +127,19 @@ export interface IOperationSettings {
    */
   daemonIpc?: IDaemonIpcConfiguration;
 
+  /**
+   * If true, and `daemon.warmWorkers` is enabled, the Rush daemon keeps the operation's `<phase>:incremental:ipc`
+   * script running as a warm worker between builds, and sends it the incremental runs that the incremental
+   * execution guard allows.
+   *
+   * @remarks
+   * Set this only if that script, run in watch mode, runs every task and check that the `<phase>` script runs,
+   * because the daemon reports a run on the worker as if the `<phase>` script had run. For Heft, that means the
+   * `lintInWatchMode` option of heft-lint-plugin and the `runInWatchMode` setting of API Extractor, which both
+   * default to skipping their task in watch mode.
+   */
+  allowDaemonWarmWorker?: boolean;
+
   /**
    * Specify the folders where this operation writes its output files. If enabled, the Rush build
    * cache will restore these folders from the cache. The strings are folder names under the project
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index af95f8278d..236f317d0c 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -12,6 +12,7 @@ describe('daemon configuration', () => {
       autoStart: true,
       usePersistentIpcRunners: false,
       incrementalBuilds: true,
+      warmWorkers: false,
       idleTimeoutSeconds: 900
     });
     expect(
@@ -37,7 +38,8 @@ describe('daemon configuration', () => {
     { RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: '' },
     { RUSH_DAEMON_EXPERIMENTAL: 'yes' },
     { RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'yes' },
-    { RUSH_DAEMON_INCREMENTAL_BUILDS: 'off' }
+    { RUSH_DAEMON_INCREMENTAL_BUILDS: 'off' },
+    { RUSH_DAEMON_WARM_WORKERS: 'true' }
   ])('rejects invalid overrides %j', (environment) => {
     expect(() => resolveDaemonConfiguration({}, environment)).toThrow();
   });
@@ -56,6 +58,7 @@ describe('daemon configuration', () => {
     { autoWarmByTelemetry: 1 },
     { usePersistentIpcRunners: 'true' },
     { incrementalBuilds: 'false' },
+    { warmWorkers: 1 },
     { compatiblePlugins: 'rush-example-plugin' },
     { compatiblePlugins: [''] },
     { compatiblePlugins: [' rush-example-plugin'] },
@@ -82,6 +85,14 @@ describe('daemon configuration', () => {
     );
   });
 
+  it('keeps warm workers only if the environment or configuration turns them on', () => {
+    expect(resolveDaemonConfiguration({ warmWorkers: true }, {}).warmWorkers).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ warmWorkers: true }, { RUSH_DAEMON_WARM_WORKERS: '0' }).warmWorkers
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_WARM_WORKERS: '1' }).warmWorkers).toBe(true);
+  });
+
   it('resolves compatible plugin names from the environment, then configuration, then no plugins', () => {
     expect(resolveDaemonConfiguration({}, {}).compatiblePlugins).toEqual([]);
     const configured: string[] = ['rush-a-plugin', 'rush-b-plugin'];
@@ -97,8 +108,10 @@ describe('daemon configuration', () => {
     // An empty value is an explicit override that declares no plugins.
     for (const value of ['', ' ']) {
       expect(
-        resolveDaemonConfiguration({ compatiblePlugins: configured }, { RUSH_DAEMON_COMPATIBLE_PLUGINS: value })
-          .compatiblePlugins
+        resolveDaemonConfiguration(
+          { compatiblePlugins: configured },
+          { RUSH_DAEMON_COMPATIBLE_PLUGINS: value }
+        ).compatiblePlugins
       ).toEqual([]);
     }
     const resolved: readonly string[] = resolveDaemonConfiguration(
diff --git a/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap b/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap
index 8de9fe79d0..876fe54bae 100644
--- a/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap
+++ b/libraries/rush-lib/src/api/test/__snapshots__/RushProjectConfiguration.test.ts.snap
@@ -41,6 +41,7 @@ exports[`RushProjectConfiguration operationSettingsByOperationName loads a rush-
 exports[`RushProjectConfiguration operationSettingsByOperationName loads a rush-project.json config that extends another config file 2`] = `
 Map {
   "_phase:a" => Object {
+    "allowDaemonWarmWorker": true,
     "operationName": "_phase:a",
     "outputFolderNames": Array [
       "a-a",
diff --git a/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json b/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json
index 2d9827001f..fcf2bb0c97 100644
--- a/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json
+++ b/libraries/rush-lib/src/api/test/jsonFiles/rush-project-base.json
@@ -2,7 +2,8 @@
   "operationSettings": [
     {
       "operationName": "_phase:a",
-      "outputFolderNames": ["a-a"]
+      "outputFolderNames": ["a-a"],
+      "allowDaemonWarmWorker": true
     },
     {
       "operationName": "_phase:b",
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 605c5ef016..a651ab08a1 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -238,7 +238,9 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           parameterShortName: '-p',
           argumentName: 'COUNT',
           // An engine host reads this default from the request's environment instead; see #getParallelism().
-          environmentVariable: this.#engineEnvironment ? undefined : EnvironmentVariableNames.RUSH_PARALLELISM,
+          environmentVariable: this.#engineEnvironment
+            ? undefined
+            : EnvironmentVariableNames.RUSH_PARALLELISM,
           description:
             'Specifies the maximum number of concurrent processes to launch during a build.' +
             ' The COUNT should be a positive integer, a percentage value (eg. "50%") or the word "max"' +
@@ -688,6 +690,13 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             /* webpackChunkName: 'IncrementalExecutionGuardPlugin' */ '../../logic/operations/IncrementalExecutionGuardPlugin'
           );
           new IncrementalExecutionGuardPlugin().apply(this.hooks);
+          if (this.rushConfiguration.daemon.warmWorkers && !this.#noIPCParameter?.value) {
+            // Applied after DaemonIpcOperationRunnerPlugin, so that an explicit IPC tool keeps its runner.
+            const { DaemonWarmWorkerPlugin } = await import(
+              /* webpackChunkName: 'DaemonWarmWorkerPlugin' */ '../../logic/operations/DaemonWarmWorkerPlugin'
+            );
+            new DaemonWarmWorkerPlugin().apply(this.hooks);
+          }
         }
         if (isWatch && this.#noIPCParameter?.value === false) {
           new (
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index f9fa44afde..32811efbbb 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -166,6 +166,7 @@ export type {
 } from './logic/operations/IOperationRunner';
 export type {
   IIncrementalExecutionGuard,
+  IIncrementalExecutionGuardOptions,
   IOperationCommandExecution
 } from './logic/operations/IncrementalExecutionState';
 export type {
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 485ff10710..aec9ae0dba 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -51,7 +51,7 @@ import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration'
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
 import { enableUnverifiedRetainedOperations, markResultUnverifiable } from './RetainedResultVerification';
-import { wasExecutedIncrementally } from './IncrementalExecutionState';
+import { isBuildCacheReadSkipped, wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
 const PERIODIC_CALLBACK_INTERVAL_IN_SECONDS: number = 10;
@@ -516,6 +516,9 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }
               return !!restoreFromCacheSuccess;
             };
+            // A runner that reuses outputs that it keeps in memory, e.g. a warm worker, can skip the read.
+            const isCacheReadAllowed: boolean =
+              buildCacheContext.isCacheReadAllowed && !isBuildCacheReadSkipped(record);
             if (cobuildLock) {
               // handling rebuilds. "rush rebuild" or "rush retest" command will save operations to
               // the build cache once completed, but does not retrieve them (since the "incremental"
@@ -539,14 +542,14 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                 if (restoreFromCacheSuccess) {
                   return status;
                 }
-              } else if (!buildCacheContext.isCacheReadAttempted && buildCacheContext.isCacheReadAllowed) {
+              } else if (!buildCacheContext.isCacheReadAttempted && isCacheReadAllowed) {
                 const restoreFromCacheSuccess: boolean = await restoreCacheAsync(operationBuildCache);
 
                 if (restoreFromCacheSuccess) {
                   return OperationStatus.FromCache;
                 }
               }
-            } else if (buildCacheContext.isCacheReadAllowed) {
+            } else if (isCacheReadAllowed) {
               const restoreFromCacheSuccess: boolean = await restoreCacheAsync(operationBuildCache);
 
               if (restoreFromCacheSuccess) {
diff --git a/libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts b/libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts
new file mode 100644
index 0000000000..0af5e0f7f6
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/DaemonWarmWorkerPlugin.ts
@@ -0,0 +1,127 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  ICreateOperationsContext,
+  IOperationGraphContext,
+  IPhasedCommandPlugin,
+  PhasedCommandHooks
+} from '../../pluginFramework/PhasedCommandHooks';
+import type { IOperationGraph } from './IOperationGraph';
+import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IOperationRunnerContext } from './IOperationRunner';
+import type { Operation } from './Operation';
+import type { OperationStatus } from './OperationStatus';
+import {
+  PLUGIN_NAME as ShellOperationPluginName,
+  formatCommand,
+  getCustomParameterValuesByOperation,
+  getDisplayName,
+  type ICustomParameterValuesForOperation
+} from './ShellOperationRunnerPlugin';
+import { WarmWorkerOperationRunner } from './WarmWorkerOperationRunner';
+
+const PLUGIN_NAME: 'DaemonWarmWorkerPlugin' = 'DaemonWarmWorkerPlugin';
+
+// Before the default stage, so that a worker that must not be reused is closed before CacheableOperationPlugin
+// restores the operation's outputs, and before the Rush daemon notes which runners were active.
+const PREPARE_STAGE: number = -1;
+
+/**
+ * Runs the operations whose settings set `allowDaemonWarmWorker` and whose projects define a
+ * `<phase>:incremental:ipc` script in warm workers, see `WarmWorkerOperationRunner`. For the non-watch commands of
+ * the Rush daemon, with `IncrementalExecutionGuardPlugin`, which decides whether a worker may build on top of the
+ * outputs of its last run.
+ *
+ * @remarks
+ * The script alone is not enough, because `rush start` runs the same script in watch mode, where a project may
+ * intend to skip tasks such as lint. Operations that already have a runner, e.g. one for an explicit IPC tool, and
+ * operations with a shell command or shards are not changed.
+ */
+export class DaemonWarmWorkerPlugin implements IPhasedCommandPlugin {
+  public apply(hooks: PhasedCommandHooks): void {
+    hooks.createOperationsAsync.tap(
+      {
+        name: PLUGIN_NAME,
+        before: ShellOperationPluginName
+      },
+      (operations: Set<Operation>, context: ICreateOperationsContext): Set<Operation> => {
+        const { isWatch, isIncrementalBuildAllowed } = context;
+        if (isWatch || !isIncrementalBuildAllowed) {
+          return operations;
+        }
+
+        const getCustomParameterValues: (operation: Operation) => ICustomParameterValuesForOperation =
+          getCustomParameterValuesByOperation();
+
+        for (const operation of operations) {
+          const { associatedPhase: phase, associatedProject: project, runner, settings } = operation;
+          if (
+            runner ||
+            phase.shellCommand !== undefined ||
+            settings?.sharding ||
+            settings?.allowDaemonWarmWorker !== true
+          ) {
+            continue;
+          }
+
+          const { scripts } = project.packageJson;
+          const { name: phaseName } = phase;
+          const initialScript: string | undefined = scripts?.[phaseName];
+          const incrementalIpcScript: string | undefined = scripts?.[`${phaseName}:incremental:ipc`];
+          if (!initialScript || !incrementalIpcScript) {
+            continue;
+          }
+          const initialIpcScript: string | undefined = scripts?.[`${phaseName}:ipc`];
+
+          const { parameterValues: customParameterValues, ignoredParameterValues } =
+            getCustomParameterValues(operation);
+          const initialCommand: string = formatCommand(initialScript, customParameterValues);
+          operation.runner = new WarmWorkerOperationRunner({
+            phase,
+            rushProject: project,
+            displayName: getDisplayName(phase, project),
+            initialCommand,
+            initialIpcCommand: initialIpcScript
+              ? formatCommand(initialIpcScript, customParameterValues)
+              : undefined,
+            incrementalIpcCommand: formatCommand(incrementalIpcScript, customParameterValues),
+            // As for ShellOperationRunner, so that the build cache entries do not depend on warm workers.
+            commandForHash: initialCommand,
+            ignoredParameterValues
+          });
+        }
+
+        return operations;
+      }
+    );
+
+    hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph: IOperationGraph, context: IOperationGraphContext) => {
+      if (context.isWatch || !context.isIncrementalBuildAllowed) {
+        return;
+      }
+      graph.hooks.beforeExecuteOperationAsync.tapPromise(
+        { name: PLUGIN_NAME, stage: PREPARE_STAGE },
+        async (
+          record: IOperationRunnerContext & IOperationExecutionResult
+        ): Promise<OperationStatus | undefined> => {
+          const { operation } = record;
+          const { runner } = operation;
+          if (record.enabled && runner instanceof WarmWorkerOperationRunner) {
+            await runner.prepareAsync(record, graph.resultByOperation.has(operation));
+          }
+          return undefined;
+        }
+      );
+      graph.hooks.afterExecuteOperationAsync.tapPromise(
+        PLUGIN_NAME,
+        async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+          const { runner } = record.operation;
+          if (runner instanceof WarmWorkerOperationRunner) {
+            await runner.writeUnusedNotesAsync(record);
+          }
+        }
+      );
+    });
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index f643f8b135..7e9ac9856f 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { createHash, type Hash } from 'node:crypto';
+import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { FileSystem, InternalError, Path } from '@rushstack/node-core-library';
@@ -24,10 +25,12 @@ import {
   NATIVE_COMMAND_INVALIDATION_REASON,
   setIncrementalExecutionGuard,
   type ICommandExecution,
-  type IIncrementalExecutionGuard
+  type IIncrementalExecutionGuard,
+  type IIncrementalExecutionGuardOptions
 } from './IncrementalExecutionState';
 import {
   describeOutputFileChanges,
+  hasContentHashedOutputChange,
   readOperationOutputManifestAsync,
   type IOperationOutputManifest
 } from './OperationOutputManifest';
@@ -38,6 +41,9 @@ const PLUGIN_NAME: 'IncrementalExecutionGuardPlugin' = 'IncrementalExecutionGuar
 // Runs after the default-stage taps, e.g. CacheableOperationPlugin's input file checks, which can mark a result as
 // unverifiable.
 const RECORD_RESULT_STAGE: number = 1;
+// Runs before those checks, so that a folder that was recreated before the input folders were read makes the result
+// unverifiable, if the build cache checks the operation's input files.
+const READ_INPUT_FOLDERS_STAGE: number = -1;
 
 const MAX_EXAMPLE_PATHS: number = 3;
 
@@ -225,14 +231,19 @@ export function getIncrementalInputChangeReason(
  *    failure, or a run that was interrupted or whose input files changed while it ran. A native Rush command that
  *    ran in the workspace since then forgets every such result.
  * 2. Its inputs changed as {@link getIncrementalInputChangeReason} allows.
- * 3. Its declared output folders hold the same files and folders as at the end of that run, and none of the folders
+ * 3. If that run was in a process that keeps watching the input files, such as a warm worker, none of the folders
+ *    that held its input files was deleted or recreated since that run. A watcher can miss changes in such a folder,
+ *    e.g. one that a branch switch recreated.
+ * 4. Its declared output folders hold the same files and folders as at the end of that run, and none of the folders
  *    was recreated or had an entry added, removed or replaced since then.
- * 4. Its outputs do not include bundles (JavaScript or CSS in a `dist` or `release` folder, or with a content hash in
- *    the name). A bundler can replace a chunk with a differently named one and leave the old one behind.
+ * 5. Its outputs do not include bundles (JavaScript or CSS in a `dist` or `release` folder, or with a content hash in
+ *    the name). A bundler can replace a chunk with a differently named one and leave the old one behind. A runner
+ *    whose incremental runs keep the previous build in memory can accept bundles with `outputsMayBeBundles`.
  *
  * When the incremental command succeeds, the operation's output files must be the files that it had before, or the
- * initial command runs as well. Results of the incremental command are never written to the build cache (see
- * `CacheableOperationPlugin`).
+ * initial command runs as well. The operation then never runs its incremental command again in this graph, unless
+ * the runner passed `outputsMayBeBundles` and no content-hashed output was added or removed. Results of the
+ * incremental command are never written to the build cache (see `CacheableOperationPlugin`).
  */
 export class IncrementalExecutionGuardPlugin implements IPhasedCommandPlugin {
   public apply(hooks: PhasedCommandHooks): void {
@@ -251,6 +262,9 @@ interface IOutputState {
 
 interface IIncrementalBase {
   readonly inputs: IIncrementalInputState;
+  // The identity of each folder that held an input file, if the last run was in a process that keeps watching the
+  // input files. Read before that run started, unless no check preceded it.
+  readonly inputFolders: ReadonlyMap<string, string> | undefined;
   // Rejects if the output folders could not be read.
   readonly outputsPromise: Promise<IOutputState>;
 }
@@ -261,10 +275,13 @@ interface IRecordState {
   readonly getOperationEnvironment: IOperationGraphIterationOptions['getOperationEnvironment'];
   preRunOutputs?: IOperationOutputManifest;
   verifiedOutputs?: IOutputState;
+  inputFolders?: ReadonlyMap<string, string>;
 }
 
 function applyToGraph(graph: IOperationGraph): void {
   const baseByOperation: Map<Operation, IIncrementalBase> = new Map();
+  // Callers that pass `outputsMayBeBundles` add an entry only after their incremental command renamed a
+  // content-hashed output. An operation keeps its runner for the life of the graph.
   const cleanOnlyReasonByOperation: Map<Operation, string> = new Map();
   const stateByRecord: WeakMap<IOperationExecutionResult, IRecordState> = new WeakMap();
 
@@ -284,8 +301,10 @@ function applyToGraph(graph: IOperationGraph): void {
         const recordState: IRecordState = { records, inputsSnapshot, getOperationEnvironment };
         stateByRecord.set(record, recordState);
         const guard: IIncrementalExecutionGuard = {
-          getBlockReasonAsync: () => getBlockReasonAsync(record, recordState),
-          verifyIncrementalResultAsync: () => verifyIncrementalResultAsync(record, recordState)
+          getBlockReasonAsync: (options?: IIncrementalExecutionGuardOptions) =>
+            getBlockReasonAsync(record, recordState, options),
+          verifyIncrementalResultAsync: (options?: IIncrementalExecutionGuardOptions) =>
+            verifyIncrementalResultAsync(record, recordState, options)
         };
         setIncrementalExecutionGuard(record, guard);
       }
@@ -294,7 +313,8 @@ function applyToGraph(graph: IOperationGraph): void {
 
   async function getBlockReasonAsync(
     record: IOperationExecutionResult,
-    recordState: IRecordState
+    recordState: IRecordState,
+    { outputsMayBeBundles = false }: IIncrementalExecutionGuardOptions = {}
   ): Promise<string | undefined> {
     const { operation } = record;
     const cleanOnlyReason: string | undefined = cleanOnlyReasonByOperation.get(operation);
@@ -305,6 +325,16 @@ function applyToGraph(graph: IOperationGraph): void {
     if (!base) {
       return 'its outputs were not built by a successful run of its own command in this process';
     }
+    let changedFolders: string[] | undefined;
+    if (base.inputFolders) {
+      // Read before the command starts, so that the next check notices a folder that is recreated while it runs.
+      const inputFolders: ReadonlyMap<string, string> = readInputFolderIdentities(
+        operation,
+        recordState.inputsSnapshot
+      );
+      recordState.inputFolders = inputFolders;
+      changedFolders = getChangedFolders(base.inputFolders, inputFolders);
+    }
 
     const inputChangeReason: string | undefined = getIncrementalInputChangeReason(
       operation,
@@ -319,6 +349,11 @@ function applyToGraph(graph: IOperationGraph): void {
     if (inputChangeReason) {
       return inputChangeReason;
     }
+    if (changedFolders?.length) {
+      return `folders that held its input files were deleted or recreated since its last run${formatExamplePaths(
+        changedFolders
+      )}`;
+    }
 
     const outputFolderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
     if (!outputFolderNames?.length) {
@@ -330,7 +365,7 @@ function applyToGraph(graph: IOperationGraph): void {
     } catch (error) {
       return `its output folders could not be read after its last run: ${error}`;
     }
-    if (baseOutputs.cleanOnlyReason) {
+    if (baseOutputs.cleanOnlyReason && !outputsMayBeBundles) {
       cleanOnlyReasonByOperation.set(operation, baseOutputs.cleanOnlyReason);
       return baseOutputs.cleanOnlyReason;
     }
@@ -348,7 +383,8 @@ function applyToGraph(graph: IOperationGraph): void {
 
   async function verifyIncrementalResultAsync(
     record: IOperationExecutionResult,
-    recordState: IRecordState
+    recordState: IRecordState,
+    { outputsMayBeBundles = false }: IIncrementalExecutionGuardOptions = {}
   ): Promise<string | undefined> {
     const { operation } = record;
     const { preRunOutputs } = recordState;
@@ -360,24 +396,39 @@ function applyToGraph(graph: IOperationGraph): void {
       operation.associatedProject.projectFolder,
       outputFolderNames
     );
+    if (outputs.cleanOnlyReason && !outputsMayBeBundles) {
+      cleanOnlyReasonByOperation.set(operation, outputs.cleanOnlyReason);
+      return outputs.cleanOnlyReason;
+    }
     const changes: string | undefined = describeOutputFileChanges(preRunOutputs.files, outputs.files);
     if (changes) {
-      // Its outputs may be named after their content, so a later incremental run could leave stale files behind.
-      cleanOnlyReasonByOperation.set(
-        operation,
-        `its incremental command changed which output files it has in an earlier run: ${changes}`
-      );
+      // Its outputs may be named after their content, so a later incremental run could leave stale files behind. A
+      // runner that keeps its build in memory can run again, unless a content-hashed output was renamed: a bundler
+      // renames it whenever its content changes, so the initial command would run after every incremental run.
+      if (!outputsMayBeBundles || hasContentHashedOutputChange(preRunOutputs.files, outputs.files)) {
+        cleanOnlyReasonByOperation.set(
+          operation,
+          `its incremental command changed which output files it has in an earlier run: ${changes}`
+        );
+      }
       return `the incremental command changed which output files it has: ${changes}`;
     }
-    if (outputs.cleanOnlyReason) {
-      cleanOnlyReasonByOperation.set(operation, outputs.cleanOnlyReason);
-      return outputs.cleanOnlyReason;
-    }
     // eslint-disable-next-line require-atomic-updates -- The runner of the execution record calls the guard sequentially.
     recordState.verifiedOutputs = { signature: outputs.signature, cleanOnlyReason: undefined };
     return undefined;
   }
 
+  graph.hooks.afterExecuteOperationAsync.tap(
+    { name: PLUGIN_NAME, stage: READ_INPUT_FOLDERS_STAGE },
+    (record: IOperationRunnerContext & IOperationExecutionResult): void => {
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      // E.g. the first run of the operation in this graph, which no check preceded
+      if (recordState && !recordState.inputFolders && getCommandExecution(record)?.watchesInputs) {
+        recordState.inputFolders = readInputFolderIdentities(record.operation, recordState.inputsSnapshot);
+      }
+    }
+  );
+
   graph.hooks.afterExecuteOperationAsync.tapPromise(
     { name: PLUGIN_NAME, stage: RECORD_RESULT_STAGE },
     async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
@@ -427,6 +478,7 @@ function applyToGraph(graph: IOperationGraph): void {
           getEnvironment(record, recordState),
           recordState.records
         ),
+        inputFolders: execution.watchesInputs ? recordState.inputFolders : undefined,
         outputsPromise
       });
       // Finish reading the outputs before anything else can change them, e.g. an operation that depends on this one.
@@ -504,12 +556,87 @@ function describeInputFileChanges(
   if (changedFiles.length === 0) {
     return '';
   }
-  changedFiles.sort();
-  const examples: string = changedFiles
+  return formatExamplePaths(changedFiles);
+}
+
+function formatExamplePaths(paths: string[]): string {
+  paths.sort();
+  const examples: string = paths
     .slice(0, MAX_EXAMPLE_PATHS)
     .map((filePath: string) => JSON.stringify(filePath))
     .join(', ');
-  return ` (${examples}${changedFiles.length > MAX_EXAMPLE_PATHS ? ', ...' : ''})`;
+  return ` (${examples}${paths.length > MAX_EXAMPLE_PATHS ? ', ...' : ''})`;
+}
+
+/**
+ * Returns the identity of each folder of the operation's project that holds one of its input files, by the path of
+ * the folder relative to the root of the inputs snapshot.
+ */
+function readInputFolderIdentities(
+  operation: Operation,
+  inputsSnapshot: IInputsSnapshot
+): ReadonlyMap<string, string> {
+  const { associatedProject: project, associatedPhase: phase } = operation;
+  const projectPrefix: string = getProjectPrefix(inputsSnapshot, project);
+  const folderPaths: Set<string> = new Set();
+  for (const filePath of inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name).keys()) {
+    if (filePath.startsWith(projectPrefix) && !path.isAbsolute(filePath)) {
+      folderPaths.add(filePath.slice(0, Math.max(filePath.lastIndexOf('/'), 0)));
+    }
+  }
+  const identities: Map<string, string> = new Map();
+  for (const folderPath of folderPaths) {
+    identities.set(folderPath, getFolderIdentity(path.resolve(inputsSnapshot.rootDirectory, folderPath)));
+  }
+  return identities;
+}
+
+/**
+ * Returns the folders of `lastIdentities` whose identity changed, including folders that no longer hold input files.
+ * A changed folder inside another changed folder is left out, e.g. a recreated "src" is named without its subfolders.
+ */
+function getChangedFolders(
+  lastIdentities: ReadonlyMap<string, string>,
+  currentIdentities: ReadonlyMap<string, string>
+): string[] {
+  const changedFolders: Set<string> = new Set();
+  for (const [folderPath, identity] of lastIdentities) {
+    if (currentIdentities.get(folderPath) !== identity) {
+      changedFolders.add(folderPath);
+    }
+  }
+  const topFolders: string[] = [];
+  for (const folderPath of changedFolders) {
+    if (!hasAncestorFolder(folderPath, changedFolders)) {
+      topFolders.push(folderPath);
+    }
+  }
+  return topFolders;
+}
+
+// Folder paths are relative, with "/" separators, and "" is the root of the inputs snapshot.
+function hasAncestorFolder(folderPath: string, folderPaths: ReadonlySet<string>): boolean {
+  let parentPath: string = folderPath;
+  while (parentPath) {
+    parentPath = parentPath.slice(0, Math.max(parentPath.lastIndexOf('/'), 0));
+    if (folderPaths.has(parentPath)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// A folder that was deleted and recreated has another inode, or at least another birth time. Unlike its modification
+// and status change times, neither changes when an entry of the folder is added, removed or replaced, e.g. by an
+// editor that saves a file by renaming a new file over it.
+function getFolderIdentity(folderPath: string): string {
+  try {
+    const stats: fs.Stats | undefined = fs.lstatSync(folderPath, { throwIfNoEntry: false });
+    return stats ? `${stats.dev}:${stats.ino}:${stats.birthtimeMs}` : 'missing';
+  } catch (error) {
+    // E.g. ENOTDIR, if a folder on its path was replaced by a file
+    return `${(error as NodeJS.ErrnoException).code}`;
+  }
 }
 
 /**
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
index dea5f04106..6937c6bdfa 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
@@ -18,6 +18,22 @@ export const INPUTS_CHANGED_INVALIDATION_REASON: 'workspace-inputs-changed' = 'w
  */
 export const NATIVE_COMMAND_INVALIDATION_REASON: 'native-command-completed' = 'native-command-completed';
 
+/**
+ * Options that an operation runner passes to its {@link IIncrementalExecutionGuard}.
+ *
+ * @beta
+ */
+export interface IIncrementalExecutionGuardOptions {
+  /**
+   * Set by a runner whose incremental runs keep the previous build in memory, such as a watch-mode bundler in a
+   * warm worker. Outputs that look like bundles then do not require the initial command. If an incremental run
+   * changes which output files exist, that run is still followed by the initial command, but later runs of the
+   * operation may use the incremental command again, unless the run added or removed a content-hashed file.
+   * Defaults to false.
+   */
+  readonly outputsMayBeBundles?: boolean;
+}
+
 /**
  * Decides whether an operation may run its `:incremental` command outside watch mode.
  * The Rush daemon registers one for each execution record. Runners get it from
@@ -30,12 +46,12 @@ export interface IIncrementalExecutionGuard {
    * Returns `undefined` if the incremental command may run, otherwise why it may not, as a clause that completes
    * "Not using the incremental command because ...", e.g. `its command line changed`.
    */
-  getBlockReasonAsync(): Promise<string | undefined>;
+  getBlockReasonAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
   /**
    * Called after the incremental command succeeded. Returns `undefined` if its outputs can be kept, otherwise why
    * the initial command must run as well, as a clause that completes "Running the initial command, because ...".
    */
-  verifyIncrementalResultAsync(): Promise<string | undefined>;
+  verifyIncrementalResultAsync(options?: IIncrementalExecutionGuardOptions): Promise<string | undefined>;
 }
 
 /**
@@ -57,11 +73,19 @@ export interface IOperationCommandExecution {
    * Whether the runner has an incremental command that a later iteration could use.
    */
   readonly hasIncrementalCommand: boolean;
+  /**
+   * Whether the command ran in a process that keeps watching the operation's input files after the command
+   * completed, to run the incremental command again, such as a warm worker. A watcher can miss changes in a folder
+   * that was deleted and recreated, so the next incremental run then requires that none of the folders that held
+   * input files was deleted or recreated since this run. Defaults to false.
+   */
+  readonly watchesInputs?: boolean;
 }
 
-// Both maps are keyed by the execution record, which is the runner's context and the hooks' argument.
+// All are keyed by the execution record, which is the runner's context and the hooks' argument.
 const guardByRecord: WeakMap<object, IIncrementalExecutionGuard> = new WeakMap();
 const commandExecutionByRecord: WeakMap<object, ICommandExecution> = new WeakMap();
+const recordsWithoutCacheRead: WeakSet<object> = new WeakSet();
 
 export function setIncrementalExecutionGuard(record: object, guard: IIncrementalExecutionGuard): void {
   guardByRecord.set(record, guard);
@@ -91,3 +115,19 @@ export function getCommandExecution(record: object): ICommandExecution | undefin
 export function wasExecutedIncrementally(record: object): boolean {
   return commandExecutionByRecord.get(record)?.kind === 'incremental';
 }
+
+/**
+ * Records that the runner of an execution record will run its incremental command without first trying to restore
+ * the operation from the build cache, e.g. because a restore would replace the outputs that a warm worker built and
+ * keeps in memory. Call it from a `beforeExecuteOperationAsync` tap that runs before `CacheableOperationPlugin`'s.
+ */
+export function skipBuildCacheRead(record: object): void {
+  recordsWithoutCacheRead.add(record);
+}
+
+/**
+ * Returns true if `skipBuildCacheRead` was called for the execution record.
+ */
+export function isBuildCacheReadSkipped(record: object): boolean {
+  return recordsWithoutCacheRead.has(record);
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index 310c99c409..71a9ef1dbd 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -323,8 +323,12 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
   /**
    * {@inheritdoc IOperationRunnerContext.reportCommandExecution}
    */
-  public reportCommandExecution({ kind, hasIncrementalCommand }: IOperationCommandExecution): void {
-    setCommandExecution(this, { kind, hasIncrementalCommand });
+  public reportCommandExecution({
+    kind,
+    hasIncrementalCommand,
+    watchesInputs
+  }: IOperationCommandExecution): void {
+    setCommandExecution(this, { kind, hasIncrementalCommand, watchesInputs });
   }
 
   public get silent(): boolean {
diff --git a/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
index 006b1d6c05..adac51f772 100644
--- a/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationOutputManifest.ts
@@ -118,8 +118,7 @@ export function getCleanOnlyReason(files: Iterable<string>): string | undefined
   let bundleFile: string | undefined;
   for (const file of files) {
     const baseName: string = file.slice(file.lastIndexOf('/') + 1);
-    const match: RegExpExecArray | null = HASHED_BUNDLE_FILE_REGEXP.exec(baseName);
-    if (match && /\d/.test(match[1])) {
+    if (isContentHashedBundleFile(baseName)) {
       return `its outputs include the content-hashed file "${file}"`;
     }
     if (bundleFile === undefined && BUNDLE_FILE_REGEXP.test(baseName) && BUNDLE_FOLDER_REGEXP.test(file)) {
@@ -129,9 +128,48 @@ export function getCleanOnlyReason(files: Iterable<string>): string | undefined
   return bundleFile === undefined ? undefined : `its outputs include the bundle "${bundleFile}"`;
 }
 
+function isContentHashedBundleFile(baseName: string): boolean {
+  const match: RegExpExecArray | null = HASHED_BUNDLE_FILE_REGEXP.exec(baseName);
+  return !!match && /\d/.test(match[1]);
+}
+
+// A chunk or asset that a bundler named after its content, which it renames whenever the content changes.
+function isContentHashedOutput(file: string): boolean {
+  return (
+    isContentHashedBundleFile(file.slice(file.lastIndexOf('/') + 1)) ||
+    (CONTENT_ADDRESSED_PATH_REGEXP.test(file) && BUNDLE_FOLDER_REGEXP.test(file))
+  );
+}
+
+// A content-hashed file that a bundler emits is not a cache entry: a full build would not leave an old one behind.
+function isCacheEntry(file: string): boolean {
+  return CONTENT_ADDRESSED_PATH_REGEXP.test(file) && !isContentHashedOutput(file);
+}
+
+/**
+ * Whether a content-hashed chunk or asset, as bundlers emit, is among the files that were added or removed.
+ */
+export function hasContentHashedOutputChange(
+  before: ReadonlySet<string>,
+  after: ReadonlySet<string>
+): boolean {
+  for (const file of after) {
+    if (!before.has(file) && isContentHashedOutput(file)) {
+      return true;
+    }
+  }
+  for (const file of before) {
+    if (!after.has(file) && isContentHashedOutput(file)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Describes how two sets of output files differ, e.g. `2 added ("lib/a.js", ...), 1 removed ("lib/b.js")`.
- * Files whose paths contain a content hash, such as cache entries, are ignored.
+ * Cache entries whose paths contain a content hash are ignored. Content-hashed bundles, and files in a `dist` or
+ * `release` folder, are not.
  */
 export function describeOutputFileChanges(
   before: ReadonlySet<string>,
@@ -140,12 +178,12 @@ export function describeOutputFileChanges(
   const added: string[] = [];
   const removed: string[] = [];
   for (const file of after) {
-    if (!before.has(file) && !CONTENT_ADDRESSED_PATH_REGEXP.test(file)) {
+    if (!before.has(file) && !isCacheEntry(file)) {
       added.push(file);
     }
   }
   for (const file of before) {
-    if (!after.has(file) && !CONTENT_ADDRESSED_PATH_REGEXP.test(file)) {
+    if (!after.has(file) && !isCacheEntry(file)) {
       removed.push(file);
     }
   }
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
index 9283810d9c..e4b827d42f 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunner.ts
@@ -41,7 +41,10 @@ export interface IShellOperationRunnerOptions {
   ignoredParameterValues: ReadonlyArray<string>;
 }
 
-interface ICommandTerminals {
+/**
+ * The terminals that `ShellOperationRunner.invokeCommandAsync` writes to.
+ */
+export interface ICommandTerminals {
   readonly terminal: ITerminal;
   readonly terminalProvider: ITerminalProvider;
   readonly structuredChildOutputTerminalProvider: ITerminalProvider;
@@ -166,21 +169,40 @@ export class ShellOperationRunner implements IOperationRunner {
 
   async #invokeCommandAsync(
     context: IOperationRunnerContext,
-    { terminal, terminalProvider, structuredChildOutputTerminalProvider }: ICommandTerminals,
+    terminals: ICommandTerminals,
     kind: ICommandExecution['kind'],
     commandToRun: string
   ): Promise<OperationStatus> {
-    let hasWarningOrError: boolean = false;
-
     if (this.#incrementalCommandRequiresGuard) {
       // Recorded before the command starts, so that outputs of a command that fails or is aborted are attributed to it.
       setCommandExecution(context, { kind, hasIncrementalCommand: this.#incrementalCommand !== undefined });
     }
+    return await ShellOperationRunner.invokeCommandAsync(
+      context,
+      terminals,
+      this.#rushProject,
+      kind,
+      commandToRun
+    );
+  }
+
+  /**
+   * Runs a command of an operation in a shell, in the folder of its project, and returns the operation's status.
+   * It does not record the command execution for the incremental execution guard; the caller does that.
+   */
+  public static async invokeCommandAsync(
+    context: IOperationRunnerContext,
+    { terminal, terminalProvider, structuredChildOutputTerminalProvider }: ICommandTerminals,
+    rushProject: RushConfigurationProject,
+    kind: ICommandExecution['kind'],
+    commandToRun: string
+  ): Promise<OperationStatus> {
+    let hasWarningOrError: boolean = false;
 
     // Run the operation
     terminal.writeLine(`Invoking (${kind}): ${commandToRun}`);
 
-    const { rushConfiguration, projectFolder } = this.#rushProject;
+    const { rushConfiguration, projectFolder } = rushProject;
 
     const { environment: initialEnvironment, abortSignal } = context;
     const childProcessReporter: IOperationChildProcessReporter | undefined =
@@ -291,7 +313,7 @@ export class ShellOperationRunner implements IOperationRunner {
 /**
  * Returns what an incremental execution guard returned, or why it failed.
  */
-async function getGuardResultAsync(
+export async function getGuardResultAsync(
   getResultAsync: () => Promise<string | undefined>
 ): Promise<string | undefined> {
   try {
diff --git a/libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts b/libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts
new file mode 100644
index 0000000000..065750fa86
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/WarmWorkerOperationRunner.ts
@@ -0,0 +1,753 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+import { StringDecoder } from 'node:string_decoder';
+
+import type {
+  IAfterExecuteEventMessage,
+  IExitCommandMessage,
+  IRequestRunEventMessage,
+  IRunCommandMessage,
+  ISyncEventMessage
+} from '@rushstack/operation-graph';
+import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { TerminalProviderSeverity, type ITerminal, type ITerminalProvider } from '@rushstack/terminal';
+
+import type { IPhase } from '../../api/CommandLineConfiguration';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import { Utilities, type IEnvironment } from '../../utilities/Utilities';
+import type { IOperationRunner, IOperationRunnerContext, IOperationLastState } from './IOperationRunner';
+import { OperationError } from './OperationError';
+import { OperationStatus } from './OperationStatus';
+import {
+  getIncrementalExecutionGuard,
+  setCommandExecution,
+  skipBuildCacheRead,
+  type ICommandExecution,
+  type IIncrementalExecutionGuard,
+  type IIncrementalExecutionGuardOptions
+} from './IncrementalExecutionState';
+import { getGuardResultAsync, ShellOperationRunner, type ICommandTerminals } from './ShellOperationRunner';
+
+const DEFAULT_MAX_RUNS_PER_WORKER: number = 25;
+const DEFAULT_MAX_MEMORY_GROWTH: number = 2;
+const DEFAULT_CHANGE_REPORT_TIMEOUT_MS: number = 1000;
+const EXIT_TIMEOUT_MS: number = 10000;
+const BYTES_PER_MB: number = 1024 * 1024;
+
+// A worker keeps its last build in memory and only writes the outputs that changed, so its outputs may be bundles.
+const GUARD_OPTIONS: IIncrementalExecutionGuardOptions = { outputsMayBeBundles: true };
+const INITIAL_COMMAND_REASON: string = 'the initial command must run';
+const FAILED_OPERATION_REASON: string = 'the operation failed, so its next build runs the initial command';
+
+// On Linux and macOS, TypeScript's default file watcher follows the inode of each file. After a file is replaced (git
+// deletes and recreates each file that it writes), that watcher can lose track of the file for the life of the
+// process, and a worker would then miss every later edit to the file and keep its stale outputs. A watcher on the
+// file's folder sees the new file. TypeScript reads the variable only if the tsconfig.json does not set
+// `watchOptions.watchFile`, and a value in the operation's environment is kept.
+const TYPESCRIPT_WATCH_FILE_VARIABLE: string = 'TSC_WATCHFILE';
+const TYPESCRIPT_WATCH_FILE: string = 'UseFsEventsOnParentDirectory';
+
+/**
+ * @internal
+ */
+export interface IWarmWorkerOperationRunnerOptions {
+  phase: IPhase;
+  rushProject: RushConfigurationProject;
+  displayName: string;
+  /**
+   * The initial command of the operation, which runs in a shell if `initialIpcCommand` is undefined.
+   */
+  initialCommand: string;
+  /**
+   * The `<phase>:ipc` command of the operation, if it has one: a worker that builds from scratch and then waits for
+   * further runs.
+   */
+  initialIpcCommand: string | undefined;
+  /**
+   * The `<phase>:incremental:ipc` command of the operation: a worker that builds on top of the existing outputs and
+   * then waits for further runs.
+   */
+  incrementalIpcCommand: string;
+  commandForHash: string;
+  ignoredParameterValues: ReadonlyArray<string>;
+  /**
+   * A worker is closed after this many runs. Defaults to 25.
+   */
+  maxRunsPerWorker?: number;
+  /**
+   * A worker is closed once its resident memory is more than this multiple of its resident memory after its first
+   * run. Defaults to 2.
+   */
+  maxMemoryGrowth?: number;
+  /**
+   * How long a reused worker may take to report a change that it saw, in milliseconds, before it is told to run
+   * anyway. A worker decides what to rebuild from the changes that its own file watcher reported, so a run that
+   * starts before the watcher saw an edit would not rebuild it. Defaults to 1000.
+   */
+  changeReportTimeoutMs?: number;
+}
+
+interface IRunPlan {
+  readonly kind: ICommandExecution['kind'];
+  // Printed to the operation's log before the command runs.
+  readonly notes: ReadonlyArray<string>;
+}
+
+interface IWorkerRunResult {
+  readonly status: OperationStatus;
+  readonly hasWarningOrError: boolean;
+}
+
+interface IWorkerCommandResult {
+  readonly status: OperationStatus;
+  // Whether the run was sent to a worker that had run before, i.e. one that may keep state from earlier runs.
+  readonly wasWorkerReused: boolean;
+}
+
+function isAfterExecuteEventMessage(message: unknown): message is IAfterExecuteEventMessage {
+  return (
+    !!message &&
+    typeof message === 'object' &&
+    (message as IAfterExecuteEventMessage).event === 'after-execute'
+  );
+}
+
+function isRequestRunEventMessage(message: unknown): message is IRequestRunEventMessage {
+  return (
+    !!message && typeof message === 'object' && (message as IRequestRunEventMessage).event === 'requestRun'
+  );
+}
+
+function isSyncEventMessage(message: unknown): message is ISyncEventMessage {
+  return !!message && typeof message === 'object' && (message as ISyncEventMessage).event === 'sync';
+}
+
+function formatMegabytes(bytes: number): string {
+  return `${Math.round(bytes / BYTES_PER_MB)} MB`;
+}
+
+/**
+ * A long-lived process that runs the operation's command when it receives a "run" message, and keeps the state of
+ * its last build in memory between runs.
+ */
+class WarmWorker {
+  public readonly process: ChildProcess;
+  public readonly command: string;
+  public readonly closedPromise: Promise<void>;
+  public readyPromise: Promise<void>;
+  /**
+   * True once the process sent "sync", i.e. it supports the IPC protocol.
+   */
+  public isReady: boolean = false;
+  /**
+   * True if the process reported a change since it was last told to run.
+   */
+  public isRunRequested: boolean = false;
+  public runCount: number = 0;
+  public firstResidentMemoryBytes: number | undefined;
+  public residentMemoryBytes: number | undefined;
+
+  #onRunRequested: (() => void) | undefined;
+
+  public constructor(childProcess: ChildProcess, command: string) {
+    this.process = childProcess;
+    this.command = command;
+    this.closedPromise = new Promise<void>((resolve: () => void) => {
+      childProcess.once('close', () => resolve());
+    });
+    let resolveReady!: () => void;
+    this.readyPromise = new Promise<void>((resolve: () => void) => {
+      resolveReady = resolve;
+    });
+    childProcess.on('message', (message: unknown) => {
+      if (isSyncEventMessage(message)) {
+        this.isReady = true;
+        resolveReady();
+      } else if (isRequestRunEventMessage(message)) {
+        this.isRunRequested = true;
+        this.#onRunRequested?.();
+      }
+    });
+    // Without a listener, an 'error' event would be thrown; the 'close' event reports the outcome.
+    childProcess.on('error', () => undefined);
+  }
+
+  public get pid(): number | undefined {
+    return this.process.pid;
+  }
+
+  public get isAlive(): boolean {
+    return this.process.exitCode === null && this.process.signalCode === null;
+  }
+
+  /**
+   * Waits until the process reports a change, for at most `timeoutMs`. Returns false if it did not.
+   */
+  public async waitForRunRequestAsync(
+    timeoutMs: number,
+    abortSignal: AbortSignal | undefined
+  ): Promise<boolean> {
+    if (this.isRunRequested || timeoutMs <= 0) {
+      return this.isRunRequested;
+    }
+    await new Promise<void>((resolve: () => void) => {
+      const timer: { timeout?: NodeJS.Timeout } = {};
+      const finish: () => void = () => {
+        clearTimeout(timer.timeout);
+        this.#onRunRequested = undefined;
+        abortSignal?.removeEventListener('abort', finish);
+        this.process.off('close', finish);
+        resolve();
+      };
+      timer.timeout = setTimeout(finish, timeoutMs);
+      this.#onRunRequested = finish;
+      abortSignal?.addEventListener('abort', finish, { once: true });
+      this.process.once('close', finish);
+    });
+    return this.isRunRequested;
+  }
+
+  public terminate(): void {
+    if (this.isAlive) {
+      try {
+        SubprocessTerminator.killProcessTree(this.process, SubprocessTerminator.RECOMMENDED_OPTIONS);
+      } catch {
+        // It exited in the meantime.
+      }
+    }
+  }
+
+  /**
+   * Asks the process to exit and waits until it closed. Terminates it if it cannot be asked, or if it does not
+   * exit in time.
+   */
+  public async closeAsync(): Promise<void> {
+    if (this.isAlive) {
+      if (this.process.connected) {
+        const exitCommand: IExitCommandMessage = { command: 'exit' };
+        try {
+          this.process.send(exitCommand);
+        } catch {
+          this.terminate();
+        }
+        const timeout: NodeJS.Timeout = setTimeout(() => this.terminate(), EXIT_TIMEOUT_MS);
+        await this.closedPromise;
+        clearTimeout(timeout);
+      } else {
+        this.terminate();
+      }
+    }
+    // Even after it exited, the stdio of the process or of its descendants may still be draining.
+    await this.closedPromise;
+  }
+}
+
+/**
+ * An `IOperationRunner` for the Rush daemon that runs the incremental builds of an operation in a warm worker: a
+ * long-lived process, started from the project's `<phase>:incremental:ipc` script, that keeps its last build in
+ * memory and rebuilds only what changed when it is told to run again.
+ *
+ * @remarks
+ * Whether a run may build on top of the outputs of the last one is decided by the operation's incremental
+ * execution guard, as for `ShellOperationRunner`, in `prepareAsync`. If the guard allows it and the worker is
+ * running, the build cache is not read, because restoring the outputs would not update the worker's memory. If the
+ * guard does not allow it, the worker is closed, and the initial command runs: in a new worker, if the project has
+ * a `<phase>:ipc` script, or else in a shell. The initial command also runs after a failed run on a reused worker,
+ * or on a worker that exited, so that state that a worker kept from its earlier runs cannot fail an operation that
+ * the initial command passes. The failed first run of a new worker is reported as it stands, because that run had
+ * no earlier state. After a failure, the worker is closed, because the next build runs the initial command. If
+ * `closeAsync` closes a worker between executions, e.g. for the warm set of the Rush daemon, the next execution
+ * says so. Results of incremental runs are never written to the build cache.
+ *
+ * @internal
+ */
+export class WarmWorkerOperationRunner implements IOperationRunner {
+  public readonly name: string;
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean;
+  public readonly isNoOp: boolean = false;
+
+  readonly #rushProject: RushConfigurationProject;
+  readonly #initialCommand: string;
+  readonly #initialIpcCommand: string | undefined;
+  readonly #incrementalIpcCommand: string;
+  readonly #commandForHash: string;
+  readonly #ignoredParameterValues: ReadonlyArray<string>;
+  readonly #maxRunsPerWorker: number;
+  readonly #maxMemoryGrowth: number;
+  readonly #changeReportTimeoutMs: number;
+  readonly #planByContext: WeakMap<object, IRunPlan> = new WeakMap();
+
+  #worker: WarmWorker | undefined;
+  // Resolves when the last worker that was closed has exited.
+  #lastClosePromise: Promise<void> = Promise.resolve();
+  // Set when `closeAsync` closes a worker between executions, e.g. for the warm set of the Rush daemon. The next
+  // plan writes it, because the next execution would otherwise not say why the worker is gone.
+  #closedWorkerNote: string | undefined;
+
+  public constructor(options: IWarmWorkerOperationRunnerOptions) {
+    const {
+      phase,
+      rushProject,
+      displayName,
+      initialCommand,
+      initialIpcCommand,
+      incrementalIpcCommand,
+      commandForHash,
+      ignoredParameterValues,
+      maxRunsPerWorker = DEFAULT_MAX_RUNS_PER_WORKER,
+      maxMemoryGrowth = DEFAULT_MAX_MEMORY_GROWTH,
+      changeReportTimeoutMs = DEFAULT_CHANGE_REPORT_TIMEOUT_MS
+    } = options;
+    this.name = displayName;
+    this.warningsAreAllowed =
+      EnvironmentConfiguration.allowWarningsInSuccessfulBuild || phase.allowWarningsOnSuccess || false;
+    this.#rushProject = rushProject;
+    this.#initialCommand = initialCommand;
+    this.#initialIpcCommand = initialIpcCommand;
+    this.#incrementalIpcCommand = incrementalIpcCommand;
+    this.#commandForHash = commandForHash;
+    this.#ignoredParameterValues = ignoredParameterValues;
+    this.#maxRunsPerWorker = maxRunsPerWorker;
+    this.#maxMemoryGrowth = maxMemoryGrowth;
+    this.#changeReportTimeoutMs = changeReportTimeoutMs;
+  }
+
+  public get isActive(): boolean {
+    return !!this.#worker?.isAlive;
+  }
+
+  public get residentMemoryBytes(): number | undefined {
+    return this.isActive ? this.#worker!.residentMemoryBytes : undefined;
+  }
+
+  /**
+   * The process ID of the worker, if one is running.
+   */
+  public get workerPid(): number | undefined {
+    return this.isActive ? this.#worker!.pid : undefined;
+  }
+
+  /**
+   * Decides how the next execution with this context runs. Call it before the build cache is read, i.e. from a
+   * `beforeExecuteOperationAsync` tap that runs before `CacheableOperationPlugin`'s, and call
+   * `writeUnusedNotesAsync` after the operation executed.
+   *
+   * @param context - The execution record of the operation
+   * @param hasLastState - Whether the operation has a result from an earlier execution in this graph
+   */
+  public async prepareAsync(context: IOperationRunnerContext, hasLastState: boolean): Promise<void> {
+    this.#planByContext.set(context, await this.#planAsync(context, hasLastState));
+  }
+
+  public async executeAsync(
+    context: IOperationRunnerContext,
+    lastState?: IOperationLastState
+  ): Promise<OperationStatus> {
+    const preparedPlan: IRunPlan | undefined = this.#planByContext.get(context);
+    this.#planByContext.delete(context);
+    // Without a last state, e.g. in an iteration that allows no incremental build, the initial command runs.
+    const plan: IRunPlan =
+      preparedPlan && (preparedPlan.kind === 'initial' || lastState)
+        ? preparedPlan
+        : await this.#planAsync(context, !!lastState);
+    return await context.runWithTerminalAsync(
+      async (
+        terminal: ITerminal,
+        terminalProvider: ITerminalProvider,
+        structuredChildOutputTerminalProvider: ITerminalProvider
+      ): Promise<OperationStatus> => {
+        if (this.#ignoredParameterValues.length > 0) {
+          terminal.writeLine(
+            `These parameters were ignored for this operation by project-level configuration: ${this.#ignoredParameterValues.join(' ')}`
+          );
+        }
+        for (const note of plan.notes) {
+          terminal.writeLine(note);
+        }
+        this.#closedWorkerNote = undefined;
+
+        const terminals: ICommandTerminals = {
+          terminal,
+          terminalProvider,
+          structuredChildOutputTerminalProvider
+        };
+        let status: OperationStatus;
+        if (plan.kind === 'initial') {
+          status = await this.#runInitialAsync(context, terminals);
+        } else {
+          const { status: workerStatus, wasWorkerReused } = await this.#runOnWorkerAsync(
+            context,
+            terminals,
+            'incremental',
+            this.#incrementalIpcCommand
+          );
+          status = workerStatus;
+          if (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) {
+            const guard: IIncrementalExecutionGuard | undefined = getIncrementalExecutionGuard(context);
+            const rerunReason: string | undefined = guard
+              ? await getGuardResultAsync(() => guard.verifyIncrementalResultAsync(GUARD_OPTIONS))
+              : undefined;
+            if (rerunReason !== undefined) {
+              terminal.writeLine(`Running the initial command, because ${rerunReason}.`);
+              await this.#closeWorkerAsync(terminal, INITIAL_COMMAND_REASON);
+              status = await this.#runInitialAsync(context, terminals);
+            }
+          } else if (status === OperationStatus.Failure && (wasWorkerReused || !this.isActive)) {
+            // A reused worker can fail where the initial command passes, because of state that it kept from its
+            // earlier runs, and so can a worker that crashed. The initial command then decides whether the
+            // operation fails.
+            if (context.error) {
+              terminal.writeLine(context.error.message);
+              context.error = undefined;
+            }
+            terminal.writeLine('Running the initial command, because the run on the warm worker failed.');
+            await this.#closeWorkerAsync(terminal, INITIAL_COMMAND_REASON);
+            status = await this.#runInitialAsync(context, terminals);
+          }
+        }
+
+        if (!context.shouldRunnerPersist) {
+          await this.#closeWorkerAsync(undefined, '');
+        } else if (status === OperationStatus.Failure) {
+          await this.#closeWorkerAsync(terminal, FAILED_OPERATION_REASON);
+        } else {
+          await this.#recycleWorkerIfNeededAsync(terminal);
+        }
+        return status;
+      },
+      {
+        createLogFile: true
+      }
+    );
+  }
+
+  public getConfigHash(): string {
+    return this.#commandForHash;
+  }
+
+  /**
+   * Writes the notes of the plan that `prepareAsync` made for this context if `executeAsync` did not run, e.g.
+   * because the build cache restored the operation, so that a worker that the plan closed is not closed silently.
+   * Call it after the operation executed.
+   */
+  public async writeUnusedNotesAsync(context: IOperationRunnerContext): Promise<void> {
+    const plan: IRunPlan | undefined = this.#planByContext.get(context);
+    this.#planByContext.delete(context);
+    if (plan) {
+      this.#closedWorkerNote = undefined;
+    }
+    if (plan?.notes.length) {
+      // The log file, if any, is not this runner's, e.g. the one that the build cache restored.
+      await context.runWithTerminalAsync(
+        async (terminal: ITerminal): Promise<void> => {
+          for (const note of plan.notes) {
+            terminal.writeLine(note);
+          }
+        },
+        { createLogFile: false }
+      );
+    }
+  }
+
+  public async closeAsync(): Promise<void> {
+    const worker: WarmWorker | undefined = this.#worker;
+    if (worker?.isAlive) {
+      this.#closedWorkerNote = `The warm worker (pid ${worker.pid}) was closed after the operation last ran.`;
+    }
+    await this.#closeWorkerAsync(undefined, '');
+  }
+
+  async #planAsync(context: IOperationRunnerContext, hasLastState: boolean): Promise<IRunPlan> {
+    // It stays until a plan's notes are written, e.g. if this plan is replaced.
+    const notes: string[] = this.#closedWorkerNote ? [this.#closedWorkerNote] : [];
+    // As in ShellOperationRunner, the guard is not consulted before the first execution in this graph.
+    const guard: IIncrementalExecutionGuard | undefined = hasLastState
+      ? getIncrementalExecutionGuard(context)
+      : undefined;
+    if (guard) {
+      const blockReason: string | undefined = await getGuardResultAsync(() =>
+        guard.getBlockReasonAsync(GUARD_OPTIONS)
+      );
+      if (blockReason === undefined) {
+        if (this.isActive) {
+          skipBuildCacheRead(context);
+        }
+        return { kind: 'incremental', notes };
+      }
+      notes.push(`Not using the incremental command because ${blockReason}.`);
+    }
+    // The initial command must not run on top of what a worker keeps in memory.
+    const closeNote: string | undefined = await this.#closeWorkerAsync(undefined, INITIAL_COMMAND_REASON);
+    if (closeNote) {
+      notes.push(closeNote);
+    }
+    return { kind: 'initial', notes };
+  }
+
+  async #runInitialAsync(
+    context: IOperationRunnerContext,
+    terminals: ICommandTerminals
+  ): Promise<OperationStatus> {
+    if (this.#initialIpcCommand !== undefined) {
+      return (await this.#runOnWorkerAsync(context, terminals, 'initial', this.#initialIpcCommand)).status;
+    }
+    setCommandExecution(context, { kind: 'initial', hasIncrementalCommand: true });
+    return await ShellOperationRunner.invokeCommandAsync(
+      context,
+      terminals,
+      this.#rushProject,
+      'initial',
+      this.#initialCommand
+    );
+  }
+
+  async #runOnWorkerAsync(
+    context: IOperationRunnerContext,
+    { terminal, terminalProvider }: ICommandTerminals,
+    kind: ICommandExecution['kind'],
+    command: string
+  ): Promise<IWorkerCommandResult> {
+    // Recorded before the command starts, so that outputs of a command that fails or is aborted are attributed to it.
+    setCommandExecution(context, { kind, hasIncrementalCommand: true, watchesInputs: true });
+    terminal.writeLine(`Invoking (${kind}): ${command}`);
+
+    const { abortSignal } = context;
+    let worker: WarmWorker | undefined = this.#worker;
+    if (worker?.isAlive && kind === 'initial') {
+      // A build from scratch must not run on top of what a worker keeps in memory.
+      await this.#closeWorkerAsync(terminal, INITIAL_COMMAND_REASON);
+      worker = undefined;
+    }
+    let wasRunRequested: boolean = false;
+    if (worker?.isAlive) {
+      wasRunRequested = await worker.waitForRunRequestAsync(this.#changeReportTimeoutMs, abortSignal);
+    }
+    if (worker && !worker.isAlive) {
+      terminal.writeLine(`The warm worker (pid ${worker.pid}) exited after its last run.`);
+      await this.#closeWorkerAsync(undefined, '');
+      worker = undefined;
+    }
+
+    const wasWorkerReused: boolean = worker !== undefined && worker.runCount > 0;
+    if (!worker) {
+      terminal.writeLine('Starting a warm worker for it.');
+      worker = this.#startWorker(context, command);
+    } else {
+      if (!wasRunRequested) {
+        terminal.writeVerboseLine(
+          `The warm worker did not report a change within ${this.#changeReportTimeoutMs} ms.`
+        );
+      }
+      terminal.writeLine(`Sending run ${worker.runCount + 1} to the warm worker (pid ${worker.pid}).`);
+    }
+
+    const { status, hasWarningOrError } = await this.#runWorkerAsync(
+      context,
+      worker,
+      terminal,
+      terminalProvider
+    );
+    return {
+      status:
+        status === OperationStatus.Success && hasWarningOrError ? OperationStatus.SuccessWithWarning : status,
+      wasWorkerReused
+    };
+  }
+
+  #startWorker(context: IOperationRunnerContext, command: string): WarmWorker {
+    const { rushConfiguration, projectFolder } = this.#rushProject;
+    const environment: IEnvironment | undefined = context.environment;
+    const additionalEnvironment: IEnvironment | undefined =
+      (environment ?? process.env)[TYPESCRIPT_WATCH_FILE_VARIABLE] === undefined
+        ? { [TYPESCRIPT_WATCH_FILE_VARIABLE]: TYPESCRIPT_WATCH_FILE }
+        : undefined;
+    const childProcess: ChildProcess = Utilities.executeLifecycleCommandAsync(command, {
+      rushConfiguration,
+      workingDirectory: projectFolder,
+      initCwd: rushConfiguration.commonTempFolder,
+      handleOutput: true,
+      environmentPathOptions: {
+        includeProjectBin: true
+      },
+      ipc: true,
+      // Isolate the process tree, so that it can be terminated.
+      connectSubprocessTerminator: true,
+      initialEnvironment: environment,
+      additionalEnvironment
+    });
+    const worker: WarmWorker = new WarmWorker(childProcess, command);
+    this.#worker = worker;
+    return worker;
+  }
+
+  async #runWorkerAsync(
+    context: IOperationRunnerContext,
+    worker: WarmWorker,
+    terminal: ITerminal,
+    terminalProvider: ITerminalProvider
+  ): Promise<IWorkerRunResult> {
+    const { process: subProcess } = worker;
+    const { abortSignal } = context;
+    let hasWarningOrError: boolean = false;
+    const stdoutDecoder: StringDecoder = new StringDecoder('utf8');
+    const stderrDecoder: StringDecoder = new StringDecoder('utf8');
+    const onStdout = (data: Buffer): void => {
+      terminalProvider.write(stdoutDecoder.write(data), TerminalProviderSeverity.log);
+    };
+    const onStderr = (data: Buffer): void => {
+      terminalProvider.write(stderrDecoder.write(data), TerminalProviderSeverity.error);
+      hasWarningOrError = true;
+    };
+    subProcess.stdout?.on('data', onStdout);
+    subProcess.stderr?.on('data', onStderr);
+
+    let sentRun: boolean = false;
+    let sendError: Error | undefined;
+    const onAbort = (): void => {
+      worker.terminate();
+    };
+    const status: OperationStatus = await new Promise<OperationStatus>(
+      (resolve: (status: OperationStatus) => void) => {
+        let detach: () => void = () => undefined;
+        const finish = (result: OperationStatus): void => {
+          detach();
+          resolve(result);
+        };
+        const onMessage = (message: unknown): void => {
+          if (sentRun && isAfterExecuteEventMessage(message)) {
+            const memory: number | undefined = message.residentMemoryBytes;
+            worker.residentMemoryBytes =
+              typeof memory === 'number' && Number.isSafeInteger(memory) && memory > 0 ? memory : undefined;
+            if (worker.runCount === 1) {
+              worker.firstResidentMemoryBytes = worker.residentMemoryBytes;
+            }
+            // These types are distinct, but have the same values.
+            finish(message.status as unknown as OperationStatus);
+          }
+        };
+        const onClose = (exitCode: number | null, signal: NodeJS.Signals | null): void => {
+          if (abortSignal?.aborted) {
+            finish(OperationStatus.Aborted);
+          } else if (sendError) {
+            context.error = new OperationError('error', sendError.message);
+            finish(OperationStatus.Failure);
+          } else if (sentRun) {
+            context.error = new OperationError(
+              'error',
+              `The warm worker exited before it reported the result of its run (${
+                signal ? `signal ${signal}` : `exit code ${exitCode}`
+              }).`
+            );
+            finish(OperationStatus.Failure);
+          } else if (signal) {
+            // It exited without using the IPC protocol, so it ran once, like a command in a shell.
+            context.error = new OperationError('error', `Terminated by signal: ${signal}`);
+            finish(OperationStatus.Failure);
+          } else if (exitCode !== 0) {
+            context.error = new OperationError('error', `Returned error code: ${exitCode}`);
+            finish(OperationStatus.Failure);
+          } else {
+            finish(OperationStatus.Success);
+          }
+        };
+
+        detach = () => {
+          subProcess.off('message', onMessage);
+          subProcess.off('close', onClose);
+        };
+        subProcess.on('message', onMessage);
+        subProcess.once('close', onClose);
+        if (abortSignal?.aborted) {
+          onAbort();
+        } else {
+          abortSignal?.addEventListener('abort', onAbort, { once: true });
+        }
+        worker.readyPromise.then(
+          () => {
+            if (!worker.isAlive || abortSignal?.aborted) {
+              return;
+            }
+            const runCommand: IRunCommandMessage = { command: 'run' };
+            worker.isRunRequested = false;
+            worker.runCount++;
+            sentRun = true;
+            try {
+              subProcess.send(runCommand);
+            } catch (error) {
+              sendError = new Error(`Could not send "run" to the warm worker: ${error}`);
+              worker.terminate();
+            }
+          },
+          () => undefined
+        );
+      }
+    );
+    abortSignal?.removeEventListener('abort', onAbort);
+    subProcess.stdout?.off('data', onStdout);
+    subProcess.stderr?.off('data', onStderr);
+    terminalProvider.write(stdoutDecoder.end(), TerminalProviderSeverity.log);
+    terminalProvider.write(stderrDecoder.end(), TerminalProviderSeverity.error);
+
+    if (status === OperationStatus.Aborted) {
+      // The worker was terminated, so the next run starts a new one.
+      await this.#closeWorkerAsync(undefined, '');
+      terminal.writeLine('Terminated because the operation was aborted.');
+    } else if (!worker.isAlive) {
+      await this.#closeWorkerAsync(undefined, '');
+    }
+    return { status, hasWarningOrError };
+  }
+
+  async #recycleWorkerIfNeededAsync(terminal: ITerminal): Promise<void> {
+    const worker: WarmWorker | undefined = this.#worker;
+    if (!worker?.isAlive) {
+      return;
+    }
+    const { runCount, firstResidentMemoryBytes, residentMemoryBytes } = worker;
+    if (runCount >= this.#maxRunsPerWorker) {
+      await this.#closeWorkerAsync(terminal, `it has run ${runCount} times`);
+    } else if (
+      firstResidentMemoryBytes !== undefined &&
+      residentMemoryBytes !== undefined &&
+      residentMemoryBytes > firstResidentMemoryBytes * this.#maxMemoryGrowth
+    ) {
+      await this.#closeWorkerAsync(
+        terminal,
+        `its memory grew from ${formatMegabytes(firstResidentMemoryBytes)} after its first run to ${formatMegabytes(
+          residentMemoryBytes
+        )}`
+      );
+    }
+  }
+
+  /**
+   * Closes the worker, if there is one. Returns the line that says so if it was running, and writes it to the
+   * terminal if one is given.
+   */
+  async #closeWorkerAsync(terminal: ITerminal | undefined, reason: string): Promise<string | undefined> {
+    const worker: WarmWorker | undefined = this.#worker;
+    if (!worker) {
+      // It may still be closing for another caller.
+      await this.#lastClosePromise;
+      return undefined;
+    }
+    this.#worker = undefined;
+    const note: string | undefined =
+      worker.isAlive && reason
+        ? `Closing the warm worker (pid ${worker.pid}), because ${reason}.`
+        : undefined;
+    if (note) {
+      terminal?.writeLine(note);
+    }
+    const closePromise: Promise<void> = worker.closeAsync();
+    this.#lastClosePromise = closePromise;
+    await closePromise;
+    return note;
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index ef643be028..2cf5e5b9be 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -60,7 +60,7 @@ import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
-import { setCommandExecution } from '../IncrementalExecutionState';
+import { setCommandExecution, skipBuildCacheRead } from '../IncrementalExecutionState';
 import { NullOperationRunner } from '../NullOperationRunner';
 
 const mockPhase: IPhase = {
@@ -603,6 +603,36 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     expect(testGraph.cacheWrites).toEqual(['c']);
   });
 
+  it('does not restore an operation whose runner skipped the build cache read, and writes neither it nor its consumers', async () => {
+    // "a" <- "b"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    // Like a warm worker, whose outputs are what it keeps in memory: a restore would not update them.
+    testGraph.graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      { name: 'skip-read', stage: -1 },
+      async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<undefined> => {
+        if (testGraph.incrementalNames.has(record.operation.associatedProject.packageName)) {
+          skipBuildCacheRead(record);
+        }
+        return undefined;
+      }
+    );
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Revert "a": both operations have an entry from the first iteration, but only "b" may be restored.
+    testGraph.localHashes.set('a', 'a-v1');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['b']);
+    expect(testGraph.executions).toEqual(['a:incremental']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
   it('does not re-enable operations that another plugin disabled', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     // Like a plugin that performs the work itself. This tap runs after PhasedOperationPlugin's.
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index a843903840..242f8ca749 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -65,9 +65,15 @@ import { Utilities } from '../../../utilities/Utilities';
 import { InputsSnapshot, type IInputsSnapshotProjectMetadata } from '../../incremental/InputsSnapshot';
 import { IncrementalExecutionGuardPlugin } from '../IncrementalExecutionGuardPlugin';
 import {
+  getCommandExecution,
+  getIncrementalExecutionGuard,
   INPUTS_CHANGED_INVALIDATION_REASON,
   NATIVE_COMMAND_INVALIDATION_REASON,
-  wasExecutedIncrementally
+  setCommandExecution,
+  setIncrementalExecutionGuard,
+  wasExecutedIncrementally,
+  type ICommandExecution,
+  type IIncrementalExecutionGuardOptions
 } from '../IncrementalExecutionState';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import { LegacySkipPlugin } from '../LegacySkipPlugin';
@@ -131,10 +137,19 @@ interface IWorkspaceOptions {
    * operation of its own project, which has no script and depends on the builds of the project's dependencies.
    */
   readonly hasPassThroughPhase?: boolean;
+  /**
+   * If set, the runners pass these options to the guard, like `WarmWorkerOperationRunner`.
+   */
+  readonly guardOptions?: IIncrementalExecutionGuardOptions;
   /**
    * If set, applies the skip detection that Rush uses when the build cache is not enabled.
    */
   readonly hasLegacySkipDetection?: boolean;
+  /**
+   * If set, the runners report that each command ran in a process that keeps watching the input files, like
+   * `WarmWorkerOperationRunner`.
+   */
+  readonly watchesInputs?: boolean;
 }
 
 interface ITestIteration {
@@ -153,6 +168,10 @@ interface ITestWorkspace {
   readonly operations: ReadonlyMap<string, Operation>;
   writeFile(relativePath: string, content: string): void;
   deleteFile(relativePath: string): void;
+  /**
+   * Deletes a folder and writes its files again, like a branch switch that removed the folder and restored it.
+   */
+  recreateFolder(relativePath: string): void;
   executeAsync(environment?: Readonly<Record<string, string>>): Promise<ITestIteration>;
   /**
    * Resolves when the next command that hangs has written its outputs. It runs until it is terminated.
@@ -188,8 +207,20 @@ function listFiles(folder: string, exclude: ReadonlySet<string> = new Set()): st
   return files.sort();
 }
 
+function recreateFolder(folder: string): void {
+  const contentByFile: Map<string, Buffer> = new Map(
+    listFiles(folder).map((file: string) => [file, fs.readFileSync(`${folder}/${file}`)])
+  );
+  fs.rmSync(folder, { recursive: true });
+  for (const [file, content] of contentByFile) {
+    fs.mkdirSync(path.dirname(`${folder}/${file}`), { recursive: true });
+    fs.writeFileSync(`${folder}/${file}`, content);
+  }
+}
+
 // Like a compiler: writes a file per source file, and its incremental mode neither cleans the output folder nor
 // deletes the outputs of deleted source files. A source containing "emit:<name>" also emits "<name>.js", a
+// source containing "recreate:<folder>" deletes and recreates that folder of the project while the build runs, a
 // source containing "error" fails the build, and after the output of a source containing "hang", the build runs
 // until it is terminated (it returns undefined).
 function build(projectFolder: string, isBundle: boolean, isIncremental: boolean): number | undefined {
@@ -214,6 +245,10 @@ function build(projectFolder: string, isBundle: boolean, isIncremental: boolean)
     if (emitted) {
       fs.writeFileSync(`${outputFolder}/${emitted[1]}.js`, '');
     }
+    const recreated: RegExpExecArray | null = /recreate:([\w/]+)/.exec(source);
+    if (recreated) {
+      recreateFolder(`${projectFolder}/${recreated[1]}`);
+    }
     if (source.includes('hang')) {
       return undefined;
     }
@@ -293,7 +328,7 @@ class PluginOperationRunner implements IOperationRunner {
 
 async function createWorkspaceAsync(
   projectSpecs: ReadonlyArray<IProjectSpec>,
-  { hasPassThroughPhase, hasLegacySkipDetection }: IWorkspaceOptions = {}
+  { hasPassThroughPhase, guardOptions, hasLegacySkipDetection, watchesInputs }: IWorkspaceOptions = {}
 ): Promise<ITestWorkspace> {
   const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
   workspaceFolders.push(rootFolder);
@@ -475,6 +510,35 @@ async function createWorkspaceAsync(
     isWatch: false,
     projectConfigurations
   } as unknown as IOperationGraphContext);
+  if (guardOptions) {
+    // After the guard plugin registered the guards of the iteration.
+    graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'guardOptions', stage: 1 },
+      (records: ReadonlyMap<Operation, IOperationExecutionResult>): void => {
+        for (const record of records.values()) {
+          const guard: IIncrementalExecutionGuard | undefined = getIncrementalExecutionGuard(record);
+          if (guard) {
+            setIncrementalExecutionGuard(record, {
+              getBlockReasonAsync: () => guard.getBlockReasonAsync(guardOptions),
+              verifyIncrementalResultAsync: () => guard.verifyIncrementalResultAsync(guardOptions)
+            });
+          }
+        }
+      }
+    );
+  }
+  if (watchesInputs) {
+    // Before the guard's taps
+    graph.hooks.afterExecuteOperationAsync.tap(
+      { name: 'watchesInputs', stage: -2 },
+      (record: IOperationExecutionResult): void => {
+        const execution: ICommandExecution | undefined = getCommandExecution(record);
+        if (execution) {
+          setCommandExecution(record, { ...execution, watchesInputs: true });
+        }
+      }
+    );
+  }
 
   // Like `git hash-object` for each file, except the outputs, which are ignored by git.
   const createInputsSnapshot = (environment: Readonly<Record<string, string>>): InputsSnapshot => {
@@ -507,6 +571,7 @@ async function createWorkspaceAsync(
     operations,
     writeFile,
     deleteFile: (relativePath: string) => fs.rmSync(`${rootFolder}/${relativePath}`),
+    recreateFolder: (relativePath: string) => recreateFolder(`${rootFolder}/${relativePath}`),
     executeAsync: async (environment: Readonly<Record<string, string>> = {}): Promise<ITestIteration> => {
       commands.length = 0;
       destination.reset();
@@ -793,6 +858,148 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     );
   });
 
+  it('runs the incremental command of an operation that builds a bundle for a runner that allows bundles', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a', isBundle: true }], {
+      guardOptions: { outputsMayBeBundles: true }
+    });
+    await workspace.executeAsync();
+
+    for (const content of ['one 2', 'one 3']) {
+      workspace.writeFile('a/src/one.ts', content);
+      const changed: ITestIteration = await workspace.executeAsync();
+      expect(changed.commands).toEqual(['a:incremental']);
+      expect(changed.getStatus('a')).toBe(OperationStatus.Success);
+      expect(changed.output).not.toContain('Not using the incremental command');
+    }
+  });
+
+  it('runs only the initial command after an incremental command renamed a content-hashed file, for a runner that allows bundles', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      guardOptions: { outputsMayBeBundles: true }
+    });
+    await workspace.executeAsync();
+
+    // Like a chunk with webpack's default hash length, which a bundler renames whenever its content changes.
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk_0123456789abcdef0123');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk_0123456789abcdef0123.js").'
+    );
+
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its incremental command changed which output files it has in an earlier run: 1 added ("lib/chunk_0123456789abcdef0123.js").'
+    );
+  });
+
+  it('runs the initial command only once after an incremental command that changed which output files exist, for a runner that allows bundles', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      guardOptions: { outputsMayBeBundles: true }
+    });
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one emit:chunk');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:incremental', 'a:initial']);
+    expect(changed.output).toContain(
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").'
+    );
+
+    // The initial command removed any stale outputs, and the runner keeps its build state in memory.
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('runs the initial command after a folder of its input files was recreated, for a runner that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+    await workspace.executeAsync();
+
+    // Unlike an editor that saves a file by renaming a new file over it
+    workspace.writeFile('a/src/sub/two.ts.tmp', 'two 1');
+    fs.renameSync(`${workspace.rootFolder}/a/src/sub/two.ts.tmp`, `${workspace.rootFolder}/a/src/sub/two.ts`);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    // The input files did not change, but a watcher of the old folder misses later edits of its files.
+    workspace.recreateFolder('a/src/sub');
+    expect((await workspace.executeAsync()).commands).toEqual([]);
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+    );
+
+    // The process of the initial command watches the new folder.
+    workspace.writeFile('a/src/sub/two.ts', 'two 3');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('names only the top folder of recreated folders of its input files, for a runner that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+    await workspace.executeAsync();
+
+    // Recreates "a/src/sub" as well
+    workspace.recreateFolder('a/src');
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    const changed: ITestIteration = await workspace.executeAsync();
+    expect(changed.commands).toEqual(['a:initial']);
+    expect(changed.output).toContain(
+      'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src").'
+    );
+  });
+
+  it('runs the initial command after a folder of its input files was recreated while it ran, for a runner that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one recreate:src/sub');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+    );
+  });
+
+  it('runs the incremental command after a folder of its input files was recreated, for a runner that does not watch its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    workspace.recreateFolder('a/src/sub');
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
+  it('runs the incremental command after a folder of its input files was recreated, if its last run was not in a process that watches its inputs', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    let watchesInputs: boolean = true;
+    workspace.graph.hooks.afterExecuteOperationAsync.tap(
+      { name: 'watchesInputs', stage: -2 },
+      (record: IOperationExecutionResult): void => {
+        const execution: ICommandExecution | undefined = getCommandExecution(record);
+        if (execution && watchesInputs) {
+          setCommandExecution(record, { ...execution, watchesInputs: true });
+        }
+      }
+    );
+    await workspace.executeAsync();
+    workspace.writeFile('a/src/sub/two.ts', 'two 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    // E.g. a runner that closed its worker ran the command in a shell. The next process watches the new folder.
+    watchesInputs = false;
+    workspace.writeFile('a/src/sub/two.ts', 'two 3');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    workspace.recreateFolder('a/src/sub');
+    workspace.writeFile('a/src/sub/two.ts', 'two 4');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
   it('runs the initial command after an incremental command that emitted a content-hashed file', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
     await workspace.executeAsync();
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
index 25d66cf0c7..b2146360cf 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
@@ -162,5 +162,21 @@ describe(OperationExecutionRecord.name, () => {
       record.reportCommandExecution({ kind: 'initial', hasIncrementalCommand: true });
       expect(wasExecutedIncrementally(record)).toBe(false);
     });
+
+    it('records whether the runner reports that the command ran in a process that watches the input files', () => {
+      const record: OperationExecutionRecord = createRecord(
+        createOperation({ project: createProject('project-watching') })
+      );
+
+      record.reportCommandExecution({
+        kind: 'incremental',
+        hasIncrementalCommand: true,
+        watchesInputs: true
+      });
+      expect(getCommandExecution(record)?.watchesInputs).toBe(true);
+
+      record.reportCommandExecution({ kind: 'initial', hasIncrementalCommand: true });
+      expect(getCommandExecution(record)?.watchesInputs).toBeUndefined();
+    });
   });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
index ae29e6be3c..2e06310ac9 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationOutputManifest.test.ts
@@ -8,6 +8,7 @@ import * as path from 'node:path';
 import {
   describeOutputFileChanges,
   getCleanOnlyReason,
+  hasContentHashedOutputChange,
   readOperationOutputManifestAsync,
   type IOperationOutputManifest
 } from '../OperationOutputManifest';
@@ -55,6 +56,33 @@ describe(describeOutputFileChanges.name, () => {
       )
     ).toBeUndefined();
   });
+
+  it.each([
+    ['lib/0dd8cf755e5195a5.js', 'lib/7c1e0b4f9a2d3e6f.js'],
+    ['dist/app.0123456789abcdef0123.js', 'dist/app.3210fedcba9876543210.js'],
+    ['dist/2d0bb124b0ce1c65888f.png', 'dist/5c7a3e9f1b2d4068ace1.png']
+  ])(
+    'describes a content-hashed output that a bundler renamed from %s to %s',
+    (before: string, after: string) => {
+      expect(describeOutputFileChanges(new Set([before]), new Set([after]))).toBe(
+        `1 added (${JSON.stringify(after)}), 1 removed (${JSON.stringify(before)})`
+      );
+    }
+  );
+});
+
+describe(hasContentHashedOutputChange.name, () => {
+  it.each<[string[], string[], boolean]>([
+    [['lib/a.js'], ['lib/a.js', 'lib/chunk_0123456789abcdef0123.js'], true],
+    [['lib/a.js', 'lib/chunk.main_1a2b3c4d.js'], ['lib/a.js'], true],
+    [['dist/2d0bb124b0ce1c65888f.png'], ['dist/5c7a3e9f1b2d4068ace1.png'], true],
+    [['lib/a.js'], ['lib/a.js', 'lib/b.js'], false],
+    [['dist/a.js'], ['dist/a.js', 'dist/b.js'], false],
+    [['lib/chunk.main_1a2b3c4d.js'], ['lib/chunk.main_1a2b3c4d.js', 'lib/b.js'], false],
+    [['lib/a.js'], ['lib/a.js', 'temp/jest-transform-cache-0123456789abcdef-0123456789abcdef/7f/a_1'], false]
+  ])('for %j before and %j after, returns %s', (before: string[], after: string[], expected: boolean) => {
+    expect(hasContentHashedOutputChange(new Set(before), new Set(after))).toBe(expected);
+  });
 });
 
 describe(readOperationOutputManifestAsync.name, () => {
diff --git a/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts b/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
new file mode 100644
index 0000000000..3f415bd6b1
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
@@ -0,0 +1,936 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { MockWritable } = jest.requireActual('@rushstack/terminal');
+  return { ...actual, initializeProjectLogFilesAsync: jest.fn(async () => new MockWritable()) };
+});
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import { performance } from 'node:perf_hooks';
+
+import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IOperationSettings } from '../../../api/RushProjectConfiguration';
+import {
+  PhasedCommandHooks,
+  type ICreateOperationsContext,
+  type IOperationGraphContext
+} from '../../../pluginFramework/PhasedCommandHooks';
+import { Utilities, type IEnvironment, type ILifecycleCommandOptions } from '../../../utilities/Utilities';
+import { DaemonWarmWorkerPlugin } from '../DaemonWarmWorkerPlugin';
+import {
+  getCommandExecution,
+  isBuildCacheReadSkipped,
+  setIncrementalExecutionGuard,
+  type IIncrementalExecutionGuard,
+  type IIncrementalExecutionGuardOptions
+} from '../IncrementalExecutionState';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import { NullOperationRunner } from '../NullOperationRunner';
+import { Operation } from '../Operation';
+import { OperationExecutionRecord } from '../OperationExecutionRecord';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { ShellOperationRunner } from '../ShellOperationRunner';
+import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
+import {
+  WarmWorkerOperationRunner,
+  type IWarmWorkerOperationRunnerOptions
+} from '../WarmWorkerOperationRunner';
+
+const INITIAL_COMMAND: string = 'node build.js';
+const INITIAL_IPC_COMMAND: string = 'node build.js --watch --clean';
+const INCREMENTAL_IPC_COMMAND: string = 'node build.js --watch';
+
+type WorkerBehavior = 'crash' | 'fail' | 'fail-reused' | 'hang' | 'grow' | 'request';
+
+// Like `heft run-watch` with IPC: it sends "sync" when it starts, and answers each "run" with "after-execute". It
+// prints the number of each run, and answers 20 ms later, so that the line arrives first. Its behavior:
+// - crash: it exits when it receives a run;
+// - fail: it prints an error and reports that each run failed, like a build with a compiler error;
+// - fail-reused: like fail, but only from its second run on, like a worker that kept an error from an earlier run;
+// - hang: it never answers a run;
+// - grow: it reports 100 MB more resident memory after each run, instead of 100 MB;
+// - request: it reports a change 50 ms after each run, like its file watcher would.
+const WORKER_SCRIPT: string = `
+  const behavior = process.env.WARM_WORKER_TEST_BEHAVIOR;
+  let runs = 0;
+  process.on('message', (message) => {
+    if (message.command === 'exit') {
+      process.exit(0);
+    } else if (message.command === 'run') {
+      runs++;
+      if (behavior === 'crash') {
+        process.exit(3);
+      }
+      console.log('worker run ' + runs);
+      if (behavior === 'hang') {
+        return;
+      }
+      const fails = behavior === 'fail' || (behavior === 'fail-reused' && runs > 1);
+      if (fails) {
+        console.error('worker error ' + runs);
+      }
+      setTimeout(() => {
+        const residentMemoryBytes = 100000000 * (behavior === 'grow' ? runs : 1);
+        const status = fails ? 'FAILURE' : 'SUCCESS';
+        process.send({ event: 'after-execute', status, residentMemoryBytes });
+        if (behavior === 'request') {
+          setTimeout(() => process.send({ event: 'requestRun', requestor: 'watcher' }), 50);
+        }
+      }, 20);
+    }
+  });
+  process.send({ event: 'sync' });
+`;
+
+const phase: IPhase = {
+  name: '_phase:build',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: '_phase_build',
+  missingScriptBehavior: 'silent'
+};
+
+function createProject(
+  packageName: string,
+  scripts: Record<string, string> | undefined
+): RushConfigurationProject {
+  return {
+    packageName,
+    projectFolder: __dirname,
+    packageJson: { name: packageName, version: '1.0.0', scripts },
+    rushConfiguration: { commonTempFolder: __dirname }
+  } as unknown as RushConfigurationProject;
+}
+
+interface ITestIteration {
+  readonly result: IExecutionResult;
+  readonly record: IOperationExecutionResult;
+  readonly output: string;
+  /**
+   * The commands that started a process in this iteration, in order.
+   */
+  readonly commands: ReadonlyArray<string>;
+  /**
+   * The environment of each process in `commands`, merged from the options as Utilities merges it.
+   */
+  readonly environments: ReadonlyArray<IEnvironment>;
+}
+
+interface ITestHarness {
+  readonly runner: WarmWorkerOperationRunner;
+  readonly graph: OperationGraph;
+  /**
+   * The guard of the next iterations, or undefined for none.
+   */
+  guard: IIncrementalExecutionGuard | undefined;
+  /**
+   * The options that the runner passed to the guard, in order.
+   */
+  readonly guardOptions: IIncrementalExecutionGuardOptions[];
+  blockReason: string | undefined;
+  rerunReason: string | undefined;
+  /**
+   * The behavior of the workers that start from now on.
+   */
+  workerBehavior: WorkerBehavior | undefined;
+  /**
+   * The exit code of the initial commands that run in a shell from now on.
+   */
+  initialExitCode: number;
+  shouldRunnerPersist: boolean;
+  /**
+   * The status that a tap at the default stage of `beforeExecuteOperationAsync` returns, e.g. `FromCache` for a
+   * build cache hit, so that the runner does not execute.
+   */
+  earlyReturnStatus: OperationStatus | undefined;
+  /**
+   * For each iteration, whether the build cache read was skipped when a tap at the default stage of
+   * `beforeExecuteOperationAsync`, like `CacheableOperationPlugin`'s, ran.
+   */
+  readonly isReadSkippedAtCacheStage: boolean[];
+  executeAsync(): Promise<ITestIteration>;
+  /**
+   * Resolves when a worker printed the number of its next run.
+   */
+  waitForWorkerRunAsync(): Promise<void>;
+}
+
+const children: ChildProcess[] = [];
+const graphs: OperationGraph[] = [];
+
+beforeEach(() => {
+  // Each test process is its own process tree.
+  jest.spyOn(SubprocessTerminator, 'killProcessTree').mockImplementation((child: ChildProcess) => {
+    child.kill('SIGTERM');
+  });
+});
+
+afterEach(async () => {
+  for (const graph of graphs.splice(0)) {
+    await graph.closeRunnersAsync();
+    graph.abortController.abort();
+  }
+  for (const child of children.splice(0)) {
+    if (child.exitCode === null && child.signalCode === null) {
+      const closed: Promise<unknown> = once(child, 'close');
+      child.kill();
+      await closed;
+    }
+  }
+  jest.mocked(Utilities.executeLifecycleCommandAsync).mockReset();
+  jest.restoreAllMocks();
+});
+
+async function createHarnessAsync(
+  options: Partial<IWarmWorkerOperationRunnerOptions> = {}
+): Promise<ITestHarness> {
+  const project: RushConfigurationProject = createProject('a', undefined);
+  const runner: WarmWorkerOperationRunner = new WarmWorkerOperationRunner({
+    phase,
+    rushProject: project,
+    displayName: 'a',
+    initialCommand: INITIAL_COMMAND,
+    initialIpcCommand: undefined,
+    incrementalIpcCommand: INCREMENTAL_IPC_COMMAND,
+    commandForHash: INITIAL_COMMAND,
+    ignoredParameterValues: [],
+    // Only the test of this wait waits.
+    changeReportTimeoutMs: 0,
+    ...options
+  });
+  const operation: Operation = new Operation({ phase, project, runner, logFilenameIdentifier: 'a' });
+  const destination: MockWritable = new MockWritable();
+  const graph: OperationGraph = new OperationGraph(new Set([operation]), {
+    quietMode: false,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [destination],
+    abortController: new AbortController(),
+    // Like the graphs of the Rush daemon
+    supportsTerminateRunning: true
+  });
+  graphs.push(graph);
+
+  const commands: string[] = [];
+  const environments: IEnvironment[] = [];
+  const runWaiters: (() => void)[] = [];
+  const harness: ITestHarness = {
+    runner,
+    graph,
+    guard: undefined,
+    guardOptions: [],
+    blockReason: undefined,
+    rerunReason: undefined,
+    workerBehavior: undefined,
+    initialExitCode: 0,
+    shouldRunnerPersist: true,
+    earlyReturnStatus: undefined,
+    isReadSkippedAtCacheStage: [],
+    executeAsync: async (): Promise<ITestIteration> => {
+      commands.length = 0;
+      environments.length = 0;
+      destination.reset();
+      const result: IExecutionResult = await graph.executeAsync({});
+      return {
+        result,
+        record: result.operationResults.get(operation)!,
+        output: destination.getAllOutput(),
+        commands: [...commands],
+        environments: [...environments]
+      };
+    },
+    waitForWorkerRunAsync: () => new Promise<void>((resolve: () => void) => runWaiters.push(resolve))
+  };
+  harness.guard = {
+    getBlockReasonAsync: async (guardOptions?: IIncrementalExecutionGuardOptions) => {
+      harness.guardOptions.push({ ...guardOptions });
+      return harness.blockReason;
+    },
+    verifyIncrementalResultAsync: async (guardOptions?: IIncrementalExecutionGuardOptions) => {
+      harness.guardOptions.push({ ...guardOptions });
+      return harness.rerunReason;
+    }
+  };
+
+  jest
+    .mocked(Utilities.executeLifecycleCommandAsync)
+    .mockImplementation((command: string, lifecycleOptions: ILifecycleCommandOptions) => {
+      const { ipc, initialEnvironment, additionalEnvironment } = lifecycleOptions;
+      commands.push(command);
+      environments.push({ ...(initialEnvironment ?? process.env), ...additionalEnvironment });
+      let child: ChildProcess;
+      if (ipc) {
+        child = spawn(process.execPath, ['-e', WORKER_SCRIPT], {
+          stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+          env: { ...process.env, WARM_WORKER_TEST_BEHAVIOR: harness.workerBehavior ?? '' }
+        });
+        child.stdout!.on('data', (data: Buffer) => {
+          if (data.toString().includes('worker run')) {
+            for (const resolve of runWaiters.splice(0)) {
+              resolve();
+            }
+          }
+        });
+      } else {
+        child = spawn(
+          process.execPath,
+          ['-e', `console.log("one-shot"); process.exitCode = ${harness.initialExitCode};`],
+          {
+            stdio: ['ignore', 'pipe', 'pipe']
+          }
+        );
+      }
+      children.push(child);
+      return child;
+    });
+
+  // Like IncrementalExecutionGuardPlugin, which registers a guard for each record of an iteration.
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    'test',
+    (records: ReadonlyMap<Operation, IOperationExecutionResult>): void => {
+      for (const record of records.values()) {
+        if (harness.guard) {
+          setIncrementalExecutionGuard(record, harness.guard);
+        }
+        (record as OperationExecutionRecord).shouldRunnerPersist = harness.shouldRunnerPersist;
+      }
+    }
+  );
+  // Registered before the plugin's tap, so that only the stages order them.
+  graph.hooks.beforeExecuteOperationAsync.tapPromise(
+    'test',
+    async (record: IOperationExecutionResult): Promise<OperationStatus | undefined> => {
+      harness.isReadSkippedAtCacheStage.push(isBuildCacheReadSkipped(record));
+      return harness.earlyReturnStatus;
+    }
+  );
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new DaemonWarmWorkerPlugin().apply(hooks);
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    isWatch: false
+  } as unknown as IOperationGraphContext);
+  return harness;
+}
+
+/**
+ * The `TSC_WATCHFILE` variable of each process that started in the iteration, in order.
+ */
+function getTypeScriptWatchFiles(iteration: ITestIteration): (string | undefined)[] {
+  return iteration.environments.map((environment: IEnvironment) => environment.TSC_WATCHFILE);
+}
+
+function expectLinesInOrder(output: string, lines: ReadonlyArray<string>): void {
+  let index: number = -1;
+  for (const line of lines) {
+    const next: number = output.indexOf(line, index + 1);
+    if (next < 0) {
+      throw new Error(`Expected ${JSON.stringify(line)} after offset ${index} in:\n${output}`);
+    }
+    index = next;
+  }
+}
+
+describe(WarmWorkerOperationRunner.name, () => {
+  it('runs the initial command first, then starts a worker for an allowed incremental run, and sends it the next one', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+
+    // As for ShellOperationRunner, the first run is the initial command in a shell, and the guard is not asked.
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.result.status).toBe(OperationStatus.Success);
+    expect(first.commands).toEqual([INITIAL_COMMAND]);
+    expect(first.output).toContain(`Invoking (initial): ${INITIAL_COMMAND}`);
+    expect(first.output).not.toContain('warm worker');
+    expect(getCommandExecution(first.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.guardOptions).toEqual([]);
+    expect(harness.runner.isActive).toBe(false);
+
+    const second: ITestIteration = await harness.executeAsync();
+    expect(second.result.status).toBe(OperationStatus.Success);
+    expect(second.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expectLinesInOrder(second.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1'
+    ]);
+    expect(getCommandExecution(second.record)).toEqual({
+      kind: 'incremental',
+      hasIncrementalCommand: true,
+      watchesInputs: true
+    });
+    expect(harness.runner.isActive).toBe(true);
+    const pid: number = harness.runner.workerPid!;
+
+    const third: ITestIteration = await harness.executeAsync();
+    expect(third.result.status).toBe(OperationStatus.Success);
+    expect(third.commands).toEqual([]);
+    expectLinesInOrder(third.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      `Sending run 2 to the warm worker (pid ${pid}).`,
+      'worker run 2'
+    ]);
+    expect(third.output).not.toContain('Starting a warm worker');
+    expect(getCommandExecution(third.record)).toEqual({
+      kind: 'incremental',
+      hasIncrementalCommand: true,
+      watchesInputs: true
+    });
+    expect(harness.runner.workerPid).toBe(pid);
+    expect(harness.runner.residentMemoryBytes).toBe(100000000);
+
+    // The build cache may restore an operation without a worker, but a restore would not update what a running
+    // worker keeps in memory.
+    expect(harness.isReadSkippedAtCacheStage).toEqual([false, false, true]);
+    // Each allowed run asks the guard twice: before it runs and after it succeeded.
+    expect(harness.guardOptions).toEqual(new Array(4).fill({ outputsMayBeBundles: true }));
+
+    const worker: ChildProcess = children[1];
+    await harness.graph.closeRunnersAsync();
+    expect(harness.runner.isActive).toBe(false);
+    expect(worker.exitCode).toBe(0);
+  });
+
+  it('starts each worker with a TypeScript file watcher that sees replaced files', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    harness.graph.hooks.createEnvironmentForOperation.tap('test', (environment: IEnvironment) => {
+      delete environment.TSC_WATCHFILE;
+      return environment;
+    });
+
+    // The initial command in a shell does not watch files, and keeps the environment of the operation.
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.commands).toEqual([INITIAL_COMMAND]);
+    expect(getTypeScriptWatchFiles(first)).toEqual([undefined]);
+
+    const second: ITestIteration = await harness.executeAsync();
+    expect(second.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(getTypeScriptWatchFiles(second)).toEqual(['UseFsEventsOnParentDirectory']);
+  });
+
+  it('keeps the TypeScript file watcher that the environment of the operation chooses', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ initialIpcCommand: INITIAL_IPC_COMMAND });
+    harness.graph.hooks.createEnvironmentForOperation.tap('test', (environment: IEnvironment) => {
+      environment.TSC_WATCHFILE = 'PriorityPollingInterval';
+      return environment;
+    });
+
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.commands).toEqual([INITIAL_IPC_COMMAND]);
+    expect(getTypeScriptWatchFiles(first)).toEqual(['PriorityPollingInterval']);
+  });
+
+  it('closes the worker before the initial command if the guard does not allow an incremental run', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    harness.blockReason = 'its command line changed';
+    const blocked: ITestIteration = await harness.executeAsync();
+    expect(blocked.result.status).toBe(OperationStatus.Success);
+    expect(blocked.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(blocked.output, [
+      'Not using the incremental command because its command line changed.',
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    // It exited before the build cache could restore the operation.
+    expect(worker.exitCode).toBe(0);
+    expect(harness.isReadSkippedAtCacheStage[2]).toBe(false);
+    expect(getCommandExecution(blocked.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.runner.isActive).toBe(false);
+
+    harness.blockReason = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).toContain('Starting a warm worker for it.');
+  });
+
+  it('writes why it closed the worker if the build cache restores the operation', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    harness.blockReason = 'its command line changed';
+    harness.earlyReturnStatus = OperationStatus.FromCache;
+    const restored: ITestIteration = await harness.executeAsync();
+    expect(restored.record.status).toBe(OperationStatus.FromCache);
+    expect(restored.commands).toEqual([]);
+    expectLinesInOrder(restored.output, [
+      'Not using the incremental command because its command line changed.',
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`
+    ]);
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+
+    // If the runner executes, its notes are written once.
+    harness.earlyReturnStatus = undefined;
+    const blocked: ITestIteration = await harness.executeAsync();
+    expect(blocked.commands).toEqual([INITIAL_COMMAND]);
+    expect(blocked.output.split('Not using the incremental command because').length).toBe(2);
+  });
+
+  it('closes the worker before the initial command if the operation has no guard, e.g. in a rebuild', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    harness.guard = undefined;
+    const rebuilt: ITestIteration = await harness.executeAsync();
+    expect(rebuilt.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(rebuilt.output, [
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(rebuilt.output).not.toContain('Not using the incremental command');
+    expect(worker.exitCode).toBe(0);
+  });
+
+  it('closes the worker before the initial command if the operation has no last state, even if it has a guard', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    // Like a graph whose iteration allows no incremental build: it keeps the results, but passes no last state.
+    const { executeAsync } = OperationExecutionRecord.prototype;
+    jest.spyOn(OperationExecutionRecord.prototype, 'executeAsync').mockImplementation(function (
+      this: OperationExecutionRecord,
+      lastState: OperationExecutionRecord | undefined,
+      executeContext: Parameters<OperationExecutionRecord['executeAsync']>[1]
+    ): Promise<void> {
+      return executeAsync.call(this, undefined, executeContext);
+    });
+    const rebuilt: ITestIteration = await harness.executeAsync();
+    expect(rebuilt.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(rebuilt.output, [
+      `Closing the warm worker (pid ${worker.pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(rebuilt.output).not.toContain('Not using the incremental command');
+    expect(getCommandExecution(rebuilt.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(worker.exitCode).toBe(0);
+  });
+
+  it('writes that a worker was closed between builds, e.g. by the warm set of the Rush daemon, once', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    // Like the warm set of the Rush daemon, which closes the runners of a project and drops its results.
+    const operations: Operation[] = [...harness.graph.operations];
+    await harness.graph.closeRunnersAsync(operations);
+    harness.graph.deleteResults(operations);
+    expect(worker.exitCode).toBe(0);
+
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(next.output, [
+      `The warm worker (pid ${worker.pid}) was closed after the operation last ran.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+
+    // Closing a runner without a worker writes nothing.
+    await harness.runner.closeAsync();
+    const again: ITestIteration = await harness.executeAsync();
+    expect(again.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(again.output).not.toContain('was closed after the operation last ran');
+  });
+
+  it('writes that a worker was closed between builds if the build cache restores the operation, once', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+
+    await harness.runner.closeAsync();
+    harness.earlyReturnStatus = OperationStatus.FromCache;
+    const restored: ITestIteration = await harness.executeAsync();
+    expect(restored.record.status).toBe(OperationStatus.FromCache);
+    expect(restored.output).toContain(
+      `The warm worker (pid ${worker.pid}) was closed after the operation last ran.`
+    );
+
+    harness.earlyReturnStatus = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).not.toContain('was closed after the operation last ran');
+  });
+
+  it('runs the initial command after an incremental run whose outputs the guard does not accept', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+
+    harness.rerunReason =
+      'the incremental command changed which output files it has: 1 added ("lib/chunk.js")';
+    const rerun: ITestIteration = await harness.executeAsync();
+    expect(rerun.result.status).toBe(OperationStatus.Success);
+    expect(rerun.commands).toEqual([INCREMENTAL_IPC_COMMAND, INITIAL_COMMAND]);
+    expectLinesInOrder(rerun.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1',
+      'Running the initial command, because the incremental command changed which output files it has: 1 added ("lib/chunk.js").',
+      `Closing the warm worker (pid ${children[1].pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(getCommandExecution(rerun.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('runs the initial command after a failed run on a reused worker, and reports the status of the initial command', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    // E.g. a worker whose module resolution kept an error from an earlier run.
+    harness.workerBehavior = 'fail-reused';
+    expect((await harness.executeAsync()).result.status).toBe(OperationStatus.Success);
+    const worker: ChildProcess = children[1];
+    const pid: number = harness.runner.workerPid!;
+
+    const recovered: ITestIteration = await harness.executeAsync();
+    expect(recovered.result.status).toBe(OperationStatus.Success);
+    expect(recovered.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(recovered.output, [
+      `Sending run 2 to the warm worker (pid ${pid}).`,
+      'worker error 2',
+      'Running the initial command, because the run on the warm worker failed.',
+      `Closing the warm worker (pid ${pid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_COMMAND}`,
+      'one-shot'
+    ]);
+    expect(recovered.record.error).toBeUndefined();
+    expect(getCommandExecution(recovered.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+
+    // A genuine error fails the initial command too.
+    expect((await harness.executeAsync()).output).toContain('Starting a warm worker for it.');
+    harness.initialExitCode = 2;
+    const failed: ITestIteration = await harness.executeAsync();
+    expect(failed.result.status).toBe(OperationStatus.Failure);
+    expect(failed.commands).toEqual([INITIAL_COMMAND]);
+    expectLinesInOrder(failed.output, [
+      'worker error 2',
+      'Running the initial command, because the run on the warm worker failed.',
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(failed.record.error?.message).toContain('Returned error code: 2');
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('reports a failed first run of a new worker as it stands, and closes the worker', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.workerBehavior = 'fail';
+    const failed: ITestIteration = await harness.executeAsync();
+    expect(failed.result.status).toBe(OperationStatus.Failure);
+    expect(failed.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    const worker: ChildProcess = children[1];
+    expectLinesInOrder(failed.output, [
+      'Starting a warm worker for it.',
+      'worker error 1',
+      `Closing the warm worker (pid ${worker.pid}), because the operation failed, so its next build runs the initial command.`
+    ]);
+    expect(failed.output).not.toContain('Running the initial command');
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('closes a worker whose initial run failed', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ initialIpcCommand: INITIAL_IPC_COMMAND });
+    harness.workerBehavior = 'fail';
+    const failed: ITestIteration = await harness.executeAsync();
+    expect(failed.result.status).toBe(OperationStatus.Failure);
+    expect(failed.commands).toEqual([INITIAL_IPC_COMMAND]);
+    const worker: ChildProcess = children[0];
+    expectLinesInOrder(failed.output, [
+      `Invoking (initial): ${INITIAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker error 1',
+      `Closing the warm worker (pid ${worker.pid}), because the operation failed, so its next build runs the initial command.`
+    ]);
+    expect(worker.exitCode).toBe(0);
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('runs the initial command in a new worker if the project has an ipc script, and reuses that worker', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ initialIpcCommand: INITIAL_IPC_COMMAND });
+
+    const first: ITestIteration = await harness.executeAsync();
+    expect(first.result.status).toBe(OperationStatus.Success);
+    expect(first.commands).toEqual([INITIAL_IPC_COMMAND]);
+    expectLinesInOrder(first.output, [
+      `Invoking (initial): ${INITIAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1'
+    ]);
+    expect(getCommandExecution(first.record)).toEqual({
+      kind: 'initial',
+      hasIncrementalCommand: true,
+      watchesInputs: true
+    });
+    const firstPid: number = harness.runner.workerPid!;
+
+    const second: ITestIteration = await harness.executeAsync();
+    expect(second.commands).toEqual([]);
+    expectLinesInOrder(second.output, [
+      `Invoking (incremental): ${INCREMENTAL_IPC_COMMAND}`,
+      `Sending run 2 to the warm worker (pid ${firstPid}).`,
+      'worker run 2'
+    ]);
+    expect(harness.isReadSkippedAtCacheStage).toEqual([false, true]);
+
+    // A build from scratch must not run on top of what the worker keeps in memory.
+    harness.blockReason = 'its dependencies changed';
+    const blocked: ITestIteration = await harness.executeAsync();
+    expect(blocked.commands).toEqual([INITIAL_IPC_COMMAND]);
+    expectLinesInOrder(blocked.output, [
+      'Not using the incremental command because its dependencies changed.',
+      `Closing the warm worker (pid ${firstPid}), because the initial command must run.`,
+      `Invoking (initial): ${INITIAL_IPC_COMMAND}`,
+      'Starting a warm worker for it.',
+      'worker run 1'
+    ]);
+    expect(harness.runner.workerPid).not.toBe(firstPid);
+  });
+
+  it('closes a worker after its maximum number of runs', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ maxRunsPerWorker: 2 });
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const pid: number = harness.runner.workerPid!;
+
+    const last: ITestIteration = await harness.executeAsync();
+    expectLinesInOrder(last.output, [
+      `Sending run 2 to the warm worker (pid ${pid}).`,
+      'worker run 2',
+      `Closing the warm worker (pid ${pid}), because it has run 2 times.`
+    ]);
+    expect(last.result.status).toBe(OperationStatus.Success);
+    expect(harness.runner.isActive).toBe(false);
+    expect((await harness.executeAsync()).output).toContain('Starting a warm worker for it.');
+  });
+
+  it('closes a worker once its memory grew too much', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ maxMemoryGrowth: 1.5 });
+    harness.workerBehavior = 'grow';
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const pid: number = harness.runner.workerPid!;
+    expect(harness.runner.residentMemoryBytes).toBe(100000000);
+
+    const grown: ITestIteration = await harness.executeAsync();
+    expect(grown.output).toContain(
+      `Closing the warm worker (pid ${pid}), because its memory grew from 95 MB after its first run to 191 MB.`
+    );
+    expect(harness.runner.isActive).toBe(false);
+  });
+
+  it('waits for a reused worker to report a change before it sends the next run, for at most the timeout', async () => {
+    const harness: ITestHarness = await createHarnessAsync({ changeReportTimeoutMs: 500 });
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const unreportedStart: number = performance.now();
+    const unreported: ITestIteration = await harness.executeAsync();
+    expect(performance.now() - unreportedStart).toBeGreaterThanOrEqual(450);
+    expect(unreported.output).toContain('Sending run 2 to the warm worker');
+
+    const reporting: ITestHarness = await createHarnessAsync({ changeReportTimeoutMs: 10000 });
+    reporting.workerBehavior = 'request';
+    await reporting.executeAsync();
+    await reporting.executeAsync();
+    const reportedStart: number = performance.now();
+    const reported: ITestIteration = await reporting.executeAsync();
+    expect(performance.now() - reportedStart).toBeLessThan(2000);
+    expect(reported.output).toContain('Sending run 2 to the warm worker');
+  });
+
+  it('runs the initial command if the worker exits during a run, and starts a new worker for the next one', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.workerBehavior = 'crash';
+    const crashed: ITestIteration = await harness.executeAsync();
+    expect(crashed.result.status).toBe(OperationStatus.Success);
+    expect(crashed.commands).toEqual([INCREMENTAL_IPC_COMMAND, INITIAL_COMMAND]);
+    expectLinesInOrder(crashed.output, [
+      'Starting a warm worker for it.',
+      'The warm worker exited before it reported the result of its run (exit code 3).',
+      'Running the initial command, because the run on the warm worker failed.',
+      `Invoking (initial): ${INITIAL_COMMAND}`
+    ]);
+    expect(crashed.record.error).toBeUndefined();
+    expect(getCommandExecution(crashed.record)).toEqual({ kind: 'initial', hasIncrementalCommand: true });
+    expect(harness.runner.isActive).toBe(false);
+
+    harness.workerBehavior = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.result.status).toBe(OperationStatus.Success);
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).toContain('Starting a warm worker for it.');
+  });
+
+  it('terminates the worker if the operation is aborted, and starts a new worker for the next run', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.workerBehavior = 'hang';
+    const running: Promise<void> = harness.waitForWorkerRunAsync();
+    const execution: Promise<ITestIteration> = harness.executeAsync();
+    await running;
+    const worker: ChildProcess = children[1];
+    await harness.graph.abortCurrentIterationAsync({ terminateRunning: true });
+    const aborted: ITestIteration = await execution;
+    expect(aborted.result.status).toBe(OperationStatus.Aborted);
+    // An aborted run is not a failure, so the initial command does not run.
+    expect(aborted.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(aborted.output).toContain('Terminated because the operation was aborted.');
+    expect(worker.signalCode).toBe('SIGTERM');
+    expect(harness.runner.isActive).toBe(false);
+
+    harness.workerBehavior = undefined;
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.result.status).toBe(OperationStatus.Success);
+    expect(next.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(next.output).toContain('Starting a warm worker for it.');
+  });
+
+  it('closes the worker after its run if the runner should not persist', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    harness.shouldRunnerPersist = false;
+    const closed: ITestIteration = await harness.executeAsync();
+    expect(closed.result.status).toBe(OperationStatus.Success);
+    expect(closed.commands).toEqual([INCREMENTAL_IPC_COMMAND]);
+    expect(harness.runner.isActive).toBe(false);
+    expect(children[1].exitCode).toBe(0);
+  });
+
+  it('waits for the worker to exit in each concurrent close', async () => {
+    const harness: ITestHarness = await createHarnessAsync();
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+    const exitCodes: (number | null)[] = [];
+    await Promise.all(
+      [harness.runner.closeAsync(), harness.runner.closeAsync()].map(async (promise: Promise<void>) => {
+        await promise;
+        exitCodes.push(worker.exitCode);
+      })
+    );
+    expect(exitCodes).toEqual([0, 0]);
+    await harness.runner.closeAsync();
+  });
+});
+
+describe(DaemonWarmWorkerPlugin.name, () => {
+  it('creates warm worker runners only for opted-in operations with an incremental ipc script and no other runner', async () => {
+    const scripts: Record<string, string> = {
+      '_phase:build': 'heft run --only build -- --clean',
+      '_phase:build:incremental:ipc': 'heft run-watch --only build --'
+    };
+    const optedIn: IOperationSettings = { operationName: phase.name, allowDaemonWarmWorker: true };
+    const createOperation = (
+      name: string,
+      projectScripts: Record<string, string> | undefined,
+      runner?: NullOperationRunner,
+      settings: IOperationSettings | false = optedIn
+    ): Operation =>
+      new Operation({
+        phase,
+        project: createProject(name, projectScripts),
+        runner,
+        settings: settings || undefined,
+        logFilenameIdentifier: name
+      });
+    const warm: Operation = createOperation('warm', scripts);
+    const warmWithIpc: Operation = createOperation('warm-with-ipc', {
+      ...scripts,
+      '_phase:build:ipc': 'heft run-watch --only build -- --clean'
+    });
+    // `rush start` runs the same script in watch mode, so the script alone does not opt in.
+    const withoutSettings: Operation = createOperation('without-settings', scripts, undefined, false);
+    const withoutField: Operation = createOperation('without-field', scripts, undefined, {
+      operationName: phase.name
+    });
+    const optedOut: Operation = createOperation('opted-out', scripts, undefined, {
+      operationName: phase.name,
+      allowDaemonWarmWorker: false
+    });
+    const withoutIpcScript: Operation = createOperation('without-ipc-script', {
+      '_phase:build': scripts['_phase:build']
+    });
+    const withoutScript: Operation = createOperation('without-script', {
+      '_phase:build:incremental:ipc': scripts['_phase:build:incremental:ipc']
+    });
+    const existingRunner: NullOperationRunner = new NullOperationRunner({
+      name: 'existing',
+      result: OperationStatus.NoOp,
+      silent: true
+    });
+    const withRunner: Operation = createOperation('with-runner', scripts, existingRunner);
+
+    // Like PhasedScriptAction, which applies the plugin after ShellOperationRunnerPlugin.
+    const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+    new ShellOperationRunnerPlugin().apply(hooks);
+    new DaemonWarmWorkerPlugin().apply(hooks);
+    const context: ICreateOperationsContext = {
+      isIncrementalBuildAllowed: true,
+      isWatch: false
+    } as unknown as ICreateOperationsContext;
+    await hooks.createOperationsAsync.promise(
+      new Set([
+        warm,
+        warmWithIpc,
+        withoutSettings,
+        withoutField,
+        optedOut,
+        withoutIpcScript,
+        withoutScript,
+        withRunner
+      ]),
+      context
+    );
+
+    expect(warm.runner).toBeInstanceOf(WarmWorkerOperationRunner);
+    expect(warmWithIpc.runner).toBeInstanceOf(WarmWorkerOperationRunner);
+    expect(withoutSettings.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(withoutField.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(optedOut.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(withoutIpcScript.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(withoutScript.runner).toBeInstanceOf(NullOperationRunner);
+    expect(withRunner.runner).toBe(existingRunner);
+
+    // Its build cache entries are those of ShellOperationRunner.
+    const shellHooks: PhasedCommandHooks = new PhasedCommandHooks();
+    new ShellOperationRunnerPlugin().apply(shellHooks);
+    const shellTwin: Operation = createOperation('shell-twin', scripts);
+    await shellHooks.createOperationsAsync.promise(new Set([shellTwin]), context);
+    expect(shellTwin.runner).toBeInstanceOf(ShellOperationRunner);
+    expect(warm.runner!.getConfigHash()).toBe(shellTwin.runner!.getConfigHash());
+
+    // Watch mode has its own IPC runners, and a command that allows no incremental run does not need workers.
+    for (const otherContext of [
+      { ...context, isWatch: true },
+      { ...context, isIncrementalBuildAllowed: false }
+    ]) {
+      const operation: Operation = createOperation('other', scripts);
+      await hooks.createOperationsAsync.promise(new Set([operation]), otherContext);
+      expect(operation.runner).toBeInstanceOf(ShellOperationRunner);
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/schemas/rush-project.schema.json b/libraries/rush-lib/src/schemas/rush-project.schema.json
index e45130007c..67173fd2c9 100644
--- a/libraries/rush-lib/src/schemas/rush-project.schema.json
+++ b/libraries/rush-lib/src/schemas/rush-project.schema.json
@@ -60,6 +60,11 @@
             }
           },
 
+          "allowDaemonWarmWorker": {
+            "type": "boolean",
+            "description": "If true, and daemon.warmWorkers is enabled, the Rush daemon keeps the operation's \"<phase>:incremental:ipc\" script running as a warm worker between builds, and sends it the incremental runs that the incremental execution guard allows. Set this only if that script, run in watch mode, runs every task and check that the \"<phase>\" script runs, because the daemon reports a run on the worker as if the \"<phase>\" script had run. For Heft, that means the \"lintInWatchMode\" option of heft-lint-plugin and the \"runInWatchMode\" setting of API Extractor, which both default to skipping their task in watch mode."
+          },
+
           "outputFolderNames": {
             "type": "array",
             "description": "Specify the folders where this operation writes its output files. If enabled, the Rush build cache will restore these folders from the cache. The strings are folder names under the project root folder. These folders should not be tracked by Git. They must not contain symlinks.",
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index ed1b151020..87939878e1 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -282,6 +282,11 @@
           "default": true,
           "description": "Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited since then and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. Results of an incremental script are not written to the build cache. RUSH_DAEMON_INCREMENTAL_BUILDS overrides."
         },
+        "warmWorkers": {
+          "type": "boolean",
+          "default": false,
+          "description": "Keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose rush-project.json operation settings set `allowDaemonWarmWorker`, and send it the next incremental run when incrementalBuilds allows one. Otherwise the worker is closed and the initial script runs. Requires incrementalBuilds. RUSH_DAEMON_WARM_WORKERS overrides."
+        },
         "queueTimeoutSeconds": {
           "type": "number",
           "minimum": 0,

From 5a1996bb748a7f1fd28b8c93af0a74a5068bb173 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 085/265] [rush-daemon] The daemon logs each shutdown with its
 reason, and exits when its socket file is lost

Swarm integration step 70; original commit 689084765b (merge of swarm/o04-t151-x156 at 5503c45528).
Scope: tasks 151 and 156.

Brings o04's task 151 (board 3120) and r01's task 156 (board 3253), merged together by o04 (board 3190) because they conflict in one doc comment. 151: rushd logs each shutdown with its reason, time and PID, and its ready line gets the time and PID. 156: a daemon whose socket file was deleted or replaced notices within 5 s and exits once no request runs (initiator socketLost), so the next build starts a new daemon without the 15 s wait and the in-process fallback. Second agents: t02 CONFIRMED 151 board 3249 and 156 board 3302.

s17 batch D3, item 2 of 8. Gate: ch01 GATE OK board 3747 (tree adbb8b5631)

Commits folded into this step (3):
- b5e7243165 rush-daemon: a daemon whose socket file was deleted or replaced exits once idle (task 156)
- ad32ffa563 [rush-daemon] Log each shutdown with its reason and PID, and add the time and PID to the ready line
- 5503c45528 Name a lost socket in the daemon's shutdown line

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   8 +
 .../src/test/launchClient.test.ts             |  13 +-
 .../daemon-shutdown-log_2026-09-29-01-40.json |  10 +
 .../r01-socket-check_2026-09-29-02-10.json    |  11 ++
 .../daemon-shutdown-log_2026-09-29-01-40.json |  10 +
 .../r01-socket-check_2026-09-29-02-10.json    |  11 ++
 .../reviews/api/rush-daemon-transport.api.md  |   4 +
 common/reviews/api/rush-daemon.api.md         |   2 +-
 .../src/DaemonFileChange.ts                   |  57 ++++++
 .../src/DaemonListener.ts                     |   6 +
 .../src/DaemonListenerLifetime.ts             |   8 +
 libraries/rush-daemon-transport/src/index.ts  |   1 +
 .../src/test/FileChange.test.ts               |  66 +++++++
 .../src/test/ListenerSocketCheck.test.ts      |  75 ++++++++
 libraries/rush-daemon/README.md               |   6 +
 libraries/rush-daemon/src/DaemonIdleTimer.ts  |  15 +-
 .../rush-daemon/src/DaemonShutdownError.ts    |  10 +-
 .../rush-daemon/src/DaemonSocketWatch.ts      |  36 ++++
 .../rush-daemon/src/RushDaemonCommandLine.ts  |   4 +-
 libraries/rush-daemon/src/RushDaemonHost.ts   |  71 +++++++-
 .../src/SelectedDaemonBootstrap.ts            |   5 +-
 .../src/test/DaemonIdleShutdown.test.ts       |   3 +
 .../src/test/DaemonIdleTimer.test.ts          |  33 ++++
 .../src/test/DaemonInstallationChange.test.ts |  12 +-
 .../src/test/DaemonProcessExit.test.ts        |   6 +-
 .../src/test/DaemonShutdown.test.ts           |  55 ++++++
 .../src/test/DaemonSocketLoss.test.ts         | 171 ++++++++++++++++++
 .../src/test/DaemonSocketWatch.test.ts        |  54 ++++++
 .../src/test/RushDaemonCommandLine.test.ts    |  23 ++-
 .../src/test/SuccessfulNativeMutation.test.ts |   8 +-
 .../test/WorkspaceRestartArbitration.test.ts  |   7 +-
 .../test/fixtures/SuccessfulMutationDaemon.ts |   3 +-
 32 files changed, 784 insertions(+), 20 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/daemon-shutdown-log_2026-09-29-01-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r01-socket-check_2026-09-29-02-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-shutdown-log_2026-09-29-01-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r01-socket-check_2026-09-29-02-10.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonFileChange.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/FileChange.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
 create mode 100644 libraries/rush-daemon/src/DaemonSocketWatch.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index aad50dc10e..5255400fc7 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -540,6 +540,14 @@ parent closes its descriptor after spawning. On POSIX the launcher enforces mode
 `0600` and rejects linked destinations; Windows uses the existing per-user
 transport directory permissions.
 
+Each daemon writes `<time> rushd ready at <socket> (Rush <version>, PID <pid>)` when it
+is ready, and `<time> rushd (PID <pid>) shutting down: <reason>` when it begins to shut
+down. The reason is `received SIGTERM` or `received SIGINT`; `requested by a client`, for
+`daemon stop`, `daemon stop --force` and `daemon restart`; `idle for <seconds> s`;
+`its socket file was deleted or replaced`, after the line that reports the lost socket;
+or a restart, with its cause. A daemon that is killed (SIGKILL, or SIGHUP, which it does
+not handle) writes no such line, and a crash still writes its stack.
+
 Default reading is bounded to the size observed when the log is opened, with chunked,
 backpressured output. Empty snapshots succeed without output; missing/unreadable logs
 or invalid destinations fail with a diagnostic and exit code 1. A launcher log
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index e7e0a2a7e7..a42e035a83 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -244,7 +244,14 @@ describe('standalone rushx fallback', () => {
     expect(stopped.code).toBe(1);
     const log: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'logs']);
     expect(log.code).toBe(0);
-    expect(log.stdout).toContain('rushd ready at');
+    const isoTime: string = '\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z';
+    const ready: RegExpMatchArray | null = log.stdout.match(
+      new RegExp(`^${isoTime} rushd ready at .+ \\(Rush ${Rush.version}, PID (\\d+)\\)$`, 'm')
+    );
+    expect(ready).not.toBeNull();
+    expect(log.stdout).toMatch(
+      new RegExp(`^${isoTime} rushd \\(PID ${ready![1]}\\) shutting down: idle for 2 s$`, 'm')
+    );
   }, 15000);
 
   it('reads a saved launcher log without connecting or auto-starting', async () => {
@@ -345,6 +352,10 @@ describe('standalone rushx fallback', () => {
         cancelledRequests: 0
       });
       expect(fs.existsSync(reservation)).toBe(false);
+      // The daemon writes the line before it acknowledges the request.
+      expect(fs.readFileSync(logFilePath, 'utf8')).toContain(
+        `rushd (PID ${pid}) shutting down: requested by a client ("rush-client daemon stop" or "daemon restart")\n`
+      );
       const deadline: number = Date.now() + 7000;
       while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
       const restarted: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
diff --git a/common/changes/@rushstack/rush-cli-client/daemon-shutdown-log_2026-09-29-01-40.json b/common/changes/@rushstack/rush-cli-client/daemon-shutdown-log_2026-09-29-01-40.json
new file mode 100644
index 0000000000..da9407ce07
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/daemon-shutdown-log_2026-09-29-01-40.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/r01-socket-check_2026-09-29-02-10.json b/common/changes/@rushstack/rush-daemon-transport/r01-socket-check_2026-09-29-02-10.json
new file mode 100644
index 0000000000..418856a873
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r01-socket-check_2026-09-29-02-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add `DaemonFrameListener.checkSocket()` and the `DaemonFileChange` type. On POSIX, `checkSocket()` reports `removed` when the listener's published socket was deleted, or its runtime folder was, and `replaced` when another file took the socket's name. It returns `undefined` while the socket is intact, on Windows, and after the listener released its socket.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-shutdown-log_2026-09-29-01-40.json b/common/changes/@rushstack/rush-daemon/daemon-shutdown-log_2026-09-29-01-40.json
new file mode 100644
index 0000000000..deea81a10b
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-shutdown-log_2026-09-29-01-40.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Write one line to the daemon log when the daemon begins to shut down, with its process ID and the reason (a signal, a client's `daemon stop` or `daemon restart`, the idle timeout, a lost socket, or a restart), and add the time and the process ID to the `rushd ready at` line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r01-socket-check_2026-09-29-02-10.json b/common/changes/@rushstack/rush-daemon/r01-socket-check_2026-09-29-02-10.json
new file mode 100644
index 0000000000..20f68567f8
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r01-socket-check_2026-09-29-02-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "On POSIX, a daemon now checks every 5 seconds that its socket file still exists. When the socket was deleted (for example by a cleaner of the temp folder) or another file took its name, no client could connect, and none could start another daemon while this one held the lockfile: each build waited 15 seconds and then ran without the daemon, and `daemon stop` could not reach it. The daemon now logs that its socket was removed or replaced and exits as soon as no request is running, as after an idle timeout, so that the next client starts a new daemon. Adds the `socketLost` shutdown initiator.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index ad9b1e2f86..2e1c6369eb 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -20,6 +20,9 @@ export function connectDaemonAsync(socketPath: string, options?: IDaemonConnecto
 // @beta
 export const DAEMON_RUNTIME_DIR_ENV_VAR: 'RUSHD_RUNTIME_DIR';
 
+// @beta
+export type DaemonFileChange = 'removed' | 'replaced';
+
 // @beta
 export class DaemonFrameConnection {
     constructor(socket: net.Socket);
@@ -35,6 +38,7 @@ export class DaemonFrameConnection {
 
 // @beta
 export class DaemonFrameListener {
+    checkSocket(): DaemonFileChange | undefined;
     closeAsync(): Promise<void>;
     static listenAsync(paths: IDaemonPaths, options: IDaemonListenerOptions): Promise<DaemonFrameListener>;
     releaseForExit(): boolean;
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index f9003bbbdf..b756696008 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -96,7 +96,7 @@ export class DaemonShutdownError extends Error {
 }
 
 // @beta
-export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
+export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host' | 'socketLost';
 
 // @beta
 export type DaemonShutdownStage = 'requests' | 'workspaceMaintenance' | 'requestDispatcher' | 'workspaceSession' | 'listener';
diff --git a/libraries/rush-daemon-transport/src/DaemonFileChange.ts b/libraries/rush-daemon-transport/src/DaemonFileChange.ts
new file mode 100644
index 0000000000..700296f658
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonFileChange.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { readFileIdentity } from './DaemonFileIdentity';
+import type { IDaemonFileIdentity } from './DaemonFileIdentity';
+
+/**
+ * How the file at a path differs from the file that this process created there: `removed` when nothing has
+ * the name any more, `replaced` when another file has it.
+ *
+ * @beta
+ */
+export type DaemonFileChange = 'removed' | 'replaced';
+
+const REMOVED: DaemonFileChange = 'removed';
+const REPLACED: DaemonFileChange = 'replaced';
+const NOT_A_DIRECTORY: string = 'ENOTDIR';
+
+interface IFileIdentityRead {
+  /** False when the path could not be read for a reason that says nothing about the file. */
+  readonly known: boolean;
+  readonly identity?: IDaemonFileIdentity;
+}
+
+function readIdentity(filePath: string): IFileIdentityRead {
+  try {
+    return { known: true, identity: readFileIdentity(filePath) };
+  } catch (error) {
+    // A folder on the path that became a file leaves the name as unreachable as a deletion does.
+    return { known: (error as NodeJS.ErrnoException).code === NOT_A_DIRECTORY };
+  }
+}
+
+function isSameFile(current: IDaemonFileIdentity, expected: IDaemonFileIdentity): boolean {
+  return current.dev === expected.dev && current.ino === expected.ino;
+}
+
+function compareIdentity(
+  current: IDaemonFileIdentity | undefined,
+  expected: IDaemonFileIdentity
+): DaemonFileChange | undefined {
+  if (!current) return REMOVED;
+  return isSameFile(current, expected) ? undefined : REPLACED;
+}
+
+/**
+ * Compares the file at `filePath` with `expected`, the identity of the file this process created there.
+ * @returns `undefined` while it is the same file, and also when the path cannot be read for another reason
+ * (for example permissions), since that is no evidence that the file changed.
+ */
+export function compareFileIdentity(
+  filePath: string,
+  expected: IDaemonFileIdentity
+): DaemonFileChange | undefined {
+  const read: IFileIdentityRead = readIdentity(filePath);
+  return read.known ? compareIdentity(read.identity, expected) : undefined;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonListener.ts b/libraries/rush-daemon-transport/src/DaemonListener.ts
index f131fafae8..b08d638e48 100644
--- a/libraries/rush-daemon-transport/src/DaemonListener.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListener.ts
@@ -5,6 +5,7 @@ import * as net from 'node:net';
 
 import type { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
 
+import type { DaemonFileChange } from './DaemonFileChange';
 import { pinFileIdentity } from './DaemonFileIdentity';
 import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import { DaemonFrameConnection } from './DaemonFrameConnection';
@@ -79,6 +80,11 @@ export class DaemonFrameListener {
   public releaseForExit(): boolean {
     return this.#lifetime.releaseForExit();
   }
+  /** Reports a POSIX socket that was deleted, or whose name another file took: no client can connect then.
+   * @returns `undefined` while the socket is intact, on Windows, and after the listener released it. */
+  public checkSocket(): DaemonFileChange | undefined {
+    return this.#lifetime.checkSocket();
+  }
 }
 
 function writeListenerLockfile(paths: IDaemonPaths, options: IDaemonListenerOptions): IDaemonFileIdentity {
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
index f3604f6f04..e856caf368 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
@@ -4,6 +4,8 @@
 import type * as net from 'node:net';
 
 import { hasProcessesToReap } from './DaemonExitRelease';
+import { compareFileIdentity } from './DaemonFileChange';
+import type { DaemonFileChange } from './DaemonFileChange';
 import { removeOwnFile } from './DaemonFileIdentity';
 import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import type { StopOperationGroupRecording } from './DaemonOperationGroupRecorder';
@@ -63,6 +65,12 @@ export class DaemonListenerLifetime {
     return true;
   }
 
+  /** Reports a published socket that no longer has its name, until this listener releases the socket. */
+  public checkSocket(): DaemonFileChange | undefined {
+    if (!this.#files.socket || this.#socketReleased) return undefined;
+    return compareFileIdentity(this.#paths.socketPath, this.#files.socket);
+  }
+
   #stopOnceAsync(): Promise<void> {
     // Unlink before closing, as libuv does for the path it bound, but only this listener's own socket: the
     // name may belong to a successor by now.
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index 7623e62198..430d684e4c 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -15,6 +15,7 @@
  */
 
 export { connectDaemonAsync, type IDaemonConnectorOptions } from './DaemonConnector';
+export type { DaemonFileChange } from './DaemonFileChange';
 export { DaemonFrameConnection } from './DaemonFrameConnection';
 export { DaemonFrameListener, type IDaemonListenerOptions } from './DaemonListener';
 export {
diff --git a/libraries/rush-daemon-transport/src/test/FileChange.test.ts b/libraries/rush-daemon-transport/src/test/FileChange.test.ts
new file mode 100644
index 0000000000..21f2e51ba3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FileChange.test.ts
@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { compareFileIdentity } from '../DaemonFileChange';
+import type { IDaemonFileIdentity } from '../DaemonFileIdentity';
+
+const CONTENT: string = 'content';
+const MOVED_SUFFIX: string = '.moved';
+// No file system allows a name this long, so reading it fails with ENAMETOOLONG.
+const OVERLONG_NAME_LENGTH: number = 4096;
+const OTHER_DEVICE_OFFSET: number = 1;
+
+let folder: string;
+let filePath: string;
+let created: IDaemonFileIdentity;
+
+beforeEach(() => {
+  folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-file-change-'));
+  filePath = path.join(folder, 'file');
+  fs.writeFileSync(filePath, CONTENT);
+  const { dev, ino } = fs.lstatSync(filePath);
+  created = { dev, ino };
+});
+
+afterEach(() => fs.rmSync(folder, { recursive: true, force: true }));
+
+// The moved file keeps its inode in use, so a new file at the name cannot get the same number.
+function moveAway(): void {
+  fs.renameSync(filePath, `${filePath}${MOVED_SUFFIX}`);
+}
+
+it('reports no change while the name has the file that was created there', () => {
+  expect(compareFileIdentity(filePath, created)).toBeUndefined();
+});
+
+it('reports a name that no file has any more as removed', () => {
+  moveAway();
+  expect(compareFileIdentity(filePath, created)).toBe('removed');
+});
+
+it('reports a name that another file took as replaced', () => {
+  moveAway();
+  fs.writeFileSync(filePath, CONTENT);
+  expect(compareFileIdentity(filePath, created)).toBe('replaced');
+});
+
+it('tells files apart by device as well as by inode', () => {
+  const otherDevice: IDaemonFileIdentity = { dev: created.dev + OTHER_DEVICE_OFFSET, ino: created.ino };
+  expect(compareFileIdentity(filePath, otherDevice)).toBe('replaced');
+});
+
+it('reports a name whose folder became a file as removed', () => {
+  fs.rmSync(folder, { recursive: true });
+  fs.writeFileSync(folder, CONTENT);
+  expect(compareFileIdentity(filePath, created)).toBe('removed');
+});
+
+it('reports no change when the name cannot be read for another reason', () => {
+  const overlong: string = path.join(folder, 'x'.repeat(OVERLONG_NAME_LENGTH));
+  expect(() => fs.lstatSync(overlong)).toThrow('ENAMETOOLONG');
+  expect(compareFileIdentity(overlong, created)).toBeUndefined();
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts b/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
new file mode 100644
index 0000000000..db4323fdae
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
@@ -0,0 +1,75 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import { DaemonListenerLifetime } from '../DaemonListenerLifetime';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// A named pipe has no file identity, and it can't be deleted while its server runs.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const REPLACEMENT: string = 'another file';
+const UTF8: BufferEncoding = 'utf8';
+
+let paths: IDaemonPaths;
+let listener: DaemonFrameListener;
+
+beforeEach(async () => {
+  paths = createIsolatedTestDaemonPaths();
+  listener = await DaemonFrameListener.listenAsync(paths, {
+    onConnection: () => undefined,
+    protocolVersion: DAEMON_PROTOCOL_VERSION
+  });
+});
+
+afterEach(async () => {
+  await listener.closeAsync();
+  removeIsolatedBase(paths);
+});
+
+it('reports no change while the socket has its name', () => {
+  expect(listener.checkSocket()).toBeUndefined();
+});
+
+it('reports no change for a listener that published no socket, as on Windows', () => {
+  expect(new DaemonListenerLifetime(net.createServer(), paths, {}).checkSocket()).toBeUndefined();
+});
+
+posixIt('reports a deleted socket as removed', () => {
+  fs.rmSync(paths.socketPath);
+  expect(listener.checkSocket()).toBe('removed');
+});
+
+posixIt('reports a socket whose runtime folder was deleted as removed', () => {
+  fs.rmSync(paths.runtimeDir ?? paths.socketPath, { recursive: true });
+  expect(listener.checkSocket()).toBe('removed');
+});
+
+posixIt(
+  'reports a socket name that another file took as replaced, and closes without deleting it',
+  async () => {
+    fs.rmSync(paths.socketPath);
+    fs.writeFileSync(paths.socketPath, REPLACEMENT);
+    expect(listener.checkSocket()).toBe('replaced');
+    await listener.closeAsync();
+    expect(fs.readFileSync(paths.socketPath, UTF8)).toBe(REPLACEMENT);
+  }
+);
+
+posixIt('reports no change once the listener stopped accepting and deleted its socket', async () => {
+  await listener.stopAcceptingAsync();
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+  expect(listener.checkSocket()).toBeUndefined();
+});
+
+posixIt('reports no change once the listener released its socket for exit', () => {
+  expect(listener.releaseForExit()).toBe(true);
+  expect(fs.existsSync(paths.socketPath)).toBe(false);
+  expect(listener.checkSocket()).toBeUndefined();
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 5161262ddc..ffbbaface0 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -25,6 +25,12 @@ the existing unlimited lifetime; invalid, nonpositive, or overflowing timeouts a
 The host's `closed` promise signals completion of shutdown, including idle shutdown, and `closeAsync()`
 reports cleanup failures. `serveRushDaemonAsync()` returns after either idle shutdown or its shutdown signal.
 
+Whatever starts a shutdown (a signal, a management client, the idle timeout, a lost socket, a restart or
+`closeAsync()`), the host writes one line to `onLog` when it begins, with its process ID and the reason, for example
+`rushd (PID 2750564) shutting down: received SIGTERM`; later close calls write nothing. The standalone daemon
+starts each log line with the time, and its `rushd ready at` line also has the time and the process ID, so that
+each start can be matched with its end.
+
 Protocol 0.6 management clients can stop the host through the workspace transport rather than signaling a PID
 read from disk. The host requires a lifecycle-capable hello, drains `shutdownAck` before beginning shutdown,
 then cancels outstanding requests and disposes the resolver, workspace, and endpoint through its normal close
diff --git a/libraries/rush-daemon/src/DaemonIdleTimer.ts b/libraries/rush-daemon/src/DaemonIdleTimer.ts
index f64d4400b8..91176d92ee 100644
--- a/libraries/rush-daemon/src/DaemonIdleTimer.ts
+++ b/libraries/rush-daemon/src/DaemonIdleTimer.ts
@@ -8,6 +8,7 @@ const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
 export class DaemonIdleTimer implements Disposable {
   readonly #delayMs: number | undefined;
   #activeRequests: number = 0;
+  #expired: boolean = false;
   #onIdle: (() => void) | undefined;
   #timer: NodeJS.Timeout | undefined;
 
@@ -43,6 +44,15 @@ export class DaemonIdleTimer implements Disposable {
     };
   }
 
+  /**
+   * From now on, calls `onIdle` as soon as no request is active, instead of after the idle timeout, and also when no
+   * idle timeout was configured.
+   */
+  public expire(): void {
+    this.#expired = true;
+    this.#schedule();
+  }
+
   public [Symbol.dispose](): void {
     this.#onIdle = undefined;
     clearTimeout(this.#timer);
@@ -50,8 +60,9 @@ export class DaemonIdleTimer implements Disposable {
 
   #schedule(): void {
     clearTimeout(this.#timer);
-    if (this.#activeRequests !== 0 || !this.#onIdle || this.#delayMs === undefined) return;
-    this.#timer = setTimeout(this.#onIdle, this.#delayMs);
+    const delayMs: number | undefined = this.#expired ? 0 : this.#delayMs;
+    if (this.#activeRequests !== 0 || !this.#onIdle || delayMs === undefined) return;
+    this.#timer = setTimeout(this.#onIdle, delayMs);
     this.#timer.unref();
   }
 }
diff --git a/libraries/rush-daemon/src/DaemonShutdownError.ts b/libraries/rush-daemon/src/DaemonShutdownError.ts
index f50a30252f..ff1c8c47ce 100644
--- a/libraries/rush-daemon/src/DaemonShutdownError.ts
+++ b/libraries/rush-daemon/src/DaemonShutdownError.ts
@@ -6,7 +6,13 @@
  *
  * @beta
  */
-export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host';
+export type DaemonShutdownInitiator =
+  | 'controlClient'
+  | 'signal'
+  | 'idleTimeout'
+  | 'restart'
+  | 'host'
+  | 'socketLost';
 
 /**
  * Options for {@link DaemonShutdownError}.
@@ -54,6 +60,8 @@ function describeInitiator(options: IDaemonShutdownErrorOptions): string {
       return 'the daemon restarted to apply workspace changes';
     case 'host':
       return 'the daemon host was closed';
+    case 'socketLost':
+      return 'its socket file was deleted or replaced, so no new client could connect to it';
   }
 }
 
diff --git a/libraries/rush-daemon/src/DaemonSocketWatch.ts b/libraries/rush-daemon/src/DaemonSocketWatch.ts
new file mode 100644
index 0000000000..c18d83d68e
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonSocketWatch.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonFileChange } from '@rushstack/rush-daemon-transport';
+
+/** How often a daemon checks that its socket still has its published name. */
+export const DAEMON_SOCKET_CHECK_INTERVAL_MS: number = 5000;
+
+/**
+ * Checks at an interval that the daemon's socket still has its published name, and reports the first change.
+ *
+ * @remarks
+ * The timer does not keep the process running. The watch stops once it reported a change, or when disposed.
+ */
+export class DaemonSocketWatch implements Disposable {
+  #timer: NodeJS.Timeout | undefined;
+
+  public constructor(
+    checkSocket: () => DaemonFileChange | undefined,
+    onChanged: (change: DaemonFileChange) => void,
+    intervalMs: number = DAEMON_SOCKET_CHECK_INTERVAL_MS
+  ) {
+    this.#timer = setInterval(() => {
+      const change: DaemonFileChange | undefined = checkSocket();
+      if (!change) return;
+      this[Symbol.dispose]();
+      onChanged(change);
+    }, intervalMs);
+    this.#timer.unref();
+  }
+
+  public [Symbol.dispose](): void {
+    clearInterval(this.#timer);
+    this.#timer = undefined;
+  }
+}
diff --git a/libraries/rush-daemon/src/RushDaemonCommandLine.ts b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
index e7715cee11..7940da7554 100644
--- a/libraries/rush-daemon/src/RushDaemonCommandLine.ts
+++ b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
@@ -52,7 +52,9 @@ export async function launchRushDaemonAsync(startingFolder: string = process.cwd
     onError: (error: Error) => process.stderr.write(`${error.stack ?? error.message}\n`),
     onLog: (message: string) => process.stderr.write(`${new Date().toISOString()} ${message}\n`),
     onReady: (host) => {
-      process.stdout.write(`rushd ready at ${host.paths.socketPath}\n`);
+      process.stdout.write(
+        `${new Date().toISOString()} rushd ready at ${host.paths.socketPath} (PID ${process.pid})\n`
+      );
     }
   };
   await serveRushDaemonAsync(serveOptions);
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index d6f3f8a002..25877f8796 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -13,7 +13,7 @@ import {
   DaemonFrameListener,
   resolveDaemonPathsFromProcess
 } from '@rushstack/rush-daemon-transport';
-import type { DaemonFrameConnection, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type { DaemonFileChange, DaemonFrameConnection, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { DaemonControlSession } from './DaemonControlSession';
 import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
@@ -24,6 +24,7 @@ import type { IDaemonRequestResolver } from './DaemonRequestDispatcher';
 import { DaemonShutdownDeadline } from './DaemonShutdownDeadline';
 import { DaemonShutdownDeadlineError, type DaemonShutdownStage } from './DaemonShutdownDeadlineError';
 import { DaemonShutdownError, type DaemonShutdownInitiator } from './DaemonShutdownError';
+import { DaemonSocketWatch } from './DaemonSocketWatch';
 import { WorkspaceSession } from './WorkspaceSession';
 import type { IWorkspaceSession, WorkspaceSessionFactory } from './WorkspaceSession';
 import { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
@@ -60,7 +61,8 @@ export interface IRushDaemonHostOptions {
   readonly onError?: (error: Error) => void;
   /**
    * Receives messages for the daemon log: one for each rejected request, with the stack when the failure was
-   * unexpected, and one for each restart that the clients must finish.
+   * unexpected, one for each restart that the clients must finish, one when the daemon's socket was deleted
+   * or replaced, and one with the process ID and the reason when the host begins to shut down.
    */
   readonly onLog?: (message: string) => void;
   /**
@@ -85,11 +87,19 @@ export interface IRushDaemonHostOptions {
 /**
  * A bound, workspace-keyed Rush daemon host.
  *
+ * @remarks
+ * On POSIX, the host checks every 5 seconds that its socket still has its published name. No client can connect
+ * after the socket file was deleted (for example by a cleaner of the temp folder) or its name was taken by
+ * another file, and none can start another daemon while this one owns the lockfile. After such a change, the host
+ * therefore closes as soon as no request is running, as after an idle timeout, so that the next client starts a
+ * new daemon.
+ *
  * @beta
  */
 export class RushDaemonHost {
   readonly #listener: DaemonFrameListener;
   readonly #idleTimer: DaemonIdleTimer;
+  #socketWatch: DaemonSocketWatch | undefined;
   readonly #sessions: Set<DaemonControlSession>;
   readonly #workspaceSessionProvider: WorkspaceSessionProvider;
   readonly #readWorkspaceStatus: () => IDaemonWorkspaceStatus;
@@ -103,6 +113,7 @@ export class RushDaemonHost {
   readonly #options: IRushDaemonHostOptions;
   readonly #startedAt: string;
   #restartPromise: Promise<IWorkspaceProcessRestartResult | undefined> | undefined;
+  #restartPlan: IWorkspaceProcessRestartPlan | undefined;
   #resolveRestart: ((result: IWorkspaceProcessRestartResult | undefined) => void) | undefined;
   #rejectRestart: ((error: Error) => void) | undefined;
   /**
@@ -281,7 +292,19 @@ export class RushDaemonHost {
         if (!(error instanceof DaemonShutdownDeadlineError)) host.#reportError(error);
       });
     }
-    idleTimer.start(() => requestShutdown('idleTimeout'));
+    let idleInitiator: DaemonShutdownInitiator = 'idleTimeout';
+    idleTimer.start(() => requestShutdown(idleInitiator));
+    host.#socketWatch = new DaemonSocketWatch(
+      () => listener.checkSocket(),
+      (change: DaemonFileChange) => {
+        options.onLog?.(
+          `rushd: the socket ${paths.socketPath} was ${change}, so no client can connect to this daemon; ` +
+            'exiting once running requests finish, so that the next client starts a new daemon'
+        );
+        idleInitiator = 'socketLost';
+        idleTimer.expire();
+      }
+    );
     return host;
   }
 
@@ -368,6 +391,7 @@ export class RushDaemonHost {
   async #restartOnceAsync(
     plan: IWorkspaceProcessRestartPlan
   ): Promise<IWorkspaceProcessRestartResult | undefined> {
+    this.#restartPlan = plan;
     await this.closeAsync(new DaemonShutdownError({ initiator: 'restart' }));
     if (plan.reason === 'installation-changed') return undefined;
     if (plan.failure) throw plan.failure;
@@ -395,7 +419,9 @@ export class RushDaemonHost {
   }
 
   async #closeOnceAsync(reason: DaemonShutdownError | undefined): Promise<void> {
+    this.#logShutdown(reason);
     this.#idleTimer[Symbol.dispose]();
+    this.#socketWatch?.[Symbol.dispose]();
     this.#lifecycle.closing = true;
     const errors: unknown[] = [];
     // Refuse new sessions but keep the listener's live ownership until every resource join succeeds.
@@ -445,4 +471,43 @@ export class RushDaemonHost {
       throw new AggregateError(errors, 'Failed to close Rush daemon host resources.');
     }
   }
+
+  #logShutdown(reason: DaemonShutdownError | undefined): void {
+    const description: string = describeShutdown(reason, this.#restartPlan, this.#options.idleTimeoutSeconds);
+    try {
+      this.#options.onLog?.(`rushd (PID ${process.pid}) shutting down: ${description}`);
+    } catch {
+      // An onLog callback that throws must not keep the daemon from shutting down.
+    }
+  }
+}
+
+function describeShutdown(
+  reason: DaemonShutdownError | undefined,
+  restartPlan: IWorkspaceProcessRestartPlan | undefined,
+  idleTimeoutSeconds: number | undefined
+): string {
+  switch (reason?.initiator) {
+    case 'signal':
+      return `received ${reason?.signal ?? 'a termination signal'}`;
+    case 'controlClient':
+      return 'requested by a client ("rush-client daemon stop" or "daemon restart")';
+    case 'idleTimeout':
+      return idleTimeoutSeconds === undefined ? 'idle timeout' : `idle for ${idleTimeoutSeconds} s`;
+    case 'restart':
+      switch (restartPlan?.reason) {
+        case 'hard-input-change':
+          return `restarting for Rush ${restartPlan.rushVersion}, because a request needs a new process`;
+        case 'native-mutation':
+          return `restarting for Rush ${restartPlan.rushVersion} after "rush install" or "rush update"`;
+        case 'installation-changed':
+          return 'its installation changed, so the next client starts a new daemon';
+        default:
+          return 'restarting';
+      }
+    case 'socketLost':
+      return 'its socket file was deleted or replaced, so the next client starts a new daemon';
+    default:
+      return 'the daemon host was closed';
+  }
 }
diff --git a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
index be0748b6df..9a621d480e 100644
--- a/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
+++ b/libraries/rush-daemon/src/SelectedDaemonBootstrap.ts
@@ -115,7 +115,10 @@ async function mainAsync(): Promise<void> {
       process.stderr.write(`${new Date().toISOString()} ${message}\n`);
     },
     onReady: (host) => {
-      process.stdout.write(`rushd ready at ${host.paths.socketPath} (Rush ${installation.rushVersion})\n`);
+      process.stdout.write(
+        `${new Date().toISOString()} rushd ready at ${host.paths.socketPath} ` +
+          `(Rush ${installation.rushVersion}, PID ${process.pid})\n`
+      );
     }
   });
 }
diff --git a/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts b/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts
index 401702dca3..f87a5a648d 100644
--- a/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonIdleShutdown.test.ts
@@ -47,8 +47,10 @@ describe('daemon idle shutdown', () => {
 
   it('finishes serving and removes transport artifacts after idle shutdown', async () => {
     const ready = createDeferred<RushDaemonHost>();
+    const logs: string[] = [];
     const serving: Promise<void> = serveRushDaemonAsync({
       ...createOptions(),
+      onLog: (message: string) => logs.push(message),
       onReady: (host) => ready.resolve(host),
       shutdownSignal: new AbortController().signal
     });
@@ -58,6 +60,7 @@ describe('daemon idle shutdown', () => {
       await serving;
       expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
       await expect(host.closed).resolves.toBeUndefined();
+      expect(logs).toEqual([`rushd (PID ${process.pid}) shutting down: idle for ${IDLE_TIMEOUT_SECONDS} s`]);
     } finally {
       await host.closeAsync();
     }
diff --git a/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts b/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts
index 8b67e7e341..05eb8de4de 100644
--- a/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonIdleTimer.test.ts
@@ -59,6 +59,39 @@ describe(DaemonIdleTimer.name, () => {
     expect(onIdle).not.toHaveBeenCalled();
   });
 
+  it('expires as soon as no request runs, also without a configured timeout', () => {
+    const onIdle: jest.Mock = jest.fn();
+    const timer: DaemonIdleTimer = new DaemonIdleTimer(undefined);
+    timer.start(onIdle);
+    timer.expire();
+    expect(onIdle).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(0);
+    expect(onIdle).toHaveBeenCalledTimes(1);
+  });
+
+  it('expires only after the running requests finish, without waiting for the idle timeout', () => {
+    const onIdle: jest.Mock = jest.fn();
+    const timer: DaemonIdleTimer = new DaemonIdleTimer(IDLE_TIMEOUT_SECONDS);
+    timer.start(onIdle);
+    const release: () => void = timer.acquire();
+    timer.expire();
+    jest.advanceTimersByTime(IDLE_TIMEOUT_MS * 2);
+    expect(onIdle).not.toHaveBeenCalled();
+    release();
+    jest.advanceTimersByTime(0);
+    expect(onIdle).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not expire once disposed', () => {
+    const onIdle: jest.Mock = jest.fn();
+    const timer: DaemonIdleTimer = new DaemonIdleTimer(IDLE_TIMEOUT_SECONDS);
+    timer.start(onIdle);
+    timer[Symbol.dispose]();
+    timer.expire();
+    jest.runAllTimers();
+    expect(onIdle).not.toHaveBeenCalled();
+  });
+
   it.each([0, -1, NaN, Infinity, 2147484])('rejects invalid timeout %s', (timeout: number) => {
     expect(() => new DaemonIdleTimer(timeout)).toThrow(RangeError);
   });
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
index ea3c9f482c..b6301178f9 100644
--- a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -43,6 +43,9 @@ const SERVE_A: string =
   "const fs=require('node:fs');fs.appendFileSync('../runs.txt','serve\\n');" +
   "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
   'wait();';
+const INSTALLATION_CHANGED_SHUTDOWN: string =
+  `rushd (PID ${process.pid}) shutting down: its installation changed, ` +
+  'so the next client starts a new daemon';
 
 function queuePositions(
   frames: ReadonlyArray<IDaemonFrame>
@@ -172,7 +175,8 @@ describe('a daemon whose installation changed', () => {
     expect(fixture.runs()).toEqual(['a', 'b']);
     expect(fixture.logs).toEqual([
       `rushd: the installation at ${installation.folder} was removed; exiting once running requests finish, ` +
-        'so that the next client starts a new daemon'
+        'so that the next client starts a new daemon',
+      INSTALLATION_CHANGED_SHUTDOWN
     ]);
   });
 
@@ -216,7 +220,8 @@ describe('a daemon whose installation changed', () => {
     await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
     await fixture.host.closed;
     expect(fixture.runs()).toEqual(['a', 'b']);
-    expect(fixture.logs).toHaveLength(1);
+    expect(fixture.logs).toHaveLength(2);
+    expect(fixture.logs[1]).toBe(INSTALLATION_CHANGED_SHUTDOWN);
   });
 
   it('applies an explicit wait timeout to that wait, and restarts for a later request', async () => {
@@ -422,7 +427,8 @@ describe('a daemon whose installation changed', () => {
     expect(fixture.runs()).toEqual([]);
     expect(fixture.logs).toEqual([
       `rushd: the installation at ${installation.folder} was removed; exiting once running requests finish, ` +
-        'so that the next client starts a new daemon'
+        'so that the next client starts a new daemon',
+      INSTALLATION_CHANGED_SHUTDOWN
     ]);
   });
 
diff --git a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
index 4e8a61ade3..9b253bbd6c 100644
--- a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
@@ -152,8 +152,8 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
   }
 
   it.each<[StopRoute, Reporter, RegExp]>([
-    ['daemon stop', 'callbacks', /^fixture log: rushd \(PID /m],
-    ['SIGTERM', 'default', /^rushd \(PID /m]
+    ['daemon stop', 'callbacks', /^fixture log: rushd \(PID \d+\) stopped at /m],
+    ['SIGTERM', 'default', /^rushd \(PID \d+\) stopped at /m]
   ])(
     'exits 2 s after %s if a timer that it did not start keeps it running, and logs that (%s)',
     async (route: StopRoute, reporter: Reporter, reportLine: RegExp) => {
@@ -168,7 +168,7 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
       expectLingerReport(fixture, stoppedAtMs);
       // A message for the daemon log, through onLog when there is one: not an error, and no stack.
       expect(fixture.getStderr()).toMatch(reportLine);
-      expect(fixture.getStderr().match(/rushd \(PID /g)).toHaveLength(1);
+      expect(fixture.getStderr().match(/kept its process running/g)).toHaveLength(1);
       expect(fixture.getStderr()).not.toMatch(/fixture error: |Error: rushd|^\s+at /m);
       expect(fs.existsSync(paths.socketPath)).toBe(false);
       expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
diff --git a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
index c2c8c91e3d..953b15e05c 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
@@ -8,20 +8,29 @@ import * as path from 'node:path';
 import { createDaemonHello, DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
+import { DaemonShutdownError } from '../DaemonShutdownError';
 import { RushDaemonHost } from '../RushDaemonHost';
+import { serveRushDaemonAsync } from '../serveRushDaemon';
 import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
 import { TestWorkspaceSession } from './TestWorkspaceSession';
 
+const SHUTTING_DOWN: string = `rushd (PID ${process.pid}) shutting down: `;
+
 describe('daemon management shutdown', () => {
   let repoRoot: string;
   let host: RushDaemonHost;
   let client: DaemonRequestWireClient;
+  let logs: string[];
+  let writeLog: (message: string) => void;
 
   beforeEach(async () => {
     repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-shutdown-'));
+    logs = [];
+    writeLog = (message: string) => logs.push(message);
     host = await RushDaemonHost.startAsync({
       createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
       daemonVersion: 'shutdown-test',
+      onLog: (message: string) => writeLog(message),
       repoRoot,
       rushVersion: '5.178.1'
     });
@@ -42,6 +51,9 @@ describe('daemon management shutdown', () => {
     await client.closed;
     await host.closed;
     expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+    expect(logs).toEqual([
+      `${SHUTTING_DOWN}requested by a client ("rush-client daemon stop" or "daemon restart")`
+    ]);
   });
 
   it('requires a handshake before a client can stop the daemon', async () => {
@@ -49,6 +61,49 @@ describe('daemon management shutdown', () => {
     expect((await client.readControlAsync()).kind).toBe('error');
     await client.closed;
     expect(readDaemonLockfile(host.paths.lockfilePath)).toBeDefined();
+    expect(logs).toEqual([]);
+  });
+
+  it('logs only the first reason when it is closed more than once', async () => {
+    await Promise.all([
+      host.closeAsync(new DaemonShutdownError({ initiator: 'signal', signal: 'SIGINT' })),
+      host.closeAsync()
+    ]);
+    await host.closeAsync(new DaemonShutdownError({ initiator: 'idleTimeout' }));
+    expect(logs).toEqual([`${SHUTTING_DOWN}received SIGINT`]);
+  });
+
+  it('logs a close without a reason', async () => {
+    await host.closeAsync();
+    expect(logs).toEqual([`${SHUTTING_DOWN}the daemon host was closed`]);
+  });
+
+  it('still shuts down when its onLog callback throws', async () => {
+    writeLog = () => {
+      throw new Error('The log callback failed.');
+    };
+    await host.closeAsync(new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' }));
+    expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+  });
+
+  it('logs the signal that stopped a served daemon', async () => {
+    const servedRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-shutdown-served-'));
+    const served: string[] = [];
+    const controller: AbortController = new AbortController();
+    try {
+      await serveRushDaemonAsync({
+        createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(servedRoot)),
+        daemonVersion: 'shutdown-test',
+        onLog: (message: string) => served.push(message),
+        onReady: () => controller.abort(new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })),
+        repoRoot: servedRoot,
+        rushVersion: '5.178.1',
+        shutdownSignal: controller.signal
+      });
+    } finally {
+      fs.rmSync(servedRoot, { force: true, recursive: true });
+    }
+    expect(served).toEqual([`${SHUTTING_DOWN}received SIGTERM`]);
   });
 
   it('does not accept lifecycle controls from an older negotiated minor', async () => {
diff --git a/libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts b/libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts
new file mode 100644
index 0000000000..6a184ce219
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonSocketLoss.test.ts
@@ -0,0 +1,171 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+
+import type { DaemonShutdownError } from '../DaemonShutdownError';
+import { DAEMON_SOCKET_CHECK_INTERVAL_MS } from '../DaemonSocketWatch';
+import type { GlobalCommandExecutor } from '../GlobalCommandRequestRouter';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { serveRushDaemonAsync } from '../serveRushDaemon';
+import {
+  CallbackDaemonRequestResolver,
+  createDeferred,
+  createWireEnvelope,
+  DaemonRequestWireClient
+} from './DaemonRequestWireTestUtilities';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+// A named pipe has no file identity, and it can't be deleted while its server runs.
+const posixDescribe: jest.Describe = process.platform === 'win32' ? describe.skip : describe;
+const SUCCESSOR: string = 'a successor';
+
+posixDescribe('daemon whose socket was deleted or replaced', () => {
+  let repoRoot: string;
+  let logs: string[];
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-socket-loss-'));
+    logs = [];
+    jest.useFakeTimers({ doNotFake: ['nextTick', 'setImmediate'] });
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  // The first check finds the change. Fake timers delay a zero-delay timeout set by a timer by 1 ms, so the idle
+  // timer's expiry fires only when the clock advances again.
+  async function advancePastSocketLossAsync(): Promise<void> {
+    await jest.advanceTimersByTimeAsync(DAEMON_SOCKET_CHECK_INTERVAL_MS);
+    expect(logs).toHaveLength(1);
+    await jest.advanceTimersByTimeAsync(1);
+  }
+
+  // No idle timeout, so only the lost socket can end the daemon.
+  function createOptions(): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+      daemonVersion: 'socket-loss-test',
+      onLog: (message: string) => logs.push(message),
+      repoRoot,
+      rushVersion: '5.178.1'
+    };
+  }
+
+  it('stops serving once idle after its socket was deleted, and removes its lockfile', async () => {
+    const ready = createDeferred<RushDaemonHost>();
+    const serving: Promise<void> = serveRushDaemonAsync({
+      ...createOptions(),
+      onReady: (startedHost: RushDaemonHost) => ready.resolve(startedHost),
+      shutdownSignal: new AbortController().signal
+    });
+    const host: RushDaemonHost = await ready.promise;
+    const closeSpy: jest.SpyInstance = jest.spyOn(host, 'closeAsync');
+    try {
+      fs.rmSync(host.paths.socketPath);
+      await advancePastSocketLossAsync();
+      await serving;
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+      expect(logs).toEqual([
+        `rushd: the socket ${host.paths.socketPath} was removed, so no client can connect to this daemon; ` +
+          'exiting once running requests finish, so that the next client starts a new daemon',
+        `rushd (PID ${process.pid}) shutting down: its socket file was deleted or replaced, so the next client ` +
+          'starts a new daemon'
+      ]);
+      const reason: DaemonShutdownError | undefined = closeSpy.mock.calls[0][0];
+      expect(reason?.initiator).toBe('socketLost');
+      expect(reason?.message).toContain('(its socket file was deleted or replaced, so no new client could');
+    } finally {
+      await host.closeAsync();
+    }
+  });
+
+  it('closes once idle after another file took its socket name, and leaves that file', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    try {
+      fs.rmSync(host.paths.socketPath);
+      fs.writeFileSync(host.paths.socketPath, SUCCESSOR);
+      await advancePastSocketLossAsync();
+      await host.closed;
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+      expect(fs.readFileSync(host.paths.socketPath, 'utf8')).toBe(SUCCESSOR);
+      expect(logs).toEqual([
+        expect.stringContaining(' was replaced, so no client can connect'),
+        expect.stringContaining(' shutting down: its socket file was deleted or replaced')
+      ]);
+    } finally {
+      await host.closeAsync();
+      fs.rmSync(host.paths.socketPath, { force: true });
+    }
+  });
+
+  it('finishes a running request before it closes', async () => {
+    const executing = createDeferred<void>();
+    const executed = createDeferred<void>();
+    const executorAsync: GlobalCommandExecutor = async () => {
+      executing.resolve();
+      await executed.promise;
+      return { exitCode: 0 };
+    };
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      ...createOptions(),
+      requestResolver: new CallbackDaemonRequestResolver(async () => ({
+        kind: 'global',
+        executor: executorAsync
+      }))
+    });
+    let closed: boolean = false;
+    void host.closed.then(() => (closed = true));
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    try {
+      await client.handshakeAsync();
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('running', 'custom', repoRoot)
+      });
+      await executing.promise;
+      fs.rmSync(host.paths.socketPath);
+      await jest.advanceTimersByTimeAsync(DAEMON_SOCKET_CHECK_INTERVAL_MS * 3);
+      expect(logs).toHaveLength(1);
+      expect(closed).toBe(false);
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+      executed.resolve();
+      expect((await client.readTerminalAsync('running')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      await jest.advanceTimersByTimeAsync(0);
+      await host.closed;
+      expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+    } finally {
+      executed.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('keeps serving while its socket has its name, and stops checking when it closes', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    try {
+      await jest.advanceTimersByTimeAsync(DAEMON_SOCKET_CHECK_INTERVAL_MS * 3);
+      const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(
+        host.paths.socketPath
+      );
+      await client.handshakeAsync();
+      await client.closeAsync();
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+      expect(logs).toEqual([]);
+    } finally {
+      await host.closeAsync();
+    }
+    expect(jest.getTimerCount()).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts b/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
new file mode 100644
index 0000000000..ab0a471ec8
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonFileChange } from '@rushstack/rush-daemon-transport';
+
+import { DAEMON_SOCKET_CHECK_INTERVAL_MS, DaemonSocketWatch } from '../DaemonSocketWatch';
+
+describe(DaemonSocketWatch.name, () => {
+  beforeEach(() => jest.useFakeTimers());
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  it('checks the socket at each interval and reports only the first change', () => {
+    const results: (DaemonFileChange | undefined)[] = [undefined, 'removed', 'replaced'];
+    const checkSocket: jest.Mock = jest.fn(() => results.shift());
+    const onChanged: jest.Mock = jest.fn();
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(checkSocket, onChanged);
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS - 1);
+    expect(checkSocket).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checkSocket).toHaveBeenCalledTimes(1);
+    expect(onChanged).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS);
+    expect(onChanged).toHaveBeenCalledWith('removed');
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS * 3);
+    expect(checkSocket).toHaveBeenCalledTimes(2);
+    expect(onChanged).toHaveBeenCalledTimes(1);
+    expect(jest.getTimerCount()).toBe(0);
+    watch[Symbol.dispose]();
+  });
+
+  it('stops checking once disposed', () => {
+    const checkSocket: jest.Mock = jest.fn(() => undefined);
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(checkSocket, jest.fn());
+    watch[Symbol.dispose]();
+    jest.advanceTimersByTime(DAEMON_SOCKET_CHECK_INTERVAL_MS * 2);
+    expect(checkSocket).not.toHaveBeenCalled();
+    expect(jest.getTimerCount()).toBe(0);
+  });
+
+  it('does not keep the process running', () => {
+    jest.useRealTimers();
+    const setIntervalSpy: jest.SpyInstance = jest.spyOn(global, 'setInterval');
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(() => undefined, jest.fn());
+    try {
+      const timer: NodeJS.Timeout = setIntervalSpy.mock.results[0].value;
+      expect(timer.hasRef()).toBe(false);
+    } finally {
+      watch[Symbol.dispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts b/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
index 4fab1f44a4..faf69f9bb6 100644
--- a/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
+++ b/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
@@ -14,8 +14,9 @@ import {
   resolveRushDaemonWorkspace,
   type IRushDaemonWorkspace
 } from '../RushDaemonCommandLine';
-import { serveRushDaemonAsync } from '../serveRushDaemon';
+import { serveRushDaemonAsync, type IRushDaemonServeOptions } from '../serveRushDaemon';
 import { RushDaemonRequestResolver } from '../RushDaemonRequestResolver';
+import type { RushDaemonHost } from '../RushDaemonHost';
 
 describe(resolveRushDaemonWorkspace.name, () => {
   let tempFolder: string;
@@ -70,4 +71,24 @@ describe(resolveRushDaemonWorkspace.name, () => {
       })
     );
   });
+
+  it('writes the time and the process ID on the ready line', async () => {
+    await writeFile(path.join(tempFolder, 'rush.json'), JSON.stringify({ rushVersion: Rush.version }));
+    await launchRushDaemonAsync(tempFolder);
+    const options: IRushDaemonServeOptions = jest.mocked(serveRushDaemonAsync).mock.calls.at(-1)![0];
+    const write: jest.SpyInstance = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    try {
+      await options.onReady!({ paths: { socketPath: '/tmp/rushd-test.sock' } } as RushDaemonHost);
+      const isoTime: string = '\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z';
+      expect(write.mock.calls).toEqual([
+        [
+          expect.stringMatching(
+            new RegExp(`^${isoTime} rushd ready at /tmp/rushd-test\\.sock \\(PID ${process.pid}\\)\\n$`)
+          )
+        ]
+      ]);
+    } finally {
+      write.mockRestore();
+    }
+  });
 });
diff --git a/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts b/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts
index 9bd6cd151a..6e45833946 100644
--- a/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts
+++ b/libraries/rush-daemon/src/test/SuccessfulNativeMutation.test.ts
@@ -4,6 +4,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { Rush } from '@microsoft/rush-lib';
 import { DaemonClient } from '@rushstack/rush-client-core';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
@@ -132,7 +133,12 @@ describe('successful native install/update', () => {
         } finally {
           await ready.closeAsync();
         }
-        expect(await fixture.waitForInitialExitAsync()).toMatchObject({ exitCode: 0 });
+        const initialExit: ISuccessfulMutationOutput = await fixture.waitForInitialExitAsync();
+        expect(initialExit).toMatchObject({ exitCode: 0 });
+        expect(initialExit.stderr.match(/shutting down: .*/g)).toEqual([
+          `shutting down: restarting for Rush ${Rush.version} after "rush install" or "rush update"`
+        ]);
+        expect(initialExit.stderr).toContain(`rushd (PID ${initialPid}) shutting down: `);
         expect(fs.readFileSync(path.join(fixture.controlFolder, 'events.txt'), 'utf8')).toBe(
           `postinstall:${commandName}\nresult-received\nold-resources-disposed\nsuccessor-process-started\n`
         );
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
index ade38105f6..43c9d87866 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
@@ -5,7 +5,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import { Rush, WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 import { DaemonFrameType, decodeDaemonControlMessage } from '@rushstack/rush-daemon-protocol';
 import type { DaemonControlMessage, IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
@@ -84,6 +84,11 @@ it('queues a mismatched-environment restart until matching queued and in-flight
     expect(restarted?.pid).not.toBe(before.pid);
     expect((await pongAsync(fixture)).pid).toBe(restarted?.pid);
     expect(fixture.runs()).not.toContain('b');
+    // The shutdown line only: the daemon may log other lines about the restart before it.
+    expect(fixture.logs.filter((line: string) => line.includes(' shutting down: '))).toEqual([
+      `rushd (PID ${process.pid}) shutting down: restarting for Rush ${Rush.version}, ` +
+        'because a request needs a new process'
+    ]);
   } finally {
     fs.rmSync(path.join(fixture.folder, 'hold'), { force: true });
     try {
diff --git a/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts b/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts
index a74d5eea60..52137a67ba 100644
--- a/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts
+++ b/libraries/rush-daemon/src/test/fixtures/SuccessfulMutationDaemon.ts
@@ -70,7 +70,8 @@ async function runAsync(): Promise<void> {
       fs.writeFileSync(`${filename}.tmp`, JSON.stringify({ paths: host.paths, pid: process.pid }));
       fs.renameSync(`${filename}.tmp`, filename);
     },
-    onError: (error) => process.stderr.write(`${error.stack ?? error.message}\n`)
+    onError: (error) => process.stderr.write(`${error.stack ?? error.message}\n`),
+    onLog: (message) => process.stderr.write(`${message}\n`)
   });
 }
 

From 2f7679e3635d3d852c0a8a92a6218e4d0f776d73 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 086/265] [rush-client-core] Daemon stop during a startup, and
 daemon status with no daemon

Swarm integration step 71; original commit a9ba6807cf (merge of swarm/o04-t150-x133 at 2821ea5c98).
Scope: tasks 133 and 150.

Brings o04's tasks 133 and 150, re-tipped on s16 batch B (board 3127). 133: a plain `daemon stop` during a startup either stops the daemon (rc 0, shutdownAccepted) or exits rc 1 with a line saying it didn't, instead of notRunning rc 0 while the daemon comes up anyway. 150: `rush-client daemon status` says that no daemon is running instead of "Could not connect to daemon at <sock>". Second agent: t05 CONFIRMED 133 board 2489 and 150 board 2651.

s17 batch D3, item 3 of 8. Gate: ch01 GATE OK board 3747 (tree d37576d243)

Commits folded into this step (4):
- f60c3e5721 [rush-client-core] Add connectToStartingDaemonAsync() for callers that must not leave a daemon running
- eefafdf4e2 [rush-cli-client] Make daemon stop wait for a daemon that is still starting, and stop it
- 421c66682b [rush-client-core] Fail at once when a started daemon exits before its starting client connects
- 2ff5bfdd53 [rush-cli-client] Say that no daemon is running when daemon status finds none

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  15 +-
 apps/rush-cli-client/src/daemonCommands.ts    |  86 ++++++-
 apps/rush-cli-client/src/launchClient.ts      |   1 +
 .../src/test/launchClient.test.ts             | 220 +++++++++++++++---
 .../status-no-daemon_2026-09-28-23-45.json    |  11 +
 .../stop-while-starting_2026-09-28-21-51.json |  11 +
 .../stop-while-starting_2026-09-28-21-51.json |  16 ++
 common/reviews/api/rush-client-core.api.md    |   3 +
 libraries/rush-client-core/README.md          |  13 +-
 libraries/rush-client-core/src/StartupLock.ts |  31 ++-
 .../src/connectOrAwaitDaemonStartup.ts        |  49 +++-
 .../src/connectOrStartDaemon.ts               |  20 +-
 libraries/rush-client-core/src/index.ts       |   1 +
 .../src/test/StartupLock.test.ts              |  33 ++-
 .../test/connectOrAwaitDaemonStartup.test.ts  | 121 +++++++++-
 .../src/test/connectOrStartDaemon.test.ts     |  24 ++
 .../src/test/fixtures/daemon.ts               |   8 +-
 17 files changed, 616 insertions(+), 47 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/status-no-daemon_2026-09-28-23-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/stop-while-starting_2026-09-28-21-51.json
 create mode 100644 common/changes/@rushstack/rush-client-core/stop-while-starting_2026-09-28-21-51.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 5255400fc7..87dfd0c47d 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -438,7 +438,14 @@ commands print one JSON object with `state: "ready"`, `socketPath`, and the actu
 pong fields (`uptimeMs`, available versions, optional `pid` and
 `residentMemoryBytes`, and an optional `workspace` snapshot). Exit code 0 means protocol
 readiness, not build support. An unreachable/incompatible endpoint, invalid
-arguments, or startup failure returns exit code 1 with a diagnostic. When the endpoint
+arguments, or startup failure returns exit code 1 with a diagnostic. When no daemon runs
+at all, status also exits 1, and its diagnostic says `No daemon is running for <repository>
+(Rush <version>)` and what the next command does: with `enabled` and `autoStart`, the next
+rush-client command that uses the daemon starts one; otherwise rush-client commands run Rush
+in-process. This is the normal state after `daemon stop`, the idle timeout or SIGTERM. Status
+reports it only when the endpoint refuses connections and neither an ownership record, a startup
+reservation nor (outside Windows) a socket file remains; with any of these, the diagnostic
+still says that it could not connect. When the endpoint
 refuses connections and its ownership record (`<key>.pid.json`) names a PID that no longer
 exists, the diagnostic adds that rushd exited without shutting down (an orderly shutdown
 removes the record) and that `daemon logs` may show why.
@@ -484,7 +491,11 @@ attests a restart request, not completion of successor startup or success of a c
 `rush-client daemon stop` requires protocol >= 0.6 and waits for `shutdownAck`
 followed by EOF. It reports `state: "shutdownAccepted"` with exit code 0; this
 does not assert successful workspace disposal. Stop is idempotent: when nothing
-listens at the endpoint it reports `state: "notRunning"` with exit code 0. An
+listens at the endpoint and no daemon is starting, it reports `state: "notRunning"` with exit code 0.
+While a daemon is still starting (its startup helper still runs, or another client holds the start
+mutex), stop says so on stderr and waits up to 15 seconds for that daemon to become ready, then stops
+it as below; reporting `notRunning` would leave it running afterwards. If it is still not ready by then,
+stop exits with code 1 and leaves it running; run stop again once `daemon status` reports it ready. An
 unsupported protocol, missing acknowledgement, handshake failure, or timeout
 returns exit code 1. It does not auto-start anything. Before shutdown, it removes a startup
 reservation that remains next to that daemon, as restart does, so that the reservation cannot
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index a81d671168..a56e123607 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -1,11 +1,14 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import {
   DaemonClient,
+  DaemonStartupPendingError,
   connectOrStartDaemonAsync,
+  connectToStartingDaemonAsync,
   inspectDaemonStartupReservation,
   requestDaemonShutdownAsync,
   resetDaemonArtifactsAsync,
@@ -36,6 +39,8 @@ export interface IDaemonCommandOptions {
   readonly rushJsonPath?: string;
   readonly rushVersion: string;
   readonly admission?: IDaemonRequestAdmissionOptions;
+  /** The resolved daemon settings. When no daemon runs, status uses them to say what the next command does. */
+  readonly daemonConfiguration?: { readonly enabled: boolean; readonly autoStart: boolean };
 }
 
 export async function executeDaemonCommandAsync(options: IDaemonCommandOptions): Promise<void> {
@@ -96,7 +101,11 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   const client: DaemonClient | undefined =
     command === 'start'
       ? await connectOrStartDaemonAsync(connectionOptions)
-      : await connectExistingAsync(connectionOptions, command !== 'status');
+      : command === 'stop' && options.argv[1] !== '--force'
+        ? await connectForStopAsync(connectionOptions)
+        : command === 'status'
+          ? await connectForStatusAsync(connectionOptions, options)
+          : await connectExistingAsync(connectionOptions, true);
   if (!client) {
     if (command === 'restart') {
       // Nothing to shut down: restart behaves like start.
@@ -172,6 +181,31 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
 }
 
+/**
+ * Connects to the daemon that stop shuts down. When nothing listens yet but a daemon is still starting, stop
+ * waits for it to become ready and then stops it: reporting notRunning would leave it running afterwards.
+ */
+async function connectForStopAsync(options: IConnectOrStartDaemonOptions): Promise<DaemonClient | undefined> {
+  const client: DaemonClient | undefined = await connectExistingAsync(options, true);
+  if (client) return client;
+  try {
+    return await connectToStartingDaemonAsync({
+      ...options,
+      onAwaitStartup: (owner: string, waitMs: number): void => {
+        process.stderr.write(
+          `rush-client: The daemon is not ready yet. ${owner}, so stop waits up to ` +
+            `${Math.round(waitMs / 1000)} s for it to become ready and then stops it.\n`
+        );
+      }
+    });
+  } catch (error) {
+    if (!(error instanceof DaemonStartupPendingError)) throw error;
+    throw new Error(
+      `${error.message} It was not stopped; run "rush-client daemon stop" again once "rush-client daemon status" reports it ready.`
+    );
+  }
+}
+
 /** Returns undefined when nothing listens at the endpoint and `allowAbsent` is set; other failures propagate. */
 async function connectExistingAsync(
   options: IConnectOrStartDaemonOptions,
@@ -191,6 +225,56 @@ async function connectExistingAsync(
   }
 }
 
+/**
+ * Connects for `daemon status`. When nothing listens and nothing is left at the endpoint, which is the state
+ * after `daemon stop`, the idle timeout or a signal, it fails with a diagnostic that says so instead of the
+ * transport's refused connection.
+ */
+async function connectForStatusAsync(
+  connectionOptions: IConnectOrStartDaemonOptions,
+  options: IDaemonCommandOptions
+): Promise<DaemonClient> {
+  const { paths } = connectionOptions;
+  try {
+    return await DaemonClient.connectAsync({ socketPath: paths.socketPath });
+  } catch (error) {
+    if (
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.connectionRefused &&
+      isEndpointAbsent(paths)
+    ) {
+      throw new DaemonTransportError(error.code, describeAbsentDaemon(options));
+    }
+    throw explainStartupReservation(explainExitedDaemon(error, paths), paths);
+  }
+}
+
+/**
+ * An orderly shutdown removes the ownership record and the socket, and a starting daemon has a startup
+ * reservation. A refused connection with none of them therefore means that no daemon runs or is starting.
+ * Windows names a pipe, which leaves no file behind.
+ */
+function isEndpointAbsent(paths: IDaemonPaths): boolean {
+  return (
+    !fs.existsSync(paths.lockfilePath) &&
+    !inspectDaemonStartupReservation(paths) &&
+    (process.platform === 'win32' || !fs.existsSync(paths.socketPath))
+  );
+}
+
+function describeAbsentDaemon(options: IDaemonCommandOptions): string {
+  const repoRoot: string = path.dirname(options.rushJsonPath!);
+  const absent: string = `No daemon is running for ${repoRoot} (Rush ${options.rushVersion})`;
+  const configuration: IDaemonCommandOptions['daemonConfiguration'] = options.daemonConfiguration;
+  if (!configuration) return `${absent}.`;
+  if (!configuration.enabled) {
+    return `${absent}; the daemon is not enabled here, so rush-client commands run Rush in-process.`;
+  }
+  return configuration.autoStart
+    ? `${absent}; the next rush-client command that uses the daemon starts one.`
+    : `${absent}, and auto-start is off, so rush-client commands run Rush in-process until "rush-client daemon start" starts one.`;
+}
+
 /**
  * Explains a refused connection whose ownership record names a daemon that no longer runs. An orderly
  * shutdown removes the record, so that daemon exited without shutting down, for example after a crash.
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 485d03ccad..3a3d644895 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -87,6 +87,7 @@ export async function launchClientAsync(
       environment,
       rushJsonPath,
       rushVersion: selectedVersion,
+      daemonConfiguration: { enabled: config.enabled, autoStart: config.autoStart },
       admission:
         route.argv[1] === 'graph'
           ? (route.admission ?? { waitTimeoutMs: Math.floor(config.queueTimeoutSeconds * 1000) })
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index a42e035a83..78b3d92ef5 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -35,6 +35,12 @@ interface IInvocationResult {
   readonly stderr: string;
 }
 
+// What `daemon status` adds when no daemon runs, for each resolved daemon.enabled and daemon.autoStart.
+const NEXT_COMMAND_STARTS: string = '; the next rush-client command that uses the daemon starts one.';
+const AUTO_START_OFF: string =
+  ', and auto-start is off, so rush-client commands run Rush in-process until "rush-client daemon start" starts one.';
+const NOT_ENABLED: string = '; the daemon is not enabled here, so rush-client commands run Rush in-process.';
+
 describe('standalone rushx fallback', () => {
   let folder: string;
   let project: string;
@@ -92,7 +98,8 @@ describe('standalone rushx fallback', () => {
     optIn: boolean,
     fakeTty: boolean = false,
     managementArgs?: ReadonlyArray<string>,
-    environmentOverrides: NodeJS.ProcessEnv = {}
+    environmentOverrides: NodeJS.ProcessEnv = {},
+    onStderr?: (stderr: string) => void
   ): Promise<IInvocationResult> {
     const invocationDaemonPids: Set<number> = daemonPids;
     const entry: string = client
@@ -124,6 +131,7 @@ describe('standalone rushx fallback', () => {
     });
     child.stderr!.on('data', (chunk: Buffer) => {
       stderr += chunk.toString();
+      onStderr?.(stderr);
     });
     const closed: Promise<unknown[]> = once(child, 'close');
     invocationClosures.push(closed);
@@ -142,6 +150,14 @@ describe('standalone rushx fallback', () => {
     return { code: typeof code === 'number' ? code : undefined, stdout, stderr };
   }
 
+  /** The client names the repository by the path it found; that spelling of the temporary folder varies by platform. */
+  function expectNoDaemonRunning(result: IInvocationResult, next: string): void {
+    expect(result).toMatchObject({ code: 1, stdout: '' });
+    expect(result.stderr).toMatch(/^rush-client: No daemon is running for /);
+    expect(result.stderr).toContain(`${path.sep}${path.basename(folder)} (Rush ${Rush.version})${next}\n`);
+    expect(result.stderr.split('\n')).toHaveLength(2);
+  }
+
   it('preserves native project-script output and exit code for --no-daemon', async () => {
     const native: IInvocationResult = await invokeAsync(false, false);
     expect(native.code).toBe(7);
@@ -210,10 +226,14 @@ describe('standalone rushx fallback', () => {
 
   it('status never starts an absent daemon or falls back to command execution', async () => {
     const result: IInvocationResult = await invokeAsync(true, true, false, ['daemon', 'status']);
-    expect(result.code).toBe(1);
-    expect(result.stdout).toBe('');
-    expect(result.stderr).toContain('Could not connect to daemon');
+    expectNoDaemonRunning(result, AUTO_START_OFF);
     expect(result.stderr).not.toContain('using in-process');
+    // What the next command does follows the resolved settings.
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+      NEXT_COMMAND_STARTS
+    );
+    expectNoDaemonRunning(await invokeAsync(true, false, false, ['daemon', 'status']), NOT_ENABLED);
     const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
     expect(fs.existsSync(paths.lockfilePath)).toBe(false);
   });
@@ -241,7 +261,7 @@ describe('standalone rushx fallback', () => {
       expect(fs.existsSync(paths.lockfilePath)).toBe(false);
     }
     const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
-    expect(stopped.code).toBe(1);
+    expectNoDaemonRunning(stopped, NOT_ENABLED);
     const log: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'logs']);
     expect(log.code).toBe(0);
     const isoTime: string = '\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z';
@@ -254,6 +274,58 @@ describe('standalone rushx fallback', () => {
     );
   }, 15000);
 
+  it('status says that no daemon is running after daemon stop and after SIGTERM', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    try {
+      for (const stopWith of ['daemon stop', 'SIGTERM']) {
+        const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+        expect(started.code).toBe(0);
+        const { pid }: { pid: number } = JSON.parse(started.stdout);
+        expect(pid).not.toBe(process.pid);
+        if (stopWith === 'SIGTERM') {
+          // The daemon that this test just started shuts down in order on SIGTERM.
+          process.kill(pid, 'SIGTERM');
+        } else {
+          expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+        }
+        await waitForTestProcessExitAsync(pid);
+        expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+        expectNoDaemonRunning(
+          await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+          NEXT_COMMAND_STARTS
+        );
+      }
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+    }
+  }, 30000);
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'status keeps the refused-connection diagnostic for a socket that remains without its daemon',
+    async () => {
+      const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+      fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+      const listener: ChildProcess = spawn(
+        process.execPath,
+        [
+          '-e',
+          `require('net').createServer().listen(${JSON.stringify(paths.socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+        ],
+        { stdio: 'ignore' }
+      );
+      await once(listener, 'close');
+      try {
+        expect(fs.existsSync(paths.socketPath)).toBe(true);
+        const status: IInvocationResult = await invokeAsync(true, true, false, ['daemon', 'status']);
+        expect(status).toMatchObject({ code: 1, stdout: '' });
+        expect(status.stderr).toBe(`rush-client: Could not connect to daemon at ${paths.socketPath}.\n`);
+      } finally {
+        fs.rmSync(paths.socketPath, { force: true });
+      }
+    }
+  );
+
   it('reads a saved launcher log without connecting or auto-starting', async () => {
     fs.mkdirSync(path.dirname(logFilePath), { recursive: true, mode: 0o700 });
     const contents: string = `${'startup output\n'.repeat(20000)}startup error\n`;
@@ -405,11 +477,15 @@ describe('standalone rushx fallback', () => {
       const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
       const reservation: string = `${paths.lockfilePath}.starting`;
       fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
-      let helperPid: number = process.pid;
+      // A startup helper that runs until its stdin ends, without ever starting a daemon.
+      const helper: ChildProcess = spawn(process.execPath, ['-e', 'process.stdin.resume()'], {
+        stdio: ['pipe', 'ignore', 'ignore']
+      });
+      const helperClosed: Promise<unknown[]> = once(helper, 'close');
+      const helperPid: number = helper.pid!;
       if (helperState === 'exited') {
-        const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
-        await once(exited, 'close');
-        helperPid = exited.pid!;
+        helper.stdin!.end();
+        await helperClosed;
       }
       const helperStartedAt: Date = new Date();
       fs.writeFileSync(
@@ -417,35 +493,113 @@ describe('standalone rushx fallback', () => {
         JSON.stringify({ token: 'fixture', helperPid, helperStartedAt: helperStartedAt.toISOString() })
       );
       const relaunchAfter: string = new Date(helperStartedAt.getTime() + 15000).toISOString();
-      const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
-      expect(status).toMatchObject({ code: 1, stdout: '' });
-      expect(status.stderr).toContain('Could not connect to daemon');
-      expect(status.stderr).toContain(
-        helperState === 'exited'
-          ? `its startup helper (PID ${helperPid}) exited before the daemon became ready. A command that starts the daemon after ${relaunchAfter} takes the reservation over and launches the daemon again, provided that nothing listens at ${paths.socketPath} then. "rush-client daemon logs" may show why the daemon did not become ready.`
-          : `A daemon is starting: its startup helper (PID ${helperPid}) is still waiting for it to become ready; retry shortly.`
-      );
-      const stopped: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop']);
-      expect(stopped).toMatchObject({ code: 0, stderr: '' });
-      expect(JSON.parse(stopped.stdout)).toEqual({
-        state: 'notRunning',
-        socketPath: paths.socketPath,
-        startupReservation: {
-          path: reservation,
-          helperPid,
-          helperState,
-          ...(helperState === 'exited' ? { relaunchAfter } : {})
+      try {
+        const status: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'status']);
+        expect(status).toMatchObject({ code: 1, stdout: '' });
+        expect(status.stderr).toContain('Could not connect to daemon');
+        expect(status.stderr).toContain(
+          helperState === 'exited'
+            ? `its startup helper (PID ${helperPid}) exited before the daemon became ready. A command that starts the daemon after ${relaunchAfter} takes the reservation over and launches the daemon again, provided that nothing listens at ${paths.socketPath} then. "rush-client daemon logs" may show why the daemon did not become ready.`
+            : `A daemon is starting: its startup helper (PID ${helperPid}) is still waiting for it to become ready; retry shortly.`
+        );
+        let onStopWaits: () => void = () => undefined;
+        const stopWaits: Promise<void> = new Promise((resolve) => (onStopWaits = resolve));
+        const stopping: Promise<IInvocationResult> = invokeAsync(
+          true,
+          false,
+          false,
+          ['daemon', 'stop'],
+          {},
+          (stderr: string) => {
+            if (stderr.includes('stop waits up to')) onStopWaits();
+          }
+        );
+        if (helperState === 'running') {
+          // Stop waits while the helper runs, and reports the reservation once the helper exits without a daemon.
+          await Promise.race([stopWaits, stopping]);
+          helper.stdin!.end();
+          await helperClosed;
         }
+        const stopped: IInvocationResult = await stopping;
+        expect(stopped.code).toBe(0);
+        expect(stopped.stderr).toEqual(
+          helperState === 'exited'
+            ? ''
+            : expect.stringMatching(
+                new RegExp(
+                  `^rush-client: The daemon is not ready yet\\. Its startup helper \\(PID ${helperPid}\\) is still waiting for the daemon, so stop waits up to \\d+ s for it to become ready and then stops it\\.\\n$`
+                )
+              )
+        );
+        expect(JSON.parse(stopped.stdout)).toEqual({
+          state: 'notRunning',
+          socketPath: paths.socketPath,
+          startupReservation: { path: reservation, helperPid, helperState: 'exited', relaunchAfter }
+        });
+        const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+        expect(reset).toMatchObject({ code: 0, stderr: '' });
+        expect(JSON.parse(reset.stdout)).toEqual({
+          state: 'reset',
+          socketPath: paths.socketPath,
+          removedPaths: [reservation]
+        });
+      } finally {
+        if (!helper.stdin!.writableEnded) helper.stdin!.end();
+        await helperClosed;
+      }
+    },
+    30000
+  );
+
+  it('stop waits for a daemon that is still starting and then stops it', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    const reservation: string = `${paths.lockfilePath}.starting`;
+    fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+    // This process stands in for the startup helper: it starts the daemon below while stop waits.
+    fs.writeFileSync(
+      reservation,
+      JSON.stringify({ token: 'fixture', helperPid: process.pid, helperStartedAt: new Date().toISOString() })
+    );
+    try {
+      let onStopWaits: () => void = () => undefined;
+      const stopWaits: Promise<void> = new Promise((resolve) => (onStopWaits = resolve));
+      const stopping: Promise<IInvocationResult> = invokeAsync(
+        true,
+        false,
+        false,
+        ['daemon', 'stop'],
+        {},
+        (stderr: string) => {
+          if (stderr.includes('stop waits up to')) onStopWaits();
+        }
+      );
+      await Promise.race([stopWaits, stopping]);
+      const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+      host = await RushDaemonHost.startAsync({
+        repoRoot: folder,
+        rushVersion: Rush.version,
+        daemonVersion: daemonPackage.version
       });
-      const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
-      expect(reset).toMatchObject({ code: 0, stderr: '' });
-      expect(JSON.parse(reset.stdout)).toEqual({
-        state: 'reset',
+      const stopped: IInvocationResult = await stopping;
+      expect(stopped.code).toBe(0);
+      expect(stopped.stderr).toMatch(
+        new RegExp(
+          `^rush-client: The daemon is not ready yet\\. Its startup helper \\(PID ${process.pid}\\) is still waiting for the daemon, so stop waits up to \\d+ s for it to become ready and then stops it\\.\\n$`
+        )
+      );
+      // Stop resolved the reservation next to the ready daemon before it shut that daemon down.
+      expect(JSON.parse(stopped.stdout)).toEqual({
+        state: 'shutdownAccepted',
         socketPath: paths.socketPath,
-        removedPaths: [reservation]
+        cancelledRequests: 0
       });
+      expect(fs.existsSync(reservation)).toBe(false);
+    } finally {
+      const deadline: number = Date.now() + 7000;
+      while (fs.existsSync(paths.lockfilePath) && Date.now() < deadline) await delayAsync(50);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
     }
-  );
+  }, 30000);
 
   it('status names a recorded daemon that exited without shutting down', async () => {
     const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
diff --git a/common/changes/@rushstack/rush-cli-client/status-no-daemon_2026-09-28-23-45.json b/common/changes/@rushstack/rush-cli-client/status-no-daemon_2026-09-28-23-45.json
new file mode 100644
index 0000000000..6f3b571e10
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/status-no-daemon_2026-09-28-23-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When no daemon runs, `rush-client daemon status` now says `No daemon is running for <repository> (Rush <version>)` and what the next command does, instead of only `Could not connect to daemon at <socket>.`. It still exits with code 1. A socket, ownership record or startup reservation that remains keeps the previous diagnostic.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/stop-while-starting_2026-09-28-21-51.json b/common/changes/@rushstack/rush-cli-client/stop-while-starting_2026-09-28-21-51.json
new file mode 100644
index 0000000000..fdb4085820
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/stop-while-starting_2026-09-28-21-51.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "`rush-client daemon stop` no longer reports `notRunning` while a daemon is still starting and then leaves it running: it says so on stderr, waits up to 15 seconds for that daemon to become ready, and stops it. If the daemon is still not ready, stop fails with exit code 1 and says that it was not stopped.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/stop-while-starting_2026-09-28-21-51.json b/common/changes/@rushstack/rush-client-core/stop-while-starting_2026-09-28-21-51.json
new file mode 100644
index 0000000000..505cc16f67
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/stop-while-starting_2026-09-28-21-51.json
@@ -0,0 +1,16 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `connectToStartingDaemonAsync()` for a caller that must not leave a daemon running, such as `rush-client daemon stop`: it connects without starting anything, and while a listener, a running startup helper, or another starting client can still make a daemon ready at the endpoint, it waits up to one startup deadline for that daemon instead of concluding from one refused connection that none runs. It rejects with `DaemonStartupPendingError` if the daemon is still starting at the deadline.",
+      "type": "patch"
+    },
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A client that starts a daemon now fails at once, instead of reporting a readiness timeout at its startup deadline, when that daemon became ready and exited before the client connected, for example because `rush-client daemon stop` stopped it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 73420c612c..0dfdb92a15 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -29,6 +29,9 @@ export function connectOrAwaitDaemonStartupAsync(options: IConnectOrAwaitDaemonS
 // @beta
 export function connectOrStartDaemonAsync(options: IConnectOrStartDaemonOptions): Promise<DaemonClient>;
 
+// @beta
+export function connectToStartingDaemonAsync(options: IConnectOrAwaitDaemonStartupOptions): Promise<DaemonClient | undefined>;
+
 // @beta
 export class DaemonClient {
     // (undocumented)
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index ae677fd118..0ad4e00c3a 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -107,7 +107,10 @@ record whose PID now belongs to a process that started after the record's `start
 closed, pointing to `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`),
 which removes the record, socket and reservation after the same no-listener/no-live-owner checks.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
-readiness. The explicit launcher's cwd is unchanged.
+readiness. The explicit launcher's cwd is unchanged. If the daemon exits after its helper saw it ready
+but before the starting client connected, for example because `rush-client daemon stop` stopped it,
+the client fails with `startupFailed` at once instead of at its deadline: the helper has exited 0, and
+neither an ownership record nor a startup reservation remains.
 
 While its helper runs, a startup reservation is never taken over, however long startup
 takes. Only a known spawn failure (no executable started) releases the reservation
@@ -174,6 +177,14 @@ only after binding. Other errors, such as `versionMismatch`, pass through unchan
 waiting, it calls the optional `onAwaitStartup(owner, waitMs)` once, with the live process and the
 remaining wait, so that the caller can say why the command has not started yet.
 
+`connectToStartingDaemonAsync()` connects without starting anything, for a caller that must not leave
+a daemon running, such as `rush-client daemon stop`. One refused connection does not show that no daemon
+runs: while one of the same live processes can still make a daemon ready at the endpoint, it waits up
+to one startup deadline for that daemon and connects once it completes hello/ping, whatever its
+implementation version. It resolves `undefined` when nothing listens and none of those processes
+remains, and rejects with `DaemonStartupPendingError` when one is still live at the deadline. It calls
+`onAwaitStartup(owner, waitMs)` once before it waits.
+
 `reclaimCrashedDaemonAsync(paths)` is for a caller that is about to run Rush in-process, as the CLI
 client does for `--no-daemon` and for each fallback. A daemon that crashed or was killed while it ran
 a command leaves its operations running, and they could overwrite the in-process command's outputs.
diff --git a/libraries/rush-client-core/src/StartupLock.ts b/libraries/rush-client-core/src/StartupLock.ts
index 32f0d7152d..1c5645726a 100644
--- a/libraries/rush-client-core/src/StartupLock.ts
+++ b/libraries/rush-client-core/src/StartupLock.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { LockFile } from '@rushstack/node-core-library';
@@ -12,9 +13,31 @@ export interface IStartupLock {
 
 export async function tryAcquireStartupLockAsync(paths: IDaemonPaths): Promise<IStartupLock | undefined> {
   const folder: string = path.dirname(paths.lockfilePath);
-  const lock: LockFile | undefined = LockFile.tryAcquire(
-    folder,
-    `${path.basename(paths.lockfilePath)}-start`
-  );
+  const lock: LockFile | undefined = LockFile.tryAcquire(folder, getStartupLockResourceName(paths));
   return lock ? { releaseAsync: async () => lock.release() } : undefined;
 }
+
+/**
+ * Returns false when no process holds the start mutex. A `LockFile` owner keeps its file in the folder
+ * (`<resource>#<pid>.lock`, or `<resource>.lock` on Windows; see `LockFile.getLockFilePath()`), so without one
+ * the mutex is free. Unlike `tryAcquireStartupLockAsync()`, this runs no `ps` to learn the process start time.
+ * True means the mutex may be held, for example by a process that has exited without releasing it, or that the
+ * folder cannot be read.
+ */
+export function isStartupLockFilePresent(paths: IDaemonPaths): boolean {
+  const resourceName: string = getStartupLockResourceName(paths);
+  let names: string[];
+  try {
+    names = fs.readdirSync(path.dirname(paths.lockfilePath));
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code !== 'ENOENT';
+  }
+  return names.some(
+    (name: string) =>
+      name === `${resourceName}.lock` || (name.startsWith(`${resourceName}#`) && name.endsWith('.lock'))
+  );
+}
+
+function getStartupLockResourceName(paths: IDaemonPaths): string {
+  return `${path.basename(paths.lockfilePath)}-start`;
+}
diff --git a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
index 7364009944..63ba816fb0 100644
--- a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
+++ b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
@@ -12,8 +12,12 @@ import { DaemonClientError } from './DaemonClientError';
 import { isEndpointUnboundAsync } from './DaemonOwnership';
 import { readDaemonStartupReservation, type IDaemonStartupReservation } from './DaemonStartup';
 import { getStartupHelperState } from './DaemonStartupReservation';
-import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
-import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+import {
+  connectOrStartDaemonAsync,
+  tryConnectEndpointAsync,
+  type IConnectOrStartDaemonOptions
+} from './connectOrStartDaemon';
+import { isStartupLockFilePresent, tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 /** Matches the default of {@link IConnectOrStartDaemonOptions.startupTimeoutMs}. */
 const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
@@ -100,6 +104,45 @@ async function awaitLiveStartupAsync(
   }
 }
 
+/**
+ * Connects to the daemon at this workspace's endpoint without starting one. When none listens but a live process
+ * can still make one ready there (a listener that has not completed hello/ping yet, a recorded startup helper
+ * that still waits for its daemon, or another client that holds the start mutex), this waits for that daemon
+ * and connects once it completes hello/ping, for up to `startupTimeoutMs` (15000 milliseconds by default).
+ * @remarks A caller that must not leave a daemon running, such as `rush-client daemon stop`, uses this instead
+ * of concluding from one refused connection that none runs: a daemon that is still starting becomes ready
+ * afterwards. It connects to a daemon of any implementation version, and never uses `startCommand`. Before it
+ * waits, it calls the optional `onAwaitStartup(owner, waitMs)` once.
+ * @returns `undefined` when nothing listens and no live process can still make a daemon ready.
+ * @throws {@link DaemonStartupPendingError} when such a process is still live at the deadline.
+ * @beta
+ */
+export async function connectToStartingDaemonAsync(
+  options: IConnectOrAwaitDaemonStartupOptions
+): Promise<DaemonClient | undefined> {
+  const timeoutMs: number = options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+  const deadline: number = Date.now() + timeoutMs;
+  const endpoint: IConnectOrStartDaemonOptions = { ...options, expectedDaemonVersion: undefined };
+  for (let attempt: number = 0; ; attempt++) {
+    const client: DaemonClient | undefined = await tryConnectEndpointAsync(endpoint, deadline);
+    if (client) return client;
+    const owner: string | undefined = await findLiveStartupOwnerAsync(options.paths);
+    if (owner === undefined) {
+      // A startup that finished between the two checks leaves a ready daemon.
+      return await tryConnectEndpointAsync(endpoint, Math.max(deadline, Date.now() + 1000));
+    }
+    if (Date.now() >= deadline) {
+      throw new DaemonStartupPendingError(
+        `The daemon at ${options.paths.socketPath} is still starting after ${Math.round(timeoutMs / 1000)} s. ${owner}.`
+      );
+    }
+    if (attempt === 0) options.onAwaitStartup?.(owner, deadline - Date.now());
+    await delayAsync(Math.min(RETRY_DELAY_MS, Math.max(1, deadline - Date.now())), undefined, {
+      signal: options.abortSignal
+    });
+  }
+}
+
 function isStartupFailure(error: unknown): error is DaemonClientError {
   return error instanceof DaemonClientError && (error.code === 'startupFailed' || error.code === 'timeout');
 }
@@ -123,6 +166,8 @@ async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<string |
   if (reservation?.helper && getStartupHelperState(reservation) === 'running') {
     return `Its startup helper (PID ${reservation.helper.pid}) is still waiting for the daemon`;
   }
+  // Without a lock file nothing holds the start mutex, and an idle `daemon stop` needs no `ps` run to tell.
+  if (!isStartupLockFilePresent(paths)) return undefined;
   let lock: IStartupLock | undefined;
   try {
     lock = await tryAcquireStartupLockAsync(paths);
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 3d0dfadc6a..22501c9883 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -203,6 +203,8 @@ async function startDaemonAsync(
     backoffMs = 50;
     while (Date.now() < deadline) {
       options.abortSignal?.throwIfAborted();
+      // Read before connecting: the helper exits 0 only after it saw the daemon ready.
+      const helperSawReady: boolean = child.exitCode === 0;
       const client: DaemonClient | undefined = await tryConnectAsync(options, deadline);
       if (client) {
         try {
@@ -214,6 +216,13 @@ async function startDaemonAsync(
           throw error;
         }
       }
+      if (helperSawReady && hasReadyDaemonExited(options.paths)) {
+        await waitForHelperExitAsync(helper, options, deadline);
+        throw startupError(
+          options,
+          'failed: the daemon became ready but exited before this client connected, for example because "rush-client daemon stop" stopped it'
+        );
+      }
       if ((child.exitCode !== null && child.exitCode !== 0) || child.signalCode !== null) {
         await waitForHelperExitAsync(helper, options, deadline);
         throw startupError(
@@ -232,6 +241,15 @@ async function startDaemonAsync(
   }
 }
 
+/**
+ * Whether a daemon that answered hello has since exited. A daemon writes its lockfile before it can answer
+ * hello and removes it as it exits, so a missing lockfile with no startup in progress means it is gone.
+ * Waiting out the deadline instead would report a stop that won the race at readiness as a startup timeout.
+ */
+function hasReadyDaemonExited(paths: IDaemonPaths): boolean {
+  return !fs.existsSync(paths.lockfilePath) && !readDaemonStartupReservation(paths);
+}
+
 /**
  * Holding the start mutex, waits until no startup reservation remains. The helper releases its reservation once
  * the daemon completes hello/ping, and this client resolves it on the same evidence, so a daemon that became
@@ -467,7 +485,7 @@ async function tryConnectAsync(
 }
 
 /** Connects and completes hello/ping, whether or not a startup reservation remains. */
-async function tryConnectEndpointAsync(
+export async function tryConnectEndpointAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
 ): Promise<DaemonClient | undefined> {
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index fc7fff117e..f9c499750a 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -36,6 +36,7 @@ export {
 } from './executeWithDaemonRestart';
 export {
   connectOrAwaitDaemonStartupAsync,
+  connectToStartingDaemonAsync,
   DaemonStartupPendingError,
   type IConnectOrAwaitDaemonStartupOptions
 } from './connectOrAwaitDaemonStartup';
diff --git a/libraries/rush-client-core/src/test/StartupLock.test.ts b/libraries/rush-client-core/src/test/StartupLock.test.ts
index 60e39c852c..0c4a412322 100644
--- a/libraries/rush-client-core/src/test/StartupLock.test.ts
+++ b/libraries/rush-client-core/src/test/StartupLock.test.ts
@@ -7,7 +7,7 @@ import * as path from 'node:path';
 
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
-import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import { isStartupLockFilePresent, tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import { removeTestFolderAsync } from './TestProcessExit';
 
 it('holds startup exclusively until the owning lock is released', async () => {
@@ -32,3 +32,34 @@ it('holds startup exclusively until the owning lock is released', async () => {
     await removeTestFolderAsync(folder);
   }
 });
+
+it('reports a start mutex lock file without acquiring the mutex', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-start-lock-'));
+  const paths: IDaemonPaths = {
+    lockfilePath: path.join(folder, 'daemon.pid.json'),
+    socketPath:
+      process.platform === 'win32'
+        ? `\\\\.\\pipe\\${path.basename(folder)}`
+        : path.join(folder, 'daemon.sock')
+  };
+  let lock: IStartupLock | undefined;
+  try {
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    // Lock files of other resources in the same folder don't count.
+    fs.writeFileSync(path.join(folder, 'daemon.pid.json#1.lock'), '');
+    fs.writeFileSync(path.join(folder, 'other.pid.json-start#1.lock'), '');
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    lock = await tryAcquireStartupLockAsync(paths);
+    expect(lock).toBeDefined();
+    expect(isStartupLockFilePresent(paths)).toBe(true);
+    await lock!.releaseAsync();
+    lock = undefined;
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    expect(isStartupLockFilePresent({ ...paths, lockfilePath: path.join(folder, 'missing', 'daemon.pid.json') })).toBe(
+      false
+    );
+  } finally {
+    await lock?.releaseAsync();
+    await removeTestFolderAsync(folder);
+  }
+});
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
index 94fedd12f7..8e638ebeb9 100644
--- a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
@@ -9,12 +9,18 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
+import { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient } from '../DaemonClient';
 import { DaemonClientError } from '../DaemonClientError';
 import { getDaemonStartupFilePath } from '../DaemonStartup';
-import { DaemonStartupPendingError, connectOrAwaitDaemonStartupAsync } from '../connectOrAwaitDaemonStartup';
+import {
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync,
+  connectToStartingDaemonAsync
+} from '../connectOrAwaitDaemonStartup';
 import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
@@ -311,4 +317,117 @@ describe('connectOrAwaitDaemonStartupAsync', () => {
     ).rejects.toMatchObject({ code: 'versionMismatch' });
     expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
   });
+
+  describe('connectToStartingDaemonAsync', () => {
+    it('returns at once without starting a daemon when nothing is starting', async () => {
+      const started: number = Date.now();
+      const onAwaitStartup: jest.Mock = jest.fn();
+      // Without a start mutex lock file, nothing tries to acquire the mutex (LockFile runs `ps` to do that).
+      const tryAcquire: jest.SpyInstance = jest.spyOn(LockFile, 'tryAcquire');
+      await expect(connectToStartingDaemonAsync({ ...options, onAwaitStartup })).resolves.toBeUndefined();
+      expect(tryAcquire).not.toHaveBeenCalled();
+      // A reservation whose startup helper has exited names no live starter either, and neither does a start
+      // mutex lock file that the helper left behind.
+      const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+      await once(exited, 'close');
+      fs.writeFileSync(
+        getDaemonStartupFilePath(paths),
+        JSON.stringify({ token: 'fixture', helperPid: exited.pid, helperStartedAt: new Date().toISOString() })
+      );
+      fs.writeFileSync(
+        path.join(folder, `${path.basename(paths.lockfilePath)}-start#${exited.pid}.lock`),
+        'Mon Jan  1 00:00:00 2024'
+      );
+      await expect(connectToStartingDaemonAsync({ ...options, onAwaitStartup })).resolves.toBeUndefined();
+      expect(tryAcquire).toHaveBeenCalled();
+      tryAcquire.mockRestore();
+      expect(Date.now() - started).toBeLessThan(options.startupTimeoutMs!);
+      expect(onAwaitStartup).not.toHaveBeenCalled();
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    });
+
+    it('waits for a daemon that another client is starting and connects to it, whatever its version', async () => {
+      fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1500');
+      const starter = run('starter.js', [JSON.stringify(options)]);
+      await waitForFileAsync(getDaemonStartupFilePath(paths));
+      const onAwaitStartup: jest.Mock = jest.fn();
+      const client: DaemonClient | undefined = await connectToStartingDaemonAsync({
+        ...options,
+        expectedDaemonVersion: 'replacement',
+        onAwaitStartup
+      });
+      expect(client).toBeDefined();
+      const { pid } = await client!.status;
+      await client!.closeAsync();
+      expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+      expect(onAwaitStartup.mock.calls[0][0]).toMatch(
+        /^(Its startup helper \(PID \d+\) is still waiting for the daemon|Another client is still starting the daemon)$/
+      );
+      expect(onAwaitStartup.mock.calls[0][1]).toBeGreaterThan(0);
+      expect(onAwaitStartup.mock.calls[0][1]).toBeLessThanOrEqual(options.startupTimeoutMs!);
+      expect(await starter.result).toEqual({ code: 0, stdout: '', stderr: '' });
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${pid}\n`);
+    }, 30000);
+
+    it('rejects with DaemonStartupPendingError while the daemon is still starting at the deadline', async () => {
+      fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+      const starter = run('starter.js', [JSON.stringify(options)]);
+      const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+      const helperPid: number = Number(fs.readFileSync(path.join(folder, 'parents'), 'utf8'));
+      const onAwaitStartup: jest.Mock = jest.fn();
+      const started: number = Date.now();
+      const error: unknown = await connectToStartingDaemonAsync({
+        ...options,
+        startupTimeoutMs: 1000,
+        onAwaitStartup
+      }).then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1000);
+      expect(error).toBeInstanceOf(DaemonStartupPendingError);
+      expect((error as Error).message).toBe(
+        `The daemon at ${paths.socketPath} is still starting after 1 s. Its startup helper (PID ${helperPid}) is still waiting for the daemon.`
+      );
+      expect(onAwaitStartup.mock.calls).toEqual([
+        [`Its startup helper (PID ${helperPid}) is still waiting for the daemon`, expect.any(Number)]
+      ]);
+
+      fs.unlinkSync(path.join(folder, 'hold-prebind'));
+      expect(await starter.result).toEqual({ code: 0, stdout: '', stderr: '' });
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
+    }, 30000);
+
+    it('waits while another client holds the start mutex, until it is released or the wait is aborted', async () => {
+      const holder = run('startLockHolder.js', [JSON.stringify(paths)]);
+      await waitForFileAsync(path.join(folder, 'lock-held'));
+      const abort: AbortController = new AbortController();
+      const aborted: Promise<unknown> = connectToStartingDaemonAsync({
+        ...options,
+        abortSignal: abort.signal
+      }).then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      await delayAsync(300);
+      abort.abort();
+      expect(await aborted).toMatchObject({ name: 'AbortError' });
+
+      const onAwaitStartup: jest.Mock = jest.fn();
+      const started: number = Date.now();
+      const waiting: Promise<DaemonClient | undefined> = connectToStartingDaemonAsync({
+        ...options,
+        onAwaitStartup
+      });
+      await delayAsync(500);
+      fs.writeFileSync(path.join(folder, 'release-lock'), '');
+      await expect(waiting).resolves.toBeUndefined();
+      expect(Date.now() - started).toBeGreaterThanOrEqual(500);
+      expect(onAwaitStartup.mock.calls).toEqual([
+        ['Another client is still starting the daemon', expect.any(Number)]
+      ]);
+      expect(await holder.result).toEqual({ code: 0, stdout: '', stderr: '' });
+      expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    }, 30000);
+  });
 });
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 54533aa132..62fac20d9a 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -394,6 +394,30 @@ describe('detached daemon startup', () => {
     );
   });
 
+  it('reports at once a daemon that became ready but was stopped before this client connected', async () => {
+    // The daemon reports another version, so every connect by this client misses its ready window; the helper,
+    // which does not check the version, sees it ready. The daemon then stops like one reached by "daemon stop".
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({
+      ...options,
+      startupTimeoutMs: 6000,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'other', 'stop-when-ready']
+      }
+    }).then(
+      () => new Error('Expected startup to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toContain(
+      'Daemon startup failed: the daemon became ready but exited before this client connected'
+    );
+    expect(Date.now() - started).toBeLessThan(3500);
+    expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 15000);
+
   it('refuses a relaunch while a process accepts connections at the endpoint', async () => {
     const sockets: Set<net.Socket> = new Set();
     // Accepts connections but never completes hello, like a daemon that listens but is not ready.
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 5b8f10234b..d72a43c758 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -17,6 +17,7 @@ import {
 } from '@rushstack/rush-daemon-transport';
 
 import { connectOrStartDaemonAsync } from '../../connectOrStartDaemon';
+import { getDaemonStartupFilePath } from '../../DaemonStartup';
 
 async function mainAsync(): Promise<void> {
   const paths: IDaemonPaths = JSON.parse(process.argv[2]);
@@ -174,7 +175,12 @@ async function mainAsync(): Promise<void> {
   });
   const expiry: number = Date.now() + 10000;
   const timer = setInterval(() => {
-    if (!fs.existsSync(path.join(folder, 'stop')) && Date.now() < expiry) return;
+    const stopRequested: boolean =
+      fs.existsSync(path.join(folder, 'stop')) ||
+      Date.now() >= expiry ||
+      // Like a "daemon stop" that arrives as soon as the startup helper has seen this daemon ready.
+      (mode === 'stop-when-ready' && !fs.existsSync(getDaemonStartupFilePath(paths)));
+    if (!stopRequested) return;
     void stopAsync().catch((error: Error) => {
       process.stderr.write(`${error.stack}\n`);
       process.exitCode = 1;

From 475fc57fe980008bf75bf70f8824b8b0c9df7662 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 087/265] [rush-lib] afterExecuteRequestAsync runs once for
 each request, with that request's results

Swarm integration step 72; original commit 2f4ca9f5dd (merge of swarm/r02-t65-nits at 1f1c778570).
Scope: task 65.

Brings r02's task 65, rushstack half (board 3046; NITs board 3312): the new `afterExecuteRequestAsync` hook runs once for each request, with only that request's results, command name, environment and terminal, including a warm request that needs no iteration and each of several coalesced requests. It also fixes an early-result bug that reported waiting operations as SKIPPED. Second agent: o03 CONFIRMED board 3226 and board 3371.

s17 batch D3, item 4 of 8. Gate: ch01 GATE OK board 3747 (tree 8775aa859f)

Commits folded into this step (3):
- 0e019d1662 [rush-lib] [rush-daemon] Add afterExecuteRequestAsync, invoked once for each request (task 65)
- 72242e4bbc [rush-daemon] [rush-lib] An early result leaves out operations that have not finished (task 65)
- 1f1c778570 Test the native afterExecuteRequestAsync status and command name, and document which requests get no call

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...request-results-hook_2026-09-29-01-22.json |  10 +
 ...t-summary-unfinished_2026-09-29-02-24.json |  10 +
 ...request-results-hook_2026-09-29-01-22.json |  10 +
 common/reviews/api/rush-lib.api.md            |  11 +
 .../rush-daemon/src/PhasedRequestRouter.ts    |  49 +-
 .../rush-daemon/src/PhasedRequestSummary.ts   | 182 ++++--
 .../src/test/PhasedRequestHook.test.ts        | 534 ++++++++++++++++++
 .../cli/scriptActions/PhasedScriptAction.ts   |  27 +-
 .../cli/test/RushCommandLineParser.test.ts    | 134 +++++
 libraries/rush-lib/src/index.ts               |   6 +-
 .../src/logic/operations/IOperationGraph.ts   |  52 +-
 .../pluginFramework/OperationGraphHooks.ts    |  35 +-
 12 files changed, 1005 insertions(+), 55 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/request-results-hook_2026-09-29-01-22.json
 create mode 100644 common/changes/@rushstack/rush-daemon/early-result-summary-unfinished_2026-09-29-02-24.json
 create mode 100644 common/changes/@rushstack/rush-daemon/request-results-hook_2026-09-29-01-22.json
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestHook.test.ts

diff --git a/common/changes/@microsoft/rush/request-results-hook_2026-09-29-01-22.json b/common/changes/@microsoft/rush/request-results-hook_2026-09-29-01-22.json
new file mode 100644
index 0000000000..b37f20437e
--- /dev/null
+++ b/common/changes/@microsoft/rush/request-results-hook_2026-09-29-01-22.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add the `afterExecuteRequestAsync` hook to `OperationGraphHooks`. It runs once for each command request, after the request's results are final, with the request's own operation results, command name, environment and terminal (`IOperationGraphRequestResult`). A native command calls it once per iteration; a long-lived engine calls it once per served request, including a request that needs no iteration. A request that returns before its iteration finishes omits the operations that have not finished.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/early-result-summary-unfinished_2026-09-29-02-24.json b/common/changes/@rushstack/rush-daemon/early-result-summary-unfinished_2026-09-29-02-24.json
new file mode 100644
index 0000000000..e819f3ac6c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/early-result-summary-unfinished_2026-09-29-02-24.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A request that returns early on failure no longer reports an operation that has not started yet as skipped, in its summary or in its `afterExecuteRequestAsync` results. Operations that have not finished are left out, as running ones already were.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/changes/@rushstack/rush-daemon/request-results-hook_2026-09-29-01-22.json b/common/changes/@rushstack/rush-daemon/request-results-hook_2026-09-29-01-22.json
new file mode 100644
index 0000000000..57747a304c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/request-results-hook_2026-09-29-01-22.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Call `afterExecuteRequestAsync` once for each served phased request, with that request's own results. Coalesced requests each get their own results, a no-op request gets its operations as up to date, and a failing tap fails only its own request.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 0891385d4b..3724303a3f 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -804,6 +804,16 @@ export interface IOperationGraphIterationOptions {
     startTime?: number;
 }
 
+// @alpha
+export interface IOperationGraphRequestResult extends IExecutionResult {
+    readonly commandName: string;
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    readonly operationResults: ReadonlyMap<Operation, IOperationExecutionResult>;
+    readonly requestId: string | undefined;
+    readonly status: OperationStatus;
+    readonly terminal: ITerminal;
+}
+
 // @beta
 export interface IOperationLastState {
     readonly status: OperationStatus;
@@ -1415,6 +1425,7 @@ export class OperationGraphHooks {
     readonly afterExecuteOperationAsync: AsyncSeriesHook<[
     IOperationRunnerContext & IOperationExecutionResult
     ]>;
+    readonly afterExecuteRequestAsync: AsyncSeriesHook<[IOperationGraphRequestResult]>;
     readonly beforeDeleteResults: SyncHook<[ReadonlySet<Operation>]>;
     readonly beforeExecuteIterationAsync: AsyncSeriesBailHook<[
     ReadonlyMap<Operation, IOperationExecutionResult>,
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 852beef9ed..193e881b18 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import type {
+  IExecutionResult,
   IOperationExecutionResult,
   IOperationGraph,
   IOperationGraphIterationOptions,
@@ -11,6 +12,7 @@ import type {
 } from '@microsoft/rush-lib';
 import { getWorkspaceRequestOperationEnvironment, OperationStatus } from '@microsoft/rush-lib';
 import { Sort } from '@rushstack/node-core-library';
+import type { ITerminal } from '@rushstack/terminal';
 import type {
   IDaemonPhasedEngineShape,
   IDaemonPhasedOperationSelection,
@@ -22,7 +24,7 @@ import type {
 import { PhasedRequestEventSink } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
 import { PhasedIterationDemand } from './PhasedIterationDemand';
-import { writePhasedRequestSummary } from './PhasedRequestSummary';
+import { writePhasedRequestSummaryAsync } from './PhasedRequestSummary';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
 import { DaemonShutdownError, getDaemonShutdownReason } from './DaemonShutdownError';
@@ -916,15 +918,21 @@ class PhasedRequestBatchCoordinator {
     const cleanupErrors: unknown[] = [...batchCleanupErrors];
     if (entry.requestSink) {
       if (entry.participated && this.#isEntryLive(entry)) {
-        writePhasedRequestSummary({
-          activeOperations: entry.selection.activeOperations,
-          commandName: entry.request.commandName,
-          elapsedMs: performance.now() - entry.startTimeMs,
-          executionError,
-          graph: this.#graph,
-          sink: entry.requestSink,
-          warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
-        });
+        try {
+          await writePhasedRequestSummaryAsync({
+            activeOperations: entry.selection.activeOperations,
+            commandName: entry.request.commandName,
+            executionError,
+            graph: this.#graph,
+            onResultsAsync: this.#getRequestHookInvoker(entry),
+            sink: entry.requestSink,
+            startTimeMs: entry.startTimeMs,
+            warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
+          });
+        } catch (error) {
+          // A plugin's afterExecuteRequestAsync tap failed, which fails this request as it fails a native command.
+          cleanupErrors.push(error);
+        }
       }
       try {
         await entry.requestSink.flushAsync();
@@ -1048,6 +1056,27 @@ class PhasedRequestBatchCoordinator {
     entry.markAdmissionPreemptible(() => this.#abandonContinuingEntry(entry));
   }
 
+  /**
+   * Returns the callback that invokes the graph's `afterExecuteRequestAsync` hook with one request's own results,
+   * or `undefined` when no plugin tapped it.
+   *
+   * @remarks
+   * A native command invokes the hook after each iteration. The daemon invokes it once for each request it serves
+   * instead, including a warm no-op request that needs no iteration, and in the request's own output.
+   */
+  #getRequestHookInvoker(
+    entry: IBatchEntry
+  ): ((results: IExecutionResult, terminal: ITerminal) => Promise<void>) | undefined {
+    const { afterExecuteRequestAsync } = this.#graph.hooks;
+    if (!afterExecuteRequestAsync.isUsed()) {
+      return undefined;
+    }
+    const { commandName, environment, requestId } = entry.request;
+    return async (results: IExecutionResult, terminal: ITerminal): Promise<void> => {
+      await afterExecuteRequestAsync.promise({ ...results, commandName, environment, requestId, terminal });
+    };
+  }
+
   async #rejectEntryAsync(entry: IBatchEntry, error: unknown): Promise<void> {
     if (entry.finishPromise) {
       try {
diff --git a/libraries/rush-daemon/src/PhasedRequestSummary.ts b/libraries/rush-daemon/src/PhasedRequestSummary.ts
index ed0628d60b..84f7964d4e 100644
--- a/libraries/rush-daemon/src/PhasedRequestSummary.ts
+++ b/libraries/rush-daemon/src/PhasedRequestSummary.ts
@@ -2,13 +2,24 @@
 // See LICENSE in the project root for license information.
 
 import type {
+  IExecutionResult,
+  ILogFilePaths,
   IOperationExecutionResult,
   IOperationGraph,
+  IOperationStateHashComponents,
+  IStopwatchResult,
   Operation,
   _IOperationActivityOptions
 } from '@microsoft/rush-lib';
 import { OperationStatus, _printOperationStatus } from '@microsoft/rush-lib';
-import { Terminal, TerminalProviderSeverity, type ITerminalProvider } from '@rushstack/terminal';
+import {
+  StdioSummarizer,
+  Terminal,
+  TerminalProviderSeverity,
+  type IProblemCollector,
+  type ITerminal,
+  type ITerminalProvider
+} from '@rushstack/terminal';
 
 const SECONDS_PER_MINUTE: number = 60;
 const MILLISECONDS_PER_SECOND: number = 1000;
@@ -25,21 +36,91 @@ const SUMMARIZED_STATUSES: ReadonlySet<OperationStatus> = new Set([
 
 /** The subset of a request event sink used to render a request's end-of-run summary. */
 export interface IPhasedRequestSummarySink {
-  getObservedResult(operation: Operation): { readonly executionResult: IOperationExecutionResult } | undefined;
+  getObservedResult(
+    operation: Operation
+  ): { readonly executionResult: IOperationExecutionResult } | undefined;
+  /** The record of one of this request's operations in the iteration that it is part of. */
+  getScheduledResult(operation: Operation): IOperationExecutionResult | undefined;
   onActivity(text: string, options?: _IOperationActivityOptions): void;
 }
 
-export interface IWritePhasedRequestSummaryOptions {
+export interface IPhasedRequestResultsOptions {
   readonly activeOperations: ReadonlyArray<Operation>;
-  readonly commandName: string;
-  readonly elapsedMs: number;
-  readonly executionError: unknown;
   readonly graph: IOperationGraph;
   readonly sink: IPhasedRequestSummarySink;
   /** Whether the request environment allows warnings in a successful build (`RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD`). */
   readonly warningsAllowedByEnvironment: boolean;
 }
 
+export interface IWritePhasedRequestSummaryOptions extends IPhasedRequestResultsOptions {
+  readonly commandName: string;
+  readonly executionError: unknown;
+  /**
+   * Called with the request's results after the status tables and before the duration line. Its terminal writes
+   * into the request's own output. If it throws, the summary reports errors and then rethrows the error.
+   */
+  readonly onResultsAsync: ((results: IExecutionResult, terminal: ITerminal) => Promise<void>) | undefined;
+  /** The `performance.now()` timestamp at which the request started. */
+  readonly startTimeMs: number;
+}
+
+const NEVER_STARTED_STOPWATCH: IStopwatchResult = {
+  duration: 0,
+  endTime: undefined,
+  startTime: undefined,
+  toString: () => '0.00 seconds'
+};
+const NO_PROBLEMS: IProblemCollector = { problems: new Set() };
+const NO_OUTPUT: StdioSummarizer = new StdioSummarizer();
+NO_OUTPUT.close();
+
+/**
+ * The result of a selected operation that a request did not need to run, because the operation was already up to
+ * date. Unlike a result that the graph reports, it describes only this request, so it has the `Skipped` status, no
+ * error, no problems, no output or log files and a stopwatch that was never started. The iteration id and state
+ * hashes are those of the previous result, which produced the operation's current outputs.
+ */
+class UpToDateOperationResult implements IOperationExecutionResult {
+  public readonly enabled: boolean = false;
+  public readonly error: undefined = undefined;
+  public readonly logFilePaths: ILogFilePaths | undefined = undefined;
+  public readonly nonCachedDurationMs: undefined = undefined;
+  public readonly problemCollector: IProblemCollector = NO_PROBLEMS;
+  public readonly silent: boolean = false;
+  public readonly status: OperationStatus = OperationStatus.Skipped;
+  public readonly stdioSummarizer: StdioSummarizer = NO_OUTPUT;
+  public readonly stopwatch: IStopwatchResult = NEVER_STARTED_STOPWATCH;
+  readonly #previous: IOperationExecutionResult;
+
+  public constructor(previous: IOperationExecutionResult) {
+    this.#previous = previous;
+  }
+
+  public get iterationId(): number {
+    return this.#previous.iterationId;
+  }
+
+  public get metadataFolderPath(): string {
+    return this.#previous.metadataFolderPath;
+  }
+
+  public get operation(): Operation {
+    return this.#previous.operation;
+  }
+
+  public get shouldRunnerPersist(): boolean {
+    return this.#previous.shouldRunnerPersist;
+  }
+
+  public getStateHash(): string {
+    return this.#previous.getStateHash();
+  }
+
+  public getStateHashComponents(): IOperationStateHashComponents {
+    return this.#previous.getStateHashComponents();
+  }
+}
+
 /**
  * Buffers terminal output into request-scoped activity events, one event per contiguous stream run.
  */
@@ -81,30 +162,61 @@ class RequestActivityTerminalProvider implements ITerminalProvider {
  *
  * @remarks
  * Coalesced requests share one graph iteration, so the summary is computed per request from the request's own
- * selection rather than from the whole iteration. Selected operations that the warm graph did not need to run are
- * reported as already up to date, so a warm no-op still reports what it checked.
+ * selection rather than from the whole iteration; see {@link collectPhasedRequestResults}.
  */
-export function writePhasedRequestSummary(options: IWritePhasedRequestSummaryOptions): void {
-  const { commandName, elapsedMs, executionError, sink } = options;
+export async function writePhasedRequestSummaryAsync(
+  options: IWritePhasedRequestSummaryOptions
+): Promise<void> {
+  const { commandName, executionError, onResultsAsync, sink, startTimeMs } = options;
   const provider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(sink);
   const terminal: Terminal = new Terminal(provider);
-  const duration: string = formatDuration(elapsedMs);
-  if (executionError === undefined) {
-    const operationResults: ReadonlyMap<Operation, IOperationExecutionResult> =
-      collectSummaryResults(options);
-    _printOperationStatus(terminal, {
-      operationResults,
-      status: getSummaryStatus(operationResults, options.warningsAllowedByEnvironment)
-    });
-    terminal.writeLine(`rush ${commandName} (${duration})`);
-  } else {
-    terminal.writeErrorLine(`rush ${commandName} - Errors! (${duration})`);
+  let callbackFailed: boolean = false;
+  let callbackError: unknown;
+  try {
+    if (executionError === undefined) {
+      const results: IExecutionResult = collectPhasedRequestResults(options);
+      _printOperationStatus(terminal, results);
+      try {
+        await onResultsAsync?.(results, terminal);
+      } catch (error) {
+        callbackFailed = true;
+        callbackError = error;
+      }
+    }
+    const duration: string = formatDuration(performance.now() - startTimeMs);
+    if (executionError === undefined && !callbackFailed) {
+      terminal.writeLine(`rush ${commandName} (${duration})`);
+    } else {
+      terminal.writeErrorLine(`rush ${commandName} - Errors! (${duration})`);
+    }
+  } finally {
+    provider.flush();
+  }
+  if (callbackFailed) {
+    throw callbackError;
   }
-  provider.flush();
 }
 
-function collectSummaryResults(
-  options: IWritePhasedRequestSummaryOptions
+/**
+ * Collects the results of the operations that one phased request selected, and the request's overall status.
+ *
+ * @remarks
+ * Operations are listed in graph order, as in the native summary, and silent operations are left out. A selected
+ * operation that the warm graph did not need to run is reported as an {@link UpToDateOperationResult}, so a warm
+ * no-op still reports what it checked. A request that returns early leaves out the operations that have not
+ * finished.
+ */
+export function collectPhasedRequestResults(options: IPhasedRequestResultsOptions): IExecutionResult {
+  const operationResults: ReadonlyMap<Operation, IOperationExecutionResult> =
+    collectOperationResults(options);
+  return {
+    operationResults,
+    status: getSummaryStatus(operationResults, options.warningsAllowedByEnvironment)
+  };
+}
+
+function collectOperationResults(
+  options: IPhasedRequestResultsOptions
 ): ReadonlyMap<Operation, IOperationExecutionResult> {
   const { activeOperations, graph, sink } = options;
   const active: ReadonlySet<Operation> = new Set(activeOperations);
@@ -116,9 +228,11 @@ function collectSummaryResults(
     }
     const observed: IOperationExecutionResult | undefined =
       sink.getObservedResult(operation)?.executionResult;
-    if (observed && !observed.silent) {
-      if (SUMMARIZED_STATUSES.has(observed.status)) {
-        results.set(operation, observed);
+    // A request that returns early is summarized while its iteration runs, before some operations report.
+    const current: IOperationExecutionResult | undefined = observed ?? sink.getScheduledResult(operation);
+    if (current && !current.silent) {
+      if (SUMMARIZED_STATUSES.has(current.status)) {
+        results.set(operation, current);
       }
       continue;
     }
@@ -126,23 +240,13 @@ function collectSummaryResults(
     const previous: IOperationExecutionResult | undefined =
       observed ?? graph.resultByOperation.get(operation);
     if (previous) {
-      results.set(operation, createUpToDateResult(previous));
+      // The shared record itself must not change, because other requests and the next iteration read it.
+      results.set(operation, new UpToDateOperationResult(previous));
     }
   }
   return results;
 }
 
-function createUpToDateResult(previous: IOperationExecutionResult): IOperationExecutionResult {
-  // The summary only reads these members for skipped operations; the shared record itself must not change.
-  const upToDate: Pick<IOperationExecutionResult, 'operation' | 'silent' | 'status' | 'stopwatch'> = {
-    operation: previous.operation,
-    silent: false,
-    status: OperationStatus.Skipped,
-    stopwatch: previous.stopwatch
-  };
-  return upToDate as IOperationExecutionResult;
-}
-
 function getSummaryStatus(
   results: ReadonlyMap<Operation, IOperationExecutionResult>,
   warningsAllowedByEnvironment: boolean
diff --git a/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts b/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
new file mode 100644
index 0000000000..c2815f8ff7
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
@@ -0,0 +1,534 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IOperationExecutionResult, IOperationGraphRequestResult } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonEventFrame,
+  decodeDaemonLogChunk,
+  type IDaemonEventEnvelope,
+  type IDaemonPhasedOperationSelection,
+  type IDaemonPhasedRequest,
+  type IDaemonPhasedRequestResult
+} from '@rushstack/rush-daemon-protocol';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture,
+  type ITestClientWrite,
+  type ITestRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+
+jest.setTimeout(30_000);
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_D: string = 'project-d (_phase:test)';
+const BUILD_DURATION_LINE: RegExp = /^rush build \(\d+\.\d\d seconds\)$/m;
+
+interface IRecordedRequest {
+  readonly commandName: string;
+  readonly environment: Readonly<Record<string, string | undefined>>;
+  readonly requestId: string | undefined;
+  readonly results: ReadonlyMap<string, IOperationExecutionResult>;
+  readonly status: OperationStatus;
+}
+
+function createRequest(
+  requestId: string,
+  commandName: string,
+  operationIds: ReadonlyArray<string>,
+  environment: Record<string, string> = {}
+): IDaemonPhasedRequest {
+  return {
+    commandName,
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment,
+    operationSelection: operationIds.map(
+      (operationId: string): IDaemonPhasedOperationSelection => ({ enabledState: true, operationId })
+    ),
+    requestId
+  };
+}
+
+function createFixture(): ITestRoutingFixture {
+  return createRoutingFixture(
+    new Map([
+      [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+      [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+    ]),
+    [[OPERATION_B, OPERATION_A]]
+  );
+}
+
+/** Records each request that reaches the hook, and writes `hook-<requestId>` to the request's terminal. */
+function recordRequests(
+  fixture: ITestRoutingFixture,
+  onRequest?: (request: IOperationGraphRequestResult) => void
+): IRecordedRequest[] {
+  const requests: IRecordedRequest[] = [];
+  fixture.session.operationGraph.hooks.afterExecuteRequestAsync.tapPromise(
+    'test',
+    async (request: IOperationGraphRequestResult): Promise<void> => {
+      requests.push({
+        commandName: request.commandName,
+        environment: request.environment,
+        requestId: request.requestId,
+        results: new Map(
+          Array.from(request.operationResults, ([operation, result]) => [operation.name, result])
+        ),
+        status: request.status
+      });
+      request.terminal.writeLine(`hook-${request.requestId}`);
+      onRequest?.(request);
+    }
+  );
+  return requests;
+}
+
+function getRequest(requests: ReadonlyArray<IRecordedRequest>, requestId: string): IRecordedRequest {
+  const request: IRecordedRequest | undefined = requests.find((r) => r.requestId === requestId);
+  if (!request) {
+    throw new Error(`The hook did not receive request "${requestId}".`);
+  }
+  return request;
+}
+
+function getActivity(client: TestPhasedRequestClient, stream: 'stdout' | 'stderr'): string {
+  let text: string = '';
+  for (const { event } of client.writes) {
+    const payload: { stream?: string; text?: string } | undefined =
+      event?.type === 'activityChanged' ? (event.payload as { stream?: string; text?: string }) : undefined;
+    if (payload?.stream === stream) {
+      text += payload.text;
+    }
+  }
+  return text;
+}
+
+/** Expects the hook's line to follow the status tables and to precede the duration line. */
+function expectHookOutputBetween(
+  stdout: string,
+  statusBanner: string,
+  hookLine: string,
+  durationLine: RegExp
+): void {
+  const bannerIndex: number = stdout.indexOf(statusBanner);
+  const hookIndex: number = stdout.indexOf(`${hookLine}\n`);
+  expect(bannerIndex).toBeGreaterThanOrEqual(0);
+  expect(hookIndex).toBeGreaterThan(bannerIndex);
+  expect(stdout.search(durationLine)).toBeGreaterThan(hookIndex);
+}
+
+describe('afterExecuteRequestAsync in the phased request router', () => {
+  it("invokes the hook once for each coalesced request, with that request's own results and environment", async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const [resultA, resultC] = await Promise.all([
+        router.executeAsync(createRequest('a', 'build', [OPERATION_A], { ORIGIN: 'client-a' }), clientA),
+        router.executeAsync(createRequest('c', 'build', [OPERATION_C], { ORIGIN: 'client-c' }), clientC)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(resultA).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(resultC).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(requests).toHaveLength(2);
+
+      const requestA: IRecordedRequest = getRequest(requests, 'a');
+      expect(requestA).toMatchObject({ commandName: 'build', status: OperationStatus.Success });
+      expect(requestA.environment).toEqual({ ORIGIN: 'client-a' });
+      expect(Array.from(requestA.results.keys())).toEqual([OPERATION_A]);
+      expect(requestA.results.get(OPERATION_A)?.status).toBe(OperationStatus.Success);
+
+      const requestC: IRecordedRequest = getRequest(requests, 'c');
+      expect(requestC).toMatchObject({ commandName: 'build', status: OperationStatus.Success });
+      expect(requestC.environment).toEqual({ ORIGIN: 'client-c' });
+      expect(Array.from(requestC.results.keys())).toEqual([OPERATION_C]);
+      expect(requestC.results.get(OPERATION_C)?.status).toBe(OperationStatus.Success);
+
+      // Each request's terminal writes only into that request's output, between its summary and duration line.
+      const stdoutA: string = getActivity(clientA, 'stdout');
+      const stdoutC: string = getActivity(clientC, 'stdout');
+      expect(stdoutA).not.toContain('hook-c');
+      expect(stdoutC).not.toContain('hook-a');
+      expectHookOutputBetween(stdoutA, '==[ SUCCESS: 1 operation ]==', 'hook-a', BUILD_DURATION_LINE);
+      expectHookOutputBetween(stdoutC, '==[ SUCCESS: 1 operation ]==', 'hook-c', BUILD_DURATION_LINE);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it("passes each request's own command name", async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(createRequest('a', 'build', [OPERATION_A]), new TestPhasedRequestClient());
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result = await router.executeAsync(createRequest('c', 'test', [OPERATION_C]), client);
+
+      expect(result).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(requests.map(({ commandName, requestId }) => ({ commandName, requestId }))).toEqual([
+        { commandName: 'build', requestId: 'a' },
+        { commandName: 'test', requestId: 'c' }
+      ]);
+      expectHookOutputBetween(
+        getActivity(client, 'stdout'),
+        '==[ SUCCESS: 1 operation ]==',
+        'hook-c',
+        /^rush test \(\d+\.\d\d seconds\)$/m
+      );
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('invokes the hook with Skipped results for a warm request that needs no iteration', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(createRequest('cold', 'build', [OPERATION_B]), new TestPhasedRequestClient());
+      let iterations: number = 0;
+      fixture.session.operationGraph.hooks.afterExecuteIterationAsync.tap(
+        'test',
+        (status: OperationStatus) => {
+          iterations++;
+          return status;
+        }
+      );
+      // Simulate the incremental plugin disabling every operation whose inputs did not change.
+      fixture.graph.hooks.configureIteration.tap('test', (records) => {
+        for (const record of records.values()) {
+          record.enabled = false;
+        }
+      });
+      const requests: IRecordedRequest[] = recordRequests(fixture);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+
+      const result = await router.executeAsync(createRequest('warm', 'build', [OPERATION_B]), client);
+
+      expect(result).toMatchObject({ exitCode: 0, scheduled: false });
+      expect(iterations).toBe(0);
+      expect(requests).toHaveLength(1);
+      const warm: IRecordedRequest = getRequest(requests, 'warm');
+      expect(warm.status).toBe(OperationStatus.Success);
+      expect(Array.from(warm.results.keys())).toEqual([OPERATION_A, OPERATION_B]);
+      for (const upToDate of warm.results.values()) {
+        expect(upToDate).toMatchObject({
+          error: undefined,
+          logFilePaths: undefined,
+          silent: false,
+          status: OperationStatus.Skipped
+        });
+        expect(upToDate.stopwatch).toMatchObject({ duration: 0, endTime: undefined, startTime: undefined });
+        expect(upToDate.problemCollector.problems.size).toBe(0);
+      }
+      // The results that other requests and the next iteration read are unchanged.
+      const graphStatuses: Map<string, OperationStatus> = new Map(
+        Array.from(fixture.session.operationGraph.resultByOperation, ([operation, graphResult]) => [
+          operation.name,
+          graphResult.status
+        ])
+      );
+      expect(graphStatuses.get(OPERATION_A)).toBe(OperationStatus.Success);
+      expect(graphStatuses.get(OPERATION_B)).toBe(OperationStatus.Success);
+      expectHookOutputBetween(
+        getActivity(client, 'stdout'),
+        '==[ SKIPPED: 2 operations ]==',
+        'hook-warm',
+        BUILD_DURATION_LINE
+      );
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('fails only the request whose tap throws', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const requests: IRecordedRequest[] = recordRequests(fixture, (request: IOperationGraphRequestResult) => {
+      if (request.requestId === 'a') {
+        throw new Error('summary-write-failed');
+      }
+    });
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const [resultA, resultC] = await Promise.all([
+        router.executeAsync(createRequest('a', 'build', [OPERATION_A]), clientA),
+        router.executeAsync(createRequest('c', 'build', [OPERATION_C]), clientC)
+      ]);
+
+      expect(requests.map(({ requestId }) => requestId).sort()).toEqual(['a', 'c']);
+      expect(resultA).toMatchObject({
+        errorMessage: expect.stringContaining('summary-write-failed'),
+        exitCode: 1,
+        outcome: 'failure'
+      });
+      expect(getActivity(clientA, 'stderr')).toMatch(/^rush build - Errors! \(\d+\.\d\d seconds\)$/m);
+      expect(getActivity(clientA, 'stdout')).not.toMatch(BUILD_DURATION_LINE);
+      expect(resultC).toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(getActivity(clientC, 'stdout')).toMatch(BUILD_DURATION_LINE);
+      expect(getActivity(clientC, 'stderr')).not.toContain('Errors!');
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('invokes the hook once for a request that returns early, with only the results that are final', async () => {
+    let startC: () => void = () => undefined;
+    const startedC: Promise<void> = new Promise((resolve) => {
+      startC = resolve;
+    });
+    let releaseC: () => void = () => undefined;
+    const releasedC: Promise<void> = new Promise((resolve) => {
+      releaseC = resolve;
+    });
+    let buildsOfB: number = 0;
+    let buildsOfC: number = 0;
+    // A consumes B and D, and D consumes C. In the second build, B fails once C runs, so C runs and D waits.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+        [
+          OPERATION_B,
+          new TestOperationRunner(
+            OPERATION_B,
+            OperationStatus.Success,
+            async (): Promise<OperationStatus> => {
+              if (++buildsOfB === 1) {
+                return OperationStatus.Success;
+              }
+              await startedC;
+              return OperationStatus.Failure;
+            }
+          )
+        ],
+        [
+          OPERATION_C,
+          new TestOperationRunner(OPERATION_C, OperationStatus.Success, async (): Promise<void> => {
+            if (++buildsOfC > 1) {
+              startC();
+              await releasedC;
+            }
+          })
+        ],
+        [OPERATION_D, new TestOperationRunner(OPERATION_D)]
+      ]),
+      [
+        [OPERATION_A, OPERATION_B],
+        [OPERATION_A, OPERATION_D],
+        [OPERATION_D, OPERATION_C]
+      ],
+      { parallelism: 2 }
+    );
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      // The first build leaves a successful result for every operation, which the second build runs again.
+      await expect(
+        router.executeAsync(createRequest('cold', 'build', [OPERATION_A]), new TestPhasedRequestClient())
+      ).resolves.toMatchObject({ exitCode: 0 });
+      const requests: IRecordedRequest[] = recordRequests(fixture);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      let onWritten: () => void = () => undefined;
+      const written: Promise<void> = new Promise((resolve) => {
+        onWritten = resolve;
+      });
+      client.onWriteAsync = async (write: ITestClientWrite): Promise<void> => {
+        if (write.result) {
+          onWritten();
+        }
+      };
+      const resultPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        { ...createRequest('early', 'build', [OPERATION_A]), returnEarlyOnFailure: true },
+        client
+      );
+      await written;
+
+      expect(requests).toHaveLength(1);
+      const early: IRecordedRequest = getRequest(requests, 'early');
+      expect(early.status).toBe(OperationStatus.Failure);
+      // C still runs and D has not started, so neither has a result to report yet.
+      expect(
+        Object.fromEntries(Array.from(early.results, ([name, result]) => [name, result.status]))
+      ).toEqual({
+        [OPERATION_A]: OperationStatus.Blocked,
+        [OPERATION_B]: OperationStatus.Failure
+      });
+      // The summary that the client prints lists the same operations.
+      const stdout: string = getActivity(client, 'stdout');
+      expect(stdout).not.toContain('SKIPPED');
+      expectHookOutputBetween(stdout, '==[ BLOCKED: 1 operation ]==', 'hook-early', BUILD_DURATION_LINE);
+
+      releaseC();
+      await expect(resultPromise).resolves.toMatchObject({ exitCode: 1 });
+      expect(requests).toHaveLength(1);
+    } finally {
+      releaseC();
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('does not invoke the hook for a request whose iteration failed', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    fixture.session.operationGraph.hooks.beforeExecuteIterationAsync.tapPromise(
+      'test',
+      async (): Promise<undefined> => {
+        throw new Error('iteration-failed');
+      }
+    );
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result = await new PhasedRequestRouter(fixture.session).executeAsync(
+        createRequest('broken', 'build', [OPERATION_A]),
+        client
+      );
+
+      expect(result).toMatchObject({
+        errorMessage: expect.stringContaining('iteration-failed'),
+        exitCode: 1
+      });
+      expect(requests).toEqual([]);
+      expect(getActivity(client, 'stderr')).toMatch(/^rush build - Errors! \(\d+\.\d\d seconds\)$/m);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('does not invoke the hook for a request that its client cancels', async () => {
+    let markStarted: () => void = () => undefined;
+    const started: Promise<void> = new Promise((resolve) => {
+      markStarted = resolve;
+    });
+    let release: () => void = () => undefined;
+    const released: Promise<void> = new Promise((resolve) => {
+      release = resolve;
+    });
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [
+          OPERATION_A,
+          new TestOperationRunner(OPERATION_A, OperationStatus.Success, async (): Promise<void> => {
+            markStarted();
+            await released;
+          })
+        ]
+      ])
+    );
+    const requests: IRecordedRequest[] = recordRequests(fixture);
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const resultPromise: Promise<IDaemonPhasedRequestResult> = new PhasedRequestRouter(
+        fixture.session
+      ).executeAsync(createRequest('cancelled', 'build', [OPERATION_A]), client);
+      await started;
+      client.abortController.abort();
+      release();
+
+      await expect(resultPromise).resolves.toMatchObject({ exitCode: 1, outcome: 'aborted' });
+      expect(requests.map(({ requestId }) => requestId)).toEqual([]);
+    } finally {
+      release();
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
+
+function getProjectStatuses(request: IOperationGraphRequestResult): Record<string, OperationStatus> {
+  return Object.fromEntries(
+    Array.from(request.operationResults, ([operation, result]) => [
+      operation.associatedProject.packageName,
+      result.status
+    ])
+  );
+}
+
+/** The text that a request's terminal wrote, whether it arrived as activity events or as log chunks. */
+function getRequestOutput(exchange: ITerminalExchange): string {
+  let text: string = '';
+  for (const frame of exchange.frames) {
+    if (frame.kind === DaemonFrameType.event) {
+      const event: IDaemonEventEnvelope = decodeDaemonEventFrame(frame.payload);
+      if (event.type === 'activityChanged') {
+        text += (event.payload as { text?: string }).text ?? '';
+      }
+    } else if (frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr) {
+      text += Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString();
+    }
+  }
+  return text;
+}
+
+describe('afterExecuteRequestAsync on a native engine', () => {
+  it('invokes the hook once for each request, including a warm request that needs no iteration', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      expect((await runAsync(fixture, 'cold', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      const requests: IOperationGraphRequestResult[] = [];
+      fixture.session.operationGraph!.hooks.afterExecuteRequestAsync.tapPromise(
+        'test',
+        async (request: IOperationGraphRequestResult): Promise<void> => {
+          requests.push(request);
+          request.terminal.writeLine(`hook-${request.requestId}-${request.status}`);
+        }
+      );
+
+      const warm: ITerminalExchange = await runAsync(fixture, 'warm', ['build']);
+      expect(warm.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/c/input.txt'), 'two');
+      const changed: ITerminalExchange = await runAsync(fixture, 'changed', ['build']);
+      expect(changed.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+
+      expect([...runs(fixture)].sort()).toEqual(['a:one:', 'b:one:', 'c:one:', 'c:two:']);
+      // The engine does not also invoke the hook from its iteration, which would report the changed request twice.
+      expect(
+        requests.map(({ commandName, requestId, status }) => ({ commandName, requestId, status }))
+      ).toEqual([
+        { commandName: 'build', requestId: 'warm', status: OperationStatus.Success },
+        { commandName: 'build', requestId: 'changed', status: OperationStatus.Success }
+      ]);
+      expect(getProjectStatuses(requests[0])).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Skipped
+      });
+      expect(getProjectStatuses(requests[1])).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+      expect(getRequestOutput(warm)).toContain('hook-warm-SUCCESS\n');
+      expect(getRequestOutput(changed)).toContain('hook-changed-SUCCESS\n');
+      expect(getRequestOutput(changed)).not.toContain('hook-warm');
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index a651ab08a1..f0d18842c3 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -61,7 +61,10 @@ import {
   tryGetMissingProjectShrinkwrapFileErrorAsync
 } from '../../logic/ProjectChangeAnalyzer';
 import { OperationStatus } from '../../logic/operations/OperationStatus';
-import type { IExecutionResult } from '../../logic/operations/IOperationExecutionResult';
+import type {
+  IExecutionResult,
+  IOperationExecutionResult
+} from '../../logic/operations/IOperationExecutionResult';
 import { OperationResultSummarizerPlugin } from '../../logic/operations/OperationResultSummarizerPlugin';
 import type { ITelemetryData } from '../../logic/Telemetry';
 import {
@@ -909,6 +912,28 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             return result.toObject();
           }
         );
+      } else {
+        // A native command makes one request for each iteration. An engine host invokes this hook itself, once for
+        // each request that it serves.
+        graph.hooks.afterExecuteIterationAsync.tapPromise(
+          { name: 'PhasedScriptAction', stage: Infinity },
+          async (
+            status: OperationStatus,
+            operationResults: ReadonlyMap<Operation, IOperationExecutionResult>
+          ): Promise<OperationStatus> => {
+            if (graph.hooks.afterExecuteRequestAsync.isUsed()) {
+              await graph.hooks.afterExecuteRequestAsync.promise({
+                commandName: this.actionName,
+                environment: process.env,
+                operationResults,
+                requestId: undefined,
+                status,
+                terminal
+              });
+            }
+            return status;
+          }
+        );
       }
 
       const graphContext: IOperationGraphContext = {
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
index e1427b708f..ad41a46960 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
@@ -34,9 +34,13 @@ import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
 import type { IReporterEmitEventInput, IReporterEventSink } from '@rushstack/rush-reporter';
 import type { CommandLineAction } from '@rushstack/ts-command-line';
 import { Autoinstaller } from '../../logic/Autoinstaller';
+import type { IOperationGraphRequestResult } from '../../logic/operations/IOperationGraph';
+import { OperationStatus } from '../../logic/operations/OperationStatus';
 import type { ITelemetryData } from '../../logic/Telemetry';
 import {
   getCommandLineParserInstanceAsync,
+  setSpawnMock,
+  type IParserTestInstance,
   type SpawnMockArgs,
   type SpawnMockCall,
   isolateEnvironmentConfigurationForTests,
@@ -111,6 +115,30 @@ async function expectInitializationFailureAsync(repoName: string, expectedMessag
   }
 }
 
+function captureRequestResults(parser: IParserTestInstance['parser']): IOperationGraphRequestResult[] {
+  const requests: IOperationGraphRequestResult[] = [];
+  parser.rushSession.hooks.runAnyPhasedCommand.tap('RequestHookTest', (command) => {
+    command.hooks.onGraphCreatedAsync.tap('RequestHookTest', (graph) => {
+      graph.hooks.afterExecuteRequestAsync.tapPromise(
+        'RequestHookTest',
+        async (request: IOperationGraphRequestResult) => {
+          requests.push(request);
+        }
+      );
+    });
+  });
+  return requests;
+}
+
+function getStatusByProjectName(request: IOperationGraphRequestResult): Record<string, OperationStatus> {
+  return Object.fromEntries(
+    Array.from(request.operationResults, ([operation, { status }]) => [
+      operation.associatedProject.packageName,
+      status
+    ])
+  );
+}
+
 describe('RushCommandLineParser', () => {
   describe('execute', () => {
     let _envIsolation: IEnvironmentConfigIsolation;
@@ -265,6 +293,90 @@ describe('RushCommandLineParser', () => {
             lockSpy.mockRestore();
           }
         });
+
+        it('invokes afterExecuteRequestAsync once, after afterExecuteIterationAsync, with the command results', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync('basicAndRunBuildActionRepo', 'build');
+          const hookOrder: string[] = [];
+          const requests: IOperationGraphRequestResult[] = [];
+          parser.rushSession.hooks.runAnyPhasedCommand.tap('RequestHookTest', (command) => {
+            command.hooks.onGraphCreatedAsync.tap('RequestHookTest', (graph) => {
+              graph.hooks.afterExecuteIterationAsync.tap(
+                { name: 'RequestHookTest', stage: Number.MAX_SAFE_INTEGER },
+                (status: OperationStatus) => {
+                  hookOrder.push('afterExecuteIterationAsync');
+                  return status;
+                }
+              );
+              graph.hooks.afterExecuteRequestAsync.tapPromise(
+                'RequestHookTest',
+                async (request: IOperationGraphRequestResult) => {
+                  hookOrder.push('afterExecuteRequestAsync');
+                  requests.push(request);
+                }
+              );
+            });
+          });
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(hookOrder).toEqual(['afterExecuteIterationAsync', 'afterExecuteRequestAsync']);
+          expect(requests).toHaveLength(1);
+          const [request] = requests;
+          expect(request).toMatchObject({
+            commandName: 'build',
+            requestId: undefined,
+            status: OperationStatus.Success
+          });
+          expect(request.environment).toBe(process.env);
+          expect(request.terminal).toBeDefined();
+          expect(Array.from(request.operationResults.values(), ({ status }) => status)).toEqual([
+            OperationStatus.Success,
+            OperationStatus.Success
+          ]);
+        });
+
+        it('invokes afterExecuteRequestAsync with the Failure status when an operation fails', async () => {
+          const originalExitCode: typeof process.exitCode = process.exitCode;
+          let onExit!: () => void;
+          const exited: Promise<void> = new Promise<void>((resolve: () => void) => {
+            onExit = resolve;
+          });
+          // Rush exits after it reports the failure, so wait for that before restoring process.exit.
+          const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
+            .spyOn(process, 'exit')
+            .mockImplementation((): never => {
+              onExit();
+              return undefined as never;
+            });
+          const stderrSpy: jest.SpiedFunction<typeof process.stderr.write> = jest
+            .spyOn(process.stderr, 'write')
+            .mockImplementation(() => true);
+          try {
+            const { parser } = await getCommandLineParserInstanceAsync('basicAndRunBuildActionRepo', 'build');
+            const requests: IOperationGraphRequestResult[] = captureRequestResults(parser);
+            setSpawnMock({ emitError: false, returnCode: 1 });
+
+            await parser.executeAsync();
+            await exited;
+
+            expect(exitSpy).toHaveBeenCalledWith(1);
+            expect(requests).toHaveLength(1);
+            const [request] = requests;
+            expect(request).toMatchObject({
+              commandName: 'build',
+              requestId: undefined,
+              status: OperationStatus.Failure
+            });
+            expect(getStatusByProjectName(request)).toEqual({
+              a: OperationStatus.Failure,
+              b: OperationStatus.Blocked
+            });
+          } finally {
+            stderrSpy.mockRestore();
+            exitSpy.mockRestore();
+            process.exitCode = originalExitCode;
+          }
+        });
       });
 
       describe("'custom-output' action", () => {
@@ -380,6 +492,28 @@ describe('RushCommandLineParser', () => {
           expectSpawnToMatchRegexp(secondSpawn, expectedBuildTaskRegexp);
           cwdOptionEquals(secondSpawn, `${repoPath}/b`);
         });
+
+        it('invokes afterExecuteRequestAsync with the rebuild command name', async () => {
+          const { parser } = await getCommandLineParserInstanceAsync(
+            'basicAndRunRebuildActionRepo',
+            'rebuild'
+          );
+          const requests: IOperationGraphRequestResult[] = captureRequestResults(parser);
+
+          await expect(parser.executeAsync()).resolves.toEqual(true);
+
+          expect(requests).toHaveLength(1);
+          const [request] = requests;
+          expect(request).toMatchObject({
+            commandName: 'rebuild',
+            requestId: undefined,
+            status: OperationStatus.Success
+          });
+          expect(getStatusByProjectName(request)).toEqual({
+            a: OperationStatus.Success,
+            b: OperationStatus.Success
+          });
+        });
       });
 
       describe("'custom-reporter-flag' action", () => {
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index 32811efbbb..b4c6b9cde6 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -245,7 +245,11 @@ export {
   type IPhasedCommandPlugin,
   PhasedCommandHooks
 } from './pluginFramework/PhasedCommandHooks';
-export type { IOperationGraph, IOperationGraphIterationOptions } from './logic/operations/IOperationGraph';
+export type {
+  IOperationGraph,
+  IOperationGraphIterationOptions,
+  IOperationGraphRequestResult
+} from './logic/operations/IOperationGraph';
 export type {
   IOperationChildProcessReporter as _IOperationChildProcessReporter,
   IOperationGraphEventSink as _IOperationGraphEventSink,
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index 9d78c3bede..089846f243 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -1,10 +1,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { TerminalWritable } from '@rushstack/terminal';
+import type { ITerminal, TerminalWritable } from '@rushstack/terminal';
 
 import type { Operation } from './Operation';
-import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { Parallelism } from './ParseParallelism';
 import type { OperationStatus } from './OperationStatus';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
@@ -47,6 +47,54 @@ export interface IOperationGraphIterationOptions {
   getOperationRequestId?: (operation: Operation) => string | undefined;
 }
 
+/**
+ * The results of one request for an operation graph's work, passed to
+ * {@link OperationGraphHooks.afterExecuteRequestAsync}.
+ *
+ * @remarks
+ * A native command makes one request for each iteration, so its request has the iteration's results. A long-lived
+ * host such as the Rush daemon can serve several requests with one iteration, and it serves a request whose
+ * operations are all up to date without any iteration. Each of those requests has only its own results.
+ *
+ * @alpha
+ */
+export interface IOperationGraphRequestResult extends IExecutionResult {
+  /**
+   * The results of the operations that the request selected. An operation that was already up to date, so that
+   * the request did not need to run it, has the `Skipped` status, a zero-length stopwatch and no problems.
+   * A request that returned before its iteration finished omits the operations that had not finished.
+   * The map can include silent operations; check `silent` before reporting an operation.
+   */
+  readonly operationResults: ReadonlyMap<Operation, IOperationExecutionResult>;
+
+  /**
+   * The request's overall status, as its caller reports it.
+   */
+  readonly status: OperationStatus;
+
+  /**
+   * The name of the Rush command that made the request, for example `build`.
+   */
+  readonly commandName: string;
+
+  /**
+   * The environment of the request's caller. For a native command, this is `process.env`. A long-lived host passes
+   * the environment of the client that sent the request, which can differ from the host's own `process.env`.
+   */
+  readonly environment: Readonly<Record<string, string | undefined>>;
+
+  /**
+   * The id that a long-lived host gave the request, or `undefined` for a native command.
+   */
+  readonly requestId: string | undefined;
+
+  /**
+   * Writes to the output of the request's caller. A long-lived host shows this output only to the client that sent
+   * the request.
+   */
+  readonly terminal: ITerminal;
+}
+
 /**
  * Public API for the operation graph.
  * @alpha
diff --git a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
index d372e354e6..bb0890a2e8 100644
--- a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
+++ b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
@@ -18,7 +18,11 @@ import type { OperationStatus } from '../logic/operations/OperationStatus';
 import type { IOperationRunnerContext } from '../logic/operations/IOperationRunner';
 import type { ITelemetryData } from '../logic/Telemetry';
 import type { IEnvironment } from '../utilities/Utilities';
-import type { IOperationGraph, IOperationGraphIterationOptions } from '../logic/operations/IOperationGraph';
+import type {
+  IOperationGraph,
+  IOperationGraphIterationOptions,
+  IOperationGraphRequestResult
+} from '../logic/operations/IOperationGraph';
 
 /**
  * Hooks into the execution process for operations within the graph.
@@ -29,7 +33,8 @@ import type { IOperationGraph, IOperationGraphIterationOptions } from '../logic/
  * 3. `beforeExecuteIterationAsync` - Async hook that can bail out the iteration entirely.
  * 4. Operations execute (status changes reported via `onExecutionStatesUpdated`).
  * 5. `afterExecuteIterationAsync` - Fires after all operations in the iteration have settled.
- * 6. `onIdle` - Fires when the graph enters idle state awaiting changes (watch mode only).
+ * 6. `afterExecuteRequestAsync` - Fires once for each request that the iteration served.
+ * 7. `onIdle` - Fires when the graph enters idle state awaiting changes (watch mode only).
  *
  * Additional hooks:
  * - `onEnableStatesChanged` - Fires when `setEnabledStates` mutates operation enabled flags.
@@ -147,6 +152,32 @@ export class OperationGraphHooks {
     [OperationStatus, ReadonlyMap<Operation, IOperationExecutionResult>, IOperationGraphIterationOptions]
   > = new AsyncSeriesWaterfallHook(['status', 'results', 'context'], 'afterExecuteIterationAsync');
 
+  /**
+   * Hook invoked once for each request for this graph's work, after the operations that the request selected have
+   * settled and before the request's result is reported. Use it instead of `afterExecuteIterationAsync` for work that
+   * describes one command's results, such as a build summary.
+   *
+   * @remarks
+   * A native command makes one request for each iteration, and invokes this hook after
+   * `afterExecuteIterationAsync`, with the iteration's final status and results.
+   *
+   * A long-lived host such as the Rush daemon can serve several requests with one iteration, and it serves a request
+   * whose operations are all up to date without any iteration, so the iteration hooks never fire for that request.
+   * The host invokes this hook once for each request it serves, including those, with only that request's
+   * results. Several requests can be in this hook at the same time.
+   *
+   * A host can also return a failed request as soon as nothing that still runs can change its result. It then
+   * invokes this hook while the iteration runs, and the request's results omit the operations that have not
+   * finished.
+   *
+   * The hook is not invoked for a request that ends without results: one whose iteration throws, or one that a
+   * long-lived host stops serving because its client cancelled the request or disconnected.
+   *
+   * If a tap throws, the request fails with that error.
+   */
+  public readonly afterExecuteRequestAsync: AsyncSeriesHook<[IOperationGraphRequestResult]> =
+    new AsyncSeriesHook(['request'], 'afterExecuteRequestAsync');
+
   /**
    * Hook invoked after executing an iteration, before the telemetry entry is written.
    * Allows the caller to augment or modify the log entry.

From 659f897a0bca9afea9b3c653055fed742b8d7e6e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 088/265] [rush-cli-client] Report the output behind warnings
 given after an operation succeeded

Swarm integration step 73; original commit c34fa4f992 (merge of swarm/r04-t165 at 15351b01af).
Scope: task 165.

Brings r04's task 165 (board 3076): when an operation succeeds and then gets warnings because its build cache entry can't be written, agent output prints the lines that explain the warnings instead of `(no output)`. Second agent: t07 CONFIRMED board 3206.

s17 batch D3, item 5 of 8. Gate: ch01 GATE OK board 3747 (tree eaae7633ad)

Commits folded into this step (1):
- 15351b01af Report the output behind warnings given after an operation succeeded (task 165)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  6 +-
 .../src/AgentOperationTracker.ts              | 18 ++++-
 .../src/AgentProgressRenderer.ts              | 14 +++-
 .../src/test/AgentProgressRenderer.test.ts    | 75 +++++++++++++++++++
 ...4-t165-late-warnings_2026-09-29-02-35.json | 11 +++
 5 files changed, 115 insertions(+), 9 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t165-late-warnings_2026-09-29-02-35.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 87dfd0c47d..46a60ab354 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -158,8 +158,10 @@ error count that the shown errors account for, and, when the first error shown n
 location, the lines before it. Up to three operations are reported. Two kinds are reported just
 before the summary line instead: a failed operation that wrote no output, with the error from the
 daemon's result, and, when no operation failed, the operations whose warnings failed the request
-(`warnings: …`). The error of a reported operation that wrote output is printed too, unless its
-excerpt shows it or it only gives the exit code (`Returned error code: 1`): for example an error
+(`warnings: …`). An operation that succeeded and then got warnings, because its build cache entry
+could not be written, is shown with the output that it wrote after it succeeded. The error of a
+reported operation that wrote output is printed too, unless its excerpt shows it or it only gives
+the exit code (`Returned error code: 1`): for example an error
 thrown while the operation's build cache entry was restored. Only the daemon's result carries it,
 so for an operation reported as it failed it comes just before the summary line, as an
 `error: <operation>` line followed by the error. On a pipe, a status line names a failed
diff --git a/apps/rush-cli-client/src/AgentOperationTracker.ts b/apps/rush-cli-client/src/AgentOperationTracker.ts
index 93fae6c77c..880b6995be 100644
--- a/apps/rush-cli-client/src/AgentOperationTracker.ts
+++ b/apps/rush-cli-client/src/AgentOperationTracker.ts
@@ -187,7 +187,11 @@ export class AgentOperationTracker {
     }
   }
 
-  /** Records output. Output of operations that already succeeded without warnings is discarded. */
+  /**
+   * Records output. An operation's output is discarded when it reaches a status without problems, but output
+   * that follows is kept until its output stream closes: Rush writes an operation's build cache entry after its
+   * status, and if that fails, it writes why and then changes the status to SUCCESS WITH WARNINGS.
+   */
   public appendLog(operationId: string, text: string, stream: 'stdout' | 'stderr'): void {
     if (this.#silent.has(operationId)) {
       return;
@@ -197,9 +201,6 @@ export class AgentOperationTracker {
       this.#globalExcerpt.append(text, stream);
       return;
     }
-    if (status !== undefined && TERMINAL_STATUSES.has(status) && !this.#isProblemStatus(status)) {
-      return;
-    }
     let excerpt: OperationOutputExcerpt | undefined = this.#excerpts.get(operationId);
     if (!excerpt) {
       excerpt = new OperationOutputExcerpt();
@@ -208,6 +209,14 @@ export class AgentOperationTracker {
     excerpt.append(text, stream);
   }
 
+  /** Discards an operation's output when its output stream closes, unless its status is a problem. */
+  public closeOutput(operationId: string): void {
+    const status: string | undefined = this.#statuses.get(operationId);
+    if (status !== undefined && TERMINAL_STATUSES.has(status) && !this.#isProblemStatus(status)) {
+      this.#excerpts.delete(operationId);
+    }
+  }
+
   /**
    * The operations that explain a failed request: failed operations, or, when none failed, operations that
    * reported warnings (warnings fail a build unless the command allows them).
@@ -236,6 +245,7 @@ export class AgentOperationTracker {
     this.#done++;
     this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
     if (!this.#isProblemStatus(status)) {
+      // Output that follows starts a new excerpt; see appendLog.
       this.#excerpts.delete(operationId);
       return;
     }
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index f72c577f90..5ff5f5d9f3 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -4,7 +4,11 @@
 // Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib
 // so that the first line can be written within a few milliseconds.
 
-import type { DaemonRequestAdmissionErrorCode, IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type {
+  DaemonRequestAdmissionErrorCode,
+  IDaemonEventEnvelope,
+  RUSHD_OPERATION_STREAM_CLOSED
+} from '@rushstack/rush-daemon-protocol';
 
 import { AgentNotices } from './AgentNotices';
 import {
@@ -36,6 +40,8 @@ const STARTING_PHASE: string = 'rushd is still starting; waiting for it';
 /** Ends the summary line of a cancelled request when the client stopped waiting before rushd confirmed the stop. */
 const UNCONFIRMED_STOP: string = 'rushd did not confirm that the request stopped; it may still be stopping';
 const FAILURE_STATUS: string = 'FAILURE';
+/** The protocol's name for this extension event, repeated so that loading this module does not load the protocol. */
+const OPERATION_STREAM_CLOSED: typeof RUSHD_OPERATION_STREAM_CLOSED = 'rushd.operation-stream-closed';
 const TTY_INTERVAL_MS: number = 100;
 /** The most failed (or warning) operations whose output excerpt is printed. */
 const MAX_REPORTED_OPERATIONS: number = 3;
@@ -349,11 +355,13 @@ export class AgentProgressRenderer {
         break;
       }
       case 'extension': {
-        const data: { totalOperations?: unknown } | undefined = payload.data as
-          | { totalOperations?: unknown }
+        const data: { totalOperations?: unknown; operationId?: unknown } | undefined = payload.data as
+          | { totalOperations?: unknown; operationId?: unknown }
           | undefined;
         if (data && typeof data.totalOperations === 'number') {
           this.#tracker.setHeaderTotal(data.totalOperations);
+        } else if (payload.name === OPERATION_STREAM_CLOSED && typeof data?.operationId === 'string') {
+          this.#tracker.closeOutput(data.operationId);
         }
         break;
       }
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index bd93567469..649a20aa0a 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -72,6 +72,10 @@ function header(
   });
 }
 
+function streamClosed(operationId: string): IDaemonEventEnvelope {
+  return event('extension', { name: 'rushd.operation-stream-closed', data: { operationId } });
+}
+
 function fail(renderer: AgentProgressRenderer, operationId: string, errorLines: ReadonlyArray<string>): void {
   renderer.onEvent(status(operationId, 'EXECUTING'));
   renderer.onLog(Buffer.from(errorLines.map((line) => `${line}\n`).join('')), operationId, 'stderr');
@@ -639,6 +643,77 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('reports the output that explains warnings given after an operation succeeded, such as a failed cache write', () => {
+    const { renderer, lines } = createRenderer(false);
+    const tarLine: string =
+      '"tar" exited with code 2 while attempting to create the cache entry. ' +
+      'See "/repo/a/.rush/temp/a.tar.log" for logs from the tar process.';
+    for (const operationId of ['a (build)', 'b (build)']) {
+      renderer.onEvent(status(operationId, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`built ${operationId}\n`), operationId, 'stdout');
+      renderer.onLog(Buffer.from(`note from ${operationId}\n`), operationId, 'stderr');
+      renderer.onEvent(status(operationId, 'SUCCESS'));
+    }
+    // Rush writes an operation's build cache entry after its status. If that fails, it writes why and then changes
+    // the status. The operation's output stream closes last.
+    renderer.onLog(Buffer.from(`${tarLine}\nUnable to set `), 'a (build)', 'stderr');
+    renderer.onLog(Buffer.from('local cache entry.\n'), 'a (build)', 'stderr');
+    renderer.onEvent(event('extension', { name: 'rushd.unknown', data: { operationId: 'a (build)' } }));
+    renderer.onEvent(status('a (build)', 'SUCCESS WITH WARNINGS', '/repo/a/rush-logs/a._phase_build.log'));
+    renderer.onEvent(streamClosed('a (build)'));
+    renderer.onLog(Buffer.from('Successfully set cache entry.\n'), 'b (build)', 'stdout');
+    renderer.onEvent(streamClosed('b (build)'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'warnings: a (build) · full log: /repo/a/rush-logs/a._phase_build.log',
+      `  ${tarLine}`,
+      '  Unable to set local cache entry.',
+      'rush build: FAILURE 2/2 operations (1 success with warnings, 1 success) in 0.0s · warnings: a (build)'
+    ]);
+  });
+
+  it('reports the output that an operation wrote after it succeeded when it then failed', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('compiled\n'), 'a (build)', 'stdout');
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onLog(Buffer.from('Unable to set local cache entry.\n'), 'a (build)', 'stderr');
+    renderer.onEvent(status('a (build)', 'SUCCESS WITH WARNINGS'));
+    // A later hook threw.
+    renderer.onEvent(status('a (build)', 'FAILURE', '/repo/a/rush-logs/a._phase_build.log'));
+    renderer.onEvent(streamClosed('a (build)'));
+    renderer.finish({
+      exitCode: 1,
+      operationResults: [{ operationId: 'a (build)', status: 'FAILURE', errorMessage: 'the plugin failed' }]
+    });
+    expect(lines()).toEqual([
+      'failed: a (build) · full log: /repo/a/rush-logs/a._phase_build.log',
+      '  Unable to set local cache entry.',
+      'error: a (build)',
+      '  the plugin failed',
+      'rush build: FAILURE 1/1 operations (1 failure) in 0.0s · failed: a (build)'
+    ]);
+  });
+
+  it('discards the output that an operation wrote after it succeeded once its output stream closes', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onEvent(status('a (build)', 'SUCCESS'));
+    renderer.onLog(Buffer.from('written after the first run\n'), 'a (build)', 'stderr');
+    renderer.onEvent(streamClosed('a (build)'));
+    // The operation runs again.
+    renderer.onEvent(status('a (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Warning: from the second run\n'), 'a (build)', 'stderr');
+    renderer.onEvent(status('a (build)', 'SUCCESS WITH WARNINGS', '/repo/a/rush-logs/a._phase_build.log'));
+    renderer.onEvent(streamClosed('a (build)'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'warnings: a (build) · full log: /repo/a/rush-logs/a._phase_build.log',
+      '  Warning: from the second run',
+      'rush build: FAILURE 1/1 operations (1 success with warnings) in 0.0s · warnings: a (build)'
+    ]);
+  });
+
   it('does not report warnings when the request succeeded', () => {
     const { renderer, lines } = createRenderer(false);
     renderer.onEvent(status('w (build)', 'EXECUTING'));
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t165-late-warnings_2026-09-29-02-35.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t165-late-warnings_2026-09-29-02-35.json
new file mode 100644
index 0000000000..22b004ec8e
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t165-late-warnings_2026-09-29-02-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, an operation that succeeded and then got warnings because its build cache entry could not be written is now reported with the output that explains the warnings, instead of \"(no output)\".",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 69cb52bfec325e1f29f0cc54747cf36f1c92f0c1 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 089/265] [rush-daemon] Keep the warm daemon across Claude
 Code's per-command variables

Swarm integration step 74; original commit 20a1b34711 (merge of swarm/r02-t188 at da4de811a7).
Scope: task 188.

Brings r02's task 188 (board 3243): the daemon's identity ignores the variables Claude Code's Bash tool sets for each command, so a warm daemon keeps its pid when Claude Code runs a command. Second agent: t07 CONFIRMED board 3296.

s17 batch D3, item 6 of 8. Gate: ch01 GATE OK board 3747 (tree 02cb5d8683)

Commits folded into this step (1):
- da4de811a7 [rush-lib] Keep the warm daemon across Claude Code's per-command variables (task 188)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...de-code-keeps-daemon_2026-09-29-03-18.json | 10 +++++
 ...de-code-keeps-daemon_2026-09-29-03-18.json | 10 +++++
 .../VersionSelectedDaemonLauncher.test.ts     |  6 +++
 .../test/WorkspaceReloadTierStatus.test.ts    | 26 ++++++++++++
 .../src/api/WorkspaceInputFingerprint.ts      | 35 ++++++++++++++--
 .../test/WorkspaceInputFingerprint.test.ts    | 40 +++++++++++++++++++
 6 files changed, 123 insertions(+), 4 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/claude-code-keeps-daemon_2026-09-29-03-18.json
 create mode 100644 common/changes/@rushstack/rush-daemon/claude-code-keeps-daemon_2026-09-29-03-18.json

diff --git a/common/changes/@microsoft/rush/claude-code-keeps-daemon_2026-09-29-03-18.json b/common/changes/@microsoft/rush/claude-code-keeps-daemon_2026-09-29-03-18.json
new file mode 100644
index 0000000000..3c50895b26
--- /dev/null
+++ b/common/changes/@microsoft/rush/claude-code-keeps-daemon_2026-09-29-03-18.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add the variables that Claude Code sets in each command its Bash tool runs (`CLAUDE_CODE_CHILD_SESSION`, `CLAUDE_CODE_SESSION_ID`, `CLAUDE_EFFORT`, `CLAUDE_PID`, `CLAUDE_CODE_BRIDGE_SESSION_ID`, `CLAUDE_CODE_MESSAGING_SOCKET`, `CLAUDE_CODE_MESSAGING_TOKEN` and `CLAUDE_JOB_DIR`) and the W3C trace context variables `TRACEPARENT` and `TRACESTATE` to `workspaceFingerprintIgnoredEnvironmentVariables`, so switching between Claude Code sessions, effort levels, other agents and a terminal keeps the warm Rush daemon instead of restarting it. The ones that name a session, process, folder, credential or trace span are also in `workspaceRequestScopedEnvironmentVariables`, so the daemon does not inherit them from the client that started it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/common/changes/@rushstack/rush-daemon/claude-code-keeps-daemon_2026-09-29-03-18.json b/common/changes/@rushstack/rush-daemon/claude-code-keeps-daemon_2026-09-29-03-18.json
new file mode 100644
index 0000000000..92aef0a7ed
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/claude-code-keeps-daemon_2026-09-29-03-18.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that requests from Claude Code sessions, effort levels and a terminal keep the warm daemon, and that the daemon starts without the Claude Code variables that name one session, process, folder, credential or trace span.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 4b8554b5d4..d9f601a9cd 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -99,11 +99,17 @@ describe('version-selected daemon launcher', () => {
         RUSH_PARALLELISM: '48',
         COPILOT_AGENT_SESSION_ID: 'session-1',
         ODSP_TELEMETRY_TAG: 'tag-1',
+        CLAUDE_CODE_SESSION_ID: 'claude-session-1',
+        CLAUDE_PID: '4242',
+        CLAUDE_CODE_MESSAGING_TOKEN: 'token-1',
+        TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
         RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
         RUSHD_OUTPUT: 'agent',
         // The first client's session folders may disappear while the daemon lives on.
         TMPDIR: '/tmp/session-1',
         XDG_RUNTIME_DIR: '/run/user/1000',
+        CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-1',
+        CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-1.sock',
         TEMP: '/tmp/temp-1',
         RUSHD_RUNTIME_DIR: '/var/rushd',
         UNSET: undefined
diff --git a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
index ae0b3cc932..6ea4ea576b 100644
--- a/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceReloadTierStatus.test.ts
@@ -73,6 +73,18 @@ it('reuses the warm generation when only volatile per-shell environment variable
     const before = await pongAsync(fixture);
     const generation: number = fixture.host.workspaceGeneration;
     const graph = fixture.session.operationGraph;
+    // What Claude Code's Bash tool sets in every command it runs
+    const claudeCode: Record<string, string> = {
+      ...fixture.environment,
+      CLAUDECODE: '1',
+      CLAUDE_CODE_ENTRYPOINT: 'cli',
+      CLAUDE_CODE_CHILD_SESSION: '1',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-1',
+      CLAUDE_EFFORT: 'high',
+      CLAUDE_PID: '4242',
+      CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-1.sock',
+      CLAUDE_CODE_MESSAGING_TOKEN: 'token-1'
+    };
     for (const [label, environment] of Object.entries({
       same: fixture.environment,
       shell: {
@@ -99,6 +111,20 @@ it('reuses the warm generation when only volatile per-shell environment variable
       },
       telemetryTag: { ...fixture.environment, ODSP_TELEMETRY_TAG: 'nightly-7' },
       anotherTelemetryTag: { ...fixture.environment, ODSP_TELEMETRY_TAG: 'nightly-8' },
+      claudeCode,
+      claudeEffort: { ...claudeCode, CLAUDE_EFFORT: 'max' },
+      anotherClaudeSession: {
+        ...claudeCode,
+        CLAUDE_CODE_SESSION_ID: 'claude-session-2',
+        CLAUDE_PID: '4343',
+        CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-2.sock',
+        CLAUDE_CODE_MESSAGING_TOKEN: 'token-2',
+        CLAUDE_CODE_BRIDGE_SESSION_ID: 'session_01bridge',
+        CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-2',
+        TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+        TRACESTATE: 'vendor=1'
+      },
+      humanAfterClaude: fixture.environment,
       repeatedPath: {
         ...fixture.environment,
         PATH: [fixture.environment.PATH, fixture.environment.PATH].join(path.delimiter)
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 1a1cbf7e44..8ac6ef7aa1 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -65,6 +65,13 @@ export interface IWorkspaceInputFingerprintOptions {
  *   `VSCODE_GIT_ASKPASS_EXTRA_ARGS`, `VSCODE_INJECTION`, `VSCODE_NONCE`, `GIT_ASKPASS`, `SSH_ASKPASS`
  * - coding agent session markers: `COPILOT_CLI`, `COPILOT_AGENT_SESSION_ID`, `COPILOT_LOADER_PID`,
  *   `COPILOT_CLI_BINARY_VERSION`, `COPILOT_CLI_RESOLVED_DIST_DIR`, `CLAUDECODE`, `CLAUDE_CODE_ENTRYPOINT`
+ * - the values that Claude Code sets in each command its Bash tool runs: `CLAUDE_CODE_CHILD_SESSION`,
+ *   `CLAUDE_CODE_SESSION_ID`, `CLAUDE_EFFORT` (the session's effort level, which can change within a session),
+ *   `CLAUDE_PID`, and, when the session has the feature, `CLAUDE_CODE_BRIDGE_SESSION_ID` (Remote Control),
+ *   `CLAUDE_CODE_MESSAGING_SOCKET` and `CLAUDE_CODE_MESSAGING_TOKEN` (cross-session messaging) and
+ *   `CLAUDE_JOB_DIR` (background sessions)
+ * - W3C trace context for one command: `TRACEPARENT` and `TRACESTATE`, which a traced caller such as Claude Code
+ *   sets to the span of that command
  * - `ODSP_TELEMETRY_TAG`, which tags the telemetry entry of one command with its caller's label
  * - `INIT_CWD`, which Rush removes from every lifecycle script environment and sets explicitly where needed,
  *   and `RUSH_INVOKED_FOLDER`, which Rush assigns for each invocation
@@ -143,6 +150,16 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'COPILOT_CLI_RESOLVED_DIST_DIR',
   'CLAUDECODE',
   'CLAUDE_CODE_ENTRYPOINT',
+  'CLAUDE_CODE_CHILD_SESSION',
+  'CLAUDE_CODE_SESSION_ID',
+  'CLAUDE_EFFORT',
+  'CLAUDE_PID',
+  'CLAUDE_CODE_BRIDGE_SESSION_ID',
+  'CLAUDE_CODE_MESSAGING_SOCKET',
+  'CLAUDE_CODE_MESSAGING_TOKEN',
+  'CLAUDE_JOB_DIR',
+  'TRACEPARENT',
+  'TRACESTATE',
   'ODSP_TELEMETRY_TAG',
   'INIT_CWD',
   'RUSH_INVOKED_FOLDER',
@@ -165,10 +182,12 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
  * @remarks
  * A long-lived host must not inherit these variables from the client that started it: it applies
  * `RUSH_PARALLELISM` from each request's own environment, and code running inside the host that reads a session
- * identifier such as `COPILOT_AGENT_SESSION_ID` or a telemetry label such as `ODSP_TELEMETRY_TAG` from
- * `process.env` would otherwise attribute every later session's work to the first one. Likewise, the first
- * client's `TMPDIR` or `XDG_RUNTIME_DIR` may be removed when that client's session or job ends, while the host
- * lives on. (`TMP` and `TEMP` stay, because Windows has no usable default for them.)
+ * identifier such as `COPILOT_AGENT_SESSION_ID` or `CLAUDE_CODE_SESSION_ID`, a telemetry label such as
+ * `ODSP_TELEMETRY_TAG` or a trace context such as `TRACEPARENT` from `process.env` would otherwise attribute every
+ * later session's work to the first one. `CLAUDE_PID` names the first client's agent process, and
+ * `CLAUDE_CODE_MESSAGING_TOKEN` is that session's own credential. Likewise, the first client's `TMPDIR`,
+ * `XDG_RUNTIME_DIR`, `CLAUDE_JOB_DIR` or `CLAUDE_CODE_MESSAGING_SOCKET` may be removed when that client's session
+ * or job ends, while the host lives on. (`TMP` and `TEMP` stay, because Windows has no usable default for them.)
  * On Windows, names are matched case-insensitively.
  *
  * @alpha
@@ -176,6 +195,14 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
 export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string> = new Set([
   'RUSH_PARALLELISM',
   'COPILOT_AGENT_SESSION_ID',
+  'CLAUDE_CODE_SESSION_ID',
+  'CLAUDE_PID',
+  'CLAUDE_CODE_BRIDGE_SESSION_ID',
+  'CLAUDE_CODE_MESSAGING_SOCKET',
+  'CLAUDE_CODE_MESSAGING_TOKEN',
+  'CLAUDE_JOB_DIR',
+  'TRACEPARENT',
+  'TRACESTATE',
   'ODSP_TELEMETRY_TAG',
   'TMPDIR',
   'XDG_RUNTIME_DIR'
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 2f2638fe4a..6a1f6fb304 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -221,6 +221,23 @@ describe('workspace input fingerprints', () => {
           WT_SESSION: 'w'
         },
         { ODSP_TELEMETRY_TAG: 'nightly-7' },
+        // What Claude Code's Bash tool sets in every command, and with Remote Control, messaging or a
+        // background session
+        {
+          CLAUDECODE: '1',
+          CLAUDE_CODE_ENTRYPOINT: 'cli',
+          CLAUDE_CODE_CHILD_SESSION: '1',
+          CLAUDE_CODE_SESSION_ID: 'claude-session-2',
+          CLAUDE_EFFORT: 'high',
+          CLAUDE_PID: '4242'
+        },
+        {
+          CLAUDE_CODE_BRIDGE_SESSION_ID: 'session_01bridge',
+          CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-2.sock',
+          CLAUDE_CODE_MESSAGING_TOKEN: 'token-2',
+          CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-2'
+        },
+        { TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01', TRACESTATE: 'vendor=1' },
         { PATH: `${base.PATH}${path.delimiter}${base.PATH}` },
         { TERM: undefined, PWD: undefined },
         { TMPDIR: '/scratch/job-1', XDG_RUNTIME_DIR: '/run/user/1000' },
@@ -264,6 +281,16 @@ describe('workspace input fingerprints', () => {
       RUSH_PARALLELISM: '48',
       COPILOT_AGENT_SESSION_ID: 'session-1',
       ODSP_TELEMETRY_TAG: 'tag-1',
+      CLAUDE_CODE_CHILD_SESSION: '1',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-1',
+      CLAUDE_EFFORT: 'high',
+      CLAUDE_PID: '4242',
+      CLAUDE_CODE_BRIDGE_SESSION_ID: 'session_01bridge',
+      CLAUDE_CODE_MESSAGING_SOCKET: '/tmp/claude-1000/inbox-1.sock',
+      CLAUDE_CODE_MESSAGING_TOKEN: 'token-1',
+      CLAUDE_JOB_DIR: '/home/user/.claude/jobs/job-1',
+      TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
+      TRACESTATE: 'vendor=1',
       RUSHD_OUTPUT: 'agent',
       RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
       TMPDIR: '/scratch/job-1',
@@ -274,6 +301,9 @@ describe('workspace input fingerprints', () => {
     };
     expect(getWorkspaceHostEnvironment(environment)).toEqual({
       HOME: '/home/user',
+      // Markers and settings that name no session, process, folder or secret stay.
+      CLAUDE_CODE_CHILD_SESSION: '1',
+      CLAUDE_EFFORT: 'high',
       RUSHD_OUTPUT: 'agent',
       RUSH_DAEMON_IDLE_TIMEOUT_SECONDS: '86400',
       TEMP: 'C:\\Temp',
@@ -292,6 +322,10 @@ describe('workspace input fingerprints', () => {
       COPILOT_AGENT_SESSION_ID: 'session-A',
       ODSP_TELEMETRY_TAG: 'tag-A',
       COPILOT_CLI: '1',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-A',
+      CLAUDE_EFFORT: 'high',
+      CLAUDE_PID: '4242',
+      TRACEPARENT: '00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01',
       GIT_ASKPASS: '/window-A/askpass.sh',
       WT_SESSION: 'wt-A',
       UNSET: undefined
@@ -301,6 +335,9 @@ describe('workspace input fingerprints', () => {
       PATH: '/other/bin',
       COPILOT_AGENT_SESSION_ID: 'session-B',
       ODSP_TELEMETRY_TAG: 'tag-B',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-B',
+      CLAUDE_EFFORT: 'max',
+      TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
       RUSH_PARALLELISM: '2',
       WT_SESSION: 'wt-B',
       RUSH_INVOKED_FOLDER: '/repo/apps/b',
@@ -312,6 +349,9 @@ describe('workspace input fingerprints', () => {
       NODE_OPTIONS: '--max-old-space-size=8192',
       COPILOT_AGENT_SESSION_ID: 'session-B',
       ODSP_TELEMETRY_TAG: 'tag-B',
+      CLAUDE_CODE_SESSION_ID: 'claude-session-B',
+      CLAUDE_EFFORT: 'max',
+      TRACEPARENT: '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01',
       RUSH_PARALLELISM: '2',
       WT_SESSION: 'wt-B',
       RUSH_INVOKED_FOLDER: '/repo/apps/b'

From edd23667b252bc715cb1637170b964394f7a40ba Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 090/265] [rush-cli-client] Say when a failed operation ran its
 incremental command

Swarm integration step 75; original commit ce7a5beb3c (merge of swarm/r06-t149-int2 at 9b0f67f886).
Scope: task 149.

Brings r06's task 149 (board 2398), re-tipped on s16 (board 3237): agent output says when a failed operation ran its incremental command. Second agent: o05 CONFIRMED at odsp-web scale, board 2495.

s17 batch D3, item 7 of 8. Gate: ch01 GATE OK board 3747 (tree 2e894960af)

Commits folded into this step (1):
- f59b64132a [rush-daemon] Say in agent output when a failed operation ran its incremental command (task 149)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  9 ++-
 .../src/AgentOperationTracker.ts              | 24 ++++++-
 .../src/AgentProgressRenderer.ts              | 34 ++++++++--
 .../src/test/AgentProgressRenderer.test.ts    | 63 ++++++++++++++++++-
 ...-incremental-command_2026-09-28-23-00.json | 11 ++++
 ...-incremental-command_2026-09-28-23-00.json | 11 ++++
 ...-incremental-command_2026-09-28-23-00.json | 11 ++++
 .../reviews/api/rush-daemon-protocol.api.md   |  1 +
 .../src/DaemonOperationPayloads.ts            |  7 +++
 .../rush-daemon/src/PhasedRequestEventSink.ts | 25 ++++++--
 .../src/test/PhasedRequestEventSink.test.ts   | 50 ++++++++++++++-
 11 files changed, 227 insertions(+), 19 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r06-t149-incremental-command_2026-09-28-23-00.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 46a60ab354..a9a6c49cf9 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -167,8 +167,13 @@ so for an operation reported as it failed it comes just before the summary line,
 `error: <operation>` line followed by the error. On a pipe, a status line names a failed
 operation that wrote no output 1 s after it failed, unless the result came first. The summary
 line names up to five failed (or warning) operations. Every operation's full output is in its
-project's `rush-logs/` folder, whether or not it was printed. When a request falls back to
-in-process Rush, agent mode stops and native output follows.
+project's `rush-logs/` folder, whether or not it was printed.
+When the daemon ran an operation's incremental command (its `<phase>:incremental` script; see
+`incrementalBuilds` below) and that command failed, the line reads
+`failed: <operation> · incremental command; its next run uses the initial command · full log: <path>`.
+That command can fail where the initial command, which `--no-daemon` runs, would not. Warnings
+that an incremental command reported get `· incremental command` in the same place.
+When a request falls back to in-process Rush, agent mode stops and native output follows.
 
 In agent mode a failed `rush build` doesn't wait for all of its work. Its result comes once an
 operation failed and none of the selected projects that no other selected project depends on (for
diff --git a/apps/rush-cli-client/src/AgentOperationTracker.ts b/apps/rush-cli-client/src/AgentOperationTracker.ts
index 880b6995be..951ac7a44f 100644
--- a/apps/rush-cli-client/src/AgentOperationTracker.ts
+++ b/apps/rush-cli-client/src/AgentOperationTracker.ts
@@ -4,6 +4,8 @@
 // Keep this module free of heavy imports: start.ts loads it (through AgentProgressRenderer) before
 // @microsoft/rush-lib.
 
+import type { IDaemonOperationStatusChangedPayload } from '@rushstack/rush-daemon-protocol';
+
 import { OperationOutputExcerpt } from './OperationOutputExcerpt';
 
 const FAILURE: string = 'FAILURE';
@@ -23,11 +25,19 @@ const STATUS_ORDER: ReadonlyArray<string> = [
 ];
 const TERMINAL_STATUSES: ReadonlySet<string> = new Set(STATUS_ORDER);
 
+/** Which of an operation's commands produced its status: its initial command or its incremental command. */
+export type AgentCommandKind = NonNullable<IDaemonOperationStatusChangedPayload['commandKind']>;
+
 export interface IAgentOperationStatusUpdate {
   readonly operationId: string;
   readonly status: string;
   /** The operation's full log file, when the daemon reports one (failures and warnings). */
   readonly logFilePath?: string;
+  /**
+   * The command that produced the status, when the daemon reports it (failures and warnings of an operation
+   * that has an incremental command).
+   */
+  readonly commandKind?: AgentCommandKind;
 }
 
 /** An operation's final status, as reported in the daemon's result. */
@@ -44,6 +54,8 @@ export interface IAgentProblemOperation {
   readonly excerpt: OperationOutputExcerpt | undefined;
   /** The engine's error for the operation, when the daemon's result reported one. */
   readonly errorMessage: string | undefined;
+  /** The command that failed or reported the warnings, when the daemon said which one it was. */
+  readonly commandKind: AgentCommandKind | undefined;
 }
 
 /**
@@ -66,6 +78,7 @@ export class AgentOperationTracker {
   readonly #warned: Set<string> = new Set();
   readonly #excerpts: Map<string, OperationOutputExcerpt> = new Map();
   readonly #logFilePaths: Map<string, string> = new Map();
+  readonly #commandKinds: Map<string, AgentCommandKind> = new Map();
   readonly #errorMessages: Map<string, string> = new Map();
   readonly #globalExcerpt: OperationOutputExcerpt = new OperationOutputExcerpt();
   #headerTotal: number = 0;
@@ -232,7 +245,8 @@ export class AgentOperationTracker {
       operationId,
       logFilePath: this.#logFilePaths.get(operationId),
       excerpt: this.#excerpts.get(operationId),
-      errorMessage: this.#errorMessages.get(operationId)
+      errorMessage: this.#errorMessages.get(operationId),
+      commandKind: this.#commandKinds.get(operationId)
     };
   }
 
@@ -241,7 +255,7 @@ export class AgentOperationTracker {
   }
 
   #onTerminalStatus(update: IAgentOperationStatusUpdate): void {
-    const { operationId, status, logFilePath } = update;
+    const { operationId, status, logFilePath, commandKind } = update;
     this.#done++;
     this.#counts.set(status, (this.#counts.get(status) ?? 0) + 1);
     if (!this.#isProblemStatus(status)) {
@@ -255,5 +269,11 @@ export class AgentOperationTracker {
     if (logFilePath) {
       this.#logFilePaths.set(operationId, logFilePath);
     }
+    // An operation that runs again may run its other command, or report none.
+    if (commandKind) {
+      this.#commandKinds.set(operationId, commandKind);
+    } else {
+      this.#commandKinds.delete(operationId);
+    }
   }
 }
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 5ff5f5d9f3..87369d1a12 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -12,6 +12,7 @@ import type {
 
 import { AgentNotices } from './AgentNotices';
 import {
+  type AgentCommandKind,
   AgentOperationTracker,
   type IAgentOperationResult,
   type IAgentProblemOperation
@@ -59,6 +60,14 @@ const MAX_MESSAGE_LENGTH: number = 300;
  */
 const ERROR_DETAIL_HEAD_LINES: number = 2;
 const ERROR_DETAIL_TAIL_LINES: number = 5;
+const FAILED_LABEL: string = 'failed';
+/**
+ * Follows the name of an operation whose incremental command (`<phase>:incremental`) failed or reported the
+ * warnings. That command can fail where the initial command would not, as in a build with `--no-daemon`. The daemon
+ * forgets the last successful run of an operation that failed, so the operation's next run uses its initial command.
+ */
+const INCREMENTAL_COMMAND_NOTE: string = ' · incremental command';
+const INCREMENTAL_COMMAND_FAILURE_NOTE: string = `${INCREMENTAL_COMMAND_NOTE}; its next run uses the initial command`;
 /**
  * The error of an operation whose process exited with a nonzero code. It says nothing that the operation's output
  * does not, so it is printed only for an operation that wrote no output.
@@ -143,6 +152,18 @@ function getErrorDetail(lines: ReadonlyArray<string>): string[] {
   ];
 }
 
+function getCommandKind(value: unknown): AgentCommandKind | undefined {
+  return value === 'initial' || value === 'incremental' ? value : undefined;
+}
+
+/** What a reported operation's line says about the command that failed or reported the warnings. */
+function getCommandNote(label: string, problem: IAgentProblemOperation): string {
+  if (problem.commandKind !== 'incremental') {
+    return '';
+  }
+  return label === FAILED_LABEL ? INCREMENTAL_COMMAND_FAILURE_NOTE : INCREMENTAL_COMMAND_NOTE;
+}
+
 function getMatchKey(line: string): string {
   return line.replace(WHITESPACE_PATTERN, ' ').trim().toLowerCase();
 }
@@ -454,14 +475,15 @@ export class AgentProgressRenderer {
   }
 
   #onStatusChanged(payload: Record<string, unknown>): void {
-    const { operationId, status, logFilePath } = payload;
+    const { operationId, status, logFilePath, commandKind } = payload;
     if (typeof operationId !== 'string' || typeof status !== 'string') {
       return;
     }
     this.#tracker.updateStatus({
       operationId,
       status,
-      logFilePath: typeof logFilePath === 'string' ? logFilePath : undefined
+      logFilePath: typeof logFilePath === 'string' ? logFilePath : undefined,
+      commandKind: getCommandKind(commandKind)
     });
     this.#onRunning();
     if (status === FAILURE_STATUS) {
@@ -495,7 +517,7 @@ export class AgentProgressRenderer {
       }
       return;
     }
-    const lines: string[] = this.#getProblemLines('failed', problem);
+    const lines: string[] = this.#getProblemLines(FAILED_LABEL, problem);
     const text: string = lines.map((line) => `${line}\n`).join('');
     if (this.#options.isTTY) {
       this.#clear();
@@ -554,7 +576,7 @@ export class AgentProgressRenderer {
     if (!problems.length) {
       return tracker.globalExcerpt.getExcerpt(GLOBAL_OUTPUT_EXCERPT_LINES).map((line) => `  ${line}`);
     }
-    const label: string = tracker.failed.length ? 'failed' : 'warnings';
+    const label: string = tracker.failed.length ? FAILED_LABEL : 'warnings';
     const lines: string[] = [];
     let hidden: number = 0;
     for (const problem of problems) {
@@ -573,7 +595,7 @@ export class AgentProgressRenderer {
       }
     }
     if (hidden > 0) {
-      const what: string = label === 'failed' ? 'failed operations' : 'operations with warnings';
+      const what: string = label === FAILED_LABEL ? 'failed operations' : 'operations with warnings';
       lines.push(`+${hidden} more ${what}; their logs are in each project's rush-logs folder`);
     }
     return lines;
@@ -593,7 +615,7 @@ export class AgentProgressRenderer {
     this.#reported.set(problem.operationId, shownLines);
     const logFile: string = problem.logFilePath ? ` · full log: ${problem.logFilePath}` : '';
     return [
-      `${label}: ${problem.operationId}${logFile}`,
+      `${label}: ${problem.operationId}${getCommandNote(label, problem)}${logFile}`,
       ...(shownLines.length ? shownLines : ['(no output)']).map((line) => `  ${line}`)
     ];
   }
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 649a20aa0a..c5bd6e0704 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -52,12 +52,18 @@ function registered(operationId: string, silent: boolean = false): IDaemonEventE
   return event('operationRegistered', { operationId, silent });
 }
 
-function status(operationId: string, value: string, logFilePath?: string): IDaemonEventEnvelope {
+function status(
+  operationId: string,
+  value: string,
+  logFilePath?: string,
+  commandKind?: unknown
+): IDaemonEventEnvelope {
   return event('operationStatusChanged', {
     operationId,
     previousStatus: 'READY',
     status: value,
-    logFilePath
+    logFilePath,
+    commandKind
   });
 }
 
@@ -726,6 +732,59 @@ describe(AgentProgressRenderer.name, () => {
     expect(lines().join('\n')).not.toContain('Warning: x');
   });
 
+  it('says when a failed operation ran its incremental command, and that its next run uses the initial one', () => {
+    const { renderer, lines } = createRenderer(false);
+    for (const [name, commandKind] of [
+      ['inc', 'incremental'],
+      ['init', 'initial']
+    ]) {
+      renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      renderer.onLog(Buffer.from(`${name} error\n`), `${name} (build)`, 'stderr');
+      renderer.onEvent(status(`${name} (build)`, 'FAILURE', `/repo/${name}/rush-logs/x.log`, commandKind));
+    }
+    renderer.finish({ exitCode: 1 });
+    expect(lines()).toEqual([
+      'failed: inc (build) · incremental command; its next run uses the initial command · ' +
+        'full log: /repo/inc/rush-logs/x.log',
+      '  inc error',
+      'failed: init (build) · full log: /repo/init/rush-logs/x.log',
+      '  init error',
+      'rush build: FAILURE 2/2 operations (2 failures) in 0.0s · failed: inc (build), init (build)'
+    ]);
+  });
+
+  it('says when warnings that failed the request came from an incremental command', () => {
+    const { renderer, lines } = createRenderer(false);
+    renderer.onEvent(status('w (build)', 'EXECUTING'));
+    renderer.onLog(Buffer.from('Warning: x\n'), 'w (build)', 'stderr');
+    renderer.onEvent(status('w (build)', 'SUCCESS WITH WARNINGS', '/repo/w/rush-logs/x.log', 'incremental'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().slice(-3)).toEqual([
+      'warnings: w (build) · incremental command · full log: /repo/w/rush-logs/x.log',
+      '  Warning: x',
+      'rush build: FAILURE 1/1 operations (1 success with warnings) in 0.0s · warnings: w (build)'
+    ]);
+  });
+
+  it('names the command of the last run of an operation, and ignores a command it does not know', () => {
+    const { renderer, lines } = createRenderer(false);
+    // Operations without output are reported with the summary, after their last run.
+    renderer.onEvent(status('again (build)', 'FAILURE', undefined, 'incremental'));
+    renderer.onEvent(status('again (build)', 'READY'));
+    renderer.onEvent(status('again (build)', 'EXECUTING'));
+    renderer.onEvent(status('again (build)', 'FAILURE'));
+    renderer.onEvent(status('odd (build)', 'FAILURE', undefined, 'other'));
+    renderer.onEvent(status('late (build)', 'FAILURE', undefined, 'initial'));
+    renderer.onEvent(status('late (build)', 'READY'));
+    renderer.onEvent(status('late (build)', 'FAILURE', undefined, 'incremental'));
+    renderer.finish({ exitCode: 1 });
+    expect(lines().filter((line) => line.startsWith('failed: '))).toEqual([
+      'failed: again (build)',
+      'failed: odd (build)',
+      'failed: late (build) · incremental command; its next run uses the initial command'
+    ]);
+  });
+
   it('caps the reported operations, their excerpts and the names in the summary', () => {
     const { renderer, lines } = createRenderer(false);
     for (let i: number = 0; i < 8; i++) {
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r06-t149-incremental-command_2026-09-28-23-00.json b/common/changes/@rushstack/rush-cli-client/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
new file mode 100644
index 0000000000..ed281f21c5
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, say when a failed operation ran its incremental command, which can fail where the initial command would not, and that its next run uses the initial command.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r06-t149-incremental-command_2026-09-28-23-00.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
new file mode 100644
index 0000000000..feb1e1c30c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `commandKind` to operation status events, which says whether the initial or the incremental command of a failed operation, or of an operation with warnings, produced its status.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r06-t149-incremental-command_2026-09-28-23-00.json b/common/changes/@rushstack/rush-daemon/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
new file mode 100644
index 0000000000..d34d7656f5
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r06-t149-incremental-command_2026-09-28-23-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Report which command of a failed operation, or of an operation with warnings, produced its status, when the operation has an incremental command.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 8869716e27..204048a4c7 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -434,6 +434,7 @@ export interface IDaemonOperationRegisteredPayload {
 
 // @beta
 export interface IDaemonOperationStatusChangedPayload {
+    readonly commandKind?: 'initial' | 'incremental';
     readonly logFilePath?: string;
     readonly operationId: string;
     readonly previousStatus?: string;
diff --git a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
index 261a5a8c7d..d5bbb14837 100644
--- a/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonOperationPayloads.ts
@@ -37,6 +37,13 @@ export interface IDaemonOperationStatusChangedPayload {
    * warnings and wrote a log. Clients that summarize output print it so the full output can be read later.
    */
   readonly logFilePath?: string;
+  /**
+   * Which of the operation's commands produced the status, when the operation failed or succeeded with
+   * warnings and has an incremental command (a `<phase>:incremental` script) besides its initial command.
+   * An incremental command can fail where the initial command would not, so clients that summarize output
+   * say when it ran.
+   */
+  readonly commandKind?: 'initial' | 'incremental';
 }
 
 /**
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index 58988b2d59..c6ccc0e810 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -5,6 +5,8 @@ import { randomUUID } from 'node:crypto';
 
 import type { IOperationExecutionResult, Operation, _IOperationGraphEventSink } from '@microsoft/rush-lib';
 import { OperationStatus } from '@microsoft/rush-lib';
+import { getCommandExecution } from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
+import type { ICommandExecution } from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
 import {
   DAEMON_PROTOCOL_VERSION,
   RUSHD_OPERATION_HEADER,
@@ -38,6 +40,15 @@ export const TERMINAL_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set
   OperationStatus.Aborted
 ]);
 
+/**
+ * Which command produced an operation's result, for an operation that has an incremental command. Rush records
+ * the command on the execution record, which is the result that the engine reports.
+ */
+function getCommandKind(result: IOperationExecutionResult): ICommandExecution['kind'] | undefined {
+  const execution: ICommandExecution | undefined = getCommandExecution(result);
+  return execution?.hasIncrementalCommand ? execution.kind : undefined;
+}
+
 interface IObservedOperationResult {
   readonly executionResult: IOperationExecutionResult;
   readonly status: OperationStatus;
@@ -213,16 +224,18 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
       status: result.status
     });
     this.#failed ||= isFailedStatus(result.status);
-    // Summarizing clients (agent output) point at the full log of the operations that explain a failure.
-    const logFilePath: string | undefined =
-      result.status === OperationStatus.Failure || result.status === OperationStatus.SuccessWithWarning
-        ? result.logFilePaths?.text
-        : undefined;
+    // Summarizing clients (agent output) point at the full log of the operations that explain a failure, and say
+    // whether their incremental command ran, which can fail where their initial command would not.
+    const isProblem: boolean =
+      result.status === OperationStatus.Failure || result.status === OperationStatus.SuccessWithWarning;
+    const logFilePath: string | undefined = isProblem ? result.logFilePaths?.text : undefined;
+    const commandKind: ICommandExecution['kind'] | undefined = isProblem ? getCommandKind(result) : undefined;
     const payload: IDaemonOperationStatusChangedPayload = {
       operationId,
       previousStatus,
       status: result.status,
-      ...(logFilePath ? { logFilePath } : {})
+      ...(logFilePath ? { logFilePath } : {}),
+      ...(commandKind ? { commandKind } : {})
     };
     this.#emitEvent('operationStatusChanged', payload);
   }
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
index 84eb6ab80b..55bef9d4bd 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
@@ -1,8 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
+import type {
+  IDaemonEventEnvelope,
+  IDaemonOperationStatusChangedPayload
+} from '@rushstack/rush-daemon-protocol';
 import { OperationStatus, type IOperationExecutionResult } from '@microsoft/rush-lib';
+import {
+  type ICommandExecution,
+  setCommandExecution
+} from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
 
 import { PhasedRequestEventSink } from '../PhasedRequestEventSink';
 import { TestPhasedRequestClient } from './PhasedRequestRouterTestUtilities';
@@ -135,6 +142,47 @@ it('points at the full log of failed operations and operations with warnings, an
   ]);
 });
 
+it('says which command failed or reported warnings, for an operation that has an incremental command', async () => {
+  const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+  const sink: PhasedRequestEventSink = createSink(client);
+  const incremental: ICommandExecution = { kind: 'incremental', hasIncrementalCommand: true };
+  const cases: ReadonlyArray<[OperationStatus, ICommandExecution | undefined]> = [
+    [OperationStatus.Failure, incremental],
+    [OperationStatus.SuccessWithWarning, incremental],
+    [OperationStatus.Failure, { kind: 'initial', hasIncrementalCommand: true }],
+    // The runner has no incremental command, so the initial command is the only one.
+    [OperationStatus.Failure, { kind: 'initial', hasIncrementalCommand: false }],
+    // No command ran, or the runner does not report its command.
+    [OperationStatus.Failure, undefined],
+    [OperationStatus.Success, incremental],
+    [OperationStatus.Executing, incremental]
+  ];
+  for (const [status, execution] of cases) {
+    const record: IOperationExecutionResult = createRecord(ACTIVE_OPERATION, status);
+    if (execution) {
+      setCommandExecution(record, execution);
+    }
+    sink.onOperationStatusChanged(record, OperationStatus.Ready);
+  }
+
+  await sink.flushAsync();
+
+  const payloads: IDaemonOperationStatusChangedPayload[] = client.writes
+    .map(({ event }) => event)
+    .filter((event) => event?.type === 'operationStatusChanged')
+    .map((event) => event?.payload as IDaemonOperationStatusChangedPayload);
+  expect(payloads.map(({ status, commandKind }) => [status, commandKind])).toEqual([
+    ['FAILURE', 'incremental'],
+    ['SUCCESS WITH WARNINGS', 'incremental'],
+    ['FAILURE', 'initial'],
+    ['FAILURE', undefined],
+    ['FAILURE', undefined],
+    ['SUCCESS', undefined],
+    ['EXECUTING', undefined]
+  ]);
+  expect(payloads.filter((payload) => Object.keys(payload).includes('commandKind'))).toHaveLength(3);
+});
+
 const TARGET_OPERATION: string = 'project-a (_phase:test)';
 const FAILED_OPERATION: string = 'project-b (_phase:test)';
 const RUNNING_OPERATION: string = 'project-c (_phase:test)';

From 42b35f227ec51f68e89b5dc45d827db042ed7b78 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 06:15:46 +0000
Subject: [PATCH 091/265] [rush-daemon] Detect in-place output edits and nested
 output deletes

Swarm integration step 76; original commit 0eda8967aa (merge of swarm/r02-t82-int at d0eef2ea21).
Scope: task 82.

Brings r02's task 82 (board 884; re-tip board 2830): in-place output edits and nested output deletes are detected, where they gave a wrong "no op" and a consumer built on top poisoned its own cache entry. Second agents: t03 board 952, t04 board 955 and o04 board 956. It raises idle RSS until task 119 lands; coord accepted that cost for s17 in D34 (board 3423), and it merges last in D3.

s17 batch D3, item 8 of 8. Gate: ch01 GATE OK board 3747 (tree 1b18bd3257)

Commits folded into this step (3):
- 9ff625ceeb [rush-daemon] Detect in-place and nested output edits of selected warm operations (task 82)
- 3b919d17ca [rush-daemon] Walk warm operations' outputs on a worker pool (task 82 option b)
- 04dfbe72a5 [rush-daemon] Limit the young generation of output digest workers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...emon-output-contents_2026-09-28-14-55.json |  11 +
 ...n-output-digest-pool_2026-09-28-15-40.json |  11 +
 .../src/OperationOutputFingerprints.ts        | 121 +++++++-
 .../rush-daemon/src/OutputFolderDigest.ts     |  80 +++++
 .../rush-daemon/src/OutputFolderDigestPool.ts | 293 ++++++++++++++++++
 .../src/OutputFolderDigestWorker.ts           |  11 +
 .../src/test/OutputFolderDigestPool.test.ts   | 261 ++++++++++++++++
 .../ProductionDaemonRequestResolver.test.ts   |  91 ++++++
 8 files changed, 872 insertions(+), 7 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-output-contents_2026-09-28-14-55.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-output-digest-pool_2026-09-28-15-40.json
 create mode 100644 libraries/rush-daemon/src/OutputFolderDigest.ts
 create mode 100644 libraries/rush-daemon/src/OutputFolderDigestPool.ts
 create mode 100644 libraries/rush-daemon/src/OutputFolderDigestWorker.ts
 create mode 100644 libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/daemon-output-contents_2026-09-28-14-55.json b/common/changes/@rushstack/rush-daemon/daemon-output-contents_2026-09-28-14-55.json
new file mode 100644
index 0000000000..5bad66373a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-output-contents_2026-09-28-14-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Re-run or restore a selected warm operation whose declared output files were edited in place, or whose nested output files were added or deleted, instead of reporting it as a no-op and letting its consumers build against the changed outputs.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-output-digest-pool_2026-09-28-15-40.json b/common/changes/@rushstack/rush-daemon/daemon-output-digest-pool_2026-09-28-15-40.json
new file mode 100644
index 0000000000..1a7732fe6d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-output-digest-pool_2026-09-28-15-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Spread the warm daemon's output content check over a pool of worker threads once it takes long enough to matter, so a hot no-op build of a large selection stays fast.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
index 25836885af..95c9f55a94 100644
--- a/libraries/rush-daemon/src/OperationOutputFingerprints.ts
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -6,13 +6,22 @@ import * as path from 'node:path';
 
 import {
   OperationStatus,
+  type IConfigurableOperation,
   type IOperationExecutionResult,
   type IOperationGraph,
   type Operation
 } from '@microsoft/rush-lib';
 
+import type { IOutputFolderDigest, IOutputFolderSet } from './OutputFolderDigest';
+import { getSharedOutputFolderDigester, type OutputFolderDigester } from './OutputFolderDigestPool';
+
 const PLUGIN_NAME: 'DaemonOperationOutputFingerprints' = 'DaemonOperationOutputFingerprints';
 
+/**
+ * Runs after Rush's incremental decision, which taps `configureIteration` at the default stage.
+ */
+const CONFIGURE_ITERATION_STAGE: number = 100;
+
 /**
  * Retained results that allow the warm graph to skip an operation. Other statuses always re-run. The graph only
  * retains a `Skipped` result for an operation that it selected, when a plugin (e.g. change detection) found its
@@ -27,6 +36,27 @@ const TRACKED_STATUSES: ReadonlySet<OperationStatus> = new Set([
 interface IOutputFingerprint {
   readonly record: IOperationExecutionResult;
   readonly fingerprint: string;
+  /** Undefined if the outputs could not be read when recorded; that never matches. */
+  readonly contentFingerprint: string | undefined;
+  /** The number of entries below the output folders when recorded. */
+  readonly entryCount: number;
+}
+
+interface IContentWalk {
+  readonly operation: Operation;
+  readonly folderSet: IOutputFolderSet;
+  /** The expected size of the walk, so that the largest walks start first. */
+  readonly entryCount: number;
+}
+
+interface ISkipCheck extends IContentWalk {
+  readonly state: IConfigurableOperation;
+  readonly contentFingerprint: string;
+}
+
+interface IRecordWalk extends IContentWalk {
+  readonly record: IOperationExecutionResult;
+  readonly fingerprint: string;
 }
 
 /**
@@ -35,17 +65,35 @@ interface IOutputFingerprint {
  *
  * @remarks
  * Build outputs are normally git-ignored, so they do not contribute to any operation state hash. Without
- * this check, deleting an output folder (`rm -rf lib`, `git clean -xdf`, `heft clean`) leaves a warm graph
- * that reports the operation as up to date. The fingerprint is deliberately cheap: one `stat` per declared
- * output folder, capturing existence, identity and modification time. This detects deletion, recreation,
- * and adding, removing or renaming direct children; it does not detect in-place edits of nested files.
+ * this check, a warm graph reports an operation as up to date after its outputs were deleted (`rm -rf lib`,
+ * `git clean -xdf`, `heft clean`) or edited, and a consumer that runs on top of edited outputs stores them
+ * in its own build cache entry. There are two checks:
+ *
+ * - On every reconciliation, one `stat` per declared output folder of every retained operation, capturing
+ *   existence, identity and modification time. This detects deleting or recreating a folder, and adding,
+ *   removing or renaming its direct children.
+ *
+ * - When an iteration is configured, a walk of the declared output folders of each selected operation that
+ *   Rush would otherwise skip. It compares the relative path of every nested entry and the size,
+ *   modification time and identity of every entry that is not a folder. This also detects in-place edits
+ *   and nested additions, deletions and renames. Its cost grows with the output files of the request's
+ *   selection, not with the whole warm graph. Once a walk takes long enough to matter, walks are spread
+ *   over a pool of worker threads (see {@link OutputFolderDigester}).
  */
 export class OperationOutputFingerprints {
+  readonly #digester: OutputFolderDigester;
   readonly #fingerprints: Map<Operation, IOutputFingerprint> = new Map();
   readonly #graph: IOperationGraph;
 
-  public constructor(graph: IOperationGraph) {
+  public constructor(graph: IOperationGraph, digester: OutputFolderDigester = getSharedOutputFolderDigester()) {
+    this.#digester = digester;
     this.#graph = graph;
+    graph.hooks.configureIteration.tap(
+      { name: PLUGIN_NAME, stage: CONFIGURE_ITERATION_STAGE },
+      (currentStates: ReadonlyMap<Operation, IConfigurableOperation>) => {
+        this.#enableOperationsWithChangedContents(currentStates);
+      }
+    );
     graph.hooks.afterExecuteIterationAsync.tap(
       PLUGIN_NAME,
       (status: OperationStatus, records: ReadonlyMap<Operation, IOperationExecutionResult>) => {
@@ -80,19 +128,66 @@ export class OperationOutputFingerprints {
     return changed;
   }
 
+  /**
+   * Enables each selected operation that Rush would skip if any entry below its output folders changed.
+   *
+   * @remarks
+   * The recorded fingerprint is kept until the operation produces a new retained result, so an iteration
+   * that ends before the operation runs leaves the check in place for the next request.
+   */
+  #enableOperationsWithChangedContents(currentStates: ReadonlyMap<Operation, IConfigurableOperation>): void {
+    const checks: ISkipCheck[] = [];
+    for (const [operation, state] of currentStates) {
+      if (state.enabled || !operation.enabled) {
+        continue;
+      }
+      const entry: IOutputFingerprint | undefined = this.#fingerprints.get(operation);
+      if (!entry || !this.#isRetained(operation, entry.record)) {
+        continue;
+      }
+      const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+      const { contentFingerprint, entryCount } = entry;
+      if (!folderSet || contentFingerprint === undefined) {
+        enableOperation(operation, state);
+      } else {
+        checks.push({ operation, folderSet, entryCount, state, contentFingerprint });
+      }
+    }
+    const digests: IOutputFolderDigest[] = this.#digestLargestFirst(checks);
+    checks.forEach(({ operation, state, contentFingerprint }: ISkipCheck, index: number) => {
+      if (digests[index].digest !== contentFingerprint) {
+        enableOperation(operation, state);
+      }
+    });
+  }
+
   #recordIteration(records: ReadonlyMap<Operation, IOperationExecutionResult>): void {
+    const walks: IRecordWalk[] = [];
     for (const [operation, record] of records) {
       // Only records produced by this iteration become the retained result; disabled operations keep
       // their earlier record and fingerprint.
       if (this.#isRetained(operation, record)) {
         const fingerprint: string | undefined = getOutputFingerprint(operation);
-        if (fingerprint === undefined) {
+        const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+        if (fingerprint === undefined || folderSet === undefined) {
           this.#fingerprints.delete(operation);
         } else {
-          this.#fingerprints.set(operation, { record, fingerprint });
+          const entryCount: number = this.#fingerprints.get(operation)?.entryCount ?? 0;
+          walks.push({ operation, folderSet, entryCount, record, fingerprint });
         }
       }
     }
+    const digests: IOutputFolderDigest[] = this.#digestLargestFirst(walks);
+    walks.forEach(({ operation, record, fingerprint }: IRecordWalk, index: number) => {
+      const { digest: contentFingerprint, entryCount } = digests[index];
+      this.#fingerprints.set(operation, { record, fingerprint, contentFingerprint, entryCount });
+    });
+  }
+
+  /** Sorts the walks by their expected size, largest first, and returns their digests in that order. */
+  #digestLargestFirst(walks: IContentWalk[]): IOutputFolderDigest[] {
+    walks.sort((left: IContentWalk, right: IContentWalk) => right.entryCount - left.entryCount);
+    return this.#digester.digest(walks.map(({ folderSet }: IContentWalk) => folderSet));
   }
 
   #isRetained(operation: Operation, record: IOperationExecutionResult): boolean {
@@ -100,6 +195,11 @@ export class OperationOutputFingerprints {
   }
 }
 
+function enableOperation(operation: Operation, state: IConfigurableOperation): void {
+  forgetLegacySkipState(operation);
+  state.enabled = true;
+}
+
 /**
  * Without a build cache, Rush's legacy skip detection reports an operation as skipped when its recorded
  * input state is unchanged, even though its outputs are gone. Remove that record (as the legacy skip logic
@@ -130,3 +230,10 @@ function getOutputFingerprint(operation: Operation): string | undefined {
     })
     .join('|');
 }
+
+function getOutputFolderSet(operation: Operation): IOutputFolderSet | undefined {
+  const folderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
+  return folderNames?.length
+    ? { projectFolder: operation.associatedProject.projectFolder, folderNames: [...folderNames] }
+    : undefined;
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigest.ts b/libraries/rush-daemon/src/OutputFolderDigest.ts
new file mode 100644
index 0000000000..2ff613c120
--- /dev/null
+++ b/libraries/rush-daemon/src/OutputFolderDigest.ts
@@ -0,0 +1,80 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, type Hash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** The declared output folders of one operation. */
+export interface IOutputFolderSet {
+  /** The absolute path of the project folder that the folder names are relative to. */
+  readonly projectFolder: string;
+  readonly folderNames: ReadonlyArray<string>;
+}
+
+/** The content digest of one {@link IOutputFolderSet}. */
+export interface IOutputFolderDigest {
+  /**
+   * Undefined if the folders could not be read (for example, because an entry was deleted during the walk).
+   * An undefined digest never matches.
+   */
+  readonly digest: string | undefined;
+  /** The number of entries that were read, which callers use to start the largest walks first. */
+  readonly entryCount: number;
+}
+
+interface IWalkState {
+  readonly hash: Hash;
+  entryCount: number;
+}
+
+/**
+ * Digests every entry below the given output folders: the sorted relative path of each nested entry, and the
+ * size, modification time and identity of each entry that is not a folder.
+ *
+ * @remarks
+ * Folder modification times are left out, because the sorted listing already captures added and removed
+ * entries. Symbolic links are recorded, not followed.
+ */
+export function digestOutputFolders({ projectFolder, folderNames }: IOutputFolderSet): IOutputFolderDigest {
+  const state: IWalkState = { hash: createHash('sha1'), entryCount: 0 };
+  try {
+    for (const folderName of folderNames) {
+      const folderPath: string = path.resolve(projectFolder, folderName);
+      const stats: fs.Stats | undefined = fs.statSync(folderPath, { throwIfNoEntry: false });
+      if (!stats) {
+        state.hash.update(`${folderName}\0missing\n`);
+      } else if (stats.isDirectory()) {
+        state.hash.update(`${folderName}\0folder\0${stats.ino}\n`);
+        addFolderEntries(state, folderPath, `${folderName}/`);
+      } else {
+        state.hash.update(`${folderName}\0${describeEntry(stats)}\n`);
+      }
+    }
+  } catch {
+    return { digest: undefined, entryCount: state.entryCount };
+  }
+  return { digest: state.hash.digest('hex'), entryCount: state.entryCount };
+}
+
+function addFolderEntries(state: IWalkState, folderPath: string, relativePrefix: string): void {
+  const entries: fs.Dirent[] = fs.readdirSync(folderPath, { withFileTypes: true });
+  entries.sort((left: fs.Dirent, right: fs.Dirent) =>
+    left.name < right.name ? -1 : left.name > right.name ? 1 : 0
+  );
+  state.entryCount += entries.length;
+  for (const entry of entries) {
+    const entryPath: string = path.join(folderPath, entry.name);
+    const relativePath: string = `${relativePrefix}${entry.name}`;
+    if (entry.isDirectory()) {
+      state.hash.update(`${relativePath}\0folder\n`);
+      addFolderEntries(state, entryPath, `${relativePath}/`);
+    } else {
+      state.hash.update(`${relativePath}\0${describeEntry(fs.lstatSync(entryPath))}\n`);
+    }
+  }
+}
+
+function describeEntry(stats: fs.Stats): string {
+  return `${stats.isSymbolicLink() ? 'link' : 'file'}\0${stats.size}\0${stats.mtimeMs}\0${stats.ino}`;
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigestPool.ts b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
new file mode 100644
index 0000000000..24ce9e75f6
--- /dev/null
+++ b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
@@ -0,0 +1,293 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { MessageChannel, receiveMessageOnPort, Worker, type MessagePort } from 'node:worker_threads';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from './OutputFolderDigest';
+
+/** Slot of a job's shared state that holds the index of the next folder set to claim. */
+const NEXT_INDEX_SLOT: number = 0;
+/** Slot of a job's shared state that counts the folder sets whose digest was published. */
+const COMPLETED_COUNT_SLOT: number = 1;
+const JOB_STATE_SLOT_COUNT: number = 2;
+
+/** How often a waiting caller checks whether the workers still make progress. */
+const WAIT_SLICE_MS: number = 1000;
+/**
+ * Every thread publishes a digest every few milliseconds, so this long without any progress means a worker
+ * died after claiming a folder set. Stopping the pool then only costs speed.
+ */
+const DEFAULT_STALL_TIMEOUT_MS: number = 10000;
+
+/** A digest on the calling thread that takes longer than this starts a pool for later digests. */
+const POOL_START_THRESHOLD_MS: number = 50;
+const MAX_POOL_THREAD_COUNT: number = 7;
+/**
+ * A walk allocates only short-lived objects. With the default young generation, each worker's heap keeps
+ * growing over repeated digests (by about 150 MB per worker at repo scale), while this size keeps the same
+ * speed.
+ */
+export const WORKER_MAX_YOUNG_GENERATION_SIZE_MB: number = 4;
+
+interface IOutputFolderDigestJob {
+  readonly jobId: number;
+  readonly folderSets: ReadonlyArray<IOutputFolderSet>;
+  readonly state: Int32Array;
+}
+
+/** `[jobId, index, digest]` */
+type OutputFolderDigestResult = readonly [number, number, IOutputFolderDigest];
+
+/** The `workerData` of a pool worker. */
+export interface IOutputFolderDigestWorkerData {
+  readonly resultPort: MessagePort;
+}
+
+/** Options for {@link OutputFolderDigestPool}. */
+export interface IOutputFolderDigestPoolOptions {
+  readonly threadCount: number;
+  /** Defaults to the compiled `OutputFolderDigestWorker.js` next to this module. */
+  readonly workerScriptPath?: string;
+  /**
+   * How long a caller waits for claimed folder sets without progress before it digests them itself and
+   * stops the pool. Defaults to 10 seconds.
+   */
+  readonly stallTimeoutMs?: number;
+  /** Whether the calling thread claims folder sets too, rather than only waiting. Defaults to `true`. */
+  readonly claimOnCallingThread?: boolean;
+}
+
+/** Options for {@link OutputFolderDigester}. */
+export interface IOutputFolderDigesterOptions {
+  /** Defaults to one less than the available parallelism, at most 7. Zero never starts a pool. */
+  readonly threadCount?: number;
+  /** A digest on the calling thread that takes longer than this starts the pool. Defaults to 50 ms. */
+  readonly poolStartThresholdMs?: number;
+}
+
+interface IPoolThread {
+  readonly worker: Worker;
+  readonly resultPort: MessagePort;
+}
+
+/** Serves the jobs of an {@link OutputFolderDigestPool}; runs in each pool worker. */
+export function serveOutputFolderDigestJobs(jobPort: MessagePort, resultPort: MessagePort): void {
+  jobPort.on('message', ({ jobId, folderSets, state }: IOutputFolderDigestJob) => {
+    claimAndDigest(folderSets, state, (index: number, digest: IOutputFolderDigest) => {
+      const result: OutputFolderDigestResult = [jobId, index, digest];
+      resultPort.postMessage(result);
+    });
+  });
+}
+
+/**
+ * Digests output folder sets on the calling thread and a set of worker threads together.
+ *
+ * @remarks
+ * `digest` is synchronous, so it can run inside the synchronous `configureIteration` hook. The calling thread
+ * claims folder sets the same way the workers do, then blocks in `Atomics.wait` until the folder sets that
+ * workers claimed are published, and reads them with `receiveMessageOnPort`. A walk is dominated by `readdir`
+ * and `lstat` system calls, so it shortens roughly in proportion to the number of threads. If the workers
+ * never start or stop making progress, the calling thread digests what is left, so the results always equal
+ * {@link digestOutputFolders}.
+ */
+export class OutputFolderDigestPool {
+  readonly #threads: IPoolThread[] = [];
+  readonly #stallTimeoutMs: number;
+  readonly #claimOnCallingThread: boolean;
+  #nextJobId: number = 0;
+  #stalled: boolean = false;
+
+  public constructor({
+    threadCount,
+    workerScriptPath = path.join(__dirname, 'OutputFolderDigestWorker.js'),
+    stallTimeoutMs = DEFAULT_STALL_TIMEOUT_MS,
+    claimOnCallingThread = true
+  }: IOutputFolderDigestPoolOptions) {
+    this.#stallTimeoutMs = stallTimeoutMs;
+    this.#claimOnCallingThread = claimOnCallingThread;
+    try {
+      for (let threadIndex: number = 0; threadIndex < threadCount; threadIndex++) {
+        const { port1, port2 } = new MessageChannel();
+        const workerData: IOutputFolderDigestWorkerData = { resultPort: port2 };
+        const worker: Worker = new Worker(workerScriptPath, {
+          workerData,
+          transferList: [port2],
+          resourceLimits: { maxYoungGenerationSizeMb: WORKER_MAX_YOUNG_GENERATION_SIZE_MB }
+        });
+        // Workers never keep the daemon alive. A worker that fails leaves its claims to the caller.
+        worker.unref();
+        worker.on('error', () => undefined);
+        this.#threads.push({ worker, resultPort: port1 });
+      }
+    } catch (error) {
+      this.dispose();
+      throw error;
+    }
+  }
+
+  /**
+   * Whether the pool no longer uses its workers, because they stopped making progress or the pool was
+   * disposed. The calling thread then digests everything.
+   */
+  public get stalled(): boolean {
+    return this.#stalled;
+  }
+
+  /** Returns the digest of each folder set, in order. */
+  public digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+    const results: (IOutputFolderDigest | undefined)[] = new Array(folderSets.length);
+    const state: Int32Array = new Int32Array(
+      new SharedArrayBuffer(JOB_STATE_SLOT_COUNT * Int32Array.BYTES_PER_ELEMENT)
+    );
+    const jobId: number = ++this.#nextJobId;
+    const parallel: boolean = !this.#stalled && (folderSets.length > 1 || !this.#claimOnCallingThread);
+    if (parallel) {
+      const job: IOutputFolderDigestJob = { jobId, folderSets, state };
+      for (const { worker } of this.#threads) {
+        worker.postMessage(job);
+      }
+    }
+    if (this.#claimOnCallingThread || !parallel) {
+      claimAndDigest(folderSets, state, (index: number, digest: IOutputFolderDigest) => {
+        results[index] = digest;
+      });
+    }
+    if (parallel) {
+      this.#waitForClaimedFolderSets(state, folderSets.length);
+      this.#receiveResults(jobId, results);
+    }
+    if (this.#stalled) {
+      this.dispose();
+    }
+    return folderSets.map(
+      (folderSet: IOutputFolderSet, index: number) => results[index] ?? digestOutputFolders(folderSet)
+    );
+  }
+
+  /** Stops the workers. Later digests run on the calling thread. */
+  public dispose(): void {
+    this.#stalled = true;
+    for (const { worker, resultPort } of this.#threads.splice(0)) {
+      resultPort.close();
+      void worker.terminate();
+    }
+  }
+
+  #waitForClaimedFolderSets(state: Int32Array, count: number): void {
+    let completed: number = Atomics.load(state, COMPLETED_COUNT_SLOT);
+    let progressTimeMs: number = performance.now();
+    while (completed < count) {
+      Atomics.wait(state, COMPLETED_COUNT_SLOT, completed, Math.min(WAIT_SLICE_MS, this.#stallTimeoutMs));
+      const current: number = Atomics.load(state, COMPLETED_COUNT_SLOT);
+      if (current !== completed) {
+        completed = current;
+        progressTimeMs = performance.now();
+      } else if (performance.now() - progressTimeMs >= this.#stallTimeoutMs) {
+        this.#stalled = true;
+        return;
+      }
+    }
+  }
+
+  #receiveResults(jobId: number, results: (IOutputFolderDigest | undefined)[]): void {
+    for (const { resultPort } of this.#threads) {
+      for (
+        let received: { message: unknown } | undefined = receiveMessageOnPort(resultPort);
+        received !== undefined;
+        received = receiveMessageOnPort(resultPort)
+      ) {
+        const [resultJobId, index, digest] = received.message as OutputFolderDigestResult;
+        // Results of an earlier job that stalled are dropped.
+        if (resultJobId === jobId) {
+          results[index] = digest;
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Digests output folder sets on the calling thread until one call takes longer than a threshold, and through
+ * an {@link OutputFolderDigestPool} after that, so a workspace with small outputs never starts threads.
+ */
+export class OutputFolderDigester {
+  readonly #poolStartThresholdMs: number;
+  #threadCount: number;
+  #pool: OutputFolderDigestPool | undefined;
+
+  public constructor({
+    threadCount = getDefaultThreadCount(),
+    poolStartThresholdMs = POOL_START_THRESHOLD_MS
+  }: IOutputFolderDigesterOptions = {}) {
+    this.#threadCount = threadCount;
+    this.#poolStartThresholdMs = poolStartThresholdMs;
+  }
+
+  /** Whether later digests use worker threads. */
+  public get isParallel(): boolean {
+    return this.#pool !== undefined && !this.#pool.stalled;
+  }
+
+  /** Returns the digest of each folder set, in order. */
+  public digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+    if (this.#pool && !this.#pool.stalled) {
+      return this.#pool.digest(folderSets);
+    }
+    const startTimeMs: number = performance.now();
+    const digests: IOutputFolderDigest[] = folderSets.map((folderSet: IOutputFolderSet) =>
+      digestOutputFolders(folderSet)
+    );
+    if (
+      !this.#pool &&
+      this.#threadCount > 0 &&
+      folderSets.length > 1 &&
+      performance.now() - startTimeMs > this.#poolStartThresholdMs
+    ) {
+      try {
+        this.#pool = new OutputFolderDigestPool({ threadCount: this.#threadCount });
+      } catch {
+        this.#threadCount = 0;
+      }
+    }
+    return digests;
+  }
+
+  /** Stops the pool, if one was started. Later digests run on the calling thread. */
+  public dispose(): void {
+    this.#threadCount = 0;
+    this.#pool?.dispose();
+  }
+}
+
+let sharedDigester: OutputFolderDigester | undefined;
+
+/** The process-wide digester, so that every warm graph of the daemon shares one pool. */
+export function getSharedOutputFolderDigester(): OutputFolderDigester {
+  sharedDigester ??= new OutputFolderDigester();
+  return sharedDigester;
+}
+
+/** Claims folder sets one at a time until none are left, and publishes each digest before counting it. */
+function claimAndDigest(
+  folderSets: ReadonlyArray<IOutputFolderSet>,
+  state: Int32Array,
+  publish: (index: number, digest: IOutputFolderDigest) => void
+): void {
+  for (
+    let index: number = Atomics.add(state, NEXT_INDEX_SLOT, 1);
+    index < folderSets.length;
+    index = Atomics.add(state, NEXT_INDEX_SLOT, 1)
+  ) {
+    publish(index, digestOutputFolders(folderSets[index]));
+    Atomics.add(state, COMPLETED_COUNT_SLOT, 1);
+    Atomics.notify(state, COMPLETED_COUNT_SLOT);
+  }
+}
+
+function getDefaultThreadCount(): number {
+  const parallelism: number = os.availableParallelism?.() ?? os.cpus().length;
+  return Math.max(0, Math.min(MAX_POOL_THREAD_COUNT, parallelism - 1));
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigestWorker.ts b/libraries/rush-daemon/src/OutputFolderDigestWorker.ts
new file mode 100644
index 0000000000..a2abd576c2
--- /dev/null
+++ b/libraries/rush-daemon/src/OutputFolderDigestWorker.ts
@@ -0,0 +1,11 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { parentPort, workerData } from 'node:worker_threads';
+
+import { serveOutputFolderDigestJobs, type IOutputFolderDigestWorkerData } from './OutputFolderDigestPool';
+
+// The entry point of each OutputFolderDigestPool worker.
+if (parentPort) {
+  serveOutputFolderDigestJobs(parentPort, (workerData as IOutputFolderDigestWorkerData).resultPort);
+}
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
new file mode 100644
index 0000000000..cb82f610f6
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
@@ -0,0 +1,261 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import {
+  OutputFolderDigestPool,
+  OutputFolderDigester,
+  WORKER_MAX_YOUNG_GENERATION_SIZE_MB
+} from '../OutputFolderDigestPool';
+
+const PROJECT_COUNT: number = 12;
+
+function createProjects(root: string): IOutputFolderSet[] {
+  const folderSets: IOutputFolderSet[] = [];
+  for (let projectIndex: number = 0; projectIndex < PROJECT_COUNT; projectIndex++) {
+    const projectFolder: string = path.join(root, `project-${projectIndex}`);
+    for (let fileIndex: number = 0; fileIndex <= projectIndex; fileIndex++) {
+      const folderPath: string = path.join(projectFolder, 'lib', `folder-${fileIndex % 3}`, 'nested');
+      fs.mkdirSync(folderPath, { recursive: true });
+      fs.writeFileSync(path.join(folderPath, `file-${fileIndex}.js`), `// ${projectIndex}:${fileIndex}\n`);
+    }
+    fs.mkdirSync(path.join(projectFolder, 'dist'), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'bundle.js'), 'bundle\n');
+    fs.symlinkSync('bundle.js', path.join(projectFolder, 'dist', 'link.js'));
+    fs.writeFileSync(path.join(projectFolder, 'lib.d.ts'), 'export {};\n');
+    folderSets.push({ projectFolder, folderNames: ['lib', 'dist', 'lib.d.ts', 'missing'] });
+  }
+  return folderSets;
+}
+
+function digestOnCallingThread(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+  return folderSets.map((folderSet: IOutputFolderSet) => digestOutputFolders(folderSet));
+}
+
+describe(OutputFolderDigestPool.name, () => {
+  let root: string;
+  let folderSets: IOutputFolderSet[];
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-digest-'));
+    folderSets = createProjects(root);
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('returns the digests of the calling thread when only workers claim folder sets', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 3,
+      claimOnCallingThread: false
+    });
+    try {
+      const expected: IOutputFolderDigest[] = digestOnCallingThread(folderSets);
+      expect(new Set(expected.map(({ digest }: IOutputFolderDigest) => digest)).size).toBe(PROJECT_COUNT);
+      expect(expected[PROJECT_COUNT - 1].entryCount).toBeGreaterThan(expected[0].entryCount);
+      expect(pool.digest(folderSets)).toEqual(expected);
+
+      // Same size and identity, later modification time, nested three levels down.
+      const editedFile: string = path.join(folderSets[5].projectFolder, 'lib', 'folder-2', 'nested', 'file-2.js');
+      const { size, ino, mtimeMs } = fs.statSync(editedFile);
+      fs.writeFileSync(editedFile, '// 5:X\n');
+      fs.utimesSync(editedFile, new Date(), new Date(mtimeMs + 5000));
+      expect(fs.statSync(editedFile)).toMatchObject({ size, ino });
+
+      const edited: IOutputFolderDigest[] = pool.digest(folderSets);
+      expect(edited).toEqual(digestOnCallingThread(folderSets));
+      expect(
+        edited.flatMap(({ digest }: IOutputFolderDigest, index: number) =>
+          digest === expected[index].digest ? [] : [index]
+        )
+      ).toEqual([5]);
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('shares folder sets between the calling thread and the workers', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({ threadCount: 2 });
+    try {
+      for (let attempt: number = 0; attempt < 3; attempt++) {
+        expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      }
+      expect(pool.digest([])).toEqual([]);
+      expect(pool.digest(folderSets.slice(0, 1))).toEqual(digestOnCallingThread(folderSets.slice(0, 1)));
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it("uses the results that workers publish for the caller's job only", () => {
+    // Publishes marked digests late, then digests with the same indexes for an earlier job.
+    const markingWorkerPath: string = path.join(root, 'marking-worker.js');
+    fs.writeFileSync(
+      markingWorkerPath,
+      [
+        "const { parentPort, workerData } = require('node:worker_threads');",
+        `const { digestOutputFolders } = require(${JSON.stringify(require.resolve('../OutputFolderDigest'))});`,
+        'const delay = new Int32Array(new SharedArrayBuffer(4));',
+        'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+        '  Atomics.wait(delay, 0, 0, 100);',
+        '  const claimed = [];',
+        '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+        '    const { digest, entryCount } = digestOutputFolders(folderSets[index]);',
+        '    workerData.resultPort.postMessage([jobId, index, { digest: `worker:${digest}`, entryCount }]);',
+        '    claimed.push(index);',
+        '  }',
+        '  for (const index of claimed) {',
+        "    workerData.resultPort.postMessage([jobId - 1, index, { digest: 'earlier job', entryCount: 0 }]);",
+        '  }',
+        '  Atomics.add(state, 1, claimed.length);',
+        '  Atomics.notify(state, 1);',
+        '});'
+      ].join('\n')
+    );
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 2,
+      workerScriptPath: markingWorkerPath,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(
+        digestOnCallingThread(folderSets).map(({ digest, entryCount }: IOutputFolderDigest) => ({
+          digest: `worker:${digest}`,
+          entryCount
+        }))
+      );
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('digests folder sets that stalled workers claimed on the calling thread', () => {
+    // Claims every folder set and never publishes a result.
+    const stalledWorkerPath: string = path.join(root, 'stalled-worker.js');
+    fs.writeFileSync(
+      stalledWorkerPath,
+      [
+        "const { parentPort } = require('node:worker_threads');",
+        'parentPort.on("message", ({ folderSets, state }) => {',
+        '  while (Atomics.add(state, 0, 1) < folderSets.length) {}',
+        '});'
+      ].join('\n')
+    );
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 1,
+      workerScriptPath: stalledWorkerPath,
+      stallTimeoutMs: 200,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(pool.stalled).toBe(true);
+      // Later digests don't wait for the workers again.
+      const startTimeMs: number = performance.now();
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(performance.now() - startTimeMs).toBeLessThan(200);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('limits the young generation of each worker', () => {
+    // Publishes the worker's own young generation limit as the digest of every folder set it claims.
+    const limitsWorkerPath: string = path.join(root, 'limits-worker.js');
+    fs.writeFileSync(
+      limitsWorkerPath,
+      [
+        "const { parentPort, resourceLimits, workerData } = require('node:worker_threads');",
+        'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+        '  let count = 0;',
+        '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+        '    const digest = `young:${resourceLimits.maxYoungGenerationSizeMb}`;',
+        '    workerData.resultPort.postMessage([jobId, index, { digest, entryCount: 0 }]);',
+        '    count++;',
+        '  }',
+        '  Atomics.add(state, 1, count);',
+        '  Atomics.notify(state, 1);',
+        '});'
+      ].join('\n')
+    );
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 2,
+      workerScriptPath: limitsWorkerPath,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(new Set(pool.digest(folderSets).map(({ digest }: IOutputFolderDigest) => digest))).toEqual(
+        new Set([`young:${WORKER_MAX_YOUNG_GENERATION_SIZE_MB}`])
+      );
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+});
+
+describe(OutputFolderDigester.name, () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-digester-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('starts a pool only after a digest on the calling thread takes longer than the threshold', () => {
+    const folderSets: IOutputFolderSet[] = createProjects(root);
+    const serial: OutputFolderDigester = new OutputFolderDigester({ threadCount: 2 });
+    expect(serial.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    expect(serial.isParallel).toBe(false);
+
+    const parallel: OutputFolderDigester = new OutputFolderDigester({ threadCount: 2, poolStartThresholdMs: -1 });
+    try {
+      expect(parallel.digest(folderSets.slice(0, 1))).toEqual(digestOnCallingThread(folderSets.slice(0, 1)));
+      expect(parallel.isParallel).toBe(false);
+      expect(parallel.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(parallel.isParallel).toBe(true);
+      expect(parallel.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    } finally {
+      parallel.dispose();
+    }
+    expect(parallel.isParallel).toBe(false);
+    expect(parallel.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+
+    const disabled: OutputFolderDigester = new OutputFolderDigester({ threadCount: 0, poolStartThresholdMs: -1 });
+    expect(disabled.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    expect(disabled.isParallel).toBe(false);
+  });
+
+  it('does not keep the process alive', () => {
+    const folderSets: IOutputFolderSet[] = createProjects(root);
+    const script: string = [
+      `const { OutputFolderDigester } = require(${JSON.stringify(require.resolve('../OutputFolderDigestPool'))});`,
+      'const folderSets = JSON.parse(process.argv[1]);',
+      'const digester = new OutputFolderDigester({ threadCount: 2, poolStartThresholdMs: -1 });',
+      'digester.digest(folderSets);',
+      'const digests = digester.digest(folderSets);',
+      'process.stdout.write(JSON.stringify({ isParallel: digester.isParallel, digests }));'
+    ].join('\n');
+    const result: SpawnSyncReturns<string> = spawnSync(
+      process.execPath,
+      ['-e', script, JSON.stringify(folderSets)],
+      { encoding: 'utf8', timeout: 10000 }
+    );
+    expect(result).toMatchObject({ status: 0, signal: null, stderr: '' });
+    expect(JSON.parse(result.stdout)).toEqual({
+      isParallel: true,
+      digests: digestOnCallingThread(folderSets)
+    });
+  }, 20000);
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index d98b5f0340..e5f6077fd5 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1444,6 +1444,97 @@ process.exit(23);
     }
   });
 
+  it('re-runs a selected warm operation whose nested outputs were edited in place or deleted', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toEqual(expect.arrayContaining(['a:one:', 'b:one:', 'c:one:']));
+      const libPath: string = path.join(fixture.repoRoot, 'projects/a/lib');
+      const outputPath: string = path.join(libPath, 'output.txt');
+      const { ino, mtimeMs: libModifiedMs } = fs.statSync(outputPath);
+      const libFolderModifiedMs: number = fs.statSync(libPath).mtimeMs;
+      fs.writeFileSync(outputPath, 'edited in place');
+      // Neither the output folder nor the file identity changes, so the per-folder check cannot see this.
+      expect(fs.statSync(outputPath).ino).toBe(ino);
+      expect(fs.statSync(outputPath).mtimeMs).not.toBe(libModifiedMs);
+      expect(fs.statSync(libPath).mtimeMs).toBe(libFolderModifiedMs);
+      expect((await runAsync(fixture, 'unrelated', ['build', '--only', 'c'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect((await runAsync(fixture, 'edited', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3)).toEqual(['a:one:']);
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('one');
+
+      fs.mkdirSync(path.join(libPath, 'nested'));
+      fs.writeFileSync(path.join(libPath, 'nested/stale.txt'), 'stale');
+      expect((await runAsync(fixture, 'added', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(4)).toEqual(['a:one:']);
+      const addedFolderModifiedMs: number = fs.statSync(libPath).mtimeMs;
+      fs.rmSync(path.join(libPath, 'nested/stale.txt'));
+      expect(fs.statSync(libPath).mtimeMs).toBe(addedFolderModifiedMs);
+      expect((await runAsync(fixture, 'deleted', ['build', '--to', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(5)).toEqual(['a:one:']);
+      expect((await runAsync(fixture, 'unchanged', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(runs(fixture)).toHaveLength(6);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('restores an output edited in place from the build cache before a consumer embeds it', async () => {
+    const fixture: IFixture = await createFixtureAsync(true);
+    try {
+      // Like a bundler, b's output embeds a's output.
+      fs.writeFileSync(
+        path.join(fixture.repoRoot, 'projects/b/build.cjs'),
+        `
+const fs = require('node:fs');
+const input = fs.readFileSync('input.txt', 'utf8');
+fs.appendFileSync('../../runs.txt', 'b:' + input + ':\\n');
+fs.mkdirSync('lib', { recursive: true });
+fs.writeFileSync('lib/output.txt', input + '+' + fs.readFileSync('../a/lib/output.txt', 'utf8'));
+`
+      );
+      await runAsync(fixture, 'initial', ['build', '--to', 'b']);
+      const outputPath: string = path.join(fixture.repoRoot, 'projects/b/lib/output.txt');
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('one+one');
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'edited in place');
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/b/input.txt'), 'two');
+      const edited: ITerminalExchange = await runAsync(fixture, 'edited', ['build', '--to', 'b']);
+      expect(edited.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { operationResults } = (edited.terminal as { payload: IDaemonPhasedRequestResult }).payload;
+      expect(operationResults).toEqual([
+        expect.objectContaining({ operationId: 'a (compile)', status: 'FROM CACHE' }),
+        expect.objectContaining({ operationId: 'b (compile)', status: 'SUCCESS' })
+      ]);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'utf8')).toBe('one');
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('two+one');
+      // The consumer's new cache entry holds the restored output, not the edited one.
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/b/lib'), { recursive: true });
+      const restored: ITerminalExchange = await runAsync(fixture, 'restored', ['build', '--to', 'b']);
+      expect((restored.terminal as { payload: IDaemonPhasedRequestResult }).payload.operationResults).toEqual(
+        expect.arrayContaining([expect.objectContaining({ operationId: 'b (compile)', status: 'FROM CACHE' })])
+      );
+      expect(fs.readFileSync(outputPath, 'utf8')).toBe('two+one');
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'b:two:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('reconciles changes made without a connected client and preserves an empty native selection', async () => {
     const fixture: IFixture = await createFixtureAsync();
     let reconnected: DaemonRequestWireClient | undefined;

From e5c75f1ed2a2a886f8b9c6ec3d41cd1c305f22f0 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:53 +0000
Subject: [PATCH 092/265] [rush-cli-client] Say why a command runs in-process,
 keep the user's flags there, and send `rush -q <command>` to the daemon

Swarm integration step 77; original commit 59f096cfc5 (merge of swarm/r04-t60 at 6949891851).
Refs: tasks 60 and 36.
Scope: 60 + 36.

Brings 60 + 36 (branch swarm/r04-t60). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 1 of 18. Gate: ch01 GATE OK board 4131 (tree 330bc72f83)

Commits folded into this step (1):
- 6949891851 Say why a command runs in-process, keep the user's flags there, and send `rush -q <command>` to the daemon (tasks 60 and 36)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  23 ++-
 .../src/AgentProgressRenderer.ts              |   8 +-
 apps/rush-cli-client/src/earlyRouting.ts      |  89 ++++++++++
 apps/rush-cli-client/src/inProcessFallback.ts |  10 +-
 apps/rush-cli-client/src/launchClient.ts      |  33 +++-
 apps/rush-cli-client/src/outputSelection.ts   |   9 +-
 apps/rush-cli-client/src/routing.ts           | 118 +++++++-----
 apps/rush-cli-client/src/start.ts             |   6 +-
 .../src/test/AgentProgressRenderer.test.ts    |  29 +++
 .../src/test/ClientAdmissionControls.test.ts  |   1 +
 .../src/test/RushXTerminal.test.ts            |   8 +-
 .../src/test/earlyRouting.test.ts             |  61 +++++++
 .../src/test/inProcessFallback.test.ts        |   6 +
 .../src/test/launchClient.test.ts             | 116 +++++++++++-
 .../src/test/outputSelection.test.ts          |   9 +-
 apps/rush-cli-client/src/test/routing.test.ts | 168 +++++++++++++++++-
 .../src/test/rushxFallbackLines.test.ts       | 137 ++++++++++++++
 .../src/test/startupPendingFallback.test.ts   |   4 +-
 .../src/test/versionSelectionFallback.test.ts |   5 +-
 ...04-t60-route-reasons_2026-09-29-03-55.json |  11 ++
 docs/rush/dogfooding-rush-daemon.md           |   2 +-
 21 files changed, 777 insertions(+), 76 deletions(-)
 create mode 100644 apps/rush-cli-client/src/earlyRouting.ts
 create mode 100644 apps/rush-cli-client/src/test/earlyRouting.test.ts
 create mode 100644 apps/rush-cli-client/src/test/rushxFallbackLines.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t60-route-reasons_2026-09-29-03-55.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index a9a6c49cf9..0b8cdbaa4d 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -37,13 +37,32 @@ reporter behavior without duplicating or relocating bootstrap code.
 
 Routing precedence:
 
-1. `--no-daemon` before `--`, help, never-daemonize commands, and Rushx with any TTY stdio stay in-process.
+1. `--no-daemon` before `--`, help, never-daemonize commands, an option before the command other than
+   `--quiet`/`-q` (such as `--debug`), and Rushx with any TTY stdio stay in-process. `--quiet` and `-q` only hide
+   native Rush's startup banner, which a daemon request never prints, so `rush -q build` is sent to the daemon
+   without them.
 2. CI stays in-process unless `RUSH_DAEMON=1` explicitly opts in, even if config enables the daemon.
 3. `RUSH_DAEMON` overrides `rush.json`'s `daemon.enabled`; the default is false.
 4. Auto-start is considered only after selecting daemon execution.
 
+A command that routing keeps in-process shows no progress line. It says why in one stderr line before native
+Rush starts, in agent mode (see [Output modes](#output-modes)) and, in legacy mode, when `RUSH_DAEMON=1` asked
+for the daemon. Rushx uses the `rushx-client:` prefix. `--no-daemon` and help print nothing. The lines are:
+
+- `rush-client: RUSH_LOG_LEVEL selects the native reporter; using in-process Rush.` The same line names
+  `RUSH_REPORTER=<value>`, `--reporter`, `--output`, `--log-level` or `useRushReporter in experiments.json`
+  (see below).
+- `rush-client: the daemon does not support "--debug"; using in-process Rush.`
+- `rush-client: the daemon does not run "check"; using in-process Rush.`
+- `rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.`
+- `rush-client: RUSH_DAEMON=0 turns the daemon off; using in-process Rush.`
+- `rush-client: the daemon is not enabled for this repo; using in-process Rush.` To enable it, set `daemon.enabled`
+  to `true` in `rush.json`, or set `RUSH_DAEMON=1` in the environment.
+- `rush-client: CI is set, so the daemon is off unless RUSH_DAEMON=1; using in-process Rush.` The line names
+  the first CI marker that is set: `CI`, `TF_BUILD`, `GITHUB_ACTIONS`, `JENKINS_URL` or `TEAMCITY_VERSION`.
+
 When the selected daemon cannot be reached or started, an ordinary invocation prints the reason and runs
-in-process (`rush-client: <reason> Using in-process Rush.`). A startup failure while a live process can
+in-process (`rush-client: <reason>; using in-process Rush.`). A startup failure while a live process can
 still make the daemon ready is the exception: a process that listens at the endpoint but does not
 complete hello/ping in time, a startup helper that still waits for its daemon, or another client that
 holds the start mutex, as in a burst of clients that all find no daemon. In-process Rush would take the
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 87369d1a12..c9ef8c5a38 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -227,6 +227,7 @@ export class AgentProgressRenderer {
   #frame: number = 0;
   #startingLineWritten: boolean = false;
   #sentLineWritten: boolean = false;
+  #started: boolean = false;
   #timer: ReturnType<typeof setInterval> | undefined;
   #connectingTimer: ReturnType<typeof setTimeout> | undefined;
   #statusTimer: ReturnType<typeof setTimeout> | undefined;
@@ -250,9 +251,14 @@ export class AgentProgressRenderer {
 
   /**
    * On a TTY, paints the first line and starts the spinner. On a pipe, starts the status lines, and writes the
-   * connecting line after 10 s unless the request was sent by then.
+   * connecting line after 10 s unless the request was sent by then. Does nothing if rendering already started or
+   * stopped.
    */
   public start(): void {
+    if (this.#started || this.#stopped) {
+      return;
+    }
+    this.#started = true;
     if (!this.#options.isTTY) {
       this.#connectingTimer = setTimeout(
         () => this.#writePipeLine(this.#rows()[0]),
diff --git a/apps/rush-cli-client/src/earlyRouting.ts b/apps/rush-cli-client/src/earlyRouting.ts
new file mode 100644
index 0000000000..88cd3c1242
--- /dev/null
+++ b/apps/rush-cli-client/src/earlyRouting.ts
@@ -0,0 +1,89 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib.
+
+import * as fs from 'node:fs';
+
+/** Rush commands that the client always runs in-process. `daemon` runs the client's own daemon commands. */
+export const NEVER_DAEMONIZED_COMMANDS: ReadonlySet<string> = new Set([
+  'add',
+  'change',
+  'check',
+  'deploy',
+  'init',
+  'init-autoinstaller',
+  'init-deploy',
+  'link',
+  'publish',
+  'purge',
+  'remove',
+  'scan',
+  'setup',
+  'unlink',
+  'update-autoinstaller',
+  'version',
+  'help',
+  'daemon'
+]);
+
+/**
+ * Rush's global flags that only hide its startup banner, which a daemon request never prints. The client leaves
+ * them out of a daemon request and keeps them for in-process Rush.
+ */
+export const QUIET_FLAGS: ReadonlySet<string> = new Set(['--quiet', '-q']);
+
+const CI_ENVIRONMENT_VARIABLES: ReadonlyArray<string> = [
+  'CI',
+  'TF_BUILD',
+  'GITHUB_ACTIONS',
+  'JENKINS_URL',
+  'TEAMCITY_VERSION'
+];
+
+/** Returns the first CI marker that is set. In CI, the daemon is off unless RUSH_DAEMON=1. */
+export function getCiEnvironmentVariable(
+  environment: Readonly<Record<string, string | undefined>>
+): string | undefined {
+  return CI_ENVIRONMENT_VARIABLES.find((name) => {
+    const value: string | undefined = environment[name];
+    return value !== undefined && value !== '' && value !== '0' && value !== 'false';
+  });
+}
+
+/**
+ * Whether the daemon is off for this invocation, as far as the client can tell before it loads
+ * `@microsoft/rush-lib`: there is no rush.json, RUSH_DAEMON=0, a CI marker is set without RUSH_DAEMON=1, or
+ * RUSH_DAEMON is not set and rush.json's "daemon" block does not set "enabled" to true. False when it can't tell;
+ * routing then decides. A wrong guess either way is harmless: the progress line is painted after routing, or
+ * painted and then erased.
+ */
+export function isDaemonOffBeforeRouting(
+  environment: Readonly<Record<string, string | undefined>>,
+  rushJsonPath: string | undefined
+): boolean {
+  const optIn: string | undefined = environment.RUSH_DAEMON;
+  if (rushJsonPath === undefined || optIn === '0') {
+    return true;
+  }
+  if (optIn !== '1' && getCiEnvironmentVariable(environment) !== undefined) {
+    return true;
+  }
+  if (optIn !== undefined) {
+    return false;
+  }
+  let contents: string;
+  try {
+    contents = fs.readFileSync(rushJsonPath, 'utf8');
+  } catch {
+    return false;
+  }
+  if (!/"daemon"\s*:/.test(contents)) {
+    return true;
+  }
+  // `rush init` writes the daemon block as comments. A comment marker inside a string only makes the guess wrong.
+  const uncommented: string = contents.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  // The block holds no nested objects.
+  const block: RegExpExecArray | null = /"daemon"\s*:\s*\{([^}]*)\}/.exec(uncommented);
+  return !block || !/"enabled"\s*:\s*true\b/.test(block[1]);
+}
diff --git a/apps/rush-cli-client/src/inProcessFallback.ts b/apps/rush-cli-client/src/inProcessFallback.ts
index e39f130268..e57469bd7c 100644
--- a/apps/rush-cli-client/src/inProcessFallback.ts
+++ b/apps/rush-cli-client/src/inProcessFallback.ts
@@ -3,14 +3,14 @@
 
 /**
  * Formats the stderr lines that say why the client runs a command in-process instead of on the daemon. The first
- * line of the reason is the fallback line, which starts with `rush-client:` and ends with `using in-process Rush.`
- * The other lines of a multi-line reason, such as a warning that the daemon wrote before its error, follow it as
- * detail lines.
+ * line of the reason is the fallback line, which starts with `rush-client:` (or the given client name) and ends with
+ * `using in-process Rush.` The other lines of a multi-line reason, such as a warning that the daemon wrote before its
+ * error, follow it as detail lines.
  */
-export function formatInProcessFallbackMessage(reason: string): string {
+export function formatInProcessFallbackMessage(reason: string, clientName: string = 'rush-client'): string {
   const [firstLine = '', ...details] = reason.split(/\r?\n/).filter((line) => line.trim());
   // A reason is usually a sentence, or a line that introduces the lines after it; "; using" follows it without the
   // period or the colon.
-  const fallbackLine: string = `rush-client: ${firstLine.replace(/[.:]$/, '')}; using in-process Rush.`;
+  const fallbackLine: string = `${clientName}: ${firstLine.replace(/[.:]$/, '')}; using in-process Rush.`;
   return [fallbackLine, ...details.map((line) => `  ${line}`)].map((line) => `${line}\n`).join('');
 }
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 3a3d644895..12f9de159c 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -36,7 +36,7 @@ import {
   isCancelledOutcome
 } from './clientCancellation';
 import { getDaemonConnectionOptionsAsync, getDaemonPaths } from './daemonConnectionOptions';
-import { readUseRushReporter } from './outputSelection';
+import { readUseRushReporter, selectClientOutputMode } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
 import { getTerminalColumns } from './terminalColumns';
@@ -67,13 +67,16 @@ export async function launchClientAsync(
     workspace?.daemon,
     environment
   );
+  const argv: ReadonlyArray<string> = process.argv.slice(2);
+  const useRushReporter: boolean = !rushx && !!rushJsonPath && readUseRushReporter(rushJsonPath);
+  const clientName: string = rushx ? 'rushx-client' : 'rush-client';
   const route: IClientRoute = selectClientRoute({
-    argv: process.argv.slice(2),
+    argv,
     environment,
     enabled: config.enabled,
     rushx,
     hasTerminal: !!(process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY),
-    useRushReporter: !rushx && !!rushJsonPath && readUseRushReporter(rushJsonPath)
+    useRushReporter
   });
   const selectedVersion: string =
     environment.RUSH_PREVIEW_VERSION ?? workspace?.rushVersion ?? getBundledRushVersion();
@@ -97,9 +100,21 @@ export async function launchClientAsync(
   }
   if (!route.daemon || !rushJsonPath || route.commandName === undefined) {
     agentRenderer?.dispose();
-    await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
+    // Agent output says why a command runs in-process; legacy output, which rushx-client always uses, says so only
+    // when RUSH_DAEMON=1 asked for the daemon.
+    if (
+      route.inProcessReason !== undefined &&
+      rushJsonPath &&
+      (environment.RUSH_DAEMON === '1' ||
+        (!rushx && selectClientOutputMode({ argv, environment, useRushReporter }) === 'agent'))
+    ) {
+      process.stderr.write(formatInProcessFallbackMessage(route.inProcessReason, clientName));
+    }
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
     return;
   }
+  // start.ts skips the progress line when it guesses that the daemon is off; routing decides.
+  agentRenderer?.start();
   const terminal: ConsoleTerminalProvider = new ConsoleTerminalProvider();
   const verbosity: DaemonVerbosity =
     route.argv.includes('--verbose') || route.argv.includes('-v')
@@ -161,7 +176,7 @@ export async function launchClientAsync(
         }
         const seconds: number = Math.round(waitMs / 1000);
         process.stderr.write(
-          `rush-client: The daemon is not ready yet. ${owner}, so this command waits up to ${seconds} s ` +
+          `${clientName}: The daemon is not ready yet. ${owner}, so this command waits up to ${seconds} s ` +
             'more for it instead of running Rush in-process.\n'
         );
       }
@@ -173,8 +188,8 @@ export async function launchClientAsync(
     )
       throw error;
     agentRenderer?.dispose();
-    process.stderr.write(`rush-client: ${error.message} Using in-process Rush.\n`);
-    await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
+    process.stderr.write(formatInProcessFallbackMessage(error.message, clientName));
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
     return;
   }
   const abort: AbortController = new AbortController();
@@ -321,8 +336,8 @@ export async function launchClientAsync(
     throw new Error(message);
   } else {
     agentRenderer?.dispose();
-    process.stderr.write(formatInProcessFallbackMessage(outcome.message ?? outcome.reason));
-    await launchInProcessAsync(route.argv, rushx, selectedVersion, rushJsonPath);
+    process.stderr.write(formatInProcessFallbackMessage(outcome.message ?? outcome.reason, clientName));
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
   }
 }
 
diff --git a/apps/rush-cli-client/src/outputSelection.ts b/apps/rush-cli-client/src/outputSelection.ts
index 5378bdf1d8..42fbfe413d 100644
--- a/apps/rush-cli-client/src/outputSelection.ts
+++ b/apps/rush-cli-client/src/outputSelection.ts
@@ -6,6 +6,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { NEVER_DAEMONIZED_COMMANDS, QUIET_FLAGS } from './earlyRouting';
+
 /** Environment variable that selects the rush-client output mode: `agent` or `legacy`. */
 export const RUSHD_OUTPUT_ENV_VAR: 'RUSHD_OUTPUT' = 'RUSHD_OUTPUT';
 
@@ -37,7 +39,8 @@ export function isNativeReporterEnvironmentRequested(value: string | undefined):
 
 /**
  * Returns the command name for early agent output, or undefined when the invocation has no plain
- * command (a leading option, `--help`/`-h`, or `daemon`). Daemon admission controls (`--no-wait`,
+ * command that the daemon could run (a leading option other than `--quiet`/`-q`, `--help`/`-h`, or a command
+ * that always runs in-process, such as `daemon` or `check`). Daemon admission controls (`--no-wait`,
  * `--wait-timeout SECONDS`) are skipped like `parseClientAdmissionControls()`, which is not imported
  * here to avoid loading `@rushstack/rush-daemon-protocol` before the first line; invalid controls
  * are reported later by the full parser.
@@ -52,11 +55,11 @@ export function getAgentCommandName(argv: ReadonlyArray<string>): string | undef
       remaining.push(arg);
     }
   }
-  const commandName: string | undefined = remaining[0];
+  const commandName: string | undefined = remaining.find((arg) => !QUIET_FLAGS.has(arg));
   if (
     commandName === undefined ||
     commandName.startsWith('-') ||
-    commandName === 'daemon' ||
+    NEVER_DAEMONIZED_COMMANDS.has(commandName) ||
     remaining.includes('--help') ||
     remaining.includes('-h')
   ) {
diff --git a/apps/rush-cli-client/src/routing.ts b/apps/rush-cli-client/src/routing.ts
index b9f8c52f84..2e6b6547f7 100644
--- a/apps/rush-cli-client/src/routing.ts
+++ b/apps/rush-cli-client/src/routing.ts
@@ -6,29 +6,9 @@ import type { IRushXCommandLineArguments } from '@microsoft/rush-lib';
 
 import { loadRushLib } from './lazyRushModules';
 import { parseClientAdmissionControls, type IClientAdmissionControls } from './ClientAdmissionControls';
+import { getCiEnvironmentVariable, NEVER_DAEMONIZED_COMMANDS, QUIET_FLAGS } from './earlyRouting';
 import { isNativeReporterEnvironmentRequested } from './outputSelection';
 
-const neverDaemonize: ReadonlySet<string> = new Set([
-  'add',
-  'change',
-  'check',
-  'deploy',
-  'init',
-  'init-autoinstaller',
-  'init-deploy',
-  'link',
-  'publish',
-  'purge',
-  'remove',
-  'scan',
-  'setup',
-  'unlink',
-  'update-autoinstaller',
-  'version',
-  'help',
-  'daemon'
-]);
-
 export interface IClientRouteOptions {
   readonly argv: ReadonlyArray<string>;
   readonly environment: Readonly<Record<string, string | undefined>>;
@@ -40,47 +20,93 @@ export interface IClientRouteOptions {
 }
 
 export interface IClientRoute {
+  /** The arguments of a daemon request. They leave out leading `--quiet` flags, which only native Rush uses. */
   readonly argv: ReadonlyArray<string>;
+  /** The arguments for in-process Rush: all but the client's own options. */
+  readonly nativeArgv: ReadonlyArray<string>;
   readonly daemon: boolean;
   readonly commandName: string | undefined;
   readonly admission: IDaemonRequestAdmissionOptions | undefined;
+  /**
+   * Why the command runs in-process instead of on the daemon. Absent for a daemon request, and when the
+   * invocation asks for in-process Rush or native Rush explains itself: `--no-daemon`, help, or no command.
+   */
+  readonly inProcessReason?: string;
 }
 
+const NATIVE_REPORTER_FLAGS: ReadonlyArray<string> = ['--reporter', '--output', '--log-level'];
+
 /** Routing never parses action parameters or relabels a custom command as a built-in. */
 export function selectClientRoute(options: IClientRouteOptions): IClientRoute {
   const controls: IClientAdmissionControls = parseClientAdmissionControls(options.argv);
   const separator: number = controls.argv.indexOf('--');
   const prefix: ReadonlyArray<string> = separator < 0 ? controls.argv : controls.argv.slice(0, separator);
   const noDaemon: boolean = prefix.includes('--no-daemon');
-  const argv: ReadonlyArray<string> = [
+  const nativeArgv: ReadonlyArray<string> = [
     ...prefix.filter((arg) => arg !== '--no-daemon'),
     ...(separator < 0 ? [] : controls.argv.slice(separator))
   ];
+  let quietFlags: number = 0;
+  while (!options.rushx && QUIET_FLAGS.has(nativeArgv[quietFlags])) quietFlags++;
+  const argv: ReadonlyArray<string> = nativeArgv.slice(quietFlags);
   const rushxArguments: IRushXCommandLineArguments | undefined = options.rushx
     ? loadRushLib().RushXCommand.parseArguments(argv, options.environment)
     : undefined;
-  const commandName: string | undefined = rushxArguments ? rushxArguments.commandName || undefined : argv[0];
-  const reporterControls: boolean =
-    options.environment.RUSH_LOG_LEVEL !== undefined ||
-    isNativeReporterEnvironmentRequested(options.environment.RUSH_REPORTER) ||
-    (!options.rushx &&
-      prefix.some((arg) =>
-        ['--reporter', '--output', '--log-level'].some((name) => arg === name || arg.startsWith(`${name}=`))
-      )) ||
-    (!options.rushx && !!options.useRushReporter);
-  const ci: boolean = ['CI', 'TF_BUILD', 'GITHUB_ACTIONS', 'JENKINS_URL', 'TEAMCITY_VERSION'].some((key) => {
-    const value: string | undefined = options.environment[key];
-    return value !== undefined && value !== '' && value !== '0' && value !== 'false';
-  });
-  const daemon: boolean =
-    options.enabled &&
-    !reporterControls &&
-    !noDaemon &&
-    !(options.rushx && options.hasTerminal) &&
-    !!commandName &&
-    !commandName.startsWith('-') &&
-    (options.rushx || !neverDaemonize.has(commandName)) &&
-    !(rushxArguments ? rushxArguments.help : prefix.includes('--help') || prefix.includes('-h')) &&
-    (!ci || options.environment.RUSH_DAEMON === '1');
-  return { argv, commandName, daemon, admission: controls.admission };
+  const commandName: string | undefined =
+    (rushxArguments ? rushxArguments.commandName : argv[0]) || undefined;
+  const help: boolean = rushxArguments
+    ? rushxArguments.help
+    : prefix.includes('--help') || prefix.includes('-h') || commandName === 'help';
+  const inProcessReason: string | undefined =
+    noDaemon || help || commandName === undefined
+      ? undefined
+      : getInProcessReason(options, prefix, commandName);
+  return {
+    argv,
+    nativeArgv,
+    commandName,
+    daemon: !noDaemon && !help && commandName !== undefined && inProcessReason === undefined,
+    admission: controls.admission,
+    ...(inProcessReason === undefined ? {} : { inProcessReason })
+  };
+}
+
+function getInProcessReason(
+  options: IClientRouteOptions,
+  prefix: ReadonlyArray<string>,
+  commandName: string
+): string | undefined {
+  const { environment, rushx } = options;
+  const reporter: string | undefined = getNativeReporterRequest(options, prefix);
+  if (reporter !== undefined) return `${reporter} selects the native reporter`;
+  if (commandName.startsWith('-')) return `the daemon does not support "${commandName}"`;
+  if (!rushx && NEVER_DAEMONIZED_COMMANDS.has(commandName)) return `the daemon does not run "${commandName}"`;
+  if (rushx && options.hasTerminal) return 'the daemon does not run scripts in a terminal';
+  if (!options.enabled) {
+    return environment.RUSH_DAEMON === '0'
+      ? 'RUSH_DAEMON=0 turns the daemon off'
+      : 'the daemon is not enabled for this repo';
+  }
+  const ci: string | undefined = getCiEnvironmentVariable(environment);
+  if (ci !== undefined && environment.RUSH_DAEMON !== '1') {
+    return `${ci} is set, so the daemon is off unless RUSH_DAEMON=1`;
+  }
+  return undefined;
+}
+
+function getNativeReporterRequest(
+  options: IClientRouteOptions,
+  prefix: ReadonlyArray<string>
+): string | undefined {
+  const { environment } = options;
+  if (environment.RUSH_LOG_LEVEL !== undefined) return 'RUSH_LOG_LEVEL';
+  if (isNativeReporterEnvironmentRequested(environment.RUSH_REPORTER)) {
+    return `RUSH_REPORTER=${environment.RUSH_REPORTER?.trim()}`;
+  }
+  if (options.rushx) return undefined;
+  const flag: string | undefined = NATIVE_REPORTER_FLAGS.find((name) =>
+    prefix.some((arg) => arg === name || arg.startsWith(`${name}=`))
+  );
+  if (flag !== undefined) return flag;
+  return options.useRushReporter ? 'useRushReporter in experiments.json' : undefined;
 }
diff --git a/apps/rush-cli-client/src/start.ts b/apps/rush-cli-client/src/start.ts
index ca87ecc13d..e724817594 100644
--- a/apps/rush-cli-client/src/start.ts
+++ b/apps/rush-cli-client/src/start.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { AgentProgressRenderer } from './AgentProgressRenderer';
+import { isDaemonOffBeforeRouting } from './earlyRouting';
 import {
   findRushJsonPath,
   getAgentCommandName,
@@ -30,7 +31,10 @@ const agentRenderer: AgentProgressRenderer | undefined =
         startTimeMs
       })
     : undefined;
-agentRenderer?.start();
+// A command that runs in-process shows no progress. When routing sends it to the daemon, launchClient starts this.
+if (agentRenderer && !isDaemonOffBeforeRouting(process.env, rushJsonPath)) {
+  agentRenderer.start();
+}
 
 const { launchClientAsync } = require('./launchClient') as typeof import('./launchClient');
 
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index c5bd6e0704..aeb612ae12 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1045,6 +1045,35 @@ describe(AgentProgressRenderer.name, () => {
       ]);
     });
 
+    it('starts once, and not after it stopped (task 60)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 5_000);
+      // The client starts it again once routing chose the daemon.
+      renderer.start();
+      advance(clock, 5_000);
+      advance(clock, 10_000);
+      expect(lines()).toEqual(['rush build · 10.0s · connecting to rushd (auto-starts if needed)']);
+      renderer.dispose();
+
+      for (const isTTY of [false, true]) {
+        const stopped: ITestRenderer = createRenderer(isTTY);
+        stopped.renderer.dispose();
+        stopped.renderer.start();
+        // A timer would keep the client alive after rendering stopped.
+        expect(jest.getTimerCount()).toBe(0);
+        advance(stopped.clock, 30_000);
+        expect(stopped.output).toEqual([]);
+      }
+
+      const tty: ITestRenderer = createRenderer(true);
+      tty.renderer.start();
+      const painted: number = tty.output.length;
+      tty.renderer.start();
+      expect(tty.output).toHaveLength(painted);
+      tty.renderer.dispose();
+    });
+
     it('writes one line when the client waits for a daemon that is still starting (task 95)', () => {
       const early: ITestRenderer = createRenderer(false);
       early.renderer.start();
diff --git a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
index 317e29401f..eac7e35547 100644
--- a/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
+++ b/apps/rush-cli-client/src/test/ClientAdmissionControls.test.ts
@@ -53,6 +53,7 @@ describe(parseClientAdmissionControls.name, () => {
       })
     ).toEqual({
       argv: ['build', '--', '--wait-timeout=2'],
+      nativeArgv: ['build', '--', '--wait-timeout=2'],
       commandName: 'build',
       daemon: false,
       admission: { noWait: true }
diff --git a/apps/rush-cli-client/src/test/RushXTerminal.test.ts b/apps/rush-cli-client/src/test/RushXTerminal.test.ts
index 746418a87f..1139a307ce 100644
--- a/apps/rush-cli-client/src/test/RushXTerminal.test.ts
+++ b/apps/rush-cli-client/src/test/RushXTerminal.test.ts
@@ -99,7 +99,13 @@ setInterval(()=>{},1000);
         environment,
         stdinIsTTY
       );
-      expect(client).toEqual(native);
+      // RUSH_DAEMON=1 asked for the daemon, so the client says why it did not use it (task 60).
+      expect(client).toEqual({
+        ...native,
+        output:
+          'rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.\r\n' +
+          native.output
+      });
       expect(fs.readFileSync(path.join(cwd, 'tty-runs.txt'), 'utf8')).toBe('run\nrun\n');
       expect(resolve).not.toHaveBeenCalled();
     },
diff --git a/apps/rush-cli-client/src/test/earlyRouting.test.ts b/apps/rush-cli-client/src/test/earlyRouting.test.ts
new file mode 100644
index 0000000000..3485ee9bd8
--- /dev/null
+++ b/apps/rush-cli-client/src/test/earlyRouting.test.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { getCiEnvironmentVariable, isDaemonOffBeforeRouting } from '../earlyRouting';
+
+describe(getCiEnvironmentVariable.name, () => {
+  it.each([
+    { environment: {}, name: undefined },
+    { environment: { CI: '' }, name: undefined },
+    { environment: { CI: '0', GITHUB_ACTIONS: 'false' }, name: undefined },
+    { environment: { CI: 'true' }, name: 'CI' },
+    { environment: { CI: 'false', TF_BUILD: 'True' }, name: 'TF_BUILD' },
+    { environment: { TEAMCITY_VERSION: '2024.1', JENKINS_URL: 'https://ci' }, name: 'JENKINS_URL' }
+  ])('returns $name for $environment', ({ environment, name }) => {
+    expect(getCiEnvironmentVariable(environment)).toBe(name);
+  });
+});
+
+describe(isDaemonOffBeforeRouting.name, () => {
+  let folder: string;
+  let rushJsonPath: string;
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-early-routing-'));
+    rushJsonPath = path.join(folder, 'rush.json');
+  });
+  afterEach(() => fs.rmSync(folder, { recursive: true, force: true }));
+
+  function isOff(rushJson: string, environment: Record<string, string> = {}): boolean {
+    fs.writeFileSync(rushJsonPath, rushJson);
+    return isDaemonOffBeforeRouting(environment, rushJsonPath);
+  }
+
+  it('follows RUSH_DAEMON and the CI markers', () => {
+    expect(isDaemonOffBeforeRouting({ RUSH_DAEMON: '1' }, undefined)).toBe(true);
+    expect(isOff('{ "daemon": { "enabled": true } }', { RUSH_DAEMON: '0' })).toBe(true);
+    expect(isOff('{}', { RUSH_DAEMON: '1' })).toBe(false);
+    expect(isOff('{ "daemon": { "enabled": true } }', { CI: '1' })).toBe(true);
+    expect(isOff('{}', { CI: '1', RUSH_DAEMON: '1' })).toBe(false);
+  });
+
+  it('reads daemon.enabled from rush.json when RUSH_DAEMON is not set', () => {
+    expect(isOff('{ "projects": [] }')).toBe(true);
+    expect(isOff('{ "daemon": {} }')).toBe(true);
+    expect(isOff('{ "daemon": { "enabled": false, "autoStart": true } }')).toBe(true);
+    expect(isOff('{ "daemon": { "compatiblePlugins": ["p"], "enabled": true } }')).toBe(false);
+  });
+
+  it('ignores the daemon block that `rush init` writes as comments', () => {
+    expect(isOff('{\n  // "daemon": {\n  //   "enabled": true\n  // },\n  "projects": []\n}')).toBe(true);
+    expect(isOff('{\n  /* "daemon": { "enabled": true } */\n  "projects": []\n}')).toBe(true);
+    expect(isOff('{\n  "daemon": {\n    // "enabled": false\n    "enabled": true\n  }\n}')).toBe(false);
+  });
+
+  it('cannot tell when rush.json cannot be read', () => {
+    expect(isDaemonOffBeforeRouting({}, path.join(folder, 'missing', 'rush.json'))).toBe(false);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/inProcessFallback.test.ts b/apps/rush-cli-client/src/test/inProcessFallback.test.ts
index 128f86b5a1..cea7fce1e8 100644
--- a/apps/rush-cli-client/src/test/inProcessFallback.test.ts
+++ b/apps/rush-cli-client/src/test/inProcessFallback.test.ts
@@ -18,6 +18,12 @@ describe(formatInProcessFallbackMessage.name, () => {
     );
   });
 
+  it('starts with the given client name', () => {
+    expect(
+      formatInProcessFallbackMessage('the daemon does not run scripts in a terminal', 'rushx-client')
+    ).toBe('rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.\n');
+  });
+
   it('gives the first line of a multi-line reason on the fallback line and the other lines as details', () => {
     expect(
       formatInProcessFallbackMessage(
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index 78b3d92ef5..ed17033bef 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -175,9 +175,123 @@ describe('standalone rushx fallback', () => {
     const client: IInvocationResult = await invokeAsync(true, true, true);
     expect(client.code).toBe(native.code);
     expect(client.stdout).toBe(native.stdout);
-    expect(client).toEqual(native);
+    // RUSH_DAEMON=1 asked for the daemon, so the client says why it did not use it (task 60).
+    expect(client).toEqual({
+      ...native,
+      stderr:
+        'rushx-client: the daemon does not run scripts in a terminal; using in-process Rush.\n' +
+        native.stderr
+    });
+    // rushx-client always uses legacy output, so an agent marker adds no line.
+    expect(await invokeAsync(true, false, true, undefined, { COPILOT_CLI: '1' })).toEqual(native);
   }, 15000);
 
+  it('says why a command runs in-process in agent mode, or when RUSH_DAEMON=1 asked for the daemon (task 60)', async () => {
+    const agent: IInvocationResult = await invokeAsync(true, false, false, ['-q', 'list'], {
+      COPILOT_CLI: '1'
+    });
+    expect(agent.code).toBe(0);
+    expect(agent.stderr).toBe('rush-client: RUSH_DAEMON=0 turns the daemon off; using in-process Rush.\n');
+    // In-process Rush got the quiet flag, and no progress line was written.
+    expect(agent.stdout).toContain('sample');
+    expect(agent.stdout).not.toMatch(/Rush Multi-Project Build Tool|rushd/);
+    const legacy: IInvocationResult = await invokeAsync(true, false, false, ['-q', 'list']);
+    expect(legacy).toEqual({ ...agent, stderr: '' });
+    const requested: IInvocationResult = await invokeAsync(true, true, false, ['-q', '--debug', 'list']);
+    expect(requested.code).toBe(0);
+    expect(requested.stderr).toBe(
+      'rush-client: the daemon does not support "--debug"; using in-process Rush.\n'
+    );
+    // In-process Rush got both flags: --debug lists the plugins that Rush loads.
+    expect(requested.stdout).toMatch(/^Loaded rush plugin[^]*\nsample\n$/);
+    expect(requested.stdout).not.toContain('Rush Multi-Project Build Tool');
+    expect(await invokeAsync(true, true, false, ['--no-daemon', '-q', 'list'])).toEqual(legacy);
+    expect((await invokeAsync(true, false, false, ['list'])).stdout).toContain(
+      'Rush Multi-Project Build Tool'
+    );
+  }, 30000);
+
+  it('keeps the quiet flag for in-process Rush after the daemon could not run the command (task 36)', async () => {
+    const unreachable: IInvocationResult = await invokeAsync(true, true, false, ['-q', 'list']);
+    expect(unreachable).toMatchObject({ code: 0, stdout: 'sample\n' });
+    expect(unreachable.stderr).toMatch(
+      /^rush-client: No ready daemon at .*; auto-start is disabled; using in-process Rush\.\n$/
+    );
+    const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+    host = await RushDaemonHost.startAsync({
+      repoRoot: folder,
+      rushVersion: Rush.version,
+      daemonVersion: daemonPackage.version
+    });
+    const sentBack: IInvocationResult = await invokeAsync(true, true, false, ['-q', 'list']);
+    expect(sentBack).toMatchObject({ code: 0, stdout: 'sample\n' });
+    expect(sentBack.stderr).toMatch(/^rush-client: .*; using in-process Rush\.\n$/);
+  }, 30000);
+
+  it('paints no progress line on a terminal for a command that runs in-process (task 60)', async () => {
+    const entry: string = path.resolve(__dirname, '../../bin/rush-client');
+    const invokeOnTerminalAsync = async (environment: NodeJS.ProcessEnv): Promise<IInvocationResult> => {
+      const child: ChildProcess = spawn(
+        process.execPath,
+        [
+          '-e',
+          `Object.assign(process.stdout, { isTTY: true, columns: 80 }); process.argv = [process.execPath, ${JSON.stringify(entry)}, '-q', 'list']; require(${JSON.stringify(entry)});`
+        ],
+        {
+          cwd: project,
+          env: {
+            ...getTestProcessEnvironment(),
+            COPILOT_CLI: '1',
+            TERM: 'xterm',
+            CI: 'false',
+            ...environment
+          },
+          stdio: ['ignore', 'pipe', 'pipe']
+        }
+      );
+      let stdout: string = '';
+      let stderr: string = '';
+      child.stdout!.on('data', (chunk: Buffer) => (stdout += chunk.toString()));
+      child.stderr!.on('data', (chunk: Buffer) => (stderr += chunk.toString()));
+      const closed: Promise<unknown[]> = once(child, 'close');
+      invocationClosures.push(closed);
+      const [code] = await closed;
+      return { code: typeof code === 'number' ? code : undefined, stdout, stderr };
+    };
+    for (const environment of [
+      { RUSH_DAEMON: '0' },
+      { RUSH_DAEMON: undefined },
+      { CI: '1', RUSH_DAEMON: undefined }
+    ]) {
+      const result: IInvocationResult = await invokeOnTerminalAsync(environment);
+      expect(result).toMatchObject({ code: 0, stdout: 'sample\n' });
+      expect(result.stderr).toContain('; using in-process Rush.');
+    }
+
+    // The early guess misses the escaped key and paints nothing; the line starts once routing chose the daemon.
+    const rushJsonPath: string = path.join(folder, 'rush.json');
+    const config: Record<string, unknown> = JSON.parse(fs.readFileSync(rushJsonPath, 'utf8'));
+    fs.writeFileSync(
+      rushJsonPath,
+      JSON.stringify({ ...config, daemon: { autoStart: false } }).replace(
+        '"daemon":{',
+        '"daemon":{"\\u0065nabled":true,'
+      )
+    );
+    const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
+    host = await RushDaemonHost.startAsync({
+      repoRoot: folder,
+      rushVersion: Rush.version,
+      daemonVersion: daemonPackage.version
+    });
+    const routed: IInvocationResult = await invokeOnTerminalAsync({ RUSH_DAEMON: undefined });
+    expect(routed.code).toBe(0);
+    // Painted before the request was sent, so the line started when routing chose the daemon.
+    expect(routed.stdout).toContain('rush list · ');
+    expect(routed.stdout).toContain('connecting to rushd');
+    expect(routed.stdout).toMatch(/sample\n$/);
+  }, 30000);
+
   it('starts idempotently and reports real readiness in CI without execution opt-in', async () => {
     const daemonPackage: { version: string } = require('@rushstack/rush-daemon/package.json');
     host = await RushDaemonHost.startAsync({
diff --git a/apps/rush-cli-client/src/test/outputSelection.test.ts b/apps/rush-cli-client/src/test/outputSelection.test.ts
index 23f11f467d..e2b4a7a0bb 100644
--- a/apps/rush-cli-client/src/test/outputSelection.test.ts
+++ b/apps/rush-cli-client/src/test/outputSelection.test.ts
@@ -50,8 +50,15 @@ describe(getAgentCommandName.name, () => {
     { argv: ['--wait-timeout=2', 'build', '-t', 'a'], commandName: 'build' },
     { argv: ['--no-wait', 'rebuild'], commandName: 'rebuild' },
     { argv: ['--', 'build'], commandName: undefined },
-    { argv: ['-q', 'build'], commandName: undefined },
+    { argv: ['-q', 'build'], commandName: 'build' },
+    { argv: ['--quiet', '--no-wait', '-q', 'build'], commandName: 'build' },
+    { argv: ['-q'], commandName: undefined },
+    { argv: ['-q', '--debug', 'build'], commandName: undefined },
+    { argv: ['-d', 'build'], commandName: undefined },
     { argv: ['daemon', 'status'], commandName: undefined },
+    { argv: ['-q', 'daemon', 'status'], commandName: undefined },
+    { argv: ['check'], commandName: undefined },
+    { argv: ['update-autoinstaller', '--name', 'x'], commandName: undefined },
     { argv: ['build', '--help'], commandName: undefined },
     { argv: ['build', '-h'], commandName: undefined },
     { argv: ['build', '--', '--help'], commandName: 'build' },
diff --git a/apps/rush-cli-client/src/test/routing.test.ts b/apps/rush-cli-client/src/test/routing.test.ts
index 0bac92c254..b5cb889c69 100644
--- a/apps/rush-cli-client/src/test/routing.test.ts
+++ b/apps/rush-cli-client/src/test/routing.test.ts
@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { selectClientRoute } from '../routing';
+import { selectClientRoute, type IClientRoute, type IClientRouteOptions } from '../routing';
 
 describe('opt-in routing', () => {
   it.each([
@@ -56,7 +56,12 @@ describe('opt-in routing', () => {
         environment: {},
         rushx: true
       })
-    ).toEqual({ argv: ['install', '--', '--no-daemon'], commandName: 'install', daemon: true });
+    ).toEqual({
+      argv: ['install', '--', '--no-daemon'],
+      nativeArgv: ['install', '--', '--no-daemon'],
+      commandName: 'install',
+      daemon: true
+    });
   });
 
   it('uses native Rushx option boundaries instead of treating script flags as Rush options', () => {
@@ -107,3 +112,162 @@ describe('opt-in routing', () => {
     ).toBe(true);
   });
 });
+
+describe('global flags before the command', () => {
+  it.each([
+    { argv: ['-q', 'build', '--to', 'a'], daemonArgv: ['build', '--to', 'a'] },
+    { argv: ['--quiet', 'build'], daemonArgv: ['build'] },
+    { argv: ['--quiet', '-q', 'rebuild', '-q'], daemonArgv: ['rebuild', '-q'] },
+    { argv: ['--no-wait', '-q', 'build'], daemonArgv: ['build'] }
+  ])('leaves the leading quiet flags of $argv out of the daemon request only', ({ argv, daemonArgv }) => {
+    expect(selectClientRoute({ argv, enabled: true, environment: {}, rushx: false })).toEqual({
+      argv: daemonArgv,
+      nativeArgv: argv.filter((arg) => arg !== '--no-wait'),
+      commandName: daemonArgv[0],
+      daemon: true,
+      admission: argv.includes('--no-wait') ? { noWait: true } : undefined
+    });
+  });
+
+  it('keeps every flag for in-process Rush', () => {
+    expect(
+      selectClientRoute({
+        argv: ['-q', '--no-daemon', 'build', '--', '--no-daemon'],
+        enabled: true,
+        environment: {},
+        rushx: false
+      })
+    ).toEqual({
+      argv: ['build', '--', '--no-daemon'],
+      nativeArgv: ['-q', 'build', '--', '--no-daemon'],
+      commandName: 'build',
+      daemon: false,
+      admission: undefined
+    });
+    expect(
+      selectClientRoute({ argv: ['-q', '--debug', 'build'], enabled: true, environment: {}, rushx: false })
+    ).toMatchObject({ argv: ['--debug', 'build'], nativeArgv: ['-q', '--debug', 'build'], daemon: false });
+  });
+
+  it('does not strip Rushx flags, which native Rushx parses', () => {
+    expect(
+      selectClientRoute({ argv: ['-q', 'build'], enabled: true, environment: {}, rushx: true })
+    ).toMatchObject({
+      argv: ['-q', 'build'],
+      nativeArgv: ['-q', 'build'],
+      commandName: 'build',
+      daemon: true
+    });
+  });
+
+  it('routes a quiet daemon command to the client daemon commands', () => {
+    expect(
+      selectClientRoute({ argv: ['-q', 'daemon', 'status'], enabled: true, environment: {}, rushx: false })
+    ).toMatchObject({ argv: ['daemon', 'status'], commandName: 'daemon', daemon: false });
+  });
+});
+
+describe('in-process reasons', () => {
+  it.each([
+    {
+      argv: ['build'],
+      environment: { RUSH_LOG_LEVEL: 'debug' },
+      reason: 'RUSH_LOG_LEVEL selects the native reporter'
+    },
+    {
+      argv: ['build'],
+      environment: { RUSH_REPORTER: ' json ' },
+      reason: 'RUSH_REPORTER=json selects the native reporter'
+    },
+    { argv: ['build', '--reporter=ai'], reason: '--reporter selects the native reporter' },
+    { argv: ['build', '--output', 'x.log'], reason: '--output selects the native reporter' },
+    { argv: ['build', '--log-level=debug'], reason: '--log-level selects the native reporter' },
+    {
+      argv: ['build'],
+      useRushReporter: true,
+      reason: 'useRushReporter in experiments.json selects the native reporter'
+    },
+    { argv: ['--debug', 'build'], reason: 'the daemon does not support "--debug"' },
+    { argv: ['-q', '-d', 'build'], reason: 'the daemon does not support "-d"' },
+    { argv: ['check'], reason: 'the daemon does not run "check"' },
+    {
+      argv: ['-q', 'update-autoinstaller', '--name', 'x'],
+      reason: 'the daemon does not run "update-autoinstaller"'
+    },
+    {
+      argv: ['build'],
+      enabled: false,
+      environment: { RUSH_DAEMON: '0' },
+      reason: 'RUSH_DAEMON=0 turns the daemon off'
+    },
+    { argv: ['build'], enabled: false, reason: 'the daemon is not enabled for this repo' },
+    {
+      argv: ['build'],
+      environment: { CI: 'true' },
+      reason: 'CI is set, so the daemon is off unless RUSH_DAEMON=1'
+    },
+    {
+      argv: ['build'],
+      environment: { CI: '0', TF_BUILD: 'True' },
+      reason: 'TF_BUILD is set, so the daemon is off unless RUSH_DAEMON=1'
+    },
+    // The first reason that applies is given.
+    {
+      argv: ['--debug', 'check', '--reporter=json'],
+      enabled: false,
+      environment: { CI: '1' },
+      reason: '--reporter selects the native reporter'
+    },
+    { argv: ['--debug', 'check'], enabled: false, reason: 'the daemon does not support "--debug"' },
+    { argv: ['check'], enabled: false, environment: { CI: '1' }, reason: 'the daemon does not run "check"' },
+    {
+      argv: ['build'],
+      enabled: false,
+      environment: { CI: '1' },
+      reason: 'the daemon is not enabled for this repo'
+    }
+  ])('says "$reason" for $argv', ({ reason, enabled = true, environment = {}, ...options }) => {
+    expect(selectClientRoute({ ...options, enabled, environment, rushx: false })).toMatchObject({
+      daemon: false,
+      inProcessReason: reason
+    });
+  });
+
+  it.each([
+    { argv: ['build', '--no-daemon'] },
+    { argv: ['build', '--help'] },
+    { argv: ['-h'] },
+    { argv: ['help', 'build'] },
+    { argv: ['-q'] },
+    { argv: [] }
+  ])('gives no reason when $argv asks for in-process Rush or has no command', ({ argv }) => {
+    const route: IClientRoute = selectClientRoute({
+      argv,
+      enabled: false,
+      environment: { CI: '1' },
+      rushx: false
+    });
+    expect(route.daemon).toBe(false);
+    expect(route).not.toHaveProperty('inProcessReason');
+  });
+
+  it('gives no reason for a daemon request', () => {
+    expect(
+      selectClientRoute({ argv: ['build'], enabled: true, environment: {}, rushx: false })
+    ).not.toHaveProperty('inProcessReason');
+  });
+
+  it('gives the Rushx reasons', () => {
+    const route = (options: Partial<IClientRouteOptions>): IClientRoute =>
+      selectClientRoute({ argv: ['build'], enabled: true, environment: {}, rushx: true, ...options });
+    expect(route({ hasTerminal: true }).inProcessReason).toBe(
+      'the daemon does not run scripts in a terminal'
+    );
+    expect(route({ environment: { RUSH_REPORTER: 'json' } }).inProcessReason).toBe(
+      'RUSH_REPORTER=json selects the native reporter'
+    );
+    expect(route({ argv: ['build', '--reporter=json'] })).not.toHaveProperty('inProcessReason');
+    expect(route({ argv: ['check'] })).not.toHaveProperty('inProcessReason');
+    expect(route({ enabled: false }).inProcessReason).toBe('the daemon is not enabled for this repo');
+  });
+});
diff --git a/apps/rush-cli-client/src/test/rushxFallbackLines.test.ts b/apps/rush-cli-client/src/test/rushxFallbackLines.test.ts
new file mode 100644
index 0000000000..627cd3d690
--- /dev/null
+++ b/apps/rush-cli-client/src/test/rushxFallbackLines.test.ts
@@ -0,0 +1,137 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  DaemonStartupPendingError,
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+
+// Rushx keeps a script that has a terminal in-process, so these tests hide the test runner's terminal.
+function hideTerminal(): () => void {
+  const streams: object[] = [process.stdin, process.stdout, process.stderr];
+  const descriptors: (PropertyDescriptor | undefined)[] = streams.map((stream) =>
+    Object.getOwnPropertyDescriptor(stream, 'isTTY')
+  );
+  for (const stream of streams) {
+    Object.defineProperty(stream, 'isTTY', { value: undefined, configurable: true, writable: true });
+  }
+  return () => {
+    streams.forEach((stream, index) => {
+      const descriptor: PropertyDescriptor | undefined = descriptors[index];
+      if (descriptor) Object.defineProperty(stream, 'isTTY', descriptor);
+      else delete (stream as { isTTY?: boolean }).isTTY;
+    });
+  };
+}
+
+describe('rushx-client names itself in the lines about a daemon it did not use (task 60)', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let restoreTerminal: () => void;
+  let output: jest.SpyInstance;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushx-client-fallback-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    output = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    restoreTerminal = hideTerminal();
+    process.argv = [process.execPath, 'rushx-client', 'sample'];
+    process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1' };
+    for (const name of ['RUSH_LOG_LEVEL', 'RUSH_REPORTER', 'RUSH_PREVIEW_VERSION']) delete process.env[name];
+  });
+
+  afterEach(() => {
+    restoreTerminal();
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  function expectInProcessRushx(): void {
+    expect(process.argv[1]).toBe(
+      path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rushx')
+    );
+    expect(process.argv.slice(2)).toEqual(['sample']);
+  }
+
+  it('when it cannot reach the daemon', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonClientError('startupFailed', 'No ready daemon; auto-start is disabled.'));
+    await launchClientAsync(true);
+    expectInProcessRushx();
+    expect(output.mock.calls).toEqual([
+      ['rushx-client: No ready daemon; auto-start is disabled; using in-process Rush.\n']
+    ]);
+  });
+
+  it('when the daemon sends the request back', async () => {
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      status: Promise.resolve({ pid: 42 }),
+      closeAsync: async () => undefined
+    } as unknown as DaemonClient);
+    jest.mocked(executeWithDaemonRestartAsync).mockResolvedValue({
+      kind: 'fallback',
+      reason: 'unsupported',
+      message: 'The daemon does not support explicit Rushx invocations; no request was sent.'
+    });
+    await launchClientAsync(true);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expectInProcessRushx();
+    expect(output.mock.calls).toEqual([
+      [
+        'rushx-client: The daemon does not support explicit Rushx invocations; no request was sent; ' +
+          'using in-process Rush.\n'
+      ]
+    ]);
+  });
+
+  it('when it waits for a daemon that is still starting', async () => {
+    const pending: DaemonStartupPendingError = new DaemonStartupPendingError('Still starting.');
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockImplementation(async (options) => {
+      options.onAwaitStartup?.('Its startup helper (PID 42) is still waiting for the daemon', 15000);
+      throw pending;
+    });
+    await expect(launchClientAsync(true)).rejects.toBe(pending);
+    expect(output.mock.calls).toEqual([
+      [
+        'rushx-client: The daemon is not ready yet. Its startup helper (PID 42) is still waiting for the ' +
+          'daemon, so this command waits up to 15 s more for it instead of running Rush in-process.\n'
+      ]
+    ]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
index 934fad1ace..48c1fd1ef0 100644
--- a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
+++ b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
@@ -64,7 +64,7 @@ describe('a daemon startup failure', () => {
     await expect(launchClientAsync(false)).rejects.toThrow('Another client is still starting the daemon.');
     expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledTimes(1);
     expect(process.argv).toEqual([process.execPath, 'rush-client', 'build', '--to', 'project']);
-    expect(output).not.toHaveBeenCalledWith(expect.stringContaining('Using in-process Rush'));
+    expect(output).not.toHaveBeenCalledWith(expect.stringContaining('using in-process Rush'));
   });
 
   it('says why it keeps waiting for a daemon that is still starting', async () => {
@@ -103,7 +103,7 @@ describe('a daemon startup failure', () => {
     );
     expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
     expect(output).toHaveBeenCalledWith(
-      'rush-client: No ready daemon; auto-start is disabled. Using in-process Rush.\n'
+      'rush-client: No ready daemon; auto-start is disabled; using in-process Rush.\n'
     );
   });
 });
diff --git a/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts b/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts
index 66f53b90ac..b99fed6679 100644
--- a/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts
+++ b/apps/rush-cli-client/src/test/versionSelectionFallback.test.ts
@@ -46,7 +46,10 @@ it('uses the native version selector when no compatible foreign daemon launcher
     expect(Object.isFrozen(selection.mock.calls[0][2])).toBe(true);
     expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
     expect(process.env.RUSH_DAEMON).toBeUndefined();
-    expect(output).toHaveBeenCalledWith(expect.stringContaining('Using in-process Rush'));
+    expect(output).toHaveBeenCalledWith(
+      'rush-client: Cannot launch selected Rush 5.178.1: No compatible request-launch APIs. ' +
+        'Use native Rush instead; using in-process Rush.\n'
+    );
   } finally {
     process.argv = originalArgv;
     process.env = originalEnvironment;
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t60-route-reasons_2026-09-29-03-55.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t60-route-reasons_2026-09-29-03-55.json
new file mode 100644
index 0000000000..d91c343504
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t60-route-reasons_2026-09-29-03-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "A command that the client runs in-process for a routing reason now says why in one stderr line (in agent output, or when RUSH_DAEMON=1 asked for the daemon), and shows no \"connecting to rushd\" progress line. When the daemon can't be reached, the line has the same form, `rush-client: <reason>; using in-process Rush.`, and rushx-client names itself in these lines. `rush -q build` and `rush --quiet build` are sent to the daemon; other options before the command still run in-process.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index c674e6a78e..83fb73a3bb 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -351,7 +351,7 @@ output folders are left out, because a plugin's CommonJS entry point doesn't loa
 version (`RUSH_PREVIEW_VERSION`, otherwise `rushVersion` in `rush.json`). Today both are the same, so the
 snapshot's engine is used. If a release bumps `apps/rush` and `libraries/rush-lib` without updating
 `rushVersion`, the client instead looks for a daemon-capable published release of the selected version.
-None exists, so every build falls back to native Rush, with a `rush-client: ... Using in-process Rush.`
+None exists, so every build falls back to native Rush, with a `rush-client: ...; using in-process Rush.`
 message (see [Confirm](#4-confirm-that-the-daemon-served-the-build)).
 
 To keep dogfooding in that state, select the snapshot's exact version for `rush-client` invocations only:

From b240ad51aca7c214f0933d33fd442beed304d82a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:53 +0000
Subject: [PATCH 093/265] [rush-lib] Task 97: stop printing "An unknown error
 occurred." for ended rushx scripts

Swarm integration step 78; original commit d34d57a0cf (merge of swarm/r04-t97 at cee4b61dce).
Scope: task 97.

Brings 97 (branch swarm/r04-t97). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 2 of 18. Gate: ch01 GATE OK board 4131 (tree f7530b697a)

Commits folded into this step (1):
- cee4b61dce Task 97: stop printing "An unknown error occurred." for ended rushx scripts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/RushXDaemonBoundaries.test.ts    | 14 ++++
 .../src/test/RushXDaemonTestFixture.ts        |  1 +
 ...97-served-script-end_2026-09-29-05-10.json | 11 +++
 ...97-served-script-end_2026-09-29-05-10.json | 11 +++
 .../rush-lib/src/cli/RushXCommandLine.ts      | 24 ++++--
 .../src/cli/test/RushXCommand.test.ts         | 79 +++++++++++++++++++
 libraries/rush-lib/src/utilities/Utilities.ts |  9 ++-
 7 files changed, 142 insertions(+), 7 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r04-t97-served-script-end_2026-09-29-05-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t97-served-script-end_2026-09-29-05-10.json
 create mode 100644 libraries/rush-lib/src/cli/test/RushXCommand.test.ts

diff --git a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
index 37534a31ab..7c6c90cdaa 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
@@ -239,10 +239,24 @@ describe('native Rushx execution boundaries', () => {
       kind: 'result',
       result: { exitCode: 1, aborted: true, outcome: 'aborted' }
     });
+    // The client reports the cancellation; the script's end is not an error of its own.
+    expect(result.stderr.toString()).toBe('');
     assertChildrenStopped(output);
     expect((await fixture.runAsync(fixture.request(['-q', 'args'], cwd))).exitCode).toBe(0);
   });
 
+  // cmd.exe has no built-in command that ends its own process with a signal.
+  (process.platform === 'win32' ? it.skip : it)(
+    'names the signal that ended a script, as native Rushx does',
+    async () => {
+      const cwd: string = await startAsync();
+      const served: IScriptResult = await fixture.invokeAsync(false, ['term'], cwd);
+      expect(served).toEqual(await fixture.invokeAsync(true, ['term'], cwd));
+      expect(served.exitCode).toBe(1);
+      expect(served.stderr.toString()).toContain('Error: The script was ended by SIGTERM.');
+    }
+  );
+
   it('cleans disconnected children without retrying the request', async () => {
     const cwd: string = await startAsync();
     const client: DaemonClient = await DaemonClient.connectAsync({
diff --git a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
index 0f5a87b511..49b1ff98be 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
@@ -79,6 +79,7 @@ export class RushXDaemonTestFixture implements AsyncDisposable {
             early: 'node early.cjs',
             tree: 'node tree.cjs',
             sync: 'node sync.cjs',
+            term: 'kill -TERM $$',
             daemon: 'node args.cjs'
           }
         })
diff --git a/common/changes/@microsoft/rush/swarm-r04-t97-served-script-end_2026-09-29-05-10.json b/common/changes/@microsoft/rush/swarm-r04-t97-served-script-end_2026-09-29-05-10.json
new file mode 100644
index 0000000000..1164c6eee9
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r04-t97-served-script-end_2026-09-29-05-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "A Rushx script that the Rush daemon stops because its request was cancelled or the daemon shut down no longer prints \"Error: An unknown error occurred.\" before the client's own line. A Rushx script, global command or event hook that is ended by a signal now reports \"The script was ended by <signal>.\" instead of \"An unknown error occurred.\".",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t97-served-script-end_2026-09-29-05-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t97-served-script-end_2026-09-29-05-10.json
new file mode 100644
index 0000000000..0d355453f0
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t97-served-script-end_2026-09-29-05-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test that a cancelled served Rushx script prints nothing on stderr, and that a served script ended by a signal prints the same error as native Rushx.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/RushXCommandLine.ts b/libraries/rush-lib/src/cli/RushXCommandLine.ts
index 60342cbfac..0b625d3e9c 100644
--- a/libraries/rush-lib/src/cli/RushXCommandLine.ts
+++ b/libraries/rush-lib/src/cli/RushXCommandLine.ts
@@ -164,7 +164,11 @@ export class RushXCommand {
       ignoredHooks?.handle(Event.postRushx, args.isDebug, true, consoleTerminal);
       return 0;
     } catch (error) {
-      consoleTerminal.writeErrorLine(Colorize.red('Error: ' + (error as Error).message));
+      // When the request is cancelled or the daemon shuts down, the client says so; the abort reason adds nothing.
+      const aborted: boolean = !!options.abortSignal?.aborted && error === options.abortSignal.reason;
+      if (!aborted) {
+        consoleTerminal.writeErrorLine(Colorize.red('Error: ' + (error as Error).message));
+      }
       return _getRushXExitCode(error);
     }
   }
@@ -357,7 +361,12 @@ async function _launchRushXInternalAsync(
     }
   };
   const exitCode: number = execution?.spawn
-    ? await _executeOwnedLifecycleAsync(commandWithArgs, lifecycleOptions, execution.spawn)
+    ? await _executeOwnedLifecycleAsync(
+        commandWithArgs,
+        lifecycleOptions,
+        execution.spawn,
+        execution.abortSignal
+      )
     : Utilities.executeLifecycleCommand(commandWithArgs, lifecycleOptions);
 
   execution?.abortSignal?.throwIfAborted();
@@ -541,7 +550,8 @@ function _getPackageJsonFilePath(lookup: PackageJsonLookup, cwd: string): string
 function _executeOwnedLifecycleAsync(
   command: string,
   options: ILifecycleCommandOptions,
-  spawn: NonNullable<IRushXCommandOptions['spawn']>
+  spawn: NonNullable<IRushXCommandOptions['spawn']>,
+  abortSignal: AbortSignal | undefined
 ): Promise<number> {
   const child: childProcess.ChildProcess = Utilities.executeLifecycleCommandAsync(command, {
     ...options,
@@ -550,9 +560,11 @@ function _executeOwnedLifecycleAsync(
   });
   return new Promise((resolve, reject) => {
     child.once('error', reject);
-    child.once('close', (code) => {
-      if (code === null) reject(new Error('An unknown error occurred.'));
-      else resolve(code);
+    child.once('close', (code, signal) => {
+      if (code !== null) resolve(code);
+      // The daemon ends the script when the request is cancelled or the daemon shuts down.
+      else if (abortSignal?.aborted) reject(abortSignal.reason);
+      else reject(new Error(Utilities.describeLifecycleCommandSignal(signal ?? undefined)));
     });
   });
 }
diff --git a/libraries/rush-lib/src/cli/test/RushXCommand.test.ts b/libraries/rush-lib/src/cli/test/RushXCommand.test.ts
new file mode 100644
index 0000000000..a488e0ed43
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushXCommand.test.ts
@@ -0,0 +1,79 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import { EventEmitter } from 'node:events';
+
+import { PackageJsonLookup } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { RushXCommand } from '../RushXCommandLine';
+
+type EndScript = (child: EventEmitter, controller: AbortController) => void;
+
+interface IServedResult {
+  exitCode: number;
+  stderr: string;
+}
+
+async function runOwnedScriptAsync(endScript: EndScript): Promise<IServedResult> {
+  const controller: AbortController = new AbortController();
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const terminal: Terminal = new Terminal(terminalProvider);
+  const exitCode: number = await RushXCommand.executeAsync({
+    arguments: RushXCommand.parseArguments(['-q', 'nap'], {}),
+    abortSignal: controller.signal,
+    cwd: '/repo/app',
+    environment: {},
+    rushConfiguration: undefined,
+    terminal,
+    consoleTerminal: terminal,
+    launchOptions: { isManaged: false },
+    spawn: () => {
+      const child: EventEmitter = new EventEmitter();
+      setImmediate(() => endScript(child, controller));
+      return child as childProcess.ChildProcess;
+    }
+  });
+  return { exitCode, stderr: terminalProvider.getErrorOutput({ normalizeSpecialCharacters: false }) };
+}
+
+describe(`${RushXCommand.name} with an owned spawn`, () => {
+  beforeEach(() => {
+    jest
+      .spyOn(PackageJsonLookup.prototype, 'tryGetPackageJsonFilePathFor')
+      .mockReturnValue('/repo/app/package.json');
+    jest
+      .spyOn(PackageJsonLookup.prototype, 'loadPackageJson')
+      .mockReturnValue({ name: 'app', version: '1.0.0', scripts: { nap: 'sleep 60' } });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('prints nothing for a script that ends because the request was aborted', async () => {
+    const result: IServedResult = await runOwnedScriptAsync((child, controller) => {
+      controller.abort(new Error('The request was cancelled.'));
+      child.emit('close', null, 'SIGTERM');
+    });
+    expect(result).toEqual({ exitCode: 1, stderr: '' });
+  });
+
+  it('prints an error that is not the abort reason, even after an abort', async () => {
+    const result: IServedResult = await runOwnedScriptAsync((child, controller) => {
+      controller.abort(new Error('The request was cancelled.'));
+      child.emit('error', new Error('spawn sh EACCES'));
+    });
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain('Error: spawn sh EACCES');
+  });
+
+  it('names the signal that ended a script when the request was not aborted', async () => {
+    const result: IServedResult = await runOwnedScriptAsync((child) => {
+      child.emit('close', null, 'SIGKILL');
+    });
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain('Error: The script was ended by SIGKILL.');
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/Utilities.ts b/libraries/rush-lib/src/utilities/Utilities.ts
index df68af0e61..35059c6e21 100644
--- a/libraries/rush-lib/src/utilities/Utilities.ts
+++ b/libraries/rush-lib/src/utilities/Utilities.ts
@@ -513,10 +513,17 @@ export class Utilities {
     if (result.status !== null) {
       return result.status;
     } else {
-      throw result.error || new Error('An unknown error occurred.');
+      throw result.error || new Error(Utilities.describeLifecycleCommandSignal(result.signal ?? undefined));
     }
   }
 
+  /**
+   * Describes a lifecycle command that ended without an exit code.
+   */
+  public static describeLifecycleCommandSignal(signal: NodeJS.Signals | undefined): string {
+    return signal ? `The script was ended by ${signal}.` : 'An unknown error occurred.';
+  }
+
   /**
    * Executes the command using cmd if running on windows, or using sh if running on a non-windows OS.
    * @param command - the command to run on shell

From e36dd1b55b656d5022544db648225da76fafb358 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:53 +0000
Subject: [PATCH 094/265] [rush-daemon] After a client leaves a shared
 iteration, unstarted work that only departed clients needed is skipped

Swarm integration step 79; original commit 2890025999 (merge of swarm/r05-t99-int at 1cac4735d0).
Refs: task 99.
Scope: task 99-int.

Brings 99-int (branch swarm/r05-t99-int). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 3 of 18. Gate: ch01 GATE OK board 4131 (tree 61834a6fd6)

Commits folded into this step (1):
- c60d5fc80e [rush-daemon] After a client leaves a shared iteration, unstarted work that only departed clients needed is skipped (task 99)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...thhold-departed-work_2026-09-28-19-20.json | 10 +++
 libraries/rush-daemon/README.md               |  9 ++-
 .../rush-daemon/src/PhasedIterationDemand.ts  | 45 +++++++++--
 .../rush-daemon/src/PhasedRequestRouter.ts    | 12 +--
 .../src/test/PhasedIterationDemand.test.ts    | 79 +++++++++++++++++--
 .../test/PhasedRequestCancellation.test.ts    | 69 +++++++++++++++-
 6 files changed, 202 insertions(+), 22 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-withhold-departed-work_2026-09-28-19-20.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-withhold-departed-work_2026-09-28-19-20.json b/common/changes/@rushstack/rush-daemon/swarm-r05-withhold-departed-work_2026-09-28-19-20.json
new file mode 100644
index 0000000000..0e8a256664
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-withhold-departed-work_2026-09-28-19-20.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a client leaves a shared build, operations that only departed clients needed and that have not started are skipped instead of run, so they no longer hold execution slots that the remaining clients' operations are waiting for.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index ffbbaface0..b596b256bb 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -583,10 +583,11 @@ remaining clients. The last client that still needs the iteration receives its r
 release, as for a single client. An early result is not published when any of the client's operations was aborted;
 iteration-wide failures that occur after an early result are reported only to the remaining clients. Requests
 admitted after scheduling starts form a later batch. Cancelling or disconnecting one client removes its subscription without aborting work needed by other
-clients; the graph iteration is aborted once every client in that batch has stopped needing it, or once every
-operation that a remaining client needs has finished while work that only departed clients needed has not. In the
-latter case unstarted operations never start and running ones are terminated, so neither the remaining client's
-result nor later requests wait for work that nobody needs.
+clients. From then on, operations that only departed clients needed and that have not been handed to an execution slot
+finish as skipped without running, like operations that no client selected. The graph iteration is aborted once every
+client in that batch has stopped needing it, or once every operation that a remaining client needs has finished while
+work that only departed clients needed is still running. In the latter case the running operations are terminated, so
+neither the remaining client's result nor later requests wait for work that nobody needs.
 
 The typed phased router remains separate from native initialization. `ProductionDaemonRequestResolver` supplies
 validated exact selections from `PhasedCommandEngine`; other integrations retain the existing dependency-closure
diff --git a/libraries/rush-daemon/src/PhasedIterationDemand.ts b/libraries/rush-daemon/src/PhasedIterationDemand.ts
index 2349b884e8..8e6f3d129b 100644
--- a/libraries/rush-daemon/src/PhasedIterationDemand.ts
+++ b/libraries/rush-daemon/src/PhasedIterationDemand.ts
@@ -1,20 +1,33 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IOperationExecutionResult, Operation } from '@microsoft/rush-lib';
+import type { IConfigurableOperation, IOperationExecutionResult, Operation } from '@microsoft/rush-lib';
+import { OperationStatus } from '@microsoft/rush-lib';
 
 import type { IRequestEventSink } from './PhasedRequestEventMultiplexer';
 import { TERMINAL_OPERATION_STATUSES } from './PhasedRequestEventSink';
 
+/** The statuses of a record that the graph has not handed to an execution slot yet. */
+const UNDISPATCHED_OPERATION_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Waiting,
+  OperationStatus.Ready
+]);
+
 /**
  * Tracks whether the unfinished work of a shared iteration is still needed by one of the batch's remaining clients.
  *
  * @remarks
  * A batch arms the tracker when a participating client leaves (cancellation or output failure) while other
- * participants remain. From then on, the tracker reports the iteration as abandoned, exactly once, as soon as every
- * operation that a remaining client needs has reached a terminal status while enabled operations that only departed
- * clients needed are still unfinished. Disabled operations finish without running anything, so they alone never
- * make an iteration abandoned.
+ * participants remain. From then on:
+ *
+ * - Operations that no remaining client needs and that the graph has not handed to an execution slot yet are
+ *   withheld: they are disabled, so they finish as skipped without running anything, like operations that no
+ *   client selected. An operation that already has a slot keeps it.
+ *
+ * - The tracker reports the iteration as abandoned, exactly once, as soon as every operation that a remaining client
+ *   needs has reached a terminal status while enabled operations that only departed clients needed are still
+ *   unfinished. Disabled operations finish without running anything, so they alone never make an iteration
+ *   abandoned.
  *
  * The tracker observes status changes rather than completion events: the graph dispatches an operation's dependents
  * before that operation's completion event, so aborting on completion could start a process only to terminate it.
@@ -40,6 +53,7 @@ export class PhasedIterationDemand implements IRequestEventSink {
    */
   public restrictTo(neededOperations: Iterable<Operation>): void {
     this.#needed = new Set(neededOperations);
+    this.#withholdUnneeded();
     this.#countNeededUnfinished();
     this.#evaluate();
   }
@@ -51,6 +65,7 @@ export class PhasedIterationDemand implements IRequestEventSink {
         this.#unfinished.add(record);
       }
     }
+    this.#withholdUnneeded();
     this.#countNeededUnfinished();
     this.#evaluate();
   }
@@ -65,6 +80,26 @@ export class PhasedIterationDemand implements IRequestEventSink {
     }
   }
 
+  #withholdUnneeded(): void {
+    const needed: ReadonlySet<Operation> | undefined = this.#needed;
+    if (!needed) {
+      return;
+    }
+    for (const record of this.#unfinished) {
+      if (
+        record.enabled &&
+        !needed.has(record.operation) &&
+        UNDISPATCHED_OPERATION_STATUSES.has(record.status)
+      ) {
+        // The iteration's records are the configurable operations of `configureIteration`. A record reads
+        // `enabled` when its execution starts, and so do the plugins that would otherwise restore it from the build
+        // cache or record its results.
+        const configurable: IConfigurableOperation = record;
+        configurable.enabled = false;
+      }
+    }
+  }
+
   #countNeededUnfinished(): void {
     let neededUnfinished: number = 0;
     if (this.#needed) {
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 193e881b18..c1924a2427 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -716,10 +716,11 @@ class PhasedRequestBatchCoordinator {
    * Narrows the running iteration to the remaining participants' selections after a participant left it.
    *
    * @remarks
-   * The departed client's selection stays merged into the iteration, so without this the last remaining
-   * participant would wait for, and queued requests would queue behind, work that only the departed client needed.
-   * Once every operation a remaining participant needs has finished, the iteration is aborted instead: operations
-   * that have not started are never started, and running ones are terminated, as when every client cancels.
+   * The departed client's selection stays merged into the iteration, so without this the remaining participants
+   * would wait for, and queued requests would queue behind, work that only the departed client needed. Operations
+   * that no remaining participant needs and that have not been handed to an execution slot finish as skipped
+   * instead of starting. Once every operation a remaining participant needs has finished, the iteration is aborted
+   * if unneeded work is still running, which terminates that work, as when every client cancels.
    */
   #restrictBatchDemand(): void {
     this.#batchDemand?.restrictTo(
@@ -774,7 +775,8 @@ class PhasedRequestBatchCoordinator {
    * drains them before writing the result. The iteration, graph lease and execution lease stay owned by the batch.
    * The last participant that needs the iteration keeps the ordinary contract: its result follows iteration end
    * and execution lease release, so single-client requests and warm-state retention are unchanged. When other
-   * participants left the batch, `#restrictBatchDemand` makes that end prompt by aborting work only they needed.
+   * participants left the batch, `#restrictBatchDemand` makes that end prompt by skipping or aborting work only they
+   * needed.
    */
   #finishSettledEntry(entry: IBatchEntry): void {
     if (
diff --git a/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
index 476d3d4c62..40ece2342b 100644
--- a/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
@@ -7,7 +7,7 @@ import { OperationStatus } from '@microsoft/rush-lib';
 import { PhasedIterationDemand } from '../PhasedIterationDemand';
 
 interface ITestRecord {
-  readonly enabled: boolean;
+  enabled: boolean;
   readonly operation: Operation;
   status: OperationStatus;
 }
@@ -52,6 +52,7 @@ describe(PhasedIterationDemand.name, () => {
 
     expect(abandonedCount()).toBe(0);
     expect(demand.abandoned).toBe(false);
+    expect(other.enabled).toBe(true);
   });
 
   it('reports abandonment once, when the needed work finishes before enabled unneeded work', () => {
@@ -60,10 +61,11 @@ describe(PhasedIterationDemand.name, () => {
     const running: ITestRecord = createRecord('running');
     const waiting: ITestRecord = createRecord('waiting');
     schedule(needed, running, waiting);
-    demand.restrictTo([needed.operation]);
     setStatus(running, OperationStatus.Executing);
+    demand.restrictTo([needed.operation]);
     setStatus(needed, OperationStatus.Executing);
     expect(abandonedCount()).toBe(0);
+    expect([running.enabled, waiting.enabled]).toEqual([true, false]);
 
     setStatus(needed, OperationStatus.Success);
     expect(abandonedCount()).toBe(1);
@@ -79,6 +81,7 @@ describe(PhasedIterationDemand.name, () => {
     const needed: ITestRecord = createRecord('needed');
     const other: ITestRecord = createRecord('other');
     schedule(needed, other);
+    setStatus(other, OperationStatus.Executing);
     demand.restrictTo([needed.operation]);
 
     setStatus(other, OperationStatus.Success);
@@ -102,7 +105,9 @@ describe(PhasedIterationDemand.name, () => {
     const { abandonedCount, demand, schedule, setStatus } = createDemand();
     const first: ITestRecord = createRecord('first');
     const second: ITestRecord = createRecord('second');
-    schedule(first, second, createRecord('unneeded'));
+    const unneeded: ITestRecord = createRecord('unneeded');
+    schedule(first, second, unneeded);
+    setStatus(unneeded, OperationStatus.Executing);
     demand.restrictTo([first.operation, second.operation]);
 
     setStatus(first, OperationStatus.Success);
@@ -119,8 +124,10 @@ describe(PhasedIterationDemand.name, () => {
   it('reports abandonment at once when it is armed after the needed work finished', () => {
     const { abandonedCount, demand, schedule, setStatus } = createDemand();
     const needed: ITestRecord = createRecord('needed');
-    schedule(needed, createRecord('unneeded'));
+    const unneeded: ITestRecord = createRecord('unneeded');
+    schedule(needed, unneeded);
     setStatus(needed, OperationStatus.FromCache);
+    setStatus(unneeded, OperationStatus.Executing);
     expect(abandonedCount()).toBe(0);
 
     demand.restrictTo([needed.operation]);
@@ -132,27 +139,85 @@ describe(PhasedIterationDemand.name, () => {
     const { abandonedCount, demand, schedule, setStatus } = createDemand();
     const small: ITestRecord = createRecord('small');
     const large: ITestRecord = createRecord('large');
-    schedule(small, large, createRecord('departed'));
+    const departed: ITestRecord = createRecord('departed');
+    schedule(small, large, departed);
+    setStatus(departed, OperationStatus.Executing);
     demand.restrictTo([small.operation, large.operation]);
     setStatus(small, OperationStatus.Success);
     expect(abandonedCount()).toBe(0);
+    expect(large.enabled).toBe(true);
 
     demand.restrictTo([small.operation]);
 
+    expect(large.enabled).toBe(false);
     expect(abandonedCount()).toBe(1);
   });
 
-  it('applies an arming that precedes scheduling, and treats records that are already terminal as finished', () => {
+  it('applies an arming that precedes scheduling, and withholds the unneeded work when it is scheduled', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const unneeded: ITestRecord = createRecord('unneeded');
+    unneeded.status = OperationStatus.Ready;
+    demand.restrictTo([needed.operation]);
+
+    schedule(needed, unneeded);
+
+    expect([needed.enabled, unneeded.enabled]).toEqual([true, false]);
+    setStatus(needed, OperationStatus.Success);
+    expect(abandonedCount()).toBe(0);
+  });
+
+  it('treats records that are already terminal when the iteration is scheduled as finished', () => {
     const { abandonedCount, demand, schedule, setStatus } = createDemand();
     const needed: ITestRecord = createRecord('needed');
     const alreadyFinished: ITestRecord = createRecord('already-finished');
     alreadyFinished.status = OperationStatus.Success;
+    const running: ITestRecord = createRecord('running');
+    schedule(needed, alreadyFinished, running);
+    setStatus(running, OperationStatus.Executing);
     demand.restrictTo([needed.operation, alreadyFinished.operation]);
-    schedule(needed, alreadyFinished, createRecord('unneeded'));
     expect(abandonedCount()).toBe(0);
 
     setStatus(needed, OperationStatus.Success);
 
     expect(abandonedCount()).toBe(1);
   });
+
+  it('withholds only the unneeded work that the graph has not handed to an execution slot', () => {
+    const { demand, schedule, setStatus } = createDemand();
+    const neededWaiting: ITestRecord = createRecord('needed-waiting');
+    const neededReady: ITestRecord = createRecord('needed-ready');
+    const waiting: ITestRecord = createRecord('waiting');
+    const ready: ITestRecord = createRecord('ready');
+    const queued: ITestRecord = createRecord('queued');
+    const executing: ITestRecord = createRecord('executing');
+    schedule(neededWaiting, neededReady, waiting, ready, queued, executing);
+    setStatus(neededReady, OperationStatus.Ready);
+    setStatus(ready, OperationStatus.Ready);
+    setStatus(queued, OperationStatus.Queued);
+    setStatus(executing, OperationStatus.Executing);
+
+    demand.restrictTo([neededWaiting.operation, neededReady.operation]);
+
+    expect(
+      [neededWaiting, neededReady, waiting, ready, queued, executing].map((record) => record.enabled)
+    ).toEqual([true, true, false, false, true, true]);
+  });
+
+  it('does not report abandonment when all unneeded work was withheld', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const unneeded: ITestRecord = createRecord('unneeded');
+    schedule(needed, unneeded);
+    setStatus(needed, OperationStatus.Executing);
+    demand.restrictTo([needed.operation]);
+
+    setStatus(needed, OperationStatus.Success);
+
+    expect(unneeded.enabled).toBe(false);
+    expect(abandonedCount()).toBe(0);
+    // The withheld record finishes as skipped when the graph dispatches it.
+    setStatus(unneeded, OperationStatus.Skipped);
+    expect(abandonedCount()).toBe(0);
+  });
 });
diff --git a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
index 7664b94116..41fe02d580 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestCancellation.test.ts
@@ -363,7 +363,8 @@ describe('phased request client cancellation', () => {
     expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
       expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success })
     ]);
-    expect(abortSpy).toHaveBeenCalledWith({ terminateRunning: true });
+    // The abandoned operations had not started, so they finished as skipped and nothing had to be aborted.
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
     expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
     expect(fixture.runners.get(OPERATION_C)?.runCount).toBe(0);
     // The remaining client's result stays warm; the abandoned operations are not retained.
@@ -372,6 +373,72 @@ describe('phased request client cancellation', () => {
     );
   });
 
+  it('never starts work that only a cancelled client needed while the remaining client still needs its own', async () => {
+    const { hanging: shared, actionAsync: sharedActionAsync } = createHangingOperation();
+    const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();
+    // The cancelled client needs A, C and D. The remaining client needs A and B. Once A finishes, the queue hands C to
+    // the only slot before B: C comes later in the graph's order and, through D, has the longer critical path.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Success, sharedActionAsync)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C, OperationStatus.Success, orphanActionAsync)],
+        [OPERATION_D, new TestOperationRunner(OPERATION_D)]
+      ]),
+      [
+        [OPERATION_B, OPERATION_A],
+        [OPERATION_C, OPERATION_A],
+        [OPERATION_D, OPERATION_C]
+      ],
+      { supportsTerminateRunning: true }
+    );
+    const abortSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'abortCurrentIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const cancelledClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const cancelled: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('cancelled', OPERATION_D),
+      cancelledClient
+    );
+    const continuing: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('continuing', OPERATION_B),
+      new TestPhasedRequestClient('two')
+    );
+    await shared.started;
+
+    cancelledClient.abortController.abort();
+    expect(await cancelled).toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    const releasedAt: number = Date.now();
+    shared.release();
+    const result: IDaemonPhasedRequestResult | typeof TIMED_OUT = await raceWithTimeoutAsync(
+      continuing,
+      PROMPT_CANCELLATION_MS
+    );
+    // Lets an iteration that started the abandoned work finish, so a failure below is reported cleanly.
+    orphan.release();
+
+    expect(result).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(Date.now() - releasedAt).toBeLessThan(PROMPT_CANCELLATION_MS);
+    expect((result as IDaemonPhasedRequestResult).operationResults).toEqual([
+      expect.objectContaining({ operationId: OPERATION_A, status: OperationStatus.Success }),
+      expect.objectContaining({ operationId: OPERATION_B, status: OperationStatus.Success })
+    ]);
+    expect(
+      [OPERATION_A, OPERATION_B, OPERATION_C, OPERATION_D].map((id: string) => fixture.runners.get(id)?.runCount)
+    ).toEqual([1, 1, 0, 0]);
+    expect(abortSpy).not.toHaveBeenCalledWith({ terminateRunning: true });
+    // The skipped operations are not retained, so the next request that selects them runs them.
+    expect(new Set([...fixture.graph.resultByOperation.keys()].map(({ name }) => name))).toEqual(
+      new Set([OPERATION_A, OPERATION_B])
+    );
+    const next: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('next', OPERATION_D),
+      new TestPhasedRequestClient('three')
+    );
+    expect(next).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect([OPERATION_C, OPERATION_D].map((id: string) => fixture.runners.get(id)?.runCount)).toEqual([1, 1]);
+  });
+
   it('terminates running work that only a cancelled client needed once the remaining client has its operations', async () => {
     const { hanging: remaining, actionAsync: remainingActionAsync } = createHangingOperation();
     const { hanging: orphan, actionAsync: orphanActionAsync } = createHangingOperation();

From af084ae351bf11e2896242af2efd6503088367fe Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:53 +0000
Subject: [PATCH 095/265] [rush-lib] Test legacy skip records for rebuild and
 disabled cache

Swarm integration step 80; original commit 41e0b83549 (merge of swarm/r03-t180-nit1 at 60aec3136f).
Refs: n180 NIT.
Scope: task 180-nit1.

Brings 180-nit1 (branch swarm/r03-t180-nit1). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 4 of 18. Gate: ch01 GATE OK board 4131 (tree faf1d81f09)

Commits folded into this step (3):
- 59abe93a06 rush-lib: keep legacy skip detection from trusting replaced outputs
- 430fd46a7f rush-lib: test which strategies delete the legacy skip records (180 NIT 1)
- 60aec3136f rush-lib: test legacy skip records for rebuild and disabled cache (n180 NIT)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...cy-skip-invalidation_2026-09-29-03-30.json |  11 +
 .../cli/scriptActions/PhasedScriptAction.ts   |   7 +-
 .../RushCommandLineParserLegacySkip.test.ts   | 196 +++++++++++
 .../cli/test/legacySkipRepo/a/package.json    |   8 +
 .../cli/test/legacySkipRepo/b/package.json    |  11 +
 .../src/cli/test/legacySkipRepo/rush.json     |  17 +
 .../src/logic/operations/LegacySkipPlugin.ts  |  49 ++-
 .../operations/test/LegacySkipPlugin.test.ts  | 328 ++++++++++++++++++
 8 files changed, 619 insertions(+), 8 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/r03-legacy-skip-invalidation_2026-09-29-03-30.json
 create mode 100644 libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
 create mode 100644 libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json
 create mode 100644 libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json
 create mode 100644 libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json
 create mode 100644 libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts

diff --git a/common/changes/@microsoft/rush/r03-legacy-skip-invalidation_2026-09-29-03-30.json b/common/changes/@microsoft/rush/r03-legacy-skip-invalidation_2026-09-29-03-30.json
new file mode 100644
index 0000000000..69178208b6
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-legacy-skip-invalidation_2026-09-29-03-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where, with the build cache disabled, Rush could skip an operation whose outputs had since been replaced for other inputs, by a build cache restore or by a command that ran the operation with the build cache enabled or with \"disableBuildCache\".",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index f0d18842c3..5c84d7aabe 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -76,7 +76,7 @@ import { CobuildConfiguration } from '../../api/CobuildConfiguration';
 import { CacheableOperationPlugin } from '../../logic/operations/CacheableOperationPlugin';
 import type { IInputsSnapshot, GetInputsSnapshotAsyncFn } from '../../logic/incremental/InputsSnapshot';
 import { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
-import { LegacySkipPlugin } from '../../logic/operations/LegacySkipPlugin';
+import { LegacySkipInvalidationPlugin, LegacySkipPlugin } from '../../logic/operations/LegacySkipPlugin';
 import { ValidateOperationsPlugin } from '../../logic/operations/ValidateOperationsPlugin';
 import { ShardedPhasedOperationPlugin } from '../../logic/operations/ShardedPhaseOperationPlugin';
 import { FlagFile } from '../../api/FlagFile';
@@ -721,6 +721,11 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           },
           isPnpm
         } = this.rushConfiguration;
+        if (buildCacheConfiguration?.buildCacheEnabled || this.#disableBuildCache) {
+          // These strategies change outputs without updating the records of legacy skip detection, which a
+          // later command without the build cache would otherwise trust.
+          new LegacySkipInvalidationPlugin().apply(this.hooks);
+        }
         if (buildCacheConfiguration?.buildCacheEnabled) {
           terminal.writeVerboseLine(`Incremental strategy: cache restoration`);
           new CacheableOperationPlugin({
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
new file mode 100644
index 0000000000..b629f6b17e
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
@@ -0,0 +1,196 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock(`@rushstack/package-deps-hash`, () => {
+  return {
+    getRepoRoot(dir: string): string {
+      return dir;
+    },
+    getDetailedRepoStateAsync(): IDetailedRepoState {
+      return {
+        hasSubmodules: false,
+        hasUncommittedChanges: false,
+        files: new Map([['common/config/rush/npm-shrinkwrap.json', 'hash']]),
+        symlinks: new Map()
+      };
+    },
+    getRepoChangesAsync(): ReadonlyMap<string, string> {
+      return new Map();
+    },
+    getGitHashForFiles(filePaths: Iterable<string>): ReadonlyMap<string, string> {
+      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+    },
+    hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): Promise<ReadonlyMap<string, string>> {
+      return Promise.resolve(new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath])));
+    }
+  };
+});
+
+import './mockRushCommandLineParser';
+
+import * as path from 'node:path';
+import type { SpawnOptions } from 'node:child_process';
+
+import { FileSystem, JsonFile, LockFile } from '@rushstack/node-core-library';
+import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
+
+import type { RushCommandLineParser } from '../RushCommandLineParser';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import {
+  getCommandLineParserInstanceAsync,
+  isolateEnvironmentConfigurationForTests,
+  setSpawnMock,
+  type IEnvironmentConfigIsolation,
+  type SpawnMockCall
+} from './TestUtils';
+
+// The repo has no command-line.json, so "build" is the default command, which uses legacy skip detection.
+const REPO_NAME: string = 'legacySkipRepo';
+const PROJECT_FOLDER_NAMES: ReadonlyArray<string> = ['a', 'b'];
+
+jest.setTimeout(1000000);
+
+/**
+ * Executes the command and returns the folder names of the projects whose script it spawned.
+ */
+async function executeAsync(parser: RushCommandLineParser, spawnMock: jest.Mock): Promise<string[]> {
+  spawnMock.mockClear();
+  await expect(parser.executeAsync()).resolves.toEqual(true);
+  return spawnMock.mock.calls
+    .map((spawnCall: SpawnMockCall) => path.basename(String((spawnCall[2] as SpawnOptions).cwd)))
+    .sort();
+}
+
+/**
+ * Runs another command in a repo that {@link getCommandLineParserInstanceAsync} created, as a new Rush process
+ * would.
+ */
+async function runAsync(repoPath: string, commandName: string): Promise<string[]> {
+  const { RushCommandLineParser: Parser } = await import('../RushCommandLineParser');
+  // The parser refuses to load .env files after the previous command validated the environment.
+  EnvironmentConfiguration.reset();
+  const parser: RushCommandLineParser = new Parser({ cwd: repoPath });
+  process.argv = ['pretend-this-is-node.exe', 'pretend-this-is-rush', commandName];
+  return await executeAsync(parser, setSpawnMock());
+}
+
+/**
+ * Returns the folder names of the projects that have a legacy skip record for the "build" command.
+ */
+function getProjectsWithRecords(repoPath: string): string[] {
+  return PROJECT_FOLDER_NAMES.filter((projectFolderName: string) =>
+    FileSystem.exists(`${repoPath}/${projectFolderName}/.rush/temp/package-deps_build.json`)
+  );
+}
+
+describe('RushCommandLineParser legacy skip records', () => {
+  let _envIsolation: IEnvironmentConfigIsolation;
+  let _lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire>;
+  let _originalExitCode: string | number | undefined;
+
+  beforeEach(() => {
+    // A command that succeeds sets process.exitCode to 0. When Jest runs only this file, it shares the
+    // process with Heft, which would then exit with 0 even though tests failed.
+    _originalExitCode = process.exitCode;
+    _envIsolation = isolateEnvironmentConfigurationForTests();
+
+    // Rush keeps the repo lock until the process exits, so it would refuse the second command in a repo.
+    const tryAcquire: typeof LockFile.tryAcquire = LockFile.tryAcquire.bind(LockFile);
+    _lockSpy = jest
+      .spyOn(LockFile, 'tryAcquire')
+      .mockImplementation((resourceFolder: string, resourceName: string) =>
+        resourceName === 'rush' ? ({} as LockFile) : tryAcquire(resourceFolder, resourceName)
+      );
+  });
+
+  afterEach(() => {
+    _lockSpy.mockRestore();
+    jest.clearAllMocks();
+    _envIsolation.restore();
+    process.exitCode = _originalExitCode;
+  });
+
+  it('keeps the records in a build without the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+
+    expect(await runAsync(repoPath, 'build')).toEqual([]);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+
+  it('keeps the records in a build whose build-cache.json disables the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    // "rush init" creates build-cache.json with the build cache disabled.
+    await JsonFile.saveAsync(
+      { buildCacheEnabled: false, cacheProvider: 'local-only' },
+      `${repoPath}/common/config/rush/build-cache.json`,
+      { ensureFolderExists: true }
+    );
+    expect(await runAsync(repoPath, 'build')).toEqual([]);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+
+  it('deletes the records in a build with the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    const buildCacheJsonPath: string = `${repoPath}/common/config/rush/build-cache.json`;
+    await JsonFile.saveAsync({ buildCacheEnabled: true, cacheProvider: 'local-only' }, buildCacheJsonPath, {
+      ensureFolderExists: true
+    });
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual([]);
+
+    // Without the records, a later build without the build cache can't skip the projects.
+    await FileSystem.deleteFileAsync(buildCacheJsonPath);
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+
+  it('deletes the records in a rebuild with the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    // A rebuild replaces the outputs even though it never skips.
+    await JsonFile.saveAsync(
+      { buildCacheEnabled: true, cacheProvider: 'local-only' },
+      `${repoPath}/common/config/rush/build-cache.json`,
+      { ensureFolderExists: true }
+    );
+    expect(await runAsync(repoPath, 'rebuild')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual([]);
+  });
+
+  it('deletes the records in a command that disables the build cache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+
+    const commandLineJsonPath: string = `${repoPath}/common/config/rush/command-line.json`;
+    await JsonFile.saveAsync(
+      {
+        commands: [
+          {
+            commandKind: 'bulk',
+            name: 'build',
+            summary: 'Builds every project, without the build cache or skipping.',
+            enableParallelism: true,
+            incremental: true,
+            disableBuildCache: true
+          }
+        ]
+      },
+      commandLineJsonPath,
+      { ensureFolderExists: true }
+    );
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual([]);
+
+    // Without the records, the build can't skip the projects once it uses legacy skip detection again.
+    await FileSystem.deleteFileAsync(commandLineJsonPath);
+    expect(await runAsync(repoPath, 'build')).toEqual(['a', 'b']);
+    expect(getProjectsWithRecords(repoPath)).toEqual(['a', 'b']);
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json
new file mode 100644
index 0000000000..7ee3b0abd1
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/a/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "a",
+  "version": "1.0.0",
+  "description": "Test package a",
+  "scripts": {
+    "build": "fake_build_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json
new file mode 100644
index 0000000000..c8e366acc5
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/b/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "b",
+  "version": "1.0.0",
+  "description": "Test package b",
+  "dependencies": {
+    "a": "1.0.0"
+  },
+  "scripts": {
+    "build": "fake_build_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json
new file mode 100644
index 0000000000..f39da1606c
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/rush.json
@@ -0,0 +1,17 @@
+{
+  "npmVersion": "6.4.1",
+  "rushVersion": "5.5.2",
+  "projectFolderMinDepth": 1,
+  "projectFolderMaxDepth": 99,
+
+  "projects": [
+    {
+      "packageName": "a",
+      "projectFolder": "a"
+    },
+    {
+      "packageName": "b",
+      "projectFolder": "b"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index b7eb963fe8..fff4b83541 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -15,6 +15,18 @@ import type { IOperationExecutionResult } from './IOperationExecutionResult';
 import { wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'LegacySkipPlugin' = 'LegacySkipPlugin';
+const INVALIDATION_PLUGIN_NAME: 'LegacySkipInvalidationPlugin' = 'LegacySkipInvalidationPlugin';
+
+/**
+ * Returns the path of the file in which {@link LegacySkipPlugin} records the inputs of the last successful
+ * execution of an operation.
+ */
+function _getPackageDepsPath(operation: Operation): string {
+  return path.join(
+    operation.associatedProject.projectRushTempFolder,
+    `package-deps_${operation.logFilenameIdentifier}.json`
+  );
+}
 
 function _areShallowEqual(object1: JsonObject, object2: JsonObject): boolean {
   for (const n in object1) {
@@ -79,7 +91,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           for (const record of operations.values()) {
             const { operation } = record;
-            const { associatedProject, associatedPhase, runner, logFilenameIdentifier } = operation;
+            const { associatedProject, associatedPhase, runner } = operation;
             if (!runner) {
               continue;
             }
@@ -93,12 +105,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
               continue;
             }
 
-            const packageDepsFilename: string = `package-deps_${logFilenameIdentifier}.json`;
-
-            const packageDepsPath: string = path.join(
-              associatedProject.projectRushTempFolder,
-              packageDepsFilename
-            );
+            const packageDepsPath: string = _getPackageDepsPath(operation);
 
             let packageDeps: IProjectDeps | undefined;
 
@@ -270,3 +277,31 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
     });
   }
 }
+
+/**
+ * Core phased command plugin for the incremental strategies other than {@link LegacySkipPlugin}, such as
+ * build cache restoration. Before an operation executes or restores its outputs, it deletes the record of
+ * inputs that {@link LegacySkipPlugin} saved after the operation last succeeded. The outputs may afterwards
+ * belong to other inputs, so a later command without the build cache must execute the operation instead of
+ * skipping it.
+ */
+export class LegacySkipInvalidationPlugin implements IPhasedCommandPlugin {
+  public apply(hooks: PhasedCommandHooks): void {
+    hooks.onGraphCreatedAsync.tap(INVALIDATION_PLUGIN_NAME, (graph) => {
+      graph.hooks.beforeExecuteOperationAsync.tapPromise(
+        // Ahead of every plugin that may restore the outputs and then bail, such as the build cache plugin
+        { name: INVALIDATION_PLUGIN_NAME, stage: -Infinity },
+        async (
+          record: IOperationRunnerContext & IOperationExecutionResult
+        ): Promise<OperationStatus | undefined> => {
+          const { operation } = record;
+          // A disabled operation neither executes nor restores its outputs.
+          if (record.enabled && operation.runner?.cacheable) {
+            await FileSystem.deleteFileAsync(_getPackageDepsPath(operation));
+          }
+          return undefined;
+        }
+      );
+    });
+  }
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
new file mode 100644
index 0000000000..77b341be3d
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
@@ -0,0 +1,328 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../../../utilities/Utilities');
+jest.mock('../OperationStateFile');
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+jest.mock('../OperationMetadataManager', () => {
+  class MockOperationMetadataManager {
+    public readonly logFilenameIdentifier: string;
+    public readonly metadataFolderPath: string = '.rush/temp/operation/mock';
+    public readonly stateFile: { state: undefined } = { state: undefined };
+    public constructor({ operation }: { operation: { logFilenameIdentifier: string } }) {
+      this.logFilenameIdentifier = operation.logFilenameIdentifier;
+    }
+    public async saveAsync(): Promise<void> {
+      /* noop */
+    }
+    public async tryRestoreAsync(): Promise<void> {
+      /* noop */
+    }
+    public tryRestoreStopwatch<T>(originalStopwatch: T): T {
+      return originalStopwatch;
+    }
+  }
+  return { OperationMetadataManager: MockOperationMetadataManager };
+});
+jest.mock('../../buildCache/OperationBuildCache', () => ({
+  OperationBuildCache: { forOperation: jest.fn() }
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
+import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
+import { CacheableOperationPlugin } from '../CacheableOperationPlugin';
+import { LegacySkipInvalidationPlugin, LegacySkipPlugin } from '../LegacySkipPlugin';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { OperationGraph } from '../OperationGraph';
+import { Operation } from '../Operation';
+import { OperationStatus } from '../OperationStatus';
+import type { IOperationRunner } from '../IOperationRunner';
+import type { IExecutionResult } from '../IOperationExecutionResult';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: { self: new Set(), upstream: new Set() },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+/**
+ * The strategy of a command: legacy skip detection (the build cache is off), the build cache, or neither
+ * (a command that disables the build cache).
+ */
+type Strategy = 'legacy-skip' | 'build-cache' | 'none';
+
+/**
+ * A checkout of independent projects, each with one operation.
+ */
+interface ICheckout {
+  readonly folder: string;
+  /**
+   * The version of the input files of each project
+   */
+  readonly inputs: Map<string, string>;
+  /**
+   * The version of the input files that each project's outputs were built from
+   */
+  readonly outputs: Map<string, string>;
+  /**
+   * The outputs in the build cache, by project name and state hash
+   */
+  readonly cacheEntries: Map<string, string>;
+  /**
+   * The names of the projects that the last command executed
+   */
+  readonly executions: string[];
+}
+
+class MockRunner implements IOperationRunner {
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly cacheable: boolean = true;
+  public readonly warningsAreAllowed: boolean = false;
+  public readonly isNoOp: boolean = false;
+  public readonly name: string;
+  readonly #checkout: ICheckout;
+
+  public constructor(name: string, checkout: ICheckout) {
+    this.name = name;
+    this.#checkout = checkout;
+  }
+
+  public async executeAsync(): Promise<OperationStatus> {
+    this.#checkout.executions.push(this.name);
+    this.#checkout.outputs.set(this.name, this.#checkout.inputs.get(this.name)!);
+    return OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'config';
+  }
+}
+
+/**
+ * Runs a command in a new process, e.g. `rush build`, and returns the status of each project's operation.
+ */
+async function runCommandAsync(
+  checkout: ICheckout,
+  strategy: Strategy,
+  disabledNames: ReadonlySet<string> = new Set()
+): Promise<Record<string, OperationStatus>> {
+  const { folder, inputs, outputs, cacheEntries, executions } = checkout;
+  const operations: Map<string, Operation> = new Map();
+  const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
+  for (const name of inputs.keys()) {
+    const projectFolder: string = path.join(folder, name);
+    const project: RushConfigurationProject = {
+      packageName: name,
+      projectFolder,
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp')
+    } as unknown as RushConfigurationProject;
+    projectConfigurations.set(project, {
+      getCacheDisabledReason: () => undefined
+    } as unknown as RushProjectConfiguration);
+    operations.set(
+      name,
+      new Operation({
+        runner: new MockRunner(name, checkout),
+        logFilenameIdentifier: name,
+        phase: mockPhase,
+        project,
+        enabled: !disabledNames.has(name)
+      })
+    );
+  }
+
+  jest.mocked(OperationBuildCache.forOperation).mockImplementation((record) => {
+    const { packageName } = record.operation.associatedProject;
+    const getCacheKey = (): string => `${packageName}@${record.getStateHash()}`;
+    return {
+      tryRestoreFromCacheAsync: async () => {
+        const cachedOutputs: string | undefined = cacheEntries.get(getCacheKey());
+        if (cachedOutputs !== undefined) {
+          outputs.set(packageName, cachedOutputs);
+        }
+        return cachedOutputs !== undefined;
+      },
+      trySetCacheEntryAsync: async () => {
+        cacheEntries.set(getCacheKey(), outputs.get(packageName)!);
+        return true;
+      }
+    } as unknown as OperationBuildCache;
+  });
+
+  const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  if (strategy === 'legacy-skip') {
+    new LegacySkipPlugin({
+      allowWarningsInSuccessfulBuild: false,
+      terminal,
+      changedProjectsOnly: false,
+      isIncrementalBuildAllowed: true
+    }).apply(hooks);
+  } else {
+    if (strategy === 'build-cache') {
+      new CacheableOperationPlugin({
+        allowWarningsInSuccessfulBuild: false,
+        buildCacheConfiguration: {
+          buildCacheEnabled: true,
+          cacheWriteEnabled: true
+        } as unknown as BuildCacheConfiguration,
+        cobuildConfiguration: undefined,
+        terminal,
+        excludeAppleDoubleFiles: false,
+        useDirectFileTransfersForBuildCache: false
+      }).apply(hooks);
+    }
+    // Applied after the build cache plugin, which must not restore outputs before this plugin runs.
+    new LegacySkipInvalidationPlugin().apply(hooks);
+  }
+
+  const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 1,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController: new AbortController()
+  });
+  await hooks.onGraphCreatedAsync.promise(graph, {
+    isIncrementalBuildAllowed: true,
+    projectConfigurations
+  } as unknown as IOperationGraphContext);
+
+  const inputsSnapshot: IInputsSnapshot = {
+    hashes: new Map(),
+    rootDirectory: folder,
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
+      new Map([[`${project.packageName}/src/index.ts`, inputs.get(project.packageName)!]]),
+    getOperationOwnStateHash: (project: RushConfigurationProject) => inputs.get(project.packageName)!
+  };
+
+  executions.length = 0;
+  const result: IExecutionResult = await graph.executeAsync({ inputsSnapshot });
+  const statuses: Record<string, OperationStatus> = {};
+  for (const [name, operation] of operations) {
+    statuses[name] = result.operationResults.get(operation)!.status;
+  }
+  return statuses;
+}
+
+describe(LegacySkipPlugin.name, () => {
+  let checkout: ICheckout;
+
+  beforeEach(() => {
+    checkout = {
+      folder: fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-legacy-skip-')),
+      inputs: new Map([['a', 'A']]),
+      outputs: new Map(),
+      cacheEntries: new Map(),
+      executions: []
+    };
+  });
+
+  afterEach(() => {
+    fs.rmSync(checkout.folder, { recursive: true, force: true });
+  });
+
+  it('skips an operation whose inputs are unchanged since it last succeeded', async () => {
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Skipped });
+    expect(checkout.executions).toEqual([]);
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('B');
+  });
+
+  it('executes an operation whose outputs the build cache restored for other inputs since then', async () => {
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache')).toEqual({ a: OperationStatus.Success });
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache')).toEqual({ a: OperationStatus.FromCache });
+    expect(checkout.outputs.get('a')).toBe('B');
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Skipped });
+  });
+
+  it('executes an operation that the build cache plugin executed for other inputs since then', async () => {
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('A');
+  });
+
+  it('executes an operation that a command without the build cache executed for other inputs since then', async () => {
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'none')).toEqual({ a: OperationStatus.Success });
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({ a: OperationStatus.Success });
+    expect(checkout.outputs.get('a')).toBe('A');
+  });
+
+  it('still skips an operation that a command with the build cache did not execute', async () => {
+    checkout.inputs.set('b', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Success
+    });
+
+    // --only a
+    checkout.inputs.set('a', 'B');
+    expect(await runCommandAsync(checkout, 'build-cache', new Set(['b']))).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped
+    });
+
+    checkout.inputs.set('a', 'A');
+    expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped
+    });
+    expect(checkout.executions).toEqual(['a']);
+  });
+});

From c63d36c2aa3013c7372f91138b71d1e0061fe009 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 096/265] [rush-lib] Reuse the state of unchanged projects when
 taking a new inputs snapshot

Swarm integration step 81; original commit 0d7d25cff3 (merge of swarm/r07-t193 at 745e7052bb).
Scope: task 193.

Brings 193 (branch swarm/r07-t193). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 5 of 18. Gate: ch01 GATE OK board 4131 (tree 45f742b87d)

Commits folded into this step (1):
- 745e7052bb [rush-lib] Reuse the state of unchanged projects when taking a new inputs snapshot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ntal-inputs-snapshot_2026-09-29-04-15.json |  11 +
 .../src/logic/ProjectChangeAnalyzer.ts        |   6 +-
 .../src/logic/incremental/InputsSnapshot.ts   | 331 +++++++++++++--
 .../incremental/test/InputsSnapshot.test.ts   | 387 ++++++++++++++++++
 .../logic/test/ProjectChangeAnalyzer.test.ts  |   7 +
 5 files changed, 711 insertions(+), 31 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/incremental-inputs-snapshot_2026-09-29-04-15.json

diff --git a/common/changes/@microsoft/rush/incremental-inputs-snapshot_2026-09-29-04-15.json b/common/changes/@microsoft/rush/incremental-inputs-snapshot_2026-09-29-04-15.json
new file mode 100644
index 0000000000..1e13341c7c
--- /dev/null
+++ b/common/changes/@microsoft/rush/incremental-inputs-snapshot_2026-09-29-04-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a long-lived process such as the Rush daemon takes a new snapshot of the repository's inputs, reuse the state of each project whose inputs didn't change instead of computing the hashes of every project again. Also fix an issue where asking a snapshot again for the input files of an operation whose files could not be listed returned a partial result instead of failing.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
index 1c00206dc4..2720d5504c 100644
--- a/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
+++ b/libraries/rush-lib/src/logic/ProjectChangeAnalyzer.ts
@@ -507,13 +507,15 @@ export class ProjectChangeAnalyzer {
             return previousSnapshot.snapshot;
           }
 
-          const snapshot: IInputsSnapshot = new InputsSnapshot({
+          const snapshot: InputsSnapshot = new InputsSnapshot({
             additionalHashes,
             environment,
             globalAdditionalFiles,
             hashes,
             hasUncommittedChanges,
             lookupByPath,
+            // Only the projects whose inputs changed need new state, and their hashes computed again
+            previousSnapshot: previousSnapshot?.snapshot,
             projectMap,
             rootDir: rootDirectory,
             workingTreeReadStartTimeMs
@@ -813,7 +815,7 @@ interface IReusableInputsSnapshot {
   readonly environment: Readonly<Record<string, string | undefined>>;
   readonly operationAdditionalFileCount: number;
   readonly repoState: IDetailedRepoState;
-  readonly snapshot: IInputsSnapshot;
+  readonly snapshot: InputsSnapshot;
 }
 
 /**
diff --git a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
index 14949e73d4..ad96a3e900 100644
--- a/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
+++ b/libraries/rush-lib/src/logic/incremental/InputsSnapshot.ts
@@ -115,6 +115,18 @@ export interface IInputsSnapshotParameters {
    * Optimized lookup engine used to route `hashes` to individual projects.
    */
   lookupByPath: IReadonlyLookupByPath<IRushConfigurationProjectForSnapshot>;
+  /**
+   * An earlier snapshot of the same repository. The new snapshot reuses the state of each project whose inputs
+   * have the same hashes in both, including the hashes that the earlier snapshot has computed for it. This makes
+   * a snapshot in which few files changed faster to create and to query, and doesn't change any result.
+   *
+   * @remarks
+   * The state is reused only if `lookupByPath` and `projectMap` are the same objects, and the root directory,
+   * the Node.js version, the environment, the hashes of the global additional files and the number of additional
+   * files of the operations are the same. Otherwise the snapshot is created from scratch. The additional files of
+   * an operation may be added to, but not removed or replaced.
+   */
+  previousSnapshot?: InputsSnapshot;
   /**
    * Metadata for each project.
    */
@@ -131,6 +143,8 @@ export interface IInputsSnapshotParameters {
 
 const { hashDelimiter } = RushConstants;
 
+const EMPTY_MAP: ReadonlyMap<string, string> = new Map();
+
 /**
  * Represents a synchronously-queryable in-memory snapshot of the state of the inputs to a Rush repository.
  *
@@ -242,6 +256,13 @@ export class InputsSnapshot implements IInputsSnapshot {
    * Pre-computed Node.js version strings at each granularity level for `dependsOnNodeVersion`.
    */
   readonly #nodeVersionByGranularity: Readonly<Record<NodeVersionGranularity, string>>;
+  /**
+   * The inputs that a later snapshot must share to reuse the state of the projects in this one.
+   */
+  readonly #lookupByPath: IReadonlyLookupByPath<IRushConfigurationProjectForSnapshot>;
+  readonly #projectMap: IRushSnapshotProjectMetadataMap;
+  readonly #nodeVersion: string;
+  readonly #operationAdditionalFileCount: number;
 
   /**
    *
@@ -257,31 +278,11 @@ export class InputsSnapshot implements IInputsSnapshot {
       hasUncommittedChanges,
       lookupByPath,
       nodeVersion = process.version,
+      previousSnapshot,
+      projectMap,
       rootDir,
       workingTreeReadStartTimeMs
     } = params;
-    const projectMetadataMap: Map<
-      IRushConfigurationProjectForSnapshot,
-      IInternalInputsSnapshotProjectMetadata
-    > = new Map();
-    for (const [project, record] of params.projectMap) {
-      projectMetadataMap.set(project, createInternalRecord(project, record, rootDir));
-    }
-
-    // Route hashes to individual projects
-    for (const [file, hash] of hashes) {
-      const project: IRushConfigurationProjectForSnapshot | undefined = lookupByPath.findChildPath(file);
-      if (!project) {
-        continue;
-      }
-
-      let record: IInternalInputsSnapshotProjectMetadata | undefined = projectMetadataMap.get(project);
-      if (!record) {
-        projectMetadataMap.set(project, (record = createInternalRecord(project, undefined, rootDir)));
-      }
-
-      record.hashes.set(file, hash);
-    }
 
     let globalAdditionalHashes: Map<string, string> | undefined;
     if (globalAdditionalFiles) {
@@ -303,18 +304,28 @@ export class InputsSnapshot implements IInputsSnapshot {
       }
     }
 
-    for (const record of projectMetadataMap.values()) {
-      // Ensure stable ordering.
-      Sort.sortMapKeys(record.hashes);
-    }
-
-    this.#projectMetadataMap = projectMetadataMap;
+    const operationAdditionalFileCount: number = countOperationAdditionalFiles(projectMap);
+
+    this.#projectMetadataMap =
+      (previousSnapshot &&
+        previousSnapshot.#tryDeriveProjectMetadataMap(
+          params,
+          environment,
+          nodeVersion,
+          globalAdditionalHashes,
+          operationAdditionalFileCount
+        )) ??
+      createProjectMetadataMap(hashes, lookupByPath, projectMap, rootDir);
     this.#additionalHashes = additionalHashes;
     this.#globalAdditionalHashes = globalAdditionalHashes;
     // Snapshot the environment so that queries are not impacted by when they happen
     this.#environment = environment;
     // Parse Node.js version once so it doesn't need to be re-parsed per operation
     this.#nodeVersionByGranularity = _parseNodeVersion(nodeVersion);
+    this.#lookupByPath = lookupByPath;
+    this.#projectMap = projectMap;
+    this.#nodeVersion = nodeVersion;
+    this.#operationAdditionalFileCount = operationAdditionalFileCount;
     this.hashes = hashes;
     this.hasUncommittedChanges = hasUncommittedChanges;
     this.rootDirectory = rootDir;
@@ -337,7 +348,6 @@ export class InputsSnapshot implements IInputsSnapshot {
     let hashes: Map<string, string> | undefined = fileHashesByOperationName.get(operationName);
     if (!hashes) {
       hashes = new Map();
-      fileHashesByOperationName.set(operationName, hashes);
       // TODO: Support incrementalBuildIgnoredGlobs per-operation
       const filter: (filePath: string) => boolean = getOrCreateProjectFilter(record);
 
@@ -393,6 +403,9 @@ export class InputsSnapshot implements IInputsSnapshot {
           );
         }
       }
+
+      // Only a complete result is kept, so that a query that fails fails again
+      fileHashesByOperationName.set(operationName, hashes);
     }
 
     return hashes;
@@ -491,6 +504,266 @@ export class InputsSnapshot implements IInputsSnapshot {
       yield [filePath, hash];
     }
   }
+
+  /**
+   * Returns the state of each project for a later snapshot with the given parameters. It is the state of each
+   * project in this snapshot whose inputs have the same hashes, and new state for each other project. Returns
+   * undefined if the later snapshot differs from this one in more than the hashes of files.
+   */
+  #tryDeriveProjectMetadataMap(
+    params: IInputsSnapshotParameters,
+    environment: Readonly<Record<string, string | undefined>>,
+    nodeVersion: string,
+    globalAdditionalHashes: ReadonlyMap<string, string> | undefined,
+    operationAdditionalFileCount: number
+  ): Map<IRushConfigurationProjectForSnapshot, IInternalInputsSnapshotProjectMetadata> | undefined {
+    const { additionalHashes, hashes, lookupByPath, projectMap, rootDir } = params;
+    if (
+      lookupByPath !== this.#lookupByPath ||
+      projectMap !== this.#projectMap ||
+      rootDir !== this.rootDirectory ||
+      nodeVersion !== this.#nodeVersion ||
+      operationAdditionalFileCount !== this.#operationAdditionalFileCount ||
+      !areMapsEqual(globalAdditionalHashes ?? EMPTY_MAP, this.#globalAdditionalHashes ?? EMPTY_MAP) ||
+      !areEnvironmentsEqual(environment, this.#environment)
+    ) {
+      return undefined;
+    }
+
+    const changedFiles: Set<string> = new Set();
+    addChangedFiles(this.hashes, hashes, changedFiles);
+    addChangedFiles(this.#additionalHashes ?? EMPTY_MAP, additionalHashes ?? EMPTY_MAP, changedFiles);
+
+    const previousMetadataMap: ReadonlyMap<
+      IRushConfigurationProjectForSnapshot,
+      IInternalInputsSnapshotProjectMetadata
+    > = this.#projectMetadataMap;
+    const projectMetadataMap: Map<
+      IRushConfigurationProjectForSnapshot,
+      IInternalInputsSnapshotProjectMetadata
+    > = new Map(previousMetadataMap);
+    if (changedFiles.size === 0) {
+      return projectMetadataMap;
+    }
+
+    const changedFilesByProject: Map<IRushConfigurationProjectForSnapshot, string[]> = new Map();
+    for (const file of changedFiles) {
+      const project: IRushConfigurationProjectForSnapshot | undefined = lookupByPath.findChildPath(file);
+      if (project) {
+        let projectFiles: string[] | undefined = changedFilesByProject.get(project);
+        if (!projectFiles) {
+          changedFilesByProject.set(project, (projectFiles = []));
+        }
+        projectFiles.push(file);
+      }
+    }
+
+    // The operations of a project also depend on their additional files, which may be outside of the project
+    for (const [project, { additionalFilesByOperationName }] of previousMetadataMap) {
+      if (
+        additionalFilesByOperationName &&
+        !changedFilesByProject.has(project) &&
+        dependsOnAnyFile(additionalFilesByOperationName, changedFiles)
+      ) {
+        changedFilesByProject.set(project, []);
+      }
+    }
+
+    for (const [project, projectFiles] of changedFilesByProject) {
+      const previousRecord: IInternalInputsSnapshotProjectMetadata | undefined =
+        previousMetadataMap.get(project);
+      const record: IInternalInputsSnapshotProjectMetadata = createInternalRecord(
+        project,
+        projectMap.get(project),
+        rootDir
+      );
+      if (previousRecord) {
+        // The filter depends only on the configuration of the project
+        record.projectFilePathFilter = previousRecord.projectFilePathFilter;
+        for (const [file, hash] of previousRecord.hashes) {
+          // A query adds the global additional files to the hashes of the project
+          if (!globalAdditionalHashes?.has(file)) {
+            record.hashes.set(file, hash);
+          }
+        }
+      }
+
+      let addedFile: boolean = false;
+      for (const file of projectFiles) {
+        const hash: string | undefined = hashes.get(file);
+        if (hash === undefined) {
+          record.hashes.delete(file);
+        } else {
+          addedFile ||= !record.hashes.has(file);
+          record.hashes.set(file, hash);
+        }
+      }
+
+      if (addedFile) {
+        // Ensure stable ordering.
+        Sort.sortMapKeys(record.hashes);
+      }
+
+      if (record.hashes.size === 0 && !projectMap.has(project)) {
+        // A project that has no metadata has state only while it has files
+        projectMetadataMap.delete(project);
+      } else {
+        projectMetadataMap.set(project, record);
+      }
+    }
+
+    return projectMetadataMap;
+  }
+}
+
+function createProjectMetadataMap(
+  hashes: ReadonlyMap<string, string>,
+  lookupByPath: IReadonlyLookupByPath<IRushConfigurationProjectForSnapshot>,
+  projectMap: IRushSnapshotProjectMetadataMap,
+  rootDir: string
+): Map<IRushConfigurationProjectForSnapshot, IInternalInputsSnapshotProjectMetadata> {
+  const projectMetadataMap: Map<
+    IRushConfigurationProjectForSnapshot,
+    IInternalInputsSnapshotProjectMetadata
+  > = new Map();
+  for (const [project, record] of projectMap) {
+    projectMetadataMap.set(project, createInternalRecord(project, record, rootDir));
+  }
+
+  // Route hashes to individual projects
+  for (const [file, hash] of hashes) {
+    const project: IRushConfigurationProjectForSnapshot | undefined = lookupByPath.findChildPath(file);
+    if (!project) {
+      continue;
+    }
+
+    let record: IInternalInputsSnapshotProjectMetadata | undefined = projectMetadataMap.get(project);
+    if (!record) {
+      projectMetadataMap.set(project, (record = createInternalRecord(project, undefined, rootDir)));
+    }
+
+    record.hashes.set(file, hash);
+  }
+
+  for (const record of projectMetadataMap.values()) {
+    // Ensure stable ordering.
+    Sort.sortMapKeys(record.hashes);
+  }
+
+  return projectMetadataMap;
+}
+
+/**
+ * Adds each file that has a hash in only one of the maps, or different hashes in them, to `changedFiles`.
+ */
+function addChangedFiles(
+  previousHashes: ReadonlyMap<string, string>,
+  hashes: ReadonlyMap<string, string>,
+  changedFiles: Set<string>
+): void {
+  if (previousHashes === hashes) {
+    return;
+  }
+
+  // Both maps usually list almost all files in sorted order. Merge them in that order, which reads each map in
+  // sequence, and look up only the files that are out of order.
+  const previousEntries: Iterator<[string, string]> = previousHashes.entries();
+  let previous: IteratorResult<[string, string]> = previousEntries.next();
+  for (const [file, hash] of hashes) {
+    let previousHash: string | undefined;
+    while (!previous.done) {
+      const [previousFile, previousFileHash] = previous.value;
+      if (previousFile === file) {
+        previousHash = previousFileHash;
+        previous = previousEntries.next();
+        break;
+      }
+
+      if (previousFile > file) {
+        break;
+      }
+
+      if (!hashes.has(previousFile)) {
+        changedFiles.add(previousFile);
+      }
+      previous = previousEntries.next();
+    }
+
+    if (previousHash === undefined) {
+      previousHash = previousHashes.get(file);
+    }
+
+    if (previousHash !== hash) {
+      changedFiles.add(file);
+    }
+  }
+
+  for (; !previous.done; previous = previousEntries.next()) {
+    const previousFile: string = previous.value[0];
+    if (!hashes.has(previousFile)) {
+      changedFiles.add(previousFile);
+    }
+  }
+}
+
+function dependsOnAnyFile(
+  additionalFilesByOperationName: ReadonlyMap<string, ReadonlySet<string>>,
+  files: ReadonlySet<string>
+): boolean {
+  for (const additionalFiles of additionalFilesByOperationName.values()) {
+    const [smaller, larger] =
+      additionalFiles.size < files.size ? [additionalFiles, files] : [files, additionalFiles];
+    for (const file of smaller) {
+      if (larger.has(file)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+function countOperationAdditionalFiles(projectMap: IRushSnapshotProjectMetadataMap): number {
+  let count: number = 0;
+  for (const { additionalFilesByOperationName } of projectMap.values()) {
+    for (const additionalFiles of additionalFilesByOperationName?.values() ?? []) {
+      count += additionalFiles.size;
+    }
+  }
+
+  return count;
+}
+
+function areMapsEqual(a: ReadonlyMap<string, string>, b: ReadonlyMap<string, string>): boolean {
+  if (a.size !== b.size) {
+    return false;
+  }
+
+  for (const [key, value] of a) {
+    if (b.get(key) !== value) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function areEnvironmentsEqual(
+  a: Readonly<Record<string, string | undefined>>,
+  b: Readonly<Record<string, string | undefined>>
+): boolean {
+  const keys: string[] = Object.keys(a);
+  if (keys.length !== Object.keys(b).length) {
+    return false;
+  }
+
+  for (const key of keys) {
+    if (a[key] !== b[key] || !Object.prototype.hasOwnProperty.call(b, key)) {
+      return false;
+    }
+  }
+
+  return true;
 }
 
 /**
diff --git a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
index c0b85794b3..fc29aaa848 100644
--- a/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
+++ b/libraries/rush-lib/src/logic/incremental/test/InputsSnapshot.test.ts
@@ -7,6 +7,7 @@ import type { RushProjectConfiguration } from '../../../api/RushProjectConfigura
 import {
   InputsSnapshot,
   type IInputsSnapshotParameters,
+  type IInputsSnapshotProjectMetadata,
   type IRushConfigurationProjectForSnapshot
 } from '../InputsSnapshot';
 
@@ -101,6 +102,41 @@ describe(InputsSnapshot.name, () => {
       ).toThrowErrorMatchingSnapshot();
     });
 
+    it('Fails each time for an operation whose input files cannot be listed', () => {
+      const { project, options } = getTestConfig();
+
+      const projectConfig: Pick<RushProjectConfiguration, 'operationSettingsByOperationName'> = {
+        operationSettingsByOperationName: new Map([
+          ['_phase:build', { operationName: '_phase:build', outputFolderNames: ['lib'] }]
+        ])
+      };
+
+      const input: InputsSnapshot = new InputsSnapshot({
+        ...options,
+        projectMap: new Map([
+          [
+            project,
+            {
+              projectConfig: projectConfig as RushProjectConfiguration,
+              additionalFilesByOperationName: new Map([['_phase:test', new Set(['/ext/missing.json'])]])
+            }
+          ]
+        ])
+      });
+
+      for (let i: number = 0; i < 2; i++) {
+        expect(() => input.getTrackedFileHashesForOperation(project, '_phase:build')).toThrow(
+          'contains tracked input file "a/lib/file3.js"'
+        );
+        expect(() => input.getOperationOwnStateHash(project, '_phase:build')).toThrow(
+          'contains tracked input file "a/lib/file3.js"'
+        );
+        expect(() => input.getTrackedFileHashesForOperation(project, '_phase:test')).toThrow(
+          'Could not find hash for file path "/ext/missing.json"'
+        );
+      }
+    });
+
     it('Respects additionalFilesByOperationName', () => {
       const { project, options } = getTestConfig();
 
@@ -758,4 +794,355 @@ describe(InputsSnapshot.name, () => {
       );
     });
   });
+
+  describe('previousSnapshot', () => {
+    const operationNames: (string | undefined)[] = [undefined, '_phase:build', '_phase:test'];
+
+    interface IDerivationTestConfig {
+      projects: IRushConfigurationProjectForSnapshot[];
+      a: IRushConfigurationProjectForSnapshot;
+      b: IRushConfigurationProjectForSnapshot;
+      c: IRushConfigurationProjectForSnapshot;
+      bAdditionalFiles: Set<string>;
+      options: IInputsSnapshotParameters;
+    }
+
+    function getDerivationTestConfig(): IDerivationTestConfig {
+      const a: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/a',
+        projectRelativeFolder: 'a'
+      };
+      const b: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/b',
+        projectRelativeFolder: 'b'
+      };
+      // A project that has no metadata, which has state only while it has files
+      const c: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/c',
+        projectRelativeFolder: 'c'
+      };
+      // A project that has metadata but no files
+      const d: IRushConfigurationProjectForSnapshot = {
+        projectFolder: '/root/d',
+        projectRelativeFolder: 'd'
+      };
+
+      const aConfig: Pick<
+        RushProjectConfiguration,
+        'incrementalBuildIgnoredGlobs' | 'operationSettingsByOperationName'
+      > = {
+        incrementalBuildIgnoredGlobs: ['*.md'],
+        operationSettingsByOperationName: new Map([
+          [
+            '_phase:build',
+            { operationName: '_phase:build', dependsOnEnvVars: ['FOO'], outputFolderNames: ['lib'] }
+          ],
+          ['_phase:test', { operationName: '_phase:test', dependsOnNodeVersion: 'major' }]
+        ])
+      };
+      const bConfig: Pick<RushProjectConfiguration, 'operationSettingsByOperationName'> = {
+        operationSettingsByOperationName: new Map([['_phase:build', { operationName: '_phase:build' }]])
+      };
+      const bAdditionalFiles: Set<string> = new Set(['common/shared.json', '/ext/tool.json']);
+
+      return {
+        projects: [a, b, c, d],
+        a,
+        b,
+        c,
+        bAdditionalFiles,
+        options: {
+          rootDir: '/root',
+          additionalHashes: new Map([['/ext/tool.json', 'ext1']]),
+          environment: { FOO: '1' },
+          globalAdditionalFiles: ['common/config/global.json'],
+          hashes: new Map([
+            ['a/README.md', 'a0'],
+            ['a/src/x.ts', 'a1'],
+            ['a/src/y.ts', 'a2'],
+            ['b/index.ts', 'b1'],
+            ['c/file.ts', 'c1'],
+            ['common/config/global.json', 'g1'],
+            ['common/other.txt', 'o1'],
+            ['common/shared.json', 's1']
+          ]),
+          hasUncommittedChanges: false,
+          lookupByPath: new LookupByPath(
+            [a, b, c, d].map((project) => [project.projectRelativeFolder, project])
+          ),
+          nodeVersion: 'v22.1.0',
+          projectMap: new Map<IRushConfigurationProjectForSnapshot, IInputsSnapshotProjectMetadata>([
+            [a, { projectConfig: aConfig as RushProjectConfiguration }],
+            [
+              b,
+              {
+                projectConfig: bConfig as RushProjectConfiguration,
+                additionalFilesByOperationName: new Map([['_phase:build', bAdditionalFiles]])
+              }
+            ],
+            [d, {}]
+          ])
+        }
+      };
+    }
+
+    function queryAll(snapshot: InputsSnapshot, projects: IRushConfigurationProjectForSnapshot[]): string[] {
+      const results: string[] = [];
+      for (const project of projects) {
+        for (const operationName of operationNames) {
+          try {
+            const tracked: [string, string][] = Array.from(
+              snapshot.getTrackedFileHashesForOperation(project, operationName)
+            );
+            const hash: string = snapshot.getOperationOwnStateHash(project, operationName);
+            const hashInOtherEnvironment: string = snapshot.getOperationOwnStateHash(project, operationName, {
+              FOO: 'other'
+            });
+            results.push(JSON.stringify({ tracked, hash, hashInOtherEnvironment }));
+          } catch (error) {
+            results.push(`error: ${error.message}`);
+          }
+        }
+      }
+
+      return results;
+    }
+
+    function expectSameAsNewSnapshot(
+      derived: InputsSnapshot,
+      options: IInputsSnapshotParameters,
+      projects: IRushConfigurationProjectForSnapshot[]
+    ): void {
+      const created: InputsSnapshot = new InputsSnapshot({ ...options, previousSnapshot: undefined });
+      expect(queryAll(derived, projects)).toEqual(queryAll(created, projects));
+      expect(derived.hashes).toBe(options.hashes);
+      expect(derived.hasUncommittedChanges).toBe(options.hasUncommittedChanges);
+      expect(derived.workingTreeReadStartTimeMs).toBe(options.workingTreeReadStartTimeMs);
+    }
+
+    it('Reuses the state of each project whose inputs did not change', () => {
+      const { projects, a, b, options } = getDerivationTestConfig();
+      const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      queryAll(previousSnapshot, projects);
+
+      const hashes: Map<string, string> = new Map(options.hashes);
+      hashes.set('a/src/x.ts', 'a1-changed');
+      const derivedOptions: IInputsSnapshotParameters = {
+        ...options,
+        hashes,
+        hasUncommittedChanges: true,
+        workingTreeReadStartTimeMs: 1234,
+        previousSnapshot
+      };
+      const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+      expect(derived.getTrackedFileHashesForOperation(b, '_phase:build')).toBe(
+        previousSnapshot.getTrackedFileHashesForOperation(b, '_phase:build')
+      );
+      expect(derived.getTrackedFileHashesForOperation(a, '_phase:build')).not.toBe(
+        previousSnapshot.getTrackedFileHashesForOperation(a, '_phase:build')
+      );
+      expect(derived.getOperationOwnStateHash(a, '_phase:build')).not.toEqual(
+        previousSnapshot.getOperationOwnStateHash(a, '_phase:build')
+      );
+      expectSameAsNewSnapshot(derived, derivedOptions, projects);
+    });
+
+    it('Computes the state of a project again when its files are added, changed or removed', () => {
+      const { projects, a, options } = getDerivationTestConfig();
+      const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      queryAll(previousSnapshot, projects);
+
+      const hashes: Map<string, string> = new Map(options.hashes);
+      // Sorts before the other files of the project
+      hashes.set('a/.eslintrc.js', 'a3');
+      hashes.delete('a/src/y.ts');
+      hashes.set('c/file.ts', 'c1-changed');
+      hashes.set('common/other.txt', 'o1-changed');
+      const derivedOptions: IInputsSnapshotParameters = { ...options, hashes, previousSnapshot };
+      const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+      expect(Array.from(derived.getTrackedFileHashesForOperation(a).keys())).toEqual([
+        'a/.eslintrc.js',
+        'a/src/x.ts',
+        'common/config/global.json'
+      ]);
+      expectSameAsNewSnapshot(derived, derivedOptions, projects);
+    });
+
+    it('Computes the state of a project again when one of its additional files changes', () => {
+      const { projects, b, options } = getDerivationTestConfig();
+      for (const [file, hashes, additionalHashes] of [
+        [
+          'common/shared.json',
+          new Map([...options.hashes, ['common/shared.json', 's2']]),
+          options.additionalHashes
+        ],
+        ['/ext/tool.json', options.hashes, new Map([['/ext/tool.json', 'ext2']])]
+      ] as const) {
+        const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+        queryAll(previousSnapshot, projects);
+
+        const derivedOptions: IInputsSnapshotParameters = {
+          ...options,
+          hashes,
+          additionalHashes,
+          previousSnapshot
+        };
+        const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+        expect(derived.getTrackedFileHashesForOperation(b, '_phase:build').get(file)).not.toEqual(
+          previousSnapshot.getTrackedFileHashesForOperation(b, '_phase:build').get(file)
+        );
+        expectSameAsNewSnapshot(derived, derivedOptions, projects);
+      }
+    });
+
+    it('Removes the state of a project that has no metadata when it no longer has files', () => {
+      const { projects, c, options } = getDerivationTestConfig();
+      const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      queryAll(previousSnapshot, projects);
+
+      const hashes: Map<string, string> = new Map(options.hashes);
+      hashes.delete('c/file.ts');
+      const derivedOptions: IInputsSnapshotParameters = { ...options, hashes, previousSnapshot };
+      const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+      expect(() => derived.getTrackedFileHashesForOperation(c)).toThrow('No information available');
+      expectSameAsNewSnapshot(derived, derivedOptions, projects);
+
+      // And creates it again when a file is added back
+      const restoredOptions: IInputsSnapshotParameters = {
+        ...options,
+        previousSnapshot: derived
+      };
+      expectSameAsNewSnapshot(new InputsSnapshot(restoredOptions), restoredOptions, projects);
+    });
+
+    it('Creates the state of every project again when any other input changes', () => {
+      const { projects, b, bAdditionalFiles, options } = getDerivationTestConfig();
+      const hashes: Map<string, string> = new Map(options.hashes);
+      hashes.set('a/src/x.ts', 'a1-changed');
+      const changes: [string, () => Partial<IInputsSnapshotParameters>][] = [
+        ['environment', () => ({ environment: { FOO: '2' } })],
+        ['an environment variable that no operation hashes', () => ({ environment: { FOO: '1', BAR: '' } })],
+        ['node version', () => ({ nodeVersion: 'v23.0.0' })],
+        [
+          'global additional file',
+          () => ({ hashes: new Map([...hashes, ['common/config/global.json', 'g2']]) })
+        ],
+        ['global additional files', () => ({ globalAdditionalFiles: [] })],
+        ['root directory', () => ({ rootDir: '/root/' })],
+        ['lookup', () => ({ lookupByPath: new LookupByPath(Array.from(options.lookupByPath.entries())) })],
+        ['project map', () => ({ projectMap: new Map(options.projectMap) })],
+        [
+          'additional files of an operation',
+          () => {
+            bAdditionalFiles.add('common/other.txt');
+            return {};
+          }
+        ]
+      ];
+
+      for (const [name, getChange] of changes) {
+        const previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+        queryAll(previousSnapshot, projects);
+
+        const derivedOptions: IInputsSnapshotParameters = {
+          ...options,
+          hashes,
+          ...getChange(),
+          previousSnapshot
+        };
+        const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+
+        const reusedState: boolean =
+          derived.getTrackedFileHashesForOperation(b, '_phase:build') ===
+          previousSnapshot.getTrackedFileHashesForOperation(b, '_phase:build');
+        expect({ name, reusedState }).toEqual({ name, reusedState: false });
+        expectSameAsNewSnapshot(derived, derivedOptions, projects);
+      }
+    });
+
+    it('Computes the same state as a new snapshot after any sequence of changes', () => {
+      const { projects, bAdditionalFiles, options } = getDerivationTestConfig();
+      const files: string[] = [
+        'a/README.md',
+        'a/src/x.ts',
+        'a/src/y.ts',
+        'a/src/z.ts',
+        'a/b.ts',
+        'a/lib/output.js',
+        'a/libs/input.ts',
+        'aa/file.ts',
+        'b/index.ts',
+        'b/util.ts',
+        'c/file.ts',
+        'c/other.ts',
+        'd/new.ts',
+        'common/other.txt',
+        'common/shared.json',
+        'common/zzz.txt'
+      ];
+      const random: () => number = createRandom(42);
+      const pick = <T>(items: T[]): T => items[Math.floor(random() * items.length)];
+
+      let hashes: Map<string, string> = new Map(options.hashes);
+      let additionalHashes: ReadonlyMap<string, string> | undefined = options.additionalHashes;
+      let previousSnapshot: InputsSnapshot = new InputsSnapshot(options);
+      for (let i: number = 0; i < 300; i++) {
+        // Query some operations of the previous snapshot, as a host does before it takes the next one
+        for (const project of projects) {
+          for (const operationName of operationNames) {
+            if (random() < 0.5) {
+              try {
+                previousSnapshot.getOperationOwnStateHash(project, operationName);
+              } catch {
+                // Compared below
+              }
+            }
+          }
+        }
+
+        hashes = new Map(hashes);
+        const changeCount: number = Math.floor(random() * 4);
+        for (let j: number = 0; j < changeCount; j++) {
+          const file: string = pick(files);
+          if (hashes.has(file) && random() < 0.4) {
+            hashes.delete(file);
+          } else {
+            hashes.set(file, `${pick(['h1', 'h2', 'h3'])}`);
+          }
+        }
+
+        if (random() < 0.2) {
+          additionalHashes = new Map([['/ext/tool.json', pick(['ext1', 'ext2'])]]);
+        }
+
+        if (random() < 0.03) {
+          bAdditionalFiles.add(pick(files));
+        }
+
+        const derivedOptions: IInputsSnapshotParameters = {
+          ...options,
+          additionalHashes,
+          // Sometimes list the files out of order
+          hashes: random() < 0.2 ? new Map(Array.from(hashes).reverse()) : hashes,
+          previousSnapshot
+        };
+        const derived: InputsSnapshot = new InputsSnapshot(derivedOptions);
+        expectSameAsNewSnapshot(derived, derivedOptions, projects);
+        previousSnapshot = derived;
+      }
+    });
+  });
 });
+
+function createRandom(seed: number): () => number {
+  // A Park-Miller generator, so that a failure can be reproduced
+  let state: number = seed;
+  return (): number => {
+    state = (state * 48271) % 2147483647;
+    return state / 2147483647;
+  };
+}
diff --git a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
index a6e9e6c5a9..f914904c85 100644
--- a/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
+++ b/libraries/rush-lib/src/logic/test/ProjectChangeAnalyzer.test.ts
@@ -363,6 +363,9 @@ describe(ProjectChangeAnalyzer.name, () => {
           expect(mockSnapshot.mock.calls[1][0].hashes).toBe(
             (await mockGetCachedRepoStateAsync.mock.results[2].value).files
           );
+          // The new snapshot can reuse the state of the projects whose inputs did not change
+          expect(mockSnapshot.mock.calls[0][0].previousSnapshot).toBeUndefined();
+          expect(mockSnapshot.mock.calls[1][0].previousSnapshot).toBe(snapshot);
         });
 
         it('takes a new snapshot when the environment changes', async () => {
@@ -385,6 +388,9 @@ describe(ProjectChangeAnalyzer.name, () => {
           process.env.PROJECT_CHANGE_ANALYZER_TEST = '2';
           await expect(provider!()).resolves.not.toBe(nextSnapshot);
           expect(mockSnapshot).toHaveBeenCalledTimes(3);
+          // The snapshot decides for itself which state of the previous one it can still use
+          expect(mockSnapshot.mock.calls[1][0].previousSnapshot).toBe(snapshot);
+          expect(mockSnapshot.mock.calls[2][0].previousSnapshot).toBe(nextSnapshot);
         });
 
         it('takes a new snapshot when the additional files or their hashes change', async () => {
@@ -461,6 +467,7 @@ describe(ProjectChangeAnalyzer.name, () => {
           const snapshot: IInputsSnapshot | undefined = await provider!();
           await expect(provider!()).resolves.not.toBe(snapshot);
           expect(mockSnapshot).toHaveBeenCalledTimes(2);
+          expect(mockSnapshot.mock.calls[1][0].previousSnapshot).toBeUndefined();
           expect(mockOnGetDetailedRepoState).toHaveBeenCalledTimes(2);
           expect(mockGetCachedRepoStateAsync).not.toHaveBeenCalled();
           expect(mockCreateRepoStateCache).not.toHaveBeenCalled();

From 24e812efd713f6cbf2b0d0ddb1eb1991895d4cb7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 097/265] [rush-daemon] Say which batches write every result
 before logging

Swarm integration step 82; original commit db2c2c3771 (merge of swarm/m03-t186-nit1 at 9cf1d8ac48).
Refs: task 186 NIT 1.
Scope: task 186-nit1.

Brings 186-nit1 (branch swarm/m03-t186-nit1). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 6 of 18. Gate: ch01 GATE OK board 4131 (tree 2cc84122df)

Commits folded into this step (2):
- 642889338f [rush-daemon] Write a request's result before logging its telemetry (task 186)
- 9cf1d8ac48 [rush-daemon] Say which batches write every result before logging (task 186 NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...lts-before-telemetry_2026-09-29-04-18.json |  10 ++
 .../rush-daemon/src/PhasedRequestRouter.ts    |  91 ++++++++----
 .../rush-daemon/src/PhasedRequestTelemetry.ts |  21 +--
 .../src/test/PhasedRequestTelemetry.test.ts   | 140 +++++++++++++++++-
 4 files changed, 219 insertions(+), 43 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/batch-results-before-telemetry_2026-09-29-04-18.json

diff --git a/common/changes/@rushstack/rush-daemon/batch-results-before-telemetry_2026-09-29-04-18.json b/common/changes/@rushstack/rush-daemon/batch-results-before-telemetry_2026-09-29-04-18.json
new file mode 100644
index 0000000000..3aad5ee2fe
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/batch-results-before-telemetry_2026-09-29-04-18.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Log each phased request's telemetry entry after its result is written to the client, or the write fails, so the clients of a batch no longer wait while the daemon logs every entry of the batch. The entry still describes the moment the result was produced.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index c1924a2427..053321d09d 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -54,6 +54,7 @@ import {
   type IPhasedRequestTelemetryMeasure,
   type IPhasedRequestTelemetryObservations,
   type IPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryReport,
   type IPhasedRequestTelemetrySink
 } from './PhasedRequestTelemetry';
 
@@ -186,7 +187,8 @@ export class PhasedRequestRouter {
    *
    * @remarks
    * If `telemetry` is provided, it receives this request's report once the request has taken part in a graph
-   * iteration or a no-op check, before the result is written to the client.
+   * iteration or a no-op check, after the result was written to the client or the write failed. A failed
+   * result that is published while operations of the request still run is reported once the iteration ended.
    *
    * `receivedTimeMs` is the `performance.now()` timestamp at which the daemon received the request. The request can
    * join a batch whose input reconcile started after this time. It defaults to the time of this call.
@@ -970,11 +972,15 @@ class PhasedRequestBatchCoordinator {
       scheduled: entry.participated && batchScheduled,
       warningsAllowedByEnvironment: entry.warningsAllowedByEnvironment
     });
-    if (entry.participated) {
-      this.#logTelemetry(entry, result, batchScheduled, report !== 'final');
-    }
+    const logTelemetry: (() => void) | undefined = entry.participated
+      ? this.#prepareTelemetry(entry, result, batchScheduled, report !== 'final')
+      : undefined;
     try {
-      await entry.client.writeResultAsync(result);
+      try {
+        await entry.client.writeResultAsync(result);
+      } finally {
+        logTelemetry?.();
+      }
       this.#completeEntry(entry);
       this.#settleEntry(entry, () => entry.resolve(result));
     } catch (error) {
@@ -984,34 +990,45 @@ class PhasedRequestBatchCoordinator {
   }
 
   /**
-   * Reports the request to its telemetry sink, with the timing of the result that the client receives.
+   * Takes the request's telemetry report as of the result that is about to be written, and returns the function
+   * that logs it.
    *
    * @remarks
-   * For an entry that continues after its result, the operations that its failure did not block still run, so
-   * the report waits until the iteration ended, and `#settleContinuingEntry` sends it with their final
-   * statuses.
+   * The router logs the report once it wrote the result, or failed to. Logging an entry takes milliseconds. In a
+   * batch whose results are produced together, logging first would make every client of the batch wait for all of
+   * the batch's entries, and would add the earlier entries' logging to each entry's timing; now every result is
+   * written before any entry is logged. In a scheduled batch, results come in groups as operations finish, so each
+   * result is written before its own entry is logged, and an earlier group's entries may be logged before a later
+   * group's results are written.
+   *
+   * An entry that continues after its result gets no function: the operations that its failure did not block
+   * still run, so its report waits until the iteration ended, and `#settleContinuingEntry` sends it with their
+   * final statuses. Either way, the report has the timing of the result that the client receives.
    */
-  #logTelemetry(
+  #prepareTelemetry(
     entry: IBatchEntry,
     result: IDaemonPhasedRequestResult,
     batchScheduled: boolean,
     earlyResult: boolean
-  ): void {
+  ): (() => void) | undefined {
     const { batchTimings: timings, requestSink, telemetry } = entry;
     if (!telemetry || !requestSink || !timings) {
-      return;
+      return undefined;
     }
-    const resultTimeMs: number = performance.now();
-    const executionStartTimeMs: number = Math.max(timings.startTimeMs, entry.joinedTimeMs ?? 0);
-    // Measured now, because the batch timings go on changing until the iteration ends.
-    const measures: IPhasedRequestTelemetryMeasure[] = createTelemetryMeasures(
-      entry,
-      timings,
-      executionStartTimeMs,
-      resultTimeMs
-    );
-    const logRequest = (observations: IPhasedRequestTelemetryObservations): void => {
-      try {
+    let report: IPhasedRequestTelemetryReport;
+    try {
+      const resultTimeMs: number = performance.now();
+      const executionStartTimeMs: number = Math.max(timings.startTimeMs, entry.joinedTimeMs ?? 0);
+      // Measured now, because the batch timings go on changing until the iteration ends.
+      const measures: IPhasedRequestTelemetryMeasure[] = createTelemetryMeasures(
+        entry,
+        timings,
+        executionStartTimeMs,
+        resultTimeMs
+      );
+      const createReport = (
+        observations: IPhasedRequestTelemetryObservations
+      ): IPhasedRequestTelemetryReport => {
         const { records, countRetained }: IPhasedRequestTelemetryRecords =
           collectPhasedRequestTelemetryRecords({
             activeOperations: entry.selection.activeOperations,
@@ -1019,7 +1036,7 @@ class PhasedRequestBatchCoordinator {
             observations,
             upToDateTimeMs: executionStartTimeMs
           });
-        telemetry.logRequest({
+        return {
           request: entry.request,
           result,
           records,
@@ -1032,16 +1049,30 @@ class PhasedRequestBatchCoordinator {
           iterationStartTimeMs: batchScheduled ? timings.scheduleStartTimeMs : undefined,
           resultTimeMs,
           measures
-        });
+        };
+      };
+      if (entry.continuesAfterResult) {
+        entry.logTelemetryAfterIteration = () => {
+          try {
+            telemetry.logRequest(createReport(getIterationObservations(requestSink)));
+          } catch {
+            // Telemetry never changes a request's result.
+          }
+        };
+        return undefined;
+      }
+      report = createReport(requestSink);
+    } catch {
+      // Telemetry never changes a request's result.
+      return undefined;
+    }
+    return () => {
+      try {
+        telemetry.logRequest(report);
       } catch {
         // Telemetry never changes a request's result.
       }
     };
-    if (entry.continuesAfterResult) {
-      entry.logTelemetryAfterIteration = () => logRequest(getIterationObservations(requestSink));
-    } else {
-      logRequest(requestSink);
-    }
   }
 
   #settleEntry(entry: IBatchEntry, settle: () => void): void {
diff --git a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
index 64734b1891..6dc16271bf 100644
--- a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
+++ b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
@@ -67,18 +67,19 @@ export interface IPhasedRequestTelemetryReport {
  * Receives one report for each phased request that took part in a graph iteration or no-op check.
  *
  * @remarks
- * The router invokes the sink before it writes the request's result, except for a failed result that it
- * publishes while operations of the request that the failure did not block still run: that request is reported
- * once the iteration ended, so that those operations have their final statuses. The report still has the timing
- * of the result that the client received. The sink must not throw; the router ignores its errors so that telemetry
- * never changes a result.
+ * The router invokes the sink once it wrote the request's result, or failed to, so that logging never delays a
+ * result. A failed result that the router publishes while operations of the request that the failure did not
+ * block still run is reported once the iteration ended instead, so that those operations have their final
+ * statuses. Either way, the report has the timing of the result that the client received. The sink must not
+ * throw; the router ignores its errors so that telemetry never changes a result.
  *
  * @beta
  */
 export interface IPhasedRequestTelemetrySink {
   /**
-   * Called once for each request, before its result is written to the client, or once the iteration ended for a
-   * failed result that was published while operations of the request still ran. Errors are ignored.
+   * Called once for each request, after its result was written to the client or the write failed, or once the
+   * iteration ended for a failed result that was published while operations of the request still ran. Errors are
+   * ignored.
    */
   logRequest(report: IPhasedRequestTelemetryReport): void;
 }
@@ -146,11 +147,13 @@ export function collectPhasedRequestTelemetryRecords(
 }
 
 function createAbortedRecord(observed: IOperationExecutionResult): IPhasedCommandEngineTelemetryRecord {
-  // The client stopped observing before this operation finished.
+  // The client stopped observing before this operation finished. The operation may still finish before the report
+  // is logged, so the report keeps the times it had when it was taken.
+  const { startTime, endTime } = observed.stopwatch;
   return {
     status: OperationStatus.Aborted,
     silent: false,
-    stopwatch: observed.stopwatch,
+    stopwatch: { startTime, endTime },
     nonCachedDurationMs: undefined
   };
 }
diff --git a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
index ead18ae7b1..ca93202789 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
@@ -4,6 +4,7 @@
 import type { IDaemonPhasedRequest } from '@rushstack/rush-daemon-protocol';
 import {
   OperationStatus,
+  type IOperationExecutionResult,
   type IPhasedCommandEngineTelemetryOptions,
   type IPhasedCommandEngineTelemetryRecord,
   type ITelemetryData,
@@ -11,7 +12,11 @@ import {
 } from '@microsoft/rush-lib';
 
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
-import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
+import {
+  collectPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryReport,
+  type IPhasedRequestTelemetrySink
+} from '../PhasedRequestTelemetry';
 import {
   createDaemonRequestTelemetryData,
   createDaemonRequestTelemetrySink,
@@ -23,7 +28,7 @@ import {
   TestPhasedRequestClient,
   createRoutingFixture
 } from './PhasedRequestRouterTestUtilities';
-import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
 
 const OPERATION_A: string = 'project-a (_phase:test)';
 const OPERATION_B: string = 'project-b (_phase:test)';
@@ -97,7 +102,7 @@ async function executeAsync(
 }
 
 describe('phased request telemetry', () => {
-  it('reports each coalesced request once, with its own selection, before its result is written', async () => {
+  it('reports each coalesced request once, with its own selection, after its result is written', async () => {
     const fixture: ITestRoutingFixture = createFixture();
     const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
     try {
@@ -109,7 +114,7 @@ describe('phased request telemetry', () => {
       expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
       for (const sink of [dependency, consumer]) {
         expect(sink.reports).toHaveLength(1);
-        expect(sink.resultsWrittenBeforeReport).toEqual([false]);
+        expect(sink.resultsWrittenBeforeReport).toEqual([true]);
         const [report] = sink.reports;
         expect(report).toMatchObject({ batchSize: 2, scheduled: true, countRetained: 0 });
         expect(report.result).toMatchObject({ exitCode: 0, outcome: 'success' });
@@ -132,6 +137,97 @@ describe('phased request telemetry', () => {
     }
   });
 
+  it('writes the results of a batch before it logs any of their entries', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    // An execution lease, as the warm engine has, makes the batch's requests produce their results together.
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => ({
+      [Symbol.asyncDispose]: async (): Promise<void> => undefined
+    });
+    // The batch finds its operations up to date, so none of its requests gets an early result.
+    let iteration: number = 0;
+    fixture.graph.hooks.configureIteration.tap('warm no-op', (records, previousResults) => {
+      if (iteration++ === 0) {
+        return;
+      }
+      for (const record of records.values()) {
+        if (previousResults.has(record.operation)) {
+          record.enabled = false;
+        }
+      }
+    });
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const events: string[] = [];
+    const reports: IPhasedRequestTelemetryReport[] = [];
+    let firstLogTimeMs: number | undefined;
+    async function executeRecordedAsync(requestId: string, ...operationIds: string[]): Promise<void> {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient(requestId);
+      client.onWriteAsync = async ({ result }: ITestClientWrite): Promise<void> => {
+        if (result) {
+          events.push(`write ${requestId}`);
+        }
+      };
+      await router.executeAsync(
+        createRequest(requestId, ...operationIds),
+        client,
+        false,
+        undefined,
+        undefined,
+        {
+          logRequest: (report: IPhasedRequestTelemetryReport) => {
+            firstLogTimeMs ??= performance.now();
+            events.push(`log ${requestId}`);
+            reports.push(report);
+          }
+        }
+      );
+    }
+    try {
+      await executeAsync(router, createRequest('initial', OPERATION_B));
+      await Promise.all([
+        executeRecordedAsync('first', OPERATION_A),
+        executeRecordedAsync('second', OPERATION_B),
+        executeRecordedAsync('third', OPERATION_A, OPERATION_B)
+      ]);
+
+      expect(reports.map(({ batchSize, earlyResult }) => ({ batchSize, earlyResult }))).toEqual([
+        { batchSize: 3, earlyResult: false },
+        { batchSize: 3, earlyResult: false },
+        { batchSize: 3, earlyResult: false }
+      ]);
+      // Logging an entry takes milliseconds in the daemon, so no client waits for its batch-mates' entries...
+      expect(events.slice(0, 3).sort()).toEqual(['write first', 'write second', 'write third']);
+      expect(events.slice(3).sort()).toEqual(['log first', 'log second', 'log third']);
+      // ...and no entry's timing includes the logging of the entries before it.
+      for (const { resultTimeMs } of reports) {
+        expect(resultTimeMs).toBeLessThanOrEqual(firstLogTimeMs!);
+      }
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports a request once when its result cannot be written', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient('departed');
+      client.onWriteAsync = async ({ result }: ITestClientWrite): Promise<void> => {
+        if (result) {
+          throw new Error('The client left.');
+        }
+      };
+      const sink: RecordingTelemetrySink = new RecordingTelemetrySink(client);
+      await expect(
+        router.executeAsync(createRequest('departed', OPERATION_A), client, false, undefined, undefined, sink)
+      ).rejects.toThrow('The client left.');
+
+      expect(sink.reports).toHaveLength(1);
+      expect(sink.reports[0].result).toMatchObject({ exitCode: 0, outcome: 'success' });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
   it('reports every request of an iteration before the next queued iteration starts', async () => {
     const OPERATION_C: string = 'project-c (_phase:test)';
     let resolveStarted: () => void = () => undefined;
@@ -289,6 +385,42 @@ describe('phased request telemetry', () => {
   });
 });
 
+describe(collectPhasedRequestTelemetryRecords.name, () => {
+  it('keeps the times that an unfinished operation had when the records were taken', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    try {
+      const operation: Operation = fixture.operations.get(OPERATION_A)!;
+      const stopwatch: { startTime: number | undefined; endTime: number | undefined } = {
+        startTime: 1,
+        endTime: undefined
+      };
+      const executionResult: IOperationExecutionResult = {
+        operation,
+        silent: false,
+        status: OperationStatus.Executing,
+        stopwatch
+      } as unknown as IOperationExecutionResult;
+      const { records } = collectPhasedRequestTelemetryRecords({
+        activeOperations: [operation],
+        graph: fixture.session.operationGraph,
+        observations: { getObservedResult: () => ({ executionResult }) },
+        upToDateTimeMs: 0
+      });
+      // The router logs the records once it wrote the result, and the operation may finish in between.
+      stopwatch.endTime = 2;
+
+      expect(records.get(operation)).toEqual({
+        status: OperationStatus.Aborted,
+        silent: false,
+        stopwatch: { startTime: 1, endTime: undefined },
+        nonCachedDurationMs: undefined
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+});
+
 describe(createDaemonRequestTelemetryData.name, () => {
   // Other suites' graph iterations record native measures in the same process-wide timeline.
   beforeEach(() => performance.clearMeasures());

From 526ae839411111505ac038a3de7f549b49a82bea Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 098/265] [rush-daemon-transport] Keep the socket's error when
 the lockfile's also fails

Swarm integration step 83; original commit 8be98a7c20 (merge of swarm/r01-t197-nit1 at db5147164d).
Refs: task 197 NIT N1.
Scope: task 197-nit1.

Brings 197-nit1 (branch swarm/r01-t197-nit1). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 7 of 18. Gate: ch01 GATE OK board 4131 (tree ee18e8e5aa)

Commits folded into this step (4):
- 81dd79c948 rush-daemon-transport: ENOTDIR reads as nothing there; removeOwnFile always releases (task 197)
- 4e4bdeecbd rush-daemon-transport: a listener closes and releases everything when a deletion fails (task 197)
- 1ed80ba18a rush-daemon: test that a stopped daemon exits at once when it cannot delete its files (task 197)
- db5147164d rush-daemon-transport: keep the socket's error when the lockfile's also fails (task 197 NIT N1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-runtime-folder-file_2026-09-29-04-57.json | 11 +++
 ...-runtime-folder-file_2026-09-29-04-57.json | 11 +++
 .../src/DaemonFileChange.ts                   |  6 +-
 .../src/DaemonFileIdentity.ts                 | 24 +++--
 .../src/DaemonListenerLifetime.ts             | 21 +++--
 .../src/DaemonReleaseAfter.ts                 | 32 +++++++
 .../src/test/FileIdentity.test.ts             | 29 ++++++
 .../src/test/ListenerCloseFailure.test.ts     | 90 +++++++++++++++++++
 .../src/test/ListenerSocketCheck.test.ts      | 12 +++
 .../src/test/ReleaseAfter.test.ts             | 41 +++++++++
 .../src/test/DaemonProcessExit.test.ts        | 43 +++++++++
 11 files changed, 300 insertions(+), 20 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r01-runtime-folder-file_2026-09-29-04-57.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r01-runtime-folder-file_2026-09-29-04-57.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/r01-runtime-folder-file_2026-09-29-04-57.json b/common/changes/@rushstack/rush-daemon-transport/r01-runtime-folder-file_2026-09-29-04-57.json
new file mode 100644
index 0000000000..53a903ce46
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r01-runtime-folder-file_2026-09-29-04-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "On POSIX, `DaemonFrameListener.stopAcceptingAsync()` and `closeAsync()` no longer fail when a file took the name of the listener's runtime folder: they treat its socket and lockfile as deleted. When they cannot delete those files for another reason, for example ELOOP or EACCES on the runtime folder, they still close the server, stop recording operation groups and release both files, and then reject with that error. When both deletions fail, they reject with an AggregateError of the socket's error and then the lockfile's, whose message names both. Before, the error skipped those steps, and the open server kept a stopped daemon's process running until its 2 second exit deadline.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r01-runtime-folder-file_2026-09-29-04-57.json b/common/changes/@rushstack/rush-daemon/r01-runtime-folder-file_2026-09-29-04-57.json
new file mode 100644
index 0000000000..8801fa375c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r01-runtime-folder-file_2026-09-29-04-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a stopped daemon exits at once, without an error, after a file took the name of its runtime folder, and that a daemon that cannot delete its files exits at once and reports both failures, the socket's and then the lockfile's.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFileChange.ts b/libraries/rush-daemon-transport/src/DaemonFileChange.ts
index 700296f658..6dbaab78cf 100644
--- a/libraries/rush-daemon-transport/src/DaemonFileChange.ts
+++ b/libraries/rush-daemon-transport/src/DaemonFileChange.ts
@@ -14,7 +14,6 @@ export type DaemonFileChange = 'removed' | 'replaced';
 
 const REMOVED: DaemonFileChange = 'removed';
 const REPLACED: DaemonFileChange = 'replaced';
-const NOT_A_DIRECTORY: string = 'ENOTDIR';
 
 interface IFileIdentityRead {
   /** False when the path could not be read for a reason that says nothing about the file. */
@@ -25,9 +24,8 @@ interface IFileIdentityRead {
 function readIdentity(filePath: string): IFileIdentityRead {
   try {
     return { known: true, identity: readFileIdentity(filePath) };
-  } catch (error) {
-    // A folder on the path that became a file leaves the name as unreachable as a deletion does.
-    return { known: (error as NodeJS.ErrnoException).code === NOT_A_DIRECTORY };
+  } catch {
+    return { known: false };
   }
 }
 
diff --git a/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
index 2d2c896b67..34b959f3fd 100644
--- a/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
+++ b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
@@ -5,6 +5,7 @@ import * as fs from 'node:fs';
 
 const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 const READ_ONLY: string = 'r';
+const NOT_A_DIRECTORY: string = 'ENOTDIR';
 
 /** The device and inode of a file that this process created. */
 export interface IDaemonFileIdentity {
@@ -14,9 +15,19 @@ export interface IDaemonFileIdentity {
   readonly fd?: number;
 }
 
+function lstatIfPresent(filePath: string): fs.Stats | undefined {
+  try {
+    return fs.lstatSync(filePath, { throwIfNoEntry: false });
+  } catch (error) {
+    // A folder on the path that became a file leaves nothing at the path, as a deletion does.
+    if ((error as NodeJS.ErrnoException).code !== NOT_A_DIRECTORY) throw error;
+    return undefined;
+  }
+}
+
 /** The identity of the file (not a link target) at `filePath`, or `undefined` when nothing is there. */
 export function readFileIdentity(filePath: string): IDaemonFileIdentity | undefined {
-  const stats: fs.Stats | undefined = fs.lstatSync(filePath, { throwIfNoEntry: false });
+  const stats: fs.Stats | undefined = lstatIfPresent(filePath);
   return stats && { dev: stats.dev, ino: stats.ino };
 }
 
@@ -46,8 +57,8 @@ function release(identity: IDaemonFileIdentity): void {
 }
 
 /**
- * Deletes `filePath` only while it is still the file this process created, then releases `identity`. Call it
- * once for each identity.
+ * Deletes `filePath` only while it is still the file this process created, then releases `identity`, even
+ * when the deletion fails. Call it once for each identity.
  *
  * @remarks
  * Once a daemon's socket or lockfile has been replaced, for example after someone deleted it and a successor
@@ -55,6 +66,9 @@ function release(identity: IDaemonFileIdentity): void {
  */
 export function removeOwnFile(filePath: string, identity: IDaemonFileIdentity | undefined): void {
   if (!identity) return;
-  if (isSameFile(readFileIdentity(filePath), identity)) fs.rmSync(filePath, { force: true });
-  release(identity);
+  try {
+    if (isSameFile(readFileIdentity(filePath), identity)) fs.rmSync(filePath, { force: true });
+  } finally {
+    release(identity);
+  }
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
index e856caf368..a13c729701 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerLifetime.ts
@@ -10,6 +10,7 @@ import { removeOwnFile } from './DaemonFileIdentity';
 import type { IDaemonFileIdentity } from './DaemonFileIdentity';
 import type { StopOperationGroupRecording } from './DaemonOperationGroupRecorder';
 import type { IDaemonPaths } from './DaemonPaths';
+import { releaseAfterAsync } from './DaemonReleaseAfter';
 
 /** The files a listener created: its published POSIX socket and its lockfile. */
 export interface IDaemonListenerFiles {
@@ -50,7 +51,7 @@ export class DaemonListenerLifetime {
   }
 
   public closeAsync(): Promise<void> {
-    this.#closePromise ??= this.#closeOnceAsync();
+    this.#closePromise ??= releaseAfterAsync(this.stopAcceptingAsync(), () => this.#releaseLockfile());
     return this.#closePromise;
   }
 
@@ -71,16 +72,14 @@ export class DaemonListenerLifetime {
     return compareFileIdentity(this.#paths.socketPath, this.#files.socket);
   }
 
-  #stopOnceAsync(): Promise<void> {
-    // Unlink before closing, as libuv does for the path it bound, but only this listener's own socket: the
-    // name may belong to a successor by now.
-    this.#releaseSocket();
-    return new Promise<void>((resolve: () => void) => this.#server.close(() => resolve()));
-  }
-
-  async #closeOnceAsync(): Promise<void> {
-    await this.stopAcceptingAsync();
-    this.#releaseLockfile();
+  async #stopOnceAsync(): Promise<void> {
+    // Unlink first, as libuv does for the path it bound, but only this listener's own socket: the name may
+    // belong to a successor by now. Close even when that fails, or the open server keeps the process up.
+    try {
+      this.#releaseSocket();
+    } finally {
+      await new Promise<void>((resolve: () => void) => this.#server.close(() => resolve()));
+    }
   }
 
   #releaseSocket(): void {
diff --git a/libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts b/libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts
new file mode 100644
index 0000000000..27e978e3e6
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReleaseAfter.ts
@@ -0,0 +1,32 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+const THEN: string = '. Then: ';
+
+function describeError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function releaseAfterFailure(stepError: unknown, release: () => void): unknown {
+  try {
+    release();
+  } catch (releaseError) {
+    const message: string = `${describeError(stepError)}${THEN}${describeError(releaseError)}`;
+    return new AggregateError([stepError, releaseError], message);
+  }
+  return stepError;
+}
+
+/**
+ * Runs `release` once `step` settles, even when `step` fails. When only `step` fails, rejects with its error. When
+ * `release` fails too, rejects with an AggregateError of both errors, in that order, whose message names both: a
+ * daemon reports only the stack of the error that stops it.
+ */
+export async function releaseAfterAsync(step: Promise<void>, release: () => void): Promise<void> {
+  try {
+    await step;
+  } catch (stepError) {
+    throw releaseAfterFailure(stepError, release);
+  }
+  release();
+}
diff --git a/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts b/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
index 3ad643c1e0..22d4a28075 100644
--- a/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
+++ b/libraries/rush-daemon-transport/src/test/FileIdentity.test.ts
@@ -18,6 +18,8 @@ const UTF8: BufferEncoding = 'utf8';
 const SOCKET_MODE: number = 0o600;
 const PERMISSION_MODULUS: number = 0o1000;
 const PRIVATE_NAME_PREFIX: string = '.bind-';
+const REPLACEMENT: string = 'another file';
+const MOVED_SUFFIX: string = '.moved';
 
 function createFile(paths: IDaemonPaths, content: string): string {
   const filePath: string = path.join(paths.runtimeDir ?? '', 'file');
@@ -47,6 +49,33 @@ posixIt('removes a file that is still the pinned one', () => {
   removeIsolatedBase(paths);
 });
 
+posixIt('reads nothing at a path whose folder became a file, and still releases the pinned inode', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'only');
+  const pinned: IDaemonFileIdentity = pinFileIdentity(filePath);
+  fs.rmSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(path.dirname(filePath), REPLACEMENT);
+  expect(readFileIdentity(filePath)).toBeUndefined();
+  removeOwnFile(filePath, pinned);
+  expect(fs.readFileSync(path.dirname(filePath), UTF8)).toBe(REPLACEMENT);
+  expect(() => fs.fstatSync(pinned.fd ?? Number.NaN)).toThrow();
+  removeIsolatedBase(paths);
+});
+
+posixIt('releases the pinned inode when it cannot read the path, and throws why', () => {
+  const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
+  const filePath: string = createFile(paths, 'only');
+  const pinned: IDaemonFileIdentity = pinFileIdentity(filePath);
+  const folder: string = path.dirname(filePath);
+  // A folder that became a link to itself: every path through it fails with ELOOP.
+  fs.renameSync(folder, `${folder}${MOVED_SUFFIX}`);
+  fs.symlinkSync(folder, folder);
+  expect(() => removeOwnFile(filePath, pinned)).toThrow('ELOOP');
+  expect(() => fs.fstatSync(pinned.fd ?? Number.NaN)).toThrow();
+  expect(fs.readFileSync(path.join(`${folder}${MOVED_SUFFIX}`, 'file'), UTF8)).toBe('only');
+  removeIsolatedBase(paths);
+});
+
 posixIt('publishes an owner-only socket and deletes the private name it bound', async () => {
   const paths: IDaemonPaths = createIsolatedTestDaemonPaths();
   const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
diff --git a/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts b/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
new file mode 100644
index 0000000000..406194dbac
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
@@ -0,0 +1,90 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+
+import type { IDaemonFileIdentity } from '../DaemonFileIdentity';
+import { pinFileIdentity } from '../DaemonFileIdentity';
+import { DaemonListenerLifetime } from '../DaemonListenerLifetime';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { listenPublishedAsync } from '../DaemonSocketPublication';
+
+import { createIsolatedTestDaemonPaths, removeIsolatedBase } from './TestDaemonFixture';
+
+// A named pipe has no runtime folder that could be replaced.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const REPLACEMENT: string = 'another file';
+const LOCKFILE_CONTENT: string = '{}';
+const MOVED_SUFFIX: string = '.moved';
+const UTF8: BufferEncoding = 'utf8';
+const ONCE: number = 1;
+const ELOOP: string = 'ELOOP';
+
+let paths: IDaemonPaths;
+let server: net.Server;
+let lockfile: IDaemonFileIdentity;
+let stopRecording: jest.Mock;
+let lifetime: DaemonListenerLifetime;
+
+beforeEach(async () => {
+  paths = createIsolatedTestDaemonPaths();
+  ensureDaemonRuntimeDir(paths);
+  server = net.createServer();
+  const socket: IDaemonFileIdentity = await listenPublishedAsync(server, paths);
+  fs.writeFileSync(paths.lockfilePath, LOCKFILE_CONTENT);
+  lockfile = pinFileIdentity(paths.lockfilePath);
+  stopRecording = jest.fn();
+  lifetime = new DaemonListenerLifetime(server, paths, { socket, lockfile }, stopRecording);
+});
+
+afterEach(() => {
+  // Only after a failed test: the listener closes its server itself.
+  if (server.listening) server.close();
+  removeIsolatedBase(paths);
+});
+
+/**
+ * Deletes the socket with no stat of it (`fs.rmSync` would stat it first). After a sync stat of a socket, Node 22's
+ * `fs.realpathSync` can return a path with a link unresolved (it checks a stale stat), and jest then fails to load
+ * its own modules.
+ */
+function unlinkSocket(): void {
+  fs.unlinkSync(paths.socketPath);
+}
+
+function expectClosedAndReleased(): void {
+  expect(server.listening).toBe(false);
+  expect(stopRecording).toHaveBeenCalledTimes(ONCE);
+  expect(() => fs.fstatSync(lockfile.fd ?? Number.NaN)).toThrow();
+}
+
+posixIt(
+  'closes and releases everything, without an error, after a file took its runtime folder',
+  async () => {
+    const folder: string = paths.runtimeDir ?? '';
+    unlinkSocket();
+    fs.rmSync(folder, { recursive: true });
+    fs.writeFileSync(folder, REPLACEMENT);
+    await lifetime.closeAsync();
+    expectClosedAndReleased();
+    expect(fs.readFileSync(folder, UTF8)).toBe(REPLACEMENT);
+  }
+);
+
+posixIt('closes and releases everything when it cannot delete its files, and rejects with why', async () => {
+  const folder: string = paths.runtimeDir ?? '';
+  unlinkSocket();
+  // A runtime folder that became a link to itself: every path through it fails with ELOOP.
+  fs.renameSync(folder, `${folder}${MOVED_SUFFIX}`);
+  fs.symlinkSync(folder, folder);
+  const closing: Promise<void> = lifetime.closeAsync();
+  // Both errors, the socket's first: the lockfile's does not replace it.
+  await expect(closing).rejects.toMatchObject({
+    errors: [expect.objectContaining({ code: ELOOP }), expect.objectContaining({ code: ELOOP })]
+  });
+  await expect(closing).rejects.toThrow(`'${paths.socketPath}'. Then: `);
+  await expect(closing).rejects.toThrow(`'${paths.lockfilePath}'`);
+  expectClosedAndReleased();
+});
diff --git a/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts b/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
index db4323fdae..11fa8eb994 100644
--- a/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
+++ b/libraries/rush-daemon-transport/src/test/ListenerSocketCheck.test.ts
@@ -51,6 +51,18 @@ posixIt('reports a socket whose runtime folder was deleted as removed', () => {
   expect(listener.checkSocket()).toBe('removed');
 });
 
+posixIt(
+  'closes without an error after a file took the name of its runtime folder, and leaves it',
+  async () => {
+    const folder: string = paths.runtimeDir ?? paths.socketPath;
+    fs.rmSync(folder, { recursive: true });
+    fs.writeFileSync(folder, REPLACEMENT);
+    expect(listener.checkSocket()).toBe('removed');
+    await listener.closeAsync();
+    expect(fs.readFileSync(folder, UTF8)).toBe(REPLACEMENT);
+  }
+);
+
 posixIt(
   'reports a socket name that another file took as replaced, and closes without deleting it',
   async () => {
diff --git a/libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts b/libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts
new file mode 100644
index 0000000000..4226d9efe3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ReleaseAfter.test.ts
@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { releaseAfterAsync } from '../DaemonReleaseAfter';
+
+const ONCE: number = 1;
+const STEP_ERROR: Error = new Error('the step failed');
+const RELEASE_ERROR: Error = new Error('the release failed');
+const STEP_TEXT: string = 'a step that rejects with text';
+
+function throwReleaseError(): void {
+  throw RELEASE_ERROR;
+}
+
+it('releases after a step that works', async () => {
+  const release: jest.Mock = jest.fn();
+  await releaseAfterAsync(Promise.resolve(), release);
+  expect(release).toHaveBeenCalledTimes(ONCE);
+});
+
+it('rejects with the error of the release when only the release fails', async () => {
+  await expect(releaseAfterAsync(Promise.resolve(), throwReleaseError)).rejects.toBe(RELEASE_ERROR);
+});
+
+it('releases after a step that fails, and rejects with the error of the step', async () => {
+  const release: jest.Mock = jest.fn();
+  await expect(releaseAfterAsync(Promise.reject(STEP_ERROR), release)).rejects.toBe(STEP_ERROR);
+  expect(release).toHaveBeenCalledTimes(ONCE);
+});
+
+it('rejects with both errors, in order, when the step and the release fail', async () => {
+  const releasing: Promise<void> = releaseAfterAsync(Promise.reject(STEP_ERROR), throwReleaseError);
+  await expect(releasing).rejects.toBeInstanceOf(AggregateError);
+  await expect(releasing).rejects.toMatchObject({ errors: [STEP_ERROR, RELEASE_ERROR] });
+  await expect(releasing).rejects.toThrow(`${STEP_ERROR.message}. Then: ${RELEASE_ERROR.message}`);
+});
+
+it('names a failure that is not an Error by its text', async () => {
+  const releasing: Promise<void> = releaseAfterAsync(Promise.reject(STEP_TEXT), throwReleaseError);
+  await expect(releasing).rejects.toThrow(`${STEP_TEXT}. Then: ${RELEASE_ERROR.message}`);
+});
diff --git a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
index 9b253bbd6c..00741e1058 100644
--- a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
@@ -36,6 +36,15 @@ interface IFixtureDaemon {
 
 type StopRoute = 'daemon stop' | 'SIGTERM';
 
+/**
+ * Deletes a daemon's socket with no stat of it (`fs.rmSync` would stat it first). After a sync stat of a socket,
+ * Node 22's `fs.realpathSync` can return a path with a link unresolved (it checks a stale stat), and jest then
+ * fails to load its own modules.
+ */
+function unlinkSocket(socketPath: string): void {
+  fs.unlinkSync(socketPath);
+}
+
 (process.platform === 'win32' ? describe.skip : describe)('a daemon process after the daemon stops', () => {
   let folder: string;
   let repoRoot: string;
@@ -214,4 +223,38 @@ type StopRoute = 'daemon stop' | 'SIGTERM';
     expect(fs.existsSync(paths.socketPath)).toBe(false);
     expect(readDaemonLockfile(paths.lockfilePath)).toBeUndefined();
   }, 30000);
+
+  it('exits as soon as it stops, without an error, after a file took the name of its runtime folder', async () => {
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'callbacks', 'process');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    const runtimeDir: string = paths.runtimeDir ?? '';
+    unlinkSocket(paths.socketPath);
+    fs.rmSync(runtimeDir, { recursive: true });
+    fs.writeFileSync(runtimeDir, 'another file');
+    await stopAsync(fixture, paths, 'SIGTERM');
+
+    const { code, signal } = await waitForExitAsync(fixture);
+    expect({ code, signal }).toEqual({ code: 0, signal: undefined });
+    expect(fixture.getStderr()).not.toMatch(/fixture error: |ENOTDIR|kept its process running|^\s+at /m);
+    expect(fs.readFileSync(runtimeDir, 'utf8')).toBe('another file');
+  }, 30000);
+
+  it('exits as soon as it stops when it cannot delete its files, and reports why', async () => {
+    const fixture: IFixtureDaemon = startDaemon('nothing', 'callbacks', 'process');
+    const { paths } = await waitForJsonAsync<{ paths: IDaemonPaths }>(fixture, 'ready.json');
+    const runtimeDir: string = paths.runtimeDir ?? '';
+    // A runtime folder that became a link to itself: every path through it fails with ELOOP.
+    fs.renameSync(runtimeDir, `${runtimeDir}.moved`);
+    fs.symlinkSync(runtimeDir, runtimeDir);
+    await stopAsync(fixture, paths, 'SIGTERM');
+
+    const { code, signal } = await waitForExitAsync(fixture);
+    // The daemon could not delete its socket, so the test does.
+    unlinkSocket(path.join(`${runtimeDir}.moved`, path.basename(paths.socketPath)));
+    expect({ code, signal }).toEqual({ code: 1, signal: undefined });
+    // Both failures are reported: the socket's first, then the lockfile's.
+    expect(fixture.getStderr()).toContain(`lstat '${paths.socketPath}'. Then: ELOOP`);
+    expect(fixture.getStderr()).toContain(`lstat '${paths.lockfilePath}'`);
+    expect(fixture.getStderr()).not.toMatch(/kept its process running/);
+  }, 30000);
 });

From 18c2d24de9c03d7d6bb56c3359e1faf51b49020d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 099/265] [rush-daemon-transport] Settle a backpressured frame
 send when its socket ends or closes

Swarm integration step 84; original commit 57e6375fa0 (merge of swarm/m03-t209 at f2193d5048).
Scope: task 209.

Brings 209 (branch swarm/m03-t209). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 8 of 18. Gate: ch01 GATE OK board 4131 (tree 83d60b4fb4)

Commits folded into this step (1):
- f2193d5048 Settle a backpressured frame send when its socket ends or closes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../m03-t209-drain_2026-09-29-06-00.json      | 11 +++
 .../src/DaemonBufferedWrite.ts                | 40 ++++++++
 .../src/DaemonFrameConnection.ts              |  6 +-
 .../src/test/BackpressureFixture.ts           | 62 ++++++++++++
 .../src/test/BackpressuredSend.test.ts        | 95 +++++++++++++++++++
 5 files changed, 211 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/m03-t209-drain_2026-09-29-06-00.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/BackpressureFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/m03-t209-drain_2026-09-29-06-00.json b/common/changes/@rushstack/rush-daemon-transport/m03-t209-drain_2026-09-29-06-00.json
new file mode 100644
index 0000000000..1da871bec4
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/m03-t209-drain_2026-09-29-06-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "A frame send that waits for backpressure now settles when its socket finishes writing while it ends, as the daemon's side does once its peer half-closes, and rejects with `transportClosed` when the socket closes first without an error. It used to wait forever for a `'drain'` that never came.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
new file mode 100644
index 0000000000..22a4de4fea
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as net from 'node:net';
+
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+/**
+ * Waits until a socket whose `write()` returned `false` has written what it buffered.
+ * @remarks
+ * `'drain'` alone can wait forever. A socket that is ending, as the daemon's side is once its peer
+ * half-closes, finishes writing without a `'drain'`, and a socket destroyed without an error emits no
+ * `'error'`. So `'finish'` resolves too, `'error'` rejects with its error, and a `'close'` that comes
+ * first rejects with `transportClosed`.
+ * @internal
+ */
+export function waitForBufferedWriteAsync(socket: net.Socket): Promise<void> {
+  return new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+    function settle(error: Error | undefined): void {
+      socket.off('drain', onWritten).off('finish', onWritten).off('close', onClosed).off('error', settle);
+      if (error === undefined) {
+        resolve();
+      } else {
+        reject(error);
+      }
+    }
+    function onWritten(): void {
+      settle(undefined);
+    }
+    function onClosed(): void {
+      settle(
+        new DaemonTransportError(
+          DaemonTransportErrorCode.transportClosed,
+          'The connection closed before it wrote a frame.'
+        )
+      );
+    }
+    socket.on('drain', onWritten).on('finish', onWritten).on('close', onClosed).on('error', settle);
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts b/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
index 019dbdd96d..3e42c92a35 100644
--- a/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
+++ b/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
@@ -1,12 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { once } from 'node:events';
 import type * as net from 'node:net';
 
 import { DaemonFrameDecoder, encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
+import { waitForBufferedWriteAsync } from './DaemonBufferedWrite';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 
 /** One end of a framed rushd connection over a `net` socket (Unix socket or named pipe).
@@ -36,11 +36,11 @@ export class DaemonFrameConnection {
   public onClosed(handler: (error: Error | undefined) => void): void {
     this.#closedHandler = handler;
   }
-  /** Encodes and writes a frame, resolving when the socket has drained it. @throws {@link DaemonTransportError} when closed. */
+  /** Encodes and writes a frame, resolving once the socket has written it. @throws {@link DaemonTransportError} when closed, or when it closes first. */
   public async sendFrameAsync(frame: IDaemonFrame): Promise<void> {
     this.#assertOpen();
     if (!this.#socket.write(encodeDaemonFrame(frame))) {
-      await once(this.#socket, 'drain');
+      await waitForBufferedWriteAsync(this.#socket);
     }
   }
   /** Half-closes the writable side and releases the socket. */
diff --git a/libraries/rush-daemon-transport/src/test/BackpressureFixture.ts b/libraries/rush-daemon-transport/src/test/BackpressureFixture.ts
new file mode 100644
index 0000000000..e4f5a9af8b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/BackpressureFixture.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonFrameType } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import type { DaemonFrameConnection } from '../DaemonFrameConnection';
+import type { IDaemonPaths } from '../DaemonPaths';
+
+import { createDeferred, createTestDaemonPaths, startTestDaemonPair } from './TestDaemonFixture';
+import type { IDeferred, ITestDaemonPair } from './TestDaemonFixture';
+
+const FILL_BYTE: number = 0x61;
+
+/** A send so far: still pending, resolved, or the error it rejected with. */
+export type SendState = 'pending' | 'resolved' | Error;
+
+/** A test pair whose server side has accepted, and the error its server side closed with. */
+export interface IBackpressurePair extends ITestDaemonPair {
+  readonly server: DaemonFrameConnection;
+  readonly serverClosed: Promise<Error | undefined>;
+}
+
+/** A log frame with a payload of the given size. */
+export function createFrame(byteCount: number): IDaemonFrame {
+  return { kind: DaemonFrameType.logStdout, payload: Buffer.alloc(byteCount, FILL_BYTE) };
+}
+
+/** Records how a send settles, without leaving its rejection unhandled. */
+export function trackSend(send: Promise<void>): () => SendState {
+  let state: SendState = 'pending';
+  send.then(
+    () => {
+      state = 'resolved';
+    },
+    (error: Error) => {
+      state = error;
+    }
+  );
+  return () => state;
+}
+
+/** Lets every callback that the current event queued run first. */
+export async function nextMacrotaskAsync(): Promise<void> {
+  await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+}
+
+/** Runs a test on a new pair whose client doesn't read until the test resumes it, then closes the pair. */
+export async function withPausedPairAsync(test: (pair: IBackpressurePair) => Promise<void>): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const pair: ITestDaemonPair = await startTestDaemonPair(paths);
+  try {
+    const server: DaemonFrameConnection = await pair.serverSide;
+    const serverClosed: IDeferred<Error | undefined> = createDeferred<Error | undefined>();
+    server.onClosed((error: Error | undefined) => serverClosed.resolve(error));
+    pair.client.socket.pause();
+    await test({ ...pair, server, serverClosed: serverClosed.promise });
+  } finally {
+    await pair.client.closeAsync();
+    await pair.listener.closeAsync();
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts b/libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts
new file mode 100644
index 0000000000..257260c276
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/BackpressuredSend.test.ts
@@ -0,0 +1,95 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonTransportError, DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createFrame, nextMacrotaskAsync, trackSend, withPausedPairAsync } from './BackpressureFixture';
+import type { IBackpressurePair, SendState } from './BackpressureFixture';
+import { createDeferred } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+
+// A peer can half-close a Unix socket, but not a Windows named pipe.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const LARGE_FRAME_BYTES: number = 4194304;
+const SMALL_FRAME_BYTES: number = 1;
+const MEBIBYTE: number = 1048576;
+const FRAME_COUNT: number = 16;
+const NONE: number = 0;
+const SOCKET_EVENTS: ReadonlyArray<string> = ['drain', 'finish', 'close', 'error'];
+const TRANSPORT_CLOSED: Partial<DaemonTransportError> = { code: DaemonTransportErrorCode.transportClosed };
+
+function countListeners(pair: IBackpressurePair): number[] {
+  return SOCKET_EVENTS.map((eventName: string) => pair.server.socket.listenerCount(eventName));
+}
+
+posixIt('settles a backpressured send when the peer half-closes, then reads the frame', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const received: IDeferred<number> = createDeferred<number>();
+    pair.client.onFrame((frame: IDaemonFrame) => received.resolve(frame.payload.length));
+    const send: Promise<void> = pair.server.sendFrameAsync(createFrame(LARGE_FRAME_BYTES));
+    const sendState: () => SendState = trackSend(send);
+    // The next frame in line, started as a session's send queue starts it.
+    const nextState: () => SendState = trackSend(
+      send.then(() => pair.server.sendFrameAsync(createFrame(SMALL_FRAME_BYTES)))
+    );
+    expect(pair.server.socket.writableNeedDrain).toBe(true);
+    // The daemon's side doesn't allow a half-open connection, so the peer's FIN ends it, and the
+    // buffered frame then finishes writing without a 'drain'.
+    pair.client.socket.end();
+    pair.client.socket.resume();
+    expect(await received.promise).toBe(LARGE_FRAME_BYTES);
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    expect(sendState()).toBe('resolved');
+    expect(nextState()).toBeInstanceOf(DaemonTransportError);
+    expect(nextState()).toMatchObject(TRANSPORT_CLOSED);
+  });
+});
+
+it('rejects a backpressured send when its connection closes without an error first', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const sendState: () => SendState = trackSend(pair.server.sendFrameAsync(createFrame(LARGE_FRAME_BYTES)));
+    expect(pair.server.socket.writableNeedDrain).toBe(true);
+    pair.server.socket.destroy();
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    expect(sendState()).toBeInstanceOf(DaemonTransportError);
+    expect(sendState()).toMatchObject(TRANSPORT_CLOSED);
+  });
+});
+
+it('rejects a backpressured send with the error that aborted its connection', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const abortError: Error = new Error('The drain deadline passed.');
+    const sendState: () => SendState = trackSend(pair.server.sendFrameAsync(createFrame(LARGE_FRAME_BYTES)));
+    expect(pair.server.socket.writableNeedDrain).toBe(true);
+    pair.server.abort(abortError);
+    expect(await pair.serverClosed).toBe(abortError);
+    await nextMacrotaskAsync();
+    expect(sendState()).toBe(abortError);
+  });
+});
+
+it('leaves no socket listeners behind once backpressured sends drain', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    const allReceived: IDeferred<void> = createDeferred<void>();
+    const listenersBefore: number[] = countListeners(pair);
+    let received: number = NONE;
+    let backpressured: number = NONE;
+    pair.client.onFrame(() => {
+      received++;
+      if (received === FRAME_COUNT) allReceived.resolve();
+    });
+    pair.client.socket.resume();
+    for (let index: number = NONE; index < FRAME_COUNT; index++) {
+      const send: Promise<void> = pair.server.sendFrameAsync(createFrame(MEBIBYTE));
+      if (pair.server.socket.writableNeedDrain) backpressured++;
+      await send;
+    }
+    await allReceived.promise;
+    expect(backpressured).toBeGreaterThan(NONE);
+    expect(countListeners(pair)).toEqual(listenersBefore);
+  });
+});

From 2ab333f49ce752baf8e487c1fd5001261b441103 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 100/265] [rush-client-core] Test how rush-client-core waits
 for a daemon that another process starts

Swarm integration step 85; original commit 11d7df2b7f (merge of o07/t95-tests at e8e0b22a14).
Scope: 211 tests.

Brings 211 tests (branch o07/t95-tests). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 9 of 18. Gate: ch01 GATE OK board 4131 (tree 243d4de348)

Commits folded into this step (1):
- e8e0b22a14 Test how rush-client-core waits for a daemon that another process starts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...daemon-startup-retry-tests_2026-09-29.json |  11 ++
 .../connectOrAwaitDaemonStartupRetry.test.ts  | 123 ++++++++++++++++++
 2 files changed, 134 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-client-core/daemon-startup-retry-tests_2026-09-29.json
 create mode 100644 libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/daemon-startup-retry-tests_2026-09-29.json b/common/changes/@rushstack/rush-client-core/daemon-startup-retry-tests_2026-09-29.json
new file mode 100644
index 0000000000..767c8f6855
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/daemon-startup-retry-tests_2026-09-29.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts
new file mode 100644
index 0000000000..8b7d34ab2b
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartupRetry.test.ts
@@ -0,0 +1,123 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import type { DaemonClient } from '../DaemonClient';
+import { DaemonClientError } from '../DaemonClientError';
+import * as DaemonOwnership from '../DaemonOwnership';
+import * as DaemonStartup from '../DaemonStartup';
+import * as DaemonStartupReservation from '../DaemonStartupReservation';
+import * as StartupLock from '../StartupLock';
+import * as ConnectOrStartDaemon from '../connectOrStartDaemon';
+import {
+  connectOrAwaitDaemonStartupAsync,
+  type IConnectOrAwaitDaemonStartupOptions
+} from '../connectOrAwaitDaemonStartup';
+
+const STARTUP_TIMEOUT_MS: number = 10000;
+const HELPER_OWNER: string = 'Its startup helper (PID 4242) is still waiting for the daemon';
+
+// The fixture daemon can't make a startup attempt fail at once, or with a `timeout` error, so these tests
+// replace the startup attempt and the checks for a live owner. The owner is a running startup helper.
+describe('connectOrAwaitDaemonStartupAsync with startup attempts that fail at once', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let connect: jest.SpyInstance;
+  let notices: { owner: string; waitMs: number }[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-retry-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    notices = [];
+    jest.spyOn(DaemonOwnership, 'isEndpointUnboundAsync').mockResolvedValue(true);
+    jest.spyOn(DaemonStartup, 'readDaemonStartupReservation').mockReturnValue({
+      contents: 'reservation',
+      helper: { pid: 4242, startedAt: 'Tue Sep 29 04:00:00 2026' }
+    });
+    jest.spyOn(DaemonStartupReservation, 'getStartupHelperState').mockReturnValue('running');
+    // Nobody else holds the start mutex.
+    jest.spyOn(StartupLock, 'tryAcquireStartupLockAsync').mockResolvedValue({ releaseAsync: async () => {} });
+    connect = jest.spyOn(ConnectOrStartDaemon, 'connectOrStartDaemonAsync');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createOptions(): IConnectOrAwaitDaemonStartupOptions {
+    return {
+      paths,
+      startupTimeoutMs: STARTUP_TIMEOUT_MS,
+      onAwaitStartup: (owner: string, waitMs: number): void => {
+        notices.push({ owner, waitMs });
+      }
+    };
+  }
+
+  it('keeps waiting through a timeout error, as through a failed startup', async () => {
+    const client: DaemonClient = {} as DaemonClient;
+    connect
+      .mockRejectedValueOnce(
+        new DaemonClientError('timeout', 'Daemon startup timed out awaiting hello/ping readiness.')
+      )
+      .mockRejectedValueOnce(
+        new DaemonClientError('timeout', 'Daemon startup timed out awaiting hello/ping readiness.')
+      )
+      .mockResolvedValueOnce(client);
+
+    await expect(connectOrAwaitDaemonStartupAsync(createOptions())).resolves.toBe(client);
+    expect(connect).toHaveBeenCalledTimes(3);
+    expect(notices).toEqual([{ owner: HELPER_OWNER, waitMs: expect.any(Number) }]);
+  });
+
+  it('says once that it waits, and retries every 100 ms with only the time left', async () => {
+    const client: DaemonClient = {} as DaemonClient;
+    const attempts: { at: number; startupTimeoutMs: number | undefined }[] = [];
+    connect.mockImplementation(
+      async (options: ConnectOrStartDaemon.IConnectOrStartDaemonOptions): Promise<DaemonClient> => {
+        attempts.push({ at: Date.now(), startupTimeoutMs: options.startupTimeoutMs });
+        if (attempts.length < 5) {
+          throw new DaemonClientError('startupFailed', 'Daemon startup failed.');
+        }
+        return client;
+      }
+    );
+
+    await expect(connectOrAwaitDaemonStartupAsync(createOptions())).resolves.toBe(client);
+    expect(notices).toEqual([{ owner: HELPER_OWNER, waitMs: expect.any(Number) }]);
+    expect(notices[0].waitMs).toBeLessThanOrEqual(STARTUP_TIMEOUT_MS);
+
+    // The first attempt is the caller's own. The first retry follows it at once, with at most the whole
+    // second deadline, and each later retry waits about 100 ms and gets only what is left of that deadline.
+    expect(attempts).toHaveLength(5);
+    expect(attempts[0].startupTimeoutMs).toBe(STARTUP_TIMEOUT_MS);
+    expect(attempts[1].startupTimeoutMs).toBeLessThanOrEqual(STARTUP_TIMEOUT_MS);
+    for (let i: number = 2; i < attempts.length; i++) {
+      expect(attempts[i].at - attempts[i - 1].at).toBeGreaterThanOrEqual(90);
+      expect(attempts[i].startupTimeoutMs).toBeLessThanOrEqual(attempts[i - 1].startupTimeoutMs! - 90);
+      expect(attempts[i].startupTimeoutMs).toBeGreaterThan(0);
+    }
+  });
+
+  it('counts a startup reservation that cannot be read as no owner, so the caller can run in-process', async () => {
+    jest.spyOn(DaemonStartup, 'readDaemonStartupReservation').mockImplementation(() => {
+      throw new Error('EACCES: permission denied');
+    });
+    const startupError: DaemonClientError = new DaemonClientError('startupFailed', 'Daemon startup failed.');
+    connect.mockRejectedValueOnce(startupError);
+
+    await expect(connectOrAwaitDaemonStartupAsync(createOptions())).rejects.toBe(startupError);
+    expect(connect).toHaveBeenCalledTimes(1);
+    expect(notices).toEqual([]);
+  });
+});

From a7846055a273b5d5d40046cc827e12b318c266d2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 101/265] [rush-cli-client] Say which process rush-client waits
 for in its agent-output line

Swarm integration step 86; original commit 48c6443d7c (merge of o07/t95-n1 at 4078fa8e9e).
Scope: 211 n1.

Brings 211 n1 (branch o07/t95-n1). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 10 of 18. Gate: ch01 GATE OK board 4131 (tree ddcd9fb66b)

Commits folded into this step (1):
- 4078fa8e9e Say which process rush-client waits for in its agent-output line

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                      |  5 +++--
 apps/rush-cli-client/src/AgentProgressRenderer.ts   |  9 ++++++---
 apps/rush-cli-client/src/launchClient.ts            |  2 +-
 .../src/test/AgentProgressRenderer.test.ts          | 13 +++++++++++++
 .../src/test/startupPendingFallback.test.ts         |  9 +++++++--
 .../agent-startup-wait-owner_2026-09-29.json        | 11 +++++++++++
 6 files changed, 41 insertions(+), 8 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/agent-startup-wait-owner_2026-09-29.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 0b8cdbaa4d..9bd6c866b0 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -71,7 +71,7 @@ already running in this repository." Instead, the client keeps trying for one mo
 (15 seconds, so about 30 seconds in all) and uses the daemon once it is ready. It says so when it starts
 waiting (`rush-client: The daemon is not ready yet. <live process>, so this command waits up to 15 s more
 for it instead of running Rush in-process.`; agent output shows "rushd is still starting; waiting for it"
-as the progress phase, and on a pipe writes it as a progress line). If the daemon is still not ready, the command exits with code 1. The message
+as the progress phase, and on a pipe writes it as a progress line that ends with `because <live process>`). If the daemon is still not ready, the command exits with code 1. The message
 gives the startup error with its `--no-daemon` hint, then the process that is still live, "so Rush was
 not run in-process", and a pointer to `rush-client daemon status`.
 
@@ -150,7 +150,8 @@ daemon has the request (`rush build · 0.1s · sent to rushd; preparing the work
 lines, so that it does not look hung: one whenever nothing was written for 25 s, with the counts
 and the running operations, and one when connecting to the daemon takes more than 10 s. A
 wait for a daemon that is still starting gets a line of its own
-(`rushd is still starting; waiting for it (up to 15s more)`). A
+(`rushd is still starting; waiting for it (up to 15s more) because its startup helper (PID 4242) is
+still waiting for the daemon`). A
 request that waited for admission says so at the end of its summary line
 (`· queued behind another request (position 1 at 0.2s)`). It always ends with one summary
 line, for example
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index c9ef8c5a38..8b29a36de6 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -285,15 +285,18 @@ export class AgentProgressRenderer {
 
   /**
    * The daemon is not ready yet, but a live process can still make it ready, so the client waits up to `waitMs`
-   * more for it instead of running Rush in-process. On a pipe, says so once; the connecting line is then not due.
+   * more for it instead of running Rush in-process. On a pipe, says so once, with `owner`, the sentence that
+   * describes that process, for example "Its startup helper (PID 123) is still waiting for the daemon"; the
+   * connecting line is then not due.
    */
-  public onAwaitStartup(waitMs: number): void {
+  public onAwaitStartup(waitMs: number, owner?: string): void {
     this.setPhase(STARTING_PHASE);
     clearTimeout(this.#connectingTimer);
     this.#connectingTimer = undefined;
     if (!this.#options.isTTY && !this.#stopped && !this.#startingLineWritten) {
       this.#startingLineWritten = true;
-      this.#writePipeLine(`${this.#rows()[0]} (up to ${Math.round(waitMs / 1000)}s more)`);
+      const reason: string = owner ? ` because ${owner.charAt(0).toLowerCase()}${owner.slice(1)}` : '';
+      this.#writePipeLine(`${this.#rows()[0]} (up to ${Math.round(waitMs / 1000)}s more)${reason}`);
     }
   }
 
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 12f9de159c..9cc6850871 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -171,7 +171,7 @@ export async function launchClientAsync(
       ...connection,
       onAwaitStartup: (owner: string, waitMs: number): void => {
         if (agentRenderer) {
-          agentRenderer.onAwaitStartup(waitMs);
+          agentRenderer.onAwaitStartup(waitMs, owner);
           return;
         }
         const seconds: number = Math.round(waitMs / 1000);
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index aeb612ae12..c822fd4174 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1110,6 +1110,19 @@ describe(AgentProgressRenderer.name, () => {
       ]);
     });
 
+    it('names the process it waits for in the line for a daemon that is still starting', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      advance(clock, 300);
+      renderer.onAwaitStartup(15_000, 'Its startup helper (PID 4242) is still waiting for the daemon');
+      renderer.onAwaitStartup(14_000, 'Another client is still starting the daemon');
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.3s · rushd is still starting; waiting for it (up to 15s more) because its startup ' +
+          'helper (PID 4242) is still waiting for the daemon'
+      ]);
+    });
+
     it('writes nothing for a request that is handed to in-process Rush within 10 s', () => {
       const { renderer, output, clock } = createRenderer(false);
       renderer.start();
diff --git a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
index 48c1fd1ef0..32dd799881 100644
--- a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
+++ b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
@@ -79,7 +79,7 @@ describe('a daemon startup failure', () => {
         'so this command waits up to 15 s more for it instead of running Rush in-process.\n'
     );
 
-    // Agent output shows it as the phase of its progress line instead.
+    // Agent output shows it as the phase of its progress line instead, and names the live process there.
     output.mockClear();
     const write: jest.Mock = jest.fn();
     const renderer: AgentProgressRenderer = new AgentProgressRenderer({
@@ -89,7 +89,12 @@ describe('a daemon startup failure', () => {
       write
     });
     await expect(launchClientAsync(false, renderer)).rejects.toBe(pending);
-    expect(write).toHaveBeenCalledWith(expect.stringContaining('rushd is still starting; waiting for it'));
+    expect(write).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'rushd is still starting; waiting for it (up to 15s more) because its startup helper (PID 42) is ' +
+          'still waiting for the daemon'
+      )
+    );
     expect(output).not.toHaveBeenCalledWith(expect.stringContaining('The daemon is not ready yet'));
   });
 
diff --git a/common/changes/@rushstack/rush-cli-client/agent-startup-wait-owner_2026-09-29.json b/common/changes/@rushstack/rush-cli-client/agent-startup-wait-owner_2026-09-29.json
new file mode 100644
index 0000000000..40d02de519
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/agent-startup-wait-owner_2026-09-29.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output on a pipe, the line for a daemon that is still starting now names the live process that the client waits for.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}

From b178b3dac25312d63f1074b81756a15120f64bee Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 102/265] [rush-daemon] Escape control characters in restart
 variable names (task 184) (and 2 more)

Swarm integration step 87; original commit 723afd2d3a (merge of swarm/r06-t184-int2 at a205528877).
Scope: task 184-int2.

Brings 184-int2 (branch swarm/r06-t184-int2). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 11 of 18. Gate: ch01 GATE OK board 4131 (tree e017e4e262)

Commits folded into this step (3):
- c8d4efbb74 rush-daemon: escape control characters in restart variable names (task 184)
- d8243a1ec0 rush-client-core: add DaemonRestartFailedError with the restart reason (task 184)
- 080c28b844 rush-cli-client: say why the daemon restarted when its successor fails (task 184)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                | 10 ++-
 .../src/daemonRestartNotice.ts                | 16 +++++
 apps/rush-cli-client/src/launchClient.ts      |  8 ++-
 .../src/test/daemonRestartNotice.test.ts      | 44 ++++++++++++-
 .../src/test/nativeBuild.test.ts              | 38 ++++++++++++
 ...-failure-and-escapes_2026-09-29-03-00.json | 11 ++++
 ...-failure-and-escapes_2026-09-29-03-00.json | 11 ++++
 ...-failure-and-escapes_2026-09-29-03-00.json | 11 ++++
 ...-failure-and-escapes_2026-09-29-03-00.json | 11 ++++
 common/reviews/api/rush-client-core.api.md    |  6 ++
 .../src/executeWithDaemonRestart.ts           | 21 ++++++-
 libraries/rush-client-core/src/index.ts       |  1 +
 .../src/test/connectOrStartDaemon.test.ts     | 61 ++++++++++++++++++-
 libraries/rush-daemon-protocol/README.md      |  4 +-
 .../src/DaemonEnvironmentChange.ts            |  3 +-
 libraries/rush-daemon/README.md               |  7 ++-
 .../src/EnvironmentRestartReason.ts           | 18 +++++-
 .../src/test/EnvironmentRestartReason.test.ts | 19 ++++++
 18 files changed, 286 insertions(+), 14 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 9bd6c866b0..32182b1781 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -334,7 +334,15 @@ restarted the daemon (PID <pid>).` It names at most four variables and then says
 many more differed (`A, B, C, D and 2 more`). A command that was waiting when another
 command's environment restarted the daemon prints that command's variables, because the
 successor starts with that command's environment. A daemon that does not name the
-variables gets no line.
+variables gets no line. A variable name that holds a control character, such as a newline
+or ESC, is printed with that character written as a `\xHH` escape, so the line stays one
+line.
+
+If the daemon that replaces it does not start, after either kind of restart, the command
+fails with exit code 1 and one line that gives the reason for the restart before the
+startup error: `rush-client: A command's environment differed from the daemon's in
+NODE_OPTIONS; the restarted daemon did not start: <startup error>`. A variable that keeps
+the daemon from starting is then among the names in that line.
 
 When the connection is lost before a command's result, the command fails with exit code 1
 and is not retried. The diagnostic keeps "Daemon disconnected before delivering a result; the
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index 860175a0a7..e116ad7455 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -2,6 +2,8 @@
 // See LICENSE in the project root for license information.
 
 import {
+  DaemonClientError,
+  DaemonRestartFailedError,
   formatDaemonRestartCause,
   type IDaemonRestartNotice,
   type IDaemonRestartWaitDetails
@@ -47,6 +49,20 @@ export function formatDaemonRestartNotice(notice: IDaemonRestartNotice, rushx: b
   return `${rushx ? 'rushx-client' : 'rush-client'}: ${cause}; restarted the daemon${pid}.`;
 }
 
+/**
+ * Returns the error to report when a command's daemon restarted and the new daemon did not start. Its message says
+ * first why the daemon restarted, so that a user whose environment keeps the daemon from starting knows what to
+ * change. Any other error, and a restart for a reason that this client does not know, is returned unchanged.
+ */
+export function explainDaemonRestartFailure(error: unknown): unknown {
+  if (!(error instanceof DaemonRestartFailedError)) return error;
+  const cause: string | undefined = formatRestartedCause(error.restartReason);
+  if (cause === undefined) return error;
+  return new DaemonClientError(error.code, `${cause}; the restarted daemon did not start: ${error.message}`, {
+    cause: error
+  });
+}
+
 /**
  * Where a restart line goes: the agent renderer when one is active, and otherwise stderr.
  */
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 9cc6850871..0940e95fb0 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -40,7 +40,11 @@ import { readUseRushReporter, selectClientOutputMode } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
 import { getTerminalColumns } from './terminalColumns';
-import { createDaemonRequestNoticeHandlers, type IDaemonRequestNoticeHandlers } from './daemonRestartNotice';
+import {
+  createDaemonRequestNoticeHandlers,
+  explainDaemonRestartFailure,
+  type IDaemonRequestNoticeHandlers
+} from './daemonRestartNotice';
 import { formatInProcessFallbackMessage } from './inProcessFallback';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
@@ -291,7 +295,7 @@ export async function launchClientAsync(
     });
   } catch (error) {
     // After cancellation, a transport failure (e.g. the cancellation deadline) still means "cancelled".
-    if (!isCancelled() || !(error instanceof DaemonClientError)) throw error;
+    if (!isCancelled() || !(error instanceof DaemonClientError)) throw explainDaemonRestartFailure(error);
     outcome = undefined;
   } finally {
     notices?.dispose();
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index 09732dc527..f8096ff9dd 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -1,7 +1,11 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
+import {
+  DaemonClientError,
+  DaemonRestartFailedError,
+  type IDaemonRestartWaitDetails
+} from '@rushstack/rush-client-core';
 import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 
 import {
@@ -9,6 +13,7 @@ import {
   RESUBMITTED_PHASE,
   createDaemonRequestNoticeHandlers,
   createDaemonRestartNoticeHandler,
+  explainDaemonRestartFailure,
   formatDaemonRestartNotice,
   formatDaemonRestartWait,
   type IDaemonRequestNoticeHandlers
@@ -83,6 +88,43 @@ describe(formatDaemonRestartNotice.name, () => {
   });
 });
 
+describe(explainDaemonRestartFailure.name, () => {
+  const startupError: DaemonClientError = new DaemonClientError(
+    'startupFailed',
+    'Daemon startup has an unresolved startup handoff at /run/rushd.pid.json.starting.'
+  );
+
+  it('says first why the daemon restarted, and keeps the code and the startup error', () => {
+    const explain = (reason: DaemonRestartReason): unknown =>
+      explainDaemonRestartFailure(new DaemonRestartFailedError(startupError, reason));
+    const environment: unknown = explain({ kind: 'environmentChanged', variableNames: ['NODE_OPTIONS'] });
+    expect(environment).toBeInstanceOf(DaemonClientError);
+    expect(environment).toMatchObject({
+      code: 'startupFailed',
+      message:
+        "A command's environment differed from the daemon's in NODE_OPTIONS; the restarted daemon did not " +
+        'start: Daemon startup has an unresolved startup handoff at /run/rushd.pid.json.starting.'
+    });
+    const { cause } = environment as DaemonClientError;
+    expect(cause).toBeInstanceOf(DaemonRestartFailedError);
+    expect((cause as DaemonRestartFailedError).cause).toBe(startupError);
+    expect(
+      (explain({ kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' }) as Error).message
+    ).toBe(
+      "The daemon's installation at /snapshots/s9 was removed; the restarted daemon did not start: " +
+        'Daemon startup has an unresolved startup handoff at /run/rushd.pid.json.starting.'
+    );
+  });
+
+  it('returns any other error, and a restart for a reason that this client does not know, unchanged', () => {
+    const newer: DaemonRestartFailedError = new DaemonRestartFailedError(startupError, NEWER_REASON);
+    const other: Error = new Error('other');
+    expect(explainDaemonRestartFailure(newer)).toBe(newer);
+    expect(explainDaemonRestartFailure(startupError)).toBe(startupError);
+    expect(explainDaemonRestartFailure(other)).toBe(other);
+  });
+});
+
 describe(createDaemonRestartNoticeHandler.name, () => {
   const notice = {
     restart: 1,
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index 2f02fe76b6..528c002f41 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -56,6 +56,10 @@ function isOperationRunning(pid: number): boolean {
   }
 }
 
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 describe('native build through the standalone client', () => {
   let fixture: INativeBuildTestFixture | undefined;
   beforeEach(() => {
@@ -378,6 +382,40 @@ describe('native build through the standalone client', () => {
         }),
       45000
     );
+
+    it.each(['legacy', 'agent'] as const)(
+      'says why the daemon restarted when the daemon that replaces it does not start (%s output)',
+      (output) =>
+        runWithFixtureAsync(async ({ folder, environment, invokeAsync }) => {
+          // Only the daemon's launch fails; the client and the helper that starts the daemon still run.
+          const refusePath: string = path.join(folder, 'refuse-daemon-launch.cjs');
+          fs.writeFileSync(
+            refusePath,
+            "if (process.argv.some((arg) => arg.endsWith('SelectedDaemonBootstrap.js')) && " +
+              "process.argv.includes('--launch')) process.exit(3);\n"
+          );
+          environment.RUSHD_OUTPUT = output;
+          environment.NODE_OPTIONS = `--require ${JSON.stringify(refusePath)}`;
+          const failed: IResult = await invokeAsync(argv);
+          delete environment.NODE_OPTIONS;
+          delete environment.RUSHD_OUTPUT;
+          expect(failed.code).toBe(1);
+          const cause: string =
+            "A command's environment differed from the daemon's in NODE_OPTIONS; the restarted daemon did not start: ";
+          // The whole line goes to stderr. Agent output also starts its summary with the cause, which a clipped
+          // summary keeps.
+          expect(failed.stderr).toMatch(new RegExp(`^rush-client: ${escapeRegExp(cause)}[^\\n]+\\n$`, 'm'));
+          if (output === 'agent') {
+            expect(failed.stdout).toMatch(
+              new RegExp(`^rush build: FAILURE [^\\n]* · ${escapeRegExp(cause)}`, 'm')
+            );
+          }
+          expect(`${failed.stdout}${failed.stderr}`).not.toContain('restarted the daemon (PID');
+          expect(failed.stderr).not.toContain('refuse-daemon-launch');
+          expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
+        }),
+      45000
+    );
   });
 
   (process.platform === 'linux' ? it : it.skip)(
diff --git a/common/changes/@rushstack/rush-cli-client/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json b/common/changes/@rushstack/rush-cli-client/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
new file mode 100644
index 0000000000..afe078c6d4
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the daemon that replaces a restarted daemon does not start, the error line now gives the reason for the restart, such as the environment variables that differed, before the startup error.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json b/common/changes/@rushstack/rush-client-core/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
new file mode 100644
index 0000000000..5ee4cdc289
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `DaemonRestartFailedError`, which `executeWithDaemonRestartAsync` throws with the restart reason when the daemon that replaces a restarted daemon does not start.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json b/common/changes/@rushstack/rush-daemon-protocol/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
new file mode 100644
index 0000000000..2b83ff4dc8
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Document that `environmentChanged` variable names have control characters written as `\\xHH` escapes.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json b/common/changes/@rushstack/rush-daemon/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
new file mode 100644
index 0000000000..f1474431c4
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t184-restart-failure-and-escapes_2026-09-29-03-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A variable name in an environment restart reason now has each control character, such as a newline or ESC, written as a `\\xHH` escape, so the client line and the daemon log line that name it stay on one line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 0dfdb92a15..d3f8ac8fd9 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -67,6 +67,12 @@ export type DaemonClientOutcome = {
     readonly rejection: IDaemonRequestRejectedMessage['payload'];
 };
 
+// @beta
+export class DaemonRestartFailedError extends DaemonClientError {
+    constructor(startupError: DaemonClientError, restartReason: DaemonRestartReason);
+    readonly restartReason: DaemonRestartReason;
+}
+
 // @beta
 export type DaemonRestartRequester = 'thisRequest' | 'anotherRequest';
 
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index 9d5fc8d4a2..9501da8207 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -52,6 +52,22 @@ export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOp
   readonly onRestartAsync?: (notice: IDaemonRestartNotice) => Promise<void>;
 }
 
+/**
+ * Thrown by {@link executeWithDaemonRestartAsync} when the previous daemon said why it restarted and the daemon that
+ * replaces it did not become ready. Its code and message are those of the startup error, which is its cause.
+ * @beta
+ */
+export class DaemonRestartFailedError extends DaemonClientError {
+  /** Why the previous daemon asked for the restart. */
+  public readonly restartReason: DaemonRestartReason;
+
+  public constructor(startupError: DaemonClientError, restartReason: DaemonRestartReason) {
+    super(startupError.code, startupError.message, { cause: startupError });
+    this.name = 'DaemonRestartFailedError';
+    this.restartReason = restartReason;
+  }
+}
+
 /**
  * Executes on a ready client, retrying only for a typed pre-execution restart.
  * Preserves the original request, callbacks and unread input; never retries connection loss.
@@ -134,7 +150,10 @@ export async function executeWithDaemonRestartAsync(
         if (boundedByAdmission && error instanceof DaemonClientError && isExpired(getRemainingMs())) {
           return restartExhaustedOutcome(retry);
         }
-        throw error;
+        // The reason tells a user whose environment keeps the new daemon from starting what to change.
+        throw reason && error instanceof DaemonClientError
+          ? new DaemonRestartFailedError(error, reason)
+          : error;
       } finally {
         await previous?.closeAsync().catch(() => undefined);
         previous = undefined;
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index f9c499750a..0e12fcd33f 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -30,6 +30,7 @@ export {
 } from './DaemonStartupReservation';
 export { reclaimCrashedDaemonAsync } from './ExitedDaemonReclaim';
 export {
+  DaemonRestartFailedError,
   executeWithDaemonRestartAsync,
   type IDaemonRestartNotice,
   type IExecuteWithDaemonRestartOptions
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 62fac20d9a..398de70200 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -32,7 +32,11 @@ import {
   type IConnectOrStartDaemonOptions,
   type IDaemonStartCommand
 } from '../connectOrStartDaemon';
-import { executeWithDaemonRestartAsync, type IDaemonRestartNotice } from '../executeWithDaemonRestart';
+import {
+  DaemonRestartFailedError,
+  executeWithDaemonRestartAsync,
+  type IDaemonRestartNotice
+} from '../executeWithDaemonRestart';
 import {
   getDaemonStartupFilePath,
   readDaemonStartupReservation,
@@ -1098,6 +1102,61 @@ describe('detached daemon startup', () => {
     ]);
   });
 
+  it.each([
+    ['restart-installation', true],
+    ['restart-once', false]
+  ])(
+    'says why the daemon restarted when the daemon that replaces it does not start, for %s',
+    async (mode, reported) => {
+      const connection: IConnectOrStartDaemonOptions = {
+        ...options,
+        startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+      };
+      const client = await connectOrStartDaemonAsync(connection);
+      const request = captureDaemonRequest({
+        argv: ['test'],
+        commandName: 'test',
+        commandOrigin: 'custom',
+        cwd: folder,
+        environment: {},
+        terminal: { isTTY: false, supportsColor: false }
+      });
+      // The successor's entry point is missing, so it exits before it becomes ready.
+      const failing: IConnectOrStartDaemonOptions = {
+        ...connection,
+        startCommand: { ...connection.startCommand!, args: [path.join(folder, 'missing-entry.js')] }
+      };
+      const notices: IDaemonRestartNotice[] = [];
+      const error: unknown = await executeWithDaemonRestartAsync(client, failing, {
+        request,
+        onRestartAsync: async (notice) => {
+          notices.push(notice);
+        }
+      }).catch((caught: unknown) => caught);
+      expect(notices).toEqual([]);
+      expect(error).toBeInstanceOf(DaemonClientError);
+      expect((error as DaemonClientError).code).toBe('startupFailed');
+      expect((error as DaemonClientError).message).toContain(getDaemonLogFilePath(paths));
+      if (reported) {
+        expect(error).toBeInstanceOf(DaemonRestartFailedError);
+        const { cause, message, restartReason } = error as DaemonRestartFailedError;
+        expect(restartReason).toEqual({
+          kind: 'installationChanged',
+          change: 'removed',
+          folder: path.join(folder, 'gone')
+        });
+        // The startup error is the cause, and its message is kept as it is.
+        expect(cause).toBeInstanceOf(DaemonClientError);
+        expect(cause).not.toBeInstanceOf(DaemonRestartFailedError);
+        expect(message).toBe((cause as DaemonClientError).message);
+      } else {
+        expect(error).not.toBeInstanceOf(DaemonRestartFailedError);
+      }
+      expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+      expect(fs.readFileSync(path.join(folder, 'requests'), 'utf8').trim().split('\n')).toHaveLength(1);
+    }
+  );
+
   it.each(['execution', 'connection'])(
     'cancels successor waiting using the %s signal without replay',
     async (source) => {
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index 66f554ecbe..79020f33f8 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -64,7 +64,9 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   string. The ordinary mutation result has no retry flag and drains before restart.
   A retry result may say why in `restartReason`: `installationChanged` names the folder that
   was removed or replaced, and `environmentChanged` names the environment variables that
-  differ from the daemon's, never their values. Clients ignore kinds they do not know.
+  differ from the daemon's, never their values, with each control character of a name, such
+  as a newline or ESC, sent as a `\xHH` escape so that a client prints the names on one line.
+  Clients ignore kinds they do not know.
 - **Read-only workspace status** - optional `pong.payload.workspace` reports the provider generation,
   installed session token, graph existence and real warm accounting. An absent token means no session is
   installed; an absent `warmSet` means no controller is attached, not zero memory. Warm status includes
diff --git a/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
index 7fb66ec2b5..d8ad2dd72d 100644
--- a/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
@@ -13,7 +13,8 @@ export interface IDaemonEnvironmentChangedRestartReason {
   /**
    * The sorted names of the variables that differ: those that only one of the two environments sets, and those that
    * they set to different values. Values are never sent, because a variable such as `NODE_OPTIONS` can carry a
-   * secret. A daemon may send an empty list.
+   * secret. Each control character of a name, such as a newline or ESC, is sent as a `\xHH` escape, so that a client
+   * can print the names on one line. A daemon may send an empty list.
    */
   readonly variableNames: readonly string[];
 }
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index b596b256bb..d3a401cec6 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -225,9 +225,10 @@ The `retryAfterRestart: true` result of the request that restarts the daemon for
 `restartReason: { kind: 'environmentChanged', variableNames }`: the sorted names of the variables that are set in only
 one of the two environments, or set to different values, compared as the fingerprint's `environmentHash` compares them
 (without the variables that it ignores, and with repeated `PATH` entries removed). Values are never sent, since a
-variable such as `NODE_OPTIONS` can hold a secret. Each request that is answered while that restart is pending gets
-the same reason, because the successor starts with the restarting request's environment, not its own. The daemon log
-(`onLog`) names the request and the variables.
+variable such as `NODE_OPTIONS` can hold a secret. Each control character of a name, such as a newline or ESC, is sent
+as a `\xHH` escape, so that the client's line and the daemon log's line each stay one line. Each request that is
+answered while that restart is pending gets the same reason, because the successor starts with the restarting
+request's environment, not its own. The daemon log (`onLog`) names the request and the variables.
 
 Protocol 0.10 (`DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR`) provides bounded, typed retry authorization.
 Only a pre-execution command result may carry `retryAfterRestart: true`. During a planned restart, accepted
diff --git a/libraries/rush-daemon/src/EnvironmentRestartReason.ts b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
index 1c205b3ea3..52e01f3869 100644
--- a/libraries/rush-daemon/src/EnvironmentRestartReason.ts
+++ b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
@@ -10,6 +10,9 @@ import type { IDaemonEnvironmentChangedRestartReason } from '@rushstack/rush-dae
  */
 export type EnvironmentIdentityEntries = ReadonlyMap<string, string>;
 
+/** A control character, such as a newline or ESC, which would split or restyle a line that prints the name. */
+const CONTROL_CHARACTER: RegExp = /\p{Cc}/gu;
+
 /** Returns the variables of `environment` that a daemon's identity includes. */
 export function getEnvironmentIdentityEntries(
   environment: Readonly<Record<string, string | undefined>>
@@ -19,8 +22,10 @@ export function getEnvironmentIdentityEntries(
 
 /**
  * Says why a daemon that started with `startupEntries` restarts for a request with `environment`: the sorted names
- * of the variables that are set in only one of them or set to different values, never the values. Returns
- * `undefined` when the environments do not differ, which is when their fingerprint `environmentHash` is the same.
+ * of the variables that are set in only one of them or set to different values, never the values. Each control
+ * character of a name is written as a `\xHH` escape, so that the client and the daemon log print the names on one
+ * line. Returns `undefined` when the environments do not differ, which is when their fingerprint `environmentHash` is
+ * the same.
  */
 export function getEnvironmentRestartReason(
   startupEntries: EnvironmentIdentityEntries,
@@ -35,5 +40,12 @@ export function getEnvironmentRestartReason(
     if (!startupEntries.has(name)) variableNames.add(name);
   }
   if (variableNames.size === 0) return undefined;
-  return { kind: 'environmentChanged', variableNames: Array.from(variableNames).sort() };
+  return { kind: 'environmentChanged', variableNames: Array.from(variableNames, escapeVariableName).sort() };
+}
+
+function escapeVariableName(name: string): string {
+  return name.replace(
+    CONTROL_CHARACTER,
+    (character: string) => `\\x${character.charCodeAt(0).toString(16).padStart(2, '0')}`
+  );
 }
diff --git a/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
index fcbf765054..a47098dc91 100644
--- a/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
+++ b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
@@ -59,4 +59,23 @@ describe(getEnvironmentRestartReason.name, () => {
       getEnvironmentRestartReason(getEnvironmentIdentityEntries({ ...STARTUP, EMPTY: '' }), STARTUP)
     ).toEqual({ kind: 'environmentChanged', variableNames: ['EMPTY'] });
   });
+
+  it('writes each control character of a name as an escape, so that the names print on one line', () => {
+    const reason = getEnvironmentRestartReason(startupEntries, {
+      ...STARTUP,
+      'NAME_NL\nSECOND_LINE': 'a',
+      'NAME_ESC\u001b[31mRED\u001b[0m': 'b',
+      'NAME_C1\u009b2J\u007f': 'c',
+      'NAME_PRINTABLE_\u00e9': 'd'
+    });
+    expect(reason).toEqual({
+      kind: 'environmentChanged',
+      variableNames: [
+        'NAME_C1\\x9b2J\\x7f',
+        'NAME_ESC\\x1b[31mRED\\x1b[0m',
+        'NAME_NL\\x0aSECOND_LINE',
+        'NAME_PRINTABLE_\u00e9'
+      ]
+    });
+  });
 });

From 26eed2a607f778e42a9ecd28177d4ab27c518d95 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:54 +0000
Subject: [PATCH 103/265] [rush-daemon] Test the default shutdown deadline of a
 daemon process

Swarm integration step 88; original commit f0e3dd5082 (merge of swarm/r01-t115-nit1 at c4c4753313).
Refs: 115 NIT 2.
Scope: task 115-nit1.

Brings 115-nit1 (branch swarm/r01-t115-nit1). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 12 of 18. Gate: ch01 GATE OK board 4131 (tree 7edd3fca13)

Commits folded into this step (2):
- 419bc5cdc7 rush-daemon: test that releaseForExit keeps everything while a recorded child runs (115 NIT 1)
- c4c4753313 rush-daemon: test the default shutdown deadline of a daemon process (115 NIT 2)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...e-with-children-test_2026-09-29-04-13.json | 11 +++++
 ...efault-deadline-test_2026-09-29-04-13.json | 11 +++++
 .../src/test/DaemonShutdownDeadline.test.ts   | 48 +++++++++++++++++++
 .../src/test/DaemonShutdownProcess.test.ts    | 18 ++++++-
 .../src/test/fixtures/StuckShutdownDaemon.ts  |  7 ++-
 5 files changed, 92 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/t115-nit1-release-with-children-test_2026-09-29-04-13.json
 create mode 100644 common/changes/@rushstack/rush-daemon/t115-nit2-default-deadline-test_2026-09-29-04-13.json

diff --git a/common/changes/@rushstack/rush-daemon/t115-nit1-release-with-children-test_2026-09-29-04-13.json b/common/changes/@rushstack/rush-daemon/t115-nit1-release-with-children-test_2026-09-29-04-13.json
new file mode 100644
index 0000000000..7b729ad38e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/t115-nit1-release-with-children-test_2026-09-29-04-13.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a daemon whose shutdown was cut short keeps its socket, lockfile and repository lock on exit while a child process that it recorded still runs.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/t115-nit2-default-deadline-test_2026-09-29-04-13.json b/common/changes/@rushstack/rush-daemon/t115-nit2-default-deadline-test_2026-09-29-04-13.json
new file mode 100644
index 0000000000..814f510f05
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/t115-nit2-default-deadline-test_2026-09-29-04-13.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a daemon process without a shutdown deadline of its own exits at the 10 second default.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
index b870a8b76e..1121d55862 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
@@ -1,6 +1,9 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -23,6 +26,8 @@ import { captureTestDaemonListenerAsync } from './TestDaemonListener';
 import { createTemporaryRepo, TemporaryRepoWorkspaceSession } from './TemporaryRepoWorkspaceSession';
 
 const REQUEST_ID: string = 'waits-for-lock';
+// The daemon records the process groups of its detached children on Linux only.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
 
 describe('daemon shutdown deadline', () => {
   let repoRoot: string;
@@ -122,6 +127,49 @@ describe('daemon shutdown deadline', () => {
     }
   }, 20000);
 
+  linuxIt(
+    'keeps its files and the repository lock while a recorded child runs',
+    async () => {
+      const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+        RushDaemonHost.startAsync(createOptions({ shutdownDeadlineMs: 300 }))
+      );
+      const client: DaemonRequestWireClient = await startRequestAsync(host);
+      const repoLock: LockFile | undefined = LockFile.tryAcquire(commonTempFolder, 'rush');
+      const repoLockPath: string = LockFile.getLockFilePath(commonTempFolder, 'rush');
+      // Like an operation of the stuck request: detached, so the daemon records its group while it runs.
+      const operation: ChildProcess = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], {
+        detached: true,
+        stdio: 'ignore'
+      });
+      try {
+        await once(operation, 'spawn');
+        expect(repoLock).toBeDefined();
+        await stopAsync(host);
+        await host.closed;
+        await expect(host.closeAsync()).rejects.toBeInstanceOf(DaemonShutdownDeadlineError);
+
+        // A successor must reap the child first, so everything stays, as after a crash.
+        expect(host.releaseForExit()).toBe(false);
+        expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+        expect(fs.existsSync(host.paths.socketPath)).toBe(true);
+        expect(fs.existsSync(repoLockPath)).toBe(true);
+
+        operation.kill('SIGKILL');
+        await once(operation, 'exit');
+        expect(host.releaseForExit()).toBe(true);
+        expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+        expect(fs.existsSync(host.paths.socketPath)).toBe(false);
+        expect(fs.existsSync(repoLockPath)).toBe(false);
+      } finally {
+        if (operation.exitCode === null && operation.signalCode === null) operation.kill('SIGKILL');
+        repoLock?.release();
+        await client.closeAsync();
+        await listener.closeAsync();
+      }
+    },
+    20000
+  );
+
   it('cuts a running shutdown short when it is expired, as a second signal does', async () => {
     const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
       RushDaemonHost.startAsync(createOptions())
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
index f388017848..9b6a87a013 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
@@ -10,6 +10,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import { LockFile } from '@rushstack/node-core-library';
 import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
+import { DEFAULT_SHUTDOWN_DEADLINE_MS } from '../serveRushDaemon';
 import { createWireEnvelope, DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
 import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
 import {
@@ -90,7 +91,7 @@ interface IStuckRequest {
     return JSON.parse(fs.readFileSync(filename, 'utf8'));
   }
 
-  function startDaemon(shutdownDeadlineMs: number): IStuckDaemon {
+  function startDaemon(shutdownDeadlineMs: number | 'default'): IStuckDaemon {
     const child: ChildProcess = spawn(
       process.execPath,
       [FIXTURE_PATH, repoRoot, controlFolder, String(shutdownDeadlineMs)],
@@ -168,6 +169,21 @@ interface IStuckRequest {
     expectReleased(request);
   }, 30000);
 
+  it('exits at the default deadline when it has none of its own', async () => {
+    const stuckDaemon: IStuckDaemon = startDaemon('default');
+    const request: IStuckRequest = await startStuckRequestAsync(stuckDaemon);
+    const signaledAtMs: number = Date.now();
+    stuckDaemon.process.kill('SIGTERM');
+
+    expect(await stuckDaemon.exited).toEqual({ code: 1, signal: undefined });
+    expect(Date.now() - signaledAtMs).toBeGreaterThanOrEqual(DEFAULT_SHUTDOWN_DEADLINE_MS - 100);
+    expect(stuckDaemon.getStderr()).toMatch(
+      /The Rush daemon's shutdown did not finish within 10\.\d s, while waiting for requests to finish\./
+    );
+    await request.client.closed;
+    expectReleased(request);
+  }, 40000);
+
   it('exits at once on a second signal', async () => {
     // Far beyond the test's timeout, so only the second signal can end the shutdown in time.
     const stuckDaemon: IStuckDaemon = startDaemon(60000);
diff --git a/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts b/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
index 50e197440b..511f0d64a0 100644
--- a/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
+++ b/libraries/rush-daemon/src/test/fixtures/StuckShutdownDaemon.ts
@@ -49,14 +49,17 @@ async function runStuckRequestAsync(
 async function runAsync(): Promise<void> {
   const [repoRoot, controlFolder, shutdownDeadlineMs] = process.argv.slice(2);
   if (!repoRoot || !controlFolder || !shutdownDeadlineMs) {
-    throw new Error('The fixture needs a repository folder, a control folder and a shutdown deadline.');
+    throw new Error(
+      'The fixture needs a repository folder, a control folder and a shutdown deadline (or "default").'
+    );
   }
   // Process mode: no shutdownSignal, so the daemon handles SIGINT and SIGTERM itself.
   await serveRushDaemonAsync({
     repoRoot,
     rushVersion: '5.178.1',
     daemonVersion: 'stuck-shutdown-fixture',
-    shutdownDeadlineMs: Number(shutdownDeadlineMs),
+    // "default" leaves the deadline out, as rushd does.
+    ...(shutdownDeadlineMs === 'default' ? {} : { shutdownDeadlineMs: Number(shutdownDeadlineMs) }),
     createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
     requestResolver: new CallbackDaemonRequestResolver((options: IResolveDaemonRequestOptions) =>
       runStuckRequestAsync(options, controlFolder)

From 3d631f4ed4f806953ae15c9a3b958c6214ad4466 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 104/265] [rush-daemon] Test that a request that needs a
 restart for its environment does not check its inputs again during the drain

Swarm integration step 89; original commit 627f229690 (merge of swarm/r05-t127-nit1 at 67f9972263).
Refs: task 127, ch01 NIT 1.
Scope: task 127-nit1.

Brings 127-nit1 (branch swarm/r05-t127-nit1). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 13 of 18. Gate: ch01 GATE OK board 4131 (tree 66951bb8d6)

Commits folded into this step (1):
- 67f9972263 [rush-daemon] Test that a request that needs a restart for its environment does not check its inputs again during the drain (task 127, ch01 NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...eck-environment-test_2026-09-29-04-50.json | 11 ++++
 .../WorkspaceServedScriptAdmission.test.ts    | 55 +++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-t127-nit1-recheck-environment-test_2026-09-29-04-50.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-t127-nit1-recheck-environment-test_2026-09-29-04-50.json b/common/changes/@rushstack/rush-daemon/swarm-r05-t127-nit1-recheck-environment-test_2026-09-29-04-50.json
new file mode 100644
index 0000000000..6224fba82a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-t127-nit1-recheck-environment-test_2026-09-29-04-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a request that needs a restart for its environment does not check its inputs again while it waits for the restart drain.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index b9ff7653b3..5375358b66 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -602,6 +602,61 @@ describe('a restart drain whose change is reverted', () => {
       await closeRestartingFixtureAsync(fixture);
     }
   });
+
+  it('does not check again for a request that needs the restart for its environment, so the others see their revert', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    const capturesOfChangedEnvironment: () => number = () =>
+      inputCaptureMock.mock.calls.filter(
+        ([options]) => options.environment.RUSHD_RELOAD_TIER_TEST === 'changed'
+      ).length;
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      const revert: () => void = changeInstallation(fixture);
+      const changed: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' },
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => changed.positions.length > 0 || changed.settled(), 'the first build to wait');
+      // Each second, its check would start about 0.3 s before the second build's, which would then share it.
+      await delayAsync(300);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the second build to wait');
+      inputCaptureMock.mockClear();
+      await delayAsync(2500);
+      expect(capturesOfChangedEnvironment()).toBe(0);
+      expect(changed.settled()).toBe(false);
+      expect(build.settled()).toBe(false);
+
+      const revertedAt: number = Date.now();
+      revert();
+      expectSuccess(await build.exchange);
+      expect(Date.now() - revertedAt).toBeLessThan(5000);
+      // A request's environment does not change, so the first build still waits for the restart.
+      expect(changed.settled()).toBe(false);
+      expect(capturesOfChangedEnvironment()).toBe(0);
+      expect((await pongAsync(fixture)).pid).toBe(before.pid);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      expect((await changed.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
 });
 
 describe('the reason for a restart that waits for a served rushx script', () => {

From 3f1511d43d1758f692ae6bf449c3de4f34fb3881 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 105/265] [rush-azure-storage-build-cache-plugin] Test the
 storageEndpoint pattern in the plugin's options schema

Swarm integration step 90; original commit 66d76593af (merge of swarm/r03-t164-nit4 at 0bfdc117bd).
Refs: task 164 NIT 4.
Scope: task 164-nit4.

Brings 164-nit4 (branch swarm/r03-t164-nit4). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 14 of 18. Gate: ch01 GATE OK board 4131 (tree 1efb607588)

Commits folded into this step (1):
- 0bfdc117bd [rush-azure-storage-build-cache-plugin] Test the storageEndpoint pattern in the plugin's options schema (task 164 NIT 4)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-endpoint-credential_2026-09-29-00-29.json |  2 +-
 .../test/AzureBlobStorageConfigSchema.test.ts | 72 +++++++++++++++++++
 2 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts

diff --git a/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json b/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json
index 33f72bb77e..9f0fbed61d 100644
--- a/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json
+++ b/common/changes/@microsoft/rush/azure-storage-endpoint-credential_2026-09-29-00-29.json
@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@microsoft/rush",
-      "comment": "The Azure Storage build cache plugin now saves credentials for each `storageEndpoint`, so a credential saved for one endpoint is never sent to another. build-cache.json now rejects a `storageEndpoint` that doesn't start with `http://` or `https://`.",
+      "comment": "The Azure Storage build cache plugin now saves credentials for each `storageEndpoint`, so a credential saved for one endpoint is never sent to another. A credential that was saved for a custom `storageEndpoint` before this change must be saved again with `rush update-cloud-credentials`, because its key now includes the endpoint. build-cache.json and the plugin's options file now reject a `storageEndpoint` that doesn't start with `http://` or `https://`.",
       "type": "none"
     }
   ],
diff --git a/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts
new file mode 100644
index 0000000000..17bcb5cda6
--- /dev/null
+++ b/rush-plugins/rush-azure-storage-build-cache-plugin/src/test/AzureBlobStorageConfigSchema.test.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { JsonFile, JsonSchema, type JsonObject } from '@rushstack/node-core-library';
+
+const PACKAGE_FOLDER: string = path.resolve(__dirname, '../..');
+const PLUGIN_NAME: string = 'rush-azure-storage-build-cache-plugin';
+const OPTIONS_FILE_PATH: string = `common/config/rush-plugins/${PLUGIN_NAME}.json`;
+const PATTERN_ERROR: RegExp =
+  /#\/storageEndpoint\s+must match pattern "\^\[Hh\]\[Tt\]\[Tt\]\[Pp\]\[Ss\]\?:\/\/"/;
+
+interface IRushPluginManifestJson {
+  plugins: { pluginName: string; optionsSchema?: string }[];
+}
+
+// Rush validates common/config/rush-plugins/<plugin>.json with the schema that the plugin's manifest names.
+function loadOptionsSchema(): JsonSchema {
+  const manifest: IRushPluginManifestJson = JsonFile.load(`${PACKAGE_FOLDER}/rush-plugin-manifest.json`);
+  const optionsSchema: string | undefined = manifest.plugins.find(
+    (plugin) => plugin.pluginName === PLUGIN_NAME
+  )?.optionsSchema;
+  if (!optionsSchema) {
+    throw new Error(`The manifest names no optionsSchema for ${PLUGIN_NAME}`);
+  }
+
+  return JsonSchema.fromFile(path.join(PACKAGE_FOLDER, optionsSchema));
+}
+
+describe('the options schema of rush-azure-storage-build-cache-plugin', () => {
+  let schema: JsonSchema;
+
+  beforeAll(() => {
+    schema = loadOptionsSchema();
+  });
+
+  function validate(storageEndpoint: string | undefined): void {
+    const options: JsonObject = { storageAccountName: 'example', storageContainerName: 'build-cache' };
+    if (storageEndpoint !== undefined) {
+      options.storageEndpoint = storageEndpoint;
+    }
+
+    schema.validateObject(options, OPTIONS_FILE_PATH);
+  }
+
+  it.each([
+    // "localhost:" parses as a URI scheme, so only the pattern catches this common mistake.
+    { kind: 'no scheme', storageEndpoint: 'localhost:10000/devstoreaccount1' },
+    { kind: 'another scheme', storageEndpoint: 'ftp://example.com/devstoreaccount1' },
+    { kind: 'a scheme that only ends in https', storageEndpoint: 'git+https://example.com/devstoreaccount1' }
+  ])('rejects a storageEndpoint with $kind', ({ storageEndpoint }) => {
+    expect(() => validate(storageEndpoint)).toThrow(PATTERN_ERROR);
+  });
+
+  it('rejects a storageEndpoint that is not a URI', () => {
+    expect(() => validate('http://127.0.0.1 port 10000')).toThrow(
+      /#\/storageEndpoint\s+must match format "uri"/
+    );
+  });
+
+  it.each([
+    { kind: 'no storageEndpoint', storageEndpoint: undefined },
+    { kind: 'an http storageEndpoint', storageEndpoint: 'http://127.0.0.1:10000/devstoreaccount1' },
+    { kind: 'an https storageEndpoint', storageEndpoint: 'https://my-proxy.example.com/devstoreaccount1' },
+    // URI schemes are case-insensitive, and Rush accepted this before the pattern existed.
+    { kind: 'a storageEndpoint with an uppercase scheme', storageEndpoint: 'HTTP://127.0.0.1:10000/x' },
+    { kind: 'a storageEndpoint with a mixed-case scheme', storageEndpoint: 'hTtPs://example.com/x' }
+  ])('accepts $kind', ({ storageEndpoint }) => {
+    expect(() => validate(storageEndpoint)).not.toThrow();
+  });
+});

From b159b4bac5468274c2d8f8cbaf9d8b0ddac5567a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 106/265] [rush-daemon][rush-cli-client] Test the restart
 reason's file cap, a mutation's reason and the result line's client name

Swarm integration step 91; original commit 928e957038 (merge of swarm/r05-t166-nits at 702ff67bfe).
Scope: task 166-nits.

Brings 166-nits (branch swarm/r05-t166-nits). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 15 of 18. Gate: ch01 GATE OK board 4131 (tree 49e02edbfb)

Commits folded into this step (1):
- 702ff67bfe [rush-daemon][rush-cli-client] Test the restart reason's file cap, a mutation's reason and the result line's client name

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/launchClientResultStderr.test.ts | 126 ++++++++++++++++++
 .../swarm-r05-t166-nits_2026-09-29-05-25.json |  11 ++
 .../swarm-r05-t166-nits_2026-09-29-05-25.json |  11 ++
 .../WorkspaceServedScriptAdmission.test.ts    |  72 +++++++++-
 4 files changed, 219 insertions(+), 1 deletion(-)
 create mode 100644 apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r05-t166-nits_2026-09-29-05-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-t166-nits_2026-09-29-05-25.json

diff --git a/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts b/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
new file mode 100644
index 0000000000..99dacc04f0
--- /dev/null
+++ b/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
@@ -0,0 +1,126 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+
+import type { ClientName } from '../ClientAdmissionControls';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+const RESTART_WAIT_TIMEOUT: string =
+  'The rushx script was not admitted before the daemon could restart because ' +
+  'common/config/rush/pnpm-lock.yaml changed. Stop the script, or use --wait-timeout <seconds> to wait longer.';
+
+describe('the stderr line of a failed daemon result (task 166)', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let stderr: string[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-result-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    stderr = [];
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      stderr.push(Buffer.from(chunk).toString());
+      (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+      return true;
+    }) as typeof process.stderr.write);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: process.pid })
+    } as unknown as DaemonClient);
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  describe.each<[ClientName, boolean, string[]]>([
+    ['rush-client', false, ['build', '--to', 'project']],
+    ['rushx-client', true, ['serve']]
+  ])('of %s', (clientName: ClientName, rushx: boolean, argv: string[]) => {
+    it.each<[string, Omit<IDaemonCommandResult, 'requestId'>, string]>([
+      [
+        "the daemon's error",
+        {
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          errorMessage: 'The daemon shut down before the request ran.'
+        },
+        `${clientName}: The daemon shut down before the request ran.\n`
+      ],
+      [
+        "the daemon's reason for an admission failure",
+        {
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage: RESTART_WAIT_TIMEOUT
+        },
+        `${clientName}: daemon admission failed (wait-timeout): ${RESTART_WAIT_TIMEOUT}\n`
+      ]
+    ])('names the client before %s', async (name, result, line) => {
+      process.argv = [process.execPath, clientName, ...argv];
+      jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => ({
+        kind: 'result',
+        result: { requestId: options.request.requestId, ...result }
+      }));
+      await launchClientAsync(rushx);
+      expect(jest.mocked(executeWithDaemonRestartAsync).mock.calls[0][2].request.invocationKind).toBe(
+        rushx ? 'rushx' : 'rush'
+      );
+      expect(stderr).toEqual([line]);
+      expect(process.exitCode).toBe(1);
+    });
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r05-t166-nits_2026-09-29-05-25.json b/common/changes/@rushstack/rush-cli-client/swarm-r05-t166-nits_2026-09-29-05-25.json
new file mode 100644
index 0000000000..417c7a8857
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r05-t166-nits_2026-09-29-05-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test that the stderr line of a failed daemon result names rushx-client for a rushx command and rush-client otherwise.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-t166-nits_2026-09-29-05-25.json b/common/changes/@rushstack/rush-daemon/swarm-r05-t166-nits_2026-09-29-05-25.json
new file mode 100644
index 0000000000..5dca1431fe
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-t166-nits_2026-09-29-05-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a restart reason names at most 3 changed files of Rush or its plugins, and that an install that restarts for another reason leaves the changed installation files out of its reason.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index 5375358b66..87e6da4bc9 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -15,7 +15,8 @@ import * as path from 'node:path';
 import {
   captureWorkspaceInputFingerprintAsync,
   type IWorkspaceInputFingerprint,
-  WorkspaceInputChangeTier
+  WorkspaceInputChangeTier,
+  WorkspaceRuntimeFingerprintCache
 } from '@microsoft/rush-lib';
 import {
   DaemonFrameType,
@@ -673,8 +674,67 @@ describe('the reason for a restart that waits for a served rushx script', () =>
     }));
   }
 
+  let changedImplementationPaths: jest.SpyInstance<ReadonlyArray<string>, []> | undefined;
+
+  /** Makes every later capture find the given files of Rush or its plugins changed, in this order. */
+  function changeImplementationFiles(fixture: DaemonGraphTestFixture, files: ReadonlyArray<string>): void {
+    changeCapturedInputs({ runtimeHash: 'changed' });
+    changedImplementationPaths = jest
+      .spyOn(WorkspaceRuntimeFingerprintCache.prototype, 'changedPaths', 'get')
+      .mockReturnValue(files.map((file: string) => path.join(fixture.folder, file)));
+  }
+
   afterEach(() => {
     inputCaptureMock.mockImplementation(actualCaptureAsync);
+    changedImplementationPaths?.mockRestore();
+    changedImplementationPaths = undefined;
+  });
+
+  const PLUGIN_FILES: ReadonlyArray<string> = ['a', 'b', 'c', 'd'].map(
+    (name: string) => `common/autoinstallers/plugins/node_modules/rush-plugin/lib/${name}.js`
+  );
+
+  it('leaves the changed installation files out of the reason of an install that restarts for another reason', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The install is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      // An install is expected to change the installation, so only the changed code makes it restart first.
+      changeInstallation(fixture);
+      changeImplementationFiles(fixture, PLUGIN_FILES.slice(0, 1));
+      const install: IStreamedRequest = await startRequestAsync(fixture, ['install'], {
+        admission: { waitTimeoutMs: 1500 }
+      });
+      const { terminal } = await install.exchange;
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+        'The request was not admitted before the daemon could restart because the code of Rush or a Rush plugin ' +
+          `changed (${PLUGIN_FILES[0]}).`
+      );
+      expect(install.positionPayloads).toEqual([
+        {
+          position: 1,
+          requestId: install.requestId,
+          restartReason: { kind: 'workspaceInputsChanged', implementationFiles: PLUGIN_FILES.slice(0, 1) },
+          scriptCount: 1
+        }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      inputCaptureMock.mockImplementation(actualCaptureAsync);
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
   });
 
   it.each<
@@ -704,6 +764,16 @@ describe('the reason for a restart that waits for a served rushx script', () =>
       { kind: 'workspaceInputsChanged', implementationFiles: [] },
       'because the code of Rush or a Rush plugin changed'
     ],
+    [
+      'at most 3 changed files of Rush or its plugins',
+      (fixture: DaemonGraphTestFixture) => {
+        changeImplementationFiles(fixture, PLUGIN_FILES);
+        return {};
+      },
+      { kind: 'workspaceInputsChanged', implementationFiles: PLUGIN_FILES.slice(0, 3) },
+      `because the code of Rush or a Rush plugin changed (${PLUGIN_FILES[0]}, ${PLUGIN_FILES[1]} and ` +
+        `${PLUGIN_FILES[2]})`
+    ],
     [
       'another Rush version',
       () => {

From 8b636345aa220382cee89cd3da50ba416d4faf59 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 107/265] [package-deps-hash] Test that a new copy of the Git
 index keeps no caches when only its entry count or version differs

Swarm integration step 92; original commit 8d237df633 (merge of swarm/r07-t169-nits at bc8796720c).
Scope: task 169-nits.

Brings 169-nits (branch swarm/r07-t169-nits). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 16 of 18. Gate: ch01 GATE OK board 4131 (tree a0397e74b5)

Commits folded into this step (1):
- bc8796720c [package-deps-hash] Test that a new copy of the Git index keeps no caches when only its entry count or version differs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...dex-carry-over-tests_2026-09-29-05-10.json | 11 +++++++++
 .../src/test/GitIndexFile.test.ts             | 23 +++++++++++++------
 2 files changed, 27 insertions(+), 7 deletions(-)
 create mode 100644 common/changes/@rushstack/package-deps-hash/git-index-carry-over-tests_2026-09-29-05-10.json

diff --git a/common/changes/@rushstack/package-deps-hash/git-index-carry-over-tests_2026-09-29-05-10.json b/common/changes/@rushstack/package-deps-hash/git-index-carry-over-tests_2026-09-29-05-10.json
new file mode 100644
index 0000000000..d38f73e1ab
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/git-index-carry-over-tests_2026-09-29-05-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Test that a new copy of the Git index keeps no cache of the previous copy when the index only drops its last files, or has another version that records paths the same way.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
index 64f14f77db..173c9e4118 100644
--- a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
+++ b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
@@ -482,6 +482,8 @@ describe(tryCarryOverGitIndexCaches.name, () => {
   it.each<[string, () => void, number]>([
     ['adds a file', () => runGit('add', 'untracked.txt'), 5],
     ['removes a file', () => runGit('rm', '--cached', '--quiet', 'a.txt'), 3],
+    // Then the entries of the index are the first entries of the previous copy
+    ['removes the last file', () => runGit('rm', '--cached', '--quiet', LONG_FILE_PATH), 3],
     ['renames a file', () => runGit('mv', 'a.txt', 'e.txt'), 4],
     [
       'records another file in place of one',
@@ -520,13 +522,20 @@ describe(tryCarryOverGitIndexCaches.name, () => {
     ).toBeUndefined();
   });
 
-  it('returns undefined when the index and the previous copy have different versions', () => {
-    createRepoWithCopy(4);
-    runGit('update-index', '--index-version=2');
-    expect(
-      tryCarryOverGitIndexCaches(readIndex(), fs.readFileSync(copyPath), SHA1_OBJECT_ID_LENGTH)
-    ).toBeUndefined();
-  });
+  // Unlike a version 4 index, a version 3 index records its paths as a version 2 index does
+  it.each<[number, number]>([
+    [2, 4],
+    [3, 2]
+  ])(
+    'returns undefined when the index and the previous copy have versions %i and %i',
+    (version: number, previousVersion: number) => {
+      createRepoWithCopy(previousVersion);
+      setIndexVersion(version);
+      expect(
+        tryCarryOverGitIndexCaches(readIndex(), fs.readFileSync(copyPath), SHA1_OBJECT_ID_LENGTH)
+      ).toBeUndefined();
+    }
+  );
 
   it('returns undefined when the previous copy has no untracked cache', () => {
     createRepoWithCopy(4);

From cfefdb2b99b9f290ee316fc31cf0e22e012fa928 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 108/265] [rush-cli-client] Test the fallback line for a
 multi-line reason from a request that rushd sends back

Swarm integration step 93; original commit 77ad5cecb1 (merge of swarm/r04-t170-nit3 at da22c11bcf).
Refs: task 170 NIT 3, ch01 board 3310.
Scope: task 170-nit3.

Brings 170-nit3 (branch swarm/r04-t170-nit3). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 17 of 18. Gate: ch01 GATE OK board 4131 (tree 257aefda0e)

Commits folded into this step (1):
- da22c11bcf Test the fallback line for a multi-line reason from a request that rushd sends back (task 170 NIT 3, ch01 board 3310)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/sentBackFallback.test.ts         | 73 +++++++++++++++++++
 .../swarm-r04-t170-nit3_2026-09-29-04-45.json | 11 +++
 2 files changed, 84 insertions(+)
 create mode 100644 apps/rush-cli-client/src/test/sentBackFallback.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t170-nit3_2026-09-29-04-45.json

diff --git a/apps/rush-cli-client/src/test/sentBackFallback.test.ts b/apps/rush-cli-client/src/test/sentBackFallback.test.ts
new file mode 100644
index 0000000000..64918a48df
--- /dev/null
+++ b/apps/rush-cli-client/src/test/sentBackFallback.test.ts
@@ -0,0 +1,73 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+
+it('keeps the detail lines of a multi-line reason when the daemon sends a request back', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-sent-back-'));
+  const originalArgv: string[] = process.argv;
+  const originalEnvironment: NodeJS.ProcessEnv = process.env;
+  fs.writeFileSync(
+    path.join(folder, 'rush.json'),
+    JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+  );
+  jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+    paths: {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    }
+  });
+  jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+    status: Promise.resolve({ pid: 42 }),
+    closeAsync: async () => undefined
+  } as unknown as DaemonClient);
+  // The daemon puts the error first and the lines that explain it after it (task 170).
+  jest.mocked(executeWithDaemonRestartAsync).mockResolvedValue({
+    kind: 'fallback',
+    reason: 'unsupported',
+    message: 'Error reading "/repo/common/config/rush/command-line.json":\n  Unexpected token } at 3:1\n'
+  });
+  const output: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+  jest.spyOn(process, 'cwd').mockReturnValue(folder);
+  process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+  process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
+  for (const name of ['RUSH_LOG_LEVEL', 'RUSH_PREVIEW_VERSION']) delete process.env[name];
+  try {
+    await launchClientAsync(false);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(output.mock.calls).toEqual([
+      [
+        'rush-client: Error reading "/repo/common/config/rush/command-line.json"; using in-process Rush.\n' +
+          '    Unexpected token } at 3:1\n'
+      ]
+    ]);
+    expect(process.argv[1]).toBe(
+      path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rush')
+    );
+    expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
+  } finally {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    fs.rmSync(folder, { recursive: true });
+  }
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t170-nit3_2026-09-29-04-45.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t170-nit3_2026-09-29-04-45.json
new file mode 100644
index 0000000000..cb8e430ebe
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t170-nit3_2026-09-29-04-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test that when rushd sends a request back with a reason that spans several lines, the in-process fallback line keeps the first line and prints the rest as indented detail lines.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 98c5d18bc9b6c1144a054dcf4bed2c24ef243d5a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 109/265] [heft-typescript-plugin] Use the system's own
 watchFile when TypeScript has no WatchFileKind

Swarm integration step 94; original commit 033744a8f4 (merge of o07/heft-ts-watchfile-oldts at 622a1337ec).
Scope: 171 + NIT 1 + old-TS fix.

Brings 171 + NIT 1 + old-TS fix (branch o07/heft-ts-watchfile-oldts). Second agents and evidence: ch01's GATE OK board 4131.

s18 batch E1, item 18 of 18. Gate: ch01 GATE OK board 4131 (tree 1bfce0c609)

Commits folded into this step (3):
- 8aa4f3bd96 Notice when a missing root file comes back in heft-typescript-plugin's watch mode
- c42dc6a9de Create heft-typescript-plugin's TypeScript system with a tested function
- 622a1337ec Use the system's own watchFile when TypeScript has no WatchFileKind

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../watch-missing-root-files_2026-09-29.json  |  10 +
 .../heft-typescript-plugin/package.json       |   3 +-
 .../src/TypeScriptBuilder.ts                  |   6 +-
 .../src/existenceAwareWatchFile.ts            | 132 ++++++
 .../src/test/existenceAwareWatchFile.test.ts  | 415 ++++++++++++++++++
 5 files changed, 562 insertions(+), 4 deletions(-)
 create mode 100644 common/changes/@rushstack/heft-typescript-plugin/watch-missing-root-files_2026-09-29.json
 create mode 100644 heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts
 create mode 100644 heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts

diff --git a/common/changes/@rushstack/heft-typescript-plugin/watch-missing-root-files_2026-09-29.json b/common/changes/@rushstack/heft-typescript-plugin/watch-missing-root-files_2026-09-29.json
new file mode 100644
index 0000000000..9e3d573cf1
--- /dev/null
+++ b/common/changes/@rushstack/heft-typescript-plugin/watch-missing-root-files_2026-09-29.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-typescript-plugin",
+      "comment": "Fix an issue where, in watch mode with the `useFsEventsOnParentDirectory` file watcher, a source file that was missing when TypeScript last updated the program could stay \"not found\" (TS6053) after it came back, until Heft restarted.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-typescript-plugin"
+}
diff --git a/heft-plugins/heft-typescript-plugin/package.json b/heft-plugins/heft-typescript-plugin/package.json
index 361d965cef..c939f335c9 100644
--- a/heft-plugins/heft-typescript-plugin/package.json
+++ b/heft-plugins/heft-typescript-plugin/package.json
@@ -43,7 +43,8 @@
     "build": "heft test --clean",
     "start": "heft build-watch",
     "_phase:build": "heft run --only build -- --clean",
-    "_phase:pack": "rush-pnpm pack"
+    "_phase:pack": "rush-pnpm pack",
+    "_phase:test": "heft run --only test -- --clean"
   },
   "peerDependencies": {
     "@rushstack/heft": "1.3.1"
diff --git a/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts b/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts
index 6b6e758434..b01ebc3c61 100644
--- a/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts
+++ b/heft-plugins/heft-typescript-plugin/src/TypeScriptBuilder.ts
@@ -26,6 +26,7 @@ import type {
   ITypescriptWorkerData
 } from './types';
 import { configureProgramForMultiEmit } from './configureProgramForMultiEmit';
+import { createSystemWithExistenceAwareWatchFile } from './existenceAwareWatchFile';
 import { loadTsconfig } from './tsconfigLoader';
 import { loadTypeScriptToolAsync } from './loadTypeScriptTool';
 
@@ -253,12 +254,11 @@ export class TypeScriptBuilder {
       const getCurrentDirectory: () => string = () => this.#configuration.buildFolderPath;
 
       // Need to also update watchFile and watchDirectory
-      const system: ITypeScriptNodeSystem = {
-        ...baseSystem,
+      const system: ITypeScriptNodeSystem = createSystemWithExistenceAwareWatchFile(ts, baseSystem, {
         getCurrentDirectory,
         clearTimeout,
         setTimeout
-      };
+      });
       const { realpath } = system;
 
       if (realpath && system.getAccessibleFileSystemEntries) {
diff --git a/heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts b/heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts
new file mode 100644
index 0000000000..3eaa757b0e
--- /dev/null
+++ b/heft-plugins/heft-typescript-plugin/src/existenceAwareWatchFile.ts
@@ -0,0 +1,132 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as TTypescript from 'typescript';
+
+/**
+ * The type of `TTypescript.System.watchFile`.
+ */
+export type WatchFileFunction = NonNullable<TTypescript.System['watchFile']>;
+
+/**
+ * The parts of the TypeScript API that {@link createExistenceAwareWatchFile} uses. TypeScript 3.7 and older have no
+ * `WatchFileKind`.
+ */
+export type ExistenceAwareWatchFileTypeScript = Pick<typeof TTypescript, 'FileWatcherEventKind'> &
+  Partial<Pick<typeof TTypescript, 'WatchFileKind'>>;
+
+// TypeScript's `PollingInterval.Medium`, which it uses for missing files. Only used if the caller passes no interval.
+const DEFAULT_MISSING_FILE_POLLING_INTERVAL_MS: number = 500;
+
+/**
+ * Wraps a TypeScript system's `watchFile`, so that a watcher reports `Created` or `Deleted`, instead of `Changed`,
+ * when the watched file appeared or disappeared since the watcher's last event, and so that a watcher reports
+ * `Created` when a missing file comes back, even if the system's watcher doesn't notice. Returns `undefined` if the
+ * system can't watch files, and the system's own `watchFile` if TypeScript has no `WatchFileKind`.
+ *
+ * @remarks
+ * A watch program acts on a missing file only when the file's watcher reports `Created`, and a watch program that was
+ * created from a list of root files has no other way to notice that a missing root file is back. Without that event,
+ * a root file that was missing when the program was updated stays "not found" (TS6053) until the process restarts.
+ * TypeScript's `useFsEventsOnParentDirectory` file watcher doesn't always report it:
+ *
+ * - Except on macOS, it reports every event as `Changed`.
+ *
+ * - It watches the file's folder. If the folder was deleted, it watches the folder again only after the folder is
+ *   back, and it reports nothing about the files that were written to the folder before then.
+ *
+ * So while the file is missing, the returned watcher also polls for it with TypeScript's polling file watcher, at the
+ * caller's polling interval, or every 500 ms if the caller didn't pass one.
+ *
+ * TypeScript 3.7 and older have no `WatchFileKind`, so a watcher can't ask them for a polling file watcher.
+ */
+export function createExistenceAwareWatchFile(
+  ts: ExistenceAwareWatchFileTypeScript,
+  system: Pick<TTypescript.System, 'fileExists' | 'watchFile'>
+): WatchFileFunction | undefined {
+  const { watchFile: baseWatchFile } = system;
+  const { WatchFileKind } = ts;
+  if (!baseWatchFile || !WatchFileKind) {
+    return baseWatchFile;
+  }
+
+  const { Created, Changed, Deleted } = ts.FileWatcherEventKind;
+  const { PriorityPollingInterval } = WatchFileKind;
+  return (
+    fileName: string,
+    callback: TTypescript.FileWatcherCallback,
+    pollingInterval?: number,
+    options?: TTypescript.WatchOptions
+  ): TTypescript.FileWatcher => {
+    let existed: boolean = system.fileExists(fileName);
+    let closed: boolean = false;
+    let missingFileWatcher: TTypescript.FileWatcher | undefined;
+
+    const updateMissingFileWatcher = (): void => {
+      if (existed || closed) {
+        missingFileWatcher?.close();
+        missingFileWatcher = undefined;
+      } else if (!missingFileWatcher) {
+        missingFileWatcher = baseWatchFile.call(
+          system,
+          fileName,
+          (eventFileName: string, eventKind: TTypescript.FileWatcherEventKind, modifiedTime?: Date): void => {
+            if (!existed && !closed && system.fileExists(fileName)) {
+              existed = true;
+              updateMissingFileWatcher();
+              callback(eventFileName, Created, modifiedTime);
+            }
+          },
+          pollingInterval ?? DEFAULT_MISSING_FILE_POLLING_INTERVAL_MS,
+          { ...options, watchFile: PriorityPollingInterval }
+        );
+      }
+    };
+
+    const watcher: TTypescript.FileWatcher = baseWatchFile.call(
+      system,
+      fileName,
+      (eventFileName: string, eventKind: TTypescript.FileWatcherEventKind, modifiedTime?: Date): void => {
+        const exists: boolean = system.fileExists(fileName);
+        let reportedEventKind: TTypescript.FileWatcherEventKind = eventKind;
+        if (eventKind === Changed && exists !== existed) {
+          reportedEventKind = exists ? Created : Deleted;
+        }
+
+        existed = exists;
+        updateMissingFileWatcher();
+        callback(eventFileName, reportedEventKind, modifiedTime);
+      },
+      pollingInterval,
+      options
+    );
+    updateMissingFileWatcher();
+
+    return {
+      close: (): void => {
+        closed = true;
+        watcher.close();
+        updateMissingFileWatcher();
+      }
+    };
+  };
+}
+
+/**
+ * Returns a copy of a TypeScript system with the given overrides, whose `watchFile` is what
+ * {@link createExistenceAwareWatchFile} returns for the system.
+ */
+export function createSystemWithExistenceAwareWatchFile<
+  TSystem extends Pick<TTypescript.System, 'fileExists' | 'watchFile'>
+>(
+  ts: ExistenceAwareWatchFileTypeScript,
+  system: TSystem,
+  overrides: Partial<Omit<TSystem, 'watchFile'>>
+): TSystem {
+  return {
+    ...system,
+    ...overrides,
+    // So that a watch program notices when a missing root file comes back
+    watchFile: createExistenceAwareWatchFile(ts, system)
+  };
+}
diff --git a/heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts b/heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts
new file mode 100644
index 0000000000..c38b0e3989
--- /dev/null
+++ b/heft-plugins/heft-typescript-plugin/src/test/existenceAwareWatchFile.test.ts
@@ -0,0 +1,415 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as ts from 'typescript';
+
+import { Async, FileSystem, PackageJsonLookup } from '@rushstack/node-core-library';
+
+import {
+  createExistenceAwareWatchFile,
+  createSystemWithExistenceAwareWatchFile,
+  type WatchFileFunction
+} from '../existenceAwareWatchFile';
+
+const { Created, Changed, Deleted } = ts.FileWatcherEventKind;
+const { PriorityPollingInterval, UseFsEventsOnParentDirectory } = ts.WatchFileKind;
+
+// TypeScript 3.7 and older have no `WatchFileKind`.
+const TYPESCRIPT_WITHOUT_WATCH_FILE_KIND: Pick<typeof ts, 'FileWatcherEventKind'> = {
+  FileWatcherEventKind: ts.FileWatcherEventKind
+};
+
+const WATCHED_FILE_PATH: string = '/project/src/b.ts';
+const POLLING_INTERVAL: number = 250;
+const WATCH_OPTIONS: ts.WatchOptions = {
+  watchFile: UseFsEventsOnParentDirectory,
+  fallbackPolling: ts.PollingWatchKind.DynamicPriority
+};
+
+interface IBaseWatcher {
+  callback: ts.FileWatcherCallback;
+  pollingInterval: number | undefined;
+  options: ts.WatchOptions | undefined;
+  closed: boolean;
+}
+
+interface IFakeSystem {
+  files: Set<string>;
+  watchers: IBaseWatcher[];
+  system: Pick<ts.System, 'fileExists' | 'watchFile'>;
+}
+
+function createFakeSystem(existingFilePaths: string[]): IFakeSystem {
+  const files: Set<string> = new Set(existingFilePaths);
+  const watchers: IBaseWatcher[] = [];
+  const system: Pick<ts.System, 'fileExists' | 'watchFile'> = {
+    fileExists: (filePath: string) => files.has(filePath),
+    watchFile: (
+      filePath: string,
+      callback: ts.FileWatcherCallback,
+      pollingInterval?: number,
+      options?: ts.WatchOptions
+    ): ts.FileWatcher => {
+      const watcher: IBaseWatcher = { callback, pollingInterval, options, closed: false };
+      watchers.push(watcher);
+      return {
+        close: () => {
+          watcher.closed = true;
+        }
+      };
+    }
+  };
+  return { files, watchers, system };
+}
+
+function watchAndRecordKinds(
+  fakeSystem: IFakeSystem
+): [baseWatcher: IBaseWatcher, reportedKinds: ts.FileWatcherEventKind[], watcher: ts.FileWatcher] {
+  const watchFile: WatchFileFunction = createExistenceAwareWatchFile(ts, fakeSystem.system)!;
+  const reportedKinds: ts.FileWatcherEventKind[] = [];
+  const watcher: ts.FileWatcher = watchFile(
+    WATCHED_FILE_PATH,
+    (fileName: string, eventKind: ts.FileWatcherEventKind) => {
+      reportedKinds.push(eventKind);
+    },
+    POLLING_INTERVAL,
+    WATCH_OPTIONS
+  );
+  const [baseWatcher] = fakeSystem.watchers;
+  expect(baseWatcher.options).toBe(WATCH_OPTIONS);
+  return [baseWatcher, reportedKinds, watcher];
+}
+
+function getOpenPollingWatchers(fakeSystem: IFakeSystem): IBaseWatcher[] {
+  return fakeSystem.watchers.filter(
+    (watcher: IBaseWatcher) => !watcher.closed && watcher.options?.watchFile === PriorityPollingInterval
+  );
+}
+
+describe(createExistenceAwareWatchFile.name, () => {
+  it('returns undefined if the system cannot watch files', () => {
+    expect(createExistenceAwareWatchFile(ts, { fileExists: () => true })).toBeUndefined();
+    expect(
+      createExistenceAwareWatchFile(TYPESCRIPT_WITHOUT_WATCH_FILE_KIND, { fileExists: () => true })
+    ).toBeUndefined();
+  });
+
+  it("returns the system's own watchFile if TypeScript has no WatchFileKind", () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    expect(createExistenceAwareWatchFile(TYPESCRIPT_WITHOUT_WATCH_FILE_KIND, fakeSystem.system)).toBe(
+      fakeSystem.system.watchFile
+    );
+  });
+
+  it('reports "Changed" as "Created" or "Deleted" when the file appeared or disappeared since the last event', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const [baseWatcher, reportedKinds] = watchAndRecordKinds(fakeSystem);
+
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+
+    expect(reportedKinds).toEqual([Created, Changed, Deleted, Changed, Created]);
+  });
+
+  it('passes "Created" and "Deleted" through, and counts them as the latest state', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([WATCHED_FILE_PATH]);
+    const [baseWatcher, reportedKinds] = watchAndRecordKinds(fakeSystem);
+
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Deleted);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Created);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+
+    expect(reportedKinds).toEqual([Deleted, Changed, Created, Changed]);
+  });
+
+  it('passes the arguments through and returns a watcher that closes the base watcher', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([WATCHED_FILE_PATH]);
+    const watchFile: WatchFileFunction = createExistenceAwareWatchFile(ts, fakeSystem.system)!;
+    const events: [string, ts.FileWatcherEventKind, Date | undefined][] = [];
+    const watcher: ts.FileWatcher = watchFile(
+      WATCHED_FILE_PATH,
+      (fileName: string, eventKind: ts.FileWatcherEventKind, modifiedTime?: Date) => {
+        events.push([fileName, eventKind, modifiedTime]);
+      },
+      250,
+      WATCH_OPTIONS
+    );
+
+    // The file exists, so nothing polls for it.
+    expect(fakeSystem.watchers).toHaveLength(1);
+    const [baseWatcher] = fakeSystem.watchers;
+    expect(baseWatcher.pollingInterval).toBe(250);
+    expect(baseWatcher.options).toBe(WATCH_OPTIONS);
+
+    const modifiedTime: Date = new Date(1000);
+    baseWatcher.callback('/project/src/sub/../b.ts', Changed, modifiedTime);
+    expect(events).toEqual([['/project/src/sub/../b.ts', Changed, modifiedTime]]);
+
+    expect(baseWatcher.closed).toBe(false);
+    watcher.close();
+    expect(baseWatcher.closed).toBe(true);
+  });
+
+  it('polls for a missing file with the same polling interval, and reports "Created" once when the poll finds it', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const watchFile: WatchFileFunction = createExistenceAwareWatchFile(ts, fakeSystem.system)!;
+    const events: [string, ts.FileWatcherEventKind, Date | undefined][] = [];
+    watchFile(
+      WATCHED_FILE_PATH,
+      (fileName: string, eventKind: ts.FileWatcherEventKind, modifiedTime?: Date) => {
+        events.push([fileName, eventKind, modifiedTime]);
+      },
+      POLLING_INTERVAL,
+      WATCH_OPTIONS
+    );
+
+    expect(fakeSystem.watchers).toHaveLength(2);
+    const [baseWatcher, pollingWatcher] = fakeSystem.watchers;
+    expect(baseWatcher.options).toBe(WATCH_OPTIONS);
+    expect(pollingWatcher.pollingInterval).toBe(POLLING_INTERVAL);
+    expect(pollingWatcher.options).toEqual({ ...WATCH_OPTIONS, watchFile: PriorityPollingInterval });
+
+    pollingWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(events).toEqual([]);
+
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    const modifiedTime: Date = new Date(2000);
+    pollingWatcher.callback(WATCHED_FILE_PATH, Changed, modifiedTime);
+    expect(events).toEqual([[WATCHED_FILE_PATH, Created, modifiedTime]]);
+    expect(pollingWatcher.closed).toBe(true);
+
+    // The base watcher sees the same file, which it now reports as changed.
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(events.map(([, eventKind]) => eventKind)).toEqual([Created, Changed]);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([]);
+
+    // A late event from the closed polling watcher doesn't report the file again.
+    pollingWatcher.callback(WATCHED_FILE_PATH, Created);
+    expect(events).toHaveLength(2);
+
+    // A caller that passes no polling interval or options gets TypeScript's interval for missing files.
+    watchFile('/project/src/c.ts', () => {
+      // Not called
+    });
+    expect(fakeSystem.watchers).toHaveLength(4);
+    expect(fakeSystem.watchers[2].pollingInterval).toBeUndefined();
+    expect(fakeSystem.watchers[3].pollingInterval).toBe(500);
+    expect(fakeSystem.watchers[3].options).toEqual({ watchFile: PriorityPollingInterval });
+  });
+
+  it('polls again whenever the file goes missing, and stops polling when the watcher is closed', () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([WATCHED_FILE_PATH]);
+    const [baseWatcher, reportedKinds, watcher] = watchAndRecordKinds(fakeSystem);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([]);
+
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(reportedKinds).toEqual([Deleted, Changed]);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([fakeSystem.watchers[1]]);
+
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(reportedKinds).toEqual([Deleted, Changed, Created]);
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([]);
+
+    fakeSystem.files.delete(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Deleted);
+    expect(reportedKinds).toEqual([Deleted, Changed, Created, Deleted]);
+    const pollingWatcher: IBaseWatcher = fakeSystem.watchers[2];
+    expect(getOpenPollingWatchers(fakeSystem)).toEqual([pollingWatcher]);
+
+    watcher.close();
+    expect(baseWatcher.closed).toBe(true);
+    expect(pollingWatcher.closed).toBe(true);
+
+    // Events that arrive after the watcher was closed don't report the file or poll for it again.
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    pollingWatcher.callback(WATCHED_FILE_PATH, Created);
+    expect(reportedKinds).toEqual([Deleted, Changed, Created, Deleted, Changed]);
+    expect(fakeSystem.watchers).toHaveLength(3);
+  });
+});
+
+describe(createSystemWithExistenceAwareWatchFile.name, () => {
+  it("keeps the system's members and the overrides, and wraps the system's watchFile", () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const readFile: (filePath: string) => string | undefined = () => undefined;
+    const baseGetCurrentDirectory: () => string = () => '/';
+    const getCurrentDirectory: () => string = () => '/project';
+    const baseSystem: Pick<ts.System, 'fileExists' | 'watchFile' | 'readFile' | 'getCurrentDirectory'> = {
+      ...fakeSystem.system,
+      readFile,
+      getCurrentDirectory: baseGetCurrentDirectory
+    };
+
+    const system: Pick<ts.System, 'fileExists' | 'watchFile' | 'readFile' | 'getCurrentDirectory'> =
+      createSystemWithExistenceAwareWatchFile(ts, baseSystem, { getCurrentDirectory });
+    expect(system).not.toBe(baseSystem);
+    expect(system.fileExists).toBe(baseSystem.fileExists);
+    expect(system.readFile).toBe(readFile);
+    expect(system.getCurrentDirectory).toBe(getCurrentDirectory);
+    expect(baseSystem.getCurrentDirectory).toBe(baseGetCurrentDirectory);
+    expect(system.watchFile).not.toBe(baseSystem.watchFile);
+
+    const reportedKinds: ts.FileWatcherEventKind[] = [];
+    system.watchFile!(
+      WATCHED_FILE_PATH,
+      (fileName: string, eventKind: ts.FileWatcherEventKind) => {
+        reportedKinds.push(eventKind);
+      },
+      POLLING_INTERVAL,
+      WATCH_OPTIONS
+    );
+    // The file is missing, so the system's watchFile was called for the watcher and for a poll.
+    expect(fakeSystem.watchers).toHaveLength(2);
+    expect(getOpenPollingWatchers(fakeSystem)).toHaveLength(1);
+
+    const [baseWatcher] = fakeSystem.watchers;
+    fakeSystem.files.add(WATCHED_FILE_PATH);
+    baseWatcher.callback(WATCHED_FILE_PATH, Changed);
+    expect(reportedKinds).toEqual([Created]);
+    expect(getOpenPollingWatchers(fakeSystem)).toHaveLength(0);
+  });
+
+  it("keeps the system's own watchFile if TypeScript has no WatchFileKind", () => {
+    const fakeSystem: IFakeSystem = createFakeSystem([]);
+    const getCurrentDirectory: () => string = () => '/project';
+    const system: Pick<ts.System, 'fileExists' | 'watchFile' | 'getCurrentDirectory'> =
+      createSystemWithExistenceAwareWatchFile(
+        TYPESCRIPT_WITHOUT_WATCH_FILE_KIND,
+        { ...fakeSystem.system, getCurrentDirectory: () => '/' },
+        { getCurrentDirectory }
+      );
+    expect(system.watchFile).toBe(fakeSystem.system.watchFile);
+    expect(system.getCurrentDirectory).toBe(getCurrentDirectory);
+  });
+
+  it('has no watchFile if the system cannot watch files', () => {
+    const system: Pick<ts.System, 'fileExists' | 'watchFile'> = createSystemWithExistenceAwareWatchFile(
+      ts,
+      { fileExists: () => true },
+      {}
+    );
+    expect(system.watchFile).toBeUndefined();
+  });
+});
+
+describe('A TypeScript watch program that uses useFsEventsOnParentDirectory', () => {
+  const projectFolderPath: string = PackageJsonLookup.instance.tryGetPackageFolderFor(__dirname)!;
+
+  async function expectRecompiledAfterMissingAsync(
+    caseName: string,
+    deleteAsync: (bFilePath: string, bFolderPath: string) => Promise<void>
+  ): Promise<void> {
+    const testFolderPath: string = `${projectFolderPath}/temp/test/existenceAwareWatchFile/${caseName}`;
+    const aFilePath: string = `${testFolderPath}/src/a.ts`;
+    const bFolderPath: string = `${testFolderPath}/src/sub`;
+    const bFilePath: string = `${bFolderPath}/b.ts`;
+    const bDeclarationFilePath: string = `${testFolderPath}/lib/sub/b.d.ts`;
+
+    await FileSystem.ensureEmptyFolderAsync(testFolderPath);
+    await FileSystem.writeFileAsync(aFilePath, 'export const a: number = 1;\n', { ensureFolderExists: true });
+    await FileSystem.writeFileAsync(bFilePath, 'export const b: number = 1;\n', { ensureFolderExists: true });
+
+    // Like heft, run the program updates that TypeScript schedules only when asked to.
+    const pendingWork: Set<() => void> = new Set();
+    const system: ts.System = createSystemWithExistenceAwareWatchFile(ts, ts.sys, {
+      setTimeout: (callback: (...args: unknown[]) => void, ms: number, ...args: unknown[]): (() => void) => {
+        const work: () => void = () => callback(...args);
+        pendingWork.add(work);
+        return work;
+      },
+      clearTimeout: (work: () => void): void => {
+        pendingWork.delete(work);
+      }
+    });
+
+    const diagnosticCodes: number[] = [];
+    const host: ts.WatchCompilerHostOfFilesAndCompilerOptions<ts.EmitAndSemanticDiagnosticsBuilderProgram> =
+      ts.createWatchCompilerHost(
+        [aFilePath, bFilePath],
+        {
+          declaration: true,
+          lib: ['lib.es2019.d.ts'],
+          module: ts.ModuleKind.CommonJS,
+          outDir: `${testFolderPath}/lib`,
+          rootDir: `${testFolderPath}/src`,
+          skipLibCheck: true,
+          target: ts.ScriptTarget.ES2019,
+          types: []
+        },
+        system,
+        ts.createEmitAndSemanticDiagnosticsBuilderProgram,
+        (diagnostic: ts.Diagnostic) => {
+          diagnosticCodes.push(diagnostic.code);
+        },
+        () => {
+          // Ignore the watch status messages
+        },
+        undefined,
+        { watchFile: ts.WatchFileKind.UseFsEventsOnParentDirectory }
+      );
+
+    async function runNextProgramUpdateAsync(): Promise<void> {
+      const deadline: number = Date.now() + 10000;
+      while (pendingWork.size === 0) {
+        if (Date.now() > deadline) {
+          throw new Error('TypeScript did not schedule a program update.');
+        }
+
+        await Async.sleepAsync(20);
+      }
+
+      diagnosticCodes.length = 0;
+      for (const work of pendingWork) {
+        pendingWork.delete(work);
+        work();
+      }
+    }
+
+    const watchProgram: ts.WatchOfFilesAndCompilerOptions<ts.EmitAndSemanticDiagnosticsBuilderProgram> =
+      ts.createWatchProgram(host);
+    try {
+      expect(diagnosticCodes).toEqual([]);
+
+      await deleteAsync(bFilePath, bFolderPath);
+      await runNextProgramUpdateAsync();
+      // error TS6053: File '.../b.ts' not found.
+      expect(diagnosticCodes).toEqual([6053]);
+
+      await FileSystem.writeFileAsync(
+        bFilePath,
+        'export const b: number = 2;\nexport const b2: number = 3;\n',
+        { ensureFolderExists: true }
+      );
+      await runNextProgramUpdateAsync();
+      expect(diagnosticCodes).toEqual([]);
+      expect(await FileSystem.readFileAsync(bDeclarationFilePath)).toContain('b2');
+    } finally {
+      watchProgram.close();
+    }
+  }
+
+  it('compiles a root file again after it was missing during a program update', async () => {
+    await expectRecompiledAfterMissingAsync('file', async (bFilePath: string) => {
+      await FileSystem.deleteFileAsync(bFilePath);
+    });
+  }, 30000);
+
+  it('compiles a root file again after its folder was missing during a program update', async () => {
+    await expectRecompiledAfterMissingAsync('folder', async (bFilePath: string, bFolderPath: string) => {
+      await FileSystem.deleteFolderAsync(bFolderPath);
+    });
+  }, 30000);
+});

From 5fc8b911ec563108863a2d9e626240581ed61674 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 110/265] [rush-daemon-transport] Report a reclaim's stopped
 operations to a callback (task 177) (and 5 more)

Swarm integration step 95; original commit cefd76b256 (merge of swarm/r06-t177-int3 at a08d04af45).
Scope: task 177-int3.

Brings 177-int3 (branch swarm/r06-t177-int3). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 1 of 21. Gate: ch01 GATE OK board 4527 (tree 9346b7a8e0)

Commits folded into this step (6):
- ec0b9d69d0 [rush-daemon-transport] Report a reclaim's stopped operations to a callback (task 177)
- b695ac0fe6 [rush-client-core] Pass a reclaim's stopped operations to onOrphansReaped (task 177)
- b4a398f810 [rush-cli-client] Say what a reclaim stopped in one rush-client line (task 177)
- 788d0d18a8 [rush-cli-client] Test the reclaim line when a start reclaims an exited daemon (task 177)
- 353a162709 [rush-daemon-transport] Test reclaim reports of killed and reclaimed operation groups (task 177)
- d9f98ea659 [rush-cli-client] Test the rushx-client reclaim line (task 177)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                | 12 ++-
 apps/rush-cli-client/src/daemonCommands.ts    | 17 ++--
 .../src/daemonReclaimNotice.ts                | 57 +++++++++++++
 apps/rush-cli-client/src/launchClient.ts      | 17 +++-
 .../src/test/daemonReclaimNotice.test.ts      | 72 ++++++++++++++++
 .../src/test/nativeBuild.test.ts              | 82 ++++++++++++++++++-
 ...-t177-reclaim-notice_2026-09-29-02-10.json | 11 +++
 ...-t177-reclaim-notice_2026-09-29-02-10.json | 11 +++
 ...-t177-reclaim-notice_2026-09-29-02-10.json | 11 +++
 common/reviews/api/rush-client-core.api.md    |  5 +-
 .../reviews/api/rush-daemon-transport.api.md  | 14 +++-
 libraries/rush-client-core/README.md          | 13 +--
 .../rush-client-core/src/DaemonDisconnect.ts  |  8 +-
 .../src/ExitedDaemonReclaim.ts                | 34 +++++---
 .../src/connectOrStartDaemon.ts               |  9 +-
 .../src/executeWithDaemonRestart.ts           |  4 +-
 .../src/test/DaemonDisconnect.test.ts         | 23 ++++++
 .../src/test/ExitedDaemonReclaim.test.ts      | 15 +++-
 .../src/test/OrphanedOperation.ts             |  4 +-
 .../src/test/connectOrStartDaemon.test.ts     | 60 ++++++++++++++
 .../src/test/fixtures/daemon.ts               | 22 ++++-
 .../src/DaemonGroupTermination.ts             |  5 +-
 .../src/DaemonOperationGroupReaper.ts         |  9 +-
 .../src/DaemonOrphanReaper.ts                 | 16 +++-
 .../src/DaemonReapOptions.ts                  | 14 +++-
 .../src/DaemonReclaim.ts                      | 28 ++++---
 .../src/DaemonReclaimOptions.ts               | 29 +++++++
 libraries/rush-daemon-transport/src/index.ts  |  1 +
 .../test/DaemonOperationGroupReaper.test.ts   | 15 ++++
 .../src/test/DaemonOrphanReaper.test.ts       | 13 +++
 .../test/OperationGroupReapOnReclaim.test.ts  | 30 +++++++
 .../test/OperationGroupTermination.test.ts    | 16 ++++
 .../src/test/OrphanReapOnReclaim.test.ts      | 28 +++++--
 33 files changed, 634 insertions(+), 71 deletions(-)
 create mode 100644 apps/rush-cli-client/src/daemonReclaimNotice.ts
 create mode 100644 apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 32182b1781..fa036922db 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -352,10 +352,18 @@ the daemon exits again, to `--no-daemon` (`rushx-client --no-daemon` for Rushx),
 second line the fatal error that the launcher log recorded after the command was sent. Before it
 prints that, the client stops the operations that the exited daemon left running and removes its
 ownership record and socket, as the next daemon start would, so a rerun, with or without
-`--no-daemon`, does not race them. A `RUSH_DAEMON_ORPHANS_REAPED` warning says what it stopped.
+`--no-daemon`, does not race them.
 Rush run in-process, with `--no-daemon` or as a fallback, first does the same when the ownership
 record names a daemon that no longer runs, for example when the client that ran the command was
-killed along with the daemon.
+killed along with the daemon. Each of these reclaims, and the one that `daemon start` or an automatic
+start does, prints one line that says what it stopped, for example:
+
+```
+rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).
+```
+
+The line begins "Killed" instead, and ends "they did not exit after SIGTERM", when an operation
+needed SIGKILL. While agent mode shows its progress lines, the line is written among them.
 If rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
 or `daemon restart` still end a command as cancelled (exit code 130).
 
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index a56e123607..1265fc7a11 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -29,6 +29,7 @@ import type { IDaemonPongMessage, IDaemonRequestAdmissionOptions } from '@rushst
 import { getDaemonConnectionOptionsAsync } from './daemonConnectionOptions';
 import { printDaemonLogAsync } from './daemonLogs';
 import { executeDaemonGraphCommandAsync } from './daemonGraph';
+import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
 import { writeStreamAsync } from './writeStreamAsync';
 
 const FORCE_STOP_WAIT_MS: number = 15000;
@@ -71,12 +72,16 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
   }
   if (!options.rushJsonPath) throw new Error('Daemon management requires a repository containing rush.json.');
   const mayStart: boolean = command === 'start' || command === 'restart';
-  const connectionOptions: IConnectOrStartDaemonOptions = await getDaemonConnectionOptionsAsync(
-    path.dirname(options.rushJsonPath),
-    options.rushVersion,
-    options.environment,
-    mayStart
-  );
+  const connectionOptions: IConnectOrStartDaemonOptions = {
+    ...(await getDaemonConnectionOptionsAsync(
+      path.dirname(options.rushJsonPath),
+      options.rushVersion,
+      options.environment,
+      mayStart
+    )),
+    // A start reclaims a daemon that exited uncleanly, and says what it stopped.
+    onOrphansReaped: createOrphanReapNoticeHandler({ rushx: false, agentRenderer: undefined, writeStderr })
+  };
   if (command === 'logs') {
     if (options.argv[1] !== '--follow') {
       await printDaemonLogAsync(connectionOptions.paths);
diff --git a/apps/rush-cli-client/src/daemonReclaimNotice.ts b/apps/rush-cli-client/src/daemonReclaimNotice.ts
new file mode 100644
index 0000000000..9854f61ee2
--- /dev/null
+++ b/apps/rush-cli-client/src/daemonReclaimNotice.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
+
+/** The most process groups that a line names before it says how many more were stopped. */
+const MAX_NAMED_GROUPS: number = 4;
+
+/** Lists process groups as `process group A`, `process groups A and B`, or `process groups A, B, C, D and 2 more`. */
+function formatProcessGroups(groupIds: readonly number[]): string {
+  const items: string[] = groupIds.slice(0, MAX_NAMED_GROUPS).map(String);
+  if (groupIds.length > items.length) items.push(`${groupIds.length - items.length} more`);
+  const last: string | undefined = items.pop();
+  return items.length === 0 ? `process group ${last}` : `process groups ${items.join(', ')} and ${last}`;
+}
+
+/**
+ * Returns the line that tells the user that the operations an exited daemon left running were stopped, so that
+ * they cannot overwrite the outputs of this command.
+ */
+export function formatOrphanReapNotice(reap: IDaemonOrphanReap, rushx: boolean): string {
+  const client: string = rushx ? 'rushx-client' : 'rush-client';
+  const operations: string =
+    `the operations that the exited daemon (PID ${reap.daemonPid}) left running ` +
+    `(${formatProcessGroups(reap.processGroupIds)})`;
+  return reap.outcome === 'killed'
+    ? `${client}: Killed ${operations}; they did not exit after SIGTERM.`
+    : `${client}: Stopped ${operations}.`;
+}
+
+/**
+ * Where a reclaim line goes: the agent renderer when one is active, and otherwise stderr.
+ */
+export interface IOrphanReapNoticeTarget {
+  readonly rushx: boolean;
+  readonly agentRenderer: { note(line: string): void } | undefined;
+  readonly writeStderr: (text: string) => void;
+}
+
+/**
+ * Creates the `onOrphansReaped` callback that prints {@link formatOrphanReapNotice}'s line, in place of the
+ * `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+ */
+export function createOrphanReapNoticeHandler(
+  target: IOrphanReapNoticeTarget
+): (reap: IDaemonOrphanReap) => void {
+  return (reap: IDaemonOrphanReap): void => {
+    const line: string = formatOrphanReapNotice(reap, target.rushx);
+    if (target.agentRenderer) target.agentRenderer.note(line);
+    else target.writeStderr(`${line}\n`);
+  };
+}
+
+/** Writes to this process's stderr. */
+export function writeStderr(text: string): void {
+  process.stderr.write(text);
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 0940e95fb0..da82889dd9 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -21,7 +21,7 @@ import {
   type IConnectOrStartDaemonOptions
 } from '@rushstack/rush-client-core';
 import type { DaemonVerbosity, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
-import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
 import { executeDaemonCommandAsync } from './daemonCommands';
@@ -46,6 +46,7 @@ import {
   type IDaemonRequestNoticeHandlers
 } from './daemonRestartNotice';
 import { formatInProcessFallbackMessage } from './inProcessFallback';
+import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
 import { writeStreamAsync } from './writeStreamAsync';
 import {
   getBundledRushVersion,
@@ -167,7 +168,9 @@ export async function launchClientAsync(
         columns: request.terminal.columns,
         colorLevel: terminal.supportsColor ? 1 : 0,
         verbosity
-      }
+      },
+      // A reclaim before a start, or after the daemon exited during the command, says what it stopped.
+      onOrphansReaped: createOrphanReapNoticeHandler({ rushx, agentRenderer, writeStderr })
     };
     // While a live daemon or starter can still make the daemon ready, a startup failure rejects with a
     // DaemonStartupPendingError, which is not a DaemonClientError, so Rush does not run in-process next to it.
@@ -362,7 +365,15 @@ async function launchInProcessAsync(
     } catch {
       // Without the daemon's folder there is nothing to reclaim; Rush reports a workspace problem itself.
     }
-    if (paths) await reclaimCrashedDaemonAsync(paths);
+    if (paths) {
+      // Any agent renderer was disposed before Rush runs in-process.
+      const onOrphansReaped: (reap: IDaemonOrphanReap) => void = createOrphanReapNoticeHandler({
+        rushx,
+        agentRenderer: undefined,
+        writeStderr
+      });
+      await reclaimCrashedDaemonAsync(paths, { onOrphansReaped });
+    }
   }
   launchInProcess(argv, rushx, selectedVersion);
 }
diff --git a/apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts b/apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts
new file mode 100644
index 0000000000..6a4580d58f
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonReclaimNotice.test.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
+
+import { createOrphanReapNoticeHandler, formatOrphanReapNotice } from '../daemonReclaimNotice';
+
+function reapOf(processGroupIds: number[], outcome: IDaemonOrphanReap['outcome']): IDaemonOrphanReap {
+  return { daemonPid: 4242, processGroupIds, outcome };
+}
+
+describe(formatOrphanReapNotice.name, () => {
+  it('names the exited daemon and the process group that was stopped', () => {
+    expect(formatOrphanReapNotice(reapOf([4242], 'terminated'), false)).toBe(
+      'rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).'
+    );
+    expect(formatOrphanReapNotice(reapOf([4242], 'terminated'), true)).toBe(
+      'rushx-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).'
+    );
+  });
+
+  it('says when the operations had to be killed', () => {
+    expect(formatOrphanReapNotice(reapOf([501, 502], 'killed'), false)).toBe(
+      'rush-client: Killed the operations that the exited daemon (PID 4242) left running ' +
+        '(process groups 501 and 502); they did not exit after SIGTERM.'
+    );
+  });
+
+  it('lists up to four process groups, then counts the others', () => {
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503], 'terminated'), false)).toContain(
+      '(process groups 501, 502 and 503).'
+    );
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503, 504], 'terminated'), false)).toContain(
+      '(process groups 501, 502, 503 and 504).'
+    );
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503, 504, 505], 'terminated'), false)).toContain(
+      '(process groups 501, 502, 503, 504 and 1 more).'
+    );
+    expect(formatOrphanReapNotice(reapOf([501, 502, 503, 504, 505, 506], 'terminated'), false)).toContain(
+      '(process groups 501, 502, 503, 504 and 2 more).'
+    );
+  });
+});
+
+describe(createOrphanReapNoticeHandler.name, () => {
+  const line: string =
+    'rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).';
+
+  it('writes the line to stderr without an agent renderer', () => {
+    const writes: string[] = [];
+    const handler: (reap: IDaemonOrphanReap) => void = createOrphanReapNoticeHandler({
+      rushx: false,
+      agentRenderer: undefined,
+      writeStderr: (text: string) => writes.push(text)
+    });
+    handler(reapOf([4242], 'terminated'));
+    expect(writes).toEqual([`${line}\n`]);
+  });
+
+  it('gives the line to the agent renderer, and writes nothing to stderr', () => {
+    const notes: string[] = [];
+    const writes: string[] = [];
+    const handler: (reap: IDaemonOrphanReap) => void = createOrphanReapNoticeHandler({
+      rushx: false,
+      agentRenderer: { note: (text: string) => notes.push(text) },
+      writeStderr: (text: string) => writes.push(text)
+    });
+    handler(reapOf([4242], 'terminated'));
+    expect(notes).toEqual([line]);
+    expect(writes).toEqual([]);
+  });
+});
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index 528c002f41..fd65827ac7 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -56,6 +56,26 @@ function isOperationRunning(pid: number): boolean {
   }
 }
 
+/**
+ * Expects one line of `client` on `stream`, and no Node.js process warning, for the stand-in daemon's
+ * operation.
+ */
+function expectOneReclaimLine(
+  result: IResult,
+  daemonPid: number,
+  stream: 'stdout' | 'stderr',
+  client: 'rush-client' | 'rushx-client' = 'rush-client'
+): void {
+  // The stand-in daemon's operation shares its process group, as a phased operation does.
+  const reclaimLine: string =
+    `${client}: Stopped the operations that the exited daemon (PID ${daemonPid}) left running ` +
+    `(process group ${daemonPid}).`;
+  const output: string = `${result.stdout}\n${result.stderr}`;
+  expect(output.split('\n').filter((line) => line.includes('left running'))).toEqual([reclaimLine]);
+  expect(result[stream]).toContain(reclaimLine);
+  expect(output).not.toMatch(/RUSH_DAEMON_ORPHANS_REAPED|--trace-warnings|\(node:\d+\)/);
+}
+
 function escapeRegExp(text: string): string {
   return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -427,7 +447,7 @@ describe('native build through the standalone client', () => {
           expect(isOperationRunning(operationPid)).toBe(true);
           const native: IResult = await invokeAsync(['--no-daemon', 'build']);
           expect(native.code).toBe(0);
-          expect(native.stderr).toContain(`Reclaimed dead daemon ${daemonPid}:`);
+          expectOneReclaimLine(native, daemonPid, 'stderr');
           expect(isOperationRunning(operationPid)).toBe(false);
           expect(fs.existsSync(paths.lockfilePath)).toBe(false);
           expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
@@ -438,4 +458,64 @@ describe('native build through the standalone client', () => {
       }),
     30000
   );
+
+  (process.platform === 'linux' ? it : it.skip).each([
+    { output: 'legacy', stream: 'stderr' },
+    { output: 'agent', stream: 'stdout' }
+  ] as const)(
+    'stops the operations that a crashed daemon left running before it starts the next daemon ($output output)',
+    ({ output, stream }) =>
+      runWithFixtureAsync(async ({ folder, paths, environment, invokeAsync }) => {
+        environment.RUSHD_OUTPUT = output;
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const served: IResult = await invokeAsync(['build']);
+          expect(served.code).toBe(0);
+          expect(served.stderr).not.toMatch(/using in-process/i);
+          expectOneReclaimLine(served, daemonPid, stream);
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(fs.readFileSync(path.join(folder, 'runs.txt'), 'utf8')).toBe('a:one\nb:one\n');
+          expect(JSON.parse((await invokeAsync(['daemon', 'status'])).stdout).pid).not.toBe(daemonPid);
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'says rushx-client when rushx stops the operations that a crashed daemon left running',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const script: IResult = await invokeAsync(['build'], true);
+          expect(script.code).toBe(0);
+          expect(script.stderr).not.toMatch(/using in-process/i);
+          expect(script.stdout).toContain('rushx-only');
+          expectOneReclaimLine(script, daemonPid, 'stderr', 'rushx-client');
+          expect(isOperationRunning(operationPid)).toBe(false);
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a crashed daemon left running when "daemon start" starts the next daemon',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const started: IResult = await invokeAsync(['daemon', 'start']);
+          expect(started.code).toBe(0);
+          expectOneReclaimLine(started, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
new file mode 100644
index 0000000000..ebdf2c0ab9
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the client stops the operations that an exited daemon left running, it now says so in one `rush-client:` line instead of a Node.js `RUSH_DAEMON_ORPHANS_REAPED` process warning.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
new file mode 100644
index 0000000000..ca0e4096f1
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add an optional `onOrphansReaped` callback to the connection options and to `reclaimCrashedDaemonAsync()`. It receives the operations that a reclaim stopped, before a daemon start or after a connection to a daemon that exited was lost, instead of the `RUSH_DAEMON_ORPHANS_REAPED` process warning.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
new file mode 100644
index 0000000000..cf78b65d48
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t177-reclaim-notice_2026-09-29-02-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add an optional `onOrphansReaped` callback to `reclaimStaleDaemonAsync()`. It receives the process groups that the reclaim stopped, so that a caller can report them itself instead of the `RUSH_DAEMON_ORPHANS_REAPED` process warning.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index d3f8ac8fd9..6644ca1175 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -9,9 +9,11 @@ import { IDaemonClientCaps } from '@rushstack/rush-daemon-protocol';
 import { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
 import { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonLockfile } from '@rushstack/rush-daemon-transport';
+import { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
 import { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
 import { IDaemonProtocolVersion } from '@rushstack/rush-daemon-protocol';
+import { IDaemonReclaimOptions } from '@rushstack/rush-daemon-transport';
 import { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonRequestRejectedMessage } from '@rushstack/rush-daemon-protocol';
 import { IDaemonShutdownAckMessage } from '@rushstack/rush-daemon-protocol';
@@ -109,6 +111,7 @@ export interface IConnectOrAwaitDaemonStartupOptions extends IConnectOrStartDaem
 // @beta
 export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectOptions, 'socketPath'> {
     readonly abortSignal?: AbortSignal;
+    readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
     // (undocumented)
     readonly paths: IDaemonPaths;
     readonly previousDaemon?: Pick<IDaemonLockfile, 'pid' | 'startedAt'>;
@@ -205,7 +208,7 @@ export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOp
 export function inspectDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservationInfo | undefined;
 
 // @beta
-export function reclaimCrashedDaemonAsync(paths: IDaemonPaths): Promise<void>;
+export function reclaimCrashedDaemonAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void>;
 
 // @beta
 export function requestDaemonShutdownAsync(client: DaemonClient, paths: IDaemonPaths, timeoutMs?: number): Promise<Pick<IDaemonLockfile, 'pid' | 'startedAt'>>;
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index 2e1c6369eb..63d8c79741 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -92,6 +92,13 @@ export interface IDaemonLockfile {
     readonly startedAt: string;
 }
 
+// @beta
+export interface IDaemonOrphanReap {
+    readonly daemonPid: number;
+    readonly outcome: 'terminated' | 'killed';
+    readonly processGroupIds: readonly number[];
+}
+
 // @beta
 export interface IDaemonPathEnvironment {
     readonly env: Readonly<Record<string, string | undefined>>;
@@ -107,6 +114,11 @@ export interface IDaemonPaths {
     readonly socketPath: string;
 }
 
+// @beta
+export interface IDaemonReclaimOptions {
+    readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
+}
+
 // @beta
 export function isDaemonProcessAlive(pid: number): boolean;
 
@@ -121,7 +133,7 @@ export interface IWorkspaceKeyInput {
 export function readDaemonLockfile(lockfilePath: string): IDaemonLockfile | undefined;
 
 // @beta
-export function reclaimStaleDaemonAsync(paths: IDaemonPaths): Promise<void>;
+export function reclaimStaleDaemonAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void>;
 
 // @beta
 export function removeDaemonArtifacts(lockfilePath: string, socketPath: string): void;
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 0ad4e00c3a..dc9dc61637 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -72,10 +72,13 @@ Before it returns that error, it reclaims the exited daemon as the next daemon s
 running the command again, with or without the daemon, does not race the operations the daemon
 left running. While the ownership record names that process, it takes the start mutex and, unless
 a startup is reserved, calls `reclaimStaleDaemonAsync()`, which terminates the orphaned operation
-process groups (each reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning) and removes the
-ownership record and socket. It waits up to 5 seconds while another client holds the start mutex,
-or while the exited process is not reaped yet. If the reclaim fails or times out, the message is
-the same, and the next daemon start reclaims the daemon instead.
+process groups and removes the ownership record and socket. Each set of groups that it stops is
+passed to the connection's optional `onOrphansReaped(reap)` (the daemon's PID, the process groups,
+and whether they were `terminated` or `killed`), so that the caller can say so in its own words;
+without it, each is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. The reclaim before
+a daemon start reports the same way. It waits up to 5 seconds while another client holds the start
+mutex, or while the exited process is not reaped yet. If the reclaim fails or times out, the
+message is the same, and the next daemon start reclaims the daemon instead.
 If the process still runs, the message says that only the connection closed. After the abort
 signal fires, the error is unchanged, so the caller reports the cancellation.
 
@@ -192,7 +195,7 @@ When the ownership record names a PID that no longer exists (on Linux, also an e
 not reaped yet), it reclaims that daemon as described above for a lost connection: under the start
 mutex, only when no startup is reserved, and waiting up to 5 seconds. It does nothing when there is no
 record, when a process with the recorded PID runs, or when the runtime folder is not private, and it
-never throws.
+never throws. Its optional `options.onOrphansReaped` receives what it stopped, as above.
 
 `getDaemonLogFilePath(paths)` is the shared stable path used by both the launcher
 and the CLI's local `daemon logs` reader. Child stdout/stderr are appended across
diff --git a/libraries/rush-client-core/src/DaemonDisconnect.ts b/libraries/rush-client-core/src/DaemonDisconnect.ts
index fb40328d77..d28cc73a6c 100644
--- a/libraries/rush-client-core/src/DaemonDisconnect.ts
+++ b/libraries/rush-client-core/src/DaemonDisconnect.ts
@@ -10,7 +10,8 @@ import {
   DaemonTransportErrorCode,
   readDaemonLockfile,
   type IDaemonLockfile,
-  type IDaemonPaths
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
 } from '@rushstack/rush-daemon-transport';
 
 import type { DaemonClient } from './DaemonClient';
@@ -74,7 +75,8 @@ export async function observeServingDaemonAsync(
 export async function explainLostConnectionAsync(
   error: unknown,
   daemon: IServingDaemon | undefined,
-  request: IDaemonRequestEnvelope
+  request: IDaemonRequestEnvelope,
+  reclaimOptions?: IDaemonReclaimOptions
 ): Promise<unknown> {
   if (!daemon || !isConnectionLoss(error)) return error;
   const exited: boolean | undefined = await waitForExitAsync(daemon);
@@ -87,7 +89,7 @@ export async function explainLostConnectionAsync(
     );
   }
   const loggedError: string | undefined = readLoggedFatalError(daemon);
-  await reclaimExitedDaemonAsync(daemon);
+  await reclaimExitedDaemonAsync(daemon, reclaimOptions);
   const client: string = request.invocationKind === 'rushx' ? 'rushx-client' : 'rush-client';
   const message: string =
     `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${daemon.pid}) exited while it ran the command; ` +
diff --git a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
index 807cae4029..4d2f35cc42 100644
--- a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
+++ b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
@@ -8,7 +8,8 @@ import {
   readDaemonLockfile,
   reclaimStaleDaemonAsync,
   type IDaemonLockfile,
-  type IDaemonPaths
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
 } from '@rushstack/rush-daemon-transport';
 
 import { isProcessAlive } from './DaemonOwnership';
@@ -38,15 +39,18 @@ export interface IExitedDaemon {
  *
  * @remarks
  * Call it before Rush runs in-process. Like the next daemon start, it terminates the daemon's orphaned
- * operation process groups (each reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning) and removes the
- * ownership record and socket. It does so only under the start mutex and when no startup is reserved, and it
- * waits up to 5 seconds while another client holds the mutex or while the exited process is not reaped yet.
- * It does nothing when there is no record, when a process with the recorded PID runs, or when the runtime
- * folder is not private, and it never throws.
+ * operation process groups and removes the ownership record and socket. Each set of groups that it stops is
+ * reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. It does so
+ * only under the start mutex and when no startup is reserved, and it waits up to 5 seconds while another client
+ * holds the mutex or while the exited process is not reaped yet. It does nothing when there is no record, when
+ * a process with the recorded PID runs, or when the runtime folder is not private, and it never throws.
  *
  * @beta
  */
-export async function reclaimCrashedDaemonAsync(paths: IDaemonPaths): Promise<void> {
+export async function reclaimCrashedDaemonAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
   let owner: IDaemonLockfile | undefined;
   try {
     // Every daemon command checks the folder before it trusts the records in it.
@@ -58,16 +62,20 @@ export async function reclaimCrashedDaemonAsync(paths: IDaemonPaths): Promise<vo
     // For example EPERM: the PID exists but cannot be inspected.
     return;
   }
-  await reclaimExitedDaemonAsync({ pid: owner.pid, startedAt: owner.startedAt, paths });
+  await reclaimExitedDaemonAsync({ pid: owner.pid, startedAt: owner.startedAt, paths }, options);
 }
 
 /**
  * Stops the operations that an exited daemon left running, and removes its ownership record and socket, as
- * the next daemon start would (`RUSH_DAEMON_ORPHANS_REAPED` warnings say what was stopped). Best effort: it
- * acts only while the ownership record names that daemon, under the start mutex, and when no startup is
- * reserved. While another client holds the mutex, for example to reclaim the same daemon, it waits.
+ * the next daemon start would (`options.onOrphansReaped` or `RUSH_DAEMON_ORPHANS_REAPED` warnings say what was
+ * stopped). Best effort: it acts only while the ownership record names that daemon, under the start mutex, and
+ * when no startup is reserved. While another client holds the mutex, for example to reclaim the same daemon,
+ * it waits.
  */
-export async function reclaimExitedDaemonAsync(daemon: IExitedDaemon): Promise<void> {
+export async function reclaimExitedDaemonAsync(
+  daemon: IExitedDaemon,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
   const deadline: number = Date.now() + RECLAIM_WAIT_MS;
   try {
     while (isRecordedOwner(daemon)) {
@@ -77,7 +85,7 @@ export async function reclaimExitedDaemonAsync(daemon: IExitedDaemon): Promise<v
         if (lock) {
           try {
             if (isRecordedOwner(daemon) && !readDaemonStartupReservation(daemon.paths)) {
-              await reclaimStaleDaemonAsync(daemon.paths);
+              await reclaimStaleDaemonAsync(daemon.paths, options);
             }
           } finally {
             await lock.releaseAsync();
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 22501c9883..9fb4e29369 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -14,6 +14,7 @@ import {
   reclaimStaleDaemonAsync,
   readDaemonLockfile,
   type IDaemonLockfile,
+  type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
@@ -94,6 +95,12 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
   readonly startupTimeoutMs?: number;
   /** Cancels waiting/startup, without stopping startup already handed off to the detached helper. */
   readonly abortSignal?: AbortSignal;
+  /**
+   * Receives the operations that a reclaim stopped because the daemon that left them running had exited: before
+   * a daemon start, or after a connection to a daemon that exited was lost. When omitted, each is reported as a
+   * `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+   */
+  readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
 }
 
 /**
@@ -195,7 +202,7 @@ async function startDaemonAsync(
     if (handoff) return handoff;
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before reclaim');
     await reclaimAbandonedOwnershipAsync(options.paths);
-    await reclaimStaleDaemonAsync(options.paths);
+    await reclaimStaleDaemonAsync(options.paths, { onOrphansReaped: options.onOrphansReaped });
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before spawn');
     options.abortSignal?.throwIfAborted();
     const helper: IStartupHelper = await spawnDetachedAsync(options, deadline, abandonedHelper);
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index 9501da8207..86fb9b2a60 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -193,7 +193,9 @@ async function executeOnDaemonAsync(
   } catch (error) {
     // After cancellation the caller reports the cancellation, whatever the connection did afterwards.
     if (execution.abortSignal?.aborted) throw error;
-    throw await explainLostConnectionAsync(error, daemon, execution.request);
+    throw await explainLostConnectionAsync(error, daemon, execution.request, {
+      onOrphansReaped: connection.onOrphansReaped
+    });
   }
 }
 
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
index 69bfd1f157..f48ab04461 100644
--- a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -11,6 +11,7 @@ import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import {
   DaemonTransportError,
   DaemonTransportErrorCode,
+  type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
@@ -180,6 +181,28 @@ describe(explainLostConnectionAsync.name, () => {
     }
   );
 
+  linuxIt('reports what the reclaim stopped to onOrphansReaped instead of a process warning', async () => {
+    const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+    try {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      const reaps: IDaemonOrphanReap[] = [];
+      const explained: unknown = await explainLostConnectionAsync(
+        getLostConnection(),
+        getServingDaemon(daemonPid),
+        request,
+        { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) }
+      );
+      expect(explained).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+      expect(isRunning(operationPid)).toBe(false);
+      // The stand-in daemon's operation shares its process group, as a phased operation does.
+      expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+      expect(warning).not.toHaveBeenCalled();
+    } finally {
+      warning.mockRestore();
+    }
+  });
+
   linuxIt('reclaims an exited daemon that is not reaped yet once it is reaped', async () => {
     await withUnreapedChildAsync(async (child, parentPid) => {
       const deadline: number = Date.now() + 5000;
diff --git a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
index 424fd8c612..1fe263c849 100644
--- a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
+++ b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
@@ -6,7 +6,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { reclaimCrashedDaemonAsync } from '../ExitedDaemonReclaim';
 import { isProcessDefunct } from '../ProcessStartTime';
@@ -69,6 +69,19 @@ describe(reclaimCrashedDaemonAsync.name, () => {
     );
   });
 
+  linuxIt('reports what it stopped to onOrphansReaped instead of a process warning', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    const reaps: IDaemonOrphanReap[] = [];
+    await reclaimCrashedDaemonAsync(paths, {
+      onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+    });
+    expect(isRunning(operationPid)).toBe(false);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    expect(warning).not.toHaveBeenCalled();
+  });
+
   linuxIt(
     'leaves a running daemon alone, without waiting while another client holds the start mutex',
     async () => {
diff --git a/libraries/rush-client-core/src/test/OrphanedOperation.ts b/libraries/rush-client-core/src/test/OrphanedOperation.ts
index 561ec1fa7a..4d56cfc5ce 100644
--- a/libraries/rush-client-core/src/test/OrphanedOperation.ts
+++ b/libraries/rush-client-core/src/test/OrphanedOperation.ts
@@ -15,8 +15,8 @@ import {
 
 import { isProcessDefunct } from '../ProcessStartTime';
 
-// An operation process that a stand-in daemon starts; it exits by itself after a minute.
-const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+/** An operation process that a stand-in daemon starts; it exits by itself after a minute. */
+export const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
 // A stand-in daemon: like a phased operation, which is spawned without `detached`, its operation process
 // inherits the daemon's process group. It prints that process's PID.
 const FAKE_DAEMON_SCRIPT: string =
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 398de70200..aaf656174d 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -16,6 +16,7 @@ import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import {
   readDaemonLockfile,
   type IDaemonLockfile,
+  type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
@@ -49,6 +50,12 @@ import {
   tryTakeOverAbandonedStartupReservationAsync
 } from '../DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  isRunning,
+  recordDaemonOwner,
+  startOrphanedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 /** How long after a launch a client may take over its reservation once the helper exited. */
@@ -1359,6 +1366,31 @@ describe('detached daemon startup', () => {
       expect(fs.readFileSync(getDaemonLogFilePath(paths), 'utf8')).toContain(earlierCrash);
     });
 
+    (process.platform === 'linux' ? it : it.skip)(
+      'reports the operations that rushd left running to onOrphansReaped',
+      async () => {
+        const reaps: IDaemonOrphanReap[] = [];
+        const connection: IConnectOrStartDaemonOptions = {
+          ...withMode('orphan-and-kill-on-request'),
+          onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+        };
+        const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+        const { pid } = await client.status;
+        const operationsPath: string = path.join(folder, 'operations');
+        try {
+          await expect(
+            executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+          ).rejects.toMatchObject({ code: 'disconnected', message: exitedMessage(pid!, false) });
+          expect(isRunning(Number(fs.readFileSync(operationsPath, 'utf8')))).toBe(false);
+          expect(reaps).toEqual([{ daemonPid: pid, processGroupIds: [pid], outcome: 'terminated' }]);
+        } finally {
+          if (fs.existsSync(operationsPath)) {
+            stopOperationIfRunning(Number(fs.readFileSync(operationsPath, 'utf8')));
+          }
+        }
+      }
+    );
+
     it('says the connection closed while rushd still runs', async () => {
       const connection: IConnectOrStartDaemonOptions = withMode('close-on-request');
       const client: DaemonClient = await connectOrStartDaemonAsync(connection);
@@ -1750,6 +1782,34 @@ describe('detached daemon startup', () => {
     }
   );
 
+  (process.platform === 'linux' ? it : it.skip)(
+    'reports the operations that a crashed daemon left running to onOrphansReaped before a start',
+    async () => {
+      const operationPids: number[] = [];
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      try {
+        const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+        await leaveStaleSocketAsync();
+        recordDaemonOwner(paths, daemonPid);
+        const reaps: IDaemonOrphanReap[] = [];
+        const client: DaemonClient = await connectOrStartDaemonAsync({
+          ...options,
+          onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+        });
+        await client.closeAsync();
+        expect(isRunning(operationPid)).toBe(false);
+        expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+        expect(warning).not.toHaveBeenCalled();
+        expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
+      } finally {
+        warning.mockRestore();
+        operationPids.forEach(stopOperationIfRunning);
+      }
+    }
+  );
+
   (process.platform === 'linux' ? it : it.skip)(
     'reclaims a record whose live PID started after the record was written',
     async () => {
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index d72a43c758..7d12ee38cd 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
@@ -18,6 +19,7 @@ import {
 
 import { connectOrStartDaemonAsync } from '../../connectOrStartDaemon';
 import { getDaemonStartupFilePath } from '../../DaemonStartup';
+import { OPERATION_SCRIPT } from '../OrphanedOperation';
 
 async function mainAsync(): Promise<void> {
   const paths: IDaemonPaths = JSON.parse(process.argv[2]);
@@ -78,7 +80,12 @@ async function mainAsync(): Promise<void> {
           });
         } else if (message.kind === 'requestStart') {
           fs.appendFileSync(path.join(folder, 'requests'), `${daemonVersion}\n`);
-          if (mode === 'crash-on-request' || mode === 'kill-on-request') {
+          if (mode === 'orphan-and-kill-on-request') startOperation();
+          if (
+            mode === 'crash-on-request' ||
+            mode === 'kill-on-request' ||
+            mode === 'orphan-and-kill-on-request'
+          ) {
             exitAbruptly();
             return;
           }
@@ -192,10 +199,21 @@ async function mainAsync(): Promise<void> {
     return closing;
   }
 
+  /**
+   * Like a phased operation, which is spawned without `detached`, starts an operation process in this daemon's
+   * process group, and records its PID in the "operations" file.
+   */
+  function startOperation(): void {
+    const operation = spawn(process.execPath, ['-e', OPERATION_SCRIPT], { stdio: 'ignore' });
+    fs.writeFileSync(path.join(folder, 'operations'), String(operation.pid));
+  }
+
   /** Exits like a crashed daemon, without cleanup. The test expects this exit, so it also counts as stopped. */
   function exitAbruptly(): void {
     fs.writeFileSync(path.join(folder, `stopped-${process.pid}`), '');
-    if (mode === 'kill-on-request') process.kill(process.pid, 'SIGKILL');
+    if (mode === 'kill-on-request' || mode === 'orphan-and-kill-on-request') {
+      process.kill(process.pid, 'SIGKILL');
+    }
     setImmediate(() => {
       throw new Error('fixture daemon crash\nwhile running the request');
     });
diff --git a/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts b/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
index df74a2495e..6f7b216798 100644
--- a/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
+++ b/libraries/rush-daemon-transport/src/DaemonGroupTermination.ts
@@ -2,11 +2,12 @@
 // See LICENSE in the project root for license information.
 
 import type { IReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
 
 const POLL_INTERVAL_MS: number = 20;
 
 /** Outcome of reaping a dead daemon's orphaned process groups. */
-export type DaemonOrphanReapOutcome = 'none' | 'terminated' | 'killed';
+export type DaemonOrphanReapOutcome = 'none' | IDaemonOrphanReap['outcome'];
 
 function listExistingGroups(context: IReapContext, groupIds: readonly number[]): number[] {
   return groupIds.filter((groupId: number) => context.ops.groupExists(groupId));
@@ -43,7 +44,7 @@ function signalExistingGroups(
 export async function terminateProcessGroupsAsync(
   context: IReapContext,
   groupIds: readonly number[]
-): Promise<DaemonOrphanReapOutcome> {
+): Promise<IDaemonOrphanReap['outcome']> {
   signalExistingGroups(context, groupIds, 'SIGTERM');
   if (await waitForGroupsExitAsync(context, groupIds)) return 'terminated';
   signalExistingGroups(context, groupIds, 'SIGKILL');
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index 98fbb7c589..108e87b62f 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -11,8 +11,9 @@ import {
 import type { IOperationGroupRecord } from './DaemonOperationGroups';
 import { isOwnedEntry } from './DaemonOwnedEntry';
 import type { IProcessStat } from './DaemonProcessStat';
-import { createReapContext, isSignalableGroup } from './DaemonReapOptions';
+import { createReapContext, isSignalableGroup, reportOrphansReaped } from './DaemonReapOptions';
 import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
 
 const NO_MEMBERS: number = 0;
 const LIST_SEPARATOR: string = ', ';
@@ -41,8 +42,10 @@ async function terminateAndLogAsync(
   context: IReapContext,
   groupIds: number[]
 ): Promise<DaemonOrphanReapOutcome> {
-  const outcome: DaemonOrphanReapOutcome = await terminateProcessGroupsAsync(context, groupIds);
-  context.ops.log(
+  const outcome: IDaemonOrphanReap['outcome'] = await terminateProcessGroupsAsync(context, groupIds);
+  reportOrphansReaped(
+    context,
+    { daemonPid: context.deadPid, processGroupIds: groupIds, outcome },
     `Reclaimed dead daemon ${context.deadPid}: its orphaned operation process groups ` +
       `${groupIds.join(LIST_SEPARATOR)} were ${outcome}.`
   );
diff --git a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
index e1433d0f4c..474c307a59 100644
--- a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
@@ -6,8 +6,14 @@ import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
 import type { IDaemonLockfile } from './DaemonLockfile';
 import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
 import { isOwnedEntry } from './DaemonOwnedEntry';
-import { createReapContext, isSignalableGroup, resolveCallerUid } from './DaemonReapOptions';
+import {
+  createReapContext,
+  isSignalableGroup,
+  reportOrphansReaped,
+  resolveCallerUid
+} from './DaemonReapOptions';
 import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
 
 function isOrphanedDaemonGroup(context: IReapContext): boolean {
   return isSignalableGroup(context.deadPid, context) && context.ops.groupExists(context.deadPid);
@@ -32,8 +38,12 @@ export async function reapDeadDaemonProcessGroupAsync(
 ): Promise<DaemonOrphanReapOutcome> {
   const context: IReapContext = createReapContext(deadPid, options);
   if (!isOrphanedDaemonGroup(context)) return 'none';
-  const outcome: DaemonOrphanReapOutcome = await terminateProcessGroupsAsync(context, [deadPid]);
-  context.ops.log(`Reclaimed dead daemon ${deadPid}: its orphaned operation process group was ${outcome}.`);
+  const outcome: IDaemonOrphanReap['outcome'] = await terminateProcessGroupsAsync(context, [deadPid]);
+  reportOrphansReaped(
+    context,
+    { daemonPid: deadPid, processGroupIds: [deadPid], outcome },
+    `Reclaimed dead daemon ${deadPid}: its orphaned operation process group was ${outcome}.`
+  );
   return outcome;
 }
 
diff --git a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
index 68e6468be3..f4d137fc7d 100644
--- a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
@@ -3,6 +3,7 @@
 
 import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
 import { POSIX_PROCESS_GROUP_OPS } from './DaemonProcessGroup';
+import type { IDaemonOrphanReap, IDaemonReclaimOptions } from './DaemonReclaimOptions';
 
 const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 // 0 and 1 are never daemons, and kill(-0)/kill(-1) would signal our own group or every process.
@@ -10,7 +11,7 @@ const FIRST_USER_PID: number = 2;
 const DEFAULT_GRACE_MS: number = 2000;
 
 /** Options for reaping a dead daemon's orphans; every field defaults to the real process. */
-export interface IDaemonOrphanReaperOptions {
+export interface IDaemonOrphanReaperOptions extends IDaemonReclaimOptions {
   readonly ops?: IDaemonProcessGroupOps;
   readonly platform?: NodeJS.Platform;
   readonly selfPid?: number;
@@ -21,7 +22,7 @@ export interface IDaemonOrphanReaperOptions {
 }
 
 /** {@link IDaemonOrphanReaperOptions} with every default applied, for the dead daemon `deadPid`. */
-export interface IReapContext {
+export interface IReapContext extends IDaemonReclaimOptions {
   readonly ops: IDaemonProcessGroupOps;
   readonly platform: NodeJS.Platform;
   readonly selfPid: number;
@@ -46,10 +47,17 @@ export function createReapContext(deadPid: number, options: IDaemonOrphanReaperO
     ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
     deadPid,
     graceMs: options.graceMs ?? DEFAULT_GRACE_MS,
-    uid: resolveCallerUid(options)
+    uid: resolveCallerUid(options),
+    onOrphansReaped: options.onOrphansReaped
   };
 }
 
+/** Reports the process groups that a reap stopped to `onOrphansReaped`, or else logs `message`. */
+export function reportOrphansReaped(context: IReapContext, reap: IDaemonOrphanReap, message: string): void {
+  if (context.onOrphansReaped) context.onOrphansReaped(reap);
+  else context.ops.log(message);
+}
+
 function isNeitherSelfNorOwnGroup(groupId: number, context: IReapContext): boolean {
   // Fail closed: an unknown own group might be `groupId` (e.g. rush-client run by an operation).
   const ownGroupId: number | undefined = context.ops.ownGroupId();
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index b330f4c808..e779dacce6 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -10,6 +10,7 @@ import { reapOrphansOfDeadOwnerAsync } from './DaemonOrphanReaper';
 import type { IDaemonPaths } from './DaemonPaths';
 import { tryAcquireReclaimLock } from './DaemonReclaimLock';
 import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
 import { assertDaemonRuntimeDirIsPrivate } from './DaemonRuntimeDir';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 
@@ -17,15 +18,13 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * Reclaims the socket/pipe path when it is held by a dead daemon.
  *
  * @remarks
- * Two-factor stale detection — the lockfile PID must be dead *and* a connect
- * probe must fail — so a daemon that is alive but momentarily unresponsive is
- * never reclaimed underneath itself. Reclaims are serialized through the
- * lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may
- * unlink the socket path, so a concurrent starter cannot delete a socket that
- * another process just bound. Operation processes still running in the dead
- * daemon's process group, or in the operation process groups it recorded, are
- * terminated first (see `DaemonOrphanReaper`). Nothing is read, reaped or
- * removed unless the runtime directory is a private directory of this user.
+ * Two-factor stale detection — the lockfile PID must be dead *and* a connect probe must fail — so a daemon
+ * that is alive but momentarily unresponsive is never reclaimed underneath itself. Reclaims are serialized
+ * through the lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may unlink the socket
+ * path, so a concurrent starter cannot delete a socket that another process just bound. Operation processes
+ * still running in the dead daemon's process group, or in the operation process groups it recorded, are
+ * terminated first (see `DaemonOrphanReaper`) and reported to `options.onOrphansReaped`. Nothing is read,
+ * reaped or removed unless the runtime directory is a private directory of this user.
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
@@ -35,7 +34,10 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  *
  * @beta
  */
-export async function reclaimStaleDaemonAsync(paths: IDaemonPaths): Promise<void> {
+export async function reclaimStaleDaemonAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
   assertDaemonRuntimeDirIsPrivate(paths);
   // The mutex lives beside the lockfile (never the same file): the lockfile
   // records the *running* daemon's live PID, while the mutex only ever records
@@ -46,7 +48,7 @@ export async function reclaimStaleDaemonAsync(paths: IDaemonPaths): Promise<void
     throwAlreadyRunning(paths, 'another starter holds the reclaim lock');
   }
   try {
-    await reclaimUnderLockAsync(paths);
+    await reclaimUnderLockAsync(paths, options);
   } finally {
     try {
       fs.unlinkSync(reclaimLockPath(paths));
@@ -60,7 +62,7 @@ function reclaimLockPath(paths: IDaemonPaths): string {
   return `${paths.lockfilePath}.reclaim`;
 }
 
-async function reclaimUnderLockAsync(paths: IDaemonPaths): Promise<void> {
+async function reclaimUnderLockAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void> {
   const owner: ReturnType<typeof readDaemonLockfile> = readDaemonLockfile(paths.lockfilePath);
   if (isLockfilePidAlive(owner)) {
     throwAlreadyRunning(paths, 'its lockfile PID is alive');
@@ -70,7 +72,7 @@ async function reclaimUnderLockAsync(paths: IDaemonPaths): Promise<void> {
     throwAlreadyRunning(paths, 'it answers a connect probe');
   }
   // A daemon that died uncleanly leaves its operations running; stop them before a successor re-runs them.
-  await reapOrphansOfDeadOwnerAsync(paths.lockfilePath, owner);
+  await reapOrphansOfDeadOwnerAsync(paths.lockfilePath, owner, options);
   removeDaemonArtifacts(paths.lockfilePath, paths.socketPath);
 }
 
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts b/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
new file mode 100644
index 0000000000..c2a0d9d2f7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
@@ -0,0 +1,29 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Process groups that a reclaim stopped, because the daemon that left them running had exited.
+ *
+ * @beta
+ */
+export interface IDaemonOrphanReap {
+  /** The PID of the daemon that exited. */
+  readonly daemonPid: number;
+  /** The process groups that were stopped: the daemon's own group, or the operation groups it recorded. */
+  readonly processGroupIds: readonly number[];
+  /** `terminated` when every group exited after SIGTERM, and `killed` when some needed SIGKILL. */
+  readonly outcome: 'terminated' | 'killed';
+}
+
+/**
+ * Options for {@link reclaimStaleDaemonAsync}.
+ *
+ * @beta
+ */
+export interface IDaemonReclaimOptions {
+  /**
+   * Called once for each set of process groups that the reclaim stopped, so that the caller can say so in
+   * its own words. When it is omitted, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+   */
+  readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
+}
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index 430d684e4c..7c9e40a67c 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -34,6 +34,7 @@ export {
 } from './DaemonPaths';
 export { resolveDaemonPathsFromProcess } from './DaemonPathsFromProcess';
 export { reclaimStaleDaemonAsync } from './DaemonReclaim';
+export type { IDaemonOrphanReap, IDaemonReclaimOptions } from './DaemonReclaimOptions';
 export { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 export { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 export {
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
index a77feb6589..ae5534d2d3 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
@@ -3,6 +3,8 @@
 
 import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
 import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import {
   OPERATION_CHILD,
@@ -33,6 +35,19 @@ it('signals a recorded group whose leader is alive with the recorded start time'
   expect(result.logs).toEqual([expect.stringContaining(`groups ${OPERATION_GROUP} were terminated`)]);
 });
 
+it('reports a group that needed SIGKILL to onOrphansReaped as killed instead of logging it', async () => {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGKILL', processes: operationTree(OPERATION_GROUP) });
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('killed');
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [OPERATION_GROUP], outcome: 'killed' }]);
+  expect(fake.logs).toEqual([]);
+});
+
 it('signals a group whose leader has exited when every live member is in its session', async () => {
   const result: IFakeGroup & { outcome: string } = await reapAsync(operationTree(OPERATION_GROUP, false));
   expect(result.outcome).toBe('terminated');
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
index 1defa97d7c..dae3dc3b87 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonOrphanReaper.test.ts
@@ -3,6 +3,7 @@
 
 import { reapDeadDaemonProcessGroupAsync } from '../DaemonOrphanReaper';
 import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import { DEAD_PID, SELF_PID, createFakeGroup } from './OrphanReaperFixture';
 import type { IFakeGroup } from './OrphanReaperFixture';
@@ -23,6 +24,18 @@ it('escalates to SIGKILL when the group outlives the grace period', async () =>
   expect(fake.logs).toEqual([expect.stringContaining('killed')]);
 });
 
+it('reports the stopped group to onOrphansReaped instead of logging it', async () => {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGKILL' });
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, options)).resolves.toBe('killed');
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [DEAD_PID], outcome: 'killed' }]);
+  expect(fake.logs).toEqual([]);
+});
+
 it('fails the reclaim when the group is still present after SIGKILL', async () => {
   const fake: IFakeGroup = createFakeGroup({});
   await expect(reapDeadDaemonProcessGroupAsync(DEAD_PID, fake.options)).rejects.toThrow(/survived SIGKILL/);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
index 8051359a9e..dfc7c840d1 100644
--- a/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupReapOnReclaim.test.ts
@@ -5,6 +5,7 @@ import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOp
 import type { IOperationGroupRecord } from '../DaemonOperationGroups';
 import type { IDaemonPaths } from '../DaemonPaths';
 import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import {
   killFakeDaemonAsync,
@@ -57,3 +58,32 @@ posixIt(
   reapsOrphanedOperationGroupsAsync,
   REAP_TEST_TIMEOUT_MS
 );
+
+async function reportsReapedOperationGroupsAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  await killFakeDaemonAsync(fake);
+  expect(await waitUntilAsync(() => isGone(exitingLeader))).toBe(true);
+  writeDeadOwnerLockfile(paths, fake);
+  const reaps: IDaemonOrphanReap[] = [];
+  await reclaimStaleDaemonAsync(paths, { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) });
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+  const operations: IDaemonOrphanReap[] = reaps.filter((reap: IDaemonOrphanReap) =>
+    reap.processGroupIds.includes(waitingLeader)
+  );
+  expect(operations).toEqual([
+    { daemonPid: Number(fake.daemon.pid), processGroupIds: expect.any(Array), outcome: 'terminated' }
+  ]);
+  const [{ processGroupIds }] = operations;
+  expect(new Set(processGroupIds)).toEqual(new Set([waitingLeader, exitingLeader]));
+  expect(warning).not.toHaveBeenCalled();
+}
+
+posixIt(
+  'reports the reaped operation groups to onOrphansReaped instead of logging them',
+  reportsReapedOperationGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
index dfb3c7dc42..572fc7db8f 100644
--- a/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupTermination.test.ts
@@ -4,6 +4,7 @@
 import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
 import type { IProcessStat } from '../DaemonProcessStat';
 import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import {
   OPERATION_GROUP,
@@ -42,6 +43,21 @@ it('signals every proven group together and escalates the survivors to SIGKILL',
   expect(recordsRemain(lockfilePath)).toBe(false);
 });
 
+it('reports every group it stopped to onOrphansReaped instead of logging them', async () => {
+  const fake: IFakeGroup = createOperations({ exitsOn: 'SIGTERM' });
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  const lockfilePath: string = recordGroups(BOTH_GROUPS);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe(
+    'terminated'
+  );
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: BOTH_GROUPS, outcome: 'terminated' }]);
+  expect(fake.logs).toEqual([]);
+});
+
 it('fails the reclaim and keeps the records when a group survives SIGKILL', async () => {
   const fake: IFakeGroup = createOperations({});
   const lockfilePath: string = recordGroups(BOTH_GROUPS);
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
index 2e4a96a4cf..6237e34954 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
@@ -12,6 +12,7 @@ import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import { isDaemonProcessAlive, writeDaemonLockfile } from '../DaemonLockfile';
 import type { IDaemonPaths } from '../DaemonPaths';
 import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import { createTestDaemonPaths } from './TestDaemonFixture';
 
@@ -52,10 +53,8 @@ async function waitUntilDeadAsync(pid: number): Promise<boolean> {
   return false;
 }
 
-posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaiming', async () => {
-  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
-  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
-  expect(isDaemonProcessAlive(orphanPid)).toBe(true);
+/** Records `daemonPid` as the owner of new test paths. */
+function recordDeadOwner(daemonPid: number): IDaemonPaths {
   const paths: IDaemonPaths = createTestDaemonPaths();
   writeDaemonLockfile(paths.lockfilePath, {
     pid: daemonPid,
@@ -63,8 +62,27 @@ posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaim
     startedAt: new Date().toISOString(),
     socketPath: paths.socketPath
   });
-  await reclaimStaleDaemonAsync(paths);
+  return paths;
+}
+
+posixIt('reaps operation processes orphaned by a SIGKILLed daemon before reclaiming', async () => {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
+  expect(isDaemonProcessAlive(orphanPid)).toBe(true);
+  await reclaimStaleDaemonAsync(recordDeadOwner(daemonPid));
   expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
   expect(warning).toHaveBeenCalledWith(expect.stringContaining(`dead daemon ${daemonPid}`), expect.anything());
   warning.mockRestore();
 });
+
+posixIt('reports what it stopped to onOrphansReaped instead of a process warning', async () => {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const { daemonPid, orphanPid } = await createOrphanedGroupAsync();
+  const reaps: IDaemonOrphanReap[] = [];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): number => reaps.push(reap);
+  await reclaimStaleDaemonAsync(recordDeadOwner(daemonPid), { onOrphansReaped });
+  expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
+  expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+  expect(warning).not.toHaveBeenCalled();
+  warning.mockRestore();
+});

From cc14840011fa72408847976b19b96effef19a8ce Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:55 +0000
Subject: [PATCH 111/265] [rush-client-core] Name a daemon that exited without
 shutting down after a client reclaimed it

Swarm integration step 96; original commit 5f7356e706 (merge of swarm/o04-t192-int2 at ee5eab70f6).
Refs: task 192.
Scope: task 192-int2.

Brings 192-int2 (branch swarm/o04-t192-int2). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 2 of 21. Gate: ch01 GATE OK board 4527 (tree b4b55cdde0)

Commits folded into this step (1):
- dd647302bb Name a daemon that exited without shutting down after a client reclaimed it (task 192)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   8 +-
 apps/rush-cli-client/src/daemonCommands.ts    |  20 ++-
 .../src/test/launchClient.test.ts             |  60 +++++++-
 ...o04-t192-reclaim-log_2026-09-29-03-52.json |  11 ++
 ...o04-t192-reclaim-log_2026-09-29-03-52.json |  11 ++
 common/reviews/api/rush-client-core.api.md    |   3 +
 libraries/rush-client-core/README.md          |   7 +-
 .../rush-client-core/src/DaemonOwnership.ts   |  15 +-
 .../src/ExitedDaemonReclaim.ts                |   7 +-
 .../src/ReclaimedDaemonLog.ts                 | 123 ++++++++++++++++
 libraries/rush-client-core/src/index.ts       |   1 +
 .../src/test/DaemonDisconnect.test.ts         |  31 ++++
 .../src/test/ExitedDaemonReclaim.test.ts      |  23 +++
 .../src/test/ReclaimedDaemonLog.test.ts       | 137 ++++++++++++++++++
 14 files changed, 448 insertions(+), 9 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json
 create mode 100644 libraries/rush-client-core/src/ReclaimedDaemonLog.ts
 create mode 100644 libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index fa036922db..e9f29b7ec9 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -492,6 +492,11 @@ still says that it could not connect. When the endpoint
 refuses connections and its ownership record (`<key>.pid.json`) names a PID that no longer
 exists, the diagnostic adds that rushd exited without shutting down (an orderly shutdown
 removes the record) and that `daemon logs` may show why.
+A client that lost its connection to that daemon, or that ran Rush in-process, removes the record
+when it reclaims the daemon, and appends a line that names the daemon to the launcher log. Until a
+daemon becomes ready again or `daemon stop --force` resets the workspace, the `No daemon is running`
+diagnostic then adds `The last daemon, rushd (PID <pid>), exited without shutting down; "rush-client
+daemon logs" may show why.`
 A daemon whose installation was removed or replaced still answers, but it restarts on
 the next command: status then prints `state: "installationChanged"` with the pong's
 `installationChange` (`change` and `folder`), a hint on stderr, and exits with code 1.
@@ -556,7 +561,8 @@ left behind). It holds the start mutex, proves that no listener is bound, and
 refuses (exit 1) while the recorded owner PID still exists and cannot be shown to
 be a reused PID. It never kills a process. Automatic startup already reclaims
 the common leftovers on its own (see below); this is the documented escape hatch
-that every fail-closed startup message points to.
+that every fail-closed startup message points to. A reset also appends a line to the launcher log
+that clears the report of a daemon that a client reclaimed, so status no longer names it.
 
 `rush-client daemon restart` first verifies that the selected Rush version has a
 launcher and captures the original lock's PID/start timestamp, checking that it
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index 1265fc7a11..0062a3e5fd 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -9,6 +9,7 @@ import {
   DaemonStartupPendingError,
   connectOrStartDaemonAsync,
   connectToStartingDaemonAsync,
+  findReclaimedDaemonPid,
   inspectDaemonStartupReservation,
   requestDaemonShutdownAsync,
   resetDaemonArtifactsAsync,
@@ -233,7 +234,8 @@ async function connectExistingAsync(
 /**
  * Connects for `daemon status`. When nothing listens and nothing is left at the endpoint, which is the state
  * after `daemon stop`, the idle timeout or a signal, it fails with a diagnostic that says so instead of the
- * transport's refused connection.
+ * transport's refused connection. It also names a daemon that a client reclaimed after it exited without
+ * shutting down, until a daemon becomes ready again.
  */
 async function connectForStatusAsync(
   connectionOptions: IConnectOrStartDaemonOptions,
@@ -248,7 +250,10 @@ async function connectForStatusAsync(
       error.code === DaemonTransportErrorCode.connectionRefused &&
       isEndpointAbsent(paths)
     ) {
-      throw new DaemonTransportError(error.code, describeAbsentDaemon(options));
+      throw new DaemonTransportError(
+        error.code,
+        `${describeAbsentDaemon(options)}${describeReclaimedDaemon(paths)}`
+      );
     }
     throw explainStartupReservation(explainExitedDaemon(error, paths), paths);
   }
@@ -280,6 +285,17 @@ function describeAbsentDaemon(options: IDaemonCommandOptions): string {
     : `${absent}, and auto-start is off, so rush-client commands run Rush in-process until "rush-client daemon start" starts one.`;
 }
 
+/**
+ * A client that reclaims a daemon that exited without shutting down removes the ownership record that
+ * {@link explainExitedDaemon} reads, so the reclaim is logged, and status reads that instead.
+ */
+function describeReclaimedDaemon(paths: IDaemonPaths): string {
+  const pid: number | undefined = findReclaimedDaemonPid(paths);
+  return pid === undefined
+    ? ''
+    : ` The last daemon, rushd (PID ${pid}), exited without shutting down; "rush-client daemon logs" may show why.`;
+}
+
 /**
  * Explains a refused connection whose ownership record names a daemon that no longer runs. An orderly
  * shutdown removes the record, so that daemon exited without shutting down, for example after a crash.
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index ed17033bef..20b929be85 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -10,7 +10,12 @@ import * as http from 'node:http';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { Rush } from '@microsoft/rush-lib';
-import { DaemonClient, connectOrStartDaemonAsync, getDaemonLogFilePath } from '@rushstack/rush-client-core';
+import {
+  DaemonClient,
+  connectOrStartDaemonAsync,
+  getDaemonLogFilePath,
+  reclaimCrashedDaemonAsync
+} from '@rushstack/rush-client-core';
 import type { DaemonClientOutcome } from '@rushstack/rush-client-core';
 import { RushDaemonHost, WorkspaceSession } from '@rushstack/rush-daemon';
 import {
@@ -747,6 +752,59 @@ describe('standalone rushx fallback', () => {
     }
   });
 
+  it('status still names a daemon that exited without shutting down after a client reclaimed it', async () => {
+    const { paths } = getDaemonConnectionOptions(folder, Rush.version, {}, false);
+    fs.mkdirSync(path.dirname(paths.lockfilePath), { recursive: true, mode: 0o700 });
+    async function reclaimExitedDaemonAsync(): Promise<string> {
+      const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+      await once(exited, 'close');
+      const record: IDaemonLockfile = {
+        pid: exited.pid!,
+        protocolVersion: { major: 0, minor: 11 },
+        startedAt: new Date().toISOString(),
+        socketPath: paths.socketPath
+      };
+      fs.writeFileSync(paths.lockfilePath, JSON.stringify(record));
+      // As the client whose command the daemon ran does, or Rush in-process; this removes the record.
+      await reclaimCrashedDaemonAsync(paths);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+      return ` The last daemon, rushd (PID ${record.pid}), exited without shutting down; "rush-client daemon logs" may show why.`;
+    }
+    const exitedWithoutShutdown: string = await reclaimExitedDaemonAsync();
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+      NEXT_COMMAND_STARTS + exitedWithoutShutdown
+    );
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status']),
+      AUTO_START_OFF + exitedWithoutShutdown
+    );
+    expectNoDaemonRunning(
+      await invokeAsync(true, false, false, ['daemon', 'status']),
+      NOT_ENABLED + exitedWithoutShutdown
+    );
+    // A reset clears the report, as it removed the record before a client reclaimed the daemon.
+    const reset: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'stop', '--force']);
+    expect(reset).toMatchObject({ code: 0, stderr: '' });
+    expect(JSON.parse(reset.stdout)).toMatchObject({ state: 'notRunning', removedPaths: [] });
+    expectNoDaemonRunning(await invokeAsync(true, false, false, ['daemon', 'status']), NOT_ENABLED);
+    // So does a daemon that becomes ready, even when it is then stopped in order.
+    const exitedAgain: string = await reclaimExitedDaemonAsync();
+    expectNoDaemonRunning(
+      await invokeAsync(true, false, false, ['daemon', 'status']),
+      NOT_ENABLED + exitedAgain
+    );
+    const started: IInvocationResult = await invokeAsync(true, false, false, ['daemon', 'start']);
+    expect(started.code).toBe(0);
+    const { pid }: { pid: number } = JSON.parse(started.stdout);
+    expect((await invokeAsync(true, false, false, ['daemon', 'stop'])).code).toBe(0);
+    await waitForTestProcessExitAsync(pid);
+    expectNoDaemonRunning(
+      await invokeAsync(true, true, false, ['daemon', 'status'], { RUSH_DAEMON_AUTO_START: '1' }),
+      NEXT_COMMAND_STARTS
+    );
+  }, 30000);
+
   (process.platform === 'win32' ? it.skip : it)(
     'stop --force removes stale artifacts left by a killed daemon',
     async () => {
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json b/common/changes/@rushstack/rush-cli-client/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json
new file mode 100644
index 0000000000..068bc0603a
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "After a client reclaimed a daemon that exited without shutting down, `rush-client daemon status` now adds `The last daemon, rushd (PID <pid>), exited without shutting down; \"rush-client daemon logs\" may show why.` to its `No daemon is running` diagnostic, until a daemon becomes ready again or `rush-client daemon stop --force` resets the workspace. Before, the reclaim removed the ownership record that this report needs.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json b/common/changes/@rushstack/rush-client-core/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json
new file mode 100644
index 0000000000..70234de472
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-o04-t192-reclaim-log_2026-09-29-03-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A client that reclaims a daemon that exited without shutting down now appends a line that names the daemon's PID to the launcher log, and the new `findReclaimedDaemonPid(paths)` returns that PID until a daemon becomes ready again or `resetDaemonArtifactsAsync()` clears it, so that the report survives the removal of the ownership record.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 6644ca1175..8405a3bec0 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -89,6 +89,9 @@ export class DaemonStartupPendingError extends Error {
 // @beta
 export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, options: IExecuteWithDaemonRestartOptions): Promise<DaemonClientOutcome>;
 
+// @beta
+export function findReclaimedDaemonPid(paths: IDaemonPaths): number | undefined;
+
 // @beta
 export function formatDaemonRestartCause(reason: DaemonRestartReason, requester: DaemonRestartRequester): string | undefined;
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index dc9dc61637..b99acc3526 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -202,7 +202,12 @@ and the CLI's local `daemon logs` reader. Child stdout/stderr are appended acros
 restarts, including startup failures; the parent always closes its descriptor
 after spawn or failure. On POSIX the launcher enforces `0600` permissions on a
 regular, unshared, current-user-owned file and refuses symlink destinations.
-This is a text launcher log, not structured request observability.
+This is a text launcher log, not structured request observability. A client that reclaims a daemon
+that exited without shutting down, after a lost connection or in `reclaimCrashedDaemonAsync()`,
+appends a line that names the daemon's PID to it, under the same file checks. Once the reclaim has
+removed the ownership record, `findReclaimedDaemonPid(paths)` returns that PID from the log's last
+64 KiB, unless a daemon wrote its `rushd ready at` line after it or `resetDaemonArtifactsAsync()`
+cleared the report with a line of its own; `rush-client daemon status` uses it.
 
 `shutdownAsync()` requires a fresh connection with negotiated minor >= 6. It sends
 the existing `shutdown` control and resolves only after `shutdownAck` and EOF,
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index 108d46712c..78a59df096 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -11,6 +11,7 @@ import type { IDaemonLockfile, IDaemonPaths } from '@rushstack/rush-daemon-trans
 import { DaemonClientError } from './DaemonClientError';
 import { getDaemonStartupFilePath } from './DaemonStartup';
 import { isProcessStartedAfter } from './ProcessStartTime';
+import { clearReclaimedDaemonReport } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 const PROBE_TIMEOUT_MS: number = 1000;
@@ -124,7 +125,9 @@ export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promi
  * after verifying that no listener is bound and that the recorded owner, if any, is gone.
  * @remarks Never kills a process. Fails when another client holds the start mutex, a listener is bound,
  * or the recorded owner is alive; with `waitTimeoutMs`, those conditions are re-checked until the deadline
- * (for example, while a daemon that just acknowledged shutdown finishes its cleanup).
+ * (for example, while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears
+ * the report of a daemon that a client reclaimed after it exited without shutting down
+ * ({@link findReclaimedDaemonPid}).
  * @beta
  */
 export async function resetDaemonArtifactsAsync(
@@ -175,6 +178,7 @@ async function tryResetDaemonArtifactsAsync(
     for (const filePath of others) {
       if (tryUnlink(filePath)) removedPaths.push(filePath);
     }
+    clearReclaimedDaemonReport(paths);
     return { removedPaths };
   } finally {
     await lock.releaseAsync();
@@ -192,7 +196,9 @@ export function isEndpointUnboundAsync(socketPath: string): Promise<boolean> {
     socket.setTimeout(PROBE_TIMEOUT_MS);
     socket.once('connect', () => settle(false));
     socket.once('timeout', () => settle(false));
-    socket.once('error', (error) => settle(hasErrorCode(error, 'ECONNREFUSED') || hasErrorCode(error, 'ENOENT')));
+    socket.once('error', (error) =>
+      settle(hasErrorCode(error, 'ECONNREFUSED') || hasErrorCode(error, 'ENOENT'))
+    );
   });
 }
 
@@ -243,7 +249,10 @@ function removeIfUnchanged(filePath: string, expected: string): boolean {
     throw error;
   }
   if (current !== expected) {
-    throw new DaemonClientError('startupFailed', `${filePath} changed during reclaim; refusing to remove it.`);
+    throw new DaemonClientError(
+      'startupFailed',
+      `${filePath} changed during reclaim; refusing to remove it.`
+    );
   }
   return tryUnlink(filePath);
 }
diff --git a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
index 4d2f35cc42..dfa3315939 100644
--- a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
+++ b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
@@ -15,6 +15,7 @@ import {
 import { isProcessAlive } from './DaemonOwnership';
 import { readDaemonStartupReservation } from './DaemonStartup';
 import { isProcessDefunct } from './ProcessStartTime';
+import { logReclaimedDaemon } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 /**
@@ -45,6 +46,9 @@ export interface IExitedDaemon {
  * holds the mutex or while the exited process is not reaped yet. It does nothing when there is no record, when
  * a process with the recorded PID runs, or when the runtime folder is not private, and it never throws.
  *
+ * A reclaim appends a line that names the daemon to the launcher log, so that `rush-client daemon status` can
+ * still say that it exited without shutting down once its ownership record is gone.
+ *
  * @beta
  */
 export async function reclaimCrashedDaemonAsync(
@@ -70,7 +74,7 @@ export async function reclaimCrashedDaemonAsync(
  * the next daemon start would (`options.onOrphansReaped` or `RUSH_DAEMON_ORPHANS_REAPED` warnings say what was
  * stopped). Best effort: it acts only while the ownership record names that daemon, under the start mutex, and
  * when no startup is reserved. While another client holds the mutex, for example to reclaim the same daemon,
- * it waits.
+ * it waits. A reclaim is logged ({@link logReclaimedDaemon}).
  */
 export async function reclaimExitedDaemonAsync(
   daemon: IExitedDaemon,
@@ -86,6 +90,7 @@ export async function reclaimExitedDaemonAsync(
           try {
             if (isRecordedOwner(daemon) && !readDaemonStartupReservation(daemon.paths)) {
               await reclaimStaleDaemonAsync(daemon.paths, options);
+              logReclaimedDaemon(daemon.paths, daemon.pid);
             }
           } finally {
             await lock.releaseAsync();
diff --git a/libraries/rush-client-core/src/ReclaimedDaemonLog.ts b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
new file mode 100644
index 0000000000..52fc51749b
--- /dev/null
+++ b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
@@ -0,0 +1,123 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { getDaemonLogFilePath } from './DaemonLogFile';
+
+/** Only the end of the log matters: once a daemon became ready after the reclaim, nothing is reported. */
+const MAX_LOG_READ_BYTES: number = 64 * 1024;
+const RECLAIM_LINE: RegExp =
+  /^\S+ rush-client \(PID \d+\): rushd \(PID (\d+)\) exited without shutting down;/;
+const RESET_LINE: RegExp = /^\S+ rush-client \(PID \d+\): reset the daemon's files;/;
+/** Every daemon writes this line once it is ready, with or without a time and PID before and after it. */
+const READY_LINE: RegExp = /\brushd ready at /;
+
+/**
+ * Appends a line to the workspace's launcher log that says that the daemon with this PID exited without shutting
+ * down and that this client reclaimed it. The reclaim removed the ownership record that named the daemon, so this
+ * line is what `rush-client daemon status` reads afterwards ({@link findReclaimedDaemonPid}). Best effort: it
+ * writes only to a regular, unshared file of this user, as the launcher does, and it never throws.
+ */
+export function logReclaimedDaemon(paths: IDaemonPaths, pid: number): void {
+  appendClientLine(
+    paths,
+    `rushd (PID ${pid}) exited without shutting down; stopped any operations it left running and removed ` +
+      'its ownership record and socket.'
+  );
+}
+
+/**
+ * Clears the report of the daemon that a client last reclaimed, if one is reported ({@link findReclaimedDaemonPid}),
+ * with a line in the launcher log, for a reset of the workspace's daemon files. Best effort; it never throws.
+ */
+export function clearReclaimedDaemonReport(paths: IDaemonPaths): void {
+  const pid: number | undefined = findReclaimedDaemonPid(paths);
+  if (pid !== undefined) {
+    appendClientLine(
+      paths,
+      `reset the daemon's files; the report that rushd (PID ${pid}) exited without shutting down is cleared.`
+    );
+  }
+}
+
+/**
+ * Returns the PID of the daemon that a client last reclaimed because it exited without shutting down, as the
+ * workspace's launcher log records it, unless a daemon became ready after that or `resetDaemonArtifactsAsync()`
+ * (`rush-client daemon stop --force`) cleared the report.
+ *
+ * @remarks
+ * A client reclaims such a daemon after it lost the connection to it, or before Rush runs in-process; the reclaim
+ * removes the daemon's ownership record and socket, and appends a line that names the daemon to the launcher log.
+ * This reads at most the log's last 64 KiB. It returns undefined when the log cannot be read, and never throws.
+ *
+ * @beta
+ */
+export function findReclaimedDaemonPid(paths: IDaemonPaths): number | undefined {
+  const lines: string[] | undefined = readLogTailLines(getDaemonLogFilePath(paths));
+  if (!lines) return undefined;
+  for (let index: number = lines.length - 1; index >= 0; index--) {
+    if (READY_LINE.test(lines[index]) || RESET_LINE.test(lines[index])) return undefined;
+    const match: RegExpExecArray | null = RECLAIM_LINE.exec(lines[index]);
+    if (match) {
+      const pid: number = Number(match[1]);
+      return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined;
+    }
+  }
+  return undefined;
+}
+
+/** Appends one line in the form of the launcher's own lines, under the launcher's checks of the log file. */
+function appendClientLine(paths: IDaemonPaths, text: string): void {
+  let fd: number | undefined;
+  try {
+    fd = fs.openSync(
+      getDaemonLogFilePath(paths),
+      // These distinct native flags have non-overlapping values.
+      fs.constants.O_WRONLY +
+        fs.constants.O_APPEND +
+        fs.constants.O_CREAT +
+        (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK),
+      0o600
+    );
+    const stats: fs.Stats = fs.fstatSync(fd);
+    if (!stats.isFile() || stats.nlink !== 1) return;
+    if (process.platform !== 'win32') {
+      if (stats.uid !== process.getuid?.()) return;
+      fs.fchmodSync(fd, 0o600);
+    }
+    fs.writeSync(fd, `${new Date().toISOString()} rush-client (PID ${process.pid}): ${text}\n`);
+  } catch {
+    // Whatever the line reports is done; only the report of it is lost.
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function readLogTailLines(logFilePath: string): string[] | undefined {
+  let fd: number | undefined;
+  try {
+    fd = fs.openSync(
+      logFilePath,
+      // These distinct native flags have non-overlapping values.
+      fs.constants.O_RDONLY +
+        (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK)
+    );
+    const stats: fs.Stats = fs.fstatSync(fd);
+    if (!stats.isFile()) return undefined;
+    const start: number = Math.max(0, stats.size - MAX_LOG_READ_BYTES);
+    const buffer: Buffer = Buffer.alloc(stats.size - start);
+    const lines: string[] = buffer
+      .toString('utf8', 0, fs.readSync(fd, buffer, 0, buffer.length, start))
+      .split(/\r?\n/);
+    // A read that starts inside the log can start inside a line.
+    if (start > 0) lines.shift();
+    return lines;
+  } catch {
+    return undefined;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index 0e12fcd33f..94b6ac9bab 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -17,6 +17,7 @@ export {
 export { formatDaemonRestartCause, type DaemonRestartRequester } from './DaemonRestartCause';
 export { DaemonClientError, type DaemonClientErrorCode } from './DaemonClientError';
 export { getDaemonLogFilePath } from './DaemonLogFile';
+export { findReclaimedDaemonPid } from './ReclaimedDaemonLog';
 export {
   resetDaemonArtifactsAsync,
   type IDaemonArtifactResetOptions,
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
index f48ab04461..1b27c2dc42 100644
--- a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -18,8 +18,10 @@ import {
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
 import { explainLostConnectionAsync, findLoggedFatalError, type IServingDaemon } from '../DaemonDisconnect';
+import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { reserveDaemonStartup } from '../DaemonStartup';
 import { isProcessDefunct } from '../ProcessStartTime';
+import { findReclaimedDaemonPid } from '../ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import {
   isRunning,
@@ -282,6 +284,7 @@ describe(explainLostConnectionAsync.name, () => {
     expect(Date.now() - startedAt).toBeLessThan(1000);
     expect(isRunning(operationPid)).toBe(true);
     expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    expect(fs.existsSync(getDaemonLogFilePath(paths))).toBe(false);
   });
 
   linuxIt('leaves the files alone when the ownership record names another daemon', async () => {
@@ -312,5 +315,33 @@ describe(explainLostConnectionAsync.name, () => {
     ).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
     expect(isRunning(operationPid)).toBe(true);
     expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    expect(fs.existsSync(getDaemonLogFilePath(paths))).toBe(false);
+  });
+
+  linuxIt('logs the reclaim, so that the daemon can be named after its record is gone', async () => {
+    const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+    try {
+      const { daemonPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      expect(
+        await explainLostConnectionAsync(getLostConnection(), getServingDaemon(daemonPid), request)
+      ).toMatchObject({ code: 'disconnected', message: getExitMessage(daemonPid) });
+      expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+      expect(warning).toHaveBeenCalledWith(
+        expect.stringContaining(`Reclaimed dead daemon ${daemonPid}:`),
+        expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+      );
+      expect(fs.readFileSync(getDaemonLogFilePath(paths), 'utf8').split('\n')).toEqual([
+        expect.stringMatching(
+          new RegExp(
+            `^\\S+Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${daemonPid}\\) exited without`
+          )
+        ),
+        ''
+      ]);
+      expect(findReclaimedDaemonPid(paths)).toBe(daemonPid);
+    } finally {
+      warning.mockRestore();
+    }
   });
 });
diff --git a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
index 1fe263c849..59e577c417 100644
--- a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
+++ b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
@@ -8,8 +8,10 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
+import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { reclaimCrashedDaemonAsync } from '../ExitedDaemonReclaim';
 import { isProcessDefunct } from '../ProcessStartTime';
+import { findReclaimedDaemonPid } from '../ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import {
   isRunning,
@@ -141,9 +143,30 @@ describe(reclaimCrashedDaemonAsync.name, () => {
       expect(isRunning(operationPid)).toBe(true);
       expect(fs.existsSync(paths.lockfilePath)).toBe(true);
       expect(warning).not.toHaveBeenCalled();
+      expect(fs.existsSync(getDaemonLogFilePath(paths))).toBe(false);
     } finally {
       await lock?.releaseAsync();
       fs.unlinkSync(link);
     }
   });
+
+  linuxIt('logs the reclaim once, so that the daemon can be named after its record is gone', async () => {
+    const { daemonPid } = await startOrphanedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    await reclaimCrashedDaemonAsync(paths);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    const logFilePath: string = getDaemonLogFilePath(paths);
+    const logged: string = fs.readFileSync(logFilePath, 'utf8');
+    expect(logged).toMatch(
+      new RegExp(
+        `^\\S+Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${daemonPid}\\) exited without shutting down; ` +
+          'stopped any operations it left running and removed its ownership record and socket\\.\\n$'
+      )
+    );
+    expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
+    expect(findReclaimedDaemonPid(paths)).toBe(daemonPid);
+    // Without a record there is nothing to reclaim, or to log.
+    await reclaimCrashedDaemonAsync(paths);
+    expect(fs.readFileSync(logFilePath, 'utf8')).toBe(logged);
+  });
 });
diff --git a/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
new file mode 100644
index 0000000000..760ab32df2
--- /dev/null
+++ b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
@@ -0,0 +1,137 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
+import { findReclaimedDaemonPid, logReclaimedDaemon } from '../ReclaimedDaemonLog';
+
+const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+
+/** The line that a client appends after it reclaimed the daemon with this PID. */
+function getReclaimLine(pid: number): RegExp {
+  return new RegExp(
+    `^\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${pid}\\) ` +
+      'exited without shutting down; stopped any operations it left running and removed its ownership record and socket\\.$'
+  );
+}
+
+describe(findReclaimedDaemonPid.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let logFilePath: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reclaim-log-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    logFilePath = getDaemonLogFilePath(paths);
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  function readLogLines(): string[] {
+    return fs.readFileSync(logFilePath, 'utf8').split('\n');
+  }
+
+  it('returns the PID that the last reclaim logged', () => {
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    logReclaimedDaemon(paths, 101);
+    expect(readLogLines()).toEqual([expect.stringMatching(getReclaimLine(101)), '']);
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    // For example, the output of a daemon that failed to start.
+    fs.appendFileSync(logFilePath, 'Error: listen EADDRINUSE\n');
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    logReclaimedDaemon(paths, 102);
+    expect(readLogLines()).toEqual([
+      expect.stringMatching(getReclaimLine(101)),
+      'Error: listen EADDRINUSE',
+      expect.stringMatching(getReclaimLine(102)),
+      ''
+    ]);
+    expect(findReclaimedDaemonPid(paths)).toBe(102);
+  });
+
+  it('returns undefined once a daemon became ready after the reclaim', () => {
+    for (const ready of [
+      'rushd ready at /run/d.sock (Rush 5.0.0)',
+      '2026-09-29T00:00:00.000Z rushd ready at /run/d.sock (Rush 5.0.0, PID 7)'
+    ]) {
+      logReclaimedDaemon(paths, 101);
+      fs.appendFileSync(logFilePath, `${ready}\n`);
+      expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    }
+    logReclaimedDaemon(paths, 103);
+    expect(findReclaimedDaemonPid(paths)).toBe(103);
+  });
+
+  it("ignores a daemon's output that quotes the line", () => {
+    fs.writeFileSync(
+      logFilePath,
+      'Error: 2026-09-29T00:00:00.000Z rush-client (PID 1): rushd (PID 99) exited without shutting down; x\n'
+    );
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+  });
+
+  it('reads only the complete lines in the last 64 KiB of the log', () => {
+    logReclaimedDaemon(paths, 104);
+    const lineLength: number = fs.statSync(logFilePath).size;
+    // The read then starts 5 bytes into the line, after "2026-"; the rest of it would still look like a reclaim.
+    fs.appendFileSync(logFilePath, `${'x'.repeat(64 * 1024 - lineLength + 4)}\n`);
+    expect(fs.statSync(logFilePath).size - 64 * 1024).toBe(5);
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    logReclaimedDaemon(paths, 105);
+    expect(findReclaimedDaemonPid(paths)).toBe(105);
+  });
+
+  posixIt('writes only to a regular file of this user that has no other links', () => {
+    const target: string = path.join(folder, 'target.log');
+    fs.writeFileSync(target, 'kept\n');
+    fs.symlinkSync(target, logFilePath);
+    logReclaimedDaemon(paths, 106);
+    expect(fs.readFileSync(target, 'utf8')).toBe('kept\n');
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    fs.unlinkSync(logFilePath);
+    fs.linkSync(target, logFilePath);
+    logReclaimedDaemon(paths, 106);
+    expect(fs.readFileSync(target, 'utf8')).toBe('kept\n');
+    fs.unlinkSync(logFilePath);
+    // As the launcher does, it makes the log private.
+    fs.writeFileSync(logFilePath, '');
+    fs.chmodSync(logFilePath, 0o644);
+    logReclaimedDaemon(paths, 106);
+    expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
+    expect(findReclaimedDaemonPid(paths)).toBe(106);
+  });
+
+  it('is cleared by a reset of the daemon files', async () => {
+    logReclaimedDaemon(paths, 107);
+    expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [] });
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    expect(readLogLines()).toEqual([
+      expect.stringMatching(getReclaimLine(107)),
+      expect.stringMatching(
+        new RegExp(
+          `^\\S+Z rush-client \\(PID ${process.pid}\\): reset the daemon's files; the report that rushd ` +
+            '\\(PID 107\\) exited without shutting down is cleared\\.$'
+        )
+      ),
+      ''
+    ]);
+    // Without a report, a reset adds nothing.
+    await resetDaemonArtifactsAsync(paths);
+    expect(readLogLines()).toHaveLength(3);
+    logReclaimedDaemon(paths, 108);
+    expect(findReclaimedDaemonPid(paths)).toBe(108);
+  });
+});

From 8123f8cf642da511b8f908b5376d39831cb64027 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 112/265] [rush-client-core] Start a client's launcher-log line
 on a line of its own when the log ends inside a line (task 213) (and 1 more)

Swarm integration step 97; original commit 51038605a3 (merge of swarm/o04-t213-int3 at 0a683e346b).
Scope: task 213-int3.

Brings 213-int3 (branch swarm/o04-t213-int3). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 3 of 21. Gate: ch01 GATE OK board 4527 (tree 5090a6cce4)

Commits folded into this step (2):
- 6923a47821 Start a client's launcher-log line on a line of its own when the log ends inside a line (task 213)
- 1f28075503 Stat the launcher log without leaving its type in Node's shared stat array (task 213, fix 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-t213-log-line-start_2026-09-29-05-41.json | 11 +++
 .../src/ReclaimedDaemonLog.ts                 | 77 ++++++++++++++-----
 .../src/test/ReclaimedDaemonLog.test.ts       | 74 ++++++++++++++++++
 3 files changed, 142 insertions(+), 20 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-o04-t213-log-line-start_2026-09-29-05-41.json

diff --git a/common/changes/@rushstack/rush-client-core/swarm-o04-t213-log-line-start_2026-09-29-05-41.json b/common/changes/@rushstack/rush-client-core/swarm-o04-t213-log-line-start_2026-09-29-05-41.json
new file mode 100644
index 0000000000..8cc21c6e44
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-o04-t213-log-line-start_2026-09-29-05-41.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A line that a client appends to the launcher log now starts on a line of its own when the log ends inside a line, for example after a daemon that was killed before it finished one, so that `findReclaimedDaemonPid(paths)` still finds the report of a reclaimed daemon and its reset.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-client-core/src/ReclaimedDaemonLog.ts b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
index 52fc51749b..525a56e4ec 100644
--- a/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
+++ b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
@@ -69,33 +69,69 @@ export function findReclaimedDaemonPid(paths: IDaemonPaths): number | undefined
   return undefined;
 }
 
-/** Appends one line in the form of the launcher's own lines, under the launcher's checks of the log file. */
+interface IAppendableLog {
+  readonly fd: number;
+  /** Whether the log was also opened for reading. */
+  readonly readable: boolean;
+}
+
+/**
+ * Appends one line in the form of the launcher's own lines, under the launcher's checks of the log file. When
+ * the log ends inside a line, for example after a daemon that was killed before it finished one, the line starts
+ * on a line of its own, so that {@link findReclaimedDaemonPid} can read it; that needs a log this user may read.
+ */
 function appendClientLine(paths: IDaemonPaths, text: string): void {
-  let fd: number | undefined;
+  let log: IAppendableLog | undefined;
   try {
-    fd = fs.openSync(
-      getDaemonLogFilePath(paths),
-      // These distinct native flags have non-overlapping values.
-      fs.constants.O_WRONLY +
-        fs.constants.O_APPEND +
-        fs.constants.O_CREAT +
-        (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK),
-      0o600
-    );
-    const stats: fs.Stats = fs.fstatSync(fd);
-    if (!stats.isFile() || stats.nlink !== 1) return;
+    log = openLogForAppend(getDaemonLogFilePath(paths));
+    const stats: fs.BigIntStats = statOpenLog(log.fd);
+    if (!stats.isFile() || stats.nlink !== 1n) return;
     if (process.platform !== 'win32') {
-      if (stats.uid !== process.getuid?.()) return;
-      fs.fchmodSync(fd, 0o600);
+      if (Number(stats.uid) !== process.getuid?.()) return;
+      fs.fchmodSync(log.fd, 0o600);
     }
-    fs.writeSync(fd, `${new Date().toISOString()} rush-client (PID ${process.pid}): ${text}\n`);
+    const separator: string = log.readable && endsInsideLine(log.fd, Number(stats.size)) ? '\n' : '';
+    fs.writeSync(
+      log.fd,
+      `${separator}${new Date().toISOString()} rush-client (PID ${process.pid}): ${text}\n`
+    );
   } catch {
     // Whatever the line reports is done; only the report of it is lost.
   } finally {
-    if (fd !== undefined) fs.closeSync(fd);
+    if (log !== undefined) fs.closeSync(log.fd);
   }
 }
 
+/** Opens the log to read it too when this user may, and else, as the launcher does, only to write to it. */
+function openLogForAppend(logFilePath: string): IAppendableLog {
+  // These distinct native flags have non-overlapping values.
+  const flags: number =
+    fs.constants.O_APPEND +
+    fs.constants.O_CREAT +
+    (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK);
+  try {
+    return { fd: fs.openSync(logFilePath, fs.constants.O_RDWR + flags, 0o600), readable: true };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'EACCES') throw error;
+    return { fd: fs.openSync(logFilePath, fs.constants.O_WRONLY + flags, 0o600), readable: false };
+  }
+}
+
+function endsInsideLine(fd: number, size: number): boolean {
+  if (size === 0) return false;
+  const lastByte: Buffer = Buffer.alloc(1);
+  return fs.readSync(fd, lastByte, 0, 1, size - 1) === 1 && lastByte[0] !== 0x0a;
+}
+
+/**
+ * Stats the open log. A plain stat would leave the log's file type in Node's shared stat array, and Node's cached
+ * realpath reads that array: after a FIFO, the next require() in this process would not resolve symlinks, so a
+ * package that pnpm installed could not find its dependencies. A bigint stat fills another array.
+ */
+function statOpenLog(fd: number): fs.BigIntStats {
+  return fs.fstatSync(fd, { bigint: true });
+}
+
 function readLogTailLines(logFilePath: string): string[] | undefined {
   let fd: number | undefined;
   try {
@@ -105,10 +141,11 @@ function readLogTailLines(logFilePath: string): string[] | undefined {
       fs.constants.O_RDONLY +
         (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK)
     );
-    const stats: fs.Stats = fs.fstatSync(fd);
+    const stats: fs.BigIntStats = statOpenLog(fd);
     if (!stats.isFile()) return undefined;
-    const start: number = Math.max(0, stats.size - MAX_LOG_READ_BYTES);
-    const buffer: Buffer = Buffer.alloc(stats.size - start);
+    const size: number = Number(stats.size);
+    const start: number = Math.max(0, size - MAX_LOG_READ_BYTES);
+    const buffer: Buffer = Buffer.alloc(size - start);
     const lines: string[] = buffer
       .toString('utf8', 0, fs.readSync(fd, buffer, 0, buffer.length, start))
       .split(/\r?\n/);
diff --git a/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
index 760ab32df2..4b8ee38ac9 100644
--- a/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
+++ b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -94,6 +95,24 @@ describe(findReclaimedDaemonPid.name, () => {
     expect(findReclaimedDaemonPid(paths)).toBe(105);
   });
 
+  it('starts its line on a line of its own when the log ends inside a line', async () => {
+    // For example, the output of a daemon that was killed before it finished a line.
+    fs.writeFileSync(logFilePath, 'Error: boom');
+    logReclaimedDaemon(paths, 109);
+    expect(readLogLines()).toEqual(['Error: boom', expect.stringMatching(getReclaimLine(109)), '']);
+    expect(findReclaimedDaemonPid(paths)).toBe(109);
+    fs.appendFileSync(logFilePath, '    at boom');
+    await resetDaemonArtifactsAsync(paths);
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    expect(readLogLines()).toEqual([
+      'Error: boom',
+      expect.stringMatching(getReclaimLine(109)),
+      '    at boom',
+      expect.stringMatching(/^\S+Z rush-client \(PID \d+\): reset the daemon's files; /),
+      ''
+    ]);
+  });
+
   posixIt('writes only to a regular file of this user that has no other links', () => {
     const target: string = path.join(folder, 'target.log');
     fs.writeFileSync(target, 'kept\n');
@@ -112,8 +131,63 @@ describe(findReclaimedDaemonPid.name, () => {
     logReclaimedDaemon(paths, 106);
     expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
     expect(findReclaimedDaemonPid(paths)).toBe(106);
+    // Also a log that it may only write, which the launcher opens too.
+    fs.chmodSync(logFilePath, 0o200);
+    logReclaimedDaemon(paths, 110);
+    expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
+    expect(findReclaimedDaemonPid(paths)).toBe(110);
   });
 
+  // For example, Rush that runs in-process after the client reclaimed a daemon. Jest resolves modules itself, so
+  // a Node process of its own runs the function and then requires a package the way Node does.
+  posixIt.each([logReclaimedDaemon.name, findReclaimedDaemonPid.name])(
+    'leaves require() resolving symlinks after %s met a log that is a FIFO',
+    (functionName: string) => {
+      // As pnpm installs them: the package finds its dependency only from its real path.
+      const store: string = path.join(folder, 'store', 'node_modules');
+      fs.mkdirSync(path.join(store, 'reclaim-log-dependency'), { recursive: true });
+      fs.writeFileSync(path.join(store, 'reclaim-log-dependency', 'index.js'), "module.exports = 'found';");
+      fs.mkdirSync(path.join(store, 'reclaim-log-package'));
+      fs.writeFileSync(
+        path.join(store, 'reclaim-log-package', 'index.js'),
+        "module.exports = require('reclaim-log-dependency');"
+      );
+      fs.mkdirSync(path.join(folder, 'app', 'node_modules'), { recursive: true });
+      fs.symlinkSync(
+        path.join(store, 'reclaim-log-package'),
+        path.join(folder, 'app', 'node_modules', 'reclaim-log-package')
+      );
+      fs.writeFileSync(
+        path.join(folder, 'main.js'),
+        'const [modulePath, pathsJson, functionName] = process.argv.slice(2);\n' +
+          'require(modulePath)[functionName](JSON.parse(pathsJson), 111);\n' +
+          "try { process.stdout.write(require('./app/node_modules/reclaim-log-package')); }\n" +
+          'catch (error) { process.stdout.write(error.code); }\n'
+      );
+      expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0);
+      const child: SpawnSyncReturns<string> = spawnSync(
+        process.execPath,
+        [
+          path.join(folder, 'main.js'),
+          require.resolve('../ReclaimedDaemonLog'),
+          JSON.stringify(paths),
+          functionName
+        ],
+        {
+          cwd: folder,
+          encoding: 'utf8',
+          env: { ...process.env, NODE_OPTIONS: undefined, NODE_PRESERVE_SYMLINKS: undefined },
+          timeout: 10000
+        }
+      );
+      expect({ status: child.status, stdout: child.stdout, stderr: child.stderr }).toEqual({
+        status: 0,
+        stdout: 'found',
+        stderr: ''
+      });
+    }
+  );
+
   it('is cleared by a reset of the daemon files', async () => {
     logReclaimedDaemon(paths, 107);
     expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [] });

From 6ea793fa48305bbf29693042954bd67814701fca Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 113/265] [rush-daemon] Keep rushd running, and stopping
 cleanly, when nothing reads its output

Swarm integration step 98; original commit 96641539ef (merge of swarm/o04-t195 at e2da590f35).
Refs: task 195.
Scope: task 195.

Brings 195 (branch swarm/o04-t195). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 4 of 21. Gate: ch01 GATE OK board 4527 (tree 82ea3c31c4)

Commits folded into this step (1):
- e2da590f35 Keep rushd running, and stopping cleanly, when nothing reads its output (task 195)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...4-t195-closed-output_2026-09-29-06-20.json |  10 ++
 libraries/rush-daemon/README.md               |   4 +-
 .../rush-daemon/src/RushDaemonCommandLine.ts  |  16 ++
 libraries/rush-daemon/src/start.ts            |   5 +-
 .../src/test/DaemonClosedOutput.test.ts       | 168 ++++++++++++++++++
 .../src/test/RushDaemonCommandLine.test.ts    |  11 ++
 6 files changed, 212 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-o04-t195-closed-output_2026-09-29-06-20.json
 create mode 100644 libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-o04-t195-closed-output_2026-09-29-06-20.json b/common/changes/@rushstack/rush-daemon/swarm-o04-t195-closed-output_2026-09-29-06-20.json
new file mode 100644
index 0000000000..28e22d8224
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-o04-t195-closed-output_2026-09-29-06-20.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "`rushd` no longer exits with code 1 and leaves its socket and lockfile behind when whatever reads its output has gone, as with `rushd 2>&1 | tee rushd.log` after Ctrl+C: it goes on without its output and stops cleanly.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index d3a401cec6..e5f19e42bd 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -29,7 +29,9 @@ Whatever starts a shutdown (a signal, a management client, the idle timeout, a l
 `closeAsync()`), the host writes one line to `onLog` when it begins, with its process ID and the reason, for example
 `rushd (PID 2750564) shutting down: received SIGTERM`; later close calls write nothing. The standalone daemon
 starts each log line with the time, and its `rushd ready at` line also has the time and the process ID, so that
-each start can be matched with its end.
+each start can be matched with its end. If whatever reads the output of `rushd` goes away first, as with
+`rushd 2>&1 | tee rushd.log` when Ctrl+C stops `tee` as well, `rushd` goes on without its output: it still stops
+cleanly and removes its socket and lockfile.
 
 Protocol 0.6 management clients can stop the host through the workspace transport rather than signaling a PID
 read from disk. The host requires a lifecycle-capable hello, drains `shutdownAck` before beginning shutdown,
diff --git a/libraries/rush-daemon/src/RushDaemonCommandLine.ts b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
index 7940da7554..7cad249a5d 100644
--- a/libraries/rush-daemon/src/RushDaemonCommandLine.ts
+++ b/libraries/rush-daemon/src/RushDaemonCommandLine.ts
@@ -60,6 +60,22 @@ export async function launchRushDaemonAsync(startingFolder: string = process.cwd
   await serveRushDaemonAsync(serveOptions);
 }
 
+/**
+ * An 'error' listener for the process's stdout and stderr that lets `rushd` go on without its output once whatever
+ * read that output has gone.
+ *
+ * @remarks
+ * After `rushd 2>&1 | tee rushd.log`, Ctrl+C stops `tee` as well as `rushd`. The next write, such as the ready line
+ * or the shutdown line, then fails with EPIPE, which Node.js reports as an 'error' event on the stream. Unhandled,
+ * that error would end the process with code 1 before the daemon removed its socket and lockfile. Any other error
+ * is thrown, as it was without a listener.
+ */
+export function ignoreClosedReader(error: NodeJS.ErrnoException): void {
+  if (error.code !== 'EPIPE') {
+    throw error;
+  }
+}
+
 function findRushJsonPath(startingFolder: string): string {
   let currentFolder: string = path.resolve(startingFolder);
   while (true) {
diff --git a/libraries/rush-daemon/src/start.ts b/libraries/rush-daemon/src/start.ts
index 7f1b6378c2..9234d053b0 100644
--- a/libraries/rush-daemon/src/start.ts
+++ b/libraries/rush-daemon/src/start.ts
@@ -3,7 +3,10 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { launchRushDaemonAsync } from './RushDaemonCommandLine';
+import { ignoreClosedReader, launchRushDaemonAsync } from './RushDaemonCommandLine';
+
+process.stdout.on('error', ignoreClosedReader);
+process.stderr.on('error', ignoreClosedReader);
 
 launchRushDaemonAsync().catch((error: Error) => {
   process.stderr.write(`${error.stack ?? error.message}\n`);
diff --git a/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts b/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
new file mode 100644
index 0000000000..0183a01d99
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
@@ -0,0 +1,168 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
+
+const RUSHD_PATH: string = path.join(__dirname, '..', 'start.js');
+const POLL_INTERVAL_MS: number = 20;
+const START_TIMEOUT_MS: number = 15000;
+// Far longer than the daemon takes to write its ready line once it listens.
+const AFTER_READY_MS: number = 500;
+const READY_LINE: RegExp = /rushd ready at (\S+) \(PID \d+\)\n/;
+
+interface IProcessExit {
+  readonly code: number | undefined;
+  readonly signal: NodeJS.Signals | undefined;
+}
+
+interface IRushd {
+  readonly process: ChildProcess;
+  readonly exited: Promise<IProcessExit>;
+  readonly getStderr: () => string;
+}
+
+// As after `rushd 2>&1 | tee rushd.log`, when Ctrl+C stops tee as well as rushd.
+(process.platform === 'win32' ? describe.skip : describe)('rushd when nothing reads its output', () => {
+  let folder: string;
+  let repoRoot: string;
+  let runtimeBase: string;
+  let rushd: IRushd | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-closed-output-'));
+    repoRoot = path.join(folder, 'repo');
+    runtimeBase = path.join(folder, 'runtime');
+    createTemporaryRepo(repoRoot);
+    fs.mkdirSync(runtimeBase, { mode: 0o700 });
+  });
+
+  afterEach(async () => {
+    const started: IRushd | undefined = rushd;
+    rushd = undefined;
+    // Only the rushd process that this test started, if a failed test left it running.
+    if (started && started.process.exitCode === null && started.process.signalCode === null) {
+      started.process.kill('SIGKILL');
+      await started.exited;
+    }
+    fs.rmSync(folder, { force: true, recursive: true });
+  });
+
+  function startRushd(): IRushd {
+    const child: ChildProcess = spawn(process.execPath, [RUSHD_PATH], {
+      cwd: repoRoot,
+      env: { ...process.env, RUSHD_RUNTIME_DIR: runtimeBase, RUSH_TEMP_FOLDER: undefined },
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let stderr: string = '';
+    child.stderr?.setEncoding('utf8').on('data', (chunk: string) => (stderr += chunk));
+    const exited: Promise<IProcessExit> = new Promise((resolve) => {
+      child.once('exit', (code, signal) => resolve({ code: code ?? undefined, signal: signal ?? undefined }));
+    });
+    rushd = { process: child, exited, getStderr: () => stderr };
+    return rushd;
+  }
+
+  /** Resolves with the socket path from the ready line. */
+  function readReadyLineAsync(started: IRushd): Promise<string> {
+    return new Promise((resolve, reject) => {
+      let stdout: string = '';
+      const timer: NodeJS.Timeout = setTimeout(
+        () => reject(new Error(`rushd was not ready within ${START_TIMEOUT_MS} ms:\n${started.getStderr()}`)),
+        START_TIMEOUT_MS
+      );
+      started.process.stdout?.setEncoding('utf8').on('data', (chunk: string) => {
+        stdout += chunk;
+        const match: RegExpExecArray | null = READY_LINE.exec(stdout);
+        if (match) {
+          clearTimeout(timer);
+          resolve(match[1]);
+        }
+      });
+      void started.exited.then(({ code, signal }) => {
+        clearTimeout(timer);
+        reject(new Error(`rushd exited (${code ?? signal}) before it was ready:\n${started.getStderr()}`));
+      });
+    });
+  }
+
+  /** Resolves with the socket path, once rushd has written its socket and lockfile. */
+  async function waitForDaemonFilesAsync(started: IRushd): Promise<string> {
+    const deadlineMs: number = Date.now() + START_TIMEOUT_MS;
+    while (true) {
+      for (const runtimeDir of fs.readdirSync(runtimeBase)) {
+        const names: string[] = fs.readdirSync(path.join(runtimeBase, runtimeDir));
+        const socketName: string | undefined = names.find((name) => name.endsWith('.sock'));
+        if (socketName && names.includes(lockfileNameOf(socketName))) {
+          return path.join(runtimeBase, runtimeDir, socketName);
+        }
+      }
+      if (started.process.exitCode !== null || Date.now() > deadlineMs) {
+        throw new Error(`rushd did not write its socket and lockfile:\n${started.getStderr()}`);
+      }
+      await delayAsync(POLL_INTERVAL_MS);
+    }
+  }
+
+  function lockfileNameOf(socketName: string): string {
+    return socketName.replace(/\.sock$/, '.pid.json');
+  }
+
+  function getDaemonFiles(socketPath: string): { socket: boolean; lockfile: boolean } {
+    const lockfilePath: string = path.join(
+      path.dirname(socketPath),
+      lockfileNameOf(path.basename(socketPath))
+    );
+    return { socket: fs.existsSync(socketPath), lockfile: fs.existsSync(lockfilePath) };
+  }
+
+  it.each<NodeJS.Signals>(['SIGTERM', 'SIGINT'])(
+    'stops on %s and removes its socket and lockfile when nothing reads its stderr',
+    async (signal: NodeJS.Signals) => {
+      const started: IRushd = startRushd();
+      const socketPath: string = await readReadyLineAsync(started);
+      expect(getDaemonFiles(socketPath)).toEqual({ socket: true, lockfile: true });
+
+      started.process.stderr?.destroy();
+      started.process.kill(signal);
+
+      // The shutdown line, which goes to stderr, used to end the process with an unhandled EPIPE.
+      const exit: IProcessExit = await started.exited;
+      expect({ ...exit, ...getDaemonFiles(socketPath) }).toEqual({
+        code: 0,
+        signal: undefined,
+        socket: false,
+        lockfile: false
+      });
+    },
+    30000
+  );
+
+  it('keeps running when nothing reads its stdout, and then stops cleanly', async () => {
+    const started: IRushd = startRushd();
+    started.process.stdout?.destroy();
+    const socketPath: string = await waitForDaemonFilesAsync(started);
+    await delayAsync(AFTER_READY_MS);
+
+    // The ready line, which goes to stdout, used to end the process with an unhandled EPIPE.
+    expect({ exitCode: started.process.exitCode, stderr: started.getStderr() }).toEqual({
+      exitCode: null,
+      stderr: ''
+    });
+    started.process.kill('SIGTERM');
+
+    const exit: IProcessExit = await started.exited;
+    expect({ ...exit, ...getDaemonFiles(socketPath) }).toEqual({
+      code: 0,
+      signal: undefined,
+      socket: false,
+      lockfile: false
+    });
+    expect(started.getStderr()).toMatch(/^\S+ rushd \(PID \d+\) shutting down: received SIGTERM\n$/);
+  }, 30000);
+});
diff --git a/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts b/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
index faf69f9bb6..4d0408c169 100644
--- a/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
+++ b/libraries/rush-daemon/src/test/RushDaemonCommandLine.test.ts
@@ -10,6 +10,7 @@ import { tmpdir } from 'node:os';
 import { Rush } from '@microsoft/rush-lib';
 
 import {
+  ignoreClosedReader,
   launchRushDaemonAsync,
   resolveRushDaemonWorkspace,
   type IRushDaemonWorkspace
@@ -92,3 +93,13 @@ describe(resolveRushDaemonWorkspace.name, () => {
     }
   });
 });
+
+describe(ignoreClosedReader.name, () => {
+  it('ignores the EPIPE of an output whose reader has gone, and throws any other error', () => {
+    const closedReader: NodeJS.ErrnoException = Object.assign(new Error('write EPIPE'), { code: 'EPIPE' });
+    const otherError: NodeJS.ErrnoException = Object.assign(new Error('write EIO'), { code: 'EIO' });
+
+    expect(() => ignoreClosedReader(closedReader)).not.toThrow();
+    expect(() => ignoreClosedReader(otherError)).toThrow(otherError);
+  });
+});

From 8e843500ffd004388b060204c01cef36caeeebc7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 114/265] [rush-daemon] Test that an early result's iteration
 measure ends at the result

Swarm integration step 99; original commit 141b0a16c8 (merge of swarm/r02-t168-nit1 at 233821c47f).
Refs: 168 NIT, board 3617.
Scope: task 168-nit1.

Brings 168-nit1 (branch swarm/r02-t168-nit1). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 5 of 21. Gate: ch01 GATE OK board 4527 (tree eba7b8942a)

Commits folded into this step (1):
- 233821c47f [rush-daemon] Test that an early result's iteration measure ends at the result (168 NIT, board 3617)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../early-result-measures-test_2026-09-29-06-44.json  | 11 +++++++++++
 .../src/test/PhasedRequestEarlyFailure.test.ts        |  6 ++++++
 2 files changed, 17 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/early-result-measures-test_2026-09-29-06-44.json

diff --git a/common/changes/@rushstack/rush-daemon/early-result-measures-test_2026-09-29-06-44.json b/common/changes/@rushstack/rush-daemon/early-result-measures-test_2026-09-29-06-44.json
new file mode 100644
index 0000000000..ad8c3a37e6
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/early-result-measures-test_2026-09-29-06-44.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a failed build which returns early logs the measures taken at its result, while its iteration goes on.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
index 800d4049b0..27bdbd12b5 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -514,6 +514,12 @@ describe('phased requests that return early on failure', () => {
         expect(record.stopwatch.endTime).toBeGreaterThan(report.resultTimeMs);
       }
     }
+    // The measures are taken at the result too, when the iteration had not ended yet.
+    expect(report.measures).toContainEqual({
+      name: 'rush:daemon:executeIteration',
+      startTimeMs: expect.any(Number),
+      endTimeMs: report.resultTimeMs
+    });
   });
 
   it('logs the work that continues as aborted when the request is aborted after its result and stops it', async () => {

From 1534a71c4adedf9ef2e3370424d14164ff7bc067 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 115/265] [rush-lib] Allow "disableBuildCache" on phased
 commands in command-line.json

Swarm integration step 100; original commit 91abbea65b (merge of swarm/r03-t205 at e0bdf1911c).
Scope: task 205.

Brings 205 (branch swarm/r03-t205). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 6 of 21. Gate: ch01 GATE OK board 4527 (tree 80b98db7aa)

Commits folded into this step (1):
- e0bdf1911c rush-lib: allow "disableBuildCache" on phased commands in command-line.json

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ed-disableBuildCache_2026-09-29-06-24.json |  11 ++
 libraries/rush-lib/src/api/CommandLineJson.ts |   1 +
 .../api/test/CommandLineConfiguration.test.ts |  30 +++++
 ...command-line-phased-disableBuildCache.json |  22 ++++
 .../command-line-phased-unknown-property.json |  22 ++++
 ...dLineParserPhasedDisableBuildCache.test.ts | 115 ++++++++++++++++++
 .../a/package.json                            |   9 ++
 .../b/package.json                            |  12 ++
 .../common/config/rush/command-line.json      |  36 ++++++
 .../phasedDisableBuildCacheRepo/rush.json     |  17 +++
 .../src/schemas/command-line.schema.json      |   1 +
 11 files changed, 276 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/r03-t205-phased-disableBuildCache_2026-09-29-06-24.json
 create mode 100644 libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json
 create mode 100644 libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json
 create mode 100644 libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
 create mode 100644 libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json
 create mode 100644 libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json
 create mode 100644 libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json
 create mode 100644 libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json

diff --git a/common/changes/@microsoft/rush/r03-t205-phased-disableBuildCache_2026-09-29-06-24.json b/common/changes/@microsoft/rush/r03-t205-phased-disableBuildCache_2026-09-29-06-24.json
new file mode 100644
index 0000000000..e5cd6883b1
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-t205-phased-disableBuildCache_2026-09-29-06-24.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix a JSON schema issue that prevented \"disableBuildCache\" from being specified for a phased command in command-line.json",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/api/CommandLineJson.ts b/libraries/rush-lib/src/api/CommandLineJson.ts
index 6d07a60980..e34dcef548 100644
--- a/libraries/rush-lib/src/api/CommandLineJson.ts
+++ b/libraries/rush-lib/src/api/CommandLineJson.ts
@@ -48,6 +48,7 @@ export interface IPhasedCommandWithoutPhasesJson extends IBaseCommandJson {
  */
 export interface IPhasedCommandJson extends IPhasedCommandWithoutPhasesJson {
   phases: string[];
+  disableBuildCache?: boolean;
   watchOptions?: {
     alwaysWatch: boolean;
     debounceMs?: number;
diff --git a/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts b/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts
index 6cd9360ed1..0aa5e78353 100644
--- a/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/CommandLineConfiguration.test.ts
@@ -294,4 +294,34 @@ describe(CommandLineConfiguration.name, () => {
       expect(phase.shellCommand).toEqual('echo');
     });
   });
+
+  describe('disableBuildCache in phased command', () => {
+    const loaders: {
+      loaderName: string;
+      load: (jsonFilePath: string) => CommandLineConfiguration | undefined;
+    }[] = [
+      {
+        loaderName: 'loadFromFileOrDefault',
+        load: (jsonFilePath: string) => CommandLineConfiguration.loadFromFileOrDefault(jsonFilePath)
+      },
+      {
+        loaderName: 'tryLoadFromFile',
+        load: (jsonFilePath: string) => CommandLineConfiguration.tryLoadFromFile(jsonFilePath)
+      }
+    ];
+
+    it.each(loaders)('is allowed by $loaderName', ({ load }) => {
+      const command: IPhasedCommandConfig | undefined = load(
+        `${__dirname}/jsonFiles/command-line-phased-disableBuildCache.json`
+      )?.commands.get('ship') as IPhasedCommandConfig | undefined;
+      expect(command?.commandKind).toEqual('phased');
+      expect(command?.disableBuildCache).toEqual(true);
+    });
+
+    it.each(loaders)('does not allow other undeclared properties in $loaderName', ({ load }) => {
+      expect(() => load(`${__dirname}/jsonFiles/command-line-phased-unknown-property.json`)).toThrow(
+        /must NOT have additional properties: disableBuildCaches/
+      );
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json
new file mode 100644
index 0000000000..52b463aaa6
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-disableBuildCache.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [
+    {
+      "commandKind": "phased",
+      "name": "ship",
+      "summary": "Ships every project, without the build cache or skipping.",
+      "enableParallelism": true,
+      "incremental": true,
+      "disableBuildCache": true,
+      "phases": ["_phase:ship"]
+    }
+  ],
+  "phases": [
+    {
+      "name": "_phase:ship",
+      "dependencies": {
+        "upstream": ["_phase:ship"]
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json
new file mode 100644
index 0000000000..3721053fbf
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/jsonFiles/command-line-phased-unknown-property.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [
+    {
+      "commandKind": "phased",
+      "name": "ship",
+      "summary": "Ships every project.",
+      "enableParallelism": true,
+      "incremental": true,
+      "disableBuildCaches": true,
+      "phases": ["_phase:ship"]
+    }
+  ],
+  "phases": [
+    {
+      "name": "_phase:ship",
+      "dependencies": {
+        "upstream": ["_phase:ship"]
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
new file mode 100644
index 0000000000..f61b6ea786
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
@@ -0,0 +1,115 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock(`@rushstack/package-deps-hash`, () => {
+  return {
+    getRepoRoot(dir: string): string {
+      return dir;
+    },
+    getDetailedRepoStateAsync(): IDetailedRepoState {
+      return {
+        hasSubmodules: false,
+        hasUncommittedChanges: false,
+        files: new Map([['common/config/rush/npm-shrinkwrap.json', 'hash']]),
+        symlinks: new Map()
+      };
+    },
+    getRepoChangesAsync(): ReadonlyMap<string, string> {
+      return new Map();
+    },
+    getGitHashForFiles(filePaths: Iterable<string>): ReadonlyMap<string, string> {
+      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+    },
+    hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): Promise<ReadonlyMap<string, string>> {
+      return Promise.resolve(new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath])));
+    }
+  };
+});
+
+import './mockRushCommandLineParser';
+
+import * as path from 'node:path';
+import type { SpawnOptions } from 'node:child_process';
+
+import { LockFile } from '@rushstack/node-core-library';
+import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
+
+import type { RushCommandLineParser } from '../RushCommandLineParser';
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import {
+  getCommandLineParserInstanceAsync,
+  isolateEnvironmentConfigurationForTests,
+  setSpawnMock,
+  type IEnvironmentConfigIsolation,
+  type SpawnMockCall
+} from './TestUtils';
+
+// The repo has no build cache, so its incremental phased commands use legacy skip detection, unless they set
+// "disableBuildCache" in command-line.json.
+const REPO_NAME: string = 'phasedDisableBuildCacheRepo';
+
+jest.setTimeout(1000000);
+
+/**
+ * Executes the command and returns the folder names of the projects whose script it spawned.
+ */
+async function executeAsync(parser: RushCommandLineParser, spawnMock: jest.Mock): Promise<string[]> {
+  spawnMock.mockClear();
+  await expect(parser.executeAsync()).resolves.toEqual(true);
+  return spawnMock.mock.calls
+    .map((spawnCall: SpawnMockCall) => path.basename(String((spawnCall[2] as SpawnOptions).cwd)))
+    .sort();
+}
+
+/**
+ * Runs another command in a repo that {@link getCommandLineParserInstanceAsync} created, as a new Rush process
+ * would.
+ */
+async function runAsync(repoPath: string, commandName: string): Promise<string[]> {
+  const { RushCommandLineParser: Parser } = await import('../RushCommandLineParser');
+  // The parser refuses to load .env files after the previous command validated the environment.
+  EnvironmentConfiguration.reset();
+  const parser: RushCommandLineParser = new Parser({ cwd: repoPath });
+  process.argv = ['pretend-this-is-node.exe', 'pretend-this-is-rush', commandName];
+  return await executeAsync(parser, setSpawnMock());
+}
+
+describe('RushCommandLineParser phased command with disableBuildCache', () => {
+  let _envIsolation: IEnvironmentConfigIsolation;
+  let _lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire>;
+  let _originalExitCode: string | number | undefined;
+
+  beforeEach(() => {
+    // A command that succeeds sets process.exitCode to 0. When Jest runs only this file, it shares the
+    // process with Heft, which would then exit with 0 even though tests failed.
+    _originalExitCode = process.exitCode;
+    _envIsolation = isolateEnvironmentConfigurationForTests();
+
+    // Rush keeps the repo lock until the process exits, so it would refuse the second command in a repo.
+    const tryAcquire: typeof LockFile.tryAcquire = LockFile.tryAcquire.bind(LockFile);
+    _lockSpy = jest
+      .spyOn(LockFile, 'tryAcquire')
+      .mockImplementation((resourceFolder: string, resourceName: string) =>
+        resourceName === 'rush' ? ({} as LockFile) : tryAcquire(resourceFolder, resourceName)
+      );
+  });
+
+  afterEach(() => {
+    _lockSpy.mockRestore();
+    jest.clearAllMocks();
+    _envIsolation.restore();
+    process.exitCode = _originalExitCode;
+  });
+
+  it('skips the unchanged projects in a phased command without disableBuildCache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'stage');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(await runAsync(repoPath, 'stage')).toEqual([]);
+  });
+
+  it('runs every project again in a phased command with disableBuildCache', async () => {
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'ship');
+    expect(await executeAsync(parser, spawnMock)).toEqual(['a', 'b']);
+    expect(await runAsync(repoPath, 'ship')).toEqual(['a', 'b']);
+  });
+});
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json
new file mode 100644
index 0000000000..6cfb59b20a
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/a/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "a",
+  "version": "1.0.0",
+  "description": "Test package a",
+  "scripts": {
+    "_phase:ship": "fake_ship_task_but_works_with_mock",
+    "_phase:stage": "fake_stage_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json
new file mode 100644
index 0000000000..be10955ab7
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/b/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "b",
+  "version": "1.0.0",
+  "description": "Test package b",
+  "dependencies": {
+    "a": "1.0.0"
+  },
+  "scripts": {
+    "_phase:ship": "fake_ship_task_but_works_with_mock",
+    "_phase:stage": "fake_stage_task_but_works_with_mock"
+  }
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json
new file mode 100644
index 0000000000..59256a24de
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/command-line.json
@@ -0,0 +1,36 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [
+    {
+      "commandKind": "phased",
+      "name": "stage",
+      "summary": "An incremental phased command, which skips the projects whose inputs didn't change.",
+      "enableParallelism": true,
+      "incremental": true,
+      "phases": ["_phase:stage"]
+    },
+    {
+      "commandKind": "phased",
+      "name": "ship",
+      "summary": "An incremental phased command that disables the build cache, and with it the skipping.",
+      "enableParallelism": true,
+      "incremental": true,
+      "disableBuildCache": true,
+      "phases": ["_phase:ship"]
+    }
+  ],
+  "phases": [
+    {
+      "name": "_phase:stage",
+      "dependencies": {
+        "upstream": ["_phase:stage"]
+      }
+    },
+    {
+      "name": "_phase:ship",
+      "dependencies": {
+        "upstream": ["_phase:ship"]
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json
new file mode 100644
index 0000000000..f39da1606c
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/rush.json
@@ -0,0 +1,17 @@
+{
+  "npmVersion": "6.4.1",
+  "rushVersion": "5.5.2",
+  "projectFolderMinDepth": 1,
+  "projectFolderMaxDepth": 99,
+
+  "projects": [
+    {
+      "packageName": "a",
+      "projectFolder": "a"
+    },
+    {
+      "packageName": "b",
+      "projectFolder": "b"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/schemas/command-line.schema.json b/libraries/rush-lib/src/schemas/command-line.schema.json
index 195235d8e7..399e6fd2f9 100644
--- a/libraries/rush-lib/src/schemas/command-line.schema.json
+++ b/libraries/rush-lib/src/schemas/command-line.schema.json
@@ -300,6 +300,7 @@
             "allowOversubscription": { "$ref": "#/definitions/anything" },
             "incremental": { "$ref": "#/definitions/anything" },
             "phases": { "$ref": "#/definitions/anything" },
+            "disableBuildCache": { "$ref": "#/definitions/anything" },
             "watchOptions": { "$ref": "#/definitions/anything" },
             "installOptions": { "$ref": "#/definitions/anything" }
           }

From f6f5b4eeb0f6653d65ecdefa6bcf7c8fd12390be Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 116/265] [rush-lib] Drain stdout and stderr before exiting on
 failure

Swarm integration step 101; original commit 9e56400fb5.
Refs: task 204.

Brings 204 (no branch in the shared repo, merged by hash). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 7 of 21. Gate: ch01 GATE OK board 4527 (tree 8c715ff8c7)

Commits folded into this step (1):
- 7d9ea1e0d6 [rush-lib] Drain stdout and stderr before exiting on failure (task 204)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...04-flush-before-exit_2026-09-29-05-08.json |  11 ++
 .../rush-lib/src/cli/RushCommandLineParser.ts |   7 +-
 ...RushCommandLineParserReporterClose.test.ts |  47 +++++++
 .../rush-lib/src/utilities/streamUtilities.ts |  51 +++++++
 .../utilities/test/streamUtilities.test.ts    | 132 ++++++++++++++++++
 5 files changed, 247 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-o05-t204-flush-before-exit_2026-09-29-05-08.json
 create mode 100644 libraries/rush-lib/src/utilities/streamUtilities.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/streamUtilities.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-o05-t204-flush-before-exit_2026-09-29-05-08.json b/common/changes/@microsoft/rush/swarm-o05-t204-flush-before-exit_2026-09-29-05-08.json
new file mode 100644
index 0000000000..cb3d4d31dd
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-o05-t204-flush-before-exit_2026-09-29-05-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a command fails, Rush now waits for stdout and stderr to accept the output already written to them before it calls `process.exit()`. Before, when stdout was a pipe that was read more slowly than Rush wrote to it, the reader lost the end of the output, including the summary of the failed operations. If the reader closes the pipe while Rush waits, Rush still exits with the command's exit code.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/RushCommandLineParser.ts b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
index 70bbe7d2c8..3f8f430391 100644
--- a/libraries/rush-lib/src/cli/RushCommandLineParser.ts
+++ b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
@@ -74,6 +74,7 @@ import { RushAlerts } from '../utilities/RushAlerts';
 import { getEngineJsonFileLoadCache, type JsonFileLoadCache } from '../utilities/JsonFileLoadCache';
 import { initializeDotEnv } from '../logic/dotenv';
 import { measureAsyncFn } from '../utilities/performance';
+import { waitForStreamsToFlushAsync } from '../utilities/streamUtilities';
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
 import {
   _correlateRushSessionError,
@@ -830,7 +831,11 @@ export class RushCommandLineParser extends CommandLineParser {
     if (telemetryFlushAsync) {
       pendingFlushes.push(telemetryFlushAsync);
     }
-    void Promise.allSettled(pendingFlushes).then(handleExit);
+    // process.exit() discards output that a pipe hasn't accepted yet, such as the end of a failed build's
+    // log and its summary when the reader is slower than Rush.
+    void Promise.allSettled(pendingFlushes)
+      .then(() => waitForStreamsToFlushAsync([process.stdout, process.stderr]))
+      .finally(handleExit);
   }
 
   #reportInitializationErrorAndSetExitCode(error: Error): void {
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts
index e8a2925931..bb6b5e7ceb 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserReporterClose.test.ts
@@ -118,6 +118,53 @@ describe('RushCommandLineParser reporter close', () => {
     expect(exitSpy).toHaveBeenCalledWith(1);
   });
 
+  it('waits for queued stdout and stderr output before an explicit parser exit', async () => {
+    const streams: NodeJS.WriteStream[] = [process.stdout, process.stderr];
+    const flushCallbacks: Map<NodeJS.WriteStream, () => void> = new Map();
+    for (const stream of streams) {
+      // Writable.prototype.writableLength isn't configurable, so jest can't spy on it; shadow it instead.
+      Object.defineProperty(stream, 'writableLength', { configurable: true, get: () => 100 });
+      jest.spyOn(stream, 'write').mockImplementation(((chunk: unknown, callback?: () => void): boolean => {
+        if (chunk === '' && callback) {
+          flushCallbacks.set(stream, callback);
+        }
+        return true;
+      }) as typeof stream.write);
+    }
+
+    try {
+      const parser: RushCommandLineParser = new RushCommandLineParser({
+        cwd: `${__dirname}/repo`,
+        reporterCloseAsync: async () => undefined
+      });
+      jest
+        .spyOn(parser.pluginManager, 'tryInitializeUnassociatedPluginsAsync')
+        .mockRejectedValue(new Error('parser failed'));
+      const exitSpy: jest.SpyInstance<never, [code?: string | number | null | undefined]> = jest
+        .spyOn(process, 'exit')
+        .mockImplementation(() => undefined as never);
+      jest.spyOn(console, 'error').mockImplementation(() => undefined);
+
+      await expect(parser.executeAsync(['build'])).resolves.toBe(false);
+      await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+
+      expect(flushCallbacks.size).toBe(2);
+      expect(exitSpy).not.toHaveBeenCalled();
+
+      flushCallbacks.get(process.stdout)!();
+      await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+      expect(exitSpy).not.toHaveBeenCalled();
+
+      flushCallbacks.get(process.stderr)!();
+      await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+      expect(exitSpy).toHaveBeenCalledWith(1);
+    } finally {
+      for (const stream of streams) {
+        Reflect.deleteProperty(stream, 'writableLength');
+      }
+    }
+  });
+
   it('does not execute after an initialization failure', async () => {
     let resolveClose: (() => void) | undefined;
     const closeAsync: jest.Mock<Promise<void>, []> = jest.fn(
diff --git a/libraries/rush-lib/src/utilities/streamUtilities.ts b/libraries/rush-lib/src/utilities/streamUtilities.ts
new file mode 100644
index 0000000000..34852864bd
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/streamUtilities.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * The members of a writable stream that {@link waitForStreamsToFlushAsync} uses.
+ */
+export interface IFlushableStream {
+  readonly writable: boolean;
+  readonly writableLength: number;
+  write(chunk: string, callback: () => void): boolean;
+  once(event: 'error', listener: () => void): unknown;
+  removeListener(event: 'error', listener: () => void): unknown;
+}
+
+/**
+ * Resolves once each stream has handed the output already written to it to the operating system,
+ * or has failed.
+ *
+ * @remarks
+ * On POSIX, Node.js writes to a pipe asynchronously, and `process.exit()` discards the output that
+ * is still queued. Call this before `process.exit()`, or a reader that reads more slowly than the
+ * process writes loses the end of the output, for example the summary of a failed build.
+ *
+ * A stream can fail while this waits, for example with EPIPE when its reader closes the pipe. This
+ * handles the stream's `error` event, which would otherwise end the process as an uncaught exception
+ * instead of letting the caller exit with its own exit code.
+ */
+export async function waitForStreamsToFlushAsync(streams: Iterable<IFlushableStream>): Promise<void> {
+  const pendingWrites: Promise<void>[] = [];
+  for (const stream of streams) {
+    if (stream.writable && stream.writableLength > 0) {
+      pendingWrites.push(
+        new Promise<void>((resolve: () => void) => {
+          const onError = (): void => resolve();
+          stream.once('error', onError);
+          // A stream finishes its writes in order, so the callback of this empty write runs after the
+          // output queued before it has been written. If the stream fails, the callback runs before the
+          // stream emits `error`, so a stream that can no longer be written keeps the listener.
+          stream.write('', () => {
+            if (stream.writable) {
+              stream.removeListener('error', onError);
+            }
+            resolve();
+          });
+        })
+      );
+    }
+  }
+
+  await Promise.all(pendingWrites);
+}
diff --git a/libraries/rush-lib/src/utilities/test/streamUtilities.test.ts b/libraries/rush-lib/src/utilities/test/streamUtilities.test.ts
new file mode 100644
index 0000000000..e6875ff087
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/streamUtilities.test.ts
@@ -0,0 +1,132 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { EventEmitter } from 'node:events';
+import { Writable } from 'node:stream';
+
+import { type IFlushableStream, waitForStreamsToFlushAsync } from '../streamUtilities';
+
+class FakeStream extends EventEmitter implements IFlushableStream {
+  public writable: boolean = true;
+  public writableLength: number;
+  public readonly writeCallbacks: (() => void)[] = [];
+
+  public constructor(writableLength: number) {
+    super();
+    this.writableLength = writableLength;
+  }
+
+  public write(chunk: string, callback: () => void): boolean {
+    this.writeCallbacks.push(callback);
+    return true;
+  }
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => {
+      settled = true;
+    },
+    () => {
+      settled = true;
+    }
+  );
+  await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+  return settled;
+}
+
+describe(waitForStreamsToFlushAsync.name, () => {
+  it('does not write to a stream that has nothing queued', async () => {
+    const stream: FakeStream = new FakeStream(0);
+
+    await expect(waitForStreamsToFlushAsync([stream])).resolves.toBeUndefined();
+
+    expect(stream.writeCallbacks).toHaveLength(0);
+  });
+
+  it('does not write to a stream that can no longer be written', async () => {
+    const stream: FakeStream = new FakeStream(100);
+    stream.writable = false;
+
+    await expect(waitForStreamsToFlushAsync([stream])).resolves.toBeUndefined();
+
+    expect(stream.writeCallbacks).toHaveLength(0);
+  });
+
+  it('waits until each stream with queued output has written it', async () => {
+    const stdout: FakeStream = new FakeStream(100);
+    const stderr: FakeStream = new FakeStream(20);
+    const idle: FakeStream = new FakeStream(0);
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stdout, stderr, idle]);
+
+    expect(stdout.writeCallbacks).toHaveLength(1);
+    expect(stderr.writeCallbacks).toHaveLength(1);
+    expect(idle.writeCallbacks).toHaveLength(0);
+    stdout.writeCallbacks[0]();
+    await expect(isSettledAsync(flush)).resolves.toBe(false);
+    stderr.writeCallbacks[0]();
+    await expect(flush).resolves.toBeUndefined();
+    expect(stdout.listenerCount('error')).toBe(0);
+    expect(stderr.listenerCount('error')).toBe(0);
+  });
+
+  it('handles the error event of a stream that fails while it waits', async () => {
+    const stream: FakeStream = new FakeStream(100);
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stream]);
+    // A Node.js stream that fails runs its pending write callbacks first, then emits 'error'.
+    stream.writable = false;
+    stream.writeCallbacks[0]();
+
+    await expect(flush).resolves.toBeUndefined();
+    expect(() => stream.emit('error', new Error('write EPIPE'))).not.toThrow();
+    expect(stream.listenerCount('error')).toBe(0);
+  });
+
+  it('waits for the writes that a Node.js stream has not finished', async () => {
+    const written: string[] = [];
+    const finishWrites: (() => void)[] = [];
+    const stream: Writable = new Writable({
+      write(chunk: Buffer, encoding: BufferEncoding, callback: () => void): void {
+        written.push(chunk.toString());
+        finishWrites.push(() => callback());
+      }
+    });
+    stream.write('first');
+    stream.write('second');
+    expect(stream.writableLength).toBe('firstsecond'.length);
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stream]);
+
+    finishWrites.shift()!();
+    await expect(isSettledAsync(flush)).resolves.toBe(false);
+    finishWrites.shift()!();
+    await expect(isSettledAsync(flush)).resolves.toBe(false);
+    expect(written).toEqual(['first', 'second', '']);
+    finishWrites.shift()!();
+    await expect(flush).resolves.toBeUndefined();
+    expect(stream.writableLength).toBe(0);
+    expect(stream.listenerCount('error')).toBe(0);
+  });
+
+  it('handles the error that a Node.js stream emits after it fails a queued write', async () => {
+    const finishWrites: ((error?: Error) => void)[] = [];
+    const stream: Writable = new Writable({
+      write(chunk: Buffer, encoding: BufferEncoding, callback: (error?: Error) => void): void {
+        finishWrites.push(callback);
+      }
+    });
+    stream.write('queued');
+
+    const flush: Promise<void> = waitForStreamsToFlushAsync([stream]);
+    finishWrites.shift()!(new Error('write EPIPE'));
+
+    await expect(flush).resolves.toBeUndefined();
+    // The stream emits 'error' on a later tick. Without a listener, that is an uncaught exception.
+    await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+    expect(stream.destroyed).toBe(true);
+    expect(stream.listenerCount('error')).toBe(0);
+  });
+});

From 5c91d8984129d9b1a1ed09c0cec7d0cdf4ca72e1 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 117/265] [package-deps-hash] Compare the content of Git
 configuration files in RepoStateCache

Swarm integration step 102; original commit 896e68fa9c (merge of swarm/r07-t194 at 20f59f1515).
Scope: task 194.

Brings 194 (branch swarm/r07-t194). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 8 of 21. Gate: ch01 GATE OK board 4527 (tree b2e35929ff)

Commits folded into this step (1):
- 20f59f1515 [package-deps-hash] Compare the content of Git configuration files in RepoStateCache

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t-config-fingerprint_2026-09-29-04-55.json |  11 ++
 libraries/package-deps-hash/src/FileStamp.ts  |  35 +++++
 .../package-deps-hash/src/RepoStateCache.ts   | 121 ++++++++++++++++--
 .../src/test/FileStamp.test.ts                |  49 +++++++
 .../src/test/RepoStateCache.test.ts           | 107 ++++++++++++++++
 5 files changed, 311 insertions(+), 12 deletions(-)
 create mode 100644 common/changes/@rushstack/package-deps-hash/content-config-fingerprint_2026-09-29-04-55.json
 create mode 100644 libraries/package-deps-hash/src/test/FileStamp.test.ts

diff --git a/common/changes/@rushstack/package-deps-hash/content-config-fingerprint_2026-09-29-04-55.json b/common/changes/@rushstack/package-deps-hash/content-config-fingerprint_2026-09-29-04-55.json
new file mode 100644
index 0000000000..9a5e100ee7
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/content-config-fingerprint_2026-09-29-04-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "`RepoStateCache` now compares the content of the Git configuration and attributes files, not their timestamps, so a file that Git rewrites with the same content, for example the repository's configuration when `git branch -D` deletes a branch, no longer makes the next calls copy the Git index and hash files again. A missing file counts as an empty one. The cache still copies the index again after a call during which one of these files may have been written.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/FileStamp.ts b/libraries/package-deps-hash/src/FileStamp.ts
index aa3b0c68bd..932349543c 100644
--- a/libraries/package-deps-hash/src/FileStamp.ts
+++ b/libraries/package-deps-hash/src/FileStamp.ts
@@ -14,6 +14,41 @@ import type * as fs from 'node:fs';
  */
 export const SETTLED_FILE_AGE_MS: number = 3000;
 
+/**
+ * A write gets a newer ctime than a file's last change this many milliseconds earlier, on a filesystem whose
+ * timestamps have a fine granularity. It allows for a jiffy on Linux, and for the lag of the kernel's coarse clock
+ * behind this process's clock.
+ */
+const FINE_TIMESTAMP_MARGIN_MS: number = 100;
+
+/**
+ * Timestamps that are whole multiples of 10 milliseconds may come from a filesystem whose timestamps have a coarse
+ * granularity, such as FAT. Other timestamps have a fine granularity.
+ */
+const COARSE_TIMESTAMP_UNIT_NS: bigint = BigInt(1e7);
+
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1e6);
+
+/**
+ * Whether any write to a file made at or after `timeNs` changes the stamp of the file from the stamp of `stats`.
+ *
+ * @remarks
+ * Every write updates the file's ctime, and userspace can't set it. The write gets a newer ctime unless the file's
+ * last change falls within the granularity of the filesystem's timestamps before it.
+ */
+export function revealsWriteAfter(stats: fs.BigIntStats, timeNs: bigint): boolean {
+  const marginMs: number =
+    stats.ctimeNs % COARSE_TIMESTAMP_UNIT_NS === BigInt(0) ? SETTLED_FILE_AGE_MS : FINE_TIMESTAMP_MARGIN_MS;
+  return stats.ctimeNs < timeNs - BigInt(marginMs) * NANOSECONDS_PER_MILLISECOND;
+}
+
+/**
+ * The current time, in nanoseconds since the epoch, to compare with the times of files.
+ */
+export function getTimeNs(): bigint {
+  return BigInt(Date.now()) * NANOSECONDS_PER_MILLISECOND;
+}
+
 /**
  * The ctime and mtime a file must be older than for its stamp to be memoized. Take it before examining any of
  * the files, so that a write made after a file's examination gets a later ctime.
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index 987422c033..a9fd614ae0 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -7,7 +7,13 @@ import * as path from 'node:path';
 
 import { FileSystem } from '@rushstack/node-core-library/lib/FileSystem';
 
-import { getFileStamp, getSettledBeforeNs, isFileStatSettled } from './FileStamp';
+import {
+  getFileStamp,
+  getSettledBeforeNs,
+  getTimeNs,
+  isFileStatSettled,
+  revealsWriteAfter
+} from './FileStamp';
 import {
   type IGitIndexSummary,
   summarizeGitIndex,
@@ -58,6 +64,7 @@ const INDEX_HEADER_LENGTH: number = 12;
 const NANOSECONDS_PER_SECOND: bigint = BigInt(1e9);
 const PRIVATE_FOLDER_PREFIX: string = 'package-deps-hash-';
 const PRIVATE_INDEX_NAME: string = 'index';
+const EMPTY_CONTENT: Buffer = Buffer.alloc(0);
 const ATTRIBUTES_FILE_NAME: string = '.gitattributes';
 
 // Unlike the other commands, "git status" doesn't pass "--no-optional-locks", so that it can save its refreshed
@@ -83,6 +90,23 @@ interface IGitPaths {
   readonly configurationPaths: ReadonlyArray<string>;
 }
 
+interface IConfigurationFile {
+  readonly path: string;
+  /**
+   * The content of the file. Git reads a missing file as an empty one, and ignores one that it can't read, if it
+   * doesn't fail.
+   */
+  readonly content: Buffer;
+  /**
+   * The stamp of the file when the call read it, or the code of the error that prevented examining it.
+   */
+  readonly stamp: string;
+  /**
+   * Whether any later write to the file changes its stamp.
+   */
+  readonly revealsLaterWrite: boolean;
+}
+
 interface IPrivateIndex {
   readonly path: string;
   readonly entryCount: number;
@@ -153,9 +177,11 @@ function noop(): void {}
  * A call may return the same state as an earlier call, so the state must not be modified.
  *
  * The state also depends on the attributes and configuration of Git, under which `git status` refreshed the copy.
- * The index is copied again, and the files hashed again, when the repository's configuration or `info/attributes`
- * file changes, or when the user's `.gitconfig` file or the Git configuration or attributes file in the user's
- * configuration folder changes. The index is copied again when a `.gitattributes` file changes that `git status`
+ * The index is copied again, and the files hashed again, when the content of the repository's configuration or
+ * `info/attributes` file changes, or of the user's `.gitconfig` file or the Git configuration or attributes file in
+ * the user's configuration folder, or when one of these files may have been written during the previous call, while
+ * Git read it. A file that is rewritten with the same content, as `git branch -D` rewrites the configuration of the
+ * repository, isn't a change. The index is copied again when a `.gitattributes` file changes that `git status`
  * lists as modified or untracked, or that is in a folder that contains a filter path; the call that detects the
  * change computes the state without the cache. The index is also copied again when the filter changes. Changes to
  * the system configuration, to a configuration file included by another, to a custom `core.attributesFile`, or to
@@ -181,7 +207,10 @@ export class RepoStateCache {
   #privateIndex: IPrivateIndex | undefined;
   #tree: ITree | undefined;
   #previousResult: IResult | undefined;
-  #configurationFingerprint: string = '';
+  /**
+   * The configuration files as the last call read them, if Git read the same versions of them during that call
+   */
+  #configurationFiles: ReadonlyArray<IConfigurationFile> | undefined;
   #unsettledFingerprintCount: number = 0;
   readonly #fileHashes: Map<string, IFileHash> = new Map();
 
@@ -238,6 +267,7 @@ export class RepoStateCache {
         return state;
       }
 
+      this.#checkConfigurationFiles();
       if (state) {
         this.#consecutiveFailureCount = 0;
         return state;
@@ -269,13 +299,12 @@ export class RepoStateCache {
     const settledBeforeNs: bigint = getSettledBeforeNs();
     const gitPaths: IGitPaths = await this.#getGitPathsAsync();
     const filterKey: string = JSON.stringify(filterPath ?? []);
-    const configurationFingerprint: string = this.#getFingerprint(
-      gitPaths.configurationPaths,
-      settledBeforeNs
-    );
-    const hasConfigurationChanged: boolean = configurationFingerprint !== this.#configurationFingerprint;
+    const configurationFiles: IConfigurationFile[] = readConfigurationFiles(gitPaths.configurationPaths);
+    // Only the content counts. Git rewrites a configuration file with the same content, for example when
+    // "git branch -D" deletes a branch.
+    const hasConfigurationChanged: boolean = !haveSameContent(this.#configurationFiles, configurationFiles);
+    this.#configurationFiles = configurationFiles;
     if (hasConfigurationChanged) {
-      this.#configurationFingerprint = configurationFingerprint;
       this.#fileHashes.clear();
     }
 
@@ -712,6 +741,21 @@ export class RepoStateCache {
     return isFileStatSettled(stats, settledBeforeNs) ? getFileStamp(stats) : undefined;
   }
 
+  /**
+   * Git reads the configuration files while a call runs. If one of them may have been written since the call read
+   * it, Git may have read another version of it, so the next call treats the configuration as changed.
+   */
+  #checkConfigurationFiles(): void {
+    if (
+      this.#configurationFiles?.some(
+        ({ path: filePath, stamp, revealsLaterWrite }: IConfigurationFile) =>
+          !revealsLaterWrite || getStampOrErrorStamp(filePath) !== stamp
+      )
+    ) {
+      this.#configurationFiles = undefined;
+    }
+  }
+
   /**
    * Identifies the versions of the files. A file that changed recently gets a fingerprint that matches no other.
    */
@@ -755,7 +799,7 @@ export class RepoStateCache {
     this.#privateIndex = undefined;
     this.#tree = undefined;
     this.#previousResult = undefined;
-    this.#configurationFingerprint = '';
+    this.#configurationFiles = undefined;
     this.#fileHashes.clear();
     // Start over in a new folder, in case something deleted this one
     if (this.#privateFolderPath) {
@@ -858,6 +902,59 @@ function getParentFolderPath(relativePath: string): string {
   return separatorIndex < 0 ? '' : relativePath.slice(0, separatorIndex);
 }
 
+function readConfigurationFiles(filePaths: ReadonlyArray<string>): IConfigurationFile[] {
+  // Take the time before examining any of the files, so that a write made after a file's examination is later
+  const timeNs: bigint = getTimeNs();
+  return filePaths.map((filePath: string) => readConfigurationFile(filePath, timeNs));
+}
+
+function readConfigurationFile(filePath: string, timeNs: bigint): IConfigurationFile {
+  let stats: fs.BigIntStats;
+  try {
+    stats = fs.statSync(filePath, { bigint: true });
+  } catch (error) {
+    // Creating the file changes its stamp
+    return { path: filePath, content: EMPTY_CONTENT, stamp: getErrorStamp(error), revealsLaterWrite: true };
+  }
+
+  let content: Buffer = EMPTY_CONTENT;
+  try {
+    content = fs.readFileSync(filePath);
+  } catch {
+    // For example, a folder in place of the file
+  }
+
+  return {
+    path: filePath,
+    content,
+    stamp: getFileStamp(stats),
+    revealsLaterWrite: revealsWriteAfter(stats, timeNs)
+  };
+}
+
+function getStampOrErrorStamp(filePath: string): string {
+  try {
+    return getFileStamp(fs.statSync(filePath, { bigint: true }));
+  } catch (error) {
+    return getErrorStamp(error);
+  }
+}
+
+function getErrorStamp(error: unknown): string {
+  return `!${(error as NodeJS.ErrnoException).code}`;
+}
+
+function haveSameContent(
+  previousFiles: ReadonlyArray<IConfigurationFile> | undefined,
+  files: ReadonlyArray<IConfigurationFile>
+): boolean {
+  // Both lists have a file for each of the same configuration paths, in the same order
+  return (
+    previousFiles?.length === files.length &&
+    files.every(({ content }: IConfigurationFile, i: number) => content.equals(previousFiles[i].content))
+  );
+}
+
 /**
  * Lists the attributes files that affect how "git status" refreshes the files within the filter: those that it
  * lists as modified or untracked, and those in the folders that contain the filter paths, which it doesn't list.
diff --git a/libraries/package-deps-hash/src/test/FileStamp.test.ts b/libraries/package-deps-hash/src/test/FileStamp.test.ts
new file mode 100644
index 0000000000..1b998051c1
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/FileStamp.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+
+import { getTimeNs, revealsWriteAfter } from '../FileStamp';
+
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1e6);
+
+function getStats(ctimeNs: bigint): fs.BigIntStats {
+  return { ctimeNs } as fs.BigIntStats;
+}
+
+function afterMs(timeNs: bigint, milliseconds: number, nanoseconds: number = 0): bigint {
+  return timeNs + BigInt(milliseconds) * NANOSECONDS_PER_MILLISECOND + BigInt(nanoseconds);
+}
+
+describe(revealsWriteAfter.name, () => {
+  it('reveals a write made more than 100 ms after the last change of a file with fine timestamps', () => {
+    const ctimeNs: bigint = BigInt('1790000000123456789');
+    const stats: fs.BigIntStats = getStats(ctimeNs);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 100, 1))).toBe(true);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 3000))).toBe(true);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 100))).toBe(false);
+    expect(revealsWriteAfter(stats, afterMs(ctimeNs, 50))).toBe(false);
+    expect(revealsWriteAfter(stats, ctimeNs)).toBe(false);
+  });
+
+  it('reveals a write made more than 3 s after the last change of a file whose timestamps may be coarse', () => {
+    // Whole seconds, as on a filesystem that records seconds, and whole multiples of 10 ms
+    for (const ctimeNs of [BigInt('1790000000000000000'), BigInt('1790000000120000000')]) {
+      const stats: fs.BigIntStats = getStats(ctimeNs);
+      expect(revealsWriteAfter(stats, afterMs(ctimeNs, 3000, 1))).toBe(true);
+      expect(revealsWriteAfter(stats, afterMs(ctimeNs, 3000))).toBe(false);
+      expect(revealsWriteAfter(stats, afterMs(ctimeNs, 100, 1))).toBe(false);
+    }
+  });
+});
+
+describe(getTimeNs.name, () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('returns the current time in nanoseconds', () => {
+    jest.spyOn(Date, 'now').mockReturnValue(1790000000123);
+    expect(getTimeNs()).toBe(BigInt('1790000000123000000'));
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
index 6f7799802d..33b8872d35 100644
--- a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -709,6 +709,113 @@ describe(RepoStateCache.name, () => {
     expect(state.files.get('a.txt')).toBe(hashText('modified\n'));
   });
 
+  it('reuses the copy of the index and the hashes when Git rewrites its configuration with the same content', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    const configurationPath: string = path.join(repoPath, '.git', 'config');
+    const { ino } = fs.statSync(configurationPath);
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git writes a new file with the same content when it deletes a branch that has no configuration
+    runGit('branch', 'other');
+    runGit('branch', '-D', 'other');
+    expect(fs.statSync(configurationPath).ino).not.toBe(ino);
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('reuses the copy of the index when a missing configuration file is created empty', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+
+    // Git reads a missing file as an empty one
+    writeFile('.git/info/attributes', '');
+    takeGitCommands();
+    const state: IDetailedRepoState = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('reads a configuration file that cannot be read as an empty one, as Git does', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\n');
+    // Git ignores a folder in place of the file
+    const attributesPath: string = path.join(repoPath, '.git', 'info', 'attributes');
+    fs.mkdirSync(attributesPath, { recursive: true });
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    takeGitCommands();
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+
+    fs.rmdirSync(attributesPath);
+    writeFile('.git/info/attributes', '');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).not.toHaveBeenCalled();
+    expect(takeGitCommandNames()).toEqual(['status']);
+  });
+
+  it('hashes files again when a configuration file changes during a call, even if it changes back', async () => {
+    settleFiles();
+    writeFile('a.txt', 'modified\r\n');
+    await getStateAsync();
+    const configurationPath: string = path.join(repoPath, '.git', 'config');
+    const configuration: Buffer = fs.readFileSync(configurationPath);
+    // The next call hashes the file under another configuration, which is gone again when the call ends
+    writeFile('a.txt', 'changed\r\n');
+    beforeSpawn = ({ command }: IGitCommand) => {
+      if (command === 'hash-object') {
+        runGit('config', 'core.autocrlf', 'true');
+      }
+    };
+    afterSpawn = ({ command }: IGitCommand, childProcess: ChildProcess) => {
+      if (command === 'hash-object') {
+        childProcess.once('exit', () => fs.writeFileSync(configurationPath, configuration));
+      }
+    };
+    let state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('a.txt')).toBe(hashText('changed\n'));
+    expect(fs.readFileSync(configurationPath)).toEqual(configuration);
+
+    beforeSpawn = undefined;
+    afterSpawn = undefined;
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    takeGitCommands();
+    state = await getStateAsync();
+    await expectUncachedStateAsync(state);
+    expect(state.files.get('a.txt')).toBe(hashText('changed\r\n'));
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+    expect(takeGitCommandNames()).toEqual(['hash-object', 'status']);
+  });
+
+  it('copies the index again after a call that started while a configuration file could change unseen', async () => {
+    const configurationPath: string = path.join(repoPath, '.git', 'config');
+    const changeTimeMs: number = Number(
+      fs.statSync(configurationPath, { bigint: true }).ctimeNs / BigInt(1e6)
+    );
+    // A write right after the last change might not change the stamp of the file
+    const dateNowSpy: jest.SpyInstance = jest.spyOn(Date, 'now').mockReturnValue(changeTimeMs + 50);
+    await getStateAsync();
+    const writeFileSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'writeFile');
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(1);
+
+    // Any later write changes the stamp, so the call after the next one reuses the copy
+    dateNowSpy.mockReturnValue(changeTimeMs + 5000);
+    await getStateAsync();
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+    await expectUncachedStateAsync(await getStateAsync());
+    expect(writeFileSpy).toHaveBeenCalledTimes(2);
+  });
+
   it('reads the index again while its stamp may still change', async () => {
     settleFiles();
     const summarizeSpy: jest.SpyInstance = jest.spyOn(GitIndexFile, 'summarizeGitIndex');

From 10ce36577884089f6ddbcff6ca90dcf053beeba3 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 118/265] [rush-daemon] Take the inputs snapshot while
 validating the graph inputs

Swarm integration step 103; original commit 337fc5fb97 (merge of swarm/r07-t212 at 1dccd5c6f1).
Scope: task 212.

Brings 212 (branch swarm/r07-t212). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 9 of 21. Gate: ch01 GATE OK board 4527 (tree 8552dfca4d)

Commits folded into this step (3):
- 9a551270e8 [package-deps-hash] Start "git status" before examining the additional files
- a1ddac7181 [rush-lib] Read the repository state while checking a long-lived engine's graph inputs
- 1dccd5c6f1 [rush-daemon] Take the inputs snapshot while validating the graph inputs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...apshot-during-checks_2026-09-29-05-45.json |  11 +
 .../git-status-first_2026-09-29-05-45.json    |  11 +
 ...ot-during-validation_2026-09-29-05-45.json |  11 +
 .../package-deps-hash/src/RepoStateCache.ts   |   6 +-
 .../src/test/RepoStateCache.test.ts           |  17 ++
 .../src/WorkspaceEngineComponentFactory.ts    |  34 ++-
 .../WorkspaceEngineComponentFactory.test.ts   | 197 ++++++++++++++++++
 .../cli/scriptActions/PhasedScriptAction.ts   |  32 +--
 .../src/utilities/runDuringChecksAsync.ts     |  29 +++
 .../test/runDuringChecksAsync.test.ts         | 103 +++++++++
 10 files changed, 430 insertions(+), 21 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/inputs-snapshot-during-checks_2026-09-29-05-45.json
 create mode 100644 common/changes/@rushstack/package-deps-hash/git-status-first_2026-09-29-05-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/inputs-snapshot-during-validation_2026-09-29-05-45.json
 create mode 100644 libraries/rush-lib/src/utilities/runDuringChecksAsync.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts

diff --git a/common/changes/@microsoft/rush/inputs-snapshot-during-checks_2026-09-29-05-45.json b/common/changes/@microsoft/rush/inputs-snapshot-during-checks_2026-09-29-05-45.json
new file mode 100644
index 0000000000..b02bd52f2a
--- /dev/null
+++ b/common/changes/@microsoft/rush/inputs-snapshot-during-checks_2026-09-29-05-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a long-lived process such as the Rush daemon takes a new snapshot of the repository's inputs, Git now reads the repository while Rush checks the installation and the configuration of each project, instead of after these checks. If a check fails, Rush still reports its error, after Git finishes.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/package-deps-hash/git-status-first_2026-09-29-05-45.json b/common/changes/@rushstack/package-deps-hash/git-status-first_2026-09-29-05-45.json
new file mode 100644
index 0000000000..53c634fe11
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/git-status-first_2026-09-29-05-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "`RepoStateCache` now starts `git status` before it examines the additional files to hash, instead of after them. The removal of a lock file that an interrupted `git status` left behind was asynchronous, so it finished only after the additional files were examined. In a large repository, this made each call wait tens of milliseconds longer.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/inputs-snapshot-during-validation_2026-09-29-05-45.json b/common/changes/@rushstack/rush-daemon/inputs-snapshot-during-validation_2026-09-29-05-45.json
new file mode 100644
index 0000000000..b98280552c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/inputs-snapshot-during-validation_2026-09-29-05-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a request refreshes the workspace inputs, the daemon now takes the inputs snapshot while it validates the inputs that define the operation graph, instead of after the validation. If the validation fails, the daemon waits for the snapshot to finish and discards it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index a9fd614ae0..c8014de8e1 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -423,8 +423,10 @@ export class RepoStateCache {
   ): Promise<[ITree | undefined, string]> {
     const currentTree: ITree | undefined = this.#tree;
     let treePromise: Promise<ITree>;
-    // An interrupted "git status" may have left its lock file behind, which would stop the next one from saving
-    await fs.promises.rm(`${privateIndex.path}.lock`, { force: true });
+    // An interrupted "git status" may have left its lock file behind, which would stop the next one from saving.
+    // Remove it synchronously, so that Git starts at once: an asynchronous removal would finish only after the
+    // caller examined the additional files, which it starts to do meanwhile.
+    fs.rmSync(`${privateIndex.path}.lock`, { force: true });
     if (currentTree?.filterKey === filterKey) {
       treePromise = Promise.resolve(currentTree);
     } else {
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
index 33b8872d35..0da5d133cd 100644
--- a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -937,6 +937,23 @@ describe(RepoStateCache.name, () => {
     expect(fs.readFileSync(getPrivateIndexPath())).not.toEqual(privateIndexContent);
   });
 
+  it('starts "git status" before it examines the additional files', async () => {
+    const additionalPaths: string[] = ['b.txt', 'dir/c.txt'];
+    await getStateAsync(additionalPaths);
+    const lstatSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'lstat');
+    let lstatCallCountAtStatus: number | undefined;
+    beforeSpawn = ({ command, usesPrivateIndex }: IGitCommand) => {
+      if (command === 'status' && usesPrivateIndex) {
+        lstatCallCountAtStatus = lstatSpy.mock.calls.length;
+      }
+    };
+
+    const state: IDetailedRepoState = await getStateAsync(additionalPaths);
+    expect(lstatCallCountAtStatus).toBe(0);
+    expect(lstatSpy).toHaveBeenCalledTimes(additionalPaths.length);
+    await expectUncachedStateAsync(state, additionalPaths);
+  });
+
   it('lets "git status" save the copy of the index when the environment disables optional locks', async () => {
     const optionalLocks: string | undefined = process.env.GIT_OPTIONAL_LOCKS;
     process.env.GIT_OPTIONAL_LOCKS = '0';
diff --git a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
index 9b34180ea6..bb9cb462b2 100644
--- a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
+++ b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
@@ -168,7 +168,13 @@ export interface IWorkspaceEngineComponentFactoryOptions {
   readonly isEngineRecreationRequiredAsync?: IsWorkspaceEngineRecreationRequiredAsync;
   readonly mapInvalidationsToOperationsAsync: MapWorkspaceInvalidationsToOperationsAsync;
   readonly shape: IWorkspaceEngineShape;
-  /** Refresh inputs even without a watcher notification (for request-time freshness). */
+  /**
+   * Refresh inputs even without a watcher notification (for request-time freshness).
+   *
+   * @remarks
+   * The inputs snapshot is then taken while the graph inputs are validated. If the validation fails, the
+   * reconciliation waits for the snapshot to finish, and discards it.
+   */
   readonly refreshInputsOnEveryRequest?: boolean;
   /** Authoritative graph-definition validation, awaited on every reconciliation before trusting path hints. */
   readonly validateGraphInputsAsync?: () => Promise<void>;
@@ -242,10 +248,27 @@ class WorkspaceEngineLifecycle {
   }
 
   async #reconcileOnceAsync(): Promise<IWorkspaceInvalidationReconciliation> {
-    await this.#validateGraphInputsAsync?.();
+    // Read before the inputs, so that the inputs snapshot includes each change that this reconciliation acknowledges
     const invalidationSnapshot: IWorkspaceInvalidationSnapshot = this.#invalidations.getSnapshot();
-    if (await this.#requiresEngineRecreationAsync(invalidationSnapshot)) {
-      throw new WorkspaceEngineRecreationRequiredError();
+    // A reconciliation that refreshes the inputs reads them in any case, so it reads them while the checks run
+    const nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined = this
+      .#refreshInputsOnEveryRequest
+      ? this.#components.getInputsSnapshotAsync()
+      : undefined;
+    // The snapshot may fail before the checks finish, which must not be reported as an unhandled rejection
+    const nextInputsSnapshotSettledPromise: Promise<void> | undefined = nextInputsSnapshotPromise?.then(
+      () => undefined,
+      () => undefined
+    );
+    try {
+      await this.#validateGraphInputsAsync?.();
+      if (await this.#requiresEngineRecreationAsync(invalidationSnapshot)) {
+        throw new WorkspaceEngineRecreationRequiredError();
+      }
+    } catch (error) {
+      // No command may still read the inputs once the reconciliation failed
+      await nextInputsSnapshotSettledPromise;
+      throw error;
     }
     const isFullInvalidation: boolean =
       this.#requiresFullInvalidation ||
@@ -264,7 +287,8 @@ class WorkspaceEngineLifecycle {
       };
     }
 
-    const nextInputsSnapshot: IInputsSnapshot | undefined = await this.#components.getInputsSnapshotAsync();
+    const nextInputsSnapshot: IInputsSnapshot | undefined =
+      await (nextInputsSnapshotPromise ?? this.#components.getInputsSnapshotAsync());
     if (!nextInputsSnapshot) {
       throw new Error('Rush could not capture the next workspace inputs snapshot.');
     }
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
index fe98bba0bd..2e5ddc5c41 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
@@ -21,6 +21,7 @@ import type {
   IClassifyWorkspaceInvalidationsOptions,
   ICreateWorkspaceEngineComponentsOptions,
   IMapWorkspaceInvalidationsOptions,
+  IWorkspaceEngineComponentFactoryOptions,
   IWorkspaceEngineComponents,
   IWorkspaceEngineShape
 } from '../WorkspaceEngineComponentFactory';
@@ -190,6 +191,36 @@ async function disposeComponentsAsync(components: IWorkspaceSessionComponents):
   await components[Symbol.asyncDispose]();
 }
 
+interface IDeferred<T> {
+  readonly promise: Promise<T>;
+  resolve(value: T): void;
+  reject(error: Error): void;
+}
+
+function createDeferred<T>(): IDeferred<T> {
+  let resolveDeferred!: (value: T) => void;
+  let rejectDeferred!: (error: Error) => void;
+  const promise: Promise<T> = new Promise<T>((resolve, reject) => {
+    resolveDeferred = resolve;
+    rejectDeferred = reject;
+  });
+  return { promise, resolve: resolveDeferred, reject: rejectDeferred };
+}
+
+// Lets every pending callback run, including those of timers
+function waitForTurnsAsync(): Promise<void> {
+  return new Promise((resolve: () => void) => setTimeout(resolve, 10));
+}
+
+function trackSettlement(promise: Promise<unknown>): { readonly isSettled: boolean } {
+  const state: { isSettled: boolean } = { isSettled: false };
+  const onSettled = (): void => {
+    state.isSettled = true;
+  };
+  void promise.then(onSettled, onSettled);
+  return state;
+}
+
 describe(WorkspaceEngineComponentFactory.name, () => {
   it('initializes exactly once through WorkspaceSession and reconciles startup conservatively', async () => {
     const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
@@ -730,4 +761,170 @@ describe(WorkspaceEngineComponentFactory.name, () => {
       })
     ).rejects.toThrow('is not declared in the workspace engine shape');
   });
+
+  describe('validation of the graph inputs', () => {
+    const CHANGED_PATH: string = 'libraries/a/src/index.ts';
+
+    async function createComponentsAsync(
+      engine: ITestEngine,
+      invalidations: WorkspaceInvalidationTracker,
+      options: Partial<IWorkspaceEngineComponentFactoryOptions>
+    ): Promise<IWorkspaceSessionComponents> {
+      const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
+        createEngineComponentsAsync: async () => engine.components,
+        mapInvalidationsToOperationsAsync: async () => [],
+        refreshInputsOnEveryRequest: true,
+        shape: {
+          phaseNames: [PHASE_NAME],
+          pluginNames: [PLUGIN_NAME]
+        },
+        ...options
+      });
+      return await factory.createAsync({ invalidations, rushConfiguration: TEST_RUSH_CONFIGURATION });
+    }
+
+    it('runs while the inputs snapshot is taken, if the inputs are refreshed on every request', async () => {
+      const events: string[] = [];
+      const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
+      const snapshot: IDeferred<IInputsSnapshot> = createDeferred();
+      const validation: IDeferred<void> = createDeferred();
+      const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, () => {
+        events.push('snapshot');
+        return snapshot.promise;
+      });
+      const components: IWorkspaceSessionComponents = await createComponentsAsync(
+        engine,
+        new WorkspaceInvalidationTracker(),
+        {
+          validateGraphInputsAsync: () => {
+            events.push('validation');
+            return validation.promise;
+          }
+        }
+      );
+
+      const reconciliationPromise: Promise<unknown> = getReconcileAsync(components)();
+      await waitForTurnsAsync();
+      expect(events).toEqual(['snapshot', 'validation']);
+      validation.resolve();
+      snapshot.resolve(nextSnapshot);
+      await expect(reconciliationPromise).resolves.toMatchObject({
+        inputsSnapshot: nextSnapshot,
+        isFullInvalidation: false
+      });
+      expect(components.inputsSnapshot).toBe(nextSnapshot);
+      await disposeComponentsAsync(components);
+    });
+
+    it('runs before the inputs snapshot is taken, if the inputs are not refreshed on every request', async () => {
+      const events: string[] = [];
+      const validation: IDeferred<void> = createDeferred();
+      const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, async () => {
+        events.push('snapshot');
+        return createInputsSnapshot('next');
+      });
+      const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+      invalidations.invalidate(CHANGED_PATH);
+      const components: IWorkspaceSessionComponents = await createComponentsAsync(engine, invalidations, {
+        refreshInputsOnEveryRequest: false,
+        validateGraphInputsAsync: () => {
+          events.push('validation');
+          return validation.promise;
+        }
+      });
+
+      const reconciliationPromise: Promise<unknown> = getReconcileAsync(components)();
+      await waitForTurnsAsync();
+      expect(events).toEqual(['validation']);
+      validation.resolve();
+      await reconciliationPromise;
+      expect(events).toEqual(['validation', 'snapshot']);
+      await disposeComponentsAsync(components);
+    });
+
+    it.each<[string, Partial<IWorkspaceEngineComponentFactoryOptions>]>([
+      [
+        'the graph inputs changed',
+        {
+          validateGraphInputsAsync: async (): Promise<void> => {
+            throw new WorkspaceEngineRecreationRequiredError();
+          }
+        }
+      ],
+      [
+        'a change requires a new engine',
+        {
+          isEngineRecreationRequiredAsync: async (): Promise<boolean> => true,
+          validateGraphInputsAsync: async (): Promise<void> => undefined
+        }
+      ]
+    ])(
+      'waits for the inputs snapshot if %s, and keeps the invalidations',
+      async (description: string, options: Partial<IWorkspaceEngineComponentFactoryOptions>) => {
+        const snapshot: IDeferred<IInputsSnapshot> = createDeferred();
+        const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, () => snapshot.promise);
+        const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+        invalidations.invalidate(CHANGED_PATH);
+        const components: IWorkspaceSessionComponents = await createComponentsAsync(
+          engine,
+          invalidations,
+          options
+        );
+
+        const reconciliationPromise: Promise<unknown> = getReconcileAsync(components)();
+        const reconciliation: { readonly isSettled: boolean } = trackSettlement(reconciliationPromise);
+        await waitForTurnsAsync();
+        expect(reconciliation.isSettled).toBe(false);
+        snapshot.reject(new Error('The inputs snapshot failed'));
+        await expect(reconciliationPromise).rejects.toBeInstanceOf(WorkspaceEngineRecreationRequiredError);
+        expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+        expect(invalidations.getSnapshot().changedPaths).toEqual([CHANGED_PATH]);
+        await disposeComponentsAsync(components);
+      }
+    );
+
+    it('handles an inputs snapshot that fails while it runs', async () => {
+      const onUnhandledRejection: jest.Mock = jest.fn();
+      process.on('unhandledRejection', onUnhandledRejection);
+      try {
+        const error: Error = new Error('The inputs snapshot failed');
+        const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, () =>
+          Promise.reject(error)
+        );
+        const components: IWorkspaceSessionComponents = await createComponentsAsync(
+          engine,
+          new WorkspaceInvalidationTracker(),
+          { validateGraphInputsAsync: waitForTurnsAsync }
+        );
+
+        await expect(getReconcileAsync(components)()).rejects.toBe(error);
+        expect(onUnhandledRejection).not.toHaveBeenCalled();
+        await disposeComponentsAsync(components);
+      } finally {
+        process.off('unhandledRejection', onUnhandledRejection);
+      }
+    });
+
+    it('acknowledges only the invalidations that precede the inputs snapshot', async () => {
+      const laterPath: string = 'libraries/b/src/index.ts';
+      const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+      invalidations.invalidate(CHANGED_PATH);
+      const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, async () => {
+        // Git may read the file before this change
+        invalidations.invalidate(laterPath);
+        return createInputsSnapshot('next');
+      });
+      const mapInvalidationsToOperationsAsync: jest.Mock = jest.fn(async () => []);
+      const components: IWorkspaceSessionComponents = await createComponentsAsync(engine, invalidations, {
+        mapInvalidationsToOperationsAsync,
+        validateGraphInputsAsync: async () => undefined
+      });
+
+      await getReconcileAsync(components)();
+      expect(mapInvalidationsToOperationsAsync).toHaveBeenCalledTimes(1);
+      expect(mapInvalidationsToOperationsAsync.mock.calls[0][0].changedPaths).toEqual([CHANGED_PATH]);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([laterPath]);
+      await disposeComponentsAsync(components);
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 5c84d7aabe..926aa0bb72 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -87,6 +87,7 @@ import { IgnoredParametersPlugin } from '../../logic/operations/IgnoredParameter
 import { TrimRushEnvironmentVariablesPlugin } from '../../logic/operations/TrimRushEnvironmentVariablesPlugin';
 import { DebugHashesPlugin } from '../../logic/operations/DebugHashesPlugin';
 import { measureAsyncFn, measureFn } from '../../utilities/performance';
+import { runDuringChecksAsync } from '../../utilities/runDuringChecksAsync';
 import { attachReporterOperationEventSink } from '../../logic/operations/ReporterOperationEventSink';
 import { _isRushSessionOperationStreamEnabled } from '../../pluginFramework/RushSession';
 
@@ -866,20 +867,23 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
 
       const getGraphInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined =
         onEngine && getInputsSnapshotAsync
-          ? async () => {
-              await this.#validateInstallStateAsync();
-              const currentConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
-                await this.#loadEngineProjectConfigurationsAsync(relevantProjects, terminal);
-              if (
-                (await getProjectConfigurationIdentityAsync(
-                  currentConfigurations,
-                  this.rushConfiguration.daemon.usePersistentIpcRunners
-                )) !== projectConfigurationIdentity
-              ) {
-                throw new PhasedCommandEngineConfigurationChangedError();
-              }
-              return await getInputsSnapshotAsync();
-            }
+          ? () =>
+              // Git reads the repository state while the configuration is checked
+              runDuringChecksAsync(getInputsSnapshotAsync, async () => {
+                await this.#validateInstallStateAsync();
+                const currentConfigurations: ReadonlyMap<
+                  RushConfigurationProject,
+                  RushProjectConfiguration
+                > = await this.#loadEngineProjectConfigurationsAsync(relevantProjects, terminal);
+                if (
+                  (await getProjectConfigurationIdentityAsync(
+                    currentConfigurations,
+                    this.rushConfiguration.daemon.usePersistentIpcRunners
+                  )) !== projectConfigurationIdentity
+                ) {
+                  throw new PhasedCommandEngineConfigurationChangedError();
+                }
+              })
           : getInputsSnapshotAsync;
       const graphOptions: IOperationGraphOptions = {
         quietMode: isQuietMode,
diff --git a/libraries/rush-lib/src/utilities/runDuringChecksAsync.ts b/libraries/rush-lib/src/utilities/runDuringChecksAsync.ts
new file mode 100644
index 0000000000..4ef6196704
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/runDuringChecksAsync.ts
@@ -0,0 +1,29 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+function noop(): void {}
+
+/**
+ * Starts an operation, then runs the checks that decide whether its result may be used, so that both run at the
+ * same time. Returns the result of the operation if the checks pass.
+ *
+ * @remarks
+ * If the checks fail, this waits for the operation to finish, so that no work continues after the call, and throws
+ * the error of the checks, whether or not the operation failed too.
+ */
+export async function runDuringChecksAsync<T>(
+  runAsync: () => Promise<T>,
+  checkAsync: () => Promise<void>
+): Promise<T> {
+  const resultPromise: Promise<T> = runAsync();
+  // The operation may fail before the checks finish, which must not be reported as an unhandled rejection
+  const settledPromise: Promise<void> = resultPromise.then(noop, noop);
+  try {
+    await checkAsync();
+  } catch (error) {
+    await settledPromise;
+    throw error;
+  }
+
+  return await resultPromise;
+}
diff --git a/libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts b/libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts
new file mode 100644
index 0000000000..e7570b28a0
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/runDuringChecksAsync.test.ts
@@ -0,0 +1,103 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { runDuringChecksAsync } from '../runDuringChecksAsync';
+
+interface IDeferred<T> {
+  readonly promise: Promise<T>;
+  resolve(value: T): void;
+  reject(error: Error): void;
+}
+
+function createDeferred<T>(): IDeferred<T> {
+  let resolveDeferred!: (value: T) => void;
+  let rejectDeferred!: (error: Error) => void;
+  const promise: Promise<T> = new Promise<T>((resolve, reject) => {
+    resolveDeferred = resolve;
+    rejectDeferred = reject;
+  });
+  return { promise, resolve: resolveDeferred, reject: rejectDeferred };
+}
+
+// Lets every pending callback run, including those of timers and of I/O
+function waitForTurnsAsync(): Promise<void> {
+  return new Promise((resolve: () => void) => setTimeout(resolve, 10));
+}
+
+describe(runDuringChecksAsync.name, () => {
+  it('starts the operation before the checks, and returns its result once both finish', async () => {
+    const events: string[] = [];
+    const operation: IDeferred<number> = createDeferred();
+    const resultPromise: Promise<number> = runDuringChecksAsync(
+      async () => {
+        events.push('operation started');
+        return await operation.promise;
+      },
+      async () => {
+        events.push('checks started');
+        await waitForTurnsAsync();
+        events.push('checks passed');
+      }
+    );
+    let result: number | undefined;
+    void resultPromise.then((value: number) => {
+      result = value;
+    });
+
+    expect(events).toEqual(['operation started', 'checks started']);
+    await waitForTurnsAsync();
+    await waitForTurnsAsync();
+    expect(events).toEqual(['operation started', 'checks started', 'checks passed']);
+    expect(result).toBeUndefined();
+    operation.resolve(3);
+    expect(await resultPromise).toBe(3);
+  });
+
+  it('throws the error of the operation if the checks pass', async () => {
+    const error: Error = new Error('The operation failed');
+
+    await expect(runDuringChecksAsync(() => Promise.reject(error), async () => {})).rejects.toBe(error);
+  });
+
+  it('waits for the operation if the checks fail, and throws the error of the checks', async () => {
+    const operation: IDeferred<number> = createDeferred();
+    const checkError: Error = new Error('The checks failed');
+    const resultPromise: Promise<number> = runDuringChecksAsync(
+      () => operation.promise,
+      async () => {
+        throw checkError;
+      }
+    );
+    let isSettled: boolean = false;
+    void resultPromise.then(
+      () => {
+        isSettled = true;
+      },
+      () => {
+        isSettled = true;
+      }
+    );
+
+    await waitForTurnsAsync();
+    expect(isSettled).toBe(false);
+    operation.reject(new Error('The operation failed too'));
+    await expect(resultPromise).rejects.toBe(checkError);
+  });
+
+  it('handles a failure of the operation while the checks run', async () => {
+    const onUnhandledRejection: jest.Mock = jest.fn();
+    process.on('unhandledRejection', onUnhandledRejection);
+    try {
+      const error: Error = new Error('The operation failed');
+      const resultPromise: Promise<number> = runDuringChecksAsync(
+        () => Promise.reject(error),
+        waitForTurnsAsync
+      );
+
+      await expect(resultPromise).rejects.toBe(error);
+      expect(onUnhandledRejection).not.toHaveBeenCalled();
+    } finally {
+      process.off('unhandledRejection', onUnhandledRejection);
+    }
+  });
+});

From 7869af9d05af652d3829458eb345c114e7d4882d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:56 +0000
Subject: [PATCH 119/265] [rush-lib] Test that a warm worker survives an
 iteration that skips its operation

Swarm integration step 104; original commit dfa693cccd.

Brings 107-nit4 (no branch in the shared repo, merged by hash). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 10 of 21. Gate: ch01 GATE OK board 4527 (tree 4ec8857841)

Commits folded into this step (1):
- 26a0653cdd Test that a warm worker survives an iteration that skips its operation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rs-disabled-operation-test_2026-09-29.json | 11 ++++++
 .../test/WarmWorkerOperationRunner.test.ts    | 39 ++++++++++++++++++-
 2 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/rushd-warm-workers-disabled-operation-test_2026-09-29.json

diff --git a/common/changes/@microsoft/rush/rushd-warm-workers-disabled-operation-test_2026-09-29.json b/common/changes/@microsoft/rush/rushd-warm-workers-disabled-operation-test_2026-09-29.json
new file mode 100644
index 0000000000..bba1834b76
--- /dev/null
+++ b/common/changes/@microsoft/rush/rushd-warm-workers-disabled-operation-test_2026-09-29.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts b/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
index 3f415bd6b1..894704d917 100644
--- a/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/WarmWorkerOperationRunner.test.ts
@@ -194,7 +194,8 @@ afterEach(async () => {
 });
 
 async function createHarnessAsync(
-  options: Partial<IWarmWorkerOperationRunnerOptions> = {}
+  options: Partial<IWarmWorkerOperationRunnerOptions> = {},
+  otherOperations: Operation[] = []
 ): Promise<ITestHarness> {
   const project: RushConfigurationProject = createProject('a', undefined);
   const runner: WarmWorkerOperationRunner = new WarmWorkerOperationRunner({
@@ -212,7 +213,7 @@ async function createHarnessAsync(
   });
   const operation: Operation = new Operation({ phase, project, runner, logFilenameIdentifier: 'a' });
   const destination: MockWritable = new MockWritable();
-  const graph: OperationGraph = new OperationGraph(new Set([operation]), {
+  const graph: OperationGraph = new OperationGraph(new Set([operation, ...otherOperations]), {
     quietMode: false,
     debugMode: false,
     parallelism: 1,
@@ -933,4 +934,38 @@ describe(DaemonWarmWorkerPlugin.name, () => {
       expect(operation.runner).toBeInstanceOf(ShellOperationRunner);
     }
   });
+
+  it('does not prepare the worker of an operation that an iteration does not run', async () => {
+    // An iteration in which no operation is enabled does not run at all, so another operation runs in each one.
+    const other: Operation = new Operation({
+      phase,
+      project: createProject('other', undefined),
+      runner: new NullOperationRunner({ name: 'other', result: OperationStatus.Success, silent: false }),
+      logFilenameIdentifier: 'other'
+    });
+    const harness: ITestHarness = await createHarnessAsync({}, [other]);
+    await harness.executeAsync();
+    await harness.executeAsync();
+    const worker: ChildProcess = children[1];
+    const operation: Operation = [...harness.graph.operations].find(
+      ({ runner }: Operation) => runner === harness.runner
+    )!;
+
+    // If the operation ran, the guard would make the runner close the worker before the initial command.
+    harness.blockReason = 'its command line changed';
+    const guardCallCount: number = harness.guardOptions.length;
+    harness.graph.setEnabledStates([operation], false, 'unsafe');
+    const skipped: ITestIteration = await harness.executeAsync();
+    expect(skipped.record.status).toBe(OperationStatus.Skipped);
+    expect(skipped.commands).toEqual([]);
+    expect(harness.runner.isActive).toBe(true);
+    expect(worker.exitCode).toBeNull();
+    expect(harness.guardOptions).toHaveLength(guardCallCount);
+
+    harness.blockReason = undefined;
+    harness.graph.setEnabledStates([operation], true, 'unsafe');
+    const next: ITestIteration = await harness.executeAsync();
+    expect(next.commands).toEqual([]);
+    expect(next.output).toContain(`Sending run 2 to the warm worker (pid ${worker.pid}).`);
+  });
 });

From 885e33b00263b69dc123d7de1f16fa8dc4d895ef Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 120/265] [heft] Never exit with code 0 after an error

Swarm integration step 105; original commit c9325021e7 (merge of swarm/r03-t200 at 18e59c6665).
Scope: task 200.

Brings 200 (branch swarm/r03-t200). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 11 of 21. Gate: ch01 GATE OK board 4527 (tree cf09155465)

Commits folded into this step (1):
- 18e59c6665 [heft] Never exit with code 0 after an error

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/cli/HeftCommandLineParser.test.ts     | 110 ++++++++++++++++++
 apps/heft/src/cli/HeftCommandLineParser.ts    |   9 +-
 apps/heft/src/utilities/CliUtilities.ts       |  12 ++
 .../src/utilities/test/CliUtilities.test.ts   |  26 +++++
 ...heft-error-exit-code_2026-09-29-07-05.json |  11 ++
 5 files changed, 161 insertions(+), 7 deletions(-)
 create mode 100644 apps/heft/src/cli/HeftCommandLineParser.test.ts
 create mode 100644 apps/heft/src/utilities/test/CliUtilities.test.ts
 create mode 100644 common/changes/@rushstack/heft/r03-t200-heft-error-exit-code_2026-09-29-07-05.json

diff --git a/apps/heft/src/cli/HeftCommandLineParser.test.ts b/apps/heft/src/cli/HeftCommandLineParser.test.ts
new file mode 100644
index 0000000000..ce4b37bdea
--- /dev/null
+++ b/apps/heft/src/cli/HeftCommandLineParser.test.ts
@@ -0,0 +1,110 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+jest.setTimeout(30_000);
+
+const HEFT_START_PATH: string = path.resolve(__dirname, '../start.js');
+
+// A project with one task. The task sets process.exitCode to FIXTURE_EXIT_CODE in the Heft process, the
+// way a test that Jest runs in band can, and then fails if FIXTURE_FAIL is set.
+const FIXTURE_FILES: Record<string, string> = {
+  'package.json': JSON.stringify({ name: 'heft-exit-code-fixture', version: '1.0.0', private: true }),
+  'heft-plugin.json': JSON.stringify({
+    taskPlugins: [{ pluginName: 'exit-code-fixture-plugin', entryPoint: './plugin.js' }]
+  }),
+  'config/heft.json': JSON.stringify({
+    phasesByName: {
+      test: { tasksByName: { fixture: { taskPlugin: { pluginPackage: 'heft-exit-code-fixture' } } } }
+    }
+  }),
+  'plugin.js': `module.exports = class {
+  apply(taskSession) {
+    taskSession.hooks.run.tapPromise('exit-code-fixture-plugin', async () => {
+      process.exitCode = Number(process.env.FIXTURE_EXIT_CODE);
+      if (process.env.FIXTURE_FAIL) {
+        throw new Error('The fixture task failed on purpose');
+      }
+    });
+  }
+};
+`
+};
+
+interface IHeftResult {
+  exitCode: number | undefined;
+  output: string;
+}
+
+describe('HeftCommandLineParser', () => {
+  let fixtureFolderPath: string;
+
+  beforeAll(() => {
+    fixtureFolderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-exit-code-'));
+    for (const [relativePath, contents] of Object.entries(FIXTURE_FILES)) {
+      const filePath: string = path.join(fixtureFolderPath, relativePath);
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, contents);
+    }
+  });
+
+  afterAll(() => {
+    fs.rmSync(fixtureFolderPath, { recursive: true, force: true });
+  });
+
+  async function runHeftTestAsync(taskExitCode: number, taskFails: boolean): Promise<IHeftResult> {
+    const env: NodeJS.ProcessEnv = { ...process.env, FIXTURE_EXIT_CODE: String(taskExitCode) };
+    delete env.FIXTURE_FAIL;
+    delete env._RUSH_REPORTER_CHILD_FD;
+    delete env._RUSH_REPORTER_CHILD_ACK_FD;
+    if (taskFails) {
+      env.FIXTURE_FAIL = '1';
+    }
+
+    const child: childProcess.ChildProcess = childProcess.spawn(process.execPath, [HEFT_START_PATH, 'test'], {
+      cwd: fixtureFolderPath,
+      env,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let output: string = '';
+    const appendOutput: (chunk: string) => void = (chunk: string) => {
+      output += chunk;
+    };
+    child.stdout?.setEncoding('utf8').on('data', appendOutput);
+    child.stderr?.setEncoding('utf8').on('data', appendOutput);
+    const exitCode: number | null = await new Promise((resolve, reject) => {
+      child.once('error', reject);
+      child.once('close', resolve);
+    });
+
+    return { exitCode: exitCode ?? undefined, output };
+  }
+
+  it('exits with 1 when a task fails after code in the Heft process set process.exitCode to 0', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(0, true);
+    expect(output).toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(1);
+  });
+
+  it('exits with 1 when a task fails after code in the Heft process set a negative process.exitCode', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(-1, true);
+    expect(output).toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(1);
+  });
+
+  it('keeps a positive process.exitCode when a task fails', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(3, true);
+    expect(output).toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(3);
+  });
+
+  it('exits with 0 when the task succeeds after code in the Heft process set process.exitCode to 0', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(0, false);
+    expect(output).not.toContain('The fixture task failed on purpose');
+    expect(exitCode).toBe(0);
+  });
+});
diff --git a/apps/heft/src/cli/HeftCommandLineParser.ts b/apps/heft/src/cli/HeftCommandLineParser.ts
index 6b7ada3970..7aec0c77f7 100644
--- a/apps/heft/src/cli/HeftCommandLineParser.ts
+++ b/apps/heft/src/cli/HeftCommandLineParser.ts
@@ -26,7 +26,7 @@ import { PhaseAction } from './actions/PhaseAction';
 import { RunAction } from './actions/RunAction';
 import type { IHeftActionOptions } from './actions/IHeftAction';
 import { AliasAction } from './actions/AliasAction';
-import { getToolParameterNamesFromArgs } from '../utilities/CliUtilities';
+import { getErrorExitCode, getToolParameterNamesFromArgs } from '../utilities/CliUtilities';
 import { Constants } from '../utilities/Constants';
 import { HeftChildReporter } from '../pluginFramework/logging/HeftChildReporter';
 
@@ -271,11 +271,6 @@ export class HeftCommandLineParser extends CommandLineParser {
       this.globalTerminal.writeErrorLine(error.stack!);
     }
 
-    const exitCode: string | number | undefined = process.exitCode;
-    if (!exitCode || typeof exitCode !== 'number' || exitCode > 0) {
-      process.exit(exitCode);
-    } else {
-      process.exit(1);
-    }
+    process.exit(getErrorExitCode(process.exitCode));
   }
 }
diff --git a/apps/heft/src/utilities/CliUtilities.ts b/apps/heft/src/utilities/CliUtilities.ts
index d322dc45e1..d2a0b1e4fb 100644
--- a/apps/heft/src/utilities/CliUtilities.ts
+++ b/apps/heft/src/utilities/CliUtilities.ts
@@ -20,3 +20,15 @@ export function getToolParameterNamesFromArgs(argv: string[] = process.argv): Se
   }
   return toolParameters;
 }
+
+/**
+ * Get the exit code for a Heft process that is exiting because of an error. This is `exitCode` if it
+ * is a positive integer, and 1 otherwise, so it is never 0.
+ *
+ * @param exitCode - The current value of `process.exitCode`. Code that ran in the Heft process, such as
+ * a test that Jest ran in band, may have set it to 0.
+ */
+export function getErrorExitCode(exitCode: string | number | undefined): number {
+  const numericExitCode: number = Number(exitCode);
+  return Number.isInteger(numericExitCode) && numericExitCode > 0 ? numericExitCode : 1;
+}
diff --git a/apps/heft/src/utilities/test/CliUtilities.test.ts b/apps/heft/src/utilities/test/CliUtilities.test.ts
new file mode 100644
index 0000000000..ef2fcf633d
--- /dev/null
+++ b/apps/heft/src/utilities/test/CliUtilities.test.ts
@@ -0,0 +1,26 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getErrorExitCode } from '../CliUtilities';
+
+describe(getErrorExitCode.name, () => {
+  const cases: [string | number | undefined, number][] = [
+    [undefined, 1],
+    [0, 1],
+    ['0', 1],
+    ['', 1],
+    [-1, 1],
+    [1.5, 1],
+    ['abc', 1],
+    [1, 1],
+    [2, 2],
+    ['3', 3]
+  ];
+
+  it.each(cases)(
+    'maps an exit code of %p to %p',
+    (exitCode: string | number | undefined, expected: number) => {
+      expect(getErrorExitCode(exitCode)).toBe(expected);
+    }
+  );
+});
diff --git a/common/changes/@rushstack/heft/r03-t200-heft-error-exit-code_2026-09-29-07-05.json b/common/changes/@rushstack/heft/r03-t200-heft-error-exit-code_2026-09-29-07-05.json
new file mode 100644
index 0000000000..6ca1a25882
--- /dev/null
+++ b/common/changes/@rushstack/heft/r03-t200-heft-error-exit-code_2026-09-29-07-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft",
+      "comment": "Fix an issue where Heft exited with code 0 after an error if code that ran in the Heft process, such as a test that Jest ran in band, set `process.exitCode` to 0.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft",
+  "email": "selarkin@microsoft.com"
+}

From 63365bc46a2838699e500305b7222e3aa8f9e4ee Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 121/265] [rush-lib] Fix rush-lib critical path lengths that
 depended on visit order

Swarm integration step 106; original commit 36d08b63df (merge of swarm/m03-t215 at af3b1a5aa5).
Scope: task 215.

Brings 215 (branch swarm/m03-t215). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 12 of 21. Gate: ch01 GATE OK board 4527 (tree 425bdd301b)

Commits folded into this step (1):
- af3b1a5aa5 Fix rush-lib critical path lengths that depended on visit order

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...3-t215-critical-path_2026-09-29-06-55.json |  10 ++
 .../logic/operations/AsyncOperationQueue.ts   |   5 +-
 .../operations/OperationExecutionRecord.ts    |  30 ++---
 .../test/AsyncOperationQueue.test.ts          | 116 +++++++++++++++++-
 4 files changed, 142 insertions(+), 19 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/m03-t215-critical-path_2026-09-29-06-55.json

diff --git a/common/changes/@microsoft/rush/m03-t215-critical-path_2026-09-29-06-55.json b/common/changes/@microsoft/rush/m03-t215-critical-path_2026-09-29-06-55.json
new file mode 100644
index 0000000000..bf5e49131e
--- /dev/null
+++ b/common/changes/@microsoft/rush/m03-t215-critical-path_2026-09-29-06-55.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix the critical path lengths that prioritize operations in the scheduler. An operation's length left out its consumer's weight when that consumer was visited for the first time, so the lengths, and the order in which ready operations started, depended on the order in which operations were visited. The operation at the start of the longest chain now starts first.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
index bc0add0f9c..40d253ed4a 100644
--- a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
+++ b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
@@ -262,8 +262,9 @@ function calculateCriticalPathLength(
     }
     dependencyChain.delete(operation);
   }
-  // Include the contribution from the current operation
-  operation.criticalPathLength = criticalPathLength + operation.weight;
+  // Include the contribution from the current operation, and return the same value that later visits will read
+  criticalPathLength += operation.weight;
+  operation.criticalPathLength = criticalPathLength;
 
   // Directly writing operations to an output collection here would yield a topological sorted set
   // However, we want a bit more fine-tuning of the output than just the raw topology
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index 71a9ef1dbd..40fba9396b 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -112,32 +112,32 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
   public shouldRunnerPersist: boolean = true;
 
   /**
-   * This number represents how far away this Operation is from the furthest "root" operation (i.e.
-   * an operation with no consumers). This helps us to calculate the critical path (i.e. the
-   * longest chain of projects which must be executed in order, thereby limiting execution speed
-   * of the entire operation tree.
+   * This number is the total weight of the longest chain of operations from this Operation to a "root"
+   * operation (i.e. an operation with no consumers), including this Operation's own weight. This helps
+   * us to calculate the critical path (i.e. the longest chain of projects which must be executed in
+   * order, thereby limiting execution speed of the entire operation tree.
    *
    * This number is calculated via a memoized depth-first search, and when choosing the next
    * operation to execute, the operation with the highest criticalPathLength is chosen.
    *
-   * Example:
+   * Example, where every operation has a weight of 1:
    * ```
-   *        (0) A
+   *        (1) A
    *             \
-   *          (1) B     C (0)         (applications)
+   *          (2) B     C (1)         (applications)
    *               \   /|\
    *                \ / | \
-   *             (2) D  |  X (1)      (utilities)
+   *             (3) D  |  X (2)      (utilities)
    *                    | / \
    *                    |/   \
-   *                (2) Y     Z (2)   (other utilities)
+   *                (3) Y     Z (3)   (other utilities)
    *
-   * All roots (A & C) have a criticalPathLength of 0.
-   * B has a score of 1, since A depends on it.
-   * D has a score of 2, since we look at the longest chain (e.g D->B->A is longer than D->C)
-   * X has a score of 1, since the only package which depends on it is A
-   * Z has a score of 2, since only X depends on it, and X has a score of 1
-   * Y has a score of 2, since the chain Y->X->C is longer than Y->C
+   * All roots (A & C) have a criticalPathLength of 1, their own weight.
+   * B has a score of 2, since A depends on it.
+   * D has a score of 3, since we look at the longest chain (e.g D->B->A is longer than D->C)
+   * X has a score of 2, since the only package which depends on it is C
+   * Z has a score of 3, since only X depends on it, and X has a score of 2
+   * Y has a score of 3, since the chain Y->X->C is longer than Y->C
    * ```
    *
    * The algorithm is implemented in AsyncOperationQueue.ts as calculateCriticalPathLength()
diff --git a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
index c9aab3e37f..d8eeb56c15 100644
--- a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
@@ -43,18 +43,57 @@ function getOrCreateProject(name: string): RushConfigurationProject {
   return project;
 }
 
-function createRecord(name: string): OperationExecutionRecord {
+function createRecord(name: string, weight?: number): OperationExecutionRecord {
   return new OperationExecutionRecord(
     new Operation({
       runner: new MockOperationRunner(name),
       logFilenameIdentifier: 'operation',
       phase: mockPhase,
-      project: getOrCreateProject(name)
+      project: getOrCreateProject(name),
+      settings: weight === undefined ? undefined : { operationName: mockPhase.name, weight }
     }),
     { maxParallelism: 10 } as unknown as IOperationExecutionRecordContext
   );
 }
 
+const criticalPathSort: IOperationSortFunction = (
+  a: OperationExecutionRecord,
+  b: OperationExecutionRecord
+): number => {
+  return a.criticalPathLength! - b.criticalPathLength!;
+};
+
+function getPermutations<T>(items: readonly T[]): T[][] {
+  if (items.length <= 1) {
+    return [items.slice()];
+  }
+  const permutations: T[][] = [];
+  for (let i: number = 0; i < items.length; i++) {
+    const rest: T[] = [...items.slice(0, i), ...items.slice(i + 1)];
+    for (const permutation of getPermutations(rest)) {
+      permutations.push([items[i], ...permutation]);
+    }
+  }
+  return permutations;
+}
+
+/**
+ * Creates a record for each entry of `weights`, adds each `[consumer, dependency]` edge, and returns the records.
+ */
+function createGraph(
+  weights: Record<string, number>,
+  edges: readonly [consumer: string, dependency: string][]
+): Map<string, OperationExecutionRecord> {
+  const records: Map<string, OperationExecutionRecord> = new Map();
+  for (const [name, weight] of Object.entries(weights)) {
+    records.set(name, createRecord(name, weight));
+  }
+  for (const [consumer, dependency] of edges) {
+    addDependency(records.get(consumer)!, records.get(dependency)!);
+  }
+  return records;
+}
+
 describe(AsyncOperationQueue.name, () => {
   it('iterates operations in topological order', async () => {
     const operations = [createRecord('a'), createRecord('b'), createRecord('c'), createRecord('d')];
@@ -284,4 +323,77 @@ describe(AsyncOperationQueue.name, () => {
     expect((await queue.next()).value).toBe(a);
     expect(isStatusRead).toBe(true);
   });
+
+  describe('critical path length', () => {
+    // An operation's length is the total weight of the longest chain from it to an operation with no consumers,
+    // including its own weight. It must not depend on the order in which the operations are visited.
+    it.each([
+      {
+        title: 'a chain',
+        weights: { a: 1, b: 1, c: 1 },
+        edges: [
+          ['c', 'b'],
+          ['b', 'a']
+        ],
+        expected: { a: 3, b: 2, c: 1 }
+      },
+      {
+        title: 'a diamond',
+        weights: { a: 1, b: 1, c: 1, d: 1 },
+        edges: [
+          ['b', 'a'],
+          ['c', 'a'],
+          ['d', 'b'],
+          ['d', 'c']
+        ],
+        expected: { a: 3, b: 2, c: 2, d: 1 }
+      },
+      {
+        title: 'a weighted fork',
+        weights: { a: 2, b: 3, c: 1, d: 5 },
+        edges: [
+          ['c', 'b'],
+          ['b', 'a'],
+          ['d', 'a']
+        ],
+        expected: { a: 7, b: 4, c: 1, d: 5 }
+      }
+    ] as {
+      title: string;
+      weights: Record<string, number>;
+      edges: [consumer: string, dependency: string][];
+      expected: Record<string, number>;
+    }[])('is the same for every insertion order in $title', ({ weights, edges, expected }) => {
+      for (const order of getPermutations(Object.keys(weights))) {
+        const records: Map<string, OperationExecutionRecord> = createGraph(weights, edges);
+        new AsyncOperationQueue(
+          order.map((name: string) => records.get(name)!),
+          nullSort
+        );
+
+        const lengths: Record<string, number | undefined> = {};
+        for (const [name, record] of records) {
+          lengths[name] = record.criticalPathLength;
+        }
+        expect({ order, lengths }).toEqual({ order, lengths: expected });
+      }
+    });
+
+    it('assigns the operation that starts the longest chain first, whatever the insertion order', async () => {
+      for (const order of getPermutations(['a', 'b', 'c', 'z'])) {
+        // c depends on b, which depends on a. z has no dependencies and no consumers.
+        const records: Map<string, OperationExecutionRecord> = createGraph({ a: 1, b: 1, c: 1, z: 1 }, [
+          ['c', 'b'],
+          ['b', 'a']
+        ]);
+        const queue: AsyncOperationQueue = new AsyncOperationQueue(
+          order.map((name: string) => records.get(name)!),
+          criticalPathSort
+        );
+
+        const first: IteratorResult<OperationExecutionRecord> = await queue.next();
+        expect({ order, first: first.value?.name }).toEqual({ order, first: 'a' });
+      }
+    });
+  });
 });

From ed08a0e3dc2c38d8f565c12d6dc14074277b8445 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 122/265] [rush-lib] Don't reinstall the package manager
 because of a stale lock alone

Swarm integration step 107; original commit 7014dc08e0 (merge of swarm/r03-t201 at e2aadba3a7).
Scope: task 201.

Brings 201 (branch swarm/r03-t201). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 13 of 21. Gate: ch01 GATE OK board 4527 (tree 83b98b7486)

Commits folded into this step (1):
- e2aadba3a7 [rush-lib] Don't reinstall the package manager because of a stale lock alone

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...package-manager-lock_2026-09-29-07-30.json |  11 ++
 .../logic/installManager/InstallHelpers.ts    |  21 +++-
 .../src/logic/test/InstallHelpers.test.ts     | 104 ++++++++++++++++++
 3 files changed, 130 insertions(+), 6 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/r03-t201-stale-package-manager-lock_2026-09-29-07-30.json

diff --git a/common/changes/@microsoft/rush/r03-t201-stale-package-manager-lock_2026-09-29-07-30.json b/common/changes/@microsoft/rush/r03-t201-stale-package-manager-lock_2026-09-29-07-30.json
new file mode 100644
index 0000000000..4aaf20d72d
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-t201-stale-package-manager-lock_2026-09-29-07-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where a Rush command that found a stale package manager lock in `~/.rush` deleted and reinstalled the package manager there, even though it was installed correctly. The reinstall could break other Rush commands that were running that package manager, and it failed if the registry needed credentials that the command didn't have. Rush now reinstalls the package manager only if its last-install flag is missing or out of date, and it no longer rewrites that flag on every command.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts b/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
index 0ff8126e63..1d1eb22c5a 100644
--- a/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
+++ b/libraries/rush-lib/src/logic/installManager/InstallHelpers.ts
@@ -495,12 +495,19 @@ export class InstallHelpers {
     logIfConsoleOutputIsNotRestricted(`Acquired lock for ${packageManagerAndVersion}`);
 
     try {
-      if (!(await packageManagerMarker.isValidAsync()) || lock.dirtyWhenAcquired) {
+      // Only the flag decides whether to reinstall. A stale lock (lock.dirtyWhenAcquired) only means that
+      // some process exited while it held the lock. An install deletes the flag before it changes the
+      // folder, so an interrupted install leaves no flag. Reinstalling because of a stale lock alone would
+      // empty a shared folder that other processes may be running the package manager from.
+      if (!(await packageManagerMarker.isValidAsync())) {
         logIfConsoleOutputIsNotRestricted(
           Colorize.bold(`Installing ${packageManager} version ${packageManagerVersion}\n`)
         );
 
-        // note that this will remove the last-install flag from the directory
+        // Delete the flag first, so that an interrupted install can't leave it next to a partly
+        // deleted or partly installed folder.
+        await packageManagerMarker.clearAsync();
+
         await Utilities.installPackageInDirectoryAsync({
           directory: packageManagerToolFolder,
           packageName: packageManager,
@@ -522,14 +529,16 @@ export class InstallHelpers {
         logIfConsoleOutputIsNotRestricted(
           `Successfully installed ${packageManager} version ${packageManagerVersion}`
         );
+
+        // Write the flag only after an install. Rewriting a valid flag on every call would let a process
+        // that is killed during the write leave an empty flag, and the next caller would reinstall.
+        await packageManagerMarker.createAsync();
       } else {
         logIfConsoleOutputIsNotRestricted(
           `Found ${packageManager} version ${packageManagerVersion} in ${packageManagerToolFolder}`
         );
       }
 
-      await packageManagerMarker.createAsync();
-
       // Example: "C:\MyRepo\common\temp"
       FileSystem.ensureFolder(rushConfiguration.commonTempFolder);
 
@@ -556,8 +565,8 @@ export class InstallHelpers {
     } finally {
       // A long-lived process such as the Rush daemon calls this again after a failed install.
       // LockFile keeps an in-process record of every held lock, so a lock that is never released
-      // makes that later call wait forever. A failed install empties the tool folder first, which
-      // removes the last-install flag, so the next caller installs again.
+      // makes that later call wait forever. A failed install deletes the last-install flag before it
+      // changes the tool folder, so the next caller installs again.
       lock.release();
     }
   }
diff --git a/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts b/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
index f7cc1ba6d4..9f6eda0d49 100644
--- a/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
+++ b/libraries/rush-lib/src/logic/test/InstallHelpers.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -82,7 +83,10 @@ describe(InstallHelpers.name, () => {
     let tempFolder: string;
     let rushConfiguration: RushConfiguration;
     let rushGlobalFolder: RushGlobalFolder;
+    let toolFolder: string;
+    let flagPath: string;
     let installPackageMock: jest.SpyInstance;
+    let acquireLockSpy: jest.SpyInstance<Promise<LockFile>>;
 
     beforeEach(() => {
       tempFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-ensure-local-package-manager-'));
@@ -93,16 +97,116 @@ describe(InstallHelpers.name, () => {
         commonTempFolder: `${tempFolder}/repo/common/temp`
       } as unknown as RushConfiguration;
       rushGlobalFolder = { nodeSpecificPath: `${tempFolder}/rush-home` } as unknown as RushGlobalFolder;
+      toolFolder = `${rushGlobalFolder.nodeSpecificPath}/${lockResourceName}`;
+      flagPath = `${toolFolder}/last-install.flag`;
       installPackageMock = jest
         .spyOn(Utilities, 'installPackageInDirectoryAsync')
         .mockRejectedValue(new Error('Unexpected package manager install'));
+      acquireLockSpy = jest.spyOn(LockFile, 'acquireAsync');
     });
 
     afterEach(() => {
       installPackageMock.mockRestore();
+      acquireLockSpy.mockRestore();
       fs.rmSync(tempFolder, { recursive: true, force: true });
     });
 
+    function getLockFileNames(): string[] {
+      return fs
+        .readdirSync(rushGlobalFolder.nodeSpecificPath)
+        .filter((name: string) => name.startsWith(lockResourceName) && name.endsWith('.lock'));
+    }
+
+    // Like a Rush process that is killed while it holds the lock: a child process takes the lock
+    // and exits without releasing it.
+    function leaveStaleLock(): void {
+      fs.mkdirSync(rushGlobalFolder.nodeSpecificPath, { recursive: true });
+      const script: string =
+        `require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))})` +
+        `.LockFile.tryAcquire(${JSON.stringify(rushGlobalFolder.nodeSpecificPath)}, ` +
+        `${JSON.stringify(lockResourceName)}) || process.exit(1);`;
+      execFileSync(process.execPath, ['-e', script]);
+      expect(getLockFileNames()).toHaveLength(1);
+    }
+
+    async function wasAcquiredLockDirtyAsync(): Promise<boolean> {
+      expect(acquireLockSpy).toHaveBeenCalledTimes(1);
+      const lock: LockFile = await acquireLockSpy.mock.results[0].value;
+      return lock.dirtyWhenAcquired;
+    }
+
+    it('does not reinstall when it removes a stale lock and the last-install flag is valid', async () => {
+      // Not the format that LastInstallFlag writes, so that a rewrite would show.
+      const flagContents: string = JSON.stringify({ node: process.versions.node });
+      await FileSystem.writeFileAsync(flagPath, flagContents, { ensureFolderExists: true });
+      await FileSystem.writeFileAsync(`${toolFolder}/node_modules/.bin/pnpm`, 'the installed tool', {
+        ensureFolderExists: true
+      });
+      leaveStaleLock();
+
+      await InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true);
+
+      await expect(wasAcquiredLockDirtyAsync()).resolves.toBe(true);
+      expect(installPackageMock).not.toHaveBeenCalled();
+      await expect(FileSystem.readFileAsync(`${toolFolder}/node_modules/.bin/pnpm`)).resolves.toBe(
+        'the installed tool'
+      );
+      await expect(FileSystem.readFileAsync(flagPath)).resolves.toBe(flagContents);
+      await expect(
+        FileSystem.getLinkStatisticsAsync(`${rushConfiguration.commonTempFolder}/pnpm-local`)
+      ).resolves.toBeDefined();
+      expect(getLockFileNames()).toEqual([]);
+    });
+
+    it.each([
+      ['missing, as after an interrupted install', undefined],
+      ['empty, as after an interrupted write', ''],
+      ['for another Node.js version', JSON.stringify({ node: '0.0.1' })]
+    ])(
+      'reinstalls when the last-install flag is %s, deleting the flag before the install',
+      async (description: string, flagContents: string | undefined) => {
+        // What an interrupted install leaves: a partly installed folder and a stale lock.
+        await FileSystem.writeFileAsync(`${toolFolder}/package.json`, '{}', { ensureFolderExists: true });
+        if (flagContents !== undefined) {
+          await FileSystem.writeFileAsync(flagPath, flagContents);
+        }
+        leaveStaleLock();
+        let flagExistedDuringInstall: boolean | undefined;
+        installPackageMock.mockImplementationOnce(async () => {
+          flagExistedDuringInstall = await FileSystem.existsAsync(flagPath);
+        });
+
+        await InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true);
+
+        await expect(wasAcquiredLockDirtyAsync()).resolves.toBe(true);
+        expect(installPackageMock).toHaveBeenCalledTimes(1);
+        expect(installPackageMock.mock.calls[0][0]).toMatchObject({
+          directory: toolFolder,
+          packageName: 'pnpm',
+          version: packageManagerVersion
+        });
+        expect(flagExistedDuringInstall).toBe(false);
+        await expect(JsonFile.loadAsync(flagPath)).resolves.toEqual({ node: process.versions.node });
+        await expect(
+          FileSystem.getLinkStatisticsAsync(`${rushConfiguration.commonTempFolder}/pnpm-local`)
+        ).resolves.toBeDefined();
+        expect(getLockFileNames()).toEqual([]);
+      }
+    );
+
+    it('leaves no last-install flag when the install fails', async () => {
+      await FileSystem.writeFileAsync(flagPath, JSON.stringify({ node: '0.0.1' }), {
+        ensureFolderExists: true
+      });
+      installPackageMock.mockRejectedValueOnce(new Error('npm error code E401'));
+
+      await expect(
+        InstallHelpers.ensureLocalPackageManagerAsync(rushConfiguration, rushGlobalFolder, 1, true)
+      ).rejects.toThrow('npm error code E401');
+
+      await expect(FileSystem.existsAsync(flagPath)).resolves.toBe(false);
+    });
+
     it('releases the package manager lock when the install fails, so the same process can retry', async () => {
       installPackageMock
         .mockRejectedValueOnce(new Error('npm error code E401'))

From 2fe1ce96a293e11990c133c84cf574c91047c85d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 123/265] [rush-daemon-transport] Test a send on a connection
 that already closed

Swarm integration step 108; original commit 75a68e09d2 (merge of swarm/m03-t209-nit1 at 15f80059fe).
Refs: task 209 NIT 1.
Scope: task 209-nit1.

Brings 209-nit1 (branch swarm/m03-t209-nit1). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 14 of 21. Gate: ch01 GATE OK board 4527 (tree cb6fb308c1)

Commits folded into this step (1):
- 15f80059fe [rush-daemon-transport] Test a send on a connection that already closed (task 209 NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/DaemonBufferedWrite.ts                |  4 ++++
 .../src/test/SendAfterClose.test.ts           | 22 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts

diff --git a/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
index 22a4de4fea..29ada609f3 100644
--- a/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
+++ b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
@@ -12,6 +12,10 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * half-closes, finishes writing without a `'drain'`, and a socket destroyed without an error emits no
  * `'error'`. So `'finish'` resolves too, `'error'` rejects with its error, and a `'close'` that comes
  * first rejects with `transportClosed`.
+ *
+ * The socket must not have closed before the write. A write to a closed socket returns `false` and
+ * emits nothing more, so this would wait for a `'close'` that has already happened.
+ * `DaemonFrameConnection` checks `socket.closed` before it writes.
  * @internal
  */
 export function waitForBufferedWriteAsync(socket: net.Socket): Promise<void> {
diff --git a/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts b/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
new file mode 100644
index 0000000000..638e3cd084
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonTransportError, DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { createFrame, nextMacrotaskAsync, trackSend, withPausedPairAsync } from './BackpressureFixture';
+import type { IBackpressurePair, SendState } from './BackpressureFixture';
+
+const SMALL_FRAME_BYTES: number = 1;
+
+it('rejects a send on a connection that already closed without an error', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    pair.server.socket.destroy();
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    // A write to a closed socket emits nothing more, so only the open check can settle this send.
+    const sendState: () => SendState = trackSend(pair.server.sendFrameAsync(createFrame(SMALL_FRAME_BYTES)));
+    await nextMacrotaskAsync();
+    expect(sendState()).toBeInstanceOf(DaemonTransportError);
+    expect(sendState()).toMatchObject({ code: DaemonTransportErrorCode.transportClosed });
+  });
+});

From 8445b5291fb2bbc8c9578cc68c3e6da69b7ecb90 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 124/265] [rush-lib] Reuse unchanged operation state hashes
 across iterations

Swarm integration step 109; original commit a94072e8ee (merge of swarm/r07-t221 at f6ea91f25b).
Scope: task 221.

Brings 221 (branch swarm/r07-t221). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 15 of 21. Gate: ch01 GATE OK board 4527 (tree 547cffd351)

Commits folded into this step (1):
- f6ea91f25b [rush-lib] Reuse unchanged operation state hashes across iterations

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...changed-state-hashes_2026-09-29-07-04.json |  11 +
 .../operations/OperationExecutionRecord.ts    | 146 +++++++----
 .../src/logic/operations/OperationGraph.ts    |   8 +
 .../test/OperationExecutionRecord.test.ts     | 226 +++++++++++++++++-
 .../test/OperationGraphStateHash.test.ts      | 143 +++++++++++
 5 files changed, 484 insertions(+), 50 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/reuse-unchanged-state-hashes_2026-09-29-07-04.json
 create mode 100644 libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts

diff --git a/common/changes/@microsoft/rush/reuse-unchanged-state-hashes_2026-09-29-07-04.json b/common/changes/@microsoft/rush/reuse-unchanged-state-hashes_2026-09-29-07-04.json
new file mode 100644
index 0000000000..fbe96fb0fc
--- /dev/null
+++ b/common/changes/@microsoft/rush/reuse-unchanged-state-hashes_2026-09-29-07-04.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a long-lived process such as the Rush daemon runs a command again, an operation now reuses its state hash from the previous run if its own inputs, its configuration and the state hashes of its dependencies are unchanged, instead of hashing every operation again.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index 40fba9396b..c548b17cc1 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -61,6 +61,11 @@ export interface IOperationExecutionRecordContext {
   getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
   invalidate?: (operations: Iterable<Operation>, reason: string) => void;
   inputsSnapshot: IInputsSnapshot | undefined;
+  /**
+   * The state hash that each operation's record last calculated, kept across iterations. A record reuses its
+   * operation's entry when the entry was calculated from the same inputs, and replaces it otherwise.
+   */
+  stateHashCache?: WeakMap<Operation, IOperationStateHashCacheEntry>;
   maxParallelism: number;
   /** Aborted when the host requests termination of running operations in this iteration. */
   terminateSignal?: AbortSignal;
@@ -75,6 +80,22 @@ export interface IOperationExecutionRecordContext {
   quietMode: boolean;
 }
 
+/**
+ * An operation's state hash and components, with the inputs that they were calculated from.
+ * The state hash is a function of these inputs alone.
+ * @internal
+ */
+export interface IOperationStateHashCacheEntry {
+  readonly local: string;
+  readonly config: string;
+  /**
+   * The name and then the state hash of each dependency record, in the order of the record's dependencies.
+   */
+  readonly dependencyNamesAndHashes: readonly string[];
+  readonly components: IOperationStateHashComponents;
+  readonly hash: string;
+}
+
 /**
  * Context object for the executeAsync() method.
  * @internal
@@ -185,8 +206,7 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
 
   #collatedWriter: CollatedWriter | undefined = undefined;
   #status: OperationStatus;
-  #stateHash: string | undefined;
-  #stateHashComponents: IOperationStateHashComponents | undefined;
+  #stateHashEntry: IOperationStateHashCacheEntry | undefined;
   #operationStreamClosed: boolean = false;
   #operationCompleted: boolean = false;
 
@@ -213,8 +233,7 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
 
     this.#context = context;
     this.#status = operation.dependencies.size > 0 ? OperationStatus.Waiting : OperationStatus.Ready;
-    this.#stateHash = undefined;
-    this.#stateHashComponents = undefined;
+    this.#stateHashEntry = undefined;
   }
 
   public get name(): string {
@@ -416,61 +435,90 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
   }
 
   public getStateHash(): string {
-    if (this.#stateHash === undefined) {
-      const { dependencies, local, config } = this.getStateHashComponents();
-
-      const hasher: crypto.Hash = crypto.createHash('sha1');
-      for (const dep of dependencies) {
-        hasher.update(`${RushConstants.hashDelimiter}${dep}`);
-      }
-      hasher.update(`${RushConstants.hashDelimiter}local=${local}`);
-      hasher.update(`${RushConstants.hashDelimiter}config=${config}`);
-
-      const hash: string = hasher.digest('hex');
-      this.#stateHash = hash;
-    }
-    return this.#stateHash;
+    this.#stateHashEntry ??= this.#calculateStateHash();
+    return this.#stateHashEntry.hash;
   }
 
   public getStateHashComponents(): IOperationStateHashComponents {
-    if (!this.#stateHashComponents) {
-      const { inputsSnapshot } = this.#context;
+    this.#stateHashEntry ??= this.#calculateStateHash();
+    return this.#stateHashEntry.components;
+  }
 
-      if (!inputsSnapshot) {
-        throw new Error(`Cannot calculate state hash without git.`);
-      }
+  #calculateStateHash(): IOperationStateHashCacheEntry {
+    const { inputsSnapshot, stateHashCache } = this.#context;
 
-      if (this.dependencies.size !== this.operation.dependencies.size) {
-        throw new InternalError(
-          `State hash calculation failed. Dependencies of record do not match the operation.`
-        );
-      }
+    if (!inputsSnapshot) {
+      throw new Error(`Cannot calculate state hash without git.`);
+    }
 
-      // The final state hashes of operation dependencies are factored into the hash to ensure that any
-      // state changes in dependencies will invalidate the cache.
-      const dependencies: string[] = Array.from(this.dependencies, (record) => {
-        return `${record.name}=${record.getStateHash()}`;
-      }).sort();
-
-      const { associatedProject, associatedPhase } = this;
-      // Examples of data in the local state hash:
-      // - Environment variables specified in `dependsOnEnvVars`
-      // - Git hashes of tracked files in the associated project
-      // - Git hash of the shrinkwrap file for the project
-      // - Git hashes of any files specified in `dependsOnAdditionalFiles` (must not be associated with a project)
-      const local: string = inputsSnapshot.getOperationOwnStateHash(
-        associatedProject,
-        associatedPhase.name,
-        this.#context.getOperationEnvironment?.(this.operation)
+    if (this.dependencies.size !== this.operation.dependencies.size) {
+      throw new InternalError(
+        `State hash calculation failed. Dependencies of record do not match the operation.`
       );
+    }
 
-      // Examples of data in the config hash:
-      // - CLI parameters (ShellOperationRunner)
-      const config: string = this.runner.getConfigHash();
+    // The final state hashes of operation dependencies are factored into the hash to ensure that any
+    // state changes in dependencies will invalidate the cache.
+    const previousEntry: IOperationStateHashCacheEntry | undefined = stateHashCache?.get(this.operation);
+    const previousDependencies: readonly string[] | undefined = previousEntry?.dependencyNamesAndHashes;
+    let hasSameDependencies: boolean = previousDependencies?.length === this.dependencies.size * 2;
+    let dependencyIndex: number = 0;
+    for (const record of this.dependencies) {
+      const dependencyHash: string = record.getStateHash();
+      if (
+        previousDependencies?.[dependencyIndex] !== record.name ||
+        previousDependencies[dependencyIndex + 1] !== dependencyHash
+      ) {
+        hasSameDependencies = false;
+      }
+      dependencyIndex += 2;
+    }
+
+    const { associatedProject, associatedPhase } = this;
+    // Examples of data in the local state hash:
+    // - Environment variables specified in `dependsOnEnvVars`
+    // - Git hashes of tracked files in the associated project
+    // - Git hash of the shrinkwrap file for the project
+    // - Git hashes of any files specified in `dependsOnAdditionalFiles` (must not be associated with a project)
+    const local: string = inputsSnapshot.getOperationOwnStateHash(
+      associatedProject,
+      associatedPhase.name,
+      this.#context.getOperationEnvironment?.(this.operation)
+    );
+
+    // Examples of data in the config hash:
+    // - CLI parameters (ShellOperationRunner)
+    const config: string = this.runner.getConfigHash();
+
+    if (hasSameDependencies && previousEntry?.local === local && previousEntry.config === config) {
+      // Nothing else goes into the hash, so the earlier entry is what this record would calculate
+      return previousEntry;
+    }
 
-      this.#stateHashComponents = { dependencies, local, config };
+    const dependencyNamesAndHashes: string[] = [];
+    for (const record of this.dependencies) {
+      dependencyNamesAndHashes.push(record.name, record.getStateHash());
     }
-    return this.#stateHashComponents;
+    const dependencies: string[] = Array.from(this.dependencies, (record) => {
+      return `${record.name}=${record.getStateHash()}`;
+    }).sort();
+
+    const hasher: crypto.Hash = crypto.createHash('sha1');
+    for (const dep of dependencies) {
+      hasher.update(`${RushConstants.hashDelimiter}${dep}`);
+    }
+    hasher.update(`${RushConstants.hashDelimiter}local=${local}`);
+    hasher.update(`${RushConstants.hashDelimiter}config=${config}`);
+
+    const entry: IOperationStateHashCacheEntry = {
+      local,
+      config,
+      dependencyNamesAndHashes,
+      components: { dependencies, local, config },
+      hash: hasher.digest('hex')
+    };
+    stateHashCache?.set(this.operation, entry);
+    return entry;
   }
 
   /**
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index 3983c886b1..3bfe990ba4 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -19,6 +19,7 @@ import type { IOperationGraphEventSink } from './OperationEventSink';
 import {
   type IOperationExecutionContext,
   type IOperationExecutionRecordContext,
+  type IOperationStateHashCacheEntry,
   OperationExecutionRecord
 } from './OperationExecutionRecord';
 import type { IExecutionResult } from './IOperationExecutionResult';
@@ -179,6 +180,12 @@ export class OperationGraph implements IOperationGraph {
    */
   readonly #deferredInvalidations: Map<OperationExecutionRecord, string | undefined> = new Map();
 
+  /**
+   * Each operation's last calculated state hash. An iteration reuses an operation's hash when its inputs
+   * are unchanged, rather than hashing every operation of the graph again.
+   */
+  readonly #stateHashCache: WeakMap<Operation, IOperationStateHashCacheEntry> = new WeakMap();
+
   #currentIteration: IExecutionIterationContext | undefined = undefined;
   #scheduledIteration: IExecutionIterationContext | undefined = undefined;
 
@@ -731,6 +738,7 @@ export class OperationGraph implements IOperationGraph {
       streamCollator,
       terminal,
       inputsSnapshot,
+      stateHashCache: this.#stateHashCache,
       maxParallelism: this.#maxParallelism,
       onOperationStateChanged: undefined,
       createEnvironment: createEnvironmentForOperation,
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
index b2146360cf..dde4910f43 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationExecutionRecord.test.ts
@@ -4,8 +4,14 @@
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { IOperationSettings } from '../../../api/RushProjectConfiguration';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type { IOperationStateHashComponents } from '../IOperationExecutionResult';
 import { Operation } from '../Operation';
-import { type IOperationExecutionRecordContext, OperationExecutionRecord } from '../OperationExecutionRecord';
+import {
+  type IOperationExecutionRecordContext,
+  type IOperationStateHashCacheEntry,
+  OperationExecutionRecord
+} from '../OperationExecutionRecord';
 import {
   getCommandExecution,
   setIncrementalExecutionGuard,
@@ -54,6 +60,124 @@ function createRecord(operation: Operation, maxParallelism: number = 8): Operati
   } as unknown as IOperationExecutionRecordContext);
 }
 
+class ConfigurableRunner extends MockOperationRunner {
+  public configHash: string = 'config';
+  public configHashRequests: number = 0;
+
+  public override getConfigHash(): string {
+    this.configHashRequests++;
+    return this.configHash;
+  }
+}
+
+/**
+ * Operations a, b, c and d, where b depends on a, and c depends on a and b. The own state hash of each operation is
+ * its entry in `localHashes`, and its config hash is its runner's `configHash`.
+ */
+class StateHashFixture {
+  public readonly operations: Map<string, Operation> = new Map();
+  public readonly runners: Map<string, ConfigurableRunner> = new Map();
+  public readonly localHashes: Map<string, string> = new Map();
+  public readonly ownStateHashRequests: string[] = [];
+  public readonly inputsSnapshot: IInputsSnapshot;
+
+  public constructor() {
+    for (const name of ['a', 'b', 'c', 'd']) {
+      const runner: ConfigurableRunner = new ConfigurableRunner(name);
+      this.runners.set(name, runner);
+      this.operations.set(
+        name,
+        new Operation({
+          phase: MOCK_PHASE,
+          project: createProject(name),
+          runner,
+          logFilenameIdentifier: name
+        })
+      );
+      this.localHashes.set(name, `local-${name}`);
+    }
+    this.getOperation('b').addDependency(this.getOperation('a'));
+    this.getOperation('c').addDependency(this.getOperation('a'));
+    this.getOperation('c').addDependency(this.getOperation('b'));
+
+    this.inputsSnapshot = {
+      hashes: new Map(),
+      rootDirectory: '/repo',
+      hasUncommittedChanges: false,
+      getTrackedFileHashesForOperation: () => new Map(),
+      getOperationOwnStateHash: (project: IRushConfigurationProjectForSnapshot) => {
+        const { packageName } = project as RushConfigurationProject;
+        this.ownStateHashRequests.push(packageName);
+        return this.localHashes.get(packageName)!;
+      }
+    };
+  }
+
+  public getOperation(name: string): Operation {
+    return this.operations.get(name)!;
+  }
+
+  public getConfigHashRequests(): number[] {
+    return Array.from(this.runners.values(), (runner: ConfigurableRunner) => runner.configHashRequests);
+  }
+
+  /**
+   * Creates the records of one iteration the way that the graph does, and calculates every state hash.
+   */
+  public calculate(
+    stateHashCache: WeakMap<Operation, IOperationStateHashCacheEntry> | undefined
+  ): Map<string, OperationExecutionRecord> {
+    const context: IOperationExecutionRecordContext = {
+      maxParallelism: 1,
+      inputsSnapshot: this.inputsSnapshot,
+      stateHashCache
+    } as unknown as IOperationExecutionRecordContext;
+    const recordByOperation: Map<Operation, OperationExecutionRecord> = new Map();
+    for (const operation of this.operations.values()) {
+      recordByOperation.set(operation, new OperationExecutionRecord(operation, context));
+    }
+    for (const [operation, record] of recordByOperation) {
+      for (const dependency of operation.dependencies) {
+        record.dependencies.add(recordByOperation.get(dependency)!);
+      }
+    }
+    const records: Map<string, OperationExecutionRecord> = new Map();
+    for (const record of recordByOperation.values()) {
+      record.getStateHash();
+      records.set(record.name, record);
+    }
+    return records;
+  }
+}
+
+function getHashes(records: ReadonlyMap<string, OperationExecutionRecord>): Record<string, string> {
+  return Object.fromEntries(Array.from(records, ([name, record]) => [name, record.getStateHash()]));
+}
+
+function getComponents(
+  records: ReadonlyMap<string, OperationExecutionRecord>
+): Record<string, IOperationStateHashComponents> {
+  return Object.fromEntries(Array.from(records, ([name, record]) => [name, record.getStateHashComponents()]));
+}
+
+/**
+ * Checks that the records' hashes are the ones that records without a cache calculate, and returns the names of
+ * the records that reused the components of `previous`.
+ */
+function getReusedNames(
+  fixture: StateHashFixture,
+  previous: ReadonlyMap<string, OperationExecutionRecord>,
+  current: ReadonlyMap<string, OperationExecutionRecord>
+): string[] {
+  const uncached: Map<string, OperationExecutionRecord> = fixture.calculate(undefined);
+  expect(getHashes(current)).toEqual(getHashes(uncached));
+  expect(getComponents(current)).toEqual(getComponents(uncached));
+  return Array.from(current.keys()).filter(
+    (name: string) =>
+      current.get(name)!.getStateHashComponents() === previous.get(name)!.getStateHashComponents()
+  );
+}
+
 describe(OperationExecutionRecord.name, () => {
   describe('weight', () => {
     it('snapshots numeric operation weight for a normal (non-no-op) operation', () => {
@@ -179,4 +303,104 @@ describe(OperationExecutionRecord.name, () => {
       expect(getCommandExecution(record)?.watchesInputs).toBeUndefined();
     });
   });
+
+  describe('state hash', () => {
+    let fixture: StateHashFixture;
+    let cache: WeakMap<Operation, IOperationStateHashCacheEntry>;
+
+    beforeEach(() => {
+      fixture = new StateHashFixture();
+      cache = new WeakMap();
+    });
+
+    it('reuses the last state hash of every operation whose inputs did not change', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(fixture.ownStateHashRequests).toEqual(['a', 'b', 'c', 'd']);
+      expect(fixture.getConfigHashRequests()).toEqual([1, 1, 1, 1]);
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      // Every record still reads its own inputs to check the cached entry
+      expect(fixture.ownStateHashRequests).toEqual(['a', 'b', 'c', 'd', 'a', 'b', 'c', 'd']);
+      expect(fixture.getConfigHashRequests()).toEqual([2, 2, 2, 2]);
+      expect(getHashes(second)).toEqual(getHashes(first));
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'b', 'c', 'd']);
+    });
+
+    it("calculates the state hashes again when an operation's own state hash changes, for it and its consumers", () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.localHashes.set('a', 'local-a-edited');
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['d']);
+      for (const name of ['a', 'b', 'c']) {
+        expect(second.get(name)!.getStateHash()).not.toBe(first.get(name)!.getStateHash());
+      }
+    });
+
+    it("calculates the state hashes again when an operation's config hash changes, for it and its consumers", () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.runners.get('b')!.configHash = 'config-edited';
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'd']);
+      expect(second.get('b')!.getStateHashComponents().config).toBe('config-edited');
+    });
+
+    it('calculates the state hash again when an operation gains or loses a dependency', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.getOperation('d').addDependency(fixture.getOperation('a'));
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'b', 'c']);
+      expect(second.get('d')!.getStateHashComponents().dependencies).toEqual([
+        `a=${second.get('a')!.getStateHash()}`
+      ]);
+
+      // c keeps its first dependency, a, and loses its last one, b
+      fixture.getOperation('c').deleteDependency(fixture.getOperation('b'));
+      const third: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, second, third)).toEqual(['a', 'b', 'd']);
+      expect(third.get('c')!.getStateHashComponents().dependencies).toEqual([
+        `a=${third.get('a')!.getStateHash()}`
+      ]);
+    });
+
+    it('calculates the state hash again when a dependency is replaced by one with the same state hash', () => {
+      // a and d have the same inputs and no dependencies, so they have the same state hash
+      fixture.localHashes.set('d', 'local-a');
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(first.get('d')!.getStateHash()).toBe(first.get('a')!.getStateHash());
+      fixture.getOperation('b').deleteDependency(fixture.getOperation('a'));
+      fixture.getOperation('b').addDependency(fixture.getOperation('d'));
+
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'd']);
+      expect(second.get('b')!.getStateHashComponents().dependencies).toEqual([
+        `d=${second.get('d')!.getStateHash()}`
+      ]);
+    });
+
+    it('keeps the newest state hash, so that a later iteration without changes reuses it', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      fixture.localHashes.set('b', 'local-b-edited');
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, first, second)).toEqual(['a', 'd']);
+
+      const third: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, second, third)).toEqual(['a', 'b', 'c', 'd']);
+
+      // Going back to the first inputs calculates the first hashes again
+      fixture.localHashes.set('b', 'local-b');
+      const fourth: Map<string, OperationExecutionRecord> = fixture.calculate(cache);
+      expect(getReusedNames(fixture, third, fourth)).toEqual(['a', 'd']);
+      expect(getHashes(fourth)).toEqual(getHashes(first));
+    });
+
+    it('calculates every state hash when the context has no cache', () => {
+      const first: Map<string, OperationExecutionRecord> = fixture.calculate(undefined);
+      const second: Map<string, OperationExecutionRecord> = fixture.calculate(undefined);
+      expect(getReusedNames(fixture, first, second)).toEqual([]);
+      expect(getHashes(second)).toEqual(getHashes(first));
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
new file mode 100644
index 0000000000..036926870c
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
@@ -0,0 +1,143 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type { IOperationStateHashComponents } from '../IOperationExecutionResult';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+interface IStateHashes {
+  readonly components: ReadonlyMap<string, IOperationStateHashComponents>;
+  readonly hashes: ReadonlyMap<string, string>;
+}
+
+/**
+ * A graph of operations a, b and c, where b depends on a. Each iteration hashes the own inputs of each operation as
+ * its entry in `localHashes`.
+ */
+class StateHashGraph {
+  public readonly iterations: IStateHashes[] = [];
+  public readonly graph: OperationGraph;
+  readonly #inputsSnapshot: IInputsSnapshot;
+
+  public constructor(localHashes: ReadonlyMap<string, string>) {
+    const operations: Map<string, Operation> = new Map();
+    for (const name of ['a', 'b', 'c']) {
+      operations.set(
+        name,
+        new Operation({
+          runner: new MockOperationRunner(name),
+          logFilenameIdentifier: name,
+          phase: mockPhase,
+          project: { packageName: name } as unknown as RushConfigurationProject
+        })
+      );
+    }
+    operations.get('b')!.addDependency(operations.get('a')!);
+
+    this.graph = new OperationGraph(new Set(operations.values()), {
+      quietMode: false,
+      debugMode: false,
+      parallelism: 1,
+      allowOversubscription: true,
+      destinations: [new MockWritable()],
+      abortController: new AbortController()
+    });
+    this.graph.hooks.configureIteration.tap('test', (records) => {
+      const components: Map<string, IOperationStateHashComponents> = new Map();
+      const hashes: Map<string, string> = new Map();
+      for (const [operation, record] of records) {
+        components.set(operation.name, record.getStateHashComponents());
+        hashes.set(operation.name, record.getStateHash());
+      }
+      this.iterations.push({ components, hashes });
+    });
+
+    this.#inputsSnapshot = {
+      hashes: new Map(),
+      rootDirectory: '/repo',
+      hasUncommittedChanges: false,
+      getTrackedFileHashesForOperation: () => new Map(),
+      getOperationOwnStateHash: (project: IRushConfigurationProjectForSnapshot) =>
+        localHashes.get((project as RushConfigurationProject).packageName)!
+    };
+  }
+
+  public async executeAsync(): Promise<IStateHashes> {
+    expect((await this.graph.executeAsync({ inputsSnapshot: this.#inputsSnapshot })).status).toBe(
+      OperationStatus.Success
+    );
+    return this.iterations[this.iterations.length - 1];
+  }
+}
+
+function getReusedNames(previous: IStateHashes, current: IStateHashes): string[] {
+  return Array.from(current.components.keys()).filter(
+    (name: string) => current.components.get(name) === previous.components.get(name)
+  );
+}
+
+describe('OperationGraph state hashes', () => {
+  it('reuses the state hash of each operation whose inputs did not change since the previous iteration', async () => {
+    const localHashes: Map<string, string> = new Map([
+      ['a', 'local-a'],
+      ['b', 'local-b'],
+      ['c', 'local-c']
+    ]);
+    const graph: StateHashGraph = new StateHashGraph(localHashes);
+
+    const first: IStateHashes = await graph.executeAsync();
+    const second: IStateHashes = await graph.executeAsync();
+    expect(getReusedNames(first, second)).toEqual(['a', 'b', 'c']);
+    expect(second.hashes).toEqual(first.hashes);
+
+    localHashes.set('a', 'local-a-edited');
+    const third: IStateHashes = await graph.executeAsync();
+    expect(getReusedNames(second, third)).toEqual(['c']);
+    expect(third.hashes.get('a')).not.toBe(second.hashes.get('a'));
+    expect(third.hashes.get('b')).not.toBe(second.hashes.get('b'));
+
+    // A new graph has nothing to reuse, and calculates the same state hashes
+    const uncached: IStateHashes = await new StateHashGraph(localHashes).executeAsync();
+    expect(third.hashes).toEqual(uncached.hashes);
+    expect(third.components).toEqual(uncached.components);
+  });
+});

From 35b782a05371e2f77fb4448de903dc7aab4b55ab Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 125/265] [rush-cli-client] Skip the restart notice when a wait
 line already gave its cause

Swarm integration step 110; original commit d68a31ffce (merge of swarm/r06-t222 at 672eef89f6).
Refs: task 222.
Scope: task 222.

Brings 222 (branch swarm/r06-t222). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 16 of 21. Gate: ch01 GATE OK board 4527 (tree 5aca3fba63)

Commits folded into this step (1):
- 672eef89f6 [rush-cli-client] Skip the restart notice when a wait line already gave its cause (task 222)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   7 +
 .../src/AgentProgressRenderer.ts              |  13 +-
 .../src/daemonRestartNotice.ts                |  39 ++++-
 .../src/test/AgentProgressRenderer.test.ts    |  20 ++-
 .../src/test/daemonRestartNotice.test.ts      | 156 +++++++++++++++++-
 ...-restart-notice-once_2026-09-29-07-20.json |  11 ++
 6 files changed, 222 insertions(+), 24 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/r06-t222-restart-notice-once_2026-09-29-07-20.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index e9f29b7ec9..9ba821298e 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -344,6 +344,13 @@ startup error: `rush-client: A command's environment differed from the daemon's
 NODE_OPTIONS; the restarted daemon did not start: <startup error>`. A variable that keeps
 the daemon from starting is then among the names in that line.
 
+The client leaves out the `…; restarted the daemon (PID <pid>).` line of either kind when
+the command already wrote a wait line (see above) for the same cause since it last
+restarted, because that line said why the daemon restarts: the same variables, or the same
+change to the same installation. The wait line counts when it was written as a line, on
+stderr or as an agent status line on a pipe. With agent output on a terminal, the wait is
+only in the live rows, so the line is printed above them.
+
 When the connection is lost before a command's result, the command fails with exit code 1
 and is not retried. The diagnostic keeps "Daemon disconnected before delivering a result; the
 command was not retried." and says what happened to rushd. If its process exited (a crash, an
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 8b29a36de6..8fa8527818 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -339,17 +339,20 @@ export class AgentProgressRenderer {
    * The request waits for a daemon restart, and `wait` says why and for what. The phase and the status lines say
    * that instead of a queue position. On a pipe, `announce` writes a status line at once, so that the wait and its
    * cause are known when the wait begins or its cause changes, rather than at the next status line. Once the client
-   * asked rushd to cancel the request, the cancelling phase stays, and nothing is written.
+   * asked rushd to cancel the request, the cancelling phase stays, and nothing is written. Returns whether it wrote
+   * a line.
    */
-  public onRestartWait(wait: string, announce: boolean): void {
+  public onRestartWait(wait: string, announce: boolean): boolean {
     if (this.#cancelling) {
-      return;
+      return false;
     }
     this.#queued = undefined;
     this.setPhase(wait);
-    if (announce && !this.#options.isTTY) {
-      this.#writePipeLine(this.#getStatusLine());
+    if (!announce || this.#options.isTTY || this.#stopped) {
+      return false;
     }
+    this.#writePipeLine(this.#getStatusLine());
+    return true;
   }
 
   /**
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index e116ad7455..95ad73b86e 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -160,13 +160,34 @@ function getRestartWaitCause(wait: IDaemonRestartWait): string {
   return `${anotherRequest}:${cause ?? wait.reason.kind}`;
 }
 
+/**
+ * Whether a restart wait line for `waitReason` already said why the daemon restarted for `reason`, so that the
+ * restart notice would only repeat it: the same variables, or the same change to the same installation.
+ */
+function isRestartCauseWritten(
+  waitReason: DaemonRestartReason | undefined,
+  reason: DaemonRestartReason | undefined
+): boolean {
+  if (waitReason?.kind === 'environmentChanged' && reason?.kind === 'environmentChanged') {
+    const names: readonly string[] = reason.variableNames;
+    return (
+      waitReason.variableNames.length === names.length &&
+      waitReason.variableNames.every((name: string, index: number) => name === names[index])
+    );
+  }
+  if (waitReason?.kind === 'installationChanged' && reason?.kind === 'installationChanged') {
+    return waitReason.folder === reason.folder && waitReason.change === reason.change;
+  }
+  return false;
+}
+
 /** The agent renderer methods that tell an agent why a request waits or restarted. */
 export interface IAgentRequestNoticeRenderer {
   note(line: string): void;
   setPhase(phase: string): void;
   onQueuePosition(position: number): void;
-  /** See `AgentProgressRenderer.onRestartWait`. */
-  onRestartWait(wait: string, announce: boolean): void;
+  /** See `AgentProgressRenderer.onRestartWait`. Returns whether it wrote the wait as a line. */
+  onRestartWait(wait: string, announce: boolean): boolean;
 }
 
 /**
@@ -220,8 +241,9 @@ interface IRestartWaitState {
 /**
  * Creates the callbacks that tell the user why a request waits or restarted. The lines name the daemon that serves
  * the request, which changes when the request follows a restart. A restart wait line is repeated until the request
- * restarts, gets input, output or an event, or waits for plain admission instead. Once the request ends or the
- * client asks rushd to cancel it (see `dispose`), nothing more is written.
+ * restarts, gets input, output or an event, or waits for plain admission instead. A restart gets no notice when the
+ * request already wrote a wait line for the same cause since it last restarted, since that line said why. Once the
+ * request ends or the client asks rushd to cancel it (see `dispose`), nothing more is written.
  */
 export function createDaemonRequestNoticeHandlers(
   target: IDaemonRequestNoticeTarget
@@ -233,6 +255,8 @@ export function createDaemonRequestNoticeHandlers(
   let daemonPid: number | undefined = target.daemonPid;
   let restartWait: IRestartWaitState | undefined;
   let showedRestartWait: boolean = false;
+  // The reason of the last wait line written as a line since the request last restarted.
+  let writtenWaitReason: DaemonRestartReason | undefined;
   let disposed: boolean = false;
 
   const endRestartWait = (): void => {
@@ -247,6 +271,7 @@ export function createDaemonRequestNoticeHandlers(
     state.timer.unref?.();
     const elapsedMs: number = now() - state.startedAtMs;
     const line: string = formatDaemonRestartWait({ ...state.wait, daemonPid, elapsedMs });
+    writtenWaitReason = state.wait.reason;
     await target.writeStderrAsync(`${prefix}: ${line}.\n`);
   };
 
@@ -254,7 +279,9 @@ export function createDaemonRequestNoticeHandlers(
     onRestartAsync: async (notice: IDaemonRestartNotice): Promise<void> => {
       endRestartWait();
       daemonPid = notice.successorPid;
-      await writeRestartNoticeAsync(notice);
+      const waitReason: DaemonRestartReason | undefined = writtenWaitReason;
+      writtenWaitReason = undefined;
+      if (!isRestartCauseWritten(waitReason, notice.reason)) await writeRestartNoticeAsync(notice);
       // The phase still says that the request waits for the previous daemon.
       if (agentRenderer && showedRestartWait) agentRenderer.setPhase(RESUBMITTED_PHASE);
       showedRestartWait = false;
@@ -291,7 +318,7 @@ export function createDaemonRequestNoticeHandlers(
       if (agentRenderer) {
         showedRestartWait = true;
         // The agent renderer's own status lines repeat the phase.
-        agentRenderer.onRestartWait(line, announce);
+        if (agentRenderer.onRestartWait(line, announce)) writtenWaitReason = restartReason;
       } else if (announce || (stderrIsTTY && changed)) {
         await writeRestartWaitAsync(state);
       }
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index c822fd4174..e2cc6c9db7 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1313,13 +1313,15 @@ describe(AgentProgressRenderer.name, () => {
       advance(clock, 400);
       renderer.onQueuePosition(1);
       advance(clock, 600);
-      renderer.onRestartWait(wait('2 running requests'), true);
+      // It says whether it wrote the wait as a line, so the client knows whether a restart notice would repeat it.
+      expect(renderer.onRestartWait(wait('2 running requests'), true)).toBe(true);
       advance(clock, 1000);
-      renderer.onRestartWait(wait('1 running request'), false);
+      expect(renderer.onRestartWait(wait('1 running request'), false)).toBe(false);
       advance(clock, 23_999);
       expect(lines()).toHaveLength(2);
       advance(clock, 1);
       renderer.dispose();
+      expect(renderer.onRestartWait(wait('3 running requests'), true)).toBe(false);
       expect(lines()).toEqual([
         'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
         `rush build · 1.0s · ${wait('2 running requests')}`,
@@ -1333,10 +1335,10 @@ describe(AgentProgressRenderer.name, () => {
         'waiting for 1 running request to finish; the daemon (PID 41) then restarts, because x changed';
       renderer.start();
       renderer.onRequestSent();
-      renderer.onRestartWait(wait, true);
+      expect(renderer.onRestartWait(wait, true)).toBe(true);
       advance(clock, 2000);
       renderer.onCancelRequested(5_000);
-      renderer.onRestartWait(`${wait} again`, true);
+      expect(renderer.onRestartWait(`${wait} again`, true)).toBe(false);
       advance(clock, 25_000);
       renderer.dispose();
       expect(lines()).toEqual([
@@ -1382,10 +1384,12 @@ describe(AgentProgressRenderer.name, () => {
   it('shows a restart wait as the phase of the live rows on a TTY, and writes no line for it', () => {
     const { renderer, output } = createRenderer(true, 'build', 200);
     renderer.start();
-    renderer.onRestartWait(
-      'waiting for 1 running request to finish; the daemon (PID 41) then restarts',
-      true
-    );
+    expect(
+      renderer.onRestartWait(
+        'waiting for 1 running request to finish; the daemon (PID 41) then restarts',
+        true
+      )
+    ).toBe(false);
     expect(output).toHaveLength(2);
     expect(output[1].replace(ANSI_ESCAPE, '')).toMatch(
       /^. rush build · 0\.0s · waiting for 1 running request to finish; the daemon \(PID 41\) then restarts\n/
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index f8096ff9dd..b4a9f6cf24 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -283,11 +283,18 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     jest.advanceTimersByTime(ms);
   }
 
-  function createHandlers(options: { agent: boolean; stderrIsTTY: boolean; rushx?: boolean }): {
+  function createHandlers(options: {
+    agent: boolean;
+    stderrIsTTY: boolean;
+    rushx?: boolean;
+    // Whether the agent renderer writes an announced wait as a line, as it does on a pipe.
+    agentWritesWaitLines?: boolean;
+  }): {
     calls: string[];
     handlers: IDaemonRequestNoticeHandlers;
   } {
     const calls: string[] = [];
+    const agentWritesWaitLines: boolean = options.agentWritesWaitLines ?? true;
     const handlers: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
       rushx: !!options.rushx,
       stderrIsTTY: options.stderrIsTTY,
@@ -298,8 +305,10 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
             note: (line: string) => calls.push(`note: ${line}`),
             setPhase: (phase: string) => calls.push(`phase: ${phase}`),
             onQueuePosition: (position: number) => calls.push(`position: ${position}`),
-            onRestartWait: (wait: string, announce: boolean) =>
-              calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`)
+            onRestartWait: (wait: string, announce: boolean) => {
+              calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`);
+              return announce && agentWritesWaitLines;
+            }
           }
         : undefined,
       writeStderrAsync: async (text: string) => {
@@ -311,6 +320,24 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
 
   const LOCKFILE_WAIT: string =
     'the daemon (PID 41) then restarts, because common/config/rush/pnpm-lock.yaml changed';
+  const ENV_NODE_OPTIONS: DaemonRestartReason = {
+    kind: 'environmentChanged',
+    variableNames: ['NODE_OPTIONS']
+  };
+  const ENV_BOTH: DaemonRestartReason = {
+    kind: 'environmentChanged',
+    variableNames: ['NODE_OPTIONS', 'RUSH_X']
+  };
+  const REPLACED: DaemonRestartReason = {
+    kind: 'installationChanged',
+    change: 'replaced',
+    folder: '/snapshots/s9'
+  };
+  const REMOVED_S10: DaemonRestartReason = {
+    kind: 'installationChanged',
+    change: 'removed',
+    folder: '/snapshots/s10'
+  };
 
   describe.each([
     ['rush-client', false],
@@ -430,16 +457,109 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
         await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
         await handlers.onQueuePositionAsync(1, LOCKFILE, {});
         handlers.dispose();
+        // The wait line said why the daemon restarted, so the restart gets no notice (task 222).
         expect(calls).toEqual([
           ...(stderrIsTTY ? [`stderr: ${client}: waiting for daemon admission (position 3).\n`] : []),
           `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, because ` +
             'its installation at /snapshots/s9 was removed.\n',
-          `stderr: ${client}: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).\n`,
           `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 42) then restarts, because ` +
             'common/config/rush/pnpm-lock.yaml changed.\n'
         ]);
       }
     });
+
+    it('gives no restart notice when a wait line since the last restart gave its cause (task 222)', async () => {
+      const cases: [DaemonRestartReason, IDaemonRestartWaitDetails, DaemonRestartReason][] = [
+        [
+          ENV_BOTH,
+          { scriptCount: 1 },
+          { kind: 'environmentChanged', variableNames: ['NODE_OPTIONS', 'RUSH_X'] }
+        ],
+        [REMOVED, {}, { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' }],
+        // The wait line names the variables of the request that the daemon restarts for, and so does the notice.
+        [ENV_NODE_OPTIONS, ANOTHER, ENV_NODE_OPTIONS]
+      ];
+      for (const stderrIsTTY of [false, true]) {
+        for (const [waitReason, details, reason] of cases) {
+          const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+          await handlers.onQueuePositionAsync(1, waitReason, details);
+          advance(RESTART_WAIT_REPEAT_MS);
+          await handlers.onRestartAsync({ restart: 1, reason, successorPid: 42 });
+          advance(RESTART_WAIT_REPEAT_MS * 2);
+          handlers.dispose();
+          expect(calls).toHaveLength(2);
+          expect(calls[1]).toBe(calls[0].replace(': waiting for ', ': still waiting after 25s for '));
+        }
+      }
+    });
+
+    it('gives the restart notice when no wait line since the last restart gave its cause (task 222)', async () => {
+      const notice = (cause: string, pid: number): string =>
+        `stderr: ${client}: ${cause}; restarted the daemon (PID ${pid}).\n`;
+      const cases: [string, (handlers: IDaemonRequestNoticeHandlers) => Promise<void>, string][] = [
+        [
+          'other variables',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, ENV_NODE_OPTIONS, {});
+            await handlers.onRestartAsync({ restart: 1, reason: ENV_BOTH, successorPid: 42 });
+          },
+          notice("A command's environment differed from the daemon's in NODE_OPTIONS and RUSH_X", 42)
+        ],
+        [
+          'another change',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, REMOVED, {});
+            await handlers.onRestartAsync({ restart: 1, reason: REPLACED, successorPid: 42 });
+          },
+          notice("The daemon's installation at /snapshots/s9 was replaced", 42)
+        ],
+        [
+          'another installation',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, REMOVED, {});
+            await handlers.onRestartAsync({ restart: 1, reason: REMOVED_S10, successorPid: 42 });
+          },
+          notice("The daemon's installation at /snapshots/s10 was removed", 42)
+        ],
+        [
+          'another kind',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+            await handlers.onRestartAsync({ restart: 1, reason: ENV_NODE_OPTIONS, successorPid: 42 });
+          },
+          notice("A command's environment differed from the daemon's in NODE_OPTIONS", 42)
+        ],
+        [
+          'a plain position',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1);
+            await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+          },
+          notice("The daemon's installation at /snapshots/s9 was removed", 42)
+        ],
+        [
+          'a second restart',
+          async (handlers) => {
+            await handlers.onQueuePositionAsync(1, REMOVED, {});
+            await handlers.onRestartAsync({ restart: 1, reason: REMOVED, successorPid: 42 });
+            await handlers.onRestartAsync({ restart: 2, reason: REMOVED, successorPid: 43 });
+          },
+          notice("The daemon's installation at /snapshots/s9 was removed", 43)
+        ]
+      ];
+      for (const stderrIsTTY of [false, true]) {
+        for (const [name, runAsync, expected] of cases) {
+          const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+          await runAsync(handlers);
+          handlers.dispose();
+          expect([name, calls.filter((call: string) => call.includes('restarted the daemon'))]).toEqual([
+            name,
+            [expected]
+          ]);
+          expect(calls[calls.length - 1]).toBe(expected);
+        }
+      }
+    });
   });
 
   it('shows a restart wait as the agent phase, announces each cause, and names the new daemon after the restart', async () => {
@@ -453,17 +573,43 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     await handlers.onQueuePositionAsync(1, REMOVED, {});
     handlers.dispose();
     const removed: string = 'because its installation at /snapshots/s9 was removed';
+    // The renderer wrote the announced wait as a line, which said why the daemon restarted, so the restart gets no
+    // note (task 222).
     expect(calls).toEqual([
       'position: 2',
       `announce: waiting for 2 running requests to finish, including 1 rushx script; ${LOCKFILE_WAIT}`,
       `wait: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`,
       `announce: waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${removed}`,
-      "note: rush-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).",
       `phase: ${RESUBMITTED_PHASE}`,
       `announce: waiting for 1 running request to finish; the daemon (PID 42) then restarts, ${removed}`
     ]);
   });
 
+  it('gives the agent a note for the restart only when the renderer wrote no line for its wait (task 222)', async () => {
+    const wait: string =
+      "waiting for 1 running request to finish; the daemon (PID 41) then restarts, because this request's " +
+      "environment differs from the daemon's in NODE_OPTIONS";
+    for (const agentWritesWaitLines of [true, false]) {
+      const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false, agentWritesWaitLines });
+      await handlers.onQueuePositionAsync(1, ENV_NODE_OPTIONS, {});
+      await handlers.onQueuePositionAsync(1, ENV_NODE_OPTIONS, {});
+      await handlers.onRestartAsync({ restart: 1, reason: ENV_NODE_OPTIONS, successorPid: 42 });
+      handlers.dispose();
+      // On a TTY, the wait was only in the live rows, which the renderer then redraws.
+      expect(calls).toEqual([
+        `announce: ${wait}`,
+        `wait: ${wait}`,
+        ...(agentWritesWaitLines
+          ? []
+          : [
+              "note: rush-client: A command's environment differed from the daemon's in NODE_OPTIONS; restarted " +
+                'the daemon (PID 42).'
+            ]),
+        `phase: ${RESUBMITTED_PHASE}`
+      ]);
+    }
+  });
+
   it('keeps the agent phase after a restart that the request did not wait for', async () => {
     const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
     await handlers.onQueuePositionAsync(1);
diff --git a/common/changes/@rushstack/rush-cli-client/r06-t222-restart-notice-once_2026-09-29-07-20.json b/common/changes/@rushstack/rush-cli-client/r06-t222-restart-notice-once_2026-09-29-07-20.json
new file mode 100644
index 0000000000..ed18d30bda
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r06-t222-restart-notice-once_2026-09-29-07-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Skip the daemon restart line when the command already printed a wait line for the same cause since it last restarted.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From d3faa08ca771c95b81f020b5d1e93af8a3332a39 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 126/265] [rush-cli-client] Test that the early daemon check
 reads "enabled" only inside the daemon block

Swarm integration step 111; original commit fb6df36f6e (merge of swarm/r04-t60-nit2 at 91b9f8abf6).
Refs: task 60 NIT 2, ch01 board 4131.
Scope: task 60-nit2.

Brings 60-nit2 (branch swarm/r04-t60-nit2). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 17 of 21. Gate: ch01 GATE OK board 4527 (tree b7717d801e)

Commits folded into this step (1):
- 91b9f8abf6 Test that the early daemon check reads "enabled" only inside the daemon block (task 60 NIT 2, ch01 board 4131)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/src/test/earlyRouting.test.ts    |  6 ++++++
 .../swarm-r04-t60-nit2_2026-09-29-07-56.json          | 11 +++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t60-nit2_2026-09-29-07-56.json

diff --git a/apps/rush-cli-client/src/test/earlyRouting.test.ts b/apps/rush-cli-client/src/test/earlyRouting.test.ts
index 3485ee9bd8..95a86ed680 100644
--- a/apps/rush-cli-client/src/test/earlyRouting.test.ts
+++ b/apps/rush-cli-client/src/test/earlyRouting.test.ts
@@ -49,6 +49,12 @@ describe(isDaemonOffBeforeRouting.name, () => {
     expect(isOff('{ "daemon": { "compatiblePlugins": ["p"], "enabled": true } }')).toBe(false);
   });
 
+  it('reads "enabled" only inside the daemon block', () => {
+    expect(isOff('{ "daemon": {}, "x": { "enabled": true } }')).toBe(true);
+    expect(isOff('{ "x": { "enabled": true }, "daemon": { "enabled": false } }')).toBe(true);
+    expect(isOff('{ "x": { "enabled": false }, "daemon": { "enabled": true } }')).toBe(false);
+  });
+
   it('ignores the daemon block that `rush init` writes as comments', () => {
     expect(isOff('{\n  // "daemon": {\n  //   "enabled": true\n  // },\n  "projects": []\n}')).toBe(true);
     expect(isOff('{\n  /* "daemon": { "enabled": true } */\n  "projects": []\n}')).toBe(true);
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t60-nit2_2026-09-29-07-56.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t60-nit2_2026-09-29-07-56.json
new file mode 100644
index 0000000000..30a89bf097
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t60-nit2_2026-09-29-07-56.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test that the early daemon check reads \"enabled\" only inside rush.json's daemon block.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From e0eb3c36edd3222caba070801380c34da181f8ee Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:57 +0000
Subject: [PATCH 127/265] [rush-client-core, rush-cli-client] Test the startup
 cases that n133's mutants left untested (ch01 NITs 5-8)

Swarm integration step 112; original commit 2fabfdd173 (merge of swarm/o04-t133-nits-int at d90ccebd9d).
Scope: task 133-nits.

Brings 133-nits (branch swarm/o04-t133-nits-int). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 18 of 21. Gate: ch01 GATE OK board 4527 (tree 2223e4225f)

Commits folded into this step (1):
- bfddf14b39 [rush-client-core, rush-cli-client] Test the startup cases that n133's mutants left untested (ch01 NITs 5-8)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/startupPendingFallback.test.ts   | 31 ++++++++++++-
 .../src/test/StartupLock.test.ts              | 41 +++++++++++++++--
 .../test/connectOrAwaitDaemonStartup.test.ts  | 44 +++++++++++++++++++
 .../src/test/connectOrStartDaemon.test.ts     | 41 +++++++++++++++++
 .../src/test/fixtures/daemon.ts               | 12 ++++-
 5 files changed, 162 insertions(+), 7 deletions(-)

diff --git a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
index 32dd799881..6434be9fb7 100644
--- a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
+++ b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
@@ -4,7 +4,8 @@
 jest.mock('@microsoft/rush/lib/start', () => ({}));
 jest.mock('@rushstack/rush-client-core', () => ({
   ...jest.requireActual('@rushstack/rush-client-core'),
-  connectOrAwaitDaemonStartupAsync: jest.fn()
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  connectToStartingDaemonAsync: jest.fn()
 }));
 
 import * as fs from 'node:fs';
@@ -14,7 +15,8 @@ import * as path from 'node:path';
 import {
   DaemonClientError,
   DaemonStartupPendingError,
-  connectOrAwaitDaemonStartupAsync
+  connectOrAwaitDaemonStartupAsync,
+  connectToStartingDaemonAsync
 } from '@rushstack/rush-client-core';
 
 import { AgentProgressRenderer } from '../AgentProgressRenderer';
@@ -54,6 +56,7 @@ describe('a daemon startup failure', () => {
     process.env = originalEnvironment;
     jest.restoreAllMocks();
     jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(connectToStartingDaemonAsync).mockReset();
     fs.rmSync(folder, { recursive: true });
   });
 
@@ -111,4 +114,28 @@ describe('a daemon startup failure', () => {
       'rush-client: No ready daemon; auto-start is disabled; using in-process Rush.\n'
     );
   });
+
+  it('fails daemon stop without stopping a daemon that is still starting, and says to run stop again', async () => {
+    process.argv = [process.execPath, 'rush-client', 'daemon', 'stop'];
+    const pending: string = `The daemon at ${path.join(folder, 'd.sock')} is still starting after 15 s. Another client is still starting the daemon.`;
+    jest.mocked(connectToStartingDaemonAsync).mockImplementation(async (options) => {
+      options.onAwaitStartup?.('Another client is still starting the daemon', 15000);
+      throw new DaemonStartupPendingError(pending);
+    });
+    const error: Error = await launchClientAsync(false).then(
+      () => new Error('Expected daemon stop to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toBe(
+      `${pending} It was not stopped; run "rush-client daemon stop" again once "rush-client daemon status" reports it ready.`
+    );
+    expect(connectToStartingDaemonAsync).toHaveBeenCalledTimes(1);
+    expect(output.mock.calls).toEqual([
+      [
+        'rush-client: The daemon is not ready yet. Another client is still starting the daemon, ' +
+          'so stop waits up to 15 s for it to become ready and then stops it.\n'
+      ]
+    ]);
+    expect(connectOrAwaitDaemonStartupAsync).not.toHaveBeenCalled();
+  });
 });
diff --git a/libraries/rush-client-core/src/test/StartupLock.test.ts b/libraries/rush-client-core/src/test/StartupLock.test.ts
index 0c4a412322..54a881914c 100644
--- a/libraries/rush-client-core/src/test/StartupLock.test.ts
+++ b/libraries/rush-client-core/src/test/StartupLock.test.ts
@@ -5,6 +5,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { isStartupLockFilePresent, tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
@@ -55,11 +56,45 @@ it('reports a start mutex lock file without acquiring the mutex', async () => {
     await lock!.releaseAsync();
     lock = undefined;
     expect(isStartupLockFilePresent(paths)).toBe(false);
-    expect(isStartupLockFilePresent({ ...paths, lockfilePath: path.join(folder, 'missing', 'daemon.pid.json') })).toBe(
-      false
-    );
+    expect(
+      isStartupLockFilePresent({ ...paths, lockfilePath: path.join(folder, 'missing', 'daemon.pid.json') })
+    ).toBe(false);
   } finally {
     await lock?.releaseAsync();
     await removeTestFolderAsync(folder);
   }
 });
+
+it('reports a start mutex lock file with the name that LockFile gives it on Windows', async () => {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-start-lock-'));
+  const paths: IDaemonPaths = {
+    lockfilePath: path.join(folder, 'daemon.pid.json'),
+    socketPath:
+      process.platform === 'win32'
+        ? `\\\\.\\pipe\\${path.basename(folder)}`
+        : path.join(folder, 'daemon.sock')
+  };
+  const windowsLockPath: string = getWindowsLockFilePath(folder, 'daemon.pid.json-start');
+  try {
+    expect(path.basename(windowsLockPath)).toBe('daemon.pid.json-start.lock');
+    // Names that only begin like it don't count.
+    fs.writeFileSync(path.join(folder, 'daemon.pid.json-starter.lock'), '');
+    fs.writeFileSync(`${windowsLockPath}.tmp`, '');
+    expect(isStartupLockFilePresent(paths)).toBe(false);
+    fs.writeFileSync(windowsLockPath, '');
+    expect(isStartupLockFilePresent(paths)).toBe(true);
+  } finally {
+    await removeTestFolderAsync(folder);
+  }
+});
+
+/** The lock file that `LockFile` names without a PID, as it does on Windows. */
+function getWindowsLockFilePath(folder: string, resourceName: string): string {
+  const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+  Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+  try {
+    return LockFile.getLockFilePath(folder, resourceName);
+  } finally {
+    Object.defineProperty(process, 'platform', platform);
+  }
+}
diff --git a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
index 8e638ebeb9..f2e847985d 100644
--- a/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrAwaitDaemonStartup.test.ts
@@ -15,6 +15,7 @@ import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import type { DaemonClient } from '../DaemonClient';
 import { DaemonClientError } from '../DaemonClientError';
+import * as DaemonOwnership from '../DaemonOwnership';
 import { getDaemonStartupFilePath } from '../DaemonStartup';
 import {
   DaemonStartupPendingError,
@@ -398,6 +399,49 @@ describe('connectOrAwaitDaemonStartupAsync', () => {
       expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8')).toBe(`${daemonPid}\n`);
     }, 30000);
 
+    it('connects to a daemon that became ready between its first connect and its check for a live owner', async () => {
+      // The daemon waits to listen until this client has found nothing listening, and is ready before that check
+      // returns. Then nothing owns a startup, so only the last connect can find the ready daemon.
+      fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+      const daemon = run('daemon.js', [JSON.stringify(paths)]);
+      const daemonPid: number = Number(await waitForFileAsync(path.join(folder, 'prebind')));
+      // This test, not a startup helper, is the daemon's parent, so afterEach must not wait for it to exit.
+      expect(fs.readFileSync(path.join(folder, 'parents'), 'utf8')).toBe(`${process.pid}\n`);
+      fs.unlinkSync(path.join(folder, 'parents'));
+      const isEndpointUnboundAsync: (socketPath: string) => Promise<boolean> =
+        DaemonOwnership.isEndpointUnboundAsync;
+      const endpointCheck: jest.SpyInstance = jest
+        .spyOn(DaemonOwnership, 'isEndpointUnboundAsync')
+        .mockImplementation(async (socketPath: string) => {
+          const unbound: boolean = await isEndpointUnboundAsync(socketPath);
+          fs.unlinkSync(path.join(folder, 'hold-prebind'));
+          const deadline: number = Date.now() + 10000;
+          while ((await isEndpointUnboundAsync(socketPath)) && Date.now() < deadline) await delayAsync(20);
+          return unbound;
+        });
+      const onAwaitStartup: jest.Mock = jest.fn();
+      try {
+        const client: DaemonClient | undefined = await connectToStartingDaemonAsync({
+          ...options,
+          onAwaitStartup
+        });
+        expect(endpointCheck).toHaveBeenCalledTimes(1);
+        expect(client).toBeDefined();
+        const { pid } = await client!.status;
+        await client!.closeAsync();
+        expect(pid).toBe(daemonPid);
+      } finally {
+        endpointCheck.mockRestore();
+      }
+      expect(onAwaitStartup).not.toHaveBeenCalled();
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      expect(await daemon.result).toEqual({
+        code: 0,
+        stdout: 'launcher stdout\n',
+        stderr: 'launcher stderr\n'
+      });
+    }, 30000);
+
     it('waits while another client holds the start mutex, until it is released or the wait is aborted', async () => {
       const holder = run('startLockHolder.js', [JSON.stringify(paths)]);
       await waitForFileAsync(path.join(folder, 'lock-held'));
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index aaf656174d..d3a49f61a1 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -429,6 +429,47 @@ describe('detached daemon startup', () => {
     expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
   }, 15000);
 
+  it('waits out its deadline for a daemon that became ready and still has its lockfile', async () => {
+    // As above, the helper sees the daemon ready and this client never connects, but the daemon stays up.
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({
+      ...options,
+      startupTimeoutMs: 3000,
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'other'] }
+    }).then(
+      () => new Error('Expected startup to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toContain('Daemon startup timed out awaiting hello/ping readiness.');
+    expect(Date.now() - started).toBeGreaterThanOrEqual(3000);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(false);
+  }, 15000);
+
+  it('waits out its deadline while another startup is reserved after the daemon that became ready exited', async () => {
+    // As above, but the daemon exits once it has reserved another startup, as a successor's starter would.
+    const started: number = Date.now();
+    const error: Error = await connectOrStartDaemonAsync({
+      ...options,
+      startupTimeoutMs: 3000,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'other', 'reserve-and-stop-when-ready']
+      }
+    }).then(
+      () => new Error('Expected startup to fail.'),
+      (failure: Error) => failure
+    );
+    expect(error.message).toContain('Daemon startup timed out awaiting hello/ping readiness.');
+    expect(Date.now() - started).toBeGreaterThanOrEqual(3000);
+    const daemonPids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+    expect(daemonPids).toHaveLength(1);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(JSON.parse(fs.readFileSync(getDaemonStartupFilePath(paths), 'utf8'))).toMatchObject({
+      helperPid: Number(daemonPids[0])
+    });
+  }, 15000);
+
   it('refuses a relaunch while a process accepts connections at the endpoint', async () => {
     const sockets: Set<net.Socket> = new Set();
     // Accepts connections but never completes hello, like a daemon that listens but is not ready.
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 7d12ee38cd..9675772ec3 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -18,7 +18,7 @@ import {
 } from '@rushstack/rush-daemon-transport';
 
 import { connectOrStartDaemonAsync } from '../../connectOrStartDaemon';
-import { getDaemonStartupFilePath } from '../../DaemonStartup';
+import { getDaemonStartupFilePath, reserveDaemonStartup } from '../../DaemonStartup';
 import { OPERATION_SCRIPT } from '../OrphanedOperation';
 
 async function mainAsync(): Promise<void> {
@@ -182,11 +182,19 @@ async function mainAsync(): Promise<void> {
   });
   const expiry: number = Date.now() + 10000;
   const timer = setInterval(() => {
+    // The startup helper releases its reservation once it has seen this daemon ready.
+    const readySeen: boolean =
+      (mode === 'stop-when-ready' || mode === 'reserve-and-stop-when-ready') &&
+      !fs.existsSync(getDaemonStartupFilePath(paths));
+    if (readySeen && mode === 'reserve-and-stop-when-ready') {
+      // Like a daemon that exits while another startup is reserved, for example its successor's.
+      reserveDaemonStartup(paths, { pid: process.pid, startedAt: new Date().toISOString() });
+    }
     const stopRequested: boolean =
       fs.existsSync(path.join(folder, 'stop')) ||
       Date.now() >= expiry ||
       // Like a "daemon stop" that arrives as soon as the startup helper has seen this daemon ready.
-      (mode === 'stop-when-ready' && !fs.existsSync(getDaemonStartupFilePath(paths)));
+      readySeen;
     if (!stopRequested) return;
     void stopAsync().catch((error: Error) => {
       process.stderr.write(`${error.stack}\n`);

From ea74314d95123082f4321d5500013055ea4502db Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 128/265] [rush-daemon-transport] Stat sockets with { bigint:
 true }

Swarm integration step 113; original commit 4c623537e7 (merge of swarm/r01-t210 at 1f23d6b61e).
Refs: task 210.
Scope: task 210.

Brings 210 (branch swarm/r01-t210). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 19 of 21. Gate: ch01 GATE OK board 4527 (tree f102fad908)

Commits folded into this step (1):
- 1f23d6b61e rush-daemon-transport: stat sockets with { bigint: true } (task 210)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...1-bigint-socket-stat_2026-09-29-07-40.json | 11 +++
 .../src/DaemonFileIdentity.ts                 | 33 +++++--
 .../src/DaemonRuntimeFolderCheck.ts           | 23 ++---
 .../src/DaemonSocketPublication.ts            |  8 +-
 .../rush-daemon-transport/src/DaemonUnlink.ts | 22 +++++
 .../src/test/LinkedPackageFixture.ts          | 87 +++++++++++++++++++
 .../src/test/RequireAfterSocketStat.test.ts   | 54 ++++++++++++
 .../src/test/Unlink.test.ts                   | 40 +++++++++
 8 files changed, 257 insertions(+), 21 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r01-bigint-socket-stat_2026-09-29-07-40.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonUnlink.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/Unlink.test.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/r01-bigint-socket-stat_2026-09-29-07-40.json b/common/changes/@rushstack/rush-daemon-transport/r01-bigint-socket-stat_2026-09-29-07-40.json
new file mode 100644
index 0000000000..4bc6c5f4af
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r01-bigint-socket-stat_2026-09-29-07-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Stat the daemon's socket and the runtime folder with `{ bigint: true }`, and delete sockets without `fs.rmSync`, which stats them first. On Node 22, a plain stat of a socket or FIFO left its type in the stat array that Node's cached `fs.realpathSync` reads (nodejs/node#65113), so the next `require()` in the process could load a package through its symbolic link and then fail to find the package's dependencies. For example, when another user had put a socket or FIFO at the runtime folder's name in `/tmp`, a client that fell back to in-process Rush failed with \"Cannot find module\".",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
index 34b959f3fd..c6db7f83cc 100644
--- a/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
+++ b/libraries/rush-daemon-transport/src/DaemonFileIdentity.ts
@@ -3,6 +3,8 @@
 
 import * as fs from 'node:fs';
 
+import { unlinkIfPresent } from './DaemonUnlink';
+
 const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 const READ_ONLY: string = 'r';
 const NOT_A_DIRECTORY: string = 'ENOTDIR';
@@ -15,9 +17,19 @@ export interface IDaemonFileIdentity {
   readonly fd?: number;
 }
 
-function lstatIfPresent(filePath: string): fs.Stats | undefined {
+/**
+ * Every stat here uses `{ bigint: true }`, which fills a stat array of its own. A plain stat of a socket leaves
+ * the socket's type in the array that Node 22's cached `fs.realpathSync` reads (nodejs/node#65113), and the next
+ * `require()` in the process could then load a package through its symbolic link. Pinned and read identities
+ * are converted the same way, so they compare equal.
+ */
+function toIdentity(stats: fs.BigIntStats): IDaemonFileIdentity {
+  return { dev: Number(stats.dev), ino: Number(stats.ino) };
+}
+
+function lstatIfPresent(filePath: string): fs.BigIntStats | undefined {
   try {
-    return fs.lstatSync(filePath, { throwIfNoEntry: false });
+    return fs.lstatSync(filePath, { bigint: true, throwIfNoEntry: false });
   } catch (error) {
     // A folder on the path that became a file leaves nothing at the path, as a deletion does.
     if ((error as NodeJS.ErrnoException).code !== NOT_A_DIRECTORY) throw error;
@@ -27,8 +39,13 @@ function lstatIfPresent(filePath: string): fs.Stats | undefined {
 
 /** The identity of the file (not a link target) at `filePath`, or `undefined` when nothing is there. */
 export function readFileIdentity(filePath: string): IDaemonFileIdentity | undefined {
-  const stats: fs.Stats | undefined = lstatIfPresent(filePath);
-  return stats && { dev: stats.dev, ino: stats.ino };
+  const stats: fs.BigIntStats | undefined = lstatIfPresent(filePath);
+  return stats && toIdentity(stats);
+}
+
+/** The identity of the file (not a link target) at `filePath`. Throws when nothing is there. */
+export function getFileIdentity(filePath: string): IDaemonFileIdentity {
+  return toIdentity(fs.lstatSync(filePath, { bigint: true }));
 }
 
 /**
@@ -41,10 +58,10 @@ export function readFileIdentity(filePath: string): IDaemonFileIdentity | undefi
  */
 export function pinFileIdentity(filePath: string): IDaemonFileIdentity {
   const fd: number = fs.openSync(filePath, READ_ONLY);
-  const { dev, ino } = fs.fstatSync(fd);
-  if (process.platform !== WINDOWS_PLATFORM) return { dev, ino, fd };
+  const identity: IDaemonFileIdentity = toIdentity(fs.fstatSync(fd, { bigint: true }));
+  if (process.platform !== WINDOWS_PLATFORM) return { ...identity, fd };
   fs.closeSync(fd);
-  return { dev, ino };
+  return identity;
 }
 
 function isSameFile(current: IDaemonFileIdentity | undefined, expected: IDaemonFileIdentity): boolean {
@@ -67,7 +84,7 @@ function release(identity: IDaemonFileIdentity): void {
 export function removeOwnFile(filePath: string, identity: IDaemonFileIdentity | undefined): void {
   if (!identity) return;
   try {
-    if (isSameFile(readFileIdentity(filePath), identity)) fs.rmSync(filePath, { force: true });
+    if (isSameFile(readFileIdentity(filePath), identity)) unlinkIfPresent(filePath);
   } finally {
     release(identity);
   }
diff --git a/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts b/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
index a9cce175ec..6d782b4f17 100644
--- a/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
+++ b/libraries/rush-daemon-transport/src/DaemonRuntimeFolderCheck.ts
@@ -14,22 +14,22 @@ const NO_MODE_BITS: number = 0;
 const OCTAL_RADIX: number = 8;
 
 interface IUnsafeFolderCheck {
-  readonly isUnsafe: (stats: fs.Stats, uid: number | undefined) => boolean;
+  readonly isUnsafe: (stats: fs.BigIntStats, uid: number | undefined) => boolean;
   readonly reason: string;
 }
 
 const UNSAFE_FOLDER_CHECKS: readonly IUnsafeFolderCheck[] = [
-  { isUnsafe: (stats: fs.Stats) => stats.isSymbolicLink(), reason: 'it is a symbolic link' },
-  { isUnsafe: (stats: fs.Stats) => !stats.isDirectory(), reason: 'it is not a directory' },
+  { isUnsafe: (stats: fs.BigIntStats) => stats.isSymbolicLink(), reason: 'it is a symbolic link' },
+  { isUnsafe: (stats: fs.BigIntStats) => !stats.isDirectory(), reason: 'it is not a directory' },
   {
     // Windows has no uid to compare.
-    isUnsafe: (stats: fs.Stats, uid: number | undefined) => uid !== undefined && stats.uid !== uid,
+    isUnsafe: (stats: fs.BigIntStats, uid: number | undefined) => uid !== undefined && Number(stats.uid) !== uid,
     reason: 'another user owns it'
   }
 ];
 
-function createUnsafeFolderError(folder: string, stats: fs.Stats, reason: string): DaemonTransportError {
-  const mode: string = (stats.mode % PERMISSION_MODE_MODULUS).toString(OCTAL_RADIX);
+function createUnsafeFolderError(folder: string, stats: fs.BigIntStats, reason: string): DaemonTransportError {
+  const mode: string = (Number(stats.mode) % PERMISSION_MODE_MODULUS).toString(OCTAL_RADIX);
   return new DaemonTransportError(
     DaemonTransportErrorCode.unsafeRuntimeDirectory,
     `The daemon runtime folder ${folder} is unsafe: ${reason} (owner uid ${stats.uid}, mode ${mode}). ` +
@@ -37,14 +37,14 @@ function createUnsafeFolderError(folder: string, stats: fs.Stats, reason: string
   );
 }
 
-function restrictToOwner(folder: string, stats: fs.Stats, uid: number | undefined): void {
+function restrictToOwner(folder: string, stats: fs.BigIntStats, uid: number | undefined): void {
   // Windows has no POSIX permission bits to tighten.
-  if (uid !== undefined && stats.mode % GROUP_AND_OTHER_MODE_MODULUS !== NO_MODE_BITS) {
+  if (uid !== undefined && Number(stats.mode) % GROUP_AND_OTHER_MODE_MODULUS !== NO_MODE_BITS) {
     fs.chmodSync(folder, DIR_MODE);
   }
 }
 
-function assertSafeFolder(folder: string, stats: fs.Stats, uid: number | undefined): void {
+function assertSafeFolder(folder: string, stats: fs.BigIntStats, uid: number | undefined): void {
   const unsafe: IUnsafeFolderCheck | undefined = UNSAFE_FOLDER_CHECKS.find((check: IUnsafeFolderCheck) =>
     check.isUnsafe(stats, uid)
   );
@@ -59,6 +59,9 @@ function assertSafeFolder(folder: string, stats: fs.Stats, uid: number | undefin
  * @throws {@link DaemonTransportError} with code `unsafeRuntimeDirectory`.
  */
 export function verifyRuntimeFolder(folder: string, uid: number | undefined): void {
-  const stats: fs.Stats | undefined = fs.lstatSync(folder, { throwIfNoEntry: false });
+  // Another user can put a socket or FIFO at this name in /tmp. A plain stat of one would leave its type in the
+  // stat array that Node 22's cached realpath reads (nodejs/node#65113), and in-process Rush, which a client
+  // falls back to for an unsafe folder, could then fail to find its modules.
+  const stats: fs.BigIntStats | undefined = fs.lstatSync(folder, { bigint: true, throwIfNoEntry: false });
   if (stats) assertSafeFolder(folder, stats, uid);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
index d3e72e3c8c..e452bef2c8 100644
--- a/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
+++ b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
@@ -7,11 +7,13 @@ import type * as net from 'node:net';
 import * as path from 'node:path';
 
 import type { IDaemonFileIdentity } from './DaemonFileIdentity';
+import { getFileIdentity } from './DaemonFileIdentity';
 import { listenOrErrorAsync, toListenTransportError } from './DaemonListenerNet';
 import type { INetError } from './DaemonListenerNet';
 import type { IDaemonPaths } from './DaemonPaths';
 import { reclaimStaleDaemonAsync } from './DaemonReclaim';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+import { unlinkIfPresent } from './DaemonUnlink';
 
 const PRIVATE_NAME_PREFIX: string = '.bind-';
 const PRIVATE_NAME_SEPARATOR: string = '-';
@@ -50,13 +52,13 @@ function stillInUse(socketPath: string): DaemonTransportError {
 
 async function publishAsync(privatePath: string, paths: IDaemonPaths): Promise<IDaemonFileIdentity> {
   fs.chmodSync(privatePath, SOCKET_MODE);
-  const { dev, ino } = fs.lstatSync(privatePath);
+  const identity: IDaemonFileIdentity = getFileIdentity(privatePath);
   if (!tryLink(privatePath, paths.socketPath)) {
     // Reclaim a dead daemon's leftovers once (this throws while their owner lives), then try again.
     await reclaimStaleDaemonAsync(paths);
     if (!tryLink(privatePath, paths.socketPath)) throw stillInUse(paths.socketPath);
   }
-  return { dev, ino };
+  return identity;
 }
 
 /**
@@ -83,6 +85,6 @@ export async function listenPublishedAsync(
     await closeServerAsync(server);
     throw publishError;
   } finally {
-    fs.rmSync(privatePath, { force: true });
+    unlinkIfPresent(privatePath);
   }
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonUnlink.ts b/libraries/rush-daemon-transport/src/DaemonUnlink.ts
new file mode 100644
index 0000000000..d2016272f1
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonUnlink.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const NO_ENTRY: string = 'ENOENT';
+
+/**
+ * Deletes the file (never a folder) at `filePath`, if there is one.
+ *
+ * @remarks
+ * Unlike `fs.rmSync`, it does not stat the file first. A plain stat of a socket leaves the socket's type in the
+ * stat array that Node 22's cached `fs.realpathSync` reads (nodejs/node#65113), and the next `require()` in the
+ * process could then load a package through its symbolic link, where the package's dependencies are not found.
+ */
+export function unlinkIfPresent(filePath: string): void {
+  try {
+    fs.unlinkSync(filePath);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== NO_ENTRY) throw error;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts b/libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts
new file mode 100644
index 0000000000..5fbf9f9f5b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/LinkedPackageFixture.ts
@@ -0,0 +1,87 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import type { SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { unlinkIfPresent } from '../DaemonUnlink';
+
+const PACKAGE_NAME: string = 'linked-package';
+const DEPENDENCY_NAME: string = 'linked-dependency';
+const INDEX_NAME: string = 'index.js';
+const MAIN_NAME: string = 'main.js';
+const NODE_MODULES: string = 'node_modules';
+const SOCKET_NAME: string = 's.sock';
+const PUBLISHED_NAME: string = 'p.sock';
+const FOLDER_PREFIX: string = 'rushd-linked-';
+// Short, as a socket path must be (104 bytes on macOS).
+const POSIX_TEMP_FOLDER: string = '/tmp';
+const CHILD_TIMEOUT_MS: number = 10000;
+const UTF8: BufferEncoding = 'utf8';
+
+/** How a Node process of its own exited, and what it printed. */
+export interface IChildOutcome {
+  readonly status: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * Creates a folder in which `node_modules/linked-package` is a symbolic link into a store, as pnpm installs
+ * packages. The package finds its dependency only from its real path.
+ */
+export function createLinkedPackageFolder(): string {
+  const folder: string = fs.mkdtempSync(path.join(POSIX_TEMP_FOLDER, FOLDER_PREFIX));
+  const store: string = path.join(folder, 'store', NODE_MODULES);
+  fs.mkdirSync(path.join(store, DEPENDENCY_NAME), { recursive: true });
+  fs.writeFileSync(path.join(store, DEPENDENCY_NAME, INDEX_NAME), "module.exports = 'found';");
+  fs.mkdirSync(path.join(store, PACKAGE_NAME));
+  fs.writeFileSync(path.join(store, PACKAGE_NAME, INDEX_NAME), `module.exports = require('${DEPENDENCY_NAME}');`);
+  fs.mkdirSync(path.join(folder, NODE_MODULES));
+  fs.symlinkSync(path.join(store, PACKAGE_NAME), path.join(folder, NODE_MODULES, PACKAGE_NAME));
+  return folder;
+}
+
+function createMain(call: string): string {
+  return [
+    "const fs = require('node:fs');",
+    "const net = require('node:net');",
+    'const [modulePath, socketPath, publishedPath] = process.argv.slice(2);',
+    'const target = require(modulePath);',
+    "const out = (value) => process.stdout.write(String(value) + ' ');",
+    'const server = net.createServer().listen(socketPath, async () => {',
+    `  ${call}`,
+    `  try { process.stdout.write(require('${PACKAGE_NAME}')); } catch (error) { process.stdout.write(error.code); }`,
+    '  server.close();',
+    '});'
+  ].join('\n');
+}
+
+/**
+ * Runs `call` in a Node process of its own while a socket listens at `socketPath`, then requires the linked
+ * package and prints what it exports, or the error's code. `call` is JavaScript that can use `target` (the module
+ * at `modulePath`), `socketPath`, `publishedPath` (a free name), `fs`, `net` and `out` (which prints a value). The
+ * main module is in `folder`, so the loader has already cached that path as one without links.
+ */
+export function runThenRequireLinkedPackage(folder: string, modulePath: string, call: string): IChildOutcome {
+  fs.writeFileSync(path.join(folder, MAIN_NAME), createMain(call));
+  const socketPaths: string[] = [SOCKET_NAME, PUBLISHED_NAME].map((name: string) => path.join(folder, name));
+  const child: SpawnSyncReturns<string> = spawnSync(process.execPath, [MAIN_NAME, modulePath, ...socketPaths], {
+    cwd: folder,
+    encoding: UTF8,
+    env: { ...process.env, NODE_OPTIONS: undefined, NODE_PRESERVE_SYMLINKS: undefined },
+    timeout: CHILD_TIMEOUT_MS
+  });
+  return { status: child.status, stdout: child.stdout, stderr: child.stderr };
+}
+
+/**
+ * Deletes a folder from {@link createLinkedPackageFolder}. Its sockets are unlinked first: `fs.rmSync` would stat
+ * them, and this process's own later `require()` calls could then fail as the child's would.
+ */
+export function removeLinkedPackageFolder(folder: string): void {
+  for (const name of [SOCKET_NAME, PUBLISHED_NAME]) unlinkIfPresent(path.join(folder, name));
+  fs.rmSync(folder, { recursive: true, force: true });
+}
diff --git a/libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts b/libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts
new file mode 100644
index 0000000000..2a2376fae3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/RequireAfterSocketStat.test.ts
@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IChildOutcome } from './LinkedPackageFixture';
+import {
+  createLinkedPackageFolder,
+  removeLinkedPackageFolder,
+  runThenRequireLinkedPackage
+} from './LinkedPackageFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+
+/** What meets the socket, its module, JavaScript that calls it (see the fixture), and what the child prints. */
+type SocketCase = readonly [string, string, string, string];
+
+const SOCKET_CASES: readonly SocketCase[] = [
+  ['readFileIdentity', 'DaemonFileIdentity', 'out(typeof target.readFileIdentity(socketPath).ino);', 'number found'],
+  [
+    'removeOwnFile',
+    'DaemonFileIdentity',
+    'target.removeOwnFile(socketPath, target.readFileIdentity(socketPath)); out(fs.existsSync(socketPath));',
+    'false found'
+  ],
+  [
+    'listenPublishedAsync',
+    'DaemonSocketPublication',
+    'const published = net.createServer();' +
+      ' out(typeof (await target.listenPublishedAsync(published, { socketPath: publishedPath })).ino);' +
+      ' published.close();',
+    'number found'
+  ],
+  [
+    'verifyRuntimeFolder',
+    'DaemonRuntimeFolderCheck',
+    'try { target.verifyRuntimeFolder(socketPath, process.getuid()); } catch (error) { out(error.code); }',
+    'unsafeRuntimeDirectory found'
+  ]
+];
+
+// A plain stat of a socket leaves its type in the stat array that Node 22's cached realpath reads
+// (nodejs/node#65113). Jest resolves modules itself, so a Node process of its own makes each call and then requires
+// a package through a symbolic link, as pnpm installs them.
+posixIt.each(SOCKET_CASES)(
+  'leaves require() resolving symbolic links after %s meets a socket',
+  (name: string, moduleName: string, call: string, expected: string) => {
+    const folder: string = createLinkedPackageFolder();
+    try {
+      const outcome: IChildOutcome = runThenRequireLinkedPackage(folder, require.resolve(`../${moduleName}`), call);
+      expect(outcome).toEqual({ status: 0, stdout: expected, stderr: '' });
+    } finally {
+      removeLinkedPackageFolder(folder);
+    }
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/Unlink.test.ts b/libraries/rush-daemon-transport/src/test/Unlink.test.ts
new file mode 100644
index 0000000000..bc8844666e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/Unlink.test.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { unlinkIfPresent } from '../DaemonUnlink';
+
+const FOLDER_PREFIX: string = 'rushd-unlink-';
+
+describe(unlinkIfPresent.name, () => {
+  let folder: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), FOLDER_PREFIX));
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('deletes a file', () => {
+    const filePath: string = path.join(folder, 'file');
+    fs.writeFileSync(filePath, 'content');
+    unlinkIfPresent(filePath);
+    expect(fs.existsSync(filePath)).toBe(false);
+  });
+
+  it('does nothing when nothing is at the path', () => {
+    expect(() => unlinkIfPresent(path.join(folder, 'missing'))).not.toThrow();
+  });
+
+  it('throws for a folder, and leaves it', () => {
+    const child: string = path.join(folder, 'child');
+    fs.mkdirSync(child);
+    expect(() => unlinkIfPresent(child)).toThrow();
+    expect(fs.statSync(child).isDirectory()).toBe(true);
+  });
+});

From f550183e6e21a60c61a6d4dbaf527e67fdd135a9 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 129/265] [rush-lib] Pin total memory and the CPU model in the
 telemetry test

Swarm integration step 114; original commit aa9237df9a (merge of swarm/m03-t179-nit1 at c350c17f4b).
Scope: 179 + 179-nit1.

Brings 179 + 179-nit1 (branch swarm/m03-t179-nit1). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 20 of 21. Gate: ch01 GATE OK board 4527 (tree 550d7d5dba)

Commits folded into this step (2):
- 5095b7a10d Read the CPUs once per process for rush-lib telemetry
- c350c17f4b Pin total memory and the CPU model in the telemetry test

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../m03-t179-cpu-info_2026-09-29-07-52.json   |  10 ++
 libraries/rush-lib/src/logic/Telemetry.ts     |  39 +++++--
 .../logic/test/TelemetryMachineInfo.test.ts   | 105 ++++++++++++++++++
 3 files changed, 144 insertions(+), 10 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/m03-t179-cpu-info_2026-09-29-07-52.json
 create mode 100644 libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts

diff --git a/common/changes/@microsoft/rush/m03-t179-cpu-info_2026-09-29-07-52.json b/common/changes/@microsoft/rush/m03-t179-cpu-info_2026-09-29-07-52.json
new file mode 100644
index 0000000000..ec639c58e4
--- /dev/null
+++ b/common/changes/@microsoft/rush/m03-t179-cpu-info_2026-09-29-07-52.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Read the CPU model and count for telemetry once per process instead of for every telemetry entry. On a machine with many CPUs each read takes milliseconds, and the Rush daemon logs an entry for every request. Total and free memory are still read for each entry.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/src/logic/Telemetry.ts b/libraries/rush-lib/src/logic/Telemetry.ts
index c8adc46bdc..dc45dee120 100644
--- a/libraries/rush-lib/src/logic/Telemetry.ts
+++ b/libraries/rush-lib/src/logic/Telemetry.ts
@@ -155,6 +155,34 @@ export interface ITelemetryData {
 const MAX_FILE_COUNT: number = 100;
 const ONE_MEGABYTE_IN_BYTES: 1048576 = 1048576;
 
+interface ICpuSummary {
+  model: string;
+  count: number;
+}
+
+// os.cpus() takes milliseconds on a machine with many CPUs (on Linux it reads a file for each one), and the
+// Rush daemon logs telemetry for every request, so the CPUs are read at most once per process.
+let _cpuSummary: ICpuSummary | undefined;
+
+function getMachineInfo(): ITelemetryMachineInfo {
+  if (!_cpuSummary) {
+    const cpus: os.CpuInfo[] = os.cpus();
+    _cpuSummary = {
+      // The Node.js model is sometimes padded, for example:
+      // "AMD Ryzen 7 3700X 8-Core Processor             "
+      model: cpus[0].model.trim(),
+      count: cpus.length
+    };
+  }
+  return {
+    machineArchitecture: os.arch(),
+    machineCpu: _cpuSummary.model,
+    machineCores: _cpuSummary.count,
+    machineTotalMemoryMiB: Math.round(os.totalmem() / ONE_MEGABYTE_IN_BYTES),
+    machineFreeMemoryMiB: Math.round(os.freemem() / ONE_MEGABYTE_IN_BYTES)
+  };
+}
+
 export class Telemetry {
   #enabled: boolean;
   #store: ITelemetryData[];
@@ -184,7 +212,6 @@ export class Telemetry {
     );
     const processExitCode: number =
       typeof process.exitCode === 'number' ? process.exitCode : Number(process.exitCode);
-    const cpus: os.CpuInfo[] = os.cpus();
     const data: ITelemetryData = {
       ...telemetryData,
       reporterData: reporterAggregate
@@ -205,15 +232,7 @@ export class Telemetry {
         : telemetryData.reporterData,
       performanceEntries:
         telemetryData.performanceEntries || collectPerformanceEntries(this.#telemetryStartTime),
-      machineInfo: telemetryData.machineInfo || {
-        machineArchitecture: os.arch(),
-        // The Node.js model is sometimes padded, for example:
-        // "AMD Ryzen 7 3700X 8-Core Processor             "
-        machineCpu: cpus[0].model.trim(),
-        machineCores: cpus.length,
-        machineTotalMemoryMiB: Math.round(os.totalmem() / ONE_MEGABYTE_IN_BYTES),
-        machineFreeMemoryMiB: Math.round(os.freemem() / ONE_MEGABYTE_IN_BYTES)
-      },
+      machineInfo: telemetryData.machineInfo || getMachineInfo(),
       timestampMs: telemetryData.timestampMs || new Date().getTime(),
       platform: telemetryData.platform || process.platform,
       rushVersion: telemetryData.rushVersion || Rush.version
diff --git a/libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts b/libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts
new file mode 100644
index 0000000000..eb1ac10971
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/TelemetryMachineInfo.test.ts
@@ -0,0 +1,105 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('node:os', () => {
+  const actual: typeof import('node:os') = jest.requireActual('node:os');
+  function createCpu(model: string): import('node:os').CpuInfo {
+    return { model, speed: 3000, times: { user: 0, nice: 0, sys: 0, idle: 0, irq: 0 } };
+  }
+  // Node.js sometimes pads the model. The models differ, so the test can tell which CPU's model is reported.
+  const cpus: import('node:os').CpuInfo[] = [
+    createCpu('Test CPU @ 3.00GHz   '),
+    createCpu('Second CPU'),
+    createCpu('Third CPU')
+  ];
+  return {
+    ...actual,
+    cpus: jest.fn(() => cpus),
+    freemem: jest.fn(actual.freemem),
+    totalmem: jest.fn(actual.totalmem)
+  };
+});
+
+import * as os from 'node:os';
+
+import { ConsoleTerminalProvider } from '@rushstack/terminal';
+
+import { RushConfiguration } from '../../api/RushConfiguration';
+import { RushSession } from '../../pluginFramework/RushSession';
+import { Telemetry, type ITelemetryData, type ITelemetryMachineInfo } from '../Telemetry';
+
+const ONE_MEBIBYTE: number = 1024 * 1024;
+
+const mockedCpus: jest.MockedFunction<typeof os.cpus> = jest.mocked(os.cpus);
+const mockedFreemem: jest.MockedFunction<typeof os.freemem> = jest.mocked(os.freemem);
+const mockedTotalmem: jest.MockedFunction<typeof os.totalmem> = jest.mocked(os.totalmem);
+
+const logData: ITelemetryData = {
+  name: 'build',
+  durationInSeconds: 1,
+  result: 'Succeeded'
+};
+
+function createTelemetry(): Telemetry {
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    `${__dirname}/telemetry/telemetryEnabled.json`
+  );
+  const rushSession: RushSession = new RushSession({
+    terminalProvider: new ConsoleTerminalProvider(),
+    getIsDebugMode: () => false
+  });
+  return new Telemetry(rushConfiguration, rushSession);
+}
+
+describe(`${Telemetry.name} machine info`, () => {
+  // Telemetry keeps the CPU values for the rest of the process, and each test file gets its own module
+  // registry, so one test covers both the first read and the later entries.
+  it('reads the CPUs once per process, and the total and free memory for each entry', () => {
+    const telemetry: Telemetry = createTelemetry();
+    const secondTelemetry: Telemetry = createTelemetry();
+    // Other modules can read the CPUs while they load, so count only the reads from here on.
+    mockedCpus.mockClear();
+    mockedTotalmem
+      .mockReturnValueOnce(1000 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(2000 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(3000 * ONE_MEBIBYTE);
+    mockedFreemem
+      .mockReturnValueOnce(100 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(200 * ONE_MEBIBYTE)
+      .mockReturnValueOnce(300 * ONE_MEBIBYTE);
+
+    const suppliedMachineInfo: ITelemetryMachineInfo = {
+      machineArchitecture: 'arm64',
+      machineCpu: 'Supplied CPU',
+      machineCores: 1,
+      machineTotalMemoryMiB: 1,
+      machineFreeMemoryMiB: 1
+    };
+    telemetry.log({ ...logData, machineInfo: suppliedMachineInfo });
+    expect(mockedCpus).not.toHaveBeenCalled();
+
+    telemetry.log(logData);
+    telemetry.log(logData);
+    secondTelemetry.log(logData);
+    expect(mockedCpus).toHaveBeenCalledTimes(1);
+
+    const expectedCpuInfo: Pick<
+      ITelemetryMachineInfo,
+      'machineArchitecture' | 'machineCpu' | 'machineCores'
+    > = {
+      machineArchitecture: os.arch(),
+      machineCpu: 'Test CPU @ 3.00GHz',
+      machineCores: 3
+    };
+    expect(telemetry.store.map((data: ITelemetryData) => data.machineInfo)).toEqual([
+      suppliedMachineInfo,
+      { ...expectedCpuInfo, machineTotalMemoryMiB: 1000, machineFreeMemoryMiB: 100 },
+      { ...expectedCpuInfo, machineTotalMemoryMiB: 2000, machineFreeMemoryMiB: 200 }
+    ]);
+    expect(secondTelemetry.store[0].machineInfo).toEqual({
+      ...expectedCpuInfo,
+      machineTotalMemoryMiB: 3000,
+      machineFreeMemoryMiB: 300
+    });
+  });
+});

From 48b1d13a876296fa2dc377c348c218f6b78716d8 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 130/265] [rush-daemon] Test that a reconciliation uses the
 inputs snapshot it started during the checks

Swarm integration step 115; original commit f6688e3136 (merge of swarm/r07-t212-nit at 1d5e422b1b).
Scope: task 212-nit.

Brings 212-nit (branch swarm/r07-t212-nit). Second agents and evidence: ch01's GATE OK board 4527.

s18 batch E2a, item 21 of 21. Gate: ch01 GATE OK board 4527 (tree b0adfe0514)

Commits folded into this step (1):
- 1d5e422b1b [rush-daemon] Test that a reconciliation uses the inputs snapshot it started during the checks

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../inputs-snapshot-reuse-test_2026-09-29-09-15.json  | 11 +++++++++++
 .../src/test/WorkspaceEngineComponentFactory.test.ts  |  2 ++
 2 files changed, 13 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/inputs-snapshot-reuse-test_2026-09-29-09-15.json

diff --git a/common/changes/@rushstack/rush-daemon/inputs-snapshot-reuse-test_2026-09-29-09-15.json b/common/changes/@rushstack/rush-daemon/inputs-snapshot-reuse-test_2026-09-29-09-15.json
new file mode 100644
index 0000000000..bcd417ce8a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/inputs-snapshot-reuse-test_2026-09-29-09-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a reconciliation uses the inputs snapshot that it started while it validated the graph inputs, and does not read the inputs again.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
index 2e5ddc5c41..0f6023a498 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
@@ -812,6 +812,8 @@ describe(WorkspaceEngineComponentFactory.name, () => {
         inputsSnapshot: nextSnapshot,
         isFullInvalidation: false
       });
+      // The inputs are not read again after the checks.
+      expect(events).toEqual(['snapshot', 'validation']);
       expect(components.inputsSnapshot).toBe(nextSnapshot);
       await disposeComponentsAsync(components);
     });

From 87256609155155951e41597de1529cd2387c8fe7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 131/265] [heft] Test that Heft writes an unreported error
 before it exits

Swarm integration step 116; original commit d9386be78a (merge of swarm/r03-t200-nit1 at 0d97f5df3c).
Scope: task 200-nit1.

Brings 200-nit1 (branch swarm/r03-t200-nit1). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 1 of 20. Gate: ch01 GATE OK board 4947 (tree 4ee1bbecf7)

Commits folded into this step (1):
- 0d97f5df3c [heft] Test that Heft writes an unreported error before it exits

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/cli/HeftCommandLineParser.test.ts     | 46 +++++++++++++++----
 1 file changed, 38 insertions(+), 8 deletions(-)

diff --git a/apps/heft/src/cli/HeftCommandLineParser.test.ts b/apps/heft/src/cli/HeftCommandLineParser.test.ts
index ce4b37bdea..7be596af5e 100644
--- a/apps/heft/src/cli/HeftCommandLineParser.test.ts
+++ b/apps/heft/src/cli/HeftCommandLineParser.test.ts
@@ -35,6 +35,26 @@ const FIXTURE_FILES: Record<string, string> = {
 `
 };
 
+// The same project, but its heft.json declares an alias with the name of the "test" phase's action, so Heft fails
+// before any task runs, with an error that nothing has reported yet.
+const ALIAS_CLASH_FIXTURE_FILES: Record<string, string> = {
+  ...FIXTURE_FILES,
+  'config/heft.json': JSON.stringify({
+    ...JSON.parse(FIXTURE_FILES['config/heft.json']),
+    aliasesByName: { test: { actionName: 'test' } }
+  })
+};
+
+function createFixtureFolder(files: Record<string, string>): string {
+  const fixtureFolderPath: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-exit-code-'));
+  for (const [relativePath, contents] of Object.entries(files)) {
+    const filePath: string = path.join(fixtureFolderPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, contents);
+  }
+  return fixtureFolderPath;
+}
+
 interface IHeftResult {
   exitCode: number | undefined;
   output: string;
@@ -42,21 +62,23 @@ interface IHeftResult {
 
 describe('HeftCommandLineParser', () => {
   let fixtureFolderPath: string;
+  let aliasClashFixtureFolderPath: string;
 
   beforeAll(() => {
-    fixtureFolderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-exit-code-'));
-    for (const [relativePath, contents] of Object.entries(FIXTURE_FILES)) {
-      const filePath: string = path.join(fixtureFolderPath, relativePath);
-      fs.mkdirSync(path.dirname(filePath), { recursive: true });
-      fs.writeFileSync(filePath, contents);
-    }
+    fixtureFolderPath = createFixtureFolder(FIXTURE_FILES);
+    aliasClashFixtureFolderPath = createFixtureFolder(ALIAS_CLASH_FIXTURE_FILES);
   });
 
   afterAll(() => {
     fs.rmSync(fixtureFolderPath, { recursive: true, force: true });
+    fs.rmSync(aliasClashFixtureFolderPath, { recursive: true, force: true });
   });
 
-  async function runHeftTestAsync(taskExitCode: number, taskFails: boolean): Promise<IHeftResult> {
+  async function runHeftTestAsync(
+    taskExitCode: number,
+    taskFails: boolean,
+    folderPath: string = fixtureFolderPath
+  ): Promise<IHeftResult> {
     const env: NodeJS.ProcessEnv = { ...process.env, FIXTURE_EXIT_CODE: String(taskExitCode) };
     delete env.FIXTURE_FAIL;
     delete env._RUSH_REPORTER_CHILD_FD;
@@ -66,7 +88,7 @@ describe('HeftCommandLineParser', () => {
     }
 
     const child: childProcess.ChildProcess = childProcess.spawn(process.execPath, [HEFT_START_PATH, 'test'], {
-      cwd: fixtureFolderPath,
+      cwd: folderPath,
       env,
       stdio: ['ignore', 'pipe', 'pipe']
     });
@@ -107,4 +129,12 @@ describe('HeftCommandLineParser', () => {
     expect(output).not.toContain('The fixture task failed on purpose');
     expect(exitCode).toBe(0);
   });
+
+  it('writes an error that nothing reported before it exits, and exits with 1', async () => {
+    const { exitCode, output }: IHeftResult = await runHeftTestAsync(0, false, aliasClashFixtureFolderPath);
+    expect(output).toContain(
+      'The alias "test" specified in heft.json cannot be used because an action with that name already exists.'
+    );
+    expect(exitCode).toBe(1);
+  });
 });

From b2aa0659e69cb6d574a95761b323a273e8740f23 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 132/265] [rush-lib] Give the FlagFile and LastInstallFlag
 tests separate temp folders

Swarm integration step 117; original commit 714d3ef058 (merge of swarm/m03-t182 at 12bc691a65).
Scope: task 182.

Brings 182 (branch swarm/m03-t182). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 2 of 20. Gate: ch01 GATE OK board 4947 (tree c7cdb9a714)

Commits folded into this step (1):
- 12bc691a65 Give the FlagFile and LastInstallFlag tests separate temp folders

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../m03-t182-flag-temp-folders_2026-09-29-08-17.json   | 10 ++++++++++
 libraries/rush-lib/src/api/test/FlagFile.test.ts       |  2 +-
 .../rush-lib/src/api/test/LastInstallFlag.test.ts      |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/m03-t182-flag-temp-folders_2026-09-29-08-17.json

diff --git a/common/changes/@microsoft/rush/m03-t182-flag-temp-folders_2026-09-29-08-17.json b/common/changes/@microsoft/rush/m03-t182-flag-temp-folders_2026-09-29-08-17.json
new file mode 100644
index 0000000000..d6966620b9
--- /dev/null
+++ b/common/changes/@microsoft/rush/m03-t182-flag-temp-folders_2026-09-29-08-17.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/src/api/test/FlagFile.test.ts b/libraries/rush-lib/src/api/test/FlagFile.test.ts
index 017c648aeb..6e30604cf5 100644
--- a/libraries/rush-lib/src/api/test/FlagFile.test.ts
+++ b/libraries/rush-lib/src/api/test/FlagFile.test.ts
@@ -7,7 +7,7 @@ import { FileSystem } from '@rushstack/node-core-library';
 import { FlagFile } from '../FlagFile';
 import { RushConstants } from '../../logic/RushConstants';
 
-const TEMP_DIR_PATH: string = `${__dirname}/temp`;
+const TEMP_DIR_PATH: string = `${__dirname}/temp-${FlagFile.name}`;
 
 describe(FlagFile.name, () => {
   beforeEach(() => {
diff --git a/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts b/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts
index 11aa23f09a..c0433bf28d 100644
--- a/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts
+++ b/libraries/rush-lib/src/api/test/LastInstallFlag.test.ts
@@ -6,7 +6,7 @@ import { FileSystem } from '@rushstack/node-core-library';
 
 import { LastInstallFlag } from '../LastInstallFlag';
 
-const TEMP_DIR_PATH: string = `${__dirname}/temp`;
+const TEMP_DIR_PATH: string = `${__dirname}/temp-${LastInstallFlag.name}`;
 
 describe(LastInstallFlag.name, () => {
   beforeEach(() => {

From ac3c53b88e09e66ee4b9b8ae4439e8f481ddecfd Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 133/265] [rush-lib] Test that a result restored from the build
 cache passes an unselected dependency on to its consumers

Swarm integration step 118; original commit 5f39d9cbdf (merge of swarm/r02-t223 at 25d212c4b2).
Refs: task 223.
Scope: task 223.

Brings 223 (branch swarm/r02-t223). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 3 of 20. Gate: ch01 GATE OK board 4947 (tree d3386f237c)

Commits folded into this step (3):
- c8991173a6 [rush-lib] Don't write a cache entry built against a dependency that the request did not select (task 223)
- 2a12018c98 [rush-lib] Test that no cobuild lock is taken for a result that can't be written (task 223)
- 25d212c4b2 [rush-lib] Test that a result restored from the build cache passes an unselected dependency on to its consumers (task 223)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...etained-result-trust_2026-09-28-14-10.json |   2 +-
 ...-blocks-cache-writes_2026-09-29-07-40.json |  10 +
 .../operations/CacheableOperationPlugin.ts    |  55 ++++-
 .../test/CacheableOperationPlugin.test.ts     |   5 +-
 ...ableOperationPluginRetainedResults.test.ts | 199 +++++++++++++++++-
 5 files changed, 254 insertions(+), 17 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/unselected-dependency-blocks-cache-writes_2026-09-29-07-40.json

diff --git a/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json b/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json
index f77be5bea1..09e6fbc539 100644
--- a/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json
+++ b/common/changes/@microsoft/rush/swarm-r07-retained-result-trust_2026-09-28-14-10.json
@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@microsoft/rush",
-      "comment": "In long-lived operation graphs such as the Rush daemon, an operation that a request did not select no longer blocks build cache writes for its consumers if its retained result is trusted at its current state hash. A selected operation whose retained result is not trusted is now restored from the build cache or run again instead of being skipped, so it no longer stops cache writes for its consumers or keeps outputs that were built against dependencies that have since been rebuilt.",
+      "comment": "In long-lived operation graphs such as the Rush daemon, a selected operation whose retained result is not trusted is now restored from the build cache or run again instead of being skipped, so it no longer stops cache writes for its consumers or keeps outputs that were built against dependencies that have since been rebuilt.",
       "type": "patch"
     }
   ],
diff --git a/common/changes/@microsoft/rush/unselected-dependency-blocks-cache-writes_2026-09-29-07-40.json b/common/changes/@microsoft/rush/unselected-dependency-blocks-cache-writes_2026-09-29-07-40.json
new file mode 100644
index 0000000000..e67aad0b4a
--- /dev/null
+++ b/common/changes/@microsoft/rush/unselected-dependency-blocks-cache-writes_2026-09-29-07-40.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "In long-lived operation graphs such as the Rush daemon, an operation that runs while the request does not select one of its direct or indirect dependencies no longer writes a build cache entry, as in a run that does not select that dependency. The outputs of that dependency are not checked, so they may have been edited since it ran. The operation runs again when a later request selects that dependency too, and the dependency is still skipped if it is unchanged.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index aec9ae0dba..81175c57af 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -91,6 +91,13 @@ export interface IOperationBuildCacheContext {
   // to the build cache. Unlike a blocked cache write, this does not stop a long-lived graph from trusting them.
   isIncrementalResult: boolean;
 
+  // True if a dependency of this operation, or one of theirs, was skipped by an iteration of a long-lived graph (e.g.
+  // the Rush daemon) that did not select it, while its retained result was trusted. The iteration did not verify its
+  // outputs, which may have been edited in place, so neither the outputs of this operation nor those of its consumers
+  // are written to the build cache, as in a run that does not select that dependency. If this operation executes, its
+  // result is not trusted. If it is skipped, it keeps its trust, since its outputs were not built in this iteration.
+  hasUnverifiedDependency: boolean;
+
   // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
   // the iteration's inputs snapshot. Used to refuse cache writes, and to keep a long-lived graph from skipping
   // the operation later, if the inputs changed while the snapshot was being taken or while the operation was
@@ -228,7 +235,19 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
           // This also re-verifies results that are not trusted for other reasons, e.g. because their input files
           // changed while they were executing. Without cache writes, nothing is ever trusted.
           if (buildCacheConfiguration.cacheWriteEnabled && iterationOptions.inputsSnapshot) {
-            enableUnverifiedRetainedOperations(currentStates, lastStates, trustedStateHashByOperation);
+            // An operation that this iteration does not select blocks the cache writes of its consumers (see the
+            // afterExecuteOperationAsync tap below), so running them again would not make them trusted either.
+            const trustedStateHashBySelectedOperation: Map<Operation, string> = new Map();
+            for (const [operation, stateHash] of trustedStateHashByOperation) {
+              if (operation.enabled !== false) {
+                trustedStateHashBySelectedOperation.set(operation, stateHash);
+              }
+            }
+            enableUnverifiedRetainedOperations(
+              currentStates,
+              lastStates,
+              trustedStateHashBySelectedOperation
+            );
           }
         }
       );
@@ -328,6 +347,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               cacheRestored: false,
               isCacheReadAttempted: false,
               isIncrementalResult: false,
+              hasUnverifiedDependency: false,
               inputFilesState,
               inputFileHashes: inputFilesState ? fileHashes : undefined
             };
@@ -557,7 +577,11 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               }
             }
 
-            if (buildCacheContext.isCacheWriteAllowed && cobuildLock) {
+            if (
+              buildCacheContext.isCacheWriteAllowed &&
+              !buildCacheContext.hasUnverifiedDependency &&
+              cobuildLock
+            ) {
               const acquireSuccess: boolean = await cobuildLock.tryAcquireLockAsync();
               if (acquireSuccess) {
                 const { periodicCallback } = buildCacheContext;
@@ -618,10 +642,12 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             operationBuildCache,
             isCacheWriteAllowed: isCacheWriteAllowedForOperation,
             isIncrementalResult,
+            hasUnverifiedDependency,
             buildCacheTerminal,
             cacheRestored
           } = buildCacheContext;
-          const isCacheWriteAllowed: boolean = isCacheWriteAllowedForOperation && !isIncrementalResult;
+          const isCacheWriteAllowed: boolean =
+            isCacheWriteAllowedForOperation && !isIncrementalResult && !hasUnverifiedDependency;
 
           try {
             if (!cacheRestored) {
@@ -764,15 +790,16 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
           let blockCacheWrite: boolean = !buildCacheContext?.isCacheWriteAllowed;
           // Whether the outputs that consumers execute against are an incremental result
           let isIncrementalResult: boolean = false;
+          // Whether consumers execute against outputs that this iteration did not verify
+          let hasUnverifiedOutputs: boolean = !!buildCacheContext?.hasUnverifiedDependency;
 
           switch (record.status) {
             case OperationStatus.Skipped: {
               // Skipping generally means we cannot guarantee integrity, so prevent cache writes in dependents.
               // The exception is an operation that was not re-run because a previous iteration of this graph
               // produced a trusted result at exactly the same state hash (e.g. a result retained by a
-              // long-lived graph such as the Rush daemon), whether or not this iteration selected it. Since the
-              // state hash of an operation covers the state hashes of all of its dependencies, a consumer's
-              // cache key fully describes this input.
+              // long-lived graph such as the Rush daemon). Since the state hash of an operation covers the
+              // state hashes of all of its dependencies, a consumer's cache key fully describes this input.
               if (blockCacheWrite || trustedStateHashByOperation.get(operation) !== record.getStateHash()) {
                 blockCacheWrite = true;
                 trustedStateHashByOperation.delete(operation);
@@ -780,6 +807,13 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               } else {
                 isIncrementalResult =
                   incrementalStateHashByOperation.get(operation) === record.getStateHash();
+                // Output files are not part of the state hash, and only the outputs of selected operations are
+                // checked (e.g. by the Rush daemon), so those of an operation that this iteration did not select
+                // may have been edited in place since. As in a run that does not select it, its consumers do not
+                // write to the build cache, but it keeps its trust for later iterations that select it.
+                if (operation.enabled === false && !operation.isNoOp) {
+                  hasUnverifiedOutputs = true;
+                }
               }
               break;
             }
@@ -789,6 +823,10 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               isIncrementalResult =
                 record.status !== OperationStatus.FromCache &&
                 (!!buildCacheContext?.isIncrementalResult || wasExecutedIncrementally(record));
+              if (hasUnverifiedOutputs && record.status !== OperationStatus.FromCache && !operation.isNoOp) {
+                // The outputs of this operation may embed unverified outputs of its dependencies.
+                blockCacheWrite = true;
+              }
               if (!blockCacheWrite && buildCacheContext && SUCCESS_STATUSES.has(record.status)) {
                 // The outputs of this operation were produced (or restored) in an iteration where cache
                 // writes were allowed, so they can be trusted by consumers in later iterations as long as
@@ -809,7 +847,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
           }
 
           // Apply status changes to direct dependents
-          if (blockCacheWrite || isIncrementalResult) {
+          if (blockCacheWrite || isIncrementalResult || hasUnverifiedOutputs) {
             for (const consumer of operation.consumers) {
               const consumerBuildCacheContext: IOperationBuildCacheContext | undefined =
                 this.#getBuildCacheContextByOperation(consumer);
@@ -820,6 +858,9 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                 if (isIncrementalResult) {
                   consumerBuildCacheContext.isIncrementalResult = true;
                 }
+                if (hasUnverifiedOutputs) {
+                  consumerBuildCacheContext.hasUnverifiedDependency = true;
+                }
               }
             }
           }
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index 9a2281d00b..e109c7c2ab 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -306,7 +306,7 @@ describe(CacheableOperationPlugin.name, () => {
     expect(testGraph.cacheWrites).toEqual(['c']);
   });
 
-  it('writes a cache entry when a dependency that was not selected (e.g. --only) is trusted at its state hash', async () => {
+  it('does not write a cache entry when a dependency that was not selected (e.g. --only) is trusted at its state hash', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     await testGraph.executeAsync();
 
@@ -314,9 +314,10 @@ describe(CacheableOperationPlugin.name, () => {
     testGraph.localHashes.set('b', 'b-v2');
     const result: IExecutionResult = await testGraph.executeAsync();
 
+    // The outputs of "a" are not part of its state hash, and this iteration did not verify them.
     expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Skipped);
     expect(testGraph.executions).toEqual(['b']);
-    expect(testGraph.cacheWrites).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
   });
 
   it('does not write a cache entry when a dependency that was not selected (e.g. --only) has changed', async () => {
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index 2cf5e5b9be..5ea4acc161 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -48,7 +48,9 @@ import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { CobuildConfiguration } from '../../../api/CobuildConfiguration';
 import type { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import type { ICobuildContext, ICobuildLockProvider } from '../../cobuild/ICobuildLockProvider';
 import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
 import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
 import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
@@ -112,6 +114,10 @@ interface ITestGraph {
   executions: string[];
   cacheWrites: string[];
   cacheRestores: string[];
+  /**
+   * The operations that acquired a cobuild lock, if enabled by `cobuild`.
+   */
+  cobuildLocks: string[];
   /**
    * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
    */
@@ -138,6 +144,10 @@ interface ITestGraphOptions {
    * which reports a selected operation as skipped if its name is in this set, because its outputs are up to date.
    */
   upToDate?: ReadonlySet<string>;
+  /**
+   * If true, enables cobuilds with a lock provider that grants every lock and has no completed states.
+   */
+  cobuild?: boolean;
 }
 
 /**
@@ -145,11 +155,12 @@ interface ITestGraphOptions {
  * The mock build cache stores an entry per operation and state hash, and restores it if it exists.
  */
 async function createTestGraphAsync(names: string[], options: ITestGraphOptions = {}): Promise<ITestGraph> {
-  const { dependencies, cacheWriteEnabled = true, upToDate } = options;
+  const { dependencies, cacheWriteEnabled = true, upToDate, cobuild } = options;
   const executions: string[] = [];
   const checks: string[] = [];
   const cacheWrites: string[] = [];
   const cacheRestores: string[] = [];
+  const cobuildLocks: string[] = [];
   const incrementalNames: Set<string> = new Set();
   const cacheEntries: Set<string> = new Set();
   const localHashes: Map<string, string> = new Map();
@@ -160,7 +171,8 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
   for (const name of names) {
     const project: RushConfigurationProject = {
       packageName: name,
-      projectFolder: `/repo/${name}`
+      projectFolder: `/repo/${name}`,
+      projectRelativeFolder: name
     } as unknown as RushConfigurationProject;
     projectConfigurations.set(project, {
       getCacheDisabledReason: () => undefined
@@ -190,6 +202,9 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     const name: string = record.operation.associatedProject.packageName;
     const getCacheKey = (): string => `${name}@${record.getStateHash()}`;
     return {
+      get cacheId(): string {
+        return getCacheKey();
+      },
       tryRestoreFromCacheAsync: async () => {
         const restored: boolean = cacheEntries.has(getCacheKey());
         if (restored) {
@@ -205,6 +220,23 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     } as unknown as OperationBuildCache;
   });
 
+  const cobuildLockProvider: Pick<
+    ICobuildLockProvider,
+    'acquireLockAsync' | 'renewLockAsync' | 'getCompletedStateAsync' | 'setCompletedStateAsync'
+  > = {
+    acquireLockAsync: async ({ packageName }: ICobuildContext) => {
+      cobuildLocks.push(packageName);
+      return true;
+    },
+    renewLockAsync: async () => {
+      /* noop */
+    },
+    getCompletedStateAsync: async () => undefined,
+    setCompletedStateAsync: async () => {
+      /* noop */
+    }
+  };
+
   const terminal: Terminal = new Terminal(new StringBufferTerminalProvider());
   const hooks: PhasedCommandHooks = new PhasedCommandHooks();
   new PhasedOperationPlugin().apply(hooks);
@@ -214,7 +246,15 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
       buildCacheEnabled: true,
       cacheWriteEnabled
     } as unknown as BuildCacheConfiguration,
-    cobuildConfiguration: undefined,
+    cobuildConfiguration: cobuild
+      ? ({
+          cobuildFeatureEnabled: true,
+          cobuildContextId: 'context',
+          cobuildRunnerId: 'runner',
+          cobuildLeafProjectLogOnlyAllowed: false,
+          getCobuildLockProvider: () => cobuildLockProvider
+        } as unknown as CobuildConfiguration)
+      : undefined,
     terminal,
     excludeAppleDoubleFiles: false,
     useDirectFileTransfersForBuildCache: false
@@ -274,12 +314,14 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     executions,
     cacheWrites,
     cacheRestores,
+    cobuildLocks,
     checks,
     incrementalNames,
     executeAsync: async () => {
       executions.length = 0;
       cacheWrites.length = 0;
       cacheRestores.length = 0;
+      cobuildLocks.length = 0;
       checks.length = 0;
       return await graph.executeAsync({ inputsSnapshot });
     }
@@ -304,20 +346,20 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     await testGraph.executeAsync();
     expect(testGraph.cacheWrites).toEqual(['app']);
 
-    // S2: edit "tool", then --only tool
+    // S2: edit "tool", then --only tool. As in a run that does not select "lib", its entry is not written.
     testGraph.localHashes.set('tool', 'tool-v2');
     lib.enabled = false;
     app.enabled = false;
     await testGraph.executeAsync();
     expect(testGraph.executions).toEqual(['tool']);
-    expect(testGraph.cacheWrites).toEqual(['tool']);
+    expect(testGraph.cacheWrites).toEqual([]);
 
     // S3: --to app
     lib.enabled = true;
     app.enabled = true;
     await testGraph.executeAsync();
-    expect(testGraph.executions).toEqual(['app']);
-    expect(testGraph.cacheWrites).toEqual(['app']);
+    expect(testGraph.executions).toEqual(['tool', 'app']);
+    expect(testGraph.cacheWrites).toEqual(['tool', 'app']);
 
     // S4: edit "app", then --to app
     testGraph.localHashes.set('app', 'app-v3');
@@ -355,6 +397,149 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     }
   });
 
+  it('does not write a result built against a trusted dependency that the request did not select', async () => {
+    // The outputs of "a" are not part of its state hash, so they may have been edited in place since it executed.
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // Edit "b", then --only b: "b" is built against outputs of "a" that this iteration did not verify.
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // Repeating the request cannot produce a trusted result for "b", so it is skipped.
+    const repeatedResult: IExecutionResult = await testGraph.executeAsync();
+    expect(repeatedResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+
+    // --to b: "b" has no entry at its state hash, so it executes again.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('does not acquire a cobuild lock for a result built against a trusted dependency that the request did not select', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cobuild: true });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+    expect(testGraph.cobuildLocks).toEqual(['a', 'b']);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    // Edit "b", then --only b: as for a write, a lock is only acquired for a result that can be written.
+    testGraph.localHashes.set('b', 'b-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cobuildLocks).toEqual([]);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not write a result built against a trusted dependency that the request did not select, through an operation without a script', async () => {
+    // "a" <- "n" <- "b", where "n" has no script
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'n', 'b'], {
+      noOpNames: new Set(['n'])
+    });
+    const { operations } = testGraph;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    // Edit "b", then --only b: "b" is built against outputs of "a" that this iteration did not verify.
+    testGraph.localHashes.set('b', 'b-v2');
+    operations.get('a')!.enabled = false;
+    operations.get('n')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to b
+    operations.get('a')!.enabled = true;
+    operations.get('n')!.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.cacheWrites).toEqual(['b']);
+  });
+
+  it('keeps trusting a skipped consumer of an operation without a script whose dependency the request did not select', async () => {
+    // "a" <- "n" <- "c", where "n" has no script, and "d"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'n', 'c', 'd'], {
+      noOpNames: new Set(['n']),
+      dependencies: { n: ['a'], c: ['n'] }
+    });
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // Edit "d", then --impacted-by n --to d: "n" has no outputs, so it keeps its trust, and so does "c", which
+    // is skipped.
+    testGraph.localHashes.set('d', 'd-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['d']);
+    expect(testGraph.cacheWrites).toEqual(['d']);
+
+    // --to c --to d
+    a.enabled = true;
+    const result: IExecutionResult = await testGraph.executeAsync();
+    expect(result.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.executions).toEqual([]);
+  });
+
+  it('keeps trusting a skipped result whose dependency the request did not select, but does not write its consumers', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+
+    // Edit "c", then --impacted-by b: "b" is skipped, and "c" can read the unverified outputs of "a" through it.
+    testGraph.localHashes.set('c', 'c-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to c: "b" was not built in that iteration, so it is still trusted.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual(['c']);
+  });
+
+  it('trusts a result restored from the build cache while its dependency is not selected, but does not write its consumers', async () => {
+    // "a" <- "b" <- "c"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c']);
+    const a: Operation = testGraph.operations.get('a')!;
+    await testGraph.executeAsync();
+    testGraph.localHashes.set('b', 'b-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['b', 'c']);
+
+    // Revert "b" and edit "c", then --impacted-by b: "b" has an entry from the first iteration, and "c" can read
+    // the unverified outputs of "a" through it.
+    testGraph.localHashes.set('b', 'b-v1');
+    testGraph.localHashes.set('c', 'c-v2');
+    a.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['b']);
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // --to c: the restored outputs of "b" match its state hash.
+    a.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.executions).toEqual(['c']);
+    expect(testGraph.cacheWrites).toEqual(['c']);
+  });
+
   it('re-executes a retained result that was built against a dependency that has since been rebuilt', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
     const a: Operation = testGraph.operations.get('a')!;

From f2ec4b9088268702f36f65b25c1f2f84cd4ff744 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 134/265] [rush-daemon-transport] Probe a recorded group with
 kill() before scanning /proc for its members

Swarm integration step 119; original commit 0f00ca502e (merge of swarm/r06-t203-int at ae0c48a095).
Refs: task 203 ADDENDUM.
Scope: task 203-int.

Brings 203-int (branch swarm/r06-t203-int). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 4 of 20. Gate: ch01 GATE OK board 4947 (tree 4113fca76e)

Commits folded into this step (3):
- 3ccc8860f4 Sweep the operation groups of dead daemons that no lockfile names (task 203)
- af48a3fdb8 Count a dead daemon's zombie operation groups as gone (task 203 follow-up)
- ae0c48a095 Probe a recorded group with kill() before scanning /proc for its members (task 203 ADDENDUM)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t203-stranded-groups_2026-09-29-05-40.json | 11 +++
 ...06-t203-probe-groups_2026-09-29-08-00.json | 11 +++
 ...t203-stranded-groups_2026-09-29-05-40.json | 11 +++
 ...6-t203-zombie-groups_2026-09-29-06-10.json | 11 +++
 libraries/rush-client-core/README.md          |  5 +-
 .../src/DaemonGroupMemberScan.ts              | 42 ++++++++
 .../src/DaemonOperationGroupReaper.ts         | 17 +++-
 .../src/DaemonOperationGroupSweep.ts          | 40 ++++++++
 .../src/DaemonOperationGroups.ts              | 27 +++++-
 .../src/DaemonOrphanReaper.ts                 | 23 ++++-
 .../src/DaemonProcessGroup.ts                 | 14 ++-
 .../src/DaemonProcessStat.ts                  | 23 +++--
 .../src/DaemonReclaim.ts                      |  7 +-
 .../test/DaemonOperationGroupReaper.test.ts   |  8 ++
 .../src/test/DaemonProcessGroup.test.ts       | 11 +++
 .../src/test/GroupMemberScan.test.ts          | 97 +++++++++++++++++++
 .../src/test/OperationGroupSweep.test.ts      | 85 ++++++++++++++++
 .../src/test/OperationGroupSweepFixture.ts    | 59 +++++++++++
 .../src/test/OrphanReaperFixture.ts           |  1 +
 .../src/test/StaleRecordProbe.test.ts         | 59 +++++++++++
 .../test/StrandedGroupReapOnReclaim.test.ts   | 77 +++++++++++++++
 .../src/test/SweepOwnership.test.ts           | 53 ++++++++++
 .../src/test/UnreapedLeaderFixture.ts         | 47 +++++++++
 .../src/test/ZombieOperationGroups.test.ts    | 97 +++++++++++++++++++
 24 files changed, 811 insertions(+), 25 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-probe-groups_2026-09-29-08-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-zombie-groups_2026-09-29-06-10.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json
new file mode 100644
index 0000000000..9e4d19613d
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "The reclaim before a daemon start, and after a daemon that exited, now also stops the operations that other dead daemons recorded but that no ownership record names any more, for example after an older `rush-client daemon stop --force`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-probe-groups_2026-09-29-08-00.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-probe-groups_2026-09-29-08-00.json
new file mode 100644
index 0000000000..92ffbddbd5
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-probe-groups_2026-09-29-08-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "When reaping a dead daemon's operation process groups, drop a record whose group has no process at all, as `kill` shows, without reading every process's `/proc` record, so that a reclaim that finds many stale records no longer scans `/proc` once per record.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json
new file mode 100644
index 0000000000..32a5c3d15d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-stranded-groups_2026-09-29-05-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "When reclaiming a daemon's socket, also reap the operation process groups recorded by earlier daemons that are gone but that no lockfile names any more (for example after an older `rush-client daemon stop --force`), with the same proof per group as for the lockfile's owner, and delete their record folders.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-zombie-groups_2026-09-29-06-10.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-zombie-groups_2026-09-29-06-10.json
new file mode 100644
index 0000000000..df36d9a0ab
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t203-zombie-groups_2026-09-29-06-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "When reaping a dead daemon's operation process groups, count a group whose members have all exited but are not reaped (zombies) as gone where `/proc` can tell, and never take a zombie leader as proof of its group, so that a parent that never reaps no longer makes every reclaim fail.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index b99acc3526..c3ab2bec78 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -72,7 +72,10 @@ Before it returns that error, it reclaims the exited daemon as the next daemon s
 running the command again, with or without the daemon, does not race the operations the daemon
 left running. While the ownership record names that process, it takes the start mutex and, unless
 a startup is reserved, calls `reclaimStaleDaemonAsync()`, which terminates the orphaned operation
-process groups and removes the ownership record and socket. Each set of groups that it stops is
+process groups (and those that other dead daemons recorded but that no ownership record names any
+more) and removes the ownership record and socket. Where `/proc` shows that every process left in a
+group has exited but is not reaped yet (a zombie), the group counts as stopped, because no signal
+can end it. Each set of groups that it stops is
 passed to the connection's optional `onOrphansReaped(reap)` (the daemon's PID, the process groups,
 and whether they were `terminated` or `killed`), so that the caller can say so in its own words;
 without it, each is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. The reclaim before
diff --git a/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts b/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
new file mode 100644
index 0000000000..56853f4248
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { isLiveMemberOf, readProcessIds, readStatRecord } from './DaemonProcessStat';
+
+const NO_SIGNAL: number = 0;
+const NO_SUCH_PROCESS: string = 'ESRCH';
+// Reading a listed process's record fails with these codes once the process is gone.
+const GONE_ERROR_CODES: ReadonlySet<string | undefined> = new Set(['ENOENT', NO_SUCH_PROCESS]);
+
+// A listed process whose record cannot be read for another reason (another user's process under the
+// `hidepid` mount option, for example) might be a live member, so it counts as one.
+function isLiveOrUnreadableMemberOf(groupId: number, pid: number): boolean {
+  try {
+    return isLiveMemberOf(groupId, readStatRecord(pid));
+  } catch (error) {
+    return !GONE_ERROR_CODES.has((error as NodeJS.ErrnoException).code);
+  }
+}
+
+/**
+ * `true` while some process of group `groupId` has not exited, as `/proc` shows it. A zombie, which has
+ * exited but which its parent has not reaped, does not count. Throws when `/proc` cannot be listed.
+ */
+export function hasLiveGroupMember(groupId: number): boolean {
+  const isMember = (pid: number): boolean => isLiveOrUnreadableMemberOf(groupId, pid);
+  // A group's id is its leader's pid, so a live leader answers without reading every process's record.
+  return isMember(groupId) || readProcessIds().some(isMember);
+}
+
+/**
+ * `false` only when `kill` proves that group `groupId` has no process at all, not even a zombie (ESRCH), which
+ * spares a scan of every process's record. A group that this user may not signal counts as having members.
+ */
+export function mayHaveGroupMembers(groupId: number): boolean {
+  try {
+    process.kill(-groupId, NO_SIGNAL);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException | undefined)?.code !== NO_SUCH_PROCESS;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index 108e87b62f..7e99376830 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -26,15 +26,23 @@ function isSameLeader(leader: IProcessStat, record: IOperationGroupRecord): bool
 
 // Every group lives inside one session. A group whose session is its own id was created by setsid() of
 // the recorded leader (or of a reused pid that also called setsid(), which needs the pid space to wrap);
-// a shell job's group lives in its shell's session and is rejected.
+// a shell job's group lives in its shell's session and is rejected. A stale record's group usually has no
+// process at all, which kill() proves without reading every process's record.
 function isLeaderlessOperationGroup(groupId: number, context: IReapContext): boolean {
+  if (!context.ops.mayHaveMembers(groupId)) return false;
   const members: IProcessStat[] = context.ops.listLiveGroupMembers(groupId);
   return members.length > NO_MEMBERS && members.every((member: IProcessStat) => member.sessionId === groupId);
 }
 
+// A zombie leader has exited, and only its parent can remove it, so it proves nothing about its group.
+function readLiveLeader(groupId: number, context: IReapContext): IProcessStat | undefined {
+  const leader: IProcessStat | undefined = context.ops.readProcessStat(groupId);
+  return leader?.exited ? undefined : leader;
+}
+
 function isProvenOperationGroup(record: IOperationGroupRecord, context: IReapContext): boolean {
   if (!isSignalableGroup(record.groupId, context)) return false;
-  const leader: IProcessStat | undefined = context.ops.readProcessStat(record.groupId);
+  const leader: IProcessStat | undefined = readLiveLeader(record.groupId, context);
   return leader ? isSameLeader(leader, record) : isLeaderlessOperationGroup(record.groupId, context);
 }
 
@@ -72,8 +80,9 @@ async function reapRecordedGroupsAsync(
  * @remarks
  * A record is signaled only when it provably still names the daemon's operation: its leader is alive with
  * the recorded start time and still leads group and session `groupId` (a reused pid has another start
- * time), or its leader has exited and every live member of the group is in session `groupId`. Unproven
- * records are dropped without a signal. Records survive a failed reap, so the next reclaim retries.
+ * time), or its leader has exited (a zombie leader has too) and every live member of the group is in
+ * session `groupId`. Unproven records are dropped without a signal. Records survive a failed reap, so the
+ * next reclaim retries.
  * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
  * Call only under the reclaim mutex, after the daemon has been proven dead.
  */
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts
new file mode 100644
index 0000000000..161d0f2367
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupSweep.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import { listOperationGroupsDaemonPids } from './DaemonOperationGroups';
+import { createReapContext } from './DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
+
+// Only a folder's pid is known, not its daemon's start time, so a live process with that pid may be the
+// daemon or may reuse its pid. The daemon ran as this user, so only a pid that has no process this user may
+// signal proves that it is gone.
+function isStranded(context: IReapContext): boolean {
+  return context.deadPid !== context.selfPid && !context.ops.isProcessAlive(context.deadPid);
+}
+
+/**
+ * Reaps the record folders beside `lockfilePath` that belong to daemons which are gone but which no lockfile
+ * names any more, for example because an older `rush-client daemon stop --force` removed the lockfile,
+ * without a reclaim, while their operations still ran.
+ *
+ * @remarks
+ * The folders of the caller and of `ownerPid`, the daemon that the lockfile names, are skipped; the reclaim
+ * reaps the owner's folder by itself. A folder whose pid has a live process stays for a later reclaim. Each
+ * other folder goes through {@link reapDeadDaemonOperationGroupsAsync}: a record is signaled only with the
+ * proof that it requires, unproven records are dropped without a signal, and a folder that is a symbolic link
+ * or that another user owns is left alone. Call only under the reclaim mutex.
+ */
+export async function sweepStrandedOperationGroupsAsync(
+  lockfilePath: string,
+  ownerPid: number | undefined,
+  options: IDaemonOrphanReaperOptions
+): Promise<void> {
+  const stranded: IReapContext[] = listOperationGroupsDaemonPids(lockfilePath)
+    .filter((pid: number) => pid !== ownerPid)
+    .map((pid: number) => createReapContext(pid, options))
+    .filter(isStranded);
+  for (const { deadPid } of stranded) {
+    await reapDeadDaemonOperationGroupsAsync(lockfilePath, deadPid, options);
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
index 57fc2f4fb4..114459d26b 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
@@ -7,6 +7,8 @@ import * as path from 'node:path';
 const FOLDER_INFIX: string = '.groups-';
 const NAME_SEPARATOR: string = '-';
 const RECORD_NAME_PATTERN: RegExp = /^(\d+)-(\d+)$/;
+// A pid as getOperationGroupsFolder() writes it: no sign, no leading zero, and never 0.
+const DAEMON_PID_PATTERN: RegExp = /^[1-9]\d*$/;
 const GROUP_ID_MATCH: number = 1;
 const START_TIME_MATCH: number = 2;
 const DIR_MODE: number = 0o700;
@@ -48,15 +50,30 @@ function isRecord(record: IOperationGroupRecord | undefined): record is IOperati
   return record !== undefined;
 }
 
-/** Reads the recorded groups; a missing or unreadable folder holds none. */
-export function readOperationGroupRecords(folder: string): IOperationGroupRecord[] {
-  let names: string[];
+function readFolderNames(folder: string): string[] {
   try {
-    names = fs.readdirSync(folder);
+    return fs.readdirSync(folder);
   } catch {
     return [];
   }
-  return names.map(parseRecordName).filter(isRecord);
+}
+
+/** Reads the recorded groups; a missing or unreadable folder holds none. */
+export function readOperationGroupRecords(folder: string): IOperationGroupRecord[] {
+  return readFolderNames(folder).map(parseRecordName).filter(isRecord);
+}
+
+/**
+ * The pids of the daemons, running or not, whose record folders are beside `lockfilePath`. A name that
+ * isn't a pid as {@link getOperationGroupsFolder} writes it, or whose number is too large to be exact, is
+ * skipped.
+ */
+export function listOperationGroupsDaemonPids(lockfilePath: string): number[] {
+  const prefix: string = `${path.basename(lockfilePath)}${FOLDER_INFIX}`;
+  return readFolderNames(path.dirname(lockfilePath))
+    .filter((name: string) => name.startsWith(prefix) && DAEMON_PID_PATTERN.test(name.slice(prefix.length)))
+    .map((name: string) => Number(name.slice(prefix.length)))
+    .filter(Number.isSafeInteger);
 }
 
 /** Deletes the sidecar folder and every record in it; idempotent. */
diff --git a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
index 474c307a59..5ee589a3a1 100644
--- a/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOrphanReaper.ts
@@ -5,6 +5,7 @@ import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
 import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
 import type { IDaemonLockfile } from './DaemonLockfile';
 import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import { sweepStrandedOperationGroupsAsync } from './DaemonOperationGroupSweep';
 import { isOwnedEntry } from './DaemonOwnedEntry';
 import {
   createReapContext,
@@ -55,16 +56,28 @@ function isOwnRecord(
   return owner !== undefined && isOwnedEntry(lockfilePath, 'file', resolveCallerUid(options));
 }
 
+async function reapRecordedOwnerAsync(
+  lockfilePath: string,
+  owner: IDaemonLockfile | undefined,
+  options: IDaemonOrphanReaperOptions
+): Promise<void> {
+  if (!isOwnRecord(lockfilePath, owner, options)) return;
+  await reapDeadDaemonProcessGroupAsync(owner.pid, options);
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, owner.pid, options);
+}
+
 /**
- * Reaps the orphaned processes of a reclaimed daemon's recorded owner, if there is one. A lockfile that is a
- * symbolic link, or that another user owns, names no daemon of this user, so nothing is signaled.
+ * Reaps the orphaned processes of a reclaimed daemon's recorded owner, if there is one, and then the
+ * recorded operation groups of other dead daemons that no lockfile names
+ * (see {@link sweepStrandedOperationGroupsAsync}). A lockfile that is a symbolic link, or that another user
+ * owns, names no daemon of this user, so its owner is not signaled, and the sweep skips the owner's folder
+ * too.
  */
 export async function reapOrphansOfDeadOwnerAsync(
   lockfilePath: string,
   owner: IDaemonLockfile | undefined,
   options: IDaemonOrphanReaperOptions = {}
 ): Promise<void> {
-  if (!isOwnRecord(lockfilePath, owner, options)) return;
-  await reapDeadDaemonProcessGroupAsync(owner.pid, options);
-  await reapDeadDaemonOperationGroupsAsync(lockfilePath, owner.pid, options);
+  await reapRecordedOwnerAsync(lockfilePath, owner, options);
+  await sweepStrandedOperationGroupsAsync(lockfilePath, owner?.pid, options);
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
index 09ba56928d..f64101d363 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
@@ -4,6 +4,7 @@
 import * as fs from 'node:fs';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
+import { hasLiveGroupMember, mayHaveGroupMembers } from './DaemonGroupMemberScan';
 import { isDaemonProcessAlive } from './DaemonLockfile';
 import { listLiveGroupMembers, readProcessStat } from './DaemonProcessStat';
 import type { IProcessStat } from './DaemonProcessStat';
@@ -20,7 +21,10 @@ const PGRP_FIELD_INDEX: number = 3;
 /** Process probing/signaling used to reap a dead daemon's orphaned process groups; injectable for tests. */
 export interface IDaemonProcessGroupOps {
   readonly isProcessAlive: (pid: number) => boolean;
+  /** `true` while a member of the group has not exited; where `/proc` exists, a group of zombies is gone. */
   readonly groupExists: (groupId: number) => boolean;
+  /** `false` only when the group has no process at all, not even a zombie; `true` when that is unknown. */
+  readonly mayHaveMembers: (groupId: number) => boolean;
   readonly signalGroup: (groupId: number, signal: NodeJS.Signals) => void;
   /** The caller's own process group id, or `undefined` when the platform cannot report it. */
   readonly ownGroupId: () => number | undefined;
@@ -38,7 +42,7 @@ function rethrowUnlessNoSuchProcess(error: unknown): void {
   if ((error as NodeJS.ErrnoException | undefined)?.code !== NO_SUCH_PROCESS) throw error;
 }
 
-function groupExists(groupId: number): boolean {
+function hasAnyMember(groupId: number): boolean {
   try {
     process.kill(-groupId, NO_SIGNAL);
     return true;
@@ -48,6 +52,13 @@ function groupExists(groupId: number): boolean {
   }
 }
 
+// kill() also finds a group whose members have all exited but are not reaped (zombies). No signal ends
+// them, and a parent that never reaps, such as a container's init, keeps them, so where `/proc` can tell,
+// they don't count. Without `/proc`, any member counts.
+function groupExists(groupId: number): boolean {
+  return hasAnyMember(groupId) && (!fs.existsSync(PROC_SELF_STAT) || hasLiveGroupMember(groupId));
+}
+
 function signalGroup(groupId: number, signal: NodeJS.Signals): void {
   try {
     process.kill(-groupId, signal);
@@ -74,6 +85,7 @@ function log(message: string): void {
 export const POSIX_PROCESS_GROUP_OPS: IDaemonProcessGroupOps = {
   isProcessAlive: isDaemonProcessAlive,
   groupExists,
+  mayHaveMembers: mayHaveGroupMembers,
   signalGroup,
   ownGroupId,
   readProcessStat,
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
index 6a1401d8ab..f0e5e30746 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
@@ -40,25 +40,36 @@ function parseProcessStat(pid: number, stat: string): IProcessStat {
   };
 }
 
+/** Reads `/proc/<pid>/stat`; throws when the record cannot be read. */
+export function readStatRecord(pid: number): IProcessStat {
+  return parseProcessStat(pid, fs.readFileSync(`${PROC_ROOT}/${pid}/${STAT_FILE_NAME}`, UTF8));
+}
+
 /** Reads `/proc/<pid>/stat`; `undefined` when the process is gone or the platform has no `/proc`. */
 export function readProcessStat(pid: number): IProcessStat | undefined {
   try {
-    return parseProcessStat(pid, fs.readFileSync(`${PROC_ROOT}/${pid}/${STAT_FILE_NAME}`, UTF8));
+    return readStatRecord(pid);
   } catch {
     return undefined;
   }
 }
 
-function isLiveMemberOf(groupId: number, stat: IProcessStat | undefined): stat is IProcessStat {
+/** `true` when `stat` is the record of a process in group `groupId` that has not exited. */
+export function isLiveMemberOf(groupId: number, stat: IProcessStat | undefined): stat is IProcessStat {
   return stat !== undefined && stat.groupId === groupId && !stat.exited;
 }
 
+/** Lists the pids in `/proc`; throws when `/proc` cannot be listed. */
+export function readProcessIds(): number[] {
+  return fs
+    .readdirSync(PROC_ROOT)
+    .filter((name: string) => PID_PATTERN.test(name))
+    .map(Number);
+}
+
 function listProcessIds(): number[] {
   try {
-    return fs
-      .readdirSync(PROC_ROOT)
-      .filter((name: string) => PID_PATTERN.test(name))
-      .map(Number);
+    return readProcessIds();
   } catch {
     return [];
   }
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index e779dacce6..872a54ce32 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -22,9 +22,10 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * that is alive but momentarily unresponsive is never reclaimed underneath itself. Reclaims are serialized
  * through the lockfile mutex ({@link tryAcquireReclaimLock}): only the mutex holder may unlink the socket
  * path, so a concurrent starter cannot delete a socket that another process just bound. Operation processes
- * still running in the dead daemon's process group, or in the operation process groups it recorded, are
- * terminated first (see `DaemonOrphanReaper`) and reported to `options.onOrphansReaped`. Nothing is read,
- * reaped or removed unless the runtime directory is a private directory of this user.
+ * still running in the dead daemon's process group, or in the operation process groups that it recorded, are
+ * terminated first, and so are the operation process groups recorded by other daemons that are gone and that
+ * no lockfile names (see `DaemonOrphanReaper`). They are reported to `options.onOrphansReaped`. Nothing is
+ * read, reaped or removed unless the runtime directory is a private directory of this user.
  *
  * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when a
  * live (or plausibly live) daemon owns the path, or when another starter holds
diff --git a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
index ae5534d2d3..404064dd9e 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonOperationGroupReaper.test.ts
@@ -54,6 +54,14 @@ it('signals a group whose leader has exited when every live member is in its ses
   expect(result.targets).toEqual([OPERATION_GROUP]);
 });
 
+it('signals a group whose leader is a zombie when every live member is in its session', async () => {
+  const zombieLeader: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), exited: true };
+  const processes: IProcessStat[] = [zombieLeader, ...operationTree(OPERATION_GROUP, false)];
+  const result: IFakeGroup & { outcome: string } = await reapAsync(processes);
+  expect(result.outcome).toBe('terminated');
+  expect(result.targets).toEqual([OPERATION_GROUP]);
+});
+
 it('never signals a reused pid: the leader has another start time', async () => {
   const reused: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), startTime: REUSED_START };
   const result: IFakeGroup & { outcome: string } = await reapAsync([reused]);
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
index 8ab89515a3..e2c107e60b 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessGroup.test.ts
@@ -4,6 +4,7 @@
 import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
 
 const GROUP_ID: number = 4242;
+const NO_SIGNAL: number = 0;
 
 function throwErrno(code: string): never {
   throw Object.assign(new Error(code), { code });
@@ -13,6 +14,16 @@ afterEach(() => {
   jest.restoreAllMocks();
 });
 
+it('treats only ESRCH as proof that a process group has no process at all', () => {
+  const kill: jest.SpyInstance = jest.spyOn(process, 'kill').mockImplementation(() => throwErrno('ESRCH'));
+  expect(POSIX_PROCESS_GROUP_OPS.mayHaveMembers(GROUP_ID)).toBe(false);
+  expect(kill).toHaveBeenCalledWith(-GROUP_ID, NO_SIGNAL);
+  kill.mockImplementation(() => throwErrno('EPERM'));
+  expect(POSIX_PROCESS_GROUP_OPS.mayHaveMembers(GROUP_ID)).toBe(true);
+  kill.mockImplementation(() => true);
+  expect(POSIX_PROCESS_GROUP_OPS.mayHaveMembers(GROUP_ID)).toBe(true);
+});
+
 it('treats only ESRCH as proof that a process group is gone', () => {
   jest.spyOn(process, 'kill').mockImplementation(() => throwErrno('ESRCH'));
   expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(false);
diff --git a/libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts b/libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts
new file mode 100644
index 0000000000..c5bb5f5253
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/GroupMemberScan.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { hasLiveGroupMember } from '../DaemonGroupMemberScan';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+
+const GROUP_ID: number = 4242;
+const OTHER_GROUP_ID: number = 4243;
+const MEMBER_PID: number = 101;
+const LEADER_STAT_PATH: string = `/proc/${GROUP_ID}/stat`;
+// A `/proc` listing of the group's leader and one other member; `self` is no pid.
+const PROC_LISTING: string[] = [String(GROUP_ID), String(MEMBER_PID), 'self'];
+// proc_pid_stat(5): "pid (comm) state ppid pgrp session", then 15 fields up to starttime.
+const FIELDS_BEFORE_START_TIME: number = 15;
+const LIVE: string = 'S';
+const ZOMBIE: string = 'Z';
+
+type ReadRecord = () => string;
+
+function inGroup(state: string): ReadRecord {
+  return () => `0 (sleep) ${state} 1 ${GROUP_ID} ${GROUP_ID}${' 0'.repeat(FIELDS_BEFORE_START_TIME)} 777`;
+}
+
+function failing(code: string): ReadRecord {
+  return () => {
+    throw Object.assign(new Error(code), { code });
+  };
+}
+
+const GONE: ReadRecord = failing('ENOENT');
+
+// `readLeader` and `readMember` give the stat records of the group's leader and of its other member.
+function mockProc(readLeader: ReadRecord, readMember: ReadRecord): jest.SpyInstance {
+  jest
+    .spyOn(fs, 'readFileSync')
+    .mockImplementation((path: fs.PathOrFileDescriptor) =>
+      path === LEADER_STAT_PATH ? readLeader() : readMember()
+    );
+  return (jest.spyOn(fs, 'readdirSync') as jest.SpyInstance).mockReturnValue(PROC_LISTING);
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+it('answers from a live leader without listing /proc', () => {
+  const listing: jest.SpyInstance = mockProc(inGroup(LIVE), inGroup(ZOMBIE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+  expect(listing).not.toHaveBeenCalled();
+});
+
+it('counts a live member when the leader is gone or a zombie, and no zombie or other group', () => {
+  mockProc(GONE, inGroup(LIVE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+  expect(hasLiveGroupMember(OTHER_GROUP_ID)).toBe(false);
+  mockProc(inGroup(ZOMBIE), inGroup(LIVE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+  mockProc(inGroup(ZOMBIE), inGroup(ZOMBIE));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(false);
+});
+
+it.each(['ENOENT', 'ESRCH'])('does not count a listed process that is gone (%s)', (code: string) => {
+  mockProc(failing(code), failing(code));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(false);
+});
+
+it('counts a listed process whose record it cannot read, as under hidepid, as a live member', () => {
+  mockProc(GONE, failing('EACCES'));
+  expect(hasLiveGroupMember(GROUP_ID)).toBe(true);
+});
+
+it('throws when it cannot list /proc', () => {
+  mockProc(GONE, GONE).mockImplementation(failing('EMFILE'));
+  expect(() => hasLiveGroupMember(GROUP_ID)).toThrow('EMFILE');
+});
+
+describe('a group that kill() still finds', () => {
+  beforeEach(() => {
+    jest.spyOn(process, 'kill').mockImplementation(() => true);
+  });
+
+  it('is gone once every member that /proc lists has exited', () => {
+    jest.spyOn(fs, 'existsSync').mockReturnValue(true);
+    mockProc(inGroup(ZOMBIE), inGroup(ZOMBIE));
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(false);
+    mockProc(GONE, inGroup(LIVE));
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(true);
+  });
+
+  it('exists where there is no /proc to tell', () => {
+    jest.spyOn(fs, 'existsSync').mockReturnValue(false);
+    mockProc(GONE, GONE).mockImplementation(failing('ENOENT'));
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(GROUP_ID)).toBe(true);
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts
new file mode 100644
index 0000000000..99a5e0a498
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSweep.test.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { sweepStrandedOperationGroupsAsync } from '../DaemonOperationGroupSweep';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { OPERATION_GROUP, OTHER_OPERATION_GROUP, operationTree, stat } from './OperationGroupFixture';
+import {
+  OTHER_STRANDED_PID,
+  STRANDED_PID,
+  recordDaemonFolder,
+  recordFolder,
+  removeCreatedEntries,
+  withLivePids
+} from './OperationGroupSweepFixture';
+import { SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const LIVE_PID: number = 4303;
+const OWNER_PID: number = 4304;
+const REUSED_START: string = '999';
+const NO_OWNER: undefined = undefined;
+// Number() rounds this name to 1e20, whose folder name it is again, but no process can have that pid.
+const UNSAFE_PID_NAME: string = '100000000000000000000';
+
+afterEach(removeCreatedEntries);
+
+// OPERATION_GROUP is the operation its record names; OTHER_OPERATION_GROUP's leader is another process.
+function createFake(): IFakeGroup {
+  const reused: IProcessStat = {
+    ...stat(OTHER_OPERATION_GROUP, OTHER_OPERATION_GROUP),
+    startTime: REUSED_START
+  };
+  return createFakeGroup({ exitsOn: 'SIGTERM', processes: [...operationTree(OPERATION_GROUP), reused] });
+}
+
+function existing(folders: readonly string[]): string[] {
+  return folders.filter((folder: string) => fs.existsSync(folder));
+}
+
+it('sweeps the folders of dead daemons that no lockfile names, and signals only proven groups', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folders: string[] = [
+    recordDaemonFolder(lockfilePath, STRANDED_PID, [OPERATION_GROUP]),
+    recordDaemonFolder(lockfilePath, OTHER_STRANDED_PID, [OTHER_OPERATION_GROUP])
+  ];
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, withLivePids(fake, [SELF_PID]));
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+  expect(fake.logs).toEqual([
+    `Reclaimed dead daemon ${STRANDED_PID}: its orphaned operation process groups ` +
+      `${OPERATION_GROUP} were terminated.`
+  ]);
+  expect(existing(folders)).toEqual([]);
+});
+
+it('leaves the folders of a live pid (maybe reused), of the lockfile owner and of the caller', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folders: string[] = [LIVE_PID, OWNER_PID, SELF_PID].map((pid: number) =>
+    recordDaemonFolder(lockfilePath, pid, [OPERATION_GROUP])
+  );
+  await sweepStrandedOperationGroupsAsync(lockfilePath, OWNER_PID, withLivePids(fake, [LIVE_PID]));
+  expect(fake.signals).toEqual([]);
+  expect(existing(folders)).toEqual(folders);
+});
+
+it('leaves folders that only look like a record folder of the lockfile, or name no real pid', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folders: string[] = [
+    `${lockfilePath}.groups-0${STRANDED_PID}`,
+    `${lockfilePath}.groups-0`,
+    `${lockfilePath}.groups--${STRANDED_PID}`,
+    `${lockfilePath}.groups-${UNSAFE_PID_NAME}`,
+    `${lockfilePath}.groups-${STRANDED_PID}.old`,
+    `${lockfilePath}.old.groups-${STRANDED_PID}`
+  ].map((folder: string) => recordFolder(folder, [OPERATION_GROUP]));
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, withLivePids(fake, [SELF_PID]));
+  expect(fake.signals).toEqual([]);
+  expect(existing(folders)).toEqual(folders);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts
new file mode 100644
index 0000000000..2718780c5b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSweepFixture.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { RECORDED_START } from './OperationGroupFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+/** A daemon that is gone and whose record folder no lockfile names. */
+export const STRANDED_PID: number = 4301;
+/** A second such daemon. */
+export const OTHER_STRANDED_PID: number = 4302;
+const FIRST_INDEX: number = 0;
+const LINK_TARGET_SUFFIX: string = '.target';
+
+const createdEntries: string[] = [];
+
+/** Records `groupIds` in `folder`; {@link removeCreatedEntries} deletes what a test leaves. */
+export function recordFolder(folder: string, groupIds: readonly number[]): string {
+  fs.mkdirSync(folder, { recursive: true });
+  for (const groupId of groupIds) writeOperationGroupRecord(folder, { groupId, startTime: RECORDED_START });
+  createdEntries.push(folder);
+  return folder;
+}
+
+/** Records `groupIds` in the record folder of daemon `daemonPid` beside `lockfilePath`. */
+export function recordDaemonFolder(
+  lockfilePath: string,
+  daemonPid: number,
+  groupIds: readonly number[]
+): string {
+  return recordFolder(getOperationGroupsFolder(lockfilePath, daemonPid), groupIds);
+}
+
+/** Moves `entryPath` aside and puts a symbolic link to it in its place. */
+export function moveBehindLink(entryPath: string): void {
+  const target: string = `${entryPath}${LINK_TARGET_SUFFIX}`;
+  fs.renameSync(entryPath, target);
+  fs.symlinkSync(target, entryPath);
+  createdEntries.push(target);
+}
+
+/** Deletes the folders, links and link targets that the helpers above created. */
+export function removeCreatedEntries(): void {
+  for (const entry of createdEntries.splice(FIRST_INDEX)) fs.rmSync(entry, { recursive: true, force: true });
+}
+
+/** The options of `fake`, in whose process table exactly `livePids` are alive. */
+export function withLivePids(fake: IFakeGroup, livePids: readonly number[]): IDaemonOrphanReaperOptions {
+  const ops: IDaemonProcessGroupOps = {
+    ...(fake.options.ops as IDaemonProcessGroupOps),
+    isProcessAlive: (pid: number) => livePids.includes(pid)
+  };
+  return { ...fake.options, ops };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
index 59fdcb4014..4a13daf393 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
@@ -70,6 +70,7 @@ function createGroupOps(table: IFakeTable): IDaemonProcessGroupOps {
   return {
     isProcessAlive: () => spec.daemonAlive === true,
     groupExists: (groupId: number) => groupExists(table, groupId),
+    mayHaveMembers: (groupId: number) => groupExists(table, groupId),
     signalGroup: (groupId: number, signal: NodeJS.Signals) => {
       table.targets.push(groupId);
       table.signals.push(signal);
diff --git a/libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts b/libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts
new file mode 100644
index 0000000000..37894d7fc7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/StaleRecordProbe.test.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import {
+  OPERATION_GROUP,
+  OTHER_OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain
+} from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+interface IScanCount {
+  /** The group of each scan of the process table for a group's members, in order. */
+  readonly scannedGroups: number[];
+  readonly options: IDaemonOrphanReaperOptions;
+}
+
+// The options of `fake`, which also count each scan of its process table for a group's members.
+function countScans(fake: IFakeGroup): IScanCount {
+  const ops: IDaemonProcessGroupOps = fake.options.ops as IDaemonProcessGroupOps;
+  const scannedGroups: number[] = [];
+  const listLiveGroupMembers = (groupId: number): IProcessStat[] => {
+    scannedGroups.push(groupId);
+    return ops.listLiveGroupMembers(groupId);
+  };
+  return { scannedGroups, options: { ...fake.options, ops: { ...ops, listLiveGroupMembers } } };
+}
+
+it('drops a record whose group has no process without a scan of every process', async () => {
+  const fake: IFakeGroup = createFakeGroup({
+    exitsOn: 'SIGTERM',
+    processes: operationTree(OPERATION_GROUP, false)
+  });
+  const { scannedGroups, options } = countScans(fake);
+  const lockfilePath: string = recordGroups([OTHER_OPERATION_GROUP, OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe(
+    'terminated'
+  );
+  expect(scannedGroups).toEqual([OPERATION_GROUP]);
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+});
+
+it('still decides by the proof when a group that kill() finds has no live member', async () => {
+  const fake: IFakeGroup = createFakeGroup({ anyGroupExists: true, processes: [] });
+  const { scannedGroups, options } = countScans(fake);
+  const lockfilePath: string = recordGroups([OTHER_OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+  expect(scannedGroups).toEqual([OTHER_OPERATION_GROUP]);
+  expect(fake.signals).toEqual([]);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+});
diff --git a/libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts
new file mode 100644
index 0000000000..47298d2192
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/StrandedGroupReapOnReclaim.test.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { reclaimStaleDaemonAsync } from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { killFakeDaemonAsync, startFakeDaemonAsync } from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Above the worst case of the reaper's SIGTERM and SIGKILL grace periods plus the polls below.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+const RECORDED_OPERATIONS: number = 2;
+
+let started: IStartedProcess[] = [];
+let folders: string[] = [];
+afterEach(() => {
+  // A failed assertion must not leave this test's processes or record folders behind.
+  killStillRunning(started);
+  for (const folder of folders) fs.rmSync(folder, { recursive: true, force: true });
+  started = [];
+  folders = [];
+});
+
+// A fake daemon records its operations, but no lockfile names it, as after an older `daemon stop --force`
+// that removed the lockfile, without a reclaim, while the daemon's operations still ran.
+async function startUnnamedDaemonAsync(paths: IDaemonPaths): Promise<[IFakeDaemon, string]> {
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  const folder: string = getOperationGroupsFolder(paths.lockfilePath, Number(fake.daemon.pid));
+  folders.push(folder);
+  return [fake, folder];
+}
+
+async function reapsStrandedGroupsAsync(): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const [fake, folder] = await startUnnamedDaemonAsync(paths);
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  await killFakeDaemonAsync(fake);
+  expect(await waitUntilAsync(() => isGone(exitingLeader))).toBe(true);
+  const reaps: IDaemonOrphanReap[] = [];
+  await reclaimStaleDaemonAsync(paths, { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) });
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+  expect(fs.existsSync(folder)).toBe(false);
+  expect(reaps).toEqual([
+    { daemonPid: Number(fake.daemon.pid), processGroupIds: expect.any(Array), outcome: 'terminated' }
+  ]);
+  const [{ processGroupIds }] = reaps;
+  expect(new Set(processGroupIds)).toEqual(new Set([waitingLeader, exitingLeader]));
+}
+
+posixIt(
+  'reaps the operation groups of a dead daemon that no lockfile names',
+  reapsStrandedGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
+
+async function leavesLiveDaemonGroupsAsync(): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const [fake, folder] = await startUnnamedDaemonAsync(paths);
+  await reclaimStaleDaemonAsync(paths);
+  expect(fake.pids.every(isAlive)).toBe(true);
+  expect(readOperationGroupRecords(folder)).toHaveLength(RECORDED_OPERATIONS);
+}
+
+posixIt(
+  'leaves the operation groups of a live daemon that no lockfile names',
+  leavesLiveDaemonGroupsAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts b/libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts
new file mode 100644
index 0000000000..68a3f47930
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SweepOwnership.test.ts
@@ -0,0 +1,53 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { sweepStrandedOperationGroupsAsync } from '../DaemonOperationGroupSweep';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_GROUP, operationTree } from './OperationGroupFixture';
+import {
+  STRANDED_PID,
+  moveBehindLink,
+  recordDaemonFolder,
+  removeCreatedEntries,
+  withLivePids
+} from './OperationGroupSweepFixture';
+import { SELF_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const NO_UID: number = 0;
+const OTHER_USER_OFFSET: number = 1;
+const NO_OWNER: undefined = undefined;
+
+afterEach(removeCreatedEntries);
+
+function createFake(): IFakeGroup {
+  return createFakeGroup({ exitsOn: 'SIGTERM', processes: operationTree(OPERATION_GROUP) });
+}
+
+posixIt('never signals the groups in a stranded record folder that is a symbolic link', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = recordDaemonFolder(lockfilePath, STRANDED_PID, [OPERATION_GROUP]);
+  moveBehindLink(folder);
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, withLivePids(fake, [SELF_PID]));
+  expect(fake.signals).toEqual([]);
+  expect(fs.lstatSync(folder).isSymbolicLink()).toBe(true);
+});
+
+posixIt('never signals the groups in a stranded record folder of another user', async () => {
+  const fake: IFakeGroup = createFake();
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = recordDaemonFolder(lockfilePath, STRANDED_PID, [OPERATION_GROUP]);
+  const options: IDaemonOrphanReaperOptions = {
+    ...withLivePids(fake, [SELF_PID]),
+    uid: (process.getuid?.() ?? NO_UID) + OTHER_USER_OFFSET
+  };
+  await sweepStrandedOperationGroupsAsync(lockfilePath, NO_OWNER, options);
+  expect(fake.signals).toEqual([]);
+  expect(fs.existsSync(folder)).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts b/libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts
new file mode 100644
index 0000000000..c2a3af7c11
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/UnreapedLeaderFixture.ts
@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import type { Readable } from 'node:stream';
+
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+
+// sh without job control keeps a background job in the shell's process group, so the job leads no group
+// and setsid(1) calls setsid() itself instead of forking. The shell then becomes a sleep, which never reaps
+// the job.
+const UNREAPED_LEADER_SCRIPT: string =
+  'setsid sleep 600 </dev/null >/dev/null 2>&1 & echo $!; exec sleep 600';
+const FIRST_INDEX: number = 0;
+
+const started: IStartedProcess[] = [];
+
+/**
+ * Starts a process that leads its own session and process group, like a detached operation, and whose parent
+ * never reaps it: once it exits, it stays a zombie. Returns its pid.
+ */
+export async function startUnreapedLeaderAsync(): Promise<number> {
+  const parent: ChildProcess = spawn('/bin/sh', ['-c', UNREAPED_LEADER_SCRIPT], {
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const [chunk] = (await once(parent.stdout as Readable, 'data')) as [Buffer];
+  (parent.stdout as Readable).destroy();
+  const pid: number = Number(chunk.toString().trim());
+  started.push(...identifyStarted([Number(parent.pid), pid]));
+  await waitUntilAsync(() => readProcessStat(pid)?.sessionId === pid);
+  return pid;
+}
+
+/** `true` once `pid` has exited but is not reaped. */
+export function isZombie(pid: number): boolean {
+  return readProcessStat(pid)?.exited === true;
+}
+
+/** Kills the parents and leaders that are still the processes started; a parent's exit lets its zombie go. */
+export function killUnreapedLeaders(): void {
+  killStillRunning(started.splice(FIRST_INDEX));
+}
diff --git a/libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts b/libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts
new file mode 100644
index 0000000000..265c4dbe9b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ZombieOperationGroups.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { OPERATION_GROUP, recordGroups, stat } from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { waitUntilAsync } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+import { isZombie, killUnreapedLeaders, startUnreapedLeaderAsync } from './UnreapedLeaderFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Short, so that a group that never counts as gone fails its test within about a second.
+const GRACE_MS: number = 500;
+const TEST_TIMEOUT_MS: number = 30000;
+// The real process table, in which daemon DEAD_PID is dead whatever this host runs under that pid.
+const REAL_OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false },
+  graceMs: GRACE_MS
+};
+
+let folders: string[] = [];
+afterEach(() => {
+  killUnreapedLeaders();
+  for (const folder of folders) fs.rmSync(folder, { recursive: true, force: true });
+  folders = [];
+});
+
+/** Records `leader` with its real start time for dead daemon DEAD_PID; returns the lockfile path. */
+function recordLeader(leader: number): string {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  folders.push(folder);
+  fs.mkdirSync(folder, { recursive: true });
+  const { startTime } = readProcessStat(leader) as IProcessStat;
+  writeOperationGroupRecord(folder, { groupId: leader, startTime });
+  return lockfilePath;
+}
+
+linuxIt(
+  'counts a group whose only member is a zombie as gone',
+  async () => {
+    const leader: number = await startUnreapedLeaderAsync();
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(leader)).toBe(true);
+    process.kill(leader, 'SIGKILL');
+    expect(await waitUntilAsync(() => isZombie(leader))).toBe(true);
+    expect(POSIX_PROCESS_GROUP_OPS.groupExists(leader)).toBe(false);
+  },
+  TEST_TIMEOUT_MS
+);
+
+async function stopsGroupLeftAsZombieAsync(): Promise<void> {
+  const leader: number = await startUnreapedLeaderAsync();
+  const lockfilePath: string = recordLeader(leader);
+  const reaps: IDaemonOrphanReap[] = [];
+  const options: IDaemonOrphanReaperOptions = {
+    ...REAL_OPTIONS,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  };
+  const outcome: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options);
+  await expect(outcome).resolves.toBe('terminated');
+  expect(isZombie(leader)).toBe(true);
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [leader], outcome: 'terminated' }]);
+  expect(fs.existsSync(getOperationGroupsFolder(lockfilePath, DEAD_PID))).toBe(false);
+}
+
+linuxIt('stops a group whose parent never reaps it', stopsGroupLeftAsZombieAsync, TEST_TIMEOUT_MS);
+
+async function dropsZombieLeaderAsync(): Promise<void> {
+  const leader: number = await startUnreapedLeaderAsync();
+  const lockfilePath: string = recordLeader(leader);
+  process.kill(leader, 'SIGKILL');
+  expect(await waitUntilAsync(() => isZombie(leader))).toBe(true);
+  const outcome: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, REAL_OPTIONS);
+  await expect(outcome).resolves.toBe('none');
+  expect(fs.existsSync(getOperationGroupsFolder(lockfilePath, DEAD_PID))).toBe(false);
+}
+
+linuxIt('drops the record of a leader that is already a zombie', dropsZombieLeaderAsync, TEST_TIMEOUT_MS);
+
+it('never signals a recorded group whose leader is a zombie and that has no live member', async () => {
+  const zombieLeader: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), exited: true };
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', processes: [zombieLeader] });
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  const outcome: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options);
+  await expect(outcome).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+});

From e8a455ec5912d53e95d5fd78835a141c419b931e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:58 +0000
Subject: [PATCH 135/265] [rush-client-core] Say that another client may be
 resetting the daemon when the start mutex is held

Swarm integration step 120; original commit b8d29764ef (merge of swarm/o04-t199-nit1 at a589b2a5c8).
Refs: 199 NIT 1.
Scope: task 199-nit1.

Brings 199-nit1 (branch swarm/o04-t199-nit1). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 5 of 20. Gate: ch01 GATE OK board 4947 (tree 9fee0d170b)

Commits folded into this step (2):
- 26baca5afa Stop the operations of a daemon that exited before "daemon stop --force" removes its files (task 199)
- a589b2a5c8 [rush-client-core] Say that another client may be resetting the daemon when the start mutex is held (199 NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  16 +-
 apps/rush-cli-client/src/daemonCommands.ts    |  41 +++-
 .../src/test/ShutdownExitDaemonTestProcess.ts |  58 +++++
 .../src/test/nativeBuild.test.ts              |  78 +++++++
 ...199-force-reset-reap_2026-09-29-04-52.json |  11 +
 ...199-force-reset-reap_2026-09-29-04-52.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   2 +-
 libraries/rush-client-core/README.md          |   4 +
 .../rush-client-core/src/DaemonOwnership.ts   | 104 +++++++--
 .../src/connectOrStartDaemon.ts               |   2 +-
 .../src/test/DaemonArtifactReset.test.ts      | 204 ++++++++++++++++++
 .../src/test/OrphanedOperation.ts             |  47 ++++
 .../src/test/connectOrStartDaemon.test.ts     |   4 +-
 13 files changed, 549 insertions(+), 33 deletions(-)
 create mode 100644 apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json
 create mode 100644 libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 9ba821298e..5eff149828 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -362,8 +362,8 @@ ownership record and socket, as the next daemon start would, so a rerun, with or
 `--no-daemon`, does not race them.
 Rush run in-process, with `--no-daemon` or as a fallback, first does the same when the ownership
 record names a daemon that no longer runs, for example when the client that ran the command was
-killed along with the daemon. Each of these reclaims, and the one that `daemon start` or an automatic
-start does, prints one line that says what it stopped, for example:
+killed along with the daemon. Each of these reclaims, and the ones that `daemon start`, an automatic
+start and `daemon stop --force` do, prints one line that says what it stopped, for example:
 
 ```
 rush-client: Stopped the operations that the exited daemon (PID 4242) left running (process group 4242).
@@ -566,7 +566,17 @@ any remaining artifacts, such as an abandoned startup reservation, reporting the
 `state: "reset"` and the `removedPaths` (or `state: "notRunning"` if nothing was
 left behind). It holds the start mutex, proves that no listener is bound, and
 refuses (exit 1) while the recorded owner PID still exists and cannot be shown to
-be a reused PID. It never kills a process. Automatic startup already reclaims
+be a reused PID. When the recorded owner PID no longer exists, the daemon exited without shutting
+down and may have left operations running that only its records name, so the reset first stops them
+as the next daemon start would: SIGTERM, then SIGKILL 2 seconds later, to the daemon's own process
+group and to each operation process group that it recorded whose leader still has the recorded start
+time (or has exited, while every live member of the group is in the group's own session). It prints the
+line shown above for a lost connection and reports what it stopped in `orphansReaped` (`daemonPid`,
+`processGroupIds`, `outcome`). A recorded group that it cannot prove, such as a PID that a later
+process now has, is not signalled; its record is removed with the others. If the operations cannot be
+stopped, it exits with code 1 and removes nothing. While another process reclaims the same files it
+also exits with code 1, except that after a shutdown it re-checks for up to 15 seconds. Otherwise it
+never signals a process. Automatic startup already reclaims
 the common leftovers on its own (see below); this is the documented escape hatch
 that every fail-closed startup message points to. A reset also appends a line to the launcher log
 that clears the report of a daemon that a client reclaimed, so status no longer names it.
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index 0062a3e5fd..4d2229f4a5 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -23,6 +23,7 @@ import {
   isDaemonProcessAlive,
   readDaemonLockfile,
   type IDaemonLockfile,
+  type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 import type { IDaemonPongMessage, IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
@@ -80,7 +81,7 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       options.environment,
       mayStart
     )),
-    // A start reclaims a daemon that exited uncleanly, and says what it stopped.
+    // A start, or a forced stop, reclaims a daemon that exited uncleanly, and says what it stopped.
     onOrphansReaped: createOrphanReapNoticeHandler({ rushx: false, agentRenderer: undefined, writeStderr })
   };
   if (command === 'logs') {
@@ -123,14 +124,12 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       }
       return;
     }
-    const { removedPaths } =
-      options.argv[1] === '--force'
-        ? await resetDaemonArtifactsAsync(connectionOptions.paths)
-        : { removedPaths: [] };
+    const reset: IForceResetResult | undefined =
+      options.argv[1] === '--force' ? await forceResetAsync(connectionOptions) : undefined;
     await writeStatusAsync({
-      state: removedPaths.length > 0 ? 'reset' : 'notRunning',
+      state: reset && reset.removedPaths.length > 0 ? 'reset' : 'notRunning',
       socketPath: connectionOptions.paths.socketPath,
-      ...(options.argv[1] === '--force' ? { removedPaths } : {}),
+      ...reset,
       ...getStartupReservationStatus(connectionOptions.paths)
     });
     return;
@@ -156,14 +155,12 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       if (options.argv[1] === '--force') {
         // Wait for the acknowledged daemon to release its listener and record, then clear leftovers
         // such as an abandoned startup reservation in the same invocation.
-        const { removedPaths } = await resetDaemonArtifactsAsync(connectionOptions.paths, {
-          waitTimeoutMs: FORCE_STOP_WAIT_MS
-        });
+        const reset: IForceResetResult = await forceResetAsync(connectionOptions, FORCE_STOP_WAIT_MS);
         await writeStatusAsync({
           state: 'shutdownAccepted',
           socketPath: connectionOptions.paths.socketPath,
           ...cancelled,
-          removedPaths
+          ...reset
         });
         return;
       }
@@ -367,6 +364,28 @@ function writeStatusAsync(status: object): Promise<void> {
   return writeStreamAsync(process.stdout, Buffer.from(`${JSON.stringify(status)}\n`));
 }
 
+interface IForceResetResult {
+  readonly removedPaths: ReadonlyArray<string>;
+  /** Present when the reset first stopped operations that a daemon that exited had left running. */
+  readonly orphansReaped?: ReadonlyArray<IDaemonOrphanReap>;
+}
+
+/** Removes the leftover daemon files; the operations that it stops first are also noted on stderr. */
+async function forceResetAsync(
+  connectionOptions: IConnectOrStartDaemonOptions,
+  waitTimeoutMs?: number
+): Promise<IForceResetResult> {
+  const orphansReaped: IDaemonOrphanReap[] = [];
+  const { removedPaths } = await resetDaemonArtifactsAsync(connectionOptions.paths, {
+    waitTimeoutMs,
+    onOrphansReaped: (reap: IDaemonOrphanReap): void => {
+      orphansReaped.push(reap);
+      connectionOptions.onOrphansReaped?.(reap);
+    }
+  });
+  return orphansReaped.length > 0 ? { removedPaths, orphansReaped } : { removedPaths };
+}
+
 /** A daemon whose installation was removed or replaced still answers, but restarts on its next request. */
 async function writeReadyStatusAsync(
   paths: IDaemonPaths,
diff --git a/apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts b/apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts
new file mode 100644
index 0000000000..513fa9c458
--- /dev/null
+++ b/apps/rush-cli-client/src/test/ShutdownExitDaemonTestProcess.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameListener, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+// A stand-in daemon that acknowledges a shutdown and then exits without releasing its files, as a daemon that
+// crashes while it shuts down does. Once it listens, it starts an operation process, which shares its process group
+// like a phased operation and keeps running after it exits, and prints that process's PID.
+async function mainAsync(): Promise<void> {
+  const paths: IDaemonPaths = JSON.parse(process.argv[2]);
+  await DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: (connection) => {
+      connection.onFrame(async (frame) => {
+        const message = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'hello') {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage({
+              kind: 'helloAck',
+              payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'stand-in' }
+            })
+          });
+        } else if (message.kind === 'ping') {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage({
+              kind: 'pong',
+              payload: { daemonVersion: 'stand-in', uptimeMs: 1, pid: process.pid }
+            })
+          });
+        } else if (message.kind === 'shutdown') {
+          await connection.sendFrameAsync({
+            kind: DaemonFrameType.controlJson,
+            payload: encodeDaemonControlMessage({ kind: 'shutdownAck', payload: {} })
+          });
+          await connection.closeAsync();
+          process.kill(process.pid, 'SIGKILL');
+        }
+      });
+    }
+  });
+  const operation: ChildProcess = spawn(process.execPath, ['-e', process.argv[3]], { stdio: 'ignore' });
+  process.stdout.write(`${operation.pid}\n`);
+}
+
+mainAsync().catch((error: Error) => {
+  process.stderr.write(`${error.stack}\n`);
+  process.exitCode = 1;
+});
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index fd65827ac7..819e8be37c 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -47,6 +47,27 @@ async function startCrashedDaemonAsync(
   return { daemonPid: daemon.pid!, operationPid: Number(chunk.toString().trim()) };
 }
 
+/**
+ * Starts a stand-in daemon that exits without releasing its files once it acknowledges a shutdown, and waits until
+ * it listens and its operation runs.
+ */
+async function startShutdownExitDaemonAsync(
+  paths: IDaemonPaths
+): Promise<{ daemon: ChildProcess; operationPid: number }> {
+  const daemon: ChildProcess = spawn(
+    process.execPath,
+    [path.join(__dirname, 'ShutdownExitDaemonTestProcess.js'), JSON.stringify(paths), OPERATION_SCRIPT],
+    { detached: true, stdio: ['ignore', 'pipe', 'inherit'] }
+  );
+  const listening: [Buffer] | undefined = await Promise.race([
+    once(daemon.stdout!, 'data') as Promise<[Buffer]>,
+    once(daemon, 'exit').then(() => undefined)
+  ]);
+  daemon.stdout!.destroy();
+  if (!listening) throw new Error('The stand-in daemon exited before it listened.');
+  return { daemon, operationPid: Number(listening[0].toString().trim()) };
+}
+
 /** False once the operation process has exited, even before it is reaped: a zombie's command line is empty. */
 function isOperationRunning(pid: number): boolean {
   try {
@@ -518,4 +539,61 @@ describe('native build through the standalone client', () => {
       }),
     30000
   );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a crashed daemon left running when "daemon stop --force" removes its files',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemonPid, operationPid } = await startCrashedDaemonAsync(paths);
+        try {
+          const reset: IResult = await invokeAsync(['daemon', 'stop', '--force']);
+          expect(reset.code).toBe(0);
+          expectOneReclaimLine(reset, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(JSON.parse(reset.stdout)).toEqual({
+            state: 'reset',
+            socketPath: paths.socketPath,
+            removedPaths: [paths.lockfilePath],
+            orphansReaped: [{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]
+          });
+          // Nothing that the record led to is left, so a second reset stops and removes nothing.
+          const again: IResult = await invokeAsync(['daemon', 'stop', '--force']);
+          expect(again).toMatchObject({ code: 0, stderr: '' });
+          expect(JSON.parse(again.stdout)).toEqual({
+            state: 'notRunning',
+            socketPath: paths.socketPath,
+            removedPaths: []
+          });
+        } finally {
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations that a daemon left running when it exits after it acknowledges "daemon stop --force"',
+    () =>
+      runWithFixtureAsync(async ({ paths, invokeAsync }) => {
+        const { daemon, operationPid } = await startShutdownExitDaemonAsync(paths);
+        const daemonPid: number = daemon.pid!;
+        try {
+          const stopped: IResult = await invokeAsync(['daemon', 'stop', '--force']);
+          expect(stopped.code).toBe(0);
+          expectOneReclaimLine(stopped, daemonPid, 'stderr');
+          expect(isOperationRunning(operationPid)).toBe(false);
+          expect(JSON.parse(stopped.stdout)).toEqual({
+            state: 'shutdownAccepted',
+            socketPath: paths.socketPath,
+            removedPaths: [paths.lockfilePath, paths.socketPath],
+            orphansReaped: [{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]
+          });
+        } finally {
+          // Node signals the stand-in only until it is reaped, so never a process that reused its PID.
+          daemon.kill('SIGKILL');
+          if (isOperationRunning(operationPid)) process.kill(operationPid, 'SIGKILL');
+        }
+      }),
+    30000
+  );
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json b/common/changes/@rushstack/rush-cli-client/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json
new file mode 100644
index 0000000000..86ade9db1c
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "`rush-client daemon stop --force` now stops the operations that a daemon that exited without shutting down left running before it removes the daemon's files, as the next `daemon start` would. It prints the same `rush-client: Stopped the operations that the exited daemon (PID <pid>) left running (process group <pgid>).` line and reports what it stopped in `orphansReaped`. If they cannot be stopped, it exits with code 1 and removes nothing. Before, it removed the ownership record that names those operations and left them running.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json b/common/changes/@rushstack/rush-client-core/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json
new file mode 100644
index 0000000000..ce52526b08
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-o04-t199-force-reset-reap_2026-09-29-04-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "`resetDaemonArtifactsAsync()` now stops the operations that a daemon that exited without shutting down left running before it removes the daemon's ownership record, as the next daemon start would, and reports them to the new `onOrphansReaped` option (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings). It removes nothing when they cannot be stopped. Before, it removed the record that names those operations, so no later start could stop them.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 8405a3bec0..87b2c83e44 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -124,7 +124,7 @@ export interface IConnectOrStartDaemonOptions extends Omit<IDaemonClientConnectO
 }
 
 // @beta
-export interface IDaemonArtifactResetOptions {
+export interface IDaemonArtifactResetOptions extends IDaemonReclaimOptions {
     readonly waitTimeoutMs?: number;
 }
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index c3ab2bec78..a3c1d2988e 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -112,6 +112,10 @@ record whose PID now belongs to a process that started after the record's `start
 (PID reuse, detected from `/proc`). Any other live PID with an unreachable socket fails
 closed, pointing to `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`),
 which removes the record, socket and reservation after the same no-listener/no-live-owner checks.
+When the recorded PID no longer exists, the reset first stops the operations that the owner left
+running, as `reclaimStaleDaemonAsync()` does before the next start, and reports them to
+`options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings). It removes nothing when
+they cannot be stopped, and it never signals a process otherwise.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
 readiness. The explicit launcher's cwd is unchanged. If the daemon exits after its helper saw it ready
 but before the starting client connected, for example because `rush-client daemon stop` stopped it,
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index 78a59df096..7d925e3e2d 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -6,7 +6,14 @@ import * as net from 'node:net';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import type { IDaemonLockfile, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import {
+  DaemonTransportError,
+  DaemonTransportErrorCode,
+  reclaimStaleDaemonAsync,
+  type IDaemonLockfile,
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
 
 import { DaemonClientError } from './DaemonClientError';
 import { getDaemonStartupFilePath } from './DaemonStartup';
@@ -29,8 +36,11 @@ type OwnershipState =
   | { readonly kind: 'owned'; readonly raw: string; readonly owner: DaemonOwnership };
 
 /** Options for {@link resetDaemonArtifactsAsync}. @beta */
-export interface IDaemonArtifactResetOptions {
-  /** How long to keep re-checking a bound listener, live owner, or held start mutex. Defaults to 0. */
+export interface IDaemonArtifactResetOptions extends IDaemonReclaimOptions {
+  /**
+   * How long to keep re-checking a bound listener, a live owner, a held start mutex, or another process that
+   * reclaims the files of an owner that exited. Defaults to 0.
+   */
   readonly waitTimeoutMs?: number;
 }
 
@@ -123,11 +133,15 @@ export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promi
 /**
  * Removes this workspace's leftover daemon files (ownership record, socket, and startup reservation)
  * after verifying that no listener is bound and that the recorded owner, if any, is gone.
- * @remarks Never kills a process. Fails when another client holds the start mutex, a listener is bound,
- * or the recorded owner is alive; with `waitTimeoutMs`, those conditions are re-checked until the deadline
- * (for example, while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears
- * the report of a daemon that a client reclaimed after it exited without shutting down
- * ({@link findReclaimedDaemonPid}).
+ * @remarks When the recorded PID no longer exists, the owner exited without shutting down and may have left
+ * operations running, which only its records name. So the reset first stops them, as the next daemon start
+ * would (`reclaimStaleDaemonAsync`), and reports each set of process groups that it stops to
+ * `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. When they cannot be
+ * stopped, it throws and removes nothing. Otherwise it never signals a process. Fails when another client holds
+ * the start mutex, a listener is bound, the recorded owner is alive, or another process reclaims the files of
+ * the owner that exited; with `waitTimeoutMs`, those conditions are re-checked until the deadline (for example,
+ * while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears the report of a
+ * daemon that a client reclaimed after it exited without shutting down ({@link findReclaimedDaemonPid}).
  * @beta
  */
 export async function resetDaemonArtifactsAsync(
@@ -136,7 +150,10 @@ export async function resetDaemonArtifactsAsync(
 ): Promise<IDaemonArtifactResetResult> {
   const deadline: number = Date.now() + (options?.waitTimeoutMs ?? 0);
   while (true) {
-    const outcome: IDaemonArtifactResetResult | DaemonClientError = await tryResetDaemonArtifactsAsync(paths);
+    const outcome: IDaemonArtifactResetResult | DaemonClientError = await tryResetDaemonArtifactsAsync(
+      paths,
+      options
+    );
     if (!(outcome instanceof DaemonClientError)) return outcome;
     if (Date.now() >= deadline) throw outcome;
     await delayAsync(Math.min(RESET_RETRY_MS, Math.max(1, deadline - Date.now())));
@@ -145,14 +162,15 @@ export async function resetDaemonArtifactsAsync(
 
 /** Returns a (not thrown) error for conditions that may clear on their own. */
 async function tryResetDaemonArtifactsAsync(
-  paths: IDaemonPaths
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions | undefined
 ): Promise<IDaemonArtifactResetResult | DaemonClientError> {
   if (!fs.existsSync(path.dirname(paths.lockfilePath))) return { removedPaths: [] };
   const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
   if (!lock) {
     return new DaemonClientError(
       'startupFailed',
-      `Another client is starting the daemon for ${paths.lockfilePath}; retry after it finishes.`
+      `Another client is starting or resetting the daemon for ${paths.lockfilePath}; retry after it finishes.`
     );
   }
   try {
@@ -169,14 +187,27 @@ async function tryResetDaemonArtifactsAsync(
         `PID ${state.owner.pid} still owns ${paths.lockfilePath}; it may be a daemon that is shutting down. Wait for it to exit (or stop that process yourself), then retry. No process was killed.`
       );
     }
+    // A reclaim removes the record and the socket itself, right after its own checks.
+    const reclaimed: ReadonlySet<string> | DaemonClientError | undefined =
+      state.kind === 'owned' && !isProcessAlive(state.owner.pid)
+        ? await reclaimExitedOwnerAsync(paths, state.owner.pid, options)
+        : undefined;
+    if (reclaimed instanceof DaemonClientError) return reclaimed;
     const removedPaths: string[] = [];
-    if (state.kind !== 'absent' && removeIfUnchanged(paths.lockfilePath, state.raw)) {
+    if (
+      reclaimed
+        ? reclaimed.has(paths.lockfilePath)
+        : state.kind !== 'absent' && removeIfUnchanged(paths.lockfilePath, state.raw)
+    ) {
       removedPaths.push(paths.lockfilePath);
     }
-    const others: string[] = [getDaemonStartupFilePath(paths)];
-    if (process.platform !== 'win32') others.push(paths.socketPath);
-    for (const filePath of others) {
-      if (tryUnlink(filePath)) removedPaths.push(filePath);
+    const startupFilePath: string = getDaemonStartupFilePath(paths);
+    if (tryUnlink(startupFilePath)) removedPaths.push(startupFilePath);
+    if (
+      process.platform !== 'win32' &&
+      (reclaimed ? reclaimed.has(paths.socketPath) : tryUnlink(paths.socketPath))
+    ) {
+      removedPaths.push(paths.socketPath);
     }
     clearReclaimedDaemonReport(paths);
     return { removedPaths };
@@ -185,6 +216,47 @@ async function tryResetDaemonArtifactsAsync(
   }
 }
 
+/**
+ * Stops the operations that an owner that exited left running, and removes its record and socket, as the next
+ * daemon start would. Returns the files that it removed, or a (not thrown) error while another process
+ * reclaims them. Removing the record without this would strand those operations: nothing else names them.
+ */
+async function reclaimExitedOwnerAsync(
+  paths: IDaemonPaths,
+  ownerPid: number,
+  options: IDaemonReclaimOptions | undefined
+): Promise<ReadonlySet<string> | DaemonClientError> {
+  const files: string[] =
+    process.platform === 'win32' ? [paths.lockfilePath] : [paths.lockfilePath, paths.socketPath];
+  const present: string[] = files.filter((filePath) => isPresent(filePath));
+  try {
+    await reclaimStaleDaemonAsync(paths, { onOrphansReaped: options?.onOrphansReaped });
+  } catch (error) {
+    // Another process holds the reclaim lock, or a daemon started since the checks above.
+    if (
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.daemonAlreadyRunning
+    ) {
+      return new DaemonClientError(
+        'startupFailed',
+        `Another process is reclaiming the files of rushd (PID ${ownerPid}), which exited without shutting down, or a daemon is starting at ${paths.socketPath}; retry after it finishes.`,
+        { cause: error }
+      );
+    }
+    const reason: string = error instanceof Error ? error.message : String(error);
+    throw new DaemonClientError(
+      'startupFailed',
+      `rushd (PID ${ownerPid}) exited without shutting down, and stopping the operations that it left running failed, so no file was removed: ${reason}`,
+      { cause: error }
+    );
+  }
+  return new Set(present.filter((filePath) => !isPresent(filePath)));
+}
+
+function isPresent(filePath: string): boolean {
+  return fs.lstatSync(filePath, { throwIfNoEntry: false }) !== undefined;
+}
+
 /** Resolves true only when a connection attempt proves that nothing listens at the endpoint. */
 export function isEndpointUnboundAsync(socketPath: string): Promise<boolean> {
   return new Promise<boolean>((resolve) => {
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 9fb4e29369..6f3a066032 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -388,7 +388,7 @@ async function resolveReservationBeforeShutdownAsync(
   if (!lock) {
     throw new DaemonClientError(
       'startupFailed',
-      `Another client is starting the daemon for ${paths.lockfilePath}; shutdown was not sent.`
+      `Another client is starting or resetting the daemon for ${paths.lockfilePath}; shutdown was not sent.`
     );
   }
   try {
diff --git a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
new file mode 100644
index 0000000000..faa7625a5b
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
@@ -0,0 +1,204 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  tryAcquireReclaimLock,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
+import { getDaemonStartupFilePath } from '../DaemonStartup';
+import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
+import {
+  isRunning,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  startExitedProcessAsync,
+  startOrphanedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+function getDaemonPaths(runtimeDir: string): IDaemonPaths {
+  return {
+    runtimeDir,
+    socketPath: path.join(runtimeDir, 'd.sock'),
+    lockfilePath: path.join(runtimeDir, 'daemon.pid.json')
+  };
+}
+
+/** A listener that was killed without cleanup leaves a socket file that refuses connections. */
+async function leaveStaleSocketAsync(socketPath: string): Promise<void> {
+  const listener: ChildProcess = spawn(
+    process.execPath,
+    [
+      '-e',
+      `require('net').createServer().listen(${JSON.stringify(socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+    ],
+    { stdio: 'ignore' }
+  );
+  await once(listener, 'close');
+}
+
+describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutting down`, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+  let warning: jest.SpyInstance;
+  let reaps: IDaemonOrphanReap[];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+    reaps.push(reap);
+  };
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reset-'));
+    paths = getDaemonPaths(folder);
+    operationPids = [];
+    reaps = [];
+    warning = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  });
+
+  afterEach(async () => {
+    warning.mockRestore();
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  linuxIt('stops the operations that the owner left running before it removes its files', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    await leaveStaleSocketAsync(paths.socketPath);
+    recordDaemonOwner(paths, daemonPid);
+    fs.writeFileSync(getDaemonStartupFilePath(paths), 'abandoned');
+    expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+      removedPaths: [paths.lockfilePath, getDaemonStartupFilePath(paths), paths.socketPath]
+    });
+    expect(isRunning(operationPid)).toBe(false);
+    expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    expect(warning).not.toHaveBeenCalled();
+    expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({ removedPaths: [] });
+    expect(reaps).toHaveLength(1);
+  });
+
+  linuxIt(
+    'stops a recorded operation group but never one whose leader has another start time, and removes the records',
+    async () => {
+      const daemonPid: number = await startExitedProcessAsync();
+      const recorded: number = await startDetachedOperationAsync(operationPids);
+      const other: number = await startDetachedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      recordOperationGroup(paths.lockfilePath, daemonPid, recorded, readProcessStartTime(recorded));
+      // As if the daemon recorded an operation whose PID a process that started later now has.
+      const earlier: string = String(Number(readProcessStartTime(other)) - 1);
+      recordOperationGroup(paths.lockfilePath, daemonPid, other, earlier);
+      expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [paths.lockfilePath] });
+      expect(isRunning(recorded)).toBe(false);
+      expect(isRunning(other)).toBe(true);
+      // Without onOrphansReaped, each set of stopped groups is reported as a process warning.
+      expect(warning.mock.calls).toEqual([
+        [
+          `Reclaimed dead daemon ${daemonPid}: its orphaned operation process groups ${recorded} were terminated.`,
+          expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+        ]
+      ]);
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${daemonPid}`)).toBe(false);
+    }
+  );
+
+  linuxIt(
+    'waits while another process reclaims the owner, and signals and removes nothing until then',
+    async () => {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      // For example, a daemon that starts reclaims the endpoint of the owner that exited under this lock.
+      const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+      expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+      await expect(resetDaemonArtifactsAsync(paths, { onOrphansReaped })).rejects.toThrow(
+        `Another process is reclaiming the files of rushd (PID ${daemonPid})`
+      );
+      expect(isRunning(operationPid)).toBe(true);
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+      expect(reaps).toEqual([]);
+      const release: NodeJS.Timeout = setTimeout(() => fs.unlinkSync(reclaimLockPath), 300);
+      try {
+        expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped, waitTimeoutMs: 5000 })).toEqual({
+          removedPaths: [paths.lockfilePath]
+        });
+      } finally {
+        clearTimeout(release);
+      }
+      expect(isRunning(operationPid)).toBe(false);
+      expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    }
+  );
+
+  linuxIt('signals and removes nothing when it cannot reclaim the owner', async () => {
+    const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+    await leaveStaleSocketAsync(paths.socketPath);
+    recordDaemonOwner(paths, daemonPid);
+    fs.writeFileSync(getDaemonStartupFilePath(paths), 'abandoned');
+    const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+    // The reclaim trusts no record in a runtime folder that it reaches through a symbolic link.
+    const link: string = path.join(folder, 'link');
+    fs.symlinkSync(folder, link);
+    await expect(resetDaemonArtifactsAsync(getDaemonPaths(link), { onOrphansReaped })).rejects.toThrow(
+      `rushd (PID ${daemonPid}) exited without shutting down, and stopping the operations that it left ` +
+        `running failed, so no file was removed: The daemon runtime folder ${link} is unsafe`
+    );
+    expect(isRunning(operationPid)).toBe(true);
+    expect(reaps).toEqual([]);
+    expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+    expect(fs.existsSync(getDaemonStartupFilePath(paths))).toBe(true);
+    expect(fs.existsSync(paths.socketPath)).toBe(true);
+  });
+
+  linuxIt(
+    'removes a record whose PID a process that started later now has, and signals nothing',
+    async () => {
+      // It leads a process group of its own, so a signal to the group that the record names would stop it.
+      const unrelated: number = await startDetachedOperationAsync(operationPids);
+      recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+      expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([]);
+      expect(warning).not.toHaveBeenCalled();
+    }
+  );
+
+  linuxIt(
+    'says that another client may be resetting the daemon while it holds the start mutex, and signals nothing',
+    async () => {
+      const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+      recordDaemonOwner(paths, daemonPid);
+      // For example, a concurrent "daemon stop --force" that still stops what the owner left running.
+      const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(paths);
+      expect(lock).toBeDefined();
+      try {
+        await expect(resetDaemonArtifactsAsync(paths, { onOrphansReaped })).rejects.toThrow(
+          `Another client is starting or resetting the daemon for ${paths.lockfilePath}; retry after it finishes.`
+        );
+        expect(isRunning(operationPid)).toBe(true);
+        expect(reaps).toEqual([]);
+      } finally {
+        await lock!.releaseAsync();
+      }
+      expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(operationPid)).toBe(false);
+      expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/OrphanedOperation.ts b/libraries/rush-client-core/src/test/OrphanedOperation.ts
index 4d56cfc5ce..a04361d1de 100644
--- a/libraries/rush-client-core/src/test/OrphanedOperation.ts
+++ b/libraries/rush-client-core/src/test/OrphanedOperation.ts
@@ -4,6 +4,7 @@
 import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
+import * as path from 'node:path';
 import type { Readable } from 'node:stream';
 
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
@@ -58,6 +59,52 @@ export async function startOrphanedOperationAsync(
   return { daemonPid: daemon.pid!, operationPid };
 }
 
+/**
+ * Starts an operation process that leads its own process group and session, as Rush starts an operation. Its PID
+ * is added to `operationPids` first, so that {@link stopOperationIfRunning} can clean it up. POSIX only.
+ */
+export async function startDetachedOperationAsync(operationPids: number[]): Promise<number> {
+  const operation: ChildProcess = spawn(process.execPath, ['-e', OPERATION_SCRIPT], {
+    detached: true,
+    stdio: 'ignore'
+  });
+  await once(operation, 'spawn');
+  operationPids.push(operation.pid!);
+  return operation.pid!;
+}
+
+/** Starts a process and waits until it has exited and was reaped, so that its PID names no process. */
+export async function startExitedProcessAsync(): Promise<number> {
+  const child: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+  await once(child, 'exit');
+  return child.pid!;
+}
+
+// Fields after the ")" that ends the command name in /proc/<pid>/stat; starttime is field 22 of the record.
+const START_TIME_INDEX: number = 20;
+
+/** The start time that a daemon records for an operation process group (clock ticks after boot). Linux only. */
+export function readProcessStartTime(pid: number): string {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  // The command name may contain spaces and ")".
+  return stat.slice(stat.lastIndexOf(')')).split(' ')[START_TIME_INDEX];
+}
+
+/**
+ * Records the operation process group `groupId` of daemon `daemonPid` as the daemon does: an empty file named
+ * `<groupId>-<startTime>` in the folder `<lockfile>.groups-<daemonPid>`.
+ */
+export function recordOperationGroup(
+  lockfilePath: string,
+  daemonPid: number,
+  groupId: number,
+  startTime: string
+): void {
+  const folder: string = `${lockfilePath}.groups-${daemonPid}`;
+  fs.mkdirSync(folder, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(path.join(folder, `${groupId}-${startTime}`), '', { mode: 0o600 });
+}
+
 /** Writes the ownership record that a daemon with this PID would write. */
 export function recordDaemonOwner(
   paths: IDaemonPaths,
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index d3a49f61a1..6987fdcb49 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -692,7 +692,9 @@ describe('detached daemon startup', () => {
     expect(lock).toBeDefined();
     const running: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
     try {
-      await expect(requestDaemonShutdownAsync(running, paths, 300)).rejects.toThrow('shutdown was not sent');
+      await expect(requestDaemonShutdownAsync(running, paths, 300)).rejects.toThrow(
+        `Another client is starting or resetting the daemon for ${paths.lockfilePath}; shutdown was not sent.`
+      );
     } finally {
       await running.closeAsync();
       await lock!.releaseAsync();

From aabe56a5256223f5872ffcfb07aec4844f057eae Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:59 +0000
Subject: [PATCH 136/265] [rush-daemon] Return a request's freed memory to the
 OS once the daemon is idle (task 119) (and 1 more)

Swarm integration step 121; original commit 444109a938 (merge of swarm/r06-t119-int2 at 70a127628b).
Scope: task 119-int2.

Brings 119-int2 (branch swarm/r06-t119-int2). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 6 of 20. Gate: ch01 GATE OK board 4947 (tree bacafe22cb)

Commits folded into this step (2):
- fe3c8d2770 [rush-daemon] Return a request's freed memory to the OS once the daemon is idle (task 119)
- 34a30b3a0c [rush-daemon] Turn --expose-gc off again in the test of task 146 that takes gc (for task 119)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...e-garbage-collection_2026-09-29-04-15.json |  11 +
 ...warm-r06-t119-gcflag_2026-09-29-08-50.json |  11 +
 common/reviews/api/rush-daemon.api.md         |   1 +
 libraries/rush-daemon/README.md               |   8 +
 .../src/DaemonIdleGarbageCollector.ts         | 122 +++++++++
 .../src/ReducingGarbageCollection.ts          |  46 ++++
 libraries/rush-daemon/src/RushDaemonHost.ts   |  63 ++++-
 libraries/rush-daemon/src/WorkspaceWarmSet.ts |   3 +-
 libraries/rush-daemon/src/serveRushDaemon.ts  |  18 +-
 .../test/DaemonIdleGarbageCollection.test.ts  | 236 ++++++++++++++++++
 .../test/DaemonIdleGarbageCollector.test.ts   | 169 +++++++++++++
 .../test/ProductionDaemonRequestParse.test.ts |  21 +-
 .../test/ReducingGarbageCollection.test.ts    |  42 ++++
 13 files changed, 745 insertions(+), 6 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-idle-garbage-collection_2026-09-29-04-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r06-t119-gcflag_2026-09-29-08-50.json
 create mode 100644 libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
 create mode 100644 libraries/rush-daemon/src/ReducingGarbageCollection.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
 create mode 100644 libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/rushd-idle-garbage-collection_2026-09-29-04-15.json b/common/changes/@rushstack/rush-daemon/rushd-idle-garbage-collection_2026-09-29-04-15.json
new file mode 100644
index 0000000000..62c4ff12c3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-idle-garbage-collection_2026-09-29-04-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Return the memory that a request freed to the operating system once the daemon has been idle for 10 seconds, instead of keeping the resident memory of its busiest recent request.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r06-t119-gcflag_2026-09-29-08-50.json b/common/changes/@rushstack/rush-daemon/swarm-r06-t119-gcflag_2026-09-29-08-50.json
new file mode 100644
index 0000000000..02412a3584
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r06-t119-gcflag_2026-09-29-08-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Turn --expose-gc off again in a test that takes V8's gc function, so that later test files in the same jest worker get no gc global.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index b756696008..a02af92db3 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -535,6 +535,7 @@ export interface IRushDaemonHostOptions {
     readonly createWorkspaceSessionAsync?: WorkspaceSessionFactory;
     readonly daemonVersion: string;
     readonly getSuccessorLaunchAsync?: GetWorkspaceSuccessorLaunchAsync;
+    readonly idleGarbageCollectionDelayMs?: number;
     readonly idleTimeoutSeconds?: number;
     readonly onError?: (error: Error) => void;
     readonly onInteractiveConnection?: (connection: IDaemonInteractiveConnection) => void;
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index e5f19e42bd..c054b1bce1 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -25,6 +25,14 @@ the existing unlimited lifetime; invalid, nonpositive, or overflowing timeouts a
 The host's `closed` promise signals completion of shutdown, including idle shutdown, and `closeAsync()`
 reports cleanup failures. `serveRushDaemonAsync()` returns after either idle shutdown or its shutdown signal.
 
+Hosts can also set `idleGarbageCollectionDelayMs`, which `serveRushDaemonAsync()` defaults to 10 seconds for a
+daemon that owns its process. After a request, once no request has been pending for that long and the operation
+graph has no iteration scheduled or running, the host runs one full garbage collection that returns the freed heap
+pages to the operating system. It logs the resident memory and heap before and after, and how long the collection
+paused the daemon. It runs again only after another request. Collections during a request free the heap but keep
+its pages pooled for reuse. V8 returns them by itself only when its memory reducer, which checks every 8 seconds,
+finds the process idle, and after some requests it never does.
+
 Whatever starts a shutdown (a signal, a management client, the idle timeout, a lost socket, a restart or
 `closeAsync()`), the host writes one line to `onLog` when it begins, with its process ID and the reason, for example
 `rushd (PID 2750564) shutting down: received SIGTERM`; later close calls write nothing. The standalone daemon
diff --git a/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts b/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
new file mode 100644
index 0000000000..ded1d235d6
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
@@ -0,0 +1,122 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
+
+/** What one idle garbage collection returned, and how long it paused the daemon. */
+export interface IDaemonIdleGarbageCollection {
+  readonly durationMs: number;
+  readonly heapUsedBytesBefore: number;
+  readonly heapUsedBytesAfter: number;
+  readonly residentBytesBefore: number;
+  readonly residentBytesAfter: number;
+}
+
+export interface IDaemonIdleGarbageCollectorOptions {
+  /** How long no request may be pending, and no engine work running, before the collection starts. */
+  readonly delayMs: number;
+  /** Runs one full garbage collection that returns the freed heap pages to the operating system. */
+  readonly collect: () => void;
+  /** Whether engine work that no request waits for, such as an iteration that its clients left, is running. */
+  readonly isEngineBusy: () => boolean;
+  readonly onCollected: (collection: IDaemonIdleGarbageCollection) => void;
+  /**
+   * Receives the error from a collection that failed, or whose memory use could not be read. The collector then
+   * stops.
+   */
+  readonly onError: (error: Error) => void;
+}
+
+/**
+ * Runs one memory-reducing garbage collection after each request, once the daemon has been idle for a while.
+ *
+ * @remarks
+ * Full collections during a request free the heap but keep its pages pooled, so the daemon keeps the resident memory
+ * of its busiest recent request. V8's memory reducer returns the pages only when one of its checks, 8 seconds apart,
+ * finds the mutator idle, and after some requests none does. This collector runs one collection once no request has
+ * been pending for the delay and the engine is idle. It never starts one while a request is pending, and it does
+ * not start another until a request settles again.
+ */
+export class DaemonIdleGarbageCollector implements Disposable {
+  readonly #options: IDaemonIdleGarbageCollectorOptions;
+  #activeRequests: number = 0;
+  #settledSinceCollection: boolean = false;
+  #stopped: boolean = false;
+  #timer: NodeJS.Timeout | undefined;
+
+  public constructor(options: IDaemonIdleGarbageCollectorOptions) {
+    const { delayMs } = options;
+    if (!Number.isFinite(delayMs) || delayMs <= 0 || delayMs > MAX_TIMER_DELAY_MS) {
+      throw new RangeError(
+        `The idle garbage collection delay must be greater than zero and at most ${MAX_TIMER_DELAY_MS} ms.`
+      );
+    }
+    this.#options = options;
+  }
+
+  /** Counts a request as pending until the returned function is called. */
+  public acquire(): () => void {
+    this.#activeRequests++;
+    this.#clearTimer();
+    let released: boolean = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.#activeRequests--;
+      this.#settledSinceCollection = true;
+      this.#schedule();
+    };
+  }
+
+  public [Symbol.dispose](): void {
+    this.#stopped = true;
+    this.#clearTimer();
+  }
+
+  #schedule(): void {
+    this.#clearTimer();
+    if (this.#stopped || this.#activeRequests !== 0 || !this.#settledSinceCollection) return;
+    this.#timer = setTimeout(() => this.#collectWhenIdle(), this.#options.delayMs);
+    this.#timer.unref();
+  }
+
+  #clearTimer(): void {
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+  }
+
+  #collectWhenIdle(): void {
+    this.#timer = undefined;
+    if (this.#options.isEngineBusy()) {
+      // The engine is still running work that no request waits for; wait a whole delay again.
+      this.#schedule();
+      return;
+    }
+    this.#settledSinceCollection = false;
+    let collection: IDaemonIdleGarbageCollection;
+    try {
+      collection = measureCollection(this.#options.collect);
+    } catch (error) {
+      this.#stopped = true;
+      this.#options.onError(error as Error);
+      return;
+    }
+    this.#options.onCollected(collection);
+  }
+}
+
+function measureCollection(collect: () => void): IDaemonIdleGarbageCollection {
+  // Reading the resident memory can fail too, for example when the process has no file descriptor left.
+  const before: NodeJS.MemoryUsage = process.memoryUsage();
+  const startTime: number = performance.now();
+  collect();
+  const durationMs: number = performance.now() - startTime;
+  const after: NodeJS.MemoryUsage = process.memoryUsage();
+  return {
+    durationMs,
+    heapUsedBytesBefore: before.heapUsed,
+    heapUsedBytesAfter: after.heapUsed,
+    residentBytesBefore: before.rss,
+    residentBytesAfter: after.rss
+  };
+}
diff --git a/libraries/rush-daemon/src/ReducingGarbageCollection.ts b/libraries/rush-daemon/src/ReducingGarbageCollection.ts
new file mode 100644
index 0000000000..b52f9b5a89
--- /dev/null
+++ b/libraries/rush-daemon/src/ReducingGarbageCollection.ts
@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as v8 from 'node:v8';
+import * as vm from 'node:vm';
+
+interface IGarbageCollectionOptions {
+  readonly type: 'major';
+  readonly execution: 'sync';
+  readonly flavor: 'last-resort';
+}
+
+type GarbageCollectionFunction = (options: IGarbageCollectionOptions) => void;
+
+const REDUCING_GARBAGE_COLLECTION: IGarbageCollectionOptions = {
+  type: 'major',
+  execution: 'sync',
+  // V8 runs full collections that reduce the memory footprint until nothing more is freed. Only these return the
+  // freed pages to the operating system; a regular full collection keeps them pooled for reuse.
+  flavor: 'last-resort'
+};
+
+/**
+ * Returns a function that runs V8's memory-reducing full garbage collection, which returns the heap pages that it
+ * frees to the operating system.
+ *
+ * @remarks
+ * Unless the process already exposes `gc`, `--expose-gc` is set only while one new context is created, so
+ * `globalThis.gc` stays undefined and contexts that are created later get no `gc` global.
+ */
+export function getReducingGarbageCollection(): () => void {
+  let gc: unknown = (globalThis as { gc?: unknown }).gc;
+  if (typeof gc !== 'function') {
+    v8.setFlagsFromString('--expose-gc');
+    try {
+      gc = vm.runInNewContext('gc');
+    } finally {
+      v8.setFlagsFromString('--no-expose-gc');
+    }
+  }
+  if (typeof gc !== 'function') {
+    throw new Error('V8 did not provide a garbage collection function.');
+  }
+  const collect: GarbageCollectionFunction = gc as GarbageCollectionFunction;
+  return () => collect(REDUCING_GARBAGE_COLLECTION);
+}
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 25877f8796..202d72f87b 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -4,6 +4,7 @@
 import * as fs from 'node:fs';
 import { realpath } from 'node:fs/promises';
 
+import type { IOperationGraph } from '@microsoft/rush-lib';
 import { LockFile } from '@rushstack/node-core-library';
 import { connectOrStartDaemonAsync, type DaemonClient } from '@rushstack/rush-client-core';
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
@@ -17,6 +18,7 @@ import type { DaemonFileChange, DaemonFrameConnection, IDaemonPaths } from '@rus
 
 import { DaemonControlSession } from './DaemonControlSession';
 import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
+import { DaemonIdleGarbageCollector, type IDaemonIdleGarbageCollection } from './DaemonIdleGarbageCollector';
 import { DaemonIdleTimer } from './DaemonIdleTimer';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
@@ -25,11 +27,13 @@ import { DaemonShutdownDeadline } from './DaemonShutdownDeadline';
 import { DaemonShutdownDeadlineError, type DaemonShutdownStage } from './DaemonShutdownDeadlineError';
 import { DaemonShutdownError, type DaemonShutdownInitiator } from './DaemonShutdownError';
 import { DaemonSocketWatch } from './DaemonSocketWatch';
+import { getReducingGarbageCollection } from './ReducingGarbageCollection';
 import { WorkspaceSession } from './WorkspaceSession';
 import type { IWorkspaceSession, WorkspaceSessionFactory } from './WorkspaceSession';
 import { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 import { getWorkspaceStatus } from './WorkspaceStatus';
 import { WorkspaceRequestLifecycle } from './WorkspaceRequestLifecycle';
+import { isGraphBusy } from './WorkspaceWarmSet';
 import type {
   GetWorkspaceSuccessorLaunchAsync,
   IWorkspaceProcessRestartPlan,
@@ -50,6 +54,15 @@ export interface IRushDaemonHostOptions {
   readonly daemonVersion: string;
   /** Shuts down after this many seconds without pending requests. Disabled when omitted. */
   readonly idleTimeoutSeconds?: number;
+  /**
+   * After a request, once no request has been pending for this many milliseconds and the operation graph is idle,
+   * runs one full garbage collection that returns the freed heap pages to the operating system, and logs what it
+   * returned through {@link IRushDaemonHostOptions.onLog}. It runs again only after another request. Without it, the
+   * process keeps the resident memory of its busiest recent request until V8 finds it idle by itself, which after
+   * some requests doesn't happen. Disabled when omitted, except that {@link serveRushDaemonAsync} defaults it for a
+   * daemon that owns its process.
+   */
+  readonly idleGarbageCollectionDelayMs?: number;
   /**
    * How long {@link RushDaemonHost.closeAsync} waits for shutdown cleanup before it rejects with
    * {@link DaemonShutdownDeadlineError}, so that an await that ignores cancellation cannot keep the daemon from
@@ -99,6 +112,7 @@ export interface IRushDaemonHostOptions {
 export class RushDaemonHost {
   readonly #listener: DaemonFrameListener;
   readonly #idleTimer: DaemonIdleTimer;
+  readonly #idleGarbageCollector: DaemonIdleGarbageCollector | undefined;
   #socketWatch: DaemonSocketWatch | undefined;
   readonly #sessions: Set<DaemonControlSession>;
   readonly #workspaceSessionProvider: WorkspaceSessionProvider;
@@ -136,6 +150,7 @@ export class RushDaemonHost {
     requestDispatcher: DaemonRequestDispatcher,
     workspaceSessionProvider: WorkspaceSessionProvider,
     idleTimer: DaemonIdleTimer,
+    idleGarbageCollector: DaemonIdleGarbageCollector | undefined,
     options: IRushDaemonHostOptions,
     startedAt: string,
     readWorkspaceStatus: () => IDaemonWorkspaceStatus
@@ -151,6 +166,7 @@ export class RushDaemonHost {
     this.#workspaceSessionProvider = workspaceSessionProvider;
     this.#readWorkspaceStatus = readWorkspaceStatus;
     this.#idleTimer = idleTimer;
+    this.#idleGarbageCollector = idleGarbageCollector;
     this.#options = options;
     this.#startedAt = startedAt;
     this.#shutdownDeadline = new DaemonShutdownDeadline({
@@ -190,6 +206,10 @@ export class RushDaemonHost {
         rushVersion: options.rushVersion
       }
     );
+    const idleGarbageCollector: DaemonIdleGarbageCollector | undefined = createIdleGarbageCollector(
+      options,
+      workspaceSessionProvider
+    );
     const startedAtMs: number = Date.now();
     const workspaceSession: IWorkspaceSession = await workspaceSessionProvider.getSessionAsync();
     let requestLifecycle: WorkspaceRequestLifecycle | undefined;
@@ -237,7 +257,14 @@ export class RushDaemonHost {
               }
             },
             onError: (error: Error) => options.onError?.(error),
-            onRequestStarted: () => idleTimer.acquire(),
+            onRequestStarted: () => {
+              const releaseIdleTimer: () => void = idleTimer.acquire();
+              const releaseIdleGarbageCollector: (() => void) | undefined = idleGarbageCollector?.acquire();
+              return () => {
+                releaseIdleTimer();
+                releaseIdleGarbageCollector?.();
+              };
+            },
             onShutdownRequested: () => requestShutdown('controlClient'),
             getActiveRequestCount: () => {
               let count: number = 0;
@@ -279,6 +306,7 @@ export class RushDaemonHost {
       requestDispatcher,
       workspaceSessionProvider,
       idleTimer,
+      idleGarbageCollector,
       options,
       new Date(startedAtMs).toISOString(),
       readWorkspaceStatus
@@ -421,6 +449,7 @@ export class RushDaemonHost {
   async #closeOnceAsync(reason: DaemonShutdownError | undefined): Promise<void> {
     this.#logShutdown(reason);
     this.#idleTimer[Symbol.dispose]();
+    this.#idleGarbageCollector?.[Symbol.dispose]();
     this.#socketWatch?.[Symbol.dispose]();
     this.#lifecycle.closing = true;
     const errors: unknown[] = [];
@@ -511,3 +540,35 @@ function describeShutdown(
       return 'the daemon host was closed';
   }
 }
+
+const BYTES_PER_MB: number = 1024 * 1024;
+
+function createIdleGarbageCollector(
+  options: IRushDaemonHostOptions,
+  workspaceSessionProvider: WorkspaceSessionProvider
+): DaemonIdleGarbageCollector | undefined {
+  const { idleGarbageCollectionDelayMs: delayMs, onLog } = options;
+  if (delayMs === undefined) return undefined;
+  let collect: (() => void) | undefined;
+  return new DaemonIdleGarbageCollector({
+    delayMs,
+    collect: () => (collect ??= getReducingGarbageCollection())(),
+    isEngineBusy: () => {
+      const graph: IOperationGraph | undefined = workspaceSessionProvider.currentSession?.operationGraph;
+      return graph !== undefined && isGraphBusy(graph);
+    },
+    onCollected: (collection: IDaemonIdleGarbageCollection) =>
+      onLog?.(formatIdleGarbageCollection(collection)),
+    onError: (error: Error) =>
+      onLog?.(`rushd: idle garbage collection failed and is now off: ${error.message}`)
+  });
+}
+
+function formatIdleGarbageCollection(collection: IDaemonIdleGarbageCollection): string {
+  const toMB = (bytes: number): number => Math.round(bytes / BYTES_PER_MB);
+  return (
+    `rushd: idle garbage collection: resident memory ${toMB(collection.residentBytesBefore)} MB -> ` +
+    `${toMB(collection.residentBytesAfter)} MB, heap ${toMB(collection.heapUsedBytesBefore)} MB -> ` +
+    `${toMB(collection.heapUsedBytesAfter)} MB, paused ${Math.round(collection.durationMs)} ms`
+  );
+}
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 6f1bfd9527..5ad9ac88c7 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -563,7 +563,8 @@ function hasEnabledConsumer(operation: Operation): boolean {
   return false;
 }
 
-function isGraphBusy(graph: IOperationGraph): boolean {
+/** Whether the graph has an iteration scheduled or running, or is closing. */
+export function isGraphBusy(graph: IOperationGraph): boolean {
   return (
     graph.hasScheduledIteration ||
     graph.status === OperationStatus.Executing ||
diff --git a/libraries/rush-daemon/src/serveRushDaemon.ts b/libraries/rush-daemon/src/serveRushDaemon.ts
index bc3e2d4781..f7baceaa7f 100644
--- a/libraries/rush-daemon/src/serveRushDaemon.ts
+++ b/libraries/rush-daemon/src/serveRushDaemon.ts
@@ -21,7 +21,8 @@ export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
   readonly onReady?: (host: RushDaemonHost) => void | Promise<void>;
   /**
    * Requests a clean shutdown. When omitted, the daemon owns its process: the first SIGINT or SIGTERM requests a
-   * clean shutdown, and {@link IRushDaemonHostOptions.shutdownDeadlineMs} defaults to 10 seconds. If the shutdown
+   * clean shutdown, {@link IRushDaemonHostOptions.shutdownDeadlineMs} defaults to 10 seconds and
+   * {@link IRushDaemonHostOptions.idleGarbageCollectionDelayMs} defaults to 10 seconds. If the shutdown
    * does not finish by then, or another signal arrives first, the daemon reports why, releases what it safely can
    * and exits the process with code 1. Once it stops, if something else keeps the process running for 2 seconds,
    * it writes its PID, when it stopped and the active resources that Node.js lists to the daemon log
@@ -37,6 +38,14 @@ export interface IRushDaemonServeOptions extends IRushDaemonHostOptions {
  */
 export const DEFAULT_SHUTDOWN_DEADLINE_MS: number = 10000;
 
+/**
+ * How long a daemon that owns its process waits after a request, with no request pending and its operation graph
+ * idle, before it returns the heap pages that the request freed to the operating system. V8's memory reducer checks
+ * whether the process is idle every 8 seconds; after requests in a large workspace, it returned them only 12 to 17
+ * seconds after the request, or not at all.
+ */
+export const DEFAULT_IDLE_GARBAGE_COLLECTION_DELAY_MS: number = 10000;
+
 /**
  * How long a daemon that owns its process waits, after it stops serving, for the process to end by itself before it
  * exits anyway. By then it has released its socket and lockfile, so `daemon status` and `daemon stop` can no longer
@@ -70,7 +79,12 @@ export async function serveRushDaemonAsync(options: IRushDaemonServeOptions): Pr
   });
   try {
     await serveUntilClosedAsync(
-      { ...options, shutdownDeadlineMs: options.shutdownDeadlineMs ?? DEFAULT_SHUTDOWN_DEADLINE_MS },
+      {
+        ...options,
+        shutdownDeadlineMs: options.shutdownDeadlineMs ?? DEFAULT_SHUTDOWN_DEADLINE_MS,
+        idleGarbageCollectionDelayMs:
+          options.idleGarbageCollectionDelayMs ?? DEFAULT_IDLE_GARBAGE_COLLECTION_DELAY_MS
+      },
       signalRegistration,
       (startedHost: RushDaemonHost) => (host = startedHost)
     );
diff --git a/libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts
new file mode 100644
index 0000000000..ec478098ea
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollection.test.ts
@@ -0,0 +1,236 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../ReducingGarbageCollection', () => ({ getReducingGarbageCollection: jest.fn() }));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { OperationStatus, type IOperationGraph } from '@microsoft/rush-lib';
+
+import type { GlobalCommandExecutor } from '../GlobalCommandRequestRouter';
+import { getReducingGarbageCollection } from '../ReducingGarbageCollection';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { serveRushDaemonAsync } from '../serveRushDaemon';
+import {
+  CallbackDaemonRequestResolver,
+  createDeferred,
+  createWireEnvelope,
+  DaemonRequestWireClient,
+  type IDeferred
+} from './DaemonRequestWireTestUtilities';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+const DELAY_MS: number = 10000;
+const COLLECTION_LOG: RegExp =
+  /^rushd: idle garbage collection: resident memory \d+ MB -> \d+ MB, heap \d+ MB -> \d+ MB, paused \d+ ms$/;
+
+class GraphWorkspaceSession extends TestWorkspaceSession {
+  public override operationGraph: IOperationGraph | undefined = undefined;
+}
+
+interface IBusyGraph {
+  hasScheduledIteration: boolean;
+  readonly status: OperationStatus;
+  readonly abortController: AbortController;
+}
+
+/** Lets the daemon finish a request that its client has already seen end, with real I/O and immediates. */
+async function settleAsync(): Promise<void> {
+  for (let i: number = 0; i < 20; i++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+describe('daemon idle garbage collection', () => {
+  let repoRoot: string;
+  let collect: jest.Mock;
+  let logs: string[];
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-idle-gc-'));
+    jest.useFakeTimers({ doNotFake: ['nextTick', 'setImmediate'] });
+    collect = jest.fn();
+    jest.mocked(getReducingGarbageCollection).mockReset().mockReturnValue(collect);
+    logs = [];
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  function createOptions(
+    executorAsync: GlobalCommandExecutor = () => Promise.resolve({ exitCode: 0 }),
+    session: TestWorkspaceSession = new TestWorkspaceSession(repoRoot)
+  ): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(session),
+      daemonVersion: 'idle-gc-test',
+      idleGarbageCollectionDelayMs: DELAY_MS,
+      onLog: (message: string) => logs.push(message),
+      repoRoot,
+      requestResolver: new CallbackDaemonRequestResolver(async () => ({
+        kind: 'global',
+        executor: executorAsync
+      })),
+      rushVersion: '5.178.1'
+    };
+  }
+
+  async function connectAsync(host: RushDaemonHost): Promise<DaemonRequestWireClient> {
+    const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+    await client.handshakeAsync();
+    return client;
+  }
+
+  async function startRequestAsync(client: DaemonRequestWireClient, requestId: string): Promise<void> {
+    await client.sendControlAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope(requestId, 'custom', repoRoot)
+    });
+  }
+
+  async function runRequestAsync(client: DaemonRequestWireClient, requestId: string): Promise<void> {
+    await startRequestAsync(client, requestId);
+    expect((await client.readTerminalAsync(requestId)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    await settleAsync();
+  }
+
+  it('collects once after a request, logs what it returned, and waits for the next request', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).not.toHaveBeenCalled();
+      await runRequestAsync(client, 'first');
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+      expect(logs.filter((message: string) => COLLECTION_LOG.test(message))).toHaveLength(1);
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+      await runRequestAsync(client, 'second');
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(2);
+      expect(getReducingGarbageCollection).toHaveBeenCalledTimes(1);
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('does not collect while a request is pending', async () => {
+    const executing: IDeferred<void> = createDeferred<void>();
+    const executed: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(
+      createOptions(async () => {
+        executing.resolve();
+        await executed.promise;
+        return { exitCode: 0 };
+      })
+    );
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await startRequestAsync(client, 'pending');
+      await executing.promise;
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).not.toHaveBeenCalled();
+      executed.resolve();
+      await client.readTerminalAsync('pending');
+      await settleAsync();
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+    } finally {
+      executed.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('waits while the operation graph is busy after its requests ended', async () => {
+    const session: GraphWorkspaceSession = new GraphWorkspaceSession(repoRoot);
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions(undefined, session));
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'left-iteration');
+      const graph: IBusyGraph = {
+        hasScheduledIteration: true,
+        status: OperationStatus.Ready,
+        abortController: new AbortController()
+      };
+      session.operationGraph = graph as unknown as IOperationGraph;
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(collect).not.toHaveBeenCalled();
+      graph.hasScheduledIteration = false;
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      expect(collect).toHaveBeenCalledTimes(1);
+    } finally {
+      session.operationGraph = undefined;
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('logs a failed collection once and stops collecting', async () => {
+    jest.mocked(getReducingGarbageCollection).mockImplementation(() => {
+      throw new Error('no gc here');
+    });
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'first');
+      await jest.advanceTimersByTimeAsync(DELAY_MS);
+      await runRequestAsync(client, 'second');
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(getReducingGarbageCollection).toHaveBeenCalledTimes(1);
+      expect(logs.filter((message: string) => message.startsWith('rushd: idle garbage collection'))).toEqual([
+        'rushd: idle garbage collection failed and is now off: no gc here'
+      ]);
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('does not collect once the host closes', async () => {
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions());
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'first');
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+    await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+  });
+
+  it('is off for a daemon that does not own its process unless the delay is set', async () => {
+    const shutdown: AbortController = new AbortController();
+    const ready: IDeferred<RushDaemonHost> = createDeferred<RushDaemonHost>();
+    const serving: Promise<void> = serveRushDaemonAsync({
+      ...createOptions(),
+      idleGarbageCollectionDelayMs: undefined,
+      onReady: (host: RushDaemonHost) => ready.resolve(host),
+      shutdownSignal: shutdown.signal
+    });
+    const host: RushDaemonHost = await ready.promise;
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await runRequestAsync(client, 'first');
+      await jest.advanceTimersByTimeAsync(10 * DELAY_MS);
+      expect(getReducingGarbageCollection).not.toHaveBeenCalled();
+      expect(collect).not.toHaveBeenCalled();
+    } finally {
+      await client.closeAsync();
+      shutdown.abort();
+      await serving;
+      await host.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
new file mode 100644
index 0000000000..51db354841
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
@@ -0,0 +1,169 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DaemonIdleGarbageCollector,
+  type IDaemonIdleGarbageCollection,
+  type IDaemonIdleGarbageCollectorOptions
+} from '../DaemonIdleGarbageCollector';
+
+const DELAY_MS: number = 10000;
+
+describe(DaemonIdleGarbageCollector.name, () => {
+  let collect: jest.Mock;
+  let onCollected: jest.Mock;
+  let onError: jest.Mock;
+  let engineBusy: boolean;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    collect = jest.fn();
+    onCollected = jest.fn();
+    onError = jest.fn();
+    engineBusy = false;
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    jest.useRealTimers();
+  });
+
+  function createCollector(
+    options?: Partial<IDaemonIdleGarbageCollectorOptions>
+  ): DaemonIdleGarbageCollector {
+    return new DaemonIdleGarbageCollector({
+      delayMs: DELAY_MS,
+      collect,
+      isEngineBusy: () => engineBusy,
+      onCollected,
+      onError,
+      ...options
+    });
+  }
+
+  it('does not collect before the first request settles', () => {
+    createCollector();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+  });
+
+  it('collects once, a full delay after the last pending request settles, and never while one is pending', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    const releaseFirst: () => void = collector.acquire();
+    const releaseSecond: () => void = collector.acquire();
+    releaseFirst();
+    releaseFirst();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+    releaseSecond();
+    jest.advanceTimersByTime(DELAY_MS - 1);
+    expect(collect).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(collect).toHaveBeenCalledTimes(1);
+    jest.advanceTimersByTime(100 * DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+  });
+
+  it('collects again only after another request settles', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+    const release: () => void = collector.acquire();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+    release();
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(2);
+  });
+
+  it('gives a request that starts during the delay a full delay after it settles', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS - 1);
+    const release: () => void = collector.acquire();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+    release();
+    jest.advanceTimersByTime(DELAY_MS - 1);
+    expect(collect).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(collect).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits a full delay again while the engine is busy without a request', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    engineBusy = true;
+    collector.acquire()();
+    jest.advanceTimersByTime(3 * DELAY_MS);
+    expect(collect).not.toHaveBeenCalled();
+    engineBusy = false;
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+  });
+
+  it('reports the memory before and after the collection and the time it took', () => {
+    jest
+      .spyOn(process, 'memoryUsage')
+      .mockReturnValueOnce({ rss: 1800, heapTotal: 1500, heapUsed: 1300, external: 0, arrayBuffers: 0 })
+      .mockReturnValueOnce({ rss: 600, heapTotal: 500, heapUsed: 440, external: 0, arrayBuffers: 0 });
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    expect(onCollected).toHaveBeenCalledTimes(1);
+    const collection: IDaemonIdleGarbageCollection = onCollected.mock.calls[0][0];
+    expect(collection).toMatchObject({
+      heapUsedBytesBefore: 1300,
+      heapUsedBytesAfter: 440,
+      residentBytesBefore: 1800,
+      residentBytesAfter: 600
+    });
+    expect(collection.durationMs).toBeGreaterThanOrEqual(0);
+  });
+
+  it('reports a failed collection once and stops', () => {
+    const error: Error = new Error('no gc');
+    collect.mockImplementation(() => {
+      throw error;
+    });
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    collector.acquire()();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(collect).toHaveBeenCalledTimes(1);
+    expect(onError).toHaveBeenCalledTimes(1);
+    expect(onError).toHaveBeenCalledWith(error);
+    expect(onCollected).not.toHaveBeenCalled();
+  });
+
+  it('reports a failure to read the memory use once and stops', () => {
+    const error: Error = new Error('EMFILE: too many open files, uv_resident_set_memory');
+    jest.spyOn(process, 'memoryUsage').mockImplementation(() => {
+      throw error;
+    });
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    jest.advanceTimersByTime(DELAY_MS);
+    collector.acquire()();
+    jest.advanceTimersByTime(10 * DELAY_MS);
+    expect(onError).toHaveBeenCalledTimes(1);
+    expect(onError).toHaveBeenCalledWith(error);
+    expect(collect).not.toHaveBeenCalled();
+    expect(onCollected).not.toHaveBeenCalled();
+  });
+
+  it('does not collect after it is disposed', () => {
+    const collector: DaemonIdleGarbageCollector = createCollector();
+    collector.acquire()();
+    const release: () => void = collector.acquire();
+    collector[Symbol.dispose]();
+    release();
+    jest.runAllTimers();
+    expect(collect).not.toHaveBeenCalled();
+  });
+
+  it.each([0, -1, NaN, Infinity, 2147483648])('rejects the delay %s', (delayMs: number) => {
+    expect(() => createCollector({ delayMs })).toThrow(RangeError);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
index 65fa44b3c0..4bba9bcaf6 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
@@ -48,6 +48,24 @@ async function checkIdentityAsync(
   await resolver.getCommandParameterIdentityAsync(createOptions(session));
 }
 
+/**
+ * Returns V8's garbage collection function. Unless the process already exposes `gc`, `--expose-gc` is turned off
+ * again once one context has it, because every context that is created while it is on gets a `gc` global: that
+ * includes the one that jest creates for the next test file in this worker.
+ */
+function getGarbageCollection(): () => void {
+  const exposed: unknown = (globalThis as { gc?: unknown }).gc;
+  if (typeof exposed === 'function') {
+    return exposed as () => void;
+  }
+  v8.setFlagsFromString('--expose-gc');
+  try {
+    return vm.runInNewContext('gc');
+  } finally {
+    v8.setFlagsFromString('--no-expose-gc');
+  }
+}
+
 /** The workspace lifecycle resolves a request with a copy of the envelope of its identity check. */
 function dispatched(options: IResolveDaemonRequestOptions): IResolveDaemonRequestOptions {
   return { ...options, envelope: { ...options.envelope, admission: { waitTimeoutMs: 1000 } } };
@@ -181,8 +199,7 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
   });
 
   it('keeps the parse of an identity check only as long as its request', async () => {
-    v8.setFlagsFromString('--expose-gc');
-    const collectGarbage: () => void = vm.runInNewContext('gc');
+    const collectGarbage: () => void = getGarbageCollection();
     const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
     await checkIdentityAsync(resolver, createSession());
     parse.mockClear();
diff --git a/libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts b/libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts
new file mode 100644
index 0000000000..cb4e770822
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ReducingGarbageCollection.test.ts
@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { constants, PerformanceObserver, type PerformanceEntry } from 'node:perf_hooks';
+import * as vm from 'node:vm';
+
+import { getReducingGarbageCollection } from '../ReducingGarbageCollection';
+
+interface IGarbageCollectionDetail {
+  readonly kind: number;
+}
+
+async function countMajorCollectionsAsync(action: () => void): Promise<number> {
+  const entries: PerformanceEntry[] = [];
+  const observer: PerformanceObserver = new PerformanceObserver((list) => entries.push(...list.getEntries()));
+  observer.observe({ entryTypes: ['gc'] });
+  try {
+    action();
+    // Node.js reports collections to observers asynchronously.
+    await new Promise<void>((resolve) => setTimeout(resolve, 100));
+  } finally {
+    observer.disconnect();
+  }
+  return entries.filter(
+    (entry: PerformanceEntry) =>
+      (entry.detail as IGarbageCollectionDetail | undefined)?.kind === constants.NODE_PERFORMANCE_GC_MAJOR
+  ).length;
+}
+
+describe(getReducingGarbageCollection.name, () => {
+  it('runs full collections until nothing more is freed', async () => {
+    const collect: () => void = getReducingGarbageCollection();
+    // A regular full collection runs once; the memory-reducing one repeats at least once more.
+    expect(await countMajorCollectionsAsync(collect)).toBeGreaterThanOrEqual(2);
+  });
+
+  it('does not expose gc to scripts', () => {
+    getReducingGarbageCollection()();
+    expect((globalThis as { gc?: unknown }).gc).toBeUndefined();
+    expect(vm.runInNewContext('typeof gc')).toBe('undefined');
+  });
+});

From d462a1e3d2ed87adb771adcedf97e007983df25a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:59 +0000
Subject: [PATCH 137/265] [rush-daemon] Keep test fixture commits from starting
 Git maintenance

Swarm integration step 122; original commit 169911c461 (merge of swarm/m03-t229 at 031c68b106).
Scope: task 229.

Brings 229 (branch swarm/m03-t229). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 7 of 20. Gate: ch01 GATE OK board 4947 (tree 2bea4a2199)

Commits folded into this step (1):
- 031c68b106 Keep test fixture commits from starting Git maintenance

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../rush-cli-client/src/test/NativeBuildTestFixture.ts |  3 +++
 .../src/test/PersistentIpcTestFixture.ts               |  3 +++
 .../m03-t229-fixture-maintenance_2026-09-29-08-44.json | 10 ++++++++++
 .../m03-t229-fixture-maintenance_2026-09-29-08-44.json | 10 ++++++++++
 .../rush-daemon/src/test/DaemonGraphTestFixture.ts     |  3 +++
 .../rush-daemon/src/test/NativeEngineTestFixture.ts    |  3 +++
 .../rush-daemon/src/test/SuccessfulMutationFixture.ts  |  3 +++
 7 files changed, 35 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/m03-t229-fixture-maintenance_2026-09-29-08-44.json
 create mode 100644 common/changes/@rushstack/rush-daemon/m03-t229-fixture-maintenance_2026-09-29-08-44.json

diff --git a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
index 659e65647a..7a7fc52242 100644
--- a/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
+++ b/apps/rush-cli-client/src/test/NativeBuildTestFixture.ts
@@ -112,6 +112,9 @@ export function createNativeBuildTestFixture(): INativeBuildTestFixture {
   execFileSync(
     'git',
     [
+      // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+      '-c',
+      'maintenance.auto=false',
       '-c',
       'user.name=Client Test',
       '-c',
diff --git a/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts b/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts
index 470c0160e3..e9d3d9672a 100644
--- a/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts
+++ b/apps/rush-cli-client/src/test/PersistentIpcTestFixture.ts
@@ -156,6 +156,9 @@ export function createPersistentIpcTestFixture(
   execFileSync(
     'git',
     [
+      // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+      '-c',
+      'maintenance.auto=false',
       '-c',
       'user.name=IPC Test',
       '-c',
diff --git a/common/changes/@rushstack/rush-cli-client/m03-t229-fixture-maintenance_2026-09-29-08-44.json b/common/changes/@rushstack/rush-cli-client/m03-t229-fixture-maintenance_2026-09-29-08-44.json
new file mode 100644
index 0000000000..fd9f3b8857
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/m03-t229-fixture-maintenance_2026-09-29-08-44.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Disable automatic Git maintenance for test fixture commits, so that a detached repack can't write into .git while a test removes the fixture.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}
diff --git a/common/changes/@rushstack/rush-daemon/m03-t229-fixture-maintenance_2026-09-29-08-44.json b/common/changes/@rushstack/rush-daemon/m03-t229-fixture-maintenance_2026-09-29-08-44.json
new file mode 100644
index 0000000000..aab5700305
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/m03-t229-fixture-maintenance_2026-09-29-08-44.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Disable automatic Git maintenance for test fixture commits, so that a detached repack can't write into .git while a test removes the fixture.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index bd78e3072a..8fd10c52dc 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -121,6 +121,9 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
       execFileSync(
         'git',
         [
+          // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+          '-c',
+          'maintenance.auto=false',
           '-c',
           'user.name=Graph Test',
           '-c',
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
index 5013e5cfdd..b8e0dccbf8 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -258,6 +258,9 @@ if (input === 'failure') process.exitCode = 7;
   execFileSync(
     'git',
     [
+      // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+      '-c',
+      'maintenance.auto=false',
       '-c',
       'user.name=Engine Test',
       '-c',
diff --git a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
index c6a00d72b3..eb273476cf 100644
--- a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
+++ b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
@@ -288,6 +288,9 @@ if (fs.existsSync(controlFile)) {
     execFileSync(
       'git',
       [
+        // Don't start a detached `git maintenance` that could still be writing into .git during cleanup
+        '-c',
+        'maintenance.auto=false',
         '-c',
         'user.name=Mutation Test',
         '-c',

From 847f530354af3f41c35c8538639f6d874fa2259c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:59 +0000
Subject: [PATCH 138/265] [heft] Rename the heft change file for the watcher
 fix

Swarm integration step 123; original commit a1c750a5a0 (merge of swarm/r03-t202-nit1 at f5145b5c84).
Scope: task 202-nit1.

Brings 202-nit1 (branch swarm/r03-t202-nit1). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 8 of 20. Gate: ch01 GATE OK board 4947 (tree 72f55c8f4d)

Commits folded into this step (2):
- 91f764e711 [heft] Close the previous watcher when a watch-mode run starts
- f5145b5c84 Rename the heft change file for the watcher fix

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/utilities/WatchFileSystemAdapter.ts   |  17 +-
 .../test/WatchFileSystemAdapter.test.ts       | 233 ++++++++++++++++++
 ...ose-previous-watcher_2026-09-29-08-00.json |  11 +
 3 files changed, 257 insertions(+), 4 deletions(-)
 create mode 100644 apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
 create mode 100644 common/changes/@rushstack/heft/heft-watch-close-previous-watcher_2026-09-29-08-00.json

diff --git a/apps/heft/src/utilities/WatchFileSystemAdapter.ts b/apps/heft/src/utilities/WatchFileSystemAdapter.ts
index cc886e24a2..9ac3f2df59 100644
--- a/apps/heft/src/utilities/WatchFileSystemAdapter.ts
+++ b/apps/heft/src/utilities/WatchFileSystemAdapter.ts
@@ -261,11 +261,20 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
   public setBaseline(): void {
     this.#lastQueryTime = Date.now();
 
-    if (this.#watcher) {
-      const times: Map<string, { timestamp: number; safeTime: number }> = new Map();
-      this.#watcher.pause();
-      this.#watcher.collectTimeInfoEntries(times, times);
+    const watcher: Watchpack | undefined = this.#watcher;
+    if (watcher) {
+      this.#watcher = undefined;
+      const times: Map<string, ITimeEntry> = new Map();
+      watcher.collectTimeInfoEntries(times, times);
+      // Close the previous watcher instead of only pausing it. A paused watcher keeps its directory watchers,
+      // so every run would leak another set of them. A kept watcher also keeps its OS watch on a folder that
+      // was deleted and recreated, and later watchers on that folder would share the dead watch, so edits in
+      // the recreated folder would be reported one run late.
+      watcher.close();
       this.#times = times;
+    } else {
+      // Nothing is watching, so times collected for an earlier run may be out of date.
+      this.#times = undefined;
     }
   }
 
diff --git a/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
new file mode 100644
index 0000000000..b33befa908
--- /dev/null
+++ b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
@@ -0,0 +1,233 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import Watchpack from 'watchpack';
+
+import { Async } from '@rushstack/node-core-library';
+
+import { watchGlobAsync } from '../../plugins/FileGlobSpecifier';
+import { type IWatchedFileState, WatchFileSystemAdapter } from '../WatchFileSystemAdapter';
+
+const RUN_REQUEST_TIMEOUT_MS: number = 5000;
+// Long enough for a watcher to finish its first scan, and for events to arrive
+const SETTLE_MS: number = 250;
+const TEST_TIMEOUT_MS: number = 30000;
+// An hour ago, plus some milliseconds so that watchpack sees the file system's timestamps are precise. Files get
+// old mtimes so that a new watcher doesn't report a file as changed just because it was written right before
+// the watcher started.
+const BASE_MTIME_MS: number = Math.floor(Date.now() / 1000) * 1000 - 3600 * 1000 + 123;
+
+interface IRunOptions {
+  watch?: boolean;
+  beforeWatch?: () => void;
+}
+
+interface IRun {
+  changed: string[];
+  isRunRequested(): boolean;
+  waitForRunRequestAsync(): Promise<boolean>;
+}
+
+describe(WatchFileSystemAdapter.name, () => {
+  let rootFolder: string;
+  let writeCount: number;
+  let adapter: WatchFileSystemAdapter;
+  let watchSpy: jest.SpyInstance;
+  let collectSpy: jest.SpyInstance;
+  let closeSpy: jest.SpyInstance;
+
+  function writeFile(relativePath: string, mtimeMs?: number): void {
+    const filePath: string = path.join(rootFolder, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    writeCount++;
+    fs.writeFileSync(filePath, `export const value: number = ${writeCount};\n`);
+    const mtime: Date = new Date(mtimeMs ?? BASE_MTIME_MS + writeCount * 1000);
+    fs.utimesSync(filePath, mtime, mtime);
+  }
+
+  // Drives the adapter the way TaskOperationRunner does in watch mode
+  async function runAsync(options: IRunOptions = {}): Promise<IRun> {
+    const { watch = true, beforeWatch } = options;
+    adapter.setBaseline();
+    const states: Map<string, IWatchedFileState> = await watchGlobAsync('src/**/*.ts', {
+      cwd: rootFolder,
+      fs: adapter
+    });
+    const changed: string[] = [];
+    for (const [file, state] of states) {
+      if (state.changed) {
+        changed.push(file);
+      }
+    }
+    changed.sort();
+
+    beforeWatch?.();
+
+    let requested: boolean = false;
+    let onRequest: (() => void) | undefined;
+    if (watch) {
+      adapter.watch(() => {
+        requested = true;
+        onRequest?.();
+      });
+    }
+
+    return {
+      changed,
+      isRunRequested: () => requested,
+      waitForRunRequestAsync: () =>
+        new Promise<boolean>((resolve: (value: boolean) => void) => {
+          if (requested) {
+            resolve(true);
+            return;
+          }
+          const timeout: NodeJS.Timeout = setTimeout(() => resolve(false), RUN_REQUEST_TIMEOUT_MS);
+          onRequest = () => {
+            clearTimeout(timeout);
+            resolve(true);
+          };
+        })
+    };
+  }
+
+  // The first run's watcher may request a run just because the folders are new, so tests only use it to start
+  async function startAsync(): Promise<void> {
+    writeFile('src/a.ts');
+    writeFile('src/sub/b.ts');
+    const run: IRun = await runAsync();
+    expect(run.changed).toEqual(['src/a.ts', 'src/sub/b.ts']);
+    await Async.sleepAsync(SETTLE_MS);
+  }
+
+  beforeEach(() => {
+    rootFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-watch-fs-'));
+    writeCount = 0;
+    watchSpy = jest.spyOn(Watchpack.prototype, 'watch');
+    collectSpy = jest.spyOn(Watchpack.prototype, 'collectTimeInfoEntries');
+    closeSpy = jest.spyOn(Watchpack.prototype, 'close');
+    adapter = new WatchFileSystemAdapter();
+  });
+
+  afterEach(() => {
+    for (const watcher of watchSpy.mock.contexts) {
+      (watcher as Watchpack).close();
+    }
+    jest.restoreAllMocks();
+    fs.rmSync(rootFolder, { recursive: true, force: true });
+  });
+
+  it(
+    'requests a run when a watched file changes, and reports the file in that run',
+    async () => {
+      await startAsync();
+
+      const run2: IRun = await runAsync();
+      expect(run2.changed).toEqual([]);
+      await Async.sleepAsync(SETTLE_MS);
+      expect(run2.isRunRequested()).toBe(false);
+
+      writeFile('src/sub/b.ts');
+      expect(await run2.waitForRunRequestAsync()).toBe(true);
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests another run for a file that changes while a run is in progress',
+    async () => {
+      await startAsync();
+
+      // The file changes after the glob has read it, and before the run starts watching
+      const run2: IRun = await runAsync({
+        beforeWatch: () => writeFile('src/sub/b.ts', Date.now())
+      });
+      expect(run2.changed).toEqual([]);
+      expect(await run2.waitForRunRequestAsync()).toBe(true);
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'closes the previous watcher, after collecting its times, when the next run starts',
+    async () => {
+      writeFile('src/a.ts');
+      await runAsync();
+      expect(watchSpy).toHaveBeenCalledTimes(1);
+      const watcher1: Watchpack = watchSpy.mock.contexts[0];
+      expect(closeSpy).not.toHaveBeenCalled();
+
+      await runAsync();
+      expect(watchSpy).toHaveBeenCalledTimes(2);
+      const watcher2: Watchpack = watchSpy.mock.contexts[1];
+      expect(watcher2).not.toBe(watcher1);
+      expect(collectSpy).toHaveBeenCalledTimes(1);
+      expect(collectSpy.mock.contexts[0]).toBe(watcher1);
+      expect(closeSpy).toHaveBeenCalledTimes(1);
+      expect(closeSpy.mock.contexts[0]).toBe(watcher1);
+      expect(collectSpy.mock.invocationCallOrder[0]).toBeLessThan(closeSpy.mock.invocationCallOrder[0]);
+
+      await runAsync();
+      expect(closeSpy).toHaveBeenCalledTimes(2);
+      expect(closeSpy.mock.contexts[1]).toBe(watcher2);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'reports a file that changed after a run that did not start watching',
+    async () => {
+      await startAsync();
+
+      // Like a run in which copying files fails, so that TaskOperationRunner never calls watch()
+      const run2: IRun = await runAsync({ watch: false });
+      expect(run2.changed).toEqual([]);
+
+      writeFile('src/sub/b.ts');
+      await Async.sleepAsync(SETTLE_MS);
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  // On Linux, a watch stays on the deleted folder. Windows doesn't let a watched folder be recreated.
+  (process.platform === 'linux' ? it : it.skip)(
+    'reports a change in a folder that was deleted and recreated, in the run after the change',
+    async () => {
+      await startAsync();
+
+      const run2: IRun = await runAsync();
+      expect(run2.changed).toEqual([]);
+      await Async.sleepAsync(SETTLE_MS);
+
+      // Delete and recreate the folder, as switching branches can
+      fs.rmSync(path.join(rootFolder, 'src/sub'), { recursive: true });
+      writeFile('src/sub/b.ts');
+      expect(await run2.waitForRunRequestAsync()).toBe(true);
+      await Async.sleepAsync(SETTLE_MS);
+
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      await Async.sleepAsync(SETTLE_MS);
+      expect(run3.isRunRequested()).toBe(false);
+
+      writeFile('src/sub/b.ts');
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+      const run4: IRun = await runAsync();
+      expect(run4.changed).toEqual(['src/sub/b.ts']);
+      await Async.sleepAsync(SETTLE_MS);
+
+      const run5: IRun = await runAsync();
+      expect(run5.changed).toEqual([]);
+    },
+    TEST_TIMEOUT_MS
+  );
+});
diff --git a/common/changes/@rushstack/heft/heft-watch-close-previous-watcher_2026-09-29-08-00.json b/common/changes/@rushstack/heft/heft-watch-close-previous-watcher_2026-09-29-08-00.json
new file mode 100644
index 0000000000..8c4d35ff29
--- /dev/null
+++ b/common/changes/@rushstack/heft/heft-watch-close-previous-watcher_2026-09-29-08-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft",
+      "comment": "Fix an issue in watch mode where each run left the previous run's file watcher open, so memory use grew with every run, and a later edit in a folder that was deleted and recreated didn't start a run and was only reported one run late.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft",
+  "email": "selarkin@microsoft.com"
+}

From 3d6848d7171afbea93d774779491a329cdc3406f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:59 +0000
Subject: [PATCH 139/265] [rush-lib] Test that the incremental guard skips
 files Git ignores

Swarm integration step 124; original commit a711e0cd22.

Brings 190-nit1 (no branch in the shared repo, merged by hash). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 9 of 20. Gate: ch01 GATE OK board 4947 (tree 2ad2121399)

Commits folded into this step (2):
- c7eb2ac872 Check whether input files change while an operation runs, cache or not
- 99d972ceef [rush-lib] Test that the incremental guard skips files Git ignores

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...al-guard-input-files_2026-09-29-08-46.json |  11 +
 .../operations/CacheableOperationPlugin.ts    |  40 +--
 .../IncrementalExecutionGuardPlugin.ts        | 138 ++++++++-
 .../operations/InputFilesStatSignature.ts     |  31 ++
 .../src/logic/operations/LegacySkipPlugin.ts  |  14 +-
 .../operations/RetainedResultVerification.ts  |  20 ++
 .../test/CacheableOperationPlugin.test.ts     |  30 +-
 .../IncrementalExecutionGuardPlugin.test.ts   | 286 +++++++++++++++++-
 8 files changed, 522 insertions(+), 48 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/incremental-guard-input-files_2026-09-29-08-46.json

diff --git a/common/changes/@microsoft/rush/incremental-guard-input-files_2026-09-29-08-46.json b/common/changes/@microsoft/rush/incremental-guard-input-files_2026-09-29-08-46.json
new file mode 100644
index 0000000000..c0b9707deb
--- /dev/null
+++ b/common/changes/@microsoft/rush/incremental-guard-input-files_2026-09-29-08-46.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "With `daemon.incrementalBuilds`, the Rush daemon checks whether the input files of an operation that succeeded changed after the inputs snapshot of the build was taken, e.g. because an editor saved a file while the operation ran, whether or not the build cache is enabled. Before, only the build cache checked this, and only for the operations whose results it can write. If a file was edited, added, deleted or replaced while the operation ran, or saved while the snapshot was taken, a later build runs the operation again with its initial script instead of skipping it or building on its outputs incrementally, and its package-deps file is not written.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 81175c57af..bbe7bfbef5 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -5,7 +5,6 @@ import * as crypto from 'node:crypto';
 import * as path from 'node:path';
 
 import { InternalError, NewlineKind, Sort, Executable } from '@rushstack/node-core-library';
-import { hashFilesAsync } from '@rushstack/package-deps-hash';
 import { CollatedTerminal, type CollatedWriter } from '@rushstack/stream-collator';
 import {
   DiscardStdoutTransform,
@@ -33,6 +32,7 @@ import { PeriodicCallback } from './PeriodicCallback';
 import {
   captureInputFilesState,
   haveInputFilesChanged,
+  haveSnapshotHashesChangedAsync,
   hasUntrackedGitFiles,
   type IInputFilesState
 } from './InputFilesStatSignature';
@@ -50,7 +50,11 @@ import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperat
 import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration';
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
-import { enableUnverifiedRetainedOperations, markResultUnverifiable } from './RetainedResultVerification';
+import {
+  enableUnverifiedRetainedOperations,
+  markInputFilesChecked,
+  markResultUnverifiable
+} from './RetainedResultVerification';
 import { isBuildCacheReadSkipped, wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
@@ -169,31 +173,6 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
     return hasUntrackedGitFiles(gitPath, rootDirectory, newEntryPaths, outputFolderPaths);
   }
 
-  /**
-   * Returns true if the current Git hash of any of the specified files differs from its hash in the inputs
-   * snapshot. If the files cannot be hashed, conservatively returns true.
-   */
-  async #haveSnapshotHashesChangedAsync(
-    rootDirectory: string,
-    filePaths: ReadonlyArray<string>,
-    snapshotHashes: ReadonlyMap<string, string> | undefined
-  ): Promise<boolean> {
-    const gitPath: string | undefined = this.#getGitPath();
-    if (!gitPath || !snapshotHashes) {
-      return true;
-    }
-    try {
-      for (const [filePath, hash] of await hashFilesAsync(rootDirectory, filePaths, gitPath)) {
-        if (snapshotHashes.get(filePath) !== hash) {
-          return true;
-        }
-      }
-      return false;
-    } catch {
-      return true;
-    }
-  }
-
   public apply(hooks: PhasedCommandHooks): void {
     const {
       allowWarningsInSuccessfulBuild,
@@ -326,6 +305,10 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                     inputsSnapshot.workingTreeReadStartTimeMs
                   )
                 : undefined;
+            if (inputFilesState && runner.cacheable) {
+              // The input files are checked after the operation executes, so IncrementalExecutionGuardPlugin need not.
+              markInputFilesChecked(record);
+            }
 
             const buildCacheContext: IOperationBuildCacheContext = {
               // Supports cache writes by default for initial operations.
@@ -729,7 +712,8 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               // built from newer content than the cache key describes.
               const haveSnapshotHashesChanged: boolean =
                 inputFilesState.filesChangedDuringSnapshot.length > 0 &&
-                (await this.#haveSnapshotHashesChangedAsync(
+                (await haveSnapshotHashesChangedAsync(
+                  this.#getGitPath(),
                   inputFilesState.rootDirectory,
                   inputFilesState.filesChangedDuringSnapshot,
                   inputFileHashes
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index 7e9ac9856f..2fe311b24e 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -5,8 +5,9 @@ import { createHash, type Hash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { FileSystem, InternalError, Path } from '@rushstack/node-core-library';
+import { FileSystem, InternalError, Path, Executable } from '@rushstack/node-core-library';
 
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
 import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import type {
@@ -34,16 +35,30 @@ import {
   readOperationOutputManifestAsync,
   type IOperationOutputManifest
 } from './OperationOutputManifest';
-import { isResultUnverifiable } from './RetainedResultVerification';
+import {
+  captureInputFilesState,
+  haveInputFilesChanged,
+  haveSnapshotHashesChangedAsync,
+  hasUntrackedGitFiles,
+  type IInputFilesState
+} from './InputFilesStatSignature';
+import {
+  areInputFilesChecked,
+  isResultUnverifiable,
+  markResultUnverifiable
+} from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'IncrementalExecutionGuardPlugin' = 'IncrementalExecutionGuardPlugin';
 
-// Runs after the default-stage taps, e.g. CacheableOperationPlugin's input file checks, which can mark a result as
-// unverifiable.
+// Runs after the default-stage taps, e.g. the input file checks of this plugin and of CacheableOperationPlugin, which
+// can mark a result as unverifiable.
 const RECORD_RESULT_STAGE: number = 1;
 // Runs before those checks, so that a folder that was recreated before the input folders were read makes the result
-// unverifiable, if the build cache checks the operation's input files.
+// unverifiable.
 const READ_INPUT_FOLDERS_STAGE: number = -1;
+// Runs after the default-stage taps, e.g. that of CacheableOperationPlugin, which captures the input files of the
+// operations whose input files it checks.
+const CAPTURE_INPUT_FILES_STAGE: number = 1;
 
 const MAX_EXAMPLE_PATHS: number = 3;
 
@@ -244,6 +259,11 @@ export function getIncrementalInputChangeReason(
  * initial command runs as well. The operation then never runs its incremental command again in this graph, unless
  * the runner passed `outputsMayBeBundles` and no content-hashed output was added or removed. Results of the
  * incremental command are never written to the build cache (see `CacheableOperationPlugin`).
+ *
+ * The input files of an operation changed while it ran if they differ from their state right after the inputs snapshot
+ * of the iteration, e.g. because an editor saved a file. This plugin compares them after each command, unless
+ * `CacheableOperationPlugin` does, so that such a result never becomes a base, and a long-lived graph runs the
+ * operation again instead of skipping it at that state hash, whether or not the build cache is enabled.
  */
 export class IncrementalExecutionGuardPlugin implements IPhasedCommandPlugin {
   public apply(hooks: PhasedCommandHooks): void {
@@ -276,6 +296,8 @@ interface IRecordState {
   preRunOutputs?: IOperationOutputManifest;
   verifiedOutputs?: IOutputState;
   inputFolders?: ReadonlyMap<string, string>;
+  // Captured right after the inputs snapshot, if this plugin checks the operation's input files.
+  inputFilesState?: IInputFilesState;
 }
 
 function applyToGraph(graph: IOperationGraph): void {
@@ -311,6 +333,34 @@ function applyToGraph(graph: IOperationGraph): void {
     }
   );
 
+  let gitPath: string | undefined;
+  let isGitPathResolved: boolean = false;
+  const getGitPath = (): string | undefined => {
+    if (!isGitPathResolved) {
+      gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
+      isGitPathResolved = true;
+    }
+    return gitPath;
+  };
+
+  graph.hooks.beforeExecuteIterationAsync.tap(
+    { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
+    (records: ReadonlyMap<Operation, IOperationExecutionResult>): void => {
+      for (const record of records.values()) {
+        const recordState: IRecordState | undefined = stateByRecord.get(record);
+        const { runner, associatedProject: project, associatedPhase: phase } = record.operation;
+        if (recordState && record.enabled && runner && !runner.isNoOp && !areInputFilesChecked(record)) {
+          const { inputsSnapshot } = recordState;
+          recordState.inputFilesState = captureInputFilesState(
+            inputsSnapshot.rootDirectory,
+            inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name).keys(),
+            inputsSnapshot.workingTreeReadStartTimeMs
+          );
+        }
+      }
+    }
+  );
+
   async function getBlockReasonAsync(
     record: IOperationExecutionResult,
     recordState: IRecordState,
@@ -429,6 +479,31 @@ function applyToGraph(graph: IOperationGraph): void {
     }
   );
 
+  graph.hooks.afterExecuteOperationAsync.tapPromise(
+    PLUGIN_NAME,
+    async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+      const { status } = record;
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      const inputFilesState: IInputFilesState | undefined = recordState?.inputFilesState;
+      if (!recordState || !inputFilesState) {
+        return;
+      }
+      recordState.inputFilesState = undefined;
+      if (
+        (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) &&
+        !isResultUnverifiable(record) &&
+        (await haveOperationInputFilesChangedAsync(
+          record,
+          recordState.inputsSnapshot,
+          inputFilesState,
+          getGitPath
+        ))
+      ) {
+        markResultUnverifiable(record);
+      }
+    }
+  );
+
   graph.hooks.afterExecuteOperationAsync.tapPromise(
     { name: PLUGIN_NAME, stage: RECORD_RESULT_STAGE },
     async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
@@ -639,6 +714,59 @@ function getFolderIdentity(folderPath: string): string {
   }
 }
 
+/**
+ * Returns the absolute paths of the folders that an operation's command writes in its project: its metadata folder and
+ * its output folders.
+ */
+function getOutputFolderPaths(record: IOperationExecutionResult): string[] {
+  const { operation, metadataFolderPath } = record;
+  const { projectFolder } = operation.associatedProject;
+  return [metadataFolderPath, ...(operation.settings?.outputFolderNames ?? [])].map((folderName: string) =>
+    path.resolve(projectFolder, folderName)
+  );
+}
+
+/**
+ * Returns true if an operation's input files changed since their state was captured: a file was modified, deleted or
+ * replaced, a potential input file was created in a folder that holds its input files, or a file was saved while the
+ * inputs snapshot was being taken, after Git hashed it.
+ */
+async function haveOperationInputFilesChangedAsync(
+  record: IOperationExecutionResult,
+  inputsSnapshot: IInputsSnapshot,
+  inputFilesState: IInputFilesState,
+  getGitPath: () => string | undefined
+): Promise<boolean> {
+  const { rootDirectory, filesChangedDuringSnapshot } = inputFilesState;
+  const outputFolderPaths: string[] = getOutputFolderPaths(record);
+  const isNewInput = (newEntryPaths: ReadonlyArray<string>): boolean => {
+    // E.g. the output folder that the first run of the operation created
+    const candidatePaths: string[] = newEntryPaths.filter(
+      (entryPath: string) =>
+        !outputFolderPaths.some((folderPath: string) => Path.isUnderOrEqual(entryPath, folderPath))
+    );
+    if (candidatePaths.length === 0) {
+      return false;
+    }
+    const gitPath: string | undefined = getGitPath();
+    // Without Git it cannot be told whether the new entries are ignored, so they count as inputs.
+    return !gitPath || hasUntrackedGitFiles(gitPath, rootDirectory, candidatePaths, outputFolderPaths);
+  };
+  if (haveInputFilesChanged(inputFilesState, isNewInput)) {
+    return true;
+  }
+  if (filesChangedDuringSnapshot.length === 0) {
+    return false;
+  }
+  const { associatedProject: project, associatedPhase: phase } = record.operation;
+  return await haveSnapshotHashesChangedAsync(
+    getGitPath(),
+    rootDirectory,
+    filesChangedDuringSnapshot,
+    inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name)
+  );
+}
+
 /**
  * Returns the dependencies of an operation by name, including the dependencies that it has through operations of its
  * own project, e.g. through a phase without a script that only orders its build after the builds of other projects.
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
index 1e32a0da61..a354ba6734 100644
--- a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -6,6 +6,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { Executable } from '@rushstack/node-core-library';
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
 
 /**
  * How far outside of the snapshot window a file time may be and still count as a save during the window.
@@ -179,6 +180,36 @@ export function haveInputFilesChanged(state: IInputFilesState, isNewInput: IsNew
   return newEntryPaths.length > 0 && isNewInput(newEntryPaths);
 }
 
+/**
+ * Returns true if the current Git hash of any of the specified files differs from its hash in the inputs
+ * snapshot. If Git was not found or the files cannot be hashed, conservatively returns true.
+ *
+ * @param gitPath - The path of the Git executable, if it was found
+ * @param rootDirectory - The repository root that the file paths are relative to
+ * @param filePaths - The files to hash, e.g. the `filesChangedDuringSnapshot` of an `IInputFilesState`
+ * @param snapshotHashes - The hashes of the files in the inputs snapshot, by path
+ */
+export async function haveSnapshotHashesChangedAsync(
+  gitPath: string | undefined,
+  rootDirectory: string,
+  filePaths: ReadonlyArray<string>,
+  snapshotHashes: ReadonlyMap<string, string> | undefined
+): Promise<boolean> {
+  if (!gitPath || !snapshotHashes) {
+    return true;
+  }
+  try {
+    for (const [filePath, hash] of await hashFilesAsync(rootDirectory, filePaths, gitPath)) {
+      if (snapshotHashes.get(filePath) !== hash) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return true;
+  }
+}
+
 function toGitPathspec(rootDirectory: string, absolutePath: string): string {
   return path.relative(rootDirectory, absolutePath).split(path.sep).join('/');
 }
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index fff4b83541..f1800f2105 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -13,6 +13,7 @@ import type { IOperationGraphIterationOptions } from './IOperationGraph';
 import type { IOperationRunnerContext } from './IOperationRunner';
 import type { IOperationExecutionResult } from './IOperationExecutionResult';
 import { wasExecutedIncrementally } from './IncrementalExecutionState';
+import { isResultUnverifiable } from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'LegacySkipPlugin' = 'LegacySkipPlugin';
 const INVALIDATION_PLUGIN_NAME: 'LegacySkipInvalidationPlugin' = 'LegacySkipInvalidationPlugin';
@@ -42,6 +43,10 @@ function _areShallowEqual(object1: JsonObject, object2: JsonObject): boolean {
   return true;
 }
 
+// Runs after the default-stage taps that can mark the result of an operation as unverifiable, e.g. that of
+// IncrementalExecutionGuardPlugin, which checks whether the input files changed while the operation executed.
+const RECORD_PACKAGE_DEPS_STAGE: number = 1;
+
 export interface IProjectDeps {
   files: { [filePath: string]: string };
   arguments: string;
@@ -224,7 +229,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
       );
 
       graph.hooks.afterExecuteOperationAsync.tapPromise(
-        PLUGIN_NAME,
+        { name: PLUGIN_NAME, stage: RECORD_PACKAGE_DEPS_STAGE },
         async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
           const { status, operation } = record;
 
@@ -253,9 +258,10 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           const { packageDeps, packageDepsPath } = skipRecord;
 
-          if (wasExecutedIncrementally(record)) {
-            // The outputs of an incremental command can differ from those of the initial command, so a later
-            // command must not skip the operation.
+          if (wasExecutedIncrementally(record) || isResultUnverifiable(record)) {
+            // The outputs of an incremental command can differ from those of the initial command, and the outputs of
+            // a run whose input files changed while it ran may not match the recorded inputs, so a later command must
+            // not skip the operation.
             return;
           }
 
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
index 5cadda9523..19b7821ff0 100644
--- a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -6,6 +6,7 @@ import type { IConfigurableOperation, IOperationExecutionResult } from './IOpera
 import { type OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 
 const unverifiableResults: WeakSet<IOperationExecutionResult> = new WeakSet();
+const resultsWithCheckedInputFiles: WeakSet<IOperationExecutionResult> = new WeakSet();
 
 /**
  * Records that the outputs of a result of the executing iteration may not match its state hash, e.g. because input
@@ -28,6 +29,25 @@ export function isResultUnverifiable(result: IOperationExecutionResult): boolean
   return unverifiableResults.has(result);
 }
 
+/**
+ * Records that a plugin checks whether the input files of the operation change from the inputs snapshot of the
+ * executing iteration until the operation has executed, and calls `markResultUnverifiable` for the result if they do,
+ * so that `IncrementalExecutionGuardPlugin` does not check them as well.
+ *
+ * @remarks
+ * Call this from a `beforeExecuteIterationAsync` tap with the default stage.
+ */
+export function markInputFilesChecked(result: IOperationExecutionResult): void {
+  resultsWithCheckedInputFiles.add(result);
+}
+
+/**
+ * Returns true if `markInputFilesChecked` was called for the result.
+ */
+export function areInputFilesChecked(result: IOperationExecutionResult): boolean {
+  return resultsWithCheckedInputFiles.has(result);
+}
+
 /**
  * Re-enables selected operations whose result retained by a previous iteration of a long-lived graph
  * (e.g. the Rush daemon) is current by state hash, but not verified at that state hash, so that they are restored
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index e109c7c2ab..2f5f0a63ed 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -71,9 +71,10 @@ import { OperationGraph } from '../OperationGraph';
 import { Operation } from '../Operation';
 import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
-import type { IExecutionResult } from '../IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import { FILE_TIME_TOLERANCE_MS } from '../InputFilesStatSignature';
+import { areInputFilesChecked } from '../RetainedResultVerification';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -523,6 +524,33 @@ describe(CacheableOperationPlugin.name, () => {
     );
   });
 
+  it('tells other plugins which operations it checks the input files of', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c', 'd']);
+    testGraph.cacheDisabledReasons.set('b', 'Caching has been disabled for this project.');
+    // Like a runner whose results are never written to the build cache
+    (testGraph.operations.get('c')!.runner as { cacheable: boolean }).cacheable = false;
+    let checkedOperations: string[] = [];
+    // Like IncrementalExecutionGuardPlugin, which checks the input files of the other operations
+    testGraph.graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'test', stage: 1 },
+      (records: ReadonlyMap<Operation, IOperationExecutionResult>): undefined => {
+        checkedOperations = [];
+        for (const record of records.values()) {
+          if (areInputFilesChecked(record)) {
+            checkedOperations.push(record.operation.associatedProject.packageName);
+          }
+        }
+        return undefined;
+      }
+    );
+    await testGraph.executeAsync();
+    expect(checkedOperations).toEqual(['a', 'd']);
+
+    testGraph.localHashes.set('d', 'd-v2');
+    await testGraph.executeAsync();
+    expect(checkedOperations).toEqual(['d']);
+  });
+
   describe('reason that caching is disabled', () => {
     const cacheDisabledReason: string = 'Caching has been disabled for this project.';
 
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 242f8ca749..fa38cd5636 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -47,10 +47,11 @@ import * as path from 'node:path';
 import { PassThrough } from 'node:stream';
 
 import { LookupByPath } from '@rushstack/lookup-by-path';
-import { SubprocessTerminator } from '@rushstack/node-core-library';
+import { Executable, SubprocessTerminator } from '@rushstack/node-core-library';
 import { type ITerminal, MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
+import { EnvironmentConfiguration } from '../../../api/EnvironmentConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
 import type { IOperationSettings, RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
 import type {
@@ -83,7 +84,7 @@ import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import { OperationGraph } from '../OperationGraph';
 import { OperationStatus } from '../OperationStatus';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
-import { markResultUnverifiable } from '../RetainedResultVerification';
+import { markInputFilesChecked, markResultUnverifiable } from '../RetainedResultVerification';
 import { ShellOperationRunner } from '../ShellOperationRunner';
 
 const PHASE_NAME: string = '_phase:build';
@@ -150,6 +151,10 @@ interface IWorkspaceOptions {
    * `WarmWorkerOperationRunner`.
    */
   readonly watchesInputs?: boolean;
+  /**
+   * If set, each inputs snapshot records when it began reading the working tree, like one that Git computes.
+   */
+  readonly recordsWorkingTreeReadStartTime?: boolean;
 }
 
 interface ITestIteration {
@@ -218,12 +223,29 @@ function recreateFolder(folder: string): void {
   }
 }
 
+// Recreates a folder by moving its entries into a new folder, which keeps the identity, size and times of each file.
+function moveFolder(folder: string): void {
+  const newFolder: string = `${folder}.new`;
+  fs.mkdirSync(newFolder);
+  for (const entry of fs.readdirSync(folder)) {
+    fs.renameSync(`${folder}/${entry}`, `${newFolder}/${entry}`);
+  }
+  fs.rmdirSync(folder);
+  fs.renameSync(newFolder, folder);
+}
+
 // Like a compiler: writes a file per source file, and its incremental mode neither cleans the output folder nor
 // deletes the outputs of deleted source files. A source containing "emit:<name>" also emits "<name>.js", a
 // source containing "recreate:<folder>" deletes and recreates that folder of the project while the build runs, a
-// source containing "error" fails the build, and after the output of a source containing "hang", the build runs
-// until it is terminated (it returns undefined).
-function build(projectFolder: string, isBundle: boolean, isIncremental: boolean): number | undefined {
+// source containing "move:<folder>" recreates that folder by moving its files while the build runs, a source
+// containing "warning" adds a warning to `warnings`, a source containing "error" fails the build, and after the
+// output of a source containing "hang", the build runs until it is terminated (it returns undefined).
+function build(
+  projectFolder: string,
+  isBundle: boolean,
+  isIncremental: boolean,
+  warnings: string[] = []
+): number | undefined {
   const outputFolder: string = `${projectFolder}/${isBundle ? 'dist' : 'lib'}`;
   if (!isIncremental) {
     fs.rmSync(outputFolder, { recursive: true, force: true });
@@ -235,6 +257,9 @@ function build(projectFolder: string, isBundle: boolean, isIncremental: boolean)
     if (source.includes('error')) {
       return 1;
     }
+    if (source.includes('warning')) {
+      warnings.push(`Warning in ${sourcePath}`);
+    }
     bundle.push(source);
     if (!isBundle) {
       const outputPath: string = `${outputFolder}/${sourcePath.replace(/\.ts$/, '.js')}`;
@@ -249,6 +274,10 @@ function build(projectFolder: string, isBundle: boolean, isIncremental: boolean)
     if (recreated) {
       recreateFolder(`${projectFolder}/${recreated[1]}`);
     }
+    const moved: RegExpExecArray | null = /move:([\w/]+)/.exec(source);
+    if (moved) {
+      moveFolder(`${projectFolder}/${moved[1]}`);
+    }
     if (source.includes('hang')) {
       return undefined;
     }
@@ -328,7 +357,13 @@ class PluginOperationRunner implements IOperationRunner {
 
 async function createWorkspaceAsync(
   projectSpecs: ReadonlyArray<IProjectSpec>,
-  { hasPassThroughPhase, guardOptions, hasLegacySkipDetection, watchesInputs }: IWorkspaceOptions = {}
+  {
+    hasPassThroughPhase,
+    guardOptions,
+    hasLegacySkipDetection,
+    watchesInputs,
+    recordsWorkingTreeReadStartTime
+  }: IWorkspaceOptions = {}
 ): Promise<ITestWorkspace> {
   const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
   workspaceFolders.push(rootFolder);
@@ -355,7 +390,8 @@ async function createWorkspaceAsync(
       const spec: IProjectSpec = specByFolder.get(workingDirectory)!;
       const isIncremental: boolean = command === INCREMENTAL_COMMAND;
       commands.push(`${spec.name}:${isIncremental ? 'incremental' : 'initial'}`);
-      const exitCode: number | undefined = build(workingDirectory, !!spec.isBundle, isIncremental);
+      const warnings: string[] = [];
+      const exitCode: number | undefined = build(workingDirectory, !!spec.isBundle, isIncremental, warnings);
       const child: childProcess.ChildProcess = Object.assign(new EventEmitter(), {
         stdout: new PassThrough(),
         stderr: new PassThrough(),
@@ -365,6 +401,10 @@ async function createWorkspaceAsync(
         for (const resolve of hangWaiters.splice(0)) {
           resolve();
         }
+      } else if (warnings.length > 0) {
+        (child.stderr as PassThrough).write(warnings.join('\n'));
+        // The runner reads the warnings after it starts to listen for output, so the process closes afterwards.
+        setImmediate(() => close(child, exitCode, null));
       } else {
         close(child, exitCode, null);
       }
@@ -542,10 +582,13 @@ async function createWorkspaceAsync(
 
   // Like `git hash-object` for each file, except the outputs, which are ignored by git.
   const createInputsSnapshot = (environment: Readonly<Record<string, string>>): InputsSnapshot => {
+    const workingTreeReadStartTimeMs: number | undefined = recordsWorkingTreeReadStartTime
+      ? Date.now()
+      : undefined;
     const hashes: Map<string, string> = new Map();
     const hashFile = (file: string): void => {
       const content: Buffer = fs.readFileSync(`${rootFolder}/${file}`);
-      hashes.set(file, createHash('sha1').update(content).digest('hex'));
+      hashes.set(file, createHash('sha1').update(`blob ${content.length}\0`).update(content).digest('hex'));
     };
     for (const [prefix, outputFolderName] of outputFolderByPrefix) {
       for (const file of listFiles(`${rootFolder}/${prefix}`, new Set([outputFolderName]))) {
@@ -561,7 +604,8 @@ async function createWorkspaceAsync(
       hasUncommittedChanges: false,
       lookupByPath,
       projectMap,
-      environment: { ...environment }
+      environment: { ...environment },
+      workingTreeReadStartTimeMs
     });
   };
 
@@ -955,7 +999,8 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
     await workspace.executeAsync();
 
-    workspace.writeFile('a/src/one.ts', 'one recreate:src/sub');
+    // The input files keep their identity, so the result is the base of the next run.
+    workspace.writeFile('a/src/one.ts', 'one move:src/sub');
     expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
 
     workspace.writeFile('a/src/one.ts', 'one 3');
@@ -1110,6 +1155,227 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     expect((await workspace.executeAsync()).commands).toEqual(['a:incremental', 'b:incremental']);
   });
 
+  describe('with input files that change while the operation executes', () => {
+    // Like an editor that saves a file while the command of the operation reads the input files
+    const changeWhileExecuting = (workspace: ITestWorkspace, change: () => void): void => {
+      let pendingChange: (() => void) | undefined = change;
+      workspace.graph.hooks.beforeExecuteOperationAsync.tap('changeWhileExecuting', (): undefined => {
+        pendingChange?.();
+        pendingChange = undefined;
+        return undefined;
+      });
+    };
+    const readOutput = (workspace: ITestWorkspace, relativePath: string): string | undefined => {
+      const outputPath: string = `${workspace.rootFolder}/${relativePath}`;
+      return fs.existsSync(outputPath) ? fs.readFileSync(outputPath, 'utf8') : undefined;
+    };
+
+    it.each<
+      [string, (workspace: ITestWorkspace) => void, (workspace: ITestWorkspace) => void, string, string]
+    >([
+      [
+        'a file was edited',
+        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two edited'),
+        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
+        'a/lib/sub/two.js',
+        'two'
+      ],
+      [
+        'a file was added',
+        (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
+        (workspace: ITestWorkspace) => workspace.deleteFile('a/src/three.ts'),
+        'a/lib/three.js',
+        'none'
+      ]
+    ])(
+      'runs the operation again if %s while it executed and was changed back',
+      async (
+        name: string,
+        change: (workspace: ITestWorkspace) => void,
+        changeBack: (workspace: ITestWorkspace) => void,
+        outputFile: string,
+        expectedOutput: string
+      ) => {
+        const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+        changeWhileExecuting(workspace, () => change(workspace));
+        expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+        expect(readOutput(workspace, outputFile) ?? 'none').not.toBe(expectedOutput);
+
+        // The inputs snapshot is the same as that of the last run, but the outputs were built from other inputs.
+        changeBack(workspace);
+        const next: ITestIteration = await workspace.executeAsync();
+        expect(next.commands).toEqual(['a:initial']);
+        expect(next.output).toContain(
+          'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+        );
+        expect(readOutput(workspace, outputFile) ?? 'none').toBe(expectedOutput);
+
+        expect((await workspace.executeAsync()).commands).toEqual([]);
+      }
+    );
+
+    it('runs the operation again if a file was edited while it executed with warnings and was changed back', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+      const first: ITestIteration = await workspace.executeAsync();
+      expect(first.commands).toEqual(['a:initial']);
+      expect(first.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+    });
+
+    it('counts a file that was added while it executed as an input file if Git is not found', async () => {
+      jest.spyOn(EnvironmentConfiguration, 'gitBinaryPath', 'get').mockReturnValue(undefined);
+      jest.spyOn(Executable, 'tryResolve').mockReturnValue(undefined);
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/three.ts', 'three'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.deleteFile('a/src/three.ts');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, 'a/lib/three.js')).toBeUndefined();
+    });
+
+    it.each<[string, string, ReadonlyArray<string>]>([
+      [
+        'counts a file that was added while it executed as an input file if Git does not ignore it',
+        'a/src/three.ts',
+        ['a:initial']
+      ],
+      [
+        'does not count a file that was added while it executed as an input file if Git ignores it',
+        'a/src/three.log',
+        []
+      ]
+    ])('%s', async (name: string, addedFile: string, expectedCommands: ReadonlyArray<string>) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      expect(
+        Executable.spawnSync('git', ['init', '--quiet'], { currentWorkingDirectory: workspace.rootFolder })
+          .status
+      ).toBe(0);
+      workspace.writeFile('.gitignore', '*.log\n');
+      changeWhileExecuting(workspace, () => workspace.writeFile(addedFile, 'three'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      // The inputs snapshot is the same as that of the last run.
+      workspace.deleteFile(addedFile);
+      expect((await workspace.executeAsync()).commands).toEqual(expectedCommands);
+    });
+
+    it.each([false, true])(
+      'runs the initial command after an incremental command whose input files changed while it ran (watches inputs: %s)',
+      async (watchesInputs: boolean) => {
+        const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs });
+        await workspace.executeAsync();
+
+        workspace.writeFile('a/src/one.ts', 'one 2');
+        changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two 2'));
+        expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+        workspace.writeFile('a/src/one.ts', 'one 3');
+        const next: ITestIteration = await workspace.executeAsync();
+        expect(next.commands).toEqual(['a:initial']);
+        expect(next.output).toContain(
+          'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+        );
+
+        workspace.writeFile('a/src/one.ts', 'one 4');
+        expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+      }
+    );
+
+    it('runs the initial command after a folder of its input files was recreated while its first run ran, for a runner that watches its inputs', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
+      // The folders that held its input files are read after the first run, so they cannot show the change.
+      workspace.writeFile('a/src/one.ts', 'one recreate:src/sub');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(
+        'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+      );
+    });
+
+    it('runs the operation again if a file was saved while the inputs snapshot was being taken', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+        recordsWorkingTreeReadStartTime: true
+      });
+      // Saved after it was hashed, and before its state was captured, so its state does not change afterwards
+      let isSaved: boolean = false;
+      workspace.graph.hooks.beforeExecuteIterationAsync.tap('saveWhileSnapshotting', (): undefined => {
+        if (!isSaved) {
+          workspace.writeFile('a/src/sub/two.ts', 'two saved');
+          isSaved = true;
+        }
+        return undefined;
+      });
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two saved');
+
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+
+      // The files saved since the last snapshot started have the hashes that it recorded.
+      expect((await workspace.executeAsync()).commands).toEqual([]);
+    });
+
+    it('does not let a later command skip the operation', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+        hasLegacySkipDetection: true
+      });
+      const packageDepsPath: string = `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(packageDepsPath)).toBe(false);
+
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(packageDepsPath)).toBe(true);
+      expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+    });
+
+    it('does not let a later command skip the operation if a plugin that is applied later finds the change', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+        hasLegacySkipDetection: true
+      });
+      const packageDepsPath: string = `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+      // After the taps of the plugins of the workspace
+      workspace.graph.hooks.afterExecuteOperationAsync.tap('test', (record: IOperationExecutionResult) =>
+        markResultUnverifiable(record)
+      );
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(packageDepsPath)).toBe(false);
+    });
+
+    it('leaves the check to another plugin that checks the input files', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      // Like CacheableOperationPlugin
+      workspace.graph.hooks.beforeExecuteIterationAsync.tap(
+        'checksInputFiles',
+        (records: ReadonlyMap<Operation, IOperationExecutionResult>): undefined => {
+          for (const record of records.values()) {
+            markInputFilesChecked(record);
+          }
+          return undefined;
+        }
+      );
+      changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      // The other plugin did not mark the result as unverifiable.
+      workspace.writeFile('a/src/sub/two.ts', 'two');
+      expect((await workspace.executeAsync()).commands).toEqual([]);
+    });
+  });
+
   it('forgets every base after a native command, but not after an input change', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
     await workspace.executeAsync();

From 01027c3ce8eddb0bfbc14e0ead613a4bb2e307bc Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:59 +0000
Subject: [PATCH 140/265] [rush-daemon-transport] Make
 OrphanReapOnReclaim.test's operation child exit by itself

Swarm integration step 125; original commit 1ddbf04929 (merge of swarm/r06-t237 at 40a7184719).
Refs: task 237.
Scope: task 237.

Brings 237 (branch swarm/r06-t237). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 10 of 20. Gate: ch01 GATE OK board 4947 (tree f9bc3b79f2)

Commits folded into this step (1):
- 40a7184719 [rush-daemon-transport] Make OrphanReapOnReclaim.test's operation child exit by itself (task 237)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../swarm-r06-t237_2026-09-29-09-15.json              | 11 +++++++++++
 .../src/test/OrphanReapOnReclaim.test.ts              |  6 +++++-
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t237_2026-09-29-09-15.json

diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t237_2026-09-29-09-15.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t237_2026-09-29-09-15.json
new file mode 100644
index 0000000000..f865bd1db8
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t237_2026-09-29-09-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Make the operation process in a reclaim test exit by itself after a minute, so a failed reap doesn't leave it running.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
index 6237e34954..c8c9d922ec 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReapOnReclaim.test.ts
@@ -20,10 +20,14 @@ const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
 const FIRST_ATTEMPT: number = 0;
 const POLL_ATTEMPTS: number = 100;
 const POLL_INTERVAL_MS: number = 20;
+// The operation child exits by itself after a minute, so a run where the reap fails doesn't leave it running.
+// The test waits only 2 s for the reap, so the child's own exit can't make the test pass.
+const OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
 // A stand-in daemon: spawns one operation child and prints the child pid. Like a phased operation (spawned
 // without `detached`), the child inherits the daemon's process group.
 const FAKE_DAEMON_SCRIPT: string =
-  "const c=require('node:child_process').spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'});" +
+  "const c=require('node:child_process')" +
+  `.spawn(process.execPath,['-e','${OPERATION_SCRIPT}'],{stdio:'ignore'});` +
   "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
 
 interface IOrphanedGroup {

From f0a23b663b7e6d6de95d3281d04124ba56e5690c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:43:59 +0000
Subject: [PATCH 141/265] [rush-cli-client] Test that pongs keep a long request
 from counting as silent (task 69(a), o01 NIT 1)

Swarm integration step 126; original commit 1348edae77 (merge of swarm/r04-t69 at c0ffde495b).
Scope: task 69(a).

Brings 69(a) (branch swarm/r04-t69). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 11 of 20. Gate: ch01 GATE OK board 4947 (tree e0a7501791)

Commits folded into this step (2):
- e95dedc22e Say when rushd stops responding while a command runs (task 69(a))
- c0ffde495b Test that pongs keep a long request from counting as silent (task 69(a), o01 NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  13 +
 .../src/AgentProgressRenderer.ts              |  82 +++++-
 apps/rush-cli-client/src/daemonSilence.ts     |  76 ++++++
 apps/rush-cli-client/src/launchClient.ts      |   6 +
 .../src/test/AgentProgressRenderer.test.ts    |  67 +++++
 .../src/test/daemonSilence.test.ts            |  61 +++++
 ...4-t69-daemon-silence_2026-09-29-07-20.json |  11 +
 ...4-t69-daemon-silence_2026-09-29-07-20.json |  11 +
 .../swarm-r04-t69-nit1_2026-09-29-09-10.json  |  11 +
 ...4-t69-daemon-silence_2026-09-29-07-20.json |  11 +
 ...4-t69-daemon-silence_2026-09-29-07-20.json |  11 +
 common/reviews/api/rush-client-core.api.md    |  15 ++
 .../reviews/api/rush-daemon-protocol.api.md   |   3 +
 libraries/rush-client-core/README.md          |   9 +
 .../rush-client-core/src/DaemonClient.ts      | 135 +++++++++-
 libraries/rush-client-core/src/index.ts       |   4 +-
 .../src/test/DaemonClient.test.ts             | 252 +++++++++++++++++-
 libraries/rush-daemon-protocol/README.md      |   4 +
 .../src/DaemonProtocolVersion.ts              |   9 +-
 libraries/rush-daemon-protocol/src/index.ts   |   2 +-
 .../rush-daemon/src/DaemonControlSession.ts   |   9 +
 .../src/test/DaemonRequestWireGlobal.test.ts  |  68 ++++-
 22 files changed, 855 insertions(+), 15 deletions(-)
 create mode 100644 apps/rush-cli-client/src/daemonSilence.ts
 create mode 100644 apps/rush-cli-client/src/test/daemonSilence.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t69-nit1_2026-09-29-09-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 5eff149828..3ac096f9ee 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -374,6 +374,19 @@ needed SIGKILL. While agent mode shows its progress lines, the line is written a
 If rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
 or `daemon restart` still end a command as cancelled (exit code 130).
 
+While a command runs, the client checks that rushd still responds. Once rushd has sent nothing
+for 10 s, the client pings it. Once it has sent nothing for 30 s, not even the reply, for example
+because its process was stopped, the client says so at once and says what that means:
+`rush-client: rushd (PID <pid>) has not responded for 30s; its process may be stopped or
+overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.` When
+rushd sends anything again, a second line says so: `rush-client: rushd (PID <pid>) responded again
+after 70s.` In agent mode, the progress phase says it; on a pipe both lines are written at once,
+and until rushd responds, the status lines say how long it has not responded instead of what runs.
+Time in which the client itself was stopped or busy writing output does not count. An interrupt
+asks rushd to cancel the command, which a stopped rushd cannot confirm, so the client stops waiting
+when its 5 s cancellation wait ends, and writes no more of these lines once it asked. Daemons older
+than protocol 0.13 are not checked.
+
 Piped input uses protocol 0.7's negotiated stdin admission and EOF. The client does
 not read input until the command attaches an input destination, and sends bounded
 chunks only as the daemon grants write credits. EOF follows all preceding writes;
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 8fa8527818..48c2d7a43a 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -4,6 +4,7 @@
 // Keep this module free of heavy imports: start.ts loads it before @microsoft/rush-lib
 // so that the first line can be written within a few milliseconds.
 
+import type { IDaemonSilence } from '@rushstack/rush-client-core';
 import type {
   DaemonRequestAdmissionErrorCode,
   IDaemonEventEnvelope,
@@ -18,6 +19,7 @@ import {
   type IAgentProblemOperation
 } from './AgentOperationTracker';
 import { clipLine } from './OperationOutputExcerpt';
+import { DAEMON_SILENCE_ADVICE, formatDaemonResponded, formatDaemonSilence } from './daemonSilence';
 
 const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
 /**
@@ -101,6 +103,12 @@ interface IQueuePosition {
   readonly elapsed: string;
 }
 
+/** A daemon that has not responded: its process ID, and since when (on the renderer's clock) it has sent nothing. */
+interface ISilence {
+  readonly pid: number | undefined;
+  readonly sinceMs: number;
+}
+
 export interface IAgentProgressRendererOptions {
   readonly commandName: string;
   readonly isTTY: boolean;
@@ -205,7 +213,8 @@ function getOperationErrorLines(
  * summary line, and nothing else. Status lines keep a longer request from looking hung: whenever nothing was
  * written for 25 s, a status line with the counts and the running operations follows, and a connection that
  * takes longer than 10 s gets one. A wait for a daemon that is still starting also gets a line, once, and so
- * does a cancellation, as soon as the client asks rushd to stop the request. Only the first three failed
+ * does a cancellation, as soon as the client asks rushd to stop the request. So does a daemon that has not
+ * responded for 30 s, with what to do, and the same daemon when it responds again. Only the first three failed
  * operations are reported. Whether warnings fail the request is only known at its end, so operations with
  * warnings are reported before the summary line; so is a failed operation that wrote no output, whose error
  * only the daemon's result carries. On a pipe, the next status line, which names that operation, is then due
@@ -238,6 +247,8 @@ export class AgentProgressRenderer {
   #stopped: boolean = false;
   /** The client asked rushd to cancel the request; the progress line says so until the end. */
   #cancelling: boolean = false;
+  /** rushd has not responded, and has sent nothing since; see {@link AgentProgressRenderer.onDaemonUnresponsive}. */
+  #silence: ISilence | undefined;
   /** On a pipe: an operation that wrote no output failed, and no line has named it yet. */
   #unnamedFailure: boolean = false;
   /** The error message that the summary line contains in full, once written. */
@@ -366,11 +377,46 @@ export class AgentProgressRenderer {
     }
     this.setPhase(`cancelling; waiting up to ${Math.round(timeoutMs / 1000)}s for rushd to stop the request`);
     this.#cancelling = true;
+    this.#silence = undefined;
     if (!this.#options.isTTY) {
       this.#writePipeLine(this.#rows()[0]);
     }
   }
 
+  /**
+   * rushd has sent nothing for `silence.silentForMs`, not even the reply to a ping. Until it sends something again,
+   * the progress line says so, with what to do, and a pipe's status lines say so instead of what runs, which is no
+   * longer known. On a pipe, that line is written at once. Once the client asked rushd to cancel the request,
+   * nothing changes.
+   */
+  public onDaemonUnresponsive(silence: IDaemonSilence): void {
+    if (this.#cancelling) {
+      return;
+    }
+    this.#silence = { pid: silence.pid, sinceMs: this.#now() - silence.silentForMs };
+    if (this.#options.isTTY) {
+      this.#paint();
+    } else {
+      this.#writePipeLine(this.#rows()[0]);
+    }
+  }
+
+  /**
+   * rushd sent something again after {@link AgentProgressRenderer.onDaemonUnresponsive}. The progress line returns
+   * to the phase; on a pipe, a line says how long rushd was silent.
+   */
+  public onDaemonResponsive(silence: IDaemonSilence): void {
+    if (!this.#silence) {
+      return;
+    }
+    this.#silence = undefined;
+    if (this.#options.isTTY) {
+      this.#paint();
+    } else {
+      this.#writePipeLine(`${this.#getHeader()} · ${formatDaemonResponded(silence)}`);
+    }
+  }
+
   public onEvent(event: IDaemonEventEnvelope): void {
     if (this.#stopped) {
       return;
@@ -653,11 +699,26 @@ export class AgentProgressRenderer {
     return `${((this.#now() - this.#startTimeMs) / 1000).toFixed(1)}s`;
   }
 
-  #rows(): [string, string, string] {
-    const { total, done, running, failed } = this.#tracker;
+  /** The start of every progress line: `rush <command> <done>/<total> · <elapsed>`. */
+  #getHeader(): string {
+    const { total, done } = this.#tracker;
     const counter: string = total ? ` ${done}/${total}` : '';
+    return `rush ${this.#options.commandName}${counter} · ${this.#elapsed()}`;
+  }
+
+  /** How long rushd has not responded, unless it has responded since, or the request is being cancelled. */
+  #getSilence(): string | undefined {
+    if (!this.#silence || this.#cancelling) {
+      return undefined;
+    }
+    return formatDaemonSilence(this.#silence.pid, this.#now() - this.#silence.sinceMs);
+  }
+
+  #rows(): [string, string, string] {
+    const { running, failed } = this.#tracker;
+    const silence: string | undefined = this.#getSilence();
     return [
-      `rush ${this.#options.commandName}${counter} · ${this.#elapsed()} · ${this.#phase}`,
+      `${this.#getHeader()} · ${silence === undefined ? this.#phase : `${silence}; ${DAEMON_SILENCE_ADVICE}`}`,
       running.length ? `running: ${formatNames(running, MAX_LIVE_NAMES)}` : '',
       failed.length ? `failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : this.#lastActivity
     ];
@@ -692,12 +753,16 @@ export class AgentProgressRenderer {
   /**
    * A pipe status line: the counts, then the running operations, or else what the request waits for. The daemon
    * does not report admission, so after a queue position this says when the position was reported instead of
-   * claiming that the request is still queued.
+   * claiming that the request is still queued. While rushd has not responded, what runs is not known, so the line
+   * says how long rushd has not responded instead.
    */
   #getStatusLine(): string {
-    const { total, done, running, failed } = this.#tracker;
+    const { running, failed } = this.#tracker;
     let activity: string = this.#phase;
-    if (running.length) {
+    const silence: string | undefined = this.#getSilence();
+    if (silence !== undefined) {
+      activity = silence;
+    } else if (running.length) {
       activity = `running: ${formatNames(running, MAX_LIVE_NAMES)}`;
     } else if (this.#queued) {
       activity =
@@ -705,8 +770,7 @@ export class AgentProgressRenderer {
         `(queue position ${this.#queued.position} at ${this.#queued.elapsed})`;
     }
     const failures: string = failed.length ? ` · failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : '';
-    const counter: string = total ? ` ${done}/${total}` : '';
-    return `rush ${this.#options.commandName}${counter} · ${this.#elapsed()} · ${activity}${failures}`;
+    return `${this.#getHeader()} · ${activity}${failures}`;
   }
 
   #paint(): void {
diff --git a/apps/rush-cli-client/src/daemonSilence.ts b/apps/rush-cli-client/src/daemonSilence.ts
new file mode 100644
index 0000000000..328daf54f7
--- /dev/null
+++ b/apps/rush-cli-client/src/daemonSilence.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// Keep this module free of runtime imports: AgentProgressRenderer, which start.ts loads before
+// @microsoft/rush-lib, uses it.
+
+import type { IDaemonClientLivenessOptions, IDaemonSilence } from '@rushstack/rush-client-core';
+
+/**
+ * What a daemon that has not responded means, and what to do, to follow a semicolon. `rush-client daemon status`
+ * would not help: it waits 5 s for the same daemon to get ready, and then says only that it did not.
+ */
+export const DAEMON_SILENCE_ADVICE: string =
+  'its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting';
+
+function formatDaemon(pid: number | undefined): string {
+  return pid === undefined ? 'rushd' : `rushd (PID ${pid})`;
+}
+
+function formatSeconds(ms: number): string {
+  return `${Math.floor(ms / 1000)}s`;
+}
+
+/** Says how long the daemon has sent nothing, for example "rushd (PID 41) has not responded for 30s". */
+export function formatDaemonSilence(pid: number | undefined, silentForMs: number): string {
+  return `${formatDaemon(pid)} has not responded for ${formatSeconds(silentForMs)}`;
+}
+
+/** Says that the daemon sent something again, for example "rushd (PID 41) responded again after 70s". */
+export function formatDaemonResponded(silence: IDaemonSilence): string {
+  return `${formatDaemon(silence.pid)} responded again after ${formatSeconds(silence.silentForMs)}`;
+}
+
+/** The agent renderer's methods for a daemon that stops responding, and for one that responds again. */
+export interface IAgentDaemonSilenceRenderer {
+  onDaemonUnresponsive(silence: IDaemonSilence): void;
+  onDaemonResponsive(silence: IDaemonSilence): void;
+}
+
+/** Where the lines about a daemon that stopped responding go. */
+export interface IDaemonSilenceTarget {
+  readonly rushx: boolean;
+  readonly agentRenderer: IAgentDaemonSilenceRenderer | undefined;
+  readonly writeStderrAsync: (text: string) => Promise<void>;
+}
+
+/**
+ * Creates a request's liveness check. When the daemon stops responding, the agent renderer says so, if one is
+ * active, and otherwise a line on stderr does, with what to do. When it responds again, a second line says so.
+ * An interrupt asks the daemon to cancel the request; a stopped daemon cannot confirm that, so the client stops
+ * waiting when its cancellation timeout ends.
+ */
+export function createDaemonLivenessOptions(target: IDaemonSilenceTarget): IDaemonClientLivenessOptions {
+  const { agentRenderer } = target;
+  const prefix: string = target.rushx ? 'rushx-client' : 'rush-client';
+  const writeLine = (line: string): void => {
+    // After SIGHUP the terminal may be gone.
+    target.writeStderrAsync(`${prefix}: ${line}\n`).catch(() => undefined);
+  };
+  return {
+    onUnresponsive: (silence: IDaemonSilence): void => {
+      if (agentRenderer) {
+        agentRenderer.onDaemonUnresponsive(silence);
+        return;
+      }
+      writeLine(`${formatDaemonSilence(silence.pid, silence.silentForMs)}; ${DAEMON_SILENCE_ADVICE}.`);
+    },
+    onResponsive: (silence: IDaemonSilence): void => {
+      if (agentRenderer) {
+        agentRenderer.onDaemonResponsive(silence);
+        return;
+      }
+      writeLine(`${formatDaemonResponded(silence)}.`);
+    }
+  };
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index da82889dd9..e0b651f076 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -39,6 +39,7 @@ import { getDaemonConnectionOptionsAsync, getDaemonPaths } from './daemonConnect
 import { readUseRushReporter, selectClientOutputMode } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
+import { createDaemonLivenessOptions } from './daemonSilence';
 import { getTerminalColumns } from './terminalColumns';
 import {
   createDaemonRequestNoticeHandlers,
@@ -289,6 +290,11 @@ export async function launchClientAsync(
       requiresStdinEnd: !process.stdin.isTTY,
       cancelOnCtrlC: !!process.stdin.isTTY,
       onCancelRequested,
+      liveness: createDaemonLivenessOptions({
+        rushx,
+        agentRenderer,
+        writeStderrAsync: (text) => writeStreamAsync(process.stderr, Buffer.from(text))
+      }),
       initialRawMode: !!process.stdin.isRaw,
       setRawMode: process.stdin.isTTY
         ? (enabled) => {
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index e2cc6c9db7..3c25b58605 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1365,6 +1365,56 @@ describe(AgentProgressRenderer.name, () => {
         'rush build · 45.0s · sent to rushd; preparing the workspace graph'
       ]);
     });
+
+    it('says at once that rushd has not responded, and in the status lines, until it responds again (task 69)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      for (const name of ['a', 'b', 'c', 'd', 'e']) {
+        renderer.onEvent(registered(`${name} (build)`));
+        renderer.onEvent(status(`${name} (build)`, 'EXECUTING'));
+      }
+      for (const name of ['a', 'b', 'c', 'd']) {
+        renderer.onEvent(status(`${name} (build)`, 'SUCCESS'));
+      }
+      // rushd stops at 5 s; the client reports it once rushd has sent nothing for 30 s.
+      advance(clock, 25_000);
+      advance(clock, 10_000);
+      renderer.onDaemonUnresponsive({ pid: 12345, silentForMs: 30_000 });
+      advance(clock, 25_000);
+      advance(clock, 15_200);
+      renderer.onDaemonResponsive({ pid: 12345, silentForMs: 70_200 });
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build 4/5 · 25.0s · running: e (build)',
+        'rush build 4/5 · 35.0s · rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
+        'rush build 4/5 · 60.0s · rushd (PID 12345) has not responded for 55s',
+        'rush build 4/5 · 75.2s · rushd (PID 12345) responded again after 70s',
+        'rush build 4/5 · 100.2s · running: e (build)'
+      ]);
+    });
+
+    it('says nothing more about a silent rushd once the client asked it to cancel the request (task 69)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 20_000);
+      renderer.onDaemonUnresponsive({ pid: undefined, silentForMs: 20_000 });
+      advance(clock, 2_000);
+      renderer.onCancelRequested(5_000);
+      renderer.onDaemonUnresponsive({ pid: undefined, silentForMs: 22_000 });
+      renderer.onDaemonResponsive({ pid: undefined, silentForMs: 22_500 });
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build · 20.0s · rushd has not responded for 20s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
+        'rush build · 22.0s · cancelling; waiting up to 5s for rushd to stop the request',
+        'rush build · 47.0s · cancelling; waiting up to 5s for rushd to stop the request'
+      ]);
+    });
   });
 
   it('writes a note between progress lines on a pipe', () => {
@@ -1397,6 +1447,23 @@ describe(AgentProgressRenderer.name, () => {
     renderer.dispose();
   });
 
+  it('shows on a TTY that rushd has not responded, with what to do, until it responds again (task 69)', () => {
+    const { renderer, output, clock } = createRenderer(true, 'build', 200);
+    const firstRow = (text: string): string => text.replace(ANSI_ESCAPE, '').split('\n')[0];
+    renderer.start();
+    clock.ms = 35_000;
+    renderer.onDaemonUnresponsive({ pid: 12345, silentForMs: 30_000 });
+    expect(output).toHaveLength(2);
+    expect(firstRow(output[1])).toMatch(
+      /^. rush build · 35\.0s · rushd \(PID 12345\) has not responded for 30s; its process may be stopped or overloaded\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
+    );
+    clock.ms = 75_200;
+    renderer.onDaemonResponsive({ pid: 12345, silentForMs: 70_200 });
+    expect(output).toHaveLength(3);
+    expect(firstRow(output[2])).toMatch(/^. rush build · 75\.2s · connecting to rushd/);
+    renderer.dispose();
+  });
+
   it('writes a note above the live rows on a TTY and redraws them below it', () => {
     const { renderer, output } = createRenderer(true);
     renderer.start();
diff --git a/apps/rush-cli-client/src/test/daemonSilence.test.ts b/apps/rush-cli-client/src/test/daemonSilence.test.ts
new file mode 100644
index 0000000000..34d8e1a85e
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonSilence.test.ts
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonClientLivenessOptions } from '@rushstack/rush-client-core';
+
+import { createDaemonLivenessOptions } from '../daemonSilence';
+import type { IAgentDaemonSilenceRenderer } from '../daemonSilence';
+
+describe(createDaemonLivenessOptions.name, () => {
+  function createLegacy(rushx: boolean): { liveness: IDaemonClientLivenessOptions; written: string[] } {
+    const written: string[] = [];
+    const liveness: IDaemonClientLivenessOptions = createDaemonLivenessOptions({
+      rushx,
+      agentRenderer: undefined,
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    return { liveness, written };
+  }
+
+  it('writes a line with what to do when rushd stops responding, and one when it responds again', () => {
+    const { liveness, written } = createLegacy(false);
+    liveness.onUnresponsive({ pid: 12345, silentForMs: 30_999 });
+    liveness.onResponsive?.({ pid: 12345, silentForMs: 70_200 });
+    expect(written).toEqual([
+      'rush-client: rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
+      'rush-client: rushd (PID 12345) responded again after 70s.\n'
+    ]);
+  });
+
+  it('names rushx-client, and names no PID when rushd reported none', () => {
+    const { liveness, written } = createLegacy(true);
+    liveness.onUnresponsive({ pid: undefined, silentForMs: 30_000 });
+    liveness.onResponsive?.({ pid: undefined, silentForMs: 31_000 });
+    expect(written).toEqual([
+      'rushx-client: rushd has not responded for 30s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
+      'rushx-client: rushd responded again after 31s.\n'
+    ]);
+  });
+
+  it('leaves both reports to the agent renderer when it is active', () => {
+    const written: string[] = [];
+    const agentRenderer: IAgentDaemonSilenceRenderer = {
+      onDaemonUnresponsive: jest.fn(),
+      onDaemonResponsive: jest.fn()
+    };
+    const liveness: IDaemonClientLivenessOptions = createDaemonLivenessOptions({
+      rushx: false,
+      agentRenderer,
+      writeStderrAsync: async (text: string) => {
+        written.push(text);
+      }
+    });
+    liveness.onUnresponsive({ pid: 41, silentForMs: 30_000 });
+    liveness.onResponsive?.({ pid: 41, silentForMs: 40_000 });
+    expect(agentRenderer.onDaemonUnresponsive).toHaveBeenCalledWith({ pid: 41, silentForMs: 30_000 });
+    expect(agentRenderer.onDaemonResponsive).toHaveBeenCalledWith({ pid: 41, silentForMs: 40_000 });
+    expect(written).toEqual([]);
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
new file mode 100644
index 0000000000..a805d6b5db
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Say when rushd has not responded for 30 s while a command runs (for example because its process was stopped), what that means and how to stop waiting, and say when it responds again. Agent output shows it in the progress line and the status lines.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
new file mode 100644
index 0000000000..496716e992
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add the optional `liveness` check to `executeAsync`: against a 0.13 daemon, the client pings a daemon that sent nothing for 10 s and calls `onUnresponsive` with its PID once it sent nothing for 30 s, then `onResponsive` when it sends something again. Time in the client's own callbacks and stalls of the client's event loop do not count.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t69-nit1_2026-09-29-09-10.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t69-nit1_2026-09-29-09-10.json
new file mode 100644
index 0000000000..8a78c90467
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t69-nit1_2026-09-29-09-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
new file mode 100644
index 0000000000..7fb244f1c6
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Advertise protocol minor 13 (`DAEMON_KEEPALIVE_PROTOCOL_MINOR`): a client may ping while its request runs, and a daemon that is closing the session ignores the ping instead of answering it with a protocol error that could arrive ahead of the request's result.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
new file mode 100644
index 0000000000..07dc9fd53f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t69-daemon-silence_2026-09-29-07-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Ignore a ping that arrives while the session closes, so that the client gets the request's typed result rather than a protocol error.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 87b2c83e44..41f3fb9c97 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -152,6 +152,7 @@ export interface IDaemonClientExecuteOptions {
     readonly cancelOnCtrlC?: boolean;
     // (undocumented)
     readonly initialRawMode?: boolean;
+    readonly liveness?: IDaemonClientLivenessOptions;
     readonly onCancelRequested?: (timeoutMs: number) => void;
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
@@ -169,6 +170,14 @@ export interface IDaemonClientExecuteOptions {
     readonly stdin?: Readable;
 }
 
+// @beta
+export interface IDaemonClientLivenessOptions {
+    readonly onResponsive?: (silence: IDaemonSilence) => void;
+    readonly onUnresponsive: (silence: IDaemonSilence) => void;
+    readonly pingAfterMs?: number;
+    readonly unresponsiveAfterMs?: number;
+}
+
 // @beta
 export interface IDaemonRestartNotice {
     readonly reason: DaemonRestartReason | undefined;
@@ -182,6 +191,12 @@ export interface IDaemonRestartWaitDetails {
     readonly scriptCount?: number;
 }
 
+// @beta
+export interface IDaemonSilence {
+    readonly pid: number | undefined;
+    readonly silentForMs: number;
+}
+
 // @beta
 export interface IDaemonStartCommand {
     // (undocumented)
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 204048a4c7..453f8de5f2 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -67,6 +67,9 @@ export const DAEMON_INTERACTIVE_IO_PROTOCOL_MINOR: number;
 // @beta
 export const DAEMON_INVOCATION_KIND_PROTOCOL_MINOR: number;
 
+// @beta
+export const DAEMON_KEEPALIVE_PROTOCOL_MINOR: number;
+
 // @beta
 export const DAEMON_LIFECYCLE_PROTOCOL_MINOR: number;
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index a3c1d2988e..233fb90267 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -30,6 +30,15 @@ never reasons to replay possibly executed work. Only pre-execution `unsupported`
 acknowledged only after applying them. Input listeners and raw state are restored
 on success, cancellation, disconnect and failure. No resize messages are sent.
 
+The optional `liveness` check tells a caller that the daemon stopped responding while its request runs, for
+example because the daemon's process was stopped. Once the daemon has sent nothing for 10 s (by default), the
+client pings it, with one ping at a time. Once it has sent nothing for 30 s, not even the reply,
+`onUnresponsive` is called with its PID, and `onResponsive` follows if it sends anything again. Time that the
+client spends in its own callbacks does not count, nor does a stall of the client's event loop, for example
+while the client's process was stopped. The check stops when the client asks the daemon to cancel the
+request. It requires 0.13: an older daemon that received a ping while it closed the connection could send a
+protocol error ahead of the request's result.
+
 `executeWithDaemonRestartAsync(readyClient, connectionOptions, executionOptions)`
 retries an explicit `retryAfterRestart: true` result a bounded number of times. Before
 each hand-off it captures the endpoint's PID/start identity, requires protocol 0.10,
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index b79995055f..c78c98d8da 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -6,6 +6,7 @@ import type { Readable } from 'node:stream';
 import {
   DAEMON_INPUT_LIFECYCLE_PROTOCOL_MINOR,
   DAEMON_INVOCATION_KIND_PROTOCOL_MINOR,
+  DAEMON_KEEPALIVE_PROTOCOL_MINOR,
   DAEMON_LIFECYCLE_PROTOCOL_MINOR,
   DAEMON_PROTOCOL_VERSION,
   DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR,
@@ -35,6 +36,10 @@ import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from './DaemonClientEr
 import { adaptDaemonRequestToPeer } from './DaemonRequestEnvironment';
 
 const MAX_STDIN_CHUNK_BYTES: number = 64 * 1024;
+const DEFAULT_PING_AFTER_MS: number = 10_000;
+const DEFAULT_UNRESPONSIVE_AFTER_MS: number = 30_000;
+/** The liveness check looks at least this often, so that it reports a silent daemon at most this late. */
+const MAX_LIVENESS_CHECK_INTERVAL_MS: number = 1000;
 
 /** Options for a fresh connection; readiness includes both hello and ping. @beta */
 export interface IDaemonClientConnectOptions {
@@ -95,6 +100,52 @@ export interface IDaemonClientExecuteOptions {
    * that, the client disconnects without it. Not called for a request that was never sent.
    */
   readonly onCancelRequested?: (timeoutMs: number) => void;
+  /**
+   * Checks that the daemon still responds while the request runs. Daemons older than protocol 0.13 are not
+   * checked. The check stops when the client asks the daemon to cancel the request.
+   */
+  readonly liveness?: IDaemonClientLivenessOptions;
+}
+
+/**
+ * How long a daemon has sent nothing to a request's connection.
+ *
+ * @beta
+ */
+export interface IDaemonSilence {
+  /** The daemon's process ID, when it reported one. */
+  readonly pid: number | undefined;
+  /** How long the daemon has sent nothing, in milliseconds. */
+  readonly silentForMs: number;
+}
+
+/**
+ * A check that the daemon still responds while a request runs. Once the daemon has sent nothing for `pingAfterMs`,
+ * the client pings it, with one ping at a time. Only time in which the client could read what the daemon sent
+ * counts: not time spent in the client's own callbacks, and not time in which the client's event loop stalled, for
+ * example while its process was stopped.
+ *
+ * @beta
+ */
+export interface IDaemonClientLivenessOptions {
+  /** Defaults to 10000 milliseconds. */
+  readonly pingAfterMs?: number;
+  /** Defaults to 30000 milliseconds. */
+  readonly unresponsiveAfterMs?: number;
+  /** Called once the daemon has sent nothing, not even the reply to a ping, for `unresponsiveAfterMs`. */
+  readonly onUnresponsive: (silence: IDaemonSilence) => void;
+  /** Called when the daemon sends something after `onUnresponsive`, with how long it had sent nothing. */
+  readonly onResponsive?: (silence: IDaemonSilence) => void;
+}
+
+/** A running liveness check; see {@link IDaemonClientLivenessOptions}. */
+interface ILivenessCheck {
+  readonly options: IDaemonClientLivenessOptions;
+  readonly pingAfterMs: number;
+  readonly unresponsiveAfterMs: number;
+  readonly intervalMs: number;
+  /** When the check last ran, as a `performance.now()` value. */
+  lastCheckAtMs: number;
 }
 
 /** Only explicit, pre-execution rejections permit in-process fallback. @beta */
@@ -156,11 +207,18 @@ export class DaemonClient {
   #cancelTimer: ReturnType<typeof setTimeout> | undefined;
   #cancelSent: boolean = false;
   #wasInputPaused: boolean = true;
+  #daemonPid: number | undefined;
+  /** When the client last received a frame, or finished handling one, as a `performance.now()` value. */
+  #lastHeardAtMs: number = 0;
+  #frameInFlight: boolean = false;
+  #livenessTimer: ReturnType<typeof setInterval> | undefined;
+  #pingPending: boolean = false;
+  #silenceReported: boolean = false;
 
   private constructor(connection: DaemonFrameConnection, options: IDaemonClientConnectOptions) {
     this.#connection = connection;
     this.#connectOptions = options;
-    connection.onFrame((frame) => this.#onFrameAsync(frame));
+    connection.onFrame((frame) => this.#receiveFrameAsync(frame));
     connection.onClosed((error) => {
       if (this.#shutdown && this.#shutdownAcknowledged && !error) {
         this.#shutdown.resolve(undefined);
@@ -264,6 +322,8 @@ export class DaemonClient {
     options.abortSignal?.addEventListener('abort', cancel, { once: true });
     try {
       validateTimeout(options.cancellationTimeoutMs ?? 5000);
+      validateTimeout(options.liveness?.pingAfterMs ?? DEFAULT_PING_AFTER_MS);
+      validateTimeout(options.liveness?.unresponsiveAfterMs ?? DEFAULT_UNRESPONSIVE_AFTER_MS);
       if (options.stdin?.readableEncoding) {
         throw new Error('Daemon stdin must supply raw bytes; do not use setEncoding().');
       }
@@ -306,6 +366,7 @@ export class DaemonClient {
         };
       }
       this.#result = deferred();
+      this.#startLivenessCheck(options.liveness);
       await Promise.all([
         this.#sendControlAsync({
           kind: 'requestStart',
@@ -316,6 +377,7 @@ export class DaemonClient {
       return await this.#result.promise;
     } finally {
       this.#finished = true;
+      this.#stopLivenessCheck();
       clearTimeout(this.#cancelTimer);
       options.abortSignal?.removeEventListener('abort', cancel);
       this.#stopInput();
@@ -334,6 +396,7 @@ export class DaemonClient {
   #cancel(): void {
     if (this.#cancelSent || this.#finished || !this.#execution) return;
     this.#cancelSent = true;
+    this.#stopLivenessCheck();
     this.#stopInput();
     const timeoutMs: number = this.#execution.cancellationTimeoutMs ?? 5000;
     this.#cancelTimer = setTimeout(() => {
@@ -351,6 +414,70 @@ export class DaemonClient {
     this.#execution.onCancelRequested?.(timeoutMs);
   }
 
+  /** Handles a frame; while it does, the client reads nothing more, so the daemon's silence is not measured. */
+  async #receiveFrameAsync(frame: IDaemonFrame): Promise<void> {
+    const nowMs: number = performance.now();
+    if (this.#silenceReported) {
+      this.#silenceReported = false;
+      this.#execution?.liveness?.onResponsive?.({
+        pid: this.#daemonPid,
+        silentForMs: nowMs - this.#lastHeardAtMs
+      });
+    }
+    this.#frameInFlight = true;
+    try {
+      await this.#onFrameAsync(frame);
+    } finally {
+      this.#frameInFlight = false;
+      this.#lastHeardAtMs = performance.now();
+    }
+  }
+
+  #startLivenessCheck(options: IDaemonClientLivenessOptions | undefined): void {
+    if (!options || this.protocolVersion.minor < DAEMON_KEEPALIVE_PROTOCOL_MINOR) return;
+    const pingAfterMs: number = options.pingAfterMs ?? DEFAULT_PING_AFTER_MS;
+    const unresponsiveAfterMs: number = options.unresponsiveAfterMs ?? DEFAULT_UNRESPONSIVE_AFTER_MS;
+    const check: ILivenessCheck = {
+      options,
+      pingAfterMs,
+      unresponsiveAfterMs,
+      intervalMs: Math.min(MAX_LIVENESS_CHECK_INTERVAL_MS, pingAfterMs, unresponsiveAfterMs),
+      lastCheckAtMs: performance.now()
+    };
+    this.#lastHeardAtMs = check.lastCheckAtMs;
+    this.#livenessTimer = setInterval(() => this.#checkLiveness(check), check.intervalMs);
+    this.#livenessTimer.unref?.();
+  }
+
+  #checkLiveness(check: ILivenessCheck): void {
+    const nowMs: number = performance.now();
+    // A check that runs this late means that the client's own event loop stalled, for example while the process
+    // was stopped. Frames that the daemon sent meanwhile may still wait to be read, so that is not its silence.
+    const stalledMs: number = nowMs - check.lastCheckAtMs - check.intervalMs;
+    check.lastCheckAtMs = nowMs;
+    if (stalledMs > check.intervalMs) {
+      this.#lastHeardAtMs = Math.min(nowMs, this.#lastHeardAtMs + stalledMs);
+    }
+    if (this.#finished || this.#frameInFlight) return;
+    const silentForMs: number = nowMs - this.#lastHeardAtMs;
+    if (silentForMs >= check.pingAfterMs && !this.#pingPending) {
+      this.#pingPending = true;
+      // A send that fails closes the connection, which fails the request.
+      this.#sendControlAsync({ kind: 'ping', payload: {} }).catch(() => undefined);
+    }
+    if (silentForMs >= check.unresponsiveAfterMs && !this.#silenceReported) {
+      this.#silenceReported = true;
+      check.options.onUnresponsive({ pid: this.#daemonPid, silentForMs });
+    }
+  }
+
+  /** Once stopped, the check reports nothing more, not even that the daemon responds again. */
+  #stopLivenessCheck(): void {
+    clearInterval(this.#livenessTimer);
+    this.#livenessTimer = undefined;
+    this.#silenceReported = false;
+  }
+
   async #onFrameAsync(frame: IDaemonFrame): Promise<void> {
     if (frame.kind === DaemonFrameType.controlJson) {
       await this.#onControlAsync(decodeDaemonControlMessage(frame.payload));
@@ -415,9 +542,15 @@ export class DaemonClient {
           `Expected daemon ${expected}, received ${message.payload.daemonVersion ?? 'unknown'}. Stop the old daemon before retrying; no PID was killed.`
         );
       }
+      this.#daemonPid = message.payload.pid;
       this.#ready.resolve(message.payload);
       return;
     }
+    // The reply to the liveness check's ping, which can also arrive after the result.
+    if (message.kind === 'pong' && this.#pingPending) {
+      this.#pingPending = false;
+      return;
+    }
     if (message.kind === 'shutdownAck') {
       if (!this.#shutdown || this.#shutdownAcknowledged) {
         throw new DaemonProtocolError('malformedControlMessage', 'Unexpected shutdown acknowledgement.');
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index 94b6ac9bab..f16290e02d 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -12,7 +12,9 @@ export {
   type DaemonClientOutcome,
   type IDaemonClientConnectOptions,
   type IDaemonClientExecuteOptions,
-  type IDaemonRestartWaitDetails
+  type IDaemonClientLivenessOptions,
+  type IDaemonRestartWaitDetails,
+  type IDaemonSilence
 } from './DaemonClient';
 export { formatDaemonRestartCause, type DaemonRestartRequester } from './DaemonRestartCause';
 export { DaemonClientError, type DaemonClientErrorCode } from './DaemonClientError';
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index fa4c521fa4..6f15e7cfb2 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -4,6 +4,7 @@
 import * as net from 'node:net';
 import { PassThrough } from 'node:stream';
 import {
+  DAEMON_KEEPALIVE_PROTOCOL_MINOR,
   DAEMON_PROTOCOL_VERSION,
   DaemonFrameType,
   decodeDaemonControlMessage,
@@ -18,9 +19,12 @@ import {
 import { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { DaemonClient } from '../DaemonClient';
+import type { IDaemonClientLivenessOptions, IDaemonSilence } from '../DaemonClient';
 import { adaptDaemonRequestToPeer } from '../DaemonRequestEnvironment';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 
+const DAEMON_PID: number = 4242;
+
 describe('DaemonClient', () => {
   let server: net.Server;
   let connection: DaemonFrameConnection | undefined;
@@ -28,6 +32,7 @@ describe('DaemonClient', () => {
   let controls: DaemonControlMessage[];
   let peerVersion: IDaemonProtocolVersion;
   let acknowledgeInput: boolean;
+  let answerPings: boolean;
   let onRequest: (message: DaemonControlMessage) => Promise<void>;
   let onStdin: (bytes: Uint8Array) => Promise<void>;
 
@@ -35,6 +40,7 @@ describe('DaemonClient', () => {
     controls = [];
     peerVersion = DAEMON_PROTOCOL_VERSION;
     acknowledgeInput = true;
+    answerPings = true;
     address =
       process.platform === 'win32'
         ? `\\\\.\\pipe\\rush-client-test-${process.pid}-${Math.random()}`
@@ -59,7 +65,13 @@ describe('DaemonClient', () => {
             payload: { protocolVersion: peerVersion, sessionId: 'test' }
           });
         } else if (message.kind === 'ping') {
-          await sendAsync({ kind: 'pong', payload: { uptimeMs: 1, daemonVersion: 'test' } });
+          // The readiness ping is always answered.
+          if (answerPings || !controls.some((control) => control.kind === 'requestStart')) {
+            await sendAsync({
+              kind: 'pong',
+              payload: { uptimeMs: 1, daemonVersion: 'test', pid: DAEMON_PID }
+            });
+          }
         } else {
           await onRequest(message);
         }
@@ -770,6 +782,244 @@ describe('DaemonClient', () => {
     // A raw Ctrl+C raises no signal, so only the client can say that it cancels.
     expect(cancelRequests).toEqual([5000]);
   });
+
+  describe('liveness check (task 69)', () => {
+    const PING_AFTER_MS: number = 100;
+    const UNRESPONSIVE_AFTER_MS: number = 300;
+
+    function sleepAsync(ms: number): Promise<void> {
+      return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+
+    async function waitForAsync(condition: () => boolean): Promise<void> {
+      while (!condition()) await sleepAsync(5);
+    }
+
+    /** Blocks this thread, and with it the client, as if the client's process was stopped. */
+    function blockThread(ms: number): void {
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    }
+
+    function countPingsAfter(kind: DaemonControlMessage['kind']): number {
+      const index: number = controls.findIndex((message) => message.kind === kind);
+      return index < 0 ? 0 : controls.slice(index).filter((message) => message.kind === 'ping').length;
+    }
+
+    /** Sends later, so that the fake daemon, which reads nothing while it handles a message, still reads. */
+    function sendLater(ms: number, send: () => Promise<void>): void {
+      setTimeout(() => {
+        send().catch(() => undefined);
+      }, ms);
+    }
+
+    function sendResultAsync(requestId: string): Promise<void> {
+      return sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    }
+
+    function sendAbortedResultAsync(requestId: string): Promise<void> {
+      return sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 130, aborted: true, outcome: 'aborted' }
+      });
+    }
+
+    function liveness(overrides: Partial<IDaemonClientLivenessOptions> = {}): IDaemonClientLivenessOptions {
+      return {
+        pingAfterMs: PING_AFTER_MS,
+        unresponsiveAfterMs: UNRESPONSIVE_AFTER_MS,
+        onUnresponsive: () => undefined,
+        ...overrides
+      };
+    }
+
+    it('pings a silent daemon one ping at a time, reports its silence once, and reports when it responds', async () => {
+      answerPings = false;
+      const envelope = request();
+      const unresponsive: IDaemonSilence[] = [];
+      const responsive: IDaemonSilence[] = [];
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = client.executeAsync({
+        request: envelope,
+        liveness: liveness({
+          onUnresponsive: (silence) => unresponsive.push(silence),
+          onResponsive: (silence) => responsive.push(silence)
+        })
+      });
+      // A failed expectation must not leave this rejection to the next test.
+      outcome.catch(() => undefined);
+      await waitForAsync(() => unresponsive.length > 0);
+      await sleepAsync(2 * UNRESPONSIVE_AFTER_MS);
+      expect(countPingsAfter('requestStart')).toBe(1);
+      expect(unresponsive).toEqual([{ pid: DAEMON_PID, silentForMs: expect.any(Number) }]);
+      expect(unresponsive[0].silentForMs).toBeGreaterThanOrEqual(UNRESPONSIVE_AFTER_MS);
+      expect(responsive).toEqual([]);
+      // The daemon answers the ping late, as a stopped daemon does once it continues.
+      await sendAsync({ kind: 'pong', payload: { uptimeMs: 2, pid: DAEMON_PID } });
+      await waitForAsync(() => responsive.length > 0);
+      expect(responsive).toEqual([{ pid: DAEMON_PID, silentForMs: expect.any(Number) }]);
+      expect(responsive[0].silentForMs).toBeGreaterThanOrEqual(unresponsive[0].silentForMs);
+      await sendResultAsync(envelope.requestId);
+      expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    });
+
+    it('does not check a daemon that predates the check', async () => {
+      peerVersion = { major: DAEMON_PROTOCOL_VERSION.major, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR - 1 };
+      answerPings = false;
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') {
+          sendLater(2 * UNRESPONSIVE_AFTER_MS, () => sendResultAsync(envelope.requestId));
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({ request: envelope, liveness: liveness({ onUnresponsive }) })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(countPingsAfter('requestStart')).toBe(0);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it('does not report a daemon that answers its pings while a long request runs', async () => {
+      // 1000 ms, not the file's 300 ms: a check runs every PING_AFTER_MS, so a ping can go out only after about
+      // 2 * PING_AFTER_MS of silence, and a pong that a busy host delays by another PING_AFTER_MS would reach 300 ms.
+      const unresponsiveAfterMs: number = 1000;
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') {
+          sendLater(2 * unresponsiveAfterMs, () => sendResultAsync(envelope.requestId));
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({
+          request: envelope,
+          liveness: liveness({ unresponsiveAfterMs, onUnresponsive })
+        })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      // The request outlasts the silence limit, and only the pongs keep the daemon from counting as silent.
+      expect(countPingsAfter('requestStart')).toBeGreaterThan(1);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it("does not count the time that the client's own callbacks take as the daemon's silence", async () => {
+      answerPings = false;
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind !== 'requestStart') return;
+        await connection!.sendFrameAsync({
+          kind: DaemonFrameType.logStdout,
+          payload: encodeDaemonLogChunk({ operationId: 'op', chunk: Buffer.from('slow') })
+        });
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = await client.executeAsync({
+        request: envelope,
+        onStdoutAsync: async () => {
+          // The daemon sends its result while the client still writes the output before it.
+          await sendResultAsync(envelope.requestId);
+          await sleepAsync(2 * UNRESPONSIVE_AFTER_MS);
+        },
+        liveness: liveness({ onUnresponsive })
+      });
+      expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(countPingsAfter('requestStart')).toBe(0);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it("does not count a stall of the client's own event loop as the daemon's silence", async () => {
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind !== 'requestStart') return;
+        blockThread(2 * UNRESPONSIVE_AFTER_MS);
+        sendLater(PING_AFTER_MS / 2, () => sendResultAsync(envelope.requestId));
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({ request: envelope, liveness: liveness({ onUnresponsive }) })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it('stops checking once the client asks the daemon to cancel the request', async () => {
+      answerPings = false;
+      const abort = new AbortController();
+      const envelope = request();
+      const onUnresponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') abort.abort();
+        if (message.kind === 'requestCancel') {
+          sendLater(2 * UNRESPONSIVE_AFTER_MS, () => sendAbortedResultAsync(envelope.requestId));
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      expect(
+        await client.executeAsync({
+          request: envelope,
+          abortSignal: abort.signal,
+          liveness: liveness({ onUnresponsive })
+        })
+      ).toMatchObject({ kind: 'result', result: { exitCode: 130 } });
+      expect(countPingsAfter('requestCancel')).toBe(0);
+      expect(onUnresponsive).not.toHaveBeenCalled();
+    });
+
+    it('does not report that a silent daemon responds again once the client has asked it to cancel', async () => {
+      answerPings = false;
+      const abort = new AbortController();
+      const envelope = request();
+      const unresponsive: IDaemonSilence[] = [];
+      const onResponsive: jest.Mock = jest.fn();
+      onRequest = async (message) => {
+        if (message.kind === 'requestCancel') {
+          await sendAsync({ kind: 'pong', payload: { uptimeMs: 2, pid: DAEMON_PID } });
+          await sendAbortedResultAsync(envelope.requestId);
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = client.executeAsync({
+        request: envelope,
+        abortSignal: abort.signal,
+        liveness: liveness({ onUnresponsive: (silence) => unresponsive.push(silence), onResponsive })
+      });
+      // A failed expectation must not leave this rejection to the next test.
+      outcome.catch(() => undefined);
+      await waitForAsync(() => unresponsive.length > 0);
+      abort.abort();
+      expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 130 } });
+      expect(onResponsive).not.toHaveBeenCalled();
+    });
+
+    it('accepts the reply to its ping after the result', async () => {
+      answerPings = false;
+      const envelope = request();
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      const outcome = client.executeAsync({ request: envelope, liveness: liveness() });
+      // A failed expectation must not leave this rejection to the next test.
+      outcome.catch(() => undefined);
+      await waitForAsync(() => countPingsAfter('requestStart') > 0);
+      await sendResultAsync(envelope.requestId);
+      await sendAsync({ kind: 'pong', payload: { uptimeMs: 2, pid: DAEMON_PID } });
+      expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    });
+
+    it.each([{ pingAfterMs: 0 }, { unresponsiveAfterMs: 1.5 }, { unresponsiveAfterMs: 0x80000000 }])(
+      'rejects %p before it sends the request',
+      async (durations) => {
+        const client = await DaemonClient.connectAsync({ socketPath: address });
+        await expect(
+          client.executeAsync({ request: request(), liveness: liveness(durations) })
+        ).rejects.toThrow(RangeError);
+        expect(controls.some((message) => message.kind === 'requestStart')).toBe(false);
+      }
+    );
+  });
 });
 
 it('captures an immutable request snapshot without undefined environment entries', () => {
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index 79020f33f8..e880561d58 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -74,6 +74,10 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   unmeasured runners, pressure and cleanup diagnostics. Child RSS is a last-completion sample, not a
   process-tree ceiling. Nested records and numeric fields are validated. Older pong shapes remain valid;
   this additive field does not change the 0.9 request, generation-fencing or retry contracts.
+- **Keepalive (0.13)** - a client may `ping` while its request runs, to learn whether the daemon still
+  responds, and gets a `pong` as before. A daemon that is closing the session ignores a `ping` rather than
+  answering it with a protocol `error`, which could reach the client ahead of the request's typed result.
+  Clients must negotiate `DAEMON_KEEPALIVE_PROTOCOL_MINOR` before they ping during a request.
 
 Part of the Rush 6 / rushd re-architecture:
 [microsoft/rushstack#5894](https://github.com/microsoft/rushstack/issues/5894).
diff --git a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
index 37a661c978..1a67644dcf 100644
--- a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
@@ -35,6 +35,13 @@ export const DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR: number = 11;
  */
 export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number = 12;
 
+/**
+ * The first protocol minor whose daemons ignore a `ping` that arrives while the connection closes, rather than
+ * failing the connection with a protocol error that could reach the client before the request's result. From this
+ * minor on, a client may ping the daemon at any time while a request runs, to learn whether it still responds. @beta
+ */
+export const DAEMON_KEEPALIVE_PROTOCOL_MINOR: number = 13;
+
 /**
  * A rushd wire protocol version.
  *
@@ -68,7 +75,7 @@ export interface IDaemonProtocolVersion {
  */
 export const DAEMON_PROTOCOL_VERSION: IDaemonProtocolVersion = {
   major: 0,
-  minor: DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR
+  minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR
 };
 
 /**
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 648d0cf50a..2ab27cba03 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -26,7 +26,7 @@ export { DAEMON_GRAPH_GENERATION_PROTOCOL_MINOR } from './DaemonProtocolVersion'
 export { DAEMON_INPUT_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_INTERACTIVE_IO_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_INVOCATION_KIND_PROTOCOL_MINOR } from './DaemonProtocolVersion';
-export { DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
+export { DAEMON_KEEPALIVE_PROTOCOL_MINOR, DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR, DAEMON_PROTOCOL_VERSION } from './DaemonProtocolVersion';
 export { DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR } from './DaemonProtocolVersion';
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 296a3b3410..0f1d7b3d6b 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -156,6 +156,9 @@ export class DaemonControlSession {
 
   async #onFrameAsync(frame: IDaemonFrame): Promise<void> {
     if (this.#isClosing) {
+      // A client may ping at any time while its request runs. The request's own result, or the closed connection,
+      // answers it; an error sent now could reach the client before that result.
+      if (isPingFrame(frame)) return;
       throw new DaemonProtocolError('malformedControlMessage', 'The daemon session is closing.');
     }
     if (frame.kind === DaemonFrameType.stdin) {
@@ -598,6 +601,12 @@ function describeRequest(envelope: IDaemonRequestEnvelope): string {
     : `"${command}"`;
 }
 
+function isPingFrame(frame: IDaemonFrame): boolean {
+  return (
+    frame.kind === DaemonFrameType.controlJson && decodeDaemonControlMessage(frame.payload).kind === 'ping'
+  );
+}
+
 function writeShutdownResultAsync(
   requestId: string,
   state: IRequestState,
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
index e570988009..70899f1485 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
@@ -5,7 +5,11 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
-import { DaemonFrameType, decodeDaemonLogChunk } from '@rushstack/rush-daemon-protocol';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  decodeDaemonLogChunk
+} from '@rushstack/rush-daemon-protocol';
 import type { DaemonControlMessage, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
 import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
@@ -26,6 +30,8 @@ const DAEMON_VERSION: string = 'wire-test';
 const RUSH_VERSION: string = '5.178.1';
 const INPUT_BYTE: number = 0xff;
 const WAIT_TIMEOUT_MS: number = 20;
+/** Long enough for the daemon to read a ping from a local socket. */
+const PING_READ_WAIT_MS: number = 100;
 const FAILURE_EXIT_CODE: number = 7;
 const testRepoRoots: Set<string> = new Set();
 
@@ -349,6 +355,60 @@ describe('daemon global request wire integration', () => {
     }
   });
 
+  it('ignores a ping that arrives while a shutdown stops a running request, and still sends its result', async () => {
+    const repoRoot: string = createRepoRoot();
+    const started: IDeferred<void> = createDeferred<void>();
+    const aborted: IDeferred<void> = createDeferred<void>();
+    const releaseAborted: IDeferred<void> = createDeferred<void>();
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async () => {
+      const executorAsync: GlobalCommandExecutor = async (context) => {
+        started.resolve();
+        if (!context.abortSignal.aborted) {
+          await new Promise((resolve) =>
+            context.abortSignal.addEventListener('abort', resolve, { once: true })
+          );
+        }
+        aborted.resolve();
+        await releaseAborted.promise;
+        return { exitCode: 0 };
+      };
+      return { executor: executorAsync, kind: 'global' };
+    });
+    const errors: Error[] = [];
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      ...createHostOptions(repoRoot, resolver),
+      onError: (error: Error) => errors.push(error)
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host);
+    try {
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('keepalive', 'custom', repoRoot)
+      });
+      await started.promise;
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'controlClient' })
+      );
+      // The shutdown marks the session closing and aborts the request; the session then waits for its result.
+      await aborted.promise;
+      await client.sendControlAsync({ kind: 'ping', payload: {} });
+      await new Promise((resolve) => setTimeout(resolve, PING_READ_WAIT_MS));
+      releaseAborted.resolve();
+      const exchange: ITerminalExchange = await client.readTerminalAsync('keepalive');
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { aborted: true, requestId: 'keepalive' }
+      });
+      expect(readControlKinds(exchange)).not.toContain('error');
+      await closePromise;
+      expect(errors).toEqual([]);
+    } finally {
+      releaseAborted.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
   it('rejects a second active request on one connection without cancelling the first', async () => {
     const repoRoot: string = createRepoRoot();
     const started: IDeferred<void> = createDeferred<void>();
@@ -476,3 +536,9 @@ function readLogText(exchange: ITerminalExchange): string {
     .map((frame) => new TextDecoder().decode(decodeDaemonLogChunk(frame.payload).chunk))
     .join('');
 }
+
+function readControlKinds(exchange: ITerminalExchange): string[] {
+  return exchange.frames
+    .filter((frame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame) => decodeDaemonControlMessage(frame.payload).kind);
+}

From 5e396c38ade4a4dc3efbea29996732bcd9133e6f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 142/265] [rush-lib] Queue a watch iteration when an IPC runner
 requests a run

Swarm integration step 127; original commit c696721977 (merge of swarm/r01-t216 at 71843caf92).
Scope: task 216.

Brings 216 (branch swarm/r01-t216). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 12 of 20. Gate: ch01 GATE OK board 4947 (tree 262b9b852a)

Commits folded into this step (1):
- 71843caf92 [rush-lib] Queue a watch iteration when an IPC runner requests a run

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...6-watch-run-requests_2026-09-29-09-15.json |  11 +
 .../rush-lib/src/logic/ProjectWatcher.ts      | 180 +++++-
 .../src/logic/test/ProjectWatcher.test.ts     | 600 ++++++++++++++++++
 3 files changed, 786 insertions(+), 5 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r01-t216-watch-run-requests_2026-09-29-09-15.json
 create mode 100644 libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-r01-t216-watch-run-requests_2026-09-29-09-15.json b/common/changes/@microsoft/rush/swarm-r01-t216-watch-run-requests_2026-09-29-09-15.json
new file mode 100644
index 0000000000..64eed04dd7
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r01-t216-watch-run-requests_2026-09-29-09-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue in watch mode where an IPC operation runner's request to run its operation again, such as a request from `heft run-watch`, did not queue a new iteration, so the operation waited for the next file change. Watch mode now queues an iteration for the request, or, if the request arrives during an iteration that does not run the operation after the request, queues one when that iteration ends.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/ProjectWatcher.ts b/libraries/rush-lib/src/logic/ProjectWatcher.ts
index 9fccfcb0c9..3d700cdc1a 100644
--- a/libraries/rush-lib/src/logic/ProjectWatcher.ts
+++ b/libraries/rush-lib/src/logic/ProjectWatcher.ts
@@ -15,6 +15,7 @@ import type { IInputsSnapshot } from './incremental/InputsSnapshot';
 import type { RushConfiguration } from '../api/RushConfiguration';
 import type { RushConfigurationProject } from '../api/RushConfigurationProject';
 import type { IOperationGraph, IOperationGraphIterationOptions } from './operations/IOperationGraph';
+import type { IOperationExecutionResult } from './operations/IOperationExecutionResult';
 import type { Operation } from './operations/Operation';
 import { OperationStatus } from './operations/OperationStatus';
 
@@ -59,9 +60,37 @@ const KEYBIND_HELP: string =
   `[${KEY_CLOSE_RUNNERS}]close-runners [${KEY_DEBUG}]debug [${KEY_VERBOSE}]verbose ` +
   `[${KEY_PAUSE_RESUME}]pause/resume [${KEY_BUILD}]build [${KEY_PARALLELISM_UP}/${KEY_PARALLELISM_DOWN}]parallelism`;
 
+/**
+ * The invalidation reason of the `i` keybind (and of rush-serve-plugin's `invalidate` command). It only marks
+ * operations as stale; a separate build command runs them. Any other invalidation, such as an IPC runner's
+ * `requestRun`, asks for the operations to run again, so the watcher queues an iteration for it.
+ */
+const MANUAL_INVALIDATION_REASON: 'manual-invalidation' = 'manual-invalidation';
+
+/**
+ * The statuses of an execution record that has not started executing in its iteration.
+ */
+const NOT_STARTED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Waiting,
+  OperationStatus.Ready,
+  OperationStatus.Queued
+]);
+
+/**
+ * An operation's request to run again, kept until an iteration that could serve it has finished.
+ */
+interface IRunRequest {
+  readonly reason: string | undefined;
+  /**
+   * The id of the first iteration whose run of the operation starts after the request.
+   */
+  readonly servedByIterationId: number;
+}
+
 /**
  * Watches a set of projects in the repository for file changes and triggers
- * rebuild iterations on the operation graph.
+ * rebuild iterations on the operation graph. Also queues an iteration when an operation
+ * asks to run again, for example when an IPC runner's process sends `requestRun`.
  *
  * Uses `fs.watch()` rather than `chokidar` because only a boolean "something changed"
  * signal is needed; actual change detection is deferred to `getInputsSnapshotAsync`.
@@ -84,6 +113,17 @@ export class ProjectWatcher {
   #stdinListening: boolean = false;
   #stdinHadRawMode: boolean | undefined;
   #onStdinDataBound: ((chunk: Buffer | string) => void) | undefined;
+  /**
+   * The records of the iteration that most recently started executing, until the graph next goes idle.
+   */
+  #iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+  #lastIterationId: number = 0;
+  readonly #runRequests: Map<Operation, IRunRequest> = new Map();
+  /**
+   * What the pending debounce will queue an iteration for.
+   */
+  #hasQueuedFileChange: boolean = false;
+  readonly #queuedRunRequests: Set<string> = new Set();
 
   public constructor(options: IProjectWatcherOptions) {
     const {
@@ -111,24 +151,43 @@ export class ProjectWatcher {
     graph.hooks.beforeExecuteIterationAsync.tapPromise(
       'ProjectWatcher',
       async (
-        records: ReadonlyMap<Operation, unknown>,
+        records: ReadonlyMap<Operation, IOperationExecutionResult>,
         iterationOptions: IOperationGraphIterationOptions
       ): Promise<void> => {
         this.clearStatus();
         this.#lastSnapshot = iterationOptions.inputsSnapshot;
+        this.#iterationRecords = records;
+        const firstRecord: IOperationExecutionResult | undefined = records.values().next().value;
+        this.#lastIterationId = firstRecord?.iterationId ?? this.#lastIterationId;
+        // This iteration serves the file changes and run requests that were waiting to queue one.
+        this.#clearDebounce();
         await this.#stopWatchingAsync();
       }
     );
 
     // Start watching once execution loop enters waiting state
     graph.hooks.onIdle.tap('ProjectWatcher', () => {
+      const iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined =
+        this.#iterationRecords;
+      this.#iterationRecords = undefined;
       this.#startWatching();
+      if (iterationRecords) {
+        this.#requeueUnservedRunRequests(iterationRecords);
+      }
     });
 
+    graph.hooks.onInvalidateOperations.tap(
+      'ProjectWatcher',
+      (operations: Iterable<Operation>, reason: string | undefined) => {
+        this.#onInvalidateOperations(operations, reason);
+      }
+    );
+
     // Dispose stdin listener when session aborts
     graph.abortController.signal.addEventListener(
       'abort',
       () => {
+        this.#clearDebounce();
         this.#disposeStdin();
       },
       { once: true }
@@ -301,17 +360,47 @@ export class ProjectWatcher {
     if (fileName === '.git' || fileName === 'node_modules') {
       return;
     }
+    this.#hasQueuedFileChange = true;
+    this.#debounce();
+  }
+
+  /**
+   * Queues an iteration after `debounceMs` without further file changes or run requests.
+   */
+  #debounce(): void {
+    if (this.#graph.abortController.signal.aborted) {
+      // The watch session has ended.
+      return;
+    }
     if (this.#debounceHandle) {
       clearTimeout(this.#debounceHandle);
     }
     this.#debounceHandle = setTimeout(() => this.#scheduleIteration(), this.#debounceMs);
   }
 
+  #clearDebounce(): void {
+    if (this.#debounceHandle) {
+      clearTimeout(this.#debounceHandle);
+      this.#debounceHandle = undefined;
+    }
+    this.#hasQueuedFileChange = false;
+    this.#queuedRunRequests.clear();
+  }
+
   /**
-   * Schedules a new execution iteration on the graph in response to detected file changes.
+   * Schedules a new execution iteration on the graph in response to detected file changes
+   * or run requests.
    */
   #scheduleIteration(): void {
-    this.#setStatus('File change detected. Queuing new iteration...');
+    this.#debounceHandle = undefined;
+    const runRequests: string[] = Array.from(this.#queuedRunRequests);
+    const status: string =
+      runRequests.length > 0 && !this.#hasQueuedFileChange
+        ? `Run requested by ${runRequests.join(', ')}. Queuing new iteration...`
+        : 'File change detected. Queuing new iteration...';
+    this.#hasQueuedFileChange = false;
+    this.#queuedRunRequests.clear();
+    this.#setStatus(status);
     this.#graph
       .scheduleIterationAsync({})
       .catch((e: unknown) =>
@@ -319,6 +408,87 @@ export class ProjectWatcher {
       );
   }
 
+  /**
+   * Records operations that asked to run again. While the graph is idle, queues an iteration for them.
+   * During an iteration, waits until the graph goes idle to check whether the iteration served them.
+   */
+  #onInvalidateOperations(operations: Iterable<Operation>, reason: string | undefined): void {
+    if (reason === MANUAL_INVALIDATION_REASON) {
+      return;
+    }
+    const isIdle: boolean = !this.#iterationRecords;
+    for (const operation of operations) {
+      this.#runRequests.set(operation, {
+        reason,
+        servedByIterationId: this.#getServingIterationId(operation)
+      });
+      if (isIdle) {
+        this.#queuedRunRequests.add(reason ? `${operation.name} [${reason}]` : operation.name);
+      }
+    }
+    if (isIdle) {
+      this.#debounce();
+    }
+  }
+
+  /**
+   * Returns the id of the first iteration whose run of the operation would start after a request made now.
+   */
+  #getServingIterationId(operation: Operation): number {
+    const record: IOperationExecutionResult | undefined = this.#iterationRecords?.get(operation);
+    // A record that is already committed has finished, even if a deferred invalidation has reset it to Ready.
+    const hasStarted: boolean =
+      !record ||
+      !NOT_STARTED_STATUSES.has(record.status) ||
+      this.#graph.resultByOperation.get(operation) === record;
+    return hasStarted ? this.#lastIterationId + 1 : this.#lastIterationId;
+  }
+
+  /**
+   * Called when the graph goes idle after an iteration. Queues another iteration for each run request that
+   * the iteration did not serve. The graph marks an invalidated operation's committed result as Ready, but
+   * an iteration that was already running the operation then commits a newer result over it, so such a
+   * request is invalidated again here.
+   */
+  #requeueUnservedRunRequests(iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>): void {
+    const graph: IOperationGraph = this.#graph;
+    // Operations whose result predates the request. They must be marked as stale again.
+    const outdatedOperationsByReason: Map<string | undefined, Operation[]> = new Map();
+    // Operations with no result, or whose result is still marked as stale. The next iteration runs them.
+    const readyOperationsByReason: Map<string | undefined, Operation[]> = new Map();
+    for (const [operation, { reason, servedByIterationId }] of this.#runRequests) {
+      const result: IOperationExecutionResult | undefined = graph.resultByOperation.get(operation);
+      const unmarkedResult: IOperationExecutionResult | undefined =
+        result?.status === OperationStatus.Ready ? undefined : result;
+      if (unmarkedResult && unmarkedResult.iterationId >= servedByIterationId) {
+        continue;
+      }
+      const record: IOperationExecutionResult | undefined = iterationRecords.get(operation);
+      if (record?.enabled && record.iterationId >= servedByIterationId) {
+        // The operation was selected to run after the request, but did not produce a result, for example
+        // because a dependency failed or the iteration was aborted. Do not retry it.
+        continue;
+      }
+      const operationsByReason: Map<string | undefined, Operation[]> = unmarkedResult
+        ? outdatedOperationsByReason
+        : readyOperationsByReason;
+      let group: Operation[] | undefined = operationsByReason.get(reason);
+      if (!group) {
+        group = [];
+        operationsByReason.set(reason, group);
+      }
+      group.push(operation);
+    }
+    this.#runRequests.clear();
+    for (const [reason, operations] of outdatedOperationsByReason) {
+      // Fires onInvalidateOperations, which records the request again and queues an iteration.
+      graph.invalidateOperations(operations, reason);
+    }
+    for (const [reason, operations] of readyOperationsByReason) {
+      this.#onInvalidateOperations(operations, reason);
+    }
+  }
+
   /**
    * Sets up a raw-mode stdin listener so the user can interact with the watch session
    * via single-key keybinds. Captures the previous raw-mode state for restoration on dispose.
@@ -397,7 +567,7 @@ export class ProjectWatcher {
           break;
         }
         case KEY_INVALIDATE: {
-          graph.invalidateOperations(undefined, 'manual-invalidation');
+          graph.invalidateOperations(undefined, MANUAL_INVALIDATION_REASON);
           this.#setStatus('All operations invalidated');
           break;
         }
diff --git a/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts b/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
new file mode 100644
index 0000000000..d3bf5a4d47
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
@@ -0,0 +1,600 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+type MockFsListener = (eventType: string, fileName: string) => void;
+
+// The listeners of the watcher's open file system watchers, so that tests can simulate file changes.
+const mockFsListeners: Set<MockFsListener> = new Set();
+
+jest.mock('node:fs', () => {
+  const actual: typeof import('node:fs') = jest.requireActual('node:fs');
+  const { EventEmitter } = jest.requireActual<typeof import('node:events')>('node:events');
+  class MockFsWatcher extends EventEmitter {
+    readonly #listener: MockFsListener;
+    public constructor(listener: MockFsListener) {
+      super();
+      this.#listener = listener;
+      mockFsListeners.add(listener);
+    }
+    public close(): void {
+      mockFsListeners.delete(this.#listener);
+      this.emit('close');
+    }
+    public unref(): this {
+      return this;
+    }
+  }
+  return {
+    ...actual,
+    watch: jest.fn(
+      (watchedPath: string, options: unknown, listener: MockFsListener) => new MockFsWatcher(listener)
+    )
+  };
+});
+jest.mock('@rushstack/package-deps-hash', () => {
+  const actual: typeof import('@rushstack/package-deps-hash') = jest.requireActual(
+    '@rushstack/package-deps-hash'
+  );
+  return { ...actual, getRepoRoot: () => '/repo' };
+});
+jest.mock('../Git', () => ({
+  Git: class {
+    public getGitPathOrThrow(): string {
+      return 'git';
+    }
+  }
+}));
+jest.mock('../operations/OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../operations/ProjectLogWritable', () => {
+  const actual: typeof import('../operations/ProjectLogWritable') = jest.requireActual(
+    '../operations/ProjectLogWritable'
+  );
+  const { TerminalWritable } =
+    jest.requireActual<typeof import('@rushstack/terminal')>('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { setTimeout as sleepAsync } from 'node:timers/promises';
+
+import { AnsiEscape, MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { IPhase } from '../../api/CommandLineConfiguration';
+import type { RushConfiguration } from '../../api/RushConfiguration';
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import type { IOperationRunner, IOperationRunnerContext } from '../operations/IOperationRunner';
+import type { IOperationExecutionResult } from '../operations/IOperationExecutionResult';
+import { Operation } from '../operations/Operation';
+import { OperationGraph } from '../operations/OperationGraph';
+import { OperationStatus } from '../operations/OperationStatus';
+import { ProjectWatcher } from '../ProjectWatcher';
+
+const DEBOUNCE_MS: number = 10;
+const REQUESTOR: string = 'test-requestor';
+
+// The statuses of a result that PhasedOperationPlugin keeps if the operation's inputs did not change.
+const RETAINED_STATUSES: ReadonlySet<OperationStatus> = new Set([
+  OperationStatus.Success,
+  OperationStatus.FromCache,
+  OperationStatus.NoOp,
+  OperationStatus.Skipped
+]);
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+type TestRunnerAction = (runCount: number) => Promise<OperationStatus | void> | OperationStatus | void;
+
+/**
+ * Like an IPC runner, keeps the invalidate callback of its first run to request more runs.
+ */
+class TestRunner implements IOperationRunner {
+  public readonly name: string;
+  public readonly cacheable: boolean = false;
+  public readonly reportTiming: boolean = true;
+  public readonly silent: boolean = false;
+  public readonly warningsAreAllowed: boolean = false;
+  public runCount: number = 0;
+  public action: TestRunnerAction | undefined;
+  #invalidate: ((reason: string) => void) | undefined;
+
+  public constructor(name: string) {
+    this.name = name;
+  }
+
+  public requestRun(): void {
+    if (!this.#invalidate) {
+      throw new Error(`${this.name} has not run yet`);
+    }
+    this.#invalidate(REQUESTOR);
+  }
+
+  public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    this.runCount++;
+    this.#invalidate ??= context.getInvalidateCallback();
+    return (await this.action?.(this.runCount)) || OperationStatus.Success;
+  }
+
+  public getConfigHash(): string {
+    return 'test';
+  }
+}
+
+interface ITestOperation {
+  operation: Operation;
+  runner: TestRunner;
+}
+
+function createOperation(name: string): ITestOperation {
+  const runner: TestRunner = new TestRunner(name);
+  const operation: Operation = new Operation({
+    runner,
+    phase: mockPhase,
+    project: { packageName: name, projectFolder: `/repo/${name}` } as unknown as RushConfigurationProject,
+    logFilenameIdentifier: name
+  });
+  return { operation, runner };
+}
+
+interface IWatchSession {
+  readonly graph: OperationGraph;
+  readonly abortController: AbortController;
+  readonly terminalProvider: StringBufferTerminalProvider;
+  /**
+   * The session has settled when nothing changes for this long.
+   */
+  readonly settleMs: number;
+  /**
+   * The names of the operations that each executed iteration enabled.
+   */
+  readonly iterations: string[][];
+  /**
+   * Operations to run in the next iteration even if their last result is current, as if their files changed.
+   */
+  readonly dirty: Set<Operation>;
+  idleCount: number;
+  watcher?: ProjectWatcher;
+}
+
+const sessions: IWatchSession[] = [];
+
+function createWatchSession(operations: Operation[], debounceMs: number = DEBOUNCE_MS): IWatchSession {
+  const abortController: AbortController = new AbortController();
+  const graph: OperationGraph = new OperationGraph(new Set(operations), {
+    quietMode: true,
+    debugMode: false,
+    parallelism: 2,
+    allowOversubscription: true,
+    destinations: [new MockWritable()],
+    abortController,
+    isWatch: true
+  });
+  const session: IWatchSession = {
+    graph,
+    abortController,
+    terminalProvider: new StringBufferTerminalProvider(),
+    settleMs: debounceMs * 10,
+    iterations: [],
+    dirty: new Set(),
+    idleCount: 0
+  };
+  sessions.push(session);
+
+  // Like PhasedOperationPlugin, runs the operations whose last result is not current.
+  graph.hooks.configureIteration.tap('test', (currentStates, lastStates) => {
+    for (const [operation, currentState] of currentStates) {
+      const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
+      currentState.enabled =
+        !lastState || !RETAINED_STATUSES.has(lastState.status) || session.dirty.has(operation);
+    }
+    session.dirty.clear();
+  });
+  graph.hooks.beforeExecuteIterationAsync.tap('test', (records) => {
+    const enabled: string[] = [];
+    for (const [operation, record] of records) {
+      if (record.enabled) {
+        enabled.push(operation.name);
+      }
+    }
+    session.iterations.push(enabled);
+  });
+  graph.hooks.onIdle.tap('test', () => {
+    session.idleCount++;
+  });
+
+  session.watcher = new ProjectWatcher({
+    graph,
+    debounceMs,
+    rushConfiguration: {
+      rushJsonFolder: '/repo',
+      commonRushConfigFolder: '/repo/common/config/rush'
+    } as unknown as RushConfiguration,
+    terminal: new Terminal(session.terminalProvider),
+    renderStatusInPlace: false,
+    initialSnapshot: {
+      getTrackedFileHashesForOperation: () => undefined
+    } as unknown as IInputsSnapshot
+  });
+  return session;
+}
+
+function getSessionState(session: IWatchSession): string {
+  const { graph, iterations, idleCount } = session;
+  return `${iterations.length}/${idleCount}/${graph.status}/${graph.hasScheduledIteration}`;
+}
+
+/**
+ * Waits until the session is idle and stays unchanged, including any debounced iteration.
+ */
+async function settleAsync(session: IWatchSession): Promise<void> {
+  let lastState: string | undefined;
+  for (let i: number = 0; i < 30; i++) {
+    await sleepAsync(session.settleMs);
+    const state: string = getSessionState(session);
+    if (
+      state === lastState &&
+      session.graph.status !== OperationStatus.Executing &&
+      !session.graph.hasScheduledIteration
+    ) {
+      return;
+    }
+    lastState = state;
+  }
+  throw new Error(`The watch session did not settle; it ran ${session.iterations.length} iterations`);
+}
+
+async function startWatchSessionAsync(session: IWatchSession): Promise<void> {
+  await session.graph.executeAsync({});
+  await settleAsync(session);
+}
+
+function simulateFileChange(): void {
+  for (const listener of mockFsListeners) {
+    listener('change', 'index.ts');
+  }
+}
+
+/**
+ * Returns the statuses that the watcher printed, without the mode label.
+ */
+function getStatuses(session: IWatchSession): string[] {
+  const output: string = AnsiEscape.removeCodes(
+    session.terminalProvider.getOutput({ normalizeSpecialCharacters: false })
+  );
+  const statuses: string[] = [];
+  for (const line of output.split('\n')) {
+    const index: number = line.indexOf('Watch Status: ');
+    if (index >= 0) {
+      statuses.push(line.slice(index + 'Watch Status: '.length));
+    }
+  }
+  return statuses;
+}
+
+function getRequestStatus(...names: string[]): string {
+  return `Run requested by ${names.map((name) => `${name} [${REQUESTOR}]`).join(', ')}. Queuing new iteration...`;
+}
+
+describe(ProjectWatcher.name, () => {
+  afterEach(() => {
+    for (const session of sessions.splice(0)) {
+      session.abortController.abort();
+    }
+    mockFsListeners.clear();
+  });
+
+  it('queues an iteration when an operation requests a run while the graph is idle', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+    // Without a request or a file change, nothing else runs.
+    expect(session.iterations).toEqual([['a', 'b']]);
+
+    a.runner.requestRun();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+    expect(b.runner.runCount).toBe(1);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      getRequestStatus('a'),
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('reruns an operation that requests a run after it completed in the executing iteration', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // b is still running when a's result is written and a requests another run.
+    b.runner.action = async (runCount: number) => {
+      if (runCount === 1) {
+        while (session.graph.resultByOperation.get(a.operation)?.status !== OperationStatus.Success) {
+          await sleepAsync(1);
+        }
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+    expect(b.runner.runCount).toBe(1);
+  });
+
+  it('reruns an operation that requests a run while it is executing', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    a.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a'], ['a'], ['a']]);
+    expect(a.runner.runCount).toBe(3);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      'File change detected. Queuing new iteration...',
+      'Waiting for changes...',
+      getRequestStatus('a'),
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('reruns an operation that requests a run after it executed but before its result is written', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    session.graph.hooks.afterExecuteOperationAsync.tap('test', (record) => {
+      if (record.operation === a.operation && a.runner.runCount === 2) {
+        a.runner.requestRun();
+      }
+    });
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a'], ['a'], ['a']]);
+    expect(a.runner.runCount).toBe(3);
+  });
+
+  it('does not rerun an operation that requests a run before it starts in the executing iteration', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // a waits for b, so it starts after the request.
+    b.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    session.dirty.add(b.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+    expect(a.runner.runCount).toBe(2);
+  });
+
+  it('reruns an operation that requests a run during an iteration that does not include it', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // a is not part of the second iteration, and has not been skipped yet when it requests a run.
+    b.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(b.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['b'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+    expect(b.runner.runCount).toBe(2);
+  });
+
+  it('does not rerun an operation that a failed dependency blocked after its request', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+
+    b.runner.action = () => OperationStatus.Failure;
+    session.dirty.add(b.operation);
+    a.runner.requestRun();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+    expect(a.runner.runCount).toBe(1);
+    expect(b.runner.runCount).toBe(2);
+  });
+
+  it('queues one iteration for the requests and file changes within the debounce interval', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+
+    a.runner.requestRun();
+    b.runner.requestRun();
+    await settleAsync(session);
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+
+    a.runner.requestRun();
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a', 'b'], ['a']]);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      getRequestStatus('a', 'b'),
+      'Waiting for changes...',
+      'File change detected. Queuing new iteration...',
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('does not rerun an operation whose request an earlier iteration served', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    a.operation.addDependency(b.operation);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    // a waits for b, so it starts after the request.
+    b.runner.action = (runCount: number) => {
+      if (runCount === 2) {
+        a.runner.requestRun();
+      }
+    };
+    // Queues a third iteration, which does not include a. It starts without the graph going idle in between.
+    session.graph.hooks.afterExecuteIterationAsync.tapPromise('test', async (status: OperationStatus) => {
+      if (session.iterations.length === 2 && !session.graph.hasScheduledIteration) {
+        session.dirty.add(b.operation);
+        await session.graph.scheduleIterationAsync({});
+      }
+      return status;
+    });
+    await startWatchSessionAsync(session);
+
+    session.dirty.add(a.operation);
+    session.dirty.add(b.operation);
+    simulateFileChange();
+    await settleAsync(session);
+
+    expect(session.iterations).toEqual([['a', 'b'], ['a', 'b'], ['b']]);
+    expect(session.idleCount).toBe(2);
+    expect(a.runner.runCount).toBe(2);
+  });
+
+  it('serves a pending request with an iteration that starts before the debounce interval ends', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation], DEBOUNCE_MS * 5);
+    await startWatchSessionAsync(session);
+
+    a.runner.requestRun();
+    // Like the build keybind.
+    await session.graph.scheduleIterationAsync({});
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a', 'b'], ['a']]);
+
+    b.runner.requestRun();
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a', 'b'], ['a'], ['b']]);
+    expect(getStatuses(session)).toEqual([
+      'Waiting for changes...',
+      'Waiting for changes...',
+      getRequestStatus('b'),
+      'Waiting for changes...'
+    ]);
+  });
+
+  it('queues one iteration for a request while the watch is paused', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    await startWatchSessionAsync(session);
+
+    session.graph.pauseNextIteration = true;
+    a.runner.requestRun();
+    await sleepAsync(session.settleMs * 2);
+    expect(session.graph.hasScheduledIteration).toBe(true);
+    expect(session.iterations).toEqual([['a']]);
+    expect(getStatuses(session)).toEqual(['Waiting for changes...', getRequestStatus('a')]);
+
+    session.graph.pauseNextIteration = false;
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a'], ['a']]);
+    expect(a.runner.runCount).toBe(2);
+  });
+
+  it('does not queue an iteration for a manual invalidation', async () => {
+    const a: ITestOperation = createOperation('a');
+    const b: ITestOperation = createOperation('b');
+    const session: IWatchSession = createWatchSession([a.operation, b.operation]);
+    await startWatchSessionAsync(session);
+
+    session.graph.invalidateOperations(undefined, 'manual-invalidation');
+    await settleAsync(session);
+    expect(session.iterations).toEqual([['a', 'b']]);
+
+    // The invalidated operations run in the next iteration.
+    simulateFileChange();
+    await settleAsync(session);
+    expect(session.iterations).toEqual([
+      ['a', 'b'],
+      ['a', 'b']
+    ]);
+  });
+
+  it('does not queue an iteration for a request after the watch session ends', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    await startWatchSessionAsync(session);
+
+    session.abortController.abort();
+    a.runner.requestRun();
+    await sleepAsync(session.settleMs);
+
+    expect(session.graph.hasScheduledIteration).toBe(false);
+    expect(getStatuses(session)).toEqual(['Waiting for changes...']);
+  });
+
+  it('does not queue an iteration for a pending request when the watch session ends', async () => {
+    const a: ITestOperation = createOperation('a');
+    const session: IWatchSession = createWatchSession([a.operation]);
+    await startWatchSessionAsync(session);
+
+    a.runner.requestRun();
+    session.abortController.abort();
+    await sleepAsync(session.settleMs);
+
+    expect(session.graph.hasScheduledIteration).toBe(false);
+    expect(getStatuses(session)).toEqual(['Waiting for changes...']);
+  });
+});

From 3e7936cdfdcaf877e6814b12e611ffc9ef4e3b5a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 143/265] [rush-client-core] Move task 214's new tests so that
 they merge with other batch E changes

Swarm integration step 128; original commit 353f68cdae (merge of swarm/r06-t214 at 5f5b0f8f52).
Scope: task 214.

Brings 214 (branch swarm/r06-t214). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 13 of 20. Gate: ch01 GATE OK board 4947 (tree a340192f88)

Commits folded into this step (3):
- 7c2e74cc0e Stop the recorded operations of an owner whose PID was reused before removing its record (task 214)
- 61e0c5f5d9 Ignore ESRCH when test cleanup kills a process that already exited (transport tests)
- 5f5b0f8f52 [rush-client-core] Move task 214's new tests so that they merge with other batch E changes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  10 +-
 ...-reused-owner-groups_2026-09-29-08-40.json |  11 ++
 ...-reused-owner-groups_2026-09-29-08-40.json |  11 ++
 ...-reused-owner-groups_2026-09-29-08-40.json |  11 ++
 .../reviews/api/rush-daemon-transport.api.md  |   3 +
 libraries/rush-client-core/README.md          |  14 +-
 .../rush-client-core/src/DaemonOwnership.ts   |  81 ++++++++---
 .../src/connectOrStartDaemon.ts               |   2 +-
 .../test/AbandonedOwnershipReclaim.test.ts    |  98 +++++++++++++
 .../src/test/DaemonArtifactReset.test.ts      |  56 ++++++++
 .../connectOrStartDaemonReusedOwner.test.ts   | 132 ++++++++++++++++++
 .../src/DaemonOperationGroupReaper.ts         |   3 +-
 .../src/DaemonReapOptions.ts                  |  25 +++-
 .../src/DaemonReclaim.ts                      |  37 +----
 .../src/DaemonReclaimMutex.ts                 |  51 +++++++
 .../src/DaemonReusedOwnerReap.ts              |  42 ++++++
 libraries/rush-daemon-transport/src/index.ts  |   1 +
 .../src/test/ProcessWaitFixture.ts            |  12 +-
 .../src/test/ReusedOwnerReap.test.ts          |  75 ++++++++++
 19 files changed, 611 insertions(+), 64 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
 create mode 100644 libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
 create mode 100644 libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 3ac096f9ee..752c4d2e9c 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -583,7 +583,10 @@ be a reused PID. When the recorded owner PID no longer exists, the daemon exited
 down and may have left operations running that only its records name, so the reset first stops them
 as the next daemon start would: SIGTERM, then SIGKILL 2 seconds later, to the daemon's own process
 group and to each operation process group that it recorded whose leader still has the recorded start
-time (or has exited, while every live member of the group is in the group's own session). It prints the
+time (or has exited, while every live member of the group is in the group's own session). When a
+process that started after the record was written has the recorded PID now, the daemon exited the same
+way, so the reset stops the operation process groups that it recorded the same way, but never the
+process group whose ID is that PID, which the later process may lead. It prints the
 line shown above for a lost connection and reports what it stopped in `orphansReaped` (`daemonPid`,
 `processGroupIds`, `outcome`). A recorded group that it cannot prove, such as a PID that a later
 process now has, is not signalled; its record is removed with the others. If the operations cannot be
@@ -613,7 +616,10 @@ one whose helper exited, as described above), a socket
 without an ownership record, or an unreadable/corrupt record, is removed only after
 a connection attempt is refused (so no listener exists). On Linux, a record whose
 PID now belongs to a process that started after the record's `startedAt` (PID reuse)
-is treated as dead; other platforms fail closed and point to `daemon stop --force`.
+is treated as dead; other platforms fail closed and point to `daemon stop --force`. Before such a
+record is removed, the operation process groups that the daemon recorded are stopped as
+`daemon stop --force` stops them, and the line shown above for a lost connection is printed; if they
+cannot be stopped, the command fails and the record stays.
 
 Restart is explicit even when automatic startup or CI execution routing is
 disabled, but conflicts with `--no-daemon`. The two-phase host retains ownership
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json b/common/changes/@rushstack/rush-cli-client/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
new file mode 100644
index 0000000000..8a0e0ab4f6
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the ownership record names a PID that a process that started later now has, automatic startup and `daemon stop --force` now stop the operations that the exited daemon left running before they remove the record, and say so, instead of leaving those operations running with nothing that names them.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
new file mode 100644
index 0000000000..20417f0415
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Before a start or `resetDaemonArtifactsAsync()` removes an ownership record whose PID a process that started later now has, stop the operation process groups that the exited daemon recorded, which nothing names once the record is gone, and report them to `onOrphansReaped`; if they cannot be stopped, remove nothing.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
new file mode 100644
index 0000000000..a0ae39e89e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t214-reused-owner-groups_2026-09-29-08-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add `reapReusedOwnerOperationGroupsAsync()`, which stops the operation process groups that a daemon recorded once a process that started after its lockfile was written has the daemon's PID, with the proof of each group that a dead daemon's records require, but never the process group whose ID is that PID.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index 63d8c79741..6300d7a7e2 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -132,6 +132,9 @@ export interface IWorkspaceKeyInput {
 // @beta
 export function readDaemonLockfile(lockfilePath: string): IDaemonLockfile | undefined;
 
+// @beta
+export function reapReusedOwnerOperationGroupsAsync(paths: IDaemonPaths, ownerPid: number, options?: IDaemonReclaimOptions): Promise<void>;
+
 // @beta
 export function reclaimStaleDaemonAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void>;
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 233fb90267..3f75f8bc9b 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -118,13 +118,19 @@ is killed. While holding the mutex with no startup reservation (or after taking
 abandoned one, see below), stale leftovers are reclaimed only when provably safe: a socket without an ownership record, or a corrupt
 record, once a connection attempt is refused (no listener exists); and, on Linux, a
 record whose PID now belongs to a process that started after the record's `startedAt`
-(PID reuse, detected from `/proc`). Any other live PID with an unreachable socket fails
+(PID reuse, detected from `/proc`). Once that record is gone, nothing names the operations that the
+owner left running, so before it removes the record it stops the operation process groups that the
+owner recorded (`reapReusedOwnerOperationGroupsAsync()`), with the proof of each group that
+`reclaimStaleDaemonAsync()` requires, but never the process group whose ID is the recorded PID, which
+the later process may lead. If they cannot be stopped, the start fails and removes nothing.
+Any other live PID with an unreachable socket fails
 closed, pointing to `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`),
 which removes the record, socket and reservation after the same no-listener/no-live-owner checks.
 When the recorded PID no longer exists, the reset first stops the operations that the owner left
-running, as `reclaimStaleDaemonAsync()` does before the next start, and reports them to
-`options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings). It removes nothing when
-they cannot be stopped, and it never signals a process otherwise.
+running, as `reclaimStaleDaemonAsync()` does before the next start; when a process that started later
+has it, the reset stops the recorded operation process groups as the start does. Both report what they
+stop to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings). The reset removes
+nothing when they cannot be stopped, and it never signals a process otherwise.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
 readiness. The explicit launcher's cwd is unchanged. If the daemon exits after its helper saw it ready
 but before the starting client connected, for example because `rush-client daemon stop` stopped it,
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index 7d925e3e2d..7d657a12dd 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -9,6 +9,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import {
   DaemonTransportError,
   DaemonTransportErrorCode,
+  reapReusedOwnerOperationGroupsAsync,
   reclaimStaleDaemonAsync,
   type IDaemonLockfile,
   type IDaemonPaths,
@@ -109,8 +110,16 @@ export function isOwnerProcessAlive(owner: { readonly pid: number; readonly star
  * observed no startup reservation, or taken over one whose helper is gone. A daemon publishes its endpoint only
  * after it listens, so a refused connection then proves no listener exists. A daemon that a gone helper
  * launched may still publish later; of two daemons that publish, the second finds the first and exits.
+ * When a process that started after the record was written now has the recorded PID, the owner exited without
+ * shutting down, and once its record is gone no reclaim finds the operations that it recorded. So they are
+ * stopped first, with the proof that `reclaimStaleDaemonAsync` requires of each group but never the group of
+ * that process, and reported to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings).
+ * If they cannot be stopped, it throws and removes nothing.
  */
-export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promise<void> {
+export async function reclaimAbandonedOwnershipAsync(
+  paths: IDaemonPaths,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
   const state: OwnershipState = inspectOwnership(paths.lockfilePath);
   if (state.kind === 'owned' && !isProcessAlive(state.owner.pid)) return;
   if (state.kind === 'owned' && !isProcessStartedAfter(state.owner.pid, state.owner.startedAt)) {
@@ -126,6 +135,7 @@ export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promi
       `${describeOwnership(state, paths)}, but ${paths.socketPath} did not refuse a connection; refusing automatic reclaim. ${DAEMON_RESET_HINT}`
     );
   }
+  if (state.kind === 'owned') await reapReusedOwnerOperationGroupsAsync(paths, state.owner.pid, options);
   // The transport reclaim then removes the unbound socket under its own two-factor checks.
   if (state.kind !== 'absent') removeIfUnchanged(paths.lockfilePath, state.raw);
 }
@@ -133,15 +143,17 @@ export async function reclaimAbandonedOwnershipAsync(paths: IDaemonPaths): Promi
 /**
  * Removes this workspace's leftover daemon files (ownership record, socket, and startup reservation)
  * after verifying that no listener is bound and that the recorded owner, if any, is gone.
- * @remarks When the recorded PID no longer exists, the owner exited without shutting down and may have left
- * operations running, which only its records name. So the reset first stops them, as the next daemon start
- * would (`reclaimStaleDaemonAsync`), and reports each set of process groups that it stops to
- * `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. When they cannot be
- * stopped, it throws and removes nothing. Otherwise it never signals a process. Fails when another client holds
- * the start mutex, a listener is bound, the recorded owner is alive, or another process reclaims the files of
- * the owner that exited; with `waitTimeoutMs`, those conditions are re-checked until the deadline (for example,
- * while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears the report of a
- * daemon that a client reclaimed after it exited without shutting down ({@link findReclaimedDaemonPid}).
+ * @remarks When the recorded PID no longer exists, or a process that started after the record was written has
+ * it now, the owner exited without shutting down and may have left operations running, which only its records
+ * name. So the reset first stops them, as the next daemon start would (`reclaimStaleDaemonAsync`), but never
+ * the process group of a process that has the recorded PID now, and reports each set of process groups that it
+ * stops to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. When they
+ * cannot be stopped, it throws and removes nothing. Otherwise it never signals a process. Fails when another
+ * client holds the start mutex, a listener is bound, the recorded owner is alive, or another process reclaims
+ * the files of the owner that exited; with `waitTimeoutMs`, those conditions are re-checked until the deadline
+ * (for example, while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears the
+ * report of a daemon that a client reclaimed after it exited without shutting down
+ * ({@link findReclaimedDaemonPid}).
  * @beta
  */
 export async function resetDaemonArtifactsAsync(
@@ -188,10 +200,11 @@ async function tryResetDaemonArtifactsAsync(
       );
     }
     // A reclaim removes the record and the socket itself, right after its own checks.
-    const reclaimed: ReadonlySet<string> | DaemonClientError | undefined =
-      state.kind === 'owned' && !isProcessAlive(state.owner.pid)
-        ? await reclaimExitedOwnerAsync(paths, state.owner.pid, options)
-        : undefined;
+    const reclaimed: ReadonlySet<string> | DaemonClientError | undefined = await stopOwnerLeftoversAsync(
+      paths,
+      state,
+      options
+    );
     if (reclaimed instanceof DaemonClientError) return reclaimed;
     const removedPaths: string[] = [];
     if (
@@ -216,6 +229,26 @@ async function tryResetDaemonArtifactsAsync(
   }
 }
 
+/**
+ * Stops what an owner that exited without shutting down left running, before its record is removed. When its PID
+ * no longer exists, that is a reclaim ({@link reclaimExitedOwnerAsync}), which returns the files that it
+ * removed. When a process that started after the record was written has its PID (the caller has ruled out a
+ * live owner), only the operation groups that the owner recorded are stopped, never that process, and the
+ * caller removes the record. Returns a (not thrown) error while another process reclaims the owner's files.
+ */
+async function stopOwnerLeftoversAsync(
+  paths: IDaemonPaths,
+  state: OwnershipState,
+  options: IDaemonReclaimOptions | undefined
+): Promise<ReadonlySet<string> | DaemonClientError | undefined> {
+  if (state.kind !== 'owned') return undefined;
+  const ownerPid: number = state.owner.pid;
+  if (!isProcessAlive(ownerPid)) return await reclaimExitedOwnerAsync(paths, ownerPid, options);
+  return await tryReclaimOwnerAsync(paths, ownerPid, () =>
+    reapReusedOwnerOperationGroupsAsync(paths, ownerPid, { onOrphansReaped: options?.onOrphansReaped })
+  );
+}
+
 /**
  * Stops the operations that an owner that exited left running, and removes its record and socket, as the next
  * daemon start would. Returns the files that it removed, or a (not thrown) error while another process
@@ -229,8 +262,25 @@ async function reclaimExitedOwnerAsync(
   const files: string[] =
     process.platform === 'win32' ? [paths.lockfilePath] : [paths.lockfilePath, paths.socketPath];
   const present: string[] = files.filter((filePath) => isPresent(filePath));
+  const failure: DaemonClientError | undefined = await tryReclaimOwnerAsync(paths, ownerPid, () =>
+    reclaimStaleDaemonAsync(paths, { onOrphansReaped: options?.onOrphansReaped })
+  );
+  return failure ?? new Set(present.filter((filePath) => !isPresent(filePath)));
+}
+
+/**
+ * Runs `reclaimAsync` for the files of owner `ownerPid`, which exited without shutting down. Returns a (not
+ * thrown) error while another process reclaims them, and throws when the operations that the owner left running
+ * cannot be stopped.
+ */
+async function tryReclaimOwnerAsync(
+  paths: IDaemonPaths,
+  ownerPid: number,
+  reclaimAsync: () => Promise<void>
+): Promise<DaemonClientError | undefined> {
   try {
-    await reclaimStaleDaemonAsync(paths, { onOrphansReaped: options?.onOrphansReaped });
+    await reclaimAsync();
+    return undefined;
   } catch (error) {
     // Another process holds the reclaim lock, or a daemon started since the checks above.
     if (
@@ -250,7 +300,6 @@ async function reclaimExitedOwnerAsync(
       { cause: error }
     );
   }
-  return new Set(present.filter((filePath) => !isPresent(filePath)));
 }
 
 function isPresent(filePath: string): boolean {
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 6f3a066032..0b82fcf9a0 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -201,7 +201,7 @@ async function startDaemonAsync(
     const handoff: DaemonClient | undefined = await waitForHandoffAsync(options, deadline);
     if (handoff) return handoff;
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before reclaim');
-    await reclaimAbandonedOwnershipAsync(options.paths);
+    await reclaimAbandonedOwnershipAsync(options.paths, { onOrphansReaped: options.onOrphansReaped });
     await reclaimStaleDaemonAsync(options.paths, { onOrphansReaped: options.onOrphansReaped });
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before spawn');
     options.abortSignal?.throwIfAborted();
diff --git a/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts b/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
new file mode 100644
index 0000000000..5739a8b64a
--- /dev/null
+++ b/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonTransportErrorCode,
+  tryAcquireReclaimLock,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { reclaimAbandonedOwnershipAsync } from '../DaemonOwnership';
+import {
+  isRunning,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+describe(`${reclaimAbandonedOwnershipAsync.name} when a process that started later has the recorded PID`, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let operationPids: number[];
+  let reaps: IDaemonOrphanReap[];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+    reaps.push(reap);
+  };
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-abandoned-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    operationPids = [];
+    reaps = [];
+  });
+
+  afterEach(async () => {
+    operationPids.forEach(stopOperationIfRunning);
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  /**
+   * Records an owner whose PID a process that started later has now, as if the owner recorded that process's
+   * group and one group that it started. Returns the PIDs of that process and of the recorded group's leader.
+   */
+  async function recordReusedOwnerAsync(): Promise<[number, number]> {
+    // Each leads a process group and session of its own, as an operation does.
+    const unrelated: number = await startDetachedOperationAsync(operationPids);
+    const recorded: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+    recordOperationGroup(paths.lockfilePath, unrelated, unrelated, readProcessStartTime(unrelated));
+    recordOperationGroup(paths.lockfilePath, unrelated, recorded, readProcessStartTime(recorded));
+    return [unrelated, recorded];
+  }
+
+  linuxIt('stops the recorded operations before it removes the record, but never that process', async () => {
+    const [unrelated, recorded] = await recordReusedOwnerAsync();
+    await reclaimAbandonedOwnershipAsync(paths, { onOrphansReaped });
+    expect(isRunning(recorded)).toBe(false);
+    expect(isRunning(unrelated)).toBe(true);
+    expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
+  });
+
+  linuxIt(
+    'keeps the record and signals nothing while the recorded operations cannot be stopped',
+    async () => {
+      const [unrelated, recorded] = await recordReusedOwnerAsync();
+      const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      // For example, a daemon that starts reclaims the endpoint under this lock.
+      const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+      expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+      try {
+        await expect(reclaimAbandonedOwnershipAsync(paths, { onOrphansReaped })).rejects.toMatchObject({
+          code: DaemonTransportErrorCode.daemonAlreadyRunning
+        });
+      } finally {
+        fs.unlinkSync(reclaimLockPath);
+      }
+      expect(isRunning(recorded)).toBe(true);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([]);
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(true);
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
index faa7625a5b..aff7842bb5 100644
--- a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
@@ -162,6 +162,62 @@ describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutti
     expect(fs.existsSync(paths.socketPath)).toBe(true);
   });
 
+  /**
+   * Records an owner whose PID a process that started later now has, as if the owner recorded that process's
+   * group (with its start time), one group `recorded` that it started, and one group whose leader has another
+   * start time than the recorded one. Returns those three PIDs.
+   */
+  async function recordReusedOwnerAsync(): Promise<[number, number, number]> {
+    // Each leads a process group and session of its own, as an operation does.
+    const unrelated: number = await startDetachedOperationAsync(operationPids);
+    const recorded: number = await startDetachedOperationAsync(operationPids);
+    const other: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+    recordOperationGroup(paths.lockfilePath, unrelated, unrelated, readProcessStartTime(unrelated));
+    recordOperationGroup(paths.lockfilePath, unrelated, recorded, readProcessStartTime(recorded));
+    const earlier: string = String(Number(readProcessStartTime(other)) - 1);
+    recordOperationGroup(paths.lockfilePath, unrelated, other, earlier);
+    return [unrelated, recorded, other];
+  }
+
+  linuxIt(
+    'stops the proven operation groups of an owner whose PID a later process has, but never that process',
+    async () => {
+      const [unrelated, recorded, other] = await recordReusedOwnerAsync();
+      expect(await resetDaemonArtifactsAsync(paths, { onOrphansReaped })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(recorded)).toBe(false);
+      expect(isRunning(other)).toBe(true);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+      expect(warning).not.toHaveBeenCalled();
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
+    }
+  );
+
+  linuxIt(
+    'signals and removes nothing while another process reclaims, when a later process has the PID',
+    async () => {
+      const [unrelated, recorded] = await recordReusedOwnerAsync();
+      const record: string = fs.readFileSync(paths.lockfilePath, 'utf8');
+      const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+      expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+      try {
+        await expect(resetDaemonArtifactsAsync(paths, { onOrphansReaped })).rejects.toThrow(
+          `Another process is reclaiming the files of rushd (PID ${unrelated})`
+        );
+      } finally {
+        fs.unlinkSync(reclaimLockPath);
+      }
+      expect(isRunning(recorded)).toBe(true);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(reaps).toEqual([]);
+      expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
+      expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(true);
+    }
+  );
+
   linuxIt(
     'removes a record whose PID a process that started later now has, and signals nothing',
     async () => {
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
new file mode 100644
index 0000000000..c64484d42c
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
@@ -0,0 +1,132 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  readDaemonLockfile,
+  type IDaemonOrphanReap,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient } from '../DaemonClient';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import {
+  isRunning,
+  readProcessStartTime,
+  recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  stopOperationIfRunning
+} from './OrphanedOperation';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe('detached daemon startup after a daemon whose PID a later process has', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-reused-owner-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-reused-owner-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  async function leaveStaleSocketAsync(): Promise<void> {
+    // A listener killed without cleanup leaves a bound-nowhere socket file behind.
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [
+        '-e',
+        `require('net').createServer().listen(${JSON.stringify(paths.socketPath)}, () => process.kill(process.pid, 'SIGKILL'))`
+      ],
+      { stdio: 'ignore' }
+    );
+    await once(child, 'close');
+  }
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'stops the operations of a record whose live PID a later process has, but never that process, before a start',
+    async () => {
+      const operationPids: number[] = [];
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      try {
+        // Each leads a process group and session of its own, as an operation does.
+        const unrelated: number = await startDetachedOperationAsync(operationPids);
+        const recorded: number = await startDetachedOperationAsync(operationPids);
+        await leaveStaleSocketAsync();
+        recordDaemonOwner(paths, unrelated, new Date(Date.now() - 3600000).toISOString());
+        recordOperationGroup(paths.lockfilePath, unrelated, unrelated, readProcessStartTime(unrelated));
+        recordOperationGroup(paths.lockfilePath, unrelated, recorded, readProcessStartTime(recorded));
+        const reaps: IDaemonOrphanReap[] = [];
+        const client: DaemonClient = await connectOrStartDaemonAsync({
+          ...options,
+          onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+        });
+        await client.closeAsync();
+        expect(isRunning(recorded)).toBe(false);
+        expect(isRunning(unrelated)).toBe(true);
+        expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+        expect(warning).not.toHaveBeenCalled();
+        expect(readDaemonLockfile(paths.lockfilePath)?.pid).not.toBe(unrelated);
+        expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
+      } finally {
+        warning.mockRestore();
+        operationPids.forEach(stopOperationIfRunning);
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index 7e99376830..e4c6e2e5d2 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -84,7 +84,8 @@ async function reapRecordedGroupsAsync(
  * session `groupId`. Unproven records are dropped without a signal. Records survive a failed reap, so the
  * next reclaim retries.
  * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
- * Call only under the reclaim mutex, after the daemon has been proven dead.
+ * Call only under the reclaim mutex, after the daemon has been proven dead, or its pid proven reused
+ * (`deadPidReused`).
  */
 export async function reapDeadDaemonOperationGroupsAsync(
   lockfilePath: string,
diff --git a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
index f4d137fc7d..cdf9a58a23 100644
--- a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
@@ -19,6 +19,11 @@ export interface IDaemonOrphanReaperOptions extends IDaemonReclaimOptions {
   readonly graceMs?: number;
   /** The caller's user id (`process.getuid()`); only records that this user owns are acted on. */
   readonly uid?: number;
+  /**
+   * `true` when a process that started after the dead daemon's lockfile was written now has the daemon's pid:
+   * the daemon is gone although its pid is alive, and that process may lead group `deadPid`.
+   */
+  readonly deadPidReused?: boolean;
 }
 
 /** {@link IDaemonOrphanReaperOptions} with every default applied, for the dead daemon `deadPid`. */
@@ -29,12 +34,19 @@ export interface IReapContext extends IDaemonReclaimOptions {
   readonly deadPid: number;
   readonly graceMs: number;
   readonly uid: number | undefined;
+  readonly deadPidReused: boolean;
 }
 
 function resolveCaller(options: IDaemonOrphanReaperOptions): Pick<IReapContext, 'platform' | 'selfPid'> {
   return { platform: options.platform ?? process.platform, selfPid: options.selfPid ?? process.pid };
 }
 
+function resolveReapPolicy(
+  options: IDaemonOrphanReaperOptions
+): Pick<IReapContext, 'graceMs' | 'deadPidReused'> {
+  return { graceMs: options.graceMs ?? DEFAULT_GRACE_MS, deadPidReused: options.deadPidReused ?? false };
+}
+
 /** The user whose records may be acted on. */
 export function resolveCallerUid(options: IDaemonOrphanReaperOptions): number | undefined {
   return options.uid ?? process.getuid?.();
@@ -44,9 +56,9 @@ export function resolveCallerUid(options: IDaemonOrphanReaperOptions): number |
 export function createReapContext(deadPid: number, options: IDaemonOrphanReaperOptions): IReapContext {
   return {
     ...resolveCaller(options),
+    ...resolveReapPolicy(options),
     ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
     deadPid,
-    graceMs: options.graceMs ?? DEFAULT_GRACE_MS,
     uid: resolveCallerUid(options),
     onOrphansReaped: options.onOrphansReaped
   };
@@ -70,11 +82,16 @@ const SIGNALABLE_GROUP_CHECKS: readonly GroupCheck[] = [
   (groupId: number, context: IReapContext) => context.platform !== WINDOWS_PLATFORM,
   (groupId: number) => Number.isSafeInteger(groupId) && groupId >= FIRST_USER_PID,
   isNeitherSelfNorOwnGroup,
-  // A live daemon still owns its operations.
-  (groupId: number, context: IReapContext) => !context.ops.isProcessAlive(context.deadPid)
+  // A live daemon still owns its operations. The later process that has a gone daemon's pid may lead group
+  // `deadPid`, which is then never signaled.
+  (groupId: number, context: IReapContext) =>
+    context.deadPidReused ? groupId !== context.deadPid : !context.ops.isProcessAlive(context.deadPid)
 ];
 
-/** `true` when group `groupId` may be signaled at all: POSIX, a user pid, not ours, and its daemon is dead. */
+/**
+ * `true` when group `groupId` may be signaled at all: POSIX, a user pid, not ours, and its daemon is dead (or
+ * its pid was reused, and the group is not the one of that pid).
+ */
 export function isSignalableGroup(groupId: number, context: IReapContext): boolean {
   return SIGNALABLE_GROUP_CHECKS.every((check: GroupCheck) => check(groupId, context));
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaim.ts b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
index 872a54ce32..1faf5f9078 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaim.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaim.ts
@@ -1,18 +1,13 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import * as fs from 'node:fs';
-
 import { connectDaemonAsync } from './DaemonConnector';
 import type { DaemonFrameConnection } from './DaemonFrameConnection';
 import { isDaemonProcessAlive, readDaemonLockfile, removeDaemonArtifacts } from './DaemonLockfile';
 import { reapOrphansOfDeadOwnerAsync } from './DaemonOrphanReaper';
 import type { IDaemonPaths } from './DaemonPaths';
-import { tryAcquireReclaimLock } from './DaemonReclaimLock';
-import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
+import { runUnderReclaimMutexAsync, throwAlreadyRunning } from './DaemonReclaimMutex';
 import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
-import { assertDaemonRuntimeDirIsPrivate } from './DaemonRuntimeDir';
-import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 
 /**
  * Reclaims the socket/pipe path when it is held by a dead daemon.
@@ -39,28 +34,7 @@ export async function reclaimStaleDaemonAsync(
   paths: IDaemonPaths,
   options?: IDaemonReclaimOptions
 ): Promise<void> {
-  assertDaemonRuntimeDirIsPrivate(paths);
-  // The mutex lives beside the lockfile (never the same file): the lockfile
-  // records the *running* daemon's live PID, while the mutex only ever records
-  // a reclaimer's pid. So a live daemon is "locked" (its PID alive), while a
-  // dead daemon's stale record is safe to steal.
-  const lock: DaemonReclaimLockOutcome = tryAcquireReclaimLock(reclaimLockPath(paths));
-  if (!lock.acquired) {
-    throwAlreadyRunning(paths, 'another starter holds the reclaim lock');
-  }
-  try {
-    await reclaimUnderLockAsync(paths, options);
-  } finally {
-    try {
-      fs.unlinkSync(reclaimLockPath(paths));
-    } catch {
-      // Another starter may have already cleared it; release is best-effort.
-    }
-  }
-}
-
-function reclaimLockPath(paths: IDaemonPaths): string {
-  return `${paths.lockfilePath}.reclaim`;
+  await runUnderReclaimMutexAsync(paths, () => reclaimUnderLockAsync(paths, options));
 }
 
 async function reclaimUnderLockAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void> {
@@ -81,13 +55,6 @@ function isLockfilePidAlive(lockfile: ReturnType<typeof readDaemonLockfile>): bo
   return lockfile !== undefined && isDaemonProcessAlive(lockfile.pid);
 }
 
-function throwAlreadyRunning(paths: IDaemonPaths, reason: string): never {
-  throw new DaemonTransportError(
-    DaemonTransportErrorCode.daemonAlreadyRunning,
-    `A live daemon already listens at ${paths.socketPath} (${reason}).`
-  );
-}
-
 async function probeConnectionFailsAsync(socketPath: string): Promise<boolean> {
   try {
     const probe: DaemonFrameConnection = await connectDaemonAsync(socketPath);
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts b/libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts
new file mode 100644
index 0000000000..e1ffd9bbf2
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReclaimMutex.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from './DaemonPaths';
+import { tryAcquireReclaimLock } from './DaemonReclaimLock';
+import type { DaemonReclaimLockOutcome } from './DaemonReclaimLock';
+import { assertDaemonRuntimeDirIsPrivate } from './DaemonRuntimeDir';
+import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
+
+function reclaimLockPath(paths: IDaemonPaths): string {
+  return `${paths.lockfilePath}.reclaim`;
+}
+
+/** Throws {@link DaemonTransportErrorCode.daemonAlreadyRunning} for the endpoint of `paths`. */
+export function throwAlreadyRunning(paths: IDaemonPaths, reason: string): never {
+  throw new DaemonTransportError(
+    DaemonTransportErrorCode.daemonAlreadyRunning,
+    `A live daemon already listens at ${paths.socketPath} (${reason}).`
+  );
+}
+
+/**
+ * Runs `action` while holding the reclaim mutex of `paths`, in a runtime directory that is private to this
+ * user. Throws `daemonAlreadyRunning` when another starter holds the mutex, and `unsafeRuntimeDirectory` for an
+ * unsafe runtime directory.
+ */
+export async function runUnderReclaimMutexAsync(
+  paths: IDaemonPaths,
+  action: () => Promise<void>
+): Promise<void> {
+  assertDaemonRuntimeDirIsPrivate(paths);
+  // The mutex lives beside the lockfile (never the same file): the lockfile
+  // records the *running* daemon's live PID, while the mutex only ever records
+  // a reclaimer's pid. So a live daemon is "locked" (its PID alive), while a
+  // dead daemon's stale record is safe to steal.
+  const lock: DaemonReclaimLockOutcome = tryAcquireReclaimLock(reclaimLockPath(paths));
+  if (!lock.acquired) {
+    throwAlreadyRunning(paths, 'another starter holds the reclaim lock');
+  }
+  try {
+    await action();
+  } finally {
+    try {
+      fs.unlinkSync(reclaimLockPath(paths));
+    } catch {
+      // Another starter may have already cleared it; release is best-effort.
+    }
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts b/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
new file mode 100644
index 0000000000..4bb46bec4e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from './DaemonOperationGroupReaper';
+import type { IDaemonPaths } from './DaemonPaths';
+import type { IDaemonOrphanReaperOptions } from './DaemonReapOptions';
+import { runUnderReclaimMutexAsync } from './DaemonReclaimMutex';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
+
+/**
+ * Stops the operation process groups that the daemon which wrote the lockfile recorded, when a process that
+ * started after the lockfile was written now has that daemon's PID, `ownerPid`, and deletes the records.
+ *
+ * @remarks
+ * The caller proves the reuse, for example from `/proc` and the lockfile's `startedAt`. The daemon is then gone,
+ * and the process that has its PID now is not a daemon that lost its lockfile either, because such a daemon
+ * would have written a later one. Once the lockfile is removed, no reclaim finds these records, since a live
+ * PID's record folder is left alone, so call this before removing it.
+ * A record is signaled only with the proof that a dead daemon's records require: its leader is alive with the
+ * recorded start time and leads its own group and session, or its leader has exited and every live member of
+ * the group is in the group's own session. Group `ownerPid`, which the later process may lead, is never
+ * signaled. Unproven records are dropped without a signal, and records survive a failed reap. Each set of
+ * stopped groups is reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process
+ * warning. Nothing is read, reaped or removed unless the runtime directory is a private directory of this
+ * user, and a record folder that is a symbolic link, or that another user owns, is left alone.
+ *
+ * @throws {@link DaemonTransportError} with code `daemonAlreadyRunning` when another process holds the
+ * reclaim lock, and with code `unsafeRuntimeDirectory` for an unsafe runtime directory; and an `Error` when a
+ * group survives SIGKILL.
+ *
+ * @beta
+ */
+export async function reapReusedOwnerOperationGroupsAsync(
+  paths: IDaemonPaths,
+  ownerPid: number,
+  options?: IDaemonReclaimOptions
+): Promise<void> {
+  const reaperOptions: IDaemonOrphanReaperOptions = { ...options, deadPidReused: true };
+  await runUnderReclaimMutexAsync(paths, async () => {
+    await reapDeadDaemonOperationGroupsAsync(paths.lockfilePath, ownerPid, reaperOptions);
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index 7c9e40a67c..fa5e01686e 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -35,6 +35,7 @@ export {
 export { resolveDaemonPathsFromProcess } from './DaemonPathsFromProcess';
 export { reclaimStaleDaemonAsync } from './DaemonReclaim';
 export type { IDaemonOrphanReap, IDaemonReclaimOptions } from './DaemonReclaimOptions';
+export { reapReusedOwnerOperationGroupsAsync } from './DaemonReusedOwnerReap';
 export { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 export { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 export {
diff --git a/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts b/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
index 546c6007c6..0e592e2d52 100644
--- a/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/ProcessWaitFixture.ts
@@ -6,6 +6,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import { readProcessStat } from '../DaemonProcessStat';
 import type { IProcessStat } from '../DaemonProcessStat';
 
+const NO_SUCH_PROCESS: string = 'ESRCH';
 const FIRST_ATTEMPT: number = 0;
 const POLL_ATTEMPTS: number = 250;
 const POLL_INTERVAL_MS: number = 20;
@@ -45,9 +46,18 @@ function isStillRunning({ pid, startTime }: IStartedProcess): boolean {
   return startTime !== undefined && readProcessStat(pid)?.startTime === startTime;
 }
 
+function killIfPresent(pid: number): void {
+  try {
+    process.kill(pid, 'SIGKILL');
+  } catch (error) {
+    // Killing one process can end another first: an operation that reads the fake daemon's pipe exits with it.
+    if ((error as NodeJS.ErrnoException).code !== NO_SUCH_PROCESS) throw error;
+  }
+}
+
 /** SIGKILLs the started processes that are still the same processes; for test cleanup only. */
 export function killStillRunning(started: readonly IStartedProcess[]): void {
   for (const { pid } of started.filter(isStillRunning)) {
-    process.kill(pid, 'SIGKILL');
+    killIfPresent(pid);
   }
 }
diff --git a/libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts b/libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts
new file mode 100644
index 0000000000..bc23b4833b
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ReusedOwnerReap.test.ts
@@ -0,0 +1,75 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from '../DaemonPaths';
+import type { IProcessStat } from '../DaemonProcessStat';
+import { tryAcquireReclaimLock } from '../DaemonReclaimLock';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+import { reapReusedOwnerOperationGroupsAsync } from '../DaemonReusedOwnerReap';
+import { ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+import { DaemonTransportErrorCode } from '../DaemonTransportError';
+
+import { OPERATION_GROUP, OTHER_OPERATION_GROUP, operationTree, stat } from './OperationGroupFixture';
+import { recordDaemonFolder, removeCreatedEntries } from './OperationGroupSweepFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const REUSED_START: string = '999';
+const RECORDED_GROUPS: readonly number[] = [OPERATION_GROUP, OTHER_OPERATION_GROUP, DEAD_PID];
+
+afterEach(removeCreatedEntries);
+
+interface IReusedOwner {
+  readonly paths: IDaemonPaths;
+  readonly fake: IFakeGroup;
+  /** The record folder of the owner. */
+  readonly folder: string;
+}
+
+// A process that started after the daemon's lockfile was written has the daemon's pid, so the fake reports
+// every pid alive. It leads group DEAD_PID with the start time recorded for that group, so only the rule for
+// the owner's own group keeps it from being signaled. OTHER_OPERATION_GROUP's leader has another start time.
+function recordReusedOwner(): IReusedOwner {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  ensureDaemonRuntimeDir(paths);
+  const otherLeader: IProcessStat = {
+    ...stat(OTHER_OPERATION_GROUP, OTHER_OPERATION_GROUP),
+    startTime: REUSED_START
+  };
+  const fake: IFakeGroup = createFakeGroup({
+    daemonAlive: true,
+    exitsOn: 'SIGTERM',
+    processes: [...operationTree(OPERATION_GROUP), otherLeader, stat(DEAD_PID, DEAD_PID)]
+  });
+  return { paths, fake, folder: recordDaemonFolder(paths.lockfilePath, DEAD_PID, RECORDED_GROUPS) };
+}
+
+it('stops only the proven groups of an owner whose pid a later process has, never that process', async () => {
+  const { paths, fake, folder } = recordReusedOwner();
+  const reaps: IDaemonOrphanReap[] = [];
+  await reapReusedOwnerOperationGroupsAsync(paths, DEAD_PID, {
+    ...fake.options,
+    onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap)
+  });
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+  expect(reaps).toEqual([{ daemonPid: DEAD_PID, processGroupIds: [OPERATION_GROUP], outcome: 'terminated' }]);
+  expect(fs.existsSync(folder)).toBe(false);
+});
+
+it('signals nothing and keeps the records while another process holds the reclaim lock', async () => {
+  const { paths, fake, folder } = recordReusedOwner();
+  const reclaimLockPath: string = `${paths.lockfilePath}.reclaim`;
+  expect(tryAcquireReclaimLock(reclaimLockPath)).toEqual({ acquired: true });
+  try {
+    await expect(reapReusedOwnerOperationGroupsAsync(paths, DEAD_PID, fake.options)).rejects.toMatchObject({
+      code: DaemonTransportErrorCode.daemonAlreadyRunning
+    });
+  } finally {
+    fs.unlinkSync(reclaimLockPath);
+  }
+  expect(fake.signals).toEqual([]);
+  expect(fs.existsSync(folder)).toBe(true);
+});

From a2d945a238d95f9d88393f359bbdfdc565d77fa0 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 144/265] [rush-daemon] Let clients that are still connecting
 join a shared build batch (task 135) (and 1 more)

Swarm integration step 129; original commit 99dcfdbff1 (merge of swarm/r05-t135-int3 at 03f9eb57c9).
Scope: task 135-int3.

Brings 135-int3 (branch swarm/r05-t135-int3). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 14 of 20. Gate: ch01 GATE OK board 4947 (tree 95ff3d06f0)

Commits folded into this step (2):
- 625686f093 rush-daemon: let clients that are still connecting join a shared build batch (task 135)
- 4d3ea3d5e1 rush-daemon: a connecting client stays active until the daemon finishes writing its reply (task 135)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...n-connecting-clients_2026-09-29-07-05.json |  11 +
 common/reviews/api/rush-daemon.api.md         |   3 +
 .../src/ConnectingClientTracker.ts            | 124 +++++++++++
 .../rush-daemon/src/DaemonControlSession.ts   |  23 +-
 .../src/DaemonRequestDispatcher.ts            |  10 +-
 .../src/DaemonWireRequestClient.ts            |  12 ++
 .../rush-daemon/src/PhasedRequestClient.ts    |  11 +
 .../rush-daemon/src/PhasedRequestRouter.ts    |  13 +-
 libraries/rush-daemon/src/RushDaemonHost.ts   |   3 +
 .../src/WorkspaceRequestLifecycle.ts          |   4 +-
 .../src/test/ConnectingClientTracker.test.ts  | 166 +++++++++++++++
 .../src/test/DaemonRequestWirePhased.test.ts  | 200 ++++++++++++++++++
 .../test/DaemonRequestWireTestUtilities.ts    |  13 ++
 .../test/NativeConnectingClientJoin.test.ts   |  96 +++++++++
 .../src/test/PhasedRequestBatching.test.ts    |  58 +++++
 .../test/PhasedRequestRouterTestUtilities.ts  |   4 +
 .../src/test/PhasedRequestTelemetry.test.ts   |  32 +++
 17 files changed, 777 insertions(+), 6 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-t135-join-connecting-clients_2026-09-29-07-05.json
 create mode 100644 libraries/rush-daemon/src/ConnectingClientTracker.ts
 create mode 100644 libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-t135-join-connecting-clients_2026-09-29-07-05.json b/common/changes/@rushstack/rush-daemon/swarm-r05-t135-join-connecting-clients_2026-09-29-07-05.json
new file mode 100644
index 0000000000..3314783885
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-t135-join-connecting-clients_2026-09-29-07-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Before a batch of shared builds reconciles its inputs, the daemon waits up to 100 ms for clients that connected but have not sent their request yet, so that their requests can join the batch. Such a client counts as connecting until 100 ms after the daemon last read a frame from it or finished writing one to it. A request now counts as received when the daemon reads its request frame, and the telemetry adds an `awaitConnectingClients` measure.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index a02af92db3..eb6876f777 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -178,10 +178,12 @@ export interface IDaemonRequestDispatchClient {
     getNextEventSequence(): number;
     // (undocumented)
     readonly interactiveSession: IInteractiveRequestSession;
+    readonly receivedTimeMs?: number;
     // (undocumented)
     readonly sessionId: string;
     // (undocumented)
     readonly supportsRequestAdmission: boolean;
+    waitForConnectingClientsAsync?(): Promise<void>;
     // (undocumented)
     writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
     // (undocumented)
@@ -409,6 +411,7 @@ export interface IPhasedRequestClient {
     readonly interactiveSession?: IInteractiveRequestSession;
     readonly sessionId: string;
     readonly supportsRequestAdmission?: boolean;
+    waitForConnectingClientsAsync?(): Promise<void>;
     writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
     writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
     writeQueuePositionAsync?(message: IDaemonRequestQueuePositionMessage): Promise<void>;
diff --git a/libraries/rush-daemon/src/ConnectingClientTracker.ts b/libraries/rush-daemon/src/ConnectingClientTracker.ts
new file mode 100644
index 0000000000..fac35422ac
--- /dev/null
+++ b/libraries/rush-daemon/src/ConnectingClientTracker.ts
@@ -0,0 +1,124 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/** One connection that the daemon accepted, until it sends its first request or starts closing. */
+export interface IConnectingClient {
+  /** Records that the daemon read a frame from the connection or finished writing one to it. */
+  touch(): void;
+  /** Stops tracking the connection, because it sent its first request or is closing. */
+  settle(): void;
+}
+
+/** Options for {@link ConnectingClientTracker}. */
+export interface IConnectingClientTrackerOptions {
+  /** How long after its latest activity a connection still counts as connecting. */
+  readonly idleLimitMs?: number;
+  /** The longest that one call to {@link ConnectingClientTracker.waitAsync} waits. */
+  readonly waitLimitMs?: number;
+}
+
+// A client sends its next handshake frame as soon as it reads the daemon's reply, so a connection that neither sent
+// a frame nor got one for this long is not about to send a request.
+const DEFAULT_IDLE_LIMIT_MS: number = 100;
+// What a batch of shared builds may spend waiting before its reconcile, so that a stalled client costs little.
+const DEFAULT_WAIT_LIMIT_MS: number = 100;
+
+/**
+ * Tracks the connections that the daemon accepted and that have not sent a request yet, so that a batch of shared
+ * builds can wait for their requests before its input reconcile starts.
+ *
+ * @remarks
+ * A client exchanges hello, subscribe and ping with the daemon before it sends its request. Each exchange waits
+ * while the daemon is busy, for example preparing another request, so a client that connected before a batch
+ * closed can send its request after the batch's reconcile started. That request cannot join the batch; it waits for
+ * the batch to finish, then reconciles again. Waiting for such clients first lets their requests join the batch.
+ */
+export class ConnectingClientTracker {
+  readonly #idleLimitMs: number;
+  readonly #waitLimitMs: number;
+  readonly #lastActivityTimeMs: Map<IConnectingClient, number> = new Map();
+  readonly #waiters: Set<() => void> = new Set();
+
+  public constructor(options: IConnectingClientTrackerOptions = {}) {
+    this.#idleLimitMs = options.idleLimitMs ?? DEFAULT_IDLE_LIMIT_MS;
+    this.#waitLimitMs = options.waitLimitMs ?? DEFAULT_WAIT_LIMIT_MS;
+  }
+
+  /** Starts tracking a connection that the daemon has just accepted. */
+  public add(): IConnectingClient {
+    const client: IConnectingClient = {
+      touch: () => {
+        if (this.#lastActivityTimeMs.has(client)) {
+          this.#lastActivityTimeMs.set(client, performance.now());
+        }
+      },
+      settle: () => {
+        if (this.#lastActivityTimeMs.delete(client)) {
+          for (const wake of Array.from(this.#waiters)) wake();
+        }
+      }
+    };
+    this.#lastActivityTimeMs.set(client, performance.now());
+    return client;
+  }
+
+  /**
+   * Resolves once no tracked connection had activity within the idle limit, or once the wait limit has passed.
+   *
+   * @remarks
+   * It first lets the event loop poll for I/O, which accepts the connections that wait in the listening socket's
+   * backlog, so that they are tracked too. Before it decides that a connection is idle, it lets the event loop poll
+   * again, so that frames that arrived while the daemon was busy are read first, and replies that waited for the
+   * event loop finish writing first.
+   */
+  public async waitAsync(): Promise<void> {
+    await waitForPollAsync();
+    const deadlineMs: number = performance.now() + this.#waitLimitMs;
+    for (;;) {
+      const nowMs: number = performance.now();
+      const idleTimeMs: number | undefined = this.#getIdleTimeMs();
+      if (idleTimeMs === undefined || idleTimeMs <= nowMs || deadlineMs <= nowMs) {
+        return;
+      }
+      await this.#waitForSettleAsync(Math.min(idleTimeMs, deadlineMs) - nowMs);
+      if (this.#lastActivityTimeMs.size > 0) {
+        await waitForPollAsync();
+      }
+    }
+  }
+
+  /** When the tracked connection with the latest frame becomes idle, or undefined if none is tracked. */
+  #getIdleTimeMs(): number | undefined {
+    let latestMs: number | undefined;
+    for (const timeMs of this.#lastActivityTimeMs.values()) {
+      if (latestMs === undefined || timeMs > latestMs) {
+        latestMs = timeMs;
+      }
+    }
+    return latestMs === undefined ? undefined : latestMs + this.#idleLimitMs;
+  }
+
+  /** Resolves when a tracked connection settles or after `timeoutMs`, whichever comes first. */
+  async #waitForSettleAsync(timeoutMs: number): Promise<void> {
+    let wake: () => void = () => undefined;
+    const woken: Promise<void> = new Promise<void>((resolve) => {
+      wake = resolve;
+    });
+    this.#waiters.add(wake);
+    const timeout: ReturnType<typeof setTimeout> = setTimeout(wake, timeoutMs);
+    try {
+      await woken;
+    } finally {
+      clearTimeout(timeout);
+      this.#waiters.delete(wake);
+    }
+  }
+}
+
+/** Resolves after the event loop has polled for I/O at least once since the call. */
+async function waitForPollAsync(): Promise<void> {
+  // Called while the event loop handles I/O, the first immediate runs before the loop polls again, so the poll that
+  // it follows can have started before the call. The second immediate follows a poll that started after it.
+  await new Promise<void>((resolve) => setImmediate(resolve));
+  await new Promise<void>((resolve) => setImmediate(resolve));
+}
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 0f1d7b3d6b..072949e649 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -29,6 +29,7 @@ import type {
 import type { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { createGlobalCommandResult } from './CommandResultPolicy';
+import type { ConnectingClientTracker, IConnectingClient } from './ConnectingClientTracker';
 import { DaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
 import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
@@ -60,6 +61,8 @@ export interface IDaemonControlSessionOptions {
   readonly checkInstallation?: () => IDaemonInstallationChange | undefined;
   /** Receives a message for the daemon log for each rejected request. */
   readonly onLog?: (message: string) => void;
+  /** Tracks this connection until it sends its first request or starts closing. */
+  readonly connectingClients?: ConnectingClientTracker;
 }
 
 interface IRequestState {
@@ -91,6 +94,7 @@ export class DaemonControlSession {
   readonly #completedRequestIds: Set<string> = new Set();
   readonly #closedPromise: Promise<void>;
   readonly #resolveClosed: () => void;
+  readonly #connectingClient: IConnectingClient | undefined;
   #closePromise: Promise<void> | undefined;
   #connectionClosed: boolean = false;
   #handshakeComplete: boolean = false;
@@ -108,6 +112,7 @@ export class DaemonControlSession {
   public constructor(connection: DaemonFrameConnection, options: IDaemonControlSessionOptions) {
     this.#connection = connection;
     this.#options = options;
+    this.#connectingClient = options.connectingClients?.add();
     const closed: ReturnType<typeof createDeferred> = createDeferred();
     this.#closedPromise = closed.promise;
     this.#resolveClosed = closed.resolve;
@@ -147,6 +152,7 @@ export class DaemonControlSession {
   }
 
   async #handleFrameSafelyAsync(frame: IDaemonFrame): Promise<void> {
+    this.#connectingClient?.touch();
     try {
       await this.#onFrameAsync(frame);
     } catch (error) {
@@ -293,6 +299,7 @@ export class DaemonControlSession {
   }
 
   #startRequest(envelope: IDaemonRequestEnvelope): void {
+    const receivedTimeMs: number = performance.now();
     this.#assertRequestLifecycleReady();
     const requestId: string = envelope.requestId;
     if (this.#requestById.has(requestId) || this.#completedRequestIds.has(requestId)) {
@@ -328,15 +335,18 @@ export class DaemonControlSession {
       requestId
     });
     const sessionId: string = this.#sessionId!;
+    const connectingClients: ConnectingClientTracker | undefined = this.#options.connectingClients;
     const client: DaemonWireRequestClient = new DaemonWireRequestClient({
       abortSignal: abortController.signal,
       getNextEventSequence: () => this.#getNextEventSequence(),
       interactiveSession,
+      receivedTimeMs,
       requestId,
       sendControlAsync: (message: DaemonControlMessage) => this.#enqueueControlAsync(message),
       sendFrameAsync: (frame: IDaemonFrame) => this.#enqueueFrameAsync(frame),
       sessionId,
-      supportsRequestAdmission: this.#peerSupportsRequestAdmission
+      supportsRequestAdmission: this.#peerSupportsRequestAdmission,
+      waitForConnectingClientsAsync: connectingClients && (() => connectingClients.waitAsync())
     });
     const state: IRequestState = {
       abortController,
@@ -354,6 +364,8 @@ export class DaemonControlSession {
         releaseActivity?.();
       });
     void state.completion.catch((error: unknown) => this.#handleSendFailureAsync(error));
+    // The request has its receipt time, so a batch that waits for this connection can now close.
+    this.#connectingClient?.settle();
   }
 
   #getNextEventSequence(): number {
@@ -470,7 +482,13 @@ export class DaemonControlSession {
   #enqueueFrameAsync(frame: IDaemonFrame, closeAfterSend: boolean = false): Promise<void> {
     const sendPromise: Promise<void> = this.#sendQueue
       .then(() => this.#connection.sendFrameAsync(frame))
-      .then(() => (closeAfterSend ? this.#connection.closeAsync() : undefined));
+      .then(() => {
+        // Before its request, a client waits for each reply. A large reply (the pong carries the warm set status)
+        // finishes writing only when the event loop runs, so a busy daemon can write it long after the client's
+        // last frame. Its client must not count as idle before it could read the reply.
+        this.#connectingClient?.touch();
+        return closeAfterSend ? this.#connection.closeAsync() : undefined;
+      });
     this.#sendQueue = sendPromise.catch(() => undefined);
     return sendPromise;
   }
@@ -509,6 +527,7 @@ export class DaemonControlSession {
   #markClosing(reason: Error, keepFinishedRequests: boolean = false): void {
     if (this.#isClosing) return;
     this.#isClosing = true;
+    this.#connectingClient?.settle();
     this.#interactiveConnection.close(reason);
     for (const state of this.#requestById.values()) {
       if (!keepFinishedRequests || !state.client.terminalOutcomeSent) {
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index 60aaa0c4d4..a5e2ab84e3 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -91,9 +91,17 @@ export class DaemonRequestDispatchError extends Error {
 export interface IDaemonRequestDispatchClient {
   readonly abortSignal: AbortSignal;
   readonly interactiveSession: IInteractiveRequestSession;
+  /**
+   * The `performance.now()` timestamp at which the transport read the request. A host lifecycle reports it as the
+   * request's {@link IDaemonRequestLifecycleInfo.receivedTimeMs}. When it is omitted, the request counts as received
+   * when its dispatch starts.
+   */
+  readonly receivedTimeMs?: number;
   readonly sessionId: string;
   readonly supportsRequestAdmission: boolean;
   getNextEventSequence(): number;
+  /** {@inheritDoc IPhasedRequestClient.waitForConnectingClientsAsync} */
+  waitForConnectingClientsAsync?(): Promise<void>;
   writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
   writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
   writeQueuePositionAsync(message: IDaemonRequestQueuePositionMessage): Promise<void>;
@@ -214,7 +222,7 @@ async function dispatchWorkspaceRequestAsync(
       onExecutionStarting,
       resolved.requestSettings,
       resolved.telemetry,
-      lifecycleInfo?.receivedTimeMs
+      lifecycleInfo?.receivedTimeMs ?? client.receivedTimeMs
     );
   }
   const globalRouter: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(workspaceSession);
diff --git a/libraries/rush-daemon/src/DaemonWireRequestClient.ts b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
index f2fb40af53..4f7db611f6 100644
--- a/libraries/rush-daemon/src/DaemonWireRequestClient.ts
+++ b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
@@ -24,11 +24,15 @@ export interface IDaemonWireRequestClientOptions {
   readonly abortSignal: AbortSignal;
   readonly getNextEventSequence: () => number;
   readonly interactiveSession: IInteractiveRequestSession;
+  /** The `performance.now()` timestamp at which the control session read the request. */
+  readonly receivedTimeMs: number;
   readonly requestId: string;
   readonly sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
   readonly sessionId: string;
   readonly supportsRequestAdmission: boolean;
+  /** Waits for the daemon's other connections that have not sent a request yet. Resolves at once if omitted. */
+  readonly waitForConnectingClientsAsync?: () => Promise<void>;
 }
 
 /** Ordered wire destination for one request owned by a control session. @internal */
@@ -37,10 +41,12 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
   readonly #requestId: string;
   readonly #sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly #sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
+  readonly #waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
   #terminalOutcomeSent: boolean = false;
 
   public readonly abortSignal: AbortSignal;
   public readonly interactiveSession: IInteractiveRequestSession;
+  public readonly receivedTimeMs: number;
   public readonly sessionId: string;
   public readonly supportsRequestAdmission: boolean;
 
@@ -48,17 +54,23 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     this.abortSignal = options.abortSignal;
     this.#getNextEventSequence = options.getNextEventSequence;
     this.interactiveSession = options.interactiveSession;
+    this.receivedTimeMs = options.receivedTimeMs;
     this.#requestId = options.requestId;
     this.#sendControlAsync = options.sendControlAsync;
     this.#sendFrameAsync = options.sendFrameAsync;
     this.sessionId = options.sessionId;
     this.supportsRequestAdmission = options.supportsRequestAdmission;
+    this.#waitForConnectingClientsAsync = options.waitForConnectingClientsAsync;
   }
 
   public getNextEventSequence(): number {
     return this.#getNextEventSequence();
   }
 
+  public async waitForConnectingClientsAsync(): Promise<void> {
+    await this.#waitForConnectingClientsAsync?.();
+  }
+
   public get terminalOutcomeSent(): boolean {
     return this.#terminalOutcomeSent;
   }
diff --git a/libraries/rush-daemon/src/PhasedRequestClient.ts b/libraries/rush-daemon/src/PhasedRequestClient.ts
index 23a8028836..5edbbda63f 100644
--- a/libraries/rush-daemon/src/PhasedRequestClient.ts
+++ b/libraries/rush-daemon/src/PhasedRequestClient.ts
@@ -55,4 +55,15 @@ export interface IPhasedRequestClient {
 
   /** Writes the request's current one-based scheduler queue position. */
   writeQueuePositionAsync?(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+
+  /**
+   * Resolves once the daemon's other clients that are still connecting have sent their requests, or are not about
+   * to send one. The wait is short and capped.
+   *
+   * @remarks
+   * The router calls it before a batch of shared builds starts its input reconcile. A request that the daemon
+   * receives before then can still join the batch, so a client that connected while the daemon was busy shares the
+   * batch's iteration instead of waiting for it and reconciling again.
+   */
+  waitForConnectingClientsAsync?(): Promise<void>;
 }
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 053321d09d..540a707d82 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -105,6 +105,8 @@ interface IBatchTimings {
   readonly startTimeMs: number;
   batchSize: number;
   leasesAcquiredTimeMs: number | undefined;
+  /** The end of the wait for connecting clients, where the input reconcile starts. */
+  reconcileStartTimeMs: number | undefined;
   reconciledTimeMs: number | undefined;
   selectionsAppliedTimeMs: number | undefined;
   /** The start of `scheduleIterationAsync`, which is where a native iteration's duration starts. */
@@ -478,6 +480,7 @@ class PhasedRequestBatchCoordinator {
       startTimeMs: performance.now(),
       batchSize: 0,
       leasesAcquiredTimeMs: undefined,
+      reconcileStartTimeMs: undefined,
       reconciledTimeMs: undefined,
       selectionsAppliedTimeMs: undefined,
       scheduleStartTimeMs: undefined,
@@ -506,9 +509,14 @@ class PhasedRequestBatchCoordinator {
       }
       executionLease = await this.#workspaceSession.acquireExecutionLeaseAsync?.();
       timings.leasesAcquiredTimeMs = performance.now();
+      if (this.#acceptingCurrentBatch) {
+        // A client that connected while the daemon was busy may not have sent its request yet. Let it, so that
+        // the request is received before the reconcile starts and can join this batch.
+        await batch[0].client.waitForConnectingClientsAsync?.();
+      }
       // Requests received before this point made their changes before the reconcile reads the inputs, so they can
       // still join while it runs. Requests received later wait for the next batch, which reconciles again.
-      this.#reconcileStartTimeMs = performance.now();
+      this.#reconcileStartTimeMs = timings.reconcileStartTimeMs = performance.now();
       await this.#workspaceSession.reconcileInvalidationsAsync();
       timings.reconciledTimeMs = performance.now();
 
@@ -1161,7 +1169,8 @@ function createTelemetryMeasures(
   addMeasure('admission', entry.startTimeMs, entry.admittedTimeMs);
   addMeasure('queueWait', entry.admittedTimeMs, executionStartTimeMs);
   addMeasure('acquireExecutionLease', timings.startTimeMs, timings.leasesAcquiredTimeMs);
-  addMeasure('reconcileInvalidations', timings.leasesAcquiredTimeMs, timings.reconciledTimeMs);
+  addMeasure('awaitConnectingClients', timings.leasesAcquiredTimeMs, timings.reconcileStartTimeMs);
+  addMeasure('reconcileInvalidations', timings.reconcileStartTimeMs, timings.reconciledTimeMs);
   addMeasure('applySelections', timings.reconciledTimeMs, timings.selectionsAppliedTimeMs);
   addMeasure('scheduleIteration', timings.scheduleStartTimeMs, timings.scheduledTimeMs);
   addMeasure('executeIteration', timings.executionStartTimeMs, timings.iterationEndTimeMs ?? resultTimeMs);
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 202d72f87b..3e446cc4a3 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -16,6 +16,7 @@ import {
 } from '@rushstack/rush-daemon-transport';
 import type { DaemonFileChange, DaemonFrameConnection, IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
+import { ConnectingClientTracker } from './ConnectingClientTracker';
 import { DaemonControlSession } from './DaemonControlSession';
 import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
 import { DaemonIdleGarbageCollector, type IDaemonIdleGarbageCollection } from './DaemonIdleGarbageCollector';
@@ -236,6 +237,7 @@ export class RushDaemonHost {
       options.requestResolver,
       requestLifecycle
     );
+    const connectingClients: ConnectingClientTracker = new ConnectingClientTracker();
     let listener: DaemonFrameListener;
     try {
       listener = await DaemonFrameListener.listenAsync(paths, {
@@ -243,6 +245,7 @@ export class RushDaemonHost {
         startedAt: new Date(startedAtMs).toISOString(),
         onConnection: (connection: DaemonFrameConnection) => {
           const session: DaemonControlSession = new DaemonControlSession(connection, {
+            connectingClients,
             daemonVersion: options.daemonVersion,
             dispatcher: requestDispatcher,
             startedAtMs,
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 29ab445144..374837c37c 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -258,7 +258,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     destination: IDaemonRequestDispatchClient,
     dispatchWorkspaceRequestAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
-    const receivedTimeMs: number = performance.now();
+    const receivedTimeMs: number = destination.receivedTimeMs ?? performance.now();
     const dispatchAsync: DispatchWorkspaceRequestAsync = (options) =>
       dispatchWorkspaceRequestAsync({
         ...options,
@@ -1391,9 +1391,11 @@ function createLifecycleClient(
   return {
     abortSignal,
     interactiveSession: client.interactiveSession,
+    receivedTimeMs: client.receivedTimeMs,
     sessionId: client.sessionId,
     supportsRequestAdmission: client.supportsRequestAdmission,
     getNextEventSequence: () => client.getNextEventSequence(),
+    waitForConnectingClientsAsync: async () => await client.waitForConnectingClientsAsync?.(),
     writeEventAsync: (event) => {
       state.began = true;
       return client.writeEventAsync(event);
diff --git a/libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts b/libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts
new file mode 100644
index 0000000000..a5b2fd2d71
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ConnectingClientTracker.test.ts
@@ -0,0 +1,166 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { ConnectingClientTracker } from '../ConnectingClientTracker';
+import type { IConnectingClient } from '../ConnectingClientTracker';
+
+interface IObservedWait {
+  readonly done: boolean;
+}
+
+function observe(waitPromise: Promise<void>): IObservedWait {
+  const observed: { done: boolean } = { done: false };
+  void waitPromise.then(() => {
+    observed.done = true;
+  });
+  return observed;
+}
+
+// With fake timers, an immediate that is queued while timers run fires 1 ms later. So a wait that the tracker
+// resumes from a timer, which then lets the event loop poll, ends a few milliseconds after that timer.
+describe(ConnectingClientTracker.name, () => {
+  beforeEach(() => jest.useFakeTimers());
+  afterEach(() => jest.useRealTimers());
+
+  it('does not wait when no connection is connecting', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(5);
+    expect(wait.done).toBe(true);
+    expect(jest.getTimerCount()).toBe(0);
+  });
+
+  it('waits for a connection that the event loop accepts after the wait began', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    // The daemon accepts a connection when the event loop polls for I/O. The wait's first immediate can run before
+    // that poll, and this one runs after it.
+    setImmediate(() => tracker.add());
+    await jest.advanceTimersByTimeAsync(99);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(11);
+    expect(wait.done).toBe(true);
+  });
+
+  it('stops waiting as soon as the connection settles', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const client: IConnectingClient = tracker.add();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(40);
+    expect(wait.done).toBe(false);
+    client.settle();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.done).toBe(true);
+    expect(jest.getTimerCount()).toBe(0);
+  });
+
+  it('counts a connection as idle once its latest frame is as old as the idle limit', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 1000
+    });
+    tracker.add();
+    await jest.advanceTimersByTimeAsync(99);
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(1);
+    expect(wait.done).toBe(true);
+  });
+
+  it('measures the idle limit from the latest frame rather than from the start of the wait', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 1000
+    });
+    tracker.add();
+    await jest.advanceTimersByTimeAsync(30);
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(60);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(20);
+    expect(wait.done).toBe(true);
+
+    // The connection never sent a request, so it stays tracked, but a later wait does not wait for it.
+    await jest.advanceTimersByTimeAsync(500);
+    const laterWait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(5);
+    expect(laterWait.done).toBe(true);
+  });
+
+  it('keeps waiting while the connection receives frames, up to the wait limit', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 250
+    });
+    const client: IConnectingClient = tracker.add();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(90);
+    client.touch();
+    await jest.advanceTimersByTimeAsync(90);
+    expect(wait.done).toBe(false);
+    client.touch();
+    await jest.advanceTimersByTimeAsync(69);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(11);
+    expect(wait.done).toBe(true);
+  });
+
+  it('reads the frames that already arrived before it decides that another connection is idle', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 1000
+    });
+    const other: IConnectingClient = tracker.add();
+    await jest.advanceTimersByTimeAsync(50);
+    const requesting: IConnectingClient = tracker.add();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(70);
+
+    // The event loop reads the other connection's frame in the same poll as the request, after it.
+    setImmediate(() => other.touch());
+    requesting.settle();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(99);
+    expect(wait.done).toBe(false);
+    await jest.advanceTimersByTimeAsync(11);
+    expect(wait.done).toBe(true);
+  });
+
+  it('ignores frames and repeated settles after the connection settled', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const client: IConnectingClient = tracker.add();
+    client.settle();
+    client.settle();
+    client.touch();
+    const wait: IObservedWait = observe(tracker.waitAsync());
+    await jest.advanceTimersByTimeAsync(5);
+    expect(wait.done).toBe(true);
+  });
+
+  it('wakes every wait when a connection settles, and each keeps waiting for the others', async () => {
+    const tracker: ConnectingClientTracker = new ConnectingClientTracker({
+      idleLimitMs: 100,
+      waitLimitMs: 100
+    });
+    const first: IConnectingClient = tracker.add();
+    const second: IConnectingClient = tracker.add();
+    const waits: IObservedWait[] = [observe(tracker.waitAsync()), observe(tracker.waitAsync())];
+    await jest.advanceTimersByTimeAsync(10);
+    first.settle();
+    await jest.advanceTimersByTimeAsync(5);
+    expect(waits.map((wait: IObservedWait) => wait.done)).toEqual([false, false]);
+    second.settle();
+    await jest.advanceTimersByTimeAsync(5);
+    expect(waits.map((wait: IObservedWait) => wait.done)).toEqual([true, true]);
+    expect(jest.getTimerCount()).toBe(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts
index d98de894d4..0951837e4d 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWirePhased.test.ts
@@ -7,7 +7,9 @@ import * as path from 'node:path';
 
 import { OperationStatus } from '@microsoft/rush-lib';
 import {
+  DAEMON_PROTOCOL_VERSION,
   DaemonFrameType,
+  createDaemonHello,
   decodeDaemonControlMessage,
   decodeDaemonEventFrame,
   decodeDaemonLogChunk
@@ -19,10 +21,12 @@ import type {
 } from '@rushstack/rush-daemon-protocol';
 import type { ITerminal } from '@rushstack/terminal';
 
+import { ConnectingClientTracker } from '../ConnectingClientTracker';
 import type { IDaemonRequestResolver } from '../DaemonRequestDispatcher';
 import { RushDaemonHost } from '../RushDaemonHost';
 import type { IRushDaemonHostOptions } from '../RushDaemonHost';
 import { WorkspaceEngineRecreationRequiredError } from '../WorkspaceEngineComponentFactory';
+import type { IWorkspaceWarmSetStatus } from '../WorkspaceWarmSet';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -228,6 +232,160 @@ describe('daemon phased request wire integration', () => {
     }
   });
 
+  it('lets a client that connected while the daemon was busy send a request that joins the batch', async () => {
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ])
+    );
+    const leaseRequested: IDeferred<void> = createDeferred<void>();
+    const grantLease: IDeferred<void> = createDeferred<void>();
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      leaseRequested.resolve();
+      await grantLease.promise;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    const reconcileStarted: IDeferred<void> = createDeferred<void>();
+    const lateRequestResolved: IDeferred<void> = createDeferred<void>();
+    let reconcileCount: number = 0;
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      if (reconcileCount++ === 0) {
+        reconcileStarted.resolve();
+        // Like a slower reconcile, this one lets the late request reach the router before it ends.
+        await lateRequestResolved.promise;
+        await settleAsync();
+      }
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => {
+      if (envelope.requestId === 'late') {
+        // Like a slower resolver, this one reaches the router after the reconcile started. The request still joins,
+        // because the daemon received it before then.
+        await reconcileStarted.promise;
+        lateRequestResolved.resolve();
+      }
+      return { kind: 'phased', request: createPhasedRequest(envelope) };
+    });
+    const host: RushDaemonHost = await startHostAsync(repoRoot, fixture, resolver);
+    const clients: DaemonRequestWireClient[] = [await connectAsync(host)];
+    try {
+      const early: Promise<ITerminalExchange> = startAsync(
+        clients[0],
+        phasedEnvelope(repoRoot, 'early', OPERATION_A)
+      );
+      await leaseRequested.promise;
+      // The late client connects, then takes a while before its handshake, as when the daemon replies slowly.
+      clients.push(await DaemonRequestWireClient.connectAsync(host.paths.socketPath));
+      await sleepAsync(150);
+      await clients[1].handshakeAsync();
+      grantLease.resolve();
+      await settleAsync();
+      const late: ITerminalExchange = await startAsync(
+        clients[1],
+        phasedEnvelope(repoRoot, 'late', OPERATION_C)
+      );
+
+      for (const exchange of [await early, late]) {
+        expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      }
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
+  it('counts a connection as connecting until it sends its first request or closes', async () => {
+    const addSpy: jest.SpyInstance = jest.spyOn(ConnectingClientTracker.prototype, 'add');
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([[OPERATION_A, new TestOperationRunner(OPERATION_A)]])
+    );
+    const leaseRequested: IDeferred<void> = createDeferred<void>();
+    const grantLease: IDeferred<void> = createDeferred<void>();
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      leaseRequested.resolve();
+      await grantLease.promise;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+    const host: RushDaemonHost = await startHostAsync(repoRoot, fixture);
+    const clients: DaemonRequestWireClient[] = [];
+    try {
+      clients.push(await connectAsync(host));
+      const tracker: ConnectingClientTracker = addSpy.mock.contexts[0] as ConnectingClientTracker;
+      expect(await isWaitingAsync(tracker)).toBe(true);
+      const exchange: Promise<ITerminalExchange> = startAsync(
+        clients[0],
+        phasedEnvelope(repoRoot, 'request', OPERATION_A)
+      );
+      // The request's own batch must not wait for the connection that sent it.
+      await leaseRequested.promise;
+      expect(await isWaitingAsync(tracker)).toBe(false);
+      grantLease.resolve();
+      expect((await exchange).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(await isWaitingAsync(tracker)).toBe(false);
+
+      clients.push(await connectAsync(host));
+      expect(await isWaitingAsync(tracker)).toBe(true);
+      await clients[1].closeAsync();
+      await clients[1].closed;
+      expect(await isWaitingAsync(tracker)).toBe(false);
+      expect(addSpy).toHaveBeenCalledTimes(2);
+    } finally {
+      addSpy.mockRestore();
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
+  it('counts a connection as connecting again once the daemon finishes writing a reply that waited', async () => {
+    const addSpy: jest.SpyInstance = jest.spyOn(ConnectingClientTracker.prototype, 'add');
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([[OPERATION_A, new TestOperationRunner(OPERATION_A)]])
+    );
+    const host: RushDaemonHost = await startHostAsync(repoRoot, fixture);
+    const clients: DaemonRequestWireClient[] = [];
+    try {
+      clients.push(await connectAsync(host));
+      const tracker: ConnectingClientTracker = addSpy.mock.contexts[0] as ConnectingClientTracker;
+      // The first request installs the session, whose warm set status each pong then carries. As in a large repo,
+      // that makes the pong larger than the socket's buffers.
+      const first: ITerminalExchange = await startAsync(
+        clients[0],
+        phasedEnvelope(repoRoot, 'first', OPERATION_A)
+      );
+      expect(first.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      fixture.session.warmSetStatus = createLargeWarmSetStatus();
+
+      const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(
+        host.paths.socketPath
+      );
+      clients.push(client);
+      await client.sendControlAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+      expect((await client.readControlAsync()).kind).toBe('helloAck');
+      await settleAsync();
+      client.pauseReading();
+      await client.sendControlAsync({ kind: 'ping', payload: {} });
+      // The daemon read the ping but cannot finish writing the pong. A client that stops reading must not hold
+      // batches, so its connection still counts as idle once the frame it sent last is old enough.
+      await sleepAsync(150);
+      expect(await isWaitingAsync(tracker)).toBe(false);
+
+      // As when the daemon was too busy to finish writing the pong, the client gets the pong only now, and has not
+      // sent its request yet.
+      client.resumeReading();
+      expect((await client.readControlAsync()).kind).toBe('pong');
+      expect(await isWaitingAsync(tracker)).toBe(true);
+    } finally {
+      addSpy.mockRestore();
+      await Promise.all(clients.map((client: DaemonRequestWireClient) => client.closeAsync()));
+      await host.closeAsync();
+    }
+  });
+
   it('fails closed with a typed recreation-required outcome before scheduling stale work', async () => {
     const repoRoot: string = createRepoRoot();
     const fixture: ITestRoutingFixture = createRoutingFixture(
@@ -360,3 +518,45 @@ async function readUntilControlKindAsync(
     if (message.kind === kind) return message;
   }
 }
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+function sleepAsync(durationMs: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, durationMs));
+}
+
+/** Whether a batch would still wait for a connecting client after the daemon handled the frames it received. */
+async function isWaitingAsync(tracker: ConnectingClientTracker): Promise<boolean> {
+  return await Promise.race([tracker.waitAsync().then(() => false), settleAsync().then(() => true)]);
+}
+
+/** A warm set status of about 2 MB, like a large repo's, which is larger than any platform's socket buffers. */
+function createLargeWarmSetStatus(): IWorkspaceWarmSetStatus {
+  const projectNames: string[] = Array.from(
+    { length: 20_000 },
+    (unused, index) => `@example/${'large-project-name-'.repeat(5)}${index}`
+  );
+  return {
+    cleanupFailures: [],
+    configuration: {
+      autoWarmByTelemetry: false,
+      warmIdleTimeoutSeconds: 60,
+      warmMemoryBudgetMB: 1024,
+      warmSetMaxProjects: 20_000
+    },
+    daemonResidentMemoryBytes: 0,
+    deferredReason: undefined,
+    maintenanceState: 'running',
+    measuredRunnerMemoryBytes: 0,
+    overMemoryBudget: false,
+    overProjectLimit: false,
+    protectedProjectNames: [],
+    retainedProjectNames: projectNames,
+    unmeasuredRunnerCount: 0,
+    watchedProjectNames: []
+  };
+}
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
index 62d9a9c913..2911562e07 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
@@ -117,6 +117,19 @@ export class DaemonRequestWireClient {
     return this.#connection.closeAsync();
   }
 
+  /**
+   * Stops reading from the socket, so that what the daemon writes backs up in the socket's buffers. Call it only
+   * while no frame is being received.
+   */
+  public pauseReading(): void {
+    this.#connection.socket.pause();
+  }
+
+  /** Reads from the socket again after {@link DaemonRequestWireClient.pauseReading}. */
+  public resumeReading(): void {
+    this.#connection.socket.resume();
+  }
+
   #receive(frame: IDaemonFrame): void {
     const waiter: IFrameWaiter | undefined = this.#waiters.shift();
     if (waiter) waiter.resolve(frame);
diff --git a/libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts b/libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts
new file mode 100644
index 0000000000..f7ef107a92
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeConnectingClientJoin.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IRequestLease } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import type { WorkspaceSession } from '../WorkspaceSession';
+import {
+  DaemonRequestWireClient,
+  createDeferred,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+import { createFixtureAsync, runAsync, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('native production daemon engine with a client that is still connecting', () => {
+  it('waits under its native lease for a client that is still connecting, whose request then joins the batch', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const leaseRequested: IDeferred<void> = createDeferred();
+    const grantLease: IDeferred<void> = createDeferred();
+    const secondAdmitted: IDeferred<void> = createDeferred();
+    let secondClient: DaemonRequestWireClient | undefined;
+    let first: Promise<ITerminalExchange> | undefined;
+    let second: Promise<ITerminalExchange> | undefined;
+    try {
+      await runAsync(fixture, 'initialize', ['build', '--only', 'c']);
+      await fixture.session.quiesceWarmSetAsync();
+      const graph: IOperationGraph = fixture.session.operationGraph!;
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(graph, 'scheduleIterationAsync');
+      const acquireExecutionLeaseAsync: WorkspaceSession['acquireExecutionLeaseAsync'] =
+        fixture.session.acquireExecutionLeaseAsync.bind(fixture.session);
+      jest.spyOn(fixture.session, 'acquireExecutionLeaseAsync').mockImplementationOnce(async () => {
+        leaseRequested.resolve();
+        await grantLease.promise;
+        return await acquireExecutionLeaseAsync();
+      });
+      const reconcileAsync: WorkspaceSession['reconcileInvalidationsAsync'] =
+        fixture.session.reconcileInvalidationsAsync.bind(fixture.session);
+      jest.spyOn(fixture.session, 'reconcileInvalidationsAsync').mockImplementationOnce(async () => {
+        // Like a slower reconcile, this one lets the second request reach the router before it ends.
+        await secondAdmitted.promise;
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        return await reconcileAsync();
+      });
+      const routeAsync: PhasedRequestRouter['executeAsync'] = PhasedRequestRouter.prototype.executeAsync;
+      let routedRequests: number = 0;
+      jest.spyOn(PhasedRequestRouter.prototype, 'executeAsync').mockImplementation(async function (
+        this: PhasedRequestRouter,
+        ...args: Parameters<PhasedRequestRouter['executeAsync']>
+      ) {
+        routedRequests++;
+        return await routeAsync.apply(this, args);
+      });
+      const admitAsync: RequestAdmissionController['acquireAsync'] =
+        RequestAdmissionController.prototype.acquireAsync;
+      jest.spyOn(RequestAdmissionController.prototype, 'acquireAsync').mockImplementation(async function (
+        this: RequestAdmissionController,
+        ...args: Parameters<RequestAdmissionController['acquireAsync']>
+      ) {
+        const lease: IRequestLease = await admitAsync.apply(this, args);
+        if (routedRequests === 2) secondAdmitted.resolve();
+        return lease;
+      });
+      first = runAsync(fixture, 'dependency', ['build', '--to', 'a']);
+      await leaseRequested.promise;
+      // The second client connects while the daemon is busy, and takes a while before its handshake.
+      secondClient = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
+      await new Promise<void>((resolve) => setTimeout(resolve, 150));
+      await secondClient.handshakeAsync();
+      grantLease.resolve();
+      for (let turn: number = 0; turn < 20; turn++) {
+        await new Promise<void>((resolve) => setImmediate(resolve));
+      }
+      second = runAsync({ ...fixture, client: secondClient }, 'consumer', ['build', '--to', 'b']);
+      const results: ITerminalExchange[] = await Promise.all([first, second]);
+      for (const result of results)
+        expect(result.terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0 }
+        });
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      grantLease.resolve();
+      secondAdmitted.resolve();
+      await first;
+      await second;
+      jest.restoreAllMocks();
+      await secondClient?.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index 5e4b77751a..80fe618395 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -1127,6 +1127,64 @@ describe('shared phased request batching', () => {
     expect(scheduleSpy).toHaveBeenCalledTimes(1);
   });
 
+  it('waits for connecting clients before the reconcile, so that a request one sends meanwhile joins the batch', async () => {
+    const input: TestWorkspaceInput = new TestWorkspaceInput();
+    const events: string[] = [];
+    const fixture: ITestRoutingFixture = createFixture({
+      actionCAsync: async (): Promise<void> => {
+        events.push(`run:C ${input.describe()}`);
+      }
+    });
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      events.push('reconcile');
+      input.read();
+    };
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    let second: Promise<IDaemonPhasedRequestResult> | undefined;
+    const waitForConnectingClientsAsync: jest.Mock<Promise<void>, []> = jest.fn(async (): Promise<void> => {
+      // A client that connected while the daemon was busy changes project-c's input, then sends a compatible build.
+      events.push('wait');
+      input.edit();
+      second = router.executeAsync(
+        createRequest('second', OPERATION_C),
+        new TestPhasedRequestClient('two'),
+        false,
+        undefined,
+        undefined,
+        undefined,
+        performance.now()
+      );
+      await settleAsync();
+    });
+    const firstClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    firstClient.waitForConnectingClientsAsync = waitForConnectingClientsAsync;
+
+    expect(await router.executeAsync(createRequest('first', OPERATION_A), firstClient)).toMatchObject({
+      exitCode: 0,
+      outcome: 'success'
+    });
+    expect(await second).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(events).toEqual(['wait', 'reconcile', 'run:C snapshot=1 disk=1']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(waitForConnectingClientsAsync).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not wait for connecting clients before a batch that no other request can join', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const waitForConnectingClientsAsync: jest.Mock<Promise<void>, []> = jest.fn(
+      async (): Promise<void> => undefined
+    );
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    client.waitForConnectingClientsAsync = waitForConnectingClientsAsync;
+
+    expect(
+      await router.executeAsync({ ...createRequest('list', OPERATION_A), commandName: 'list' }, client)
+    ).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(waitForConnectingClientsAsync).not.toHaveBeenCalled();
+  });
+
   it('lets a late shared build wait past a default timeout while a compatible batch executes', async () => {
     const operationStarted: IDeferred = createDeferred();
     const releaseOperation: IDeferred = createDeferred();
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts b/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
index 58a52c478d..f2d5ac3a62 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouterTestUtilities.ts
@@ -34,6 +34,7 @@ import type {
   IWorkspaceSessionMetadata
 } from '../WorkspaceSession';
 import { WorkspaceInvalidationTracker } from '../WorkspaceInvalidationTracker';
+import type { IWorkspaceWarmSetStatus } from '../WorkspaceWarmSet';
 import { TEST_RUSH_CONFIGURATION, TEST_REPO_ROOT } from './TestWorkspaceSession';
 
 export const TEST_ENGINE_SHAPE: IWorkspaceEngineShape = {
@@ -69,6 +70,8 @@ export class TestPhasedRequestClient implements IPhasedRequestClient {
   public interactiveInputSink: IInteractiveRequestInputSink | undefined;
   public interactiveSession: IInteractiveRequestSession | undefined;
   public onWriteAsync: ((write: ITestClientWrite) => Promise<void>) | undefined;
+  /** What the router awaits for the daemon's connecting clients before it reconciles this client's batch. */
+  public waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
   readonly #sequenceState: { next: number };
 
   public constructor(sessionIdOrSequenceState: string | { next: number } = 'test-session') {
@@ -195,6 +198,7 @@ export class TestRoutingWorkspaceSession implements IWorkspaceSession {
   public readonly rushConfiguration: RushConfiguration = TEST_RUSH_CONFIGURATION;
   public readonly rushSession: RushSession | undefined = undefined;
   public readonly operationGraph: IOperationGraph;
+  public warmSetStatus: IWorkspaceWarmSetStatus | undefined;
   public onReconcileAsync: (() => Promise<void>) | undefined;
   public acquireExecutionLeaseAsync: (() => Promise<AsyncDisposable | undefined>) | undefined;
 
diff --git a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
index ca93202789..4f13c38ffe 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
@@ -14,6 +14,7 @@ import {
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import {
   collectPhasedRequestTelemetryRecords,
+  type IPhasedRequestTelemetryMeasure,
   type IPhasedRequestTelemetryReport,
   type IPhasedRequestTelemetrySink
 } from '../PhasedRequestTelemetry';
@@ -37,6 +38,7 @@ const DAEMON_MEASURES: ReadonlyArray<string> = [
   'rush:daemon:admission',
   'rush:daemon:queueWait',
   'rush:daemon:acquireExecutionLease',
+  'rush:daemon:awaitConnectingClients',
   'rush:daemon:reconcileInvalidations',
   'rush:daemon:applySelections',
   'rush:daemon:scheduleIteration',
@@ -291,6 +293,36 @@ describe('phased request telemetry', () => {
     }
   });
 
+  it('measures the wait for connecting clients between the execution lease and the reconcile', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('waiting');
+    client.waitForConnectingClientsAsync = () => new Promise<void>((resolve) => setTimeout(resolve, 20));
+    const sink: RecordingTelemetrySink = new RecordingTelemetrySink(client);
+    try {
+      await router.executeAsync(
+        createRequest('waiting', OPERATION_A),
+        client,
+        false,
+        undefined,
+        undefined,
+        sink
+      );
+
+      const measures: Map<string, IPhasedRequestTelemetryMeasure> = new Map(
+        sink.reports[0].measures.map((measure: IPhasedRequestTelemetryMeasure) => [measure.name, measure])
+      );
+      const lease: IPhasedRequestTelemetryMeasure = measures.get('rush:daemon:acquireExecutionLease')!;
+      const wait: IPhasedRequestTelemetryMeasure = measures.get('rush:daemon:awaitConnectingClients')!;
+      const reconcile: IPhasedRequestTelemetryMeasure = measures.get('rush:daemon:reconcileInvalidations')!;
+      expect(wait.startTimeMs).toBe(lease.endTimeMs);
+      expect(wait.endTimeMs - wait.startTimeMs).toBeGreaterThanOrEqual(10);
+      expect(reconcile.startTimeMs).toBe(wait.endTimeMs);
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
   it('reports the operations of a request with no work as retained and skipped', async () => {
     const fixture: ITestRoutingFixture = createFixture();
     let iteration: number = 0;

From 22e0c0b5f4563c0dcde5cf84930020c71d95aac2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 145/265] [heft-lint-plugin] Fix the ESLint cache for files
 that have suppressed messages

Swarm integration step 130; original commit 4f4c0f007a (merge of swarm/m03-t236 at e17746ecd1).
Scope: task 236.

Brings 236 (branch swarm/m03-t236). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 15 of 20. Gate: ch01 GATE OK board 4947 (tree d7e1301879)

Commits folded into this step (1):
- e17746ecd1 Fix the ESLint cache for files that have suppressed messages

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...int-cache-suppressed_2026-09-29-09-28.json |  10 +
 heft-plugins/heft-lint-plugin/src/Eslint.ts   |   7 +-
 .../heft-lint-plugin/src/test/Eslint.test.ts  | 202 ++++++++++++++++++
 3 files changed, 216 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/heft-lint-plugin/m03-t236-lint-cache-suppressed_2026-09-29-09-28.json
 create mode 100644 heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts

diff --git a/common/changes/@rushstack/heft-lint-plugin/m03-t236-lint-cache-suppressed_2026-09-29-09-28.json b/common/changes/@rushstack/heft-lint-plugin/m03-t236-lint-cache-suppressed_2026-09-29-09-28.json
new file mode 100644
index 0000000000..7e4fabfd6a
--- /dev/null
+++ b/common/changes/@rushstack/heft-lint-plugin/m03-t236-lint-cache-suppressed_2026-09-29-09-28.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-lint-plugin",
+      "comment": "Fix an issue where the ESLint cache treated a file as passing when it had a suppressed message (from an `eslint-disable` comment or a bulk suppression), even if it also had warnings or errors that weren't suppressed. Runs without `--clean` didn't lint the file again, so those warnings and errors weren't reported.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-lint-plugin"
+}
diff --git a/heft-plugins/heft-lint-plugin/src/Eslint.ts b/heft-plugins/heft-lint-plugin/src/Eslint.ts
index 23c6e6fc5c..9f85bb6483 100644
--- a/heft-plugins/heft-lint-plugin/src/Eslint.ts
+++ b/heft-plugins/heft-lint-plugin/src/Eslint.ts
@@ -523,10 +523,11 @@ export class Eslint extends LinterBase<TEslint.ESLint.LintResult | TEslintLegacy
   protected override hasLintFailures(
     lintResults: (TEslint.ESLint.LintResult | TEslintLegacy.ESLint.LintResult)[]
   ): boolean {
+    // ESLint's error and warning counts leave out suppressed messages (from eslint-disable comments and from bulk
+    // suppressions), so a file whose problems are all suppressed passes, and a file with any problem that isn't
+    // suppressed fails.
     return lintResults.some((lintResult: TEslint.ESLint.LintResult | TEslintLegacy.ESLint.LintResult) => {
-      return (
-        !lintResult.suppressedMessages?.length && (lintResult.errorCount > 0 || lintResult.warningCount > 0)
-      );
+      return lintResult.errorCount > 0 || lintResult.warningCount > 0;
     });
   }
 
diff --git a/heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts b/heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts
new file mode 100644
index 0000000000..3005d850c3
--- /dev/null
+++ b/heft-plugins/heft-lint-plugin/src/test/Eslint.test.ts
@@ -0,0 +1,202 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import path from 'node:path';
+
+import type * as TEslint from 'eslint';
+import * as ts from 'typescript';
+
+import type { IScopedLogger } from '@rushstack/heft';
+import { FileSystem, Path } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { Eslint } from '../Eslint';
+import type { IExtendedProgram, IExtendedSourceFile } from '../internalTypings/TypeScriptInternals';
+
+const PROJECT_FOLDER: string = path.resolve(__dirname, '../..');
+const FIXTURE_FOLDER: string = `${PROJECT_FOLDER}/temp/test/eslint-lint-cache`;
+// ESLint 9 loads its configuration with a dynamic import, which Jest doesn't support without
+// --experimental-vm-modules. So these tests load a stand-in for the ESLint package from a path that doesn't exist.
+const FAKE_ESLINT_PATH: string = `${FIXTURE_FOLDER}/node_modules/eslint`;
+
+const SOURCE: string = 'let a: any = 1;\nexport const b = a | 2;\n';
+
+const PREFER_CONST_WARNING: TEslint.Linter.LintMessage = {
+  ruleId: 'prefer-const',
+  severity: 1,
+  message: "'a' is never reassigned. Use 'const' instead.",
+  line: 1,
+  column: 5
+};
+
+const NO_BITWISE_ERROR: TEslint.Linter.LintMessage = {
+  ruleId: 'no-bitwise',
+  severity: 2,
+  message: "Unexpected use of '|'.",
+  line: 2,
+  column: 18
+};
+
+// With ESLint 9.37 or newer, @rushstack/eslint-patch adds a bulk suppression to the problem's suppressions, as an
+// eslint-disable comment does. So ESLint reports the problem in `suppressedMessages` instead of `messages`.
+const BULK_SUPPRESSED_ERROR: TEslint.Linter.SuppressedLintMessage = {
+  ruleId: '@typescript-eslint/no-explicit-any',
+  severity: 2,
+  message: 'Unexpected any. Specify a different type.',
+  line: 1,
+  column: 8,
+  suppressions: [{ kind: 'bulk', justification: '' }]
+};
+
+// The messages that the stand-in reports for every file that it lints.
+let fakeMessages: TEslint.Linter.LintMessage[] = [];
+let fakeSuppressedMessages: TEslint.Linter.SuppressedLintMessage[] = [];
+
+// The method names are ESLint's, so they don't end in "Async".
+/* eslint-disable @typescript-eslint/naming-convention */
+class FakeESLint {
+  public static readonly version: string = '9.37.0';
+
+  public async lintText(text: string, options: { filePath: string }): Promise<TEslint.ESLint.LintResult[]> {
+    // Like ESLint, count only the messages that aren't suppressed.
+    return [
+      {
+        filePath: options.filePath,
+        messages: fakeMessages,
+        suppressedMessages: fakeSuppressedMessages,
+        errorCount: fakeMessages.filter((message) => message.severity === 2).length,
+        fatalErrorCount: 0,
+        warningCount: fakeMessages.filter((message) => message.severity === 1).length,
+        fixableErrorCount: 0,
+        fixableWarningCount: 0,
+        usedDeprecatedRules: []
+      }
+    ];
+  }
+
+  public async calculateConfigForFile(): Promise<object> {
+    return {};
+  }
+
+  public async isPathIgnored(): Promise<boolean> {
+    return false;
+  }
+}
+/* eslint-enable @typescript-eslint/naming-convention */
+
+jest.doMock(FAKE_ESLINT_PATH, () => ({ ESLint: FakeESLint }), { virtual: true });
+// Eslint.initializeAsync() replaces the timer in this module before it loads the package.
+jest.doMock(`${FAKE_ESLINT_PATH}/lib/linter/timing`, () => ({ enabled: false }), { virtual: true });
+
+interface ILintRun {
+  lintedFileCounts: number[];
+  reports: string[];
+}
+
+function createProgram(): IExtendedProgram {
+  const filePath: string = `${FIXTURE_FOLDER}/src/a.ts`;
+  FileSystem.writeFile(filePath, SOURCE, { ensureFolderExists: true });
+  return ts.createProgram({
+    rootNames: [filePath],
+    options: {
+      configFilePath: `${FIXTURE_FOLDER}/tsconfig.json`,
+      noEmit: true,
+      types: []
+    }
+  }) as IExtendedProgram;
+}
+
+// Lints the program as one heft run does: a new linter reads the lint cache that the previous run wrote.
+async function lintAsync(
+  program: IExtendedProgram,
+  changedFiles: readonly IExtendedSourceFile[]
+): Promise<ILintRun> {
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+  const reports: string[] = [];
+  const logger: Partial<IScopedLogger> = {
+    terminal: new Terminal(terminalProvider),
+    emitError: (error: Error) => reports.push(`error ${error.message}`),
+    emitWarning: (warning: Error) => reports.push(`warning ${warning.message}`)
+  };
+
+  const linter: Eslint = await Eslint.initializeAsync({
+    scopedLogger: logger as IScopedLogger,
+    buildFolderPath: FIXTURE_FOLDER,
+    buildMetadataFolderPath: `${FIXTURE_FOLDER}/temp/lint`,
+    linterToolPath: FAKE_ESLINT_PATH,
+    linterConfigFilePath: `${FIXTURE_FOLDER}/eslint.config.js`,
+    tsProgram: program
+  });
+  const typeScriptFilenames: Set<string> = new Set(
+    program
+      .getRootFileNames()
+      .map((fileName: string) => Path.convertToSlashes(path.resolve(FIXTURE_FOLDER, fileName)))
+  );
+  await linter.performLintingAsync({
+    tsProgram: program,
+    typeScriptFilenames,
+    allProgramFilenames: typeScriptFilenames,
+    changedFiles: new Set(changedFiles)
+  });
+
+  const lintedFileCounts: number[] = Array.from(
+    terminalProvider.getVerboseOutput().matchAll(/Lint: [\d.]+ms \((\d+) files\)/g),
+    (match) => Number(match[1])
+  );
+  return { lintedFileCounts, reports };
+}
+
+describe('Eslint lint cache', () => {
+  beforeEach(() => {
+    FileSystem.ensureEmptyFolder(FIXTURE_FOLDER);
+    fakeMessages = [];
+    fakeSuppressedMessages = [];
+  });
+
+  it.each([
+    {
+      failure: 'a warning',
+      message: PREFER_CONST_WARNING,
+      report: "warning (prefer-const) 'a' is never reassigned. Use 'const' instead."
+    },
+    {
+      failure: 'an error',
+      message: NO_BITWISE_ERROR,
+      report: "error (no-bitwise) Unexpected use of '|'."
+    }
+  ])(
+    'lints a file again, and reports $failure again, when the file also has a suppressed message',
+    async ({ message, report }) => {
+      fakeMessages = [message];
+      fakeSuppressedMessages = [BULK_SUPPRESSED_ERROR];
+      const program: IExtendedProgram = createProgram();
+
+      expect(await lintAsync(program, program.getSourceFiles())).toEqual({
+        lintedFileCounts: [1],
+        reports: [report]
+      });
+
+      // Nothing changed, so TypeScript reports no changed files. The file has a lint failure, so it isn't in the
+      // lint cache: it's linted again, and the failure is reported again.
+      expect(await lintAsync(program, [])).toEqual({
+        lintedFileCounts: [1],
+        reports: [report]
+      });
+    }
+  );
+
+  it('caches a file whose messages are all suppressed', async () => {
+    fakeSuppressedMessages = [BULK_SUPPRESSED_ERROR];
+    const program: IExtendedProgram = createProgram();
+
+    expect(await lintAsync(program, program.getSourceFiles())).toEqual({
+      lintedFileCounts: [1],
+      reports: []
+    });
+
+    expect(await lintAsync(program, [])).toEqual({
+      lintedFileCounts: [0],
+      reports: []
+    });
+  });
+});

From 636b70cb1c40be580871ee0cc7b2c69c889e7b0c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 146/265] [rush-client-core] Say what a startup test's
 reservation pins

Swarm integration step 131; original commit 1d80464c2e (merge of swarm/o04-t133-nits-c1-int at 0147e14b79).
Scope: task 133-nits-c1.

Brings 133-nits-c1 (branch swarm/o04-t133-nits-c1-int). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 16 of 20. Gate: ch01 GATE OK board 4947 (tree 291bfd8666)

Commits folded into this step (1):
- d7a0508fc6 [rush-client-core] Say what a startup test's reservation pins

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../rush-client-core/src/test/connectOrStartDaemon.test.ts      | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 6987fdcb49..cdc645df00 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -448,6 +448,8 @@ describe('detached daemon startup', () => {
 
   it('waits out its deadline while another startup is reserved after the daemon that became ready exited', async () => {
     // As above, but the daemon exits once it has reserved another startup, as a successor's starter would.
+    // It reserves under its own PID, so its owner has exited too: this pins only that a reservation file
+    // makes the client wait. If the client ever checks that the owner is alive, this test must change.
     const started: number = Date.now();
     const error: Error = await connectOrStartDaemonAsync({
       ...options,

From 605ae9f929677cd11452f3faff83aecd782f43c7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 147/265] [rush-daemon] End held test fixture scripts after 2
 minutes

Swarm integration step 132; original commit f1c85170b9 (merge of swarm/o05-t235 at 64aa3de608).
Scope: task 235.

Brings 235 (branch swarm/o05-t235). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 17 of 20. Gate: ch01 GATE OK board 4947 (tree 026d38cdd8)

Commits folded into this step (1):
- 64aa3de608 [rush-daemon] End held test fixture scripts after 2 minutes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ture-script-deadline_2026-09-29-09-15.json | 11 +++
 .../src/test/DaemonGraphTestFixture.ts        | 21 +++++
 .../src/test/DaemonInstallationChange.test.ts | 16 ++--
 .../src/test/FixtureScriptDeadline.test.ts    | 79 +++++++++++++++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  | 17 ++--
 .../WorkspaceEnvironmentRestartReason.test.ts |  8 +-
 .../WorkspacePreparationAdmission.test.ts     | 13 +--
 .../test/WorkspaceRestartArbitration.test.ts  | 10 ++-
 .../WorkspaceServedScriptAdmission.test.ts    | 48 ++++++++---
 .../test/WorkspaceTransitionAdmission.test.ts |  8 +-
 10 files changed, 188 insertions(+), 43 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/fixture-script-deadline_2026-09-29-09-15.json
 create mode 100644 libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/fixture-script-deadline_2026-09-29-09-15.json b/common/changes/@rushstack/rush-daemon/fixture-script-deadline_2026-09-29-09-15.json
new file mode 100644
index 0000000000..0f32603994
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/fixture-script-deadline_2026-09-29-09-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test fixture scripts that wait for their test to release them now exit by themselves after 2 minutes, so a test that times out, or whose Jest worker exits first, no longer leaves them running.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index 8fd10c52dc..a6d0c6d3e5 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -32,6 +32,27 @@ import {
 import { assertSuccessfulNativeBuild } from './NativeBuildTestResult';
 import { removeTestFolderAsync } from './TestProcessExit';
 
+/**
+ * How long a fixture script that waits for its test may run. Keep it longer than the timeout of every test that uses
+ * it (60 s at most today). Each of these scripts runs in its own session (the daemon starts every operation that way),
+ * so when a test never reaches the `finally` that releases its script (the test timed out, or its Jest worker exited
+ * first), nothing else ends the script.
+ */
+export const FIXTURE_SCRIPT_DEADLINE_MS: number = 120_000;
+
+/**
+ * Prefixes `script` with a timer that ends it with exit code 1 once `deadlineMs` has passed. Use it for every fixture
+ * script that waits for a marker file its test writes or removes. The timer is unref'd, so a script that its test
+ * released still exits as soon as it finishes.
+ */
+export function withScriptDeadline(script: string, deadlineMs: number = FIXTURE_SCRIPT_DEADLINE_MS): string {
+  if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= 0) {
+    throw new RangeError(`Expected a positive whole number of milliseconds, not ${deadlineMs}.`);
+  }
+  const message: string = `fixture script: its test did not release it within ${deadlineMs} ms`;
+  return `setTimeout(()=>{console.error(${JSON.stringify(message)});process.exit(1);},${deadlineMs}).unref();${script}`;
+}
+
 export class DaemonGraphTestFixture implements AsyncDisposable {
   public session!: WorkspaceSession;
   public host!: RushDaemonHost;
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
index b6301178f9..e1c59c7438 100644
--- a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -20,7 +20,7 @@ import {
 import { captureDaemonInstallation, type CheckDaemonInstallation } from '../DaemonInstallationMonitor';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import type { WorkspaceSession } from '../WorkspaceSession';
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import {
   createDeferred,
   type DaemonRequestWireClient,
@@ -34,15 +34,17 @@ import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 jest.setTimeout(30_000);
 
 const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
-const LONG_BUILD_A: string =
+const LONG_BUILD_A: string = withScriptDeadline(
   "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
-  "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('finished-a'):setTimeout(wait,20);" +
-  'wait();';
+    "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('finished-a'):setTimeout(wait,20);" +
+    'wait();'
+);
 // A script such as a dev server, which runs until it is stopped.
-const SERVE_A: string =
+const SERVE_A: string = withScriptDeadline(
   "const fs=require('node:fs');fs.appendFileSync('../runs.txt','serve\\n');" +
-  "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
-  'wait();';
+    "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
+    'wait();'
+);
 const INSTALLATION_CHANGED_SHUTDOWN: string =
   `rushd (PID ${process.pid}) shutting down: its installation changed, ` +
   'so the next client starts a new daemon';
diff --git a/libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts b/libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts
new file mode 100644
index 0000000000..6fceaf8235
--- /dev/null
+++ b/libraries/rush-daemon/src/test/FixtureScriptDeadline.test.ts
@@ -0,0 +1,79 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+import type { Readable } from 'node:stream';
+
+import { FIXTURE_SCRIPT_DEADLINE_MS, withScriptDeadline } from './DaemonGraphTestFixture';
+
+jest.setTimeout(30_000);
+
+interface IScriptExit {
+  readonly exitCode: number | undefined;
+  readonly signal: string | undefined;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly elapsedMs: number;
+}
+
+function runScriptAsync(script: string): Promise<IScriptExit> {
+  const start: number = Date.now();
+  return new Promise((resolve, reject) => {
+    const child: childProcess.ChildProcessByStdio<null, Readable, Readable> = childProcess.spawn(
+      process.execPath,
+      ['-e', script],
+      { stdio: ['ignore', 'pipe', 'pipe'] }
+    );
+    let stdout: string = '';
+    let stderr: string = '';
+    child.stdout.setEncoding('utf8').on('data', (text: string) => (stdout += text));
+    child.stderr.setEncoding('utf8').on('data', (text: string) => (stderr += text));
+    child.on('error', reject);
+    child.on('close', (code, signal) =>
+      resolve({
+        exitCode: code ?? undefined,
+        signal: signal ?? undefined,
+        stdout,
+        stderr,
+        elapsedMs: Date.now() - start
+      })
+    );
+  });
+}
+
+describe(withScriptDeadline.name, () => {
+  it('ends a script that its test never released, with exit code 1 and one stderr line', async () => {
+    // Without the deadline, the script's own backstop would end it with exit code 7 after 10 s.
+    const result: IScriptExit = await runScriptAsync(
+      withScriptDeadline('setInterval(()=>{},20);setTimeout(()=>process.exit(7),10_000);', 300)
+    );
+    expect(result).toMatchObject({
+      exitCode: 1,
+      signal: undefined,
+      stdout: '',
+      stderr: 'fixture script: its test did not release it within 300 ms\n'
+    });
+    expect(result.elapsedMs).toBeGreaterThanOrEqual(300);
+  });
+
+  it('lets a script that its test released exit as soon as it finishes', async () => {
+    const result: IScriptExit = await runScriptAsync(
+      withScriptDeadline("setTimeout(()=>console.log('released'),50);", 20_000)
+    );
+    expect(result).toMatchObject({ exitCode: 0, signal: undefined, stdout: 'released\n', stderr: '' });
+    expect(result.elapsedMs).toBeLessThan(10_000);
+  });
+
+  it('outlasts the 60 s timeout of the tests that use it, by default', () => {
+    expect(FIXTURE_SCRIPT_DEADLINE_MS).toBeGreaterThan(60_000);
+    expect(withScriptDeadline('wait();')).toMatch(
+      new RegExp(`,${FIXTURE_SCRIPT_DEADLINE_MS}\\)\\.unref\\(\\);wait\\(\\);$`)
+    );
+  });
+
+  it('rejects a deadline that is not a positive whole number of milliseconds', () => {
+    for (const deadlineMs of [0, -1, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+      expect(() => withScriptDeadline('wait();', deadlineMs)).toThrow(RangeError);
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index b924f9480a..73aa9d4d7b 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -20,7 +20,7 @@ import {
 import type { IResolveDaemonRequestOptions, ResolvedDaemonRequest } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
@@ -38,8 +38,9 @@ interface IEarlyFailureFixtureOptions {
 }
 
 /** Keeps the output that it inherits open until the test removes the `hold` marker. */
-const HOLD_OUTPUT_SCRIPT: string =
-  "const fs=require('node:fs');const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);";
+const HOLD_OUTPUT_SCRIPT: string = withScriptDeadline(
+  "const fs=require('node:fs');const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);"
+);
 
 /**
  * b consumes a and c. a fails, and c holds its build open until the test removes the `hold` marker, so a build of b
@@ -77,10 +78,12 @@ function createEarlyFailureFixtureAsync({
     );
     created.write(
       'c/build.cjs',
-      "const fs=require('node:fs');" +
-        startOutputHolder +
-        "fs.appendFileSync('../runs.txt','c\\n');" +
-        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      withScriptDeadline(
+        "const fs=require('node:fs');" +
+          startOutputHolder +
+          "fs.appendFileSync('../runs.txt','c\\n');" +
+          "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      )
     );
   });
 }
diff --git a/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
index 003777a529..c67ee0af9b 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
@@ -13,7 +13,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
@@ -57,8 +57,10 @@ it('tells the request that restarts the daemon for its environment, and each req
     created.write('hold', '');
     created.write(
       'c/build.cjs',
-      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
-        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      withScriptDeadline(
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+          "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      )
     );
   });
   const clients: DaemonRequestWireClient[] = [];
diff --git a/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
index a1d868b232..6962ce26b4 100644
--- a/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspacePreparationAdmission.test.ts
@@ -14,7 +14,7 @@ import * as path from 'node:path';
 
 import * as rushLib from '@microsoft/rush-lib';
 
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import { createDeferred, type IDeferred, type ITerminalExchange } from './DaemonRequestWireTestUtilities';
 
 jest.setTimeout(60_000);
@@ -43,8 +43,10 @@ async function createFixtureAsync(): Promise<DaemonGraphTestFixture> {
     created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
     created.write(
       'a/build.cjs',
-      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
-        "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+      withScriptDeadline(
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+          "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+      )
     );
   });
 }
@@ -52,9 +54,8 @@ async function createFixtureAsync(): Promise<DaemonGraphTestFixture> {
 /** Makes the next project configuration capture, which a warm build runs before it is routed, take `CAPTURE_MS`. */
 function slowDownNextCapture(): IDeferred<void> {
   const captured: IDeferred<void> = createDeferred<void>();
-  const actual: typeof rushLib.captureProjectConfigurationFingerprintAsync = jest.requireActual<
-    typeof rushLib
-  >('@microsoft/rush-lib').captureProjectConfigurationFingerprintAsync;
+  const actual: typeof rushLib.captureProjectConfigurationFingerprintAsync =
+    jest.requireActual<typeof rushLib>('@microsoft/rush-lib').captureProjectConfigurationFingerprintAsync;
   captureMock.mockClear();
   captureMock.mockImplementationOnce(async (...args) => {
     await delayAsync(CAPTURE_MS);
diff --git a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
index 43c9d87866..9bd57768ea 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRestartArbitration.test.ts
@@ -10,7 +10,7 @@ import { DaemonFrameType, decodeDaemonControlMessage } from '@rushstack/rush-dae
 import type { DaemonControlMessage, IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
@@ -34,8 +34,10 @@ it('queues a mismatched-environment restart until matching queued and in-flight
     created.write('hold', '');
     created.write(
       'c/build.cjs',
-      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
-        "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      withScriptDeadline(
+        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+          "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+      )
     );
   });
   const order: string[] = [];
@@ -99,4 +101,4 @@ it('queues a mismatched-environment restart until matching queued and in-flight
       await fixture[Symbol.asyncDispose]();
     }
   }
-});
\ No newline at end of file
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index 87e6da4bc9..e74a9101cb 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -30,7 +30,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
-import { DaemonGraphTestFixture, responseSnapshot } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, responseSnapshot, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
@@ -85,9 +85,11 @@ function createServingFixtureAsync(
     );
     created.write(
       'a/serve.cjs',
-      "const fs=require('node:fs');const n=process.argv[2]||'serve';fs.appendFileSync('../runs.txt',n+'-start\\n');" +
-        "const t=setInterval(()=>{if(fs.existsSync('../release-'+n)){clearInterval(t);" +
-        "fs.appendFileSync('../runs.txt',n+'-end\\n');}},20);"
+      withScriptDeadline(
+        "const fs=require('node:fs');const n=process.argv[2]||'serve';fs.appendFileSync('../runs.txt',n+'-start\\n');" +
+          "const t=setInterval(()=>{if(fs.existsSync('../release-'+n)){clearInterval(t);" +
+          "fs.appendFileSync('../runs.txt',n+'-end\\n');}},20);"
+      )
     );
     configure?.(created);
   });
@@ -399,12 +401,18 @@ describe('a restart drain whose change is reverted', () => {
       const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
         admission: { waitTimeoutMs: 20_000 }
       });
-      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the build to wait for the drain');
+      await waitForAsync(
+        () => build.positions.length > 0 || build.settled(),
+        'the build to wait for the drain'
+      );
       const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
         ...SERVE2,
         cwd: path.join(fixture.folder, 'a')
       });
-      await waitForAsync(() => late.positions.length > 0 || late.settled(), 'the script to wait for the restart');
+      await waitForAsync(
+        () => late.positions.length > 0 || late.settled(),
+        'the script to wait for the restart'
+      );
       // Several rechecks find that the change is still there.
       await delayAsync(2500);
       expect(build.settled()).toBe(false);
@@ -447,7 +455,10 @@ describe('a restart drain whose change is reverted', () => {
       const pause: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'pause'], {
         admission: { waitTimeoutMs: 20_000 }
       });
-      await waitForAsync(() => pause.positions.length > 0 || pause.settled(), 'the request to wait for the drain');
+      await waitForAsync(
+        () => pause.positions.length > 0 || pause.settled(),
+        'the request to wait for the drain'
+      );
       await delayAsync(1500);
       expect(pause.settled()).toBe(false);
       // Like a build, the request is told why it waits (task 166).
@@ -490,7 +501,10 @@ describe('a restart drain whose change is reverted', () => {
       const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
         admission: { waitTimeoutMs: 20_000 }
       });
-      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the build to wait for the drain');
+      await waitForAsync(
+        () => build.positions.length > 0 || build.settled(),
+        'the build to wait for the drain'
+      );
       await delayAsync(2500);
       expect(build.settled()).toBe(false);
 
@@ -515,9 +529,11 @@ describe('a restart drain whose change is reverted', () => {
       // Project c builds until the test creates release-build.
       created.write(
         'c/build.cjs',
-        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c-start\\n');" +
-          "const t=setInterval(()=>{if(fs.existsSync('../release-build')){clearInterval(t);" +
-          "fs.appendFileSync('../runs.txt','c-end\\n');}},20);"
+        withScriptDeadline(
+          "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c-start\\n');" +
+            "const t=setInterval(()=>{if(fs.existsSync('../release-build')){clearInterval(t);" +
+            "fs.appendFileSync('../runs.txt','c-end\\n');}},20);"
+        )
       );
     });
     try {
@@ -529,12 +545,18 @@ describe('a restart drain whose change is reverted', () => {
       const build: IStreamedRequest = await startRequestAsync(fixture, ['build', '--to', 'c'], {
         admission: { waitTimeoutMs: 20_000 }
       });
-      await waitForAsync(() => build.positions.length > 0 || build.settled(), 'the build to wait for the drain');
+      await waitForAsync(
+        () => build.positions.length > 0 || build.settled(),
+        'the build to wait for the drain'
+      );
       const late: IStreamedRequest = await startRequestAsync(fixture, ['serve2'], {
         ...SERVE2,
         cwd: path.join(fixture.folder, 'a')
       });
-      await waitForAsync(() => late.positions.length > 0 || late.settled(), 'the script to wait for the restart');
+      await waitForAsync(
+        () => late.positions.length > 0 || late.settled(),
+        'the script to wait for the restart'
+      );
 
       // The drain ends as the script exits, so the build most likely finds the revert only after the drain.
       revert();
diff --git a/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
index 2d8586d358..2a8b6e30f6 100644
--- a/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceTransitionAdmission.test.ts
@@ -6,7 +6,7 @@ import * as path from 'node:path';
 
 import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
 
-import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import { createDeferred, type IDeferred, type ITerminalExchange } from './DaemonRequestWireTestUtilities';
 
 jest.setTimeout(60_000);
@@ -113,8 +113,10 @@ describe('workspace admission behind a graph transition', () => {
       created.write('.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\nrelease-a\n');
       created.write(
         'a/build.cjs',
-        "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
-          "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+        withScriptDeadline(
+          "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+            "const wait=()=>fs.existsSync('../release-a')?console.log('finished-a'):setTimeout(wait,20);wait();"
+        )
       );
     });
     const releaseFile: string = path.join(fixture.folder, 'release-a');

From 857fcb217bc77b41affe81397d9a1588b09a11cc Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:00 +0000
Subject: [PATCH 148/265] [rush-daemon] Test unreadable outputs, entry size and
 identity, and stalled digest workers

Swarm integration step 133; original commit 0b59409558 (merge of swarm/r02-t82-nits at 90984603de).
Refs: 82 NITs, board 3747.
Scope: task 239.

Brings 239 (branch swarm/r02-t82-nits). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 18 of 20. Gate: ch01 GATE OK board 4947 (tree 7f9d5dd87d)

Commits folded into this step (1):
- 90984603de [rush-daemon] Test unreadable outputs, entry size and identity, and stalled digest workers (82 NITs, board 3747)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ingerprint-gaps-test_2026-09-29-09-40.json | 11 +++
 ...rationOutputFingerprintsUnreadable.test.ts | 58 ++++++++++++++++
 .../test/OutputFolderDigestEntries.test.ts    | 68 +++++++++++++++++++
 .../test/OutputFolderDigestPoolStall.test.ts  | 66 ++++++++++++++++++
 4 files changed, 203 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/output-fingerprint-gaps-test_2026-09-29-09-40.json
 create mode 100644 libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts
 create mode 100644 libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts
 create mode 100644 libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/output-fingerprint-gaps-test_2026-09-29-09-40.json b/common/changes/@rushstack/rush-daemon/output-fingerprint-gaps-test_2026-09-29-09-40.json
new file mode 100644
index 0000000000..e0df7b98ad
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/output-fingerprint-gaps-test_2026-09-29-09-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a warm operation whose output folders can't be read re-runs until they can be read again, that the digest of an output file changes with its size or identity alone, and that a digest pool stops workers that stall.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts
new file mode 100644
index 0000000000..79a96f677b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprintsUnreadable.test.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import type { IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+
+import { OperationOutputFingerprints } from '../OperationOutputFingerprints';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(60_000);
+
+async function buildToBAsync(fixture: IFixture, requestId: string): Promise<IDaemonPhasedRequestResult> {
+  const { terminal } = await runAsync(fixture, requestId, ['build', '--to', 'b']);
+  expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+  return (terminal as { payload: IDaemonPhasedRequestResult }).payload;
+}
+
+describe(OperationOutputFingerprints.name, () => {
+  const canRevokeReadAccess: boolean = process.platform !== 'win32' && process.getuid?.() !== 0;
+  (canRevokeReadAccess ? it : it.skip)(
+    're-runs a warm operation on every request while its declared outputs cannot be read',
+    async () => {
+      const fixture: IFixture = await createFixtureAsync();
+      const libPath: string = path.join(fixture.repoRoot, 'projects/a/lib');
+      const unreadablePath: string = path.join(libPath, 'unreadable');
+      try {
+        await buildToBAsync(fixture, 'initial');
+        expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+        const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+
+        // Adding the folder changes the output folder, so the reconciliation re-runs a.
+        fs.mkdirSync(unreadablePath);
+        fs.chmodSync(unreadablePath, 0);
+        expect(await buildToBAsync(fixture, 'added')).toMatchObject({ scheduled: true });
+        expect(runs(fixture).slice(2)).toEqual(['a:one:']);
+
+        // The output folder is unchanged from here on, so only the content check re-runs a.
+        const { ino, mtimeMs } = fs.statSync(libPath);
+        expect(await buildToBAsync(fixture, 'unreadable')).toMatchObject({ scheduled: true });
+        expect(runs(fixture).slice(3)).toEqual(['a:one:']);
+        fs.chmodSync(unreadablePath, 0o755);
+        expect(await buildToBAsync(fixture, 'readable')).toMatchObject({ scheduled: true });
+        expect(runs(fixture).slice(4)).toEqual(['a:one:']);
+        expect(fs.statSync(libPath)).toMatchObject({ ino, mtimeMs });
+
+        expect(await buildToBAsync(fixture, 'unchanged')).toMatchObject({ scheduled: false });
+        expect(runs(fixture)).toHaveLength(5);
+        expect(fixture.session.operationGraph).toBe(graph);
+      } finally {
+        if (fs.existsSync(unreadablePath)) fs.chmodSync(unreadablePath, 0o755);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts
new file mode 100644
index 0000000000..36e25ebab9
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestEntries.test.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+
+/** A whole second, so the modification time that a test sets reads back exactly. */
+const MODIFIED_TIME: Date = new Date('2026-01-01T00:00:00.000Z');
+
+describe(digestOutputFolders.name, () => {
+  let projectFolder: string;
+  let nestedFolder: string;
+  let filePath: string;
+  let folderSet: IOutputFolderSet;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-entries-'));
+    nestedFolder = path.join(projectFolder, 'lib', 'nested');
+    filePath = path.join(nestedFolder, 'output.js');
+    fs.mkdirSync(nestedFolder, { recursive: true });
+    fs.writeFileSync(filePath, 'one');
+    fs.utimesSync(filePath, MODIFIED_TIME, MODIFIED_TIME);
+    folderSet = { projectFolder, folderNames: ['lib'] };
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  it('changes when only the size of a nested file changes', () => {
+    const { ino, mtimeMs } = fs.statSync(filePath);
+    const before: string | undefined = digestOutputFolders(folderSet).digest;
+    fs.appendFileSync(filePath, ' more');
+    fs.utimesSync(filePath, MODIFIED_TIME, MODIFIED_TIME);
+    expect(fs.statSync(filePath)).toMatchObject({ ino, mtimeMs });
+    expect(digestOutputFolders(folderSet).digest).not.toBe(before);
+  });
+
+  it('changes when a nested file is replaced by one with the same size and modification time', () => {
+    // Outside the output folder, so the listing is the same before and after the rename.
+    const replacementPath: string = path.join(projectFolder, 'replacement.js');
+    fs.writeFileSync(replacementPath, 'one');
+    fs.utimesSync(replacementPath, MODIFIED_TIME, MODIFIED_TIME);
+    const { ino, size, mtimeMs } = fs.statSync(filePath);
+    const before: string | undefined = digestOutputFolders(folderSet).digest;
+    fs.renameSync(replacementPath, filePath);
+    const replaced: fs.Stats = fs.statSync(filePath);
+    expect(replaced).toMatchObject({ size, mtimeMs });
+    expect(replaced.ino).not.toBe(ino);
+    expect(digestOutputFolders(folderSet).digest).not.toBe(before);
+  });
+
+  const canRevokeReadAccess: boolean = process.platform !== 'win32' && process.getuid?.() !== 0;
+  (canRevokeReadAccess ? it : it.skip)('has no digest while a nested folder cannot be read', () => {
+    const readable: IOutputFolderDigest = digestOutputFolders(folderSet);
+    expect(readable.digest).toEqual(expect.any(String));
+    fs.chmodSync(nestedFolder, 0);
+    try {
+      expect(digestOutputFolders(folderSet).digest).toBeUndefined();
+    } finally {
+      fs.chmodSync(nestedFolder, 0o755);
+    }
+    expect(digestOutputFolders(folderSet)).toEqual(readable);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts
new file mode 100644
index 0000000000..a67d947d23
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPoolStall.test.ts
@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { Worker } from 'node:worker_threads';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import { OutputFolderDigestPool } from '../OutputFolderDigestPool';
+
+const THREAD_COUNT: number = 2;
+
+describe(OutputFolderDigestPool.name, () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-stall-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('stops its workers when they stall', async () => {
+    const folderSets: IOutputFolderSet[] = ['a', 'b', 'c'].map((name: string) => {
+      const projectFolder: string = path.join(root, name);
+      fs.mkdirSync(path.join(projectFolder, 'lib'), { recursive: true });
+      fs.writeFileSync(path.join(projectFolder, 'lib', 'output.js'), name);
+      return { projectFolder, folderNames: ['lib'] };
+    });
+    // Claims every folder set and never publishes a result.
+    const stalledWorkerPath: string = path.join(root, 'stalled-worker.js');
+    fs.writeFileSync(
+      stalledWorkerPath,
+      [
+        "const { parentPort } = require('node:worker_threads');",
+        'parentPort.on("message", ({ folderSets, state }) => {',
+        '  while (Atomics.add(state, 0, 1) < folderSets.length) {}',
+        '});'
+      ].join('\n')
+    );
+    const terminate: jest.SpyInstance<Promise<number>, []> = jest.spyOn(Worker.prototype, 'terminate');
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      workerScriptPath: stalledWorkerPath,
+      stallTimeoutMs: 200,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(
+        folderSets.map((folderSet: IOutputFolderSet): IOutputFolderDigest => digestOutputFolders(folderSet))
+      );
+      expect(pool.stalled).toBe(true);
+      // The digest itself stopped each worker once, and each worker's thread exits.
+      const stoppedWorkers: Worker[] = terminate.mock.contexts;
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+      expect(new Set(stoppedWorkers).size).toBe(THREAD_COUNT);
+      await Promise.all(terminate.mock.results.map(({ value }: jest.MockResult<Promise<number>>) => value));
+      expect(stoppedWorkers.map(({ threadId }: Worker) => threadId)).toEqual([-1, -1]);
+    } finally {
+      pool.dispose();
+      terminate.mockRestore();
+    }
+  }, 20_000);
+});

From 363cffc5ff346b3fffdd695b70fd7265d2a26dcd Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:01 +0000
Subject: [PATCH 149/265] [rush-cli-client] Test that a wait line for other
 variables doesn't stop the restart notice

Swarm integration step 134; original commit e62983f879 (merge of swarm/r06-t222-nit1 at 7cb5585c96).
Refs: task 222, NIT board 4399.
Scope: task 222-nit1.

Brings 222-nit1 (branch swarm/r06-t222-nit1). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 19 of 20. Gate: ch01 GATE OK board 4947 (tree ec3109b104)

Commits folded into this step (1):
- 7cb5585c96 [rush-cli-client] Test that a wait line for other variables doesn't stop the restart notice (task 222, NIT board 4399)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/daemonRestartNotice.test.ts              |  9 +++++++++
 .../r06-t222-nit1_2026-09-29-09-55.json               | 11 +++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/r06-t222-nit1_2026-09-29-09-55.json

diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index b4a9f6cf24..aab692d03b 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -505,6 +505,15 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
           },
           notice("A command's environment differed from the daemon's in NODE_OPTIONS and RUSH_X", 42)
         ],
+        [
+          'as many other variables',
+          async (handlers) => {
+            const waitReason: DaemonRestartReason = { kind: 'environmentChanged', variableNames: ['RUSH_X'] };
+            await handlers.onQueuePositionAsync(1, waitReason, {});
+            await handlers.onRestartAsync({ restart: 1, reason: ENV_NODE_OPTIONS, successorPid: 42 });
+          },
+          notice("A command's environment differed from the daemon's in NODE_OPTIONS", 42)
+        ],
         [
           'another change',
           async (handlers) => {
diff --git a/common/changes/@rushstack/rush-cli-client/r06-t222-nit1_2026-09-29-09-55.json b/common/changes/@rushstack/rush-cli-client/r06-t222-nit1_2026-09-29-09-55.json
new file mode 100644
index 0000000000..6ae04488bc
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r06-t222-nit1_2026-09-29-09-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test that a wait line for other variables, as many as the restart's, doesn't stop the restart notice.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From be85a49b8a8b334e19f93509f0782c998fe28d18 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 12:44:01 +0000
Subject: [PATCH 150/265] [rush-daemon] Serve the phased commands of
 command-line.json (task 35 step A) (and 17 more)

Swarm integration step 135; original commit 4286b8f643 (merge of swarm/r02-t140-nit1-int8 at a0cefd5bb2).
Scope: task 140-nit1-int8.

Brings 140-nit1-int8 (branch swarm/r02-t140-nit1-int8). Second agents and evidence: ch01's GATE OK board 4947.

s18 batch E2b, item 20 of 20. Gate: ch01 GATE OK board 4947 (tree dac294edad)

Commits folded into this step (18):
- b8db1ce0c1 [rush-daemon] Serve the phased commands of command-line.json (task 35 step A)
- 6cb2fa4c66 [rush-daemon] Share one engine between phased commands (task 52)
- 11d214dc2a [rush-daemon] Move the native engine test fixture into its own module
- 7ffbd6518a [rush-lib] Test that an iteration that allows no incremental build runs the initial command and sets the base
- ce54989d32 [rush-lib] Let declared command-agnostic plugins tap runAnyPhasedCommand without blocking engine sharing
- ac925e31a4 [rush-lib] Name the parameters that differ when a daemon engine can't serve a request
- f1d4370da4 [rush-lib] Test that a non-incremental iteration enables operations that a plugin found up to date
- e8e6287196 Test that a shared engine logs each request's telemetry under the request's own command
- 0439a3d936 Answer a custom command's usage error only as 78 answers build's (35 x 78, 35 x 167)
- be67131f0f Say how the daemon answers an invalid custom command line in the change file (t06 board 3592 NIT 2)
- bb334b52da Format the files of the D2 merge with Prettier
- 1bb81ccb29 Reload with a graph-affecting parameter in 78 NIT 7's test, since build's engine serves --ignore-hooks (140 x D2)
- f5e9c91709 Test the parse that the identity check keeps with 140's engine sharing and origin check (146 x 140)
- e0612c809e Move 35's custom-command tests out of ProductionDaemonRequestResolver.test.ts (140 x 82, max-lines)
- 0c5e7cd739 Keep commands that are not incremental off engines with persistent IPC runners (52 x persistentIpc)
- 9c5ba56dc0 Move the RushX holder and legacy-request tests to 35's custom-command parse (ch01 board 4236)
- 0ecbe7a28a Document that persistent IPC runners keep rebuild on its own graph (52 x persistentIpc)
- 1eb52cd473 [rush-daemon] Test the name check of a request that reuses its identity check's parse (t06 NIT 1, board 3898)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   5 +-
 .../src/test/RushXDaemonAlias.test.ts         |   4 +
 .../src/test/RushXDaemonBoundaries.test.ts    |  13 +-
 ...and-agnostic-plugins_2026-09-28-22-40.json |  11 +
 ...ing-names-parameters_2026-09-28-23-02.json |  11 +
 ...6-ipc-engine-sharing_2026-09-29-08-55.json |  11 +
 ...stom-phased-commands_2026-09-28-17-52.json |  11 +
 ...ased-command-engines_2026-09-28-20-55.json |  11 +
 ...nt6-rushx-test-seams_2026-09-29-08-55.json |  11 +
 ...arse-name-check-test_2026-09-29-07-04.json |  11 +
 ...stom-phased-commands_2026-09-28-17-52.json |  11 +
 ...ased-command-engines_2026-09-28-20-55.json |  11 +
 common/reviews/api/rush-daemon.api.md         |   3 +-
 common/reviews/api/rush-lib.api.md            |   6 +
 docs/rush/dogfooding-rush-daemon.md           |  36 ++-
 docs/rush/environment-variables.md            |   1 +
 libraries/rush-daemon/README.md               |  38 ++-
 .../src/DaemonRequestDispatcher.ts            |   9 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  26 +-
 .../src/ProductionDaemonRequestResolver.ts    | 140 ++++++--
 .../src/RushCommandRequestPolicy.ts           |  24 +-
 .../src/WorkspaceRequestLifecycle.ts          |  31 +-
 .../src/test/DaemonGraphGeneration.test.ts    |   3 +-
 .../src/test/DaemonRequestUsageError.test.ts  |  65 +++-
 .../src/test/NativeEngineTestFixture.ts       |  88 ++++-
 .../src/test/PhasedRequestBatching.test.ts    |  18 +-
 .../ProductionDaemonCustomCommands.test.ts    | 111 +++++++
 .../test/ProductionDaemonRequestParse.test.ts |  42 ++-
 .../ProductionDaemonRequestResolver.test.ts   |  23 +-
 .../src/test/RushCommandRequestPolicy.test.ts |  21 ++
 .../test/WorkspaceEarlyFailureResult.test.ts  |  12 +-
 .../src/test/WorkspaceEngineSharing.test.ts   | 269 ++++++++++++++++
 libraries/rush-lib/assets/rush-init/rush.json |   5 +-
 .../rush-lib/src/api/DaemonConfiguration.ts   |  27 +-
 .../src/api/EnvironmentConfiguration.ts       |   3 +
 .../rush-lib/src/api/PhasedCommandEngine.ts   | 192 +++++++++--
 .../src/api/PhasedCommandEngineUsageError.ts  |   2 +-
 .../src/api/test/DaemonConfiguration.test.ts  | 109 ++++---
 .../src/api/test/PhasedCommandEngine.test.ts  | 302 +++++++++++++++++-
 ...asedCommandEngineParameterIdentity.test.ts |  17 +-
 .../test/PhasedCommandEngineSharing.test.ts   | 243 ++++++++++++++
 .../test/WorkspaceInputFingerprint.test.ts    |   2 +
 .../cli/scriptActions/PhasedScriptAction.ts   | 200 +++++++++++-
 .../operations/CacheableOperationPlugin.ts    |   3 +-
 .../src/logic/operations/IOperationGraph.ts   |  12 +
 .../src/logic/operations/LegacySkipPlugin.ts  |   4 +-
 .../src/logic/operations/OperationGraph.ts    |  15 +-
 .../logic/operations/PhasedOperationPlugin.ts |   5 +-
 ...ableOperationPluginRetainedResults.test.ts |  24 +-
 .../IncrementalExecutionGuardPlugin.test.ts   |  29 +-
 ...asedOperationPluginRetainedResults.test.ts |  88 ++++-
 .../pluginFramework/PhasedCommandHookTaps.ts  |  72 +++++
 .../PluginLoader/PluginLoaderBase.ts          |   5 +
 .../src/pluginFramework/PluginManager.ts      |  32 +-
 .../test/PhasedCommandHookTaps.test.ts        |  86 +++++
 .../schemas/rush-plugin-manifest.schema.json  |   4 +
 .../rush-lib/src/schemas/rush.schema.json     |   9 +
 57 files changed, 2373 insertions(+), 204 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/command-agnostic-plugins_2026-09-28-22-40.json
 create mode 100644 common/changes/@microsoft/rush/daemon-sharing-names-parameters_2026-09-28-23-02.json
 create mode 100644 common/changes/@microsoft/rush/r02-t140-int6-ipc-engine-sharing_2026-09-29-08-55.json
 create mode 100644 common/changes/@microsoft/rush/serve-custom-phased-commands_2026-09-28-17-52.json
 create mode 100644 common/changes/@microsoft/rush/share-phased-command-engines_2026-09-28-20-55.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r02-t140-int6-rushx-test-seams_2026-09-29-08-55.json
 create mode 100644 common/changes/@rushstack/rush-daemon/identity-parse-name-check-test_2026-09-29-07-04.json
 create mode 100644 common/changes/@rushstack/rush-daemon/serve-custom-phased-commands_2026-09-28-17-52.json
 create mode 100644 common/changes/@rushstack/rush-daemon/share-phased-command-engines_2026-09-28-20-55.json
 create mode 100644 libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
 create mode 100644 libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
 create mode 100644 libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts
 create mode 100644 libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 752c4d2e9c..a40a79e41e 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -217,8 +217,9 @@ Request cwd, environment, argv, width and color are captured before connecting.
 The protocol currently expresses request color as a boolean; subscriptions carry
 the corresponding color level. There is no SIGWINCH forwarding.
 
-The standalone host now binds native `build`/`rebuild` requests to a reusable
-all-project graph. Native Rush parsing, project selection, graph plugins, and
+The standalone host now binds native `build`/`rebuild` requests, and the phased
+commands of command-line.json (such as `test`), to a reusable all-project graph.
+Global commands still run in-process. Native Rush parsing, project selection, graph plugins, and
 incremental/cache semantics are reused rather than spawning another Rush CLI.
 The client renders operation headers, collated text, and activity events; global
 command byte streams remain byte-preserving. A `rushx build` script never claims
diff --git a/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts b/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
index b8f81115f6..46cf4dfe3a 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonAlias.test.ts
@@ -158,8 +158,12 @@ console.log(JSON.stringify({
       kind: 'global',
       executor: holdAsync
     });
+    // The workspace parses a custom Rush command before it captures inputs, and that parse falls back in this
+    // fixture. A built-in origin reaches the mocked resolution unparsed, and an unknown built-in command is
+    // still exclusive.
     const holder = fixture.runAsync({
       ...fixture.request(['hold'], path.join(physicalRoot, 'projects/a')),
+      commandOrigin: 'built-in',
       invocationKind: 'rush'
     });
     await holding;
diff --git a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
index 7c6c90cdaa..06a862bf2b 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonBoundaries.test.ts
@@ -194,7 +194,14 @@ describe('native Rushx execution boundaries', () => {
       kind: 'global',
       executor: holdAsync
     });
-    const holder = fixture.runAsync({ ...fixture.request(['hold'], cwd), invocationKind: 'rush' });
+    // The workspace parses a custom Rush command before it captures inputs, and that parse falls back in this
+    // fixture. A built-in origin reaches the mocked resolution unparsed, and an unknown built-in command is
+    // still exclusive.
+    const holder = fixture.runAsync({
+      ...fixture.request(['hold'], cwd),
+      commandOrigin: 'built-in',
+      invocationKind: 'rush'
+    });
     await holding;
     const onQueuePositionAsync = jest.fn(async () => undefined);
     try {
@@ -212,7 +219,9 @@ describe('native Rushx execution boundaries', () => {
 
   it('does not guess package scripts for legacy or custom workspace requests', async () => {
     const cwd: string = await startAsync();
-    const phased = jest.spyOn(fixture.phasedResolver, 'resolveRequestAsync');
+    // The workspace parses a custom Rush command before it captures inputs, and this fixture's requests fall
+    // back there. A rushx request never reaches that parse.
+    const phased = jest.spyOn(fixture.phasedResolver, 'getCommandParameterIdentityAsync');
     for (const invocationKind of [undefined, 'rush'] as const) {
       const request: IDaemonRequestEnvelope = { ...fixture.request(['build'], cwd), invocationKind };
       expect((await fixture.runAsync(request)).outcome).toMatchObject({
diff --git a/common/changes/@microsoft/rush/command-agnostic-plugins_2026-09-28-22-40.json b/common/changes/@microsoft/rush/command-agnostic-plugins_2026-09-28-22-40.json
new file mode 100644
index 0000000000..0534b582dd
--- /dev/null
+++ b/common/changes/@microsoft/rush/command-agnostic-plugins_2026-09-28-22-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let a daemon engine serve other phased commands while a Rush plugin taps the `runAnyPhasedCommand` hook, if the plugin is declared command-agnostic through the `daemonCommandAgnostic` manifest field, the rush.json `daemon.commandAgnosticPlugins` setting, or the `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS` environment variable. The reason an engine is not shared now names the plugin whose tap prevents it.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/daemon-sharing-names-parameters_2026-09-28-23-02.json b/common/changes/@microsoft/rush/daemon-sharing-names-parameters_2026-09-28-23-02.json
new file mode 100644
index 0000000000..da279126fd
--- /dev/null
+++ b/common/changes/@microsoft/rush/daemon-sharing-names-parameters_2026-09-28-23-02.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a daemon engine can't serve a request because the parameters differ, the reason now names the parameters that differ, for example `--test-path-pattern for \"_phase:test\"`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/r02-t140-int6-ipc-engine-sharing_2026-09-29-08-55.json b/common/changes/@microsoft/rush/r02-t140-int6-ipc-engine-sharing_2026-09-29-08-55.json
new file mode 100644
index 0000000000..5cc926536f
--- /dev/null
+++ b/common/changes/@microsoft/rush/r02-t140-int6-ipc-engine-sharing_2026-09-29-08-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "A long-lived engine host no longer serves a command that is not incremental, such as `rebuild`, on an engine that runs persistent IPC runners (`daemon.usePersistentIpcRunners`), because those runners serve only incremental commands (`PhasedCommandEngine.getEngineSharingBlocker`). Such a command gets its own engine, which runs the scripts of the operations that it selects.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/serve-custom-phased-commands_2026-09-28-17-52.json b/common/changes/@microsoft/rush/serve-custom-phased-commands_2026-09-28-17-52.json
new file mode 100644
index 0000000000..98456a9fb5
--- /dev/null
+++ b/common/changes/@microsoft/rush/serve-custom-phased-commands_2026-09-28-17-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let a long-lived engine host parse the phased commands of command-line.json, such as `test`, in addition to `build` and `rebuild`, and expose whether a parsed command is incremental. Build event-hook scripts block only `build` and `rebuild`, which are the only commands that run them.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/share-phased-command-engines_2026-09-28-20-55.json b/common/changes/@microsoft/rush/share-phased-command-engines_2026-09-28-20-55.json
new file mode 100644
index 0000000000..096e824e36
--- /dev/null
+++ b/common/changes/@microsoft/rush/share-phased-command-engines_2026-09-28-20-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let a long-lived engine host serve a request of one phased command on the engine of another, for example `rebuild` on a `build` engine or `build` on a `test` engine, when the engine's graph has the operations of the request and gives the same arguments to its phases, and the same plugins are associated with both commands (`PhasedCommandEngine.getEngineSharingBlocker`). An iteration of an operation graph can now disallow incremental builds (`IOperationGraphIterationOptions.isIncrementalBuildAllowed`), so that such a `rebuild` runs every operation that it selects, without earlier results, build cache restores or the legacy skip check.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r02-t140-int6-rushx-test-seams_2026-09-29-08-55.json b/common/changes/@rushstack/rush-cli-client/r02-t140-int6-rushx-test-seams_2026-09-29-08-55.json
new file mode 100644
index 0000000000..690b855dd3
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r02-t140-int6-rushx-test-seams_2026-09-29-08-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/identity-parse-name-check-test_2026-09-29-07-04.json b/common/changes/@rushstack/rush-daemon/identity-parse-name-check-test_2026-09-29-07-04.json
new file mode 100644
index 0000000000..8f6802e425
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/identity-parse-name-check-test_2026-09-29-07-04.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a request which reuses the parse of its identity check is rejected when its command name does not match that parse.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/serve-custom-phased-commands_2026-09-28-17-52.json b/common/changes/@rushstack/rush-daemon/serve-custom-phased-commands_2026-09-28-17-52.json
new file mode 100644
index 0000000000..9b6c19a27f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/serve-custom-phased-commands_2026-09-28-17-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Serve the phased commands of command-line.json, such as `test` and `retest`, on their own warm graph. An incremental command shares build admission like `build`; a non-incremental one is exclusive like `rebuild`. Global commands are still rejected, before any workspace input is read, so the client runs them in-process. After a build, the daemon answers an invalid command line of a custom phased command, such as `rush test --nope`, with native Rush's exit code 2; a command line that names no phased command, such as `rush nope` or `rush hello --nope`, goes back to the client.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/share-phased-command-engines_2026-09-28-20-55.json b/common/changes/@rushstack/rush-daemon/share-phased-command-engines_2026-09-28-20-55.json
new file mode 100644
index 0000000000..5b76f4473e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/share-phased-command-engines_2026-09-28-20-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Serve phased commands on one shared engine where possible instead of reloading the graph whenever the command changes: a `test` engine serves `build` and `rebuild`, and a `build` engine serves `rebuild`, which runs every operation that it selects. The first `test` after a `build` reloads the graph once. A custom command whose engine could not serve the current engine's command either, such as `retest` after `build`, is unsupported, so the client runs it in-process instead of making the daemon switch between two engines.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index eb6876f777..e2227d4820 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -485,6 +485,7 @@ export interface IResolvedDaemonGlobalRequest {
 // @beta
 export interface IResolvedDaemonPhasedRequest {
     readonly exactSelection?: boolean;
+    readonly exclusivityClass?: RequestExclusivityClass;
     // (undocumented)
     readonly kind: 'phased';
     // (undocumented)
@@ -765,7 +766,7 @@ export type MapWorkspaceInvalidationsToOperationsAsync = (options: IMapWorkspace
 // @beta
 export class PhasedRequestRouter {
     constructor(workspaceSession: IWorkspaceSession);
-    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings, telemetry?: IPhasedRequestTelemetrySink, receivedTimeMs?: number): Promise<IDaemonPhasedRequestResult>;
+    executeAsync(request: IDaemonPhasedRequest, client: IPhasedRequestClient, exactSelection?: boolean, onExecutionStarting?: () => void, requestSettings?: IPhasedCommandEngineRequestSettings, telemetry?: IPhasedRequestTelemetrySink, receivedTimeMs?: number, requestExclusivityClass?: RequestExclusivityClass): Promise<IDaemonPhasedRequestResult>;
 }
 
 // @beta
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 3724303a3f..6d202a4612 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -329,6 +329,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_WARM_SET_MAX_PROJECTS: "RUSH_DAEMON_WARM_SET_MAX_PROJECTS";
     readonly RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: "RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY";
     readonly RUSH_DAEMON_COMPATIBLE_PLUGINS: "RUSH_DAEMON_COMPATIBLE_PLUGINS";
+    readonly RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS: "RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS";
     readonly RUSH_DAEMON_EXPERIMENTAL: "RUSH_DAEMON_EXPERIMENTAL";
 };
 
@@ -527,6 +528,7 @@ export interface ICustomTipsJson {
 export interface IDaemonConfigurationJson {
     readonly autoStart?: boolean;
     readonly autoWarmByTelemetry?: boolean;
+    readonly commandAgnosticPlugins?: ReadonlyArray<string>;
     readonly compatiblePlugins?: ReadonlyArray<string>;
     readonly enabled?: boolean;
     readonly idleTimeoutSeconds?: number;
@@ -801,6 +803,7 @@ export interface IOperationGraphIterationOptions {
     getOperationRequestId?: (operation: Operation) => string | undefined;
     // (undocumented)
     inputsSnapshot?: IInputsSnapshot;
+    isIncrementalBuildAllowed?: boolean;
     startTime?: number;
 }
 
@@ -1011,6 +1014,7 @@ export interface IPhasedCommandEngineLogTelemetryOptions {
 
 // @alpha
 export interface IPhasedCommandEngineRequestSettings {
+    readonly isIncrementalBuildAllowed: boolean;
     // (undocumented)
     readonly parallelism: Parallelism;
     // (undocumented)
@@ -1594,6 +1598,8 @@ export class PhasedCommandEngine {
     readonly commandName: string;
     createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine>;
     createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData;
+    getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession): string | undefined;
+    readonly isIncremental: boolean;
     // (undocumented)
     readonly parameterIdentity: string;
     static parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine>;
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 83fb73a3bb..26aeb9912d 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -91,7 +91,15 @@ rush-client build --to @rushstack/tree-pattern
 ```
 
 Any project selection that `rush build` accepts works, including projects in the `build-tests-subspace`
-subspace. `rush-client rebuild` is also supported.
+subspace. `rush-client rebuild` is also supported, as are the phased commands of command-line.json
+(for example `rush-client test`). Commands share the warm graph where they can: a `test` graph also serves
+`build` and `rebuild`, and a `build` graph serves `rebuild`. The first `rush-client test` after a build reloads
+the graph once; later builds reuse the test graph. A custom command whose graph could not serve the current
+graph's command either, such as `retest` (which is not incremental) after a build, runs in-process instead, so
+that the two commands don't reload the graph on every switch. With `daemon.usePersistentIpcRunners`, a
+command that is not incremental never runs on another command's graph, because persistent IPC runners serve
+only incremental commands. After a `rush-client test`, for example, `rebuild` reloads the graph and `retest`
+runs in-process.
 
 ## 4. Confirm that the daemon served the build
 
@@ -184,9 +192,10 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   `VSCODE_*` value from another terminal window, or a changed `PATH`, restarts the daemon before anything runs,
   and the new process then serves the request. This is not a fallback, but it costs a cold start and changes
   `pid`. Run related requests from the same terminal.
-- **Only phased `build` and `rebuild` use the warm engine.** `rush start` (which always watches),
+- **Only phased commands use the warm engine:** `build`, `rebuild`, and the phased commands of
+  command-line.json. Global commands, `rush start` (which always watches),
   `--watch`, `--install`, `--variant`, and `--node-diagnostic-dir` stay native, as do build event-hook
-  scripts and reporter controls such as `--output`. Keep using ordinary Rush for `install`, `update`, and
+  scripts (for `build` and `rebuild`, the only commands that run them) and reporter controls such as `--output`. Keep using ordinary Rush for `install`, `update`, and
   other commands. `rushx-client` keeps scripts attached to a TTY in-process.
 - **No persistent Heft or TypeScript workers by default.** Each operation still starts its Heft process; the
   daemon saves Rush startup and graph construction, not compilation. The `usePersistentIpcRunners`/`daemonIpc`
@@ -314,9 +323,13 @@ The engine lifecycle that a declared plugin must support:
 - **Once per engine:** the plugin's `apply()`, `runAnyPhasedCommand`, `runPhasedCommand.for(<command>)`,
   `createOperationsAsync` and `onGraphCreatedAsync`. The engine builds the graph for every project, with
   `isWatch` false; each request then selects operations from it. A request whose parameters differ from the
-  engine's (other than project selection, `--verbose`, `--parallelism` and `--timeline`) or a changed
+  engine's (other than project selection, `--include-phase-deps`, `--ignore-hooks`, `--verbose`, `--parallelism`
+  and `--timeline`) or a changed
   configuration file replaces the engine, and the new engine applies the plugin again in the same process.
-  Module-level state therefore outlives an engine.
+  Module-level state therefore outlives an engine. An engine serves another command, such as `rebuild` on a
+  `build` engine, only if the same plugins are associated with both commands, no plugin taps the
+  `runPhasedCommand` hook of either command, and every plugin that taps `runAnyPhasedCommand` is declared
+  command-agnostic (below), because Rush calls these hooks only with the command that created the engine.
 - **Once per iteration:** the operation graph hooks, such as `configureIteration`,
   `beforeExecuteIterationAsync`, `before`/`afterExecuteOperationAsync`, `createEnvironmentForOperation` and
   `afterExecuteIterationAsync`. One iteration can serve several concurrent requests. If every operation that
@@ -340,6 +353,19 @@ Rules for a daemon-compatible plugin:
   clients, and output written while the engine is created reaches the request that created it; the daemon
   drops output written between iterations.
 
+A plugin that taps `runAnyPhasedCommand` keeps an engine from serving any command other than the one that
+created it, unless the plugin is also declared command-agnostic: what it does from that hook doesn't depend on
+the command. Its callbacks there, and the command hooks that they tap in turn (such as `createOperationsAsync`
+and `onGraphCreatedAsync`), don't read the command's name, its parameters, its phase selection or
+`isIncrementalBuildAllowed`. A plugin that only reads `isWatch`, for example, is command-agnostic. Declare it the
+same three ways as above: `"daemonCommandAgnostic": true` in the manifest, the `rush.json` setting
+`"daemon": { "commandAgnosticPlugins": [...] }`, or `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS` in one shell. The
+same release rules apply: releases whose schemas predate these settings reject them, and then only the
+variable works, only for `rush-client`, and only with an engine that recognizes it. The declaration covers only
+the taps that the plugin's `apply()` adds; a tap added later, an interceptor on the hook, or a tap of
+`runPhasedCommand` still keeps the engine to its own command. When a plugin keeps an engine to its own command,
+a request of another command replaces the engine, or, for a `rush-client` custom command that neither engine
+could serve, falls back to native Rush with a message that names the plugin.
 Node.js loads a plugin's code only once, so the daemon treats the installed package folder of every configured
 plugin as part of its implementation: a change to a plugin's `.js` or `.json` files, including through a
 `link:` dependency, starts a new daemon for the next request. Declaration (`lib-dts`) and ES module (`lib-esm`)
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index e89f8206d5..0144927f44 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -34,6 +34,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
 | `RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY` | `0` | Rank retention using measured time saved, frequency and memory, with conservative LRU fallback. Never speculatively executes scripts. Overrides `autoWarmByTelemetry`. |
 | `RUSH_DAEMON_COMPATIBLE_PLUGINS` | empty | Comma-separated `pluginName` values of configured Rush plugins that the repository has verified for long-lived daemon engines, in addition to plugins whose manifest sets `daemonCompatible`. Entries are trimmed; an empty entry is an error, and an empty value lists no plugins. Part of the daemon's environment identity. Overrides `compatiblePlugins`. See [Rush plugins in daemon engines](./dogfooding-rush-daemon.md#rush-plugins-in-daemon-engines). |
+| `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS` | empty | Comma-separated `pluginName` values of configured Rush plugins that the repository has verified to be command-agnostic, in addition to plugins whose manifest sets `daemonCommandAgnostic`. Their `runAnyPhasedCommand` taps then don't keep a daemon engine from serving other phased commands. Entries are trimmed; an empty entry is an error, and an empty value lists no plugins. Part of the daemon's environment identity. Overrides `commandAgnosticPlugins`. See [Rush plugins in daemon engines](./dogfooding-rush-daemon.md#rush-plugins-in-daemon-engines). |
 | `RUSH_DAEMON_EXPERIMENTAL` | `0` | Enable the experimental `rush-client daemon graph` command surface. Does not start a daemon or enable builds; no corresponding `rush.json` property. |
 
 The timeout maximum is the signed 32-bit millisecond limit used by Node.js `setTimeout`,
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index c054b1bce1..7ac5610c79 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -84,7 +84,8 @@ a workspace graph. Embedded hosts can install the composite explicitly; omitting
 
 ### Bounded native engine integration
 
-`PhasedCommandEngine` in `rush-lib` parses native `build` and `rebuild` commands without invoking CLI execution,
+`PhasedCommandEngine` in `rush-lib` parses native `build` and `rebuild` commands, and the phased commands of
+command-line.json, without invoking CLI execution,
 initializing `.env`, changing the process working directory, or mutating `process.env`. Graph preparation reuses
 `PhasedScriptAction`'s standard operation, sharding, shell-runner, validation, cache/legacy-skip, and situational
 plugin pipeline. It does not launch a Rush CLI subprocess. The graph includes every project, and native
@@ -118,8 +119,10 @@ environment, so it sees the submitting shell's values, as a native command would
 the daemon's `process.env` when the operation starts, so it includes variables that a plugin sets in the same
 iteration's `beforeExecuteIterationAsync`; state hashes use the values from when the iteration was scheduled, before
 those hooks run, as native Rush does.
-Compatible selections reuse the same graph and records. An unchanged successful build schedules no work; rebuild
-still invalidates the graph on each request. Every execution refreshes operation inputs under its native lease.
+Compatible selections reuse the same graph and records. An unchanged successful build schedules no work. A
+`rebuild`, or another command with `"incremental": false`, runs every operation that it selects again, without
+earlier results, build cache restores or the legacy skip check, and the graph keeps the new results for later
+requests. Every execution refreshes operation inputs under its native lease.
 With the build cache enabled, a cacheable operation whose tracked input files change while the inputs snapshot is
 taken or while it executes is not kept as up to date, whether or not cache writes are allowed: the next request runs
 it and its consumers again, even if the files were changed back in between. Operations whose build cache is
@@ -308,9 +311,24 @@ resolver before replacing its session, and disposes the current resolver at shut
 its normal disposer to its owned delegates.
 
 **Client integration boundary:** the resolver requires `commandOrigin: "built-in"` for native
-`build`/`rebuild`. The standalone client identifies these workspace commands while leaving
-`rushx build` and other script invocations custom. The resolver also validates the native parsed
-action; identical script names alone never authorize a workspace build.
+`build`/`rebuild` and `commandOrigin: "custom"` for the phased commands of command-line.json. The
+standalone client identifies these workspace commands while leaving `rushx build` and other script
+invocations custom. The resolver also validates the native parsed action; identical script names alone
+never authorize a workspace build. Commands share one graph where they can
+(`PhasedCommandEngine.getEngineSharingBlocker`). The graph of an incremental command serves another phased
+command if it has every operation of the phases that the request selects, both commands give the same arguments
+to the phases that the request can run, the same plugins are associated with both commands, and no plugin taps
+`runAnyPhasedCommand` or the `runPhasedCommand` hook of either command. So a `test` graph serves `build` and
+`rebuild`, and a `build` graph serves `rebuild`. The graph of a non-incremental command serves only that
+command. With `daemon.usePersistentIpcRunners`, no other graph serves a non-incremental command such as
+`rebuild` either, because persistent IPC runners serve only incremental commands. Any other built-in request
+reloads the graph. Any other custom request reloads it only if the new
+graph could serve the current graph's command, so that two commands never replace each other's graph on every
+request; otherwise, for example `retest` after `build`, it is rejected as unsupported and the client runs it
+in-process. Each request keeps its own admission class: an incremental custom command shares build admission
+like `build`; one with `"incremental": false` is exclusive and reruns its selection like `rebuild`. A global
+command, or a built-in command that is not phased, is rejected as unsupported before any workspace input is read,
+so the client runs it in-process.
 
 ### Explicit persistent Node operations
 
@@ -339,9 +357,11 @@ including on Windows. Descriptor args and non-ignored native custom parameter to
 quotes, spaces and shell metacharacters are not parsed or expanded. Native cwd, environment, IPC stdio and
 process ownership are preserved. No shell string is rewritten to obtain a launcher.
 
-Only unsharded incremental daemon builds use this path. Rebuild, ordinary/native fallback, empty/missing
-canonical scripts, and preassigned runners (including shard/collator and architectural NoOp nodes) retain their
-native behavior. Existing watch-only `:ipc` declarations and the graph's `isWatch` setting are unchanged.
+Only unsharded graphs of incremental commands use this path. A graph created by `rebuild`, ordinary/native
+fallback, empty/missing canonical scripts, and preassigned runners (including shard/collator and architectural
+NoOp nodes) retain their native behavior. A `rebuild` that the graph of an incremental command serves first closes
+the runners of the operations that it selects, so each one starts cold, as in a native `rush rebuild` process.
+Existing watch-only `:ipc` declarations and the graph's `isWatch` setting are unchanged.
 The existing `--no-ipc` is honored when the native command registers it. IPC runners remain **non-cacheable**,
 as in native watch mode; this is an explicit execution/cache-policy choice. Their hash still uses the native
 canonical command and non-ignored custom parameters, not an invented command identity.
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index a5e2ab84e3..4cd9da596f 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -21,6 +21,7 @@ import { PhasedRequestRouter } from './PhasedRequestRouter';
 import type { IGlobalCommandRequestClient } from './GlobalCommandRequestClient';
 import type { IPhasedRequestTelemetrySink } from './PhasedRequestTelemetry';
 import type { IWorkspaceSession } from './WorkspaceSession';
+import type { RequestExclusivityClass } from './RequestScheduler';
 import { DaemonGraphRequestRouter } from './DaemonGraphRequestRouter';
 import { getDaemonGraphObserver } from './DaemonGraphObserver';
 import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
@@ -36,6 +37,11 @@ export interface IResolvedDaemonPhasedRequest {
   readonly exactSelection?: boolean;
   /** Verbosity and parallelism for this request; applied to the shared graph before its iteration. */
   readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+  /**
+   * Workspace admission class of the parsed command. Defaults to the built-in command classification, which
+   * makes every command that is not built in `EXCLUSIVE`.
+   */
+  readonly exclusivityClass?: RequestExclusivityClass;
   /** Receives the request's telemetry report once it has taken part in a graph iteration or no-op check. */
   readonly telemetry?: IPhasedRequestTelemetrySink;
 }
@@ -222,7 +228,8 @@ async function dispatchWorkspaceRequestAsync(
       onExecutionStarting,
       resolved.requestSettings,
       resolved.telemetry,
-      lifecycleInfo?.receivedTimeMs ?? client.receivedTimeMs
+      lifecycleInfo?.receivedTimeMs ?? client.receivedTimeMs,
+      resolved.exclusivityClass
     );
   }
   const globalRouter: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(workspaceSession);
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 540a707d82..bb74726281 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -194,6 +194,7 @@ export class PhasedRequestRouter {
    *
    * `receivedTimeMs` is the `performance.now()` timestamp at which the daemon received the request. The request can
    * join a batch whose input reconcile started after this time. It defaults to the time of this call.
+   * `requestExclusivityClass` is the admission class chosen by the resolver; it defaults to `classifyRushCommand`.
    */
   public async executeAsync(
     request: IDaemonPhasedRequest,
@@ -202,7 +203,8 @@ export class PhasedRequestRouter {
     onExecutionStarting?: () => void,
     requestSettings?: IPhasedCommandEngineRequestSettings,
     telemetry?: IPhasedRequestTelemetrySink,
-    receivedTimeMs?: number
+    receivedTimeMs?: number,
+    requestExclusivityClass?: RequestExclusivityClass
   ): Promise<IDaemonPhasedRequestResult> {
     const startTimeMs: number = performance.now();
     validateRequestIdentity(request);
@@ -221,10 +223,12 @@ export class PhasedRequestRouter {
     }
     const graph: IDualEmitOperationGraph = getDualEmitGraph(this.#workspaceSession);
     const routingState: IGraphRoutingState = getGraphRoutingState(graph, this.#workspaceSession);
-    const exclusivityClass: RequestExclusivityClass = classifyRushCommand({
-      commandName: request.commandName,
-      commandOrigin: request.commandOrigin
-    });
+    const exclusivityClass: RequestExclusivityClass =
+      requestExclusivityClass ??
+      classifyRushCommand({
+        commandName: request.commandName,
+        commandOrigin: request.commandOrigin
+      });
     const workspaceScheduler: RequestScheduler = getWorkspaceRequestScheduler(this.#workspaceSession);
     let admissionController: RequestAdmissionController | undefined;
     let admissionLease: IRequestLease;
@@ -551,6 +555,15 @@ class PhasedRequestBatchCoordinator {
           this.#finishDetachedEntry(entry);
         }
       }
+      // Batches never mix request settings (`requestSettingsKey`).
+      const isIncrementalBuildAllowed: boolean | undefined =
+        participants[0].requestSettings?.isIncrementalBuildAllowed;
+      if (isIncrementalBuildAllowed === false) {
+        // Like a native `rush rebuild` process, a non-incremental request starts every operation it runs cold.
+        await this.#graph.closeRunnersAsync(
+          Array.from(this.#graph.operations).filter((operation: Operation) => operation.enabled !== false)
+        );
+      }
       const demand: PhasedIterationDemand = new PhasedIterationDemand(() => this.#onBatchAbandoned(demand));
       this.#batchDemand = demand;
       const unsubscribeDemand: () => void = this.#multiplexer.subscribe(demand);
@@ -590,7 +603,8 @@ class PhasedRequestBatchCoordinator {
         timings.scheduleStartTimeMs = performance.now();
         scheduled = await this.#graph.scheduleIterationAsync({
           inputsSnapshot: this.#workspaceSession.inputsSnapshot,
-          ...createOperationParticipantLookups(participants)
+          ...createOperationParticipantLookups(participants),
+          isIncrementalBuildAllowed
         });
         timings.scheduledTimeMs = performance.now();
         if (scheduled) {
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 2fbcf08eee..7b6dc27d08 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -17,9 +17,13 @@ import {
   type IOperationGraph,
   type ITelemetryData,
   type Operation,
-  type OperationEnabledState
+  type OperationEnabledState,
+  type RushSession
 } from '@microsoft/rush-lib';
-import type { IDaemonPhasedOperationSelection, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import type {
+  IDaemonPhasedOperationSelection,
+  IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
 
 import {
   DaemonRequestDispatchError,
@@ -38,10 +42,19 @@ import type { IWorkspaceSession, IWorkspaceSessionComponents } from './Workspace
 import { EngineTerminalProvider } from './EngineTerminalProvider';
 import { OperationOutputFingerprints } from './OperationOutputFingerprints';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
-import type { IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
+import { BUILT_IN_RUSH_COMMAND_CLASSIFICATION, classifyPhasedRushCommand } from './RushCommandRequestPolicy';
 import { createInputsCompatibilityCheck, getOperationsWithChangedInputs } from './WorkspaceInputsComparison';
 import { createDaemonRequestTelemetrySink, type IDaemonEngineCreationTiming } from './DaemonRequestTelemetry';
 
+const BUILT_IN_PHASED_COMMAND_NAMES: ReadonlySet<string> = new Set(['build', 'rebuild']);
+
+/** The parsed command that created an engine, and the Rush session that its plugins were applied to. */
+interface IBoundEngine {
+  readonly command: PhasedCommandEngine;
+  readonly rushSession: RushSession | undefined;
+}
+
 /** A native parse of the command line of a request. */
 interface IParsedCommand {
   readonly command: PhasedCommandEngine;
@@ -51,25 +64,32 @@ interface IParsedCommand {
 }
 
 /**
- * Binds the standalone host to a real native build/rebuild graph on its first request.
+ * Binds the standalone host to a real native phased command graph on its first request.
  *
  * @remarks
- * A host is pinned to its first command and graph-affecting, non-selection parameters. Presentation and
- * scheduling parameters (`--verbose`, `--parallelism`, `--timeline`) are applied per request instead.
- * Incompatible parameters,
+ * A host is pinned to the engine of its first command. That engine serves every later request whose command it can
+ * serve (`PhasedCommandEngine.getEngineSharingBlocker`): requests of the same command whose graph-affecting,
+ * non-selection parameters are the same, and, if the first command is incremental, requests of other commands, for
+ * example `rebuild` on the engine of `build`, or `build` on the engine of `test`. Presentation and scheduling
+ * parameters (`--verbose`, `--parallelism`, `--timeline`) and whether the command is incremental are applied per
+ * request instead.
+ * Another built-in command, or another custom command whose own engine could serve the first command, replaces
+ * the engine through a reload; any other custom command is unsupported, so that the host never switches back and
+ * forth between two engines. Incompatible parameters,
  * environments, or graph inputs are rejected before scheduling; no request is retried automatically.
- * The initial supported surface excludes external plugins that participate in the requested command
+ * It serves build, rebuild and the phased commands of command-line.json. The initial supported surface excludes
+ * external plugins that participate in the requested command
  * (unless their manifest or the repository declares them daemon-compatible), .env initialization,
- * install/watch, event-hook scripts, and rushx/global commands. Use the unchanged native CLI for those surfaces.
+ * install/watch, build event-hook scripts, and rushx/global commands. Use the unchanged native CLI for those surfaces.
  * @beta
  */
 export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   #binding: Promise<void> | undefined;
+  #boundCommand: PhasedCommandEngine | undefined;
   /** The request whose handling created the warm engine, and when it did. */
   #engineCreation: (IDaemonEngineCreationTiming & { readonly requestId: string }) | undefined;
   #logTelemetry: EngineLogTelemetry | undefined;
   #loggedRequestCount: number = 0;
-  #parameterIdentity: string | undefined;
   #workspaceSession: IWorkspaceSession | undefined;
   readonly #environmentIdentity: string;
   readonly #preparationLock: LockFile | undefined;
@@ -111,12 +131,41 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     });
   }
 
-  /** Inspects the native command shape without constructing or executing an operation graph. */
+  /**
+   * Inspects the native command shape without constructing or executing an operation graph.
+   *
+   * @remarks
+   * Returns the identity of the bound engine's command when that engine can serve the request, so that the
+   * lifecycle reuses it, and the request's own identity otherwise, so that the lifecycle reloads. A custom command
+   * that the bound engine cannot serve, and whose own engine could not serve the bound engine's command, is
+   * unsupported.
+   */
   public async getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string> {
+    const { envelope, workspaceSession } = options;
     const parsed: IParsedCommand = await this.#parseCommandAsync(options);
     // Resolving the same request uses this parse instead of parsing the same command line again.
     this.#identityParses.set(options.abortSignal, parsed);
-    return parsed.command.parameterIdentity;
+    const { command } = parsed;
+    const engine: IBoundEngine | undefined = await this.#tryGetBoundEngineAsync(workspaceSession);
+    if (!engine) return command.parameterIdentity;
+    const blocker: string | undefined = getEngineSharingBlocker(engine, command);
+    if (blocker === undefined) return engine.command.parameterIdentity;
+    if (envelope.commandOrigin === 'custom') {
+      const reverseBlocker: string | undefined = getEngineSharingBlocker(
+        { command, rushSession: engine.rushSession },
+        engine.command
+      );
+      if (reverseBlocker !== undefined) {
+        const engineName: string = engine.command.commandName;
+        throw new DaemonRequestDispatchError(
+          'unsupported',
+          `The daemon's engine, created by "${engineName}", cannot serve "${command.commandName}" because ` +
+            `${blocker}, and an engine created by "${command.commandName}" could not serve "${engineName}" ` +
+            `because ${reverseBlocker}.`
+        );
+      }
+    }
+    return command.parameterIdentity;
   }
 
   public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
@@ -128,14 +177,11 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     );
     let bindingStartTimeMs: number | undefined;
     if (this.#binding) {
-      if (
-        this.#parameterIdentity !== command.parameterIdentity ||
-        this.#workspaceSession !== workspaceSession
-      ) {
+      if (!(await this.#canServeAsync(command, workspaceSession))) {
         throw new WorkspaceEngineRecreationRequiredError();
       }
     } else {
-      this.#parameterIdentity = command.parameterIdentity;
+      this.#boundCommand = command;
       this.#workspaceSession = workspaceSession;
       bindingStartTimeMs = performance.now();
       const binding: Promise<void> = this.#bindAsync(command, terminal, workspaceSession);
@@ -143,7 +189,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       void binding.catch((error: unknown) => {
         if (error instanceof PhasedCommandEngineBusyError && this.#binding === binding) {
           this.#binding = undefined;
-          this.#parameterIdentity = undefined;
+          this.#boundCommand = undefined;
           this.#workspaceSession = undefined;
         }
       });
@@ -177,6 +223,11 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       kind: 'phased',
       exactSelection: true,
       requestSettings: command.requestSettings,
+      exclusivityClass: classifyPhasedRushCommand({
+        commandName: command.commandName,
+        commandOrigin: envelope.commandOrigin,
+        isIncremental: command.isIncremental
+      }),
       telemetry: logTelemetry
         ? createDaemonRequestTelemetrySink({
             command,
@@ -207,6 +258,32 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     };
   }
 
+  /** Whether the engine bound to `session` can serve `command`; see `PhasedCommandEngine.getEngineSharingBlocker`. */
+  async #canServeAsync(command: PhasedCommandEngine, session: IWorkspaceSession): Promise<boolean> {
+    if (this.#workspaceSession !== session) return false;
+    // Equal identities need no initialized engine; the caller then awaits the binding and sees its error, if any.
+    if (this.#boundCommand?.parameterIdentity === command.parameterIdentity) return true;
+    const engine: IBoundEngine | undefined = await this.#tryGetBoundEngineAsync(session);
+    return !!engine && getEngineSharingBlocker(engine, command) === undefined;
+  }
+
+  /**
+   * The command and session of the engine bound to `session`, or undefined if none is bound to it or it failed to
+   * initialize. The lifecycle binds engines under an exclusive transition lease, so no request that holds a lease
+   * waits here for a binding in progress.
+   */
+  async #tryGetBoundEngineAsync(session: IWorkspaceSession): Promise<IBoundEngine | undefined> {
+    const binding: Promise<void> | undefined = this.#binding;
+    const command: PhasedCommandEngine | undefined = this.#boundCommand;
+    if (!binding || !command || this.#workspaceSession !== session) return undefined;
+    try {
+      await binding;
+    } catch {
+      return undefined;
+    }
+    return { command, rushSession: session.rushSession };
+  }
+
   /** Returns the parse of the identity check of this request, if its command line and session are unchanged. */
   #takeIdentityParse(options: IResolveDaemonRequestOptions): IParsedCommand | undefined {
     const parsed: IParsedCommand | undefined = this.#identityParses.get(options.abortSignal);
@@ -219,10 +296,17 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     identityParse?: IParsedCommand
   ): Promise<IParsedCommand> {
     const { envelope, workspaceSession, abortSignal } = options;
-    if (!['build', 'rebuild'].includes(envelope.commandName) || envelope.commandOrigin !== 'built-in') {
+    if (isRushxInvocation(envelope)) {
+      throw new DaemonRequestDispatchError('unsupported', 'A rushx script is not a phased command request.');
+    }
+    if (
+      Object.hasOwn(BUILT_IN_RUSH_COMMAND_CLASSIFICATION, envelope.commandName) &&
+      !BUILT_IN_PHASED_COMMAND_NAMES.has(envelope.commandName)
+    ) {
+      // Skips parsing, because command-line.json cannot redefine a built-in command.
       throw new DaemonRequestDispatchError(
         'unsupported',
-        'The production daemon requires an explicitly identified native build/rebuild request. Ambiguous custom/rushx requests require --no-daemon.'
+        `"${envelope.commandName}" is a built-in command that is not phased.`
       );
     }
     if (environmentIdentity(envelope.environment) !== this.#environmentIdentity) {
@@ -259,10 +343,15 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
       }
     }
-    if (parsed.command.commandName !== envelope.commandName) {
+    // Clients mark only build and rebuild as built-in; every other phased command comes from command-line.json.
+    if (
+      parsed.command.commandName !== envelope.commandName ||
+      BUILT_IN_PHASED_COMMAND_NAMES.has(parsed.command.commandName) !==
+        (envelope.commandOrigin === 'built-in')
+    ) {
       throw new DaemonRequestDispatchError(
         'invalidRequest',
-        'The command name does not match the native parsed argv.'
+        'The command name or origin does not match the native parsed argv.'
       );
     }
     if (abortSignal.aborted)
@@ -413,6 +502,13 @@ function environmentIdentity(environment: Readonly<Record<string, string | undef
   return JSON.stringify(getWorkspaceFingerprintEnvironmentEntries(environment));
 }
 
+/** Explains why `engine` cannot serve `request`, or returns undefined if it can. */
+function getEngineSharingBlocker(engine: IBoundEngine, request: PhasedCommandEngine): string | undefined {
+  if (engine.command.parameterIdentity === request.parameterIdentity) return undefined;
+  if (!engine.rushSession) return 'the engine has no Rush session';
+  return engine.command.getEngineSharingBlocker(request, engine.rushSession);
+}
+
 /** Whether a parse has exactly the inputs that parsing the command line of this request would have. */
 function isSameCommandLine(parsed: IParsedCommand, options: IResolveDaemonRequestOptions): boolean {
   const { envelope, workspaceSession } = options;
diff --git a/libraries/rush-daemon/src/RushCommandRequestPolicy.ts b/libraries/rush-daemon/src/RushCommandRequestPolicy.ts
index 44c753ac24..ef44219d06 100644
--- a/libraries/rush-daemon/src/RushCommandRequestPolicy.ts
+++ b/libraries/rush-daemon/src/RushCommandRequestPolicy.ts
@@ -51,7 +51,8 @@ export const BUILT_IN_RUSH_COMMAND_CLASSIFICATION: Readonly<Record<string, Reque
  * Classifies a parsed Rush command for workspace admission.
  *
  * @remarks
- * Repository-defined, plugin-defined, and future commands fail closed to `EXCLUSIVE`.
+ * Repository-defined, plugin-defined, and future commands fail closed to `EXCLUSIVE`. A resolver that has
+ * parsed a repository-defined phased command classifies it with `classifyPhasedRushCommand` instead.
  *
  * @beta
  */
@@ -63,3 +64,24 @@ export function classifyRushCommand(options: IRushCommandClassificationOptions):
     ? BUILT_IN_RUSH_COMMAND_CLASSIFICATION[options.commandName]
     : RequestExclusivityClass.Exclusive;
 }
+
+export interface IPhasedRushCommandClassificationOptions extends IRushCommandClassificationOptions {
+  /** False for `rebuild` and for command-line.json phased commands with `"incremental": false`. */
+  readonly isIncremental: boolean;
+}
+
+/**
+ * Classifies a phased command that the daemon parsed natively and serves on its warm graph.
+ *
+ * @remarks
+ * Built-in commands use {@link BUILT_IN_RUSH_COMMAND_CLASSIFICATION}. A phased command from command-line.json
+ * shares build admission when it is incremental, like `build`, and is exclusive otherwise, like `rebuild`.
+ */
+export function classifyPhasedRushCommand(
+  options: IPhasedRushCommandClassificationOptions
+): RequestExclusivityClass {
+  if (options.commandOrigin === 'custom') {
+    return options.isIncremental ? RequestExclusivityClass.SharedBuild : RequestExclusivityClass.Exclusive;
+  }
+  return classifyRushCommand(options);
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 374837c37c..56916de718 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -586,7 +586,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         };
       }
       if (
-        envelope.commandOrigin !== 'built-in' ||
+        envelope.commandOrigin === 'built-in' &&
         !['build', 'rebuild', 'install', 'update'].includes(envelope.commandName)
       ) {
         return {
@@ -597,14 +597,23 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           fingerprint: this.#fingerprint
         };
       }
+      let commandIdentity: string | undefined;
+      if (envelope.commandOrigin === 'custom') {
+        // Only phased custom commands are served. Parsing before any input capture rejects a global command
+        // before it can reload or restart this workspace.
+        commandIdentity = await tryGetCustomCommandParameterIdentityAsync(this.#resolver, {
+          envelope,
+          workspaceSession: session,
+          abortSignal: client.abortSignal
+        });
+      }
       // The client changes the workspace before it sends a request, so any capture that started after the request
       // was received sees those changes. Captures that must detect changes made during a transition stay strict.
       let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope, receivedTimeMs);
       let tier: WorkspaceInputChangeTier = this.#classify(fingerprint, isMutation(envelope));
-      let commandIdentity: string | undefined;
       let projectFingerprint: string | undefined;
       if (tier !== WorkspaceInputChangeTier.Restart && !isMutation(envelope)) {
-        commandIdentity = await getCommandParameterIdentityAsync(
+        commandIdentity ??= await getCommandParameterIdentityAsync(
           this.#resolver,
           { envelope, workspaceSession: session, abortSignal: client.abortSignal },
           this.#isConfigurationCurrent(session, tier)
@@ -1319,6 +1328,22 @@ async function getCommandParameterIdentityAsync(
   }
 }
 
+/**
+ * Parses a custom command before the input capture, or returns `undefined` for a usage error. The parse after the
+ * capture answers that error only if the configuration is current (`getCommandParameterIdentityAsync`).
+ */
+async function tryGetCustomCommandParameterIdentityAsync(
+  resolver: IDaemonRequestResolver,
+  options: IResolveDaemonRequestOptions
+): Promise<string | undefined> {
+  try {
+    return await getResolverLifecycle(resolver).getCommandParameterIdentityAsync(options);
+  } catch (error) {
+    if (error instanceof DaemonRequestUsageError) return undefined;
+    throw error;
+  }
+}
+
 /** A request rejected as invalid after the resolver bound a graph to the session: its selection failed. */
 function isSelectionRejection(
   error: unknown,
diff --git a/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts b/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts
index 85691cc703..dae915e0ba 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphGeneration.test.ts
@@ -90,8 +90,9 @@ describe('graph-generation fencing over the native daemon wire', () => {
 
     it('rejects an old reference after same-process soft reload without applying it to the replacement graph', () =>
       runWithFixtureAsync(async (fixture) => {
+        // A graph-affecting parameter replaces the engine; `rebuild` would run on the engine of `build`.
         assertSuccessfulNativeBuild(
-          await fixture.runAsync(['rebuild', '--to', 'b', '--parallelism', '3']),
+          await fixture.runAsync(['build', '--to', 'b', '--parallelism', '3', '--changed-projects-only']),
           fixture.session.operationGraph
         );
         const current = responseSnapshot(await fixture.graphAsync('status'));
diff --git a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
index 4b21f9946d..504370ea4b 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
@@ -3,6 +3,7 @@
 
 import type { IOperationGraph } from '@microsoft/rush-lib';
 import { LockFile } from '@rushstack/node-core-library';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
 
@@ -44,6 +45,63 @@ it('fails an invalid command line with the exit code of native Rush instead of h
   }
 });
 
+it('answers an invalid command line of a custom phased command as it does one of build, and of no other custom command', async () => {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync((created) => {
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: [
+          {
+            commandKind: 'phased',
+            name: 'build',
+            phases: ['_phase:compile'],
+            incremental: true,
+            enableParallelism: true
+          },
+          {
+            commandKind: 'phased',
+            name: 'test',
+            summary: 'Builds and tests',
+            phases: ['_phase:compile'],
+            incremental: true,
+            enableParallelism: true
+          },
+          { commandKind: 'global', name: 'hello', summary: 'Hello', shellCommand: 'echo hello' }
+        ]
+      })
+    );
+  });
+  try {
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    const testMessage: string = 'rush test: error: Unrecognized arguments: --nope.';
+    const invalidTest: string[] = ['test', '--to', 'b', '--nope'];
+    // A custom command is parsed before the input capture, but its usage error waits for the same check as build's.
+    expect((await fixture.runAsync(invalidTest, custom)).terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { code: 'unsupported', message: testMessage }
+    });
+    expect((await fixture.buildAsync()).terminal).toMatchObject(success);
+    expect((await fixture.runAsync(invalidTest, custom)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 2, outcome: 'failure', aborted: false, errorMessage: testMessage }
+    });
+    // The daemon serves no global or unknown command, so in-process Rush reports its invalid command line.
+    for (const argv of [
+      ['hello', '--nope'],
+      ['nope', '--to', 'b']
+    ]) {
+      expect((await fixture.runAsync(argv, custom)).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported' }
+      });
+    }
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+});
+
 it('hands an invalid command line to in-process Rush after a configuration change, which parses it again', async () => {
   const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
   try {
@@ -71,14 +129,17 @@ it('hands an invalid command line to in-process Rush while the warm set waits fo
   try {
     expect((await fixture.buildAsync()).terminal).toMatchObject(success);
     expect((await fixture.runAsync(invalid)).terminal).toMatchObject(usageFailure);
-    // Other parameters need a reload. It stops the warm set before it takes the Rush lock, which this test holds.
+    // A graph-affecting parameter needs a reload (the engine of build serves --ignore-hooks itself). The reload
+    // stops the warm set before it takes the Rush lock, which this test holds.
     const native: LockFile | undefined = LockFile.tryAcquire(
       fixture.session.rushConfiguration.commonTempFolder,
       'rush'
     );
     expect(native).toBeDefined();
     try {
-      expect((await fixture.runAsync(['build', '--to', 'b', '--ignore-hooks'])).terminal).toMatchObject({
+      expect(
+        (await fixture.runAsync(['build', '--to', 'b', '--changed-projects-only'])).terminal
+      ).toMatchObject({
         kind: 'requestRejected',
         payload: { message: expect.stringContaining('Another Rush command') }
       });
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
index b8e0dccbf8..240d69b734 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -6,12 +6,13 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
 
-import { Rush, RushUserConfiguration } from '@microsoft/rush-lib';
+import { Rush, RushUserConfiguration, type ITelemetryData } from '@microsoft/rush-lib';
 import {
   DaemonFrameType,
   decodeDaemonLogChunk,
   type IDaemonRequestEnvelope
 } from '@rushstack/rush-daemon-protocol';
+import type { LockFile } from '@rushstack/node-core-library';
 
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import { RushDaemonHost } from '../RushDaemonHost';
@@ -51,6 +52,10 @@ export interface IFixtureOptions {
   readonly incrementalScript?: boolean;
   /** Sets `daemon.incrementalBuilds` in rush.json. */
   readonly incrementalBuilds?: boolean;
+  /** Adds the phased `test` (incremental) and `retest` commands, with a `_phase:test`, and a global `hello`. */
+  readonly customCommands?: boolean;
+  /** Adds a preRushBuild event hook, which only build and rebuild run. */
+  readonly buildEventHook?: boolean;
   /** Uses PNPM, which installs a dependency file (shrinkwrap-deps.json) that change detection hashes per project. */
   readonly pnpm?: boolean;
   readonly telemetryEnabled?: boolean;
@@ -58,6 +63,36 @@ export interface IFixtureOptions {
   readonly compatiblePlugins?: ReadonlyArray<string>;
 }
 
+/** Records the admission class of every phased request that a production resolver, or its replacement, resolves. */
+export class ClassRecordingResolver extends ProductionDaemonRequestResolver {
+  readonly #classes: string[];
+
+  public constructor(
+    classes: string[],
+    options?: ConstructorParameters<typeof ProductionDaemonRequestResolver>[0]
+  ) {
+    super(options);
+    this.#classes = classes;
+  }
+
+  public override createForSession(
+    preparationLock?: LockFile,
+    validateGraphInputsAsync?: () => Promise<void>
+  ): ProductionDaemonRequestResolver {
+    return new ClassRecordingResolver(this.#classes, { preparationLock, validateGraphInputsAsync });
+  }
+
+  public override async resolveRequestAsync(
+    options: IResolveDaemonRequestOptions
+  ): Promise<ResolvedDaemonRequest> {
+    const resolved: ResolvedDaemonRequest = await super.resolveRequestAsync(options);
+    if (resolved.kind === 'phased') {
+      this.#classes.push(`${resolved.request.commandName}:${resolved.exclusivityClass}`);
+    }
+    return resolved;
+  }
+}
+
 export class DecoratedTestResolver implements IDaemonRequestResolver {
   public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
   private readonly _inner: IDaemonRequestResolver;
@@ -122,6 +157,7 @@ export async function createFixtureAsync(
         ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds }),
         ...(options.compatiblePlugins === undefined ? {} : { compatiblePlugins: options.compatiblePlugins })
       },
+      ...(options.buildEventHook ? { eventHooks: { preRushBuild: ['node -e ""'] } } : {}),
       ...(options.telemetryEnabled ? { telemetryEnabled: true } : {}),
       projectFolderMinDepth: 2,
       projectFolderMaxDepth: 2,
@@ -141,7 +177,12 @@ export async function createFixtureAsync(
   write(
     'common/config/rush/command-line.json',
     JSON.stringify({
-      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      phases: [
+        { name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } },
+        ...(options.customCommands
+          ? [{ name: '_phase:test', dependencies: { self: ['_phase:compile'] } }]
+          : [])
+      ],
       commands: [
         {
           commandKind: 'phased',
@@ -149,7 +190,33 @@ export async function createFixtureAsync(
           phases: ['_phase:compile'],
           incremental: true,
           enableParallelism: true
-        }
+        },
+        ...(options.customCommands
+          ? [
+              {
+                commandKind: 'phased',
+                name: 'test',
+                summary: 'Builds and tests',
+                phases: ['_phase:compile', '_phase:test'],
+                incremental: true,
+                enableParallelism: true
+              },
+              {
+                commandKind: 'phased',
+                name: 'retest',
+                summary: 'Rebuilds and tests',
+                phases: ['_phase:compile', '_phase:test'],
+                incremental: false,
+                enableParallelism: true
+              },
+              {
+                commandKind: 'global',
+                name: 'hello',
+                summary: 'A global command',
+                shellCommand: 'node -e ""'
+              }
+            ]
+          : [])
       ],
       parameters: [
         {
@@ -182,7 +249,8 @@ export async function createFixtureAsync(
           '_phase:compile': 'node build.cjs',
           ...(options.incrementalScript
             ? { '_phase:compile:incremental': 'node build.cjs --incremental' }
-            : {})
+            : {}),
+          ...(options.customCommands ? { '_phase:test': 'node test.cjs' } : {})
         },
         dependencies: name === 'b' ? { a: '1.0.0' } : {}
       })
@@ -195,6 +263,10 @@ export async function createFixtureAsync(
     );
     write(`projects/${name}/input.txt`, 'one');
     if (options.pnpm) write(`projects/${name}/.rush/temp/shrinkwrap-deps.json`, '{}');
+    write(
+      `projects/${name}/test.cjs`,
+      `require('node:fs').appendFileSync('../../runs.txt', 'test-${name}\\n');\n`
+    );
     write(
       `projects/${name}/build.cjs`,
       `
@@ -350,3 +422,11 @@ export function requestEnvironment(): Record<string, string> {
     Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
   );
 }
+
+export function readTelemetryEntries(repoRoot: string): ITelemetryData[] {
+  const folder: string = path.join(repoRoot, 'common/temp/telemetry');
+  return fs
+    .readdirSync(folder)
+    .sort()
+    .flatMap((name: string) => JSON.parse(fs.readFileSync(path.join(folder, name), 'utf8')));
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index 80fe618395..f016158dd0 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -183,12 +183,24 @@ describe('shared phased request batching', () => {
     const scheduleSpy: jest.SpyInstance = jest
       .spyOn(graph, 'scheduleIterationAsync')
       .mockImplementation((...args: Parameters<typeof graph.scheduleIterationAsync>) => {
-        scheduledSettings.push({ parallelism: graph.parallelism, quietMode: graph.quietMode });
+        scheduledSettings.push({
+          parallelism: graph.parallelism,
+          quietMode: graph.quietMode,
+          isIncrementalBuildAllowed: args[0].isIncrementalBuildAllowed as boolean
+        });
         return originalScheduleAsync(...args);
       });
     const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
-    const defaultSettings: IPhasedCommandEngineRequestSettings = { parallelism: 4, quietMode: true };
-    const verboseSerialSettings: IPhasedCommandEngineRequestSettings = { parallelism: 1, quietMode: false };
+    const defaultSettings: IPhasedCommandEngineRequestSettings = {
+      parallelism: 4,
+      quietMode: true,
+      isIncrementalBuildAllowed: true
+    };
+    const verboseSerialSettings: IPhasedCommandEngineRequestSettings = {
+      parallelism: 1,
+      quietMode: false,
+      isIncrementalBuildAllowed: false
+    };
 
     const [first, second] = await Promise.all([
       router.executeAsync(
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
new file mode 100644
index 0000000000..b205183786
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
@@ -0,0 +1,111 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import {
+  ClassRecordingResolver,
+  createFixtureAsync,
+  runAsync,
+  runs,
+  type IFixture
+} from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('native production daemon engine', () => {
+  it('serves phased commands from command-line.json on a shared graph with their own admission class', async () => {
+    const classes: string[] = [];
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', {
+      customCommands: true,
+      resolver: new ClassRecordingResolver(classes)
+    });
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    try {
+      expect((await runAsync(fixture, 'test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 0,
+          scheduled: true,
+          operationResults: [
+            { operationId: 'a (compile)', status: 'SUCCESS' },
+            { operationId: 'a (test)', status: 'SUCCESS' }
+          ]
+        }
+      });
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(testGraph?.operations.size).toBe(6);
+      expect((await runAsync(fixture, 'warm-test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: false }
+      });
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a']);
+
+      // Like rebuild, retest runs every selected operation on every request, here on the engine of test.
+      for (const id of ['retest-one', 'retest-two']) {
+        expect((await runAsync(fixture, id, ['retest', '--only', 'a'], custom)).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: true }
+        });
+      }
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a', 'a:one:', 'test-a', 'a:one:', 'test-a']);
+
+      // Clients mark only build and rebuild as built-in commands.
+      expect((await runAsync(fixture, 'built-in-test', ['test', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'invalidRequest' }
+      });
+      // A generation reload also resolves its first request once to bind the engine.
+      expect(new Set(classes)).toEqual(new Set(['test:SHARED-BUILD', 'retest:EXCLUSIVE']));
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('rejects other commands before reading inputs and serves custom commands despite build event hooks', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', {
+      customCommands: true,
+      buildEventHook: true
+    });
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    try {
+      expect((await runAsync(fixture, 'hooked-build', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: expect.stringContaining('event-hook') }
+      });
+      expect((await runAsync(fixture, 'test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      // A served command would reload the graph for this change; a command that cannot be served must not.
+      const filename: string = path.join(fixture.repoRoot, 'projects/a/package.json');
+      const json: { scripts: Record<string, string> } = JSON.parse(fs.readFileSync(filename, 'utf8'));
+      json.scripts['_phase:compile'] = 'node build.cjs --changed';
+      fs.writeFileSync(filename, JSON.stringify(json));
+      expect((await runAsync(fixture, 'global', ['hello'], custom)).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: expect.stringContaining('is not a phased command') }
+      });
+      expect((await runAsync(fixture, 'list', ['list'], custom)).terminal).toMatchObject({
+        kind: 'requestRejected',
+        payload: { code: 'unsupported', message: '"list" is a built-in command that is not phased.' }
+      });
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect((await runAsync(fixture, 'changed', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(fixture.session.operationGraph).not.toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a', 'a:one:--changed', 'test-a']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
index 4bba9bcaf6..832d58ec71 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
@@ -18,6 +18,7 @@ function createSession(): IWorkspaceSession {
   // The native engine is already bound, so that a resolution only parses and selects operations.
   return {
     rushConfiguration: {},
+    rushSession: {},
     operationGraph: {},
     engineShape: {},
     initializeEngineAsync: async () => undefined
@@ -73,12 +74,14 @@ function dispatched(options: IResolveDaemonRequestOptions): IResolveDaemonReques
 
 describe('ProductionDaemonRequestResolver command line parsing', () => {
   let parses: number;
+  let parameterIdentity: string;
   let selectionError: Error | undefined;
   let commands: WeakRef<PhasedCommandEngine>[];
   let parse: jest.SpyInstance;
 
   beforeEach(() => {
     parses = 0;
+    parameterIdentity = 'parameters';
     selectionError = undefined;
     commands = [];
     parse = jest
@@ -87,9 +90,11 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
         terminalProvider.write(`Warning from parse ${++parses}\n`, TerminalProviderSeverity.warning);
         const command: PhasedCommandEngine = {
           commandName: 'build',
-          parameterIdentity: 'parameters',
+          parameterIdentity,
           requestSettings: {},
           unmatchedCompatiblePluginNames: [],
+          // The engine of any parse can serve any other parse.
+          getEngineSharingBlocker: () => undefined,
           selectOperationsAsync: async () => {
             if (selectionError) throw selectionError;
             return new Map();
@@ -115,6 +120,41 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
     expect(parses).toBe(1);
   });
 
+  it('resolves a request that the bound engine serves with the parse of its identity check', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const session: IWorkspaceSession = createSession();
+    await resolver.resolveRequestAsync(createOptions(session));
+    // The identity check answers with the identity of the bound engine, which can serve this parse.
+    parameterIdentity = 'other parameters';
+    const options: IResolveDaemonRequestOptions = createOptions(session);
+    await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+    await expect(resolver.resolveRequestAsync(dispatched(options))).resolves.toMatchObject({
+      kind: 'phased',
+      request: { requestId: 'request' }
+    });
+    expect(parses).toBe(2);
+  });
+
+  it.each<[string, Partial<IDaemonRequestEnvelope>]>([
+    // build and rebuild are both built-in, so here only the name does not match the parse.
+    ['name', { commandName: 'rebuild' }],
+    ['origin', { commandOrigin: 'custom' }]
+  ])(
+    'checks the command %s of a request that it resolves with the parse of its identity check',
+    async (name, change) => {
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const options: IResolveDaemonRequestOptions = createOptions(createSession());
+      await resolver.getCommandParameterIdentityAsync(options);
+      await expect(
+        resolver.resolveRequestAsync({ ...options, envelope: { ...options.envelope, ...change } })
+      ).rejects.toMatchObject({
+        code: 'invalidRequest',
+        message: 'The command name or origin does not match the native parsed argv.'
+      });
+      expect(parses).toBe(1);
+    }
+  );
+
   it('reports the diagnostics of the parse that it reused with a selection error', async () => {
     const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
     const session: IWorkspaceSession = createSession();
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index e5f6077fd5..517d9acaa7 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -55,6 +55,7 @@ import {
   createFixtureAsync,
   DecoratedTestResolver,
   logText,
+  readTelemetryEntries,
   requestEnvironment,
   runAsync,
   runs,
@@ -63,14 +64,6 @@ import {
 
 jest.setTimeout(30_000);
 
-function readTelemetryEntries(repoRoot: string): ITelemetryData[] {
-  const folder: string = path.join(repoRoot, 'common/temp/telemetry');
-  return fs
-    .readdirSync(folder)
-    .sort()
-    .flatMap((name: string) => JSON.parse(fs.readFileSync(path.join(folder, name), 'utf8')));
-}
-
 describe('native production daemon engine', () => {
   it("runs each request's operations with its requester's session and invocation folder", async () => {
     const fixture: IFixture = await createFixtureAsync();
@@ -366,12 +359,12 @@ describe('native production daemon engine', () => {
       expect(fixture.host.workspaceGeneration).toBeGreaterThan(firstGeneration);
       expect(readDaemonLockfile(fixture.host.paths.lockfilePath)?.pid).toBe(process.pid);
       const second: WorkspaceSession = fixture.session;
-      expect((await runAsync(fixture, 'shape', ['rebuild', '--only', 'a'])).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
+      // A rebuild would share the engine of build, so change a parameter of the compile phase instead.
+      const shape: ITerminalExchange = await runAsync(fixture, 'shape', ['build', '-o', 'a', '--production']);
+      expect(shape.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
       expect(fixture.session).not.toBe(second);
-      expect(runs(fixture)).toEqual(['a:one:', 'a:one:--new-definition', 'a:one:--new-definition']);
+      const production: string = 'a:one:--new-definition --production';
+      expect(runs(fixture)).toEqual(['a:one:', 'a:one:--new-definition', production]);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
@@ -1526,7 +1519,9 @@ fs.writeFileSync('lib/output.txt', input + '+' + fs.readFileSync('../a/lib/outpu
       fs.rmSync(path.join(fixture.repoRoot, 'projects/b/lib'), { recursive: true });
       const restored: ITerminalExchange = await runAsync(fixture, 'restored', ['build', '--to', 'b']);
       expect((restored.terminal as { payload: IDaemonPhasedRequestResult }).payload.operationResults).toEqual(
-        expect.arrayContaining([expect.objectContaining({ operationId: 'b (compile)', status: 'FROM CACHE' })])
+        expect.arrayContaining([
+          expect.objectContaining({ operationId: 'b (compile)', status: 'FROM CACHE' })
+        ])
       );
       expect(fs.readFileSync(outputPath, 'utf8')).toBe('two+one');
       expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'b:two:']);
diff --git a/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts b/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts
index b6e1744051..6b45f12422 100644
--- a/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts
+++ b/libraries/rush-daemon/src/test/RushCommandRequestPolicy.test.ts
@@ -9,6 +9,7 @@ import { RushCommandLineParser } from '@microsoft/rush-lib/lib/cli/RushCommandLi
 
 import {
   BUILT_IN_RUSH_COMMAND_CLASSIFICATION,
+  classifyPhasedRushCommand,
   classifyRushCommand
 } from '../RushCommandRequestPolicy';
 import { RequestExclusivityClass } from '../RequestScheduler';
@@ -57,3 +58,23 @@ describe(classifyRushCommand.name, () => {
     );
   });
 });
+
+describe(classifyPhasedRushCommand.name, () => {
+  it('shares build admission only for incremental phased commands from command-line.json', () => {
+    expect(
+      classifyPhasedRushCommand({ commandName: 'test', commandOrigin: 'custom', isIncremental: true })
+    ).toBe(RequestExclusivityClass.SharedBuild);
+    expect(
+      classifyPhasedRushCommand({ commandName: 'retest', commandOrigin: 'custom', isIncremental: false })
+    ).toBe(RequestExclusivityClass.Exclusive);
+    expect(
+      classifyPhasedRushCommand({ commandName: 'build', commandOrigin: 'built-in', isIncremental: true })
+    ).toBe(RequestExclusivityClass.SharedBuild);
+    expect(
+      classifyPhasedRushCommand({ commandName: 'rebuild', commandOrigin: 'built-in', isIncremental: false })
+    ).toBe(RequestExclusivityClass.Exclusive);
+    expect(classifyPhasedRushCommand({ commandName: 'test', isIncremental: true })).toBe(
+      RequestExclusivityClass.Exclusive
+    );
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index 73aa9d4d7b..3bb9d0ee0e 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -17,7 +17,7 @@ import {
   type IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
 
-import type { IResolveDaemonRequestOptions, ResolvedDaemonRequest } from '../DaemonRequestDispatcher';
+import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
@@ -411,17 +411,17 @@ describe('a failed build that returns early', () => {
       const custom: IDaemonRequestEnvelope = fixture.envelope(['test', '--to', 'c'], {
         commandOrigin: 'custom'
       });
-      const resolveAsync: ProductionDaemonRequestResolver['resolveRequestAsync'] =
-        ProductionDaemonRequestResolver.prototype.resolveRequestAsync;
+      // The daemon parses a custom command before it resolves the request, and rejects this one there.
+      const getIdentityAsync: ProductionDaemonRequestResolver['getCommandParameterIdentityAsync'] =
+        ProductionDaemonRequestResolver.prototype.getCommandParameterIdentityAsync;
       jest
-        .spyOn(ProductionDaemonRequestResolver.prototype, 'resolveRequestAsync')
+        .spyOn(ProductionDaemonRequestResolver.prototype, 'getCommandParameterIdentityAsync')
         .mockImplementation(async function (
           this: ProductionDaemonRequestResolver,
           options: IResolveDaemonRequestOptions
         ) {
           if (options.envelope.requestId === custom.requestId) installationChange = change;
-          const resolved: ResolvedDaemonRequest = await resolveAsync.call(this, options);
-          return resolved;
+          return await getIdentityAsync.call(this, options);
         });
       rejected = await fixture.connectAsync();
       await rejected.sendControlAsync({ kind: 'requestStart', payload: custom });
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
new file mode 100644
index 0000000000..4490cb0673
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
@@ -0,0 +1,269 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IOperationGraph, ITelemetryData } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { readTelemetryEntries } from './NativeEngineTestFixture';
+
+jest.setTimeout(60_000);
+
+const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+
+/** build runs compile; test and retest run compile and test. `--production` changes the compile commands. */
+function configureCommands(fixture: DaemonGraphTestFixture): void {
+  fixture.write(
+    'common/config/rush/command-line.json',
+    JSON.stringify({
+      phases: [
+        { name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } },
+        { name: '_phase:test', dependencies: { self: ['_phase:compile'] } }
+      ],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        },
+        {
+          commandKind: 'phased',
+          name: 'test',
+          summary: 'Builds and tests',
+          phases: ['_phase:compile', '_phase:test'],
+          incremental: true,
+          enableParallelism: true
+        },
+        {
+          commandKind: 'phased',
+          name: 'retest',
+          summary: 'Rebuilds and tests',
+          phases: ['_phase:compile', '_phase:test'],
+          incremental: false,
+          enableParallelism: true
+        }
+      ],
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'Production build',
+          associatedCommands: ['build', 'test', 'retest'],
+          associatedPhases: ['_phase:compile']
+        }
+      ]
+    })
+  );
+  for (const name of ['a', 'b', 'c']) {
+    fixture.write(
+      `${name}/package.json`,
+      JSON.stringify({
+        name,
+        version: '1.0.0',
+        dependencies: name === 'b' ? { a: '1.0.0' } : {},
+        scripts: { '_phase:compile': 'node build.cjs', '_phase:test': 'node test.cjs' }
+      })
+    );
+    fixture.write(
+      `${name}/test.cjs`,
+      `require('node:fs').appendFileSync('../runs.txt', 'test-${name}\\n');\n`
+    );
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange, scheduled?: boolean): void {
+  expect(exchange.terminal).toMatchObject({
+    kind: 'requestResult',
+    payload: { exitCode: 0, ...(scheduled === undefined ? {} : { scheduled }) }
+  });
+}
+
+function expectUnsupported(exchange: ITerminalExchange, message: string): void {
+  expect(exchange.terminal).toMatchObject({
+    kind: 'requestRejected',
+    payload: { code: 'unsupported', message: expect.stringContaining(message) }
+  });
+}
+
+function enableTelemetry(fixture: DaemonGraphTestFixture): void {
+  const rushJson: object = JSON.parse(fs.readFileSync(path.join(fixture.folder, 'rush.json'), 'utf8'));
+  fixture.write('rush.json', JSON.stringify({ ...rushJson, telemetryEnabled: true }));
+}
+
+async function withFixtureAsync(
+  testAsync: (fixture: DaemonGraphTestFixture) => Promise<void>,
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync(
+    (created: DaemonGraphTestFixture) => {
+      configureCommands(created);
+      configure?.(created);
+    }
+  );
+  try {
+    await testAsync(fixture);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+describe('engine sharing between phased commands', () => {
+  it('switches to the engine of test once, and then serves build, retest and rebuild on it', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+
+      // The engine of build has no test operations, but an engine created by test can serve build.
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), true);
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const testGeneration: number = fixture.host.workspaceGeneration;
+      expect(testGraph).not.toBe(buildGraph);
+      expect(testGeneration).toBeGreaterThan(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'test-a']);
+
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      expectSuccess(await fixture.runAsync(['retest', '--only', 'a'], custom), true);
+      expectSuccess(await fixture.runAsync(['rebuild', '--only', 'c']), true);
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), false);
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(fixture.host.workspaceGeneration).toBe(testGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'test-a', 'a', 'test-a', 'c']);
+    }));
+
+  it('runs every selected operation of rebuild on the engine of build, and reloads an engine of rebuild for build', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['rebuild', '--to', 'b']), true);
+      const rebuildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const rebuildGeneration: number = fixture.host.workspaceGeneration;
+
+      // An engine created by a command that is not incremental serves only that command.
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(buildGraph).not.toBe(rebuildGraph);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(rebuildGeneration);
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+
+      const rebuild: ITerminalExchange = await fixture.runAsync(['rebuild', '--only', 'a']);
+      expect(rebuild.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, operationResults: [{ operationId: 'a (compile)', status: 'SUCCESS' }] }
+      });
+      // Without a build cache, LegacySkipPlugin deletes the package-deps file of every operation of an iteration
+      // that allows no skipping, disabled ones included. But the engine retained b's result, which LegacySkipPlugin
+      // found up to date, and a ran again with the same state hash, so b stays verified and does not run. Rush
+      // in-process does not run it either: the graph of its `rebuild --only a` has no b.
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+      expect(fixture.host.workspaceGeneration).toBe(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'a']);
+    }));
+
+  it('rejects a custom command when neither its engine nor the current one could serve the other', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+
+      expectUnsupported(
+        await fixture.runAsync(['retest', '--only', 'a'], custom),
+        `The daemon's engine, created by "build", cannot serve "retest" because the graph of "build" does not ` +
+          `have every operation of the "_phase:test" phase, and an engine created by "retest" could not serve ` +
+          `"build" because "retest" is not incremental.`
+      );
+      expectUnsupported(
+        await fixture.runAsync(['test', '--only', 'a', '--production'], custom),
+        'could not serve "build" because "build" has different parameters for its phases ' +
+          '(--production for "_phase:compile")'
+      );
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+      expect(fixture.host.workspaceGeneration).toBe(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b']);
+
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), true);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'test-a']);
+    }));
+
+  it('shares no engine between commands while a plugin taps runAnyPhasedCommand', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
+      const buildGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const buildGeneration: number = fixture.host.workspaceGeneration;
+      fixture.session.rushSession!.hooks.runAnyPhasedCommand.tap('WorkspaceEngineSharing.test', () => {});
+
+      expectUnsupported(
+        await fixture.runAsync(['test', '--only', 'a'], custom),
+        'could not serve "build" because a plugin taps the runAnyPhasedCommand hook'
+      );
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+
+      // The same command still shares the engine.
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b', '--ignore-hooks']), false);
+      expect(fixture.session.operationGraph).toBe(buildGraph);
+
+      // Built-in commands reload, as they did before engines were shared.
+      expectSuccess(await fixture.runAsync(['rebuild', '--only', 'a']), true);
+      expect(fixture.session.operationGraph).not.toBe(buildGraph);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(buildGeneration);
+      expect(fixture.runs()).toEqual(['a', 'b', 'a']);
+    }));
+
+  it('selects the phase dependencies of each request on a shared engine', () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['test', '--only', 'b'], custom), true);
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(fixture.runs()).toEqual(['b', 'test-b']);
+
+      // b was built without a, so it runs again once a has run.
+
+      const withDependencies: ITerminalExchange = await fixture.runAsync(
+        ['test', '--only', 'b', '--include-phase-deps'],
+        custom
+      );
+      expect(withDependencies.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 0,
+          operationResults: expect.arrayContaining([{ operationId: 'a (compile)', status: 'SUCCESS' }])
+        }
+      });
+      expectSuccess(await fixture.runAsync(['build', '--only', 'b', '--ignore-hooks']), false);
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(fixture.runs()).toEqual(['b', 'test-b', 'a', 'b', 'test-b']);
+    }));
+
+  it("logs the telemetry entry of each request that a shared engine serves under the request's own command", () =>
+    withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync(['test', '--only', 'a'], custom), true);
+      const testGraph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expectSuccess(await fixture.runAsync(['build', '--to', 'b']), true);
+      expectSuccess(await fixture.runAsync(['retest', '--only', 'a'], custom), true);
+      expectSuccess(await fixture.runAsync(['rebuild', '--only', 'c']), true);
+      expect(fixture.session.operationGraph).toBe(testGraph);
+      expect(fixture.runs()).toEqual(['a', 'test-a', 'b', 'a', 'test-a', 'c']);
+
+      const entries: ITelemetryData[] = readTelemetryEntries(fixture.folder);
+      expect(
+        entries.map(({ name, result, extraData, operationResults }) => [
+          name,
+          result,
+          extraData?.requestIndex,
+          Object.keys(operationResults ?? {}).sort()
+        ])
+      ).toEqual([
+        ['test', 'Succeeded', 1, ['a (compile)', 'a (test)']],
+        ['build', 'Succeeded', 2, ['a (compile)', 'b (compile)']],
+        ['retest', 'Succeeded', 3, ['a (compile)', 'a (test)']],
+        ['rebuild', 'Succeeded', 4, ['c (compile)']]
+      ]);
+      expect(entries[1].extraData).toMatchObject({ command_to: 'true', '--to': 'b', countSkipped: 1 });
+      expect(entries[2].extraData).toMatchObject({ command_only: 'true', '--only': 'a', countSuccess: 2 });
+    }, enableTelemetry));
+});
diff --git a/libraries/rush-lib/assets/rush-init/rush.json b/libraries/rush-lib/assets/rush-init/rush.json
index 2e66256750..93eab39672 100644
--- a/libraries/rush-lib/assets/rush-init/rush.json
+++ b/libraries/rush-lib/assets/rush-init/rush.json
@@ -339,6 +339,8 @@
    * The watch option retains host observation of warm project files between requests, without running builds.
    * The daemon serves a command that a configured Rush plugin participates in only if the plugin's manifest
    * declares "daemonCompatible", or if "compatiblePlugins" lists the plugin's name. Otherwise it runs in-process.
+   * One daemon engine serves several phased commands only if every plugin that taps the runAnyPhasedCommand hook
+   * is command-agnostic: its manifest declares "daemonCommandAgnostic", or "commandAgnosticPlugins" lists its name.
    */
   /*[LINE "HYPOTHETICAL"]*/ "daemon": {
     /*[LINE "HYPOTHETICAL"]*/ "enabled": false,
@@ -351,7 +353,8 @@
     /*[LINE "HYPOTHETICAL"]*/ "warmMemoryBudgetMB": 512,
     /*[LINE "HYPOTHETICAL"]*/ "warmSetMaxProjects": 20,
     /*[LINE "HYPOTHETICAL"]*/ "autoWarmByTelemetry": false,
-    /*[LINE "HYPOTHETICAL"]*/ "compatiblePlugins": []
+    /*[LINE "HYPOTHETICAL"]*/ "compatiblePlugins": [],
+    /*[LINE "HYPOTHETICAL"]*/ "commandAgnosticPlugins": []
   /*[LINE "HYPOTHETICAL"]*/ },
 
   /**
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 8bf935d082..0193e1db26 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -51,8 +51,17 @@ export interface IDaemonConfigurationJson {
    * for long-lived daemon engines, in addition to plugins whose manifest sets `daemonCompatible`. Defaults to none.
    */
   readonly compatiblePlugins?: ReadonlyArray<string>;
+  /**
+   * Names of configured Rush plugins (their `pluginName` in rush-plugins.json) that the repository has verified to be
+   * command-agnostic, in addition to plugins whose manifest sets `daemonCommandAgnostic`. Such a plugin's
+   * `runAnyPhasedCommand` taps do the same for every phased command, so they don't stop one daemon engine from
+   * serving several commands. Defaults to none.
+   */
+  readonly commandAgnosticPlugins?: ReadonlyArray<string>;
 }
 
+type PluginNamesKey = 'compatiblePlugins' | 'commandAgnosticPlugins';
+
 const defaults: Required<IDaemonConfigurationJson> = {
   enabled: false,
   idleTimeoutSeconds: 900,
@@ -66,7 +75,8 @@ const defaults: Required<IDaemonConfigurationJson> = {
   warmMemoryBudgetMB: 512,
   warmSetMaxProjects: 20,
   autoWarmByTelemetry: false,
-  compatiblePlugins: Object.freeze([])
+  compatiblePlugins: Object.freeze([]),
+  commandAgnosticPlugins: Object.freeze([])
 };
 
 /** The exact recognized environment names. Unknown RUSH_DAEMON* names are rejected. @beta */
@@ -84,7 +94,8 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
     warmSetMaxProjects: 'RUSH_DAEMON_WARM_SET_MAX_PROJECTS',
     autoWarmByTelemetry: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY',
-    compatiblePlugins: 'RUSH_DAEMON_COMPATIBLE_PLUGINS'
+    compatiblePlugins: 'RUSH_DAEMON_COMPATIBLE_PLUGINS',
+    commandAgnosticPlugins: 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS'
   });
 
 /**
@@ -129,26 +140,28 @@ export function resolveDaemonConfiguration(
     warmIdleTimeoutSeconds: numberOption('warmIdleTimeoutSeconds', json, environment),
     warmMemoryBudgetMB: numberOption('warmMemoryBudgetMB', json, environment),
     warmSetMaxProjects: numberOption('warmSetMaxProjects', json, environment),
-    compatiblePlugins: pluginNamesOption(json, environment)
+    compatiblePlugins: pluginNamesOption('compatiblePlugins', json, environment),
+    commandAgnosticPlugins: pluginNamesOption('commandAgnosticPlugins', json, environment)
   });
 }
 
 function pluginNamesOption(
+  key: PluginNamesKey,
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): ReadonlyArray<string> {
-  const configured: unknown = json.compatiblePlugins;
+  const configured: unknown = json[key];
   if (
     configured !== undefined &&
     (!Array.isArray(configured) ||
       configured.some((name: unknown) => typeof name !== 'string' || !isPluginName(name)))
   ) {
-    throw new Error('daemon.compatiblePlugins must be an array of plugin names.');
+    throw new Error(`daemon.${key} must be an array of plugin names.`);
   }
-  const name: string = daemonEnvironmentVariables.compatiblePlugins;
+  const name: string = daemonEnvironmentVariables[key];
   const value: string | undefined = environment[name];
   if (value === undefined) {
-    return configured ? Object.freeze([...(configured as string[])]) : defaults.compatiblePlugins;
+    return configured ? Object.freeze([...(configured as string[])]) : defaults[key];
   }
   // An empty value overrides rush.json with no plugins.
   const names: string[] = value.trim() === '' ? [] : value.split(',').map((entry: string) => entry.trim());
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index 723591e0f7..0632a9fb8c 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -292,6 +292,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY: 'RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY',
   /** Overrides the plugins that the repository has verified for long-lived daemon engines. */
   RUSH_DAEMON_COMPATIBLE_PLUGINS: 'RUSH_DAEMON_COMPATIBLE_PLUGINS',
+  /** Overrides the plugins that the repository has verified to tap `runAnyPhasedCommand` the same way for every command. */
+  RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS: 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS',
   /** Gates the experimental graph client; requires host graph integration. */
   RUSH_DAEMON_EXPERIMENTAL: 'RUSH_DAEMON_EXPERIMENTAL'
 } as const;
@@ -706,6 +708,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_SET_MAX_PROJECTS:
           case EnvironmentVariableNames.RUSH_DAEMON_AUTO_WARM_BY_TELEMETRY:
           case EnvironmentVariableNames.RUSH_DAEMON_COMPATIBLE_PLUGINS:
+          case EnvironmentVariableNames.RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS:
           case EnvironmentVariableNames.RUSH_DAEMON_EXPERIMENTAL:
             // Validated together by resolveDaemonConfiguration().
             break;
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 66b56080ed..1c5e2f4c08 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -11,7 +11,7 @@ import type { CommandLineAction } from '@rushstack/ts-command-line';
 import { CommandLineParserExitError } from '@rushstack/ts-command-line/lib/providers/CommandLineParserExitError';
 
 import { RushCommandLineParser } from '../cli/RushCommandLineParser';
-import { PhasedScriptAction } from '../cli/scriptActions/PhasedScriptAction';
+import { PhasedScriptAction, type IEnginePhaseNames } from '../cli/scriptActions/PhasedScriptAction';
 import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from '../logic/incremental/InputsSnapshot';
 import type { IOperationGraph } from '../logic/operations/IOperationGraph';
 import type { Operation, OperationEnabledState } from '../logic/operations/Operation';
@@ -20,6 +20,7 @@ import type { Parallelism } from '../logic/operations/ParseParallelism';
 import { PhasedCommandEngineExecution } from '../logic/operations/PhasedCommandEngineExecution';
 import { createPhasedTelemetryData } from '../logic/operations/PhasedCommandTelemetry';
 import { type ITelemetryData, Telemetry } from '../logic/Telemetry';
+import { getRunAnyPhasedCommandBlocker } from '../pluginFramework/PhasedCommandHookTaps';
 import type { RushSession } from '../pluginFramework/RushSession';
 import type { RushConfiguration } from './RushConfiguration';
 import { RushUserConfiguration } from './RushUserConfiguration';
@@ -123,19 +124,27 @@ export interface IParsePhasedCommandOptions {
 /**
  * Presentation and scheduling settings of one parsed command. They do not affect the operation graph or any
  * operation hash, so they are not part of `PhasedCommandEngine.parameterIdentity`; hosts apply them to the
- * shared graph (`IOperationGraph.quietMode` / `IOperationGraph.parallelism`) before each iteration.
+ * shared graph (`IOperationGraph.quietMode` / `IOperationGraph.parallelism`) and to the iteration before each
+ * iteration.
  * @alpha
  */
 export interface IPhasedCommandEngineRequestSettings {
   readonly quietMode: boolean;
   readonly parallelism: Parallelism;
+  /**
+   * False for a command that runs every selected operation, such as `rebuild`. Hosts pass it to the iteration
+   * (`IOperationGraphIterationOptions.isIncrementalBuildAllowed`), because an engine created by an incremental
+   * command can serve such a command; see `PhasedCommandEngine.getEngineSharingBlocker`.
+   */
+  readonly isIncrementalBuildAllowed: boolean;
 }
 
 /**
- * A parsed native build/rebuild command. Parsing never runs scripts or changes cwd/process.env.
+ * A parsed native phased command, such as build, rebuild or a phased command from command-line.json.
+ * Parsing never runs scripts or changes cwd/process.env.
  *
  * @remarks
- * The initial engine surface deliberately rejects watch/install, event-hook scripts, .env files, and
+ * The initial engine surface deliberately rejects watch/install, build event-hook scripts, .env files, and
  * external plugins that Rush would initialize for the command or whose command-line.json shapes it, unless
  * the plugin's manifest (`daemonCompatible`) or the repository (`daemon.compatiblePlugins`) declares that the
  * plugin supports the engine lifecycle. An engine applies each plugin once and serves many requests: session
@@ -152,6 +161,8 @@ export class PhasedCommandEngine {
 
   public readonly parameterIdentity: string;
   public readonly commandName: string;
+  /** False when every run executes all selected operations: `rebuild`, or `"incremental": false`. */
+  public readonly isIncremental: boolean;
   /**
    * Names listed by `daemon.compatiblePlugins` (or `RUSH_DAEMON_COMPATIBLE_PLUGINS`) that match no plugin
    * configured in rush-plugins.json. They have no effect and are usually misspellings, so hosts should report them.
@@ -166,13 +177,14 @@ export class PhasedCommandEngine {
     this._parser = parser;
     this._action = action;
     this.commandName = action.actionName;
+    this.isIncremental = action.isIncrementalBuildAllowed;
     this.parameterIdentity = action.getEngineParameterIdentity();
     this.unmatchedCompatiblePluginNames = unmatchedCompatiblePluginNames;
   }
 
   /**
-   * Parses a native build or rebuild command line. Throws a {@link PhasedCommandEngineUsageError} for a command
-   * line that native Rush rejects as invalid.
+   * Parses a native phased command line. Throws a {@link PhasedCommandEngineUsageError} for a command line of a
+   * phased command that native Rush rejects as invalid.
    */
   public static async parseAsync(options: IParsePhasedCommandOptions): Promise<PhasedCommandEngine> {
     const { rushConfiguration, terminalProvider, cwd, argv, environment = process.env } = options;
@@ -192,29 +204,42 @@ export class PhasedCommandEngine {
     try {
       await parser.executeWithoutErrorHandlingAsync([...argv]);
     } catch (error) {
-      // Native Rush prints this message and exits with this exit code.
-      if (error instanceof CommandLineParserExitError && error.exitCode !== 0) {
+      // Native Rush prints this message and exits with this exit code. It's a usage error only for a phased command,
+      // since the daemon serves no other command: in-process Rush reports an unknown or global command itself.
+      // Rush's global parameters are all flags, so the first argument that isn't a flag names the command.
+      const commandName: string | undefined = argv.find((arg: string) => !arg.startsWith('-'));
+      if (
+        error instanceof CommandLineParserExitError &&
+        error.exitCode !== 0 &&
+        commandName !== undefined &&
+        parser.tryGetAction(commandName) instanceof PhasedScriptAction
+      ) {
         throw new PhasedCommandEngineUsageError(error.message.trim(), error.exitCode, { cause: error });
       }
       throw error;
     }
     const action: CommandLineAction | undefined = parser.selectedAction;
-    if (!(action instanceof PhasedScriptAction) || !['build', 'rebuild'].includes(action.actionName)) {
-      throw new Error('The production daemon engine currently supports native build and rebuild only.');
+    if (!(action instanceof PhasedScriptAction)) {
+      throw new Error(
+        `The daemon engine runs phased commands only; "${action?.actionName ?? argv[0]}" is not a phased command.`
+      );
     }
     const compatiblePluginNames: ReadonlySet<string> = new Set(rushConfiguration.daemon.compatiblePlugins);
     const configuredPluginNames: ReadonlySet<string> = parser.pluginManager.configuredPluginNames;
-    const unmatchedCompatiblePluginNames: ReadonlyArray<string> = Array.from(compatiblePluginNames).filter(
-      (pluginName) => !configuredPluginNames.has(pluginName)
+    const terminal: Terminal = new Terminal(terminalProvider);
+    const unmatchedCompatiblePluginNames: ReadonlyArray<string> = warnAboutUnmatchedPluginNames(
+      terminal,
+      configuredPluginNames,
+      compatiblePluginNames,
+      'compatible plugin list (rush.json "daemon.compatiblePlugins" or RUSH_DAEMON_COMPATIBLE_PLUGINS)'
+    );
+    warnAboutUnmatchedPluginNames(
+      terminal,
+      configuredPluginNames,
+      new Set(rushConfiguration.daemon.commandAgnosticPlugins),
+      'command-agnostic plugin list (rush.json "daemon.commandAgnosticPlugins" or ' +
+        'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS)'
     );
-    if (unmatchedCompatiblePluginNames.length > 0) {
-      new Terminal(terminalProvider).writeWarningLine(
-        `The daemon's compatible plugin list (rush.json "daemon.compatiblePlugins" or ` +
-          `RUSH_DAEMON_COMPATIBLE_PLUGINS) names plugins that are not configured in rush-plugins.json: ` +
-          `${unmatchedCompatiblePluginNames.map((pluginName) => `"${pluginName}"`).join(', ')}. ` +
-          `Check that each entry is the plugin's "pluginName".`
-      );
-    }
     // Plugins which the command would never initialize, and whose command-line.json does not shape
     // this command, cannot affect a shared engine. Every other external plugin must be declared compatible
     // with the engine lifecycle; otherwise the command still requires native Rush.
@@ -326,6 +351,96 @@ export class PhasedCommandEngine {
     return this._action.getEngineRequestSettings();
   }
 
+  /**
+   * Explains why the engine created by this command cannot serve a request of `request`, or returns undefined if it
+   * can serve it. `rushSession` is the session of an engine created by this command or by `request`.
+   *
+   * @remarks
+   * An engine serves another request of the same command if its graph has the request's operations and the
+   * parameters of the two requests are the same, other than the ones that each request applies to its own iteration
+   * (selection, `requestSettings`, `--ignore-hooks` and `--include-phase-deps`). An engine created by an incremental
+   * command also serves another command, for example `rebuild` on a `build` engine or `build` on a `test` engine,
+   * if:
+   *
+   * - its graph has an operation of every project in each phase that the request selects;
+   *
+   * - the parameters of both commands give the same arguments to the phases that the request can run;
+   *
+   * - the same plugins are associated with both commands, and no plugin taps the `runPhasedCommand` hook of either
+   *   command. Rush calls this hook and `runAnyPhasedCommand` once per engine, with the command that created it, so
+   *   every tap of `runAnyPhasedCommand` must come from the `apply()` of a plugin that is declared command-agnostic:
+   *   its manifest sets `daemonCommandAgnostic`, or the repository lists it in `daemon.commandAgnosticPlugins`
+   *   (or `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS`).
+   *
+   * A request of a command that is not incremental runs each operation that it selects
+   * (`IPhasedCommandEngineRequestSettings.isIncrementalBuildAllowed`). An engine that runs persistent
+   * IPC runners (`daemon.usePersistentIpcRunners`) does not serve it, because those runners serve only
+   * incremental commands.
+   */
+  public getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession): string | undefined {
+    const { commandName } = this;
+    const requestName: string = request.commandName;
+    const sameCommand: boolean = requestName === commandName;
+    if (!sameCommand && !this.isIncremental) {
+      return `"${commandName}" is not incremental`;
+    }
+    if (!request.isIncremental && this._action.usesPersistentIpcRunners) {
+      return `"${requestName}" is not incremental, and "${commandName}" runs persistent IPC runners`;
+    }
+    const enginePhases: IEnginePhaseNames = this._action.getEnginePhaseNames();
+    const requestPhases: IEnginePhaseNames = request._action.getEnginePhaseNames();
+    for (const phaseName of requestPhases.selected) {
+      if (!enginePhases.complete.has(phaseName)) {
+        return `the graph of "${commandName}" does not have every operation of the "${phaseName}" phase`;
+      }
+    }
+    const { reachable } = requestPhases;
+    if (
+      this._action.getEngineGraphIdentity(reachable) !== request._action.getEngineGraphIdentity(reachable)
+    ) {
+      const differences: string = describeDifferences(
+        this._action.getEngineGraphIdentityParts(reachable),
+        request._action.getEngineGraphIdentityParts(reachable)
+      );
+      return `"${requestName}" has different parameters for its phases${differences}`;
+    }
+    if (sameCommand) {
+      if (
+        this._action.getEngineCustomParameterIdentity(reachable) ===
+        request._action.getEngineCustomParameterIdentity(reachable)
+      ) {
+        return undefined;
+      }
+      const differences: string = describeDifferences(
+        this._action.getEngineCustomParameterIdentityParts(reachable),
+        request._action.getEngineCustomParameterIdentityParts(reachable)
+      );
+      return `"${requestName}" has different parameters${differences}`;
+    }
+    let samePlugins: boolean;
+    try {
+      samePlugins =
+        this._parser.pluginManager.getPluginsAssociatedWithCommand(commandName).join('\n') ===
+        request._parser.pluginManager.getPluginsAssociatedWithCommand(requestName).join('\n');
+    } catch (error) {
+      return `a plugin manifest could not be read: ${(error as Error).message}`;
+    }
+    if (!samePlugins) {
+      return `different plugins are associated with "${requestName}" and "${commandName}"`;
+    }
+    const { runAnyPhasedCommand, runPhasedCommand } = rushSession.hooks;
+    const runAnyPhasedCommandBlocker: string | undefined = getRunAnyPhasedCommandBlocker(runAnyPhasedCommand);
+    if (runAnyPhasedCommandBlocker !== undefined) {
+      return runAnyPhasedCommandBlocker;
+    }
+    for (const name of [commandName, requestName]) {
+      if (runPhasedCommand.get(name)?.isUsed()) {
+        return `a plugin taps the runPhasedCommand hook of "${name}"`;
+      }
+    }
+    return undefined;
+  }
+
   /**
    * Builds the native telemetry entry for one request that this command made of a long-lived engine.
    *
@@ -393,3 +508,40 @@ export async function waitForTelemetryFlushAsync(
     clearTimeout(timeout);
   }
 }
+
+/**
+ * Names the parts whose values differ between the engine's command and the request, as " (a, b)". It returns an
+ * empty string if every part is the same, which happens only if two commands add the same arguments in another order.
+ */
+function describeDifferences(
+  engineParts: ReadonlyMap<string, string>,
+  requestParts: ReadonlyMap<string, string>
+): string {
+  const names: string[] = [];
+  for (const name of new Set([...engineParts.keys(), ...requestParts.keys()])) {
+    if (engineParts.get(name) !== requestParts.get(name)) {
+      names.push(name);
+    }
+  }
+  return names.length > 0 ? ` (${names.sort().join(', ')})` : '';
+}
+
+/** Warns about the names in a daemon plugin list that match no plugin configured in rush-plugins.json. */
+function warnAboutUnmatchedPluginNames(
+  terminal: Terminal,
+  configuredPluginNames: ReadonlySet<string>,
+  listedPluginNames: ReadonlySet<string>,
+  listDescription: string
+): ReadonlyArray<string> {
+  const unmatchedPluginNames: ReadonlyArray<string> = Array.from(listedPluginNames).filter(
+    (pluginName) => !configuredPluginNames.has(pluginName)
+  );
+  if (unmatchedPluginNames.length > 0) {
+    terminal.writeWarningLine(
+      `The daemon's ${listDescription} names plugins that are not configured in rush-plugins.json: ` +
+        `${unmatchedPluginNames.map((pluginName) => `"${pluginName}"`).join(', ')}. ` +
+        `Check that each entry is the plugin's "pluginName".`
+    );
+  }
+  return unmatchedPluginNames;
+}
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
index f487c58c1a..c950cbb53e 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
@@ -2,7 +2,7 @@
 // See LICENSE in the project root for license information.
 
 /**
- * The command line is not valid for the command, for example because it names an unknown parameter.
+ * The command line is not valid for a phased command, for example because it names an unknown parameter.
  * Native Rush prints the message and exits with {@link PhasedCommandEngineUsageError.exitCode}.
  * No engine preparation has begun.
  * @alpha
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index 236f317d0c..3944326a64 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -2,7 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { JsonSchema } from '@rushstack/node-core-library';
-import { resolveDaemonConfiguration } from '../DaemonConfiguration';
+import { type IDaemonConfigurationJson, resolveDaemonConfiguration } from '../DaemonConfiguration';
 import schemaJson from '../../schemas/rush.schema.json';
 
 describe('daemon configuration', () => {
@@ -63,7 +63,12 @@ describe('daemon configuration', () => {
     { compatiblePlugins: [''] },
     { compatiblePlugins: [' rush-example-plugin'] },
     { compatiblePlugins: ['rush-a-plugin,rush-b-plugin'] },
-    { compatiblePlugins: [1] }
+    { compatiblePlugins: [1] },
+    { commandAgnosticPlugins: 'rush-example-plugin' },
+    { commandAgnosticPlugins: [''] },
+    { commandAgnosticPlugins: [' rush-example-plugin'] },
+    { commandAgnosticPlugins: ['rush-a-plugin,rush-b-plugin'] },
+    { commandAgnosticPlugins: [1] }
   ])('publishes schema rejection for %j', (daemon) => {
     const schema = JsonSchema.fromLoadedObject(schemaJson);
     expect(() =>
@@ -93,55 +98,60 @@ describe('daemon configuration', () => {
     expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_WARM_WORKERS: '1' }).warmWorkers).toBe(true);
   });
 
-  it('resolves compatible plugin names from the environment, then configuration, then no plugins', () => {
-    expect(resolveDaemonConfiguration({}, {}).compatiblePlugins).toEqual([]);
-    const configured: string[] = ['rush-a-plugin', 'rush-b-plugin'];
-    expect(resolveDaemonConfiguration({ compatiblePlugins: configured }, {}).compatiblePlugins).toEqual(
-      configured
-    );
-    expect(
-      resolveDaemonConfiguration(
-        { compatiblePlugins: configured },
-        { RUSH_DAEMON_COMPATIBLE_PLUGINS: ' rush-c-plugin , rush-d-plugin' }
-      ).compatiblePlugins
-    ).toEqual(['rush-c-plugin', 'rush-d-plugin']);
-    // An empty value is an explicit override that declares no plugins.
-    for (const value of ['', ' ']) {
+  describe.each([
+    ['compatiblePlugins', 'RUSH_DAEMON_COMPATIBLE_PLUGINS'],
+    ['commandAgnosticPlugins', 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS']
+  ] as const)('%s', (key, variable) => {
+    it('resolves plugin names from the environment, then configuration, then no plugins', () => {
+      expect(resolveDaemonConfiguration({}, {})[key]).toEqual([]);
+      const configured: string[] = ['rush-a-plugin', 'rush-b-plugin'];
+      expect(resolveDaemonConfiguration({ [key]: configured }, {})[key]).toEqual(configured);
       expect(
-        resolveDaemonConfiguration(
-          { compatiblePlugins: configured },
-          { RUSH_DAEMON_COMPATIBLE_PLUGINS: value }
-        ).compatiblePlugins
-      ).toEqual([]);
-    }
-    const resolved: readonly string[] = resolveDaemonConfiguration(
-      { compatiblePlugins: configured },
-      {}
-    ).compatiblePlugins;
-    expect(Object.isFrozen(resolved)).toBe(true);
-    expect(resolved).not.toBe(configured);
-  });
+        resolveDaemonConfiguration({ [key]: configured }, { [variable]: ' rush-c-plugin , rush-d-plugin' })[
+          key
+        ]
+      ).toEqual(['rush-c-plugin', 'rush-d-plugin']);
+      // An empty value is an explicit override that declares no plugins.
+      for (const value of ['', ' ']) {
+        expect(resolveDaemonConfiguration({ [key]: configured }, { [variable]: value })[key]).toEqual([]);
+      }
+      const resolved: readonly string[] = resolveDaemonConfiguration({ [key]: configured }, {})[key];
+      expect(Object.isFrozen(resolved)).toBe(true);
+      expect(resolved).not.toBe(configured);
+    });
 
-  it.each([',', 'rush-a-plugin,', 'rush-a-plugin,,rush-b-plugin', ' , rush-a-plugin'])(
-    'rejects compatible plugin override %j with an empty entry',
-    (value) => {
-      expect(() => resolveDaemonConfiguration({}, { RUSH_DAEMON_COMPATIBLE_PLUGINS: value })).toThrow(
-        'RUSH_DAEMON_COMPATIBLE_PLUGINS must be a comma-separated list of plugin names.'
+    it('resolves the other plugin list independently', () => {
+      const otherKey: typeof key =
+        key === 'compatiblePlugins' ? 'commandAgnosticPlugins' : 'compatiblePlugins';
+      const resolved: Readonly<Required<IDaemonConfigurationJson>> = resolveDaemonConfiguration(
+        { [key]: ['rush-a-plugin'] },
+        { [variable]: 'rush-b-plugin' }
       );
-    }
-  );
+      expect(resolved[key]).toEqual(['rush-b-plugin']);
+      expect(resolved[otherKey]).toEqual([]);
+    });
 
-  it.each([
-    'rush-example-plugin',
-    [''],
-    [' rush-example-plugin'],
-    ['rush-a-plugin,rush-b-plugin'],
-    [1],
-    [null]
-  ])('rejects configured compatible plugins %j', (compatiblePlugins) => {
-    expect(() =>
-      resolveDaemonConfiguration({ compatiblePlugins: compatiblePlugins as unknown as string[] }, {})
-    ).toThrow('daemon.compatiblePlugins must be an array of plugin names.');
+    it.each([',', 'rush-a-plugin,', 'rush-a-plugin,,rush-b-plugin', ' , rush-a-plugin'])(
+      'rejects override %j with an empty entry',
+      (value) => {
+        expect(() => resolveDaemonConfiguration({}, { [variable]: value })).toThrow(
+          `${variable} must be a comma-separated list of plugin names.`
+        );
+      }
+    );
+
+    it.each([
+      'rush-example-plugin',
+      [''],
+      [' rush-example-plugin'],
+      ['rush-a-plugin,rush-b-plugin'],
+      [1],
+      [null]
+    ])('rejects configured value %j', (value) => {
+      expect(() => resolveDaemonConfiguration({ [key]: value as unknown as string[] }, {})).toThrow(
+        `daemon.${key} must be an array of plugin names.`
+      );
+    });
   });
 
   it('accepts all valid knobs in the published schema', () => {
@@ -159,7 +169,10 @@ describe('daemon configuration', () => {
         rushVersion: '5.179.0',
         pnpmVersion: '10.27.0',
         projects: [],
-        daemon: resolveDaemonConfiguration({ compatiblePlugins: ['rush-example-plugin'] }, {})
+        daemon: resolveDaemonConfiguration(
+          { compatiblePlugins: ['rush-example-plugin'], commandAgnosticPlugins: ['rush-example-plugin'] },
+          {}
+        )
       },
       'rush.json'
     );
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index 82669036fb..471d5701a9 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -6,13 +6,17 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { FileSystem, JsonFile } from '@rushstack/node-core-library';
-import { NoOpTerminalProvider, StringBufferTerminalProvider } from '@rushstack/terminal';
+import { NoOpTerminalProvider, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
 
 import { PhasedCommandEngine } from '../PhasedCommandEngine';
 import { PhasedCommandEngineUsageError } from '../PhasedCommandEngineUsageError';
 import { RushConfiguration } from '../RushConfiguration';
+import { RushGlobalFolder } from '../RushGlobalFolder';
 import { EnvironmentConfiguration } from '../EnvironmentConfiguration';
 import { RushCommandLineParser } from '../../cli/RushCommandLineParser';
+import { Autoinstaller } from '../../logic/Autoinstaller';
+import { PluginManager } from '../../pluginFramework/PluginManager';
+import { RushSession } from '../../pluginFramework/RushSession';
 import { JsonFileLoadCache } from '../../utilities/JsonFileLoadCache';
 
 const PACKAGE_NAME: string = '@example/rush-example-plugin';
@@ -20,6 +24,7 @@ const PLUGIN_NAME: string = 'rush-example-plugin';
 const PLUGIN_COMMAND: string = 'record-example';
 const OTHER_PLUGIN_NAME: string = 'rush-other-plugin';
 const COMPATIBLE_PLUGINS_VARIABLE: string = 'RUSH_DAEMON_COMPATIBLE_PLUGINS';
+const COMMAND_AGNOSTIC_PLUGINS_VARIABLE: string = 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS';
 
 interface IPluginFixture {
   /** Defaults to PLUGIN_NAME. The plugin's package is `@example/<pluginName>`. */
@@ -28,12 +33,21 @@ interface IPluginFixture {
   readonly commandLineJson?: object;
   readonly writeManifest?: boolean;
   readonly daemonCompatible?: boolean;
+  readonly daemonCommandAgnostic?: boolean;
+  /** If set, the plugin package has an entry point whose apply() taps these session hooks. */
+  readonly taps?: {
+    readonly runAnyPhasedCommand?: boolean;
+    /** The commands whose runPhasedCommand hook it taps. */
+    readonly runPhasedCommand?: string[];
+  };
 }
 
 interface IRepoFixture {
   readonly plugins: ReadonlyArray<IPluginFixture>;
   /** The rush.json `daemon.compatiblePlugins` setting. */
   readonly compatiblePlugins?: string[];
+  /** The rush.json `daemon.commandAgnosticPlugins` setting. */
+  readonly commandAgnosticPlugins?: string[];
   readonly commandLineJson?: object;
 }
 
@@ -91,11 +105,14 @@ function createRepo(repo: IRepoFixture): string {
     fs.mkdirSync(path.dirname(filename), { recursive: true });
     fs.writeFileSync(filename, JSON.stringify(json));
   };
+  const { compatiblePlugins, commandAgnosticPlugins } = repo;
   write('rush.json', {
     rushVersion: '5.179.0',
     pnpmVersion: '10.27.0',
     projects: [],
-    ...(repo.compatiblePlugins ? { daemon: { compatiblePlugins: repo.compatiblePlugins } } : {})
+    ...(compatiblePlugins || commandAgnosticPlugins
+      ? { daemon: { compatiblePlugins, commandAgnosticPlugins } }
+      : {})
   });
   write('common/config/rush/command-line.json', repo.commandLineJson ?? REPO_COMMAND_LINE_JSON);
   write('common/config/rush/rush-plugins.json', {
@@ -123,7 +140,8 @@ function createRepo(repo: IRepoFixture): string {
             entryPoint: './lib/index.js',
             associatedCommands: plugin.associatedCommands,
             commandLineJsonFilePath: './command-line.json',
-            daemonCompatible: plugin.daemonCompatible
+            daemonCompatible: plugin.daemonCompatible,
+            daemonCommandAgnostic: plugin.daemonCommandAgnostic
           }
         ]
       });
@@ -131,10 +149,52 @@ function createRepo(repo: IRepoFixture): string {
     if (plugin.commandLineJson) {
       write(`${storeFolder}/${pluginName}/command-line.json`, plugin.commandLineJson);
     }
+    if (plugin.taps) {
+      const packageFolder: string = `common/autoinstallers/plugins/node_modules/${getPackageName(plugin)}`;
+      write(`${packageFolder}/package.json`, { name: getPackageName(plugin), version: '1.0.0' });
+      const { runAnyPhasedCommand, runPhasedCommand = [] } = plugin.taps;
+      const statements: string[] = [
+        ...(runAnyPhasedCommand ? ['hooks.runAnyPhasedCommand.tapPromise(name, async () => {});'] : []),
+        ...runPhasedCommand.map(
+          (commandName) => `hooks.runPhasedCommand.for(${JSON.stringify(commandName)}).tap(name, () => {});`
+        )
+      ];
+      const entryPoint: string = path.join(folder, packageFolder, 'lib/index.js');
+      fs.mkdirSync(path.dirname(entryPoint), { recursive: true });
+      fs.writeFileSync(
+        entryPoint,
+        [
+          'module.exports = class {',
+          '  apply({ hooks }) {',
+          `    const name = ${JSON.stringify(pluginName)};`,
+          ...statements.map((statement) => `    ${statement}`),
+          '  }',
+          '};'
+        ].join('\n')
+      );
+    }
   }
   return folder;
 }
 
+/** Applies the plugins that Rush initializes for `commandName` to a new session, as an engine does. */
+async function applyPluginsAsync(folder: string, commandName: string): Promise<RushSession> {
+  const terminalProvider: NoOpTerminalProvider = new NoOpTerminalProvider();
+  const rushSession: RushSession = new RushSession({ terminalProvider, getIsDebugMode: () => false });
+  const pluginManager: PluginManager = new PluginManager({
+    terminal: new Terminal(terminalProvider),
+    rushConfiguration: RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json')),
+    rushSession,
+    builtInPluginConfigurations: [],
+    restrictConsoleOutput: true,
+    rushGlobalFolder: new RushGlobalFolder()
+  });
+  await pluginManager.tryInitializeUnassociatedPluginsAsync();
+  await pluginManager.tryInitializeAssociatedCommandPluginsAsync(commandName);
+  expect(pluginManager.error).toBeUndefined();
+  return rushSession;
+}
+
 async function parseBuildAsync(
   folder: string,
   argv: string[] = ['build'],
@@ -162,12 +222,16 @@ describe(PhasedCommandEngine.name, () => {
     return folder;
   }
 
-  const originalCompatiblePlugins: string | undefined = process.env[COMPATIBLE_PLUGINS_VARIABLE];
+  const originalEnvironment: ReadonlyMap<string, string | undefined> = new Map(
+    [COMPATIBLE_PLUGINS_VARIABLE, COMMAND_AGNOSTIC_PLUGINS_VARIABLE].map((name) => [name, process.env[name]])
+  );
   afterEach(() => {
-    if (originalCompatiblePlugins === undefined) {
-      delete process.env[COMPATIBLE_PLUGINS_VARIABLE];
-    } else {
-      process.env[COMPATIBLE_PLUGINS_VARIABLE] = originalCompatiblePlugins;
+    for (const [name, value] of originalEnvironment) {
+      if (value === undefined) {
+        delete process.env[name];
+      } else {
+        process.env[name] = value;
+      }
     }
     for (const folder of folders.splice(0)) {
       fs.rmSync(folder, { recursive: true, force: true });
@@ -191,6 +255,63 @@ describe(PhasedCommandEngine.name, () => {
     expect(command.commandName).toBe('build');
   });
 
+  it('parses the phased commands of command-line.json and rejects a global command', async () => {
+    const phase: string = '_phase:build';
+    const folder: string = createMultiPluginTestRepo({
+      plugins: [],
+      commandLineJson: {
+        commands: [
+          {
+            commandKind: 'phased',
+            name: 'build',
+            summary: 'Build',
+            phases: [phase],
+            enableParallelism: true,
+            incremental: true
+          },
+          {
+            commandKind: 'phased',
+            name: 'retest',
+            summary: 'Retest',
+            phases: [phase],
+            enableParallelism: true
+          },
+          { commandKind: 'global', name: 'hello', summary: 'Hello', shellCommand: 'echo hello' }
+        ],
+        phases: [{ name: phase, dependencies: { upstream: [phase] } }]
+      }
+    });
+    const build: PhasedCommandEngine = await parseBuildAsync(folder);
+    const retest: PhasedCommandEngine = await parseBuildAsync(folder, ['retest']);
+    expect([build.commandName, build.isIncremental]).toEqual(['build', true]);
+    expect([retest.commandName, retest.isIncremental]).toEqual(['retest', false]);
+    expect(retest.parameterIdentity).not.toBe(build.parameterIdentity);
+    await expect(parseBuildAsync(folder, ['hello'])).rejects.toThrow(
+      'The daemon engine runs phased commands only; "hello" is not a phased command.'
+    );
+    // Only a phased command's command line is a usage error. In-process Rush reports any other invalid one.
+    const stderrWrite: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    try {
+      for (const argv of [
+        ['retest', '--nope'],
+        ['--debug', 'retest', '--nope']
+      ]) {
+        await expect(parseBuildAsync(folder, argv)).rejects.toMatchObject({
+          name: PhasedCommandEngineUsageError.name,
+          message: 'rush retest: error: Unrecognized arguments: --nope.',
+          exitCode: 2
+        });
+      }
+      for (const argv of [['hello', '--nope'], ['nope']]) {
+        const error: unknown = await parseBuildAsync(folder, argv).catch((e: unknown) => e);
+        expect(error).toBeInstanceOf(Error);
+        expect(error).not.toBeInstanceOf(PhasedCommandEngineUsageError);
+      }
+    } finally {
+      stderrWrite.mockRestore();
+    }
+  });
+
   it('reports an invalid command line as a usage error with the exit code of native Rush', async () => {
     const folder: string = createTestRepo({ associatedCommands: [] });
     // The parser also prints the usage, as native Rush does.
@@ -326,7 +447,10 @@ describe(PhasedCommandEngine.name, () => {
         createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON, daemonCompatible: true })
       );
       await expectAcceptedAsync(
-        createTestRepo({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON }, { compatiblePlugins: [PLUGIN_NAME] })
+        createTestRepo(
+          { commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON },
+          { compatiblePlugins: [PLUGIN_NAME] }
+        )
       );
     });
 
@@ -353,7 +477,11 @@ describe(PhasedCommandEngine.name, () => {
       // The native parser also reads the file, and may fail first; either way, parsing fails.
       await expect(
         parseBuildAsync(
-          createTestRepo({ ...BUILD_PLUGIN, daemonCompatible: true, commandLineJson: { commands: 'invalid' } })
+          createTestRepo({
+            ...BUILD_PLUGIN,
+            daemonCompatible: true,
+            commandLineJson: { commands: 'invalid' }
+          })
         )
       ).rejects.toThrow(/command-line\.json/);
     });
@@ -388,6 +516,26 @@ describe(PhasedCommandEngine.name, () => {
       );
     });
 
+    it('shares an engine between commands only if the same plugins are associated with both', async () => {
+      const rushSession: RushSession = new RushSession({
+        terminalProvider: new NoOpTerminalProvider(),
+        getIsDebugMode: () => false
+      });
+      const getRebuildBlockerAsync = async (plugin: IPluginFixture): Promise<string | undefined> => {
+        const folder: string = createTestRepo({ ...plugin, daemonCompatible: true });
+        const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
+        return build.getEngineSharingBlocker(await parseBuildAsync(folder, ['rebuild']), rushSession);
+      };
+      expect(await getRebuildBlockerAsync(BUILD_PLUGIN)).toBeUndefined();
+      // Rush initializes a plugin that is associated with no command for every command.
+      expect(
+        await getRebuildBlockerAsync({ commandLineJson: COMMAND_SCOPED_COMMAND_LINE_JSON })
+      ).toBeUndefined();
+      expect(await getRebuildBlockerAsync({ ...BUILD_PLUGIN, associatedCommands: ['build'] })).toBe(
+        'different plugins are associated with "rebuild" and "build"'
+      );
+    });
+
     it('warns about declared names that match no configured plugin', async () => {
       const folder: string = createTestRepo(
         { ...BUILD_PLUGIN, daemonCompatible: true },
@@ -407,6 +555,130 @@ describe(PhasedCommandEngine.name, () => {
     });
   });
 
+  describe('command-agnostic declarations', () => {
+    // Initialized for every command, like swarm-dogfood's watch-skip plugin, which taps runAnyPhasedCommand.
+    const ANY_COMMAND_PLUGIN: IPluginFixture = {
+      daemonCompatible: true,
+      taps: { runAnyPhasedCommand: true }
+    };
+    const UNDECLARED: string =
+      `the plugin "${PLUGIN_NAME}" (${PACKAGE_NAME}) taps the runAnyPhasedCommand hook and is not ` +
+      'declared command-agnostic';
+
+    beforeEach(() => {
+      jest.spyOn(Autoinstaller.prototype, 'prepareAsync').mockImplementation(async () => {});
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+
+    /** Whether an engine that `build` created, with the plugins applied, can serve `rebuild`. */
+    async function getRebuildBlockerAsync(folder: string): Promise<string | undefined> {
+      const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
+      const rushSession: RushSession = await applyPluginsAsync(folder, 'build');
+      // The plugins never prevent the engine from serving its own command.
+      expect(
+        build.getEngineSharingBlocker(await parseBuildAsync(folder, ['build']), rushSession)
+      ).toBeUndefined();
+      return build.getEngineSharingBlocker(await parseBuildAsync(folder, ['rebuild']), rushSession);
+    }
+
+    it('shares no engine between commands while an undeclared plugin taps runAnyPhasedCommand', async () => {
+      expect(await getRebuildBlockerAsync(createTestRepo(ANY_COMMAND_PLUGIN))).toBe(UNDECLARED);
+    });
+
+    it('shares an engine between commands if the manifest declares the plugin command-agnostic', async () => {
+      expect(
+        await getRebuildBlockerAsync(createTestRepo({ ...ANY_COMMAND_PLUGIN, daemonCommandAgnostic: true }))
+      ).toBeUndefined();
+      // The declaration also covers a plugin that is associated with both commands.
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo({
+            ...ANY_COMMAND_PLUGIN,
+            associatedCommands: ['build', 'rebuild'],
+            daemonCommandAgnostic: true
+          })
+        )
+      ).toBeUndefined();
+    });
+
+    it('shares an engine between commands if rush.json declares the plugin command-agnostic', async () => {
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo(ANY_COMMAND_PLUGIN, { commandAgnosticPlugins: [PLUGIN_NAME] })
+        )
+      ).toBeUndefined();
+    });
+
+    it('lets RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS override rush.json', async () => {
+      process.env[COMMAND_AGNOSTIC_PLUGINS_VARIABLE] = ` ${PLUGIN_NAME} `;
+      expect(
+        await getRebuildBlockerAsync(createTestRepo(ANY_COMMAND_PLUGIN, { commandAgnosticPlugins: [] }))
+      ).toBeUndefined();
+      // An empty value withdraws the rush.json declarations.
+      process.env[COMMAND_AGNOSTIC_PLUGINS_VARIABLE] = '';
+      expect(
+        await getRebuildBlockerAsync(
+          createTestRepo(ANY_COMMAND_PLUGIN, { commandAgnosticPlugins: [PLUGIN_NAME] })
+        )
+      ).toBe(UNDECLARED);
+    });
+
+    it('names an undeclared plugin that taps runAnyPhasedCommand next to a declared one', async () => {
+      const folder: string = createMultiPluginTestRepo({
+        plugins: [ANY_COMMAND_PLUGIN, { ...ANY_COMMAND_PLUGIN, pluginName: OTHER_PLUGIN_NAME }],
+        commandAgnosticPlugins: [PLUGIN_NAME]
+      });
+      expect(await getRebuildBlockerAsync(folder)).toBe(
+        `the plugin "${OTHER_PLUGIN_NAME}" (@example/${OTHER_PLUGIN_NAME}) taps the runAnyPhasedCommand hook ` +
+          'and is not declared command-agnostic'
+      );
+    });
+
+    it('shares no engine while a declared plugin taps the runPhasedCommand hook of either command', async () => {
+      for (const commandName of ['build', 'rebuild']) {
+        const folder: string = createTestRepo({
+          ...ANY_COMMAND_PLUGIN,
+          daemonCommandAgnostic: true,
+          taps: { runAnyPhasedCommand: true, runPhasedCommand: [commandName] }
+        });
+        expect(await getRebuildBlockerAsync(folder)).toBe(
+          `a plugin taps the runPhasedCommand hook of "${commandName}"`
+        );
+      }
+    });
+
+    it('shares no engine while a tap that no plugin applied is on runAnyPhasedCommand', async () => {
+      const folder: string = createTestRepo({ ...ANY_COMMAND_PLUGIN, daemonCommandAgnostic: true });
+      const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
+      const rushSession: RushSession = await applyPluginsAsync(folder, 'build');
+      const rebuild: PhasedCommandEngine = await parseBuildAsync(folder, ['rebuild']);
+      expect(build.getEngineSharingBlocker(rebuild, rushSession)).toBeUndefined();
+      rushSession.hooks.runAnyPhasedCommand.tap('late', () => {});
+      expect(build.getEngineSharingBlocker(rebuild, rushSession)).toBe(
+        'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "late")'
+      );
+    });
+
+    it('warns about command-agnostic names that match no configured plugin', async () => {
+      const folder: string = createTestRepo(ANY_COMMAND_PLUGIN, {
+        commandAgnosticPlugins: ['rush-exmaple-plugin']
+      });
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const command: PhasedCommandEngine = await parseBuildAsync(folder, ['build'], terminalProvider);
+      expect(command.unmatchedCompatiblePluginNames).toEqual([]);
+      expect(terminalProvider.getWarningOutput()).toContain(
+        `The daemon's command-agnostic plugin list (rush.json "daemon.commandAgnosticPlugins" or ` +
+          `RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS) names plugins that are not configured in rush-plugins.json: ` +
+          `"rush-exmaple-plugin".`
+      );
+      // A misspelled name does not declare the plugin that it was meant to name.
+      expect(await getRebuildBlockerAsync(folder)).toBe(UNDECLARED);
+    });
+  });
+
   describe('JSON configuration files of parses that share a workspace configuration', () => {
     const REPO_COMMAND_LINE_PATH: string = 'common/config/rush/command-line.json';
     const AUTOINSTALLER_PACKAGE_JSON_PATH: string = 'common/autoinstallers/plugins/package.json';
@@ -451,7 +723,11 @@ describe(PhasedCommandEngine.name, () => {
       return RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
     }
 
-    function editJson<T>(rushConfiguration: RushConfiguration, relativePath: string, edit: (json: T) => void): void {
+    function editJson<T>(
+      rushConfiguration: RushConfiguration,
+      relativePath: string,
+      edit: (json: T) => void
+    ): void {
       const filePath: string = path.join(rushConfiguration.rushJsonFolder, relativePath);
       const json: T = JSON.parse(fs.readFileSync(filePath, 'utf8'));
       edit(json);
@@ -577,7 +853,9 @@ describe(PhasedCommandEngine.name, () => {
       // Engine parses in this process validated the environment, and a native parser must load .env files first.
       EnvironmentConfiguration.reset();
 
-      const parser: RushCommandLineParser = new RushCommandLineParser({ cwd: rushConfiguration.rushJsonFolder });
+      const parser: RushCommandLineParser = new RushCommandLineParser({
+        cwd: rushConfiguration.rushJsonFolder
+      });
       expect(parser.getAction('example-global')).toBeDefined();
       expect(cacheLoadSpy).not.toHaveBeenCalled();
       const loadedFilePaths: Set<string> = new Set(loadSpy.mock.calls.map(([filePath]) => filePath));
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
index e0799d6a68..4865e55610 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineParameterIdentity.test.ts
@@ -98,15 +98,23 @@ describe(`${PhasedCommandEngine.name} parameter identity`, () => {
   it('reports the excluded settings per request', async () => {
     expect((await parseAsync('build')).requestSettings).toEqual({
       quietMode: true,
-      parallelism: parseParallelism(undefined)
+      parallelism: parseParallelism(undefined),
+      isIncrementalBuildAllowed: true
     });
     expect((await parseAsync('build', '--verbose', '-p', '2')).requestSettings).toEqual({
       quietMode: false,
-      parallelism: 2
+      parallelism: 2,
+      isIncrementalBuildAllowed: true
     });
     expect((await parseAsync('build', '-p', '50%')).requestSettings).toEqual({
       quietMode: true,
-      parallelism: { scalar: 0.5 }
+      parallelism: { scalar: 0.5 },
+      isIncrementalBuildAllowed: true
+    });
+    expect((await parseAsync('rebuild', '--only', 'a')).requestSettings).toEqual({
+      quietMode: true,
+      parallelism: parseParallelism(undefined),
+      isIncrementalBuildAllowed: false
     });
   });
 
@@ -127,7 +135,8 @@ describe(`${PhasedCommandEngine.name} parameter identity`, () => {
     try {
       expect((await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build')).requestSettings).toEqual({
         quietMode: true,
-        parallelism: 3
+        parallelism: 3,
+        isIncrementalBuildAllowed: true
       });
       expect(
         (await parseInEnvironmentAsync({ RUSH_PARALLELISM: '3' }, 'build', '-p', '5')).requestSettings
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
new file mode 100644
index 0000000000..07d5f8f87b
--- /dev/null
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
@@ -0,0 +1,243 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import { PhasedCommandEngine } from '../PhasedCommandEngine';
+import { RushConfiguration } from '../RushConfiguration';
+import { Rush } from '../Rush';
+import { RushSession } from '../../pluginFramework/RushSession';
+
+describe(`${PhasedCommandEngine.name} engine sharing`, () => {
+  let folder: string;
+  let rushConfiguration: RushConfiguration;
+
+  function write(name: string, value: unknown): void {
+    const filename: string = path.join(folder, name);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, JSON.stringify(value));
+  }
+
+  async function parseAsync(
+    argv: string[],
+    configuration: RushConfiguration = rushConfiguration
+  ): Promise<PhasedCommandEngine> {
+    return await PhasedCommandEngine.parseAsync({
+      argv,
+      cwd: folder,
+      environment: {},
+      rushConfiguration: configuration,
+      terminalProvider: new NoOpTerminalProvider()
+    });
+  }
+
+  function createRushSession(): RushSession {
+    return new RushSession({ terminalProvider: new NoOpTerminalProvider(), getIsDebugMode: () => false });
+  }
+
+  /** Why an engine created by `engineArgv` cannot serve `requestArgv`, or undefined if it can. */
+  async function getBlockerAsync(
+    engineArgv: string[],
+    requestArgv: string[],
+    rushSession: RushSession = createRushSession(),
+    configuration: RushConfiguration = rushConfiguration
+  ): Promise<string | undefined> {
+    const engine: PhasedCommandEngine = await parseAsync(engineArgv, configuration);
+    return engine.getEngineSharingBlocker(await parseAsync(requestArgv, configuration), rushSession);
+  }
+
+  beforeAll(() => {
+    folder = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-sharing-')));
+    write('rush.json', {
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: [
+        { packageName: 'a', projectFolder: 'a' },
+        { packageName: 'b', projectFolder: 'b' }
+      ]
+    });
+    for (const name of ['a', 'b']) {
+      write(`${name}/package.json`, {
+        name,
+        version: '1.0.0',
+        dependencies: name === 'b' ? { a: '1.0.0' } : {},
+        scripts: { '_phase:compile': 'node -v', '_phase:test': 'node -v', '_phase:lint': 'node -v' }
+      });
+    }
+    write('common/config/rush/command-line.json', {
+      phases: [
+        { name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } },
+        { name: '_phase:test', dependencies: { self: ['_phase:compile'] } },
+        // Like a lint phase that reads the declarations of its dependencies.
+        { name: '_phase:lint', dependencies: { upstream: ['_phase:compile'] } }
+      ],
+      commands: [
+        { name: 'build', phases: ['_phase:compile'], incremental: true },
+        { name: 'test', phases: ['_phase:compile', '_phase:test'], incremental: true },
+        { name: 'retest', phases: ['_phase:compile', '_phase:test'], incremental: false },
+        { name: 'lint', phases: ['_phase:lint'], incremental: true }
+      ].map((command) => ({
+        ...command,
+        commandKind: 'phased',
+        summary: `The ${command.name} command`,
+        enableParallelism: true
+      })),
+      parameters: [
+        {
+          parameterKind: 'flag',
+          longName: '--production',
+          description: 'Changes the commands of the compile phase',
+          associatedCommands: ['build', 'test', 'retest', 'lint'],
+          associatedPhases: ['_phase:compile']
+        },
+        {
+          parameterKind: 'flag',
+          longName: '--coverage',
+          description: 'Changes the commands of the test phase',
+          associatedCommands: ['test', 'retest'],
+          associatedPhases: ['_phase:test']
+        },
+        {
+          parameterKind: 'string',
+          longName: '--report',
+          argumentName: 'FILE',
+          description: 'Read only by plugins',
+          associatedCommands: ['test']
+        }
+      ]
+    });
+    rushConfiguration = RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json'));
+  });
+
+  afterAll(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('serves other commands on the engine of an incremental command whose graph has their phases', async () => {
+    expect(await getBlockerAsync(['build'], ['rebuild', '--only', 'a'])).toBeUndefined();
+    expect(
+      await getBlockerAsync(['build', '--to', 'a'], ['build', '--ignore-hooks', '--verbose'])
+    ).toBeUndefined();
+    for (const request of [
+      ['build'],
+      ['rebuild'],
+      ['retest', '--only', 'b'],
+      ['test', '--include-phase-deps']
+    ]) {
+      expect(await getBlockerAsync(['test'], request)).toBeUndefined();
+    }
+    expect(await getBlockerAsync(['lint'], ['build'])).toBeUndefined();
+    expect(await getBlockerAsync(['lint'], ['lint', '--only', 'b', '--include-phase-deps'])).toBeUndefined();
+
+    expect(await getBlockerAsync(['build'], ['test'])).toBe(
+      'the graph of "build" does not have every operation of the "_phase:test" phase'
+    );
+    // With --include-phase-deps, the graph has compile operations only for the projects that others depend on.
+    expect(await getBlockerAsync(['lint', '--include-phase-deps'], ['build'])).toBe(
+      'the graph of "lint" does not have every operation of the "_phase:compile" phase'
+    );
+  });
+
+  it('serves only its own command on the engine of a command that is not incremental', async () => {
+    expect(await getBlockerAsync(['rebuild'], ['rebuild', '--only', 'a', '-p', '2'])).toBeUndefined();
+    expect(await getBlockerAsync(['retest', '--to', 'b'], ['retest', '--only', 'a'])).toBeUndefined();
+    expect(await getBlockerAsync(['rebuild'], ['build'])).toBe('"rebuild" is not incremental');
+    expect(await getBlockerAsync(['retest'], ['test'])).toBe('"retest" is not incremental');
+  });
+
+  it('serves no command that is not incremental on an engine that runs persistent IPC runners', async () => {
+    const rushJsonPath: string = path.join(folder, 'rush.json');
+    const rushJson: Record<string, unknown> = JSON.parse(fs.readFileSync(rushJsonPath, 'utf8'));
+    write('rush.json', { ...rushJson, daemon: { usePersistentIpcRunners: true } });
+    try {
+      const withIpc: RushConfiguration = RushConfiguration.loadFromConfigurationFile(rushJsonPath);
+      const getIpcBlockerAsync = (engineArgv: string[], requestArgv: string[]): Promise<string | undefined> =>
+        getBlockerAsync(engineArgv, requestArgv, createRushSession(), withIpc);
+      expect(await getIpcBlockerAsync(['build'], ['rebuild', '--only', 'a'])).toBe(
+        '"rebuild" is not incremental, and "build" runs persistent IPC runners'
+      );
+      expect(await getIpcBlockerAsync(['test'], ['retest'])).toBe(
+        '"retest" is not incremental, and "test" runs persistent IPC runners'
+      );
+      // Incremental commands still share the engine, and a command that is not incremental keeps its own.
+      expect(await getIpcBlockerAsync(['test'], ['build'])).toBeUndefined();
+      expect(await getIpcBlockerAsync(['build'], ['build', '--to', 'b'])).toBeUndefined();
+      expect(await getIpcBlockerAsync(['rebuild'], ['rebuild', '--only', 'a'])).toBeUndefined();
+      expect(await getIpcBlockerAsync(['rebuild'], ['build'])).toBe('"rebuild" is not incremental');
+    } finally {
+      write('rush.json', rushJson);
+    }
+  });
+
+  it('compares the arguments of the phases that the request can run', async () => {
+    const different: string = 'has different parameters for its phases';
+    const production: string = '(--production for "_phase:compile")';
+    expect(await getBlockerAsync(['test'], ['build', '--production'])).toBe(
+      `"build" ${different} ${production}`
+    );
+    expect(await getBlockerAsync(['build', '--production'], ['rebuild'])).toBe(
+      `"rebuild" ${different} ${production}`
+    );
+    expect(await getBlockerAsync(['build', '--production'], ['rebuild', '--production'])).toBeUndefined();
+    // --coverage changes only the test phase, which build cannot run.
+    expect(await getBlockerAsync(['test', '--coverage'], ['build'])).toBeUndefined();
+    expect(await getBlockerAsync(['test', '--coverage'], ['retest'])).toBe(
+      `"retest" ${different} (--coverage for "_phase:test")`
+    );
+    expect(await getBlockerAsync(['test', '--coverage'], ['test', '--production'])).toBe(
+      `"test" ${different} (--coverage for "_phase:test", --production for "_phase:compile")`
+    );
+    // --changed-projects-only changes how the graph enables operations.
+    expect(await getBlockerAsync(['build', '--changed-projects-only'], ['rebuild'])).toBe(
+      `"rebuild" ${different} (--changed-projects-only)`
+    );
+    expect(await getBlockerAsync(['build'], ['build', '--changed-projects-only'])).toBe(
+      `"build" ${different} (--changed-projects-only)`
+    );
+  });
+
+  it('serves the same command only with the same values of the parameters that no phase has', async () => {
+    expect(await getBlockerAsync(['test', '--report', 'x.json'], ['test'])).toBe(
+      '"test" has different parameters (--report)'
+    );
+    expect(await getBlockerAsync(['test', '--report', 'x.json'], ['test', '--report', 'y.json'])).toBe(
+      '"test" has different parameters (--report)'
+    );
+    expect(
+      await getBlockerAsync(['test', '--report', 'x.json'], ['test', '--only', 'a', '--report', 'x.json'])
+    ).toBeUndefined();
+    // Only plugins that are associated with test could read it, and build shares the engine only if there are none.
+    expect(await getBlockerAsync(['test', '--report', 'x.json'], ['build'])).toBeUndefined();
+  });
+
+  it('serves no other command while a plugin taps the hooks that Rush calls with the command', async () => {
+    const anyCommand: RushSession = createRushSession();
+    anyCommand.hooks.runAnyPhasedCommand.tap('test', () => {});
+    // Only a plugin's apply() can add a tap that a command-agnostic declaration covers.
+    expect(await getBlockerAsync(['build'], ['rebuild'], anyCommand)).toBe(
+      'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "test")'
+    );
+    const intercepted: RushSession = createRushSession();
+    intercepted.hooks.runAnyPhasedCommand.intercept({ call: () => {} });
+    expect(await getBlockerAsync(['build'], ['rebuild'], intercepted)).toBe(
+      'a plugin intercepts the runAnyPhasedCommand hook'
+    );
+    expect(await getBlockerAsync(['build'], ['build', '--to', 'b'], anyCommand)).toBeUndefined();
+
+    const testCommand: RushSession = createRushSession();
+    testCommand.hooks.runPhasedCommand.for('test').tap('test', () => {});
+    expect(await getBlockerAsync(['test'], ['build'], testCommand)).toBe(
+      'a plugin taps the runPhasedCommand hook of "test"'
+    );
+    expect(await getBlockerAsync(['build'], ['rebuild'], testCommand)).toBeUndefined();
+    // A hook that no plugin taps does not block.
+    const untapped: RushSession = createRushSession();
+    untapped.hooks.runPhasedCommand.for('build');
+    expect(await getBlockerAsync(['build'], ['rebuild'], untapped)).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index 6a1f6fb304..ac6a2157ea 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -249,6 +249,8 @@ describe('workspace input fingerprints', () => {
         { FOO: '1' },
         // Declaring a plugin daemon-compatible changes which plugins the engine applies.
         { RUSH_DAEMON_COMPATIBLE_PLUGINS: 'rush-example-plugin' },
+        // Declaring a plugin command-agnostic changes which commands the engine serves.
+        { RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS: 'rush-example-plugin' },
         { RUSH_BUILD_CACHE_ENABLED: '1' },
         { RUSH_BUILD_CACHE_WRITE_ALLOWED: '0' },
         { RUSH_DAEMON_WATCH: '1' },
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 926aa0bb72..ed6f2a74ca 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -104,6 +104,28 @@ const ENGINE_REQUEST_SCOPED_PARAMETER_NAMES: ReadonlySet<string> = new Set([
   '--timeline'
 ]);
 
+/**
+ * Parameters that are part of the engine parameter identity, but that do not keep an engine created by one command
+ * from serving another command (see `getEngineGraphIdentity`). An engine never runs build event-hook scripts, and
+ * it selects the operations of each request with the request's own `--include-phase-deps`.
+ */
+const ENGINE_SHAREABLE_PARAMETER_NAMES: ReadonlySet<string> = new Set([
+  '--ignore-hooks',
+  '--include-phase-deps'
+]);
+
+/**
+ * The phases of an engine's graph and of one request, by name; see `PhasedScriptAction.getEnginePhaseNames`.
+ */
+export interface IEnginePhaseNames {
+  /** The phases for which the graph of an engine created by this command has an operation of every project. */
+  readonly complete: ReadonlySet<string>;
+  /** The phases whose operations a request of this command selects for each project that it selects. */
+  readonly selected: ReadonlySet<string>;
+  /** Every phase that a request of this command can run: its selected phases and all of their dependencies. */
+  readonly reachable: ReadonlySet<string>;
+}
+
 /**
  * The set of overall execution statuses that mean the command did what was asked of it and should
  * exit with code 0.
@@ -183,6 +205,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   readonly #alwaysWatch: boolean;
   readonly #alwaysInstall: boolean | undefined;
   readonly #includeAllProjectsInWatchGraph: boolean;
+  readonly #phases: ReadonlyMap<string, IPhase>;
   readonly #terminal: ITerminal;
   readonly #engineEnvironment: Readonly<Record<string, string | undefined>> | undefined;
 
@@ -228,6 +251,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     this.#alwaysWatch = alwaysWatch;
     this.#alwaysInstall = alwaysInstall;
     this.#includeAllProjectsInWatchGraph = includeAllProjectsInWatchGraph;
+    this.#phases = phases;
     this._runsBeforeInstall = false;
     this.sessionAbortController = new AbortController();
 
@@ -372,6 +396,24 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     await this.#runAsync();
   }
 
+  /** False when every run executes all selected operations: `rebuild`, or `"incremental": false`. */
+  public get isIncrementalBuildAllowed(): boolean {
+    return this.#isIncrementalBuildAllowed;
+  }
+
+  /**
+   * Whether an engine created by this command runs the operations that declare `daemonIpc` in persistent
+   * Node IPC processes. `DaemonIpcOperationRunnerPlugin` installs those runners only for an incremental
+   * command.
+   */
+  public get usesPersistentIpcRunners(): boolean {
+    return (
+      this.#isIncrementalBuildAllowed &&
+      this.rushConfiguration.daemon.usePersistentIpcRunners &&
+      !this.#noIPCParameter?.value
+    );
+  }
+
   /** The names of every phase this command can schedule, including dependency and watch phases. */
   public get schedulablePhaseNames(): ReadonlySet<string> {
     const phaseNames: Set<string> = new Set();
@@ -395,6 +437,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
       throw new Error('Watch, install, variant and diagnostic-directory options require --no-daemon.');
     }
     if (
+      this.#runsBuildEventHooks() &&
       !this.#ignoreHooksParameter.value &&
       (this.rushConfiguration.eventHooks.get(Event.preRushBuild).length ||
         this.rushConfiguration.eventHooks.get(Event.postRushBuild).length)
@@ -414,6 +457,137 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     ]);
   }
 
+  /**
+   * The phases of the graph of an engine created by this command, and of the operations of one request of it.
+   *
+   * @remarks
+   * An engine creates operations of every project for the phases that the command selects, and, through their
+   * dependencies, operations of the phases that these depend on. A phase that is reached only through an `upstream`
+   * dependency has operations only for the projects that other projects depend on.
+   */
+  public getEnginePhaseNames(): IEnginePhaseNames {
+    const selected: ReadonlySet<IPhase> = this.#includePhaseDeps?.value
+      ? this.#originalPhases
+      : this.#initialPhases;
+    const complete: Set<IPhase> = new Set(selected);
+    for (const phase of complete) {
+      for (const dependency of phase.dependencies.self) {
+        complete.add(dependency);
+      }
+    }
+    const getNames = (phases: Iterable<IPhase>): ReadonlySet<string> =>
+      new Set(Array.from(phases, (phase: IPhase) => phase.name));
+    return {
+      complete: getNames(complete),
+      selected: getNames(selected),
+      reachable: getNames(this.#initialPhases)
+    };
+  }
+
+  /**
+   * The settings of this command that shape the operations of the specified phases or the graph that contains them,
+   * as JSON. An engine created by one command can serve a request of another command only if both commands have the
+   * same graph identity for the phases that the request can run.
+   *
+   * @remarks
+   * It includes the global parameters, the arguments that the custom parameters associated with each phase add to
+   * the phase's commands (and therefore to the hashes of its operations), the built-in parameters that are set,
+   * other than selection, request-scoped and `ENGINE_SHAREABLE_PARAMETER_NAMES` parameters, and the command's
+   * build cache and oversubscription settings. Unlike `getEngineParameterIdentity`, it excludes the command name
+   * and whether the command is incremental, which each request applies to its own iteration.
+   */
+  public getEngineGraphIdentity(phaseNames: ReadonlySet<string>): string {
+    const phaseArguments: [string, string[]][] = [];
+    for (const phaseName of Array.from(phaseNames).sort()) {
+      const phaseArgumentList: string[] = [];
+      for (const parameter of this.#phases.get(phaseName)?.associatedParameters ?? []) {
+        parameter.appendToArgList(phaseArgumentList);
+      }
+      phaseArguments.push([phaseName, phaseArgumentList]);
+    }
+    return JSON.stringify({
+      global: this.parser.getParameterStringMap(),
+      phases: phaseArguments,
+      builtIn: this.#getEngineGraphBuiltInParameters(),
+      disableBuildCache: this.#disableBuildCache,
+      allowOversubscription: this.#allowOversubscription
+    });
+  }
+
+  /**
+   * The contents of `getEngineGraphIdentity` for the specified phases, keyed by what each describes, so that the
+   * parameters and settings that differ between two commands can be named: `--name for "phase"` for the arguments
+   * that a phase's parameter adds, the name of a global or built-in parameter, or `name in command-line.json`.
+   */
+  public getEngineGraphIdentityParts(phaseNames: ReadonlySet<string>): ReadonlyMap<string, string> {
+    const parts: Map<string, string> = new Map(Object.entries(this.parser.getParameterStringMap()));
+    for (const phaseName of phaseNames) {
+      for (const parameter of this.#phases.get(phaseName)?.associatedParameters ?? []) {
+        const argumentList: string[] = [];
+        parameter.appendToArgList(argumentList);
+        if (argumentList.length > 0) {
+          parts.set(`${parameter.longName} for "${phaseName}"`, JSON.stringify(argumentList));
+        }
+      }
+    }
+    for (const [name, value] of this.#getEngineGraphBuiltInParameters()) {
+      parts.set(name, value);
+    }
+    parts.set('disableBuildCache in command-line.json', String(this.#disableBuildCache));
+    parts.set('allowOversubscription in command-line.json', String(this.#allowOversubscription));
+    return parts;
+  }
+
+  /**
+   * The arguments of the custom parameters of this command that are associated with none of the specified phases,
+   * as JSON. They cannot affect the operations of these phases, but a plugin that is initialized for this command can
+   * read them, so an engine serves another request of the same command only if they are equal.
+   */
+  public getEngineCustomParameterIdentity(phaseNames: ReadonlySet<string>): string {
+    const argumentList: string[] = [];
+    for (const parameter of this.#getCustomParametersOfNoPhase(phaseNames)) {
+      parameter.appendToArgList(argumentList);
+    }
+    return JSON.stringify(argumentList);
+  }
+
+  /** The arguments in `getEngineCustomParameterIdentity`, keyed by the name of the parameter that adds them. */
+  public getEngineCustomParameterIdentityParts(phaseNames: ReadonlySet<string>): ReadonlyMap<string, string> {
+    const parts: Map<string, string> = new Map();
+    for (const parameter of this.#getCustomParametersOfNoPhase(phaseNames)) {
+      const argumentList: string[] = [];
+      parameter.appendToArgList(argumentList);
+      if (argumentList.length > 0) {
+        parts.set(parameter.longName, JSON.stringify(argumentList));
+      }
+    }
+    return parts;
+  }
+
+  /** The set built-in parameters that shape the graph: not selection, request-scoped or shareable ones. */
+  #getEngineGraphBuiltInParameters(): [string, string][] {
+    const excludedNames: Set<string> = new Set([
+      ...this.#selectionParameters.parameterNames,
+      ...ENGINE_REQUEST_SCOPED_PARAMETER_NAMES,
+      ...ENGINE_SHAREABLE_PARAMETER_NAMES
+    ]);
+    for (const parameter of this.customParameters.values()) {
+      excludedNames.add(parameter.scopedLongName ?? parameter.longName);
+    }
+    return Object.entries(this.getParameterStringMap()).filter(
+      ([name, value]) => !excludedNames.has(name) && isParameterValueSet(value)
+    );
+  }
+
+  #getCustomParametersOfNoPhase(phaseNames: ReadonlySet<string>): CommandLineParameter[] {
+    return Array.from(this.customParameters)
+      .filter(
+        ([parameterJson]) =>
+          !parameterJson.associatedPhases?.some((phaseName: string) => phaseNames.has(phaseName))
+      )
+      .map(([, parameter]) => parameter);
+  }
+
   /**
    * Output verbosity and scheduling settings for one engine request. These are excluded from
    * `getEngineParameterIdentity` and must be applied to the shared graph before each iteration.
@@ -421,7 +595,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   public getEngineRequestSettings(): IPhasedCommandEngineRequestSettings {
     return {
       quietMode: !this.#verboseParameter.value,
-      parallelism: this.#getParallelism()
+      parallelism: this.#getParallelism(),
+      isIncrementalBuildAllowed: this.#isIncrementalBuildAllowed
     };
   }
 
@@ -1143,10 +1318,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   }
 
   #doBeforeTask(): void {
-    if (
-      this.actionName !== RushConstants.buildCommandName &&
-      this.actionName !== RushConstants.rebuildCommandName
-    ) {
+    if (!this.#runsBuildEventHooks()) {
       // Only collects information for built-in commands like build or rebuild.
       return;
     }
@@ -1157,15 +1329,25 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   }
 
   #doAfterTask(): void {
-    if (
-      this.actionName !== RushConstants.buildCommandName &&
-      this.actionName !== RushConstants.rebuildCommandName
-    ) {
+    if (!this.#runsBuildEventHooks()) {
       // Only collects information for built-in commands like build or rebuild.
       return;
     }
     this.eventHooksManager.handle(Event.postRushBuild, this.parser.isDebug, this.#ignoreHooksParameter.value);
   }
+
+  /** Whether this command runs the preRushBuild/postRushBuild event hooks, which only build and rebuild do. */
+  #runsBuildEventHooks(): boolean {
+    return (
+      this.actionName === RushConstants.buildCommandName ||
+      this.actionName === RushConstants.rebuildCommandName
+    );
+  }
+}
+
+/** `getParameterStringMap` maps an unset flag to "false", an unset list to "" and other unset values to undefined. */
+function isParameterValueSet(value: string | undefined): boolean {
+  return value !== undefined && value !== 'false' && value !== '';
 }
 
 async function getProjectConfigurationIdentityAsync(
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index bbe7bfbef5..1e24e52fbf 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -314,7 +314,8 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               // Supports cache writes by default for initial operations.
               // Don't write during watch runs for performance reasons (and to avoid flooding the cache)
               isCacheWriteAllowed: cacheWriteEnabled,
-              isCacheReadAllowed: isIncrementalBuildAllowed,
+              isCacheReadAllowed:
+                isIncrementalBuildAllowed && iterationOptions.isIncrementalBuildAllowed !== false,
               operationBuildCache: undefined,
               outputFolderNames,
               get cacheDisabledReason(): string | undefined {
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index 089846f243..fa1c9cf2d2 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -34,6 +34,18 @@ export interface IOperationGraphIterationOptions {
    */
   getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
 
+  /**
+   * False to run every enabled operation of this iteration as a fresh process of a non-incremental command such as
+   * `rush rebuild` would: without skipping unchanged operations, without reading the build cache, and without
+   * passing the last result to the runner (so no runner uses its incremental command). Cache writes are unaffected.
+   * When omitted or true, the graph's own setting (`ICreateOperationsContext.isIncrementalBuildAllowed`) applies.
+   *
+   * @remarks
+   * A long-lived graph created by an incremental command serves a non-incremental request this way. The results
+   * of operations that the iteration does not enable are kept.
+   */
+  isIncrementalBuildAllowed?: boolean;
+
   /**
    * Returns the identifier of the request whose environment `getOperationEnvironment` returns for an operation of
    * this iteration, or `undefined` if there is no such request. When omitted, the iteration serves no identified
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index f1800f2105..6f71ea5cd6 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -93,6 +93,8 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         ): void => {
           let logGitWarning: boolean = false;
           const { inputsSnapshot } = iterationOptions;
+          const allowSkip: boolean =
+            isIncrementalBuildAllowed && iterationOptions.isIncrementalBuildAllowed !== false;
 
           for (const record of operations.values()) {
             const { operation } = record;
@@ -147,7 +149,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             stateMap.set(operation, {
               packageDepsPath,
               packageDeps,
-              allowSkip: isIncrementalBuildAllowed
+              allowSkip
             });
           }
 
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index 3bfe990ba4..a7ff3bce47 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -98,6 +98,9 @@ interface IExecutionIterationContext extends IOperationExecutionRecordContext {
 
   startTime?: number;
 
+  /** See `IOperationGraphIterationOptions.isIncrementalBuildAllowed`. */
+  isIncrementalBuildAllowed?: boolean;
+
   getOperationRequestId?: (operation: Operation) => string | undefined;
 
   completedOperations: number;
@@ -686,12 +689,14 @@ export class OperationGraph implements IOperationGraph {
       startTime = performance.now(),
       inputsSnapshot = await getInputsSnapshotAsync?.(),
       getOperationEnvironment,
+      isIncrementalBuildAllowed,
       getOperationRequestId
     } = iterationOptions;
     const iterationOptionsForCallbacks: IOperationGraphIterationOptions = {
       startTime,
       inputsSnapshot,
       getOperationEnvironment,
+      isIncrementalBuildAllowed,
       getOperationRequestId
     };
 
@@ -738,6 +743,7 @@ export class OperationGraph implements IOperationGraph {
       streamCollator,
       terminal,
       inputsSnapshot,
+      isIncrementalBuildAllowed,
       stateHashCache: this.#stateHashCache,
       maxParallelism: this.#maxParallelism,
       onOperationStateChanged: undefined,
@@ -907,6 +913,7 @@ export class OperationGraph implements IOperationGraph {
       inputsSnapshot: iterationContext.inputsSnapshot,
       startTime: iterationContext.startTime,
       getOperationEnvironment: iterationContext.getOperationEnvironment,
+      isIncrementalBuildAllowed: iterationContext.isIncrementalBuildAllowed,
       getOperationRequestId: iterationContext.getOperationRequestId
     };
 
@@ -1028,9 +1035,11 @@ export class OperationGraph implements IOperationGraph {
               state.hasAnyAborted = true;
               executionQueue.complete(record);
             } else {
-              const lastState: OperationExecutionRecord | undefined = state.resultByOperation.get(
-                record.operation
-              );
+              // A non-incremental iteration runs each operation as a fresh `rush rebuild` process would.
+              const lastState: OperationExecutionRecord | undefined =
+                iterationContext.isIncrementalBuildAllowed === false
+                  ? undefined
+                  : state.resultByOperation.get(record.operation);
               await record.executeAsync(lastState, executionContext);
             }
           },
diff --git a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
index 105cb23b26..9bd833bdd7 100644
--- a/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/PhasedOperationPlugin.ts
@@ -320,11 +320,14 @@ function configureOperations(
   lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
   iterationOptions: IOperationGraphIterationOptions
 ): void {
+  // A non-incremental request runs every operation that it enables, like `rush rebuild`.
+  const runAllEnabled: boolean = iterationOptions.isIncrementalBuildAllowed === false;
   for (const [operation, currentState] of currentStates) {
     const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
 
     currentState.enabled =
-      operation.enabled && shouldEnableOperation(currentState, lastState, iterationOptions.inputsSnapshot);
+      operation.enabled &&
+      (runAllEnabled || shouldEnableOperation(currentState, lastState, iterationOptions.inputsSnapshot));
   }
 }
 
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index 5ea4acc161..8b3824c345 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -126,7 +126,7 @@ interface ITestGraph {
    * The names of the operations whose runner executes its incremental command
    */
   incrementalNames: Set<string>;
-  executeAsync(): Promise<IExecutionResult>;
+  executeAsync(isIncrementalBuildAllowed?: boolean): Promise<IExecutionResult>;
 }
 
 interface ITestGraphOptions {
@@ -317,13 +317,13 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     cobuildLocks,
     checks,
     incrementalNames,
-    executeAsync: async () => {
+    executeAsync: async (isIncrementalBuildAllowed?: boolean) => {
       executions.length = 0;
       cacheWrites.length = 0;
       cacheRestores.length = 0;
       cobuildLocks.length = 0;
       checks.length = 0;
-      return await graph.executeAsync({ inputsSnapshot });
+      return await graph.executeAsync({ inputsSnapshot, isIncrementalBuildAllowed });
     }
   };
 }
@@ -609,6 +609,24 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     expect(testGraph.cacheWrites).toEqual(['b']);
   });
 
+  it('restores nothing from the build cache in a non-incremental iteration, but still writes to it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+    testGraph.localHashes.set('a', 'a-v2');
+    await testGraph.executeAsync();
+
+    // Revert "a", then rebuild --to b: both have entries from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    const result: IExecutionResult = await testGraph.executeAsync(false);
+    expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.Success);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+  });
+
   it('does not re-execute untrusted retained results when cache writes are disabled', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
     await testGraph.executeAsync();
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index fa38cd5636..1bd638de41 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -177,7 +177,10 @@ interface ITestWorkspace {
    * Deletes a folder and writes its files again, like a branch switch that removed the folder and restored it.
    */
   recreateFolder(relativePath: string): void;
-  executeAsync(environment?: Readonly<Record<string, string>>): Promise<ITestIteration>;
+  executeAsync(
+    environment?: Readonly<Record<string, string>>,
+    isIncrementalBuildAllowed?: boolean
+  ): Promise<ITestIteration>;
   /**
    * Resolves when the next command that hangs has written its outputs. It runs until it is terminated.
    */
@@ -616,12 +619,16 @@ async function createWorkspaceAsync(
     writeFile,
     deleteFile: (relativePath: string) => fs.rmSync(`${rootFolder}/${relativePath}`),
     recreateFolder: (relativePath: string) => recreateFolder(`${rootFolder}/${relativePath}`),
-    executeAsync: async (environment: Readonly<Record<string, string>> = {}): Promise<ITestIteration> => {
+    executeAsync: async (
+      environment: Readonly<Record<string, string>> = {},
+      isIncrementalBuildAllowed?: boolean
+    ): Promise<ITestIteration> => {
       commands.length = 0;
       destination.reset();
       const result: IExecutionResult = await graph.executeAsync({
         inputsSnapshot: createInputsSnapshot(environment),
-        getOperationEnvironment: () => environment
+        getOperationEnvironment: () => environment,
+        isIncrementalBuildAllowed
       });
       return {
         result,
@@ -654,6 +661,22 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     expect((await workspace.executeAsync()).commands).toEqual([]);
   });
 
+  it('runs the initial command in an iteration that allows no incremental build, and uses its result as the base', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+    await workspace.executeAsync();
+
+    // Like `rush rebuild`, served by a graph of `rush build`: the runner gets no last result.
+    workspace.writeFile('a/tsconfig.json', '{ "compilerOptions": {} }');
+    const rebuilt: ITestIteration = await workspace.executeAsync({}, false);
+    expect(rebuilt.commands).toEqual(['a:initial']);
+    expect(rebuilt.output).not.toContain('Not using the incremental command');
+    expect((await workspace.executeAsync({}, false)).commands).toEqual(['a:initial']);
+
+    // The configuration file changed after the first iteration, but before the base.
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+  });
+
   interface IInputChangeCase {
     /**
      * The project, `{ name: 'a' }` by default
diff --git a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
index da2f64382e..c9c1aeb095 100644
--- a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
@@ -57,18 +57,26 @@ class MockRunner implements IOperationRunner {
   public readonly name: string;
   public readonly isNoOp: boolean;
   readonly #executions: string[];
+  readonly #incrementalExecutions: string[];
 
-  public constructor(name: string, isNoOp: boolean, executions: string[]) {
+  public constructor(name: string, isNoOp: boolean, executions: string[], incrementalExecutions: string[]) {
     this.name = name;
     this.isNoOp = isNoOp;
     this.#executions = executions;
+    this.#incrementalExecutions = incrementalExecutions;
   }
 
-  public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+  public async executeAsync(
+    context: IOperationRunnerContext,
+    lastState?: IOperationExecutionResult
+  ): Promise<OperationStatus> {
     if (this.isNoOp) {
       return OperationStatus.NoOp;
     }
     this.#executions.push(this.name);
+    if (lastState) {
+      this.#incrementalExecutions.push(this.name);
+    }
     return OperationStatus.Success;
   }
 
@@ -82,11 +90,13 @@ interface ITestGraph {
   operations: Map<string, Operation>;
   localHashes: Map<string, string>;
   executions: string[];
+  /** The executions that were given the result of the previous execution. */
+  incrementalExecutions: string[];
   /**
    * The operations that the emulated change detection plugin checked, if enabled by `upToDate`.
    */
   checks: string[];
-  executeAsync(): Promise<IExecutionResult>;
+  executeAsync(isIncrementalBuildAllowed?: boolean): Promise<IExecutionResult>;
 }
 
 interface ITestGraphOptions {
@@ -114,6 +124,7 @@ async function createTestGraphAsync(
 ): Promise<ITestGraph> {
   const { noOps, legacySkipFolder, upToDate } = options;
   const executions: string[] = [];
+  const incrementalExecutions: string[] = [];
   const checks: string[] = [];
   const localHashes: Map<string, string> = new Map();
   const operations: Map<string, Operation> = new Map();
@@ -126,7 +137,7 @@ async function createTestGraphAsync(
       projectRushTempFolder: projectFolder
     } as unknown as RushConfigurationProject;
     const operation: Operation = new Operation({
-      runner: new MockRunner(name, !!noOps?.has(name), executions),
+      runner: new MockRunner(name, !!noOps?.has(name), executions, incrementalExecutions),
       logFilenameIdentifier: name,
       phase: mockPhase,
       project
@@ -193,11 +204,13 @@ async function createTestGraphAsync(
     operations,
     localHashes,
     executions,
+    incrementalExecutions,
     checks,
-    executeAsync: async () => {
+    executeAsync: async (isIncrementalBuildAllowed?: boolean) => {
       executions.length = 0;
+      incrementalExecutions.length = 0;
       checks.length = 0;
-      return await graph.executeAsync({ inputsSnapshot });
+      return await graph.executeAsync({ inputsSnapshot, isIncrementalBuildAllowed });
     }
   };
 }
@@ -413,6 +426,32 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
     expect(testGraph.executions).toEqual([]);
   });
 
+  it('runs every selected operation of a non-incremental iteration without its previous result', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] });
+    const b: Operation = testGraph.operations.get('b')!;
+    await testGraph.executeAsync();
+
+    // rebuild --to b
+    await testGraph.executeAsync(false);
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expect(testGraph.incrementalExecutions).toEqual([]);
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+
+    // rebuild --only a: "a" has the same state hash, so "b" stays verified.
+    b.enabled = false;
+    await testGraph.executeAsync(false);
+    expect(testGraph.executions).toEqual(['a']);
+    b.enabled = true;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual([]);
+
+    // An incremental iteration gives each operation its previous result.
+    testGraph.localHashes.set('a', 'a-v2');
+    await testGraph.executeAsync();
+    expect(testGraph.incrementalExecutions).toEqual(['a', 'b']);
+  });
+
   it('reuses the result of a selected operation that a plugin found up to date while its state hash is unchanged', async () => {
     const upToDate: Set<string> = new Set(['a', 'b']);
     const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
@@ -494,6 +533,31 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
     expect(testGraph.checks).toEqual([]);
   });
 
+  it('enables every selected operation of a non-incremental iteration, even with a result that a plugin found up to date', async () => {
+    const upToDate: Set<string> = new Set(['a', 'b']);
+    const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { upToDate });
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual([]);
+
+    // rebuild --to b: the retained results are current, but each operation is checked again.
+    await testGraph.executeAsync(false);
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual([]);
+
+    // The plugin no longer finds "b" up to date, so it runs without its previous result.
+    upToDate.delete('b');
+    await testGraph.executeAsync(false);
+    expect(testGraph.checks).toEqual(['a', 'b']);
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.incrementalExecutions).toEqual([]);
+
+    const hotResult: IExecutionResult = await testGraph.executeAsync();
+    expect(hotResult.status).toBe(OperationStatus.NoOp);
+    expect(testGraph.checks).toEqual([]);
+  });
+
   describe('with legacy skip detection', () => {
     let legacySkipFolder: string;
 
@@ -545,6 +609,18 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
       expect(testGraph.executions).toEqual(['c']);
     });
 
+    it('skips no operation of a non-incremental iteration', async () => {
+      // Build once in another process, then start a long-lived graph.
+      await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
+      const testGraph: ITestGraph = await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder });
+      await testGraph.executeAsync(false);
+      expect(testGraph.executions).toEqual(['a', 'b']);
+
+      const hotResult: IExecutionResult = await testGraph.executeAsync();
+      expect(hotResult.status).toBe(OperationStatus.NoOp);
+      expect(testGraph.executions).toEqual([]);
+    });
+
     it('still skips an unverified retained result if no dependency executes', async () => {
       // Build once in another process, then start a long-lived graph.
       await (await createTestGraphAsync({ a: [], b: ['a'] }, { legacySkipFolder })).executeAsync();
diff --git a/libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts b/libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts
new file mode 100644
index 0000000000..9afd38711c
--- /dev/null
+++ b/libraries/rush-lib/src/pluginFramework/PhasedCommandHookTaps.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { AsyncSeriesHook } from 'tapable';
+
+import type { IPhasedCommand } from './RushLifeCycle';
+
+/** The plugin whose `apply()` added a tap to the `runAnyPhasedCommand` hook. */
+export interface IPhasedCommandHookTapOwner {
+  readonly pluginName: string;
+  readonly packageName: string;
+  /** Whether the plugin's manifest or the repository declares the plugin command-agnostic. */
+  readonly isCommandAgnostic: boolean;
+}
+
+type PhasedCommandHook = AsyncSeriesHook<IPhasedCommand>;
+type PhasedCommandHookTap = PhasedCommandHook['taps'][number];
+
+// tapable keeps each tap object in `hook.taps` unless a register interceptor replaces it, and an intercepted
+// hook prevents sharing anyway.
+const tapOwners: WeakMap<PhasedCommandHookTap, IPhasedCommandHookTapOwner> = new WeakMap();
+
+/** Calls `apply` and records `owner` as the owner of every tap that it adds to `hook`. */
+export function applyAndAttributeTaps(
+  hook: PhasedCommandHook,
+  owner: IPhasedCommandHookTapOwner,
+  apply: () => void
+): void {
+  const previousTaps: ReadonlySet<PhasedCommandHookTap> = new Set(hook.taps);
+  try {
+    apply();
+  } finally {
+    for (const tap of hook.taps) {
+      if (!previousTaps.has(tap)) {
+        tapOwners.set(tap, owner);
+      }
+    }
+  }
+}
+
+/**
+ * Explains why the `runAnyPhasedCommand` hook prevents a daemon engine that one phased command created from
+ * serving another phased command, or returns undefined if it does not.
+ *
+ * @remarks
+ * Rush calls the hook once per engine, with the command that created the engine. The hook prevents sharing unless
+ * every tap was added by the `apply()` of a plugin that is declared command-agnostic. An interceptor, or a tap
+ * that no plugin's `apply()` added, prevents sharing.
+ */
+export function getRunAnyPhasedCommandBlocker(hook: PhasedCommandHook): string | undefined {
+  if (!hook.isUsed()) {
+    return undefined;
+  }
+  // tapable doesn't declare the `interceptors` array that `isUsed()` reads.
+  const { interceptors } = hook as unknown as { interceptors?: ReadonlyArray<unknown> };
+  if (interceptors?.length !== 0) {
+    return 'a plugin intercepts the runAnyPhasedCommand hook';
+  }
+  for (const tap of hook.taps) {
+    const owner: IPhasedCommandHookTapOwner | undefined = tapOwners.get(tap);
+    if (!owner) {
+      return `a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "${tap.name}")`;
+    }
+    if (!owner.isCommandAgnostic) {
+      return (
+        `the plugin "${owner.pluginName}" (${owner.packageName}) taps the runAnyPhasedCommand hook and is not ` +
+        'declared command-agnostic'
+      );
+    }
+  }
+  return undefined;
+}
diff --git a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
index a5c36b6bec..f4645e8019 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginLoader/PluginLoaderBase.ts
@@ -33,6 +33,11 @@ export interface IRushPluginManifest {
   rushVersionRange?: string;
   /** Declares that the plugin honors the long-lived daemon engine lifecycle. */
   daemonCompatible?: boolean;
+  /**
+   * Declares that what the plugin does from the `runAnyPhasedCommand` hook doesn't depend on the command, so its
+   * taps there don't stop one daemon engine from serving several phased commands.
+   */
+  daemonCommandAgnostic?: boolean;
 }
 
 export interface IRushPluginManifestJson {
diff --git a/libraries/rush-lib/src/pluginFramework/PluginManager.ts b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
index 715742f15b..81b800be82 100644
--- a/libraries/rush-lib/src/pluginFramework/PluginManager.ts
+++ b/libraries/rush-lib/src/pluginFramework/PluginManager.ts
@@ -9,6 +9,7 @@ import type { RushConfiguration } from '../api/RushConfiguration';
 import { BuiltInPluginLoader, type IBuiltInPluginConfiguration } from './PluginLoader/BuiltInPluginLoader';
 import type { IRushPlugin } from './IRushPlugin';
 import { AutoinstallerPluginLoader } from './PluginLoader/AutoinstallerPluginLoader';
+import { applyAndAttributeTaps } from './PhasedCommandHookTaps';
 import { _createRushSessionForPlugin, type RushSession } from './RushSession';
 import type { PluginLoaderBase, IRushPluginManifest } from './PluginLoader/PluginLoaderBase';
 import { Rush } from '../api/Rush';
@@ -303,6 +304,20 @@ export class PluginManager {
     return reasons;
   }
 
+  /**
+   * The configured plugins that Rush initializes for the specified command because their manifests associate them
+   * with it, as sorted `packageName:pluginName` keys. Plugins that are not associated with specific commands are
+   * initialized for every command, and are not included.
+   */
+  public getPluginsAssociatedWithCommand(commandName: string): ReadonlyArray<string> {
+    return [
+      ...this.#getPluginLoadersForCommand(commandName, this.#builtInPluginLoaders),
+      ...this.#getPluginLoadersForCommand(commandName, this.#autoinstallerPluginLoaders)
+    ]
+      .map(({ packageName, pluginName }) => `${packageName}:${pluginName}`)
+      .sort();
+  }
+
   #initializePlugins(pluginLoaders: PluginLoaderBase[]): void {
     for (const pluginLoader of pluginLoaders) {
       const pluginName: string = pluginLoader.pluginName;
@@ -342,9 +357,24 @@ export class PluginManager {
         packageVersion: pluginLoader.packageVersion,
         component: pluginName
       }));
-      plugin.apply(pluginSession, this.#rushConfiguration);
+      applyAndAttributeTaps(
+        this.#rushSession.hooks.runAnyPhasedCommand,
+        { pluginName, packageName, isCommandAgnostic: this.#isCommandAgnostic(pluginLoader) },
+        () => plugin.apply(pluginSession, this.#rushConfiguration)
+      );
     } catch (e) {
       throw new InternalError(`Error applying "${pluginName}": ${e}`);
     }
   }
+
+  #isCommandAgnostic(pluginLoader: PluginLoaderBase): boolean {
+    if (pluginLoader.pluginManifest.daemonCommandAgnostic === true) {
+      return true;
+    }
+    // Like daemon.compatiblePlugins, the repository's list names plugins that rush-plugins.json configures.
+    return (
+      pluginLoader instanceof AutoinstallerPluginLoader &&
+      this.#rushConfiguration.daemon.commandAgnosticPlugins.includes(pluginLoader.pluginName)
+    );
+  }
 }
diff --git a/libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts b/libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts
new file mode 100644
index 0000000000..f51911b238
--- /dev/null
+++ b/libraries/rush-lib/src/pluginFramework/test/PhasedCommandHookTaps.test.ts
@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { AsyncSeriesHook } from 'tapable';
+
+import {
+  applyAndAttributeTaps,
+  getRunAnyPhasedCommandBlocker,
+  type IPhasedCommandHookTapOwner
+} from '../PhasedCommandHookTaps';
+import type { IPhasedCommand } from '../RushLifeCycle';
+
+function createHook(): AsyncSeriesHook<IPhasedCommand> {
+  return new AsyncSeriesHook<IPhasedCommand>(['command'], 'runAnyPhasedCommand');
+}
+
+function createOwner(pluginName: string, isCommandAgnostic: boolean): IPhasedCommandHookTapOwner {
+  return { pluginName, packageName: `@example/${pluginName}`, isCommandAgnostic };
+}
+
+describe('PhasedCommandHookTaps', () => {
+  it('does not block a hook that nothing taps or intercepts', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', false), () => {});
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBeUndefined();
+  });
+
+  it('attributes only the taps that apply() adds, including taps with options', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', true), () => {
+      hook.tapPromise('a', async () => {});
+      hook.withOptions({ stage: -1 }).tap('a-early', () => {});
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBeUndefined();
+
+    applyAndAttributeTaps(hook, createOwner('rush-b-plugin', false), () => {
+      hook.tap({ name: 'b', before: 'a' }, () => {});
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe(
+      'the plugin "rush-b-plugin" (@example/rush-b-plugin) taps the runAnyPhasedCommand hook and is not ' +
+        'declared command-agnostic'
+    );
+  });
+
+  it('blocks a tap that no apply() added', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    hook.tap('before', () => {});
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', true), () => {
+      hook.tap('a', () => {});
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe(
+      'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "before")'
+    );
+
+    const later: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(later, createOwner('rush-a-plugin', true), () => {
+      later.tap('a', () => {});
+    });
+    later.tap('after', () => {});
+    expect(getRunAnyPhasedCommandBlocker(later)).toBe(
+      'a plugin taps the runAnyPhasedCommand hook outside its apply() (the tap "after")'
+    );
+  });
+
+  it('attributes the taps of an apply() that throws', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    expect(() =>
+      applyAndAttributeTaps(hook, createOwner('rush-a-plugin', false), () => {
+        hook.tap('a', () => {});
+        throw new Error('apply failed');
+      })
+    ).toThrow('apply failed');
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe(
+      'the plugin "rush-a-plugin" (@example/rush-a-plugin) taps the runAnyPhasedCommand hook and is not ' +
+        'declared command-agnostic'
+    );
+  });
+
+  it('blocks an intercepted hook, even without taps', () => {
+    const hook: AsyncSeriesHook<IPhasedCommand> = createHook();
+    applyAndAttributeTaps(hook, createOwner('rush-a-plugin', true), () => {
+      hook.intercept({ call: () => {} });
+    });
+    expect(getRunAnyPhasedCommandBlocker(hook)).toBe('a plugin intercepts the runAnyPhasedCommand hook');
+  });
+});
diff --git a/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json b/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
index 2a37a30e76..dfc04860a8 100644
--- a/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
+++ b/libraries/rush-lib/src/schemas/rush-plugin-manifest.schema.json
@@ -50,6 +50,10 @@
           "daemonCompatible": {
             "description": "If true, the plugin declares that it works in a long-lived Rush daemon engine, where one applied instance serves many requests: its session hooks and createOperationsAsync run once per engine (with isWatch false), and its operation graph hooks run for each iteration. Such a plugin does not change process globals (such as process.env, process.exitCode, the working directory or global timers), keeps no per-request state in the process, never prompts, reads the operation environment rather than the daemon's process.env, and releases its resources when the engine is disposed. Without it, the daemon runs commands that the plugin participates in with in-process Rush, unless the repository lists the plugin in the rush.json \"daemon.compatiblePlugins\" setting.",
             "type": "boolean"
+          },
+          "daemonCommandAgnostic": {
+            "description": "If true, the plugin declares that what it does from the runAnyPhasedCommand hook doesn't depend on the command: the callbacks that its apply() taps there, and the command hooks that those callbacks tap in turn (such as createOperationsAsync and onGraphCreatedAsync), don't read the command's name, its parameters, its phase selection or isIncrementalBuildAllowed. Rush calls runAnyPhasedCommand once per daemon engine, with the command that created the engine, so without this declaration an engine serves no other command while the plugin taps the hook, unless the repository lists the plugin in the rush.json \"daemon.commandAgnosticPlugins\" setting. Taps of runPhasedCommand still prevent sharing, because Rush calls them for one command only.",
+            "type": "boolean"
           }
         }
       }
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 87939878e1..6bb99c2f75 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -330,6 +330,15 @@
           },
           "default": [],
           "description": "Names of configured Rush plugins (their pluginName in rush-plugins.json) that this repository has verified for long-lived daemon engines, in addition to plugins whose manifest sets daemonCompatible. A daemon request for a command that any other configured plugin participates in runs with in-process Rush. RUSH_DAEMON_COMPATIBLE_PLUGINS (a comma-separated list) overrides."
+        },
+        "commandAgnosticPlugins": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[^\\s,](?:[^,]*[^\\s,])?$"
+          },
+          "default": [],
+          "description": "Names of configured Rush plugins (their pluginName in rush-plugins.json) that this repository has verified to be command-agnostic, in addition to plugins whose manifest sets daemonCommandAgnostic. What such a plugin does from the runAnyPhasedCommand hook doesn't depend on the command: it doesn't read the command's name, its parameters, its phase selection or isIncrementalBuildAllowed. A daemon engine created by one command serves another command only if every plugin that taps runAnyPhasedCommand is command-agnostic. RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS (a comma-separated list) overrides."
         }
       }
     },

From 01215d65a8adefbc14af5ea15c919993abb24f31 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:03 +0000
Subject: [PATCH 151/265] [rush-lib] Delete consumer skip records after an
 unverifiable rebuild

Swarm integration step 136; original commit 456dc82be2 (merge of swarm/r03-t158-xint6 at 1786e61f4b).
Scope: task 158.

Brings 158-xint6 (branch swarm/r03-t158-xint6). Second agent: o07 board 5245. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 1 of 19. Gate: ch01 GATE OK board 5319 (tree 5b4f6b4837)

Commits folded into this step (5):
- 2f5141ae60 rush-lib: keep the legacy skip records of operations that a command doesn't execute
- 192c8fb878 rush-lib: keep the legacy skip records of consumers when a rebuild reproduces their dependency's outputs
- 37a7fbf66b [rush-lib] Test the LegacySkipPlugin paths that o03's mutants K1, K4, K5, K6 and K10 changed
- 0933fc39f1 [rush-lib] Test that a rebuild iteration of a build engine keeps the legacy skip records of operations it doesn't execute
- 1786e61f4b Delete consumer skip records after an unverifiable rebuild

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...legacy-skip-disabled_2026-09-29-03-58.json |  11 +
 .../src/logic/operations/LegacySkipPlugin.ts  |  63 ++-
 .../operations/test/LegacySkipPlugin.test.ts  | 494 +++++++++++++++++-
 ...asedOperationPluginRetainedResults.test.ts |  81 ++-
 4 files changed, 618 insertions(+), 31 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/r03-legacy-skip-disabled_2026-09-29-03-58.json

diff --git a/common/changes/@microsoft/rush/r03-legacy-skip-disabled_2026-09-29-03-58.json b/common/changes/@microsoft/rush/r03-legacy-skip-disabled_2026-09-29-03-58.json
new file mode 100644
index 0000000000..46dd915425
--- /dev/null
+++ b/common/changes/@microsoft/rush/r03-legacy-skip-disabled_2026-09-29-03-58.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where, with the build cache disabled, `rush rebuild` and the Rush daemon deleted the skip records of operations that the command did not select, so that a later command ran those operations again. Such a record is now deleted only if an operation that it depends on executed with changed inputs, or with inputs that changed while it executed.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index 6f71ea5cd6..e8c89f73a6 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -54,6 +54,17 @@ export interface IProjectDeps {
 
 interface ILegacySkipRecord {
   allowSkip: boolean;
+  /**
+   * Whether an operation that this operation depends on, directly or indirectly, changed its outputs in this
+   * iteration, so that the outputs of this operation were built against outputs that have since changed.
+   */
+  dependencyChanged: boolean;
+  /**
+   * Whether the record of this operation matched its inputs when it started. If it executes anyway, e.g. in a
+   * rebuild, it reproduces the outputs that it recorded, so the records of its consumers stay valid, unless
+   * its result is unverifiable.
+   */
+  inputsUnchanged: boolean;
   packageDeps: IProjectDeps | undefined;
   packageDepsPath: string;
 }
@@ -106,6 +117,8 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             if (!runner.cacheable) {
               stateMap.set(operation, {
                 allowSkip: true,
+                dependencyChanged: false,
+                inputsUnchanged: false,
                 packageDeps: undefined,
                 packageDepsPath: ''
               });
@@ -149,7 +162,9 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             stateMap.set(operation, {
               packageDepsPath,
               packageDeps,
-              allowSkip
+              allowSkip,
+              dependencyChanged: false,
+              inputsUnchanged: false
             });
           }
 
@@ -187,7 +202,14 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           const { associatedProject } = operation;
 
-          const { packageDepsPath, packageDeps, allowSkip } = skipRecord;
+          const { packageDepsPath, packageDeps, allowSkip, dependencyChanged } = skipRecord;
+
+          if (!record.enabled && !dependencyChanged) {
+            // The command doesn't execute this operation, e.g. because of "--only" or because the graph of a
+            // daemon's engine contains every operation in the repo. No dependency changed its outputs in this
+            // iteration either, so the outputs of this operation still match its record.
+            return;
+          }
 
           let lastProjectDeps: IProjectDeps | undefined = undefined;
 
@@ -204,19 +226,19 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             }
           }
 
-          if (allowSkip) {
-            const isPackageUnchanged: boolean = !!(
-              lastProjectDeps &&
-              packageDeps &&
-              packageDeps.arguments === lastProjectDeps.arguments &&
-              _areShallowEqual(packageDeps.files, lastProjectDeps.files)
-            );
+          const isPackageUnchanged: boolean = !!(
+            lastProjectDeps &&
+            packageDeps &&
+            packageDeps.arguments === lastProjectDeps.arguments &&
+            _areShallowEqual(packageDeps.files, lastProjectDeps.files)
+          );
 
-            if (isPackageUnchanged) {
-              return OperationStatus.Skipped;
-            }
+          if (allowSkip && isPackageUnchanged) {
+            return OperationStatus.Skipped;
           }
 
+          skipRecord.inputsUnchanged = isPackageUnchanged;
+
           // TODO: Remove legacyDepsPath with the next major release of Rush
           const legacyDepsPath: string = path.join(associatedProject.projectFolder, 'package-deps.json');
 
@@ -240,15 +262,24 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             return;
           }
 
-          const blockSkip: boolean =
-            !skipRecord.allowSkip ||
-            (!changedProjectsOnly &&
-              (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning));
+          // With "--changed-projects-only", consumers ignore changes to the outputs of their dependencies. An
+          // operation that executed although its inputs were unchanged, e.g. in a rebuild, reproduced its
+          // outputs, unless its result is unverifiable, e.g. because its inputs changed while it executed.
+          const outputsChanged: boolean =
+            !changedProjectsOnly &&
+            (!skipRecord.inputsUnchanged || isResultUnverifiable(record)) &&
+            (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning);
+          const blockSkip: boolean = !skipRecord.allowSkip || outputsChanged;
+          // Unlike allowSkip, this doesn't depend on whether the iteration allows skipping, e.g. in a rebuild.
+          const dependencyChanged: boolean = skipRecord.dependencyChanged || outputsChanged;
           if (blockSkip) {
             for (const consumer of operation.consumers) {
               const consumerSkipRecord: ILegacySkipRecord | undefined = stateMap.get(consumer);
               if (consumerSkipRecord) {
                 consumerSkipRecord.allowSkip = false;
+                if (dependencyChanged) {
+                  consumerSkipRecord.dependencyChanged = true;
+                }
               }
             }
           }
diff --git a/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
index 77b341be3d..dbbfd5fc15 100644
--- a/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
@@ -61,9 +61,11 @@ import { LegacySkipInvalidationPlugin, LegacySkipPlugin } from '../LegacySkipPlu
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
 import { OperationGraph } from '../OperationGraph';
 import { Operation } from '../Operation';
+import { NullOperationRunner } from '../NullOperationRunner';
 import { OperationStatus } from '../OperationStatus';
+import { markResultUnverifiable } from '../RetainedResultVerification';
 import type { IOperationRunner } from '../IOperationRunner';
-import type { IExecutionResult } from '../IOperationExecutionResult';
+import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -82,10 +84,30 @@ const mockPhase: IPhase = {
 type Strategy = 'legacy-skip' | 'build-cache' | 'none';
 
 /**
- * A checkout of independent projects, each with one operation.
+ * A checkout of projects, each with one operation.
  */
 interface ICheckout {
   readonly folder: string;
+  /**
+   * The names of the projects that each project depends on
+   */
+  readonly dependencies: Map<string, string[]>;
+  /**
+   * The names of the projects that have no script for the phase, so that their operations are no-ops
+   */
+  readonly scriptlessNames: Set<string>;
+  /**
+   * The names of the projects whose operations don't support skip detection, like those of IPC runners
+   */
+  readonly nonCacheableNames: Set<string>;
+  /**
+   * The names of the projects whose operations succeed with warnings
+   */
+  readonly warningNames: Set<string>;
+  /**
+   * The hash of the configuration of each project's operation, such as its command line, if it isn't "config"
+   */
+  readonly configHashes: Map<string, string>;
   /**
    * The version of the input files of each project
    */
@@ -107,7 +129,7 @@ interface ICheckout {
 class MockRunner implements IOperationRunner {
   public readonly reportTiming: boolean = true;
   public readonly silent: boolean = false;
-  public readonly cacheable: boolean = true;
+  public readonly cacheable: boolean;
   public readonly warningsAreAllowed: boolean = false;
   public readonly isNoOp: boolean = false;
   public readonly name: string;
@@ -115,29 +137,62 @@ class MockRunner implements IOperationRunner {
 
   public constructor(name: string, checkout: ICheckout) {
     this.name = name;
+    this.cacheable = !checkout.nonCacheableNames.has(name);
     this.#checkout = checkout;
   }
 
   public async executeAsync(): Promise<OperationStatus> {
     this.#checkout.executions.push(this.name);
     this.#checkout.outputs.set(this.name, this.#checkout.inputs.get(this.name)!);
-    return OperationStatus.Success;
+    return this.#checkout.warningNames.has(this.name)
+      ? OperationStatus.SuccessWithWarning
+      : OperationStatus.Success;
   }
 
   public getConfigHash(): string {
-    return 'config';
+    return this.#checkout.configHashes.get(this.name) ?? 'config';
   }
 }
 
+/**
+ * Options of a command
+ */
+interface ICommandOptions {
+  /**
+   * The names of the projects whose operations the command doesn't execute, e.g. because of `--only` or because
+   * the graph of a daemon's engine contains every operation in the repo
+   */
+  readonly disabledNames?: ReadonlySet<string>;
+  /**
+   * Whether the command may skip operations. It is false for `rush rebuild`.
+   */
+  readonly isIncrementalBuildAllowed?: boolean;
+  /**
+   * Whether the command ignores changes to the dependencies of an operation, as `--changed-projects-only` does
+   */
+  readonly changedProjectsOnly?: boolean;
+  /**
+   * The version that the input files of each of these projects change to while its operation executes. Like
+   * IncrementalExecutionGuardPlugin, the command then marks the result of the operation unverifiable.
+   */
+  readonly inputsChangedWhileExecuting?: ReadonlyMap<string, string>;
+}
+
 /**
  * Runs a command in a new process, e.g. `rush build`, and returns the status of each project's operation.
  */
 async function runCommandAsync(
   checkout: ICheckout,
   strategy: Strategy,
-  disabledNames: ReadonlySet<string> = new Set()
+  options: ICommandOptions = {}
 ): Promise<Record<string, OperationStatus>> {
-  const { folder, inputs, outputs, cacheEntries, executions } = checkout;
+  const {
+    disabledNames = new Set(),
+    isIncrementalBuildAllowed = true,
+    changedProjectsOnly = false,
+    inputsChangedWhileExecuting = new Map()
+  } = options;
+  const { folder, dependencies, scriptlessNames, inputs, outputs, cacheEntries, executions } = checkout;
   const operations: Map<string, Operation> = new Map();
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
   for (const name of inputs.keys()) {
@@ -153,7 +208,9 @@ async function runCommandAsync(
     operations.set(
       name,
       new Operation({
-        runner: new MockRunner(name, checkout),
+        runner: scriptlessNames.has(name)
+          ? new NullOperationRunner({ name, result: OperationStatus.NoOp, silent: false })
+          : new MockRunner(name, checkout),
         logFilenameIdentifier: name,
         phase: mockPhase,
         project,
@@ -161,6 +218,11 @@ async function runCommandAsync(
       })
     );
   }
+  for (const [name, dependencyNames] of dependencies) {
+    for (const dependencyName of dependencyNames) {
+      operations.get(name)!.addDependency(operations.get(dependencyName)!);
+    }
+  }
 
   jest.mocked(OperationBuildCache.forOperation).mockImplementation((record) => {
     const { packageName } = record.operation.associatedProject;
@@ -187,8 +249,8 @@ async function runCommandAsync(
     new LegacySkipPlugin({
       allowWarningsInSuccessfulBuild: false,
       terminal,
-      changedProjectsOnly: false,
-      isIncrementalBuildAllowed: true
+      changedProjectsOnly,
+      isIncrementalBuildAllowed
     }).apply(hooks);
   } else {
     if (strategy === 'build-cache') {
@@ -217,9 +279,17 @@ async function runCommandAsync(
     abortController: new AbortController()
   });
   await hooks.onGraphCreatedAsync.promise(graph, {
-    isIncrementalBuildAllowed: true,
+    isIncrementalBuildAllowed,
     projectConfigurations
   } as unknown as IOperationGraphContext);
+  graph.hooks.afterExecuteOperationAsync.tap('TestPlugin', (record: IOperationExecutionResult) => {
+    const { packageName } = record.operation.associatedProject;
+    const changedInputs: string | undefined = inputsChangedWhileExecuting.get(packageName);
+    if (changedInputs !== undefined) {
+      inputs.set(packageName, changedInputs);
+      markResultUnverifiable(record);
+    }
+  });
 
   const inputsSnapshot: IInputsSnapshot = {
     hashes: new Map(),
@@ -245,6 +315,11 @@ describe(LegacySkipPlugin.name, () => {
   beforeEach(() => {
     checkout = {
       folder: fs.mkdtempSync(path.join(os.tmpdir(), 'rush-lib-legacy-skip-')),
+      dependencies: new Map(),
+      scriptlessNames: new Set(),
+      nonCacheableNames: new Set(),
+      warningNames: new Set(),
+      configHashes: new Map(),
       inputs: new Map([['a', 'A']]),
       outputs: new Map(),
       cacheEntries: new Map(),
@@ -313,7 +388,7 @@ describe(LegacySkipPlugin.name, () => {
 
     // --only a
     checkout.inputs.set('a', 'B');
-    expect(await runCommandAsync(checkout, 'build-cache', new Set(['b']))).toEqual({
+    expect(await runCommandAsync(checkout, 'build-cache', { disabledNames: new Set(['b']) })).toEqual({
       a: OperationStatus.Success,
       b: OperationStatus.Skipped
     });
@@ -325,4 +400,399 @@ describe(LegacySkipPlugin.name, () => {
     });
     expect(checkout.executions).toEqual(['a']);
   });
+
+  describe('with dependencies between projects', () => {
+    beforeEach(() => {
+      checkout.inputs.set('b', 'A');
+      checkout.dependencies.set('b', ['a']);
+    });
+
+    it('keeps the record of a dependency that a rebuild does not execute', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only b
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['a']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Skipped, b: OperationStatus.Success });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('keeps the records of operations that a rebuild does not execute, if none of their dependencies executes', async () => {
+      // b depends on a through n, which has no script.
+      checkout.inputs.set('n', 'A');
+      checkout.scriptlessNames.add('n');
+      checkout.dependencies.set('n', ['a']);
+      checkout.dependencies.set('b', ['n']);
+      checkout.inputs.set('x', 'A');
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        n: OperationStatus.NoOp,
+        x: OperationStatus.Success
+      });
+
+      // rush rebuild --only x, on the graph of a daemon's engine
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['a', 'b', 'n']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        n: OperationStatus.NoOp,
+        x: OperationStatus.Success
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        n: OperationStatus.NoOp,
+        x: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('deletes the records of consumers that a rebuild does not execute after their dependency changed', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine
+      checkout.inputs.set('a', 'B');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b', 'c']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped, c: OperationStatus.Skipped });
+
+      // rush build --only c: its outputs were built against outputs of b, which were built against outputs of a
+      // that have since changed.
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a', 'b']) })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b', 'c']);
+    });
+
+    it('keeps the records of consumers that a rebuild does not execute, if the inputs of their dependency are unchanged', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine. Like the same command in a process of its own,
+      // whose graph doesn't contain b and c, it leaves their records as they were.
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b', 'c']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped, c: OperationStatus.Skipped });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('deletes the record of a consumer that a rebuild does not execute, after a dependency of its dependency changed', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush rebuild --only a --only b, on the graph of a daemon's engine: the inputs of b are unchanged, but it was
+      // built again against outputs of a that changed.
+      checkout.inputs.set('a', 'B');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['c']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Success, c: OperationStatus.Skipped });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['c']);
+    });
+
+    it.each(['b', 'c'])(
+      'deletes the record of a consumer that a rebuild does not execute, after %s, one of its two dependencies, changed',
+      async (changedName: string) => {
+        // d depends on b and c, which both depend on a. One case changes b and the other changes c, so that in one of
+        // them the dependency that changed finishes before the one that didn't, whatever order the two execute in.
+        checkout.inputs.set('c', 'A');
+        checkout.inputs.set('d', 'A');
+        checkout.dependencies.set('c', ['a']);
+        checkout.dependencies.set('d', ['b', 'c']);
+        expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+          a: OperationStatus.Success,
+          b: OperationStatus.Success,
+          c: OperationStatus.Success,
+          d: OperationStatus.Success
+        });
+
+        // rush rebuild --only b --only c, on the graph of a daemon's engine
+        checkout.inputs.set(changedName, 'B');
+        expect(
+          await runCommandAsync(checkout, 'legacy-skip', {
+            disabledNames: new Set(['a', 'd']),
+            isIncrementalBuildAllowed: false
+          })
+        ).toEqual({
+          a: OperationStatus.Skipped,
+          b: OperationStatus.Success,
+          c: OperationStatus.Success,
+          d: OperationStatus.Skipped
+        });
+
+        expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+          a: OperationStatus.Skipped,
+          b: OperationStatus.Skipped,
+          c: OperationStatus.Skipped,
+          d: OperationStatus.Success
+        });
+        expect(checkout.executions).toEqual(['d']);
+      }
+    );
+
+    it.each([
+      { kind: 'has no script', setName: 'scriptlessNames', statusOfN: OperationStatus.NoOp },
+      {
+        kind: 'does not support skip detection',
+        setName: 'nonCacheableNames',
+        statusOfN: OperationStatus.Skipped
+      }
+    ] as const)(
+      'deletes the record of a consumer that a rebuild does not execute, through an operation that $kind, after their dependency changed',
+      async ({ setName, statusOfN }) => {
+        // b depends on a through n, which the commands below don't execute.
+        checkout.inputs.set('n', 'A');
+        checkout[setName].add('n');
+        checkout.dependencies.set('n', ['a']);
+        checkout.dependencies.set('b', ['n']);
+        await runCommandAsync(checkout, 'legacy-skip');
+
+        // rush rebuild --only a, on the graph of a daemon's engine
+        checkout.inputs.set('a', 'B');
+        expect(
+          await runCommandAsync(checkout, 'legacy-skip', {
+            disabledNames: new Set(['n', 'b']),
+            isIncrementalBuildAllowed: false
+          })
+        ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped, n: statusOfN });
+
+        // rush build --only b
+        expect(
+          await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a', 'n']) })
+        ).toEqual({
+          a: OperationStatus.Skipped,
+          b: OperationStatus.Success,
+          n: statusOfN
+        });
+        expect(checkout.executions).toEqual(['b']);
+      }
+    );
+
+    it('deletes the record of a consumer that a rebuild does not execute, after its dependency was built with another configuration', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine, with a parameter that changes the command line of
+      // a: the files of a are unchanged, but its outputs aren't.
+      checkout.configHashes.set('a', 'other-parameters');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped });
+
+      // rush build, with the same parameter
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('deletes the record of a consumer that a rebuild does not execute, after its dependency succeeded with warnings', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine
+      checkout.inputs.set('a', 'B');
+      checkout.warningNames.add('a');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          isIncrementalBuildAllowed: false
+        })
+      ).toEqual({ a: OperationStatus.SuccessWithWarning, b: OperationStatus.Skipped });
+
+      // rush build --only b
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a']) })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('deletes the record of a consumer that a rebuild does not execute, after the input files of its dependency changed while it executed', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush rebuild --only a, on the graph of a daemon's engine. The inputs of a match its record when it
+      // starts but change while it executes, so its outputs may differ from those that b was built against.
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          isIncrementalBuildAllowed: false,
+          inputsChangedWhileExecuting: new Map([['a', 'B']])
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped });
+
+      // rush build --only b
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['a']) })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('executes the consumers of an operation that executed only because its dependency changed', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      checkout.inputs.set('a', 'B');
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['a', 'b', 'c']);
+    });
+
+    it('executes the consumers of an operation that does not support skip detection', async () => {
+      checkout.nonCacheableNames.add('a');
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['a', 'b']);
+    });
+
+    it('deletes the record of a consumer that a build does not execute after its dependency', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush build --only a, on the graph of a daemon's engine
+      checkout.inputs.set('a', 'B');
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['b']) })).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Skipped
+      });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['b']);
+    });
+
+    it('keeps the record of a consumer that a build with changedProjectsOnly does not execute', async () => {
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success
+      });
+
+      // rush build --changed-projects-only --only a, on the graph of a daemon's engine. Like the same command in
+      // a process of its own, whose graph doesn't contain b, it leaves the record of b as it was.
+      checkout.inputs.set('a', 'B');
+      expect(
+        await runCommandAsync(checkout, 'legacy-skip', {
+          disabledNames: new Set(['b']),
+          changedProjectsOnly: true
+        })
+      ).toEqual({ a: OperationStatus.Success, b: OperationStatus.Skipped });
+
+      expect(await runCommandAsync(checkout, 'legacy-skip', { changedProjectsOnly: true })).toEqual({
+        a: OperationStatus.Skipped,
+        b: OperationStatus.Skipped
+      });
+      expect(checkout.executions).toEqual([]);
+    });
+
+    it('executes a consumer whose dependency executed, through an operation that the command does not execute', async () => {
+      checkout.inputs.set('c', 'A');
+      checkout.dependencies.set('c', ['b']);
+      expect(await runCommandAsync(checkout, 'legacy-skip')).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Success,
+        c: OperationStatus.Success
+      });
+
+      // rush build --only a --only c
+      checkout.inputs.set('a', 'B');
+      expect(await runCommandAsync(checkout, 'legacy-skip', { disabledNames: new Set(['b']) })).toEqual({
+        a: OperationStatus.Success,
+        b: OperationStatus.Skipped,
+        c: OperationStatus.Success
+      });
+      expect(checkout.executions).toEqual(['a', 'c']);
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
index c9c1aeb095..8e68e93180 100644
--- a/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/PhasedOperationPluginRetainedResults.test.ts
@@ -113,6 +113,10 @@ interface ITestGraphOptions {
    * which reports a selected operation as skipped if its name is in this set, because its outputs are up to date.
    */
   upToDate?: ReadonlySet<string>;
+  /**
+   * Whether the command may skip operations. It is false for `rush rebuild`. Defaults to true.
+   */
+  isIncrementalBuildAllowed?: boolean;
 }
 
 /**
@@ -122,7 +126,12 @@ async function createTestGraphAsync(
   dependencies: Record<string, string[]>,
   options: ITestGraphOptions = {}
 ): Promise<ITestGraph> {
-  const { noOps, legacySkipFolder, upToDate } = options;
+  const {
+    noOps,
+    legacySkipFolder,
+    upToDate,
+    isIncrementalBuildAllowed: isIncrementalCommand = true
+  } = options;
   const executions: string[] = [];
   const incrementalExecutions: string[] = [];
   const checks: string[] = [];
@@ -158,7 +167,7 @@ async function createTestGraphAsync(
       allowWarningsInSuccessfulBuild: false,
       terminal: new Terminal(new StringBufferTerminalProvider()),
       changedProjectsOnly: false,
-      isIncrementalBuildAllowed: true
+      isIncrementalBuildAllowed: isIncrementalCommand
     }).apply(hooks);
   }
 
@@ -171,7 +180,7 @@ async function createTestGraphAsync(
     abortController: new AbortController()
   });
   await hooks.onGraphCreatedAsync.promise(graph, {
-    isIncrementalBuildAllowed: true,
+    isIncrementalBuildAllowed: isIncrementalCommand,
     projectConfigurations: new Map()
   } as unknown as IOperationGraphContext);
   if (upToDate) {
@@ -661,5 +670,71 @@ describe(`${PhasedOperationPlugin.name} retained results`, () => {
       expect(getStatuses(testGraph, changedResult)).toEqual({ a: 'silent', b: 'SUCCESS' });
       expect(testGraph.executions).toEqual(['b']);
     });
+
+    it("forgets a dependency's change after the iteration, so a later rebuild keeps the records of consumers that it doesn't execute", async () => {
+      // Like the engine of a daemon for "rush rebuild"
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        { a: [], b: ['a'], x: [] },
+        { legacySkipFolder, isIncrementalBuildAllowed: false }
+      );
+      const a: Operation = testGraph.operations.get('a')!;
+      const b: Operation = testGraph.operations.get('b')!;
+      const x: Operation = testGraph.operations.get('x')!;
+      const recordPathOfB: string = path.join(legacySkipFolder, 'b', 'package-deps_b.json');
+      await testGraph.executeAsync();
+      expect([...testGraph.executions].sort()).toEqual(['a', 'b', 'x']);
+
+      // --only a, after editing "a": "b" was built against the old outputs of "a", so its record is deleted.
+      testGraph.localHashes.set('a', 'a-v2');
+      b.enabled = false;
+      x.enabled = false;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['a']);
+      expect(fs.existsSync(recordPathOfB)).toBe(false);
+
+      // --only b
+      a.enabled = false;
+      b.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b']);
+      expect(fs.existsSync(recordPathOfB)).toBe(true);
+
+      // --only x, after editing "x": nothing that "b" depends on changed since "b" was built.
+      testGraph.localHashes.set('x', 'x-v2');
+      b.enabled = false;
+      x.enabled = true;
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['x']);
+      expect(fs.existsSync(recordPathOfB)).toBe(true);
+    });
+
+    it('keeps the records of operations that a rebuild iteration of a build engine does not execute, until a dependency changes', async () => {
+      // Like the engine of a daemon for "rush build", which also runs "rush rebuild"
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        { a: [], b: ['a'], x: [] },
+        { legacySkipFolder }
+      );
+      const b: Operation = testGraph.operations.get('b')!;
+      const x: Operation = testGraph.operations.get('x')!;
+      const getRecordPath = (name: string): string =>
+        path.join(legacySkipFolder, name, `package-deps_${name}.json`);
+      await testGraph.executeAsync();
+      expect([...testGraph.executions].sort()).toEqual(['a', 'b', 'x']);
+
+      // rush rebuild --only a: "a" reproduces its outputs.
+      b.enabled = false;
+      x.enabled = false;
+      await testGraph.executeAsync(false);
+      expect(testGraph.executions).toEqual(['a']);
+      expect(fs.existsSync(getRecordPath('b'))).toBe(true);
+      expect(fs.existsSync(getRecordPath('x'))).toBe(true);
+
+      // rush rebuild --only a, after editing "a": "b" was built against the old outputs of "a".
+      testGraph.localHashes.set('a', 'a-v2');
+      await testGraph.executeAsync(false);
+      expect(testGraph.executions).toEqual(['a']);
+      expect(fs.existsSync(getRecordPath('b'))).toBe(false);
+      expect(fs.existsSync(getRecordPath('x'))).toBe(true);
+    });
   });
 });

From 2abdb1893bd94f307a7d5fef255974f8b6ae94b7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:03 +0000
Subject: [PATCH 152/265] [rush-cli-client] Cancel a request whose output
 reader exits

Swarm integration step 137; original commit 2e992c3a83 (merge of swarm/o05-t226-int2 at a19724064d).
Refs: task 226.
Scope: task 226.

Brings 226-int2 (branch swarm/o05-t226-int2). Second agent: t05 board 4768. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 2 of 19. Gate: ch01 GATE OK board 5319 (tree aa4f80a8c9)

Commits folded into this step (1):
- 8a7de65c9b [rush-cli-client] Cancel a request whose output reader exits (task 226)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  11 +
 .../rush-cli-client/src/clientCancellation.ts |  17 ++
 apps/rush-cli-client/src/clientOutput.ts      | 157 ++++++++++++++
 apps/rush-cli-client/src/launchClient.ts      |  62 ++++--
 apps/rush-cli-client/src/start.ts             |  12 +-
 apps/rush-cli-client/src/startRushX.ts        |   8 +-
 .../src/test/cancellationNotice.test.ts       | 203 ++++++++++++++++++
 .../src/test/clientOutput.test.ts             | 159 ++++++++++++++
 .../src/test/nativeBuild.test.ts              |  55 +++++
 ...5-t226-closed-output_2026-09-29-08-40.json |  11 +
 10 files changed, 673 insertions(+), 22 deletions(-)
 create mode 100644 apps/rush-cli-client/src/clientOutput.ts
 create mode 100644 apps/rush-cli-client/src/test/clientOutput.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o05-t226-closed-output_2026-09-29-08-40.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index a40a79e41e..af76555a6c 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -388,6 +388,17 @@ asks rushd to cancel the command, which a stopped rushd cannot confirm, so the c
 when its 5 s cancellation wait ends, and writes no more of these lines once it asked. Daemons older
 than protocol 0.13 are not checked.
 
+When the process that reads the client's output exits first, for example `head` in
+`rush-client build | head -5`, the client's next write to that stream fails with EPIPE. The client
+does not report that as a lost connection. It asks rushd to cancel the command, waits for the stop
+as it does after Ctrl+C, and exits with code 141 (128 + SIGPIPE), which a shell reports for a writer
+that SIGPIPE ended. Instead of the cancelling and cancelled lines it prints one line, which names
+the stream: `rush-client: build cancelled, because the process reading its stdout exited (EPIPE).`
+Agent output prints the same line on stderr. The client only learns of the exit at its next write,
+which in agent output on a pipe can be the next status line, up to 25 s later. A command whose
+result arrived before a write failed keeps the result's exit code. Rush run in-process and
+`rush-client daemon logs` still report a failed write as an error.
+
 Piped input uses protocol 0.7's negotiated stdin admission and EOF. The client does
 not read input until the command attaches an input destination, and sends bounded
 chunks only as the daemon grants write credits. EOF follows all preceding writes;
diff --git a/apps/rush-cli-client/src/clientCancellation.ts b/apps/rush-cli-client/src/clientCancellation.ts
index 3cd5648516..e8597c326f 100644
--- a/apps/rush-cli-client/src/clientCancellation.ts
+++ b/apps/rush-cli-client/src/clientCancellation.ts
@@ -38,6 +38,23 @@ export function formatCancellationMessage(commandName: string, stopUnconfirmed:
     : `rush-client: ${commandName} cancelled.\n`;
 }
 
+/**
+ * Formats the notice printed when a daemon-routed command is cancelled because the process reading its output
+ * exited, for example `head` in `rush-client build | head -5`. It is the only notice of that cancellation.
+ */
+export function formatClosedOutputMessage(
+  commandName: string,
+  streamName: string,
+  code: string | undefined,
+  stopUnconfirmed: boolean
+): string {
+  const reason: string = `the process reading its ${streamName} exited${code ? ` (${code})` : ''}`;
+  return stopUnconfirmed
+    ? `rush-client: ${commandName} cancelled, because ${reason}, but rushd did not confirm that the request ` +
+        'stopped; it may still be stopping.\n'
+    : `rush-client: ${commandName} cancelled, because ${reason}.\n`;
+}
+
 /**
  * Returns whether a daemon outcome represents a cancelled command. A result is cancelled when the daemon reports it
  * as aborted, even if an operation failure determines its semantic outcome, unless the daemon aborted it for its own
diff --git a/apps/rush-cli-client/src/clientOutput.ts b/apps/rush-cli-client/src/clientOutput.ts
new file mode 100644
index 0000000000..50d8d9cb55
--- /dev/null
+++ b/apps/rush-cli-client/src/clientOutput.ts
@@ -0,0 +1,157 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+import type { Writable } from 'node:stream';
+
+import { writeStreamAsync } from './writeStreamAsync';
+
+/**
+ * The exit code of a command that stopped because the process reading its output exited: 128 + SIGPIPE, which a
+ * shell reports for a writer that SIGPIPE ended, as in `make | head`. Windows has no SIGPIPE; the code is the same.
+ */
+export const CLOSED_OUTPUT_EXIT_CODE: number = 128 + (os.constants.signals.SIGPIPE ?? 13);
+
+export type ClientOutputStreamName = 'stdout' | 'stderr';
+
+export interface IClientOutputStreams {
+  readonly stdout: Writable;
+  readonly stderr: Writable;
+}
+
+/**
+ * Returns the error code when a write failed because nothing reads the stream any more, for example after
+ * `| head` exits: EPIPE for a pipe, or ECONNRESET for a socket.
+ */
+export function getClosedOutputCode(error: unknown): string | undefined {
+  const code: unknown =
+    typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+  return code === 'EPIPE' || code === 'ECONNRESET' ? code : undefined;
+}
+
+/**
+ * One of the client's own output streams. Once a write shows that the stream's reader has exited, later writes
+ * are dropped, and the owner hears of it once.
+ */
+export class ClientOutputStream {
+  public readonly name: ClientOutputStreamName;
+  readonly #stream: Writable;
+  readonly #onClosed: (stream: ClientOutputStream) => void;
+  #closedCode: string | undefined;
+  #guarded: boolean = false;
+
+  public constructor(
+    name: ClientOutputStreamName,
+    stream: Writable,
+    onClosed: (stream: ClientOutputStream) => void
+  ) {
+    this.name = name;
+    this.#stream = stream;
+    this.#onClosed = onClosed;
+  }
+
+  /** The code of the error that showed that the stream's reader exited (for example EPIPE), if one has. */
+  public get closedCode(): string | undefined {
+    return this.#closedCode;
+  }
+
+  /** Resolves once the bytes are written, or dropped because the reader exited. Other write errors reject. */
+  public async writeAsync(bytes: Uint8Array): Promise<void> {
+    if (this.#closedCode !== undefined) return;
+    try {
+      await writeStreamAsync(this.#stream, bytes);
+    } catch (error) {
+      const code: string | undefined = getClosedOutputCode(error);
+      if (code === undefined) throw error;
+      this.#close(code);
+    }
+  }
+
+  /**
+   * Writes without waiting. Another write error is left unhandled, so that it still fails the process, as the
+   * stream's unhandled 'error' event did.
+   */
+  public write(text: string): void {
+    void this.writeAsync(Buffer.from(text));
+  }
+
+  /**
+   * Node emits a failed write's error as an 'error' event too, and a stream with no listener for it fails the
+   * process. This listener keeps a reader that exited from doing so.
+   */
+  public guard(): void {
+    if (!this.#guarded) {
+      this.#guarded = true;
+      this.#stream.on('error', this.#onStreamError);
+    }
+  }
+
+  public release(): void {
+    if (this.#guarded) {
+      this.#guarded = false;
+      this.#stream.removeListener('error', this.#onStreamError);
+    }
+  }
+
+  readonly #onStreamError = (error: Error): void => {
+    const code: string | undefined = getClosedOutputCode(error);
+    if (code !== undefined) {
+      this.#close(code);
+    } else if (this.#stream.listenerCount('error') === 1) {
+      // No write waits for this error, so it fails the process, as it would without this listener.
+      throw error;
+    }
+  };
+
+  #close(code: string): void {
+    if (this.#closedCode === undefined) {
+      this.#closedCode = code;
+      this.#onClosed(this);
+    }
+  }
+}
+
+/**
+ * The client's stdout and stderr. A reader that exits (for example `rush-client build | head -5`) makes the
+ * next write to its stream fail. The client then cancels a running daemon request, as SIGPIPE would stop a
+ * native command, instead of reporting the failed write as a lost daemon connection.
+ */
+export class ClientOutput {
+  public readonly stdout: ClientOutputStream;
+  public readonly stderr: ClientOutputStream;
+  readonly #listeners: Set<(stream: ClientOutputStream) => void> = new Set();
+
+  public constructor(streams: IClientOutputStreams = process) {
+    const onClosed = (stream: ClientOutputStream): void => {
+      for (const listener of [...this.#listeners]) listener(stream);
+    };
+    this.stdout = new ClientOutputStream('stdout', streams.stdout, onClosed);
+    this.stderr = new ClientOutputStream('stderr', streams.stderr, onClosed);
+  }
+
+  /**
+   * Calls `listener` for each stream whose reader exits, and at once for one whose reader already has. Returns a
+   * function that removes the listener.
+   */
+  public onClosed(listener: (stream: ClientOutputStream) => void): () => void {
+    this.#listeners.add(listener);
+    for (const stream of [this.stdout, this.stderr]) {
+      if (stream.closedCode !== undefined) listener(stream);
+    }
+    return () => {
+      this.#listeners.delete(listener);
+    };
+  }
+
+  /** Keeps a reader that exits from failing the process; see {@link ClientOutputStream.guard}. */
+  public guard(): void {
+    this.stdout.guard();
+    this.stderr.guard();
+  }
+
+  /** Removes the listeners of `guard()`, for example before Rush runs in-process with its own error handling. */
+  public release(): void {
+    this.stdout.release();
+    this.stderr.release();
+  }
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index e0b651f076..f2c730aaee 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -32,9 +32,11 @@ import {
   CANCELLATION_SIGNALS,
   formatCancellationMessage,
   formatCancellingMessage,
+  formatClosedOutputMessage,
   getSignalExitCode,
   isCancelledOutcome
 } from './clientCancellation';
+import { CLOSED_OUTPUT_EXIT_CODE, ClientOutput, type ClientOutputStream } from './clientOutput';
 import { getDaemonConnectionOptionsAsync, getDaemonPaths } from './daemonConnectionOptions';
 import { readUseRushReporter, selectClientOutputMode } from './outputSelection';
 import { selectClientRoute, type IClientRoute } from './routing';
@@ -48,7 +50,6 @@ import {
 } from './daemonRestartNotice';
 import { formatInProcessFallbackMessage } from './inProcessFallback';
 import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
-import { writeStreamAsync } from './writeStreamAsync';
 import {
   getBundledRushVersion,
   loadMinimalRushConfiguration,
@@ -63,7 +64,8 @@ interface IWorkspaceJson {
 
 export async function launchClientAsync(
   rushx: boolean,
-  agentRenderer?: AgentProgressRenderer
+  agentRenderer?: AgentProgressRenderer,
+  output: ClientOutput = new ClientOutput()
 ): Promise<void> {
   const cwd: string = process.cwd();
   const environment: Readonly<NodeJS.ProcessEnv> = Object.freeze({ ...process.env });
@@ -88,6 +90,7 @@ export async function launchClientAsync(
     environment.RUSH_PREVIEW_VERSION ?? workspace?.rushVersion ?? getBundledRushVersion();
   if (!rushx && route.commandName === 'daemon') {
     agentRenderer?.dispose();
+    output.release();
     if ((route.argv[1] === 'start' || route.argv[1] === 'restart') && process.argv.includes('--no-daemon')) {
       throw new Error(`--no-daemon cannot be combined with daemon ${route.argv[1]}.`);
     }
@@ -106,6 +109,7 @@ export async function launchClientAsync(
   }
   if (!route.daemon || !rushJsonPath || route.commandName === undefined) {
     agentRenderer?.dispose();
+    output.release();
     // Agent output says why a command runs in-process; legacy output, which rushx-client always uses, says so only
     // when RUSH_DAEMON=1 asked for the daemon.
     if (
@@ -196,6 +200,7 @@ export async function launchClientAsync(
     )
       throw error;
     agentRenderer?.dispose();
+    output.release();
     process.stderr.write(formatInProcessFallbackMessage(error.message, clientName));
     await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
     return;
@@ -205,6 +210,8 @@ export async function launchClientAsync(
   let cancellationSignal: NodeJS.Signals | undefined;
   // Whether the client asked the daemon to cancel the request: after a signal, or a raw Ctrl+C, which raises none.
   let cancelRequested: boolean = false;
+  // The output stream whose reader exited while the request ran, when nothing else had cancelled it first.
+  let closedOutput: ClientOutputStream | undefined;
   // Windows test harnesses emit signals without a name; treat those as Ctrl+C.
   const onSignal = (signal?: NodeJS.Signals): void => {
     cancellationSignal ??= signal ?? 'SIGINT';
@@ -219,13 +226,21 @@ export async function launchClientAsync(
       agentRenderer.onCancelRequested(timeoutMs);
       return;
     }
+    // One line, written once the request stops, says why it was cancelled.
+    if (closedOutput) return;
     // After SIGHUP the terminal may be gone.
-    writeStreamAsync(process.stderr, Buffer.from(formatCancellingMessage(commandName, timeoutMs))).catch(
-      () => undefined
-    );
+    output.stderr
+      .writeAsync(Buffer.from(formatCancellingMessage(commandName, timeoutMs)))
+      .catch(() => undefined);
   };
   const isCancelled = (): boolean => abort.signal.aborted || cancelRequested;
+  // A reader that exits (for example `| head`) cancels the request, as SIGPIPE stops a native command.
+  const onOutputClosed = (stream: ClientOutputStream): void => {
+    if (!isCancelled()) closedOutput = stream;
+    abort.abort();
+  };
   for (const signal of CANCELLATION_SIGNALS) process.on(signal, onSignal);
+  const removeOutputListener: () => void = output.onClosed(onOutputClosed);
   const renderer: ClientOperationRenderer = new ClientOperationRenderer({
     requestId: request.requestId,
     colorLevel: terminal.supportsColor ? 1 : 0,
@@ -238,14 +253,13 @@ export async function launchClientAsync(
         return !!process.stdout.isTTY;
       }
     },
-    writeAsync: (bytes, stream) =>
-      writeStreamAsync(stream === 'stderr' ? process.stderr : process.stdout, bytes)
+    writeAsync: (bytes, stream) => (stream === 'stderr' ? output.stderr : output.stdout).writeAsync(bytes)
   });
   let outcome: DaemonClientOutcome | undefined;
   const discoveryLines: string[] = [];
   const writeDiscoveryAsync = async (): Promise<void> => {
     if (discoveryLines.length > 0) {
-      await writeStreamAsync(process.stdout, Buffer.from(discoveryLines.splice(0).join('\n') + '\n'));
+      await output.stdout.writeAsync(Buffer.from(discoveryLines.splice(0).join('\n') + '\n'));
     }
   };
   try {
@@ -261,7 +275,7 @@ export async function launchClientAsync(
       agentRenderer,
       stderrIsTTY: !!process.stderr.isTTY,
       daemonPid: (await client.status).pid,
-      writeStderrAsync: (text) => writeStreamAsync(process.stderr, Buffer.from(text))
+      writeStderrAsync: (text) => output.stderr.writeAsync(Buffer.from(text))
     });
     notices = requestNotices;
     outcome = await executeWithDaemonRestartAsync(client, connection, {
@@ -293,7 +307,7 @@ export async function launchClientAsync(
       liveness: createDaemonLivenessOptions({
         rushx,
         agentRenderer,
-        writeStderrAsync: (text) => writeStreamAsync(process.stderr, Buffer.from(text))
+        writeStderrAsync: (text) => output.stderr.writeAsync(Buffer.from(text))
       }),
       initialRawMode: !!process.stdin.isRaw,
       setRawMode: process.stdin.isTTY
@@ -309,6 +323,7 @@ export async function launchClientAsync(
   } finally {
     notices?.dispose();
     for (const signal of CANCELLATION_SIGNALS) process.removeListener(signal, onSignal);
+    removeOutputListener();
     try {
       await renderer.closeAsync();
     } finally {
@@ -316,7 +331,9 @@ export async function launchClientAsync(
     }
   }
   if (outcome === undefined || isCancelledOutcome(outcome, isCancelled())) {
-    const exitCode: number = getSignalExitCode(cancellationSignal ?? 'SIGINT');
+    const exitCode: number = closedOutput
+      ? CLOSED_OUTPUT_EXIT_CODE
+      : getSignalExitCode(cancellationSignal ?? 'SIGINT');
     // The client stopped waiting (at the cancellation deadline, or when the connection closed) before the daemon
     // confirmed that the request stopped. The daemon also cancels a request whose client disconnects.
     const stopUnconfirmed: boolean = outcome === undefined && cancelRequested;
@@ -327,11 +344,21 @@ export async function launchClientAsync(
     );
     process.exitCode = exitCode;
     // After SIGHUP the terminal may be gone; the exit code is what matters. Agent output's summary line already
-    // says whether the daemon confirmed the stop.
-    await writeStreamAsync(
-      process.stderr,
-      Buffer.from(formatCancellationMessage(commandName, stopUnconfirmed && !agentRenderer))
-    ).catch(() => undefined);
+    // says whether the daemon confirmed the stop, unless its reader exited: then this line is the only report.
+    await output.stderr
+      .writeAsync(
+        Buffer.from(
+          closedOutput
+            ? formatClosedOutputMessage(
+                commandName,
+                closedOutput.name,
+                closedOutput.closedCode,
+                stopUnconfirmed
+              )
+            : formatCancellationMessage(commandName, stopUnconfirmed && !agentRenderer)
+        )
+      )
+      .catch(() => undefined);
   } else if (outcome.kind === 'result') {
     // In agent mode the summary line may already carry the complete error message; do not repeat it.
     const reportedByAgent: boolean = agentRenderer?.finish(outcome.result) ?? false;
@@ -341,7 +368,7 @@ export async function launchClientAsync(
       ? undefined
       : getResultStderr(outcome.result, request.admission, rushx ? 'rushx-client' : 'rush-client');
     if (stderr) {
-      await writeStreamAsync(process.stderr, Buffer.from(stderr));
+      await output.stderr.writeAsync(Buffer.from(stderr));
     }
   } else if (outcome.kind === 'rejected') {
     const message: string = `Daemon rejected the request (${outcome.rejection.code}): ${outcome.rejection.message}`;
@@ -349,6 +376,7 @@ export async function launchClientAsync(
     throw new Error(message);
   } else {
     agentRenderer?.dispose();
+    output.release();
     process.stderr.write(formatInProcessFallbackMessage(outcome.message ?? outcome.reason, clientName));
     await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
   }
diff --git a/apps/rush-cli-client/src/start.ts b/apps/rush-cli-client/src/start.ts
index e724817594..2173fbe213 100644
--- a/apps/rush-cli-client/src/start.ts
+++ b/apps/rush-cli-client/src/start.ts
@@ -2,6 +2,7 @@
 // See LICENSE in the project root for license information.
 
 import { AgentProgressRenderer } from './AgentProgressRenderer';
+import { ClientOutput } from './clientOutput';
 import { isDaemonOffBeforeRouting } from './earlyRouting';
 import {
   findRushJsonPath,
@@ -14,20 +15,23 @@ const startTimeMs: number = Date.now();
 const argv: string[] = process.argv.slice(2);
 const commandName: string | undefined = getAgentCommandName(argv);
 const rushJsonPath: string | undefined = findRushJsonPath(process.cwd());
+// Until Rush runs in-process, a reader of the output that exits (for example `| head`) cancels the command instead
+// of failing the process.
+const output: ClientOutput = new ClientOutput();
+output.guard();
 // Write the agent status line before loading @microsoft/rush-lib (hundreds of milliseconds).
 const agentRenderer: AgentProgressRenderer | undefined =
   selectClientOutputMode({
     argv,
     environment: process.env,
     useRushReporter: !!rushJsonPath && readUseRushReporter(rushJsonPath)
-  }) === 'agent' &&
-  commandName !== undefined
+  }) === 'agent' && commandName !== undefined
     ? new AgentProgressRenderer({
         commandName,
         // A pty without a size (e.g. `script` run without a terminal) cannot be repainted; treat it as a pipe.
         isTTY: !!process.stdout.isTTY && process.env.TERM !== 'dumb' && !!process.stdout.columns,
         columns: process.stdout.columns || 80,
-        write: (text: string) => process.stdout.write(text),
+        write: (text: string) => output.stdout.write(text),
         startTimeMs
       })
     : undefined;
@@ -38,7 +42,7 @@ if (agentRenderer && !isDaemonOffBeforeRouting(process.env, rushJsonPath)) {
 
 const { launchClientAsync } = require('./launchClient') as typeof import('./launchClient');
 
-launchClientAsync(false, agentRenderer).catch((error: Error) => {
+launchClientAsync(false, agentRenderer, output).catch((error: Error) => {
   // In agent mode the summary line may already carry the complete message; do not repeat it.
   if (!agentRenderer?.finish({ exitCode: 1, errorMessage: error.message })) {
     process.stderr.write(`rush-client: ${error.message}\n`);
diff --git a/apps/rush-cli-client/src/startRushX.ts b/apps/rush-cli-client/src/startRushX.ts
index 9c0d3be3ff..b29b7b7424 100644
--- a/apps/rush-cli-client/src/startRushX.ts
+++ b/apps/rush-cli-client/src/startRushX.ts
@@ -1,9 +1,15 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { ClientOutput } from './clientOutput';
 import { launchClientAsync } from './launchClient';
 
-launchClientAsync(true).catch((error: Error) => {
+// Until Rush runs in-process, a reader of the output that exits (for example `| head`) cancels the command instead
+// of failing the process.
+const output: ClientOutput = new ClientOutput();
+output.guard();
+
+launchClientAsync(true, undefined, output).catch((error: Error) => {
   process.stderr.write(`rushx-client: ${error.message}\n`);
   process.exitCode = 1;
 });
diff --git a/apps/rush-cli-client/src/test/cancellationNotice.test.ts b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
index 77b0588ee4..6616c78c4b 100644
--- a/apps/rush-cli-client/src/test/cancellationNotice.test.ts
+++ b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
@@ -11,6 +11,7 @@ jest.mock('@rushstack/rush-client-core', () => ({
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { Writable } from 'node:stream';
 
 import {
   DaemonClientError,
@@ -23,6 +24,7 @@ import {
 import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 
 import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import { ClientOutput } from '../clientOutput';
 import * as connectionOptions from '../daemonConnectionOptions';
 import { launchClientAsync } from '../launchClient';
 import { getTestProcessEnvironment } from './TestProcessEnvironment';
@@ -33,14 +35,41 @@ const CANCELLED: string = 'rush-client: build cancelled.\n';
 const UNCONFIRMED: string =
   'rush-client: build cancelled, but rushd did not confirm that the request stopped; it may still be stopping.\n';
 
+const CLOSED_STDOUT: string =
+  'rush-client: build cancelled, because the process reading its stdout exited (EPIPE).\n';
+
 type Execution = (options: IDaemonClientExecuteOptions) => Promise<DaemonClientOutcome>;
 
+function brokenPipe(): NodeJS.ErrnoException {
+  return Object.assign(new Error('write EPIPE'), { code: 'EPIPE', errno: -32, syscall: 'write' });
+}
+
+/** Agent output whose writes fail once `readerExited` is set, as a pipe's do once the process reading it exits. */
+class ClosingOutput extends Writable {
+  public text: string = '';
+  public readerExited: boolean = false;
+
+  public constructor() {
+    super({
+      write: (chunk: Buffer, encoding, callback) => {
+        if (this.readerExited) {
+          callback(brokenPipe());
+        } else {
+          this.text += chunk.toString();
+          callback();
+        }
+      }
+    });
+  }
+}
+
 describe('the cancellation of a daemon request (task 132)', () => {
   let folder: string;
   let originalArgv: string[];
   let originalEnvironment: NodeJS.ProcessEnv;
   let originalExitCode: typeof process.exitCode;
   let listenersBefore: Map<NodeJS.Signals, unknown[]>;
+  let errorListenersBefore: Map<NodeJS.WriteStream, unknown[]>;
   let stderr: string[];
   /** What the client had written to stderr when the daemon heard of the cancellation. */
   let stderrAtCancel: string[] | undefined;
@@ -53,6 +82,9 @@ describe('the cancellation of a daemon request (task 132)', () => {
     listenersBefore = new Map(
       (['SIGINT', 'SIGTERM'] as const).map((signal) => [signal, process.listeners(signal)])
     );
+    errorListenersBefore = new Map(
+      [process.stdout, process.stderr].map((stream) => [stream, stream.listeners('error')])
+    );
     stderr = [];
     stderrAtCancel = undefined;
     fs.writeFileSync(
@@ -95,6 +127,12 @@ describe('the cancellation of a daemon request (task 132)', () => {
     jest.restoreAllMocks();
     jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
     jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    // A failed write leaves its 'error' listener, which a real pipe's error event would have removed.
+    for (const [stream, listeners] of errorListenersBefore) {
+      for (const listener of stream.listeners('error')) {
+        if (!listeners.includes(listener)) stream.removeListener('error', listener as (error: Error) => void);
+      }
+    }
     fs.rmSync(folder, { recursive: true });
   });
 
@@ -134,6 +172,43 @@ describe('the cancellation of a daemon request (task 132)', () => {
     );
   }
 
+  /**
+   * Makes each write to `stream` fail, as a pipe's writes do once the process reading it (for example `head`)
+   * exited, and records what the client tried to write.
+   */
+  function closeReader(stream: NodeJS.WriteStream, written: string[] = []): void {
+    jest.spyOn(stream, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      written.push(Buffer.from(chunk).toString());
+      const callback: ((error: Error) => void) | undefined = rest.find(
+        (argument) => typeof argument === 'function'
+      ) as ((error: Error) => void) | undefined;
+      process.nextTick(() => callback?.(brokenPipe()));
+      return false;
+    }) as typeof stream.write);
+  }
+
+  /** Resolves once the client aborts the request; `DaemonClient` then asks rushd to cancel it. */
+  async function abortedAsync(signal: AbortSignal): Promise<void> {
+    if (signal.aborted) return;
+    await new Promise<void>((resolve, reject) => {
+      const timer: NodeJS.Timeout = setTimeout(
+        () => reject(new Error('The client did not cancel the request.')),
+        2000
+      );
+      signal.addEventListener(
+        'abort',
+        () => {
+          clearTimeout(timer);
+          resolve();
+        },
+        { once: true }
+      );
+    });
+  }
+
   function disconnected(): DaemonClientError {
     return new DaemonClientError(
       'disconnected',
@@ -274,4 +349,132 @@ describe('the cancellation of a daemon request (task 132)', () => {
     expect(stderr).toEqual([CANCELLED]);
     expect(process.exitCode).toBe(130);
   });
+
+  describe('when the process reading its output exits, as `head` does (task 226)', () => {
+    it('cancels the request, says why in one line and exits with 141, as SIGPIPE would', async () => {
+      closeReader(process.stdout);
+      execute(async (options) => {
+        // As for `rush-client build --verbose | head -5`, once head has read its lines.
+        await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+        await abortedAsync(options.abortSignal!);
+        requestCancel(options);
+        return aborted(options);
+      });
+      await launchClientAsync(false);
+      // Nothing is left to read a line that says the client waits for rushd.
+      expect(stderrAtCancel).toEqual([]);
+      expect(stderr).toEqual([CLOSED_STDOUT]);
+      expect(process.exitCode).toBe(141);
+    });
+
+    it('fails no write when stderr has the same reader (`2>&1 | head`)', async () => {
+      const written: string[] = [];
+      closeReader(process.stdout, written);
+      closeReader(process.stderr, written);
+      execute(async (options) => {
+        await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+        await abortedAsync(options.abortSignal!);
+        requestCancel(options);
+        return aborted(options);
+      });
+      await launchClientAsync(false);
+      expect(written).toEqual(['built-a\n', CLOSED_STDOUT]);
+      expect(process.exitCode).toBe(141);
+    });
+
+    it("keeps a signal's exit code and lines when the signal cancelled the request first", async () => {
+      closeReader(process.stdout);
+      execute(async (options) => {
+        deliverSignal('SIGTERM');
+        requestCancel(options);
+        // Output that was already on its way to the client.
+        await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+        return aborted(options);
+      });
+      await launchClientAsync(false);
+      expect(stderr).toEqual([CANCELLING, CANCELLED]);
+      expect(process.exitCode).toBe(143);
+    });
+
+    it('keeps the exit code of a result that arrived before the client found the reader gone', async () => {
+      const written: string[] = [];
+      closeReader(process.stderr, written);
+      execute(async (options) => ({
+        kind: 'result',
+        result: {
+          requestId: options.request.requestId,
+          exitCode: 1,
+          outcome: 'failure',
+          aborted: false,
+          errorMessage: 'Rush build failed.'
+        }
+      }));
+      await launchClientAsync(false);
+      expect(written).toEqual(['rush-client: Rush build failed.\n']);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('still fails on an EPIPE that is not from its own output', async () => {
+      execute(async () => {
+        throw brokenPipe();
+      });
+      await expect(launchClientAsync(false)).rejects.toThrow('write EPIPE');
+      expect(stderr).toEqual([]);
+    });
+
+    it('cancels the request in agent output when a status line finds the reader gone', async () => {
+      const stdout: ClosingOutput = new ClosingOutput();
+      const output: ClientOutput = new ClientOutput({ stdout, stderr: process.stderr });
+      const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+        commandName: 'build',
+        isTTY: false,
+        columns: 80,
+        write: (text: string) => output.stdout.write(text)
+      });
+      const lockfile: DaemonRestartReason = {
+        kind: 'workspaceInputsChanged',
+        installationFiles: ['common/config/rush/pnpm-lock.yaml']
+      };
+      execute(async (options) => {
+        stdout.readerExited = true;
+        // On a pipe, a new cause gets a status line at once; otherwise the next one is due every 25 s.
+        await options.onQueuePositionAsync!(1, lockfile, { scriptCount: 1 });
+        await abortedAsync(options.abortSignal!);
+        requestCancel(options);
+        return aborted(options);
+      });
+      await launchClientAsync(false, renderer, output);
+      expect(stdout.text).toMatch(
+        /^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph [^\n]*\n$/
+      );
+      // The summary line can no longer be read, so the line on stderr is the only report.
+      expect(stderr).toEqual([CLOSED_STDOUT]);
+      expect(process.exitCode).toBe(141);
+    });
+
+    it("keeps the result's exit code in agent output when only the summary line finds the reader gone", async () => {
+      const stdout: ClosingOutput = new ClosingOutput();
+      const output: ClientOutput = new ClientOutput({ stdout, stderr: process.stderr });
+      const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+        commandName: 'build',
+        isTTY: false,
+        columns: 80,
+        write: (text: string) => output.stdout.write(text)
+      });
+      execute(async (options) => {
+        // As for `rush-client build | head -1` on a request that takes less than 25 s.
+        stdout.readerExited = true;
+        return {
+          kind: 'result',
+          result: { requestId: options.request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+        };
+      });
+      await launchClientAsync(false, renderer, output);
+      expect(stdout.text).toMatch(
+        /^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph [^\n]*\n$/
+      );
+      expect(stderr).toEqual([]);
+      expect(process.exitCode).toBe(0);
+    });
+  });
 });
diff --git a/apps/rush-cli-client/src/test/clientOutput.test.ts b/apps/rush-cli-client/src/test/clientOutput.test.ts
new file mode 100644
index 0000000000..b176949aeb
--- /dev/null
+++ b/apps/rush-cli-client/src/test/clientOutput.test.ts
@@ -0,0 +1,159 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import { Writable } from 'node:stream';
+
+import {
+  CLOSED_OUTPUT_EXIT_CODE,
+  ClientOutput,
+  getClosedOutputCode,
+  type ClientOutputStream
+} from '../clientOutput';
+
+function errnoError(code: string): NodeJS.ErrnoException {
+  return Object.assign(new Error(`write ${code}`), { code, syscall: 'write' });
+}
+
+/** A stream whose writes fail with `failure` once it is set, as a pipe's do after its reader exits. */
+class FakeOutput extends Writable {
+  public readonly chunks: string[] = [];
+  public attempts: number = 0;
+  public failure: string | undefined;
+
+  public constructor() {
+    super({
+      write: (chunk: Buffer, encoding, callback) => {
+        this.attempts++;
+        if (this.failure) {
+          callback(errnoError(this.failure));
+        } else {
+          this.chunks.push(chunk.toString());
+          callback();
+        }
+      }
+    });
+  }
+}
+
+describe('ClientOutput', () => {
+  let stdout: FakeOutput;
+  let stderr: FakeOutput;
+  let output: ClientOutput;
+  let closed: ClientOutputStream[];
+
+  beforeEach(() => {
+    stdout = new FakeOutput();
+    stderr = new FakeOutput();
+    output = new ClientOutput({ stdout, stderr });
+    closed = [];
+    output.onClosed((stream) => closed.push(stream));
+  });
+
+  afterEach(() => {
+    output.release();
+  });
+
+  it('exits like a writer that SIGPIPE ended', () => {
+    expect(CLOSED_OUTPUT_EXIT_CODE).toBe(141);
+  });
+
+  it('only takes EPIPE and ECONNRESET for a reader that exited', () => {
+    expect(getClosedOutputCode(errnoError('EPIPE'))).toBe('EPIPE');
+    expect(getClosedOutputCode(errnoError('ECONNRESET'))).toBe('ECONNRESET');
+    expect(getClosedOutputCode(errnoError('ENOSPC'))).toBeUndefined();
+    expect(getClosedOutputCode(new Error('write EPIPE'))).toBeUndefined();
+    expect(getClosedOutputCode('EPIPE')).toBeUndefined();
+    expect(getClosedOutputCode(undefined)).toBeUndefined();
+  });
+
+  it('reports a reader that exited once, and then drops the writes to its stream', async () => {
+    await output.stdout.writeAsync(Buffer.from('first\n'));
+    stdout.failure = 'EPIPE';
+    await expect(output.stdout.writeAsync(Buffer.from('second\n'))).resolves.toBeUndefined();
+    await expect(output.stdout.writeAsync(Buffer.from('third\n'))).resolves.toBeUndefined();
+    expect(stdout.chunks).toEqual(['first\n']);
+    expect(stdout.attempts).toBe(2);
+    expect(closed).toEqual([output.stdout]);
+    expect(output.stdout.closedCode).toBe('EPIPE');
+    // The other stream is still read.
+    await output.stderr.writeAsync(Buffer.from('still read\n'));
+    expect(stderr.chunks).toEqual(['still read\n']);
+    expect(output.stderr.closedCode).toBeUndefined();
+  });
+
+  it('rejects any other write error, and keeps writing', async () => {
+    stdout.failure = 'ENOSPC';
+    await expect(output.stdout.writeAsync(Buffer.from('lost\n'))).rejects.toMatchObject({ code: 'ENOSPC' });
+    expect(closed).toEqual([]);
+    expect(output.stdout.closedCode).toBeUndefined();
+  });
+
+  it('reports a stream whose reader already exited to a later listener at once, until it is removed', async () => {
+    stderr.failure = 'ECONNRESET';
+    await output.stderr.writeAsync(Buffer.from('lost\n'));
+    const late: ClientOutputStream[] = [];
+    const remove: () => void = output.onClosed((stream) => late.push(stream));
+    expect(late).toEqual([output.stderr]);
+    remove();
+    stdout.failure = 'EPIPE';
+    await output.stdout.writeAsync(Buffer.from('lost\n'));
+    expect(late).toEqual([output.stderr]);
+    expect(closed).toEqual([output.stderr, output.stdout]);
+  });
+
+  it('keeps an error event of a reader that exited from failing the process, while guarded', () => {
+    output.guard();
+    output.guard();
+    expect(stdout.listenerCount('error')).toBe(1);
+    expect(() => stdout.emit('error', errnoError('EPIPE'))).not.toThrow();
+    expect(closed).toEqual([output.stdout]);
+    // No write waits for an unexpected error, so it still fails the process.
+    expect(() => stderr.emit('error', errnoError('ENOSPC'))).toThrow('write ENOSPC');
+    const handler: jest.Mock = jest.fn();
+    stderr.on('error', handler);
+    expect(() => stderr.emit('error', errnoError('ENOSPC'))).not.toThrow();
+    expect(handler).toHaveBeenCalledTimes(1);
+    stderr.removeListener('error', handler);
+    output.release();
+    expect(stdout.listenerCount('error')).toBe(0);
+    expect(stderr.listenerCount('error')).toBe(0);
+  });
+
+  it('drops the text of a write that does not wait once the reader exited', async () => {
+    stdout.failure = 'EPIPE';
+    output.guard();
+    output.stdout.write('lost\n');
+    await new Promise((resolve) => setImmediate(resolve));
+    output.stdout.write('dropped\n');
+    expect(stdout.attempts).toBe(1);
+    expect(closed).toEqual([output.stdout]);
+  });
+
+  it('recognizes a real pipe whose reader closed it', async () => {
+    // The reader closes its end of the pipe, and then waits, so that the parent does not destroy the pipe on exit.
+    const reader: ChildProcess = spawn(
+      process.execPath,
+      ['-e', "require('node:fs').closeSync(0);process.stdout.write('closed');setTimeout(()=>{},30000)"],
+      { stdio: ['pipe', 'pipe', 'ignore'] }
+    );
+    const exited: Promise<unknown[]> = once(reader, 'close');
+    const real: ClientOutput = new ClientOutput({ stdout: reader.stdin!, stderr });
+    const realClosed: ClientOutputStream[] = [];
+    real.onClosed((stream) => realClosed.push(stream));
+    real.guard();
+    try {
+      await once(reader.stdout!, 'data');
+      for (let attempt: number = 0; attempt < 20 && !realClosed.length; attempt++) {
+        await real.stdout.writeAsync(Buffer.alloc(64 * 1024));
+      }
+      expect(realClosed).toEqual([real.stdout]);
+      expect(real.stdout.closedCode).toBe('EPIPE');
+    } finally {
+      real.release();
+      reader.kill();
+      await exited;
+    }
+  });
+});
diff --git a/apps/rush-cli-client/src/test/nativeBuild.test.ts b/apps/rush-cli-client/src/test/nativeBuild.test.ts
index 819e8be37c..058b14c8d7 100644
--- a/apps/rush-cli-client/src/test/nativeBuild.test.ts
+++ b/apps/rush-cli-client/src/test/nativeBuild.test.ts
@@ -596,4 +596,59 @@ describe('native build through the standalone client', () => {
       }),
     30000
   );
+
+  it(
+    'cancels a build whose output reader exits, as `head` does, and exits with 141 (task 226)',
+    () =>
+      runWithFixtureAsync(async ({ folder, environment, trackWatch }) => {
+        // An operation that writes a line every 20 ms for 20 s.
+        fs.writeFileSync(
+          path.join(folder, 'a/build.cjs'),
+          "let n=0;const t=setInterval(()=>{console.log('tick-'+ ++n);if(n===1000)clearInterval(t);},20);"
+        );
+        const client = spawn(
+          process.execPath,
+          [path.resolve(__dirname, '../../bin/rush-client'), 'build', '--to', 'a', '--verbose'],
+          { cwd: folder, env: environment, stdio: ['ignore', 'pipe', 'pipe'] }
+        );
+        const closed = once(client, 'close');
+        trackWatch(client, closed);
+        let errors: string = '';
+        client.stderr!.on('data', (bytes: Buffer) => {
+          errors += bytes.toString();
+        });
+        let output: string = '';
+        // Stops reading once the operation's output arrives, as `head -5` does.
+        const read = new Promise<void>((resolve) => {
+          client.stdout!.on('data', (bytes: Buffer) => {
+            output += bytes.toString();
+            if (output.includes('tick-')) {
+              client.stdout!.destroy();
+              resolve();
+            }
+          });
+        });
+        try {
+          await Promise.race([
+            read,
+            closed.then(() => {
+              throw new Error(`The build ended before its output arrived: ${errors}`);
+            })
+          ]);
+          expect(await closed).toEqual([141, null]);
+          // A socket (here) may report ECONNRESET where a shell's pipe reports EPIPE.
+          expect(
+            errors.split('\n').filter((line) => /cancel|connection|EPIPE|ECONNRESET/i.test(line))
+          ).toEqual([
+            expect.stringMatching(
+              /^rush-client: build cancelled, because the process reading its stdout exited \((EPIPE|ECONNRESET)\)\.$/
+            )
+          ]);
+        } finally {
+          if (client.exitCode === null && client.signalCode === null) client.kill('SIGTERM');
+          await closed;
+        }
+      }),
+    30000
+  );
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o05-t226-closed-output_2026-09-29-08-40.json b/common/changes/@rushstack/rush-cli-client/swarm-o05-t226-closed-output_2026-09-29-08-40.json
new file mode 100644
index 0000000000..71d1b33261
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o05-t226-closed-output_2026-09-29-08-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the process reading a daemon-routed command's output exits first (for example `rush-client build | head -5`), cancel the request and exit with code 141, as SIGPIPE would, with one stderr line that names the stream. Previously legacy output reported a lost connection to rushd after a 1 s wait, and agent output crashed with an uncaught EPIPE.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 268c8665d674f13432b84d9db9ecf692f70ecdd0 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:03 +0000
Subject: [PATCH 153/265] [rush-daemon] A native install or update whose waits
 span an installation change gets the typed restart (task 189) (and 3 more)

Swarm integration step 138; original commit ef3d2bd48b (merge of swarm/r05-t189-int6 at decc8b6dee).
Scope: task 189.

Brings 189-int6 (branch swarm/r05-t189-int6). Second agent: t07 board 4949. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 3 of 19. Gate: ch01 GATE OK board 5319 (tree df6dd68523)

Commits folded into this step (4):
- 5b7cbf5176 rush-daemon: a native install or update whose waits span an installation change gets the typed restart (task 189)
- b3980cd89b Test the four gaps that t05 found in task 189 (P2, P9, P11, Q5)
- a505e7dcf9 Expect the shutdown line in the test of an install whose waits span an installation change
- fa1cbb46d7 rush-cli-client: begin rushx-client's closed-output cancellation line with rushx-client

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  11 +-
 .../src/AgentProgressRenderer.ts              |   5 +-
 .../rush-cli-client/src/clientCancellation.ts |  33 ++-
 .../src/daemonRestartNotice.ts                |  38 +++-
 apps/rush-cli-client/src/launchClient.ts      |  13 +-
 .../src/test/AgentProgressRenderer.test.ts    |  23 ++
 .../src/test/cancellationNotice.test.ts       |  68 ++++++
 .../src/test/daemonRestartNotice.test.ts      |  66 ++++++
 ...-installation-change_2026-09-29-04-25.json |  11 +
 ...-installation-change_2026-09-29-04-25.json |  11 +
 ...-installation-change_2026-09-29-04-25.json |  11 +
 ...-installation-change_2026-09-29-04-25.json |  11 +
 .../rush-client-core/src/DaemonClient.ts      |  10 +-
 libraries/rush-daemon-protocol/README.md      |   3 +
 .../src/DaemonRequestAdmission.ts             |   7 +-
 libraries/rush-daemon/README.md               |  11 +-
 .../src/WorkspaceRequestAdmission.ts          | 129 +++++++++--
 .../src/WorkspaceRequestLifecycle.ts          |  84 ++++---
 .../src/test/DaemonInstallationChange.test.ts | 206 +++++++++++++++++-
 .../test/WorkspaceRequestAdmission.test.ts    |  52 ++++-
 .../WorkspaceServedScriptAdmission.test.ts    | 170 ++++++++++++++-
 21 files changed, 885 insertions(+), 88 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index af76555a6c..465488d4ae 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -153,7 +153,8 @@ wait for a daemon that is still starting gets a line of its own
 (`rushd is still starting; waiting for it (up to 15s more) because its startup helper (PID 4242) is
 still waiting for the daemon`). A
 request that waited for admission says so at the end of its summary line
-(`· queued behind another request (position 1 at 0.2s)`). It always ends with one summary
+(`· queued behind another request (position 1 at 0.2s)`), unless it failed: a failure's summary
+line gives the failure, not the wait. It always ends with one summary
 line, for example
 `rush build: SUCCESS 772/772 operations (12 success, 760 from cache) in 3.1s`, or
 `up to date (no operations needed)`, or, when the selection parameters matched no projects,
@@ -320,7 +321,12 @@ scripts, because a script such as a dev server may run until it is stopped. A
 `rushx-client` script that waits for another request's restart prints `rushx-client:
 waiting for the daemon (PID <pid>) to restart for another request (2 requests ahead),
 because <cause>.` The line goes to the stderr that the script writes to, which is a
-pipe, because a `rushx-client` with a terminal runs the script in-process. A terminal
+pipe, because a `rushx-client` with a terminal runs the script in-process. Its first line
+comes once `rushx-client` itself has started and sent the request, which takes about half a
+second on a busy machine. A native `install` or `update` restarts the daemon once it ends,
+which would end the `rushx` scripts that the daemon runs, so it first waits for them and
+says so the same way: `rush-client: waiting for 1 running rushx script to finish, since
+this command restarts the daemon (PID <pid>), which would end it.` A terminal
 gets a line whenever the wait changes, and a pipe when the wait begins or its cause
 changes. Both get the line again with the time waited (`still waiting after 25s for
 …`) whenever 25 seconds pass without one, until the command follows the restart,
@@ -394,6 +400,7 @@ does not report that as a lost connection. It asks rushd to cancel the command,
 as it does after Ctrl+C, and exits with code 141 (128 + SIGPIPE), which a shell reports for a writer
 that SIGPIPE ended. Instead of the cancelling and cancelled lines it prints one line, which names
 the stream: `rush-client: build cancelled, because the process reading its stdout exited (EPIPE).`
+In `rushx-client` it begins with `rushx-client:`.
 Agent output prints the same line on stderr. The client only learns of the exit at its next write,
 which in agent output on a pipe can be the next status line, up to 25 s later. A command whose
 result arrived before a write failed keeps the result's exit code. Rush run in-process and
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index 48c2d7a43a..b5f321c960 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -502,8 +502,9 @@ export class AgentProgressRenderer {
     } else if (verdict === 'CANCELLED' && result?.stopUnconfirmed) {
       summary += ` · ${UNCONFIRMED_STOP}`;
     }
-    // An admission failure says that the request waited, and why it stopped waiting.
-    if (this.#firstQueued && !result?.admissionErrorCode) {
+    // Why a success or a cancellation took long. A failure has its own reason, which an old queue position is not,
+    // and an admission failure says that the request waited, and why it stopped waiting.
+    if (this.#firstQueued && verdict !== 'FAILURE' && !result?.admissionErrorCode) {
       const { position, elapsed } = this.#firstQueued;
       summary += ` · queued behind another request (position ${position} at ${elapsed})`;
     }
diff --git a/apps/rush-cli-client/src/clientCancellation.ts b/apps/rush-cli-client/src/clientCancellation.ts
index e8597c326f..bce29e0610 100644
--- a/apps/rush-cli-client/src/clientCancellation.ts
+++ b/apps/rush-cli-client/src/clientCancellation.ts
@@ -5,6 +5,8 @@ import * as os from 'node:os';
 
 import type { DaemonClientOutcome } from '@rushstack/rush-client-core';
 
+import type { ClientName } from './ClientAdmissionControls';
+
 /** Signals that cancel a daemon-routed command. */
 export const CANCELLATION_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM', 'SIGHUP'];
 
@@ -20,39 +22,50 @@ export function getSignalExitCode(signal: NodeJS.Signals): number {
 
 /**
  * Formats the notice printed as soon as the client asks the daemon to cancel a daemon-routed command, which can take
- * the daemon seconds, for example while it prepares the workspace graph.
+ * the daemon seconds, for example while it prepares the workspace graph. `clientName` begins the line, as it does
+ * the client's other lines.
  */
-export function formatCancellingMessage(commandName: string, timeoutMs: number): string {
+export function formatCancellingMessage(
+  commandName: string,
+  timeoutMs: number,
+  clientName: ClientName = 'rush-client'
+): string {
   const seconds: number = Math.round(timeoutMs / 1000);
-  return `rush-client: cancelling ${commandName}; waiting up to ${seconds} s for rushd to stop the request.\n`;
+  return `${clientName}: cancelling ${commandName}; waiting up to ${seconds} s for rushd to stop the request.\n`;
 }
 
 /**
  * Formats the notice printed when a daemon-routed command is cancelled. `stopUnconfirmed` says that the client
- * stopped waiting before the daemon confirmed that the request stopped.
+ * stopped waiting before the daemon confirmed that the request stopped. `clientName` begins the line.
  */
-export function formatCancellationMessage(commandName: string, stopUnconfirmed: boolean = false): string {
+export function formatCancellationMessage(
+  commandName: string,
+  stopUnconfirmed: boolean = false,
+  clientName: ClientName = 'rush-client'
+): string {
   return stopUnconfirmed
-    ? `rush-client: ${commandName} cancelled, but rushd did not confirm that the request stopped; ` +
+    ? `${clientName}: ${commandName} cancelled, but rushd did not confirm that the request stopped; ` +
         'it may still be stopping.\n'
-    : `rush-client: ${commandName} cancelled.\n`;
+    : `${clientName}: ${commandName} cancelled.\n`;
 }
 
 /**
  * Formats the notice printed when a daemon-routed command is cancelled because the process reading its output
  * exited, for example `head` in `rush-client build | head -5`. It is the only notice of that cancellation.
+ * `clientName` begins the line.
  */
 export function formatClosedOutputMessage(
   commandName: string,
   streamName: string,
   code: string | undefined,
-  stopUnconfirmed: boolean
+  stopUnconfirmed: boolean,
+  clientName: ClientName = 'rush-client'
 ): string {
   const reason: string = `the process reading its ${streamName} exited${code ? ` (${code})` : ''}`;
   return stopUnconfirmed
-    ? `rush-client: ${commandName} cancelled, because ${reason}, but rushd did not confirm that the request ` +
+    ? `${clientName}: ${commandName} cancelled, because ${reason}, but rushd did not confirm that the request ` +
         'stopped; it may still be stopping.\n'
-    : `rush-client: ${commandName} cancelled, because ${reason}.\n`;
+    : `${clientName}: ${commandName} cancelled, because ${reason}.\n`;
 }
 
 /**
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index 95ad73b86e..8daf35cb83 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -100,7 +100,11 @@ export interface IDaemonRestartWait {
    * request's restart, also those that wait to restart the daemon.
    */
   readonly position: number;
-  readonly reason: DaemonRestartReason;
+  /**
+   * Why the daemon restarts. Without one, the request restarts the daemon itself once it ends, as a native
+   * `install` or `update` does, and first waits for the rushx scripts that `details.scriptCount` counts to finish.
+   */
+  readonly reason: DaemonRestartReason | undefined;
   readonly details: IDaemonRestartWaitDetails;
 }
 
@@ -124,21 +128,30 @@ function formatIncludedScripts(scriptCount: number): string {
  * Says what a request that waits for a daemon restart waits for and why the daemon restarts, for example
  * "waiting for 2 running requests to finish, including 1 rushx script; the daemon (PID 41) then restarts, because
  * common/config/rush/pnpm-lock.yaml changed". A rushx script that waits for another request's restart gets
- * "waiting for the daemon (PID 41) to restart for another request (2 requests ahead), because ...". The line names
- * environment variables, never their values, and leaves out a cause that this client cannot word.
+ * "waiting for the daemon (PID 41) to restart for another request (2 requests ahead), because ...", and a request
+ * that restarts the daemon itself once it ends gets "waiting for 1 running rushx script to finish, since this
+ * command restarts the daemon (PID 41), which would end it". The line names environment variables, never their
+ * values, and leaves out a cause that this client cannot word.
  */
 export function formatDaemonRestartWait(options: IDaemonRestartWaitLineOptions): string {
   const { position, reason, details, daemonPid, elapsedMs = 0 } = options;
   const anotherRequest: boolean = !!details.restartsForAnotherRequest;
+  const pid: string = daemonPid === undefined ? '' : ` (PID ${daemonPid})`;
+  const waiting: string =
+    elapsedMs < 1000 ? 'waiting' : `still waiting after ${Math.round(elapsedMs / 1000)}s`;
+  const scriptCount: number = details.scriptCount ?? 0;
+  if (!reason) {
+    const scripts: number = scriptCount || position;
+    return (
+      `${waiting} for ${formatCount(scripts, 'running rushx script')} to finish, since this command restarts ` +
+      `the daemon${pid}, which would end ${scripts === 1 ? 'it' : 'them'}`
+    );
+  }
   const cause: string | undefined = formatDaemonRestartCause(
     reason,
     anotherRequest ? 'anotherRequest' : 'thisRequest'
   );
   const because: string = cause === undefined ? '' : `, ${cause}`;
-  const pid: string = daemonPid === undefined ? '' : ` (PID ${daemonPid})`;
-  const waiting: string =
-    elapsedMs < 1000 ? 'waiting' : `still waiting after ${Math.round(elapsedMs / 1000)}s`;
-  const scriptCount: number = details.scriptCount ?? 0;
   if (anotherRequest) {
     const ahead: string = `${formatCount(position, 'request')} ahead${formatIncludedScripts(scriptCount)}`;
     return `${waiting} for the daemon${pid} to restart for another request (${ahead})${because}`;
@@ -152,12 +165,14 @@ export function formatDaemonRestartWait(options: IDaemonRestartWaitLineOptions):
 
 /** The part of a restart wait that a pipe gets a line for at once when it changes: whose restart, and why. */
 function getRestartWaitCause(wait: IDaemonRestartWait): string {
-  const anotherRequest: boolean = !!wait.details.restartsForAnotherRequest;
+  const { reason, details } = wait;
+  if (!reason) return 'thisCommand';
+  const anotherRequest: boolean = !!details.restartsForAnotherRequest;
   const cause: string | undefined = formatDaemonRestartCause(
-    wait.reason,
+    reason,
     anotherRequest ? 'anotherRequest' : 'thisRequest'
   );
-  return `${anotherRequest}:${cause ?? wait.reason.kind}`;
+  return `${anotherRequest}:${cause ?? reason.kind}`;
 }
 
 /**
@@ -292,7 +307,8 @@ export function createDaemonRequestNoticeHandlers(
       details: IDaemonRestartWaitDetails = {}
     ): Promise<void> => {
       if (disposed) return;
-      if (!restartReason) {
+      // Without a reason, a count of scripts means that the request restarts the daemon itself once it ends.
+      if (!restartReason && !details.scriptCount) {
         endRestartWait();
         if (agentRenderer) agentRenderer.onQueuePosition(position);
         else if (stderrIsTTY) {
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index f2c730aaee..78a8aa8538 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -25,7 +25,7 @@ import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-tra
 import { ConsoleTerminalProvider } from '@rushstack/terminal';
 
 import { executeDaemonCommandAsync } from './daemonCommands';
-import { getConfiguredAdmission } from './ClientAdmissionControls';
+import { getConfiguredAdmission, type ClientName } from './ClientAdmissionControls';
 import { ClientOperationRenderer } from './ClientOperationRenderer';
 import type { AgentProgressRenderer } from './AgentProgressRenderer';
 import {
@@ -77,7 +77,7 @@ export async function launchClientAsync(
   );
   const argv: ReadonlyArray<string> = process.argv.slice(2);
   const useRushReporter: boolean = !rushx && !!rushJsonPath && readUseRushReporter(rushJsonPath);
-  const clientName: string = rushx ? 'rushx-client' : 'rush-client';
+  const clientName: ClientName = rushx ? 'rushx-client' : 'rush-client';
   const route: IClientRoute = selectClientRoute({
     argv,
     environment,
@@ -230,7 +230,7 @@ export async function launchClientAsync(
     if (closedOutput) return;
     // After SIGHUP the terminal may be gone.
     output.stderr
-      .writeAsync(Buffer.from(formatCancellingMessage(commandName, timeoutMs)))
+      .writeAsync(Buffer.from(formatCancellingMessage(commandName, timeoutMs, clientName)))
       .catch(() => undefined);
   };
   const isCancelled = (): boolean => abort.signal.aborted || cancelRequested;
@@ -353,9 +353,10 @@ export async function launchClientAsync(
                 commandName,
                 closedOutput.name,
                 closedOutput.closedCode,
-                stopUnconfirmed
+                stopUnconfirmed,
+                clientName
               )
-            : formatCancellationMessage(commandName, stopUnconfirmed && !agentRenderer)
+            : formatCancellationMessage(commandName, stopUnconfirmed && !agentRenderer, clientName)
         )
       )
       .catch(() => undefined);
@@ -366,7 +367,7 @@ export async function launchClientAsync(
     // When the agent summary line explains the failure, nothing more is printed.
     const stderr: string | undefined = reportedByAgent
       ? undefined
-      : getResultStderr(outcome.result, request.admission, rushx ? 'rushx-client' : 'rush-client');
+      : getResultStderr(outcome.result, request.admission, clientName);
     if (stderr) {
       await output.stderr.writeAsync(Buffer.from(stderr));
     }
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 3c25b58605..8d416a005e 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -492,6 +492,29 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
+  it('gives no old queue position as the reason for a failure, but keeps it for a cancellation (task 189)', () => {
+    const failed: ITestRenderer = createRenderer(false, 'install');
+    failed.clock.ms = 200;
+    failed.renderer.onQueuePosition(1);
+    failed.clock.ms = 21_600;
+    failed.renderer.finish({ exitCode: 1 });
+    expect(failed.lines()).toEqual(['rush install: FAILURE in 21.6s']);
+
+    const withMessage: ITestRenderer = createRenderer(false, 'install');
+    withMessage.renderer.onQueuePosition(1);
+    withMessage.renderer.finish({ exitCode: 1, errorMessage: 'The mutation failed.' });
+    expect(withMessage.lines()).toEqual(['rush install: FAILURE in 0.0s · The mutation failed.']);
+
+    const cancelled: ITestRenderer = createRenderer(false);
+    cancelled.clock.ms = 200;
+    cancelled.renderer.onQueuePosition(1);
+    cancelled.clock.ms = 3_000;
+    cancelled.renderer.finish({ exitCode: 130, cancelled: true });
+    expect(cancelled.lines()).toEqual([
+      'rush build: CANCELLED in 3.0s · queued behind another request (position 1 at 0.2s)'
+    ]);
+  });
+
   it('shows the excerpt of a failed operation that reported errors on stdout', () => {
     const { renderer, output } = createRenderer(false);
     renderer.onEvent(status('ok (build)', 'EXECUTING'));
diff --git a/apps/rush-cli-client/src/test/cancellationNotice.test.ts b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
index 6616c78c4b..5bedb94158 100644
--- a/apps/rush-cli-client/src/test/cancellationNotice.test.ts
+++ b/apps/rush-cli-client/src/test/cancellationNotice.test.ts
@@ -296,6 +296,49 @@ describe('the cancellation of a daemon request (task 132)', () => {
     expect(process.exitCode).toBe(130);
   });
 
+  it.each([
+    ['confirms', 'rushx-client: build cancelled.\n'],
+    [
+      'does not confirm',
+      'rushx-client: build cancelled, but rushd did not confirm that the request stopped; it may still be ' +
+        'stopping.\n'
+    ]
+  ])(
+    'begins both notices of a rushx script with rushx-client when rushd %s the stop (task 189)',
+    async (confirmation: string, cancelled: string) => {
+      process.argv = [process.execPath, 'rushx-client', 'build'];
+      execute(async (options) => {
+        deliverSignal('SIGINT');
+        requestCancel(options);
+        if (confirmation === 'confirms') return aborted(options);
+        throw cancellationDeadline();
+      });
+      await launchClientAsync(true);
+      expect(stderr).toEqual([
+        'rushx-client: cancelling build; waiting up to 5 s for rushd to stop the request.\n',
+        cancelled
+      ]);
+      expect(process.exitCode).toBe(130);
+    }
+  );
+
+  it('begins the error line of a rushx script that rushd failed with rushx-client, like its notices (task 189)', async () => {
+    process.argv = [process.execPath, 'rushx-client', 'build'];
+    execute(async (options) => ({
+      kind: 'result',
+      result: {
+        requestId: options.request.requestId,
+        exitCode: 1,
+        outcome: 'failure',
+        aborted: false,
+        errorMessage: 'The daemon shut down before the request finished.'
+      }
+    }));
+    await launchClientAsync(true);
+    expect(stderr).toEqual(['rushx-client: The daemon shut down before the request finished.\n']);
+    expect(process.exitCode).toBe(1);
+  });
+
   it('writes both notices in the agent output, once', async () => {
     const output: string[] = [];
     const renderer: AgentProgressRenderer = new AgentProgressRenderer({
@@ -367,6 +410,31 @@ describe('the cancellation of a daemon request (task 132)', () => {
       expect(process.exitCode).toBe(141);
     });
 
+    it.each([
+      ['confirms', 'rushx-client: build cancelled, because the process reading its stdout exited (EPIPE).\n'],
+      [
+        'does not confirm',
+        'rushx-client: build cancelled, because the process reading its stdout exited (EPIPE), but rushd did ' +
+          'not confirm that the request stopped; it may still be stopping.\n'
+      ]
+    ])(
+      'begins the line of a rushx script with rushx-client when rushd %s the stop, like its other notices (task 189)',
+      async (confirmation: string, closed: string) => {
+        process.argv = [process.execPath, 'rushx-client', 'build'];
+        closeReader(process.stdout);
+        execute(async (options) => {
+          await options.onStdoutAsync!(Buffer.from('built-a\n'), options.request.requestId);
+          await abortedAsync(options.abortSignal!);
+          requestCancel(options);
+          if (confirmation === 'confirms') return aborted(options);
+          throw cancellationDeadline();
+        });
+        await launchClientAsync(true);
+        expect(stderr).toEqual([closed]);
+        expect(process.exitCode).toBe(141);
+      }
+    );
+
     it('fails no write when stderr has the same reader (`2>&1 | head`)', async () => {
       const written: string[] = [];
       closeReader(process.stdout, written);
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index aab692d03b..b4b67a7341 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -247,6 +247,31 @@ describe(formatDaemonRestartWait.name, () => {
     );
   });
 
+  it('says how many rushx scripts a command that restarts the daemon itself waits for (task 189)', () => {
+    const format = (scriptCount: number, daemonPid?: number, elapsedMs?: number): string =>
+      formatDaemonRestartWait({
+        position: 1,
+        reason: undefined,
+        details: { scriptCount },
+        daemonPid,
+        elapsedMs
+      });
+    expect(format(1, 41)).toBe(
+      'waiting for 1 running rushx script to finish, since this command restarts the daemon (PID 41), which ' +
+        'would end it'
+    );
+    expect(format(2)).toBe(
+      'waiting for 2 running rushx scripts to finish, since this command restarts the daemon, which would end them'
+    );
+    expect(format(1, 41, 25_400)).toMatch(
+      /^still waiting after 25s for 1 running rushx script to finish, since this command restarts the daemon /
+    );
+    // Without a count, the position counts them.
+    expect(formatDaemonRestartWait({ position: 3, reason: undefined, details: {}, daemonPid: 41 })).toMatch(
+      /^waiting for 3 running rushx scripts to finish, since /
+    );
+  });
+
   it('says how long the request has waited, from a second on', () => {
     const format = (elapsedMs: number, details: IDaemonRestartWaitDetails): string =>
       formatDaemonRestartWait({ position: 1, reason: LOCKFILE, details, daemonPid: 41, elapsedMs });
@@ -320,6 +345,11 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
 
   const LOCKFILE_WAIT: string =
     'the daemon (PID 41) then restarts, because common/config/rush/pnpm-lock.yaml changed';
+  // What a native install or update, which restarts the daemon itself once it ends, waits for.
+  const TWO_SCRIPTS: string =
+    '2 running rushx scripts to finish, since this command restarts the daemon (PID 41), which would end them';
+  const ONE_SCRIPT: string =
+    '1 running rushx script to finish, since this command restarts the daemon (PID 41), which would end it';
   const ENV_NODE_OPTIONS: DaemonRestartReason = {
     kind: 'environmentChanged',
     variableNames: ['NODE_OPTIONS']
@@ -405,6 +435,29 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       }
     });
 
+    it('writes a line for a command that restarts the daemon itself once the rushx scripts exit (task 189)', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        // The install first waits for the workspace, as any request can, and then for the scripts.
+        await handlers.onQueuePositionAsync(1);
+        await handlers.onQueuePositionAsync(2, undefined, { scriptCount: 2 });
+        advance(RESTART_WAIT_REPEAT_MS);
+        await handlers.onQueuePositionAsync(1, undefined, { scriptCount: 1 });
+        advance(RESTART_WAIT_REPEAT_MS);
+        handlers.onRequestProgress();
+        advance(RESTART_WAIT_REPEAT_MS * 2);
+        handlers.dispose();
+        expect(calls).toEqual([
+          ...(stderrIsTTY ? [`stderr: ${client}: waiting for daemon admission (position 1).\n`] : []),
+          `stderr: ${client}: waiting for ${TWO_SCRIPTS}.\n`,
+          `stderr: ${client}: still waiting after 25s for ${TWO_SCRIPTS}.\n`,
+          // On a pipe, a new count waits for the next line.
+          ...(stderrIsTTY ? [`stderr: ${client}: still waiting after 25s for ${ONE_SCRIPT}.\n`] : []),
+          `stderr: ${client}: still waiting after 50s for ${ONE_SCRIPT}.\n`
+        ]);
+      }
+    });
+
     it('writes a line on a pipe when whose restart the request waits for changes, even for the same cause', async () => {
       const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
       await handlers.onQueuePositionAsync(1, LOCKFILE, {});
@@ -594,6 +647,19 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     ]);
   });
 
+  it('shows the rushx scripts that a command which restarts the daemon itself waits for as the agent phase (task 189)', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1);
+    await handlers.onQueuePositionAsync(2, undefined, { scriptCount: 2 });
+    await handlers.onQueuePositionAsync(1, undefined, { scriptCount: 1 });
+    handlers.dispose();
+    expect(calls).toEqual([
+      'position: 1',
+      `announce: waiting for ${TWO_SCRIPTS}`,
+      `wait: waiting for ${ONE_SCRIPT}`
+    ]);
+  });
+
   it('gives the agent a note for the restart only when the renderer wrote no line for its wait (task 222)', async () => {
     const wait: string =
       "waiting for 1 running request to finish; the daemon (PID 41) then restarts, because this request's " +
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json b/common/changes/@rushstack/rush-cli-client/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
new file mode 100644
index 0000000000..d703729dbb
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "A native install or update that waits for the rushx scripts that the daemon runs now says so, for example \"waiting for 1 running rushx script to finish, since this command restarts the daemon (PID 41), which would end it\", on a pipe too. A failed command's agent summary line no longer ends with the queue position at which it once waited. The cancellation notices of rushx-client begin with \"rushx-client:\".",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json b/common/changes/@rushstack/rush-client-core/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
new file mode 100644
index 0000000000..00f1cd61e0
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Documents that onQueuePositionAsync's restartWait.scriptCount can come without a restart reason, while a native install or update waits for rushx scripts to exit before it runs.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
new file mode 100644
index 0000000000..6a739f11e3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "A queue position's scriptCount can now come without a restartReason, while a native install or update waits for that many running rushx scripts to exit before it runs.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json b/common/changes/@rushstack/rush-daemon/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
new file mode 100644
index 0000000000..d5016ab53e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r05-t189-mutation-installation-change_2026-09-29-04-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A native install or update now checks the daemon's installation again once its waits end, just before its worker starts, so a change during those waits gets the typed installation-changed result, which the client resubmits, instead of a raw module-not-found error. When the installation changes while the worker runs or the successor is selected, the daemon exits after the mutation without selecting a successor, the mutation's output says so instead of \"Mutation completed, but successor startup is unavailable\", and each request answered from then on gets the typed result. A request that waits for the rushx scripts that the daemon runs gets queue positions that count them, with the restart reason when a later capture finds one, and its admission error names that reason.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index c78c98d8da..c5780e7b55 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -57,7 +57,11 @@ export interface IDaemonClientConnectOptions {
  * @beta
  */
 export interface IDaemonRestartWaitDetails {
-  /** How many of the requests that the queue position counts run a rushx script. */
+  /**
+   * How many of the requests that the queue position counts run a rushx script. Without a restart reason, the
+   * request waits for that many running rushx scripts to exit before it runs, because it restarts the daemon once
+   * it ends (a native `install` or `update`), which would end them.
+   */
   readonly scriptCount?: number;
   /** The request, a rushx script, waits for another request's restart rather than its own. */
   readonly restartsForAnotherRequest?: boolean;
@@ -71,7 +75,9 @@ export interface IDaemonClientExecuteOptions {
   readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
   /**
    * Called with the request's one-based queue position whenever it changes. `restartReason` is set while the request
-   * waits for a daemon restart for that reason, and `restartWait` then says more about the wait.
+   * waits for a daemon restart for that reason, and `restartWait` then says more about the wait. Without one,
+   * `restartWait.scriptCount` is set while the request waits for rushx scripts to exit, since it restarts the daemon
+   * once it ends.
    */
   readonly onQueuePositionAsync?: (
     position: number,
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index e880561d58..fcbfb1bf8c 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -29,6 +29,9 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   may carry the `restartReason` for which the daemon restarts once the requests that the position
   counts finish, with `scriptCount`, how many of those requests run a rushx script, and
   `restartsForAnotherRequest`, set for a rushx script that waits for another request's restart.
+  A `scriptCount` without a `restartReason` says that the request waits for that many running
+  rushx scripts to exit before it runs, because it restarts the daemon once it ends (a native
+  `install` or `update`).
   `workspaceInputsChanged` names the installation files or the files of Rush and its plugins that
   changed since the daemon started, or the Rush version that the request selects. Older daemons
   omit these fields, and clients ignore reason kinds they do not know.
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index fda7815f30..246df13bed 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -37,7 +37,12 @@ export interface IDaemonRequestQueuePositionMessage {
      * unknown kinds.
      */
     readonly restartReason?: DaemonRestartReason;
-    /** Set with `restartReason` if any of the requests that `position` counts run a rushx script: how many. */
+    /**
+     * Set with `restartReason` if any of the requests that `position` counts run a rushx script: how many. Set
+     * without it while the request waits for that many running rushx scripts to exit before it runs, because it
+     * restarts the daemon once it ends (a native `install` or `update`), which would end them; `position` then
+     * counts the same scripts. Older daemons send a plain position instead.
+     */
     readonly scriptCount?: number;
     /** Set with `restartReason` for a rushx script that waits for another request's restart, not its own. */
     readonly restartsForAnotherRequest?: boolean;
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 7ac5610c79..31569de7c6 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -267,7 +267,10 @@ folder. A request that times out there, or that sets `noWait`, gets its admissio
 restart. The first request that gets the result makes the daemon exit without selecting a successor, and each
 client starts one with its own launcher. A build or graph control request that waits to restart the daemon for its
 inputs checks the installation again once those waits end, just before it would select a successor, so a change
-during them gets the same result. Embedded hosts opt in with `checkInstallation`
+during them gets the same result. So does a native `install` or `update` once its waits end, just before its worker
+starts. When the installation changes after that, while the worker runs or the successor is selected, the daemon
+exits after the mutation without selecting a successor, the mutation's output says so, and each request that is
+answered from then on gets the typed result. Embedded hosts opt in with `checkInstallation`
 (`captureDaemonInstallation`).
 The daemon log (`onLog`) gets one line for the change and one for each rejected request, with its code, its
 message and, for an unexpected `routingFailed`, the stack.
@@ -305,8 +308,10 @@ environment matching, or workspace admission. A script uses its generation only
 generation lease only until it starts: a reload that another request needs never waits for a long-running script
 such as a dev server. A restart, a native `install` or `update`, and lifecycle disposal would end a running script,
 so they still wait for every running script to exit, and a planned restart counts a script as running work until it
-exits. A script that arrives while a restart is pending waits for the restart instead of starting. The host disposes
-each old
+exits. While a request waits for them, its queue position is the number of scripts that still run, which is also its
+`scriptCount`, with the `restartReason` of a restart, or without one for a native `install` or `update`, which runs
+before its restart. A script that arrives while a restart is pending waits for the restart instead of starting.
+The host disposes each old
 resolver before replacing its session, and disposes the current resolver at shutdown; the composite must forward
 its normal disposer to its owned delegates.
 
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 6f53ed75e2..bc65ed0d87 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -106,6 +106,44 @@ class WorkspaceRequestScheduler extends RequestScheduler {
   }
 }
 
+/**
+ * Admits the rushx scripts that a daemon runs, each with a shared lease that it holds until it exits, and tells a
+ * request that waits for all of them to exit (see {@link RequestAdmissionController.waitForServedScriptsAsync}) how
+ * many still run. Its leases can only be released: they cannot be downgraded or marked preemptible.
+ */
+export class ServedScriptScheduler extends RequestScheduler {
+  readonly #listeners: Set<(runningCount: number) => void> = new Set();
+
+  public override async acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease> {
+    const lease: IRequestLease = await super.acquireAsync(options);
+    let released: boolean = false;
+    return {
+      get exclusivityClass(): RequestExclusivityClass {
+        return lease.exclusivityClass;
+      },
+      release: (): void => {
+        if (released) return;
+        released = true;
+        // Counted first: the release can admit the request that waits, which then holds a lease itself.
+        const runningCount: number = this.activeRequestCount - 1;
+        lease.release();
+        if (runningCount > 0) {
+          for (const listener of [...this.#listeners]) listener(runningCount);
+        }
+      }
+    };
+  }
+
+  /**
+   * Calls `listener` with the number of leases that are still held each time one is released while others remain,
+   * until the returned function is called.
+   */
+  public onLeaseReleased(listener: (runningCount: number) => void): () => void {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+}
+
 class QueuePositionWriter {
   readonly #abortController: AbortController;
   readonly #requestId: string;
@@ -131,21 +169,35 @@ class QueuePositionWriter {
     restartWait?: IDaemonRestartWaitDetails
   ): void {
     const { scriptCount, restartsForAnotherRequest } = restartWait ?? {};
+    this.#enqueuePayload({
+      position,
+      requestId: this.#requestId,
+      ...(restartReason && {
+        restartReason,
+        ...(scriptCount ? { scriptCount } : undefined),
+        ...(restartsForAnotherRequest && { restartsForAnotherRequest })
+      })
+    });
+  }
+
+  /**
+   * Reports a wait for the rushx scripts that the daemon runs to exit, as a position that counts them. With a
+   * `restartReason`, the daemon then restarts for it. Without one, the request runs once they exit, and then restarts
+   * the daemon, as a native install or update does. A request that waits for no script reports nothing.
+   */
+  public enqueueScriptWait(scriptCount: number, restartReason: DaemonRestartReason | undefined): void {
+    if (scriptCount < 1) return;
+    this.#enqueuePayload({
+      position: scriptCount,
+      requestId: this.#requestId,
+      ...(restartReason && { restartReason }),
+      scriptCount
+    });
+  }
+
+  #enqueuePayload(payload: IDaemonRequestQueuePositionMessage['payload']): void {
     this.#tail = this.#tail
-      .then(() =>
-        this.#writeQueuePositionAsync({
-          kind: 'queuePosition',
-          payload: {
-            position,
-            requestId: this.#requestId,
-            ...(restartReason && {
-              restartReason,
-              ...(scriptCount ? { scriptCount } : undefined),
-              ...(restartsForAnotherRequest && { restartsForAnotherRequest })
-            })
-          }
-        })
-      )
+      .then(() => this.#writeQueuePositionAsync({ kind: 'queuePosition', payload }))
       .catch((error: unknown) => {
         this.#failure ??= error;
         this.#abortController.abort(error);
@@ -160,6 +212,12 @@ class QueuePositionWriter {
   }
 }
 
+/** Reports a request's queue position in a scheduler's queue to its client. */
+type ReportQueuePosition = (writer: QueuePositionWriter, position: number) => void;
+
+const reportQueuePosition: ReportQueuePosition = (writer: QueuePositionWriter, position: number) =>
+  writer.enqueue(position);
+
 /**
  * Reports whether a request that other requests wait behind is doing work on their behalf, such as loading the
  * workspace graph that they need.
@@ -351,10 +409,45 @@ export class RequestAdmissionController {
       'the running requests to finish before the daemon restarts ' +
         (formatDaemonRestartCause(restartReason, 'thisRequest') ?? 'for its environment'),
       this.#abortController.signal,
-      restartReason
+      (writer: QueuePositionWriter, position: number) => writer.enqueue(position, restartReason)
     );
   }
 
+  /**
+   * Waits until none of the rushx scripts that `scripts` admits still runs, for a request that holds the workspace's
+   * exclusive gate, so that no script can start meanwhile. What comes next would end them with this process: the
+   * daemon restarts for `restartReason`, or without one, the request runs and then restarts the daemon, as a native
+   * install or update does.
+   *
+   * @remarks
+   * Queue positions count the scripts that still run (`scriptCount`), and carry `restartReason`, so that the client
+   * can say what the request waits for, and why. The request's remaining admission budget applies, since a script
+   * may not exit until it is stopped, and a timeout names what the request waited for.
+   */
+  public async waitForServedScriptsAsync(
+    scripts: ServedScriptScheduler,
+    restartReason: DaemonRestartReason | undefined
+  ): Promise<void> {
+    const cause: string | undefined = restartReason && formatDaemonRestartCause(restartReason, 'thisRequest');
+    const unsubscribe: () => void = scripts.onLeaseReleased((runningCount: number) =>
+      this.#writer?.enqueueScriptWait(runningCount, restartReason)
+    );
+    try {
+      const lease: IRequestLease = await this.#acquireAsync(
+        scripts,
+        RequestExclusivityClass.Exclusive,
+        this.#remainingMs,
+        `a rushx script that this daemon runs to exit${cause ? `, before the daemon restarts ${cause}` : ''}`,
+        this.#abortController.signal,
+        // Until it is admitted, the request does not hold a lease itself.
+        (writer: QueuePositionWriter) => writer.enqueueScriptWait(scripts.activeRequestCount, restartReason)
+      );
+      lease.release();
+    } finally {
+      unsubscribe();
+    }
+  }
+
   /**
    * Waits for shared-build workspace admission while another request loads or reloads the workspace graph.
    *
@@ -431,7 +524,7 @@ export class RequestAdmissionController {
     waitTimeoutMs: number | undefined,
     waitingFor: string,
     abortSignal: AbortSignal = this.#abortController.signal,
-    restartReason?: DaemonRestartReason
+    reportPosition: ReportQueuePosition = reportQueuePosition
   ): Promise<IRequestLease> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
@@ -441,9 +534,7 @@ export class RequestAdmissionController {
         abortSignal,
         exclusivityClass,
         noWait: this.#admission?.noWait,
-        onQueuePositionChanged: writer
-          ? (position: number) => writer.enqueue(position, restartReason)
-          : undefined,
+        onQueuePositionChanged: writer ? (position: number) => reportPosition(writer, position) : undefined,
         waitTimeoutMs
       });
       await writer?.flushAsync();
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 56916de718..39595a5be4 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -48,6 +48,7 @@ import {
 import {
   AdmissionProgress,
   RequestAdmissionController,
+  ServedScriptScheduler,
   getRequestAdmissionErrorCode,
   getWorkspaceRequestScheduler
 } from './WorkspaceRequestAdmission';
@@ -162,7 +163,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
    * would end the script with this process (a restart, a native mutation, disposal) waits for this lease after
    * taking `#gate` exclusively, when no other script can start.
    */
-  readonly #scripts: RequestScheduler = new RequestScheduler();
+  readonly #scripts: ServedScriptScheduler = new ServedScriptScheduler();
   readonly #restartArbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   readonly #abortController: AbortController = new AbortController();
   readonly #observers: Set<AbortController> = new Set();
@@ -531,13 +532,18 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           const current: IWorkspaceInputFingerprint = await this.#captureAsync(session, controlEnvelope);
           const currentTier: WorkspaceInputChangeTier = this.#classify(current, false);
           if (currentTier === WorkspaceInputChangeTier.Restart) {
+            const restartReason: DaemonRestartReason = this.#getRestartReason(
+              current,
+              controlEnvelope.environment,
+              false
+            );
             lease.release();
             if (ticket) {
               // Like build requests, a graph-control restart must not preempt requests this process can serve.
               const drained: boolean = await admission.waitForRestartDrainAsync(
                 this.#restartArbiter,
                 ticket,
-                this.#getRestartReason(current, controlEnvelope.environment, false),
+                restartReason,
                 this.#createRestartRecheck(session, controlEnvelope, current, false)
               );
               if (this.#restartPending) throw new RestartPendingBeforeExecution();
@@ -545,7 +551,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
-            await this.#waitForServedScriptsAsync(admission);
+            await this.#waitForServedScriptsAsync(admission, restartReason);
             session = await this.#options.provider.getSessionAsync();
             await this.#quiesceWarmSetAsync(session);
             const workspaceLease: IRequestLease = await admission.acquireAsync(
@@ -675,7 +681,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       fingerprint = await this.#captureAsync(session, envelope);
       tier = this.#classify(fingerprint, isMutation(envelope));
       if (tier === WorkspaceInputChangeTier.Restart) {
-        await this.#waitForServedScriptsAsync(admission);
+        await this.#waitForServedScriptsAsync(
+          admission,
+          this.#getRestartReason(fingerprint, envelope.environment, isMutation(envelope))
+        );
         await this.#quiesceWarmSetAsync(session);
         const workspaceLease: IRequestLease = await admission.acquireAsync(
           getWorkspaceRequestScheduler(session),
@@ -704,8 +713,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             'Native mutations require a successor launcher. No worker was started.'
           );
         }
-        await this.#waitForServedScriptsAsync(admission);
+        await this.#waitForServedScriptsAsync(admission, undefined);
         await this.#quiesceWarmSetAsync(session);
+        // After every wait, as before them: a daemon whose installation changed would run the worker from, and select
+        // the successor with, code that is gone or replaced.
+        this.#throwIfInstallationChanged();
         return {
           session,
           resolver: this.#resolver,
@@ -857,19 +869,18 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   /**
    * Waits, while holding `#gate` exclusively, until no served rushx script is running; none can start meanwhile.
-   * This is contention, not graph-load progress, so requests queued behind it spend their wait timeouts.
+   * This is contention, not graph-load progress, so requests queued behind it spend their wait timeouts. The client
+   * learns how many scripts still run and, with `restartReason`, why the daemon then restarts; without one, the
+   * request is a native mutation, which runs once they exit and then restarts the daemon.
    */
-  async #waitForServedScriptsAsync(admission: RequestAdmissionController): Promise<void> {
+  async #waitForServedScriptsAsync(
+    admission: RequestAdmissionController,
+    restartReason: DaemonRestartReason | undefined
+  ): Promise<void> {
     const loading: boolean = this.#transitionProgress.active;
     this.#transitionProgress.setActive(false);
     try {
-      (
-        await admission.acquireAsync(
-          this.#scripts,
-          RequestExclusivityClass.Exclusive,
-          'a rushx script that this daemon runs to exit'
-        )
-      ).release();
+      await admission.waitForServedScriptsAsync(this.#scripts, restartReason);
     } finally {
       this.#transitionProgress.setActive(loading);
     }
@@ -1091,26 +1102,44 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     dispatchAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
     let restart: IWorkspaceProcessRestartPlan | undefined;
+    let installationChange: IDaemonInstallationChange | undefined;
+    const planWithoutSuccessor = (
+      reason: IWorkspaceProcessRestartPlan['reason'],
+      failure: Error | undefined
+    ): IWorkspaceProcessRestartPlan => ({
+      repoRoot: generation.session.metadata.repoRoot,
+      rushVersion: generation.fingerprint.selectedRushVersion,
+      environment: Object.freeze({ ...envelope.environment }),
+      reason,
+      launch: undefined,
+      failure
+    });
     const prepareRestartAsync: () => Promise<void> = async () => {
       try {
-        restart = await this.#restartPlanAsync(generation.session, envelope, 'native-mutation');
+        // A daemon whose installation changed selects no successor, which would run code that is gone or replaced.
+        if (!this.#detectInstallationChange())
+          restart = await this.#restartPlanAsync(generation.session, envelope, 'native-mutation');
       } catch (error) {
-        restart = {
-          repoRoot: generation.session.metadata.repoRoot,
-          rushVersion: generation.fingerprint.selectedRushVersion,
-          environment: Object.freeze({ ...envelope.environment }),
-          reason: 'native-mutation',
-          launch: undefined,
-          failure: error instanceof Error ? error : new Error(String(error))
-        };
+        restart = planWithoutSuccessor(
+          'native-mutation',
+          error instanceof Error ? error : new Error(String(error))
+        );
       }
+      // Also when it changed while the successor was selected, or made that fail: each client starts one instead.
+      installationChange = this.#detectInstallationChange();
+      if (installationChange) restart = planWithoutSuccessor('installation-changed', undefined);
     };
     const resolver: IDaemonRequestResolver = createNativeMutationResolver(
       envelope,
       generation.fingerprint.selectedRushVersion,
       async (context) => {
         await prepareRestartAsync();
-        if (restart?.failure)
+        if (installationChange)
+          context.terminal.writeWarningLine(
+            `The daemon's installation at ${installationChange.folder} was ${installationChange.change}, so the ` +
+              'daemon exits after this command without starting a new one; the next command starts one.'
+          );
+        else if (restart?.failure)
           context.terminal.writeErrorLine(
             `Mutation completed, but successor startup is unavailable: ${restart.failure.message}`
           );
@@ -1134,6 +1163,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         if (!state.resultDrained) {
           restart = {
             ...restart!,
+            // Unlike a changed installation, this is a failure that the host reports.
+            reason: 'native-mutation',
             launch: undefined,
             failure: new Error(
               'Mutation result could not be drained; stopping without an automatic successor.'
@@ -1142,7 +1173,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         }
         this.#lastReloadTier = WorkspaceInputChangeTier.Restart;
         this.#closing = true;
-        this.#restartPending = restart!.launch !== undefined && restart!.failure === undefined;
+        // Requests that are answered from now on retry on the successor, or on the daemon that their client starts.
+        this.#restartPending =
+          restart!.failure === undefined &&
+          (restart!.launch !== undefined || restart!.reason === 'installation-changed');
         generation.session.retire?.();
         this.#options.onRestartRequested(restart!);
       }
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
index e1c59c7438..27d8ce6a66 100644
--- a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type * as childProcess from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -9,6 +10,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import {
   DaemonFrameType,
   decodeDaemonControlMessage,
+  decodeDaemonLogChunk,
   type DaemonControlMessage,
   type IDaemonCommandResult,
   type IDaemonFrame,
@@ -18,7 +20,13 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import { captureDaemonInstallation, type CheckDaemonInstallation } from '../DaemonInstallationMonitor';
-import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import type { RushDaemonHost } from '../RushDaemonHost';
+import {
+  getInstalledWorkspaceSuccessorLaunchAsync,
+  type GetWorkspaceSuccessorLaunchAsync
+} from '../WorkspaceProcessRestart';
+import { WorkspaceRequestLifecycle } from '../WorkspaceRequestLifecycle';
 import type { WorkspaceSession } from '../WorkspaceSession';
 import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import {
@@ -513,6 +521,202 @@ describe('a daemon whose installation changed', () => {
   });
 });
 
+describe('a native install or update in a daemon whose installation changes', () => {
+  const current: { change?: IDaemonInstallationChange } = {};
+  let installation: IInstallation;
+  let fixture: DaemonGraphTestFixture;
+  let launcher: jest.MockedFunction<GetWorkspaceSuccessorLaunchAsync>;
+  let workerSpawns: number;
+  /** Called as the native mutation worker is spawned, after the request's last check before it runs. */
+  let onWorkerSpawn: () => void;
+
+  beforeEach(async () => {
+    installation = createInstallation();
+    current.change = undefined;
+    workerSpawns = 0;
+    onWorkerSpawn = () => undefined;
+    // A mutation requires a successor launcher. This one never starts a daemon, even for code that selects one.
+    launcher = jest.fn<
+      ReturnType<GetWorkspaceSuccessorLaunchAsync>,
+      Parameters<GetWorkspaceSuccessorLaunchAsync>
+    >(() => Promise.reject(new Error('No successor was expected.')));
+    const nativeChildProcess: typeof childProcess = jest.requireActual('node:child_process');
+    const spawn: typeof childProcess.spawn = nativeChildProcess.spawn;
+    jest.spyOn(nativeChildProcess, 'spawn').mockImplementation(((
+      ...args: Parameters<typeof childProcess.spawn>
+    ) => {
+      if (args[1]?.some((arg: string) => arg.endsWith(`${path.sep}NativeMutationWorker.js`))) {
+        workerSpawns++;
+        onWorkerSpawn();
+      }
+      return spawn(...args);
+    }) as typeof childProcess.spawn);
+    fixture = await DaemonGraphTestFixture.createAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.checkInstallation = () => current.change;
+      created.getSuccessorLaunchAsync = launcher;
+    });
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted.catch(() => undefined);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+      fs.rmSync(installation.root, { recursive: true, force: true });
+    }
+  });
+
+  function changeInstallation(): void {
+    current.change ??= { change: 'replaced', folder: installation.folder };
+  }
+
+  function stderrText(exchange: ITerminalExchange): string {
+    return exchange.frames
+      .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.logStderr)
+      .map((frame: IDaemonFrame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
+      .join('');
+  }
+
+  const installationChangedResult: () => object = () => ({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      retryAfterRestart: true,
+      restartReason: { kind: 'installationChanged', change: 'replaced', folder: installation.folder }
+    }
+  });
+
+  const exitWithoutSuccessorLine: () => string = () =>
+    `The daemon's installation at ${installation.folder} was replaced, so the daemon exits after this command ` +
+    'without starting a new one; the next command starts one.';
+
+  it('answers an install whose waits end after the change with the restart, and runs no worker', async () => {
+    await fixture.buildSuccessfullyAsync();
+    // The installation changes while the install waits for the warm set to stop, after its earlier checks.
+    const session: WorkspaceSession = fixture.session;
+    const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+    jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementation(async () => {
+      changeInstallation();
+      await quiesceAsync();
+    });
+
+    // --help runs the real worker, which would install nothing.
+    const { terminal } = await fixture.runAsync(['install', '--help']);
+    expect(terminal).toMatchObject(installationChangedResult());
+    expect(workerSpawns).toBe(0);
+    expect(launcher).not.toHaveBeenCalled();
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    await fixture.host.closed;
+    expect(fixture.logs).toEqual([
+      `rushd: the installation at ${installation.folder} was replaced; exiting once running requests finish, ` +
+        'so that the next client starts a new daemon',
+      INSTALLATION_CHANGED_SHUTDOWN
+    ]);
+  });
+
+  it('exits without selecting a successor when the installation changes while the worker runs, and says why', async () => {
+    onWorkerSpawn = changeInstallation;
+
+    const exchange: ITerminalExchange = await fixture.runAsync(['install', '--help']);
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    expect(exchange.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(workerSpawns).toBe(1);
+    const stderr: string = stderrText(exchange);
+    expect(stderr).toContain(exitWithoutSuccessorLine());
+    expect(stderr).not.toContain('Mutation completed');
+    // The successor would run code that is gone or replaced.
+    expect(launcher).not.toHaveBeenCalled();
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+  });
+
+  it('reports an install result that could not be delivered as a failure, even though the installation changed', async () => {
+    onWorkerSpawn = changeInstallation;
+    const warnings: unknown[] = [];
+    jest.spyOn(process, 'emitWarning').mockImplementation((warning) => {
+      warnings.push(warning);
+    });
+    // The result is lost, as it is when the client's connection fails while the worker runs.
+    jest
+      .spyOn(DaemonWireRequestClient.prototype, 'writeResultAsync')
+      .mockRejectedValueOnce(new Error('The connection to the client failed.'));
+
+    const { terminal } = await fixture.runAsync(['install', '--help']);
+    // The session answers a request whose result was not delivered with a rejection.
+    expect(terminal.kind).toBe('requestRejected');
+    expect(workerSpawns).toBe(1);
+    const undrained: string =
+      'Mutation result could not be drained; stopping without an automatic successor.';
+    // Unlike the change on its own, which the host does not report, this is a failure that it reports.
+    await expect(fixture.host.restartCompleted).rejects.toThrow(undrained);
+    expect(warnings).toContainEqual(expect.objectContaining({ message: undrained }));
+    expect(launcher).not.toHaveBeenCalled();
+  });
+
+  it('exits without a successor when the installation changes while the successor is selected', async () => {
+    launcher.mockImplementation(async () => {
+      changeInstallation();
+      // The launcher could not load a module that the change removed.
+      throw new Error("Cannot find module 'successor'");
+    });
+
+    const exchange: ITerminalExchange = await fixture.runAsync(['install', '--help']);
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    const stderr: string = stderrText(exchange);
+    expect(stderr).toContain(exitWithoutSuccessorLine());
+    expect(stderr).not.toContain('Mutation completed');
+    expect(launcher).toHaveBeenCalledTimes(1);
+    // The host reports no failure, since each client starts a daemon with its own launcher.
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+  });
+
+  it('answers a request that reaches the lifecycle after the install finished with the restart', async () => {
+    onWorkerSpawn = changeInstallation;
+    // The later request is held where it enters the lifecycle until the daemon starts to exit.
+    const late: IDaemonRequestEnvelope = fixture.envelope(BUILD_B);
+    const lateEntered: IDeferred<void> = createDeferred<void>();
+    const releaseLate: IDeferred<void> = createDeferred<void>();
+    const dispatchAsync: WorkspaceRequestLifecycle['dispatchAsync'] =
+      WorkspaceRequestLifecycle.prototype.dispatchAsync;
+    jest.spyOn(WorkspaceRequestLifecycle.prototype, 'dispatchAsync').mockImplementation(async function (
+      this: WorkspaceRequestLifecycle,
+      ...args: Parameters<WorkspaceRequestLifecycle['dispatchAsync']>
+    ) {
+      if (args[0].requestId === late.requestId) {
+        lateEntered.resolve();
+        await releaseLate.promise;
+      }
+      return await dispatchAsync.apply(this, args);
+    });
+    const closeAsync: RushDaemonHost['closeAsync'] = fixture.host.closeAsync.bind(fixture.host);
+    jest.spyOn(fixture.host, 'closeAsync').mockImplementation((reason) => {
+      releaseLate.resolve();
+      return closeAsync(reason);
+    });
+
+    const client: DaemonRequestWireClient = await fixture.connectAsync();
+    try {
+      await client.sendControlAsync({ kind: 'requestStart', payload: late });
+      await lateEntered.promise;
+      const install: ITerminalExchange = await fixture.runAsync(['install', '--help']);
+      expect(install.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(stderrText(install)).toContain(exitWithoutSuccessorLine());
+
+      expect((await client.readTerminalAsync(late.requestId)).terminal).toMatchObject(
+        installationChangedResult()
+      );
+    } finally {
+      releaseLate.resolve();
+      await client.closeAsync();
+    }
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+    expect(launcher).not.toHaveBeenCalled();
+    expect(fixture.runs()).toEqual([]);
+  });
+});
+
 it('logs each rejected request, with the stack of an unexpected failure', async () => {
   const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
   try {
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
index d88b99799f..ace4785540 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -2,7 +2,9 @@
 // See LICENSE in the project root for license information.
 
 import {
+  type DaemonRestartReason,
   type IDaemonRequestAdmissionOptions,
+  type IDaemonRequestQueuePositionMessage,
   MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS
 } from '@rushstack/rush-daemon-protocol';
 
@@ -15,7 +17,8 @@ import {
 import {
   AdmissionProgress,
   freezeDaemonRequestAdmissionOptions,
-  RequestAdmissionController
+  RequestAdmissionController,
+  ServedScriptScheduler
 } from '../WorkspaceRequestAdmission';
 
 const DEFAULT_BUDGET: IDaemonRequestAdmissionOptions = { waitTimeoutMs: 100, waitTimeoutIsDefault: true };
@@ -342,4 +345,51 @@ describe(RequestAdmissionController.name, () => {
     boundary.dispose();
     controller.dispose();
   });
+
+  it('reports no more running scripts to a request once its wait for them has ended (task 189)', async () => {
+    const scripts: ServedScriptScheduler = new ServedScriptScheduler();
+    const [first, second, third]: IRequestLease[] = [
+      await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild }),
+      await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild }),
+      await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild })
+    ];
+    const restartReason: DaemonRestartReason = {
+      kind: 'workspaceInputsChanged',
+      installationFiles: ['common/config/rush/pnpm-lock.yaml']
+    };
+    const positions: IDaemonRequestQueuePositionMessage['payload'][] = [];
+    const controller: RequestAdmissionController = new RequestAdmissionController({
+      admission: EXPLICIT_BUDGET,
+      client: {
+        abortSignal: new AbortController().signal,
+        supportsRequestAdmission: true,
+        writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+          positions.push(message.payload);
+        }
+      },
+      requestId: 'request'
+    });
+    const waitingFor = (scriptCount: number): IDaemonRequestQueuePositionMessage['payload'] => ({
+      position: scriptCount,
+      requestId: 'request',
+      restartReason,
+      scriptCount
+    });
+
+    const waiting: Promise<void> = controller.waitForServedScriptsAsync(scripts, restartReason);
+    const ended: Promise<unknown> = waiting.catch((error: unknown) => error);
+    await jest.advanceTimersByTimeAsync(0);
+    third.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(positions).toEqual([waitingFor(3), waitingFor(2)]);
+
+    await jest.advanceTimersByTimeAsync(100);
+    expect(await ended).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    // A script that exits after the wait timed out, while another still runs, is not reported to the request.
+    second.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(positions).toEqual([waitingFor(3), waitingFor(2)]);
+    first.release();
+    controller.dispose();
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index e74a9101cb..c153554603 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -30,6 +30,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import { DaemonGraphTestFixture, responseSnapshot, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
 import { pongAsync, setDaemonPolicy } from './WarmGenerationTestUtilities';
@@ -100,10 +101,13 @@ interface IServedScript {
   readonly settled: () => boolean;
 }
 
-async function serveAsync(fixture: DaemonGraphTestFixture): Promise<IServedScript> {
+async function serveAsync(
+  fixture: DaemonGraphTestFixture,
+  script: 'serve' | 'serve2' = 'serve'
+): Promise<IServedScript> {
   let settled: boolean = false;
   const exchange: Promise<ITerminalExchange> = fixture
-    .runAsync(['serve'], {
+    .runAsync([script], {
       commandOrigin: 'custom',
       invocationKind: 'rushx',
       cwd: path.join(fixture.folder, 'a')
@@ -111,7 +115,10 @@ async function serveAsync(fixture: DaemonGraphTestFixture): Promise<IServedScrip
     .finally(() => {
       settled = true;
     });
-  await waitForAsync(() => fixture.runs().includes('serve-start') || settled, 'the served script to start');
+  await waitForAsync(
+    () => fixture.runs().includes(`${script}-start`) || settled,
+    'the served script to start'
+  );
   expect(settled).toBe(false);
   return { exchange, settled: () => settled };
 }
@@ -226,10 +233,10 @@ describe('workspace admission while a served rushx script runs', () => {
       expectSuccess(await fixture.runAsync(BUILD_A));
       const script: IServedScript = await serveAsync(fixture);
 
-      const install: ITerminalExchange = await fixture.runAsync(['install'], {
+      const install: IStreamedRequest = await startRequestAsync(fixture, ['install'], {
         admission: { waitTimeoutMs: 500 }
       });
-      expect(install.terminal).toMatchObject({
+      expect((await install.exchange).terminal).toMatchObject({
         kind: 'requestResult',
         payload: {
           exitCode: 1,
@@ -239,6 +246,10 @@ describe('workspace admission while a served rushx script runs', () => {
           )
         }
       });
+      // The install runs once the script exits, and then restarts the daemon, so its client names no reason.
+      expect(install.positionPayloads).toEqual([
+        { position: 1, requestId: install.requestId, scriptCount: 1 }
+      ]);
       expect(script.settled()).toBe(false);
 
       fixture.write(RELEASE_FILE, '');
@@ -853,4 +864,153 @@ describe('the reason for a restart that waits for a served rushx script', () =>
       }
     }
   );
+
+  const INSTALLATION_FILE_CHANGED: DaemonRestartReason = {
+    kind: 'workspaceInputsChanged',
+    installationFiles: ['common/config/rush/npm-shrinkwrap.json']
+  };
+
+  /**
+   * Changes an installation file once the next capture of the workspace inputs has read them. A build that needs a
+   * reload then finds that it needs a restart only when it captures them again, while it holds the workspace
+   * exclusively, so that it waits for the served scripts there rather than in the restart drain.
+   */
+  function changeInstallationAfterNextCapture(fixture: DaemonGraphTestFixture): void {
+    changeProjectConfiguration(fixture);
+    inputCaptureMock.mockImplementationOnce(async (options) => {
+      const fingerprint: IWorkspaceInputFingerprint = await actualCaptureAsync(options);
+      changeInstallation(fixture);
+      return fingerprint;
+    });
+  }
+
+  it('names the restart in the queue positions and the admission error of a build that finds it late', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The build is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeInstallationAfterNextCapture(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 1500 }
+      });
+      const { terminal } = await build.exchange;
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+        'within its 1500ms wait timeout while waiting for a rushx script that this daemon runs to exit, before ' +
+          'the daemon restarts because common/config/rush/npm-shrinkwrap.json changed.'
+      );
+      expect(build.positionPayloads).toEqual([
+        { position: 1, requestId: build.requestId, restartReason: INSTALLATION_FILE_CHANGED, scriptCount: 1 }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('names the restart in the script wait of a graph control request as well', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      // The request is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    // The restart drain before this wait waits for every served script, so the request finds one only if the drain
+    // did not wait for it. Skipping the drain isolates the wait for the scripts.
+    const drain: jest.SpiedFunction<RequestAdmissionController['waitForRestartDrainAsync']> = jest
+      .spyOn(RequestAdmissionController.prototype, 'waitForRestartDrainAsync')
+      .mockResolvedValue(true);
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+
+      changeInstallation(fixture);
+      const pause: IStreamedRequest = await startRequestAsync(fixture, ['daemon', 'graph', 'pause'], {
+        admission: { waitTimeoutMs: 1500 }
+      });
+      const { terminal } = await pause.exchange;
+      expect(drain).toHaveBeenCalledTimes(1);
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+        'within its 1500ms wait timeout while waiting for a rushx script that this daemon runs to exit, before ' +
+          'the daemon restarts because common/config/rush/npm-shrinkwrap.json changed.'
+      );
+      expect(pause.positionPayloads).toEqual([
+        { position: 1, requestId: pause.requestId, restartReason: INSTALLATION_FILE_CHANGED, scriptCount: 1 }
+      ]);
+      expect(script.settled()).toBe(false);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+    } finally {
+      drain.mockRestore();
+      fixture.write(RELEASE_FILE, '');
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('counts down the scripts that such a build waits for, and restarts once the last one exits', async () => {
+    const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+      setDaemonPolicy(created, {});
+      created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    });
+    try {
+      const before = await pongAsync(fixture);
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const script: IServedScript = await serveAsync(fixture);
+      const script2: IServedScript = await serveAsync(fixture, 'serve2');
+
+      changeInstallationAfterNextCapture(fixture);
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 20_000 }
+      });
+      const waitingFor = (scriptCount: number): IDaemonRequestQueuePositionMessage['payload'] => ({
+        position: scriptCount,
+        requestId: build.requestId,
+        restartReason: INSTALLATION_FILE_CHANGED,
+        scriptCount
+      });
+      await waitForAsync(
+        () => build.positionPayloads.length > 0 || build.settled(),
+        'the build to wait for the scripts'
+      );
+      expect(build.positionPayloads).toEqual([waitingFor(2)]);
+
+      fixture.write(RELEASE_FILE, '');
+      expectSuccess(await script.exchange);
+      await waitForAsync(
+        () => build.positionPayloads.length > 1 || build.settled(),
+        'the build to learn that a script exited'
+      );
+      expect(build.positionPayloads).toEqual([waitingFor(2), waitingFor(1)]);
+      expect(build.settled()).toBe(false);
+
+      fixture.write(LATE_RELEASE_FILE, '');
+      expectSuccess(await script2.exchange);
+      expect((await build.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, retryAfterRestart: true }
+      });
+      // The last script to exit admitted the build, which then waited for no script.
+      expect(build.positionPayloads).toEqual([waitingFor(2), waitingFor(1)]);
+      const restarted = await fixture.host.restartCompleted;
+      expect(restarted?.pid).not.toBe(before.pid);
+    } finally {
+      fixture.write(RELEASE_FILE, '');
+      fixture.write(LATE_RELEASE_FILE, '');
+      await closeRestartingFixtureAsync(fixture);
+    }
+  });
 });

From 66eaac4980441661a51cb305fe367e45e331a095 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:03 +0000
Subject: [PATCH 154/265] [rush-client-core] Leave the warm set out of the
 reply to the liveness check's ping

Swarm integration step 139; original commit d86d223354 (merge of swarm/r05-t232-int at df7f04af6d).
Scope: task 232.

Brings 232-int (branch swarm/r05-t232-int). Second agent: t02 board 4792. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 4 of 19. Gate: ch01 GATE OK board 5319 (tree fafcee70d6)

Commits folded into this step (2):
- 575611d655 [rush-daemon] Let a ping leave the warm set out of its pong
- df7f04af6d [rush-client-core] Leave the warm set out of the reply to the liveness check's ping

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/GraphRequestContext.ts                |   2 +
 apps/rush-cli-client/src/launchClient.ts      |   2 +
 .../src/test/omitWarmSetStatus.test.ts        | 104 ++++++++++++++++++
 .../ping-omit-warm-set_2026-09-29-09-10.json  |  11 ++
 ...s-ping-omit-warm-set_2026-09-29-10-20.json |  11 ++
 .../ping-omit-warm-set_2026-09-29-09-10.json  |  11 ++
 .../ping-omit-warm-set_2026-09-29-09-10.json  |  11 ++
 .../ping-omit-warm-set_2026-09-29-09-10.json  |  11 ++
 common/reviews/api/rush-client-core.api.md    |   1 +
 .../reviews/api/rush-daemon-protocol.api.md   |   7 +-
 libraries/rush-client-core/README.md          |   3 +-
 .../rush-client-core/src/DaemonClient.ts      |  28 +++--
 .../src/test/DaemonClient.test.ts             |  30 +++++
 .../src/ControlMessageValidation.ts           |   7 +-
 .../src/DaemonControlMessage.ts               |   4 +-
 .../src/DaemonPongMessage.ts                  |  10 ++
 .../src/DaemonWorkspaceStatus.ts              |   5 +-
 libraries/rush-daemon-protocol/src/index.ts   |   2 +-
 .../src/test/PingPayload.test.ts              |  23 ++++
 .../rush-daemon/src/DaemonControlSession.ts   |   9 +-
 libraries/rush-daemon/src/RushDaemonHost.ts   |   4 +-
 libraries/rush-daemon/src/WorkspaceStatus.ts  |  10 +-
 .../src/test/WarmGenerationTestUtilities.ts   |  19 +++-
 .../src/test/WorkspaceWarmGeneration.test.ts  |  32 ++++++
 24 files changed, 329 insertions(+), 28 deletions(-)
 create mode 100644 apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/ping-omit-warm-set_2026-09-29-09-10.json
 create mode 100644 common/changes/@rushstack/rush-client-core/liveness-ping-omit-warm-set_2026-09-29-10-20.json
 create mode 100644 common/changes/@rushstack/rush-client-core/ping-omit-warm-set_2026-09-29-09-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/ping-omit-warm-set_2026-09-29-09-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/ping-omit-warm-set_2026-09-29-09-10.json
 create mode 100644 libraries/rush-daemon-protocol/src/test/PingPayload.test.ts

diff --git a/apps/rush-cli-client/src/GraphRequestContext.ts b/apps/rush-cli-client/src/GraphRequestContext.ts
index 6dc196e858..55bedd3049 100644
--- a/apps/rush-cli-client/src/GraphRequestContext.ts
+++ b/apps/rush-cli-client/src/GraphRequestContext.ts
@@ -39,6 +39,8 @@ export class GraphRequestContext implements Disposable {
     try {
       client = await DaemonClient.connectAsync({
         ...options,
+        // A graph request never reports the warm set.
+        omitWarmSetStatus: true,
         timeoutMs: remaining ? Math.min(remaining, options.timeoutMs ?? 5000) : options.timeoutMs
       });
     } catch (error) {
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 78a8aa8538..2b20d041f1 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -168,6 +168,8 @@ export async function launchClientAsync(
         request.environment,
         config.autoStart
       )),
+      // A request never reports the warm set, which in a large repo is most of the daemon's ready reply.
+      omitWarmSetStatus: true,
       capabilities: {
         isTTY: request.terminal.isTTY,
         columns: request.terminal.columns,
diff --git a/apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts b/apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts
new file mode 100644
index 0000000000..1072007d87
--- /dev/null
+++ b/apps/rush-cli-client/src/test/omitWarmSetStatus.test.ts
@@ -0,0 +1,104 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { GraphRequestContext } from '../GraphRequestContext';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+describe('omitWarmSetStatus', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  const client: DaemonClient = {
+    closeAsync: async () => undefined,
+    status: Promise.resolve({ pid: process.pid })
+  } as unknown as DaemonClient;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-warm-set-status-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue(client);
+    jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (daemon, connection, options) => ({
+      kind: 'result',
+      result: { requestId: options.request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+    }));
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('is set by a command, both when it connects and when it reconnects to a restarted daemon', async () => {
+    await launchClientAsync(false);
+    expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledTimes(1);
+    expect(connectOrAwaitDaemonStartupAsync).toHaveBeenCalledWith(
+      expect.objectContaining({ omitWarmSetStatus: true })
+    );
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledWith(
+      client,
+      expect.objectContaining({ omitWarmSetStatus: true }),
+      expect.anything()
+    );
+  });
+
+  it('is set by a graph request', async () => {
+    const connect = jest.spyOn(DaemonClient, 'connectAsync').mockResolvedValue(client);
+    const context: GraphRequestContext = new GraphRequestContext({});
+    try {
+      expect(await context.connectAsync({ socketPath: 'socket' })).toBe(client);
+    } finally {
+      context[Symbol.dispose]();
+    }
+    expect(connect).toHaveBeenCalledWith(
+      expect.objectContaining({ socketPath: 'socket', omitWarmSetStatus: true })
+    );
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/ping-omit-warm-set_2026-09-29-09-10.json b/common/changes/@rushstack/rush-cli-client/ping-omit-warm-set_2026-09-29-09-10.json
new file mode 100644
index 0000000000..9ea12db4de
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/ping-omit-warm-set_2026-09-29-09-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Commands and graph requests ask the daemon to leave the warm set out of the reply that proves it ready. In a repo with 1,823 projects, that reply was 232 KB. `rush-client daemon status`, `start` and `restart` still print the warm set.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/liveness-ping-omit-warm-set_2026-09-29-10-20.json b/common/changes/@rushstack/rush-client-core/liveness-ping-omit-warm-set_2026-09-29-10-20.json
new file mode 100644
index 0000000000..0e4319fe97
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/liveness-ping-omit-warm-set_2026-09-29-10-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "The liveness check's ping asks the daemon to leave the warm set out of its reply.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/ping-omit-warm-set_2026-09-29-09-10.json b/common/changes/@rushstack/rush-client-core/ping-omit-warm-set_2026-09-29-09-10.json
new file mode 100644
index 0000000000..68d058d363
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/ping-omit-warm-set_2026-09-29-09-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `IDaemonClientConnectOptions.omitWarmSetStatus`, which asks the daemon to leave the warm set out of `DaemonClient.status`. Older daemons ignore it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/ping-omit-warm-set_2026-09-29-09-10.json b/common/changes/@rushstack/rush-daemon-protocol/ping-omit-warm-set_2026-09-29-09-10.json
new file mode 100644
index 0000000000..8bd624c39a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/ping-omit-warm-set_2026-09-29-09-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add `IDaemonPingPayload`, whose optional `omitWarmSet` asks the daemon to leave `workspace.warmSet` out of its pong. A daemon rejects a ping whose `omitWarmSet` is not a boolean.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/ping-omit-warm-set_2026-09-29-09-10.json b/common/changes/@rushstack/rush-daemon/ping-omit-warm-set_2026-09-29-09-10.json
new file mode 100644
index 0000000000..0819a6454a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/ping-omit-warm-set_2026-09-29-09-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A pong answers a ping that sets `omitWarmSet` without the warm set, which the daemon then does not read.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 41f3fb9c97..e6df04fe86 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -139,6 +139,7 @@ export interface IDaemonClientConnectOptions {
     readonly capabilities?: IDaemonClientCaps;
     // (undocumented)
     readonly expectedDaemonVersion?: string;
+    readonly omitWarmSetStatus?: boolean;
     // (undocumented)
     readonly socketPath: string;
     readonly timeoutMs?: number;
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 453f8de5f2..6f42fd441e 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -494,7 +494,12 @@ export interface IDaemonPingMessage {
     // (undocumented)
     readonly kind: 'ping';
     // (undocumented)
-    readonly payload: DaemonEmptyPayload;
+    readonly payload: IDaemonPingPayload;
+}
+
+// @beta
+export interface IDaemonPingPayload {
+    readonly omitWarmSet?: boolean;
 }
 
 // @beta
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 3f75f8bc9b..56840158ca 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -32,7 +32,8 @@ on success, cancellation, disconnect and failure. No resize messages are sent.
 
 The optional `liveness` check tells a caller that the daemon stopped responding while its request runs, for
 example because the daemon's process was stopped. Once the daemon has sent nothing for 10 s (by default), the
-client pings it, with one ping at a time. Once it has sent nothing for 30 s, not even the reply,
+client pings it, with one ping at a time, and asks it to leave the warm set out of the reply, which only has
+to arrive. Once it has sent nothing for 30 s, not even the reply,
 `onUnresponsive` is called with its PID, and `onResponsive` follows if it sends anything again. Time that the
 client spends in its own callbacks does not count, nor does a stall of the client's event loop, for example
 while the client's process was stopped. The check stops when the client asks the daemon to cancel the
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index c5780e7b55..5cc57b07d9 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -48,6 +48,13 @@ export interface IDaemonClientConnectOptions {
   readonly expectedDaemonVersion?: string;
   /** Deadline for connection and handshake, in milliseconds. Defaults to 5000. */
   readonly timeoutMs?: number;
+  /**
+   * Asks the daemon to leave its warm set out of the reply that proves the connection ready, which
+   * {@link DaemonClient.status} returns. The warm set names every retained, protected and watched project, so a
+   * client that doesn't report it should set this. Older daemons send it anyway. Defaults to false. The pings of
+   * the liveness check always ask to leave it out; see {@link IDaemonClientLivenessOptions}.
+   */
+  readonly omitWarmSetStatus?: boolean;
 }
 
 /**
@@ -127,9 +134,9 @@ export interface IDaemonSilence {
 
 /**
  * A check that the daemon still responds while a request runs. Once the daemon has sent nothing for `pingAfterMs`,
- * the client pings it, with one ping at a time. Only time in which the client could read what the daemon sent
- * counts: not time spent in the client's own callbacks, and not time in which the client's event loop stalled, for
- * example while its process was stopped.
+ * the client pings it, with one ping at a time, and asks it to leave the warm set out of the reply. Only time in
+ * which the client could read what the daemon sent counts: not time spent in the client's own callbacks, and not
+ * time in which the client's event loop stalled, for example while its process was stopped.
  *
  * @beta
  */
@@ -276,7 +283,10 @@ export class DaemonClient {
     }
   }
 
-  /** The reply that proved this connection ready. */
+  /**
+   * The reply that proved this connection ready. It has no `workspace.warmSet` when the connection set
+   * {@link IDaemonClientConnectOptions.omitWarmSetStatus} and the daemon supports it.
+   */
   public get status(): Promise<IDaemonPongMessage['payload']> {
     return this.#ready.promise;
   }
@@ -468,8 +478,9 @@ export class DaemonClient {
     const silentForMs: number = nowMs - this.#lastHeardAtMs;
     if (silentForMs >= check.pingAfterMs && !this.#pingPending) {
       this.#pingPending = true;
-      // A send that fails closes the connection, which fails the request.
-      this.#sendControlAsync({ kind: 'ping', payload: {} }).catch(() => undefined);
+      // A send that fails closes the connection, which fails the request. Only the pong's arrival counts, so the
+      // daemon need not read or send its warm set.
+      this.#sendControlAsync({ kind: 'ping', payload: { omitWarmSet: true } }).catch(() => undefined);
     }
     if (silentForMs >= check.unresponsiveAfterMs && !this.#silenceReported) {
       this.#silenceReported = true;
@@ -537,7 +548,10 @@ export class DaemonClient {
           supportsRequestLifecycle: true
         }
       });
-      await this.#sendControlAsync({ kind: 'ping', payload: {} });
+      await this.#sendControlAsync({
+        kind: 'ping',
+        payload: this.#connectOptions.omitWarmSetStatus ? { omitWarmSet: true } : {}
+      });
       return;
     }
     if (message.kind === 'pong' && !this.#used) {
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index 6f15e7cfb2..5cb7c9ddf4 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -680,6 +680,17 @@ describe('DaemonClient', () => {
     expect(controls.some((message) => message.kind === 'ping')).toBe(true);
   });
 
+  it.each([
+    [{}, undefined],
+    [{}, false],
+    [{ omitWarmSet: true }, true]
+  ])('pings with %j when omitWarmSetStatus is %s', async (payload, omitWarmSetStatus) => {
+    const client = await DaemonClient.connectAsync({ socketPath: address, omitWarmSetStatus });
+    await client.closeAsync();
+    const pings: DaemonControlMessage[] = controls.filter((message) => message.kind === 'ping');
+    expect(pings.map((message) => message.payload)).toEqual([payload]);
+  });
+
   it('rejects peers without the request lifecycle capability', async () => {
     peerVersion = { major: 0, minor: 4 };
     await expect(DaemonClient.connectAsync({ socketPath: address })).rejects.toThrow(
@@ -865,6 +876,25 @@ describe('DaemonClient', () => {
       expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
     });
 
+    it.each([false, true])(
+      'asks the daemon to leave the warm set out of the reply to its ping (omitWarmSetStatus: %s)',
+      async (omitWarmSetStatus) => {
+        answerPings = false;
+        const envelope = request();
+        const client = await DaemonClient.connectAsync({ socketPath: address, omitWarmSetStatus });
+        const outcome = client.executeAsync({ request: envelope, liveness: liveness() });
+        // A failed expectation must not leave this rejection to the next test.
+        outcome.catch(() => undefined);
+        await waitForAsync(() => countPingsAfter('requestStart') > 0);
+        await sendResultAsync(envelope.requestId);
+        expect(await outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+        // Only the readiness ping follows omitWarmSetStatus, since DaemonClient.status returns its reply.
+        expect(
+          controls.filter((message) => message.kind === 'ping').map((message) => message.payload)
+        ).toEqual([omitWarmSetStatus ? { omitWarmSet: true } : {}, { omitWarmSet: true }]);
+      }
+    );
+
     it('does not check a daemon that predates the check', async () => {
       peerVersion = { major: DAEMON_PROTOCOL_VERSION.major, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR - 1 };
       answerPings = false;
diff --git a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
index 2be3cf95f9..e9f4816306 100644
--- a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
+++ b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
@@ -48,6 +48,11 @@ function validateError(payload: Record<string, unknown>): void {
   requireStringField(payload, 'code');
   requireStringField(payload, 'message');
 }
+function validatePing(payload: Record<string, unknown>): void {
+  if (payload.omitWarmSet !== undefined && typeof payload.omitWarmSet !== 'boolean') {
+    fail('Control message field "omitWarmSet" must be a boolean.');
+  }
+}
 type ControlValidator = (payload: Record<string, unknown>) => void;
 const noopValidator: ControlValidator = () => undefined;
 
@@ -56,7 +61,7 @@ const VALIDATORS_BY_KIND: Record<string, ControlValidator> = {
   helloAck: validateHelloAck,
   subscribe: validateSubscribeControl,
   unsubscribe: noopValidator,
-  ping: noopValidator,
+  ping: validatePing,
   pong: validateDaemonPong,
   error: validateError,
   setRawMode: validateRawModeControl,
diff --git a/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts b/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
index a21e8d422a..35c4aedbd9 100644
--- a/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
@@ -10,7 +10,7 @@ import type {
   IDaemonTerminalPolicyMessage
 } from './DaemonInteractiveControl';
 import type { IDaemonShutdownAckMessage, IDaemonShutdownMessage } from './DaemonLifecycleControl';
-import type { IDaemonPongMessage } from './DaemonPongMessage';
+import type { IDaemonPingPayload, IDaemonPongMessage } from './DaemonPongMessage';
 import type { DaemonProtocolErrorCode } from './DaemonProtocolError';
 import type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
 import type { IDaemonRequestQueuePositionMessage } from './DaemonRequestAdmission';
@@ -54,7 +54,7 @@ export interface IDaemonUnsubscribeMessage {
 /** A liveness probe. @beta */
 export interface IDaemonPingMessage {
   readonly kind: 'ping';
-  readonly payload: DaemonEmptyPayload;
+  readonly payload: IDaemonPingPayload;
 }
 
 /** A protocol error sent on the wire. @beta */
diff --git a/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts b/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
index ddeda56bfc..fdd09c7c76 100644
--- a/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonPongMessage.ts
@@ -5,6 +5,16 @@ import type { IDaemonInstallationChange } from './DaemonInstallationChange';
 import type { IDaemonProtocolVersion } from './DaemonProtocolVersion';
 import type { IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
 
+/** What a ping asks the daemon to leave out of its pong. Older daemons ignore it and leave nothing out. @beta */
+export interface IDaemonPingPayload {
+  /**
+   * Leave `workspace.warmSet` out of the pong. It names every retained, protected and watched project, which in a
+   * large repo makes the pong hundreds of kilobytes. A client that pings only to learn that the daemon is ready sets
+   * this.
+   */
+  readonly omitWarmSet?: boolean;
+}
+
 /** The liveness reply. @beta */
 export interface IDaemonPongMessage {
   readonly kind: 'pong';
diff --git a/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts b/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
index d32675bd98..281664f207 100644
--- a/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
@@ -55,6 +55,9 @@ export interface IDaemonWorkspaceStatus {
   readonly generationToken?: string;
   /** Graph existence, not a claim of successful execution or resident children. */
   readonly graphInitialized: boolean;
-  /** Absent when no warm controller is attached; absence never means measured zero memory. */
+  /**
+   * Absent when no warm controller is attached, or when the ping asked to leave it out
+   * (`IDaemonPingPayload.omitWarmSet`). Absence never means measured zero memory.
+   */
   readonly warmSet?: IDaemonWarmSetStatus;
 }
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 2ab27cba03..1ab67ed9a3 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -43,7 +43,7 @@ export type { IDaemonPingMessage, IDaemonSubscribeMessage } from './DaemonContro
 export type { IDaemonRawModeChangedMessage, IDaemonSetRawModeMessage } from './DaemonInteractiveControl';
 export type { IDaemonStdinEndMessage, IDaemonStdinReadyMessage } from './DaemonInteractiveControl';
 export type { IDaemonTerminalPolicyMessage } from './DaemonInteractiveControl';
-export type { IDaemonPongMessage } from './DaemonPongMessage';
+export type { IDaemonPingPayload, IDaemonPongMessage } from './DaemonPongMessage';
 export type { IDaemonWarmProjectRank, IDaemonWarmSetConfiguration } from './DaemonWorkspaceStatus';
 export type { IDaemonWarmSetStatus, IDaemonWorkspaceStatus } from './DaemonWorkspaceStatus';
 export type { IDaemonShutdownAckMessage, IDaemonShutdownMessage } from './DaemonLifecycleControl';
diff --git a/libraries/rush-daemon-protocol/src/test/PingPayload.test.ts b/libraries/rush-daemon-protocol/src/test/PingPayload.test.ts
new file mode 100644
index 0000000000..9798923b64
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/PingPayload.test.ts
@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonPingPayload } from '../DaemonPongMessage';
+
+import { captureProtocolError } from './TestVectors';
+
+it.each<IDaemonPingPayload>([{}, { omitWarmSet: true }, { omitWarmSet: false }])(
+  'round-trips a ping whose payload is %j',
+  (payload: IDaemonPingPayload) => {
+    const message: DaemonControlMessage = { kind: 'ping', payload };
+    expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+  }
+);
+
+it('rejects a ping whose omitWarmSet is not a boolean', () => {
+  const error: ReturnType<typeof captureProtocolError> = captureProtocolError(() =>
+    decodeDaemonControlMessage(Buffer.from('{"kind":"ping","payload":{"omitWarmSet":"yes"}}'))
+  );
+  expect(error.code).toBe('malformedControlMessage');
+});
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 072949e649..c78020f6b1 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -56,7 +56,8 @@ export interface IDaemonControlSessionOptions {
   readonly onShutdownRequested: () => void;
   /** Counts requests running on every connection, reported in the shutdown acknowledgement. */
   readonly getActiveRequestCount?: () => number;
-  readonly getWorkspaceStatus?: () => IDaemonWorkspaceStatus;
+  /** Reads the status that `pong` reports, without the warm set when the ping asked to leave it out. */
+  readonly getWorkspaceStatus?: (omitWarmSet: boolean) => IDaemonWorkspaceStatus;
   /** Reports a removed or replaced installation in `pong`. */
   readonly checkInstallation?: () => IDaemonInstallationChange | undefined;
   /** Receives a message for the daemon log for each rejected request. */
@@ -206,7 +207,7 @@ export class DaemonControlSession {
         this.#handleSubscribe(message.payload);
         return;
       case 'ping':
-        this.#send(this.#createPong());
+        this.#send(this.#createPong(message.payload.omitWarmSet === true));
         return;
       case 'shutdown':
         await this.#shutdownHostAsync();
@@ -451,7 +452,7 @@ export class DaemonControlSession {
     }
   }
 
-  #createPong(): IDaemonPongMessage {
+  #createPong(omitWarmSet: boolean): IDaemonPongMessage {
     return {
       kind: 'pong',
       payload: {
@@ -459,7 +460,7 @@ export class DaemonControlSession {
         protocolVersion: DAEMON_PROTOCOL_VERSION,
         pid: process.pid,
         residentMemoryBytes: process.memoryUsage().rss,
-        workspace: this.#options.getWorkspaceStatus?.(),
+        workspace: this.#options.getWorkspaceStatus?.(omitWarmSet),
         installationChange: this.#options.checkInstallation?.(),
         uptimeMs: Date.now() - this.#options.startedAtMs
       }
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 3e446cc4a3..8d541c2ab4 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -230,8 +230,8 @@ export class RushDaemonHost {
       await workspaceSessionProvider[Symbol.asyncDispose]();
       throw error;
     }
-    const readWorkspaceStatus = (): IDaemonWorkspaceStatus =>
-      getWorkspaceStatus(workspaceSessionProvider, requestLifecycle?.lastReloadTier ?? 0);
+    const readWorkspaceStatus = (omitWarmSet: boolean = false): IDaemonWorkspaceStatus =>
+      getWorkspaceStatus(workspaceSessionProvider, requestLifecycle?.lastReloadTier ?? 0, omitWarmSet);
     const requestDispatcher: DaemonRequestDispatcher = new DaemonRequestDispatcher(
       workspaceSession,
       options.requestResolver,
diff --git a/libraries/rush-daemon/src/WorkspaceStatus.ts b/libraries/rush-daemon/src/WorkspaceStatus.ts
index 9a35089cd0..13938c4924 100644
--- a/libraries/rush-daemon/src/WorkspaceStatus.ts
+++ b/libraries/rush-daemon/src/WorkspaceStatus.ts
@@ -7,10 +7,14 @@ import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 
-/** Status must never initialize a cold graph or wait behind reload/execution leases. */
+/**
+ * Status must never initialize a cold graph or wait behind reload/execution leases. With `omitWarmSet`, it leaves
+ * the warm set out without reading it, for a ping that only proves the daemon ready.
+ */
 export function getWorkspaceStatus(
   provider: WorkspaceSessionProvider,
-  lastReloadTier?: WorkspaceInputChangeTier
+  lastReloadTier?: WorkspaceInputChangeTier,
+  omitWarmSet: boolean = false
 ): IDaemonWorkspaceStatus {
   const session: IWorkspaceSession | undefined = provider.currentSession;
   return {
@@ -18,6 +22,6 @@ export function getWorkspaceStatus(
     lastReloadTier,
     generationToken: provider.currentGenerationToken,
     graphInitialized: session?.operationGraph !== undefined,
-    warmSet: session?.warmSetStatus
+    warmSet: omitWarmSet ? undefined : session?.warmSetStatus
   };
 }
diff --git a/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts b/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts
index df8609b0b6..41bdd6792a 100644
--- a/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/WarmGenerationTestUtilities.ts
@@ -6,13 +6,14 @@ import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { PhasedCommandEngine, type IPhasedCommandEngine, type RushConfiguration } from '@microsoft/rush-lib';
-import type { IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPingPayload, IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
 import { NoOpTerminalProvider } from '@rushstack/terminal';
 
 import { WorkspaceWarmSet, type WorkspaceWarmSetConfiguration } from '../WorkspaceWarmSet';
 import { WorkspaceSession, type IWorkspaceSessionOptions } from '../WorkspaceSession';
 import { WorkspaceSessionFileWatcher } from '../WorkspaceSessionFileWatcher';
 import type { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
 
 export const GENERATION_POLICY: WorkspaceWarmSetConfiguration = {
   watch: true,
@@ -42,15 +43,23 @@ export function getWarmSet(fixture: DaemonGraphTestFixture): WorkspaceWarmSet {
 export async function pongAsync(fixture: DaemonGraphTestFixture): Promise<IDaemonPongMessage['payload']> {
   const client = await fixture.connectAsync();
   try {
-    await client.sendControlAsync({ kind: 'ping', payload: {} });
-    const message = await client.readControlAsync();
-    if (message.kind !== 'pong') throw new Error('Expected a real daemon pong.');
-    return message.payload;
+    return await pingAsync(client);
   } finally {
     await client.closeAsync();
   }
 }
 
+/** Pings on a connection that has finished its handshake. The handshake sends its own ping, with no payload. */
+export async function pingAsync(
+  client: DaemonRequestWireClient,
+  payload: IDaemonPingPayload = {}
+): Promise<IDaemonPongMessage['payload']> {
+  await client.sendControlAsync({ kind: 'ping', payload });
+  const message = await client.readControlAsync();
+  if (message.kind !== 'pong') throw new Error('Expected a real daemon pong.');
+  return message.payload;
+}
+
 export async function createNativeEngineAsync(
   configuration: RushConfiguration
 ): Promise<IPhasedCommandEngine> {
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts
index 092cf5cf94..101d318c72 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmGeneration.test.ts
@@ -15,6 +15,7 @@ import {
   eventuallyAsync,
   GENERATION_POLICY,
   getWarmSet,
+  pingAsync,
   pongAsync,
   setDaemonPolicy
 } from './WarmGenerationTestUtilities';
@@ -67,6 +68,37 @@ describe('automatic warm generation ownership and pong accounting', () => {
     expect(fixture.host.workspaceStatus.generationToken).toBe(status.workspace?.generationToken);
   });
 
+  it('leaves the warm set out of a pong, without reading it, only when the ping asks it to', async () => {
+    setDaemonPolicy(fixture, { warmSetMaxProjects: 1, autoWarmByTelemetry: true });
+    await fixture.buildSuccessfullyAsync();
+    const warm = getWarmSet(fixture);
+    await eventuallyAsync(() => expect(warm.getStatus().retainedProjectNames).toHaveLength(1));
+    const client = await fixture.connectAsync();
+    try {
+      // The spy starts after the handshake, whose own ping reads the warm set.
+      const read = jest.spyOn(fixture.session, 'warmSetStatus', 'get');
+      const brief = await pingAsync(client, { omitWarmSet: true });
+      expect(read).not.toHaveBeenCalled();
+      expect(brief.workspace).toMatchObject({
+        generation: fixture.host.workspaceGeneration,
+        generationToken: getWorkspaceGenerationToken(fixture.session),
+        graphInitialized: true
+      });
+      expect(brief.workspace).not.toHaveProperty('warmSet');
+      for (const payload of [{}, { omitWarmSet: false }]) {
+        const full = await pingAsync(client, payload);
+        expect(full.workspace).toMatchObject({
+          ...brief.workspace,
+          warmSet: { maintenanceState: 'running' }
+        });
+        expect(full.workspace?.warmSet?.retainedProjectNames).toEqual(warm.getStatus().retainedProjectNames);
+      }
+      expect(read).toHaveBeenCalledTimes(2);
+    } finally {
+      await client.closeAsync();
+    }
+  });
+
   it('applies idle and memory knobs in the default host while reporting irreducible pressure honestly', async () => {
     setDaemonPolicy(fixture, { warmIdleTimeoutSeconds: 0.05 });
     await fixture.buildSuccessfullyAsync();

From e6e6a92c72b38ef00f92e2699ab7973627878fe6 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:04 +0000
Subject: [PATCH 155/265] [rush-daemon] Hash each output folder's file entries
 in one update (and 1 more)

Swarm integration step 140; original commit c3ab5ef5bf (merge of swarm/r07-t230-int at 54ecc5ec92).
Scope: task 230.

Brings 230-int (branch swarm/r07-t230-int). Second agent: r02 board 4899; ch04 METRICS OK board 4844, board 4893. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 5 of 19. Gate: ch01 GATE OK board 5319 (tree 2fb262c2fd)

Commits folded into this step (2):
- 34c009bae0 [rush-daemon] Hash each output folder's file entries in one update
- c88b76cb9c [rush-daemon] Walk the last checked output folders while the inputs are reconciled

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t-fewer-hash-updates_2026-09-29-09-50.json |  11 +
 ...alk-during-reconcile_2026-09-29-09-50.json |  11 +
 .../src/OperationOutputFingerprints.ts        | 185 ++++++++-
 .../rush-daemon/src/OutputFolderDigest.ts     |  18 +-
 .../rush-daemon/src/OutputFolderDigestPool.ts | 115 +++++-
 .../src/ProductionDaemonRequestResolver.ts    |  15 +-
 .../test/OperationOutputFingerprints.test.ts  | 370 ++++++++++++++++++
 .../src/test/OutputFolderDigest.test.ts       |  98 +++++
 .../src/test/OutputFolderDigestPool.test.ts   | 228 ++++++++++-
 .../test/WorkspaceEarlyFailureResult.test.ts  |  88 ++++-
 10 files changed, 1098 insertions(+), 41 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/output-digest-fewer-hash-updates_2026-09-29-09-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/output-walk-during-reconcile_2026-09-29-09-50.json
 create mode 100644 libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
 create mode 100644 libraries/rush-daemon/src/test/OutputFolderDigest.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/output-digest-fewer-hash-updates_2026-09-29-09-50.json b/common/changes/@rushstack/rush-daemon/output-digest-fewer-hash-updates_2026-09-29-09-50.json
new file mode 100644
index 0000000000..f2d37aa65c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/output-digest-fewer-hash-updates_2026-09-29-09-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The check of a warm operation's outputs hashes the entries of each output folder with far fewer hash updates, so it walks large output folders faster. The digests do not change.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/output-walk-during-reconcile_2026-09-29-09-50.json b/common/changes/@rushstack/rush-daemon/output-walk-during-reconcile_2026-09-29-09-50.json
new file mode 100644
index 0000000000..c7955ada0b
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/output-walk-during-reconcile_2026-09-29-09-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Once the check of warm operations' outputs runs on worker threads, the daemon walks the output folders that the last command checked while it reconciles the inputs of the next request, so that the request's check uses those digests instead of walking the folders again.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
index 95c9f55a94..ea4a1f2fb0 100644
--- a/libraries/rush-daemon/src/OperationOutputFingerprints.ts
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -7,13 +7,19 @@ import * as path from 'node:path';
 import {
   OperationStatus,
   type IConfigurableOperation,
+  type IInputsSnapshot,
   type IOperationExecutionResult,
   type IOperationGraph,
+  type IOperationGraphIterationOptions,
   type Operation
 } from '@microsoft/rush-lib';
 
 import type { IOutputFolderDigest, IOutputFolderSet } from './OutputFolderDigest';
-import { getSharedOutputFolderDigester, type OutputFolderDigester } from './OutputFolderDigestPool';
+import {
+  getSharedOutputFolderDigester,
+  type IBackgroundOutputFolderDigests,
+  type OutputFolderDigester
+} from './OutputFolderDigestPool';
 
 const PLUGIN_NAME: 'DaemonOperationOutputFingerprints' = 'DaemonOperationOutputFingerprints';
 
@@ -59,6 +65,16 @@ interface IRecordWalk extends IContentWalk {
   readonly fingerprint: string;
 }
 
+/** Output folders that the digester's worker threads walk while the inputs are reconciled. */
+interface IEarlyWalk {
+  readonly digests: IBackgroundOutputFolderDigests;
+  readonly folderSets: ReadonlyArray<IOutputFolderSet>;
+  /** The index of each walked operation's folder set. */
+  readonly indexByOperation: ReadonlyMap<Operation, number>;
+  /** The inputs snapshot of the reconciliation that started the walk, once that reconciliation succeeded. */
+  inputsSnapshot: IInputsSnapshot | undefined;
+}
+
 /**
  * Detects retained successful or up-to-date operations whose declared output folders were changed outside
  * the daemon.
@@ -78,20 +94,28 @@ interface IRecordWalk extends IContentWalk {
  *   modification time and identity of every entry that is not a folder. This also detects in-place edits
  *   and nested additions, deletions and renames. Its cost grows with the output files of the request's
  *   selection, not with the whole warm graph. Once a walk takes long enough to matter, walks are spread
- *   over a pool of worker threads (see {@link OutputFolderDigester}).
+ *   over a pool of worker threads (see {@link OutputFolderDigester}), and the pool walks the folders that
+ *   the last iteration walked while the inputs are reconciled (see `walkWhileReconcilingAsync`).
  */
 export class OperationOutputFingerprints {
   readonly #digester: OutputFolderDigester;
   readonly #fingerprints: Map<Operation, IOutputFingerprint> = new Map();
   readonly #graph: IOperationGraph;
+  /** The operations whose output folders the last iteration walked. The next one probably walks them again. */
+  #lastWalkedOperations: Set<Operation> = new Set();
+  #earlyWalk: IEarlyWalk | undefined;
 
   public constructor(graph: IOperationGraph, digester: OutputFolderDigester = getSharedOutputFolderDigester()) {
     this.#digester = digester;
     this.#graph = graph;
     graph.hooks.configureIteration.tap(
       { name: PLUGIN_NAME, stage: CONFIGURE_ITERATION_STAGE },
-      (currentStates: ReadonlyMap<Operation, IConfigurableOperation>) => {
-        this.#enableOperationsWithChangedContents(currentStates);
+      (
+        currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
+        lastResults: ReadonlyMap<Operation, IOperationExecutionResult>,
+        context: IOperationGraphIterationOptions
+      ) => {
+        this.#enableOperationsWithChangedContents(currentStates, this.#takeEarlyWalk(context));
       }
     );
     graph.hooks.afterExecuteIterationAsync.tap(
@@ -101,6 +125,43 @@ export class OperationOutputFingerprints {
         return status;
       }
     );
+    graph.abortController.signal.addEventListener('abort', () => this.#takeEarlyWalk()?.digests.cancel(), {
+      once: true
+    });
+  }
+
+  /**
+   * Runs a reconciliation of the inputs while the digester's worker threads walk the output folders that the
+   * last iteration walked, so that the next iteration's content check can use those digests instead of walking.
+   *
+   * @remarks
+   * Only an iteration that uses the inputs snapshot of this reconciliation uses the digests. Every request
+   * that such an iteration serves was received before the reconciliation started, so the walks see each change
+   * that was made before one of those requests was sent, as the inputs snapshot does. A later change can be
+   * missed, as it can by the inputs snapshot, and the next request finds it: an operation keeps its recorded
+   * fingerprint until it produces a new result. No operation writes its outputs during the walks, because the
+   * daemon reconciles only while no iteration runs, including work that continues after an early result.
+   */
+  public async walkWhileReconcilingAsync<TResult extends { readonly inputsSnapshot: IInputsSnapshot }>(
+    reconcileAsync: () => Promise<TResult>
+  ): Promise<TResult> {
+    this.#takeEarlyWalk()?.digests.cancel();
+    const earlyWalk: IEarlyWalk | undefined = this.#graph.abortController.signal.aborted
+      ? undefined
+      : this.#startEarlyWalk();
+    this.#earlyWalk = earlyWalk;
+    try {
+      const result: TResult = await reconcileAsync();
+      if (earlyWalk) {
+        earlyWalk.inputsSnapshot = result.inputsSnapshot;
+      }
+      return result;
+    } catch (error) {
+      if (earlyWalk && this.#earlyWalk === earlyWalk) {
+        this.#takeEarlyWalk()?.digests.cancel();
+      }
+      throw error;
+    }
   }
 
   /**
@@ -135,7 +196,10 @@ export class OperationOutputFingerprints {
    * The recorded fingerprint is kept until the operation produces a new retained result, so an iteration
    * that ends before the operation runs leaves the check in place for the next request.
    */
-  #enableOperationsWithChangedContents(currentStates: ReadonlyMap<Operation, IConfigurableOperation>): void {
+  #enableOperationsWithChangedContents(
+    currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
+    earlyWalk: IEarlyWalk | undefined
+  ): void {
     const checks: ISkipCheck[] = [];
     for (const [operation, state] of currentStates) {
       if (state.enabled || !operation.enabled) {
@@ -153,7 +217,8 @@ export class OperationOutputFingerprints {
         checks.push({ operation, folderSet, entryCount, state, contentFingerprint });
       }
     }
-    const digests: IOutputFolderDigest[] = this.#digestLargestFirst(checks);
+    this.#lastWalkedOperations = new Set(checks.map(({ operation }: ISkipCheck) => operation));
+    const digests: IOutputFolderDigest[] = this.#digestLargestFirst(checks, earlyWalk);
     checks.forEach(({ operation, state, contentFingerprint }: ISkipCheck, index: number) => {
       if (digests[index].digest !== contentFingerprint) {
         enableOperation(operation, state);
@@ -181,13 +246,79 @@ export class OperationOutputFingerprints {
     walks.forEach(({ operation, record, fingerprint }: IRecordWalk, index: number) => {
       const { digest: contentFingerprint, entryCount } = digests[index];
       this.#fingerprints.set(operation, { record, fingerprint, contentFingerprint, entryCount });
+      this.#lastWalkedOperations.add(operation);
     });
   }
 
-  /** Sorts the walks by their expected size, largest first, and returns their digests in that order. */
-  #digestLargestFirst(walks: IContentWalk[]): IOutputFolderDigest[] {
-    walks.sort((left: IContentWalk, right: IContentWalk) => right.entryCount - left.entryCount);
-    return this.#digester.digest(walks.map(({ folderSet }: IContentWalk) => folderSet));
+  /**
+   * Starts walking the output folders that the last iteration walked, if their operations still have a
+   * retained result to check.
+   */
+  #startEarlyWalk(): IEarlyWalk | undefined {
+    const walks: IContentWalk[] = [];
+    for (const operation of this.#lastWalkedOperations) {
+      const entry: IOutputFingerprint | undefined = this.#fingerprints.get(operation);
+      const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+      if (entry?.contentFingerprint !== undefined && folderSet && this.#isRetained(operation, entry.record)) {
+        walks.push({ operation, folderSet, entryCount: entry.entryCount });
+      }
+    }
+    sortLargestFirst(walks);
+    const folderSets: IOutputFolderSet[] = walks.map(({ folderSet }: IContentWalk) => folderSet);
+    const digests: IBackgroundOutputFolderDigests | undefined =
+      walks.length > 0 ? this.#digester.start(folderSets) : undefined;
+    return (
+      digests && {
+        digests,
+        folderSets,
+        indexByOperation: new Map(
+          walks.map(({ operation }: IContentWalk, index: number) => [operation, index])
+        ),
+        inputsSnapshot: undefined
+      }
+    );
+  }
+
+  /**
+   * Returns the pending early walk, and forgets it. With a context, returns it only if that iteration uses the
+   * inputs snapshot of the reconciliation that started the walk, and cancels it otherwise.
+   */
+  #takeEarlyWalk(context?: IOperationGraphIterationOptions): IEarlyWalk | undefined {
+    const earlyWalk: IEarlyWalk | undefined = this.#earlyWalk;
+    this.#earlyWalk = undefined;
+    if (
+      !earlyWalk ||
+      !context ||
+      (earlyWalk.inputsSnapshot !== undefined && earlyWalk.inputsSnapshot === context.inputsSnapshot)
+    ) {
+      return earlyWalk;
+    }
+    earlyWalk.digests.cancel();
+    return undefined;
+  }
+
+  /**
+   * Sorts the walks by their expected size, largest first, and returns their digests in that order. Uses the
+   * digests of an early walk of the same folder sets where there are any, and walks the others now.
+   */
+  #digestLargestFirst(walks: IContentWalk[], earlyWalk?: IEarlyWalk): IOutputFolderDigest[] {
+    sortLargestFirst(walks);
+    const digests: (IOutputFolderDigest | undefined)[] = earlyWalk ? takeEarlyDigests(walks, earlyWalk) : [];
+    const missingIndexes: number[] = [];
+    for (let index: number = 0; index < walks.length; index++) {
+      if (!digests[index]) {
+        missingIndexes.push(index);
+      }
+    }
+    if (missingIndexes.length > 0) {
+      const missingDigests: IOutputFolderDigest[] = this.#digester.digest(
+        missingIndexes.map((index: number) => walks[index].folderSet)
+      );
+      missingIndexes.forEach((walkIndex: number, index: number) => {
+        digests[walkIndex] = missingDigests[index];
+      });
+    }
+    return digests as IOutputFolderDigest[];
   }
 
   #isRetained(operation: Operation, record: IOperationExecutionResult): boolean {
@@ -231,6 +362,40 @@ function getOutputFingerprint(operation: Operation): string | undefined {
     .join('|');
 }
 
+/**
+ * Returns the digest that the early walk computed for each walk's folder set, where it computed one, and
+ * stops the early walk.
+ */
+function takeEarlyDigests(
+  walks: ReadonlyArray<IContentWalk>,
+  { digests, folderSets, indexByOperation }: IEarlyWalk
+): (IOutputFolderDigest | undefined)[] {
+  const earlyIndexes: (number | undefined)[] = walks.map(({ operation, folderSet }: IContentWalk) => {
+    const index: number | undefined = indexByOperation.get(operation);
+    return index !== undefined && isSameFolderSet(folderSets[index], folderSet) ? index : undefined;
+  });
+  if (earlyIndexes.every((index: number | undefined) => index === undefined)) {
+    digests.cancel();
+    return [];
+  }
+  const earlyDigests: ReadonlyArray<IOutputFolderDigest | undefined> = digests.finish();
+  return earlyIndexes.map((index: number | undefined) =>
+    index === undefined ? undefined : earlyDigests[index]
+  );
+}
+
+function sortLargestFirst(walks: IContentWalk[]): void {
+  walks.sort((left: IContentWalk, right: IContentWalk) => right.entryCount - left.entryCount);
+}
+
+function isSameFolderSet(left: IOutputFolderSet, right: IOutputFolderSet): boolean {
+  return (
+    left.projectFolder === right.projectFolder &&
+    left.folderNames.length === right.folderNames.length &&
+    left.folderNames.every((folderName: string, index: number) => folderName === right.folderNames[index])
+  );
+}
+
 function getOutputFolderSet(operation: Operation): IOutputFolderSet | undefined {
   const folderNames: ReadonlyArray<string> | undefined = operation.settings?.outputFolderNames;
   return folderNames?.length
diff --git a/libraries/rush-daemon/src/OutputFolderDigest.ts b/libraries/rush-daemon/src/OutputFolderDigest.ts
index 2ff613c120..6e04224354 100644
--- a/libraries/rush-daemon/src/OutputFolderDigest.ts
+++ b/libraries/rush-daemon/src/OutputFolderDigest.ts
@@ -63,16 +63,24 @@ function addFolderEntries(state: IWalkState, folderPath: string, relativePrefix:
     left.name < right.name ? -1 : left.name > right.name ? 1 : 0
   );
   state.entryCount += entries.length;
+  // With a single trailing separator, even for the root folder.
+  const entryPathPrefix: string = path.join(folderPath, path.sep);
+  // The lines of consecutive entries that are not folders are hashed together, which hashes the same bytes
+  // with far fewer calls.
+  let lines: string = '';
   for (const entry of entries) {
-    const entryPath: string = path.join(folderPath, entry.name);
-    const relativePath: string = `${relativePrefix}${entry.name}`;
+    const relativePath: string = relativePrefix + entry.name;
     if (entry.isDirectory()) {
-      state.hash.update(`${relativePath}\0folder\n`);
-      addFolderEntries(state, entryPath, `${relativePath}/`);
+      state.hash.update(lines + relativePath + '\0folder\n');
+      lines = '';
+      addFolderEntries(state, entryPathPrefix + entry.name, relativePath + '/');
     } else {
-      state.hash.update(`${relativePath}\0${describeEntry(fs.lstatSync(entryPath))}\n`);
+      lines += relativePath + '\0' + describeEntry(fs.lstatSync(entryPathPrefix + entry.name)) + '\n';
     }
   }
+  if (lines) {
+    state.hash.update(lines);
+  }
 }
 
 function describeEntry(stats: fs.Stats): string {
diff --git a/libraries/rush-daemon/src/OutputFolderDigestPool.ts b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
index 24ce9e75f6..004eab46f7 100644
--- a/libraries/rush-daemon/src/OutputFolderDigestPool.ts
+++ b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
@@ -40,6 +40,20 @@ interface IOutputFolderDigestJob {
 /** `[jobId, index, digest]` */
 type OutputFolderDigestResult = readonly [number, number, IOutputFolderDigest];
 
+/**
+ * Folder sets that the workers of an {@link OutputFolderDigestPool} digest while the calling thread does other
+ * work. Call `finish` or `cancel` once.
+ */
+export interface IBackgroundOutputFolderDigests {
+  /**
+   * Stops the workers from claiming more folder sets, waits for the ones they claimed, and returns their digests,
+   * indexed like the folder sets. A folder set that no worker claimed has no digest.
+   */
+  finish(): ReadonlyArray<IOutputFolderDigest | undefined>;
+  /** Stops the workers from claiming more folder sets, and drops the digests. */
+  cancel(): void;
+}
+
 /** The `workerData` of a pool worker. */
 export interface IOutputFolderDigestWorkerData {
   readonly resultPort: MessagePort;
@@ -92,11 +106,16 @@ export function serveOutputFolderDigestJobs(jobPort: MessagePort, resultPort: Me
  * and `lstat` system calls, so it shortens roughly in proportion to the number of threads. If the workers
  * never start or stop making progress, the calling thread digests what is left, so the results always equal
  * {@link digestOutputFolders}.
+ *
+ * `start` gives folder sets to the workers only, so that the calling thread can do other work while they are
+ * walked, and collects the digests that are ready when it needs them.
  */
 export class OutputFolderDigestPool {
   readonly #threads: IPoolThread[] = [];
   readonly #stallTimeoutMs: number;
   readonly #claimOnCallingThread: boolean;
+  /** The results of each job whose digests are still wanted, by job ID. */
+  readonly #resultsByJobId: Map<number, (IOutputFolderDigest | undefined)[]> = new Map();
   #nextJobId: number = 0;
   #stalled: boolean = false;
 
@@ -139,25 +158,18 @@ export class OutputFolderDigestPool {
   /** Returns the digest of each folder set, in order. */
   public digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
     const results: (IOutputFolderDigest | undefined)[] = new Array(folderSets.length);
-    const state: Int32Array = new Int32Array(
-      new SharedArrayBuffer(JOB_STATE_SLOT_COUNT * Int32Array.BYTES_PER_ELEMENT)
-    );
-    const jobId: number = ++this.#nextJobId;
+    const state: Int32Array = createJobState();
     const parallel: boolean = !this.#stalled && (folderSets.length > 1 || !this.#claimOnCallingThread);
-    if (parallel) {
-      const job: IOutputFolderDigestJob = { jobId, folderSets, state };
-      for (const { worker } of this.#threads) {
-        worker.postMessage(job);
-      }
-    }
+    const jobId: number | undefined = parallel ? this.#postJob(folderSets, state, results) : undefined;
     if (this.#claimOnCallingThread || !parallel) {
       claimAndDigest(folderSets, state, (index: number, digest: IOutputFolderDigest) => {
         results[index] = digest;
       });
     }
-    if (parallel) {
+    if (jobId !== undefined) {
       this.#waitForClaimedFolderSets(state, folderSets.length);
-      this.#receiveResults(jobId, results);
+      this.#receiveResults();
+      this.#resultsByJobId.delete(jobId);
     }
     if (this.#stalled) {
       this.dispose();
@@ -167,6 +179,47 @@ export class OutputFolderDigestPool {
     );
   }
 
+  /**
+   * Starts digesting the folder sets on the workers only, so that the calling thread can do other work meanwhile.
+   * Each digest equals that of {@link digestOutputFolders} at the time its walk ran.
+   */
+  public start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests {
+    const results: (IOutputFolderDigest | undefined)[] = new Array(folderSets.length);
+    if (this.#stalled || folderSets.length === 0) {
+      return { finish: () => results, cancel: () => undefined };
+    }
+    const state: Int32Array = createJobState();
+    const jobId: number = this.#postJob(folderSets, state, results);
+    let settled: boolean = false;
+    /** Returns the number of folder sets that workers claimed. */
+    const stopClaims = (): number => {
+      settled = true;
+      return Math.min(Atomics.exchange(state, NEXT_INDEX_SLOT, folderSets.length), folderSets.length);
+    };
+    return {
+      finish: (): ReadonlyArray<IOutputFolderDigest | undefined> => {
+        if (!settled) {
+          const claimedCount: number = stopClaims();
+          if (!this.#stalled) {
+            this.#waitForClaimedFolderSets(state, claimedCount);
+            this.#receiveResults();
+          }
+          this.#resultsByJobId.delete(jobId);
+          if (this.#stalled) {
+            this.dispose();
+          }
+        }
+        return results;
+      },
+      cancel: (): void => {
+        if (!settled) {
+          stopClaims();
+          this.#resultsByJobId.delete(jobId);
+        }
+      }
+    };
+  }
+
   /** Stops the workers. Later digests run on the calling thread. */
   public dispose(): void {
     this.#stalled = true;
@@ -176,6 +229,20 @@ export class OutputFolderDigestPool {
     }
   }
 
+  #postJob(
+    folderSets: ReadonlyArray<IOutputFolderSet>,
+    state: Int32Array,
+    results: (IOutputFolderDigest | undefined)[]
+  ): number {
+    const jobId: number = ++this.#nextJobId;
+    this.#resultsByJobId.set(jobId, results);
+    const job: IOutputFolderDigestJob = { jobId, folderSets, state };
+    for (const { worker } of this.#threads) {
+      worker.postMessage(job);
+    }
+    return jobId;
+  }
+
   #waitForClaimedFolderSets(state: Int32Array, count: number): void {
     let completed: number = Atomics.load(state, COMPLETED_COUNT_SLOT);
     let progressTimeMs: number = performance.now();
@@ -192,16 +259,20 @@ export class OutputFolderDigestPool {
     }
   }
 
-  #receiveResults(jobId: number, results: (IOutputFolderDigest | undefined)[]): void {
+  /**
+   * Reads every published result, and keeps those of jobs whose digests are still wanted. Results of a job that
+   * finished, was cancelled or stalled are dropped.
+   */
+  #receiveResults(): void {
     for (const { resultPort } of this.#threads) {
       for (
         let received: { message: unknown } | undefined = receiveMessageOnPort(resultPort);
         received !== undefined;
         received = receiveMessageOnPort(resultPort)
       ) {
-        const [resultJobId, index, digest] = received.message as OutputFolderDigestResult;
-        // Results of an earlier job that stalled are dropped.
-        if (resultJobId === jobId) {
+        const [jobId, index, digest] = received.message as OutputFolderDigestResult;
+        const results: (IOutputFolderDigest | undefined)[] | undefined = this.#resultsByJobId.get(jobId);
+        if (results) {
           results[index] = digest;
         }
       }
@@ -255,6 +326,14 @@ export class OutputFolderDigester {
     return digests;
   }
 
+  /**
+   * Starts digesting the folder sets on the pool's workers, so that the calling thread can do other work meanwhile.
+   * Returns undefined if no pool is running; see {@link OutputFolderDigestPool.start}.
+   */
+  public start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests | undefined {
+    return this.#pool && !this.#pool.stalled ? this.#pool.start(folderSets) : undefined;
+  }
+
   /** Stops the pool, if one was started. Later digests run on the calling thread. */
   public dispose(): void {
     this.#threadCount = 0;
@@ -291,3 +370,7 @@ function getDefaultThreadCount(): number {
   const parallelism: number = os.availableParallelism?.() ?? os.cpus().length;
   return Math.max(0, Math.min(MAX_POOL_THREAD_COUNT, parallelism - 1));
 }
+
+function createJobState(): Int32Array {
+  return new Int32Array(new SharedArrayBuffer(JOB_STATE_SLOT_COUNT * Int32Array.BYTES_PER_ELEMENT));
+}
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 7b6dc27d08..476212d67e 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -446,12 +446,15 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
         return {
           ...components,
           reconcileInvalidationsAsync: async () => {
-            const result: IWorkspaceInvalidationReconciliation =
-              await terminal.reconcileWithRequestDiagnosticsAsync(() =>
-                components.reconcileInvalidationsAsync!()
-              );
-            if (!engine.isIncremental) engine.operationGraph.invalidateOperations(undefined, 'rebuild');
-            return result;
+            const reconcileAsync = (): Promise<IWorkspaceInvalidationReconciliation> =>
+              terminal.reconcileWithRequestDiagnosticsAsync(() => components.reconcileInvalidationsAsync!());
+            if (!engine.isIncremental) {
+              // Every operation runs, so no output contents are checked.
+              const rebuildResult: IWorkspaceInvalidationReconciliation = await reconcileAsync();
+              engine.operationGraph.invalidateOperations(undefined, 'rebuild');
+              return rebuildResult;
+            }
+            return await outputFingerprints.walkWhileReconcilingAsync(reconcileAsync);
           }
         };
       } catch (error) {
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
new file mode 100644
index 0000000000..15aeb04b4f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
@@ -0,0 +1,370 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  Operation,
+  OperationGraphHooks,
+  OperationStatus,
+  type IConfigurableOperation,
+  type IInputsSnapshot,
+  type IOperationExecutionResult,
+  type IOperationSettings,
+  type IPhase,
+  type IOperationGraph,
+  type RushConfigurationProject
+} from '@microsoft/rush-lib';
+
+import { OperationOutputFingerprints } from '../OperationOutputFingerprints';
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import { OutputFolderDigester, type IBackgroundOutputFolderDigests } from '../OutputFolderDigestPool';
+import { createDeferred, type IDeferred } from './DaemonRequestWireTestUtilities';
+
+const PHASE: IPhase = { name: '_phase:build', logFilenameIdentifier: '_phase_build' } as IPhase;
+
+interface IReconciliation {
+  readonly inputsSnapshot: IInputsSnapshot;
+}
+
+function getProjectNames(folderSets: ReadonlyArray<IOutputFolderSet>): string {
+  return folderSets.map(({ projectFolder }: IOutputFolderSet) => path.basename(projectFolder)).join(',');
+}
+
+function createInputsSnapshot(): IInputsSnapshot {
+  return {} as IInputsSnapshot;
+}
+
+/** Digests on the calling thread and logs each call. `start` walks at once, as if the workers were quick. */
+class RecordingDigester extends OutputFolderDigester {
+  public readonly calls: string[] = [];
+
+  public constructor() {
+    super({ threadCount: 0 });
+  }
+
+  public override digest(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+    this.calls.push(`digest ${getProjectNames(folderSets)}`);
+    return super.digest(folderSets);
+  }
+
+  public override start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests {
+    this.calls.push(`start ${getProjectNames(folderSets)}`);
+    const digests: IOutputFolderDigest[] = folderSets.map((folderSet: IOutputFolderSet) =>
+      digestOutputFolders(folderSet)
+    );
+    return {
+      finish: () => {
+        this.calls.push('finish');
+        return digests;
+      },
+      cancel: () => {
+        this.calls.push('cancel');
+      }
+    };
+  }
+
+  public takeCalls(): string[] {
+    return this.calls.splice(0);
+  }
+}
+
+/** A graph whose operations have a `lib` output folder with the given number of files. */
+class TestGraph {
+  public readonly abortController: AbortController = new AbortController();
+  public readonly hooks: OperationGraphHooks = new OperationGraphHooks();
+  public readonly resultByOperation: Map<Operation, IOperationExecutionResult> = new Map();
+  public readonly fingerprints: OperationOutputFingerprints;
+  readonly #operations: Map<string, Operation> = new Map();
+  readonly #root: string;
+
+  public constructor(root: string, fileCounts: Record<string, number>, digester: OutputFolderDigester) {
+    this.#root = root;
+    for (const [name, fileCount] of Object.entries(fileCounts)) {
+      for (let fileIndex: number = 0; fileIndex < fileCount; fileIndex++) {
+        this.addFile(name, `lib/file-${fileIndex}.js`);
+      }
+      const projectFolder: string = path.join(root, name);
+      const project: RushConfigurationProject = {
+        packageName: name,
+        projectFolder,
+        projectRushTempFolder: path.join(projectFolder, 'temp')
+      } as RushConfigurationProject;
+      const settings: IOperationSettings = { operationName: PHASE.name, outputFolderNames: ['lib'] };
+      this.#operations.set(
+        name,
+        new Operation({ phase: PHASE, project, settings, logFilenameIdentifier: `${name}_build` })
+      );
+    }
+    this.fingerprints = new OperationOutputFingerprints(this as unknown as IOperationGraph, digester);
+  }
+
+  public getOperation(name: string): Operation {
+    const operation: Operation | undefined = this.#operations.get(name);
+    if (!operation) {
+      throw new Error(`No operation ${name}`);
+    }
+    return operation;
+  }
+
+  public addFile(name: string, relativePath: string): void {
+    const filePath: string = path.join(this.#root, name, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, relativePath);
+  }
+
+  /** Runs the operations successfully, which records the fingerprints of their outputs. */
+  public async runAsync(...names: string[]): Promise<void> {
+    const records: Map<Operation, IOperationExecutionResult> = new Map();
+    for (const name of names) {
+      const record: IOperationExecutionResult = {
+        status: OperationStatus.Success
+      } as IOperationExecutionResult;
+      this.resultByOperation.set(this.getOperation(name), record);
+      records.set(this.getOperation(name), record);
+    }
+    await this.hooks.afterExecuteIterationAsync.promise(OperationStatus.Success, records, {});
+  }
+
+  public async reconcileAsync(inputsSnapshot: IInputsSnapshot, whileReconciling?: () => void): Promise<void> {
+    await this.fingerprints.walkWhileReconcilingAsync(async (): Promise<IReconciliation> => {
+      whileReconciling?.();
+      return { inputsSnapshot };
+    });
+  }
+
+  /**
+   * Configures an iteration in which Rush would skip every operation but the given ones, and returns the
+   * operations that are enabled.
+   */
+  public configure(
+    inputsSnapshot: IInputsSnapshot | undefined,
+    enabledByRush: ReadonlyArray<string> = []
+  ): string[] {
+    const states: Map<Operation, IConfigurableOperation> = new Map();
+    for (const [name, operation] of this.#operations) {
+      states.set(operation, { enabled: enabledByRush.includes(name) } as IConfigurableOperation);
+    }
+    this.hooks.configureIteration.call(states, this.resultByOperation, { inputsSnapshot });
+    return [...states]
+      .filter(([, { enabled }]: [Operation, IConfigurableOperation]) => enabled)
+      .map(([operation]: [Operation, IConfigurableOperation]) => operation.associatedProject.packageName);
+  }
+}
+
+describe(OperationOutputFingerprints.name, () => {
+  let root: string;
+  let digester: RecordingDigester;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-fingerprints-'));
+    digester = new RecordingDigester();
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  async function createGraphAsync(): Promise<TestGraph> {
+    const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4 }, digester);
+    await graph.runAsync('a', 'b', 'c');
+    expect(digester.takeCalls()).toEqual(['digest a,b,c']);
+    return graph;
+  }
+
+  describe('walks while the inputs are reconciled', () => {
+    it('uses the digests of that walk for an iteration with the same inputs snapshot', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const first: IInputsSnapshot = createInputsSnapshot();
+      // The walk ran before this change, so the check misses it, as the inputs snapshot can.
+      await graph.reconcileAsync(first, () => graph.addFile('b', 'lib/new.js'));
+      expect(graph.configure(first)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+
+      // The operation keeps its recorded fingerprint, so the next request finds the change.
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual(['b']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+    });
+
+    it.each<[string, IInputsSnapshot | undefined, IInputsSnapshot | undefined]>([
+      ['another inputs snapshot', createInputsSnapshot(), createInputsSnapshot()],
+      ['no inputs snapshot', createInputsSnapshot(), undefined],
+      ['no inputs snapshot from the reconciliation', undefined, undefined]
+    ])(
+      'walks again for an iteration with %s',
+      async (
+        description: string,
+        reconciled: IInputsSnapshot | undefined,
+        iteration: IInputsSnapshot | undefined
+      ) => {
+        const graph: TestGraph = await createGraphAsync();
+        await graph.reconcileAsync(reconciled as IInputsSnapshot, () => graph.addFile('b', 'lib/new.js'));
+        expect(graph.configure(iteration)).toEqual(['b']);
+        expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel', 'digest c,b,a']);
+      }
+    );
+
+    it('cancels the walk if the reconciliation fails', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      await expect(
+        graph.fingerprints.walkWhileReconcilingAsync(async (): Promise<IReconciliation> => {
+          throw new Error('The reconciliation failed');
+        })
+      ).rejects.toThrow('The reconciliation failed');
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel']);
+      expect(graph.configure(createInputsSnapshot())).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['digest c,b,a']);
+    });
+
+    it('cancels the walk of a reconciliation that a later one replaced', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const earlier: IDeferred<IReconciliation> = createDeferred();
+      const earlierReconciliation: Promise<IReconciliation> = graph.fingerprints.walkWhileReconcilingAsync(
+        () => earlier.promise
+      );
+      const later: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(later);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel', 'start c,b,a']);
+
+      earlier.resolve({ inputsSnapshot: createInputsSnapshot() });
+      await earlierReconciliation;
+      expect(graph.configure(later)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['finish']);
+    });
+
+    it('cancels the walk when the graph is closed, and starts none after that', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const reconciliation: IDeferred<IReconciliation> = createDeferred();
+      const reconciliationPromise: Promise<IReconciliation> = graph.fingerprints.walkWhileReconcilingAsync(
+        () => reconciliation.promise
+      );
+      graph.abortController.abort();
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'cancel']);
+
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      reconciliation.resolve({ inputsSnapshot });
+      await reconciliationPromise;
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['digest c,b,a']);
+
+      await graph.reconcileAsync(createInputsSnapshot());
+      expect(digester.takeCalls()).toEqual([]);
+    });
+
+    it('walks the output folders that the last iteration walked, and others when they are checked', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, digester);
+      await graph.runAsync('a', 'b', 'c', 'd');
+      expect(digester.takeCalls()).toEqual(['digest a,b,c,d']);
+      const select = (...names: string[]): void => {
+        for (const name of ['a', 'b', 'c', 'd']) {
+          graph.getOperation(name).enabled = names.includes(name);
+        }
+      };
+
+      select('a', 'b', 'c');
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      expect(graph.configure(first)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,c,b,a', 'finish']);
+
+      select('a', 'd');
+      graph.addFile('d', 'lib/new.js');
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual(['d']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish', 'digest d']);
+
+      // The walk covers none of the checks.
+      select('b');
+      const third: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(third);
+      expect(graph.configure(third)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,a', 'cancel', 'digest b']);
+    });
+
+    it('walks only operations that keep a recorded fingerprint and a retained result', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      fs.rmSync(path.join(root, 'b', 'lib'), { recursive: true });
+      expect(
+        graph.fingerprints
+          .getOperationsWithChangedOutputs()
+          .map((operation: Operation) => operation.associatedProject.packageName)
+      ).toEqual(['b']);
+      graph.resultByOperation.set(graph.getOperation('c'), {
+        status: OperationStatus.Failure
+      } as IOperationExecutionResult);
+
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start a', 'finish']);
+    });
+
+    it('walks the output folders of operations that ran', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      // Rush runs c, so c is not checked.
+      expect(graph.configure(first, ['c'])).toEqual(['c']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+      await graph.runAsync('c');
+      expect(digester.takeCalls()).toEqual(['digest c']);
+
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+    });
+
+    it('does not use the digest of other output folders', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      graph.addFile('b', 'dist/bundle.js');
+      graph.getOperation('b').settings?.outputFolderNames?.push('dist');
+      graph.addFile('c', 'dist/bundle.js');
+      graph.getOperation('c').settings?.outputFolderNames?.splice(0, 1, 'dist');
+      expect(graph.configure(inputsSnapshot)).toEqual(['b', 'c']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish', 'digest c,b']);
+    });
+
+    it('does not start without a pool', async () => {
+      const serialDigester: OutputFolderDigester = new OutputFolderDigester({ threadCount: 0 });
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, serialDigester);
+      await graph.runAsync('a', 'b');
+      graph.addFile('a', 'lib/new.js');
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.configure(inputsSnapshot)).toEqual(['a']);
+    });
+
+    it('finds changes made before the reconciliation with a pool', async () => {
+      const poolDigester: OutputFolderDigester = new OutputFolderDigester({
+        threadCount: 2,
+        poolStartThresholdMs: -1
+      });
+      try {
+        const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, poolDigester);
+        await graph.runAsync('a', 'b', 'c', 'd');
+        expect(poolDigester.isParallel).toBe(true);
+
+        graph.addFile('b', 'lib/new.js');
+        graph.addFile('d', 'lib/nested/new.js');
+        const first: IInputsSnapshot = createInputsSnapshot();
+        await graph.reconcileAsync(first);
+        expect(graph.configure(first)).toEqual(['b', 'd']);
+
+        await graph.runAsync('b', 'd');
+        const second: IInputsSnapshot = createInputsSnapshot();
+        await graph.reconcileAsync(second);
+        expect(graph.configure(second)).toEqual([]);
+      } finally {
+        poolDigester.dispose();
+      }
+    });
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigest.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigest.test.ts
new file mode 100644
index 0000000000..f94680d145
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigest.test.ts
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { digestOutputFolders } from '../OutputFolderDigest';
+
+describe(digestOutputFolders.name, () => {
+  let projectFolder: string;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-folder-digest-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  function writeFile(relativePath: string, text: string): void {
+    fs.mkdirSync(path.dirname(path.join(projectFolder, relativePath)), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, relativePath), text);
+  }
+
+  /** The line of an entry that is not a folder. */
+  function entryLine(relativePath: string): string {
+    const stats: fs.Stats = fs.lstatSync(path.join(projectFolder, relativePath));
+    const kind: string = stats.isSymbolicLink() ? 'link' : 'file';
+    return `${relativePath}\0${kind}\0${stats.size}\0${stats.mtimeMs}\0${stats.ino}\n`;
+  }
+
+  it('hashes one line per entry, in code unit order and depth first', () => {
+    writeFile('lib/a.js', 'a');
+    writeFile('lib/Z.js', 'upper case sorts first');
+    writeFile('lib/b/c.js', 'c');
+    fs.mkdirSync(path.join(projectFolder, 'lib/b/d'));
+    writeFile('lib/e.js', 'e, after a folder');
+    fs.symlinkSync('a.js', path.join(projectFolder, 'lib/f.link'));
+    writeFile('lib/g/h.js', 'h');
+    writeFile('lib/g/\u00fc.js', 'non-ASCII');
+    writeFile('lib.d.ts', 'a file named as an output folder');
+
+    const lines: string[] = [
+      `lib\0folder\0${fs.statSync(path.join(projectFolder, 'lib')).ino}\n`,
+      entryLine('lib/Z.js'),
+      entryLine('lib/a.js'),
+      'lib/b\0folder\n',
+      entryLine('lib/b/c.js'),
+      'lib/b/d\0folder\n',
+      entryLine('lib/e.js'),
+      entryLine('lib/f.link'),
+      'lib/g\0folder\n',
+      entryLine('lib/g/h.js'),
+      entryLine('lib/g/\u00fc.js'),
+      entryLine('lib.d.ts'),
+      'missing\0missing\n'
+    ];
+    expect(digestOutputFolders({ projectFolder, folderNames: ['lib', 'lib.d.ts', 'missing'] })).toEqual({
+      digest: createHash('sha1').update(lines.join('')).digest('hex'),
+      entryCount: 10
+    });
+  });
+
+  it('records links without following them', () => {
+    writeFile('lib/a.js', 'a');
+    fs.symlinkSync('does-not-exist', path.join(projectFolder, 'lib/dangling'));
+    const lines: string[] = [
+      `lib\0folder\0${fs.statSync(path.join(projectFolder, 'lib')).ino}\n`,
+      entryLine('lib/a.js'),
+      entryLine('lib/dangling')
+    ];
+    expect(lines[2]).toMatch(/^lib\/dangling\0link\0/);
+    expect(digestOutputFolders({ projectFolder, folderNames: ['lib'] })).toEqual({
+      digest: createHash('sha1').update(lines.join('')).digest('hex'),
+      entryCount: 2
+    });
+  });
+
+  (process.platform === 'win32' || os.userInfo().uid === 0 ? it.skip : it)(
+    'has no digest if a folder cannot be read',
+    () => {
+      writeFile('lib/a.js', 'a');
+      const unreadable: string = path.join(projectFolder, 'lib/unreadable');
+      fs.mkdirSync(unreadable);
+      fs.chmodSync(unreadable, 0);
+      try {
+        expect(digestOutputFolders({ projectFolder, folderNames: ['lib'] })).toEqual({
+          digest: undefined,
+          entryCount: 2
+        });
+      } finally {
+        fs.chmodSync(unreadable, 0o755);
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
index cb82f610f6..fe30f893b9 100644
--- a/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
@@ -10,7 +10,8 @@ import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet }
 import {
   OutputFolderDigestPool,
   OutputFolderDigester,
-  WORKER_MAX_YOUNG_GENERATION_SIZE_MB
+  WORKER_MAX_YOUNG_GENERATION_SIZE_MB,
+  type IBackgroundOutputFolderDigests
 } from '../OutputFolderDigestPool';
 
 const PROJECT_COUNT: number = 12;
@@ -37,6 +38,64 @@ function digestOnCallingThread(folderSets: ReadonlyArray<IOutputFolderSet>): IOu
   return folderSets.map((folderSet: IOutputFolderSet) => digestOutputFolders(folderSet));
 }
 
+interface ITestWorkerOptions {
+  /** How long the worker waits before it claims the folder sets of a job. */
+  readonly claimDelayMs?: number;
+  /** Written once the worker has claimed every folder set of a job. */
+  readonly claimedMarkerPath?: string;
+  /** How long the worker waits after it claimed the folder sets of a job, before it digests them. */
+  readonly digestDelayMs?: number;
+  /** Whether the worker publishes digests at all. */
+  readonly publish?: boolean;
+}
+
+/** Writes a worker script that claims every folder set of a job at once, and digests them afterwards. */
+function writeTestWorker(
+  scriptPath: string,
+  { claimDelayMs = 0, claimedMarkerPath, digestDelayMs = 0, publish = true }: ITestWorkerOptions
+): string {
+  fs.writeFileSync(
+    scriptPath,
+    [
+      "const fs = require('node:fs');",
+      "const { parentPort, workerData } = require('node:worker_threads');",
+      `const { digestOutputFolders } = require(${JSON.stringify(require.resolve('../OutputFolderDigest'))});`,
+      'const delay = new Int32Array(new SharedArrayBuffer(4));',
+      'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+      `  Atomics.wait(delay, 0, 0, ${claimDelayMs});`,
+      '  const claimed = [];',
+      '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+      '    claimed.push(index);',
+      '  }',
+      claimedMarkerPath ? `  fs.writeFileSync(${JSON.stringify(claimedMarkerPath)}, '');` : '',
+      `  Atomics.wait(delay, 0, 0, ${digestDelayMs});`,
+      publish ? '' : '  return;',
+      '  for (const index of claimed) {',
+      '    workerData.resultPort.postMessage([jobId, index, digestOutputFolders(folderSets[index])]);',
+      '  }',
+      '  Atomics.add(state, 1, claimed.length);',
+      '  Atomics.notify(state, 1);',
+      '});'
+    ].join('\n')
+  );
+  return scriptPath;
+}
+
+function waitForFile(filePath: string): void {
+  const sleep: Int32Array = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  const deadlineMs: number = performance.now() + 10000;
+  while (!fs.existsSync(filePath)) {
+    if (performance.now() > deadlineMs) {
+      throw new Error(`${filePath} was not written`);
+    }
+    Atomics.wait(sleep, 0, 0, 10);
+  }
+}
+
+function withoutDigests(count: number): undefined[] {
+  return new Array(count).fill(undefined);
+}
+
 describe(OutputFolderDigestPool.name, () => {
   let root: string;
   let folderSets: IOutputFolderSet[];
@@ -167,6 +226,150 @@ describe(OutputFolderDigestPool.name, () => {
     }
   });
 
+  describe('start', () => {
+    it('digests folder sets on the workers while the caller runs other jobs', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 2,
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        // Each worker serves jobs in order, so this job ends only after every earlier folder set was claimed,
+        // and it reads the digests that the workers published for the earlier job too.
+        expect(pool.digest(folderSets.slice(0, 2))).toEqual(digestOnCallingThread(folderSets.slice(0, 2)));
+        const digests: ReadonlyArray<IOutputFolderDigest | undefined> = background.finish();
+        expect(digests).toEqual(digestOnCallingThread(folderSets));
+        expect(background.finish()).toBe(digests);
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('has no digests for folder sets that no worker claimed', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'late-worker.js'), { claimDelayMs: 2000 }),
+        claimOnCallingThread: false
+      });
+      try {
+        const startTimeMs: number = performance.now();
+        expect([...pool.start(folderSets).finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(performance.now() - startTimeMs).toBeLessThan(1000);
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('waits for the folder sets that workers claimed', () => {
+      const claimedMarkerPath: string = path.join(root, 'claimed');
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'slow-worker.js'), {
+          claimedMarkerPath,
+          digestDelayMs: 300
+        }),
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        waitForFile(claimedMarkerPath);
+        expect(background.finish()).toEqual(digestOnCallingThread(folderSets));
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('drops the digests of a cancelled job', () => {
+      const claimedMarkerPath: string = path.join(root, 'claimed');
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'slow-worker.js'), {
+          claimedMarkerPath,
+          digestDelayMs: 1000
+        }),
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        waitForFile(claimedMarkerPath);
+        background.cancel();
+        const startTimeMs: number = performance.now();
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(performance.now() - startTimeMs).toBeLessThan(500);
+
+        // The worker publishes the cancelled digests before it serves this job, which reads and drops them.
+        expect(pool.digest(folderSets.slice(0, 2))).toEqual(digestOnCallingThread(folderSets.slice(0, 2)));
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(pool.stalled).toBe(false);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('stops the pool if the workers stall', () => {
+      const claimedMarkerPath: string = path.join(root, 'claimed');
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'stalled-worker.js'), {
+          claimedMarkerPath,
+          publish: false
+        }),
+        stallTimeoutMs: 200,
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        waitForFile(claimedMarkerPath);
+        const dispose: jest.SpyInstance = jest.spyOn(pool, 'dispose');
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(pool.stalled).toBe(true);
+        expect(dispose).toHaveBeenCalled();
+
+        const startTimeMs: number = performance.now();
+        expect([...pool.start(folderSets).finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+        expect(performance.now() - startTimeMs).toBeLessThan(200);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('does not wait for a job that started before the pool stalled', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+        threadCount: 1,
+        workerScriptPath: writeTestWorker(path.join(root, 'stalled-worker.js'), { publish: false }),
+        stallTimeoutMs: 200,
+        claimOnCallingThread: false
+      });
+      try {
+        const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+        // The worker claims the folder sets of both jobs and publishes nothing.
+        expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+        expect(pool.stalled).toBe(true);
+        const startTimeMs: number = performance.now();
+        expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+        expect(performance.now() - startTimeMs).toBeLessThan(100);
+      } finally {
+        pool.dispose();
+      }
+    });
+
+    it('has nothing to digest without folder sets or after the pool was disposed', () => {
+      const pool: OutputFolderDigestPool = new OutputFolderDigestPool({ threadCount: 1 });
+      try {
+        expect(pool.start([]).finish()).toEqual([]);
+      } finally {
+        pool.dispose();
+      }
+      const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+      expect([...background.finish()]).toEqual(withoutDigests(PROJECT_COUNT));
+      background.cancel();
+    });
+  });
+
   it('limits the young generation of each worker', () => {
     // Publishes the worker's own young generation limit as the digest of every folder set it claims.
     const limitsWorkerPath: string = path.join(root, 'limits-worker.js');
@@ -237,6 +440,29 @@ describe(OutputFolderDigester.name, () => {
     expect(disabled.isParallel).toBe(false);
   });
 
+  it('starts background digests only while its pool runs', () => {
+    const folderSets: IOutputFolderSet[] = createProjects(root);
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: 2,
+      poolStartThresholdMs: -1
+    });
+    try {
+      expect(digester.start(folderSets)).toBeUndefined();
+      digester.digest(folderSets);
+      expect(digester.isParallel).toBe(true);
+      const background: IBackgroundOutputFolderDigests | undefined = digester.start(folderSets);
+      expect(background).toBeDefined();
+      const expected: IOutputFolderDigest[] = digestOnCallingThread(folderSets);
+      // Folder sets that no worker claimed yet have no digest.
+      (background?.finish() ?? []).forEach((digest: IOutputFolderDigest | undefined, index: number) => {
+        expect(digest).toEqual(digest && expected[index]);
+      });
+    } finally {
+      digester.dispose();
+    }
+    expect(digester.start(folderSets)).toBeUndefined();
+  });
+
   it('does not keep the process alive', () => {
     const folderSets: IOutputFolderSet[] = createProjects(root);
     const script: string = [
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index 3bb9d0ee0e..89c24027cd 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -18,6 +18,8 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 
 import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
+import type { IOutputFolderSet } from '../OutputFolderDigest';
+import * as outputFolderDigestPool from '../OutputFolderDigestPool';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
@@ -35,6 +37,7 @@ const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
 interface IEarlyFailureFixtureOptions {
   readonly restartable?: boolean;
   readonly slowToStop?: boolean;
+  readonly writesOutputs?: boolean;
 }
 
 /** Keeps the output that it inherits open until the test removes the `hold` marker. */
@@ -46,21 +49,36 @@ const HOLD_OUTPUT_SCRIPT: string = withScriptDeadline(
  * b consumes a and c. a fails, and c holds its build open until the test removes the `hold` marker, so a build of b
  * that returns early on failure leaves c running. With `slowToStop`, c first starts a detached process that shares
  * its output, like a stray watcher: stopping c kills c's process group but not that process, so c's operation ends
- * only when the test removes the marker.
+ * only when the test removes the marker. With `writesOutputs`, c declares its git-ignored `lib` folder as output, and
+ * writes one file there when it starts and another when the test removes the marker.
  */
 function createEarlyFailureFixtureAsync({
   restartable = false,
-  slowToStop = false
+  slowToStop = false,
+  writesOutputs = false
 }: IEarlyFailureFixtureOptions = {}): Promise<DaemonGraphTestFixture> {
   const startOutputHolder: string = slowToStop
     ? `require('node:child_process').spawn(process.execPath,['-e',${JSON.stringify(HOLD_OUTPUT_SCRIPT)}],` +
       "{detached:true,stdio:['ignore','inherit','inherit']}).unref();"
     : '';
+  const startOutputs: string = writesOutputs
+    ? "fs.mkdirSync('lib',{recursive:true});fs.writeFileSync('lib/started.js','');"
+    : '';
+  const finishOutputs: string = writesOutputs ? "fs.writeFileSync('lib/finished.js','');" : '';
   return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
     if (restartable) {
       setDaemonPolicy(created, {});
       created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
     }
+    if (writesOutputs) {
+      fs.appendFileSync(path.join(created.folder, '.gitignore'), '**/lib/\n');
+      created.write(
+        'c/config/rush-project.json',
+        JSON.stringify({
+          operationSettings: [{ operationName: '_phase:compile', outputFolderNames: ['lib'] }]
+        })
+      );
+    }
     created.write('hold', '');
     created.checkInstallation = () => installationChange;
     created.write(
@@ -81,8 +99,10 @@ function createEarlyFailureFixtureAsync({
       withScriptDeadline(
         "const fs=require('node:fs');" +
           startOutputHolder +
+          startOutputs +
           "fs.appendFileSync('../runs.txt','c\\n');" +
-          "const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);console.log('finished-c');}},20);"
+          `const t=setInterval(()=>{if(!fs.existsSync('../hold')){clearInterval(t);${finishOutputs}` +
+          "console.log('finished-c');}},20);"
       )
     );
   });
@@ -210,6 +230,68 @@ describe('a failed build that returns early', () => {
     }
   });
 
+  it('walks the outputs of the work that continues only after that work ended, for a later build', async () => {
+    const digester: outputFolderDigestPool.OutputFolderDigester =
+      new outputFolderDigestPool.OutputFolderDigester({
+        threadCount: 2,
+        poolStartThresholdMs: -1
+      });
+    const sharedDigesterSpy: jest.SpyInstance = jest
+      .spyOn(outputFolderDigestPool, 'getSharedOutputFolderDigester')
+      .mockReturnValue(digester);
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ writesOutputs: true });
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      // Start the pool, so that each reconciliation walks the output folders on its workers.
+      digester.digest(
+        ['a', 'b'].map((name: string) => ({ projectFolder: fixture.folder, folderNames: [name] }))
+      );
+      expect(digester.isParallel).toBe(true);
+      const startSpy: jest.SpyInstance = jest.spyOn(digester, 'start');
+      fs.rmSync(hold);
+      expect((await fixture.runAsync(['build', '--to', 'c'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+
+      // An edit inside c's outputs makes the next build run c again, and c then holds its build open.
+      fixture.write('hold', '');
+      fixture.write('c/lib/started.js', 'edited');
+      const early: ITerminalExchange = await fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
+      expect(early.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure' }
+      });
+      await waitForRunsAsync(fixture, 'c', 2);
+      const { projectFolder } = fixture.session.rushConfiguration.getProjectByName('c')!;
+      const walkOfC: IOutputFolderSet[][] = [[{ projectFolder, folderNames: ['lib'] }]];
+      expect(startSpy.mock.calls).toEqual([walkOfC]);
+
+      const later: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      await delayAsync(1000);
+      expect(await isSettledAsync(later)).toBe(false);
+      // The last iteration walked c's outputs, but nothing walks them again while c still writes them.
+      expect(startSpy.mock.calls).toEqual([walkOfC]);
+
+      fs.rmSync(hold);
+      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(startSpy.mock.calls).toEqual([walkOfC, walkOfC]);
+      // That walk found the outputs that c finished, so c did not run again.
+      expect(countRuns(fixture, 'c')).toBe(2);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+      sharedDigesterSpy.mockRestore();
+      digester.dispose();
+    }
+  });
+
   it('stops the work that continues before it rejects a command that the client then runs in-process', async () => {
     const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
     const hold: string = path.join(fixture.folder, 'hold');

From f73d9eb35452b3706ea0d800645b81bd0d3e885e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:04 +0000
Subject: [PATCH 156/265] [rush-daemon] Reject a command that the daemon never
 serves before it waits for admission (task 207) (and 2 more)

Swarm integration step 141; original commit 52ca3eb3c1 (merge of swarm/r04-t207-int at ec03d0f668).
Scope: task 207.

Brings 207-int (branch swarm/r04-t207-int). Second agent: t03 board 4878. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 6 of 19. Gate: ch01 GATE OK board 5319 (tree 1c34de4eee)

Commits folded into this step (3):
- a8debe7967 Reject a command that the daemon never serves before it waits for admission (task 207)
- 8adbd4a9d1 Test the early rejection that 207 and 140 now share (task 207 on 140-int5)
- 83573491f1 Test the table of commands that the daemon rejects before admission (task 207 on 140-int5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...m-r04-t207-int-tests_2026-09-29-08-40.json |  11 +
 ...rm-r04-t207-int-unit_2026-09-29-09-20.json |  11 +
 ...ted-before-admission_2026-09-29-05-50.json |  11 +
 common/reviews/api/rush-daemon.api.md         |   2 +
 .../src/DaemonRequestDispatcher.ts            |  15 +-
 .../src/ProductionDaemonRequestResolver.ts    |  42 ++--
 .../src/WorkspaceRequestLifecycle.ts          |  15 ++
 .../src/WorkspaceResolverLifecycle.ts         |  16 +-
 ...ProductionDaemonUnsupportedCommand.test.ts |  73 +++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  | 204 +++++++++++-------
 .../test/WorkspaceUnsupportedCommand.test.ts  | 178 +++++++++++++++
 11 files changed, 477 insertions(+), 101 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-tests_2026-09-29-08-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-unit_2026-09-29-09-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t207-unsupported-before-admission_2026-09-29-05-50.json
 create mode 100644 libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-tests_2026-09-29-08-40.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-tests_2026-09-29-08-40.json
new file mode 100644
index 0000000000..04534b57e9
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-tests_2026-09-29-08-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a custom command waits for admission and is served, and that a built-in command that is not phased is rejected before admission, with the stop of the work that continues and the restart once the installation changed.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-unit_2026-09-29-09-20.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-unit_2026-09-29-09-20.json
new file mode 100644
index 0000000000..9d0c6c7325
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t207-int-unit_2026-09-29-09-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test which commands the production resolver rejects before admission: rushx scripts and every built-in command except build and rebuild, but never a custom command.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t207-unsupported-before-admission_2026-09-29-05-50.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t207-unsupported-before-admission_2026-09-29-05-50.json
new file mode 100644
index 0000000000..af8bdf7c47
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t207-unsupported-before-admission_2026-09-29-05-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The daemon now rejects a built-in command that it never serves, such as `rush list`, before the request waits for admission, so that the client runs it in-process at once. Before, such a request could wait behind a build that waited for the running build before it reloaded the graph, and fail when its own wait timeout ran out. A custom command still waits for admission, because only its parse can tell whether the daemon serves it. As before, the daemon first stops the work that finished requests continue, unless the command only reads the workspace, and answers with the restart result instead once its installation changed.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index e2227d4820..9907efaae6 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -651,6 +651,7 @@ export interface IWorkspaceResolverLifecycle {
     createForSession(preparationLock?: LockFile, validateGraphInputsAsync?: () => Promise<void>): IDaemonRequestResolver;
     // (undocumented)
     getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string>;
+    getUnsupportedCommandError?(envelope: IDaemonRequestEnvelope): DaemonRequestDispatchError | undefined;
 }
 
 // @beta
@@ -778,6 +779,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     });
     createForSession(preparationLock?: LockFile, validateGraphInputsAsync?: () => Promise<void>): ProductionDaemonRequestResolver;
     getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string>;
+    getUnsupportedCommandError(envelope: IDaemonRequestEnvelope): DaemonRequestDispatchError | undefined;
     // (undocumented)
     resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest>;
     // (undocumented)
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index 4cd9da596f..39066eb9bf 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -194,11 +194,7 @@ async function dispatchWorkspaceRequestAsync(
 ): Promise<IDaemonCommandResult | undefined> {
   const { envelope, client, workspaceSession, resolver, onExecutionStarting, lifecycleInfo } = options;
   workspaceSession.assertActive?.();
-  if (
-    !isRushxInvocation(envelope) &&
-    envelope.commandOrigin === 'built-in' &&
-    (envelope.commandName === 'daemon' || (envelope.argv[0] === 'daemon' && envelope.argv[1] === 'graph'))
-  ) {
+  if (isDaemonGraphCommand(envelope)) {
     onExecutionStarting?.();
     await new DaemonGraphRequestRouter(workspaceSession).executeAsync(envelope, client);
     return undefined;
@@ -257,6 +253,15 @@ async function dispatchWorkspaceRequestAsync(
   );
 }
 
+/** Whether the dispatcher answers the request with the daemon's graph router instead of the resolver. */
+export function isDaemonGraphCommand(envelope: IDaemonRequestEnvelope): boolean {
+  return (
+    !isRushxInvocation(envelope) &&
+    envelope.commandOrigin === 'built-in' &&
+    (envelope.commandName === 'daemon' || (envelope.argv[0] === 'daemon' && envelope.argv[1] === 'graph'))
+  );
+}
+
 function validateResolvedPhasedRequest(
   envelope: IDaemonRequestEnvelope,
   request: IDaemonPhasedRequest
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 476212d67e..d28f560f9b 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -131,6 +131,32 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     });
   }
 
+  /**
+   * Rejects a rushx script and a built-in command that is not phased, since the resolver never serves either.
+   *
+   * @remarks
+   * It reads only the envelope, so it needs no session: command-line.json cannot redefine a built-in command, so
+   * the name identifies one without a parse. Whether the resolver serves a custom command is known only once its
+   * command line is parsed (`getCommandParameterIdentityAsync`), so this never rejects one.
+   */
+  public getUnsupportedCommandError(
+    envelope: IDaemonRequestEnvelope
+  ): DaemonRequestDispatchError | undefined {
+    if (isRushxInvocation(envelope)) {
+      return new DaemonRequestDispatchError('unsupported', 'A rushx script is not a phased command request.');
+    }
+    if (
+      Object.hasOwn(BUILT_IN_RUSH_COMMAND_CLASSIFICATION, envelope.commandName) &&
+      !BUILT_IN_PHASED_COMMAND_NAMES.has(envelope.commandName)
+    ) {
+      return new DaemonRequestDispatchError(
+        'unsupported',
+        `"${envelope.commandName}" is a built-in command that is not phased.`
+      );
+    }
+    return undefined;
+  }
+
   /**
    * Inspects the native command shape without constructing or executing an operation graph.
    *
@@ -296,19 +322,9 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     identityParse?: IParsedCommand
   ): Promise<IParsedCommand> {
     const { envelope, workspaceSession, abortSignal } = options;
-    if (isRushxInvocation(envelope)) {
-      throw new DaemonRequestDispatchError('unsupported', 'A rushx script is not a phased command request.');
-    }
-    if (
-      Object.hasOwn(BUILT_IN_RUSH_COMMAND_CLASSIFICATION, envelope.commandName) &&
-      !BUILT_IN_PHASED_COMMAND_NAMES.has(envelope.commandName)
-    ) {
-      // Skips parsing, because command-line.json cannot redefine a built-in command.
-      throw new DaemonRequestDispatchError(
-        'unsupported',
-        `"${envelope.commandName}" is a built-in command that is not phased.`
-      );
-    }
+    // Skips parsing for a command that the resolver never serves.
+    const unsupported: DaemonRequestDispatchError | undefined = this.getUnsupportedCommandError(envelope);
+    if (unsupported) throw unsupported;
     if (environmentIdentity(envelope.environment) !== this.#environmentIdentity) {
       throw new DaemonRequestDispatchError(
         'unsupported',
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 39595a5be4..72bb10422e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -29,6 +29,7 @@ import type {
 
 import {
   DaemonRequestDispatchError,
+  isDaemonGraphCommand,
   type DispatchWorkspaceRequestAsync,
   type IDaemonRequestDispatchClient,
   type IDaemonRequestLifecycle,
@@ -332,6 +333,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         }
         let scriptLease: IRequestLease | undefined;
         try {
+          this.#throwIfUnsupportedCommand(envelope);
           const prepared: IPreparedGeneration = await this.#prepareAsync(
             envelope,
             client,
@@ -1201,6 +1203,19 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     return change;
   }
 
+  /**
+   * Rejects a command that the resolver never serves before the request waits for admission, so that its client can
+   * run the command in-process at once. Otherwise the request would wait, for example behind a build that waits for
+   * the running build before it reloads the graph, and could fail when its own wait timeout ran out. The rejection is
+   * handled as one after admission: once the installation changed, the request gets the restart result instead.
+   */
+  #throwIfUnsupportedCommand(envelope: IDaemonRequestEnvelope): void {
+    if (isRushxInvocation(envelope) || isDaemonGraphCommand(envelope) || isMutation(envelope)) return;
+    const unsupported: DaemonRequestDispatchError | undefined =
+      this.#resolver.workspaceLifecycle?.getUnsupportedCommandError?.(envelope);
+    if (unsupported) throw unsupported;
+  }
+
   #throwIfInstallationChanged(): void {
     const change: IDaemonInstallationChange | undefined = this.#detectInstallationChange();
     if (change) throw new InstallationChangedBeforeExecution(change);
diff --git a/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts b/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts
index 4c223399ee..23235c98ae 100644
--- a/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceResolverLifecycle.ts
@@ -4,7 +4,11 @@
 import type { LockFile } from '@rushstack/node-core-library';
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
-import type { IDaemonRequestResolver, IResolveDaemonRequestOptions } from './DaemonRequestDispatcher';
+import type {
+  DaemonRequestDispatchError,
+  IDaemonRequestResolver,
+  IResolveDaemonRequestOptions
+} from './DaemonRequestDispatcher';
 
 /** Optional lifecycle capabilities retained by resolver decorators across workspace generations. @beta */
 export interface IWorkspaceResolverLifecycle {
@@ -13,6 +17,13 @@ export interface IWorkspaceResolverLifecycle {
     preparationLock?: LockFile,
     validateGraphInputsAsync?: () => Promise<void>
   ): IDaemonRequestResolver;
+  /**
+   * Returns the rejection of a command that the resolver never serves, whatever the state of the workspace, or
+   * undefined. It reads only the envelope, and the workspace lifecycle asks it before it admits the request, so the
+   * client can run such a command in-process at once instead of waiting behind other requests. It is asked about Rush
+   * commands only: not about rushx scripts, `daemon` graph requests, or `install` and `update`.
+   */
+  getUnsupportedCommandError?(envelope: IDaemonRequestEnvelope): DaemonRequestDispatchError | undefined;
 }
 
 /**
@@ -28,7 +39,8 @@ export function wrapWorkspaceResolverLifecycle(
   return (
     lifecycle && {
       getCommandParameterIdentityAsync: (options) => lifecycle.getCommandParameterIdentityAsync(options),
-      createForSession: (lock, validateAsync) => wrap(lifecycle.createForSession(lock, validateAsync))
+      createForSession: (lock, validateAsync) => wrap(lifecycle.createForSession(lock, validateAsync)),
+      getUnsupportedCommandError: (envelope) => lifecycle.getUnsupportedCommandError?.(envelope)
     }
   );
 }
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts
new file mode 100644
index 0000000000..a2f8b7f995
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonUnsupportedCommand.test.ts
@@ -0,0 +1,73 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRushCommandOrigin, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import { BUILT_IN_RUSH_COMMAND_CLASSIFICATION } from '../RushCommandRequestPolicy';
+import {
+  wrapWorkspaceResolverLifecycle,
+  type IWorkspaceResolverLifecycle
+} from '../WorkspaceResolverLifecycle';
+import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+
+const ORIGINS: DaemonRushCommandOrigin[] = ['built-in', 'custom'];
+
+function createEnvelope(
+  commandName: string,
+  overrides: Partial<IDaemonRequestEnvelope> = {}
+): IDaemonRequestEnvelope {
+  return createWireEnvelope(`request-${commandName}`, commandName, '/repo', overrides);
+}
+
+describe(ProductionDaemonRequestResolver.prototype.getUnsupportedCommandError.name, () => {
+  const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver({
+    startupEnvironment: {}
+  });
+
+  it('rejects every built-in command except build and rebuild, whatever its origin', () => {
+    const names: string[] = Object.keys(BUILT_IN_RUSH_COMMAND_CLASSIFICATION);
+    for (const commandOrigin of ORIGINS) {
+      const rejected: string[] = names.filter(
+        (name) => resolver.getUnsupportedCommandError(createEnvelope(name, { commandOrigin })) !== undefined
+      );
+      expect(rejected).toEqual(names.filter((name) => name !== 'build' && name !== 'rebuild'));
+    }
+    // rush-client sends every command other than build, rebuild, install and update as a custom command.
+    expect(resolver.getUnsupportedCommandError(createEnvelope('list'))).toMatchObject({
+      code: 'unsupported',
+      message: '"list" is a built-in command that is not phased.'
+    });
+  });
+
+  it('never rejects a custom command, since only its parse can tell whether the resolver serves it', () => {
+    for (const commandOrigin of ORIGINS) {
+      for (const name of ['test', 'hello', 'build:watch']) {
+        expect(resolver.getUnsupportedCommandError(createEnvelope(name, { commandOrigin }))).toBeUndefined();
+      }
+    }
+  });
+
+  it('rejects a rushx script, even one named like a phased command', () => {
+    for (const name of ['build', 'test']) {
+      expect(
+        resolver.getUnsupportedCommandError(createEnvelope(name, { invocationKind: 'rushx' }))
+      ).toMatchObject({
+        code: 'unsupported',
+        message: 'A rushx script is not a phased command request.'
+      });
+    }
+  });
+
+  it('is forwarded by a resolver decorator', () => {
+    const lifecycle: IWorkspaceResolverLifecycle | undefined = wrapWorkspaceResolverLifecycle(
+      resolver,
+      (inner) => inner
+    );
+    expect(lifecycle?.getUnsupportedCommandError?.(createEnvelope('list'))).toMatchObject({
+      code: 'unsupported',
+      message: '"list" is a built-in command that is not phased.'
+    });
+    expect(lifecycle?.getUnsupportedCommandError?.(createEnvelope('test'))).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index 89c24027cd..5eaad1608e 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -177,6 +177,105 @@ async function returnEarlyAsync(fixture: DaemonGraphTestFixture): Promise<void>
   expect(countRuns(fixture, 'b')).toBe(0);
 }
 
+/**
+ * The daemon rejects this command before admission, as rush-client sends it: rush-client marks only build, rebuild,
+ * install and update as built-in commands, and the daemon finds a built-in command that is not phased by its name.
+ * Unlike `list`, it does not only read the workspace.
+ */
+const NOT_PHASED: string[] = ['install-autoinstaller', '--name', 'tools'];
+
+/**
+ * After a failed build returned early, sends `argv`, which the daemon rejects so that the client runs it in-process,
+ * and checks that the daemon stopped the work that continues before it sent the rejection.
+ */
+async function expectStopBeforeRejectionAsync(argv: string[]): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+  const hold: string = path.join(fixture.folder, 'hold');
+  try {
+    await returnEarlyAsync(fixture);
+
+    const custom: ITerminalExchange = await fixture.runAsync(argv, { commandOrigin: 'custom' });
+    expect(custom.terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+    // The held c was stopped before the rejection was sent, and the in-process command can take the Rush lock.
+    expect(fs.existsSync(hold)).toBe(true);
+    expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
+    expect(isNativeLockFree(fixture)).toBe(true);
+
+    // So a later build runs c again at once, instead of waiting for the held c.
+    const later: Promise<ITerminalExchange> = fixture.runAsync(['build', '--to', 'c', '--parallelism', '3']);
+    await waitForRunsAsync(fixture, 'c', 2);
+    expect(countRuns(fixture, 'c')).toBe(2);
+    fs.rmSync(hold);
+    expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+  } finally {
+    fs.rmSync(hold, { force: true });
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+/**
+ * After a failed build returned early, and while a later build waits for the work that continues, sends `argv`,
+ * which the daemon rejects so that the client would run it in-process. `changeInstallationWhenChecked` changes the
+ * installation while the daemon checks the command. Checks that the daemon answers with the restart instead, and
+ * leaves the work that continues running.
+ */
+async function expectRestartForRejectedCommandAsync(
+  argv: string[],
+  changeInstallationWhenChecked: (custom: IDaemonRequestEnvelope, change: IDaemonInstallationChange) => void
+): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+  const hold: string = path.join(fixture.folder, 'hold');
+  let later: DaemonRequestWireClient | undefined;
+  let rejected: DaemonRequestWireClient | undefined;
+  try {
+    await returnEarlyAsync(fixture);
+    // A later build waits for the held c, so the daemon serves it until that c finishes.
+    later = await fixture.connectAsync();
+    const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c', '--parallelism', '3']);
+    await later.sendControlAsync({ kind: 'requestStart', payload: build });
+    await readUntilQueuedAsync(later);
+
+    // The installation changes while the daemon rejects a command that the client would run in-process.
+    const change: IDaemonInstallationChange = {
+      change: 'replaced',
+      folder: path.join(fixture.folder, 'daemon')
+    };
+    const custom: IDaemonRequestEnvelope = fixture.envelope(argv, { commandOrigin: 'custom' });
+    changeInstallationWhenChecked(custom, change);
+    rejected = await fixture.connectAsync();
+    await rejected.sendControlAsync({ kind: 'requestStart', payload: custom });
+
+    // So the client restarts the daemon instead of running the command in-process, and the restart waits for
+    // the later build, which still waits for the held c.
+    const restartReason: object = { kind: 'installationChanged', ...change };
+    expect(queuePositions(await readUntilQueuedAsync(rejected))).toEqual([
+      expect.objectContaining({ position: 1, restartReason })
+    ]);
+    expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+    expect(countRuns(fixture, 'c')).toBe(1);
+
+    fs.rmSync(hold);
+    expect((await later.readTerminalAsync(build.requestId)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    expect((await rejected.readTerminalAsync(custom.requestId)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 1, retryAfterRestart: true, restartReason }
+    });
+    // The held c finished, and the later build found it done.
+    expect(countRuns(fixture, 'c')).toBe(1);
+    await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
+  } finally {
+    installationChange = undefined;
+    jest.restoreAllMocks();
+    fs.rmSync(hold, { force: true });
+    await later?.closeAsync();
+    await rejected?.closeAsync();
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
 describe('a failed build that returns early', () => {
   it('lets a rebuild stop the work that continues instead of waiting for it', async () => {
     const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
@@ -293,36 +392,12 @@ describe('a failed build that returns early', () => {
   });
 
   it('stops the work that continues before it rejects a command that the client then runs in-process', async () => {
-    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
-    const hold: string = path.join(fixture.folder, 'hold');
-    try {
-      await returnEarlyAsync(fixture);
-
-      const custom: ITerminalExchange = await fixture.runAsync(['test', '--to', 'c'], {
-        commandOrigin: 'custom'
-      });
-      expect(custom.terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
-      // The held c was stopped before the rejection was sent, and the in-process command can take the Rush lock.
-      expect(fs.existsSync(hold)).toBe(true);
-      expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
-      expect(isNativeLockFree(fixture)).toBe(true);
+    // The fixture's `test` is not a phased command, so the daemon rejects it at its parse, after admission.
+    await expectStopBeforeRejectionAsync(['test', '--to', 'c']);
+  });
 
-      // So a later build runs c again at once, instead of waiting for the held c.
-      const later: Promise<ITerminalExchange> = fixture.runAsync([
-        'build',
-        '--to',
-        'c',
-        '--parallelism',
-        '3'
-      ]);
-      await waitForRunsAsync(fixture, 'c', 2);
-      expect(countRuns(fixture, 'c')).toBe(2);
-      fs.rmSync(hold);
-      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
-    } finally {
-      fs.rmSync(hold, { force: true });
-      await fixture[Symbol.asyncDispose]();
-    }
+  it('stops the work that continues before it rejects a built-in command that is not phased, before admission', async () => {
+    await expectStopBeforeRejectionAsync(NOT_PHASED);
   });
 
   it('answers a client that cancels while the work that continues is stopping, without waiting for it to stop', async () => {
@@ -473,27 +548,8 @@ describe('a failed build that returns early', () => {
   });
 
   it('answers a command that it rejects with the restart once the installation changed, and leaves the work that continues running', async () => {
-    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
-    const hold: string = path.join(fixture.folder, 'hold');
-    let later: DaemonRequestWireClient | undefined;
-    let rejected: DaemonRequestWireClient | undefined;
-    try {
-      await returnEarlyAsync(fixture);
-      // A later build waits for the held c, so the daemon serves it until that c finishes.
-      later = await fixture.connectAsync();
-      const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c', '--parallelism', '3']);
-      await later.sendControlAsync({ kind: 'requestStart', payload: build });
-      await readUntilQueuedAsync(later);
-
-      // The installation changes while the daemon rejects a command that the client would run in-process.
-      const change: IDaemonInstallationChange = {
-        change: 'replaced',
-        folder: path.join(fixture.folder, 'daemon')
-      };
-      const custom: IDaemonRequestEnvelope = fixture.envelope(['test', '--to', 'c'], {
-        commandOrigin: 'custom'
-      });
-      // The daemon parses a custom command before it resolves the request, and rejects this one there.
+    // The daemon parses a custom command before it resolves the request, and rejects this one there.
+    await expectRestartForRejectedCommandAsync(['test', '--to', 'c'], (custom, change) => {
       const getIdentityAsync: ProductionDaemonRequestResolver['getCommandParameterIdentityAsync'] =
         ProductionDaemonRequestResolver.prototype.getCommandParameterIdentityAsync;
       jest
@@ -505,37 +561,23 @@ describe('a failed build that returns early', () => {
           if (options.envelope.requestId === custom.requestId) installationChange = change;
           return await getIdentityAsync.call(this, options);
         });
-      rejected = await fixture.connectAsync();
-      await rejected.sendControlAsync({ kind: 'requestStart', payload: custom });
-
-      // So the client restarts the daemon instead of running the command in-process, and the restart waits for
-      // the later build, which still waits for the held c.
-      const restartReason: object = { kind: 'installationChanged', ...change };
-      expect(queuePositions(await readUntilQueuedAsync(rejected))).toEqual([
-        expect.objectContaining({ position: 1, restartReason })
-      ]);
-      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
-      expect(countRuns(fixture, 'c')).toBe(1);
+    });
+  });
 
-      fs.rmSync(hold);
-      expect((await later.readTerminalAsync(build.requestId)).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
-      expect((await rejected.readTerminalAsync(custom.requestId)).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 1, retryAfterRestart: true, restartReason }
-      });
-      // The held c finished, and the later build found it done.
-      expect(countRuns(fixture, 'c')).toBe(1);
-      await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
-    } finally {
-      installationChange = undefined;
-      jest.restoreAllMocks();
-      fs.rmSync(hold, { force: true });
-      await later?.closeAsync();
-      await rejected?.closeAsync();
-      await fixture[Symbol.asyncDispose]();
-    }
+  it('answers a built-in command that it rejects before admission with the restart once the installation changed, and leaves the work that continues running', async () => {
+    // The daemon rejects it before admission, since it never serves the command.
+    await expectRestartForRejectedCommandAsync(NOT_PHASED, (custom, change) => {
+      const getUnsupportedCommandError: ProductionDaemonRequestResolver['getUnsupportedCommandError'] =
+        ProductionDaemonRequestResolver.prototype.getUnsupportedCommandError;
+      jest
+        .spyOn(ProductionDaemonRequestResolver.prototype, 'getUnsupportedCommandError')
+        .mockImplementation(function (
+          this: ProductionDaemonRequestResolver,
+          envelope: IDaemonRequestEnvelope
+        ) {
+          if (envelope.requestId === custom.requestId) installationChange = change;
+          return getUnsupportedCommandError.call(this, envelope);
+        });
+    });
   });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts b/libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts
new file mode 100644
index 0000000000..942d07c8a9
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceUnsupportedCommand.test.ts
@@ -0,0 +1,178 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+/**
+ * Composes its resolvers as the production host does. c builds until the test removes the `hold` marker. `test` is a
+ * phased command of command-line.json, as in rushstack.
+ */
+function createHeldFixtureAsync(): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
+    created.servesRushx = true;
+    created.write('hold', '');
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: ['build', 'test'].map((name: string) => ({
+          commandKind: 'phased',
+          name,
+          summary: name,
+          phases: ['_phase:compile'],
+          incremental: true,
+          enableParallelism: true
+        }))
+      })
+    );
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);"
+    );
+  });
+}
+
+async function waitForRunAsync(fixture: DaemonGraphTestFixture, name: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!fixture.runs().includes(name) && Date.now() < deadline) await delayAsync(20);
+}
+
+function isQueuePosition(frame: IDaemonFrame): boolean {
+  if (frame.kind !== DaemonFrameType.controlJson) return false;
+  const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+  return message.kind === 'queuePosition';
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<void> {
+  while (!isQueuePosition(await client.readFrameAsync()));
+}
+
+interface IHeldTransition {
+  /** The rebuild, which runs c until the test removes the `hold` marker. */
+  readonly running: Promise<ITerminalExchange>;
+  /** The build after the rebuild. It reloads the graph, so it owns that transition while it waits for the rebuild. */
+  readonly built: Promise<ITerminalExchange>;
+  readonly patient: DaemonRequestWireClient;
+}
+
+async function holdTransitionAsync(fixture: DaemonGraphTestFixture): Promise<IHeldTransition> {
+  const running: Promise<ITerminalExchange> = fixture.runAsync(['rebuild', '--to', 'c']);
+  await waitForRunAsync(fixture, 'c');
+  const patient: DaemonRequestWireClient = await fixture.connectAsync();
+  const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c'], {
+    admission: { waitTimeoutMs: 60_000 }
+  });
+  await patient.sendControlAsync({ kind: 'requestStart', payload: build });
+  await readUntilQueuedAsync(patient);
+  return { running, built: patient.readTerminalAsync(build.requestId), patient };
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await delayAsync(0);
+  return settled;
+}
+
+describe('a command that the daemon never serves', () => {
+  it('is rejected at once while a build waits behind the running build to reload the graph', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      transition = await holdTransitionAsync(fixture);
+      const { running, built } = transition;
+
+      // As rush-client sends them: it marks only build, rebuild, install and update as built-in commands. `list`
+      // only reads the workspace; `install-autoinstaller` would stop the work that finished requests continue, and
+      // there is none.
+      const answers: ITerminalExchange[] = await Promise.all(
+        [
+          ['list', '--to', 'c'],
+          ['install-autoinstaller', '--name', 'tools']
+        ].map((argv: string[]) =>
+          fixture.runAsync(argv, {
+            commandOrigin: 'custom',
+            admission: { waitTimeoutMs: 5_000 }
+          })
+        )
+      );
+      for (const { frames, terminal } of answers) {
+        expect(terminal).toMatchObject({
+          kind: 'requestRejected',
+          payload: {
+            code: 'unsupported',
+            message: expect.stringContaining('is a built-in command that is not phased')
+          }
+        });
+        expect(frames.filter(isQueuePosition)).toEqual([]);
+      }
+      // Neither waited for the rebuild or the build, and neither stopped the rebuild.
+      expect(await isSettledAsync(running)).toBe(false);
+      expect(await isSettledAsync(built)).toBe(false);
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(fixture.runs()).toEqual(['c']);
+
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect((await built).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.patient.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
+
+describe('a custom command', () => {
+  it('waits for admission while a build waits behind the running build to reload the graph, and is served', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      transition = await holdTransitionAsync(fixture);
+      const { running, built } = transition;
+
+      // Only its parse, after admission, can tell whether the daemon serves a custom command.
+      const tested: Promise<ITerminalExchange> = fixture.runAsync(['test', '--to', 'c'], {
+        commandOrigin: 'custom',
+        admission: { waitTimeoutMs: 60_000 }
+      });
+      await delayAsync(1_000);
+      expect(await isSettledAsync(tested)).toBe(false);
+      expect(await isSettledAsync(running)).toBe(false);
+      expect(await isSettledAsync(built)).toBe(false);
+
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect((await built).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { frames, terminal } = await tested;
+      expect(frames.filter(isQueuePosition)).not.toEqual([]);
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.patient.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});

From fc21c8d70210a6340534e2b2cfc3cefd23c96951 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:04 +0000
Subject: [PATCH 157/265] [rush-client-core] Test that a held daemon keeps its
 ownership when a restart times out

Swarm integration step 142; original commit a95c5781f7 (merge of swarm/r06-t184-nits-m4 at b3b25ac539).
Refs: task 184, t05's P3 NIT.
Scope: task 184.

Brings 184-nits-m4 (branch swarm/r06-t184-nits-m4). Second agent: t05 board 5138. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 7 of 19. Gate: ch01 GATE OK board 5319 (tree f7a5ebb16c)

Commits folded into this step (3):
- f928ed0c26 [rush-daemon] Escape format and separator characters and backslashes in restart variable names (task 184 NITs 1 and 2)
- e5fa44afd3 [rush-client-core] Test that a failed restart keeps a timeout error's code (task 184 NIT 4)
- b3b25ac539 [rush-client-core] Test that a held daemon keeps its ownership when a restart times out (task 184, t05's P3 NIT)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...84-nits-timeout-test_2026-09-29-10-10.json |  11 ++
 ...06-t184-nits-escapes_2026-09-29-10-10.json |  11 ++
 ...06-t184-nits-escapes_2026-09-29-10-10.json |  11 ++
 .../src/test/DaemonRestartFailedError.test.ts | 124 ++++++++++++++++++
 .../src/test/fixtures/daemon.ts               |   4 +-
 libraries/rush-daemon-protocol/README.md      |   7 +-
 .../src/DaemonEnvironmentChange.ts            |   5 +-
 .../src/EnvironmentRestartReason.ts           |  27 ++--
 .../src/test/EnvironmentRestartReason.test.ts |  31 +++++
 9 files changed, 214 insertions(+), 17 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/r06-t184-nits-timeout-test_2026-09-29-10-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r06-t184-nits-escapes_2026-09-29-10-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t184-nits-escapes_2026-09-29-10-10.json
 create mode 100644 libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/r06-t184-nits-timeout-test_2026-09-29-10-10.json b/common/changes/@rushstack/rush-client-core/r06-t184-nits-timeout-test_2026-09-29-10-10.json
new file mode 100644
index 0000000000..09e6712413
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r06-t184-nits-timeout-test_2026-09-29-10-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Test that a failed restart keeps the code and message of a startup error whose code is not `startupFailed`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r06-t184-nits-escapes_2026-09-29-10-10.json b/common/changes/@rushstack/rush-daemon-protocol/r06-t184-nits-escapes_2026-09-29-10-10.json
new file mode 100644
index 0000000000..19573f743f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r06-t184-nits-escapes_2026-09-29-10-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Document that `environmentChanged` variable names also have format, line separator and paragraph separator characters and backslashes written as `\\xHH` or `\\u{H…}` escapes.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r06-t184-nits-escapes_2026-09-29-10-10.json b/common/changes/@rushstack/rush-daemon/r06-t184-nits-escapes_2026-09-29-10-10.json
new file mode 100644
index 0000000000..6d7f929533
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t184-nits-escapes_2026-09-29-10-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A variable name in an environment restart reason now also has each format, line separator or paragraph separator character, such as a bidirectional override or U+2028, written as an escape (`\\xHH` below U+0100 and `\\u{H…}` above), and each backslash written as `\\x5c`. So the name prints on one line, and each escape in it stands for one character.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts b/libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts
new file mode 100644
index 0000000000..b7f67d1a50
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonRestartFailedError.test.ts
@@ -0,0 +1,124 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient } from '../DaemonClient';
+import { DaemonClientError } from '../DaemonClientError';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { DaemonRestartFailedError, executeWithDaemonRestartAsync } from '../executeWithDaemonRestart';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+function readLines(filePath: string): string[] {
+  return fs.readFileSync(filePath, 'utf8').trim().split('\n');
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe(DaemonRestartFailedError.name, () => {
+  let folder: string;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-restart-failed-'));
+    const paths: IDaemonPaths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-restart-failed-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = readLines(path.join(folder, 'starts'));
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(readLines(path.join(folder, 'parents')));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  it('keeps the code and message of a startup error whose code is timeout', async () => {
+    // The daemon asks for a restart because its installation was removed, and then keeps its ownership.
+    const connection: IConnectOrStartDaemonOptions = {
+      ...options,
+      startCommand: {
+        ...options.startCommand!,
+        args: [...options.startCommand!.args, 'fixture', 'restart-installation-held']
+      }
+    };
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const request = captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false }
+    });
+    let error: unknown;
+    try {
+      // The handoff times out while the previous daemon still owns the lockfile, which is a `timeout` error.
+      error = await executeWithDaemonRestartAsync(
+        client,
+        { ...connection, startupTimeoutMs: 100 },
+        { request }
+      ).catch((caught: unknown) => caught);
+    } finally {
+      await client.closeAsync();
+    }
+    expect(error).toBeInstanceOf(DaemonRestartFailedError);
+    const { cause, code, message, restartReason } = error as DaemonRestartFailedError;
+    expect(cause).toBeInstanceOf(DaemonClientError);
+    expect(cause).not.toBeInstanceOf(DaemonRestartFailedError);
+    expect((cause as DaemonClientError).code).toBe('timeout');
+    expect(code).toBe('timeout');
+    expect(message).toBe((cause as DaemonClientError).message);
+    expect(message).toContain('The previous daemon still owns');
+    expect(restartReason).toEqual({
+      kind: 'installationChanged',
+      change: 'removed',
+      folder: path.join(folder, 'gone')
+    });
+    expect(readLines(path.join(folder, 'starts'))).toHaveLength(1);
+    expect(readLines(path.join(folder, 'requests'))).toHaveLength(1);
+    // The daemon kept its ownership: it did not stop as if for an ordinary restart.
+    expect(readIfPresent(path.join(folder, 'restarted'))).toBe('');
+  });
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 9675772ec3..55dc111795 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -129,7 +129,7 @@ async function mainAsync(): Promise<void> {
                 outcome: restart ? 'failure' : 'success',
                 aborted: false,
                 ...(restart ? { retryAfterRestart: true as const } : {}),
-                ...(restart && restartMode === 'restart-installation'
+                ...(restart && restartMode?.startsWith('restart-installation')
                   ? {
                       restartReason: {
                         kind: 'installationChanged' as const,
@@ -149,7 +149,7 @@ async function mainAsync(): Promise<void> {
                 process.exitCode = 1;
               });
             }
-          } else if (restart && restartMode !== 'restart-held') {
+          } else if (restart && !restartMode?.endsWith('-held')) {
             fs.appendFileSync(path.join(folder, 'restarted'), 'r');
             await stopAsync();
           }
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index fcbfb1bf8c..dfc43d3a05 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -67,9 +67,10 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   string. The ordinary mutation result has no retry flag and drains before restart.
   A retry result may say why in `restartReason`: `installationChanged` names the folder that
   was removed or replaced, and `environmentChanged` names the environment variables that
-  differ from the daemon's, never their values, with each control character of a name, such
-  as a newline or ESC, sent as a `\xHH` escape so that a client prints the names on one line.
-  Clients ignore kinds they do not know.
+  differ from the daemon's, never their values. Each control, format, line separator or
+  paragraph separator character of a name, such as a newline, ESC, U+2028 or a bidirectional
+  override, and each backslash, is sent as a `\xHH` or `\u{H…}` escape, so that a client prints
+  the names on one line. Clients ignore kinds they do not know.
 - **Read-only workspace status** - optional `pong.payload.workspace` reports the provider generation,
   installed session token, graph existence and real warm accounting. An absent token means no session is
   installed; an absent `warmSet` means no controller is attached, not zero memory. Warm status includes
diff --git a/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
index d8ad2dd72d..5f629a838e 100644
--- a/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonEnvironmentChange.ts
@@ -13,8 +13,9 @@ export interface IDaemonEnvironmentChangedRestartReason {
   /**
    * The sorted names of the variables that differ: those that only one of the two environments sets, and those that
    * they set to different values. Values are never sent, because a variable such as `NODE_OPTIONS` can carry a
-   * secret. Each control character of a name, such as a newline or ESC, is sent as a `\xHH` escape, so that a client
-   * can print the names on one line. A daemon may send an empty list.
+   * secret. Each control, format, line separator or paragraph separator character of a name, such as a newline, ESC,
+   * U+2028 or a bidirectional override, and each backslash, is sent as an escape: `\xHH` below U+0100 and `\u{H…}`
+   * from there on. So a client can print the names on one line. A daemon may send an empty list.
    */
   readonly variableNames: readonly string[];
 }
diff --git a/libraries/rush-daemon/src/EnvironmentRestartReason.ts b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
index 52e01f3869..a70282dfc1 100644
--- a/libraries/rush-daemon/src/EnvironmentRestartReason.ts
+++ b/libraries/rush-daemon/src/EnvironmentRestartReason.ts
@@ -10,8 +10,12 @@ import type { IDaemonEnvironmentChangedRestartReason } from '@rushstack/rush-dae
  */
 export type EnvironmentIdentityEntries = ReadonlyMap<string, string>;
 
-/** A control character, such as a newline or ESC, which would split or restyle a line that prints the name. */
-const CONTROL_CHARACTER: RegExp = /\p{Cc}/gu;
+/**
+ * A character that would split, restyle or reorder a line that prints the name: a control character, such as a
+ * newline or ESC, a line or paragraph separator, or a format character, such as a bidirectional override. A
+ * backslash is escaped too, so that each escape in a printed name stands for one character of the name.
+ */
+const ESCAPED_CHARACTER: RegExp = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\\]/gu;
 
 /** Returns the variables of `environment` that a daemon's identity includes. */
 export function getEnvironmentIdentityEntries(
@@ -22,10 +26,11 @@ export function getEnvironmentIdentityEntries(
 
 /**
  * Says why a daemon that started with `startupEntries` restarts for a request with `environment`: the sorted names
- * of the variables that are set in only one of them or set to different values, never the values. Each control
- * character of a name is written as a `\xHH` escape, so that the client and the daemon log print the names on one
- * line. Returns `undefined` when the environments do not differ, which is when their fingerprint `environmentHash` is
- * the same.
+ * of the variables that are set in only one of them or set to different values, never the values. Each control,
+ * format, line separator or paragraph separator character of a name, and each backslash, is written as an escape:
+ * `\xHH` below U+0100 and `\u{H…}` from there on. So the client and the daemon log print the names on one line, and
+ * a name that contains ESC prints differently from one that contains the text `\x1b`. Returns `undefined` when the
+ * environments do not differ, which is when their fingerprint `environmentHash` is the same.
  */
 export function getEnvironmentRestartReason(
   startupEntries: EnvironmentIdentityEntries,
@@ -44,8 +49,10 @@ export function getEnvironmentRestartReason(
 }
 
 function escapeVariableName(name: string): string {
-  return name.replace(
-    CONTROL_CHARACTER,
-    (character: string) => `\\x${character.charCodeAt(0).toString(16).padStart(2, '0')}`
-  );
+  return name.replace(ESCAPED_CHARACTER, (character: string) => {
+    // The `u` flag matches a character above U+FFFF as one character, so this is its whole code point.
+    const codePoint: number = character.codePointAt(0)!;
+    const hex: string = codePoint.toString(16);
+    return codePoint < 0x100 ? `\\x${hex.padStart(2, '0')}` : `\\u{${hex}}`;
+  });
 }
diff --git a/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
index a47098dc91..e6abd4630b 100644
--- a/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
+++ b/libraries/rush-daemon/src/test/EnvironmentRestartReason.test.ts
@@ -78,4 +78,35 @@ describe(getEnvironmentRestartReason.name, () => {
       ]
     });
   });
+
+  it('escapes line and paragraph separators and format characters, such as a bidirectional override', () => {
+    const reason = getEnvironmentRestartReason(startupEntries, {
+      ...STARTUP,
+      'NAME_LS\u2028PS\u2029': 'a',
+      'NAME_BIDI\u202eRLO\u2066LRI\u200bZWSP': 'b',
+      'NAME_SHY\u00adTAG\u{e0001}': 'c',
+      'NAME_PRINTABLE_\u{1f600}': 'd'
+    });
+    expect(reason).toEqual({
+      kind: 'environmentChanged',
+      variableNames: [
+        'NAME_BIDI\\u{202e}RLO\\u{2066}LRI\\u{200b}ZWSP',
+        'NAME_LS\\u{2028}PS\\u{2029}',
+        'NAME_PRINTABLE_\u{1f600}',
+        'NAME_SHY\\xadTAG\\u{e0001}'
+      ]
+    });
+  });
+
+  it('escapes a backslash, so that ESC and the text "\\x1b" in a name print differently', () => {
+    const reason = getEnvironmentRestartReason(startupEntries, {
+      ...STARTUP,
+      'NAME_Q\u001b': 'a',
+      'NAME_Q\\x1b': 'b'
+    });
+    expect(reason).toEqual({
+      kind: 'environmentChanged',
+      variableNames: ['NAME_Q\\x1b', 'NAME_Q\\x5cx1b']
+    });
+  });
 });

From 96779ba24d3ffd1a02f84414eeb97b55bd1aac94 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:04 +0000
Subject: [PATCH 158/265] [heft-webpack5-plugin] Wait for pending watch events
 before a flush

Swarm integration step 143; original commit 0e688b8284 (merge of swarm/r03-t217 at 731764213b).
Scope: task 217.

Brings 217 (branch swarm/r03-t217). Second agent: o08 board 4985, board 4986. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 8 of 19. Gate: ch01 GATE OK board 5319 (tree 27f9e04d2e)

Commits folded into this step (1):
- 731764213b [heft-webpack5-plugin] Wait for pending watch events before a flush

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...5-plugin-watch-flush_2026-09-29-09-18.json |  11 +
 .../src/DeferredWatchFileSystem.ts            | 126 +++++++-
 .../src/Webpack5Plugin.ts                     |   3 +-
 .../src/test/DeferredWatchFileSystem.test.ts  | 306 ++++++++++++++++++
 4 files changed, 444 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/heft-webpack5-plugin/heft-webpack5-plugin-watch-flush_2026-09-29-09-18.json
 create mode 100644 heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts

diff --git a/common/changes/@rushstack/heft-webpack5-plugin/heft-webpack5-plugin-watch-flush_2026-09-29-09-18.json b/common/changes/@rushstack/heft-webpack5-plugin/heft-webpack5-plugin-watch-flush_2026-09-29-09-18.json
new file mode 100644
index 0000000000..09771b1b3c
--- /dev/null
+++ b/common/changes/@rushstack/heft-webpack5-plugin/heft-webpack5-plugin-watch-flush_2026-09-29-09-18.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-webpack5-plugin",
+      "comment": "Fix an issue in watch mode where Webpack could miss a file that an upstream task had just written, which made the Webpack task report \"Webpack has not detected changes\" and start another run later. Before it resumes the compilation, the plugin now waits for the file watcher to finish recording the changes it has already seen, for up to 1 second. This also fixes an extra compilation that could start after a compilation that included a change recorded in the same millisecond that the compilation started.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-webpack5-plugin",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts b/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts
index 4d91e5c299..34e7c7a2c7 100644
--- a/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/DeferredWatchFileSystem.ts
@@ -1,9 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
 import Watchpack, { type WatchOptions } from 'watchpack';
 import type { Compiler, WebpackPluginInstance, InputFileSystem } from 'webpack';
 
+/**
+ * The longest time that {@link DeferredWatchFileSystem.flushAsync} waits for watchpack to finish recording the
+ * file system events that it has received.
+ */
+const MAX_PENDING_EVENTS_WAIT_MS: number = 1000;
+const PENDING_EVENTS_POLL_INTERVAL_MS: number = 1;
+
 export type { InputFileSystem };
 export type WatchFileSystem = NonNullable<Compiler['watchFileSystem']>;
 export type WatchCallback = Parameters<WatchFileSystem['watch']>[5];
@@ -31,6 +41,33 @@ interface ITimeInfoEntries {
   contextTimeInfoEntries: FileSystemMap;
 }
 
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that show whether it is still recording a change.
+ * They aren't part of watchpack's public API, so they are all optional.
+ */
+interface IDirectoryWatcherInternals {
+  /**
+   * True while the watcher reads the directory. Changes that the scan finds are recorded as it goes.
+   */
+  scanning?: boolean;
+  /**
+   * The names of the files that have an OS event whose `fs.lstat()` hasn't finished yet. The change is
+   * recorded only when the `fs.lstat()` finishes.
+   */
+  _activeEvents?: Map<string, boolean>;
+}
+
+/**
+ * A watchpack instance with the internal state that {@link DeferredWatchFileSystem.flushAsync} inspects.
+ * Every watchpack instance that is created with the same options object shares one watcher manager, which
+ * removes a directory watcher from `directoryWatchers` when the watcher closes.
+ */
+interface IWatchpackWithInternals extends Watchpack {
+  watcherManager?: {
+    directoryWatchers?: Map<string, IDirectoryWatcherInternals>;
+  };
+}
+
 export class DeferredWatchFileSystem implements WatchFileSystem {
   public readonly inputFileSystem: InputFileSystem;
   public readonly watcherOptions: WatchOptions;
@@ -38,6 +75,7 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
 
   readonly #onChange: () => void;
   #state: IWatchState | undefined;
+  #isFlushing: boolean = false;
 
   public constructor(inputFileSystem: InputFileSystem, onChange: () => void) {
     this.inputFileSystem = inputFileSystem;
@@ -90,6 +128,40 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     return false;
   }
 
+  /**
+   * Like {@link DeferredWatchFileSystem.flush}, but first lets watchpack finish recording the file system events
+   * that it has already received.
+   *
+   * @remarks
+   * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a file that an upstream
+   * task wrote just before a call to `flush()` can be missing from the changes. This method waits until the
+   * directory watchers have no events or scans in progress, for up to 1 second. If there are changes, it then
+   * waits for the clock to pass the time when they were recorded. The compilation that the callback starts takes
+   * its start time from the clock, and the next `watch()` call reports every change recorded at or after that
+   * start time again, as "outdated on attach".
+   *
+   * While this method waits, it keeps the changes that the watcher reports for the flush, and doesn't call
+   * `onChange` for them.
+   */
+  public async flushAsync(): Promise<boolean> {
+    if (!this.#state) {
+      return false;
+    }
+
+    this.#isFlushing = true;
+    try {
+      await this.#waitForPendingEventsAsync();
+      if (!this.watcher) {
+        // The watcher was closed while this method waited.
+        return false;
+      }
+
+      return this.flush();
+    } finally {
+      this.#isFlushing = false;
+    }
+  }
+
   public watch(
     files: Iterable<string>,
     directories: Iterable<string>,
@@ -122,7 +194,11 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
         removals.add(removal);
       }
 
-      this.#onChange();
+      // flushAsync() passes these changes to the callback when it finishes waiting, so they don't need
+      // another run.
+      if (!this.#isFlushing) {
+        this.#onChange();
+      }
     });
 
     this.watcher.watch({
@@ -171,6 +247,54 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     };
   }
 
+  async #waitForPendingEventsAsync(): Promise<void> {
+    // Let the event loop reach its poll phase, which delivers the OS events that were already queued when
+    // flushAsync() was called. If flushAsync() was called during a poll phase, the first check phase comes
+    // before the next poll phase, so it takes two turns.
+    await setImmediateAsync();
+    await setImmediateAsync();
+
+    const deadline: number = performance.now() + MAX_PENDING_EVENTS_WAIT_MS;
+    while (this.#hasPendingEvents() && performance.now() < deadline) {
+      await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+    }
+
+    if (this.#hasChanges()) {
+      // Watchpack stamps each change with Date.now() when it records it, and webpack takes the start time of
+      // the compilation from Date.now() as well. If they are equal, the next watch() reports the change again.
+      const recordedTime: number = Date.now();
+      while (Date.now() <= recordedTime) {
+        await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+      }
+    }
+  }
+
+  #hasPendingEvents(): boolean {
+    const directoryWatchers: Map<string, IDirectoryWatcherInternals> | undefined = (
+      this.watcher as IWatchpackWithInternals | undefined
+    )?.watcherManager?.directoryWatchers;
+    if (!(directoryWatchers instanceof Map)) {
+      return false;
+    }
+
+    for (const directoryWatcher of directoryWatchers.values()) {
+      if (directoryWatcher.scanning || (directoryWatcher._activeEvents?.size ?? 0) > 0) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  #hasChanges(): boolean {
+    const state: IWatchState | undefined = this.#state;
+    const watcher: Watchpack | undefined = this.watcher;
+    return (
+      (!!state && (state.changes.size > 0 || state.removals.size > 0)) ||
+      (!!watcher && (watcher.aggregatedChanges.size > 0 || watcher.aggregatedRemovals.size > 0))
+    );
+  }
+
   #fetchTimeInfo(): ITimeInfoEntries {
     const fileTimeInfoEntries: IRawFileSystemMap = new Map();
     const contextTimeInfoEntries: IRawFileSystemMap = new Map();
diff --git a/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts b/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
index bfa7e1e0dd..8dbeabaf68 100644
--- a/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
@@ -400,7 +400,8 @@ export default class Webpack5Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
     if (!isInitial && this.#watchFileSystems) {
       hasChanges = false;
       for (const watchFileSystem of this.#watchFileSystems) {
-        hasChanges = watchFileSystem.flush() || hasChanges;
+        // The upstream tasks may have just written files that the watcher has seen but not recorded yet.
+        hasChanges = (await watchFileSystem.flushAsync()) || hasChanges;
       }
     }
 
diff --git a/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
new file mode 100644
index 0000000000..e06da7c901
--- /dev/null
+++ b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -0,0 +1,306 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import type { WatchOptions } from 'watchpack';
+
+import { DeferredWatchFileSystem, type InputFileSystem, type Watcher } from '../DeferredWatchFileSystem';
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that these tests read or set.
+ */
+interface IDirectoryWatcherInternals {
+  scanning: boolean;
+  _activeEvents: Map<string, boolean>;
+}
+
+interface IFlush {
+  changes: string[];
+  removals: string[];
+}
+
+// On Linux, inotify queues the event for a write during the write, so the event loop delivers it on its next poll.
+// Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+// Enough work to keep a thread of the thread pool busy for about 100 ms.
+const PBKDF2_ITERATIONS: number = 200000;
+
+describe(DeferredWatchFileSystem.name, () => {
+  let folder: string;
+  let watchOptions: WatchOptions;
+  let onChange: jest.Mock<void, []>;
+  let purge: jest.Mock<void, [string]>;
+  let watchFileSystem: DeferredWatchFileSystem;
+  let watcher: Watcher | undefined;
+  let flushes: IFlush[];
+  let compilationStartTimes: number[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack5-plugin-test-'));
+    watchOptions = { aggregateTimeout: 20 };
+    onChange = jest.fn();
+    purge = jest.fn();
+    watchFileSystem = new DeferredWatchFileSystem({ purge } as unknown as InputFileSystem, onChange);
+    watcher = undefined;
+    flushes = [];
+    compilationStartTimes = [];
+  });
+
+  afterEach(() => {
+    watcher?.close();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createFile(name: string): string {
+    const filePath: string = path.join(folder, name);
+    fs.writeFileSync(filePath, 'initial');
+    // An old modification time, so that the first scan doesn't report the file as changed.
+    const past: Date = new Date(Date.now() - 60000);
+    fs.utimesSync(filePath, past, past);
+    return filePath;
+  }
+
+  /**
+   * Watches the files as webpack's `Watching` does. When a flush calls back, the callback takes the start time of
+   * the compilation from the clock and pauses the watcher, as `Watching._go()` does.
+   */
+  function watch(files: string[], startTime: number): void {
+    watcher = watchFileSystem.watch(
+      files,
+      [],
+      [],
+      startTime,
+      watchOptions,
+      (error, fileTimeInfoEntries, contextTimeInfoEntries, changes, removals) => {
+        compilationStartTimes.push(Date.now());
+        watcher?.pause();
+        flushes.push({
+          changes: Array.from(changes ?? []).sort(),
+          removals: Array.from(removals ?? []).sort()
+        });
+      },
+      () => {
+        // Webpack's undelayed callback isn't used.
+      }
+    );
+  }
+
+  function getDirectoryWatchers(): IDirectoryWatcherInternals[] {
+    const internals: { watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> } } =
+      watchFileSystem.watcher as unknown as {
+        watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> };
+      };
+    return Array.from(internals.watcherManager.directoryWatchers.values());
+  }
+
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = performance.now() + 5000;
+    while (!condition()) {
+      if (performance.now() > deadline) {
+        throw new Error('The condition was not met within 5 seconds');
+      }
+      await setImmediateAsync();
+    }
+  }
+
+  async function watchAndWaitForScanAsync(files: string[]): Promise<void> {
+    watch(files, Date.now());
+    await waitForAsync(() => getDirectoryWatchers().every((directoryWatcher) => !directoryWatcher.scanning));
+  }
+
+  /**
+   * Keeps every thread of the thread pool busy for a while, so that the `fs.readdir()` and `fs.lstat()` calls
+   * that the watcher makes next wait in the queue.
+   */
+  function occupyThreadPoolAsync(): Promise<void[]> {
+    const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const tasks: Promise<void>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      tasks.push(
+        new Promise<void>((resolve, reject) => {
+          crypto.pbkdf2('password', 'salt', PBKDF2_ITERATIONS, 64, 'sha512', (error) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve();
+            }
+          });
+        })
+      );
+    }
+    return Promise.all(tasks);
+  }
+
+  it('returns false before watch() is called', async () => {
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+  });
+
+  it('returns false and calls back nothing when nothing changed', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+
+    await setTimeoutAsync(50);
+    expect(flushes).toEqual([]);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file that was written just before the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    fs.writeFileSync(file, 'changed');
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    expect(purge).toHaveBeenCalledWith(file);
+    await busyThreadPool;
+    await setTimeoutAsync(50);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    fs.writeFileSync(file, 'changed');
+    await waitForAsync(() =>
+      getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
+    );
+    expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    await busyThreadPool;
+  });
+
+  itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    // An fs callback runs in the poll phase, after the event loop has collected the events that were ready, so
+    // the event for this write can't arrive before the next poll phase.
+    const flushPromise: Promise<boolean> = new Promise<boolean>((resolve, reject) => {
+      fs.stat(file, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          fs.writeFileSync(file, 'changed');
+          resolve(watchFileSystem.flushAsync());
+        }
+      });
+    });
+
+    await expect(flushPromise).resolves.toBe(true);
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux(
+    'keeps the changes that the watcher reports while it waits, without calling onChange',
+    async () => {
+      const fileA: string = createFile('a.js');
+      const fileB: string = createFile('b.js');
+      await watchAndWaitForScanAsync([fileA, fileB]);
+      let aggregatedCount: number = 0;
+      watchFileSystem.watcher!.on('aggregated', () => {
+        aggregatedCount++;
+      });
+
+      fs.writeFileSync(fileA, 'changed');
+      await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+      fs.writeFileSync(fileB, 'changed');
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+      expect(aggregatedCount).toBeGreaterThanOrEqual(1);
+      expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
+      await busyThreadPool;
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  itOnLinux(
+    'starts the compilation after the changes it passes, so the next watch() does not report them again',
+    async () => {
+      const file: string = createFile('a.js');
+      await watchAndWaitForScanAsync([file]);
+
+      const reportedAgain: number[] = [];
+      for (let i: number = 0; i < 10; i++) {
+        fs.writeFileSync(file, `change ${i}`);
+        await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(file));
+        await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+        // When the compilation is done, webpack's Watching calls watch() again with the compilation's start time.
+        // The new watcher reports every change that was recorded at or after that time, as "outdated on attach".
+        watch([file], compilationStartTimes[i]);
+        await setImmediateAsync();
+        reportedAgain.push(watchFileSystem.watcher!.aggregatedChanges.size);
+      }
+
+      expect(reportedAgain).toEqual(new Array(10).fill(0));
+      expect(flushes).toHaveLength(10);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  it('includes a change that a scan in progress finds', async () => {
+    const subfolder: string = path.join(folder, 'sub');
+    fs.mkdirSync(subfolder);
+    const file: string = path.join(subfolder, 'a.js');
+    fs.writeFileSync(file, 'new');
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    // A start time before the file was written, as for a file that changed during the compilation.
+    watch([file], Date.now() - 60000);
+    expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    await busyThreadPool;
+  });
+
+  it('returns false when the watcher is closed while it waits', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    watcher!.close();
+
+    await expect(flushPromise).resolves.toBe(false);
+    expect(flushes).toEqual([]);
+  });
+
+  it('stops waiting after 1 second', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const directoryWatcher: IDirectoryWatcherInternals = getDirectoryWatchers()[0];
+    // An event whose fs.lstat() never finishes
+    directoryWatcher._activeEvents.set('never-finishes.js', false);
+
+    try {
+      const startTime: number = performance.now();
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+      const elapsedMs: number = performance.now() - startTime;
+
+      expect(elapsedMs).toBeGreaterThanOrEqual(999);
+      expect(elapsedMs).toBeLessThan(3000);
+    } finally {
+      directoryWatcher._activeEvents.delete('never-finishes.js');
+    }
+  });
+});

From a873b3c32aacf89da1f2311c25cae4b0fc71b465 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:04 +0000
Subject: [PATCH 159/265] [rush-lib] Queue a watch iteration for edits made
 during an iteration

Swarm integration step 144; original commit b7520b9276 (merge of swarm/r01-t243 at b6e79d10e7).
Scope: task 243.

Brings 243 (branch swarm/r01-t243). Second agent: t02 board 5011, board 5013. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 9 of 19. Gate: ch01 GATE OK board 5319 (tree b0ac566070)

Commits folded into this step (1):
- b6e79d10e7 [rush-lib] Queue a watch iteration for edits made during an iteration

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...its-during-iteration_2026-09-29-10-50.json |  11 +
 .../cli/scriptActions/PhasedScriptAction.ts   |   1 +
 .../rush-lib/src/logic/ProjectWatcher.ts      |  86 +++++-
 .../src/logic/test/ProjectWatcher.test.ts     | 275 +++++++++++++++++-
 4 files changed, 363 insertions(+), 10 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r01-t243-watch-edits-during-iteration_2026-09-29-10-50.json

diff --git a/common/changes/@microsoft/rush/swarm-r01-t243-watch-edits-during-iteration_2026-09-29-10-50.json b/common/changes/@microsoft/rush/swarm-r01-t243-watch-edits-during-iteration_2026-09-29-10-50.json
new file mode 100644
index 0000000000..1f61482e60
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r01-t243-watch-edits-during-iteration_2026-09-29-10-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue in watch mode where a file that was edited while an iteration ran did not queue a new iteration, so the edit waited for the next file change. When an iteration ends, watch mode now compares a new snapshot of the inputs with the iteration's snapshot, and queues another iteration if the inputs of any operation changed.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index ed6f2a74ca..6220442cb3 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -1190,6 +1190,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           rushConfiguration: this.rushConfiguration,
           graph,
           initialSnapshot,
+          getInputsSnapshotAsync,
           terminal: presentationTerminal,
           debounceMs: this.#watchDebounceMs,
           renderStatusInPlace: !_isRushSessionOperationStreamEnabled(this.rushSession)
diff --git a/libraries/rush-lib/src/logic/ProjectWatcher.ts b/libraries/rush-lib/src/logic/ProjectWatcher.ts
index 3d700cdc1a..d06d989000 100644
--- a/libraries/rush-lib/src/logic/ProjectWatcher.ts
+++ b/libraries/rush-lib/src/logic/ProjectWatcher.ts
@@ -11,7 +11,7 @@ import { Path } from '@rushstack/node-core-library';
 import { Colorize, type ITerminal } from '@rushstack/terminal';
 
 import { Git } from './Git';
-import type { IInputsSnapshot } from './incremental/InputsSnapshot';
+import type { GetInputsSnapshotAsyncFn, IInputsSnapshot } from './incremental/InputsSnapshot';
 import type { RushConfiguration } from '../api/RushConfiguration';
 import type { RushConfigurationProject } from '../api/RushConfigurationProject';
 import type { IOperationGraph, IOperationGraphIterationOptions } from './operations/IOperationGraph';
@@ -27,6 +27,11 @@ export interface IProjectWatcherOptions {
   renderStatusInPlace?: boolean;
   /** Initial inputs snapshot; required so watcher can enumerate nested folders immediately */
   initialSnapshot: IInputsSnapshot;
+  /**
+   * Takes a new inputs snapshot, like the graph does for each iteration. If provided, the watcher uses it when the
+   * graph goes idle after an iteration, to find inputs that changed while the iteration ran.
+   */
+  getInputsSnapshotAsync?: GetInputsSnapshotAsyncFn;
 }
 
 export interface IProjectChangeResult {
@@ -94,6 +99,9 @@ interface IRunRequest {
  *
  * Uses `fs.watch()` rather than `chokidar` because only a boolean "something changed"
  * signal is needed; actual change detection is deferred to `getInputsSnapshotAsync`.
+ *
+ * The file system watchers are closed while an iteration runs. When the graph next goes idle, the watcher opens
+ * them again, then compares a new snapshot with the iteration's to find the edits made in the meantime.
  */
 export class ProjectWatcher {
   readonly #debounceMs: number;
@@ -101,6 +109,7 @@ export class ProjectWatcher {
   readonly #terminal: ITerminal;
   readonly #graph: IOperationGraph;
   readonly #renderStatusInPlace: boolean;
+  readonly #getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined;
 
   #repoRoot: string | undefined;
   #watchers: Map<string, fs.FSWatcher> | undefined;
@@ -124,6 +133,10 @@ export class ProjectWatcher {
    */
   #hasQueuedFileChange: boolean = false;
   readonly #queuedRunRequests: Set<string> = new Set();
+  /**
+   * Identifies the pending check for inputs that changed during the last iteration. Clearing it cancels the check.
+   */
+  #inputsCheck: object | undefined;
 
   public constructor(options: IProjectWatcherOptions) {
     const {
@@ -132,13 +145,15 @@ export class ProjectWatcher {
       rushConfiguration,
       terminal,
       initialSnapshot,
-      renderStatusInPlace = true
+      renderStatusInPlace = true,
+      getInputsSnapshotAsync
     } = options;
     this.#graph = graph;
     this.#debounceMs = debounceMs;
     this.#rushConfiguration = rushConfiguration;
     this.#terminal = terminal;
     this.#renderStatusInPlace = renderStatusInPlace;
+    this.#getInputsSnapshotAsync = getInputsSnapshotAsync;
     this.#lastSnapshot = initialSnapshot; // Seed snapshot
 
     const gitPath: string = new Git(rushConfiguration).getGitPathOrThrow();
@@ -161,6 +176,8 @@ export class ProjectWatcher {
         this.#lastIterationId = firstRecord?.iterationId ?? this.#lastIterationId;
         // This iteration serves the file changes and run requests that were waiting to queue one.
         this.#clearDebounce();
+        // The check after this iteration compares against its snapshot, which is newer.
+        this.#inputsCheck = undefined;
         await this.#stopWatchingAsync();
       }
     );
@@ -173,6 +190,8 @@ export class ProjectWatcher {
       this.#startWatching();
       if (iterationRecords) {
         this.#requeueUnservedRunRequests(iterationRecords);
+        // Only after the watchers are open, so that an edit is either in the new snapshot or raises an event.
+        void this.#queueIterationIfInputsChangedAsync();
       }
     });
 
@@ -188,6 +207,7 @@ export class ProjectWatcher {
       'abort',
       () => {
         this.#clearDebounce();
+        this.#inputsCheck = undefined;
         this.#disposeStdin();
       },
       { once: true }
@@ -489,6 +509,47 @@ export class ProjectWatcher {
     }
   }
 
+  /**
+   * Called when the graph goes idle after an iteration. The watchers were closed while the iteration ran, so
+   * this compares the inputs of each operation in a new snapshot with the iteration's snapshot, and queues an
+   * iteration if any changed. Starting another iteration cancels the check.
+   */
+  async #queueIterationIfInputsChangedAsync(): Promise<void> {
+    const getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined = this.#getInputsSnapshotAsync;
+    const iterationSnapshot: IInputsSnapshot | undefined = this.#lastSnapshot;
+    if (!getInputsSnapshotAsync || !iterationSnapshot) {
+      return;
+    }
+    const check: object = {};
+    this.#inputsCheck = check;
+    let changedOperation: Operation | undefined;
+    try {
+      const currentSnapshot: IInputsSnapshot | undefined = await getInputsSnapshotAsync();
+      if (this.#inputsCheck !== check || !currentSnapshot) {
+        return;
+      }
+      changedOperation = _findOperationWithChangedInputs(
+        this.#graph.operations,
+        iterationSnapshot,
+        currentSnapshot
+      );
+    } catch (e) {
+      if (this.#inputsCheck === check) {
+        this.#terminal.writeErrorLine(
+          `Failed to check for file changes made during the iteration: ${(e as Error).message}`
+        );
+      }
+      return;
+    }
+    if (changedOperation) {
+      this.#terminal.writeDebugLine(
+        `ProjectWatcher: the inputs of ${changedOperation.name} changed during the iteration`
+      );
+      this.#hasQueuedFileChange = true;
+      this.#debounce();
+    }
+  }
+
   /**
    * Sets up a raw-mode stdin listener so the user can interact with the watch session
    * via single-key keybinds. Captures the previous raw-mode state for restoration on dispose.
@@ -635,6 +696,27 @@ export class ProjectWatcher {
   }
 }
 
+/**
+ * Returns an operation whose own state hash differs between the two snapshots, if there is one. The own state
+ * hash covers the operation's tracked files, additional files and environment variables.
+ */
+function _findOperationWithChangedInputs(
+  operations: Iterable<Operation>,
+  previousSnapshot: IInputsSnapshot,
+  currentSnapshot: IInputsSnapshot
+): Operation | undefined {
+  for (const operation of operations) {
+    const { associatedProject, associatedPhase } = operation;
+    if (
+      currentSnapshot.getOperationOwnStateHash(associatedProject, associatedPhase.name) !==
+      previousSnapshot.getOperationOwnStateHash(associatedProject, associatedPhase.name)
+    ) {
+      return operation;
+    }
+  }
+  return undefined;
+}
+
 /**
  * Given an iterable of repo-relative file paths, yields the set of directory prefixes
  * that should be watched to cover those files. Used on platforms without native recursive
diff --git a/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts b/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
index d3bf5a4d47..0943e7a0e2 100644
--- a/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
+++ b/libraries/rush-lib/src/logic/test/ProjectWatcher.test.ts
@@ -171,13 +171,75 @@ interface IWatchSession {
    * Operations to run in the next iteration even if their last result is current, as if their files changed.
    */
   readonly dirty: Set<Operation>;
+  /**
+   * The inputs snapshots that the graph and the watcher take, if the session has them.
+   */
+  readonly snapshots: IMockInputsSnapshots;
   idleCount: number;
   watcher?: ProjectWatcher;
 }
 
+interface IMockInputsSnapshots {
+  /**
+   * The version of the inputs of each operation, as if in the working tree. An inputs snapshot copies it.
+   */
+  readonly inputVersions: Map<Operation, number>;
+  /**
+   * Takes the inputs snapshots of the graph.
+   */
+  getGraphSnapshotAsync: () => Promise<IInputsSnapshot | undefined>;
+  /**
+   * Takes the inputs snapshots of the watcher.
+   */
+  getWatcherSnapshotAsync: () => Promise<IInputsSnapshot | undefined>;
+  /**
+   * How many inputs snapshots the watcher has asked for.
+   */
+  watcherSnapshotCount: number;
+}
+
+interface IWatchSessionOptions {
+  debounceMs?: number;
+  /**
+   * Whether the graph and the watcher take inputs snapshots, as they do in a Git repository.
+   */
+  hasInputsSnapshots?: boolean;
+}
+
 const sessions: IWatchSession[] = [];
 
-function createWatchSession(operations: Operation[], debounceMs: number = DEBOUNCE_MS): IWatchSession {
+/**
+ * Like a Git-backed inputs snapshot. The own state hash of an operation is the version of its inputs when the
+ * snapshot was taken.
+ */
+function createInputsSnapshot(inputVersions: ReadonlyMap<Operation, number>): IInputsSnapshot {
+  const hashByOperationKey: Map<string, string> = new Map();
+  for (const [{ name, associatedProject, associatedPhase }, version] of inputVersions) {
+    hashByOperationKey.set(`${associatedProject.packageName}#${associatedPhase.name}`, `${name}@${version}`);
+  }
+  return {
+    // The edits in these tests change inputs that only the operation's phase depends on, like its additional
+    // files, so the hash of the project alone does not change.
+    getOperationOwnStateHash: (project: RushConfigurationProject, operationName?: string) =>
+      hashByOperationKey.get(`${project.packageName}#${operationName}`) ?? project.packageName,
+    getTrackedFileHashesForOperation: () => undefined
+  } as unknown as IInputsSnapshot;
+}
+
+function editInputs(session: IWatchSession, operation: Operation): void {
+  const { inputVersions } = session.snapshots;
+  inputVersions.set(operation, (inputVersions.get(operation) ?? 0) + 1);
+}
+
+function createWatchSession(operations: Operation[], options: IWatchSessionOptions = {}): IWatchSession {
+  const { debounceMs = DEBOUNCE_MS, hasInputsSnapshots = false } = options;
+  const inputVersions: Map<Operation, number> = new Map(operations.map((operation) => [operation, 0]));
+  const snapshots: IMockInputsSnapshots = {
+    inputVersions,
+    getGraphSnapshotAsync: async () => createInputsSnapshot(inputVersions),
+    getWatcherSnapshotAsync: async () => createInputsSnapshot(inputVersions),
+    watcherSnapshotCount: 0
+  };
   const abortController: AbortController = new AbortController();
   const graph: OperationGraph = new OperationGraph(new Set(operations), {
     quietMode: true,
@@ -186,7 +248,8 @@ function createWatchSession(operations: Operation[], debounceMs: number = DEBOUN
     allowOversubscription: true,
     destinations: [new MockWritable()],
     abortController,
-    isWatch: true
+    isWatch: true,
+    getInputsSnapshotAsync: hasInputsSnapshots ? () => snapshots.getGraphSnapshotAsync() : undefined
   });
   const session: IWatchSession = {
     graph,
@@ -195,16 +258,21 @@ function createWatchSession(operations: Operation[], debounceMs: number = DEBOUN
     settleMs: debounceMs * 10,
     iterations: [],
     dirty: new Set(),
+    snapshots,
     idleCount: 0
   };
   sessions.push(session);
 
   // Like PhasedOperationPlugin, runs the operations whose last result is not current.
-  graph.hooks.configureIteration.tap('test', (currentStates, lastStates) => {
+  graph.hooks.configureIteration.tap('test', (currentStates, lastStates, iterationOptions) => {
     for (const [operation, currentState] of currentStates) {
       const lastState: IOperationExecutionResult | undefined = lastStates.get(operation);
       currentState.enabled =
-        !lastState || !RETAINED_STATUSES.has(lastState.status) || session.dirty.has(operation);
+        !lastState ||
+        !RETAINED_STATUSES.has(lastState.status) ||
+        session.dirty.has(operation) ||
+        (!!iterationOptions.inputsSnapshot &&
+          currentState.getStateHashComponents().local !== lastState.getStateHashComponents().local);
     }
     session.dirty.clear();
   });
@@ -230,9 +298,13 @@ function createWatchSession(operations: Operation[], debounceMs: number = DEBOUN
     } as unknown as RushConfiguration,
     terminal: new Terminal(session.terminalProvider),
     renderStatusInPlace: false,
-    initialSnapshot: {
-      getTrackedFileHashesForOperation: () => undefined
-    } as unknown as IInputsSnapshot
+    initialSnapshot: createInputsSnapshot(inputVersions),
+    getInputsSnapshotAsync: hasInputsSnapshots
+      ? () => {
+          snapshots.watcherSnapshotCount++;
+          return snapshots.getWatcherSnapshotAsync();
+        }
+      : undefined
   });
   return session;
 }
@@ -515,7 +587,9 @@ describe(ProjectWatcher.name, () => {
   it('serves a pending request with an iteration that starts before the debounce interval ends', async () => {
     const a: ITestOperation = createOperation('a');
     const b: ITestOperation = createOperation('b');
-    const session: IWatchSession = createWatchSession([a.operation, b.operation], DEBOUNCE_MS * 5);
+    const session: IWatchSession = createWatchSession([a.operation, b.operation], {
+      debounceMs: DEBOUNCE_MS * 5
+    });
     await startWatchSessionAsync(session);
 
     a.runner.requestRun();
@@ -597,4 +671,189 @@ describe(ProjectWatcher.name, () => {
     expect(session.graph.hasScheduledIteration).toBe(false);
     expect(getStatuses(session)).toEqual(['Waiting for changes...']);
   });
+
+  describe('inputs that change during an iteration', () => {
+    it('queues an iteration for inputs that changed while an iteration ran', async () => {
+      const a: ITestOperation = createOperation('a');
+      const b: ITestOperation = createOperation('b');
+      const session: IWatchSession = createWatchSession([a.operation, b.operation], {
+        hasInputsSnapshots: true
+      });
+      a.runner.action = (runCount: number) => {
+        if (runCount === 1) {
+          editInputs(session, b.operation);
+          // The watchers are closed while an iteration runs, so this raises no event.
+          simulateFileChange();
+        }
+      };
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a', 'b'], ['b']]);
+      expect(a.runner.runCount).toBe(1);
+      expect(b.runner.runCount).toBe(2);
+      expect(getStatuses(session)).toEqual([
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...'
+      ]);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('does not queue an iteration if no inputs changed, even after a failure', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      a.runner.action = () => OperationStatus.Failure;
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(1);
+
+      // A file change still reruns the failed operation.
+      simulateFileChange();
+      await settleAsync(session);
+
+      expect(session.iterations).toEqual([['a'], ['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(2);
+      expect(a.runner.runCount).toBe(2);
+    });
+
+    it('compares the inputs with the snapshot of the iteration that ran last', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      await startWatchSessionAsync(session);
+
+      editInputs(session, a.operation);
+      simulateFileChange();
+      await settleAsync(session);
+
+      // The second iteration saw the edit, so the check after it finds no change.
+      expect(session.iterations).toEqual([['a'], ['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(2);
+      expect(getStatuses(session)).toEqual([
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...'
+      ]);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('ignores a check that completes after the next iteration starts', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      let releaseChecks: () => void = () => undefined;
+      const checksReleased: Promise<void> = new Promise((resolve) => {
+        releaseChecks = resolve;
+      });
+      session.snapshots.getWatcherSnapshotAsync = async () => {
+        await checksReleased;
+        return createInputsSnapshot(session.snapshots.inputVersions);
+      };
+      a.runner.action = async (runCount: number) => {
+        if (runCount === 2) {
+          // The check from before this iteration now sees the edit that this iteration serves.
+          releaseChecks();
+          await sleepAsync(DEBOUNCE_MS * 5);
+        }
+      };
+      await startWatchSessionAsync(session);
+
+      editInputs(session, a.operation);
+      simulateFileChange();
+      await settleAsync(session);
+
+      expect(session.iterations).toEqual([['a'], ['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(2);
+      expect(a.runner.runCount).toBe(2);
+    });
+
+    it('reports a check that fails and queues nothing', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      session.snapshots.getWatcherSnapshotAsync = async () => {
+        throw new Error('mock snapshot failure');
+      };
+      a.runner.action = () => editInputs(session, a.operation);
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a']]);
+      expect(session.terminalProvider.getErrorOutput()).toContain(
+        'Failed to check for file changes made during the iteration: mock snapshot failure'
+      );
+    });
+
+    it('does not report a check that fails after the watch session ends', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      let failCheck: () => void = () => undefined;
+      session.snapshots.getWatcherSnapshotAsync = () =>
+        new Promise((resolve, reject) => {
+          failCheck = () => reject(new Error('mock snapshot failure'));
+        });
+      await startWatchSessionAsync(session);
+
+      session.abortController.abort();
+      failCheck();
+      await sleepAsync(session.settleMs);
+
+      expect(session.snapshots.watcherSnapshotCount).toBe(1);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('does not check the inputs after an iteration without a snapshot', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      session.snapshots.getGraphSnapshotAsync = async () => undefined;
+      a.runner.action = () => editInputs(session, a.operation);
+      await startWatchSessionAsync(session);
+
+      expect(session.iterations).toEqual([['a']]);
+      expect(session.snapshots.watcherSnapshotCount).toBe(0);
+      expect(session.terminalProvider.getErrorOutput()).toBe('');
+    });
+
+    it('opens the watchers before it takes the snapshot for the check', async () => {
+      const a: ITestOperation = createOperation('a');
+      const session: IWatchSession = createWatchSession([a.operation], { hasInputsSnapshots: true });
+      const openWatcherCounts: number[] = [];
+      session.snapshots.getWatcherSnapshotAsync = async () => {
+        openWatcherCounts.push(mockFsListeners.size);
+        return createInputsSnapshot(session.snapshots.inputVersions);
+      };
+      await startWatchSessionAsync(session);
+
+      // The repository root, the common configuration folder and the project folder.
+      expect(openWatcherCounts).toEqual([3]);
+    });
+
+    it('queues one iteration for a run request and an edit from the same iteration', async () => {
+      const a: ITestOperation = createOperation('a');
+      const b: ITestOperation = createOperation('b');
+      const session: IWatchSession = createWatchSession([a.operation, b.operation], {
+        hasInputsSnapshots: true
+      });
+      a.runner.action = (runCount: number) => {
+        if (runCount === 2) {
+          // Both wait for the graph to go idle, then share the debounce.
+          a.runner.requestRun();
+          editInputs(session, b.operation);
+        }
+      };
+      await startWatchSessionAsync(session);
+
+      editInputs(session, a.operation);
+      simulateFileChange();
+      await settleAsync(session);
+
+      expect(session.iterations).toEqual([['a', 'b'], ['a'], ['a', 'b']]);
+      expect(a.runner.runCount).toBe(3);
+      expect(b.runner.runCount).toBe(2);
+      expect(getStatuses(session)).toEqual([
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...',
+        'File change detected. Queuing new iteration...',
+        'Waiting for changes...'
+      ]);
+    });
+  });
 });

From c9a97fd05a8c02513c6e77e83c0dfc662bc2a3d9 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:04 +0000
Subject: [PATCH 160/265] [rush-lib] Check input files for skip detection when
 the build cache is off

Swarm integration step 145; original commit 7b053b8dd2 (merge of swarm/m03-t233-int2 at 503e0c4eab).
Scope: task 233.

Brings 233-int2 (branch swarm/m03-t233-int2). Second agent: o07 board 5055. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 10 of 19. Gate: ch01 GATE OK board 5319 (tree 3cc271dbd4)

Commits folded into this step (1):
- 4cd08ffcb4 Check input files for skip detection when the build cache is off

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...acy-skip-input-files_2026-09-29-10-18.json |  10 +
 .../IncrementalExecutionGuardPlugin.ts        |  87 +-------
 .../src/logic/operations/LegacySkipPlugin.ts  |  65 +++++-
 .../operations/OperationInputFilesCheck.ts    |  85 +++++++
 .../IncrementalExecutionGuardPlugin.test.ts   | 209 ++++++++++++++++--
 5 files changed, 357 insertions(+), 99 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/legacy-skip-input-files_2026-09-29-10-18.json
 create mode 100644 libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts

diff --git a/common/changes/@microsoft/rush/legacy-skip-input-files_2026-09-29-10-18.json b/common/changes/@microsoft/rush/legacy-skip-input-files_2026-09-29-10-18.json
new file mode 100644
index 0000000000..4669e4e22b
--- /dev/null
+++ b/common/changes/@microsoft/rush/legacy-skip-input-files_2026-09-29-10-18.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When the build cache is not enabled, `rush build` and `rush rebuild` no longer write the package-deps file of an operation whose input files changed after the inputs snapshot of the command was taken, e.g. because an editor saved a file while the operation ran. Before, if the file was changed back before the next build, that build skipped the operation and kept the outputs that were built from the edit. The next build now runs the operation again. The same applies to watch mode, and to a Rush daemon whose `daemon.incrementalBuilds` setting is off.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index 2fe311b24e..bfe356b241 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -5,9 +5,8 @@ import { createHash, type Hash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { FileSystem, InternalError, Path, Executable } from '@rushstack/node-core-library';
+import { FileSystem, InternalError, Path } from '@rushstack/node-core-library';
 
-import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
 import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import type {
@@ -35,13 +34,8 @@ import {
   readOperationOutputManifestAsync,
   type IOperationOutputManifest
 } from './OperationOutputManifest';
-import {
-  captureInputFilesState,
-  haveInputFilesChanged,
-  haveSnapshotHashesChangedAsync,
-  hasUntrackedGitFiles,
-  type IInputFilesState
-} from './InputFilesStatSignature';
+import { captureInputFilesState, type IInputFilesState } from './InputFilesStatSignature';
+import { createGitPathGetter, haveOperationInputFilesChangedAsync } from './OperationInputFilesCheck';
 import {
   areInputFilesChecked,
   isResultUnverifiable,
@@ -50,14 +44,14 @@ import {
 
 const PLUGIN_NAME: 'IncrementalExecutionGuardPlugin' = 'IncrementalExecutionGuardPlugin';
 
-// Runs after the default-stage taps, e.g. the input file checks of this plugin and of CacheableOperationPlugin, which
-// can mark a result as unverifiable.
+// Runs after the default-stage taps, e.g. the input file checks of this plugin, CacheableOperationPlugin and
+// LegacySkipPlugin, which can mark a result as unverifiable.
 const RECORD_RESULT_STAGE: number = 1;
 // Runs before those checks, so that a folder that was recreated before the input folders were read makes the result
 // unverifiable.
 const READ_INPUT_FOLDERS_STAGE: number = -1;
-// Runs after the default-stage taps, e.g. that of CacheableOperationPlugin, which captures the input files of the
-// operations whose input files it checks.
+// Runs after the default-stage taps, e.g. those of CacheableOperationPlugin and LegacySkipPlugin, which capture the
+// input files of the operations whose input files they check.
 const CAPTURE_INPUT_FILES_STAGE: number = 1;
 
 const MAX_EXAMPLE_PATHS: number = 3;
@@ -262,8 +256,8 @@ export function getIncrementalInputChangeReason(
  *
  * The input files of an operation changed while it ran if they differ from their state right after the inputs snapshot
  * of the iteration, e.g. because an editor saved a file. This plugin compares them after each command, unless
- * `CacheableOperationPlugin` does, so that such a result never becomes a base, and a long-lived graph runs the
- * operation again instead of skipping it at that state hash, whether or not the build cache is enabled.
+ * `CacheableOperationPlugin` or `LegacySkipPlugin` does, so that such a result never becomes a base, and a long-lived
+ * graph runs the operation again instead of skipping it at that state hash, whether or not the build cache is enabled.
  */
 export class IncrementalExecutionGuardPlugin implements IPhasedCommandPlugin {
   public apply(hooks: PhasedCommandHooks): void {
@@ -333,15 +327,7 @@ function applyToGraph(graph: IOperationGraph): void {
     }
   );
 
-  let gitPath: string | undefined;
-  let isGitPathResolved: boolean = false;
-  const getGitPath = (): string | undefined => {
-    if (!isGitPathResolved) {
-      gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
-      isGitPathResolved = true;
-    }
-    return gitPath;
-  };
+  const getGitPath: () => string | undefined = createGitPathGetter();
 
   graph.hooks.beforeExecuteIterationAsync.tap(
     { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
@@ -714,59 +700,6 @@ function getFolderIdentity(folderPath: string): string {
   }
 }
 
-/**
- * Returns the absolute paths of the folders that an operation's command writes in its project: its metadata folder and
- * its output folders.
- */
-function getOutputFolderPaths(record: IOperationExecutionResult): string[] {
-  const { operation, metadataFolderPath } = record;
-  const { projectFolder } = operation.associatedProject;
-  return [metadataFolderPath, ...(operation.settings?.outputFolderNames ?? [])].map((folderName: string) =>
-    path.resolve(projectFolder, folderName)
-  );
-}
-
-/**
- * Returns true if an operation's input files changed since their state was captured: a file was modified, deleted or
- * replaced, a potential input file was created in a folder that holds its input files, or a file was saved while the
- * inputs snapshot was being taken, after Git hashed it.
- */
-async function haveOperationInputFilesChangedAsync(
-  record: IOperationExecutionResult,
-  inputsSnapshot: IInputsSnapshot,
-  inputFilesState: IInputFilesState,
-  getGitPath: () => string | undefined
-): Promise<boolean> {
-  const { rootDirectory, filesChangedDuringSnapshot } = inputFilesState;
-  const outputFolderPaths: string[] = getOutputFolderPaths(record);
-  const isNewInput = (newEntryPaths: ReadonlyArray<string>): boolean => {
-    // E.g. the output folder that the first run of the operation created
-    const candidatePaths: string[] = newEntryPaths.filter(
-      (entryPath: string) =>
-        !outputFolderPaths.some((folderPath: string) => Path.isUnderOrEqual(entryPath, folderPath))
-    );
-    if (candidatePaths.length === 0) {
-      return false;
-    }
-    const gitPath: string | undefined = getGitPath();
-    // Without Git it cannot be told whether the new entries are ignored, so they count as inputs.
-    return !gitPath || hasUntrackedGitFiles(gitPath, rootDirectory, candidatePaths, outputFolderPaths);
-  };
-  if (haveInputFilesChanged(inputFilesState, isNewInput)) {
-    return true;
-  }
-  if (filesChangedDuringSnapshot.length === 0) {
-    return false;
-  }
-  const { associatedProject: project, associatedPhase: phase } = record.operation;
-  return await haveSnapshotHashesChangedAsync(
-    getGitPath(),
-    rootDirectory,
-    filesChangedDuringSnapshot,
-    inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name)
-  );
-}
-
 /**
  * Returns the dependencies of an operation by name, including the dependencies that it has through operations of its
  * own project, e.g. through a phase without a script that only orders its build after the builds of other projects.
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index e8c89f73a6..aa25d06779 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -9,11 +9,18 @@ import { PrintUtilities, Colorize, type ITerminal } from '@rushstack/terminal';
 import type { Operation } from './Operation';
 import { OperationStatus } from './OperationStatus';
 import type { IPhasedCommandPlugin, PhasedCommandHooks } from '../../pluginFramework/PhasedCommandHooks';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import type { IOperationGraphIterationOptions } from './IOperationGraph';
 import type { IOperationRunnerContext } from './IOperationRunner';
 import type { IOperationExecutionResult } from './IOperationExecutionResult';
 import { wasExecutedIncrementally } from './IncrementalExecutionState';
-import { isResultUnverifiable } from './RetainedResultVerification';
+import { captureInputFilesState, type IInputFilesState } from './InputFilesStatSignature';
+import { createGitPathGetter, haveOperationInputFilesChangedAsync } from './OperationInputFilesCheck';
+import {
+  isResultUnverifiable,
+  markInputFilesChecked,
+  markResultUnverifiable
+} from './RetainedResultVerification';
 
 const PLUGIN_NAME: 'LegacySkipPlugin' = 'LegacySkipPlugin';
 const INVALIDATION_PLUGIN_NAME: 'LegacySkipInvalidationPlugin' = 'LegacySkipInvalidationPlugin';
@@ -43,8 +50,8 @@ function _areShallowEqual(object1: JsonObject, object2: JsonObject): boolean {
   return true;
 }
 
-// Runs after the default-stage taps that can mark the result of an operation as unverifiable, e.g. that of
-// IncrementalExecutionGuardPlugin, which checks whether the input files changed while the operation executed.
+// Runs after the default-stage taps that can mark the result of an operation as unverifiable, e.g. the input file
+// check of this plugin, which checks whether the input files changed while the operation executed.
 const RECORD_PACKAGE_DEPS_STAGE: number = 1;
 
 export interface IProjectDeps {
@@ -52,6 +59,12 @@ export interface IProjectDeps {
   arguments: string;
 }
 
+interface IInputFilesCheck {
+  readonly inputsSnapshot: IInputsSnapshot;
+  // Captured right after the inputs snapshot
+  readonly inputFilesState: IInputFilesState;
+}
+
 interface ILegacySkipRecord {
   allowSkip: boolean;
   /**
@@ -67,6 +80,8 @@ interface ILegacySkipRecord {
   inputsUnchanged: boolean;
   packageDeps: IProjectDeps | undefined;
   packageDepsPath: string;
+  // Set if this plugin checks whether the input files of the operation change until it has executed
+  inputFilesCheck?: IInputFilesCheck;
 }
 
 export interface ILegacySkipPluginOptions {
@@ -93,6 +108,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
       this.#options;
 
     hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph) => {
+      const getGitPath: () => string | undefined = createGitPathGetter();
       graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations) => {
         for (const operation of operations) stateMap.delete(operation);
       });
@@ -128,12 +144,13 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
             const packageDepsPath: string = _getPackageDepsPath(operation);
 
             let packageDeps: IProjectDeps | undefined;
+            let inputFilesCheck: IInputFilesCheck | undefined;
 
             try {
               const fileHashes: ReadonlyMap<string, string> | undefined =
                 inputsSnapshot?.getTrackedFileHashesForOperation(associatedProject, associatedPhase.name);
 
-              if (!fileHashes) {
+              if (!fileHashes || !inputsSnapshot) {
                 logGitWarning = true;
                 continue;
               }
@@ -143,10 +160,27 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
                 files[filePath] = fileHash;
               }
 
+              // A later command skips the operation if its input files match the recorded ones, so the file is only
+              // written if the input files do not change from the inputs snapshot until the operation has executed.
+              const inputFilesState: IInputFilesState | undefined =
+                record.enabled && !runner.isNoOp
+                  ? captureInputFilesState(
+                      inputsSnapshot.rootDirectory,
+                      fileHashes.keys(),
+                      inputsSnapshot.workingTreeReadStartTimeMs
+                    )
+                  : undefined;
+
               packageDeps = {
                 files,
                 arguments: runner.getConfigHash()
               };
+
+              if (inputFilesState) {
+                inputFilesCheck = { inputsSnapshot, inputFilesState };
+                // So that IncrementalExecutionGuardPlugin does not check them as well
+                markInputFilesChecked(record);
+              }
             } catch (error) {
               // To test this code path:
               // Delete a project's ".rush/temp/shrinkwrap-deps.json" then run "rush build --verbose"
@@ -164,7 +198,8 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
               packageDeps,
               allowSkip,
               dependencyChanged: false,
-              inputsUnchanged: false
+              inputsUnchanged: false,
+              inputFilesCheck
             });
           }
 
@@ -252,6 +287,26 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      graph.hooks.afterExecuteOperationAsync.tapPromise(
+        PLUGIN_NAME,
+        async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
+          const skipRecord: ILegacySkipRecord | undefined = stateMap.get(record.operation);
+          if (!skipRecord?.inputFilesCheck) {
+            return;
+          }
+          const { inputsSnapshot, inputFilesState } = skipRecord.inputFilesCheck;
+          skipRecord.inputFilesCheck = undefined;
+          const { status } = record;
+          if (
+            (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) &&
+            !isResultUnverifiable(record) &&
+            (await haveOperationInputFilesChangedAsync(record, inputsSnapshot, inputFilesState, getGitPath))
+          ) {
+            markResultUnverifiable(record);
+          }
+        }
+      );
+
       graph.hooks.afterExecuteOperationAsync.tapPromise(
         { name: PLUGIN_NAME, stage: RECORD_PACKAGE_DEPS_STAGE },
         async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
diff --git a/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts b/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
new file mode 100644
index 0000000000..9fd55d2d44
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { Executable, Path } from '@rushstack/node-core-library';
+
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
+import type { IOperationExecutionResult } from './IOperationExecutionResult';
+import {
+  haveInputFilesChanged,
+  haveSnapshotHashesChangedAsync,
+  hasUntrackedGitFiles,
+  type IInputFilesState
+} from './InputFilesStatSignature';
+
+/**
+ * Returns a function that returns the path of the Git executable, if it is found. The path is resolved when the
+ * function is first called.
+ */
+export function createGitPathGetter(): () => string | undefined {
+  let gitPath: string | undefined;
+  let isGitPathResolved: boolean = false;
+  return (): string | undefined => {
+    if (!isGitPathResolved) {
+      gitPath = EnvironmentConfiguration.gitBinaryPath || Executable.tryResolve('git');
+      isGitPathResolved = true;
+    }
+    return gitPath;
+  };
+}
+
+/**
+ * Returns the absolute paths of the folders that an operation's command writes in its project: its metadata folder and
+ * its output folders.
+ */
+function getOutputFolderPaths(record: IOperationExecutionResult): string[] {
+  const { operation, metadataFolderPath } = record;
+  const { projectFolder } = operation.associatedProject;
+  return [metadataFolderPath, ...(operation.settings?.outputFolderNames ?? [])].map((folderName: string) =>
+    path.resolve(projectFolder, folderName)
+  );
+}
+
+/**
+ * Returns true if an operation's input files changed since their state was captured: a file was modified, deleted or
+ * replaced, a potential input file was created in a folder that holds its input files, or a file was saved while the
+ * inputs snapshot was being taken, after Git hashed it.
+ */
+export async function haveOperationInputFilesChangedAsync(
+  record: IOperationExecutionResult,
+  inputsSnapshot: IInputsSnapshot,
+  inputFilesState: IInputFilesState,
+  getGitPath: () => string | undefined
+): Promise<boolean> {
+  const { rootDirectory, filesChangedDuringSnapshot } = inputFilesState;
+  const outputFolderPaths: string[] = getOutputFolderPaths(record);
+  const isNewInput = (newEntryPaths: ReadonlyArray<string>): boolean => {
+    // E.g. the output folder that the first run of the operation created
+    const candidatePaths: string[] = newEntryPaths.filter(
+      (entryPath: string) =>
+        !outputFolderPaths.some((folderPath: string) => Path.isUnderOrEqual(entryPath, folderPath))
+    );
+    if (candidatePaths.length === 0) {
+      return false;
+    }
+    const gitPath: string | undefined = getGitPath();
+    // Without Git it cannot be told whether the new entries are ignored, so they count as inputs.
+    return !gitPath || hasUntrackedGitFiles(gitPath, rootDirectory, candidatePaths, outputFolderPaths);
+  };
+  if (haveInputFilesChanged(inputFilesState, isNewInput)) {
+    return true;
+  }
+  if (filesChangedDuringSnapshot.length === 0) {
+    return false;
+  }
+  const { associatedProject: project, associatedPhase: phase } = record.operation;
+  return await haveSnapshotHashesChangedAsync(
+    getGitPath(),
+    rootDirectory,
+    filesChangedDuringSnapshot,
+    inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name)
+  );
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 1bd638de41..4b4be303c2 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -77,7 +77,7 @@ import {
   type IIncrementalExecutionGuardOptions
 } from '../IncrementalExecutionState';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
-import { LegacySkipPlugin } from '../LegacySkipPlugin';
+import { type ILegacySkipPluginOptions, LegacySkipPlugin } from '../LegacySkipPlugin';
 import { NullOperationRunner } from '../NullOperationRunner';
 import { Operation } from '../Operation';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
@@ -146,6 +146,16 @@ interface IWorkspaceOptions {
    * If set, applies the skip detection that Rush uses when the build cache is not enabled.
    */
   readonly hasLegacySkipDetection?: boolean;
+  /**
+   * Options of the skip detection of `hasLegacySkipDetection`, e.g. `isIncrementalBuildAllowed: false`, like
+   * `rush rebuild`
+   */
+  readonly legacySkipOptions?: Partial<ILegacySkipPluginOptions>;
+  /**
+   * If false, the guard is not applied, like in `rush build` without the Rush daemon, or in a Rush daemon whose
+   * `daemon.incrementalBuilds` setting is off. Defaults to true.
+   */
+  readonly hasIncrementalExecutionGuard?: boolean;
   /**
    * If set, the runners report that each command ran in a process that keeps watching the input files, like
    * `WarmWorkerOperationRunner`.
@@ -364,6 +374,8 @@ async function createWorkspaceAsync(
     hasPassThroughPhase,
     guardOptions,
     hasLegacySkipDetection,
+    legacySkipOptions,
+    hasIncrementalExecutionGuard = true,
     watchesInputs,
     recordsWorkingTreeReadStartTime
   }: IWorkspaceOptions = {}
@@ -528,12 +540,15 @@ async function createWorkspaceAsync(
 
   const hooks: PhasedCommandHooks = new PhasedCommandHooks();
   new PhasedOperationPlugin().apply(hooks);
-  new IncrementalExecutionGuardPlugin().apply(hooks);
+  if (hasIncrementalExecutionGuard) {
+    new IncrementalExecutionGuardPlugin().apply(hooks);
+  }
   if (hasLegacySkipDetection) {
     new LegacySkipPlugin({
       terminal: new Terminal(new StringBufferTerminalProvider()),
       changedProjectsOnly: false,
-      isIncrementalBuildAllowed: true
+      isIncrementalBuildAllowed: true,
+      ...legacySkipOptions
     }).apply(hooks);
   }
   const destination: MockWritable = new MockWritable();
@@ -642,6 +657,21 @@ async function createWorkspaceAsync(
   };
 }
 
+// Like an editor that saves a file while the command of the operation reads the input files
+function changeWhileExecuting(workspace: ITestWorkspace, change: () => void): void {
+  let pendingChange: (() => void) | undefined = change;
+  workspace.graph.hooks.beforeExecuteOperationAsync.tap('changeWhileExecuting', (): undefined => {
+    pendingChange?.();
+    pendingChange = undefined;
+    return undefined;
+  });
+}
+
+function readOutput(workspace: ITestWorkspace, relativePath: string): string | undefined {
+  const outputPath: string = `${workspace.rootFolder}/${relativePath}`;
+  return fs.existsSync(outputPath) ? fs.readFileSync(outputPath, 'utf8') : undefined;
+}
+
 describe(IncrementalExecutionGuardPlugin.name, () => {
   it('runs the incremental command for edits of built files, and the initial command otherwise', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
@@ -1179,20 +1209,6 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
   });
 
   describe('with input files that change while the operation executes', () => {
-    // Like an editor that saves a file while the command of the operation reads the input files
-    const changeWhileExecuting = (workspace: ITestWorkspace, change: () => void): void => {
-      let pendingChange: (() => void) | undefined = change;
-      workspace.graph.hooks.beforeExecuteOperationAsync.tap('changeWhileExecuting', (): undefined => {
-        pendingChange?.();
-        pendingChange = undefined;
-        return undefined;
-      });
-    };
-    const readOutput = (workspace: ITestWorkspace, relativePath: string): string | undefined => {
-      const outputPath: string = `${workspace.rootFolder}/${relativePath}`;
-      return fs.existsSync(outputPath) ? fs.readFileSync(outputPath, 'utf8') : undefined;
-    };
-
     it.each<
       [string, (workspace: ITestWorkspace) => void, (workspace: ITestWorkspace) => void, string, string]
     >([
@@ -1479,3 +1495,162 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     });
   });
 });
+
+describe(LegacySkipPlugin.name, () => {
+  // Like `rush build` without the Rush daemon, or a Rush daemon whose `daemon.incrementalBuilds` setting is off
+  const legacyOptions: IWorkspaceOptions = {
+    hasLegacySkipDetection: true,
+    hasIncrementalExecutionGuard: false
+  };
+  const getPackageDepsPath = (workspace: ITestWorkspace): string =>
+    `${workspace.rootFolder}/common/temp/projects/a/package-deps__phase_build.json`;
+  // Like a later Rush command, which creates a new graph, so that only the package-deps files remain.
+  const startLaterCommand = (workspace: ITestWorkspace): void =>
+    workspace.graph.deleteResults(workspace.graph.operations);
+
+  it('skips the operation in a later command if its input files did not change', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+
+    startLaterCommand(workspace);
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual([]);
+    expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
+  });
+
+  it.each<[string, (workspace: ITestWorkspace) => void, (workspace: ITestWorkspace) => void, string, string]>(
+    [
+      [
+        'a file was edited',
+        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two edited'),
+        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
+        'a/lib/sub/two.js',
+        'two'
+      ],
+      [
+        'a file was added',
+        (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
+        (workspace: ITestWorkspace) => workspace.deleteFile('a/src/three.ts'),
+        'a/lib/three.js',
+        'none'
+      ]
+    ]
+  )(
+    'runs the operation in a later command if %s while it executed and was changed back',
+    async (
+      name: string,
+      change: (workspace: ITestWorkspace) => void,
+      changeBack: (workspace: ITestWorkspace) => void,
+      outputFile: string,
+      expectedOutput: string
+    ) => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
+      changeWhileExecuting(workspace, () => change(workspace));
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+      // The inputs snapshot is the same as that of the last run, but the outputs were built from other inputs.
+      changeBack(workspace);
+      startLaterCommand(workspace);
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+      expect(readOutput(workspace, outputFile) ?? 'none').toBe(expectedOutput);
+      expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+    }
+  );
+
+  it('runs the operation again in a long-lived graph if a file was edited while it executed and was changed back', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+    workspace.writeFile('a/src/sub/two.ts', 'two');
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+
+    expect((await workspace.executeAsync()).commands).toEqual([]);
+  });
+
+  it('runs the operation in a later command if a file was saved while the inputs snapshot was being taken', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      ...legacyOptions,
+      recordsWorkingTreeReadStartTime: true
+    });
+    // Saved after it was hashed, and before its state was captured, so its state does not change afterwards
+    let isSaved: boolean = false;
+    workspace.graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'saveWhileSnapshotting', stage: -1 },
+      (): undefined => {
+        if (!isSaved) {
+          workspace.writeFile('a/src/sub/two.ts', 'two saved');
+          isSaved = true;
+        }
+        return undefined;
+      }
+    );
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two saved');
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+    workspace.writeFile('a/src/sub/two.ts', 'two');
+    startLaterCommand(workspace);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+  });
+
+  it('runs the operation in a later command if a file was edited while it executed with allowed warnings', async () => {
+    jest.spyOn(EnvironmentConfiguration, 'allowWarningsInSuccessfulBuild', 'get').mockReturnValue(true);
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      ...legacyOptions,
+      legacySkipOptions: { allowWarningsInSuccessfulBuild: true }
+    });
+    workspace.writeFile('a/src/one.ts', 'one warning');
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+    const first: ITestIteration = await workspace.executeAsync();
+    expect(first.commands).toEqual(['a:initial']);
+    expect(first.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+    workspace.writeFile('a/src/sub/two.ts', 'two');
+    startLaterCommand(workspace);
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+    expect(readOutput(workspace, 'a/lib/sub/two.js')).toBe('two');
+    // The warnings are allowed, so a later command can skip the operation.
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+  });
+
+  it('does not write the package-deps file of a rebuild whose input files changed while it executed', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      ...legacyOptions,
+      legacySkipOptions: { isIncrementalBuildAllowed: false }
+    });
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two edited'));
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
+
+    startLaterCommand(workspace);
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    // So that a later build can skip the operation
+    expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
+  });
+
+  it('checks the input files of an incremental command for IncrementalExecutionGuardPlugin', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      hasLegacySkipDetection: true
+    });
+    await workspace.executeAsync();
+
+    workspace.writeFile('a/src/one.ts', 'one 2');
+    changeWhileExecuting(workspace, () => workspace.writeFile('a/src/sub/two.ts', 'two 2'));
+    expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+    workspace.writeFile('a/src/one.ts', 'one 3');
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['a:initial']);
+    expect(next.output).toContain(
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+    );
+  });
+});

From f00f81fdf30c4dca023f312c678cc9732424833c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 161/265] [rush-cli-client] Tolerate a late daemon answer in
 the RushX daemon test comparisons

Swarm integration step 146; original commit 785c3666f6 (merge of swarm/m03-t256 at d3189ef41c).
Scope: task 256.

Brings 256 (branch swarm/m03-t256). Second agent: t07 board 5135. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 11 of 19. Gate: ch01 GATE OK board 5319 (tree 55a5cad877)

Commits folded into this step (1):
- d3189ef41c Tolerate a late daemon answer in the RushX daemon test comparisons

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/RushXDaemon.test.ts              |  8 ++++
 .../src/test/RushXDaemonTestFixture.ts        | 40 ++++++++++++++++++-
 ...est-readiness-notice_2026-09-29-11-17.json | 10 +++++
 3 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/rushx-daemon-test-readiness-notice_2026-09-29-11-17.json

diff --git a/apps/rush-cli-client/src/test/RushXDaemon.test.ts b/apps/rush-cli-client/src/test/RushXDaemon.test.ts
index 0a11be8ad5..75427560e1 100644
--- a/apps/rush-cli-client/src/test/RushXDaemon.test.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemon.test.ts
@@ -130,6 +130,14 @@ describe('native Rushx through a real daemon', () => {
     expect(native.stderr.toString()).toContain('raw-err\x1b[31mError: Failed calling');
   });
 
+  it('compares without the readiness notice that a client prints when the daemon answers it late', async () => {
+    const args: string[] = ['fail', 'two words', '--flag'];
+    const native: IScriptResult = await fixture.invokeAsync(true, args, cwd);
+    fixture.delayNextConnection(1500);
+    expect(await fixture.invokeAsync(false, args, cwd)).toEqual(native);
+    expect(fixture.readinessNotices).toBe(1);
+  });
+
   it('retains unregistered-project warnings and native missing-script errors without fallback', async () => {
     for (const [project, script] of [
       ['unregistered', 'args'],
diff --git a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
index 49b1ff98be..20f16c8b28 100644
--- a/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
+++ b/apps/rush-cli-client/src/test/RushXDaemonTestFixture.ts
@@ -34,6 +34,15 @@ export interface IRequestResult extends IScriptResult {
   readonly outcome: DaemonClientOutcome;
 }
 
+/** Matches the notice a client prints when a daemon listens but misses its hello/ping budget. */
+function createReadinessNoticePattern(socketPath: string): RegExp {
+  const escapedSocketPath: string = socketPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(
+    `^rushx?-client: The daemon is not ready yet\\. A process listens at ${escapedSocketPath} but was not ` +
+      'ready in time, so this command waits up to \\d+ s more for it instead of running Rush in-process\\.$'
+  );
+}
+
 export class RushXDaemonTestFixture implements AsyncDisposable {
   public readonly folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushx-daemon-'));
   public readonly home: string = path.join(this.folder, 'home');
@@ -41,6 +50,9 @@ export class RushXDaemonTestFixture implements AsyncDisposable {
   public readonly errors: Error[] = [];
   public host!: RushDaemonHost;
   public session!: WorkspaceSession;
+  /** The number of readiness notices that {@link RushXDaemonTestFixture.invokeAsync} removed. */
+  public readinessNotices: number = 0;
+  #nextConnectionDelayMs: number = 0;
 
   public constructor(hooks: boolean = false, pnpmSync: boolean = false) {
     this.write(
@@ -143,6 +155,11 @@ setInterval(() => {}, 1000);
       onError: (error) => {
         this.errors.push(error);
       },
+      onInteractiveConnection: () => {
+        const delayMs: number = this.#nextConnectionDelayMs;
+        this.#nextConnectionDelayMs = 0;
+        if (delayMs > 0) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
+      },
       createWorkspaceSessionAsync: async (options) => {
         this.session = await WorkspaceSession.createAsync(options);
         return this.session;
@@ -156,6 +173,14 @@ setInterval(() => {}, 1000);
     fs.writeFileSync(fullPath, content);
   }
 
+  /**
+   * Blocks the daemon's event loop (this test process) for `delayMs` as the next client connects, as a loaded
+   * host can, so that client's hello/ping answer arrives late.
+   */
+  public delayNextConnection(delayMs: number): void {
+    this.#nextConnectionDelayMs = delayMs;
+  }
+
   public environment(overrides: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
     return {
       ...getTestProcessEnvironment(),
@@ -251,12 +276,25 @@ setInterval(() => {}, 1000);
         resolve({
           exitCode: exitCode ?? undefined,
           stdout: Buffer.concat(stdout),
-          stderr: Buffer.concat(stderr)
+          stderr: native ? Buffer.concat(stderr) : this.#removeReadinessNotice(Buffer.concat(stderr))
         })
       );
     });
   }
 
+  /**
+   * This daemon runs in the test process, so on a loaded host it can miss a client's 1 s hello/ping budget. The
+   * client then prints a notice as its first line of stderr and waits for the daemon. The notice isn't output of
+   * the command, so this removes it before the comparison with native Rushx. Any other difference still fails.
+   */
+  #removeReadinessNotice(stderr: Buffer): Buffer {
+    const end: number = stderr.indexOf('\n');
+    const firstLine: string = end < 0 ? '' : stderr.toString('utf8', 0, end);
+    if (!createReadinessNoticePattern(this.host.paths.socketPath).test(firstLine)) return stderr;
+    this.readinessNotices++;
+    return stderr.subarray(end + 1);
+  }
+
   public async [Symbol.asyncDispose](): Promise<void> {
     await this.host?.closeAsync();
     fs.rmSync(this.folder, { recursive: true, force: true });
diff --git a/common/changes/@rushstack/rush-cli-client/rushx-daemon-test-readiness-notice_2026-09-29-11-17.json b/common/changes/@rushstack/rush-cli-client/rushx-daemon-test-readiness-notice_2026-09-29-11-17.json
new file mode 100644
index 0000000000..8ef7abbcba
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/rushx-daemon-test-readiness-notice_2026-09-29-11-17.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "The tests that compare rushx-client with native Rushx no longer fail when the test's daemon answers the client's first connection late, on a loaded host.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client"
+}

From 4621a2d9573f5a7998f3a5aa771f8b00c6515634 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 162/265] [heft-webpack5-plugin] Don't delete assets outside
 the output folder

Swarm integration step 147; original commit 889ad40a8a (merge of o07/webpack-stale-assets at 250c9bc9fd).
Scope: task 124.

Brings 124 (branch refs/remotes/o07/webpack-stale-assets (by hash; no swarm/ branch)). Second agent: r03 board 5006. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 12 of 19. Gate: ch01 GATE OK board 5319 (tree 11c6a55c21)

Commits folded into this step (2):
- 61c37efade [heft-webpack5-plugin] Add a deleteStaleAssetsInWatchMode option
- 250c9bc9fd [heft-webpack5-plugin] Don't delete assets outside the output folder

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...assets-in-watch-mode_2026-09-29-10-25.json |  10 +
 .../src/DeleteStaleAssetsPlugin.ts            | 205 ++++++
 .../src/Webpack5Plugin.ts                     |  10 +-
 .../schemas/heft-webpack5-plugin.schema.json  |   5 +
 .../src/test/DeleteStaleAssetsPlugin.test.ts  | 681 ++++++++++++++++++
 5 files changed, 910 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/heft-webpack5-plugin/delete-stale-assets-in-watch-mode_2026-09-29-10-25.json
 create mode 100644 heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
 create mode 100644 heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts

diff --git a/common/changes/@rushstack/heft-webpack5-plugin/delete-stale-assets-in-watch-mode_2026-09-29-10-25.json b/common/changes/@rushstack/heft-webpack5-plugin/delete-stale-assets-in-watch-mode_2026-09-29-10-25.json
new file mode 100644
index 0000000000..9f72c92420
--- /dev/null
+++ b/common/changes/@rushstack/heft-webpack5-plugin/delete-stale-assets-in-watch-mode_2026-09-29-10-25.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-webpack5-plugin",
+      "comment": "Add a `deleteStaleAssetsInWatchMode` option. When it is set, each compilation without errors in watch mode deletes the output files that earlier compilations emitted and it doesn't, such as the chunk of a dynamic import that was removed, or a file whose content hash changed.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/heft-webpack5-plugin"
+}
diff --git a/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts b/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
new file mode 100644
index 0000000000..e3febe0859
--- /dev/null
+++ b/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
@@ -0,0 +1,205 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import type { Compilation, Compiler, WebpackPluginInstance } from 'webpack';
+
+import { Async } from '@rushstack/node-core-library';
+import type { IScopedLogger } from '@rushstack/heft';
+
+type ITerminal = IScopedLogger['terminal'];
+type OutputFileSystem = NonNullable<Compiler['outputFileSystem']>;
+
+const PLUGIN_NAME: 'DeleteStaleAssetsPlugin' = 'DeleteStaleAssetsPlugin';
+
+/**
+ * The stage of webpack's CleanPlugin: after the emit taps that add assets, and before webpack writes the
+ * files.
+ */
+const EMIT_STAGE: 100 = 100;
+
+const UNLINK_CONCURRENCY: 10 = 10;
+
+interface IAssetPaths {
+  /**
+   * The output paths of every asset of the compilation.
+   */
+  all: Set<string>;
+  /**
+   * The output paths that a later compilation deletes if it no longer emits them. Hot update files aren't
+   * included, because a client can still request them after the next compilation.
+   */
+  tracked: Set<string>;
+}
+
+/**
+ * In watch mode, deletes the output files that earlier compilations emitted and the current compilation
+ * doesn't, such as the chunk of a dynamic import that was removed, or a file whose name contains a hash that
+ * changed. Webpack's watch mode never deletes these files.
+ *
+ * @remarks
+ * Unlike webpack's `output.clean`, this plugin deletes only files that the same compiler emitted earlier in
+ * the session. Other files in the output folder, such as the outputs of other tasks, are never deleted.
+ *
+ * - The first compilation deletes nothing.
+ * - A compilation with errors deletes nothing. The next compilation without errors deletes the files that it
+ *   doesn't emit from both compilations.
+ * - A compilation that emits nothing (for example, one with errors when `optimization.emitOnErrors` is false)
+ *   doesn't reach this plugin, so the files on disk are still those of the previous emit.
+ * - Hot update files are never deleted, because a client can still request them after the next compilation.
+ * - Like `output.clean`, it never deletes a file that webpack writes outside the output folder, such as the
+ *   asset `../manifest.json`. Some plugins emit such files in the first compilation only.
+ * - Like `output.clean`, if a plugin emits a file in the output folder in some compilations only, a
+ *   compilation that doesn't emit it deletes it.
+ */
+export class DeleteStaleAssetsPlugin implements WebpackPluginInstance {
+  readonly #terminal: ITerminal;
+  #previousAssetPaths: Set<string> | undefined;
+
+  public constructor(terminal: ITerminal) {
+    this.#terminal = terminal;
+  }
+
+  public apply(compiler: Compiler): void {
+    // Delete the stale files before webpack writes the new ones. On a case-insensitive file system, a file
+    // that was renamed only by case is the same file as the new one, so deleting it after the write would
+    // delete the new file.
+    compiler.hooks.emit.tapPromise(
+      { name: PLUGIN_NAME, stage: EMIT_STAGE },
+      async (compilation: Compilation): Promise<void> => {
+        await this.#onEmitAsync(compiler, compilation);
+      }
+    );
+  }
+
+  async #onEmitAsync(compiler: Compiler, compilation: Compilation): Promise<void> {
+    const outputPath: string = compilation.getPath(compiler.outputPath, {});
+    const outputFileSystem: OutputFileSystem | undefined = compiler.outputFileSystem ?? undefined;
+    const assetPaths: IAssetPaths = getAssetPaths(compilation, outputPath, outputFileSystem);
+
+    const previousAssetPaths: Set<string> | undefined = this.#previousAssetPaths;
+    if (!previousAssetPaths) {
+      this.#previousAssetPaths = assetPaths.tracked;
+      return;
+    }
+
+    if (compilation.getStats().hasErrors()) {
+      for (const assetPath of assetPaths.tracked) {
+        previousAssetPaths.add(assetPath);
+      }
+      return;
+    }
+
+    const staleAssetPaths: string[] = [];
+    for (const assetPath of previousAssetPaths) {
+      if (!assetPaths.all.has(assetPath)) {
+        staleAssetPaths.push(assetPath);
+      }
+    }
+
+    // A file that couldn't be deleted stays tracked, so that the next compilation tries again.
+    const nextAssetPaths: Set<string> = assetPaths.tracked;
+    this.#previousAssetPaths = nextAssetPaths;
+    if (staleAssetPaths.length === 0) {
+      return;
+    }
+
+    const unlink: OutputFileSystem['unlink'] = outputFileSystem?.unlink;
+    if (!unlink) {
+      for (const assetPath of staleAssetPaths) {
+        nextAssetPaths.add(assetPath);
+      }
+      compilation.warnings.push(
+        new compiler.webpack.WebpackError(
+          `${PLUGIN_NAME}: The output file system can't delete files, so ${staleAssetPaths.length} ` +
+            `file(s) that an earlier compilation emitted and this compilation doesn't were not deleted.`
+        )
+      );
+      return;
+    }
+
+    const deletedAssetPaths: string[] = [];
+    await Async.forEachAsync(
+      staleAssetPaths,
+      async (assetPath: string) => {
+        const error: NodeJS.ErrnoException | null = await new Promise(
+          (resolve: (unlinkError: NodeJS.ErrnoException | null) => void) => {
+            unlink.call(outputFileSystem, assetPath, resolve);
+          }
+        );
+        if (!error) {
+          deletedAssetPaths.push(assetPath);
+        } else if (error.code !== 'ENOENT') {
+          nextAssetPaths.add(assetPath);
+          compilation.errors.push(
+            new compiler.webpack.WebpackError(
+              `${PLUGIN_NAME}: Could not delete "${assetPath}", which an earlier compilation emitted and ` +
+                `this compilation doesn't: ${error.message}`
+            )
+          );
+        }
+      },
+      { concurrency: UNLINK_CONCURRENCY }
+    );
+
+    if (deletedAssetPaths.length > 0) {
+      this.#terminal.writeLine(
+        `Deleted ${deletedAssetPaths.length} output file(s) that earlier compilations emitted and ` +
+          `this compilation doesn't`
+      );
+      for (const assetPath of deletedAssetPaths.sort()) {
+        this.#terminal.writeVerboseLine(`Deleted "${assetPath}"`);
+      }
+    }
+  }
+}
+
+/**
+ * Gets the paths that webpack writes the compilation's assets to, except for the paths outside the output
+ * folder.
+ */
+function getAssetPaths(
+  compilation: Compilation,
+  outputPath: string,
+  outputFileSystem: OutputFileSystem | undefined
+): IAssetPaths {
+  // Like webpack, join with the output file system's join, or else with the path rules of the output path.
+  const pathApi: path.PlatformPath = path.posix.isAbsolute(outputPath) ? path.posix : path.win32;
+  const join: (path1: string, path2: string) => string = outputFileSystem?.join
+    ? outputFileSystem.join.bind(outputFileSystem)
+    : pathApi.join;
+  const all: Set<string> = new Set();
+  const tracked: Set<string> = new Set();
+  for (const { name, info } of compilation.getAssets()) {
+    // Webpack writes an asset to its name without a query string or a fragment.
+    const queryOrHashIndex: number = name.search(/[?#]/);
+    const targetFile: string = queryOrHashIndex >= 0 ? name.slice(0, queryOrHashIndex) : name;
+    const assetPath: string = join(outputPath, targetFile);
+    // Check the path that webpack writes rather than the asset name: the file of "./../manifest.json" is
+    // outside the output folder, and the file of "..json" is in it.
+    if (!isInFolder(pathApi, outputPath, assetPath)) {
+      continue;
+    }
+    all.add(assetPath);
+    if (!info.hotModuleReplacement) {
+      tracked.add(assetPath);
+    }
+  }
+
+  return { all, tracked };
+}
+
+/**
+ * Returns true if the path is in the folder, and isn't the folder itself.
+ */
+function isInFolder(pathApi: path.PlatformPath, folderPath: string, filePath: string): boolean {
+  const relativePath: string = pathApi.relative(folderPath, filePath);
+  // The relative path is absolute if the file is on another drive.
+  return (
+    relativePath !== '' &&
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${pathApi.sep}`) &&
+    !pathApi.isAbsolute(relativePath)
+  );
+}
diff --git a/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts b/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
index 8dbeabaf68..018a083d8e 100644
--- a/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/Webpack5Plugin.ts
@@ -26,10 +26,12 @@ import {
 } from './shared';
 import { tryLoadWebpackConfigurationAsync } from './WebpackConfigurationLoader';
 import { type DeferredWatchFileSystem, OverrideNodeWatchFSPlugin } from './DeferredWatchFileSystem';
+import { DeleteStaleAssetsPlugin } from './DeleteStaleAssetsPlugin';
 
 export interface IWebpackPluginOptions {
   devConfigurationPath?: string | undefined;
   configurationPath?: string | undefined;
+  deleteStaleAssetsInWatchMode?: boolean | undefined;
 }
 const SERVE_PARAMETER_LONG_NAME: '--serve' = '--serve';
 const WEBPACK_PACKAGE_NAME: 'webpack' = 'webpack';
@@ -122,6 +124,10 @@ export default class Webpack5Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
           } else {
             config.plugins.unshift(overrideWatchFSPlugin);
           }
+
+          if (options.deleteStaleAssetsInWatchMode) {
+            config.plugins.push(new DeleteStaleAssetsPlugin(taskSession.logger.terminal));
+          }
         }
       }
 
@@ -142,7 +148,9 @@ export default class Webpack5Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
           taskSession.logger.terminal
         );
         this.#webpack = await import(webpackPackagePath);
-        taskSession.logger.terminal.writeDebugLine(`Using Webpack from rig package at "${webpackPackagePath}"`);
+        taskSession.logger.terminal.writeDebugLine(
+          `Using Webpack from rig package at "${webpackPackagePath}"`
+        );
       } catch (e) {
         // Fallback to bundled version if not found in rig.
         this.#webpack = await import(WEBPACK_PACKAGE_NAME);
diff --git a/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json b/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json
index 8253d4b976..0198bb2c06 100644
--- a/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json
+++ b/heft-plugins/heft-webpack5-plugin/src/schemas/heft-webpack5-plugin.schema.json
@@ -20,6 +20,11 @@
     "configurationPath": {
       "description": "Specifies a relative path to the Webpack configuration. The default value is \"./webpack.config.js\".",
       "type": "string"
+    },
+
+    "deleteStaleAssetsInWatchMode": {
+      "description": "If true, then in watch mode, each compilation without errors deletes the output files that earlier compilations emitted and it doesn't, such as the chunk of a dynamic import that was removed, or a file whose name contains a hash that changed. Only files that Webpack emitted into the output folder during the watch session are deleted; other files, such as the outputs of other tasks and files that Webpack writes outside the output folder, are never deleted. As with Webpack's output.clean option, if a plugin emits a file in some compilations only, a compilation that doesn't emit it deletes it. The default value is false.",
+      "type": "boolean"
     }
   }
 }
diff --git a/heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts b/heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts
new file mode 100644
index 0000000000..ae93754de1
--- /dev/null
+++ b/heft-plugins/heft-webpack5-plugin/src/test/DeleteStaleAssetsPlugin.test.ts
@@ -0,0 +1,681 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import webpack from 'webpack';
+import type { Compilation, Compiler, Configuration, Stats, WebpackPluginInstance } from 'webpack';
+import { AsyncParallelHook } from 'tapable';
+
+import { FileSystem } from '@rushstack/node-core-library';
+import type {
+  HeftConfiguration,
+  IHeftTaskRunHookOptions,
+  IHeftTaskRunIncrementalHookOptions,
+  IHeftTaskSession
+} from '@rushstack/heft';
+import { MockScopedLogger } from '@rushstack/heft/lib/pluginFramework/logging/MockScopedLogger';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { DeleteStaleAssetsPlugin } from '../DeleteStaleAssetsPlugin';
+import Webpack5Plugin, { type IWebpackPluginOptions } from '../Webpack5Plugin';
+import type { IWebpackConfiguration } from '../shared';
+
+const OUTPUT_PATH: string = path.resolve('/delete-stale-assets-test/dist');
+const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/DeleteStaleAssetsPlugin');
+
+function outputPathOf(name: string): string {
+  return path.join(OUTPUT_PATH, name);
+}
+
+class StubWebpackError extends Error {}
+
+interface IStubAsset {
+  name: string;
+  hotModuleReplacement?: boolean;
+}
+
+interface IEmitResult {
+  unlinkedPaths: string[];
+  errors: Error[];
+  warnings: Error[];
+}
+
+interface IStubCompilerOptions {
+  outputPath?: string;
+  join?: (path1: string, path2: string) => string;
+  withoutUnlink?: boolean;
+}
+
+interface IStubCompiler {
+  compiler: Compiler;
+  terminalProvider: StringBufferTerminalProvider;
+  unlinkErrorCodes: Map<string, string>;
+  getEmitTapOptions(): unknown;
+  emitAsync(assets: (string | IStubAsset)[], hasErrors?: boolean): Promise<IEmitResult>;
+}
+
+function createStubCompiler(options: IStubCompilerOptions = {}): IStubCompiler {
+  const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider(false);
+  const unlinkedPaths: string[] = [];
+  const unlinkErrorCodes: Map<string, string> = new Map();
+  let emitTap: ((compilation: Compilation) => Promise<void>) | undefined;
+  let emitTapOptions: unknown;
+
+  const outputFileSystem: Partial<NonNullable<Compiler['outputFileSystem']>> = {
+    join: options.join,
+    unlink: options.withoutUnlink
+      ? undefined
+      : (filePath: unknown, callback: (error: NodeJS.ErrnoException | null) => void): void => {
+          unlinkedPaths.push(filePath as string);
+          const code: string | undefined = unlinkErrorCodes.get(filePath as string);
+          setImmediate(() => {
+            if (code) {
+              const error: NodeJS.ErrnoException = new Error(`${code}: ${filePath}`);
+              error.code = code;
+              callback(error);
+            } else {
+              callback(null);
+            }
+          });
+        }
+  };
+
+  const compiler: Compiler = {
+    outputPath: options.outputPath ?? OUTPUT_PATH,
+    outputFileSystem,
+    hooks: {
+      emit: {
+        tapPromise: (tapOptions: unknown, fn: (compilation: Compilation) => Promise<void>): void => {
+          emitTapOptions = tapOptions;
+          emitTap = fn;
+        }
+      }
+    },
+    webpack: { WebpackError: StubWebpackError }
+  } as unknown as Compiler;
+
+  new DeleteStaleAssetsPlugin(new Terminal(terminalProvider)).apply(compiler);
+
+  return {
+    compiler,
+    terminalProvider,
+    unlinkErrorCodes,
+    getEmitTapOptions: () => emitTapOptions,
+    emitAsync: async (assets: (string | IStubAsset)[], hasErrors: boolean = false): Promise<IEmitResult> => {
+      const errors: Error[] = [];
+      const warnings: Error[] = [];
+      const compilation: Compilation = {
+        getPath: (filename: string) => filename,
+        getAssets: () =>
+          assets.map((asset: string | IStubAsset) =>
+            typeof asset === 'string'
+              ? { name: asset, info: {} }
+              : { name: asset.name, info: { hotModuleReplacement: asset.hotModuleReplacement } }
+          ),
+        getStats: () => ({ hasErrors: () => hasErrors }),
+        errors,
+        warnings
+      } as unknown as Compilation;
+
+      const firstIndex: number = unlinkedPaths.length;
+      await emitTap!(compilation);
+      return { unlinkedPaths: unlinkedPaths.slice(firstIndex).sort(), errors, warnings };
+    }
+  };
+}
+
+describe(DeleteStaleAssetsPlugin.name, () => {
+  it('runs in the emit hook at the stage of webpack CleanPlugin', () => {
+    const stub: IStubCompiler = createStubCompiler();
+    expect(stub.getEmitTapOptions()).toEqual({ name: 'DeleteStaleAssetsPlugin', stage: 100 });
+  });
+
+  it('deletes nothing on the first emit', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    expect(await stub.emitAsync(['main.js', '1.js'])).toEqual({
+      unlinkedPaths: [],
+      errors: [],
+      warnings: []
+    });
+  });
+
+  it('deletes the files that the previous emit had and this emit does not, once', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', '1.js', 'nested/2.js', 'index.html']);
+
+    expect((await stub.emitAsync(['main.js', 'index.html'])).unlinkedPaths).toEqual(
+      [outputPathOf('1.js'), outputPathOf('nested/2.js')].sort()
+    );
+    expect((await stub.emitAsync(['main.js', 'index.html'])).unlinkedPaths).toEqual([]);
+  });
+
+  it('deletes nothing when files are only added', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js']);
+    expect((await stub.emitAsync(['main.js', '1.js'])).unlinkedPaths).toEqual([]);
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([outputPathOf('1.js')]);
+  });
+
+  it('deletes nothing on an emit with errors, and deletes what both emits had on the next emit without errors', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', '1.js']);
+
+    expect((await stub.emitAsync(['main.js', '2.js'], true)).unlinkedPaths).toEqual([]);
+    expect((await stub.emitAsync(['main.js', '3.js'])).unlinkedPaths).toEqual(
+      [outputPathOf('1.js'), outputPathOf('2.js')].sort()
+    );
+  });
+
+  it('writes a file without its query string or fragment', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js?v=1', 'style.css#fragment']);
+    expect((await stub.emitAsync(['main.js?v=2', 'style.css'])).unlinkedPaths).toEqual([]);
+    expect((await stub.emitAsync([])).unlinkedPaths).toEqual(
+      [outputPathOf('main.js'), outputPathOf('style.css')].sort()
+    );
+  });
+
+  it('never deletes a file that webpack writes outside the output folder', async () => {
+    // Webpack writes an asset to the output path joined with its name, with the posix or win32 path rules of
+    // the output path. So the file of "./../dot.json" is outside the output folder, and "..json" is in it.
+    const posix: IStubCompiler = createStubCompiler({ outputPath: '/stub/dist' });
+    await posix.emitAsync([
+      'main.js',
+      '../manifest.json',
+      '../../two-up.json',
+      './../dot.json',
+      'nested/./../../dot-nested.json',
+      'nested/..',
+      'nested/../..',
+      'nested/../1.js',
+      '/absolute/2.js',
+      '..json',
+      '..\\3.js'
+    ]);
+    expect((await posix.emitAsync(['main.js'])).unlinkedPaths).toEqual(
+      ['/stub/dist/1.js', '/stub/dist/absolute/2.js', '/stub/dist/..json', '/stub/dist/..\\3.js'].sort()
+    );
+
+    const win32: IStubCompiler = createStubCompiler({ outputPath: 'C:\\stub\\dist' });
+    await win32.emitAsync([
+      'main.js',
+      '..\\manifest.json',
+      '.\\..\\dot.json',
+      'C:\\absolute\\windows.js',
+      'nested\\..\\1.js',
+      'nested/2.js',
+      '\\\\server\\share\\3.js'
+    ]);
+    expect((await win32.emitAsync(['main.js'])).unlinkedPaths).toEqual(
+      ['C:\\stub\\dist\\1.js', 'C:\\stub\\dist\\nested\\2.js', 'C:\\stub\\dist\\server\\share\\3.js'].sort()
+    );
+
+    // An output file system whose join resolves an absolute name
+    const resolving: IStubCompiler = createStubCompiler({
+      outputPath: '/stub/dist',
+      join: path.posix.resolve
+    });
+    await resolving.emitAsync(['main.js', '/etc/outside.js', '1.js']);
+    expect((await resolving.emitAsync(['main.js'])).unlinkedPaths).toEqual(['/stub/dist/1.js']);
+  });
+
+  it('never deletes a hot update file, or a file that the current emit has', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', { name: 'main.1.hot-update.js', hotModuleReplacement: true }]);
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([]);
+
+    await stub.emitAsync(['main.js', 'both.js']);
+    expect(
+      (await stub.emitAsync(['main.js', { name: 'both.js', hotModuleReplacement: true }])).unlinkedPaths
+    ).toEqual([]);
+  });
+
+  it('ignores a file that is already gone', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    stub.unlinkErrorCodes.set(outputPathOf('1.js'), 'ENOENT');
+    await stub.emitAsync(['main.js', '1.js']);
+
+    expect(await stub.emitAsync(['main.js'])).toEqual({
+      unlinkedPaths: [outputPathOf('1.js')],
+      errors: [],
+      warnings: []
+    });
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([]);
+  });
+
+  it('reports a file that it could not delete as an error, and tries again on the next emit', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    stub.unlinkErrorCodes.set(outputPathOf('1.js'), 'EACCES');
+    await stub.emitAsync(['main.js', '1.js', '2.js']);
+
+    const failed: IEmitResult = await stub.emitAsync(['main.js']);
+    expect(failed.unlinkedPaths).toEqual([outputPathOf('1.js'), outputPathOf('2.js')].sort());
+    expect(failed.errors).toHaveLength(1);
+    expect(failed.errors[0]).toBeInstanceOf(StubWebpackError);
+    expect(failed.errors[0].message).toContain(`"${outputPathOf('1.js')}"`);
+    expect(failed.errors[0].message).toContain('EACCES');
+
+    stub.unlinkErrorCodes.clear();
+    expect(await stub.emitAsync(['main.js'])).toEqual({
+      unlinkedPaths: [outputPathOf('1.js')],
+      errors: [],
+      warnings: []
+    });
+  });
+
+  it('warns on each emit while the output file system cannot delete a file that the emit does not have', async () => {
+    const stub: IStubCompiler = createStubCompiler({ withoutUnlink: true });
+    await stub.emitAsync(['main.js', '1.js']);
+
+    const result: IEmitResult = await stub.emitAsync(['main.js']);
+    expect(result.errors).toEqual([]);
+    expect(result.warnings).toHaveLength(1);
+    expect(result.warnings[0].message).toContain("can't delete files");
+    expect((await stub.emitAsync(['main.js'])).warnings).toHaveLength(1);
+    expect((await stub.emitAsync(['main.js', '1.js'])).warnings).toEqual([]);
+  });
+
+  it("uses the output file system's join", async () => {
+    const stub: IStubCompiler = createStubCompiler({
+      join: (path1: string, path2: string) => path.join(path1, 'joined', path2)
+    });
+    await stub.emitAsync(['main.js', '1.js']);
+    expect((await stub.emitAsync(['main.js'])).unlinkedPaths).toEqual([outputPathOf('joined/1.js')]);
+  });
+
+  it('keeps the state of each compiler separate', async () => {
+    const first: IStubCompiler = createStubCompiler();
+    const second: IStubCompiler = createStubCompiler();
+    await first.emitAsync(['first.js']);
+    await second.emitAsync(['second.js']);
+
+    expect((await first.emitAsync([])).unlinkedPaths).toEqual([outputPathOf('first.js')]);
+    expect((await second.emitAsync(['second.js'])).unlinkedPaths).toEqual([]);
+  });
+
+  it('logs the number of deleted files, and each path in verbose output', async () => {
+    const stub: IStubCompiler = createStubCompiler();
+    await stub.emitAsync(['main.js', '1.js', '2.js']);
+    await stub.emitAsync(['main.js']);
+
+    expect(stub.terminalProvider.getOutput()).toContain(
+      'Deleted 2 output file(s) that earlier compilations emitted and this compilation does'
+    );
+    const verboseOutput: string = stub.terminalProvider.getVerboseOutput();
+    expect(verboseOutput).toContain(`Deleted "${outputPathOf('1.js')}"`);
+    expect(verboseOutput).toContain(`Deleted "${outputPathOf('2.js')}"`);
+  });
+});
+
+describe(`${DeleteStaleAssetsPlugin.name} with webpack`, () => {
+  // Each test runs several webpack compilations, which can take longer than the default timeout of Jest on a
+  // busy machine.
+  const TIMEOUT_MS: number = 60_000;
+  const ENTRY: string = 'export const value = 1;\n';
+  const LAZY_IMPORT: string = "void import(/* webpackChunkName: 'lazy' */ './lazy');\n";
+  const MISSING_IMPORT: string = "void import('./missing');\n";
+
+  let modifiedTime: number = Math.floor(Date.now() / 1000) - 100000;
+
+  async function writeSourceAsync(filePath: string, contents: string): Promise<void> {
+    await FileSystem.writeFileAsync(filePath, contents, { ensureFolderExists: true });
+    // Give each version its own modified time, so that webpack's cache sees every edit.
+    modifiedTime += 10;
+    FileSystem.updateTimes(filePath, { accessedTime: modifiedTime, modifiedTime });
+  }
+
+  async function prepareFolderAsync(name: string): Promise<string> {
+    const folder: string = `${TEST_FOLDER}/${name}`;
+    await FileSystem.ensureEmptyFolderAsync(folder);
+    await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+    await writeSourceAsync(`${folder}/src/second.js`, "console.log('second');\n");
+    await writeSourceAsync(`${folder}/src/lazy.js`, 'export const lazy = 1;\n');
+    // Files that were in the output folder before the first compilation, such as another task's output
+    await FileSystem.writeFileAsync(`${folder}/dist/other-task.txt`, 'other task\n', {
+      ensureFolderExists: true
+    });
+    await FileSystem.writeFileAsync(`${folder}/dist/lazy.chunk.js`, '// before the first compilation\n');
+    return folder;
+  }
+
+  function createCompiler(
+    folder: string,
+    emitOnErrors: boolean,
+    otherPlugins: WebpackPluginInstance[] = []
+  ): Compiler {
+    const configuration: Configuration = {
+      mode: 'development',
+      devtool: false,
+      cache: { type: 'memory' },
+      context: folder,
+      entry: {
+        main: './src/entry.js',
+        second: './src/second.js'
+      },
+      output: {
+        path: `${folder}/dist`,
+        filename: '[name].js',
+        chunkFilename: '[name].chunk.js'
+      },
+      optimization: { emitOnErrors },
+      infrastructureLogging: { level: 'none' },
+      plugins: [
+        ...otherPlugins,
+        new DeleteStaleAssetsPlugin(new Terminal(new StringBufferTerminalProvider(false)))
+      ]
+    };
+    return webpack(configuration);
+  }
+
+  async function runAsync(compiler: Compiler): Promise<Stats> {
+    return await new Promise((resolve: (stats: Stats) => void, reject: (error: Error) => void) => {
+      compiler.run((error: Error | null, stats: Stats | undefined) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve(stats!);
+        }
+      });
+    });
+  }
+
+  async function closeAsync(compiler: Compiler): Promise<void> {
+    await new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+      compiler.close((error: Error | null | undefined) => (error ? reject(error) : resolve()));
+    });
+  }
+
+  async function readOutputAsync(folder: string): Promise<string[]> {
+    return (await FileSystem.readFolderItemNamesAsync(`${folder}/dist`)).sort();
+  }
+
+  it(
+    'deletes the chunk of a removed dynamic import and keeps unchanged files and files that it did not emit',
+    async () => {
+      const folder: string = await prepareFolderAsync('remove-chunk');
+      const compiler: Compiler = createCompiler(folder, true);
+      try {
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + LAZY_IMPORT);
+        await runAsync(compiler);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+        const stats: Stats = await runAsync(compiler);
+        expect(stats.hasErrors()).toBe(false);
+        // Webpack doesn't write an unchanged file again, but it's still one of the compilation's files.
+        expect(stats.compilation.emittedAssets.has('second.js')).toBe(false);
+        expect(stats.compilation.emittedAssets.has('main.js')).toBe(true);
+        expect(await readOutputAsync(folder)).toEqual(['main.js', 'other-task.txt', 'second.js']);
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'keeps a file that was in the output folder before the first compilation',
+    async () => {
+      const folder: string = await prepareFolderAsync('first-compilation');
+      const compiler: Compiler = createCompiler(folder, true);
+      try {
+        await runAsync(compiler);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + '// edit\n');
+        await runAsync(compiler);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+        expect(await FileSystem.readFileAsync(`${folder}/dist/lazy.chunk.js`)).toEqual(
+          '// before the first compilation\n'
+        );
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'keeps the files outside the output folder that a plugin emits in the first compilation only',
+    async () => {
+      const folder: string = await prepareFolderAsync('outside-output-folder');
+      // Another task's file, at the path that "./../manifest.json" would have if "." were a folder name
+      await FileSystem.writeFileAsync(`${folder}/dist/manifest.json`, 'other task\n');
+      let hasEmitted: boolean = false;
+      // Like a plugin that writes manifests next to the output folder once per session
+      const emitOncePlugin: WebpackPluginInstance = {
+        apply: (compiler: Compiler): void => {
+          compiler.hooks.thisCompilation.tap('EmitOncePlugin', (compilation: Compilation) => {
+            compilation.hooks.processAssets.tap('EmitOncePlugin', () => {
+              if (!hasEmitted) {
+                hasEmitted = true;
+                const { RawSource } = compiler.webpack.sources;
+                compilation.emitAsset('../manifests/once.json', new RawSource('{}\n'));
+                compilation.emitAsset('./../manifest.json', new RawSource('{}\n'));
+                compilation.emitAsset('once.json', new RawSource('{}\n'));
+              }
+            });
+          });
+        }
+      };
+      const compiler: Compiler = createCompiler(folder, true, [emitOncePlugin]);
+      try {
+        await runAsync(compiler);
+        expect(await FileSystem.readFileAsync(`${folder}/manifests/once.json`)).toEqual('{}\n');
+        expect(await FileSystem.readFileAsync(`${folder}/manifest.json`)).toEqual('{}\n');
+        expect(await readOutputAsync(folder)).toContain('once.json');
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + '// edit\n');
+        expect((await runAsync(compiler)).hasErrors()).toBe(false);
+        expect(await FileSystem.readFileAsync(`${folder}/manifests/once.json`)).toEqual('{}\n');
+        expect(await FileSystem.readFileAsync(`${folder}/manifest.json`)).toEqual('{}\n');
+        expect(await FileSystem.readFileAsync(`${folder}/dist/manifest.json`)).toEqual('other task\n');
+        // As with webpack's output.clean, a file in the output folder that the compilation doesn't emit is
+        // deleted.
+        expect(await readOutputAsync(folder)).not.toContain('once.json');
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'deletes nothing when a compilation with errors emits, and cleans up on the next compilation',
+    async () => {
+      const folder: string = await prepareFolderAsync('emit-on-errors');
+      const compiler: Compiler = createCompiler(folder, true);
+      try {
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + LAZY_IMPORT);
+        await runAsync(compiler);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + MISSING_IMPORT);
+        const failed: Stats = await runAsync(compiler);
+        expect(failed.hasErrors()).toBe(true);
+        expect(failed.compilation.emittedAssets.has('main.js')).toBe(true);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+        expect((await runAsync(compiler)).hasErrors()).toBe(false);
+        expect(await readOutputAsync(folder)).toEqual(['main.js', 'other-task.txt', 'second.js']);
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+
+  it(
+    'deletes nothing when a compilation with errors does not emit, and cleans up on the next compilation',
+    async () => {
+      const folder: string = await prepareFolderAsync('no-emit-on-errors');
+      const compiler: Compiler = createCompiler(folder, false);
+      try {
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + LAZY_IMPORT);
+        await runAsync(compiler);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY + MISSING_IMPORT);
+        const failed: Stats = await runAsync(compiler);
+        expect(failed.hasErrors()).toBe(true);
+        expect(failed.compilation.emittedAssets.size).toBe(0);
+        expect(await readOutputAsync(folder)).toEqual([
+          'lazy.chunk.js',
+          'main.js',
+          'other-task.txt',
+          'second.js'
+        ]);
+
+        await writeSourceAsync(`${folder}/src/entry.js`, ENTRY);
+        expect((await runAsync(compiler)).hasErrors()).toBe(false);
+        expect(await readOutputAsync(folder)).toEqual(['main.js', 'other-task.txt', 'second.js']);
+      } finally {
+        await closeAsync(compiler);
+      }
+    },
+    TIMEOUT_MS
+  );
+});
+
+describe(`${Webpack5Plugin.name} with the deleteStaleAssetsInWatchMode option`, () => {
+  const FAKE_WEBPACK_MODULE: string = 'fake-webpack-for-DeleteStaleAssetsPlugin-test';
+  const createdConfigurations: IWebpackConfiguration[] = [];
+
+  jest.doMock(
+    FAKE_WEBPACK_MODULE,
+    () => ({
+      __esModule: true,
+      version: '5.0.0-fake',
+      default: (configuration: IWebpackConfiguration) => {
+        createdConfigurations.push(configuration);
+        let onDone: ((stats?: Stats) => void) | undefined;
+        return {
+          hooks: {
+            done: {
+              tap: (name: string, fn: (stats?: Stats) => void) => {
+                onDone = fn;
+              }
+            }
+          },
+          watch: () => {
+            setImmediate(() => onDone!());
+          },
+          run: (callback: (error: Error | null, stats?: Stats) => void) => callback(null, undefined),
+          close: (callback: (error?: Error | null) => void) => callback()
+        };
+      }
+    }),
+    { virtual: true }
+  );
+
+  beforeEach(() => {
+    createdConfigurations.length = 0;
+  });
+
+  async function runPluginAsync(
+    watch: boolean,
+    options: IWebpackPluginOptions,
+    configuration: IWebpackConfiguration
+  ): Promise<IWebpackConfiguration> {
+    const terminal: Terminal = new Terminal(new StringBufferTerminalProvider(false));
+    const logger: MockScopedLogger = new MockScopedLogger(terminal);
+    const run: AsyncParallelHook<IHeftTaskRunHookOptions> = new AsyncParallelHook(['runOptions']);
+    const runIncremental: AsyncParallelHook<IHeftTaskRunIncrementalHookOptions> = new AsyncParallelHook([
+      'runIncrementalOptions'
+    ]);
+    const taskSession: IHeftTaskSession = {
+      logger,
+      hooks: { run, runIncremental },
+      parameters: {
+        watch,
+        production: false,
+        getFlagParameter: () => ({ value: false })
+      },
+      parsedCommandLine: { commandName: 'build', unaliasedCommandName: 'build' },
+      taskName: 'webpack',
+      tempFolderPath: `${TEST_FOLDER}/temp`
+    } as unknown as IHeftTaskSession;
+    const heftConfiguration: HeftConfiguration = {
+      buildFolderPath: TEST_FOLDER,
+      rigPackageResolver: { resolvePackageAsync: async () => FAKE_WEBPACK_MODULE },
+      terminalProvider: { supportsColor: false }
+    } as unknown as HeftConfiguration;
+
+    const plugin: Webpack5Plugin = new Webpack5Plugin();
+    plugin.apply(taskSession, heftConfiguration, options);
+    plugin.accessor.hooks.onLoadConfiguration.tapPromise('test', async () => configuration);
+
+    if (watch) {
+      await runIncremental.promise({ requestRun: () => {} } as unknown as IHeftTaskRunIncrementalHookOptions);
+    } else {
+      await run.promise({} as unknown as IHeftTaskRunHookOptions);
+    }
+
+    expect(logger.errors).toEqual([]);
+    expect(createdConfigurations).toHaveLength(1);
+    return createdConfigurations[0];
+  }
+
+  function countPlugins(configuration: Configuration): number {
+    return (configuration.plugins ?? []).filter(
+      (plugin: unknown) => plugin instanceof DeleteStaleAssetsPlugin
+    ).length;
+  }
+
+  it('adds the plugin in watch mode', async () => {
+    const configuration: IWebpackConfiguration = await runPluginAsync(
+      true,
+      { deleteStaleAssetsInWatchMode: true },
+      { plugins: [] }
+    );
+    expect(countPlugins(configuration as Configuration)).toBe(1);
+  });
+
+  it('adds its own instance to each configuration', async () => {
+    const configurations: IWebpackConfiguration = await runPluginAsync(
+      true,
+      { deleteStaleAssetsInWatchMode: true },
+      [{}, { plugins: [] }]
+    );
+    const [first, second] = configurations as Configuration[];
+    expect(countPlugins(first)).toBe(1);
+    expect(countPlugins(second)).toBe(1);
+    expect(first.plugins!.find((plugin: unknown) => plugin instanceof DeleteStaleAssetsPlugin)).not.toBe(
+      second.plugins!.find((plugin: unknown) => plugin instanceof DeleteStaleAssetsPlugin)
+    );
+  });
+
+  it('does not add the plugin when the option is not set', async () => {
+    const configuration: IWebpackConfiguration = await runPluginAsync(true, {}, { plugins: [] });
+    expect(countPlugins(configuration as Configuration)).toBe(0);
+  });
+
+  it('does not add the plugin outside watch mode', async () => {
+    const configuration: IWebpackConfiguration = await runPluginAsync(
+      false,
+      { deleteStaleAssetsInWatchMode: true },
+      { plugins: [] }
+    );
+    expect(countPlugins(configuration as Configuration)).toBe(0);
+  });
+});

From 1fed617104ec38e0415fd8cabfdb161b95d0c397 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 163/265] [rush-daemon] Log one line for a reply to a client
 that went away

Swarm integration step 148; original commit 75140fe219 (merge of swarm/r03-t260 at 65241686a4).
Scope: task 260.

Brings 260 (branch swarm/r03-t260). Second agent: o01 board 5104. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 13 of 19. Gate: ch01 GATE OK board 5319 (tree d07dd3cea1)

Commits folded into this step (1):
- 65241686a4 [rush-daemon] Log one line for a reply to a client that went away

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ushd-client-gone-log_2026-09-29-11-50.json |  10 +
 libraries/rush-daemon/README.md               |   5 +-
 .../rush-daemon/src/DaemonControlSession.ts   |  60 +++-
 libraries/rush-daemon/src/RushDaemonHost.ts   |   5 +-
 .../src/test/DaemonClientGone.test.ts         | 308 ++++++++++++++++++
 5 files changed, 378 insertions(+), 10 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-client-gone-log_2026-09-29-11-50.json
 create mode 100644 libraries/rush-daemon/src/test/DaemonClientGone.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/rushd-client-gone-log_2026-09-29-11-50.json b/common/changes/@rushstack/rush-daemon/rushd-client-gone-log_2026-09-29-11-50.json
new file mode 100644
index 0000000000..cc57256211
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-client-gone-log_2026-09-29-11-50.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Log one line, instead of an error stack, for each reply that a client does not receive because it disconnected first (EPIPE or ECONNRESET).",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 31569de7c6..78a1f64ac3 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -39,7 +39,10 @@ Whatever starts a shutdown (a signal, a management client, the idle timeout, a l
 starts each log line with the time, and its `rushd ready at` line also has the time and the process ID, so that
 each start can be matched with its end. If whatever reads the output of `rushd` goes away first, as with
 `rushd 2>&1 | tee rushd.log` when Ctrl+C stops `tee` as well, `rushd` goes on without its output: it still stops
-cleanly and removes its socket and lockfile.
+cleanly and removes its socket and lockfile. A client that goes away before it gets a reply (its connection fails
+with `EPIPE` or `ECONNRESET`) is not a daemon failure: the host writes one line to `onLog` for each reply that it
+could not send, for example `rushd: a client went away before its reply; dropped the pong (write EPIPE)`, and
+nothing to `onError`.
 
 Protocol 0.6 management clients can stop the host through the workspace transport rather than signaling a PID
 read from disk. The host requires a lifecycle-capable hello, drains `shutdownAck` before beginning shutdown,
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index c78020f6b1..e9edceaaa7 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -26,6 +26,7 @@ import type {
   IDaemonRequestEnvelope,
   IDaemonWorkspaceStatus
 } from '@rushstack/rush-daemon-protocol';
+import { DaemonTransportError, DaemonTransportErrorCode } from '@rushstack/rush-daemon-transport';
 import type { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 
 import { createGlobalCommandResult } from './CommandResultPolicy';
@@ -60,7 +61,10 @@ export interface IDaemonControlSessionOptions {
   readonly getWorkspaceStatus?: (omitWarmSet: boolean) => IDaemonWorkspaceStatus;
   /** Reports a removed or replaced installation in `pong`. */
   readonly checkInstallation?: () => IDaemonInstallationChange | undefined;
-  /** Receives a message for the daemon log for each rejected request. */
+  /**
+   * Receives a message for the daemon log for each rejected request, and for each reply that could not reach a
+   * client because the client went away.
+   */
   readonly onLog?: (message: string) => void;
   /** Tracks this connection until it sends its first request or starts closing. */
   readonly connectingClients?: ConnectingClientTracker;
@@ -96,6 +100,7 @@ export class DaemonControlSession {
   readonly #closedPromise: Promise<void>;
   readonly #resolveClosed: () => void;
   readonly #connectingClient: IConnectingClient | undefined;
+  #clientGone: boolean = false;
   #closePromise: Promise<void> | undefined;
   #connectionClosed: boolean = false;
   #handshakeComplete: boolean = false;
@@ -296,7 +301,12 @@ export class DaemonControlSession {
       payload: activeRequests === undefined ? {} : { activeRequests }
     });
     this.#options.onShutdownRequested();
-    await ackPromise;
+    try {
+      await ackPromise;
+    } catch (error) {
+      if (!this.#isClientGone(error)) throw error;
+      await this.#handleSendFailureAsync(error, 'the shutdownAck');
+    }
   }
 
   #startRequest(envelope: IDaemonRequestEnvelope): void {
@@ -364,7 +374,9 @@ export class DaemonControlSession {
         this.#completeRequest(requestId, state);
         releaseActivity?.();
       });
-    void state.completion.catch((error: unknown) => this.#handleSendFailureAsync(error));
+    void state.completion.catch((error: unknown) =>
+      this.#handleSendFailureAsync(error, `the result of ${state.description}`)
+    );
     // The request has its receipt time, so a batch that waits for this connection can now close.
     this.#connectingClient?.settle();
   }
@@ -469,7 +481,7 @@ export class DaemonControlSession {
 
   #send(message: DaemonControlMessage, closeAfterSend: boolean = false): void {
     void this.#enqueueControlAsync(message, closeAfterSend).catch((error: unknown) =>
-      this.#handleSendFailureAsync(error)
+      this.#handleSendFailureAsync(error, `the ${message.kind}`)
     );
   }
 
@@ -513,12 +525,37 @@ export class DaemonControlSession {
     await this.#closeWithReasonAsync(error);
   }
 
-  async #handleSendFailureAsync(error: unknown): Promise<void> {
+  /** Reports a failed send and closes the session. `reply` names what was lost, such as `the pong`. */
+  async #handleSendFailureAsync(error: unknown, reply: string): Promise<void> {
     const normalizedError: Error = normalizeError(error);
-    this.#options.onError(normalizedError);
+    if (this.#isClientGone(error)) {
+      // Not a daemon failure, so one line instead of a stack.
+      this.#options.onLog?.(
+        `rushd: a client went away before its reply; dropped ${reply} (${(error as Error).message})`
+      );
+    } else {
+      this.#options.onError(normalizedError);
+    }
     await this.#closeWithReasonAsync(normalizedError);
   }
 
+  /**
+   * Whether an error only means that the client went away: its connection failed with EPIPE or ECONNRESET, or had
+   * already failed so before this send found it closed. Pass the error as thrown: normalizing can wrap an error
+   * from another realm, such as a socket error under Jest, and drop its code.
+   */
+  #isClientGone(error: unknown): boolean {
+    if (isClientGoneError(error)) {
+      this.#clientGone = true;
+      return true;
+    }
+    return (
+      this.#clientGone &&
+      error instanceof DaemonTransportError &&
+      error.code === DaemonTransportErrorCode.transportClosed
+    );
+  }
+
   #closeWithReasonAsync(reason: Error): Promise<void> {
     this.#markClosing(reason);
     this.#closePromise ??= this.#closeOnceAsync();
@@ -591,6 +628,8 @@ export class DaemonControlSession {
   async #handleConnectionClosedAsync(error: Error | undefined): Promise<void> {
     if (this.#connectionClosed) return;
     this.#connectionClosed = true;
+    // A client that went away is not a daemon failure. Each reply that it missed is logged when its send fails.
+    const closeError: Error | undefined = error && this.#isClientGone(error) ? undefined : error;
     // A client that disconnects after its result does not stop the work that its request still runs.
     this.#markClosing(error ?? new Error('The daemon client connection closed.'), true);
     const settlements: PromiseSettledResult<void>[] = await Promise.allSettled(
@@ -598,8 +637,9 @@ export class DaemonControlSession {
     );
     const cleanupErrors: Error[] = settlements
       .filter((result): result is PromiseRejectedResult => result.status === 'rejected')
+      .filter((result: PromiseRejectedResult) => !this.#isClientGone(result.reason))
       .map((result: PromiseRejectedResult) => normalizeError(result.reason));
-    const finalError: Error | undefined = combineCloseErrors(error, cleanupErrors);
+    const finalError: Error | undefined = combineCloseErrors(closeError, cleanupErrors);
     if (cleanupErrors.length > 0) this.#options.onError(finalError!);
     this.#options.onClosed(this, finalError);
     this.#resolveClosed();
@@ -653,6 +693,12 @@ function normalizeError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error));
 }
 
+/** Whether a connection error means that the client has closed its end, so that nothing more can reach it. */
+function isClientGoneError(error: unknown): boolean {
+  const code: unknown = (error as NodeJS.ErrnoException | undefined)?.code;
+  return code === 'EPIPE' || code === 'ECONNRESET';
+}
+
 function combineErrors(primary: unknown, cleanup: unknown): unknown {
   if (primary === undefined) return cleanup;
   return new AggregateError([primary, cleanup], 'The request failed and could not clean up.');
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 8d541c2ab4..17946b8f46 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -71,12 +71,13 @@ export interface IRushDaemonHostOptions {
    * {@link serveRushDaemonAsync} defaults it for a daemon that owns its process.
    */
   readonly shutdownDeadlineMs?: number;
-  /** Reports connection-level failures. */
+  /** Reports connection-level failures. A client that goes away before its reply is not one (see `onLog`). */
   readonly onError?: (error: Error) => void;
   /**
    * Receives messages for the daemon log: one for each rejected request, with the stack when the failure was
    * unexpected, one for each restart that the clients must finish, one when the daemon's socket was deleted
-   * or replaced, and one with the process ID and the reason when the host begins to shut down.
+   * or replaced, one for each reply that could not reach a client because the client went away, and one with
+   * the process ID and the reason when the host begins to shut down.
    */
   readonly onLog?: (message: string) => void;
   /**
diff --git a/libraries/rush-daemon/src/test/DaemonClientGone.test.ts b/libraries/rush-daemon/src/test/DaemonClientGone.test.ts
new file mode 100644
index 0000000000..2d050acfd0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonClientGone.test.ts
@@ -0,0 +1,308 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  createDaemonHello,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage,
+  encodeDaemonFrame
+} from '@rushstack/rush-daemon-protocol';
+import type { DaemonControlMessage, IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+import { DaemonTransportError, DaemonTransportErrorCode } from '@rushstack/rush-daemon-transport';
+import type { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
+
+import { DaemonControlSession } from '../DaemonControlSession';
+import { DaemonRequestDispatchError } from '../DaemonRequestDispatcher';
+import type { DaemonRequestDispatcher } from '../DaemonRequestDispatcher';
+import { RushDaemonHost } from '../RushDaemonHost';
+import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+const DAEMON_VERSION: string = '0.1.0-test';
+const WENT_AWAY: string = 'rushd: a client went away before its reply; dropped';
+const LOG_WAIT_MS: number = 2000;
+const LOG_POLL_MS: number = 10;
+
+const posixDescribe: jest.Describe = process.platform === 'win32' ? describe.skip : describe;
+
+function createSocketError(code: string, message: string): NodeJS.ErrnoException {
+  return Object.assign(new Error(message), { code });
+}
+
+function createClosedConnectionError(): DaemonTransportError {
+  return new DaemonTransportError(
+    DaemonTransportErrorCode.transportClosed,
+    'Cannot send a frame on a closed connection.'
+  );
+}
+
+/** Lets every pending promise callback and `process.nextTick` callback run. */
+function flushAsync(): Promise<void> {
+  return new Promise((resolve: () => void) => setImmediate(resolve));
+}
+
+/**
+ * Stands in for a socket connection. A send that fails first closes the connection with its error and then
+ * rejects, in the order that a socket reports a failed write.
+ */
+class FakeConnection {
+  public readonly sentKinds: string[] = [];
+  public failSendsWith: Error | undefined;
+  #frameHandler: ((frame: IDaemonFrame) => void | Promise<void>) | undefined;
+  #closedHandler: ((error: Error | undefined) => void) | undefined;
+  #closed: boolean = false;
+
+  public onFrame(handler: (frame: IDaemonFrame) => void | Promise<void>): void {
+    this.#frameHandler = handler;
+  }
+
+  public onClosed(handler: (error: Error | undefined) => void): void {
+    this.#closedHandler = handler;
+  }
+
+  public async sendFrameAsync(frame: IDaemonFrame): Promise<void> {
+    if (this.#closed) throw createClosedConnectionError();
+    if (this.failSendsWith) {
+      this.closeFromPeer(this.failSendsWith);
+      throw this.failSendsWith;
+    }
+    this.sentKinds.push(decodeDaemonControlMessage(frame.payload).kind);
+  }
+
+  public async closeAsync(): Promise<void> {
+    process.nextTick(() => this.closeFromPeer(undefined));
+  }
+
+  public abort(error: Error): void {
+    process.nextTick(() => this.closeFromPeer(error));
+  }
+
+  public async receiveAsync(message: DaemonControlMessage): Promise<void> {
+    await this.#frameHandler!({
+      kind: DaemonFrameType.controlJson,
+      payload: encodeDaemonControlMessage(message)
+    });
+  }
+
+  public closeFromPeer(error: Error | undefined): void {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#closedHandler?.(error);
+  }
+}
+
+interface ITestSession {
+  readonly connection: FakeConnection;
+  readonly session: DaemonControlSession;
+  readonly errors: Error[];
+  readonly logs: string[];
+  readonly closeErrors: (Error | undefined)[];
+  readonly shutdownRequests: string[];
+}
+
+function createTestSession(dispatcher: Partial<DaemonRequestDispatcher> = {}): ITestSession {
+  const connection: FakeConnection = new FakeConnection();
+  const errors: Error[] = [];
+  const logs: string[] = [];
+  const closeErrors: (Error | undefined)[] = [];
+  const shutdownRequests: string[] = [];
+  const session: DaemonControlSession = new DaemonControlSession(
+    connection as unknown as DaemonFrameConnection,
+    {
+      daemonVersion: DAEMON_VERSION,
+      dispatcher: dispatcher as DaemonRequestDispatcher,
+      startedAtMs: Date.now(),
+      onClosed: (closedSession: DaemonControlSession, error: Error | undefined) => closeErrors.push(error),
+      onError: (error: Error) => errors.push(error),
+      onLog: (message: string) => logs.push(message),
+      onShutdownRequested: () => shutdownRequests.push('shutdown')
+    }
+  );
+  return { connection, session, errors, logs, closeErrors, shutdownRequests };
+}
+
+async function handshakeAsync(connection: FakeConnection): Promise<void> {
+  await connection.receiveAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+  await connection.receiveAsync({
+    kind: 'subscribe',
+    payload: { isTTY: false, supportsRequestLifecycle: true }
+  });
+}
+
+describe('DaemonControlSession with a client that went away', () => {
+  it('logs one line, and reports no error, for a reply whose send fails with EPIPE', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    await connection.receiveAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, closeErrors }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the helloAck (write EPIPE)`],
+      closeErrors: [undefined]
+    });
+  });
+
+  it('treats ECONNRESET the same as EPIPE', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('ECONNRESET', 'write ECONNRESET');
+    await connection.receiveAsync({ kind: 'ping', payload: {} });
+    await flushAsync();
+    await session.closeAsync();
+    expect(connection.sentKinds).toEqual(['helloAck']);
+    expect({ errors, logs, closeErrors }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the pong (write ECONNRESET)`],
+      closeErrors: [undefined]
+    });
+  });
+
+  it('logs one line for each later reply that finds the connection closed', async () => {
+    const { connection, session, errors, logs } = createTestSession();
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    // Both pings are handled before the first pong fails, as when a client sends them and leaves.
+    await Promise.all([
+      connection.receiveAsync({ kind: 'ping', payload: {} }),
+      connection.receiveAsync({ kind: 'ping', payload: {} })
+    ]);
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs }).toEqual({
+      errors: [],
+      logs: [
+        `${WENT_AWAY} the pong (write EPIPE)`,
+        `${WENT_AWAY} the pong (Cannot send a frame on a closed connection.)`
+      ]
+    });
+  });
+
+  it('logs one line for a lost shutdown acknowledgement and still requests the shutdown', async () => {
+    const { connection, session, errors, logs, shutdownRequests } = createTestSession();
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    await connection.receiveAsync({ kind: 'shutdown', payload: {} });
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, shutdownRequests }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the shutdownAck (write EPIPE)`],
+      shutdownRequests: ['shutdown']
+    });
+  });
+
+  it('logs one line for a lost request outcome', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession({
+      dispatchAsync: async () => {
+        throw new DaemonRequestDispatchError('unsupported', 'No route for "build".');
+      }
+    });
+    await handshakeAsync(connection);
+    connection.failSendsWith = createSocketError('EPIPE', 'write EPIPE');
+    await connection.receiveAsync({
+      kind: 'requestStart',
+      payload: createWireEnvelope('request-1', 'build', os.tmpdir())
+    });
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, closeErrors }).toEqual({
+      errors: [],
+      logs: [
+        'rushd: rejected request request-1 (unsupported): No route for "build".',
+        `${WENT_AWAY} the result of "build" (write EPIPE)`
+      ],
+      closeErrors: [undefined]
+    });
+  });
+
+  it('reports nothing when a client resets a connection that has no reply pending', async () => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    await handshakeAsync(connection);
+    connection.closeFromPeer(createSocketError('ECONNRESET', 'read ECONNRESET'));
+    await flushAsync();
+    await session.closeAsync();
+    expect({ errors, logs, closeErrors }).toEqual({ errors: [], logs: [], closeErrors: [undefined] });
+  });
+
+  it.each([
+    ['another socket error', createSocketError('EIO', 'write EIO')],
+    ['a closed connection that no client-gone error closed', createClosedConnectionError()]
+  ])('still reports %s as an error', async (description: string, failure: Error) => {
+    const { connection, session, errors, logs, closeErrors } = createTestSession();
+    connection.failSendsWith = failure;
+    await connection.receiveAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
+    await flushAsync();
+    await session.closeAsync();
+    expect(logs).toEqual([]);
+    expect(errors).toHaveLength(1);
+    expect(errors[0]).toBe(failure);
+    expect(closeErrors).toHaveLength(1);
+    expect(closeErrors[0]).toBe(failure);
+  });
+});
+
+// Only the POSIX socket error codes were observed; a Windows named pipe may report a closed client differently.
+posixDescribe('RushDaemonHost with a client socket that closes before its reply', () => {
+  let repoRoot: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-daemon-client-gone-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  it('logs one line, and reports no error, for the lost hello acknowledgement', async () => {
+    const errors: Error[] = [];
+    const logs: string[] = [];
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      daemonVersion: DAEMON_VERSION,
+      repoRoot,
+      rushVersion: '5.178.1',
+      createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+      onError: (error: Error) => errors.push(error),
+      onLog: (message: string) => logs.push(message)
+    });
+    try {
+      const socket: net.Socket = await new Promise(
+        (resolve: (socket: net.Socket) => void, reject: (error: Error) => void) => {
+          const connecting: net.Socket = net.createConnection(host.paths.socketPath, () =>
+            resolve(connecting)
+          );
+          connecting.once('error', reject);
+        }
+      );
+      const socketClosed: Promise<void> = new Promise((resolve: () => void) => socket.once('close', resolve));
+      socket.write(
+        encodeDaemonFrame({
+          kind: DaemonFrameType.controlJson,
+          payload: encodeDaemonControlMessage(createDaemonHello(DAEMON_PROTOCOL_VERSION))
+        })
+      );
+      socket.destroy();
+      await socketClosed;
+      const deadlineMs: number = Date.now() + LOG_WAIT_MS;
+      while (!logs.some((message: string) => message.startsWith(WENT_AWAY)) && Date.now() < deadlineMs) {
+        await new Promise<void>((resolve: () => void) => setTimeout(resolve, LOG_POLL_MS));
+      }
+    } finally {
+      await host.closeAsync();
+    }
+    expect({
+      errors,
+      logs: logs.filter((message: string) => message.startsWith(WENT_AWAY))
+    }).toEqual({
+      errors: [],
+      logs: [`${WENT_AWAY} the helloAck (write EPIPE)`]
+    });
+  });
+});

From 5c07f6b64d8c37606b40c2319371e5c7be02baff Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 164/265] [rush-daemon-transport] rush-daemon-transport tests:
 remove what test keys leave in the shared runtime directory

Swarm integration step 149; original commit c476964f9e (merge of swarm/r06-t262 at 9f725c2448).
Scope: task 262.

Brings 262 (branch swarm/r06-t262). Second agent: t06 board 5200, board 5201. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 14 of 19. Gate: ch01 GATE OK board 5319 (tree b2868a110a)

Commits folded into this step (1):
- 9f725c2448 rush-daemon-transport tests: remove what test keys leave in the shared runtime directory

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../r06-t262-test-keys_2026-09-29-11-45.json  | 11 ++++
 .../src/test/TestDaemonFixture.ts             | 24 +++----
 .../src/test/TestDaemonKeys.test.ts           | 62 +++++++++++++++++++
 .../src/test/TestDaemonKeys.ts                | 56 +++++++++++++++++
 4 files changed, 138 insertions(+), 15 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r06-t262-test-keys_2026-09-29-11-45.json
 create mode 100644 libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/r06-t262-test-keys_2026-09-29-11-45.json b/common/changes/@rushstack/rush-daemon-transport/r06-t262-test-keys_2026-09-29-11-45.json
new file mode 100644
index 0000000000..45638cbfac
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r06-t262-test-keys_2026-09-29-11-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Tests now remove what their workspace keys leave in the shared daemon runtime directory, and no longer reuse another test file's keys.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts b/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
index 08585b307a..d4e00c9b2d 100644
--- a/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonFixture.ts
@@ -11,26 +11,20 @@ import { connectDaemonAsync } from '../DaemonConnector';
 import type { DaemonFrameConnection } from '../DaemonFrameConnection';
 import { DaemonFrameListener } from '../DaemonListener';
 import type { IDaemonPaths } from '../DaemonPaths';
-import { DAEMON_RUNTIME_DIR_ENV_VAR, resolveDaemonPaths } from '../DaemonPaths';
+import { DAEMON_RUNTIME_DIR_ENV_VAR } from '../DaemonPaths';
+
+import { resolveTestKeyPaths } from './TestDaemonKeys';
 
-let testKeyCounter: number = 0;
-const COUNTER_START: number = 1;
 const ISOLATED_BASE_PREFIX: string = 'rushd-test-base-';
 // Short, as a socket path must be (104 bytes on macOS); the daemon's own default base is /tmp too.
 const POSIX_TEMP_FOLDER: string = '/tmp';
 
-function resolveTestDaemonPaths(env: Readonly<Record<string, string>>): IDaemonPaths {
-  testKeyCounter += COUNTER_START;
-  const workspaceKey: string = `rushd-test-${process.pid}-${testKeyCounter}`;
-  return resolveDaemonPaths(
-    { platform: process.platform, env, tmpdir: os.tmpdir(), uid: process.getuid?.() },
-    workspaceKey
-  );
-}
-
-/** Creates unique daemon paths for the current platform in the user's shared runtime directory. */
+/**
+ * Creates unique daemon paths for the current platform in the user's shared runtime directory. Whatever a test
+ * leaves there under them is deleted after the test file's last test (see `removeTestKeyEntries`).
+ */
 export function createTestDaemonPaths(): IDaemonPaths {
-  return resolveTestDaemonPaths({});
+  return resolveTestKeyPaths({});
 }
 
 /**
@@ -40,7 +34,7 @@ export function createTestDaemonPaths(): IDaemonPaths {
 export function createIsolatedTestDaemonPaths(): IDaemonPaths {
   const parent: string = process.platform === 'win32' ? os.tmpdir() : POSIX_TEMP_FOLDER;
   const base: string = fs.mkdtempSync(path.join(parent, ISOLATED_BASE_PREFIX));
-  return resolveTestDaemonPaths({ [DAEMON_RUNTIME_DIR_ENV_VAR]: base });
+  return resolveTestKeyPaths({ [DAEMON_RUNTIME_DIR_ENV_VAR]: base });
 }
 
 /** Deletes the runtime base of paths from {@link createIsolatedTestDaemonPaths}. */
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts
new file mode 100644
index 0000000000..6de082aa8c
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.test.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+
+import { OPERATION_GROUP, recordGroups } from './OperationGroupFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+import { removeTestKeyEntries } from './TestDaemonKeys';
+
+it("removes what this file's keys left in the shared runtime directory, and no other file's entries", () => {
+  const recorded: string = recordGroups([OPERATION_GROUP]);
+  const { lockfilePath } = createTestDaemonPaths();
+  const entries: string[] = [lockfilePath, `${lockfilePath}.log`];
+  for (const entry of entries) fs.writeFileSync(entry, '{}');
+  // The same pid as this file's keys, as another test file in this worker would have.
+  const foreign: string = path.join(path.dirname(lockfilePath), `rushd-test-${process.pid}-other.pid.json`);
+  fs.writeFileSync(foreign, '{}');
+  try {
+    removeTestKeyEntries();
+    expect(fs.existsSync(getOperationGroupsFolder(recorded, DEAD_PID))).toBe(false);
+    expect(entries.filter((entry: string) => fs.existsSync(entry))).toEqual([]);
+    expect(fs.existsSync(foreign)).toBe(true);
+  } finally {
+    fs.rmSync(foreign, { force: true });
+  }
+});
+
+interface IModuleCopy {
+  firstKey: string;
+  removeEntries: () => void;
+}
+
+async function loadCopyAsync(): Promise<IModuleCopy> {
+  const { resolveTestKeyPaths, removeTestKeyEntries: removeEntries } = await import('./TestDaemonKeys');
+  return { firstKey: path.basename(resolveTestKeyPaths({}).lockfilePath), removeEntries };
+}
+
+it('gives each test file keys of its own, and has it remove their entries after its last test', async () => {
+  const hooks: jest.ProvidesHookCallback[] = [];
+  const spy: jest.SpyInstance = jest
+    .spyOn(global, 'afterAll')
+    .mockImplementation((hook: jest.ProvidesHookCallback) => hooks.push(hook));
+  const copies: IModuleCopy[] = [];
+  try {
+    // Fresh copies of the module, as two test files in one Jest worker get.
+    await jest.isolateModulesAsync(async () => {
+      copies.push(await loadCopyAsync());
+    });
+    await jest.isolateModulesAsync(async () => {
+      copies.push(await loadCopyAsync());
+    });
+    const [firstFileKey, secondFileKey] = copies.map((copy: IModuleCopy) => copy.firstKey);
+    expect(secondFileKey).not.toBe(firstFileKey);
+    expect(hooks).toEqual(copies.map((copy: IModuleCopy) => copy.removeEntries));
+  } finally {
+    spy.mockRestore();
+  }
+});
diff --git a/libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts
new file mode 100644
index 0000000000..8b0f107476
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/TestDaemonKeys.ts
@@ -0,0 +1,56 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '../DaemonPaths';
+import { resolveDaemonPaths } from '../DaemonPaths';
+
+const NONCE_BYTES: number = 3;
+const COUNTER_STEP: number = 1;
+const NO_OVERRIDES: Readonly<Record<string, string>> = {};
+
+// Jest runs several test files in one worker and loads this module afresh for each of them, so a key made of the
+// pid and a counter alone would repeat in the next file, and in a later worker that reuses the pid.
+const TEST_KEY_PREFIX: string = `rushd-test-${process.pid}-${crypto.randomBytes(NONCE_BYTES).toString('hex')}-`;
+let testKeyCounter: number = 0;
+
+function resolveKeyPaths(env: Readonly<Record<string, string>>, workspaceKey: string): IDaemonPaths {
+  return resolveDaemonPaths(
+    { platform: process.platform, env, tmpdir: os.tmpdir(), uid: process.getuid?.() },
+    workspaceKey
+  );
+}
+
+/** Resolves the paths of a new workspace key of this test file, in the runtime base that `env` selects. */
+export function resolveTestKeyPaths(env: Readonly<Record<string, string>>): IDaemonPaths {
+  testKeyCounter += COUNTER_STEP;
+  return resolveKeyPaths(env, `${TEST_KEY_PREFIX}${testKeyCounter}`);
+}
+
+function readFolderIfPresent(folder: string): string[] {
+  try {
+    return fs.readdirSync(folder);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Deletes every entry that this test file's keys left in the user's shared runtime directory: records, sockets,
+ * operation group records, logs and locks. Other files' and real daemons' entries are left alone.
+ */
+export function removeTestKeyEntries(): void {
+  const folder: string = path.dirname(resolveKeyPaths(NO_OVERRIDES, TEST_KEY_PREFIX).lockfilePath);
+  const names: string[] = readFolderIfPresent(folder).filter((name: string) =>
+    name.startsWith(TEST_KEY_PREFIX)
+  );
+  for (const name of names) fs.rmSync(path.join(folder, name), { recursive: true, force: true });
+}
+
+// Each test file that makes keys loads this module, so each one cleans up after its last test, including records
+// that a test keeps on purpose and those of a test that failed before its own cleanup.
+afterAll(removeTestKeyEntries);

From 2d57d6420df3450a99e86f9dce8b89c4ad787b85 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 165/265] [rush-daemon] Test that a batched iteration announces
 a shared operation to each client that selects it

Swarm integration step 150; original commit 519e714646 (merge of swarm/r05-t178-e2b6 at dec25391d8).
Scope: task 178.

Brings 178 (branch swarm/r05-t178-e2b6). Second agent: t01 board 5117. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 15 of 19. Gate: ch01 GATE OK board 5319 (tree 1bbc8f7ef6)

Commits folded into this step (2):
- 081fdd38f6 [rush-lib] [rush-daemon] Announce a batched iteration to each client with only its own operations
- dec25391d8 [rush-daemon] Test that a batched iteration announces a shared operation to each client that selects it

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...eration-announcement_2026-09-29-11-45.json |  11 ++
 ...eration-announcement_2026-09-29-11-45.json |  11 ++
 common/reviews/api/rush-lib.api.md            |   4 +
 .../src/PhasedRequestEventMultiplexer.ts      |  50 ++++++-
 .../rush-daemon/src/PhasedRequestEventSink.ts |  27 +++-
 .../src/test/PhasedRequestBatching.test.ts    | 134 ++++++++++++++++++
 .../PhasedRequestEventMultiplexer.test.ts     |  62 ++++++++
 .../src/test/PhasedRequestEventSink.test.ts   |  82 +++++++++++
 libraries/rush-lib/src/index.ts               |   9 +-
 .../logic/operations/OperationEventSink.ts    |  52 +++++++
 .../src/logic/operations/OperationGraph.ts    |  41 +++---
 .../test/OperationGraphEventSink.test.ts      | 120 +++++++++++++++-
 12 files changed, 568 insertions(+), 35 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/batched-iteration-announcement_2026-09-29-11-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/batched-iteration-announcement_2026-09-29-11-45.json

diff --git a/common/changes/@microsoft/rush/batched-iteration-announcement_2026-09-29-11-45.json b/common/changes/@microsoft/rush/batched-iteration-announcement_2026-09-29-11-45.json
new file mode 100644
index 0000000000..6b91d31899
--- /dev/null
+++ b/common/changes/@microsoft/rush/batched-iteration-announcement_2026-09-29-11-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "An operation graph event sink (internal) can implement `onIterationStarting` to announce an iteration itself. The graph then passes it the iteration's records instead of sending it the `Selected N operations:` and `Executing a maximum of N simultaneous processes...` lines as activity, and `_formatIterationStartLines` renders those lines for any set of operations. The console output is unchanged.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/batched-iteration-announcement_2026-09-29-11-45.json b/common/changes/@rushstack/rush-daemon/batched-iteration-announcement_2026-09-29-11-45.json
new file mode 100644
index 0000000000..0d9a8eb567
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/batched-iteration-announcement_2026-09-29-11-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When one iteration serves a batch of requests, each client's `Selected N operations:` list and `Executing a maximum of N simultaneous processes...` line count only that client's own operations, and a client with nothing to run in the iteration prints neither line, as when its request runs alone.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 6d202a4612..28fd570b0e 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -379,6 +379,9 @@ export class _FlagFile<TState extends JsonObject = JsonObject> {
     protected _state: TState;
 }
 
+// @internal
+export function _formatIterationStartLines(operationNames: Iterable<string>, parallelism: number, quietMode: boolean): string[];
+
 // @beta
 export type GetCacheEntryIdFunction = (options: IGenerateCacheEntryIdOptions) => string;
 
@@ -789,6 +792,7 @@ export interface IOperationGraphContext extends ICreateOperationsContext {
 export interface _IOperationGraphEventSink {
     createChildProcessReporter?(operationId: string, iterationId: number): _IOperationChildProcessReporter | undefined;
     onActivity?(text: string, options?: _IOperationActivityOptions): void;
+    onIterationStarting?(records: ReadonlyArray<IOperationExecutionResult>, parallelism: number, quietMode: boolean): void;
     onOperationChunk?(operationId: string, chunk: ITerminalChunk, result?: IOperationExecutionResult, iterationId?: number): void;
     onOperationCompleted?(result: IOperationExecutionResult): void;
     onOperationHeader?(operationId: string, completedOperations: number, totalOperations: number): void;
diff --git a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
index 39991db255..2f5602b981 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
@@ -1,11 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type {
-  IOperationExecutionResult,
-  OperationStatus,
-  _IOperationActivityOptions,
-  _IOperationGraphEventSink
+import {
+  type IOperationExecutionResult,
+  type OperationStatus,
+  type _IOperationActivityOptions,
+  type _IOperationGraphEventSink,
+  _formatIterationStartLines
 } from '@microsoft/rush-lib';
 import type { ITerminalChunk } from '@rushstack/terminal';
 
@@ -95,6 +96,35 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     }
   }
 
+  /**
+   * Lets each sink that announces iterations itself announce this one, so that each request sink can list only
+   * its own operations. Any other sink receives the announcement of all of the iteration's operations as activity,
+   * as it would without this multiplexer.
+   */
+  public onIterationStarting(
+    records: ReadonlyArray<IOperationExecutionResult>,
+    parallelism: number,
+    quietMode: boolean
+  ): void {
+    let lines: string[] | undefined;
+    const announce: (sink: _IOperationGraphEventSink) => void = (sink) => {
+      if (sink.onIterationStarting) {
+        sink.onIterationStarting(records, parallelism, quietMode);
+      } else if (sink.onActivity) {
+        lines ??= _formatIterationStartLines(getNonSilentOperationNames(records), parallelism, quietMode);
+        for (const line of lines) {
+          sink.onActivity(line);
+        }
+      }
+    };
+    if (this.#workspaceSink) {
+      announce(this.#workspaceSink);
+    }
+    for (const requestSink of this.#requestSinks) {
+      announce(requestSink);
+    }
+  }
+
   public onActivity(text: string, options?: _IOperationActivityOptions): void {
     this.#workspaceSink?.onActivity?.(text, options);
     for (const requestSink of this.#requestSinks) {
@@ -102,3 +132,13 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     }
   }
 }
+
+function getNonSilentOperationNames(records: ReadonlyArray<IOperationExecutionResult>): string[] {
+  const operationNames: string[] = [];
+  for (const record of records) {
+    if (!record.silent) {
+      operationNames.push(record.operation.name);
+    }
+  }
+  return operationNames;
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index c6ccc0e810..1a71938a57 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -4,7 +4,7 @@
 import { randomUUID } from 'node:crypto';
 
 import type { IOperationExecutionResult, Operation, _IOperationGraphEventSink } from '@microsoft/rush-lib';
-import { OperationStatus } from '@microsoft/rush-lib';
+import { OperationStatus, _formatIterationStartLines } from '@microsoft/rush-lib';
 import { getCommandExecution } from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
 import type { ICommandExecution } from '@microsoft/rush-lib/lib/logic/operations/IncrementalExecutionState';
 import {
@@ -205,6 +205,31 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     }
   }
 
+  /**
+   * Announces the iteration to this client with only its own operations, as the iteration would be announced if
+   * the client's request were the only one in it.
+   */
+  public onIterationStarting(
+    records: ReadonlyArray<IOperationExecutionResult>,
+    parallelism: number,
+    quietMode: boolean
+  ): void {
+    const operationNames: string[] = [];
+    for (const record of records) {
+      const operationId: string = record.operation.name;
+      if (!record.silent && this.#activeOperationIds.has(operationId)) {
+        operationNames.push(operationId);
+      }
+    }
+    if (operationNames.length === 0) {
+      // Alone, a request with nothing to run starts no iteration, so it is not announced.
+      return;
+    }
+    for (const line of _formatIterationStartLines(operationNames, parallelism, quietMode)) {
+      this.onActivity(line);
+    }
+  }
+
   public onOperationCompleted(result: IOperationExecutionResult): void {
     this.#settleActiveOperation(result);
     // A failure elsewhere can block this client's operations, so any operation's completion can decide its result.
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index f016158dd0..ff9ddc1849 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -636,6 +636,121 @@ describe('shared phased request batching', () => {
     ]);
   });
 
+  it.each([false, true])(
+    'announces a shared iteration to each client with only its own operations (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const fixture: ITestRoutingFixture = createFixture();
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const settings: IPhasedCommandEngineRequestSettings = {
+        parallelism: 4,
+        quietMode,
+        isIncrementalBuildAllowed: true
+      };
+      const clientB: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(createRequest('b', OPERATION_B), clientB, false, undefined, settings),
+        router.executeAsync(createRequest('c', OPERATION_C), clientC, false, undefined, settings)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(getIterationAnnouncement(clientB)).toEqual([
+        ...(quietMode ? [] : ['Selected 2 operations:', `  ${OPERATION_A}`, `  ${OPERATION_B}`, '']),
+        'Executing a maximum of 2 simultaneous processes...'
+      ]);
+      expect(getIterationAnnouncement(clientC)).toEqual([
+        ...(quietMode ? [] : ['Selected 1 operation:', `  ${OPERATION_C}`, '']),
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+    }
+  );
+
+  it.each([false, true])(
+    'announces an operation that two clients of a shared iteration both select to each of them (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const fixture: ITestRoutingFixture = createFixture();
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const settings: IPhasedCommandEngineRequestSettings = {
+        parallelism: 4,
+        quietMode,
+        isIncrementalBuildAllowed: true
+      };
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientB: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+
+      await Promise.all([
+        router.executeAsync(createRequest('a', OPERATION_A), clientA, false, undefined, settings),
+        router.executeAsync(createRequest('b', OPERATION_B), clientB, false, undefined, settings)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(1);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(getIterationAnnouncement(clientA)).toEqual([
+        ...(quietMode ? [] : ['Selected 1 operation:', `  ${OPERATION_A}`, '']),
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+      expect(getIterationAnnouncement(clientB)).toEqual([
+        ...(quietMode ? [] : ['Selected 2 operations:', `  ${OPERATION_A}`, `  ${OPERATION_B}`, '']),
+        'Executing a maximum of 2 simultaneous processes...'
+      ]);
+      expect(getHeaderData(clientA)).toEqual([
+        { completedOperations: 1, operationId: OPERATION_A, totalOperations: 1 }
+      ]);
+      expect(getHeaderData(clientB)).toEqual([
+        { completedOperations: 1, operationId: OPERATION_A, totalOperations: 2 },
+        { completedOperations: 2, operationId: OPERATION_B, totalOperations: 2 }
+      ]);
+    }
+  );
+
+  it.each([false, true])(
+    'does not announce a shared iteration to a client that has nothing to run in it, as when it is alone (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const fixture: ITestRoutingFixture = createFixture();
+      let upToDate: boolean = false;
+      fixture.graph.hooks.configureIteration.tap('project-a is up to date', (records) => {
+        for (const record of records.values()) {
+          if (upToDate && record.operation.name === OPERATION_A) {
+            record.enabled = false;
+          }
+        }
+      });
+      const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+      const settings: IPhasedCommandEngineRequestSettings = {
+        parallelism: 4,
+        quietMode,
+        isIncrementalBuildAllowed: true
+      };
+      const clientA: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      const clientC: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      await router.executeAsync(
+        createRequest('first', OPERATION_A),
+        new TestPhasedRequestClient('zero'),
+        false,
+        undefined,
+        settings
+      );
+      upToDate = true;
+
+      await Promise.all([
+        router.executeAsync(createRequest('a', OPERATION_A), clientA, false, undefined, settings),
+        router.executeAsync(createRequest('c', OPERATION_C), clientC, false, undefined, settings)
+      ]);
+
+      expect(scheduleSpy).toHaveBeenCalledTimes(2);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+      expect(getIterationAnnouncement(clientA)).toEqual([]);
+      expect(getIterationAnnouncement(clientC)).toEqual([
+        ...(quietMode ? [] : ['Selected 1 operation:', `  ${OPERATION_C}`, '']),
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+    }
+  );
+
   it('publishes a coalesced client result as soon as its own closure settles', async () => {
     const releaseB: IDeferred = createDeferred();
     const fixture: ITestRoutingFixture = createFixture({
@@ -1409,6 +1524,25 @@ describe('shared phased request batching', () => {
   });
 });
 
+/** The activity lines that announced an iteration to a client, from the `Selected` listing through the `Executing` line. */
+function getIterationAnnouncement(client: TestPhasedRequestClient): ReadonlyArray<string> {
+  const texts: string[] = client.writes.flatMap(({ event }) =>
+    event?.type === 'activityChanged' && event.scope === undefined
+      ? [(event.payload as { text: string }).text]
+      : []
+  );
+  const executingIndexes: number[] = texts.flatMap((text: string, index: number) =>
+    text.startsWith('Executing a maximum of ') ? [index] : []
+  );
+  if (executingIndexes.length === 0) {
+    expect(texts.some((text: string) => text.startsWith('Selected '))).toBe(false);
+    return [];
+  }
+  expect(executingIndexes).toHaveLength(1);
+  const selectedIndex: number = texts.findIndex((text: string) => text.startsWith('Selected '));
+  return texts.slice(selectedIndex === -1 ? executingIndexes[0] : selectedIndex, executingIndexes[0] + 1);
+}
+
 function getWrittenOperationIds(client: TestPhasedRequestClient): ReadonlySet<string> {
   const operationIdSet: Set<string> = new Set();
   for (const write of client.writes) {
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
index e5422427b6..22248f7198 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
@@ -33,4 +33,66 @@ describe(PhasedRequestEventMultiplexer.name, () => {
       'request-completed'
     ]);
   });
+
+  describe('when an iteration starts', () => {
+    const records: IOperationExecutionResult[] = [
+      { operation: { name: 'beta' }, silent: false },
+      { operation: { name: 'alpha' }, silent: false },
+      { operation: { name: 'quiet' }, silent: true }
+    ] as unknown as IOperationExecutionResult[];
+
+    function createRequestSink(
+      announcements: unknown[]
+    ): _IOperationGraphEventSink & { onIterationScheduled(): void } {
+      return {
+        onIterationScheduled: () => {},
+        onIterationStarting: (...args: unknown[]) => announcements.push(args)
+      };
+    }
+
+    it('lets each sink that announces it do so, and announces all operations as activity to any other sink', () => {
+      const workspaceActivity: string[] = [];
+      const requestActivity: string[] = [];
+      const announcements: unknown[] = [];
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer({
+        onActivity: (text: string) => workspaceActivity.push(text)
+      });
+      multiplexer.subscribe(createRequestSink(announcements));
+      multiplexer.subscribe({ onIterationScheduled: () => {} });
+      multiplexer.subscribe({
+        onIterationScheduled: () => {},
+        onActivity: (text: string) => requestActivity.push(text)
+      });
+
+      multiplexer.onIterationStarting(records, 4, false);
+
+      const allOperationsAnnouncement: string[] = [
+        'Selected 2 operations:',
+        '  alpha',
+        '  beta',
+        '',
+        'Executing a maximum of 2 simultaneous processes...'
+      ];
+      expect(workspaceActivity).toEqual(allOperationsAnnouncement);
+      expect(requestActivity).toEqual(allOperationsAnnouncement);
+      expect(announcements).toEqual([[records, 4, false]]);
+    });
+
+    it('forwards it to a workspace sink that announces iterations itself', () => {
+      const workspaceActivity: string[] = [];
+      const workspaceAnnouncements: unknown[] = [];
+      const announcements: unknown[] = [];
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer({
+        onActivity: (text: string) => workspaceActivity.push(text),
+        onIterationStarting: (...args: unknown[]) => workspaceAnnouncements.push(args)
+      });
+      multiplexer.subscribe(createRequestSink(announcements));
+
+      multiplexer.onIterationStarting(records, 1, true);
+
+      expect(workspaceActivity).toEqual([]);
+      expect(workspaceAnnouncements).toEqual([[records, 1, true]]);
+      expect(announcements).toEqual([[records, 1, true]]);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
index 55bef9d4bd..f5cb0453ea 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
@@ -253,3 +253,85 @@ describe('the early failure offer', () => {
     expect(onSettled).not.toHaveBeenCalled();
   });
 });
+
+describe('the iteration announcement', () => {
+  async function getActivityTextsAsync(
+    client: TestPhasedRequestClient,
+    sink: PhasedRequestEventSink
+  ): Promise<string[]> {
+    await sink.flushAsync();
+    return client.writes.flatMap(({ event }) =>
+      event?.type === 'activityChanged' ? [(event.payload as { text: string }).text] : []
+    );
+  }
+
+  function createAnnouncingSink(client: TestPhasedRequestClient): PhasedRequestEventSink {
+    return new PhasedRequestEventSink({
+      activeOperationIds: new Set([ACTIVE_OPERATION, SECOND_ACTIVE_OPERATION]),
+      client,
+      getNextSequence: () => client.getNextEventSequence(),
+      onWriteFailure: () => undefined,
+      rushVersion: '5.178.1'
+    });
+  }
+
+  it("lists only the client's own operations that are not silent, and caps the processes at their count", async () => {
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+    const sink: PhasedRequestEventSink = createAnnouncingSink(client);
+
+    sink.onIterationStarting(
+      [
+        createRecord(OTHER_OPERATION, OperationStatus.Ready),
+        createRecord(ACTIVE_OPERATION, OperationStatus.Ready),
+        { ...createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Ready), silent: true }
+      ] as IOperationExecutionResult[],
+      8,
+      false
+    );
+
+    expect(await getActivityTextsAsync(client, sink)).toEqual([
+      'Selected 1 operation:',
+      `  ${ACTIVE_OPERATION}`,
+      '',
+      'Executing a maximum of 1 simultaneous processes...'
+    ]);
+  });
+
+  it('caps the processes at the parallelism and omits the listing in quiet mode', async () => {
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+    const sink: PhasedRequestEventSink = createAnnouncingSink(client);
+
+    sink.onIterationStarting(
+      [
+        createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Ready),
+        createRecord(OTHER_OPERATION, OperationStatus.Ready),
+        createRecord(ACTIVE_OPERATION, OperationStatus.Ready)
+      ],
+      1,
+      true
+    );
+
+    expect(await getActivityTextsAsync(client, sink)).toEqual([
+      'Executing a maximum of 1 simultaneous processes...'
+    ]);
+  });
+
+  it.each([false, true])(
+    'announces nothing when the client has nothing to run in the iteration (quiet mode: %s)',
+    async (quietMode: boolean) => {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const sink: PhasedRequestEventSink = createAnnouncingSink(client);
+
+      sink.onIterationStarting(
+        [
+          createRecord(OTHER_OPERATION, OperationStatus.Ready),
+          { ...createRecord(ACTIVE_OPERATION, OperationStatus.Ready), silent: true }
+        ] as IOperationExecutionResult[],
+        8,
+        quietMode
+      );
+
+      expect(await getActivityTextsAsync(client, sink)).toEqual([]);
+    }
+  );
+});
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index b4c6b9cde6..e32fdf5bb4 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -250,10 +250,11 @@ export type {
   IOperationGraphIterationOptions,
   IOperationGraphRequestResult
 } from './logic/operations/IOperationGraph';
-export type {
-  IOperationChildProcessReporter as _IOperationChildProcessReporter,
-  IOperationGraphEventSink as _IOperationGraphEventSink,
-  IOperationActivityOptions as _IOperationActivityOptions
+export {
+  type IOperationChildProcessReporter as _IOperationChildProcessReporter,
+  type IOperationGraphEventSink as _IOperationGraphEventSink,
+  type IOperationActivityOptions as _IOperationActivityOptions,
+  _formatIterationStartLines
 } from './logic/operations/OperationEventSink';
 export { OperationGraphHooks } from './pluginFramework/OperationGraphHooks';
 
diff --git a/libraries/rush-lib/src/logic/operations/OperationEventSink.ts b/libraries/rush-lib/src/logic/operations/OperationEventSink.ts
index d734f764e3..b94756ea7a 100644
--- a/libraries/rush-lib/src/logic/operations/OperationEventSink.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationEventSink.ts
@@ -110,6 +110,26 @@ export interface IOperationGraphEventSink {
    */
   onActivity?(text: string, options?: IOperationActivityOptions): void;
 
+  /**
+   * Invoked once when an iteration starts executing, before any of its operations start.
+   *
+   * @remarks
+   * The engine announces an iteration with a `Selected N operations:` listing, which quiet mode omits,
+   * and an `Executing a maximum of N simultaneous processes...` line. A sink that does not implement
+   * this method receives those lines through `onActivity`. A sink that implements it receives them only
+   * through this call, so that a host serving several requests from one iteration can announce each
+   * request's own operations with `_formatIterationStartLines`.
+   *
+   * @param records - Every operation of the iteration, including silent ones.
+   * @param parallelism - The graph's parallelism for the iteration.
+   * @param quietMode - Whether the graph is in quiet mode.
+   */
+  onIterationStarting?(
+    records: ReadonlyArray<IOperationExecutionResult>,
+    parallelism: number,
+    quietMode: boolean
+  ): void;
+
   /**
    * Allocates a reporter channel for a child spawned by the specified operation.
    */
@@ -118,3 +138,35 @@ export interface IOperationGraphEventSink {
     iterationId: number
   ): IOperationChildProcessReporter | undefined;
 }
+
+/**
+ * Renders the lines that announce an iteration: the `Selected N operations:` listing, unless `quietMode`
+ * is set, followed by the `Executing a maximum of N simultaneous processes...` line.
+ *
+ * @param operationNames - The names of the operations to announce, which should not be silent, in any order.
+ * @param parallelism - The graph's parallelism.
+ * @param quietMode - Whether the graph is in quiet mode.
+ * @returns The plain text of each line, in order.
+ *
+ * @internal
+ */
+export function _formatIterationStartLines(
+  operationNames: Iterable<string>,
+  parallelism: number,
+  quietMode: boolean
+): string[] {
+  const sortedNames: string[] = Array.from(operationNames).sort();
+  const lines: string[] = [];
+  if (!quietMode) {
+    const plural: string = sortedNames.length === 1 ? '' : 's';
+    lines.push(`Selected ${sortedNames.length} operation${plural}:`);
+    for (const name of sortedNames) {
+      lines.push(`  ${name}`);
+    }
+    lines.push('');
+  }
+  // For logging purposes, don't confuse the user by suggesting we might run more operations in parallel than are scheduled.
+  const maxSimultaneousProcesses: number = Math.min(sortedNames.length, parallelism);
+  lines.push(`Executing a maximum of ${maxSimultaneousProcesses} simultaneous processes...`);
+  return lines;
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index a7ff3bce47..93ce469aba 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -15,7 +15,7 @@ import { NewlineKind, Async, InternalError, AlreadyReportedError } from '@rushst
 import { AsyncOperationQueue, type IOperationSortFunction } from './AsyncOperationQueue';
 import type { Operation } from './Operation';
 import { OperationStatus, SUCCESS_STATUSES, TERMINAL_STATUSES } from './OperationStatus';
-import type { IOperationGraphEventSink } from './OperationEventSink';
+import { _formatIterationStartLines, type IOperationGraphEventSink } from './OperationEventSink';
 import {
   type IOperationExecutionContext,
   type IOperationExecutionRecordContext,
@@ -905,7 +905,7 @@ export class OperationGraph implements IOperationGraph {
     const { hooks } = this;
     const graph: OperationGraph = this;
 
-    const { abortController, records: executionRecords, terminal, totalOperations } = iterationContext;
+    const { abortController, records: executionRecords, terminal } = iterationContext;
 
     const isInitial: boolean = this.resultByOperation.size === 0;
 
@@ -958,31 +958,24 @@ export class OperationGraph implements IOperationGraph {
     };
 
     const { eventSink } = this;
-    if (!this.quietMode) {
-      const plural: string = totalOperations === 1 ? '' : 's';
-      const selectedLine: string = `Selected ${totalOperations} operation${plural}:`;
-      terminal.writeStdoutLine(selectedLine);
-      eventSink?.onActivity?.(selectedLine);
-      const nonSilentOperations: string[] = [];
-      for (const record of executionRecords.values()) {
-        if (!record.silent) {
-          nonSilentOperations.push(record.name);
-        }
+    const { parallelism, quietMode } = this;
+    const nonSilentOperations: string[] = [];
+    for (const record of executionRecords.values()) {
+      if (!record.silent) {
+        nonSilentOperations.push(record.name);
       }
-      nonSilentOperations.sort();
-      for (const name of nonSilentOperations) {
-        terminal.writeStdoutLine(`  ${name}`);
-        eventSink?.onActivity?.(`  ${name}`);
+    }
+    // A sink that announces the iteration itself does not also receive the announcement as activity.
+    const sinkAnnouncesIteration: boolean = eventSink?.onIterationStarting !== undefined;
+    for (const line of _formatIterationStartLines(nonSilentOperations, parallelism, quietMode)) {
+      terminal.writeStdoutLine(line);
+      if (!sinkAnnouncesIteration) {
+        eventSink?.onActivity?.(line);
       }
-      terminal.writeStdoutLine('');
-      eventSink?.onActivity?.('');
     }
-
-    const maxSimultaneousProcesses: number = Math.min(totalOperations, this.parallelism);
-    // For logging purposes, don't confuse the user by suggesting we might run more operations in parallel than are scheduled.
-    const parallelismLine: string = `Executing a maximum of ${maxSimultaneousProcesses} simultaneous processes...`;
-    terminal.writeStdoutLine(parallelismLine);
-    eventSink?.onActivity?.(parallelismLine);
+    if (eventSink?.onIterationStarting) {
+      eventSink.onIterationStarting([...executionRecords.values()], parallelism, quietMode);
+    }
 
     let bailStatus: OperationStatus | undefined | void;
     try {
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts
index b43da0d743..3d94677896 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphEventSink.test.ts
@@ -46,7 +46,7 @@ import type { CollatedTerminal } from '@rushstack/stream-collator';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
-import type { IOperationGraphEventSink } from '../OperationEventSink';
+import { _formatIterationStartLines, type IOperationGraphEventSink } from '../OperationEventSink';
 import type { IOperationExecutionResult } from '../IOperationExecutionResult';
 import { OperationGraph, type IOperationGraphOptions } from '../OperationGraph';
 import { OperationStatus } from '../OperationStatus';
@@ -326,6 +326,93 @@ describe('OperationGraph event sink (dual-emit)', () => {
     expect(tappedWritable.chunks).toEqual(plainWritable.chunks);
   });
 
+  it('announces an iteration only through onIterationStarting to a sink that implements it', async () => {
+    class AnnouncingSink extends RecordingSink {
+      public readonly announcements: [string[], number, boolean][] = [];
+      public onIterationStarting(
+        records: ReadonlyArray<IOperationExecutionResult>,
+        parallelism: number,
+        quietMode: boolean
+      ): void {
+        const names: string[] = records.map(
+          (record: IOperationExecutionResult) => `${record.operation.name}${record.silent ? ' (silent)' : ''}`
+        );
+        this.announcements.push([names.sort(), parallelism, quietMode]);
+      }
+    }
+    const silentRunner: IOperationRunner = {
+      name: 'gamma',
+      reportTiming: false,
+      silent: true,
+      cacheable: false,
+      warningsAreAllowed: false,
+      isNoOp: false,
+      executeAsync: async () => OperationStatus.Success,
+      getConfigHash: () => 'gamma'
+    };
+    const createOperations: () => Set<Operation> = () =>
+      new Set([
+        createOperation('beta', new MockOperationRunner('beta', async () => OperationStatus.Success)),
+        createOperation('alpha', new MockOperationRunner('alpha', async () => OperationStatus.Success)),
+        createOperation('gamma', silentRunner)
+      ]);
+    const plainWritable: MockWritable = new MockWritable();
+    await new OperationGraph(createOperations(), {
+      ...createGraphOptions(plainWritable, false),
+      parallelism: 4,
+      maxParallelism: 8
+    }).executeAsync({});
+    const sink: AnnouncingSink = new AnnouncingSink();
+    const graph: OperationGraph = new OperationGraph(createOperations(), {
+      ...createGraphOptions(mockWritable, false),
+      parallelism: 4,
+      maxParallelism: 8
+    });
+    graph.eventSink = sink;
+
+    await graph.executeAsync({});
+
+    expect(sink.announcements).toEqual([[['alpha', 'beta', 'gamma (silent)'], 4, false]]);
+    expect(sink.activities.some((line: string) => line.startsWith('Selected '))).toBe(false);
+    expect(sink.activities).not.toContain('  alpha');
+    expect(sink.activities.some((line: string) => line.includes('simultaneous processes'))).toBe(false);
+    expect(sink.activities.some((line: string) => line.includes('"alpha" completed successfully'))).toBe(
+      true
+    );
+    // The terminal still announces the iteration, byte for byte as it does without a sink.
+    expect(mockWritable.getAllOutput()).toContain(
+      'Selected 2 operations:\n  alpha\n  beta\n\nExecuting a maximum of 2 simultaneous processes...\n'
+    );
+    expect(mockWritable.chunks).toEqual(plainWritable.chunks);
+  });
+
+  it('passes quiet mode and the current parallelism to onIterationStarting', async () => {
+    const announcements: [number, boolean][] = [];
+    const sink: RecordingSink & IOperationGraphEventSink = Object.assign(new RecordingSink(), {
+      onIterationStarting: (
+        records: ReadonlyArray<IOperationExecutionResult>,
+        parallelism: number,
+        quietMode: boolean
+      ) => {
+        announcements.push([parallelism, quietMode]);
+      }
+    });
+    const graph: OperationGraph = new OperationGraph(
+      new Set([
+        createOperation('alpha', new MockOperationRunner('alpha', async () => OperationStatus.Success))
+      ]),
+      { ...createGraphOptions(mockWritable, true), maxParallelism: 8 }
+    );
+    graph.eventSink = sink;
+    graph.parallelism = 3;
+
+    await graph.executeAsync({});
+
+    expect(announcements).toEqual([[3, true]]);
+    expect(sink.activities.some((line: string) => line.includes('simultaneous processes'))).toBe(false);
+    expect(mockWritable.getAllOutput()).toContain('Executing a maximum of 1 simultaneous processes...');
+  });
+
   it('emits phase-aware status and diagnostic events without routing operation chunks', async () => {
     const reporterSink: CapturingReporterSink = new CapturingReporterSink();
     const rushSession: RushSession = new RushSession({
@@ -1122,3 +1209,34 @@ describe('OperationGraph event sink (dual-emit)', () => {
     expect(reporterSink.inputs.some(({ type }) => type === 'externalOutput')).toBe(false);
   });
 });
+
+describe(_formatIterationStartLines.name, () => {
+  it('lists the operations in order, then caps the simultaneous processes at their count', () => {
+    expect(_formatIterationStartLines(['beta', 'alpha', 'gamma'], 8, false)).toEqual([
+      'Selected 3 operations:',
+      '  alpha',
+      '  beta',
+      '  gamma',
+      '',
+      'Executing a maximum of 3 simultaneous processes...'
+    ]);
+  });
+
+  it('uses the singular for one operation and caps the simultaneous processes at the parallelism', () => {
+    expect(_formatIterationStartLines(['alpha'], 4, false)).toEqual([
+      'Selected 1 operation:',
+      '  alpha',
+      '',
+      'Executing a maximum of 1 simultaneous processes...'
+    ]);
+    expect(_formatIterationStartLines(new Set(['alpha', 'beta', 'gamma']), 2, false).slice(-1)).toEqual([
+      'Executing a maximum of 2 simultaneous processes...'
+    ]);
+  });
+
+  it('omits the listing in quiet mode', () => {
+    expect(_formatIterationStartLines(['beta', 'alpha'], 8, true)).toEqual([
+      'Executing a maximum of 2 simultaneous processes...'
+    ]);
+  });
+});

From 919fb7aedc0623339ad44201d6c2bd64a4c23ca8 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 166/265] [rush-lib] Stop a CLI command whose output reader
 exits, and exit 141

Swarm integration step 151; original commit 6fc577a590 (merge of swarm/o05-t254-int at 64768d793c).
Scope: task 254.

Brings 254-int (branch swarm/o05-t254-int). Second agent: t05 board 5108. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 16 of 19. Gate: ch01 GATE OK board 5319 (tree d7a605e510)

Commits folded into this step (1):
- d4926f9bc2 [rush-lib] Stop a CLI command whose output reader exits, and exit 141

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...closed-output-reader_2026-09-29-11-50.json |  11 +
 libraries/rush-lib/src/api/Rush.ts            |   6 +-
 .../rush-lib/src/cli/RushCommandLineParser.ts |  15 ++
 .../cli/scriptActions/PhasedScriptAction.ts   |  51 ++++
 .../src/cli/test/ClosedOutputReader.test.ts   | 239 ++++++++++++++++++
 .../src/utilities/StandardOutputClosure.ts    | 162 ++++++++++++
 .../test/StandardOutputClosure.test.ts        | 131 ++++++++++
 7 files changed, 614 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@microsoft/rush/closed-output-reader_2026-09-29-11-50.json
 create mode 100644 libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts
 create mode 100644 libraries/rush-lib/src/utilities/StandardOutputClosure.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts

diff --git a/common/changes/@microsoft/rush/closed-output-reader_2026-09-29-11-50.json b/common/changes/@microsoft/rush/closed-output-reader_2026-09-29-11-50.json
new file mode 100644
index 0000000000..03bdf08fcc
--- /dev/null
+++ b/common/changes/@microsoft/rush/closed-output-reader_2026-09-29-11-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When the process reading Rush's output exits early, as `head` does in `rush build | head -5`, Rush no longer crashes with an EPIPE stack trace. A phased command starts no more operations, lets the ones already running finish, prints one line on stderr, and exits with code 141, as a shell reports for a command that SIGPIPE ended.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/api/Rush.ts b/libraries/rush-lib/src/api/Rush.ts
index 177116070e..af88e55cde 100644
--- a/libraries/rush-lib/src/api/Rush.ts
+++ b/libraries/rush-lib/src/api/Rush.ts
@@ -18,6 +18,7 @@ import type { IBuiltInPluginConfiguration } from '../pluginFramework/PluginLoade
 import type { IRushSessionReporterOptions } from '../pluginFramework/RushSession';
 import { RushPnpmCommandLine } from '../cli/RushPnpmCommandLine';
 import { measureAsyncFn } from '../utilities/performance';
+import { StandardOutputClosure } from '../utilities/StandardOutputClosure';
 
 interface IRushFrontendLaunchOptions extends ILaunchOptions {
   reporterCloseAsync?: () => Promise<void>;
@@ -96,6 +97,8 @@ export class Rush {
   public static launch(launcherVersion: string, options: ILaunchOptions): void {
     options = _normalizeLaunchOptions(options);
     const frontendOptions: IRushFrontendLaunchOptions = options;
+    // Before the banner, so that a reader that exits during it (`rush build | head -1`) cannot crash Rush either.
+    const standardOutputClosure: StandardOutputClosure = StandardOutputClosure.install();
 
     if (!options.reporter?.operationStreamEnabled && !RushCommandLineParser.shouldRestrictConsoleOutput()) {
       RushStartupBanner.logBanner(Rush.version, options.isManaged);
@@ -112,7 +115,8 @@ export class Rush {
       alreadyReportedNodeTooNewError: options.alreadyReportedNodeTooNewError,
       builtInPluginConfigurations: options.builtInPluginConfigurations,
       reporter: options.reporter,
-      reporterCloseAsync: frontendOptions.reporterCloseAsync
+      reporterCloseAsync: frontendOptions.reporterCloseAsync,
+      standardOutputClosure
     });
     // CommandLineParser.executeAsync() should never reject the promise
     // eslint-disable-next-line no-console
diff --git a/libraries/rush-lib/src/cli/RushCommandLineParser.ts b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
index 3f8f430391..edc6e2d64b 100644
--- a/libraries/rush-lib/src/cli/RushCommandLineParser.ts
+++ b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
@@ -75,6 +75,7 @@ import { getEngineJsonFileLoadCache, type JsonFileLoadCache } from '../utilities
 import { initializeDotEnv } from '../logic/dotenv';
 import { measureAsyncFn } from '../utilities/performance';
 import { waitForStreamsToFlushAsync } from '../utilities/streamUtilities';
+import type { StandardOutputClosure } from '../utilities/StandardOutputClosure';
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
 import {
   _correlateRushSessionError,
@@ -96,6 +97,11 @@ export interface IRushCommandLineParserOptions {
   builtInPluginConfigurations: IBuiltInPluginConfiguration[];
   reporter?: IRushSessionReporterOptions;
   reporterCloseAsync?: () => Promise<void>;
+  /**
+   * Reports that a reader of the process's stdout or stderr exited, for example `head` in `rush build | head -5`.
+   * Only the Rush CLI supplies it; see {@link RushCommandLineParser.standardOutputClosure}.
+   */
+  standardOutputClosure?: StandardOutputClosure;
   /** Parse native commands without executing CLI actions or initializing process-global state. */
   engine?: {
     rushConfiguration: RushConfiguration;
@@ -218,6 +224,14 @@ export class RushCommandLineParser extends CommandLineParser {
     return engine ? (engine.environment ?? process.env) : undefined;
   }
 
+  /**
+   * For the Rush CLI, reports that a reader of the process's stdout or stderr exited. A phased command then stops
+   * starting operations. Undefined for the automation API and for a parser that serves an engine host.
+   */
+  public get standardOutputClosure(): StandardOutputClosure | undefined {
+    return this.#rushOptions.engine ? undefined : this.#rushOptions.standardOutputClosure;
+  }
+
   public constructor(options?: Partial<IRushCommandLineParserOptions>) {
     super({
       toolFilename: 'rush',
@@ -521,6 +535,7 @@ export class RushCommandLineParser extends CommandLineParser {
       builtInPluginConfigurations: options.builtInPluginConfigurations || [],
       reporter: options.reporter,
       reporterCloseAsync: options.reporterCloseAsync,
+      standardOutputClosure: options.standardOutputClosure,
       engine: options.engine
     };
   }
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 6220442cb3..2e4dc9781e 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -88,6 +88,11 @@ import { TrimRushEnvironmentVariablesPlugin } from '../../logic/operations/TrimR
 import { DebugHashesPlugin } from '../../logic/operations/DebugHashesPlugin';
 import { measureAsyncFn, measureFn } from '../../utilities/performance';
 import { runDuringChecksAsync } from '../../utilities/runDuringChecksAsync';
+import {
+  formatClosedOutputNotice,
+  type IClosedStandardOutput,
+  type StandardOutputClosure
+} from '../../utilities/StandardOutputClosure';
 import { attachReporterOperationEventSink } from '../../logic/operations/ReporterOperationEventSink';
 import { _isRushSessionOperationStreamEnabled } from '../../pluginFramework/RushSession';
 
@@ -826,6 +831,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     const generateFullGraph: boolean = !!onEngine || (isWatch && this.#includeAllProjectsInWatchGraph);
     let transferredEngine: boolean = false;
     let ownedGraph: OperationGraph | undefined;
+    let stopOnClosedOutput: (() => void) | undefined;
 
     try {
       const projectSelection: Set<RushConfigurationProject> = await measureAsyncFn(
@@ -1158,6 +1164,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         terminal.writeLine(`Shutting down Rush...`);
         return await graph.abortCurrentIterationAsync();
       });
+      // After abortPromise listens, because a reader that already exited aborts the session at once.
+      stopOnClosedOutput = this.#stopOnClosedOutput(graph);
       attachReporterOperationEventSink(graph, this.rushSession, this.actionName, isWatch);
 
       const executeOptions: IExecuteOperationsOptions = {
@@ -1212,6 +1220,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         );
       }
     } finally {
+      // A reader that exits after the command's operations have settled cancels nothing; the exit code still says so.
+      stopOnClosedOutput?.();
       if (onEngine && !transferredEngine && ownedGraph) {
         await disposeEngineGraphAsync(ownedGraph, cobuildConfiguration);
       } else if (cobuildConfiguration && !transferredEngine) {
@@ -1220,6 +1230,47 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     }
   }
 
+  /**
+   * When the process reading the CLI's stdout or stderr exits, for example `head` in `rush build | head -5`, stops
+   * starting operations, as aborting the session does, and says so once on stderr. Operations that already started
+   * finish first: a native command does not start them in their own process groups, so it cannot stop their
+   * process trees. Returns a function that stops listening, or undefined when the parser does not report closures.
+   */
+  #stopOnClosedOutput(graph: OperationGraph): (() => void) | undefined {
+    const standardOutputClosure: StandardOutputClosure | undefined = this.parser.standardOutputClosure;
+    if (!standardOutputClosure) {
+      return undefined;
+    }
+
+    let closedOutput: IClosedStandardOutput | undefined;
+    let iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+    graph.hooks.beforeExecuteIterationAsync.tap(
+      { name: 'StandardOutputClosure', stage: -Infinity },
+      (records: ReadonlyMap<Operation, IOperationExecutionResult>): OperationStatus | undefined => {
+        iterationRecords = records;
+        // The reader exited before this iteration started, possibly while it was being scheduled: run nothing.
+        return closedOutput ? OperationStatus.Aborted : undefined;
+      }
+    );
+
+    return standardOutputClosure.onClosed((closed: IClosedStandardOutput) => {
+      if (closedOutput) {
+        return;
+      }
+      closedOutput = closed;
+      let operationsRunning: boolean = false;
+      for (const record of iterationRecords?.values() ?? []) {
+        if (record.status === OperationStatus.Executing) {
+          operationsRunning = true;
+          break;
+        }
+      }
+      // Directly to stderr: the terminal may write to the closed stdout, for example through a reporter.
+      process.stderr.write(formatClosedOutputNotice(this.actionName, closed, operationsRunning));
+      this.sessionAbortController.abort();
+    });
+  }
+
   /**
    * Runs a set of operations and reports the results.
    */
diff --git a/libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts b/libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts
new file mode 100644
index 0000000000..d350650a8c
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/ClosedOutputReader.test.ts
@@ -0,0 +1,239 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { execFileSync, spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { Rush } from '../../api/Rush';
+
+// These tests spawn the Rush CLI, which runs real operations.
+jest.setTimeout(60000);
+
+const START_PATH: string = path.resolve(__dirname, '../../../lib-commonjs/start.js');
+
+function writeFile(folder: string, name: string, text: string): void {
+  const filename: string = path.join(folder, name);
+  fs.mkdirSync(path.dirname(filename), { recursive: true });
+  fs.writeFileSync(filename, text);
+}
+
+/**
+ * A repo with projects `a` and `b`, where `b` depends on `a`. Operation `a` prints `tick-<n>` every 50 ms for about
+ * 2 s. Each operation appends its progress to `runs.txt` in the repo folder.
+ */
+function createRepo(): string {
+  const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-closed-output-'));
+  writeFile(
+    folder,
+    'rush.json',
+    JSON.stringify({
+      rushVersion: Rush.version,
+      npmVersion: '10.0.0',
+      projectFolderMinDepth: 1,
+      projects: ['a', 'b'].map((name) => ({ packageName: name, projectFolder: name }))
+    })
+  );
+  writeFile(folder, '.gitignore', 'common/temp/\n**/.rush/\n**/rush-logs/\nruns.txt\n');
+  writeFile(folder, 'common/temp/last-link.flag', '{}');
+  writeFile(folder, 'common/config/rush/npm-shrinkwrap.json', '{"lockfileVersion":3,"packages":{}}');
+  writeFile(
+    folder,
+    'common/config/rush/command-line.json',
+    JSON.stringify({
+      phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+      commands: [
+        {
+          commandKind: 'phased',
+          name: 'build',
+          phases: ['_phase:compile'],
+          enableParallelism: true,
+          incremental: true
+        }
+      ]
+    })
+  );
+  for (const name of ['a', 'b']) {
+    writeFile(
+      folder,
+      `${name}/package.json`,
+      JSON.stringify({
+        name,
+        version: '1.0.0',
+        scripts: { '_phase:compile': 'node build.cjs' },
+        dependencies: name === 'b' ? { a: '1.0.0' } : {}
+      })
+    );
+  }
+  writeFile(
+    folder,
+    'a/build.cjs',
+    "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a:start\\n');let n=0;" +
+      "const t=setInterval(()=>{console.log('tick-'+ ++n);if(n===40){clearInterval(t);" +
+      "fs.appendFileSync('../runs.txt','a:done\\n');}},50);"
+  );
+  writeFile(folder, 'b/build.cjs', "require('node:fs').appendFileSync('../runs.txt','b:start\\n');");
+  execFileSync('git', ['init', '--quiet'], { cwd: folder, stdio: 'pipe' });
+  execFileSync('git', ['add', '.'], { cwd: folder, stdio: 'pipe' });
+  execFileSync(
+    'git',
+    [
+      '-c',
+      'user.name=Rush test',
+      '-c',
+      'user.email=rush-test@example.com',
+      '-c',
+      'commit.gpgSign=false',
+      'commit',
+      '--quiet',
+      '-m',
+      'Initialize closed output fixture'
+    ],
+    { cwd: folder, stdio: 'pipe' }
+  );
+  return folder;
+}
+
+interface IRushProcess {
+  readonly child: ChildProcess;
+  readonly closed: Promise<unknown[]>;
+  /** Lines of stderr that mention a cancellation, a closed stream or a crash. */
+  readonly getReportLines: () => string[];
+  readonly getRuns: () => string | undefined;
+}
+
+function startRush(folder: string, closedStreams: 'none' | 'stdout' | 'both'): IRushProcess {
+  const environment: NodeJS.ProcessEnv = { ...process.env, RUSH_REPORTER: 'legacy' };
+  for (const name of ['CI', 'TF_BUILD', 'GITHUB_ACTIONS', 'RUSH_PARALLELISM', 'RUSH_DAEMON']) {
+    delete environment[name];
+  }
+  const child: ChildProcess = spawn(process.execPath, [START_PATH, 'build', '--to', 'b', '--verbose'], {
+    cwd: folder,
+    env: environment,
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+  const closed: Promise<unknown[]> = once(child, 'close');
+  let errors: string = '';
+  if (closedStreams === 'both') {
+    // The readers exit before Rush writes anything, as when `rush build 2>&1 | true` runs.
+    child.stdout!.destroy();
+    child.stderr!.destroy();
+  } else {
+    child.stderr!.on('data', (bytes: Buffer) => {
+      errors += bytes.toString();
+    });
+    if (closedStreams === 'stdout') {
+      child.stdout!.destroy();
+    } else {
+      child.stdout!.resume();
+    }
+  }
+  return {
+    child,
+    closed,
+    getReportLines: () =>
+      errors.split('\n').filter((line) => /cancel|EPIPE|ECONNRESET|Unhandled|Error/i.test(line)),
+    getRuns: () => {
+      const filename: string = path.join(folder, 'runs.txt');
+      return fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8') : undefined;
+    }
+  };
+}
+
+describe('The Rush CLI with a stdout reader that exits', () => {
+  const folders: string[] = [];
+  const children: ChildProcess[] = [];
+
+  function track(rush: IRushProcess): IRushProcess {
+    children.push(rush.child);
+    return rush;
+  }
+
+  function createTrackedRepo(): string {
+    const folder: string = createRepo();
+    folders.push(folder);
+    return folder;
+  }
+
+  afterEach(async () => {
+    for (const child of children.splice(0)) {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill('SIGTERM');
+        await once(child, 'close');
+      }
+    }
+    for (const folder of folders.splice(0)) {
+      fs.rmSync(folder, { recursive: true, force: true });
+    }
+  });
+
+  it('stops starting operations, lets the running one finish, and exits with 141', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'none'));
+    const { child } = rush;
+    // Stops reading at the operation's first line, as `grep -m1 tick-` would.
+    let output: string = '';
+    await new Promise<void>((resolve, reject) => {
+      child.stdout!.on('data', (bytes: Buffer) => {
+        output += bytes.toString();
+        if (output.includes('tick-')) {
+          child.stdout!.destroy();
+          resolve();
+        }
+      });
+      rush.closed.then(
+        () => reject(new Error(`The build ended before its output arrived: ${output}`)),
+        reject
+      );
+    });
+
+    expect(await rush.closed).toEqual([141, null]);
+    // A socket (here) may report ECONNRESET where a shell's pipe reports EPIPE.
+    expect(rush.getReportLines()).toEqual([
+      expect.stringMatching(
+        /^rush: build cancelled, because the process reading its stdout exited \((EPIPE|ECONNRESET)\)\. Operations that already started will finish first\.$/
+      )
+    ]);
+    // "a" finished before Rush exited, and "b" never started.
+    expect(rush.getRuns()).toBe('a:start\na:done\n');
+
+    // The cancelled build left nothing behind that stops the next one from building "b".
+    fs.rmSync(path.join(folder, 'runs.txt'));
+    const next: IRushProcess = track(startRush(folder, 'none'));
+    expect(await next.closed).toEqual([0, null]);
+    expect(next.getReportLines()).toEqual([]);
+    expect(next.getRuns()).toMatch(/(^|\n)b:start\n$/);
+  });
+
+  it('runs no operation when the reader exits before the build starts, and exits with 141', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'stdout'));
+
+    expect(await rush.closed).toEqual([141, null]);
+    expect(rush.getReportLines()).toEqual([
+      expect.stringMatching(
+        /^rush: build cancelled, because the process reading its stdout exited \((EPIPE|ECONNRESET)\)\.$/
+      )
+    ]);
+    expect(rush.getRuns()).toBeUndefined();
+  });
+
+  it('exits with 141 when the readers of both stdout and stderr exit', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'both'));
+
+    expect(await rush.closed).toEqual([141, null]);
+    expect(rush.getRuns()).toBeUndefined();
+  });
+
+  it('runs the whole build when the reader keeps reading, as `| cat` does', async () => {
+    const folder: string = createTrackedRepo();
+    const rush: IRushProcess = track(startRush(folder, 'none'));
+
+    expect(await rush.closed).toEqual([0, null]);
+    expect(rush.getReportLines()).toEqual([]);
+    expect(rush.getRuns()).toBe('a:start\na:done\nb:start\n');
+  });
+});
diff --git a/libraries/rush-lib/src/utilities/StandardOutputClosure.ts b/libraries/rush-lib/src/utilities/StandardOutputClosure.ts
new file mode 100644
index 0000000000..23171aa307
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/StandardOutputClosure.ts
@@ -0,0 +1,162 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as os from 'node:os';
+
+/**
+ * The exit code of a command that stopped because the process reading its output exited: 128 + SIGPIPE, which a
+ * shell reports for a writer that SIGPIPE ended, as in `make | head`. Windows has no SIGPIPE; the code is the same.
+ */
+export const CLOSED_OUTPUT_EXIT_CODE: number = 128 + (os.constants.signals.SIGPIPE ?? 13);
+
+export type StandardOutputStreamName = 'stdout' | 'stderr';
+
+/**
+ * A standard output stream whose reader exited.
+ */
+export interface IClosedStandardOutput {
+  readonly streamName: StandardOutputStreamName;
+  /** The code of the error that showed it: EPIPE for a pipe, or ECONNRESET for a socket. */
+  readonly code: string;
+}
+
+/**
+ * The part of a stream that {@link StandardOutputClosure} uses.
+ */
+export interface IStandardOutputClosureStream {
+  on(event: 'error', listener: (error: Error) => void): unknown;
+  listenerCount(event: 'error'): number;
+}
+
+/**
+ * The part of `process` that {@link StandardOutputClosure} uses.
+ */
+export interface IStandardOutputClosureProcess {
+  readonly stdout: IStandardOutputClosureStream;
+  readonly stderr: IStandardOutputClosureStream;
+  exitCode?: number | string | undefined;
+  on(event: 'exit', listener: () => void): unknown;
+  on(event: 'uncaughtExceptionMonitor', listener: () => void): unknown;
+}
+
+/**
+ * Returns the error code when a write failed because nothing reads the stream any more, for example after
+ * `| head` exits: EPIPE for a pipe, or ECONNRESET for a socket.
+ */
+export function getClosedOutputCode(error: unknown): string | undefined {
+  const code: unknown =
+    typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
+  return code === 'EPIPE' || code === 'ECONNRESET' ? code : undefined;
+}
+
+/**
+ * Formats the stderr line of a command that stops because the process reading its output exited, for example
+ * `rush: build cancelled, because the process reading its stdout exited (EPIPE).`
+ */
+export function formatClosedOutputNotice(
+  commandName: string,
+  closed: IClosedStandardOutput,
+  operationsRunning: boolean
+): string {
+  const notice: string = `rush: ${commandName} cancelled, because the process reading its ${closed.streamName} exited (${closed.code}).`;
+  return operationsRunning ? `${notice} Operations that already started will finish first.\n` : `${notice}\n`;
+}
+
+const installedClosures: WeakMap<IStandardOutputClosureProcess, StandardOutputClosure> = new WeakMap();
+
+/**
+ * Keeps a reader of the Rush CLI's stdout or stderr that exits early, for example `head` in
+ * `rush build | head -5`, from failing the process.
+ *
+ * @remarks
+ * Node.js ignores SIGPIPE, so each write to a stream whose reader exited fails with EPIPE, and the stream emits the
+ * error as an 'error' event. With no listener, that event ends the process with a stack trace and exit code 1. Once
+ * this class is installed, those errors are expected: the first one on each stream is recorded and reported to the
+ * {@link StandardOutputClosure.onClosed} listeners, and later ones are ignored. The process then exits with code
+ * 141, as a shell reports for a writer that SIGPIPE ended, unless it crashes with an uncaught exception or an
+ * unhandled rejection. Any other stream error still fails the process.
+ *
+ * Only the Rush CLI (`Rush.launch`) installs it. The automation API and the daemon's engine leave the process's
+ * streams to their host.
+ */
+export class StandardOutputClosure {
+  readonly #target: IStandardOutputClosureProcess;
+  readonly #closed: IClosedStandardOutput[] = [];
+  readonly #listeners: Set<(closed: IClosedStandardOutput) => void> = new Set();
+
+  private constructor(target: IStandardOutputClosureProcess) {
+    this.#target = target;
+  }
+
+  /**
+   * Installs the listeners on `target`'s stdout and stderr and its 'exit' and 'uncaughtExceptionMonitor' events,
+   * once for each target.
+   */
+  public static install(target: IStandardOutputClosureProcess = process): StandardOutputClosure {
+    let closure: StandardOutputClosure | undefined = installedClosures.get(target);
+    if (!closure) {
+      const installed: StandardOutputClosure = new StandardOutputClosure(target);
+      closure = installed;
+      installedClosures.set(target, installed);
+      installed.#guard('stdout', target.stdout);
+      installed.#guard('stderr', target.stderr);
+      let crashed: boolean = false;
+      target.on('uncaughtExceptionMonitor', () => {
+        crashed = true;
+      });
+      target.on('exit', () => {
+        // Node.js reads exitCode again after the 'exit' listeners, including after process.exit(code). A crash keeps
+        // the exit code that Node.js gives it, so that it doesn't look like a reader that exited.
+        if (installed.#closed.length && !crashed) {
+          target.exitCode = CLOSED_OUTPUT_EXIT_CODE;
+        }
+      });
+    }
+    return closure;
+  }
+
+  /**
+   * The first stream whose reader exited, if one has.
+   */
+  public get firstClosed(): IClosedStandardOutput | undefined {
+    return this.#closed[0];
+  }
+
+  /**
+   * Calls `listener` for each stream whose reader exits, and at once for each one whose reader already has.
+   * Returns a function that removes the listener.
+   */
+  public onClosed(listener: (closed: IClosedStandardOutput) => void): () => void {
+    this.#listeners.add(listener);
+    for (const closed of [...this.#closed]) {
+      if (this.#listeners.has(listener)) {
+        listener(closed);
+      }
+    }
+    return () => {
+      this.#listeners.delete(listener);
+    };
+  }
+
+  #guard(streamName: StandardOutputStreamName, stream: IStandardOutputClosureStream): void {
+    stream.on('error', (error: Error) => {
+      const code: string | undefined = getClosedOutputCode(error);
+      if (code === undefined) {
+        if (stream.listenerCount('error') === 1) {
+          // No one else handles this error, so it fails the process, as it would without this listener.
+          throw error;
+        }
+        return;
+      }
+      if (this.#closed.some((closed: IClosedStandardOutput) => closed.streamName === streamName)) {
+        return;
+      }
+      const closed: IClosedStandardOutput = { streamName, code };
+      this.#closed.push(closed);
+      this.#target.exitCode = CLOSED_OUTPUT_EXIT_CODE;
+      for (const listener of [...this.#listeners]) {
+        listener(closed);
+      }
+    });
+  }
+}
diff --git a/libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts b/libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts
new file mode 100644
index 0000000000..5484d83667
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/StandardOutputClosure.test.ts
@@ -0,0 +1,131 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { EventEmitter } from 'node:events';
+
+import {
+  CLOSED_OUTPUT_EXIT_CODE,
+  formatClosedOutputNotice,
+  type IClosedStandardOutput,
+  type IStandardOutputClosureProcess,
+  StandardOutputClosure
+} from '../StandardOutputClosure';
+
+class FakeProcess extends EventEmitter implements IStandardOutputClosureProcess {
+  public readonly stdout: EventEmitter = new EventEmitter();
+  public readonly stderr: EventEmitter = new EventEmitter();
+  public exitCode: number | string | undefined = undefined;
+
+  /** Mirrors process.exit(): Node.js reads exitCode again after the 'exit' listeners. */
+  public exit(code: number): number | string | undefined {
+    this.exitCode = code;
+    this.emit('exit', code);
+    return this.exitCode;
+  }
+}
+
+function createError(code: string): NodeJS.ErrnoException {
+  const error: NodeJS.ErrnoException = new Error(`write ${code}`);
+  error.code = code;
+  return error;
+}
+
+describe(StandardOutputClosure.name, () => {
+  it('records the first EPIPE of each stream once and exits with 141', () => {
+    const target: FakeProcess = new FakeProcess();
+    const closure: StandardOutputClosure = StandardOutputClosure.install(target);
+    const closures: IClosedStandardOutput[] = [];
+    closure.onClosed((closed: IClosedStandardOutput) => closures.push(closed));
+
+    expect(closure.firstClosed).toBeUndefined();
+    target.stdout.emit('error', createError('EPIPE'));
+    target.stdout.emit('error', createError('EPIPE'));
+    target.stderr.emit('error', createError('ECONNRESET'));
+
+    expect(closures).toEqual([
+      { streamName: 'stdout', code: 'EPIPE' },
+      { streamName: 'stderr', code: 'ECONNRESET' }
+    ]);
+    expect(closure.firstClosed).toEqual({ streamName: 'stdout', code: 'EPIPE' });
+    expect(target.exitCode).toBe(CLOSED_OUTPUT_EXIT_CODE);
+    expect(CLOSED_OUTPUT_EXIT_CODE).toBe(141);
+  });
+
+  it('keeps exit code 141 when the process later exits with another code', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+    target.stdout.emit('error', createError('EPIPE'));
+    target.exitCode = 0;
+
+    expect(target.exit(1)).toBe(141);
+  });
+
+  it('keeps the exit code of a crash after a reader exited', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+    target.stdout.emit('error', createError('EPIPE'));
+    // Node.js emits this for an uncaught exception or an unhandled rejection, then exits with code 1.
+    target.emit('uncaughtExceptionMonitor', new Error('crash'), 'uncaughtException');
+
+    expect(target.exit(1)).toBe(1);
+  });
+
+  it('leaves the exit code alone when no reader exited', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+
+    expect(target.exit(1)).toBe(1);
+    expect(target.exit(0)).toBe(0);
+  });
+
+  it('tells a listener at once about a stream that closed before it subscribed, until it unsubscribes', () => {
+    const target: FakeProcess = new FakeProcess();
+    const closure: StandardOutputClosure = StandardOutputClosure.install(target);
+    target.stderr.emit('error', createError('EPIPE'));
+
+    const closures: IClosedStandardOutput[] = [];
+    const stop: () => void = closure.onClosed((closed: IClosedStandardOutput) => closures.push(closed));
+    expect(closures).toEqual([{ streamName: 'stderr', code: 'EPIPE' }]);
+
+    stop();
+    target.stdout.emit('error', createError('EPIPE'));
+    expect(closures).toHaveLength(1);
+  });
+
+  it('still fails the process for another stream error that nothing else handles', () => {
+    const target: FakeProcess = new FakeProcess();
+    StandardOutputClosure.install(target);
+    const error: NodeJS.ErrnoException = createError('EBADF');
+
+    expect(() => target.stdout.emit('error', error)).toThrow(error);
+    expect(target.exitCode).toBeUndefined();
+
+    const handled: Error[] = [];
+    target.stderr.on('error', (otherError: Error) => handled.push(otherError));
+    expect(() => target.stderr.emit('error', error)).not.toThrow();
+    expect(handled).toEqual([error]);
+  });
+
+  it('installs its listeners once for each process', () => {
+    const target: FakeProcess = new FakeProcess();
+    const closure: StandardOutputClosure = StandardOutputClosure.install(target);
+
+    expect(StandardOutputClosure.install(target)).toBe(closure);
+    expect(target.stdout.listenerCount('error')).toBe(1);
+    expect(target.stderr.listenerCount('error')).toBe(1);
+    expect(target.listenerCount('exit')).toBe(1);
+    expect(target.listenerCount('uncaughtExceptionMonitor')).toBe(1);
+  });
+});
+
+describe(formatClosedOutputNotice.name, () => {
+  it('names the command, the stream and the error code', () => {
+    expect(formatClosedOutputNotice('build', { streamName: 'stdout', code: 'EPIPE' }, false)).toBe(
+      'rush: build cancelled, because the process reading its stdout exited (EPIPE).\n'
+    );
+    expect(formatClosedOutputNotice('test', { streamName: 'stderr', code: 'ECONNRESET' }, true)).toBe(
+      'rush: test cancelled, because the process reading its stderr exited (ECONNRESET).' +
+        ' Operations that already started will finish first.\n'
+    );
+  });
+});

From 5bf3072a196198086131fe15a5c5a7e4f1ed0c2e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 167/265] [rush-daemon] Log the operations that a starting
 daemon stops as one rushd line (task 177 NIT 1) (and 2 more)

Swarm integration step 152; original commit af4a998c7d (merge of swarm/r06-t177-nit1-int5 at e9cc1320dc).
Scope: task 177.

Brings 177-nit1-int5 (branch swarm/r06-t177-nit1-int5). Second agent: t05 board 5206. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 17 of 19. Gate: ch01 GATE OK board 5319 (tree 60f4015fee)

Commits folded into this step (3):
- 4d151964c1 [rush-daemon] Log the operations that a starting daemon stops as one rushd line (task 177 NIT 1)
- 0d0b317967 [rush-daemon-transport] Test that the listener passes on only onOrphansReaped (task 177 NIT 1)
- 122c66881c [rush-daemon-transport] Pass the reclaim options in ListenerCloseFailure.test.ts (task 177 NIT 1 with task 197)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...listener-reap-report_2026-09-29-10-36.json |  11 ++
 ...6-t177-reap-log-line_2026-09-29-10-36.json |  11 ++
 .../reviews/api/rush-daemon-transport.api.md  |   2 +-
 libraries/rush-daemon-transport/README.md     |   5 +-
 .../src/DaemonListener.ts                     |   5 +-
 .../src/DaemonListenerBinding.ts              |  32 ++--
 .../src/DaemonSocketPublication.ts            |  19 ++-
 .../src/test/ListenerCloseFailure.test.ts     |   2 +-
 .../src/test/ListenerOrphanReap.test.ts       |  97 +++++++++++
 .../src/test/ListenerReclaimOptions.test.ts   |  51 ++++++
 libraries/rush-daemon/README.md               |   5 +
 .../rush-daemon/src/DaemonOrphanReapLog.ts    |  36 ++++
 libraries/rush-daemon/src/RushDaemonHost.ts   |   8 +-
 .../src/test/DaemonOrphanReapLog.test.ts      | 158 ++++++++++++++++++
 14 files changed, 418 insertions(+), 24 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r06-t177-listener-reap-report_2026-09-29-10-36.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t177-reap-log-line_2026-09-29-10-36.json
 create mode 100644 libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
 create mode 100644 libraries/rush-daemon/src/DaemonOrphanReapLog.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/r06-t177-listener-reap-report_2026-09-29-10-36.json b/common/changes/@rushstack/rush-daemon-transport/r06-t177-listener-reap-report_2026-09-29-10-36.json
new file mode 100644
index 0000000000..2e80d0fd44
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r06-t177-listener-reap-report_2026-09-29-10-36.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "`DaemonFrameListener.listenAsync()` now also takes `onOrphansReaped`. When binding reclaims a dead daemon's socket, the process groups that the reclaim stopped go to it instead of a `RUSH_DAEMON_ORPHANS_REAPED` process warning.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r06-t177-reap-log-line_2026-09-29-10-36.json b/common/changes/@rushstack/rush-daemon/r06-t177-reap-log-line_2026-09-29-10-36.json
new file mode 100644
index 0000000000..65d9079528
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t177-reap-log-line_2026-09-29-10-36.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a starting daemon stops the operations that an exited daemon left running, it now writes one `rushd:` line to the daemon log (`onLog`) for each set of process groups that it stopped, instead of a two-line `RUSH_DAEMON_ORPHANS_REAPED` Node.js warning.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index 6300d7a7e2..3729926e7d 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -78,7 +78,7 @@ export interface IDaemonConnectorOptions {
 }
 
 // @beta
-export interface IDaemonListenerOptions {
+export interface IDaemonListenerOptions extends IDaemonReclaimOptions {
     readonly onConnection: (connection: DaemonFrameConnection) => void;
     readonly protocolVersion: IDaemonProtocolVersion;
     readonly startedAt?: string;
diff --git a/libraries/rush-daemon-transport/README.md b/libraries/rush-daemon-transport/README.md
index 97b51ffaba..dd0d6f6b29 100644
--- a/libraries/rush-daemon-transport/README.md
+++ b/libraries/rush-daemon-transport/README.md
@@ -21,7 +21,10 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
   [`@rushstack/rush-daemon-protocol`](https://www.npmjs.com/package/@rushstack/rush-daemon-protocol),
   with backpressure-aware writes and serialized async frame handlers for inbound flow control.
 - **PID/lockfile handling** — stale sockets and dead PIDs are detected (two-factor: PID liveness
-  plus a connect probe) and reclaimed without manual cleanup.
+  plus a connect probe) and reclaimed without manual cleanup. On POSIX, a reclaim first stops the
+  operations that the dead daemon left running. Both `reclaimStaleDaemonAsync` and
+  `DaemonFrameListener.listenAsync` report each set of stopped process groups to `onOrphansReaped`,
+  or, without it, as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
 - **Two-phase shutdown** — `stopAcceptingAsync()` stops admission and waits for connections while
   retaining ownership. Hosts release the endpoint with `closeAsync()` after their resources have
   finished disposing. A live owner prevents rebinding even when its socket has already closed;
diff --git a/libraries/rush-daemon-transport/src/DaemonListener.ts b/libraries/rush-daemon-transport/src/DaemonListener.ts
index b08d638e48..ba6b598e74 100644
--- a/libraries/rush-daemon-transport/src/DaemonListener.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListener.ts
@@ -17,10 +17,11 @@ import { startOperationGroupRecording } from './DaemonOperationGroupRecorder';
 import { getOperationGroupsFolder } from './DaemonOperationGroups';
 import { assertDaemonOwnershipAvailable } from './DaemonOwnership';
 import type { IDaemonPaths } from './DaemonPaths';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
 import { ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 
 /** Options for {@link DaemonFrameListener.listenAsync}. @beta */
-export interface IDaemonListenerOptions {
+export interface IDaemonListenerOptions extends IDaemonReclaimOptions {
   /** The wire protocol version this daemon speaks (recorded in the lockfile). */
   readonly protocolVersion: IDaemonProtocolVersion;
   /** The ISO 8601 start time recorded in the lockfile. Defaults to now. */
@@ -53,7 +54,7 @@ export class DaemonFrameListener {
       options.onConnection(new DaemonFrameConnection(socket));
     });
     ensureDaemonRuntimeDir(paths);
-    const socket: IDaemonFileIdentity | undefined = await listenWithReclaimAsync(server, paths);
+    const socket: IDaemonFileIdentity | undefined = await listenWithReclaimAsync(server, paths, options);
     // Lockfile after bind: a pre-existing stale record must read as dead, not
     // as a live owner that would make reclaim refuse.
     let lockfile: IDaemonFileIdentity | undefined;
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
index a10afacb56..d0906d0da7 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
@@ -8,6 +8,7 @@ import { ADDRESS_IN_USE, listenOrErrorAsync, toListenTransportError } from './Da
 import type { INetError } from './DaemonListenerNet';
 import type { IDaemonPaths } from './DaemonPaths';
 import { reclaimStaleDaemonAsync } from './DaemonReclaim';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
 import { listenPublishedAsync } from './DaemonSocketPublication';
 
 const FIRST_ATTEMPT: number = 0;
@@ -15,21 +16,28 @@ const RECLAIM_ATTEMPT: number = 1;
 const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 
 /**
- * Binds the listener, reclaiming its path once from a dead daemon. Returns the identity of a POSIX socket;
- * a Windows named pipe has no file and disappears with its server.
+ * Binds the listener, reclaiming its path once from a dead daemon. Returns the identity of a POSIX socket; a
+ * Windows named pipe has no file and disappears with its server. Of the listener's options, only
+ * `onOrphansReaped` goes on to the reclaim, because the reaper also reads fields for tests from that object.
  */
 export async function listenWithReclaimAsync(
   server: net.Server,
-  paths: IDaemonPaths
+  paths: IDaemonPaths,
+  listenerOptions: IDaemonReclaimOptions
 ): Promise<IDaemonFileIdentity | undefined> {
-  if (process.platform !== WINDOWS_PLATFORM) return listenPublishedAsync(server, paths);
-  await listenPipeWithReclaimAsync(server, paths);
+  const options: IDaemonReclaimOptions = { onOrphansReaped: listenerOptions.onOrphansReaped };
+  if (process.platform !== WINDOWS_PLATFORM) return listenPublishedAsync(server, paths, options);
+  await listenPipeWithReclaimAsync(server, paths, options);
   return undefined;
 }
 
-async function listenPipeWithReclaimAsync(server: net.Server, paths: IDaemonPaths): Promise<void> {
+async function listenPipeWithReclaimAsync(
+  server: net.Server,
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions
+): Promise<void> {
   for (let attempt: number = FIRST_ATTEMPT; attempt <= RECLAIM_ATTEMPT; attempt++) {
-    const bound: boolean = await tryListenOnceAsync(server, paths, attempt);
+    const bound: boolean = await tryListenOnceAsync(server, paths, attempt, options);
     if (bound) {
       return;
     }
@@ -39,21 +47,23 @@ async function listenPipeWithReclaimAsync(server: net.Server, paths: IDaemonPath
 async function tryListenOnceAsync(
   server: net.Server,
   paths: IDaemonPaths,
-  attempt: number
+  attempt: number,
+  options: IDaemonReclaimOptions
 ): Promise<boolean> {
   const error: INetError | undefined = await listenOrErrorAsync(server, paths.socketPath);
-  return error ? recoverFromListenErrorAsync(error, paths, attempt) : true;
+  return error ? recoverFromListenErrorAsync(error, paths, attempt, options) : true;
 }
 
 async function recoverFromListenErrorAsync(
   error: INetError,
   paths: IDaemonPaths,
-  attempt: number
+  attempt: number,
+  options: IDaemonReclaimOptions
 ): Promise<boolean> {
   const canReclaim: boolean = error.code === ADDRESS_IN_USE && attempt === FIRST_ATTEMPT;
   if (!canReclaim) {
     throw toListenTransportError(error, paths.socketPath);
   }
-  await reclaimStaleDaemonAsync(paths);
+  await reclaimStaleDaemonAsync(paths, options);
   return false;
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
index e452bef2c8..b356712661 100644
--- a/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
+++ b/libraries/rush-daemon-transport/src/DaemonSocketPublication.ts
@@ -12,6 +12,7 @@ import { listenOrErrorAsync, toListenTransportError } from './DaemonListenerNet'
 import type { INetError } from './DaemonListenerNet';
 import type { IDaemonPaths } from './DaemonPaths';
 import { reclaimStaleDaemonAsync } from './DaemonReclaim';
+import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 import { unlinkIfPresent } from './DaemonUnlink';
 
@@ -50,12 +51,16 @@ function stillInUse(socketPath: string): DaemonTransportError {
   );
 }
 
-async function publishAsync(privatePath: string, paths: IDaemonPaths): Promise<IDaemonFileIdentity> {
+async function publishAsync(
+  privatePath: string,
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions
+): Promise<IDaemonFileIdentity> {
   fs.chmodSync(privatePath, SOCKET_MODE);
   const identity: IDaemonFileIdentity = getFileIdentity(privatePath);
   if (!tryLink(privatePath, paths.socketPath)) {
     // Reclaim a dead daemon's leftovers once (this throws while their owner lives), then try again.
-    await reclaimStaleDaemonAsync(paths);
+    await reclaimStaleDaemonAsync(paths, options);
     if (!tryLink(privatePath, paths.socketPath)) throw stillInUse(paths.socketPath);
   }
   return identity;
@@ -69,18 +74,20 @@ async function publishAsync(privatePath: string, paths: IDaemonPaths): Promise<I
  * name may by then belong to a successor (after someone deleted this daemon's socket and another daemon
  * started), so only the private name is ever bound, and it is deleted as soon as the socket is published.
  * Publishing uses link(2), which, unlike bind or rename, never replaces an existing name. The socket is made
- * owner-only before it is published. Returns the identity of the published socket; the listening socket keeps
- * its inode in use, so the identity needs no open descriptor.
+ * owner-only before it is published. A dead daemon's leftovers at that name are reclaimed once, with `options`.
+ * Returns the identity of the published socket; the listening socket keeps its inode in use, so the identity
+ * needs no open descriptor.
  */
 export async function listenPublishedAsync(
   server: net.Server,
-  paths: IDaemonPaths
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions
 ): Promise<IDaemonFileIdentity> {
   const privatePath: string = getPrivateSocketPath(paths.socketPath);
   const error: INetError | undefined = await listenOrErrorAsync(server, privatePath);
   if (error) throw toListenTransportError(error, privatePath);
   try {
-    return await publishAsync(privatePath, paths);
+    return await publishAsync(privatePath, paths, options);
   } catch (publishError) {
     await closeServerAsync(server);
     throw publishError;
diff --git a/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts b/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
index 406194dbac..aee4ee36f8 100644
--- a/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
+++ b/libraries/rush-daemon-transport/src/test/ListenerCloseFailure.test.ts
@@ -32,7 +32,7 @@ beforeEach(async () => {
   paths = createIsolatedTestDaemonPaths();
   ensureDaemonRuntimeDir(paths);
   server = net.createServer();
-  const socket: IDaemonFileIdentity = await listenPublishedAsync(server, paths);
+  const socket: IDaemonFileIdentity = await listenPublishedAsync(server, paths, {});
   fs.writeFileSync(paths.lockfilePath, LOCKFILE_CONTENT);
   lockfile = pinFileIdentity(paths.lockfilePath);
   stopRecording = jest.fn();
diff --git a/libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts b/libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts
new file mode 100644
index 0000000000..2f26e288ca
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerOrphanReap.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import type { IDaemonOrphanReap, IDaemonReclaimOptions } from '../DaemonReclaimOptions';
+
+import {
+  killFakeDaemonAsync,
+  startFakeDaemonAsync,
+  writeDeadOwnerLockfile
+} from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Above the worst case of a 5 s poll plus the reaper's SIGTERM and SIGKILL grace periods, so that a
+// regression fails an assertion instead of timing out.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+const STALE_SOCKET: string = 'stale';
+const WARNING_CODE: { code: string } = { code: 'RUSH_DAEMON_ORPHANS_REAPED' };
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  // A failed assertion must not leave this test's processes running.
+  killStillRunning(started);
+  started = [];
+  jest.restoreAllMocks();
+});
+
+/** Leaves what a SIGKILLed daemon leaves behind: its operations, its lockfile and its socket. */
+async function crashFakeDaemonAsync(paths: IDaemonPaths): Promise<IFakeDaemon> {
+  const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+  started = identifyStarted([Number(fake.daemon.pid), ...fake.pids]);
+  await killFakeDaemonAsync(fake);
+  writeDeadOwnerLockfile(paths, fake);
+  fs.writeFileSync(paths.socketPath, STALE_SOCKET);
+  return fake;
+}
+
+/** Binds a listener at the crashed daemon's socket path, which reclaims it, and closes the listener again. */
+async function listenOverCrashAsync(
+  paths: IDaemonPaths,
+  fake: IFakeDaemon,
+  options: IDaemonReclaimOptions
+): Promise<void> {
+  const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
+    ...options,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined
+  });
+  await listener.closeAsync();
+  expect(await waitUntilAsync(() => !fake.pids.some(isAlive))).toBe(true);
+}
+
+async function reportsReapsToListenerOptionAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await crashFakeDaemonAsync(paths);
+  const reaps: IDaemonOrphanReap[] = [];
+  await listenOverCrashAsync(paths, fake, { onOrphansReaped: (reap: IDaemonOrphanReap) => reaps.push(reap) });
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  expect(reaps).toEqual([
+    { daemonPid: Number(fake.daemon.pid), processGroupIds: expect.any(Array), outcome: 'terminated' }
+  ]);
+  const [{ processGroupIds }] = reaps;
+  expect(new Set(processGroupIds)).toEqual(new Set([waitingLeader, exitingLeader]));
+  expect(warning).not.toHaveBeenCalled();
+}
+
+linuxIt(
+  "reports the operations it stops while reclaiming a dead daemon's socket to onOrphansReaped",
+  reportsReapsToListenerOptionAsync,
+  REAP_TEST_TIMEOUT_MS
+);
+
+async function warnsWithoutListenerOptionAsync(): Promise<void> {
+  const warning: jest.SpyInstance = jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const fake: IFakeDaemon = await crashFakeDaemonAsync(paths);
+  await listenOverCrashAsync(paths, fake, {});
+  const [waitingLeader, , exitingLeader] = fake.pids;
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${waitingLeader}`), WARNING_CODE);
+  expect(warning).toHaveBeenCalledWith(expect.stringContaining(`${exitingLeader}`), WARNING_CODE);
+}
+
+linuxIt(
+  'reports them as a process warning without onOrphansReaped',
+  warnsWithoutListenerOptionAsync,
+  REAP_TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts b/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
new file mode 100644
index 0000000000..0e35f7a19f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonFrameListener } from '../DaemonListener';
+import type { IDaemonPaths } from '../DaemonPaths';
+import * as daemonReclaim from '../DaemonReclaim';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+const DIR_MODE: number = 0o700;
+const STALE_SOCKET: string = 'stale';
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+/** Leaves a file at the socket path, which makes binding reclaim the path. */
+function plantStaleSocket(paths: IDaemonPaths): void {
+  fs.mkdirSync(path.dirname(paths.socketPath), { recursive: true, mode: DIR_MODE });
+  fs.writeFileSync(paths.socketPath, STALE_SOCKET);
+}
+
+async function passesOnlyOnOrphansReapedAsync(): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  plantStaleSocket(paths);
+  // The reclaim is stubbed: it only removes the stale socket, so that the second attempt to publish succeeds.
+  const reclaim: jest.SpyInstance = jest
+    .spyOn(daemonReclaim, 'reclaimStaleDaemonAsync')
+    .mockImplementation(async (stalePaths: IDaemonPaths) => fs.unlinkSync(stalePaths.socketPath));
+  const onOrphansReaped: (reap: IDaemonOrphanReap) => void = () => undefined;
+  const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    onConnection: () => undefined,
+    onOrphansReaped
+  });
+  await listener.closeAsync();
+  // The reaper behind the reclaim also reads fields for tests from its options: nothing else may reach it.
+  expect(reclaim.mock.calls).toEqual([[paths, { onOrphansReaped }]]);
+}
+
+posixIt(
+  'passes only onOrphansReaped from its options on to the reclaim of a stale socket',
+  passesOnlyOnOrphansReapedAsync
+);
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 78a1f64ac3..f23180b1bc 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -33,6 +33,11 @@ paused the daemon. It runs again only after another request. Collections during
 its pages pooled for reuse. V8 returns them by itself only when its memory reducer, which checks every 8 seconds,
 finds the process idle, and after some requests it never does.
 
+A daemon that exits without releasing its endpoint, for example after SIGKILL, can leave operations running.
+On POSIX, a host that reclaims such an endpoint at startup first stops them, so that they cannot overwrite the
+outputs of its own requests. The daemon log (`onLog`) gets one line for each set of process groups that it
+stopped; without `onLog`, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+
 Whatever starts a shutdown (a signal, a management client, the idle timeout, a lost socket, a restart or
 `closeAsync()`), the host writes one line to `onLog` when it begins, with its process ID and the reason, for example
 `rushd (PID 2750564) shutting down: received SIGTERM`; later close calls write nothing. The standalone daemon
diff --git a/libraries/rush-daemon/src/DaemonOrphanReapLog.ts b/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
new file mode 100644
index 0000000000..df25c29a8b
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonOrphanReap, IDaemonReclaimOptions } from '@rushstack/rush-daemon-transport';
+
+/** Lists process groups as `process group A` or `process groups A, B and C`; the log names every group. */
+function formatProcessGroups(groupIds: readonly number[]): string {
+  const items: string[] = groupIds.map(String);
+  const last: string | undefined = items.pop();
+  return items.length === 0 ? `process group ${last}` : `process groups ${items.join(', ')} and ${last}`;
+}
+
+/**
+ * Returns the daemon log line for the operations that an exited daemon left running and that this daemon
+ * stopped when it reclaimed the workspace's endpoint, so that they cannot overwrite the outputs of its requests.
+ */
+export function formatOrphanReapLogLine(reap: IDaemonOrphanReap): string {
+  const operations: string =
+    `the operations that the exited daemon (PID ${reap.daemonPid}) left running ` +
+    `(${formatProcessGroups(reap.processGroupIds)})`;
+  return reap.outcome === 'killed'
+    ? `rushd: killed ${operations}; they did not exit after SIGTERM`
+    : `rushd: stopped ${operations}`;
+}
+
+/**
+ * Returns the reclaim options that write each set of stopped process groups to `onLog` as
+ * {@link formatOrphanReapLogLine}'s line. Without `onLog`, the transport reports each set as a
+ * `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+ */
+export function getOrphanReapLogOptions(
+  onLog: ((message: string) => void) | undefined
+): IDaemonReclaimOptions {
+  if (!onLog) return {};
+  return { onOrphansReaped: (reap: IDaemonOrphanReap) => onLog(formatOrphanReapLogLine(reap)) };
+}
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 17946b8f46..273a815bd7 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -22,6 +22,7 @@ import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
 import { DaemonIdleGarbageCollector, type IDaemonIdleGarbageCollection } from './DaemonIdleGarbageCollector';
 import { DaemonIdleTimer } from './DaemonIdleTimer';
 import type { IDaemonInteractiveConnection } from './DaemonInteractiveConnection';
+import { getOrphanReapLogOptions } from './DaemonOrphanReapLog';
 import { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
 import type { IDaemonRequestResolver } from './DaemonRequestDispatcher';
 import { DaemonShutdownDeadline } from './DaemonShutdownDeadline';
@@ -76,8 +77,10 @@ export interface IRushDaemonHostOptions {
   /**
    * Receives messages for the daemon log: one for each rejected request, with the stack when the failure was
    * unexpected, one for each restart that the clients must finish, one when the daemon's socket was deleted
-   * or replaced, one for each reply that could not reach a client because the client went away, and one with
-   * the process ID and the reason when the host begins to shut down.
+   * or replaced, one for each reply that could not reach a client because the client went away, one with the
+   * process ID and the reason when the host begins to shut down, and one for each set of process groups that
+   * an exited daemon left running and that startup stopped when it reclaimed the endpoint. Without it, each
+   * such set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
    */
   readonly onLog?: (message: string) => void;
   /**
@@ -242,6 +245,7 @@ export class RushDaemonHost {
     let listener: DaemonFrameListener;
     try {
       listener = await DaemonFrameListener.listenAsync(paths, {
+        ...getOrphanReapLogOptions(options.onLog),
         protocolVersion: DAEMON_PROTOCOL_VERSION,
         startedAt: new Date(startedAtMs).toISOString(),
         onConnection: (connection: DaemonFrameConnection) => {
diff --git a/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts b/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
new file mode 100644
index 0000000000..3639114445
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
@@ -0,0 +1,158 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import type { Readable } from 'node:stream';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import {
+  computeDaemonWorkspaceKey,
+  ensureDaemonRuntimeDir,
+  isDaemonProcessAlive,
+  resolveDaemonPathsFromProcess,
+  writeDaemonLockfile
+} from '@rushstack/rush-daemon-transport';
+import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { formatOrphanReapLogLine, getOrphanReapLogOptions } from '../DaemonOrphanReapLog';
+import { RushDaemonHost } from '../RushDaemonHost';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+
+const RUSH_VERSION: string = '5.178.1';
+const DEAD_PID: number = 4242;
+const POLL_ATTEMPTS: number = 250;
+const POLL_INTERVAL_MS: number = 20;
+// Above the reaper's SIGTERM and SIGKILL grace periods plus the wait for the orphan to exit.
+const REAP_TEST_TIMEOUT_MS: number = 30000;
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A stand-in for a daemon that is SIGKILLed while it runs an operation. The operation is spawned without
+// `detached`, so it stays in the daemon's process group; it exits by itself after a minute, so that a
+// regression cannot leave it running.
+const FAKE_DAEMON_SCRIPT: string =
+  "const c=require('node:child_process').spawn(process.execPath,['-e','setTimeout(()=>{},60000)'],{stdio:'ignore'});" +
+  "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+
+describe(formatOrphanReapLogLine.name, () => {
+  it('names the exited daemon and its process group', () => {
+    expect(
+      formatOrphanReapLogLine({ daemonPid: DEAD_PID, processGroupIds: [DEAD_PID], outcome: 'terminated' })
+    ).toBe(
+      'rushd: stopped the operations that the exited daemon (PID 4242) left running (process group 4242)'
+    );
+  });
+
+  it('names every process group, and says so when they needed SIGKILL', () => {
+    expect(
+      formatOrphanReapLogLine({
+        daemonPid: DEAD_PID,
+        processGroupIds: [11, 12, 13, 14, 15],
+        outcome: 'killed'
+      })
+    ).toBe(
+      'rushd: killed the operations that the exited daemon (PID 4242) left running ' +
+        '(process groups 11, 12, 13, 14 and 15); they did not exit after SIGTERM'
+    );
+  });
+});
+
+describe(getOrphanReapLogOptions.name, () => {
+  it('keeps the process warning without onLog', () => {
+    expect(getOrphanReapLogOptions(undefined)).toEqual({});
+  });
+
+  it('writes each set of stopped process groups to onLog', () => {
+    const messages: string[] = [];
+    const reap: IDaemonOrphanReap = { daemonPid: DEAD_PID, processGroupIds: [11, 12], outcome: 'terminated' };
+    getOrphanReapLogOptions((message: string) => messages.push(message)).onOrphansReaped?.(reap);
+    expect(messages).toEqual([formatOrphanReapLogLine(reap)]);
+  });
+});
+
+interface ICrashedDaemon {
+  readonly daemonPid: number;
+  readonly orphanPid: number;
+}
+
+/** Leaves what a daemon that was SIGKILLed while running an operation leaves: the operation, lockfile and socket. */
+async function crashFakeDaemonAsync(paths: IDaemonPaths): Promise<ICrashedDaemon> {
+  const daemon: ChildProcess = spawn(process.execPath, ['-e', FAKE_DAEMON_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const stdout: Readable = daemon.stdout as Readable;
+  const [chunk] = (await once(stdout, 'data')) as [Buffer];
+  daemon.kill('SIGKILL');
+  await once(daemon, 'exit');
+  stdout.destroy();
+  const daemonPid: number = Number(daemon.pid);
+  ensureDaemonRuntimeDir(paths);
+  writeDaemonLockfile(paths.lockfilePath, {
+    pid: daemonPid,
+    protocolVersion: DAEMON_PROTOCOL_VERSION,
+    startedAt: new Date().toISOString(),
+    socketPath: paths.socketPath
+  });
+  fs.writeFileSync(paths.socketPath, 'stale');
+  return { daemonPid, orphanPid: Number(chunk.toString().trim()) };
+}
+
+async function waitUntilDeadAsync(pid: number): Promise<boolean> {
+  for (let attempt: number = 0; attempt < POLL_ATTEMPTS && isDaemonProcessAlive(pid); attempt++) {
+    await delayAsync(POLL_INTERVAL_MS);
+  }
+  return !isDaemonProcessAlive(pid);
+}
+
+describe('startup reclaim', () => {
+  let repoRoot: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-orphan-log-'));
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  linuxIt(
+    'writes the operations that it stops for a SIGKILLed daemon to the daemon log, not as a process warning',
+    async () => {
+      const warning: jest.SpyInstance = jest
+        .spyOn(process, 'emitWarning')
+        .mockImplementation(() => undefined);
+      const workspaceKey: string = computeDaemonWorkspaceKey({
+        canonicalRepoRoot: fs.realpathSync.native(repoRoot),
+        rushVersion: RUSH_VERSION
+      });
+      const { daemonPid, orphanPid } = await crashFakeDaemonAsync(
+        resolveDaemonPathsFromProcess(workspaceKey)
+      );
+      const messages: string[] = [];
+      const host: RushDaemonHost = await RushDaemonHost.startAsync({
+        createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+        daemonVersion: 'orphan-log-test',
+        repoRoot,
+        rushVersion: RUSH_VERSION,
+        onLog: (message: string) => messages.push(message)
+      });
+      await host.closeAsync();
+      // The host logs other things too, such as its shutdown. The reclaim must add exactly this one line.
+      expect(messages.filter((message: string) => message.includes('left running'))).toEqual([
+        `rushd: stopped the operations that the exited daemon (PID ${daemonPid}) left running ` +
+          `(process group ${daemonPid})`
+      ]);
+      expect(warning).not.toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({ code: 'RUSH_DAEMON_ORPHANS_REAPED' })
+      );
+      expect(await waitUntilDeadAsync(orphanPid)).toBe(true);
+    },
+    REAP_TEST_TIMEOUT_MS
+  );
+});

From 7be5591da1d44e04dd3fb7cbbeebcda8a3f66507 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:05 +0000
Subject: [PATCH 168/265] [rush-cli-client] Test that the daemon liveness lines
 go to stderr

Swarm integration step 153; original commit 1458f87c91 (merge of swarm/o05-t266 at 473112d986).
Scope: task 266.

Brings 266 (branch swarm/o05-t266). Second agent: o02 board 5223. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 18 of 19. Gate: ch01 GATE OK board 5319 (tree d4f20ba7a7)

Commits folded into this step (1):
- 473112d986 [rush-cli-client] Test that the daemon liveness lines go to stderr

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/daemonSilenceOutput.test.ts      | 145 ++++++++++++++++++
 ...aemon-silence-stderr_2026-09-29-12-30.json |  11 ++
 2 files changed, 156 insertions(+)
 create mode 100644 apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o05-t266-daemon-silence-stderr_2026-09-29-12-30.json

diff --git a/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts b/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
new file mode 100644
index 0000000000..e02b0da004
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
@@ -0,0 +1,145 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import * as connectionOptions from '../daemonConnectionOptions';
+import { launchClientAsync } from '../launchClient';
+import { getTestProcessEnvironment } from './TestProcessEnvironment';
+
+const DAEMON_PID: number = 41;
+
+const UNRESPONSIVE: string =
+  `rush-client: rushd (PID ${DAEMON_PID}) has not responded for 30s; its process may be stopped or ` +
+  'overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n';
+const RESPONDED: string = `rush-client: rushd (PID ${DAEMON_PID}) responded again after 31s.\n`;
+
+describe('the lines about a daemon that stopped responding (task 266)', () => {
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let originalExitCode: typeof process.exitCode;
+  let stdout: string[];
+  let stderr: string[];
+  /** What the client had written to stderr while the daemon was still silent. */
+  let stderrWhileSilent: string[] | undefined;
+
+  /** Records each write to `stream`, and completes it at once. */
+  function record(stream: NodeJS.WriteStream, chunks: string[]): void {
+    jest.spyOn(stream, 'write').mockImplementation(((
+      chunk: string | Uint8Array,
+      ...rest: unknown[]
+    ): boolean => {
+      chunks.push(Buffer.from(chunk).toString());
+      (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+      return true;
+    }) as typeof stream.write);
+  }
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-daemon-silence-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    originalExitCode = process.exitCode;
+    stdout = [];
+    stderr = [];
+    stderrWhileSilent = undefined;
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+    );
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    record(process.stdout, stdout);
+    record(process.stderr, stderr);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      closeAsync: async () => undefined,
+      status: Promise.resolve({ pid: DAEMON_PID })
+    } as unknown as DaemonClient);
+    // The daemon writes a line of the command's output, then sends nothing for 31 s, which DaemonClient
+    // reports once 30 s have passed, then writes another line and the result.
+    jest
+      .mocked(executeWithDaemonRestartAsync)
+      .mockImplementation(async (client, connection, { request, onStdoutAsync, liveness }) => {
+        await onStdoutAsync!(Buffer.from('built-a\n'), request.requestId);
+        liveness!.onUnresponsive({ pid: DAEMON_PID, silentForMs: 30_000 });
+        await new Promise((resolve) => setImmediate(resolve));
+        stderrWhileSilent = [...stderr];
+        liveness!.onResponsive!({ pid: DAEMON_PID, silentForMs: 31_000 });
+        await onStdoutAsync!(Buffer.from('built-b\n'), request.requestId);
+        return {
+          kind: 'result',
+          result: { requestId: request.requestId, exitCode: 0, outcome: 'success', aborted: false }
+        };
+      });
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    const environment: NodeJS.ProcessEnv = getTestProcessEnvironment(originalEnvironment);
+    for (const name of Object.keys(environment)) {
+      if (name.startsWith('RUSH_')) delete environment[name];
+    }
+    process.env = { ...environment, RUSH_DAEMON: '1' };
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    process.exitCode = originalExitCode;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it("writes them to stderr while the daemon is silent, and leaves stdout to the command's output", async () => {
+    await launchClientAsync(false);
+    // `rush-client build | grep ...` must not see them.
+    expect(stdout.join('')).toBe('built-a\nbuilt-b\n');
+    expect(stderrWhileSilent).toEqual([UNRESPONSIVE]);
+    expect(stderr).toEqual([UNRESPONSIVE, RESPONDED]);
+    expect(process.exitCode).toBe(0);
+  });
+
+  it('leaves them to the agent output, and writes none to stderr', async () => {
+    const output: string[] = [];
+    const renderer: AgentProgressRenderer = new AgentProgressRenderer({
+      commandName: 'build',
+      isTTY: false,
+      columns: 80,
+      write: (text: string) => output.push(text)
+    });
+    await launchClientAsync(false, renderer);
+    expect(output.join('').split('\n').slice(0, -1)).toEqual([
+      expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
+      expect.stringMatching(
+        /^rush build · \d+\.\ds · rushd \(PID 41\) has not responded for 30s; its process may be stopped or overloaded\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
+      ),
+      expect.stringMatching(/^rush build · \d+\.\ds · rushd \(PID 41\) responded again after 31s$/),
+      expect.stringMatching(/^rush build: SUCCESS/)
+    ]);
+    expect(stderr).toEqual([]);
+    expect(stdout).toEqual([]);
+    expect(process.exitCode).toBe(0);
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o05-t266-daemon-silence-stderr_2026-09-29-12-30.json b/common/changes/@rushstack/rush-cli-client/swarm-o05-t266-daemon-silence-stderr_2026-09-29-12-30.json
new file mode 100644
index 0000000000..4e13e60726
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o05-t266-daemon-silence-stderr_2026-09-29-12-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Add a test that the lines saying rushd has not responded, and that it responded again, go to stderr and never to stdout, where they would mix into the command's output. In agent output they stay in the agent's lines.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 5a508b0a1cb9b5ed75c11e879313c10bbb0fb170 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:44:06 +0000
Subject: [PATCH 169/265] [package-deps-hash] Detect changes to hidden
 .gitattributes files in RepoStateCache

Swarm integration step 154; original commit 4b33c75100 (merge of swarm/r07-t252 at ac7c00af64).
Scope: task 252.

Brings 252 (branch swarm/r07-t252). Second agent: t04 board 5237, board 5239. Evidence: ch01's GATE OK board 5319.

s19 batch E2c, item 19 of 19. Gate: ch01 GATE OK board 5319 (tree 954570f670)

Commits folded into this step (1):
- ac7c00af64 [package-deps-hash] Detect changes to hidden .gitattributes files in RepoStateCache

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...he-hidden-attributes_2026-09-29-12-05.json |  11 ++
 .../package-deps-hash/src/GitIndexFile.ts     | 112 +++++++++++++++++-
 .../package-deps-hash/src/RepoStateCache.ts   |  26 +++-
 .../src/test/GitIndexFile.test.ts             |  82 +++++++++++++
 .../src/test/RepoStateCache.test.ts           |  57 +++++++++
 5 files changed, 279 insertions(+), 9 deletions(-)
 create mode 100644 common/changes/@rushstack/package-deps-hash/repo-state-cache-hidden-attributes_2026-09-29-12-05.json

diff --git a/common/changes/@rushstack/package-deps-hash/repo-state-cache-hidden-attributes_2026-09-29-12-05.json b/common/changes/@rushstack/package-deps-hash/repo-state-cache-hidden-attributes_2026-09-29-12-05.json
new file mode 100644
index 0000000000..6cb3ee8be6
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/repo-state-cache-hidden-attributes_2026-09-29-12-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Fix `RepoStateCache` returning stale hashes after a change to a `.gitattributes` file that the index marks \"assume unchanged\" or \"skip worktree\", which `git status` doesn't list. The cache now copies the index again when such a file changes, and computes that call's state without the cache.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/GitIndexFile.ts b/libraries/package-deps-hash/src/GitIndexFile.ts
index f5826d8d4c..1d7d914301 100644
--- a/libraries/package-deps-hash/src/GitIndexFile.ts
+++ b/libraries/package-deps-hash/src/GitIndexFile.ts
@@ -19,8 +19,20 @@ const ENTRY_MODE_TYPE_SHIFT: number = 12;
 const ENTRY_SIZE_OFFSET: number = 36;
 const ENTRY_SIZE_LENGTH: number = 4;
 const ENTRY_FLAGS_LENGTH: number = 2;
+// "git update-index --assume-unchanged" sets this flag
+const ENTRY_ASSUME_VALID_FLAG: number = 0x8000;
 const ENTRY_EXTENDED_FLAG: number = 0x4000;
 const ENTRY_STAGE_MASK: number = 0x3000;
+// An extended flag, which "git update-index --skip-worktree" and sparse checkouts set
+const ENTRY_SKIP_WORKTREE_FLAG: number = 0x4000;
+// In a version 4 index, each byte of the variable-length integer that starts a path has 7 bits of its value, and a
+// bit that says whether another byte follows
+const VARINT_CONTINUATION_FLAG: number = 0x80;
+const VARINT_VALUE_MASK: number = 0x7f;
+const VARINT_VALUE_BITS_FACTOR: number = 0x80;
+const INITIAL_PATH_BUFFER_LENGTH: number = 4096;
+const ATTRIBUTES_FILE_NAME: Buffer = Buffer.from('.gitattributes');
+const SLASH_CHARACTER_CODE: number = 0x2f;
 const EXTENSION_HEADER_LENGTH: number = 8;
 const SPLIT_INDEX_EXTENSION_SIGNATURE: string = 'link';
 const UNTRACKED_CACHE_EXTENSION_SIGNATURE: string = 'UNTR';
@@ -78,6 +90,11 @@ export interface IGitIndexSummary {
    * Whether the index is split: its entries are then completed by a shared index file.
    */
   readonly isSplit: boolean;
+  /**
+   * The paths of the `.gitattributes` files that the index marks "assume unchanged" or "skip worktree", in the
+   * order of the index. Git doesn't examine these files, so `git status` doesn't list them, even when they change.
+   */
+  readonly hiddenAttributesFilePaths: ReadonlyArray<string>;
 }
 
 /**
@@ -226,19 +243,21 @@ export function parseGitIndexLayout(content: Buffer, objectIdLength: number): IG
  * @param objectIdLength - The length of an object ID in bytes: 20 for SHA-1, or 32 for SHA-256
  */
 export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGitIndexSummary {
-  const { entryCount, entryOffsets, extensions }: IGitIndexLayout = parseGitIndexLayout(
-    content,
-    objectIdLength
-  );
+  const layout: IGitIndexLayout = parseGitIndexLayout(content, objectIdLength);
+  const { entryCount, entryOffsets, extensions }: IGitIndexLayout = layout;
   const entriesEnd: number = entryOffsets[entryCount];
   // A copy of the entries in which the file system data of each entry is cleared, except for the mode
   const entries: Buffer = Buffer.from(content.subarray(0, entriesEnd));
   const sizes: Buffer = Buffer.alloc(entryCount * ENTRY_SIZE_LENGTH);
+  const hiddenEntryIndices: number[] = [];
   for (let i: number = 0; i < entryCount; i++) {
     const offset: number = entryOffsets[i];
     sizes.writeUInt32BE(content.readUInt32BE(offset + ENTRY_SIZE_OFFSET), i * ENTRY_SIZE_LENGTH);
     entries.fill(0, offset, offset + ENTRY_MODE_OFFSET);
     entries.fill(0, offset + ENTRY_MODE_OFFSET + ENTRY_MODE_LENGTH, offset + ENTRY_STAT_LENGTH);
+    if (isEntryHidden(content, offset + ENTRY_STAT_LENGTH + objectIdLength)) {
+      hiddenEntryIndices.push(i);
+    }
   }
 
   return {
@@ -247,10 +266,93 @@ export function summarizeGitIndex(content: Buffer, objectIdLength: number): IGit
     sizesDigest: createHash('sha1').update(sizes).digest('hex'),
     isSplit: extensions.some(
       ({ signature }: IGitIndexExtension) => signature === SPLIT_INDEX_EXTENSION_SIGNATURE
-    )
+    ),
+    hiddenAttributesFilePaths: findAttributesFilePaths(content, layout, hiddenEntryIndices)
   };
 }
 
+/**
+ * Whether the index marks an entry "assume unchanged" or "skip worktree", so that Git doesn't examine its file.
+ */
+function isEntryHidden(content: Buffer, flagsOffset: number): boolean {
+  const flags: number = content.readUInt16BE(flagsOffset);
+  return (
+    (flags & ENTRY_ASSUME_VALID_FLAG) !== 0 ||
+    ((flags & ENTRY_EXTENDED_FLAG) !== 0 &&
+      (content.readUInt16BE(flagsOffset + ENTRY_FLAGS_LENGTH) & ENTRY_SKIP_WORKTREE_FLAG) !== 0)
+  );
+}
+
+/**
+ * Returns the paths of the given entries that name a `.gitattributes` file, in the order of the entries.
+ */
+function findAttributesFilePaths(
+  content: Buffer,
+  { version, pathOffsets, pathEndOffsets }: IGitIndexLayout,
+  entryIndices: ReadonlyArray<number>
+): string[] {
+  const filePaths: string[] = [];
+  if (entryIndices.length === 0) {
+    return filePaths;
+  }
+
+  if (version !== 4) {
+    for (const i of entryIndices) {
+      if (isAttributesFilePath(content, pathOffsets[i], pathEndOffsets[i])) {
+        filePaths.push(content.toString('utf8', pathOffsets[i], pathEndOffsets[i]));
+      }
+    }
+
+    return filePaths;
+  }
+
+  // Each path only stores how many bytes to remove from the end of the previous path, and the bytes to add after
+  // those that remain, so the paths must be rebuilt in order
+  let filePath: Buffer = Buffer.alloc(INITIAL_PATH_BUFFER_LENGTH);
+  let filePathLength: number = 0;
+  let nextIndex: number = 0;
+  for (let i: number = 0; nextIndex < entryIndices.length; i++) {
+    let offset: number = pathOffsets[i];
+    let byte: number = content[offset++];
+    let removedLength: number = byte & VARINT_VALUE_MASK;
+    while (byte & VARINT_CONTINUATION_FLAG) {
+      byte = content[offset++];
+      removedLength = (removedLength + 1) * VARINT_VALUE_BITS_FACTOR + (byte & VARINT_VALUE_MASK);
+    }
+
+    if (removedLength > filePathLength) {
+      throw new Error('The Git index has a malformed path');
+    }
+
+    const keptLength: number = filePathLength - removedLength;
+    filePathLength = keptLength + pathEndOffsets[i] - offset;
+    if (filePathLength > filePath.length) {
+      const newFilePath: Buffer = Buffer.alloc(Math.max(filePathLength, filePath.length * 2));
+      filePath.copy(newFilePath, 0, 0, keptLength);
+      filePath = newFilePath;
+    }
+
+    content.copy(filePath, keptLength, offset, pathEndOffsets[i]);
+    if (i === entryIndices[nextIndex]) {
+      nextIndex++;
+      if (isAttributesFilePath(filePath, 0, filePathLength)) {
+        filePaths.push(filePath.toString('utf8', 0, filePathLength));
+      }
+    }
+  }
+
+  return filePaths;
+}
+
+function isAttributesFilePath(buffer: Buffer, start: number, end: number): boolean {
+  const nameStart: number = end - ATTRIBUTES_FILE_NAME.length;
+  return (
+    nameStart >= start &&
+    (nameStart === start || buffer[nameStart - 1] === SLASH_CHARACTER_CODE) &&
+    buffer.compare(ATTRIBUTES_FILE_NAME, 0, ATTRIBUTES_FILE_NAME.length, nameStart, end) === 0
+  );
+}
+
 /**
  * Builds a new copy of a Git index that keeps the untracked cache and the state of the file system monitor of the
  * previous copy, so that `git status` doesn't examine the folders and files that didn't change since it last
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index c8014de8e1..7666e82634 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -127,6 +127,11 @@ interface IPrivateIndex {
    * Whether the attributes files changed since the first "git status", so that the index must be copied again.
    */
   hasAttributesChanged: boolean;
+  /**
+   * The attributes files that the index marks "assume unchanged" or "skip worktree". "git status" doesn't list
+   * them, even when they change.
+   */
+  readonly hiddenAttributesFilePaths: ReadonlyArray<string>;
 }
 
 interface ITree {
@@ -182,7 +187,8 @@ function noop(): void {}
  * the user's configuration folder, or when one of these files may have been written during the previous call, while
  * Git read it. A file that is rewritten with the same content, as `git branch -D` rewrites the configuration of the
  * repository, isn't a change. The index is copied again when a `.gitattributes` file changes that `git status`
- * lists as modified or untracked, or that is in a folder that contains a filter path; the call that detects the
+ * lists as modified or untracked; that the index marks "assume unchanged" or "skip worktree", so that `git status`
+ * doesn't list it; or that is in a folder that contains a filter path. The call that detects the
  * change computes the state without the cache. The index is also copied again when the filter changes. Changes to
  * the system configuration, to a configuration file included by another, to a custom `core.attributesFile`, or to
  * an ignored `.gitattributes` file that applies to files that the index records aren't detected. In rare cases,
@@ -345,7 +351,12 @@ export class RepoStateCache {
 
     const locallyModified: Map<string, boolean> = parseGitStatus(statusOutput);
     const attributesFingerprint: string = this.#getFingerprint(
-      getAttributesFilePaths(this.#rootDirectory, locallyModified.keys(), filterPath),
+      getAttributesFilePaths(
+        this.#rootDirectory,
+        locallyModified.keys(),
+        privateIndex.hiddenAttributesFilePaths,
+        filterPath
+      ),
       settledBeforeNs
     );
     if (privateIndex.attributesFingerprint === undefined) {
@@ -620,7 +631,8 @@ export class RepoStateCache {
       // The file system monitor's state that the new copy keeps says which files Git found unchanged under the
       // attributes of the previous copy, so the next call must detect a change since then
       attributesFingerprint: carriedOverCopy ? previousIndex?.attributesFingerprint : undefined,
-      hasAttributesChanged: false
+      hasAttributesChanged: false,
+      hiddenAttributesFilePaths: summary.hiddenAttributesFilePaths
     };
     this.#privateIndex = privateIndex;
     return privateIndex;
@@ -959,11 +971,13 @@ function haveSameContent(
 
 /**
  * Lists the attributes files that affect how "git status" refreshes the files within the filter: those that it
- * lists as modified or untracked, and those in the folders that contain the filter paths, which it doesn't list.
+ * lists as modified or untracked; those that the index marks "assume unchanged" or "skip worktree", which it doesn't
+ * list even when they change; and those in the folders that contain the filter paths, which it doesn't list either.
  */
 function* getAttributesFilePaths(
   rootDirectory: string,
   modifiedFilePaths: Iterable<string>,
+  hiddenAttributesFilePaths: ReadonlyArray<string>,
   filterPath: ReadonlyArray<string> | undefined
 ): IterableIterator<string> {
   for (const filePath of modifiedFilePaths) {
@@ -972,6 +986,10 @@ function* getAttributesFilePaths(
     }
   }
 
+  for (const filePath of hiddenAttributesFilePaths) {
+    yield path.resolve(rootDirectory, filePath);
+  }
+
   const rootPath: string = path.resolve(rootDirectory);
   const folderPaths: Set<string> = new Set();
   for (const filterEntry of filterPath ?? []) {
diff --git a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
index 173c9e4118..bd13f28cf2 100644
--- a/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
+++ b/libraries/package-deps-hash/src/test/GitIndexFile.test.ts
@@ -194,6 +194,88 @@ describe(summarizeGitIndex.name, () => {
     expect(summary.sizesDigest).toBe(initialSummary.sizesDigest);
   });
 
+  it.each([2, 3, 4])(
+    'lists the .gitattributes files that a version %i index marks "assume unchanged" or "skip worktree"',
+    (version: number) => {
+      createRepo();
+      for (const filePath of [
+        '.gitattributes',
+        'dir/.gitattributes.bak',
+        'dir/not.gitattributes',
+        'dir/sub/.gitattribute',
+        'dir/sub/.gitattributes',
+        'dir/\u00fc/.gitattributes',
+        'visible/.gitattributes'
+      ]) {
+        writeFile(filePath, '# No attributes\n');
+      }
+
+      runGit('add', '.');
+      // A version 4 index stores each path relative to the previous one, even one longer than a file system allows
+      const longFilePath: string = `dir/${'long/'.repeat(1000)}.gitattributes`;
+      const objectId: string = runGit('rev-parse', ':a.txt').trim();
+      runGit('update-index', '--add', '--cacheinfo', `100644,${objectId},${longFilePath}`);
+      setIndexVersion(version);
+      expect(summarize().hiddenAttributesFilePaths).toEqual([]);
+
+      const assumeUnchangedPaths: string[] = [
+        '.gitattributes',
+        'dir/not.gitattributes',
+        'dir/sub/.gitattributes'
+      ];
+      const skipWorktreePaths: string[] = [
+        'dir/.gitattributes.bak',
+        'dir/sub/.gitattribute',
+        'dir/\u00fc/.gitattributes',
+        longFilePath
+      ];
+      if (version === 2) {
+        // Git would write a version 3 index to mark a file "skip worktree"
+        assumeUnchangedPaths.push(...skipWorktreePaths.splice(0));
+      } else {
+        // Another extended flag, which doesn't hide the file
+        writeFile('new/.gitattributes', '# No attributes\n');
+        runGit('add', '--intent-to-add', '--', 'new/.gitattributes');
+      }
+
+      runGit('update-index', '--assume-unchanged', '--', ...assumeUnchangedPaths);
+      if (skipWorktreePaths.length > 0) {
+        runGit('update-index', '--skip-worktree', '--', ...skipWorktreePaths);
+      }
+
+      expect(readIndex().readUInt32BE(4)).toBe(version);
+      expect(summarize().hiddenAttributesFilePaths).toEqual([
+        '.gitattributes',
+        longFilePath,
+        'dir/sub/.gitattributes',
+        'dir/\u00fc/.gitattributes'
+      ]);
+    }
+  );
+
+  it('lists the hidden .gitattributes files in the index of a SHA-256 repository', () => {
+    createRepo('--object-format=sha256');
+    writeFile('dir/.gitattributes', '# No attributes\n');
+    writeFile('dir/sub/.gitattributes', '# No attributes\n');
+    runGit('add', '.');
+    runGit('update-index', '--skip-worktree', '--', 'dir/sub/.gitattributes');
+    runGit('update-index', '--index-version=4');
+
+    expect(summarize(SHA256_OBJECT_ID_LENGTH).hiddenAttributesFilePaths).toEqual(['dir/sub/.gitattributes']);
+  });
+
+  it('rejects a version 4 index whose path removes more bytes than the previous path has', () => {
+    createRepo();
+    runGit('update-index', '--assume-unchanged', '--', 'dir/b.txt');
+    runGit('update-index', '--index-version=4');
+    const index: Buffer = readIndex();
+    // The first path removes a byte from the empty path before it
+    index[parseGitIndexLayout(index, SHA1_OBJECT_ID_LENGTH).pathOffsets[0]] = 1;
+    expect(() => summarizeGitIndex(index, SHA1_OBJECT_ID_LENGTH)).toThrow(
+      'The Git index has a malformed path'
+    );
+  });
+
   it('detects a split index', () => {
     createRepo();
     runGit('update-index', '--split-index');
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
index 0da5d133cd..f894ab9e50 100644
--- a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -615,6 +615,63 @@ describe(RepoStateCache.name, () => {
     expect(takeUsesPrivateIndex()).toBe(true);
   });
 
+  it.each([
+    ['--assume-unchanged', '.gitattributes', 2],
+    ['--assume-unchanged', 'dir/.gitattributes', 2],
+    ['--assume-unchanged', 'dir/.gitattributes', 4],
+    ['--skip-worktree', '.gitattributes', 3],
+    ['--skip-worktree', 'dir/.gitattributes', 3],
+    ['--skip-worktree', 'dir/.gitattributes', 4]
+  ])(
+    'copies the index again when a .gitattributes file that the index marks %s changes (%s, index version %i)',
+    async (flag: string, attributesPath: string, indexVersion: number) => {
+      settleFiles();
+      writeFile('dir/crlf.txt', 'a\r\n');
+      writeFile(attributesPath, '# No attributes\n');
+      commit();
+      runGit('update-index', flag, '--', attributesPath);
+      runGit('update-index', `--index-version=${indexVersion}`);
+      expect(fs.readFileSync(path.join(repoPath, '.git', 'index')).readUInt32BE(4)).toBe(indexVersion);
+      await getStateAsync();
+      // Git refreshes the recorded times of the file in the copy of the index, but not in the index
+      touchSettledFile('dir/crlf.txt');
+      await getStateAsync();
+      takeGitCommands();
+      await getStateAsync();
+      expect(takeGitCommandNames()).toEqual(['status']);
+
+      // "git status" doesn't list the attributes file, since Git doesn't examine it. Git now converts the line
+      // endings of the other file, so it no longer matches the index.
+      writeFile(attributesPath, '*.txt text eol=lf\n');
+      let state: IDetailedRepoState = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(state.files.get('dir/crlf.txt')).toBe(hashText('a\n'));
+
+      takeGitCommands();
+      state = await getStateAsync();
+      await expectUncachedStateAsync(state);
+      expect(takeUsesPrivateIndex()).toBe(true);
+    }
+  );
+
+  it('copies the index again when a .gitattributes file within the filter that the index marks --skip-worktree changes', async () => {
+    settleFiles();
+    writeFile('sub/dir/crlf.txt', 'a\r\n');
+    writeFile('sub/dir/.gitattributes', '# No attributes\n');
+    commit();
+    runGit('update-index', '--skip-worktree', '--', 'sub/dir/.gitattributes');
+    const filterPath: string[] = ['sub'];
+    await getStateAsync([], filterPath);
+    touchSettledFile('sub/dir/crlf.txt');
+    await getStateAsync([], filterPath);
+
+    // The attributes file is neither listed by "git status" nor in a folder that contains the filter
+    writeFile('sub/dir/.gitattributes', '*.txt text eol=lf\n');
+    const state: IDetailedRepoState = await getStateAsync([], filterPath);
+    await expectUncachedStateAsync(state, [], filterPath);
+    expect(state.files.get('sub/dir/crlf.txt')).toBe(hashText('a\n'));
+  });
+
   it('copies the index again when the filter changes, instead of computing the state without the cache', async () => {
     settleFiles();
     writeFile('dir/crlf.txt', 'a\r\n');

From 4734cdcf059ecd41d23badfcb4f2493c76e269c8 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:51 +0000
Subject: [PATCH 170/265] Update the warm worker notes on input checks and
 TypeScript

Swarm integration step 155; original commit 6497d8ac5e (merge of o07/daemon-doc-input-checks at 43207db591).
Scope: doc, no task.

Brings warm-worker doc (o07's branch o07/daemon-doc-input-checks, merged by hash; no swarm/ branch). Second agent: r01 board 5313 (o07 CLAIM board 5270). Evidence: ch01's GATE OK board 5753.

Batch E2d, item 1 of 12. Gate: ch01 GATE OK board 5753 (tree 96ddab7127)

Commits folded into this step (1):
- 43207db591 Update the warm worker notes on input checks and TypeScript

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 docs/rush/dogfooding-rush-daemon.md | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 26aeb9912d..c04b9a9552 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -235,17 +235,15 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   edit to the file and keep its stale outputs, with no error. TypeScript reads the variable only if
   `tsconfig.json` does not set `watchOptions.watchFile`. The variable's watcher fails loudly instead: on Linux,
   if a source file is missing when a run on the worker updates the TypeScript program, for example because a
-  checkout deleted it during the build and then restored it, TypeScript never finds that file again in the
-  process. The run usually fails with error `TS6053` (file not found), or with `ENOENT` if a whole folder was
-  missing, and like any failed run it closes the worker (see below), so it costs a failed run but leaves no stale
-  outputs. But if Heft sees the change while the run is in progress, it runs its tasks again, and the last pass
-  decides the result. The run can then succeed with warnings, which fails the build unless the phase sets
-  `allowWarningsOnSuccess`, but nothing runs again and the worker stays alive. The next build does not reuse that
-  worker if a folder that held the operation's input files was recreated (see below), or if the build cache is
-  enabled for the operation, because input files that changed while an operation ran make its result
-  unverifiable. A single file that is deleted and restored keeps its folder, so neither check applies to it, but
-  a program that still misses the file reports `TS6053` again in the next run on the worker, which then fails
-  and closes the worker as above.
+  checkout deleted it during the build and then restored it, the run usually fails with error `TS6053` (file not
+  found), or with `ENOENT` if a whole folder was missing, and like any failed run it closes the worker (see
+  below), so it costs a failed run but leaves no stale outputs. With TypeScript 3.8 or later, Heft's TypeScript
+  plugin reports the file as created when it comes back; with TypeScript 3.7 or older, or an older release of the
+  plugin, TypeScript never finds that file again in the process. But if Heft sees the change while the run is in
+  progress, it runs its tasks again, and the last pass decides the result. The run can then succeed with warnings,
+  which fails the build unless the phase sets `allowWarningsOnSuccess`, but nothing runs again and the worker stays
+  alive. The next build does not reuse that worker, with or without the build cache, because input files that
+  changed while an operation ran make its result unverifiable.
   A watcher of a folder can also miss every later change in it once the folder is deleted and created again, for
   example by a branch switch that removed the folder and then restored it. So the next build runs the initial
   script if a folder that held the operation's input files was deleted or recreated since the last run on the

From b79ba270f3abc6cc58fa24ad5d8ae2fbc7cfa350 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:57 +0000
Subject: [PATCH 171/265] [heft-webpack5-plugin] Explain when a relative path
 is absolute

Swarm integration step 156; original commit 6b3fd67719 (merge of o07/webpack-stale-assets-nit1 at cbf3f17a00).
Scope: task 124.

Brings 124 comment NIT (o07's branch o07/webpack-stale-assets-nit1, merged by hash; no swarm/ branch). Second agent: r03 DIFF CHECK OK board 5071. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 2 of 12. Gate: ch01 GATE OK board 5753 (tree 87468e480a)

Commits folded into this step (1):
- cbf3f17a00 [heft-webpack5-plugin] Explain when a relative path is absolute

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts b/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
index e3febe0859..b3a5b0e1a1 100644
--- a/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/DeleteStaleAssetsPlugin.ts
@@ -195,7 +195,8 @@ function getAssetPaths(
  */
 function isInFolder(pathApi: path.PlatformPath, folderPath: string, filePath: string): boolean {
   const relativePath: string = pathApi.relative(folderPath, filePath);
-  // The relative path is absolute if the file is on another drive.
+  // The relative path is absolute if the file is on another drive. On win32 it is also absolute if its first
+  // segment is a drive, e.g. `C:\a.js` for `C:\dist\C:\a.js`.
   return (
     relativePath !== '' &&
     relativePath !== '..' &&

From 88dbabb3a0b567f117cd5aec16b4e070059239e3 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:57 +0000
Subject: [PATCH 172/265] [rush-lib] Test that watch mode finds edits made
 during an iteration

Swarm integration step 157; original commit 8327c99f3a (merge of swarm/r01-t268 at 3d68091385).
Scope: task 268.

Brings 268 (branch swarm/r01-t268). Second agent: t02 board 5336, board 5394. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 3 of 12. Gate: ch01 GATE OK board 5753 (tree ead63a020e)

Commits folded into this step (1):
- 3d68091385 [rush-lib] Test that watch mode finds edits made during an iteration

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-watch-provider-test_2026-09-29-13-00.json |  11 +
 .../test/RushCommandLineParserWatch.test.ts   | 188 ++++++++++++++++++
 2 files changed, 199 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/swarm-r01-t268-watch-provider-test_2026-09-29-13-00.json
 create mode 100644 libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts

diff --git a/common/changes/@microsoft/rush/swarm-r01-t268-watch-provider-test_2026-09-29-13-00.json b/common/changes/@microsoft/rush/swarm-r01-t268-watch-provider-test_2026-09-29-13-00.json
new file mode 100644
index 0000000000..bba1834b76
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r01-t268-watch-provider-test_2026-09-29-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts
new file mode 100644
index 0000000000..6a1f850104
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserWatch.test.ts
@@ -0,0 +1,188 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { once } from 'node:events';
+
+import { JsonFile, LockFile } from '@rushstack/node-core-library';
+
+import { EnvironmentConfiguration } from '../../api/EnvironmentConfiguration';
+import { FlagFile } from '../../api/FlagFile';
+import { RushConstants } from '../../logic/RushConstants';
+import type { IOperationExecutionResult } from '../../logic/operations/IOperationExecutionResult';
+import type { Operation } from '../../logic/operations/Operation';
+import { OperationStatus } from '../../logic/operations/OperationStatus';
+import { RushCommandLineParser } from '../RushCommandLineParser';
+import { PhasedScriptAction } from '../scriptActions/PhasedScriptAction';
+
+const COMMAND_NAME: string = 'watch-test';
+const PHASE_NAME: string = '_phase:watch-test';
+// A passing run starts its second iteration well within this.
+const SECOND_ITERATION_DEADLINE_MS: number = 20000;
+
+type IterationStatuses = ReadonlyMap<string, OperationStatus>;
+
+async function createRepositoryAsync(parentFolder: string): Promise<string> {
+  const repoPath: string = path.join(parentFolder, 'repo');
+  await fs.promises.cp(path.join(__dirname, 'basicAndRunBuildActionRepo'), repoPath, { recursive: true });
+  JsonFile.save(
+    {
+      commands: [
+        {
+          commandKind: 'phased',
+          name: COMMAND_NAME,
+          summary: 'Watch fixture',
+          phases: [PHASE_NAME],
+          enableParallelism: false,
+          safeForSimultaneousRushProcesses: true,
+          watchOptions: { alwaysWatch: true, debounceMs: 1, watchPhases: [PHASE_NAME] }
+        }
+      ],
+      phases: [{ name: PHASE_NAME, dependencies: { upstream: [PHASE_NAME] } }]
+    },
+    path.join(repoPath, 'common/config/rush/command-line.json')
+  );
+  JsonFile.save({}, path.join(repoPath, 'common/config/rush/npm-shrinkwrap.json'));
+  // The lines of `rush init`'s .gitignore that cover the files Rush writes during an iteration, so that they
+  // aren't inputs.
+  await fs.promises.writeFile(path.join(repoPath, '.gitignore'), '*.log\ncommon/temp/\n**/.rush/temp/\n');
+  for (const name of ['a', 'b']) {
+    const packageJsonPath: string = path.join(repoPath, name, 'package.json');
+    const packageJson: { scripts?: Record<string, string> } = JsonFile.load(packageJsonPath);
+    JsonFile.save({ ...packageJson, scripts: { [PHASE_NAME]: 'node watch-test.js' } }, packageJsonPath);
+    await fs.promises.writeFile(path.join(repoPath, name, 'watch-test.js'), 'process.exitCode = 0;\n');
+  }
+  // Failed Git commands still throw with their stderr.
+  execFileSync('git', ['init', '--quiet'], { cwd: repoPath, stdio: 'pipe' });
+  execFileSync('git', ['add', '.'], { cwd: repoPath, stdio: 'pipe' });
+  execFileSync(
+    'git',
+    [
+      '-c',
+      'user.name=Rush test',
+      '-c',
+      'user.email=rush-test@example.com',
+      '-c',
+      'commit.gpgSign=false',
+      'commit',
+      '--quiet',
+      '-m',
+      'Initialize watch fixture'
+    ],
+    { cwd: repoPath, stdio: 'pipe' }
+  );
+  return repoPath;
+}
+
+function getStatusesByName(results: ReadonlyMap<Operation, IOperationExecutionResult>): IterationStatuses {
+  return new Map(Array.from(results, ([operation, result]) => [operation.name, result.status]));
+}
+
+describe('RushCommandLineParser watch mode', () => {
+  const temporaryFolders: string[] = [];
+  let originalExitCode: string | number | undefined;
+  let lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire>;
+
+  beforeEach(() => {
+    originalExitCode = process.exitCode;
+    process.exitCode = undefined;
+    EnvironmentConfiguration.reset();
+    lockSpy = jest.spyOn(LockFile, 'tryAcquire');
+  });
+
+  afterEach(async () => {
+    try {
+      for (const result of lockSpy.mock.results) {
+        if (result.type === 'return' && result.value && !result.value.isReleased) {
+          result.value.release();
+        }
+      }
+      await Promise.all(
+        temporaryFolders.splice(0).map((folder) => fs.promises.rm(folder, { recursive: true, force: true }))
+      );
+    } finally {
+      process.exitCode = originalExitCode;
+      EnvironmentConfiguration.reset();
+      jest.restoreAllMocks();
+    }
+  });
+
+  // Covers PhasedScriptAction passing its snapshot provider to ProjectWatcher. Without the provider, the watcher
+  // can't find the edit below.
+  it('runs again for an input that changed while the first iteration ran', async () => {
+    const temporaryFolder: string = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'rush-watch-'));
+    temporaryFolders.push(temporaryFolder);
+    const repoPath: string = await createRepositoryAsync(temporaryFolder);
+    const editedInputPath: string = path.join(repoPath, 'a', 'watch-test.js');
+
+    const closedWatchers: Promise<unknown>[] = [];
+    const originalWatch: typeof fs.watch = fs.watch;
+    jest.spyOn(fs, 'watch').mockImplementation(((...args: Parameters<typeof fs.watch>) => {
+      const watcher: fs.FSWatcher = originalWatch(...args);
+      closedWatchers.push(once(watcher, 'close'));
+      return watcher;
+    }) as typeof fs.watch);
+
+    const parser: RushCommandLineParser = new RushCommandLineParser({ cwd: repoPath });
+    await new FlagFile(
+      parser.rushConfiguration.defaultSubspace.getSubspaceTempFolderPath(),
+      RushConstants.lastLinkFlagFilename,
+      {}
+    ).createAsync();
+    const action = parser.getAction(COMMAND_NAME);
+    if (!(action instanceof PhasedScriptAction)) {
+      throw new Error('Expected the production phased watch action');
+    }
+
+    const iterations: IterationStatuses[] = [];
+    let deadline: NodeJS.Timeout | undefined;
+    const stop = (): void => {
+      clearTimeout(deadline);
+      action.sessionAbortController.abort();
+    };
+    parser.rushSession.hooks.runPhasedCommand.for(COMMAND_NAME).tap('WatchTest', (command) => {
+      command.hooks.onGraphCreatedAsync.tap('WatchTest', (graph) => {
+        graph.hooks.beforeExecuteIterationAsync.tap('WatchTest', () => {
+          if (iterations.length === 0) {
+            // The watcher opens its file system watchers only when the graph goes idle, so no watcher sees
+            // this edit. Only the snapshot that the watcher takes at idle can find it.
+            fs.writeFileSync(editedInputPath, 'process.exitCode = 0; // edited\n');
+          }
+        });
+        graph.hooks.afterExecuteIterationAsync.tap('WatchTest', (status, results) => {
+          iterations.push(getStatusesByName(results));
+          return status;
+        });
+        graph.hooks.onIdle.tap({ name: 'WatchTest', stage: Number.MAX_SAFE_INTEGER }, () => {
+          if (iterations.length < 2) {
+            clearTimeout(deadline);
+            deadline = setTimeout(stop, SECOND_ITERATION_DEADLINE_MS);
+          } else {
+            stop();
+          }
+        });
+      });
+    });
+
+    try {
+      await expect(parser.executeAsync([COMMAND_NAME])).resolves.toBe(true);
+    } finally {
+      stop();
+      await Promise.all(closedWatchers);
+    }
+
+    expect(iterations).toEqual([
+      new Map([
+        ['a (watch-test)', OperationStatus.Success],
+        ['b (watch-test)', OperationStatus.Success]
+      ]),
+      new Map([
+        ['a (watch-test)', OperationStatus.Success],
+        ['b (watch-test)', OperationStatus.Success]
+      ])
+    ]);
+  }, 60000);
+});

From 30abc4092f355cb053fdd950d030c6fb5212efd9 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:57 +0000
Subject: [PATCH 173/265] [heft-webpack5-plugin] Tests hold the thread pool
 until the flush waits

Swarm integration step 158; original commit b4eee6082e (merge of swarm/r03-t217-nit1 at e0bb8a652d).
Scope: task 217.

Brings 217-nit1 (branch swarm/r03-t217-nit1). Second agent: o07 board 5456. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 4 of 12. Gate: ch01 GATE OK board 5753 (tree d86209aee4)

Commits folded into this step (1):
- e0bb8a652d [heft-webpack5-plugin] Tests hold the thread pool until the flush waits

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/DeferredWatchFileSystem.test.ts  | 125 +++++++++++++++---
 1 file changed, 105 insertions(+), 20 deletions(-)

diff --git a/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
index e06da7c901..35e6e1b48d 100644
--- a/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as child_process from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
@@ -29,10 +30,12 @@ interface IFlush {
 // Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
 const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
 
-// Enough work to keep a thread of the thread pool busy for about 100 ms.
+// Windows has no FIFOs, so there holdThreadPool() gives each thread about 100 ms of work instead, which can take
+// longer than flushAsync() waits on a machine whose CPUs are busy.
 const PBKDF2_ITERATIONS: number = 200000;
 
 describe(DeferredWatchFileSystem.name, () => {
+  let fifoPath: string | undefined;
   let folder: string;
   let watchOptions: WatchOptions;
   let onChange: jest.Mock<void, []>;
@@ -41,6 +44,24 @@ describe(DeferredWatchFileSystem.name, () => {
   let watcher: Watcher | undefined;
   let flushes: IFlush[];
   let compilationStartTimes: number[];
+  let releaseThreadPoolAsync: (() => Promise<void>) | undefined;
+
+  beforeAll(() => {
+    if (process.platform !== 'win32') {
+      const fifoFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack5-plugin-test-fifo-'));
+      fifoPath = path.join(fifoFolder, 'fifo');
+      child_process.execFileSync('mkfifo', [fifoPath]);
+    }
+  });
+
+  afterAll(() => {
+    if (fifoPath) {
+      // Not fs.rmSync(), which calls lstat on the FIFO. Until the next stat call, Node's fs.realpathSync() then
+      // returns some paths with their symlinks unresolved, and jest fails to require() a package that pnpm linked.
+      fs.unlinkSync(fifoPath);
+      fs.rmdirSync(path.dirname(fifoPath));
+    }
+  });
 
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack5-plugin-test-'));
@@ -51,9 +72,12 @@ describe(DeferredWatchFileSystem.name, () => {
     watcher = undefined;
     flushes = [];
     compilationStartTimes = [];
+    releaseThreadPoolAsync = undefined;
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    // For a test that failed while it held the thread pool
+    await releaseThreadPoolAsync?.();
     watcher?.close();
     fs.rmSync(folder, { recursive: true, force: true });
   });
@@ -116,11 +140,52 @@ describe(DeferredWatchFileSystem.name, () => {
   }
 
   /**
-   * Keeps every thread of the thread pool busy for a while, so that the `fs.readdir()` and `fs.lstat()` calls
-   * that the watcher makes next wait in the queue.
+   * Holds every thread of the thread pool until the returned function releases them, so that the `fs.readdir()`
+   * and `fs.lstat()` calls that the watcher makes next wait in the queue. The returned function resolves when the
+   * threads are free again. On Windows, the threads are only busy for a while (see `PBKDF2_ITERATIONS`).
    */
-  function occupyThreadPoolAsync(): Promise<void[]> {
+  function holdThreadPool(): () => Promise<void> {
     const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const releaseAsync: () => Promise<void> = fifoPath
+      ? holdThreadPoolWithFifo(fifoPath, threadCount)
+      : keepThreadPoolBusy(threadCount);
+    let releasePromise: Promise<void> | undefined;
+    releaseThreadPoolAsync = () => (releasePromise ??= releaseAsync());
+    return releaseThreadPoolAsync;
+  }
+
+  function holdThreadPoolWithFifo(fifo: string, threadCount: number): () => Promise<void> {
+    // Opening a FIFO for reading blocks the thread until something opens the FIFO for writing.
+    const fdPromises: Promise<number>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      fdPromises.push(
+        new Promise<number>((resolve, reject) => {
+          fs.open(fifo, 'r', (error, fd) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve(fd);
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      // Opening a FIFO for both reading and writing doesn't block on Linux or macOS, and it releases the threads.
+      // The FIFO stays open until every thread has opened it, so that none of them blocks again.
+      const writerFd: number = fs.openSync(fifo, 'r+');
+      try {
+        for (const fd of await Promise.all(fdPromises)) {
+          fs.closeSync(fd);
+        }
+      } finally {
+        fs.closeSync(writerFd);
+      }
+    };
+  }
+
+  function keepThreadPoolBusy(threadCount: number): () => Promise<void> {
     const tasks: Promise<void>[] = [];
     for (let i: number = 0; i < threadCount; i++) {
       tasks.push(
@@ -135,7 +200,20 @@ describe(DeferredWatchFileSystem.name, () => {
         })
       );
     }
-    return Promise.all(tasks);
+
+    return async () => {
+      await Promise.all(tasks);
+    };
+  }
+
+  /**
+   * Waits until a `flushAsync()` call that was just made is waiting for pending events. It checks for them for the
+   * first time on the second turn of the event loop after the call, so after three turns it is waiting.
+   */
+  async function waitForFlushToWaitAsync(): Promise<void> {
+    for (let i: number = 0; i < 3; i++) {
+      await setImmediateAsync();
+    }
   }
 
   it('returns false before watch() is called', async () => {
@@ -156,14 +234,16 @@ describe(DeferredWatchFileSystem.name, () => {
   itOnLinux('includes a file that was written just before the call', async () => {
     const file: string = createFile('a.js');
     await watchAndWaitForScanAsync([file]);
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     fs.writeFileSync(file, 'changed');
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
     expect(purge).toHaveBeenCalledWith(file);
-    await busyThreadPool;
     await setTimeoutAsync(50);
     expect(onChange).not.toHaveBeenCalled();
   });
@@ -171,17 +251,19 @@ describe(DeferredWatchFileSystem.name, () => {
   itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
     const file: string = createFile('a.js');
     await watchAndWaitForScanAsync([file]);
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     fs.writeFileSync(file, 'changed');
     await waitForAsync(() =>
       getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
     );
     expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
-    await busyThreadPool;
   });
 
   itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
@@ -218,14 +300,15 @@ describe(DeferredWatchFileSystem.name, () => {
 
       fs.writeFileSync(fileA, 'changed');
       await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
-      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
-      const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+      const releaseAsync: () => Promise<void> = holdThreadPool();
       fs.writeFileSync(fileB, 'changed');
-      await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+      const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      await waitForAsync(() => aggregatedCount > 0);
+      await releaseAsync();
+      await expect(flushPromise).resolves.toBe(true);
 
-      expect(aggregatedCount).toBeGreaterThanOrEqual(1);
       expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
-      await busyThreadPool;
       await setTimeoutAsync(50);
       expect(onChange).not.toHaveBeenCalled();
     }
@@ -262,15 +345,17 @@ describe(DeferredWatchFileSystem.name, () => {
     fs.mkdirSync(subfolder);
     const file: string = path.join(subfolder, 'a.js');
     fs.writeFileSync(file, 'new');
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     // A start time before the file was written, as for a file that changed during the compilation.
     watch([file], Date.now() - 60000);
     expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
-    await busyThreadPool;
   });
 
   it('returns false when the watcher is closed while it waits', async () => {

From dbda68dd9dd18ca1d82534ea697b85e92fcbb866 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:57 +0000
Subject: [PATCH 174/265] [heft-rspack-plugin] Wait for pending watch events in
 the Rspack and Webpack 4 plugins

Swarm integration step 159; original commit 80b28226f8 (merge of swarm/r01-t244 at f7de575da0).
Scope: task 244.

Brings 244 (branch swarm/r01-t244). Second agent: o08 board 5409. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 5 of 12. Gate: ch01 GATE OK board 5753 (tree d95353ddd1)

Commits folded into this step (1):
- f7de575da0 Wait for pending watch events in the Rspack and Webpack 4 plugins

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...k-plugin-watch-flush_2026-09-29-11-55.json |  11 +
 ...4-plugin-watch-flush_2026-09-29-11-55.json |  11 +
 .../src/DeferredWatchFileSystem.ts            | 127 +++++++-
 .../heft-rspack-plugin/src/RspackPlugin.ts    |   3 +-
 .../src/test/DeferredWatchFileSystem.test.ts  | 307 ++++++++++++++++++
 .../src/DeferredWatchFileSystem.test.ts       | 306 +++++++++++++++++
 .../src/DeferredWatchFileSystem.ts            | 127 +++++++-
 .../src/Webpack4Plugin.ts                     |   3 +-
 8 files changed, 891 insertions(+), 4 deletions(-)
 create mode 100644 common/changes/@rushstack/heft-rspack-plugin/heft-rspack-plugin-watch-flush_2026-09-29-11-55.json
 create mode 100644 common/changes/@rushstack/heft-webpack4-plugin/heft-webpack4-plugin-watch-flush_2026-09-29-11-55.json
 create mode 100644 heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
 create mode 100644 heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts

diff --git a/common/changes/@rushstack/heft-rspack-plugin/heft-rspack-plugin-watch-flush_2026-09-29-11-55.json b/common/changes/@rushstack/heft-rspack-plugin/heft-rspack-plugin-watch-flush_2026-09-29-11-55.json
new file mode 100644
index 0000000000..d28917b823
--- /dev/null
+++ b/common/changes/@rushstack/heft-rspack-plugin/heft-rspack-plugin-watch-flush_2026-09-29-11-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-rspack-plugin",
+      "comment": "Fix an issue in watch mode where Rspack could miss a file that an upstream task had just written, which made the Rspack task report \"Rspack has not detected changes\" and start another run later. Before it resumes the compilation, the plugin now waits for the file watcher to finish recording the changes it has already seen, for up to 1 second. This also fixes an extra compilation that could start after a compilation that included a change recorded in the same millisecond that the compilation started.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-rspack-plugin",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/heft-webpack4-plugin/heft-webpack4-plugin-watch-flush_2026-09-29-11-55.json b/common/changes/@rushstack/heft-webpack4-plugin/heft-webpack4-plugin-watch-flush_2026-09-29-11-55.json
new file mode 100644
index 0000000000..56407f6c25
--- /dev/null
+++ b/common/changes/@rushstack/heft-webpack4-plugin/heft-webpack4-plugin-watch-flush_2026-09-29-11-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-webpack4-plugin",
+      "comment": "Fix an issue in watch mode where Webpack could miss a file that an upstream task had just written, which made the Webpack task report \"Webpack has not detected changes\" and start another run later. Before it resumes the compilation, the plugin now waits for the file watcher to finish recording the changes it has already seen, for up to 1 second. This also fixes an extra compilation that could start after a compilation that included a change recorded in the same millisecond that the compilation started.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-webpack4-plugin",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts b/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts
index 6b57c2d3fd..86ab74832f 100644
--- a/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts
+++ b/heft-plugins/heft-rspack-plugin/src/DeferredWatchFileSystem.ts
@@ -1,9 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
 import Watchpack, { type WatchOptions } from 'watchpack';
 import type { Compiler, RspackPluginInstance, WatchFileSystem } from '@rspack/core';
 
+/**
+ * The longest time that {@link DeferredWatchFileSystem.flushAsync} waits for watchpack to finish recording the
+ * file system events that it has received.
+ */
+const MAX_PENDING_EVENTS_WAIT_MS: number = 1000;
+const PENDING_EVENTS_POLL_INTERVAL_MS: number = 1;
+
 // InputFileSystem type is defined inline since it's not exported from @rspack/core
 // missing re-export here: https://github.com/web-infra-dev/rspack/blob/9542b49ad43f91ecbcb37ff277e0445e67b99967/packages/rspack/src/exports.ts#L133
 // type definition here: https://github.com/web-infra-dev/rspack/blob/9542b49ad43f91ecbcb37ff277e0445e67b99967/packages/rspack/src/util/fs.ts#L496
@@ -47,6 +57,33 @@ interface ITimeInfoEntries {
   contextTimeInfoEntries: FileSystemMap;
 }
 
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that show whether it is still recording a change.
+ * They aren't part of watchpack's public API, so they are all optional.
+ */
+interface IDirectoryWatcherInternals {
+  /**
+   * True while the watcher reads the directory. Changes that the scan finds are recorded as it goes.
+   */
+  scanning?: boolean;
+  /**
+   * The names of the files that have an OS event whose `fs.lstat()` hasn't finished yet. The change is
+   * recorded only when the `fs.lstat()` finishes.
+   */
+  _activeEvents?: Map<string, boolean>;
+}
+
+/**
+ * A watchpack instance with the internal state that {@link DeferredWatchFileSystem.flushAsync} inspects.
+ * Every watchpack instance that is created with the same options object shares one watcher manager, which
+ * removes a directory watcher from `directoryWatchers` when the watcher closes.
+ */
+interface IWatchpackWithInternals extends Watchpack {
+  watcherManager?: {
+    directoryWatchers?: Map<string, IDirectoryWatcherInternals>;
+  };
+}
+
 export class DeferredWatchFileSystem implements WatchFileSystem {
   public readonly inputFileSystem: InputFileSystem;
   public readonly watcherOptions: WatchOptions;
@@ -54,6 +91,7 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
 
   readonly #onChange: () => void;
   #state: IWatchState | undefined;
+  #isFlushing: boolean = false;
 
   public constructor(inputFileSystem: InputFileSystem, onChange: () => void) {
     this.inputFileSystem = inputFileSystem;
@@ -106,6 +144,40 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     return false;
   }
 
+  /**
+   * Like {@link DeferredWatchFileSystem.flush}, but first lets watchpack finish recording the file system events
+   * that it has already received.
+   *
+   * @remarks
+   * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a file that an upstream
+   * task wrote just before a call to `flush()` can be missing from the changes. This method waits until the
+   * directory watchers have no events or scans in progress, for up to 1 second. If there are changes, it then
+   * waits for the clock to pass the time when they were recorded. The compilation that the callback starts takes
+   * its start time from the clock, and the next `watch()` call reports every change recorded at or after that
+   * start time again, as "outdated on attach".
+   *
+   * While this method waits, it keeps the changes that the watcher reports for the flush, and doesn't call
+   * `onChange` for them.
+   */
+  public async flushAsync(): Promise<boolean> {
+    if (!this.#state) {
+      return false;
+    }
+
+    this.#isFlushing = true;
+    try {
+      await this.#waitForPendingEventsAsync();
+      if (!this.watcher) {
+        // The watcher was closed while this method waited.
+        return false;
+      }
+
+      return this.flush();
+    } finally {
+      this.#isFlushing = false;
+    }
+  }
+
   public watch(
     files: Iterable<string>,
     directories: Iterable<string>,
@@ -138,7 +210,11 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
         removals.add(removal);
       }
 
-      this.#onChange();
+      // flushAsync() passes these changes to the callback when it finishes waiting, so they don't need
+      // another run.
+      if (!this.#isFlushing) {
+        this.#onChange();
+      }
     });
 
     this.watcher.watch({
@@ -187,6 +263,55 @@ export class DeferredWatchFileSystem implements WatchFileSystem {
     };
   }
 
+  async #waitForPendingEventsAsync(): Promise<void> {
+    // Let the event loop reach its poll phase, which delivers the OS events that were already queued when
+    // flushAsync() was called. If flushAsync() was called during a poll phase, the first check phase comes
+    // before the next poll phase, so it takes two turns.
+    await setImmediateAsync();
+    await setImmediateAsync();
+
+    const deadline: number = performance.now() + MAX_PENDING_EVENTS_WAIT_MS;
+    while (this.#hasPendingEvents() && performance.now() < deadline) {
+      await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+    }
+
+    if (this.#hasChanges()) {
+      // Watchpack stamps each change with Date.now() when it records it, and Rspack takes the start time that it
+      // passes to the next watch() from Date.now() as well. If they are equal, the next watch() reports the change
+      // again.
+      const recordedTime: number = Date.now();
+      while (Date.now() <= recordedTime) {
+        await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+      }
+    }
+  }
+
+  #hasPendingEvents(): boolean {
+    const directoryWatchers: Map<string, IDirectoryWatcherInternals> | undefined = (
+      this.watcher as IWatchpackWithInternals | undefined
+    )?.watcherManager?.directoryWatchers;
+    if (!(directoryWatchers instanceof Map)) {
+      return false;
+    }
+
+    for (const directoryWatcher of directoryWatchers.values()) {
+      if (directoryWatcher.scanning || (directoryWatcher._activeEvents?.size ?? 0) > 0) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  #hasChanges(): boolean {
+    const state: IWatchState | undefined = this.#state;
+    const watcher: Watchpack | undefined = this.watcher;
+    return (
+      (!!state && (state.changes.size > 0 || state.removals.size > 0)) ||
+      (!!watcher && (watcher.aggregatedChanges.size > 0 || watcher.aggregatedRemovals.size > 0))
+    );
+  }
+
   #fetchTimeInfo(): ITimeInfoEntries {
     const fileTimeInfoEntries: IRawFileSystemMap = new Map();
     const contextTimeInfoEntries: IRawFileSystemMap = new Map();
diff --git a/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts b/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts
index 06ca57fae6..e5611ca5dc 100644
--- a/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts
+++ b/heft-plugins/heft-rspack-plugin/src/RspackPlugin.ts
@@ -415,7 +415,8 @@ export default class RspackPlugin implements IHeftTaskPlugin<IRspackPluginOption
     if (!isInitial && this.#watchFileSystems) {
       hasChanges = false;
       for (const watchFileSystem of this.#watchFileSystems) {
-        hasChanges = watchFileSystem.flush() || hasChanges;
+        // The upstream tasks may have just written files that the watcher has seen but not recorded yet.
+        hasChanges = (await watchFileSystem.flushAsync()) || hasChanges;
       }
     }
 
diff --git a/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
new file mode 100644
index 0000000000..ee43996eb9
--- /dev/null
+++ b/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -0,0 +1,307 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import type { WatchOptions } from 'watchpack';
+
+import { DeferredWatchFileSystem, type InputFileSystem, type Watcher } from '../DeferredWatchFileSystem';
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that these tests read or set.
+ */
+interface IDirectoryWatcherInternals {
+  scanning: boolean;
+  _activeEvents: Map<string, boolean>;
+}
+
+interface IFlush {
+  changes: string[];
+  removals: string[];
+}
+
+// On Linux, inotify queues the event for a write during the write, so the event loop delivers it on its next poll.
+// Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+// Enough work to keep a thread of the thread pool busy for about 100 ms.
+const PBKDF2_ITERATIONS: number = 200000;
+
+describe(DeferredWatchFileSystem.name, () => {
+  let folder: string;
+  let watchOptions: WatchOptions;
+  let onChange: jest.Mock<void, []>;
+  let purge: jest.Mock<void, [string]>;
+  let watchFileSystem: DeferredWatchFileSystem;
+  let watcher: Watcher | undefined;
+  let flushes: IFlush[];
+  let compilationStartTimes: number[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-rspack-plugin-test-'));
+    watchOptions = { aggregateTimeout: 20 };
+    onChange = jest.fn();
+    purge = jest.fn();
+    watchFileSystem = new DeferredWatchFileSystem({ purge } as unknown as InputFileSystem, onChange);
+    watcher = undefined;
+    flushes = [];
+    compilationStartTimes = [];
+  });
+
+  afterEach(() => {
+    watcher?.close();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createFile(name: string): string {
+    const filePath: string = path.join(folder, name);
+    fs.writeFileSync(filePath, 'initial');
+    // An old modification time, so that the first scan doesn't report the file as changed.
+    const past: Date = new Date(Date.now() - 60000);
+    fs.utimesSync(filePath, past, past);
+    return filePath;
+  }
+
+  /**
+   * Watches the files as Rspack's `Watching` does. When a flush calls back, the callback takes the start time for
+   * the next watch() from the clock and pauses the watcher, as `Watching.#go()` does.
+   */
+  function watch(files: string[], startTime: number): void {
+    watcher = watchFileSystem.watch(
+      files,
+      [],
+      [],
+      startTime,
+      watchOptions,
+      (error, fileTimeInfoEntries, contextTimeInfoEntries, changes, removals) => {
+        compilationStartTimes.push(Date.now());
+        watcher?.pause();
+        flushes.push({
+          changes: Array.from(changes ?? []).sort(),
+          removals: Array.from(removals ?? []).sort()
+        });
+      },
+      () => {
+        // Rspack's undelayed callback isn't used.
+      }
+    );
+  }
+
+  function getDirectoryWatchers(): IDirectoryWatcherInternals[] {
+    const internals: { watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> } } =
+      watchFileSystem.watcher as unknown as {
+        watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> };
+      };
+    return Array.from(internals.watcherManager.directoryWatchers.values());
+  }
+
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = performance.now() + 5000;
+    while (!condition()) {
+      if (performance.now() > deadline) {
+        throw new Error('The condition was not met within 5 seconds');
+      }
+      await setImmediateAsync();
+    }
+  }
+
+  async function watchAndWaitForScanAsync(files: string[]): Promise<void> {
+    watch(files, Date.now());
+    await waitForAsync(() => getDirectoryWatchers().every((directoryWatcher) => !directoryWatcher.scanning));
+  }
+
+  /**
+   * Keeps every thread of the thread pool busy for a while, so that the `fs.readdir()` and `fs.lstat()` calls
+   * that the watcher makes next wait in the queue.
+   */
+  function occupyThreadPoolAsync(): Promise<void[]> {
+    const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const tasks: Promise<void>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      tasks.push(
+        new Promise<void>((resolve, reject) => {
+          crypto.pbkdf2('password', 'salt', PBKDF2_ITERATIONS, 64, 'sha512', (error) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve();
+            }
+          });
+        })
+      );
+    }
+    return Promise.all(tasks);
+  }
+
+  it('returns false before watch() is called', async () => {
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+  });
+
+  it('returns false and calls back nothing when nothing changed', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+
+    await setTimeoutAsync(50);
+    expect(flushes).toEqual([]);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file that was written just before the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    fs.writeFileSync(file, 'changed');
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    expect(purge).toHaveBeenCalledWith(file);
+    await busyThreadPool;
+    await setTimeoutAsync(50);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    fs.writeFileSync(file, 'changed');
+    await waitForAsync(() =>
+      getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
+    );
+    expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    await busyThreadPool;
+  });
+
+  itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    // An fs callback runs in the poll phase, after the event loop has collected the events that were ready, so
+    // the event for this write can't arrive before the next poll phase.
+    const flushPromise: Promise<boolean> = new Promise<boolean>((resolve, reject) => {
+      fs.stat(file, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          fs.writeFileSync(file, 'changed');
+          resolve(watchFileSystem.flushAsync());
+        }
+      });
+    });
+
+    await expect(flushPromise).resolves.toBe(true);
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux(
+    'keeps the changes that the watcher reports while it waits, without calling onChange',
+    async () => {
+      const fileA: string = createFile('a.js');
+      const fileB: string = createFile('b.js');
+      await watchAndWaitForScanAsync([fileA, fileB]);
+      let aggregatedCount: number = 0;
+      watchFileSystem.watcher!.on('aggregated', () => {
+        aggregatedCount++;
+      });
+
+      fs.writeFileSync(fileA, 'changed');
+      await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+      fs.writeFileSync(fileB, 'changed');
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+      expect(aggregatedCount).toBeGreaterThanOrEqual(1);
+      expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
+      await busyThreadPool;
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  itOnLinux(
+    'starts the compilation after the changes it passes, so the next watch() does not report them again',
+    async () => {
+      const file: string = createFile('a.js');
+      await watchAndWaitForScanAsync([file]);
+
+      const reportedAgain: number[] = [];
+      for (let i: number = 0; i < 10; i++) {
+        fs.writeFileSync(file, `change ${i}`);
+        await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(file));
+        await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+        // When the compilation is done, Rspack's Watching calls watch() again with the start time that it took when
+        // the flush called back. The new watcher reports every change that was recorded at or after that time, as
+        // "outdated on attach".
+        watch([file], compilationStartTimes[i]);
+        await setImmediateAsync();
+        reportedAgain.push(watchFileSystem.watcher!.aggregatedChanges.size);
+      }
+
+      expect(reportedAgain).toEqual(new Array(10).fill(0));
+      expect(flushes).toHaveLength(10);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  it('includes a change that a scan in progress finds', async () => {
+    const subfolder: string = path.join(folder, 'sub');
+    fs.mkdirSync(subfolder);
+    const file: string = path.join(subfolder, 'a.js');
+    fs.writeFileSync(file, 'new');
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    // A start time before the file was written, as for a file that changed during the compilation.
+    watch([file], Date.now() - 60000);
+    expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    await busyThreadPool;
+  });
+
+  it('returns false when the watcher is closed while it waits', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    watcher!.close();
+
+    await expect(flushPromise).resolves.toBe(false);
+    expect(flushes).toEqual([]);
+  });
+
+  it('stops waiting after 1 second', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const directoryWatcher: IDirectoryWatcherInternals = getDirectoryWatchers()[0];
+    // An event whose fs.lstat() never finishes
+    directoryWatcher._activeEvents.set('never-finishes.js', false);
+
+    try {
+      const startTime: number = performance.now();
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+      const elapsedMs: number = performance.now() - startTime;
+
+      expect(elapsedMs).toBeGreaterThanOrEqual(999);
+      expect(elapsedMs).toBeLessThan(3000);
+    } finally {
+      directoryWatcher._activeEvents.delete('never-finishes.js');
+    }
+  });
+});
diff --git a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
new file mode 100644
index 0000000000..ec22d6fa84
--- /dev/null
+++ b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
@@ -0,0 +1,306 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import type { WatchOptions } from 'watchpack';
+
+import { DeferredWatchFileSystem, type IWatch } from './DeferredWatchFileSystem';
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that these tests read or set.
+ */
+interface IDirectoryWatcherInternals {
+  scanning: boolean;
+  _activeEvents: Map<string, boolean>;
+}
+
+interface IFlush {
+  changes: string[];
+  removals: string[];
+}
+
+// On Linux, inotify queues the event for a write during the write, so the event loop delivers it on its next poll.
+// Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+// Enough work to keep a thread of the thread pool busy for about 100 ms.
+const PBKDF2_ITERATIONS: number = 200000;
+
+describe(DeferredWatchFileSystem.name, () => {
+  let folder: string;
+  let watchOptions: WatchOptions;
+  let onChange: jest.Mock<void, []>;
+  let purge: jest.Mock<void, [string[]]>;
+  let watchFileSystem: DeferredWatchFileSystem;
+  let watcher: IWatch | undefined;
+  let flushes: IFlush[];
+  let compilationStartTimes: number[];
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack4-plugin-test-'));
+    watchOptions = { aggregateTimeout: 20 };
+    onChange = jest.fn();
+    purge = jest.fn();
+    watchFileSystem = new DeferredWatchFileSystem({ purge }, onChange);
+    watcher = undefined;
+    flushes = [];
+    compilationStartTimes = [];
+  });
+
+  afterEach(() => {
+    watcher?.close();
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function createFile(name: string): string {
+    const filePath: string = path.join(folder, name);
+    fs.writeFileSync(filePath, 'initial');
+    // An old modification time, so that the first scan doesn't report the file as changed.
+    const past: Date = new Date(Date.now() - 60000);
+    fs.utimesSync(filePath, past, past);
+    return filePath;
+  }
+
+  /**
+   * Watches the files as webpack's `Watching` does. When a flush calls back, the callback takes the start time of
+   * the compilation from the clock, as `Watching._go()` does. Webpack 4 doesn't pause the watcher there, because
+   * its callback clears `Watching.watcher` before it calls `_invalidate()`.
+   */
+  function watch(files: string[], startTime: number): void {
+    watcher = watchFileSystem.watch(
+      files,
+      [],
+      [],
+      startTime,
+      watchOptions,
+      (error, changedFiles, changedDirs, changedMissing, fileTimes, dirTimes, removals) => {
+        compilationStartTimes.push(Date.now());
+        flushes.push({
+          changes: changedFiles.slice().sort(),
+          removals: Array.from(removals).sort()
+        });
+      },
+      () => {
+        // Webpack's undelayed callback isn't used.
+      }
+    );
+  }
+
+  function getDirectoryWatchers(): IDirectoryWatcherInternals[] {
+    const internals: { watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> } } =
+      watchFileSystem.watcher as unknown as {
+        watcherManager: { directoryWatchers: Map<string, IDirectoryWatcherInternals> };
+      };
+    return Array.from(internals.watcherManager.directoryWatchers.values());
+  }
+
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = performance.now() + 5000;
+    while (!condition()) {
+      if (performance.now() > deadline) {
+        throw new Error('The condition was not met within 5 seconds');
+      }
+      await setImmediateAsync();
+    }
+  }
+
+  async function watchAndWaitForScanAsync(files: string[]): Promise<void> {
+    watch(files, Date.now());
+    await waitForAsync(() => getDirectoryWatchers().every((directoryWatcher) => !directoryWatcher.scanning));
+  }
+
+  /**
+   * Keeps every thread of the thread pool busy for a while, so that the `fs.readdir()` and `fs.lstat()` calls
+   * that the watcher makes next wait in the queue.
+   */
+  function occupyThreadPoolAsync(): Promise<void[]> {
+    const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const tasks: Promise<void>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      tasks.push(
+        new Promise<void>((resolve, reject) => {
+          crypto.pbkdf2('password', 'salt', PBKDF2_ITERATIONS, 64, 'sha512', (error) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve();
+            }
+          });
+        })
+      );
+    }
+    return Promise.all(tasks);
+  }
+
+  it('returns false before watch() is called', async () => {
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+  });
+
+  it('returns false and calls back nothing when nothing changed', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+
+    await setTimeoutAsync(50);
+    expect(flushes).toEqual([]);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file that was written just before the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    fs.writeFileSync(file, 'changed');
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    expect(purge).toHaveBeenCalledWith([file]);
+    await busyThreadPool;
+    await setTimeoutAsync(50);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    fs.writeFileSync(file, 'changed');
+    await waitForAsync(() =>
+      getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
+    );
+    expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    await busyThreadPool;
+  });
+
+  itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    // An fs callback runs in the poll phase, after the event loop has collected the events that were ready, so
+    // the event for this write can't arrive before the next poll phase.
+    const flushPromise: Promise<boolean> = new Promise<boolean>((resolve, reject) => {
+      fs.stat(file, (error) => {
+        if (error) {
+          reject(error);
+        } else {
+          fs.writeFileSync(file, 'changed');
+          resolve(watchFileSystem.flushAsync());
+        }
+      });
+    });
+
+    await expect(flushPromise).resolves.toBe(true);
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+  });
+
+  itOnLinux(
+    'keeps the changes that the watcher reports while it waits, without calling onChange',
+    async () => {
+      const fileA: string = createFile('a.js');
+      const fileB: string = createFile('b.js');
+      await watchAndWaitForScanAsync([fileA, fileB]);
+      let aggregatedCount: number = 0;
+      watchFileSystem.watcher!.on('aggregated', () => {
+        aggregatedCount++;
+      });
+
+      fs.writeFileSync(fileA, 'changed');
+      await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+      fs.writeFileSync(fileB, 'changed');
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+      expect(aggregatedCount).toBeGreaterThanOrEqual(1);
+      expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
+      await busyThreadPool;
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  itOnLinux(
+    'starts the compilation after the changes it passes, so the next watch() does not report them again',
+    async () => {
+      const file: string = createFile('a.js');
+      await watchAndWaitForScanAsync([file]);
+
+      const reportedAgain: number[] = [];
+      for (let i: number = 0; i < 10; i++) {
+        fs.writeFileSync(file, `change ${i}`);
+        await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(file));
+        await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+        // When the compilation is done, webpack's Watching calls watch() again with the compilation's start time.
+        // The new watcher reports every change that was recorded at or after that time, as "outdated on attach".
+        watch([file], compilationStartTimes[i]);
+        await setImmediateAsync();
+        reportedAgain.push(watchFileSystem.watcher!.aggregatedChanges.size);
+      }
+
+      expect(reportedAgain).toEqual(new Array(10).fill(0));
+      expect(flushes).toHaveLength(10);
+      await setTimeoutAsync(50);
+      expect(onChange).not.toHaveBeenCalled();
+    }
+  );
+
+  it('includes a change that a scan in progress finds', async () => {
+    const subfolder: string = path.join(folder, 'sub');
+    fs.mkdirSync(subfolder);
+    const file: string = path.join(subfolder, 'a.js');
+    fs.writeFileSync(file, 'new');
+    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+
+    // A start time before the file was written, as for a file that changed during the compilation.
+    watch([file], Date.now() - 60000);
+    expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
+    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+
+    expect(flushes).toEqual([{ changes: [file], removals: [] }]);
+    await busyThreadPool;
+  });
+
+  it('returns false when the watcher is closed while it waits', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+
+    fs.writeFileSync(file, 'changed');
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    watcher!.close();
+
+    await expect(flushPromise).resolves.toBe(false);
+    expect(flushes).toEqual([]);
+  });
+
+  it('stops waiting after 1 second', async () => {
+    const file: string = createFile('a.js');
+    await watchAndWaitForScanAsync([file]);
+    const directoryWatcher: IDirectoryWatcherInternals = getDirectoryWatchers()[0];
+    // An event whose fs.lstat() never finishes
+    directoryWatcher._activeEvents.set('never-finishes.js', false);
+
+    try {
+      const startTime: number = performance.now();
+      await expect(watchFileSystem.flushAsync()).resolves.toBe(false);
+      const elapsedMs: number = performance.now() - startTime;
+
+      expect(elapsedMs).toBeGreaterThanOrEqual(999);
+      expect(elapsedMs).toBeLessThan(3000);
+    } finally {
+      directoryWatcher._activeEvents.delete('never-finishes.js');
+    }
+  });
+});
diff --git a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts
index d0f719a204..fa51e964dc 100644
--- a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts
+++ b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.ts
@@ -1,9 +1,19 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { performance } from 'node:perf_hooks';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
 import Watchpack, { type WatchOptions } from 'watchpack';
 import type { Compiler, Plugin } from 'webpack';
 
+/**
+ * The longest time that {@link DeferredWatchFileSystem.flushAsync} waits for watchpack to finish recording the
+ * file system events that it has received.
+ */
+const MAX_PENDING_EVENTS_WAIT_MS: number = 1000;
+const PENDING_EVENTS_POLL_INTERVAL_MS: number = 1;
+
 export interface IPurgeable {
   purge?: (changes: string[]) => void;
 }
@@ -62,6 +72,33 @@ export interface IWatchFileSystem {
   ): IWatch;
 }
 
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that show whether it is still recording a change.
+ * They aren't part of watchpack's public API, so they are all optional.
+ */
+interface IDirectoryWatcherInternals {
+  /**
+   * True while the watcher reads the directory. Changes that the scan finds are recorded as it goes.
+   */
+  scanning?: boolean;
+  /**
+   * The names of the files that have an OS event whose `fs.lstat()` hasn't finished yet. The change is
+   * recorded only when the `fs.lstat()` finishes.
+   */
+  _activeEvents?: Map<string, boolean>;
+}
+
+/**
+ * A watchpack instance with the internal state that {@link DeferredWatchFileSystem.flushAsync} inspects.
+ * Every watchpack instance that is created with the same options object shares one watcher manager, which
+ * removes a directory watcher from `directoryWatchers` when the watcher closes.
+ */
+interface IWatchpackWithInternals extends Watchpack {
+  watcherManager?: {
+    directoryWatchers?: Map<string, IDirectoryWatcherInternals>;
+  };
+}
+
 export class DeferredWatchFileSystem implements IWatchFileSystem {
   public readonly inputFileSystem: IPurgeable;
   public readonly watcherOptions: WatchOptions;
@@ -69,6 +106,7 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
 
   readonly #onChange: () => void;
   #state: IWatchState | undefined;
+  #isFlushing: boolean = false;
 
   public constructor(inputFileSystem: IPurgeable, onChange: () => void) {
     this.inputFileSystem = inputFileSystem;
@@ -121,6 +159,40 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
     return false;
   }
 
+  /**
+   * Like {@link DeferredWatchFileSystem.flush}, but first lets watchpack finish recording the file system events
+   * that it has already received.
+   *
+   * @remarks
+   * Watchpack records a changed file only after an asynchronous `fs.lstat()` of it, so a file that an upstream
+   * task wrote just before a call to `flush()` can be missing from the changes. This method waits until the
+   * directory watchers have no events or scans in progress, for up to 1 second. If there are changes, it then
+   * waits for the clock to pass the time when they were recorded. The compilation that the callback starts takes
+   * its start time from the clock, and the next `watch()` call reports every change recorded at or after that
+   * start time again, as "outdated on attach".
+   *
+   * While this method waits, it keeps the changes that the watcher reports for the flush, and doesn't call
+   * `onChange` for them.
+   */
+  public async flushAsync(): Promise<boolean> {
+    if (!this.#state) {
+      return false;
+    }
+
+    this.#isFlushing = true;
+    try {
+      await this.#waitForPendingEventsAsync();
+      if (!this.watcher) {
+        // The watcher was closed while this method waited.
+        return false;
+      }
+
+      return this.flush();
+    } finally {
+      this.#isFlushing = false;
+    }
+  }
+
   public watch(
     files: string[],
     directories: string[],
@@ -158,7 +230,11 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
         removals.add(removal);
       }
 
-      this.#onChange();
+      // flushAsync() passes these changes to the callback when it finishes waiting, so they don't need
+      // another run.
+      if (!this.#isFlushing) {
+        this.#onChange();
+      }
     });
 
     watcher.watch({
@@ -194,6 +270,55 @@ export class DeferredWatchFileSystem implements IWatchFileSystem {
       }
     };
   }
+
+  async #waitForPendingEventsAsync(): Promise<void> {
+    // Let the event loop reach its poll phase, which delivers the OS events that were already queued when
+    // flushAsync() was called. If flushAsync() was called during a poll phase, the first check phase comes
+    // before the next poll phase, so it takes two turns.
+    await setImmediateAsync();
+    await setImmediateAsync();
+
+    const deadline: number = performance.now() + MAX_PENDING_EVENTS_WAIT_MS;
+    while (this.#hasPendingEvents() && performance.now() < deadline) {
+      await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+    }
+
+    if (this.#hasChanges()) {
+      // Watchpack stamps each change with Date.now() when it records it, and webpack takes the start time of the
+      // compilation, which it passes to the next watch(), from Date.now() as well. If they are equal, the next
+      // watch() reports the change again.
+      const recordedTime: number = Date.now();
+      while (Date.now() <= recordedTime) {
+        await setTimeoutAsync(PENDING_EVENTS_POLL_INTERVAL_MS);
+      }
+    }
+  }
+
+  #hasPendingEvents(): boolean {
+    const directoryWatchers: Map<string, IDirectoryWatcherInternals> | undefined = (
+      this.watcher as IWatchpackWithInternals | undefined
+    )?.watcherManager?.directoryWatchers;
+    if (!(directoryWatchers instanceof Map)) {
+      return false;
+    }
+
+    for (const directoryWatcher of directoryWatchers.values()) {
+      if (directoryWatcher.scanning || (directoryWatcher._activeEvents?.size ?? 0) > 0) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  #hasChanges(): boolean {
+    const state: IWatchState | undefined = this.#state;
+    const watcher: Watchpack | undefined = this.watcher;
+    return (
+      (!!state && (state.changes.size > 0 || state.removals.size > 0)) ||
+      (!!watcher && (watcher.aggregatedChanges.size > 0 || watcher.aggregatedRemovals.size > 0))
+    );
+  }
 }
 
 export class OverrideNodeWatchFSPlugin implements Plugin {
diff --git a/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts b/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts
index c8d9fc7cff..aa37b8f2e0 100644
--- a/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts
+++ b/heft-plugins/heft-webpack4-plugin/src/Webpack4Plugin.ts
@@ -399,7 +399,8 @@ export default class Webpack4Plugin implements IHeftTaskPlugin<IWebpackPluginOpt
     if (!isInitial && this.#watchFileSystems) {
       hasChanges = false;
       for (const watchFileSystem of this.#watchFileSystems) {
-        hasChanges = watchFileSystem.flush() || hasChanges;
+        // The upstream tasks may have just written files that the watcher has seen but not recorded yet.
+        hasChanges = (await watchFileSystem.flushAsync()) || hasChanges;
       }
     }
 

From 3009e26d1f6a9d92e10f327a0aca8513113fe0fc Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:57 +0000
Subject: [PATCH 175/265] [node-core-library] Don't run ps for the lockfile of
 a process that exited on Linux

Swarm integration step 160; original commit dbab9e1822 (merge of swarm/r07-t263-int at 750bb1e56d).
Scope: task 263.

Brings 263-int (branch swarm/r07-t263-int). Second agent: t06 board 5471, board 5474. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 6 of 12. Gate: ch01 GATE OK board 5753 (tree 56932ba7f5)

Commits folded into this step (1):
- 750bb1e56d [node-core-library] Don't run ps for the lockfile of a process that exited on Linux

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../lockfile-exited-process_2026-09-29.json   |  10 ++
 libraries/node-core-library/src/LockFile.ts   |  84 ++++++---
 .../src/test/LockFile.test.ts                 | 159 +++++++++++++++++-
 3 files changed, 228 insertions(+), 25 deletions(-)
 create mode 100644 common/changes/@rushstack/node-core-library/lockfile-exited-process_2026-09-29.json

diff --git a/common/changes/@rushstack/node-core-library/lockfile-exited-process_2026-09-29.json b/common/changes/@rushstack/node-core-library/lockfile-exited-process_2026-09-29.json
new file mode 100644
index 0000000000..13f13c8c5b
--- /dev/null
+++ b/common/changes/@rushstack/node-core-library/lockfile-exited-process_2026-09-29.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/node-core-library",
+      "comment": "On Linux, `LockFile` no longer runs a `ps` command for the lockfile of a process that exited without releasing its lock. It reads /proc instead, which is what `ps` reads, so a lockfile is stale in exactly the same cases as before. This saves one `ps` command for each such lockfile, which takes about 0.2 seconds on a machine with 8,000 processes.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/node-core-library"
+}
diff --git a/libraries/node-core-library/src/LockFile.ts b/libraries/node-core-library/src/LockFile.ts
index bb113c8f91..985d4cc734 100644
--- a/libraries/node-core-library/src/LockFile.ts
+++ b/libraries/node-core-library/src/LockFile.ts
@@ -662,41 +662,67 @@ function _isLockFileOfRunningProcess(
 }
 
 /**
- * Returns true if /proc shows that the lockfile of another process belongs to the running process with its PID.
- * This is much faster than running "ps", which reads the files of every process in /proc.  Returns false if the
- * start time in the lockfile is different, if /proc can't tell, or if this isn't Linux.  Then the caller must
- * run "ps", so this never makes a lockfile stale.
+ * What /proc shows about the process that wrote the lockfile of another process.  See
+ * _getLinuxLockFileProcessState().
  */
-function _isLockFileOfLinuxProcess(
+type LinuxLockFileProcessState = 'running' | 'exited' | 'unknown';
+
+/**
+ * Uses /proc to tell whether the lockfile of another process belongs to the running process with its PID.  This
+ * is much faster than running "ps", which reads the files of every process in /proc.
+ * @returns `running` if it does.  `exited` if /proc has no process with that PID, while it has the current
+ * process: "ps" reads the same /proc, so it wouldn't find a process with that PID either.  `unknown` if the start
+ * time in the lockfile is different, if /proc can't tell, or if this isn't Linux.  Then the caller must run "ps",
+ * so this never makes the lockfile of a running process stale.
+ */
+function _getLinuxLockFileProcessState(
   pid: string,
   lockFileStartTime: string | undefined,
   lockFileBirthtimeMs: number | undefined,
   getBootTimeSeconds: () => number
-): boolean {
-  if (process.platform !== 'linux' || !lockFileStartTime) {
-    return false;
+): LinuxLockFileProcessState {
+  if (process.platform !== 'linux') {
+    return 'unknown';
   }
   let startTime: ILinuxProcessStartTime | undefined;
   try {
     startTime = getLinuxProcessStartTime(parseInt(pid, 10), getBootTimeSeconds);
   } catch (error) {
     // For example, /proc isn't mounted, or it doesn't let us read the files of this process.
-    return false;
+    return 'unknown';
   }
   if (startTime === undefined) {
-    return false;
+    return _isCurrentProcessInLinuxProc(getBootTimeSeconds) ? 'exited' : 'unknown';
+  }
+  if (!lockFileStartTime) {
+    return 'unknown';
   }
   // These are the formats that getProcessStartTime() returns.
   if (lockFileStartTime === startTime.lstart || lockFileStartTime === startTime.ticks) {
-    return true;
+    return 'running';
   }
   // The other process may have written its start time with another time zone or locale.  This is the check
   // that _isLockFileOfRunningProcess() makes after running "ps" twice, with the start time from /proc.
-  return (
+  if (
     lockFileBirthtimeMs !== undefined &&
     startTime.startTimeMs <= lockFileBirthtimeMs + START_TIME_TOLERANCE_MS &&
     _isStartTimeInSomeTimeZone(lockFileStartTime, startTime.startTimeMs)
-  );
+  ) {
+    return 'running';
+  }
+  return 'unknown';
+}
+
+/**
+ * Returns true if /proc has the current process under its PID.  Otherwise, for example if /proc isn't mounted,
+ * a PID that /proc doesn't have may still belong to a running process.
+ */
+function _isCurrentProcessInLinuxProc(getBootTimeSeconds: () => number): boolean {
+  try {
+    return getLinuxProcessStartTime(process.pid, getBootTimeSeconds) !== undefined;
+  } catch (error) {
+    return false;
+  }
 }
 
 // Returned by _tryAcquireMacOrLinuxOnce() when the lockfile of another process has the same birthtime as ours.
@@ -859,17 +885,27 @@ function _tryAcquireMacOrLinuxOnce(
         // console.log(`Other pid ${otherPid} lockfile has start time: "${otherPidOldStartTime}"`);
 
         // Actual start time of the other PID.  On Linux, /proc usually shows that the file belongs to the
-        // process with that PID, even if that process has another time zone or locale, and then we don't need
-        // to run "ps", which is slow when there are many processes.  When many processes wait for the same
-        // lock, each of their attempts checks the file of every other process.
-        const otherPidCurrentStartTime: string | undefined = _isLockFileOfLinuxProcess(
-          otherPid,
-          otherPidOldStartTime,
-          otherBirthtimeMs,
-          getLinuxBootTime
-        )
-          ? otherPidOldStartTime
-          : _getStartTime(parseInt(otherPid, 10));
+        // process with that PID, even if that process has another time zone or locale, or that no process has
+        // that PID, and then we don't need to run "ps", which is slow when there are many processes.  When many
+        // processes wait for the same lock, each of their attempts checks the file of every other process, and
+        // a process that exits without releasing its lock leaves its file for the next process to check.
+        let otherPidCurrentStartTime: string | undefined;
+        switch (
+          _getLinuxLockFileProcessState(otherPid, otherPidOldStartTime, otherBirthtimeMs, getLinuxBootTime)
+        ) {
+          case 'running': {
+            otherPidCurrentStartTime = otherPidOldStartTime;
+            break;
+          }
+          case 'exited': {
+            otherPidCurrentStartTime = undefined;
+            break;
+          }
+          default: {
+            otherPidCurrentStartTime = _getStartTime(parseInt(otherPid, 10));
+            break;
+          }
+        }
 
         // console.log(`Other pid ${otherPid} actually has start time: "${otherPidCurrentStartTime}"`);
 
diff --git a/libraries/node-core-library/src/test/LockFile.test.ts b/libraries/node-core-library/src/test/LockFile.test.ts
index 1925c93e27..83d9790dc1 100644
--- a/libraries/node-core-library/src/test/LockFile.test.ts
+++ b/libraries/node-core-library/src/test/LockFile.test.ts
@@ -56,6 +56,24 @@ function createEaccesError(): NodeJS.ErrnoException {
   return Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' });
 }
 
+function createEnoentError(): NodeJS.ErrnoException {
+  return Object.assign(new Error('ENOENT: no such file or directory'), {
+    code: 'ENOENT',
+    errno: -2,
+    syscall: 'open'
+  });
+}
+
+/**
+ * Makes reading /proc/[pid]/stat fail, so that /proc can't tell whether a process has this PID, and LockFile runs
+ * "ps" for it.  A test needs this if the function that it passes to setLockFileGetProcessStartTime() returns a
+ * start time for a PID that no process has.  Otherwise /proc shows that no process has that PID, and LockFile
+ * doesn't call that function for it.
+ */
+function makeProcStatUnreadable(pid: number): void {
+  mockReadFile(`/proc/${pid}/stat`, createEaccesError());
+}
+
 // lib/test
 const libTestFolder: string = path.resolve(__dirname, '../../lib-commonjs/test');
 
@@ -347,6 +365,7 @@ describe(LockFile.name, () => {
         setLockFileGetProcessStartTime((pid: number) => {
           return pid === process.pid ? getProcessStartTime(process.pid) : otherPidStartTime;
         });
+        makeProcStatUnreadable(otherPid);
 
         // create an open lockfile
         const lockFileHandle: FileWriter = FileWriter.open(otherPidLockFileName);
@@ -515,6 +534,7 @@ describe(LockFile.name, () => {
           }
           return getProcessStartTime(pid);
         });
+        makeProcStatUnreadable(otherPid);
 
         const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
 
@@ -553,6 +573,7 @@ describe(LockFile.name, () => {
           setLockFileGetProcessStartTime((pid: number) => {
             return pid === otherPid ? otherPidStartTime : getProcessStartTime(pid);
           });
+          makeProcStatUnreadable(otherPid);
 
           const ourGetStatisticsSpy: jest.SpyInstance = jest
             .spyOn(FileWriter.prototype, 'getStatistics')
@@ -872,6 +893,7 @@ describe(LockFile.name, () => {
           setLockFileGetProcessStartTime((pid: number) => {
             return pid === exitedPid ? 'Mon Jan  2 04:53:12 2012' : getProcessStartTime(pid);
           });
+          makeProcStatUnreadable(exitedPid);
           // Right after its lockfile is read, the process releases the lock and exits.
           const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
           jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
@@ -1166,7 +1188,7 @@ describe(LockFile.name, () => {
 
             const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
 
-            // /proc never makes a lockfile stale, so "ps" decided it.
+            // /proc never makes the lockfile of a running process stale, so "ps" decided it.
             expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [otherPids[0]]]);
             expect(lock).toBeDefined();
             expect(lock!.dirtyWhenAcquired).toEqual(true);
@@ -1175,6 +1197,140 @@ describe(LockFile.name, () => {
           });
         });
 
+        describe('when other lockfiles belong to processes that exited', () => {
+          const resourceName: string = 'test';
+          const otherPidStartTime: string = 'Mon Jan  1 00:00:00 2024';
+
+          // Returns the PID of a process that has exited.  No process has it until the OS gives it to a new one.
+          function getExitedPid(): number {
+            return child_process.spawnSync('true').pid;
+          }
+
+          // Creates a lockfile for each PID that is 2 seconds older than the lockfile of this process, so that
+          // tryAcquire() acquires the lock only if all of them are stale.
+          function createOlderLockFiles(testFolder: string, contentsByPid: Map<number, string>): string[] {
+            FileSystem.ensureEmptyFolder(testFolder);
+            const otherPidLockFileNames: string[] = [];
+            for (const [otherPid, contents] of contentsByPid) {
+              const otherPidLockFileName: string = LockFile.getLockFilePath(
+                testFolder,
+                resourceName,
+                otherPid
+              );
+              FileSystem.writeFile(otherPidLockFileName, contents);
+              otherPidLockFileNames.push(otherPidLockFileName);
+            }
+            const birthtime: Date = new Date(Date.now() - 2000);
+            const originalGetStatistics: typeof FileSystem.getStatistics = FileSystem.getStatistics;
+            jest.spyOn(FileSystem, 'getStatistics').mockImplementation((filePath: string) => {
+              return otherPidLockFileNames.includes(path.resolve(filePath))
+                ? ({ birthtime } as FileSystemStats)
+                : originalGetStatistics(filePath);
+            });
+            return otherPidLockFileNames;
+          }
+
+          function expectToAcquireAndDelete(testFolder: string, otherPidLockFileNames: string[]): void {
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(true);
+            for (const otherPidLockFileName of otherPidLockFileNames) {
+              expect(FileSystem.exists(otherPidLockFileName)).toEqual(false);
+            }
+            lock!.release();
+          }
+
+          test('does not run "ps" for them', () => {
+            const testFolder: string = path.join(libTestFolder, '36');
+            const otherPidLockFileNames: string[] = createOlderLockFiles(
+              testFolder,
+              new Map([
+                [getExitedPid(), otherPidStartTime],
+                // No process can have this PID, because it is larger than the largest PID that Linux allows.
+                [999999999, otherPidStartTime],
+                // This process exited before it wrote its start time.
+                [getExitedPid(), '']
+              ])
+            );
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+            // LockFile calls the functions of this module object, so they can be spied on here.
+            const nativeChildProcess: typeof child_process = jest.requireActual('node:child_process');
+            const spawnSyncSpy: jest.SpyInstance = jest.spyOn(nativeChildProcess, 'spawnSync');
+
+            expectToAcquireAndDelete(testFolder, otherPidLockFileNames);
+
+            // "ps" ran only for the start time of this process.
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid]]);
+            expect(spawnSyncSpy).toHaveBeenCalledTimes(1);
+          });
+
+          test.each<[string, string, () => NodeJS.ErrnoException]>([
+            ['does not have this process either', '37', createEnoentError],
+            ['cannot show this process either', '40', createEaccesError]
+          ])(
+            'runs "ps" for them if /proc %s',
+            (description: string, folderName: string, createError: () => NodeJS.ErrnoException) => {
+              const testFolder: string = path.join(libTestFolder, folderName);
+              const exitedPid: number = getExitedPid();
+              const otherPidLockFileNames: string[] = createOlderLockFiles(
+                testFolder,
+                new Map([[exitedPid, otherPidStartTime]])
+              );
+              // Then /proc may not show the processes that "ps" finds.
+              mockReadFile(`/proc/${process.pid}/stat`, createError());
+              const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+              setLockFileGetProcessStartTime(getStartTimeSpy);
+
+              expectToAcquireAndDelete(testFolder, otherPidLockFileNames);
+
+              expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [exitedPid]]);
+            }
+          );
+
+          test('runs "ps" for them if /proc/[pid]/stat cannot be read', () => {
+            const testFolder: string = path.join(libTestFolder, '38');
+            const exitedPid: number = getExitedPid();
+            const otherPidLockFileNames: string[] = createOlderLockFiles(
+              testFolder,
+              new Map([[exitedPid, otherPidStartTime]])
+            );
+            mockReadFile(`/proc/${exitedPid}/stat`, createEaccesError());
+            const getStartTimeSpy: jest.Mock = jest.fn(getProcessStartTime);
+            setLockFileGetProcessStartTime(getStartTimeSpy);
+
+            expectToAcquireAndDelete(testFolder, otherPidLockFileNames);
+
+            expect(getStartTimeSpy.mock.calls).toEqual([[process.pid], [exitedPid]]);
+          });
+
+          test("doesn't mark dirtyWhenAcquired if the process releases the lock and exits before /proc is read", () => {
+            const testFolder: string = path.join(libTestFolder, '39');
+            const exitedPid: number = getExitedPid();
+            const [otherPidLockFileName] = createOlderLockFiles(
+              testFolder,
+              new Map([[exitedPid, otherPidStartTime]])
+            );
+            const originalReadFile: typeof FileSystem.readFile = FileSystem.readFile;
+            jest
+              .spyOn(FileSystem, 'readFile')
+              .mockImplementation((filePath: string, options?: IFileSystemReadFileOptions) => {
+                if (filePath === `/proc/${exitedPid}/stat`) {
+                  // The process was running when its lockfile was read.  Since then, it released the lock and exited.
+                  FileSystem.deleteFile(otherPidLockFileName);
+                }
+                return originalReadFile(filePath, options);
+              });
+
+            const lock: LockFile | undefined = LockFile.tryAcquire(testFolder, resourceName);
+
+            expect(lock).toBeDefined();
+            expect(lock!.dirtyWhenAcquired).toEqual(false);
+            lock!.release();
+          });
+        });
+
         describe('when this process acquires locks again', () => {
           const resourceName: string = 'test';
           const testFolder: string = path.join(libTestFolder, '18');
@@ -1246,6 +1402,7 @@ describe(LockFile.name, () => {
               pid === otherPid ? otherPidStartTime : getProcessStartTime(pid)
             );
             setLockFileGetProcessStartTime(getStartTimeSpy);
+            makeProcStatUnreadable(otherPid);
 
             for (let i: number = 0; i < 3; i++) {
               expect(LockFile.tryAcquire(testFolder, resourceName)).toBeUndefined();

From ff92858771a31eecc5dd7ff5ca551a4216d67162 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:57 +0000
Subject: [PATCH 176/265] [rush-client-core] Run Rush in-process when
 auto-start cannot open the launcher log

Swarm integration step 161; original commit 7f89cc400b (merge of swarm/o04-t224-int2 at 33ddeaaf78).
Scope: task 224.

Brings 224-int2 (branch swarm/o04-t224-int2). Second agent: t02 board 4628. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 7 of 12. Gate: ch01 GATE OK board 5753 (tree 36315772b9)

Commits folded into this step (1):
- 7ec7752565 Run Rush in-process when auto-start cannot open the launcher log

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   4 +
 .../src/test/startupPendingFallback.test.ts   |  38 +++++-
 ...penable-launcher-log_2026-09-29-08-28.json |  11 ++
 ...penable-launcher-log_2026-09-29-08-28.json |  11 ++
 libraries/rush-client-core/README.md          |   6 +
 .../rush-client-core/src/DaemonDisconnect.ts  |  19 ++-
 .../src/connectOrStartDaemon.ts               |  20 ++-
 .../src/test/DaemonDisconnect.test.ts         |  68 ++++++++++-
 .../src/test/SymlinkedPackageRequire.ts       |  63 ++++++++++
 .../src/test/connectOrStartDaemon.test.ts     |   5 +-
 .../connectOrStartDaemonLauncherLog.test.ts   | 114 ++++++++++++++++++
 11 files changed, 346 insertions(+), 13 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json
 create mode 100644 libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts
 create mode 100644 libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 465488d4ae..5657800b3e 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -501,6 +501,10 @@ Windows uses the named pipe `\\.\pipe\rushd-<key>` and is unchanged.
 The client refuses a runtime folder that is a symbolic link, is not a directory or belongs to
 another user, and a `RUSHD_RUNTIME_DIR` too long for the socket path: commands run in-process
 with that reason, and `daemon` commands exit 1. Remove the folder or change `RUSHD_RUNTIME_DIR`.
+Auto-start likewise refuses a launcher log that is not a regular file of yours with one link, or
+that it cannot open for writing, such as a symlink, a directory or a FIFO: commands run in-process
+with that reason (for example `Launcher log cannot be opened for writing (ELOOP): <path>`), and
+`daemon start` exits 1. Remove the file.
 A folder that others can open is made owner-only (`0700`).
 Within one runtime folder, `TMPDIR`, `TMP`, `TEMP`, `XDG_RUNTIME_DIR` and `RUSHD_RUNTIME_DIR`
 never select a different daemon; each operation receives the requesting client's values.
diff --git a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
index 6434be9fb7..f88d8f3bb9 100644
--- a/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
+++ b/apps/rush-cli-client/src/test/startupPendingFallback.test.ts
@@ -16,8 +16,10 @@ import {
   DaemonClientError,
   DaemonStartupPendingError,
   connectOrAwaitDaemonStartupAsync,
-  connectToStartingDaemonAsync
+  connectToStartingDaemonAsync,
+  getDaemonLogFilePath
 } from '@rushstack/rush-client-core';
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { AgentProgressRenderer } from '../AgentProgressRenderer';
 import * as connectionOptions from '../daemonConnectionOptions';
@@ -138,4 +140,38 @@ describe('a daemon startup failure', () => {
     ]);
     expect(connectOrAwaitDaemonStartupAsync).not.toHaveBeenCalled();
   });
+
+  (process.platform === 'win32' ? it.skip : it)(
+    'runs Rush in-process when auto-start cannot open the launcher log, and says why',
+    async () => {
+      jest
+        .mocked(connectOrAwaitDaemonStartupAsync)
+        .mockImplementation(
+          jest.requireActual('@rushstack/rush-client-core').connectOrAwaitDaemonStartupAsync
+        );
+      const paths: IDaemonPaths = {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      };
+      jest.mocked(connectionOptions.getDaemonConnectionOptionsAsync).mockResolvedValue({
+        paths,
+        startCommand: { command: process.execPath, args: ['-e', ''], cwd: folder, environment: {} }
+      });
+      const logFilePath: string = getDaemonLogFilePath(paths);
+      fs.symlinkSync(`${logFilePath}.target`, logFilePath);
+      await launchClientAsync(false);
+      expect(process.argv[1]).toBe(
+        path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rush')
+      );
+      expect(process.argv.slice(2)).toEqual(['build', '--to', 'project']);
+      // The reason and the path; the tests above pin the rest of the fallback line.
+      expect(output).toHaveBeenCalledWith(
+        expect.stringContaining(
+          `rush-client: Launcher log cannot be opened for writing (ELOOP): ${logFilePath}`
+        )
+      );
+      expect(fs.existsSync(`${logFilePath}.target`)).toBe(false);
+    }
+  );
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json b/common/changes/@rushstack/rush-cli-client/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json
new file mode 100644
index 0000000000..ef9020f655
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When auto-start cannot open the launcher log for writing, for example because it is a symlink, a directory, a FIFO without a reader or a read-only file, a command now runs Rush in-process with the reason `rush-client: Launcher log cannot be opened for writing (<code>): <path> Using in-process Rush.`, as it already did for a log that is not a regular, unshared file. Before, it failed with exit code 1 and only the error text, such as `ELOOP: too many symbolic links encountered, open '<path>'`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json b/common/changes/@rushstack/rush-client-core/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json
new file mode 100644
index 0000000000..14b58e6533
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-o04-t224-unopenable-launcher-log_2026-09-29-08-28.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When a daemon start cannot open the launcher log for writing, for example because it is a symlink, a directory, a FIFO without a reader or a read-only file, `connectOrStartDaemonAsync()` now rejects with a `startupFailed` `DaemonClientError` that names the log and the error code (`Launcher log cannot be opened for writing (ELOOP): <path>`), with the open's error as `cause`, and starts nothing. Before, it rejected with the raw error, so a caller that runs Rush in-process after a startup failure failed instead. The launcher log's stats now use `{ bigint: true }`, so that a log that is a FIFO no longer stops a later `require()` in the same process from resolving symlinks.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 56840158ca..14d42bad94 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -225,6 +225,12 @@ and the CLI's local `daemon logs` reader. Child stdout/stderr are appended acros
 restarts, including startup failures; the parent always closes its descriptor
 after spawn or failure. On POSIX the launcher enforces `0600` permissions on a
 regular, unshared, current-user-owned file and refuses symlink destinations.
+A log that it cannot open for writing, such as a symlink, a directory, a FIFO
+without a reader or a read-only file, rejects the start with a `startupFailed`
+error that names the log and the error code, as a log that fails those checks
+does, before anything is spawned. The client stats the log with
+`{ bigint: true }`: a plain stat of a FIFO would stop a later `require()` in the
+same process, such as by Rush run in-process, from resolving symlinks.
 This is a text launcher log, not structured request observability. A client that reclaims a daemon
 that exited without shutting down, after a lost connection or in `reclaimCrashedDaemonAsync()`,
 appends a line that names the daemon's PID to it, under the same file checks. Once the reclaim has
diff --git a/libraries/rush-client-core/src/DaemonDisconnect.ts b/libraries/rush-client-core/src/DaemonDisconnect.ts
index d28cc73a6c..0d8ac725b6 100644
--- a/libraries/rush-client-core/src/DaemonDisconnect.ts
+++ b/libraries/rush-client-core/src/DaemonDisconnect.ts
@@ -172,10 +172,12 @@ function readLogTail(logFilePath: string, offset: number): string | undefined {
       fs.constants.O_RDONLY +
         (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK)
     );
-    const stats: fs.Stats = fs.fstatSync(fd);
-    if (!stats.isFile() || stats.size < offset) return undefined;
-    const start: number = Math.max(offset, stats.size - MAX_LOG_READ_BYTES);
-    const buffer: Buffer = Buffer.alloc(stats.size - start);
+    // A bigint stat; see tryGetFileSize.
+    const stats: fs.BigIntStats = fs.fstatSync(fd, { bigint: true });
+    const size: number = Number(stats.size);
+    if (!stats.isFile() || size < offset) return undefined;
+    const start: number = Math.max(offset, size - MAX_LOG_READ_BYTES);
+    const buffer: Buffer = Buffer.alloc(size - start);
     return buffer.toString('utf8', 0, fs.readSync(fd, buffer, 0, buffer.length, start));
   } catch {
     return undefined;
@@ -184,10 +186,15 @@ function readLogTail(logFilePath: string, offset: number): string | undefined {
   }
 }
 
+/**
+ * A plain stat would leave the file's type in Node's shared stat array, which Node's cached realpath reads: after
+ * a FIFO or socket, a later require() in this process, such as by Rush run in-process, would not resolve symlinks.
+ * A bigint stat fills another array.
+ */
 function tryGetFileSize(filePath: string): number | undefined {
   try {
-    const stats: fs.Stats = fs.statSync(filePath);
-    return stats.isFile() ? stats.size : undefined;
+    const stats: fs.BigIntStats = fs.statSync(filePath, { bigint: true });
+    return stats.isFile() ? Number(stats.size) : undefined;
   } catch {
     return undefined;
   }
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 0b82fcf9a0..0b95918480 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -667,17 +667,29 @@ async function spawnDetachedAsync(
     fs.constants.O_APPEND +
     fs.constants.O_CREAT +
     (process.platform === 'win32' ? 0 : fs.constants.O_NOFOLLOW + fs.constants.O_NONBLOCK);
-  const logFd: number = fs.openSync(logFilePath, flags, 0o600);
+  let logFd: number;
   try {
-    const stats: fs.Stats = fs.fstatSync(logFd);
-    if (!stats.isFile() || stats.nlink !== 1) {
+    logFd = fs.openSync(logFilePath, flags, 0o600);
+  } catch (error) {
+    // For example a symlink, a directory, a FIFO without a reader, or a file that this user may not write to.
+    throw new DaemonClientError(
+      'startupFailed',
+      `Launcher log cannot be opened for writing (${(error as NodeJS.ErrnoException).code}): ${logFilePath}`,
+      { cause: error }
+    );
+  }
+  try {
+    // A plain stat would leave the log's file type in Node's shared stat array, which Node's cached realpath reads:
+    // after a FIFO, a later require() in this process, such as by Rush run in-process, would not resolve symlinks.
+    const stats: fs.BigIntStats = fs.fstatSync(logFd, { bigint: true });
+    if (!stats.isFile() || stats.nlink !== 1n) {
       throw new DaemonClientError(
         'startupFailed',
         `Launcher log must be a regular, unshared file: ${logFilePath}`
       );
     }
     if (process.platform !== 'win32') {
-      if (stats.uid !== process.getuid?.()) {
+      if (Number(stats.uid) !== process.getuid?.()) {
         throw new DaemonClientError('startupFailed', `Launcher log is owned by another user: ${logFilePath}`);
       }
       fs.fchmodSync(logFd, 0o600);
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
index 1b27c2dc42..3bf6ac8729 100644
--- a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -17,7 +17,12 @@ import {
 
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
-import { explainLostConnectionAsync, findLoggedFatalError, type IServingDaemon } from '../DaemonDisconnect';
+import {
+  explainLostConnectionAsync,
+  findLoggedFatalError,
+  observeServingDaemonAsync,
+  type IServingDaemon
+} from '../DaemonDisconnect';
 import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { reserveDaemonStartup } from '../DaemonStartup';
 import { isProcessDefunct } from '../ProcessStartTime';
@@ -29,9 +34,11 @@ import {
   startOrphanedOperationAsync,
   stopOperationIfRunning
 } from './OrphanedOperation';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
 import { withUnreapedChildAsync } from './UnreapedChildProcess';
 
 const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
 
 /** The lines that this Node.js version writes to stderr when `script` fails with an uncaught error. */
 function getCrashReport(script: string): string[] {
@@ -344,4 +351,63 @@ describe(explainLostConnectionAsync.name, () => {
       warning.mockRestore();
     }
   });
+
+  // For example, Rush that runs in-process after the daemon exited. Jest resolves modules itself, so a Node
+  // process of its own makes the call.
+  posixIt('leaves require() resolving symlinks after it read a launcher log that is a FIFO', () => {
+    const logFilePath: string = getDaemonLogFilePath(paths);
+    expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0);
+    // A process that has exited.
+    const pid: number = spawnSync(process.execPath, ['-e', '']).pid!;
+    const daemon: IServingDaemon = { pid, startedAt: undefined, logFilePath, logOffset: 0, paths };
+    const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+      folder,
+      [
+        'const [modulePath, daemonJson, requestJson] = args;',
+        "const lost = Object.assign(new Error('read ECONNRESET'), { code: 'ECONNRESET' });",
+        'const { explainLostConnectionAsync } = require(modulePath);',
+        'const explained = await explainLostConnectionAsync(lost, JSON.parse(daemonJson), JSON.parse(requestJson));',
+        'process.stdout.write(`${explained.message}\\n`);'
+      ].join('\n'),
+      [require.resolve('../DaemonDisconnect'), JSON.stringify(daemon), JSON.stringify(request)]
+    );
+    expect(result).toEqual({ status: 0, stdout: `${getExitMessage(pid)}\nfound`, stderr: '' });
+  });
+});
+
+describe(observeServingDaemonAsync.name, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-serving-daemon-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  // For example, Rush that runs in-process after the daemon exited. Jest resolves modules itself, so a Node
+  // process of its own makes the call.
+  posixIt('leaves require() resolving symlinks after it measured a launcher log that is a FIFO', () => {
+    expect(spawnSync('mkfifo', ['-m', '600', getDaemonLogFilePath(paths)]).status).toBe(0);
+    const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+      folder,
+      [
+        'const [modulePath, pathsJson] = args;',
+        'const client = { status: Promise.resolve({ pid: process.pid }) };',
+        'const { observeServingDaemonAsync } = require(modulePath);',
+        'const daemon = await observeServingDaemonAsync(client, JSON.parse(pathsJson));',
+        'process.stdout.write(`${daemon.logOffset}\\n`);'
+      ].join('\n'),
+      [require.resolve('../DaemonDisconnect'), JSON.stringify(paths)]
+    );
+    // The log is not a regular file, so the client does not read it later.
+    expect(result).toEqual({ status: 0, stdout: 'undefined\nfound', stderr: '' });
+  });
 });
diff --git a/libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts b/libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts
new file mode 100644
index 0000000000..b3f8925c71
--- /dev/null
+++ b/libraries/rush-client-core/src/test/SymlinkedPackageRequire.ts
@@ -0,0 +1,63 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** How the Node process of {@link runThenRequireSymlinkedPackage} ended. */
+export interface IRequireAfterScriptResult {
+  /** The exit code, or undefined when a signal ended the process. */
+  readonly status: number | undefined;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * Runs `script`, the body of an async function, in a Node process of its own, and then requires a package that is
+ * installed as pnpm installs it, as Rush does when it runs in-process: the package finds its dependency only from
+ * its real path. The process writes `found` to stdout when the dependency resolved, or else the error's code.
+ * @remarks Jest resolves modules itself, so only such a process shows whether a stat that the script made breaks
+ * `require()`. Node's `fs.realpathSync()` stops at a directory that it has cached when the last stat without
+ * `{ bigint: true }` found a FIFO or a socket, and then returns a path whose symlinks it did not resolve.
+ * The script reads the strings that follow the script's path on the command line from `args`.
+ */
+export function runThenRequireSymlinkedPackage(
+  folder: string,
+  script: string,
+  args: ReadonlyArray<string>
+): IRequireAfterScriptResult {
+  const store: string = path.join(folder, 'store', 'node_modules');
+  fs.mkdirSync(path.join(store, 'symlinked-package-dependency'), { recursive: true });
+  fs.writeFileSync(path.join(store, 'symlinked-package-dependency', 'index.js'), "module.exports = 'found';");
+  fs.mkdirSync(path.join(store, 'symlinked-package'));
+  fs.writeFileSync(
+    path.join(store, 'symlinked-package', 'index.js'),
+    "module.exports = require('symlinked-package-dependency');"
+  );
+  fs.mkdirSync(path.join(folder, 'app', 'node_modules'), { recursive: true });
+  fs.symlinkSync(
+    path.join(store, 'symlinked-package'),
+    path.join(folder, 'app', 'node_modules', 'symlinked-package')
+  );
+  // The script runs from the folder, so that Node has cached the folder's path as one without symlinks.
+  fs.writeFileSync(
+    path.join(folder, 'main.js'),
+    'const args = process.argv.slice(2);\n' +
+      `(async () => {\n${script}\n})().then(() => {\n` +
+      "  try { process.stdout.write(require('./app/node_modules/symlinked-package')); }\n" +
+      '  catch (error) { process.stdout.write(error.code); }\n' +
+      '});\n'
+  );
+  const child: SpawnSyncReturns<string> = spawnSync(
+    process.execPath,
+    [path.join(folder, 'main.js'), ...args],
+    {
+      cwd: folder,
+      encoding: 'utf8',
+      env: { ...process.env, NODE_OPTIONS: undefined, NODE_PRESERVE_SYMLINKS: undefined },
+      timeout: 20000
+    }
+  );
+  return { status: child.status ?? undefined, stdout: child.stdout, stderr: child.stderr };
+}
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index cdc645df00..0022b545b4 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -1736,7 +1736,10 @@ describe('detached daemon startup', () => {
       fs.writeFileSync(target, 'unchanged', { mode: 0o644 });
       fs.chmodSync(target, 0o644);
       fs.symlinkSync(target, logFilePath);
-      await expect(connectOrStartDaemonAsync(options)).rejects.toMatchObject({ code: 'ELOOP' });
+      await expect(connectOrStartDaemonAsync(options)).rejects.toMatchObject({
+        code: 'startupFailed',
+        cause: { code: 'ELOOP' }
+      });
       fs.unlinkSync(logFilePath);
       fs.linkSync(target, logFilePath);
       await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('regular, unshared file');
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts
new file mode 100644
index 0000000000..e83ace9f11
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonLauncherLog.test.ts
@@ -0,0 +1,114 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { getDaemonLogFilePath } from '../DaemonLogFile';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+describe('detached daemon startup with a launcher log that it cannot use', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let startedFilePath: string;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-launcher-log-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    startedFilePath = path.join(folder, 'started');
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      // A daemon that it started would leave this file.
+      startCommand: {
+        command: process.execPath,
+        args: ['-e', "require('node:fs').writeFileSync(process.argv[1], '')", startedFilePath],
+        cwd: folder,
+        environment: {}
+      }
+    };
+  });
+
+  afterEach(async () => {
+    await removeTestFolderAsync(folder);
+  });
+
+  // For example, a file that the user put there. A caller then runs Rush in-process and prints the reason, as it
+  // does for a log that opens but is not a regular, unshared file.
+  const unopenableLogs: [string, string, (logFilePath: string) => void][] = [
+    ['a symlink', 'ELOOP', (logFilePath: string) => fs.symlinkSync(`${logFilePath}.target`, logFilePath)],
+    [
+      'a FIFO without a reader',
+      'ENXIO',
+      (logFilePath: string) => expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0)
+    ],
+    ['a directory', 'EISDIR', (logFilePath: string) => fs.mkdirSync(logFilePath)]
+  ];
+  // Root may write to any file.
+  if (process.getuid?.() !== 0) {
+    unopenableLogs.push([
+      'a file that this user may not write to',
+      'EACCES',
+      (logFilePath: string) => fs.writeFileSync(logFilePath, 'unchanged', { mode: 0o444 })
+    ]);
+  }
+  (process.platform === 'win32' ? it.skip : it).each(unopenableLogs)(
+    'reports a launcher log that is %s and cannot be opened (%s), and starts nothing',
+    async (kind: string, code: string, createLog: (logFilePath: string) => void) => {
+      const logFilePath: string = getDaemonLogFilePath(paths);
+      createLog(logFilePath);
+      const entries: string[] = fs.readdirSync(folder);
+      const { ino, mode, size, mtimeMs } = fs.lstatSync(logFilePath);
+      await expect(connectOrStartDaemonAsync(options)).rejects.toMatchObject({
+        code: 'startupFailed',
+        message: `Launcher log cannot be opened for writing (${code}): ${logFilePath}`,
+        cause: expect.objectContaining({ code })
+      });
+      // No helper, reservation, symlink target or lock file was left behind, and the log is as it was.
+      expect(fs.readdirSync(folder)).toEqual(entries);
+      expect(fs.lstatSync(logFilePath)).toMatchObject({ ino, mode, size, mtimeMs });
+    }
+  );
+
+  // For example, Rush that runs in-process after the client refused a log that is a FIFO, which another process
+  // reads. Jest resolves modules itself, so a Node process of its own makes the call.
+  (process.platform === 'win32' ? it.skip : it)(
+    'leaves require() resolving symlinks after it refused a launcher log that is a FIFO',
+    () => {
+      const logFilePath: string = getDaemonLogFilePath(paths);
+      expect(spawnSync('mkfifo', ['-m', '600', logFilePath]).status).toBe(0);
+      const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+        folder,
+        [
+          'const [modulePath, optionsJson, logFilePath] = args;',
+          "const fs = require('node:fs');",
+          '// With a reader, the client can open the FIFO for writing.',
+          'fs.openSync(logFilePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);',
+          'const { connectOrStartDaemonAsync } = require(modulePath);',
+          'await connectOrStartDaemonAsync(JSON.parse(optionsJson)).catch((error) => {',
+          '  process.stdout.write(`${error.message}\\n`);',
+          '});'
+        ].join('\n'),
+        [require.resolve('../connectOrStartDaemon'), JSON.stringify(options), logFilePath]
+      );
+      expect(result).toEqual({
+        status: 0,
+        stdout: `Launcher log must be a regular, unshared file: ${logFilePath}\nfound`,
+        stderr: ''
+      });
+      expect(fs.existsSync(startedFilePath)).toBe(false);
+    }
+  );
+});

From 2b97550c4e0fdaeccec66e3f63bf2984126cf209 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:58 +0000
Subject: [PATCH 177/265] [rush-daemon] Record each operation's outputs when
 Rush reports its result

Swarm integration step 162; original commit 38ada69ef7 (merge of swarm/r02-t251-int at 8fcf4a55aa).
Scope: task 251.

Brings 251-int (branch swarm/r02-t251-int). Second agent: ch05 board 5345, board 5406. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 8 of 12. Gate: ch01 GATE OK board 5753 (tree ec6cff2ae1)

Commits folded into this step (1):
- ec8dcf7bc9 [rush-daemon] Record each operation's outputs when Rush reports its result

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...seline-per-operation_2026-09-29-11-45.json |  11 ++
 .../src/OperationOutputFingerprints.ts        |  50 ++++++-
 .../rush-daemon/src/OutputFolderDigestPool.ts |  28 +++-
 .../NativeOutputChangeDuringBuild.test.ts     |  57 ++++++++
 .../test/OperationOutputFingerprints.test.ts  | 131 ++++++++++++++++--
 .../src/test/OutputFolderDigestPool.test.ts   |  24 ++++
 6 files changed, 285 insertions(+), 16 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/output-baseline-per-operation_2026-09-29-11-45.json
 create mode 100644 libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/output-baseline-per-operation_2026-09-29-11-45.json b/common/changes/@rushstack/rush-daemon/output-baseline-per-operation_2026-09-29-11-45.json
new file mode 100644
index 0000000000..5144767192
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/output-baseline-per-operation_2026-09-29-11-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The daemon records each operation's outputs when Rush reports the operation's result, instead of when the command ends, so that the next request finds a change that was made to those outputs while the rest of the command ran.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
index ea4a1f2fb0..e592607282 100644
--- a/libraries/rush-daemon/src/OperationOutputFingerprints.ts
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -28,6 +28,12 @@ const PLUGIN_NAME: 'DaemonOperationOutputFingerprints' = 'DaemonOperationOutputF
  */
 const CONFIGURE_ITERATION_STAGE: number = 100;
 
+/**
+ * Runs after Rush's own `afterExecuteOperationAsync` taps, which use stages up to 1, so that the outputs are recorded
+ * with the final status of the result.
+ */
+const RECORD_OPERATION_STAGE: number = 100;
+
 /**
  * Retained results that allow the warm graph to skip an operation. Other statuses always re-run. The graph only
  * retains a `Skipped` result for an operation that it selected, when a plugin (e.g. change detection) found its
@@ -96,6 +102,9 @@ interface IEarlyWalk {
  *   selection, not with the whole warm graph. Once a walk takes long enough to matter, walks are spread
  *   over a pool of worker threads (see {@link OutputFolderDigester}), and the pool walks the folders that
  *   the last iteration walked while the inputs are reconciled (see `walkWhileReconcilingAsync`).
+ *
+ * Both record the outputs of a result when Rush reports it, before any consumer of the operation starts, so that
+ * a change that is made while the rest of the iteration runs is found by the next request.
  */
 export class OperationOutputFingerprints {
   readonly #digester: OutputFolderDigester;
@@ -104,6 +113,9 @@ export class OperationOutputFingerprints {
   /** The operations whose output folders the last iteration walked. The next one probably walks them again. */
   #lastWalkedOperations: Set<Operation> = new Set();
   #earlyWalk: IEarlyWalk | undefined;
+  /** The walks of results that this iteration recorded when Rush reported them, one folder set at a time. */
+  #recordedWalkCount: number = 0;
+  #recordedWalkMs: number = 0;
 
   public constructor(graph: IOperationGraph, digester: OutputFolderDigester = getSharedOutputFolderDigester()) {
     this.#digester = digester;
@@ -118,6 +130,10 @@ export class OperationOutputFingerprints {
         this.#enableOperationsWithChangedContents(currentStates, this.#takeEarlyWalk(context));
       }
     );
+    graph.hooks.afterExecuteOperationAsync.tap(
+      { name: PLUGIN_NAME, stage: RECORD_OPERATION_STAGE },
+      (record: IOperationExecutionResult) => this.#recordOperation(record)
+    );
     graph.hooks.afterExecuteIterationAsync.tap(
       PLUGIN_NAME,
       (status: OperationStatus, records: ReadonlyMap<Operation, IOperationExecutionResult>) => {
@@ -226,12 +242,41 @@ export class OperationOutputFingerprints {
     });
   }
 
+  /**
+   * Records the stat fingerprint and the content digest of the outputs of a result that the graph will retain, and
+   * that allows it to skip the operation later. Rush reports a result before any consumer of the operation starts,
+   * so the outputs are recorded as the operation left them.
+   */
+  #recordOperation(record: IOperationExecutionResult): void {
+    const { operation, status } = record;
+    // The graph retains a skipped result only for an operation that it selected.
+    if (!TRACKED_STATUSES.has(status) || (status === OperationStatus.Skipped && !record.enabled)) {
+      return;
+    }
+    const fingerprint: string | undefined = getOutputFingerprint(operation);
+    const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
+    if (fingerprint === undefined || folderSet === undefined) {
+      this.#fingerprints.delete(operation);
+      return;
+    }
+    const startTimeMs: number = performance.now();
+    const [{ digest: contentFingerprint, entryCount }] = this.#digester.digest([folderSet]);
+    this.#recordedWalkMs += performance.now() - startTimeMs;
+    this.#recordedWalkCount++;
+    this.#fingerprints.set(operation, { record, fingerprint, contentFingerprint, entryCount });
+    this.#lastWalkedOperations.add(operation);
+  }
+
+  /**
+   * Records the outputs of each retained result that was not recorded when Rush reported it, and lets the digester
+   * start its pool if this iteration's walks took long enough together.
+   */
   #recordIteration(records: ReadonlyMap<Operation, IOperationExecutionResult>): void {
     const walks: IRecordWalk[] = [];
     for (const [operation, record] of records) {
       // Only records produced by this iteration become the retained result; disabled operations keep
       // their earlier record and fingerprint.
-      if (this.#isRetained(operation, record)) {
+      if (this.#isRetained(operation, record) && this.#fingerprints.get(operation)?.record !== record) {
         const fingerprint: string | undefined = getOutputFingerprint(operation);
         const folderSet: IOutputFolderSet | undefined = getOutputFolderSet(operation);
         if (fingerprint === undefined || folderSet === undefined) {
@@ -248,6 +293,9 @@ export class OperationOutputFingerprints {
       this.#fingerprints.set(operation, { record, fingerprint, contentFingerprint, entryCount });
       this.#lastWalkedOperations.add(operation);
     });
+    this.#digester.recordCallingThreadDigests(this.#recordedWalkCount, this.#recordedWalkMs);
+    this.#recordedWalkCount = 0;
+    this.#recordedWalkMs = 0;
   }
 
   /**
diff --git a/libraries/rush-daemon/src/OutputFolderDigestPool.ts b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
index 004eab46f7..dca2107df9 100644
--- a/libraries/rush-daemon/src/OutputFolderDigestPool.ts
+++ b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
@@ -21,7 +21,10 @@ const WAIT_SLICE_MS: number = 1000;
  */
 const DEFAULT_STALL_TIMEOUT_MS: number = 10000;
 
-/** A digest on the calling thread that takes longer than this starts a pool for later digests. */
+/**
+ * Digests of several folder sets on the calling thread that take longer than this together start a pool for later
+ * digests.
+ */
 const POOL_START_THRESHOLD_MS: number = 50;
 const MAX_POOL_THREAD_COUNT: number = 7;
 /**
@@ -77,7 +80,10 @@ export interface IOutputFolderDigestPoolOptions {
 export interface IOutputFolderDigesterOptions {
   /** Defaults to one less than the available parallelism, at most 7. Zero never starts a pool. */
   readonly threadCount?: number;
-  /** A digest on the calling thread that takes longer than this starts the pool. Defaults to 50 ms. */
+  /**
+   * Digests of several folder sets on the calling thread that take longer than this together start the pool (see
+   * `recordCallingThreadDigests`). Defaults to 50 ms.
+   */
   readonly poolStartThresholdMs?: number;
 }
 
@@ -281,8 +287,8 @@ export class OutputFolderDigestPool {
 }
 
 /**
- * Digests output folder sets on the calling thread until one call takes longer than a threshold, and through
- * an {@link OutputFolderDigestPool} after that, so a workspace with small outputs never starts threads.
+ * Digests output folder sets on the calling thread until digests of several folder sets take longer than a threshold,
+ * and through an {@link OutputFolderDigestPool} after that, so a workspace with small outputs never starts threads.
  */
 export class OutputFolderDigester {
   readonly #poolStartThresholdMs: number;
@@ -311,11 +317,20 @@ export class OutputFolderDigester {
     const digests: IOutputFolderDigest[] = folderSets.map((folderSet: IOutputFolderSet) =>
       digestOutputFolders(folderSet)
     );
+    this.recordCallingThreadDigests(folderSets.length, performance.now() - startTimeMs);
+    return digests;
+  }
+
+  /**
+   * Starts the pool for later digests if digests of several folder sets on the calling thread took longer than the
+   * threshold together, including a caller's digests of one folder set at a time.
+   */
+  public recordCallingThreadDigests(folderSetCount: number, durationMs: number): void {
     if (
       !this.#pool &&
       this.#threadCount > 0 &&
-      folderSets.length > 1 &&
-      performance.now() - startTimeMs > this.#poolStartThresholdMs
+      folderSetCount > 1 &&
+      durationMs > this.#poolStartThresholdMs
     ) {
       try {
         this.#pool = new OutputFolderDigestPool({ threadCount: this.#threadCount });
@@ -323,7 +338,6 @@ export class OutputFolderDigester {
         this.#threadCount = 0;
       }
     }
-    return digests;
   }
 
   /**
diff --git a/libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts b/libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts
new file mode 100644
index 0000000000..c96953c1e7
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeOutputChangeDuringBuild.test.ts
@@ -0,0 +1,57 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { createNativeScriptGateAsync, type INativeScriptGate } from './NativeEngineTestCommands';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('native production daemon engine', () => {
+  it.each<[string, (libPath: string) => void]>([
+    ['adds an output file', (libPath) => fs.writeFileSync(path.join(libPath, 'race.txt'), 'race')],
+    [
+      'edits an output file in place',
+      (libPath) => fs.writeFileSync(path.join(libPath, 'output.txt'), 'edited in place')
+    ]
+  ])(
+    're-runs an operation after a change that %s once it ran, while its consumer still ran',
+    async (description: string, change: (libPath: string) => void) => {
+      const fixture: IFixture = await createFixtureAsync();
+      const gate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'b');
+      let initial: Promise<ITerminalExchange> | undefined;
+      try {
+        initial = runAsync(fixture, 'initial', ['build', '--to', 'b']);
+        await Promise.race([
+          gate.entered,
+          initial.then((exchange: ITerminalExchange) => {
+            throw new Error(`b did not enter its script gate: ${JSON.stringify(exchange.terminal)}`);
+          })
+        ]);
+        // Rush reported the result of a before b started, so the result of a does not include this change.
+        change(path.join(fixture.repoRoot, 'projects/a/lib'));
+        await gate.releaseAsync();
+        expect((await initial).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
+
+        expect((await runAsync(fixture, 'changed', ['build', '--only', 'a'])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: true }
+        });
+        expect(runs(fixture).slice(2)).toEqual(['a:one:']);
+        expect((await runAsync(fixture, 'unchanged', ['build', '--only', 'a'])).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: false }
+        });
+        expect(runs(fixture)).toHaveLength(3);
+      } finally {
+        await gate.releaseAsync();
+        await initial?.catch(() => undefined);
+        await fixture[Symbol.asyncDispose]();
+      }
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
index 15aeb04b4f..e491ee1655 100644
--- a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
@@ -12,6 +12,7 @@ import {
   type IConfigurableOperation,
   type IInputsSnapshot,
   type IOperationExecutionResult,
+  type IOperationRunnerContext,
   type IOperationSettings,
   type IPhase,
   type IOperationGraph,
@@ -29,6 +30,17 @@ interface IReconciliation {
   readonly inputsSnapshot: IInputsSnapshot;
 }
 
+interface ITestResult {
+  readonly name: string;
+  readonly status: OperationStatus;
+  /** Defaults to true. */
+  readonly enabled?: boolean;
+}
+
+function getNames(operations: ReadonlyArray<Operation>): string[] {
+  return operations.map((operation: Operation) => operation.associatedProject.packageName);
+}
+
 function getProjectNames(folderSets: ReadonlyArray<IOutputFolderSet>): string {
   return folderSets.map(({ projectFolder }: IOutputFolderSet) => path.basename(projectFolder)).join(',');
 }
@@ -117,14 +129,32 @@ class TestGraph {
 
   /** Runs the operations successfully, which records the fingerprints of their outputs. */
   public async runAsync(...names: string[]): Promise<void> {
+    await this.executeAsync(names.map((name: string) => ({ name, status: OperationStatus.Success })));
+  }
+
+  /**
+   * Reports each result as Rush does: the `afterExecuteOperationAsync` taps run before Rush retains the result, and
+   * Rush retains a skipped result only for an enabled operation. `beforeIterationEnds` runs after the last result.
+   */
+  public async executeAsync(
+    results: ReadonlyArray<ITestResult>,
+    beforeIterationEnds?: () => void
+  ): Promise<void> {
     const records: Map<Operation, IOperationExecutionResult> = new Map();
-    for (const name of names) {
-      const record: IOperationExecutionResult = {
-        status: OperationStatus.Success
-      } as IOperationExecutionResult;
-      this.resultByOperation.set(this.getOperation(name), record);
-      records.set(this.getOperation(name), record);
+    for (const { name, status, enabled = true } of results) {
+      const operation: Operation = this.getOperation(name);
+      const record: IOperationRunnerContext & IOperationExecutionResult = {
+        operation,
+        status,
+        enabled
+      } as IOperationRunnerContext & IOperationExecutionResult;
+      await this.hooks.afterExecuteOperationAsync.promise(record);
+      if (enabled || status !== OperationStatus.Skipped) {
+        this.resultByOperation.set(operation, record);
+      }
+      records.set(operation, record);
     }
+    beforeIterationEnds?.();
     await this.hooks.afterExecuteIterationAsync.promise(OperationStatus.Success, records, {});
   }
 
@@ -170,7 +200,7 @@ describe(OperationOutputFingerprints.name, () => {
   async function createGraphAsync(): Promise<TestGraph> {
     const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4 }, digester);
     await graph.runAsync('a', 'b', 'c');
-    expect(digester.takeCalls()).toEqual(['digest a,b,c']);
+    expect(digester.takeCalls()).toEqual(['digest a', 'digest b', 'digest c']);
     return graph;
   }
 
@@ -258,7 +288,7 @@ describe(OperationOutputFingerprints.name, () => {
     it('walks the output folders that the last iteration walked, and others when they are checked', async () => {
       const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, digester);
       await graph.runAsync('a', 'b', 'c', 'd');
-      expect(digester.takeCalls()).toEqual(['digest a,b,c,d']);
+      expect(digester.takeCalls()).toEqual(['digest a', 'digest b', 'digest c', 'digest d']);
       const select = (...names: string[]): void => {
         for (const name of ['a', 'b', 'c', 'd']) {
           graph.getOperation(name).enabled = names.includes(name);
@@ -367,4 +397,89 @@ describe(OperationOutputFingerprints.name, () => {
       }
     });
   });
+
+  describe('records the outputs of each operation when Rush reports its result', () => {
+    it('finds a change to an output folder that was made before the iteration ended', async () => {
+      const graph: TestGraph = new TestGraph(root, { c: 1, d: 2 }, digester);
+      await graph.executeAsync(
+        [
+          { name: 'd', status: OperationStatus.Success },
+          { name: 'c', status: OperationStatus.Success }
+        ],
+        () => graph.addFile('d', 'lib/race.js')
+      );
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['d']);
+      expect(digester.takeCalls()).toEqual(['digest d', 'digest c']);
+    });
+
+    it('finds an output file that was edited in place before the iteration ended', async () => {
+      const graph: TestGraph = new TestGraph(root, { c: 1, d: 2 }, digester);
+      await graph.executeAsync(
+        [
+          { name: 'd', status: OperationStatus.Success },
+          { name: 'c', status: OperationStatus.Success }
+        ],
+        () => fs.appendFileSync(path.join(root, 'd', 'lib', 'file-0.js'), ' edited')
+      );
+      // The output folder itself did not change.
+      expect(graph.fingerprints.getOperationsWithChangedOutputs()).toEqual([]);
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      expect(graph.configure(first)).toEqual(['d']);
+
+      await graph.runAsync('d');
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual([]);
+    });
+
+    it('records restored and up-to-date results, but not failed ones', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4 }, digester);
+      await graph.runAsync('a', 'b', 'c');
+      digester.takeCalls();
+      await graph.executeAsync(
+        [
+          { name: 'a', status: OperationStatus.FromCache },
+          { name: 'b', status: OperationStatus.Skipped },
+          { name: 'c', status: OperationStatus.Failure }
+        ],
+        () => {
+          for (const name of ['a', 'b', 'c']) {
+            graph.addFile(name, 'lib/race.js');
+          }
+        }
+      );
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['a', 'b']);
+      expect(digester.takeCalls()).toEqual(['digest a', 'digest b']);
+    });
+
+    it('keeps the fingerprint of an operation that was skipped while it was disabled', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, digester);
+      await graph.runAsync('a', 'b');
+      digester.takeCalls();
+      await graph.executeAsync([{ name: 'b', status: OperationStatus.Skipped, enabled: false }]);
+      expect(digester.takeCalls()).toEqual([]);
+      fs.appendFileSync(path.join(root, 'b', 'lib', 'file-0.js'), ' edited');
+      expect(graph.configure(undefined)).toEqual(['b']);
+    });
+
+    it('records a retained result when the iteration ends if Rush did not report it', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1 }, digester);
+      const operation: Operation = graph.getOperation('a');
+      const record: IOperationExecutionResult = {
+        operation,
+        status: OperationStatus.Success,
+        enabled: true
+      } as IOperationExecutionResult;
+      graph.resultByOperation.set(operation, record);
+      await graph.hooks.afterExecuteIterationAsync.promise(
+        OperationStatus.Success,
+        new Map([[operation, record]]),
+        {}
+      );
+      expect(digester.takeCalls()).toEqual(['digest a']);
+      graph.addFile('a', 'lib/new.js');
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['a']);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
index fe30f893b9..c579135d15 100644
--- a/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPool.test.ts
@@ -440,6 +440,30 @@ describe(OutputFolderDigester.name, () => {
     expect(disabled.isParallel).toBe(false);
   });
 
+  it('starts a pool after digests of several folder sets that a caller made one at a time took longer together', () => {
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: 2,
+      poolStartThresholdMs: 50
+    });
+    try {
+      digester.recordCallingThreadDigests(1, 51);
+      expect(digester.isParallel).toBe(false);
+      digester.recordCallingThreadDigests(2, 50);
+      expect(digester.isParallel).toBe(false);
+      digester.recordCallingThreadDigests(2, 51);
+      expect(digester.isParallel).toBe(true);
+    } finally {
+      digester.dispose();
+    }
+
+    const disabled: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: 0,
+      poolStartThresholdMs: -1
+    });
+    disabled.recordCallingThreadDigests(2, 51);
+    expect(disabled.isParallel).toBe(false);
+  });
+
   it('starts background digests only while its pool runs', () => {
     const folderSets: IOutputFolderSet[] = createProjects(root);
     const digester: OutputFolderDigester = new OutputFolderDigester({

From 8eceed90a29258102b4c75370c8ef5656eec421b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:58 +0000
Subject: [PATCH 178/265] [rush-daemon][rush-lib] Test four behaviors of task
 140 that no test pinned

Swarm integration step 163; original commit 35fdea784b (merge of swarm/r02-t267 at 958191312e).
Refs: task 267.
Scope: task 267.

Brings 267 (branch swarm/r02-t267). Second agent: o07 board 5444. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 9 of 12. Gate: ch01 GATE OK board 5753 (tree c0fb0703ac)

Commits folded into this step (1):
- 958191312e [rush-daemon][rush-lib] Test four behaviors of task 140 that no test pinned (task 267)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...closure-plugin-tests_2026-09-29-12-37.json |  11 ++
 ...mand-admission-tests_2026-09-29-12-37.json |  11 ++
 .../ProductionDaemonCustomCommands.test.ts    |  63 +++++++++
 .../src/api/test/PhasedCommandEngine.test.ts  | 133 +++++++++++++-----
 .../test/PhasedCommandEngineSharing.test.ts   |   6 +-
 5 files changed, 185 insertions(+), 39 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/engine-phase-closure-plugin-tests_2026-09-29-12-37.json
 create mode 100644 common/changes/@rushstack/rush-daemon/custom-command-admission-tests_2026-09-29-12-37.json

diff --git a/common/changes/@microsoft/rush/engine-phase-closure-plugin-tests_2026-09-29-12-37.json b/common/changes/@microsoft/rush/engine-phase-closure-plugin-tests_2026-09-29-12-37.json
new file mode 100644
index 0000000000..67a2db27c1
--- /dev/null
+++ b/common/changes/@microsoft/rush/engine-phase-closure-plugin-tests_2026-09-29-12-37.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Test that an engine's phases include the phases that its phases depend on in the same project, and that only a built-in plugin's own manifest can declare it command-agnostic.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/custom-command-admission-tests_2026-09-29-12-37.json b/common/changes/@rushstack/rush-daemon/custom-command-admission-tests_2026-09-29-12-37.json
new file mode 100644
index 0000000000..6614d4056f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/custom-command-admission-tests_2026-09-29-12-37.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a custom command is admitted to the workspace with the class of its command, and that a global command is rejected before its environment can restart the daemon.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
index b205183786..2bea5429f1 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
@@ -7,9 +7,12 @@ import * as path from 'node:path';
 import type { IOperationGraph } from '@microsoft/rush-lib';
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
+import { type IRequestLease, RequestExclusivityClass } from '../RequestScheduler';
+import { getWorkspaceRequestScheduler } from '../WorkspaceRequestAdmission';
 import {
   ClassRecordingResolver,
   createFixtureAsync,
+  requestEnvironment,
   runAsync,
   runs,
   type IFixture
@@ -108,4 +111,64 @@ describe('native production daemon engine', () => {
       await fixture[Symbol.asyncDispose]();
     }
   });
+
+  it('admits a custom command to the workspace with the class of its command', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { customCommands: true });
+    const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
+    const noWait: Partial<IDaemonRequestEnvelope> = { ...custom, admission: { noWait: true } };
+    try {
+      expect((await runAsync(fixture, 'test', ['test', '--only', 'a'], custom)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      const sharedBuild: IRequestLease = await getWorkspaceRequestScheduler(fixture.session).acquireAsync({
+        exclusivityClass: RequestExclusivityClass.SharedBuild
+      });
+      try {
+        // test is incremental, so it shares admission with builds. retest is not, so it waits for them.
+        expect((await runAsync(fixture, 'shared', ['test', '--only', 'a'], noWait)).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 0, scheduled: false }
+        });
+        expect(
+          (await runAsync(fixture, 'exclusive', ['retest', '--only', 'a'], noWait)).terminal
+        ).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'no-wait' }
+        });
+      } finally {
+        sharedBuild.release();
+      }
+      expect(runs(fixture)).toEqual(['a:one:', 'test-a']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('rejects a global command before its environment can restart the daemon', async () => {
+    const fixture: IFixture = await createFixtureAsync(false, 'direct', { customCommands: true });
+    // A variable that is part of the workspace fingerprint environment.
+    const environment: Record<string, string> = {
+      ...requestEnvironment(),
+      RUSHD_CUSTOM_COMMAND_TEST: 'changed'
+    };
+    try {
+      expect(
+        (await runAsync(fixture, 'global', ['hello'], { commandOrigin: 'custom', environment })).terminal
+      ).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+      // A build with this environment needs a new daemon process, which this host cannot launch.
+      expect(
+        (await runAsync(fixture, 'build', ['build', '--only', 'a'], { environment })).terminal
+      ).toMatchObject({
+        kind: 'requestRejected',
+        payload: {
+          code: 'routingFailed',
+          message: expect.stringContaining('A new daemon process is required (environment)')
+        }
+      });
+      expect(runs(fixture)).toEqual([]);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
 });
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index 471d5701a9..9eaaa9e90b 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -15,6 +15,7 @@ import { RushGlobalFolder } from '../RushGlobalFolder';
 import { EnvironmentConfiguration } from '../EnvironmentConfiguration';
 import { RushCommandLineParser } from '../../cli/RushCommandLineParser';
 import { Autoinstaller } from '../../logic/Autoinstaller';
+import type { IBuiltInPluginConfiguration } from '../../pluginFramework/PluginLoader/BuiltInPluginLoader';
 import { PluginManager } from '../../pluginFramework/PluginManager';
 import { RushSession } from '../../pluginFramework/RushSession';
 import { JsonFileLoadCache } from '../../utilities/JsonFileLoadCache';
@@ -98,6 +99,67 @@ function getPackageName(plugin: IPluginFixture): string {
   return `@example/${plugin.pluginName ?? PLUGIN_NAME}`;
 }
 
+function getPluginManifest(plugin: IPluginFixture): object {
+  return {
+    plugins: [
+      {
+        pluginName: plugin.pluginName ?? PLUGIN_NAME,
+        description: 'An example plugin.',
+        entryPoint: './lib/index.js',
+        associatedCommands: plugin.associatedCommands,
+        commandLineJsonFilePath: './command-line.json',
+        daemonCompatible: plugin.daemonCompatible,
+        daemonCommandAgnostic: plugin.daemonCommandAgnostic
+      }
+    ]
+  };
+}
+
+/** Writes the package of `plugin`, with an entry point whose apply() taps the hooks of `plugin.taps`. */
+function writePluginPackage(packageFolder: string, plugin: IPluginFixture): void {
+  const pluginName: string = plugin.pluginName ?? PLUGIN_NAME;
+  const { runAnyPhasedCommand, runPhasedCommand = [] } = plugin.taps ?? {};
+  const statements: string[] = [
+    ...(runAnyPhasedCommand ? ['hooks.runAnyPhasedCommand.tapPromise(name, async () => {});'] : []),
+    ...runPhasedCommand.map(
+      (commandName) => `hooks.runPhasedCommand.for(${JSON.stringify(commandName)}).tap(name, () => {});`
+    )
+  ];
+  fs.mkdirSync(path.join(packageFolder, 'lib'), { recursive: true });
+  fs.writeFileSync(
+    path.join(packageFolder, 'package.json'),
+    JSON.stringify({ name: getPackageName(plugin), version: '1.0.0' })
+  );
+  fs.writeFileSync(
+    path.join(packageFolder, 'lib/index.js'),
+    [
+      'module.exports = class {',
+      '  apply({ hooks }) {',
+      `    const name = ${JSON.stringify(pluginName)};`,
+      ...statements.map((statement) => `    ${statement}`),
+      '  }',
+      '};'
+    ].join('\n')
+  );
+}
+
+/** Writes `plugin` as a plugin that Rush provides itself, like its build cache plugins, in `pluginPackageFolder`. */
+function writeBuiltInPlugin(
+  pluginPackageFolder: string,
+  plugin: IPluginFixture
+): IBuiltInPluginConfiguration {
+  writePluginPackage(pluginPackageFolder, plugin);
+  fs.writeFileSync(
+    path.join(pluginPackageFolder, 'rush-plugin-manifest.json'),
+    JSON.stringify(getPluginManifest(plugin))
+  );
+  return {
+    packageName: getPackageName(plugin),
+    pluginName: plugin.pluginName ?? PLUGIN_NAME,
+    pluginPackageFolder
+  };
+}
+
 function createRepo(repo: IRepoFixture): string {
   const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-engine-plugins-'));
   const write = (relativePath: string, json: object): void => {
@@ -132,45 +194,15 @@ function createRepo(repo: IRepoFixture): string {
     const pluginName: string = plugin.pluginName ?? PLUGIN_NAME;
     const storeFolder: string = `common/autoinstallers/plugins/rush-plugins/${getPackageName(plugin)}`;
     if (plugin.writeManifest !== false) {
-      write(`${storeFolder}/rush-plugin-manifest.json`, {
-        plugins: [
-          {
-            pluginName,
-            description: 'An example plugin.',
-            entryPoint: './lib/index.js',
-            associatedCommands: plugin.associatedCommands,
-            commandLineJsonFilePath: './command-line.json',
-            daemonCompatible: plugin.daemonCompatible,
-            daemonCommandAgnostic: plugin.daemonCommandAgnostic
-          }
-        ]
-      });
+      write(`${storeFolder}/rush-plugin-manifest.json`, getPluginManifest(plugin));
     }
     if (plugin.commandLineJson) {
       write(`${storeFolder}/${pluginName}/command-line.json`, plugin.commandLineJson);
     }
     if (plugin.taps) {
-      const packageFolder: string = `common/autoinstallers/plugins/node_modules/${getPackageName(plugin)}`;
-      write(`${packageFolder}/package.json`, { name: getPackageName(plugin), version: '1.0.0' });
-      const { runAnyPhasedCommand, runPhasedCommand = [] } = plugin.taps;
-      const statements: string[] = [
-        ...(runAnyPhasedCommand ? ['hooks.runAnyPhasedCommand.tapPromise(name, async () => {});'] : []),
-        ...runPhasedCommand.map(
-          (commandName) => `hooks.runPhasedCommand.for(${JSON.stringify(commandName)}).tap(name, () => {});`
-        )
-      ];
-      const entryPoint: string = path.join(folder, packageFolder, 'lib/index.js');
-      fs.mkdirSync(path.dirname(entryPoint), { recursive: true });
-      fs.writeFileSync(
-        entryPoint,
-        [
-          'module.exports = class {',
-          '  apply({ hooks }) {',
-          `    const name = ${JSON.stringify(pluginName)};`,
-          ...statements.map((statement) => `    ${statement}`),
-          '  }',
-          '};'
-        ].join('\n')
+      writePluginPackage(
+        path.join(folder, `common/autoinstallers/plugins/node_modules/${getPackageName(plugin)}`),
+        plugin
       );
     }
   }
@@ -178,14 +210,18 @@ function createRepo(repo: IRepoFixture): string {
 }
 
 /** Applies the plugins that Rush initializes for `commandName` to a new session, as an engine does. */
-async function applyPluginsAsync(folder: string, commandName: string): Promise<RushSession> {
+async function applyPluginsAsync(
+  folder: string,
+  commandName: string,
+  builtInPluginConfigurations: IBuiltInPluginConfiguration[] = []
+): Promise<RushSession> {
   const terminalProvider: NoOpTerminalProvider = new NoOpTerminalProvider();
   const rushSession: RushSession = new RushSession({ terminalProvider, getIsDebugMode: () => false });
   const pluginManager: PluginManager = new PluginManager({
     terminal: new Terminal(terminalProvider),
     rushConfiguration: RushConfiguration.loadFromConfigurationFile(path.join(folder, 'rush.json')),
     rushSession,
-    builtInPluginConfigurations: [],
+    builtInPluginConfigurations: [...builtInPluginConfigurations],
     restrictConsoleOutput: true,
     rushGlobalFolder: new RushGlobalFolder()
   });
@@ -574,9 +610,12 @@ describe(PhasedCommandEngine.name, () => {
     });
 
     /** Whether an engine that `build` created, with the plugins applied, can serve `rebuild`. */
-    async function getRebuildBlockerAsync(folder: string): Promise<string | undefined> {
+    async function getRebuildBlockerAsync(
+      folder: string,
+      builtInPluginConfigurations?: IBuiltInPluginConfiguration[]
+    ): Promise<string | undefined> {
       const build: PhasedCommandEngine = await parseBuildAsync(folder, ['build']);
-      const rushSession: RushSession = await applyPluginsAsync(folder, 'build');
+      const rushSession: RushSession = await applyPluginsAsync(folder, 'build', builtInPluginConfigurations);
       // The plugins never prevent the engine from serving its own command.
       expect(
         build.getEngineSharingBlocker(await parseBuildAsync(folder, ['build']), rushSession)
@@ -612,6 +651,24 @@ describe(PhasedCommandEngine.name, () => {
       ).toBeUndefined();
     });
 
+    it('lets only its manifest declare a built-in plugin command-agnostic', async () => {
+      // Like daemon.compatiblePlugins, rush.json's list names the plugins that rush-plugins.json configures.
+      const folder: string = createMultiPluginTestRepo({
+        plugins: [],
+        commandAgnosticPlugins: [PLUGIN_NAME]
+      });
+      const listed: IBuiltInPluginConfiguration = writeBuiltInPlugin(
+        path.join(folder, 'listed'),
+        ANY_COMMAND_PLUGIN
+      );
+      expect(await getRebuildBlockerAsync(folder, [listed])).toBe(UNDECLARED);
+      const declared: IBuiltInPluginConfiguration = writeBuiltInPlugin(path.join(folder, 'declared'), {
+        ...ANY_COMMAND_PLUGIN,
+        daemonCommandAgnostic: true
+      });
+      expect(await getRebuildBlockerAsync(folder, [declared])).toBeUndefined();
+    });
+
     it('lets RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS override rush.json', async () => {
       process.env[COMMAND_AGNOSTIC_PLUGINS_VARIABLE] = ` ${PLUGIN_NAME} `;
       expect(
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
index 07d5f8f87b..4a85918e0e 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
@@ -80,7 +80,9 @@ describe(`${PhasedCommandEngine.name} engine sharing`, () => {
         { name: 'build', phases: ['_phase:compile'], incremental: true },
         { name: 'test', phases: ['_phase:compile', '_phase:test'], incremental: true },
         { name: 'retest', phases: ['_phase:compile', '_phase:test'], incremental: false },
-        { name: 'lint', phases: ['_phase:lint'], incremental: true }
+        { name: 'lint', phases: ['_phase:lint'], incremental: true },
+        // Lists the test phase without the compile phase that it depends on in the same project.
+        { name: 'unit', phases: ['_phase:test'], incremental: true }
       ].map((command) => ({
         ...command,
         commandKind: 'phased',
@@ -141,6 +143,8 @@ describe(`${PhasedCommandEngine.name} engine sharing`, () => {
     expect(await getBlockerAsync(['lint', '--include-phase-deps'], ['build'])).toBe(
       'the graph of "lint" does not have every operation of the "_phase:compile" phase'
     );
+    // Each test operation needs the compile operation of its own project, so that graph has all of them.
+    expect(await getBlockerAsync(['unit', '--include-phase-deps'], ['build'])).toBeUndefined();
   });
 
   it('serves only its own command on the engine of a command that is not incremental', async () => {

From 5b89b0c3ff409fdea17f877e6d1e587c9def9561 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:58 +0000
Subject: [PATCH 179/265] [rush-daemon] Wait for another Rush process's
 repository lock within the request's wait timeout, and name it (task 111)
 (and 2 more)

Swarm integration step 164; original commit e281b12d5c (merge of swarm/o04-t111-e2d at 5e8059a11f).
Scope: task 111.

Brings 111-e2d (branch swarm/o04-t111-e2d). Second agent: t05 board 5542. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 10 of 12. Gate: ch01 GATE OK board 5753 (tree cf7a0c604a)

Commits folded into this step (3):
- 5effde9755 Wait for another Rush process's repository lock within the request's wait timeout, and name it (task 111)
- 64a587e85a Test the daemon's own lock, a client that leaves a waiting batch, and requests behind a waiting load (task 111)
- b805c189cf Move the admission validation into DaemonRequestAdmissionValidation.ts (task 111)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  20 +-
 apps/rush-cli-client/src/launchClient.ts      |  19 +-
 .../src/nativeLockWaitNotice.ts               | 125 ++++++++
 .../src/test/nativeLockWaitNotice.test.ts     | 193 ++++++++++++
 ...111-native-lock-wait_2026-09-29-11-57.json |  11 +
 ...111-native-lock-wait_2026-09-29-11-57.json |  11 +
 ...111-native-lock-wait_2026-09-29-11-57.json |  11 +
 ...111-native-lock-wait_2026-09-29-11-57.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   9 +-
 .../reviews/api/rush-daemon-protocol.api.md   |   7 +
 libraries/rush-client-core/README.md          |   8 +-
 .../rush-client-core/src/DaemonClient.ts      |  21 +-
 .../rush-client-core/src/NativeLockHolder.ts  | 114 +++++++
 libraries/rush-client-core/src/index.ts       |   1 +
 .../src/test/DaemonClient.test.ts             |  31 ++
 .../src/test/NativeLockHolder.test.ts         | 167 ++++++++++
 libraries/rush-daemon-protocol/README.md      |   5 +-
 .../src/DaemonNativeLockHolder.ts             |  14 +
 .../src/DaemonRequestAdmission.ts             |  55 +---
 .../src/DaemonRequestAdmissionValidation.ts   |  55 ++++
 .../src/RequestAdmissionControlValidation.ts  |  35 +++
 libraries/rush-daemon-protocol/src/index.ts   |   6 +-
 .../src/test/NativeLockHolder.test.ts         |  52 +++
 .../src/test/RequestAdmission.test.ts         |   6 +-
 libraries/rush-daemon/README.md               |  16 +-
 .../rush-daemon/src/NativeRepositoryLock.ts   |  37 +++
 .../rush-daemon/src/PhasedRequestRouter.ts    |  84 ++++-
 .../src/WorkspaceRequestAdmission.ts          | 179 ++++++++++-
 .../src/WorkspaceRequestLifecycle.ts          |  25 +-
 .../src/test/NativeEngineTestCommands.ts      |  14 +-
 .../src/test/NativeLockAdmission.test.ts      | 296 ++++++++++++++++++
 .../src/test/NativeRepositoryLock.test.ts     |  82 +++++
 .../PhasedRequestRouterNativeLock.test.ts     | 248 +++++++++++++++
 .../ProductionDaemonNativeLockWait.test.ts    | 269 ++++++++++++++++
 .../ProductionDaemonRequestResolver.test.ts   |  53 ----
 35 files changed, 2146 insertions(+), 144 deletions(-)
 create mode 100644 apps/rush-cli-client/src/nativeLockWaitNotice.ts
 create mode 100644 apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
 create mode 100644 libraries/rush-client-core/src/NativeLockHolder.ts
 create mode 100644 libraries/rush-client-core/src/test/NativeLockHolder.test.ts
 create mode 100644 libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts
 create mode 100644 libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts
 create mode 100644 libraries/rush-daemon/src/NativeRepositoryLock.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
 create mode 100644 libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 5657800b3e..9f60b01128 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -66,8 +66,8 @@ in-process (`rush-client: <reason>; using in-process Rush.`). A startup failure
 still make the daemon ready is the exception: a process that listens at the endpoint but does not
 complete hello/ping in time, a startup helper that still waits for its daemon, or another client that
 holds the start mutex, as in a burst of clients that all find no daemon. In-process Rush would take the
-repository lock, and the daemon would then reject the requests it serves with "Another Rush command is
-already running in this repository." Instead, the client keeps trying for one more startup deadline
+repository lock, and the requests that the daemon serves would then wait for it, or fail when their wait
+timeout ends (see below). Instead, the client keeps trying for one more startup deadline
 (15 seconds, so about 30 seconds in all) and uses the daemon once it is ready. It says so when it starts
 waiting (`rush-client: The daemon is not ready yet. <live process>, so this command waits up to 15 s more
 for it instead of running Rush in-process.`; agent output shows "rushd is still starting; waiting for it"
@@ -114,11 +114,23 @@ In legacy output and in `rushx-client`, the admission failure line
 mode's summary line does, so it names what the request waited for, such as a daemon
 restart, and why the daemon restarts.
 
+A request also waits while a Rush process that the daemon does not run, such as
+`rush install` or a `--no-daemon` build, holds the repository's lock. Every timeout,
+the built-in default included, limits that wait, since that process can run for any
+length of time. Stderr, on a terminal and on a pipe, names the process at once
+(`rush-client: waiting for another Rush process (PID 12345: rush install) to release
+this repository's lock.`), and again with the time waited every 10 seconds
+(`still waiting after 10s for …`); agent output shows it as the progress phase. Only
+Linux tells the PID and command; elsewhere the line says `another Rush process`.
+`--no-wait` and `--wait-timeout 0` fail at once, and the admission failure line of
+these and of a timeout names the process. A request never waits for a lock that the
+daemon itself holds for another request: it fails at once, as before.
+
 Admission controls also apply to experimental graph requests, but not
 `start|stop|restart|status|logs`. They affect daemon admission only; native fallback
 retains native command behavior. Waiting positions are shown on interactive stderr,
-and a wait for a daemon restart on a pipe too (see below). Admission failures report
-their typed reason and a nonzero exit code.
+and a wait for a daemon restart (see below) or for another Rush process on a pipe
+too. Admission failures report their typed reason and a nonzero exit code.
 
 Explicit reporter/output/log-level controls (`--reporter`, `--output`, `--log-level`,
 `RUSH_REPORTER` other than `legacy`, or `RUSH_LOG_LEVEL`) retain the native frontend
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 2b20d041f1..33ab8a2f74 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -28,6 +28,7 @@ import { executeDaemonCommandAsync } from './daemonCommands';
 import { getConfiguredAdmission, type ClientName } from './ClientAdmissionControls';
 import { ClientOperationRenderer } from './ClientOperationRenderer';
 import type { AgentProgressRenderer } from './AgentProgressRenderer';
+import { withNativeLockWaitNotices, type INativeLockWaitNoticeHandlers } from './nativeLockWaitNotice';
 import {
   CANCELLATION_SIGNALS,
   formatCancellationMessage,
@@ -272,13 +273,17 @@ export async function launchClientAsync(
     }
     await renderer.initializeAsync();
     agentRenderer?.onRequestSent();
-    const requestNotices: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
-      rushx,
-      agentRenderer,
-      stderrIsTTY: !!process.stderr.isTTY,
-      daemonPid: (await client.status).pid,
-      writeStderrAsync: (text) => output.stderr.writeAsync(Buffer.from(text))
-    });
+    const writeStderrAsync = (text: string): Promise<void> => output.stderr.writeAsync(Buffer.from(text));
+    const requestNotices: INativeLockWaitNoticeHandlers = withNativeLockWaitNotices(
+      createDaemonRequestNoticeHandlers({
+        rushx,
+        agentRenderer,
+        stderrIsTTY: !!process.stderr.isTTY,
+        daemonPid: (await client.status).pid,
+        writeStderrAsync
+      }),
+      { rushx, agentRenderer, writeStderrAsync }
+    );
     notices = requestNotices;
     outcome = await executeWithDaemonRestartAsync(client, connection, {
       request,
diff --git a/apps/rush-cli-client/src/nativeLockWaitNotice.ts b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
new file mode 100644
index 0000000000..a299436557
--- /dev/null
+++ b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
@@ -0,0 +1,125 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatNativeLockHolder, type IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
+import type { DaemonRestartReason, IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+
+import type { IDaemonRequestNoticeHandlers } from './daemonRestartNotice';
+
+/** A request that waits for another Rush process says so again when it has written nothing about it for this long. */
+export const NATIVE_LOCK_WAIT_REPEAT_MS: number = 10_000;
+
+/**
+ * Says what a request waits for while a Rush process that the daemon does not run holds the repository's lock, for
+ * example "waiting for another Rush process (PID 41: rush install) to release this repository's lock", and from a
+ * second on, "still waiting after 10s for another Rush process (PID 41: rush install) to release ...".
+ */
+export function formatNativeLockWait(holder: IDaemonNativeLockHolder, elapsedMs: number = 0): string {
+  const waiting: string =
+    elapsedMs < 1000 ? 'waiting' : `still waiting after ${Math.round(elapsedMs / 1000)}s`;
+  return `${waiting} for ${formatNativeLockHolder(holder)} to release this repository's lock`;
+}
+
+/** Where the lines of {@link withNativeLockWaitNotices} go. */
+export interface INativeLockWaitNoticeTarget {
+  readonly rushx: boolean;
+  /** See `AgentProgressRenderer.onRestartWait`, which shows any wait of a request that is not a queue position. */
+  readonly agentRenderer: { onRestartWait(wait: string, announce: boolean): unknown } | undefined;
+  readonly writeStderrAsync: (text: string) => Promise<void>;
+  /** Returns the current time in milliseconds. Defaults to `Date.now`. */
+  readonly now?: () => number;
+}
+
+/** A request's notice handlers, whose queue positions can say that it waits for native Rush's repository lock. */
+export interface INativeLockWaitNoticeHandlers extends IDaemonRequestNoticeHandlers {
+  readonly onQueuePositionAsync: (
+    position: number,
+    restartReason?: DaemonRestartReason,
+    restartWait?: IDaemonRestartWaitDetails,
+    nativeLockHolder?: IDaemonNativeLockHolder
+  ) => Promise<void>;
+}
+
+interface INativeLockWaitState {
+  readonly startedAtMs: number;
+  holder: IDaemonNativeLockHolder;
+  /** Identifies the process that the last line named. */
+  key: string;
+  timer: ReturnType<typeof setTimeout> | undefined;
+}
+
+/**
+ * Adds to a request's notice `handlers` the lines that say that the request waits for a Rush process that the daemon
+ * does not run to release the repository's lock, and which process that is.
+ *
+ * @remarks
+ * Without an agent renderer, a terminal and a pipe get a line at once and whenever another process holds the lock,
+ * and the line again with the time waited when {@link NATIVE_LOCK_WAIT_REPEAT_MS} passes without one. An agent
+ * renderer shows the wait as its phase instead, which its status lines repeat, and announces each process on a pipe.
+ * The wait ends when the request gets another queue position, restarts, gets input, output or an event, or ends.
+ * The other notices are the ones that `handlers` gives.
+ */
+export function withNativeLockWaitNotices(
+  handlers: IDaemonRequestNoticeHandlers,
+  target: INativeLockWaitNoticeTarget
+): INativeLockWaitNoticeHandlers {
+  const { agentRenderer, now = Date.now } = target;
+  const prefix: string = target.rushx ? 'rushx-client' : 'rush-client';
+  let wait: INativeLockWaitState | undefined;
+  let disposed: boolean = false;
+
+  const endWait = (): void => {
+    clearTimeout(wait?.timer);
+    wait = undefined;
+  };
+  const writeWaitAsync = async (state: INativeLockWaitState): Promise<void> => {
+    clearTimeout(state.timer);
+    state.timer = setTimeout(() => {
+      if (wait === state) writeWaitAsync(state).catch(() => undefined);
+    }, NATIVE_LOCK_WAIT_REPEAT_MS);
+    state.timer.unref?.();
+    const line: string = formatNativeLockWait(state.holder, now() - state.startedAtMs);
+    await target.writeStderrAsync(`${prefix}: ${line}.\n`);
+  };
+
+  return {
+    onRestartAsync: async (notice) => {
+      endWait();
+      await handlers.onRestartAsync(notice);
+    },
+    onQueuePositionAsync: async (position, restartReason, restartWait, nativeLockHolder) => {
+      if (!nativeLockHolder || restartReason) {
+        endWait();
+        return await handlers.onQueuePositionAsync(position, restartReason, restartWait);
+      }
+      if (disposed) return;
+      // This ends a wait for a daemon restart, if the request waited for one; it waits for the lock instead.
+      handlers.onRequestProgress();
+      const key: string = `${nativeLockHolder.pid}:${nativeLockHolder.command}`;
+      if (wait?.key === key) return;
+      const state: INativeLockWaitState = (wait ??= {
+        startedAtMs: now(),
+        holder: nativeLockHolder,
+        key,
+        timer: undefined
+      });
+      state.holder = nativeLockHolder;
+      state.key = key;
+      if (agentRenderer) agentRenderer.onRestartWait(formatNativeLockWait(nativeLockHolder), true);
+      else await writeWaitAsync(state);
+    },
+    onInputAdmittedAsync: async () => {
+      endWait();
+      await handlers.onInputAdmittedAsync();
+    },
+    onRequestProgress: () => {
+      endWait();
+      handlers.onRequestProgress();
+    },
+    dispose: () => {
+      disposed = true;
+      endWait();
+      handlers.dispose();
+    }
+  };
+}
diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
new file mode 100644
index 0000000000..1ce5e77b81
--- /dev/null
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -0,0 +1,193 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonRestartReason, IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+
+import {
+  RESTART_WAIT_REPEAT_MS,
+  createDaemonRequestNoticeHandlers,
+  type IDaemonRequestNoticeTarget
+} from '../daemonRestartNotice';
+import {
+  NATIVE_LOCK_WAIT_REPEAT_MS,
+  formatNativeLockWait,
+  withNativeLockWaitNotices,
+  type INativeLockWaitNoticeHandlers
+} from '../nativeLockWaitNotice';
+
+const INSTALL: IDaemonNativeLockHolder = { pid: 41, command: 'rush install' };
+const UPDATE: IDaemonNativeLockHolder = { pid: 52, command: 'rush update' };
+const LOCKFILE: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const INSTALL_LOCK: string = "another Rush process (PID 41: rush install) to release this repository's lock";
+const UPDATE_LOCK: string = "another Rush process (PID 52: rush update) to release this repository's lock";
+
+describe(formatNativeLockWait.name, () => {
+  it('names the process that holds the lock as far as it is known, and from a second on, the time waited', () => {
+    expect(formatNativeLockWait(INSTALL)).toBe(`waiting for ${INSTALL_LOCK}`);
+    expect(formatNativeLockWait({ pid: 41 }, 999)).toBe(
+      "waiting for another Rush process (PID 41) to release this repository's lock"
+    );
+    expect(formatNativeLockWait({}, 10_400)).toBe(
+      "still waiting after 10s for another Rush process to release this repository's lock"
+    );
+  });
+});
+
+describe(withNativeLockWaitNotices.name, () => {
+  let clock: number;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    clock = 0;
+  });
+  afterEach(() => jest.useRealTimers());
+
+  function advance(ms: number): void {
+    clock += ms;
+    jest.advanceTimersByTime(ms);
+  }
+
+  function createHandlers(options: { agent: boolean; stderrIsTTY: boolean; rushx?: boolean }): {
+    calls: string[];
+    handlers: INativeLockWaitNoticeHandlers;
+  } {
+    const calls: string[] = [];
+    const target: IDaemonRequestNoticeTarget = {
+      rushx: !!options.rushx,
+      stderrIsTTY: options.stderrIsTTY,
+      daemonPid: 7,
+      now: () => clock,
+      agentRenderer: options.agent
+        ? {
+            note: (line: string) => calls.push(`note: ${line}`),
+            setPhase: (phase: string) => calls.push(`phase: ${phase}`),
+            onQueuePosition: (position: number) => calls.push(`position: ${position}`),
+            // A renderer may say whether it wrote the wait as a line.
+            onRestartWait: (wait: string, announce: boolean) => {
+              calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`);
+              return announce;
+            }
+          }
+        : undefined,
+      writeStderrAsync: async (text: string) => {
+        calls.push(`stderr: ${text}`);
+      }
+    };
+    return { calls, handlers: withNativeLockWaitNotices(createDaemonRequestNoticeHandlers(target), target) };
+  }
+
+  describe.each([
+    ['rush-client', false],
+    ['rushx-client', true]
+  ])('%s without an agent renderer', (client: string, rushx: boolean) => {
+    it('writes the wait line at once, on a pipe and a terminal', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+        handlers.dispose();
+        expect(calls).toEqual([`stderr: ${client}: waiting for ${INSTALL_LOCK}.\n`]);
+      }
+    });
+
+    it('repeats the line with the time waited every 10 s, and at once when another process holds the lock', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+      advance(4000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS - 4001);
+      expect(calls).toHaveLength(1);
+      advance(1);
+      advance(2000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS);
+      handlers.dispose();
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS * 3);
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 10s for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 12s for ${UPDATE_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 22s for ${UPDATE_LOCK}.\n`
+      ]);
+      expect(calls.join('')).not.toContain('admission failed');
+    });
+  });
+
+  it.each([
+    ['output or an event', (handlers: INativeLockWaitNoticeHandlers) => handlers.onRequestProgress(), []],
+    ['input', (handlers: INativeLockWaitNoticeHandlers) => handlers.onInputAdmittedAsync(), []],
+    [
+      'a queue position',
+      (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(2),
+      ['stderr: rush-client: waiting for daemon admission (position 2).\n']
+    ],
+    [
+      'a restart',
+      (handlers: INativeLockWaitNoticeHandlers) =>
+        handlers.onRestartAsync({
+          restart: 1,
+          reason: { kind: 'installationChanged', change: 'removed', folder: '/snapshots/s9' },
+          successorPid: 42
+        }),
+      [
+        "stderr: rush-client: The daemon's installation at /snapshots/s9 was removed; restarted the daemon (PID 42).\n"
+      ]
+    ],
+    [
+      'a wait for a restart',
+      (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(1, LOCKFILE, {}),
+      [
+        'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
+          'common/config/rush/pnpm-lock.yaml changed.\n'
+      ]
+    ]
+  ])('stops when the request gets %s, whose own notice it gives', async (name, endAsync, notices) => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await endAsync(handlers);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS * 2);
+    expect(calls).toEqual([`stderr: rush-client: waiting for ${INSTALL_LOCK}.\n`, ...notices]);
+    handlers.dispose();
+  });
+
+  it('ends a wait for a daemon restart when the request waits for the lock instead', async () => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS);
+    // The restart wait line would have been repeated by now.
+    advance(RESTART_WAIT_REPEAT_MS - 2 * NATIVE_LOCK_WAIT_REPEAT_MS);
+    handlers.dispose();
+    expect(calls).toEqual([
+      'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
+        'common/config/rush/pnpm-lock.yaml changed.\n',
+      `stderr: rush-client: waiting for ${INSTALL_LOCK}.\n`,
+      `stderr: rush-client: still waiting after 10s for ${INSTALL_LOCK}.\n`,
+      `stderr: rush-client: still waiting after 20s for ${INSTALL_LOCK}.\n`
+    ]);
+  });
+
+  it('writes nothing more once the request ends or the client asks rushd to cancel it', async () => {
+    const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    handlers.dispose();
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS * 3);
+    expect(calls).toEqual([`stderr: rush-client: waiting for ${INSTALL_LOCK}.\n`]);
+  });
+
+  it('shows the wait as the agent phase, announcing each process that holds the lock, and writes no line', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    advance(NATIVE_LOCK_WAIT_REPEAT_MS * 3);
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    handlers.onRequestProgress();
+    handlers.dispose();
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    expect(calls).toEqual([`announce: waiting for ${INSTALL_LOCK}`, `announce: waiting for ${UPDATE_LOCK}`]);
+  });
+});
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json b/common/changes/@rushstack/rush-cli-client/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
new file mode 100644
index 0000000000..7d71828eac
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "While the daemon waits for a Rush process that it does not run to release the repository's lock, `rush-client` says so at once on stderr, naming the process (`rush-client: waiting for another Rush process (PID 12345: rush install) to release this repository's lock.`), and again with the time waited every 10 seconds. Agent output shows the wait as its progress phase.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json b/common/changes/@rushstack/rush-client-core/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
new file mode 100644
index 0000000000..3a9ee4bfbc
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "`onQueuePositionAsync` gets the Rush process that holds the repository's lock as a fourth argument while the request waits for it. Add `findNativeLockHolder`, which names that process from the common temp folder's lock files (on Linux, its PID and its program and action, such as `rush install`), and `formatNativeLockHolder`, which words it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
new file mode 100644
index 0000000000..c0bca9e9df
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `nativeLockHolder` (`IDaemonNativeLockHolder`: `pid` and `command`) to queue positions, which says that a request waits for a Rush process that the daemon does not run to release the repository's lock, and which process that is. Older clients ignore it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json b/common/changes/@rushstack/rush-daemon/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
new file mode 100644
index 0000000000..78982f9080
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-o04-t111-native-lock-wait_2026-09-29-11-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "While a Rush process that the daemon does not run, such as `rush install` or a `--no-daemon` build, holds the repository's lock, a request now waits for it within its wait timeout, at the first engine initialization, at a reload and before each iteration, and tells its client which process that is. Before, the request failed at once with \"Another Rush command is already running in this repository.\" `--no-wait` and a zero timeout still fail at once, now as admission failures that name the process. A request still fails at once when the daemon itself holds the lock.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index e6df04fe86..5c053eb327 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -9,6 +9,7 @@ import { IDaemonClientCaps } from '@rushstack/rush-daemon-protocol';
 import { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
 import { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonLockfile } from '@rushstack/rush-daemon-transport';
+import { IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
 import { IDaemonOrphanReap } from '@rushstack/rush-daemon-transport';
 import { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { IDaemonPongMessage } from '@rushstack/rush-daemon-protocol';
@@ -89,12 +90,18 @@ export class DaemonStartupPendingError extends Error {
 // @beta
 export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, options: IExecuteWithDaemonRestartOptions): Promise<DaemonClientOutcome>;
 
+// @beta
+export function findNativeLockHolder(lockFolder: string, ownPid?: number): IDaemonNativeLockHolder;
+
 // @beta
 export function findReclaimedDaemonPid(paths: IDaemonPaths): number | undefined;
 
 // @beta
 export function formatDaemonRestartCause(reason: DaemonRestartReason, requester: DaemonRestartRequester): string | undefined;
 
+// @beta
+export function formatNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): string;
+
 // @beta
 export function getDaemonLogFilePath(paths: IDaemonPaths): string;
 
@@ -158,7 +165,7 @@ export interface IDaemonClientExecuteOptions {
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
     readonly onInputAdmittedAsync?: () => Promise<void>;
-    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails) => Promise<void>;
+    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails, nativeLockHolder?: IDaemonNativeLockHolder) => Promise<void>;
     // (undocumented)
     readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
     // (undocumented)
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 6f42fd441e..9456141c90 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -422,6 +422,12 @@ export interface IDaemonLogChunk {
     readonly operationId: string;
 }
 
+// @beta
+export interface IDaemonNativeLockHolder {
+    readonly command?: string;
+    readonly pid?: number;
+}
+
 // @beta
 export interface IDaemonOperationHeaderPayload {
     readonly completedOperations: number;
@@ -583,6 +589,7 @@ export interface IDaemonRequestQueuePositionMessage {
         readonly restartReason?: DaemonRestartReason;
         readonly scriptCount?: number;
         readonly restartsForAnotherRequest?: boolean;
+        readonly nativeLockHolder?: IDaemonNativeLockHolder;
     };
 }
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 14d42bad94..b612787c81 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -65,7 +65,13 @@ third argument: `scriptCount`, how many of the requests ahead run a rushx script
 `restartsForAnotherRequest`, set for a rushx script that waits for another request's restart.
 `formatDaemonRestartCause` words a reason as the end of "the daemon restarts ...", for the
 request or for such a script, and `onInputAdmittedAsync` reports when the daemon first admits
-the request's input, which for a rushx script is when the script starts. After each hand-off
+the request's input, which for a rushx script is when the script starts. While the request
+waits for a Rush process that the daemon does not run to release the repository's lock,
+`onQueuePositionAsync` gets that process as its fourth argument (`nativeLockHolder`).
+`findNativeLockHolder` finds it the way the daemon does, from the `rush#<pid>.lock` files in the
+common temp folder: on Linux, the live process with the oldest one, and its program and action
+from `/proc`, such as `rush install`, never its other arguments; elsewhere, nothing.
+`formatNativeLockHolder` words it, for example `another Rush process (PID 12345: rush install)`. After each hand-off
 to a ready successor, the optional `onRestartAsync` callback gets the restart number, the
 reason (`undefined` when the daemon gave none, as older daemons do) and the successor's PID,
 before the request is resubmitted.
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 5cc57b07d9..f624d27f3a 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -24,6 +24,7 @@ import {
   type IDaemonCommandResult,
   type IDaemonEventEnvelope,
   type IDaemonFrame,
+  type IDaemonNativeLockHolder,
   type IDaemonPongMessage,
   type IDaemonProtocolVersion,
   type IDaemonRequestEnvelope,
@@ -89,7 +90,12 @@ export interface IDaemonClientExecuteOptions {
   readonly onQueuePositionAsync?: (
     position: number,
     restartReason?: DaemonRestartReason,
-    restartWait?: IDaemonRestartWaitDetails
+    restartWait?: IDaemonRestartWaitDetails,
+    /**
+     * Set while the request waits for a Rush process that the daemon does not run to release the repository's lock,
+     * with what the daemon knows about that process.
+     */
+    nativeLockHolder?: IDaemonNativeLockHolder
   ) => Promise<void>;
   /**
    * Called once, when the daemon first admits the request's input. For a rushx script, that is when the script
@@ -632,11 +638,14 @@ export class DaemonClient {
         }
         return;
       case 'queuePosition': {
-        const { position, restartReason, scriptCount, restartsForAnotherRequest } = message.payload;
-        await execution.onQueuePositionAsync?.(position, restartReason, {
-          scriptCount,
-          restartsForAnotherRequest
-        });
+        const { position, restartReason, scriptCount, restartsForAnotherRequest, nativeLockHolder } =
+          message.payload;
+        await execution.onQueuePositionAsync?.(
+          position,
+          restartReason,
+          { scriptCount, restartsForAnotherRequest },
+          nativeLockHolder
+        );
         return;
       }
       default:
diff --git a/libraries/rush-client-core/src/NativeLockHolder.ts b/libraries/rush-client-core/src/NativeLockHolder.ts
new file mode 100644
index 0000000000..470be7a7b6
--- /dev/null
+++ b/libraries/rush-client-core/src/NativeLockHolder.ts
@@ -0,0 +1,114 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type { IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+
+import { tryGetProcessStartTimeMs } from './ProcessStartTime';
+
+/** The name of each lock file that LockFile.acquire(folder, 'rush') writes on Linux and macOS. */
+const LOCK_FILE_PATTERN: RegExp = /^rush#(\d+)\.lock$/;
+const SCRIPT_EXTENSION_PATTERN: RegExp = /\.[cm]?js$/;
+const PROGRAM_PATTERN: RegExp = /^[\w@.+-]{1,40}$/;
+const ACTION_PATTERN: RegExp = /^[a-z][\w:.-]{0,39}$/i;
+/** A process that began this long after a lock file was written cannot have written it: its PID was reused. */
+const PID_REUSE_MARGIN_MS: number = 2000;
+const HOLDER_DESCRIPTION: string = 'another Rush process';
+
+interface ILockFileCandidate {
+  readonly pid: number;
+  readonly writtenMs: number;
+}
+
+/**
+ * Names the process that holds Rush's repository lock in `lockFolder`, the common temp folder, as far as this
+ * platform can tell. Like LockFile, it treats the live process with the oldest lock file as the holder, and it
+ * ignores `ownPid`, empty lock files (processes still trying to acquire) and lock files of exited processes.
+ * Only Linux can tell a live holder from a stale lock file, so other platforms name no holder.
+ *
+ * The command is the program and its action, such as `rush install`. Later arguments can hold secrets, so they
+ * are never included. This reads files only, and never signals any process.
+ * @beta
+ */
+export function findNativeLockHolder(
+  lockFolder: string,
+  ownPid: number = process.pid
+): IDaemonNativeLockHolder {
+  if (process.platform !== 'linux') return {};
+  const holder: ILockFileCandidate | undefined = readLockFileCandidates(lockFolder, ownPid)
+    .sort((a, b) => a.writtenMs - b.writtenMs)
+    .find(isWrittenByLiveProcess);
+  if (!holder) return {};
+  const command: string | undefined = formatNativeLockCommand(readCommandLine(holder.pid));
+  return command === undefined ? { pid: holder.pid } : { pid: holder.pid, command };
+}
+
+/**
+ * Shortens the command line of a Node.js process to its program and action, for example
+ * `node /home/u/.rush/node_modules/@microsoft/rush/bin/rush install --bypass-policy` to `rush install`.
+ * Returns `undefined` when the command line does not run a script, or its program name is unusual.
+ * @beta
+ */
+export function formatNativeLockCommand(argv: readonly string[]): string | undefined {
+  const [, script, ...args] = argv;
+  if (!script || script.startsWith('-')) return undefined;
+  const program: string = path.basename(script).replace(SCRIPT_EXTENSION_PATTERN, '');
+  if (!PROGRAM_PATTERN.test(program)) return undefined;
+  // Only the first argument that is not an option can be the action; what follows it is never shown.
+  const action: string | undefined = args.find((arg) => !arg.startsWith('-'));
+  return action !== undefined && ACTION_PATTERN.test(action) ? `${program} ${action}` : program;
+}
+
+/**
+ * Describes the Rush process that holds the repository lock, for example
+ * `another Rush process (PID 12345: rush install)`, naming only what is known.
+ * @beta
+ */
+export function formatNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): string {
+  const pid: string | undefined = holder?.pid === undefined ? undefined : `PID ${holder.pid}`;
+  const details: string = [pid, holder?.command].filter((detail) => detail !== undefined).join(': ');
+  return details ? `${HOLDER_DESCRIPTION} (${details})` : HOLDER_DESCRIPTION;
+}
+
+function readLockFileCandidates(lockFolder: string, ownPid: number): ILockFileCandidate[] {
+  let names: string[];
+  try {
+    names = fs.readdirSync(lockFolder);
+  } catch {
+    return [];
+  }
+  const candidates: ILockFileCandidate[] = [];
+  for (const name of names) {
+    const pid: number = Number(LOCK_FILE_PATTERN.exec(name)?.[1]);
+    if (!Number.isSafeInteger(pid) || pid === ownPid) continue;
+    const candidate: ILockFileCandidate | undefined = tryReadCandidate(path.join(lockFolder, name), pid);
+    if (candidate) candidates.push(candidate);
+  }
+  return candidates;
+}
+
+function tryReadCandidate(filePath: string, pid: number): ILockFileCandidate | undefined {
+  try {
+    const stats: fs.Stats = fs.statSync(filePath);
+    // A process writes its start time into its lock file right after creating it, and before it can hold the lock.
+    return stats.size > 0 ? { pid, writtenMs: stats.mtimeMs } : undefined;
+  } catch {
+    // The process released the lock and deleted its lock file.
+    return undefined;
+  }
+}
+
+function isWrittenByLiveProcess({ pid, writtenMs }: ILockFileCandidate): boolean {
+  const startMs: number | undefined = tryGetProcessStartTimeMs(pid);
+  return startMs !== undefined && startMs <= writtenMs + PID_REUSE_MARGIN_MS;
+}
+
+function readCommandLine(pid: number): string[] {
+  try {
+    return fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0$/, '').split('\0');
+  } catch {
+    return [];
+  }
+}
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index f16290e02d..e855b5640d 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -51,3 +51,4 @@ export {
   type IConnectOrStartDaemonOptions,
   type IDaemonStartCommand
 } from './connectOrStartDaemon';
+export { findNativeLockHolder, formatNativeLockHolder } from './NativeLockHolder';
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index 5cb7c9ddf4..7209d31b34 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -427,6 +427,37 @@ describe('DaemonClient', () => {
     expect(outcome).toMatchObject({ kind: 'result', result: { retryAfterRestart: true, restartReason } });
   });
 
+  it('reports which Rush process a request waits for when it holds the repository lock', async () => {
+    const holder = { pid: 4242, command: 'rush install' } as const;
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      const { requestId } = message.payload;
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, nativeLockHolder: holder }
+      });
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId, nativeLockHolder: {} } });
+      await sendAsync({ kind: 'queuePosition', payload: { position: 2, requestId } });
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    };
+    const positions: unknown[] = [];
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await client.executeAsync({
+      request: request(),
+      onQueuePositionAsync: async (...args: unknown[]) => {
+        positions.push([args[0], args[1], args[3]]);
+      }
+    });
+    expect(positions).toEqual([
+      [1, undefined, holder],
+      [1, undefined, {}],
+      [2, undefined, undefined]
+    ]);
+  });
+
   it('reports once, before any input is forwarded, that the daemon admitted input', async () => {
     const stdin = new PassThrough();
     const seen: string[] = [];
diff --git a/libraries/rush-client-core/src/test/NativeLockHolder.test.ts b/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
new file mode 100644
index 0000000000..b61232adcc
--- /dev/null
+++ b/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
@@ -0,0 +1,167 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { findNativeLockHolder, formatNativeLockCommand, formatNativeLockHolder } from '../NativeLockHolder';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/native-lock-holder');
+const HOUR_MS: number = 60 * 60 * 1000;
+
+function createLockFolder(name: string): string {
+  const folder: string = path.join(TEST_FOLDER, name);
+  fs.rmSync(folder, { recursive: true, force: true });
+  fs.mkdirSync(folder, { recursive: true });
+  return folder;
+}
+
+/** Writes a lock file as LockFile.acquire does, with its owner's start time, and dates it `ageMs` back. */
+function writeLockFile(
+  folder: string,
+  pid: number,
+  ageMs: number = 0,
+  content: string = 'start time',
+  resourceName: string = 'rush'
+): void {
+  const filePath: string = path.join(folder, `${resourceName}#${pid}.lock`);
+  fs.writeFileSync(filePath, content);
+  const time: Date = new Date(Date.now() - ageMs);
+  fs.utimesSync(filePath, time, time);
+}
+
+/** Starts a process that looks like `<program> <args>` to /proc, and runs until its stdin ends. */
+async function startProgramAsync(folder: string, program: string, args: string[]): Promise<ChildProcess> {
+  const script: string = path.join(folder, program);
+  fs.writeFileSync(script, "process.stdin.resume();process.stdin.on('end',()=>process.exit(0));");
+  const child: ChildProcess = spawn(process.execPath, [script, ...args], {
+    stdio: ['pipe', 'ignore', 'ignore']
+  });
+  await once(child, 'spawn');
+  return child;
+}
+
+async function stopProgramAsync(child: ChildProcess): Promise<void> {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  const closed: Promise<unknown[]> = once(child, 'close');
+  child.stdin!.end();
+  await closed;
+}
+
+async function getExitedPidAsync(): Promise<number> {
+  const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
+  await once(exited, 'close');
+  return exited.pid!;
+}
+
+describe(formatNativeLockHolder.name, () => {
+  it.each([
+    [{ pid: 12345, command: 'rush install' }, 'another Rush process (PID 12345: rush install)'],
+    [{ pid: 12345 }, 'another Rush process (PID 12345)'],
+    [{ command: 'rush install' }, 'another Rush process (rush install)'],
+    [{}, 'another Rush process'],
+    [undefined, 'another Rush process']
+  ])('names %j as %j', (holder, expected) => {
+    expect(formatNativeLockHolder(holder)).toBe(expected);
+  });
+});
+
+describe(formatNativeLockCommand.name, () => {
+  it.each([
+    [
+      ['node', '/home/u/.rush/node_modules/@microsoft/rush/bin/rush', 'install', '--bypass-policy'],
+      'rush install'
+    ],
+    [
+      ['/usr/bin/node', '/repo/common/scripts/install-run-rush.js', '--debug', 'build'],
+      'install-run-rush build'
+    ],
+    [['node', '/opt/rush-client', '--wait-timeout', '30', 'build'], 'rush-client'],
+    [['node', '/repo/node_modules/.bin/rushx'], 'rushx'],
+    [['node', '/repo/rush', 'publish:beta'], 'rush publish:beta'],
+    [['node', '-e', 'require("x")'], undefined],
+    [['node'], undefined],
+    [['node', '/weird path/rush (copy)', 'build'], undefined]
+  ])('shortens %j to %j', (argv: string[], expected: string | undefined) => {
+    expect(formatNativeLockCommand(argv)).toBe(expected);
+  });
+
+  it('keeps no argument after the action, which could hold a secret', () => {
+    expect(formatNativeLockCommand(['node', '/repo/rush', 'publish', '--npm-auth-token', 'secret'])).toBe(
+      'rush publish'
+    );
+  });
+});
+
+describe(findNativeLockHolder.name, () => {
+  const children: ChildProcess[] = [];
+
+  afterEach(async () => {
+    await Promise.all(children.splice(0).map(stopProgramAsync));
+  });
+
+  linuxIt('names the live process with the oldest lock file, and its command', async () => {
+    const folder: string = createLockFolder('holder');
+    const holder: ChildProcess = await startProgramAsync(folder, 'rush', ['install', '--bypass-policy']);
+    const contender: ChildProcess = await startProgramAsync(folder, 'rush.js', ['build']);
+    children.push(holder, contender);
+    // An older lock file of an exited process is stale, and the daemon's own lock file is its own.
+    writeLockFile(folder, await getExitedPidAsync(), 3000);
+    writeLockFile(folder, process.pid, 2000);
+    writeLockFile(folder, holder.pid!, 1000);
+    writeLockFile(folder, contender.pid!, 0);
+    // PID 1 runs, and began long ago, but its lock file is for another resource.
+    writeLockFile(folder, 1, 4000, 'start time', 'other');
+
+    expect(findNativeLockHolder(folder)).toEqual({ pid: holder.pid, command: 'rush install' });
+  });
+
+  linuxIt(
+    'skips a lock file whose PID now belongs to a process that started after it was written',
+    async () => {
+      const folder: string = createLockFolder('reused-pid');
+      const reused: ChildProcess = await startProgramAsync(folder, 'rush', ['build']);
+      const holder: ChildProcess = await startProgramAsync(folder, 'rush', ['update']);
+      children.push(reused, holder);
+      writeLockFile(folder, reused.pid!, HOUR_MS);
+      writeLockFile(folder, holder.pid!, 0);
+
+      expect(findNativeLockHolder(folder)).toEqual({ pid: holder.pid, command: 'rush update' });
+    }
+  );
+
+  linuxIt(
+    'skips an empty lock file, which a process writes before it knows whether it acquired the lock',
+    async () => {
+      const folder: string = createLockFolder('empty');
+      const contender: ChildProcess = await startProgramAsync(folder, 'rush', ['build']);
+      children.push(contender);
+      writeLockFile(folder, contender.pid!, 0, '');
+
+      expect(findNativeLockHolder(folder)).toEqual({});
+    }
+  );
+
+  linuxIt('names only the PID of a holder whose command it cannot shorten', async () => {
+    const folder: string = createLockFolder('no-command');
+    const holder: ChildProcess = spawn(process.execPath, ['-e', 'process.stdin.resume()'], {
+      stdio: ['pipe', 'ignore', 'ignore']
+    });
+    await once(holder, 'spawn');
+    children.push(holder);
+    writeLockFile(folder, holder.pid!);
+
+    expect(findNativeLockHolder(folder)).toEqual({ pid: holder.pid });
+  });
+
+  it('names no holder when the folder has no live lock file, or cannot be read', async () => {
+    const folder: string = createLockFolder('none');
+    writeLockFile(folder, await getExitedPidAsync());
+
+    expect(findNativeLockHolder(folder)).toEqual({});
+    expect(findNativeLockHolder(path.join(folder, 'missing'))).toEqual({});
+  });
+});
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index dfc43d3a05..cd6841545e 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -34,7 +34,10 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   `install` or `update`).
   `workspaceInputsChanged` names the installation files or the files of Rush and its plugins that
   changed since the daemon started, or the Rush version that the request selects. Older daemons
-  omit these fields, and clients ignore reason kinds they do not know.
+  omit these fields, and clients ignore reason kinds they do not know. A queue position may instead
+  carry `nativeLockHolder` (`IDaemonNativeLockHolder`) while the request waits for a Rush process
+  that the daemon does not run to release the repository's lock: that process's `pid` and
+  `command`, such as `rush install`, as far as the daemon can tell. Its `position` is then 1.
 - **Request lifecycle contracts** — a validated presentation-free command envelope, cancellation,
   typed routing rejection/fallback, and one authoritative terminal result control. Command parsing
   and Rush action construction remain outside the protocol.
diff --git a/libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts b/libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts
new file mode 100644
index 0000000000..a32cd92bb2
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonNativeLockHolder.ts
@@ -0,0 +1,14 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * A Rush process that the daemon does not run, such as `rush install`, which holds the repository's lock, as far as
+ * the daemon can tell.
+ * @beta
+ */
+export interface IDaemonNativeLockHolder {
+  /** The process ID of the holder. Omitted when the lock does not name it, as on Windows. */
+  readonly pid?: number;
+  /** The holder's command, shortened to the program and its action, such as `rush install`. Omitted when unknown. */
+  readonly command?: string;
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 246df13bed..904eb67e5e 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -2,10 +2,10 @@
 // See LICENSE in the project root for license information.
 
 import type { DaemonRestartReason } from './DaemonInstallationChange';
+import type { IDaemonNativeLockHolder } from './DaemonNativeLockHolder';
 
 /** The largest wait timeout accepted by Node.js timers. @beta */
 export const MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS: number = 0x7fffffff;
-const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
 
 /** A typed reason why a daemon request was not admitted. @beta */
 export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-timeout';
@@ -46,53 +46,10 @@ export interface IDaemonRequestQueuePositionMessage {
     readonly scriptCount?: number;
     /** Set with `restartReason` for a rushx script that waits for another request's restart, not its own. */
     readonly restartsForAnotherRequest?: boolean;
+    /**
+     * Set while the request waits for a Rush process that the daemon does not run to release the repository's
+     * lock, rather than for other requests. `position` is then 1. Older daemons omit it; older clients ignore it.
+     */
+    readonly nativeLockHolder?: IDaemonNativeLockHolder;
   };
 }
-
-/** Validates resolved admission values at a daemon request boundary. @beta */
-export function validateDaemonRequestAdmissionOptions(
-  options: IDaemonRequestAdmissionOptions | undefined
-): void {
-  if (options === undefined) {
-    return;
-  }
-  validateAdmissionRecord(options);
-  validateBoolean(options.noWait, 'noWait');
-  validateBoolean(options.waitTimeoutIsDefault, 'waitTimeoutIsDefault');
-  validateWaitTimeout(options.waitTimeoutMs);
-}
-
-function validateAdmissionRecord(options: IDaemonRequestAdmissionOptions): void {
-  if (typeof options !== 'object' || options === null) {
-    throw new TypeError('Daemon request admission options must be an object.');
-  }
-}
-
-function validateBoolean(value: unknown, name: string): void {
-  if (value !== undefined && typeof value !== 'boolean') {
-    throw new TypeError(`Daemon request admission ${name} must be a boolean.`);
-  }
-}
-
-function validateWaitTimeout(value: unknown): void {
-  if (value === undefined) {
-    return;
-  }
-  if (!isBoundedInteger(value)) {
-    throw new RangeError(
-      `Daemon request admission waitTimeoutMs must be an integer between 0 and ${MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS}.`
-    );
-  }
-}
-
-function isBoundedInteger(value: unknown): value is number {
-  return isInteger(value) && isWithinWaitTimeoutRange(value);
-}
-
-function isInteger(value: unknown): value is number {
-  return typeof value === 'number' && Number.isInteger(value);
-}
-
-function isWithinWaitTimeoutRange(value: number): boolean {
-  return value >= MINIMUM_WAIT_TIMEOUT_MS && value <= MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS;
-}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts
new file mode 100644
index 0000000000..aa7b1a4703
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmissionValidation.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
+import { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
+
+const MINIMUM_WAIT_TIMEOUT_MS: number = 0;
+
+/** Validates resolved admission values at a daemon request boundary. @beta */
+export function validateDaemonRequestAdmissionOptions(
+  options: IDaemonRequestAdmissionOptions | undefined
+): void {
+  if (options === undefined) {
+    return;
+  }
+  validateAdmissionRecord(options);
+  validateBoolean(options.noWait, 'noWait');
+  validateBoolean(options.waitTimeoutIsDefault, 'waitTimeoutIsDefault');
+  validateWaitTimeout(options.waitTimeoutMs);
+}
+
+function validateAdmissionRecord(options: IDaemonRequestAdmissionOptions): void {
+  if (typeof options !== 'object' || options === null) {
+    throw new TypeError('Daemon request admission options must be an object.');
+  }
+}
+
+function validateBoolean(value: unknown, name: string): void {
+  if (value !== undefined && typeof value !== 'boolean') {
+    throw new TypeError(`Daemon request admission ${name} must be a boolean.`);
+  }
+}
+
+function validateWaitTimeout(value: unknown): void {
+  if (value === undefined) {
+    return;
+  }
+  if (!isBoundedInteger(value)) {
+    throw new RangeError(
+      `Daemon request admission waitTimeoutMs must be an integer between 0 and ${MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS}.`
+    );
+  }
+}
+
+function isBoundedInteger(value: unknown): value is number {
+  return isInteger(value) && isWithinWaitTimeoutRange(value);
+}
+
+function isInteger(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value);
+}
+
+function isWithinWaitTimeoutRange(value: number): boolean {
+  return value >= MINIMUM_WAIT_TIMEOUT_MS && value <= MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS;
+}
diff --git a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
index 357b57f0fd..d81ee7cd6a 100644
--- a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
@@ -1,10 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
 import { validateQueuedRestartReason } from './InstallationChangeValidation';
 
 const EMPTY_STRING_LENGTH: number = 0;
+const FIRST_PROCESS_ID: number = 1;
 const FIRST_QUEUE_POSITION: number = 1;
 const NO_SCRIPTS: number = 0;
 
@@ -25,6 +27,39 @@ export function validateRequestQueuePositionControl(payload: Record<string, unkn
   validateQueuedRestartReason(payload);
   validateScriptCount(payload.scriptCount);
   validateRestartsForAnotherRequest(payload.restartsForAnotherRequest);
+  validateNativeLockHolder(payload.nativeLockHolder);
+}
+
+function validateNativeLockHolder(value: unknown): void {
+  if (value !== undefined) {
+    validateNativeLockHolderFields(requireNativeLockHolderRecord(value));
+  }
+}
+
+function requireNativeLockHolderRecord(value: unknown): Record<string, unknown> {
+  if (!isDaemonControlRecord(value) || Array.isArray(value)) {
+    fail('Queue position payload.nativeLockHolder must be an object.');
+  }
+  return value;
+}
+
+function validateNativeLockHolderFields(holder: Record<string, unknown>): void {
+  validateOptional(holder.pid, isProcessId, 'nativeLockHolder.pid must be a positive safe integer');
+  validateOptional(holder.command, isNonEmptyString, 'nativeLockHolder.command must be a nonempty string');
+}
+
+function validateOptional(value: unknown, isValid: (value: unknown) => boolean, requirement: string): void {
+  if (value !== undefined && !isValid(value)) {
+    fail(`Queue position payload.${requirement}.`);
+  }
+}
+
+function isProcessId(value: unknown): boolean {
+  return Number.isSafeInteger(value) && (value as number) >= FIRST_PROCESS_ID;
+}
+
+function isNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_STRING_LENGTH;
 }
 
 function validateRestartsForAnotherRequest(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 1ab67ed9a3..63049831eb 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -61,7 +61,7 @@ export type { IDaemonInstallationChangedRestartReason } from './DaemonInstallati
 export type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
 export type { IDaemonWorkspaceInputsChangedRestartReason } from './DaemonWorkspaceInputsChange';
 export { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
-export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
+export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmissionValidation';
 export type { DaemonRequestRejectionCode, IDaemonRequestCancelMessage } from './DaemonRequestControl';
 export type { IDaemonRequestRejectedMessage, IDaemonRequestResultMessage } from './DaemonRequestControl';
 export type { IDaemonRequestStartMessage } from './DaemonRequestControl';
@@ -70,6 +70,7 @@ export type { DaemonInvocationKind } from './DaemonInvocationKind';
 export type { DaemonRequestAdmissionErrorCode } from './DaemonRequestAdmission';
 export type { IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { IDaemonRequestQueuePositionMessage } from './DaemonRequestAdmission';
+export type { IDaemonNativeLockHolder } from './DaemonNativeLockHolder';
 export type { DaemonRushCommandOrigin } from './DaemonRushCommand';
 export { RUSHD_GRAPH_SNAPSHOT } from './DaemonGraphSnapshot';
 export type { IDaemonGraphInvalidations, IDaemonGraphOperation } from './DaemonGraphSnapshot';
@@ -83,8 +84,7 @@ export type { DaemonEventPrivacy, IDaemonEventEnvelope, IDaemonEventScope } from
 export type { IDaemonEventSource } from './DaemonEventEnvelope';
 export { isDaemonEventEnvelope, validateDaemonEventEnvelope } from './DaemonEventValidation';
 export { isDaemonExtensionEventName, isRushdExtensionEventName } from './DaemonExtensionEventName';
-export { RUSHD_EXTENSION_NAMESPACE } from './DaemonExtensionEventName';
-export type { DaemonExtensionEventName } from './DaemonExtensionEventName';
+export { RUSHD_EXTENSION_NAMESPACE, type DaemonExtensionEventName } from './DaemonExtensionEventName';
 export { compareDaemonVerbosity, isDaemonVerbosity, type DaemonVerbosity } from './DaemonVerbosity';
 export { shouldSerializeDaemonEvent } from './DaemonVerbosityFilter';
 export type { DaemonDiagnosticSeverity, IDaemonDiagnosticPayload } from './DaemonVerbosityFilter';
diff --git a/libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts b/libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts
new file mode 100644
index 0000000000..e8b9b205b8
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/NativeLockHolder.test.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const FIRST_POSITION: number = 1;
+const HOLDER_PID: number = 4242;
+const REQUEST_ID: string = 'waits-for-native-rush';
+
+function queuePositionFrame(fields: object): Uint8Array {
+  const payload: object = { position: FIRST_POSITION, requestId: REQUEST_ID, ...fields };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+it('round-trips a queue position that waits for a native Rush process to release the repository lock', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: {
+      position: FIRST_POSITION,
+      requestId: REQUEST_ID,
+      nativeLockHolder: { pid: HOLDER_PID, command: 'rush install' }
+    }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it.each([{}, { pid: HOLDER_PID }, { command: 'rush build' }])(
+  'accepts a native lock holder whose pid or command is unknown %j',
+  (nativeLockHolder: object) => {
+    expect(decodeDaemonControlMessage(queuePositionFrame({ nativeLockHolder }))).toMatchObject({
+      payload: { nativeLockHolder }
+    });
+  }
+);
+
+it.each([
+  null,
+  'rush install',
+  [HOLDER_PID],
+  { pid: 0 },
+  { pid: -1 },
+  { pid: 1.5 },
+  { pid: '4242' },
+  { command: HOLDER_PID },
+  { command: '' }
+])('rejects a malformed native lock holder %j', (nativeLockHolder: unknown) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ nativeLockHolder }))).toThrow(
+    /nativeLockHolder/
+  );
+});
diff --git a/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts b/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts
index c36e1857af..53c1e7df8b 100644
--- a/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/RequestAdmission.test.ts
@@ -1,10 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import {
-  MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS,
-  validateDaemonRequestAdmissionOptions
-} from '../DaemonRequestAdmission';
+import { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from '../DaemonRequestAdmission';
+import { validateDaemonRequestAdmissionOptions } from '../DaemonRequestAdmissionValidation';
 
 const OUT_OF_RANGE_INCREMENT: number = 1;
 
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index f23180b1bc..52dbc51fc1 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -175,9 +175,19 @@ whose own operations all completed earlier may receive its result while the iter
 below); it must not assume the lock is already released. Thus ordinary native actions and permanent `--no-daemon`
 fallback can run immediately after a completed single-client warm request without stopping the daemon.
 
-A real native command holding the lock causes preparation or execution to be refused; there is no lock bypass or
-automatic retry. A later explicit request can retry after contention ends, including contention during the first
-engine initialization. A dirty native lock left by another command invalidates retained successes so the native
+When a Rush process that the daemon does not run, such as `rush install` or a `--no-daemon` build, holds the lock,
+preparation and execution wait for it within the request's wait timeout, including during the first engine
+initialization; there is no lock bypass. The daemon tries the lock every 250 ms, since native Rush does not say when
+it releases it. Coalesced requests wait together, and each one stops waiting when its own timeout ends. Each waiting
+client gets a queue position with `nativeLockHolder`, the process as far as the daemon can tell (see
+`findNativeLockHolder` in `@rushstack/rush-client-core`; on Linux, its PID and command, such as `rush install`), and
+another whenever that process changes. `--no-wait` and a zero timeout fail at once, naming the process. The built-in
+default timeout also limits this wait, because the other process can run for any length of time; a request that
+waits longer fails with an admission failure that names the process and suggests `--wait-timeout`. A cancelled
+request stops waiting and never runs. When the daemon itself holds the lock for another request, the request still
+fails at once, and the experimental graph request's lease does not wait.
+
+A dirty native lock left by another command invalidates retained successes so the native
 incremental/cache pipeline can reconcile possibly changed ignored outputs. Declared `outputFolderNames` are also
 fingerprinted (one `stat` per folder: existence, identity and modification time) when an operation succeeds or is
 restored from cache; a request whose reconciliation finds a missing or changed output folder (for example after
diff --git a/libraries/rush-daemon/src/NativeRepositoryLock.ts b/libraries/rush-daemon/src/NativeRepositoryLock.ts
new file mode 100644
index 0000000000..dbd68713d3
--- /dev/null
+++ b/libraries/rush-daemon/src/NativeRepositoryLock.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { PhasedCommandEngineBusyError } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+
+/** The resource name of native Rush's repository lock, in the common temp folder. */
+const NATIVE_LOCK_RESOURCE_NAME: string = 'rush';
+
+/**
+ * Whether this process holds native Rush's repository lock in `lockFolder`, after it failed to take the lock.
+ *
+ * @remarks
+ * A process that fails to take the lock deletes its own lock file again, so only the process that holds the lock
+ * still has one. On Windows, the lock file does not name its process, so this is never known there.
+ */
+export function isNativeLockHeldByThisProcess(lockFolder: string): boolean {
+  return (
+    process.platform !== 'win32' &&
+    fs.existsSync(LockFile.getLockFilePath(lockFolder, NATIVE_LOCK_RESOURCE_NAME))
+  );
+}
+
+/**
+ * Takes native Rush's repository lock in `lockFolder`, or returns undefined while another process holds it.
+ * If this process holds it already, for another request, waiting for it would not end, so this fails at once, as a
+ * native Rush command does.
+ */
+export function tryAcquireNativeLock(lockFolder: string): LockFile | undefined {
+  const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, NATIVE_LOCK_RESOURCE_NAME);
+  if (!lock && isNativeLockHeldByThisProcess(lockFolder)) {
+    throw new PhasedCommandEngineBusyError();
+  }
+  return lock;
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index bb74726281..02cf17bd94 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -10,10 +10,16 @@ import type {
   Operation,
   _IOperationGraphEventSink
 } from '@microsoft/rush-lib';
-import { getWorkspaceRequestOperationEnvironment, OperationStatus } from '@microsoft/rush-lib';
+import {
+  getWorkspaceRequestOperationEnvironment,
+  OperationStatus,
+  PhasedCommandEngineBusyError
+} from '@microsoft/rush-lib';
 import { Sort } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
+import { findNativeLockHolder } from '@rushstack/rush-client-core';
 import type {
+  IDaemonNativeLockHolder,
   IDaemonPhasedEngineShape,
   IDaemonPhasedOperationSelection,
   IDaemonPhasedRequest,
@@ -40,8 +46,10 @@ import {
 import {
   getRequestAdmissionErrorCode,
   getWorkspaceRequestScheduler,
+  type INativeLockWait,
   RequestAdmissionController
 } from './WorkspaceRequestAdmission';
+import { isNativeLockHeldByThisProcess } from './NativeRepositoryLock';
 import type { IWorkspaceEngineShape } from './WorkspaceEngineComponentFactory';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import {
@@ -119,6 +127,8 @@ interface IBatchTimings {
 interface IBatchEntry extends IPreparedPhasedRequest {
   abortListener: (() => void) | undefined;
   abortRequested: boolean;
+  /** Waits for native Rush's repository lock for this request; see `#acquireExecutionLeaseAsync`. */
+  readonly admissionController: RequestAdmissionController;
   batchTimings: IBatchTimings | undefined;
   completed: boolean;
   /**
@@ -365,6 +375,7 @@ class PhasedRequestBatchCoordinator {
         ...request,
         abortListener: undefined,
         abortRequested: false,
+        admissionController,
         batchTimings: undefined,
         completed: false,
         continuesAfterResult: false,
@@ -511,7 +522,7 @@ class PhasedRequestBatchCoordinator {
       if (this.#graph.hasScheduledIteration || this.#graph.status === OperationStatus.Executing) {
         throw new Error('The warm workspace operation graph is not idle.');
       }
-      executionLease = await this.#workspaceSession.acquireExecutionLeaseAsync?.();
+      executionLease = await this.#acquireExecutionLeaseAsync(batch);
       timings.leasesAcquiredTimeMs = performance.now();
       if (this.#acceptingCurrentBatch) {
         // A client that connected while the daemon was busy may not have sent its request yet. Let it, so that
@@ -1159,6 +1170,75 @@ class PhasedRequestBatchCoordinator {
     entry.reject(combineErrors(error, cleanupErrors));
   }
 
+  /**
+   * Acquires the workspace session's execution lease, which holds native Rush's repository lock. While another Rush
+   * process holds that lock, each request of the batch waits for it as it would for another request, within its own
+   * remaining admission budget, and its client is told which process it waits for; see
+   * `RequestAdmissionController.beginNativeLockWait`. A request that may not wait any longer leaves the batch with
+   * an admission error while the others wait on, and compatible requests that arrive meanwhile join the batch.
+   *
+   * @remarks
+   * The lease is acquired again rather than probed, since acquiring it invalidates what native Rush may have
+   * changed. If this process holds the lock itself, the batch fails at once, since waiting would not end.
+   */
+  async #acquireExecutionLeaseAsync(batch: IBatchEntry[]): Promise<AsyncDisposable | undefined> {
+    const session: IWorkspaceSession = this.#workspaceSession;
+    const lockFolder: string = session.rushConfiguration.commonTempFolder;
+    const waits: Map<IBatchEntry, INativeLockWait> = new Map();
+    try {
+      for (;;) {
+        try {
+          return await session.acquireExecutionLeaseAsync?.();
+        } catch (error) {
+          if (!(error instanceof PhasedCommandEngineBusyError) || isNativeLockHeldByThisProcess(lockFolder)) {
+            throw error;
+          }
+        }
+        if (batch[0].exclusivityClass === RequestExclusivityClass.SharedBuild) {
+          this.#takeCompatiblePending(batch);
+        }
+        const holder: IDaemonNativeLockHolder = findNativeLockHolder(lockFolder);
+        let retryDelayMs: number | undefined;
+        let lastError: unknown;
+        for (const entry of [...batch]) {
+          // A client that left the batch while others wait on has its answer already.
+          if (entry.finishPromise || entry.completed) continue;
+          let wait: INativeLockWait | undefined = waits.get(entry);
+          if (!wait) {
+            wait = entry.admissionController.beginNativeLockWait();
+            waits.set(entry, wait);
+          }
+          const error: RequestSchedulerError | undefined = wait.update(holder);
+          if (!error) {
+            retryDelayMs = Math.min(retryDelayMs ?? wait.retryDelayMs, wait.retryDelayMs);
+            continue;
+          }
+          batch.splice(batch.indexOf(entry), 1);
+          waits.delete(entry);
+          lastError = await wait.endAsync().then(
+            () => error,
+            (writeError: unknown) => writeError
+          );
+          await this.#rejectEntryAsync(entry, lastError);
+        }
+        if (retryDelayMs === undefined) {
+          throw lastError ?? new Error('No request of the batch waits for the repository lock any longer.');
+        }
+        await new Promise<void>((resolve: () => void) => setTimeout(resolve, retryDelayMs));
+      }
+    } finally {
+      await Promise.all(
+        Array.from(waits, async ([entry, wait]: [IBatchEntry, INativeLockWait]) => {
+          try {
+            await wait.endAsync();
+          } catch (error) {
+            this.#deactivateEntry(entry, false, error instanceof Error ? error : undefined);
+          }
+        })
+      );
+    }
+  }
+
   #completeEntry(entry: IBatchEntry): void {
     entry.completed = true;
     if (entry.abortListener) {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index bc65ed0d87..5eebed223e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -8,10 +8,15 @@ import {
 import type {
   DaemonRequestAdmissionErrorCode,
   DaemonRestartReason,
+  IDaemonNativeLockHolder,
   IDaemonRequestAdmissionOptions,
   IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
-import { formatDaemonRestartCause, type IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
+import {
+  formatDaemonRestartCause,
+  formatNativeLockHolder,
+  type IDaemonRestartWaitDetails
+} from '@rushstack/rush-client-core';
 
 import {
   type IRequestLease,
@@ -44,6 +49,27 @@ export interface IRequestAdmissionControllerOptions {
   readonly requestId: string;
 }
 
+/**
+ * A request's wait for native Rush's repository lock while another Rush process holds it; see
+ * {@link RequestAdmissionController.beginNativeLockWait}.
+ */
+export interface INativeLockWait {
+  /** How long to wait before trying the lock again: 250ms, or less when the wait timeout runs out sooner. */
+  readonly retryDelayMs: number;
+  /**
+   * Records which process holds the lock, after the request failed to take it, and tells the client when that
+   * process changed.
+   *
+   * @returns The error that ends the wait, if the request may not wait any longer.
+   */
+  update(holder: IDaemonNativeLockHolder): RequestSchedulerError | undefined;
+  /**
+   * Ends the wait: spends its time from the request's wait timeout, and waits until the client has been told about
+   * it. Calling it again returns the same promise.
+   */
+  endAsync(): Promise<void>;
+}
+
 const REQUEST_SCHEDULER_BY_SESSION: WeakMap<IWorkspaceSession, RequestScheduler> = new WeakMap();
 
 /** What a remaining admission budget does not show about the request that it came from. */
@@ -64,6 +90,8 @@ const HISTORY_BY_REMAINING_ADMISSION: WeakMap<IDaemonRequestAdmissionOptions, IA
 const GRAPH_LOAD_WAIT_FACTOR: number = 10;
 // Only the per-invocation flag is offered: Rush versions that do not recognize the environment variable reject it.
 const WAIT_LONGER_HINT: string = 'Use --wait-timeout <seconds> to wait longer.';
+/** Native Rush does not say when it releases the repository's lock, so a request that waits for it tries this often. */
+const NATIVE_LOCK_RETRY_MS: number = 250;
 
 function formatSeconds(ms: number): string {
   return `${Math.round(ms / 100) / 10}s`;
@@ -75,6 +103,21 @@ function formatUncountedTime(pausedMs: number, spentWhile: string): string {
   return seconds === '0s' ? '' : `; ${seconds} spent ${spentWhile} did not count`;
 }
 
+/** Resolves after `delayMs`, or as soon as `abortSignal` aborts. */
+function delayAsync(delayMs: number, abortSignal: AbortSignal): Promise<void> {
+  return new Promise<void>((resolve: () => void) => {
+    const timer: ReturnType<typeof setTimeout> = setTimeout(finish, delayMs);
+    abortSignal.addEventListener('abort', finish, { once: true });
+    if (abortSignal.aborted) finish();
+
+    function finish(): void {
+      clearTimeout(timer);
+      abortSignal.removeEventListener('abort', finish);
+      resolve();
+    }
+  });
+}
+
 /** Returns a frozen copy of admission options that keeps the history of a remaining budget. */
 export function freezeDaemonRequestAdmissionOptions(
   admission: IDaemonRequestAdmissionOptions
@@ -163,6 +206,21 @@ class QueuePositionWriter {
       writeQueuePositionAsync.call(client, message);
   }
 
+  /** Reports a wait for native Rush's repository lock, which `holder` holds, as the first queue position. */
+  public enqueueNativeLockWait(holder: IDaemonNativeLockHolder): void {
+    this.#tail = this.#tail
+      .then(() =>
+        this.#writeQueuePositionAsync({
+          kind: 'queuePosition',
+          payload: { position: 1, requestId: this.#requestId, nativeLockHolder: holder }
+        })
+      )
+      .catch((error: unknown) => {
+        this.#failure ??= error;
+        this.#abortController.abort(error);
+      });
+  }
+
   public enqueue(
     position: number,
     restartReason?: DaemonRestartReason,
@@ -658,6 +716,125 @@ export class RequestAdmissionController {
     return remaining;
   }
 
+  /**
+   * Begins a wait for native Rush's repository lock while another Rush process holds it. The request waits as it
+   * does for another request, within its remaining admission budget: `noWait` and a zero timeout fail at once, and
+   * otherwise the client is told which process the request waits for, as the first queue position, each time that
+   * process changes. A client-default timeout applies, since the other process can run for any length of time.
+   *
+   * @remarks
+   * {@link RequestAdmissionController.acquireNativeLockAsync} waits for the lock with it. A caller that waits once for
+   * several requests uses it directly: it tries the lock again, and then calls `update` for each request, which says
+   * when the request may not wait any longer, and finally `endAsync`.
+   */
+  public beginNativeLockWait(): INativeLockWait {
+    const writer: QueuePositionWriter | undefined = this.#writer;
+    const startMs: number = Date.now();
+    const budgetMs: number | undefined = this.#remainingMs;
+    let holder: IDaemonNativeLockHolder = {};
+    let reportedHolder: string | undefined;
+    let ended: Promise<void> | undefined;
+    return {
+      get retryDelayMs(): number {
+        return budgetMs === undefined
+          ? NATIVE_LOCK_RETRY_MS
+          : Math.min(NATIVE_LOCK_RETRY_MS, Math.max(0, budgetMs - (Date.now() - startMs)));
+      },
+      update: (foundHolder: IDaemonNativeLockHolder): RequestSchedulerError | undefined => {
+        // A process that cannot be identified, for instance once the one that was found exits, does not replace it.
+        if (foundHolder.pid !== undefined || holder.pid === undefined) holder = foundHolder;
+        const error: RequestSchedulerError | undefined = this.#getNativeLockWaitError(
+          formatNativeLockHolder(holder),
+          Date.now() - startMs,
+          budgetMs
+        );
+        const key: string = `${holder.pid}:${holder.command}`;
+        if (!error && !ended && key !== reportedHolder) {
+          reportedHolder = key;
+          writer?.enqueueNativeLockWait(holder);
+        }
+        return error;
+      },
+      endAsync: (): Promise<void> => {
+        if (!ended) {
+          this.#spend(Date.now() - startMs);
+          ended = writer ? writer.flushAsync() : Promise.resolve();
+        }
+        return ended;
+      }
+    };
+  }
+
+  /**
+   * Takes native Rush's repository lock with `tryAcquire`, which returns undefined while another Rush process holds
+   * it, and waits for that process as {@link RequestAdmissionController.beginNativeLockWait} describes. `findHolder`
+   * says which process holds the lock.
+   *
+   * @remarks
+   * The lock is tried every 250ms, since native Rush does not say when it releases it, and it is released again if
+   * the client could not be told about the wait.
+   */
+  public async acquireNativeLockAsync<TLock extends { release(): void }>(
+    tryAcquire: () => TLock | undefined,
+    findHolder: () => IDaemonNativeLockHolder
+  ): Promise<TLock> {
+    let lock: TLock | undefined = tryAcquire();
+    if (lock) return lock;
+    const wait: INativeLockWait = this.beginNativeLockWait();
+    const abortSignal: AbortSignal = this.#abortController.signal;
+    try {
+      while (!lock) {
+        const error: RequestSchedulerError | undefined = wait.update(findHolder());
+        if (error) throw error;
+        await delayAsync(wait.retryDelayMs, abortSignal);
+        if (!abortSignal.aborted) lock = tryAcquire();
+      }
+      await wait.endAsync();
+      return lock;
+    } catch (error) {
+      lock?.release();
+      await wait.endAsync();
+      throw error;
+    }
+  }
+
+  /** Returns the error that ends a wait for native Rush's repository lock, which `holder` holds, if it must end. */
+  #getNativeLockWaitError(
+    holder: string,
+    elapsedMs: number,
+    budgetMs: number | undefined
+  ): RequestSchedulerError | undefined {
+    if (this.#abortController.signal.aborted) {
+      return new RequestSchedulerError(
+        RequestSchedulerErrorCode.Aborted,
+        `The request was aborted while waiting for ${holder} to release this repository's lock.`
+      );
+    }
+    if (this.#admission?.noWait) {
+      return new RequestSchedulerError(
+        RequestSchedulerErrorCode.NoWait,
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock, and ` +
+          '--no-wait was specified.'
+      );
+    }
+    if (this.#configuredWaitTimeoutMs === 0) {
+      return new RequestSchedulerError(
+        RequestSchedulerErrorCode.WaitTimeout,
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock. ` +
+          'Use --wait-timeout <seconds> to wait for it.'
+      );
+    }
+    if (budgetMs === undefined || elapsedMs < budgetMs) return undefined;
+    const waitingFor: string = `${holder} to release this repository's lock`;
+    return this.#getReportedError(
+      new RequestSchedulerError(
+        RequestSchedulerErrorCode.WaitTimeout,
+        `The request timed out while waiting for ${waitingFor}.`
+      ),
+      waitingFor
+    ) as RequestSchedulerError;
+  }
+
   /** Spends `elapsedMs` of the wait timeout, if one applies. */
   #spend(elapsedMs: number): void {
     if (this.#remainingMs !== undefined) {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 72bb10422e..a502a58c8e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -9,7 +9,6 @@ import {
   classifyWorkspaceInputChange,
   EnvironmentVariableNames,
   getWorkspaceFingerprintEnvironmentEntries,
-  PhasedCommandEngineBusyError,
   PhasedCommandEngineProjectConfigurationError,
   Rush,
   WorkspaceInputChangeTier,
@@ -17,8 +16,9 @@ import {
   type IWorkspaceInputFingerprint,
   type RushConfiguration
 } from '@microsoft/rush-lib';
-import { LockFile } from '@rushstack/node-core-library';
+import type { LockFile } from '@rushstack/node-core-library';
 import { NoOpTerminalProvider, Terminal } from '@rushstack/terminal';
+import { findNativeLockHolder } from '@rushstack/rush-client-core';
 import type {
   DaemonRestartReason,
   IDaemonCommandResult,
@@ -54,6 +54,7 @@ import {
   getWorkspaceRequestScheduler
 } from './WorkspaceRequestAdmission';
 import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineComponentFactory';
+import { tryAcquireNativeLock } from './NativeRepositoryLock';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
 import { getRushLibPathHandoff } from './RushLibPathHandoff';
 import type { IWorkspaceSession } from './WorkspaceSession';
@@ -760,13 +761,21 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         getWorkspaceRequestScheduler(session),
         RequestExclusivityClass.Exclusive
       );
-      const nativeLock: LockFile | undefined = LockFile.tryAcquire(
-        session.rushConfiguration.commonTempFolder,
-        'rush'
-      );
-      if (!nativeLock) {
+      const lockFolder: string = session.rushConfiguration.commonTempFolder;
+      let nativeLock: LockFile;
+      // Waiting for another Rush process is contention, not graph-load progress; see `#waitForServedScriptsAsync`.
+      const loading: boolean = this.#transitionProgress.active;
+      this.#transitionProgress.setActive(false);
+      try {
+        nativeLock = await admission.acquireNativeLockAsync(
+          () => tryAcquireNativeLock(lockFolder),
+          () => findNativeLockHolder(lockFolder)
+        );
+      } catch (error) {
         workspaceLease.release();
-        throw new PhasedCommandEngineBusyError();
+        throw error;
+      } finally {
+        this.#transitionProgress.setActive(loading);
       }
       let selectionRejection: DaemonRequestDispatchError | undefined;
       try {
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts b/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
index 324916efbe..3d32cef2e8 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestCommands.ts
@@ -14,11 +14,22 @@ export interface INativeCommandResult {
   readonly stderr: string;
 }
 
+export interface INativeCommand {
+  /** Undefined when the process could not be started, and `result` rejects. */
+  readonly pid: number | undefined;
+  readonly result: Promise<INativeCommandResult>;
+}
+
 /** Runs an actual native Rush action in its own process, not as the daemon's execution engine. */
 export function runNativeCommandAsync(
   repoRoot: string,
   argv: ReadonlyArray<string>
 ): Promise<INativeCommandResult> {
+  return startNativeCommand(repoRoot, argv).result;
+}
+
+/** Starts an actual native Rush action in its own process, as {@link runNativeCommandAsync} does. */
+export function startNativeCommand(repoRoot: string, argv: ReadonlyArray<string>): INativeCommand {
   const parserPath: string = require.resolve('@microsoft/rush-lib/lib/cli/RushCommandLineParser');
   const script: string = `
     const { RushCommandLineParser } = require(${JSON.stringify(parserPath)});
@@ -40,10 +51,11 @@ export function runNativeCommandAsync(
   child.stderr!.on('data', (data: Buffer) => {
     stderr += data.toString();
   });
-  return new Promise((resolve, reject) => {
+  const result: Promise<INativeCommandResult> = new Promise((resolve, reject) => {
     child.once('error', reject);
     child.once('close', (exitCode) => resolve({ exitCode: exitCode ?? undefined, stdout, stderr }));
   });
+  return { pid: child.pid, result };
 }
 
 export interface INativeScriptGate extends AsyncDisposable {
diff --git a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
new file mode 100644
index 0000000000..10e6ea7bcc
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
@@ -0,0 +1,296 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IDaemonNativeLockHolder,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import { RequestSchedulerErrorCode } from '../RequestScheduler';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+
+const HOLDER: IDaemonNativeLockHolder = { pid: 4242, command: 'rush install' };
+const POLL_MS: number = 250;
+
+interface ITestLock {
+  released: boolean;
+  release(): void;
+}
+
+interface IAcquisition {
+  settled: boolean;
+  lock?: ITestLock;
+  error?: unknown;
+}
+
+/** Stands in for native Rush's repository lock, and for the process that holds it. */
+class NativeLockProbe {
+  public attempts: number = 0;
+  public readonly lock: ITestLock = {
+    released: false,
+    release(): void {
+      this.released = true;
+    }
+  };
+  #free: boolean = false;
+  #holder: IDaemonNativeLockHolder = HOLDER;
+
+  public readonly tryAcquire = (): ITestLock | undefined => {
+    this.attempts++;
+    return this.#free ? this.lock : undefined;
+  };
+
+  public readonly findHolder = (): IDaemonNativeLockHolder => this.#holder;
+
+  /** Another Rush process holds the lock, and `holder` is what can be found out about it. */
+  public hold(holder: IDaemonNativeLockHolder = HOLDER): void {
+    this.#free = false;
+    this.#holder = holder;
+  }
+
+  /** The Rush process that held the lock exits. */
+  public free(): void {
+    this.#free = true;
+  }
+}
+
+interface ITestController {
+  readonly controller: RequestAdmissionController;
+  readonly messages: IDaemonRequestQueuePositionMessage[];
+}
+
+function createController(
+  admission: IDaemonRequestAdmissionOptions | undefined,
+  abortSignal: AbortSignal = new AbortController().signal,
+  writeQueuePositionAsync?: (message: IDaemonRequestQueuePositionMessage) => Promise<void>
+): ITestController {
+  const messages: IDaemonRequestQueuePositionMessage[] = [];
+  const controller: RequestAdmissionController = new RequestAdmissionController({
+    admission,
+    client: {
+      abortSignal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync:
+        writeQueuePositionAsync ??
+        (async (message: IDaemonRequestQueuePositionMessage) => {
+          messages.push(message);
+        })
+    },
+    requestId: 'request'
+  });
+  return { controller, messages };
+}
+
+function track(promise: Promise<ITestLock>): IAcquisition {
+  const acquisition: IAcquisition = { settled: false };
+  promise.then(
+    (lock: ITestLock) => {
+      acquisition.settled = true;
+      acquisition.lock = lock;
+    },
+    (error: unknown) => {
+      acquisition.settled = true;
+      acquisition.error = error;
+    }
+  );
+  return acquisition;
+}
+
+function waitMessage(nativeLockHolder: IDaemonNativeLockHolder): IDaemonRequestQueuePositionMessage {
+  return { kind: 'queuePosition', payload: { position: 1, requestId: 'request', nativeLockHolder } };
+}
+
+describe(`${RequestAdmissionController.name} and native Rush's repository lock`, () => {
+  let probe: NativeLockProbe;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    probe = new NativeLockProbe();
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('takes the lock at once when no other Rush process holds it', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 1000 });
+    probe.free();
+    await expect(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)).resolves.toBe(
+      probe.lock
+    );
+    expect(probe.attempts).toBe(1);
+    expect(messages).toEqual([]);
+    expect(controller.remainingAdmission?.waitTimeoutMs).toBe(1000);
+  });
+
+  it('waits for another Rush process to release the lock, and tells the client which process holds it', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 5000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(messages).toEqual([waitMessage(HOLDER)]);
+    await jest.advanceTimersByTimeAsync(4 * POLL_MS);
+    expect(acquisition.settled).toBe(false);
+    expect(probe.attempts).toBe(5);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(acquisition).toEqual({ settled: true, lock: probe.lock });
+    expect(probe.attempts).toBe(6);
+    expect(messages).toEqual([waitMessage(HOLDER)]);
+    // The wait counts against the request's wait timeout, like waiting for another request does.
+    expect(controller.remainingAdmission?.waitTimeoutMs).toBe(5000 - 5 * POLL_MS);
+  });
+
+  it('fails when its wait timeout runs out, naming the process that holds the lock', async () => {
+    const { controller } = createController({ waitTimeoutMs: 1000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(999);
+    expect(acquisition.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(acquisition.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 1000ms wait timeout while waiting for another Rush process ' +
+        "(PID 4242: rush install) to release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+    });
+    // It tried once more at the end of its wait.
+    expect(probe.attempts).toBe(5);
+    expect(probe.lock.released).toBe(false);
+    expect(controller.remainingAdmission?.waitTimeoutMs).toBe(0);
+  });
+
+  it('fails at once for a zero wait timeout, naming the process that holds the lock', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 0 });
+    await expect(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)).rejects.toMatchObject(
+      {
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message:
+          'The request cannot be admitted immediately because another Rush process (PID 4242: rush install) ' +
+          "holds this repository's lock. Use --wait-timeout <seconds> to wait for it."
+      }
+    );
+    expect(probe.attempts).toBe(1);
+    // A request that does not wait does not say that it waits.
+    expect(messages).toEqual([]);
+  });
+
+  it('fails at once with --no-wait, naming the process that holds the lock', async () => {
+    const { controller, messages } = createController({ noWait: true });
+    await expect(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)).rejects.toMatchObject(
+      {
+        code: RequestSchedulerErrorCode.NoWait,
+        message:
+          'The request cannot be admitted immediately because another Rush process (PID 4242: rush install) ' +
+          "holds this repository's lock, and --no-wait was specified."
+      }
+    );
+    expect(probe.attempts).toBe(1);
+    expect(messages).toEqual([]);
+  });
+
+  it('names the timeout that the client asked for when an earlier wait spent part of it', async () => {
+    const { controller: earlier } = createController({ waitTimeoutMs: 1000 });
+    const first: IAcquisition = track(earlier.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder));
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(first.lock).toBe(probe.lock);
+    probe.hold();
+    const { controller: later } = createController(earlier.remainingAdmission);
+    const second: IAcquisition = track(later.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder));
+    await jest.advanceTimersByTimeAsync(499);
+    expect(second.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(second.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message: expect.stringContaining(
+        'not admitted within its 1000ms wait timeout while waiting for another'
+      )
+    });
+  });
+
+  it('stops waiting as soon as the request is aborted, and does not try the lock again', async () => {
+    const abortController: AbortController = new AbortController();
+    const { controller } = createController({ waitTimeoutMs: 5000 }, abortController.signal);
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS + 50);
+    const attempts: number = probe.attempts;
+    abortController.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(acquisition.error).toMatchObject({ code: RequestSchedulerErrorCode.Aborted });
+    probe.free();
+    await jest.advanceTimersByTimeAsync(10 * POLL_MS);
+    expect(probe.attempts).toBe(attempts);
+    expect(probe.lock.released).toBe(false);
+  });
+
+  it('waits without a limit when the request has no wait timeout', async () => {
+    const { controller } = createController(undefined);
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(60_000);
+    expect(acquisition.settled).toBe(false);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(acquisition.lock).toBe(probe.lock);
+  });
+
+  it('tells the client again only when another process holds the lock, and never forgets a known holder', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 5000 });
+    track(controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder));
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    // The holder released the lock, and no live process holds it at the moment.
+    probe.hold({});
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.hold({ pid: 5151 });
+    await jest.advanceTimersByTimeAsync(2 * POLL_MS);
+    expect(messages).toEqual([waitMessage(HOLDER), waitMessage({ pid: 5151 })]);
+  });
+
+  it('names another Rush process when it cannot tell which process holds the lock', async () => {
+    probe.hold({});
+    const { controller, messages } = createController({ waitTimeoutMs: POLL_MS });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(messages).toEqual([waitMessage({})]);
+    expect(acquisition.error).toMatchObject({
+      message:
+        'The request was not admitted within its 250ms wait timeout while waiting for another Rush process ' +
+        "to release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+    });
+  });
+
+  it('releases the lock that it took when the client could not be told about the wait', async () => {
+    let rejectWrite: (error: Error) => void = () => undefined;
+    const { controller } = createController(
+      { waitTimeoutMs: 5000 },
+      undefined,
+      () =>
+        new Promise<void>((resolve, reject) => {
+          rejectWrite = reject;
+        })
+    );
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(probe.attempts).toBe(2);
+    expect(acquisition.settled).toBe(false);
+    const writeError: Error = new Error('The client disconnected.');
+    rejectWrite(writeError);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(acquisition.error).toBe(writeError);
+    expect(probe.lock.released).toBe(true);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts b/libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts
new file mode 100644
index 0000000000..1ff128a91e
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeRepositoryLock.test.ts
@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { PhasedCommandEngineBusyError } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+
+import { isNativeLockHeldByThisProcess, tryAcquireNativeLock } from '../NativeRepositoryLock';
+
+// On Windows, the lock file does not name its process, so this process cannot tell that it holds the lock.
+const unixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/native-repository-lock');
+
+function createLockFolder(name: string): string {
+  const folder: string = path.join(TEST_FOLDER, name);
+  fs.rmSync(folder, { recursive: true, force: true });
+  fs.mkdirSync(folder, { recursive: true });
+  return folder;
+}
+
+/** Starts another process, which holds Rush's repository lock in `folder` until its stdin ends. */
+async function holdInAnotherProcessAsync(folder: string): Promise<ChildProcess> {
+  const script: string = [
+    `const { LockFile } = require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))});`,
+    `const lock = LockFile.tryAcquire(${JSON.stringify(folder)}, 'rush');`,
+    "process.stdout.write(lock ? 'held' : 'busy');",
+    'process.stdin.resume();',
+    "process.stdin.on('end', () => { lock?.release(); process.exit(0); });"
+  ].join('\n');
+  const holder: ChildProcess = spawn(process.execPath, ['-e', script], {
+    stdio: ['pipe', 'pipe', 'inherit']
+  });
+  const [output] = await once(holder.stdout!, 'data');
+  expect(String(output)).toBe('held');
+  return holder;
+}
+
+async function stopAsync(holder: ChildProcess): Promise<void> {
+  const closed: Promise<unknown[]> = once(holder, 'close');
+  holder.stdin!.end();
+  await closed;
+}
+
+describe(tryAcquireNativeLock.name, () => {
+  it('takes the lock when no Rush process holds it', () => {
+    const folder: string = createLockFolder('free');
+    const lock: LockFile | undefined = tryAcquireNativeLock(folder);
+    expect(lock).toBeInstanceOf(LockFile);
+    lock?.release();
+  });
+
+  it('takes nothing while another Rush process holds the lock, so that the request can wait for it', async () => {
+    const folder: string = createLockFolder('another-process');
+    const holder: ChildProcess = await holdInAnotherProcessAsync(folder);
+    try {
+      expect(tryAcquireNativeLock(folder)).toBeUndefined();
+      expect(isNativeLockHeldByThisProcess(folder)).toBe(false);
+    } finally {
+      await stopAsync(holder);
+    }
+    const lock: LockFile | undefined = tryAcquireNativeLock(folder);
+    expect(lock).toBeInstanceOf(LockFile);
+    lock?.release();
+  });
+
+  unixIt('fails at once when this process holds the lock already, since waiting for it would not end', () => {
+    const folder: string = createLockFolder('this-process');
+    const lock: LockFile | undefined = tryAcquireNativeLock(folder);
+    expect(lock).toBeInstanceOf(LockFile);
+    try {
+      expect(isNativeLockHeldByThisProcess(folder)).toBe(true);
+      expect(() => tryAcquireNativeLock(folder)).toThrow(PhasedCommandEngineBusyError);
+    } finally {
+      lock?.release();
+    }
+    expect(isNativeLockHeldByThisProcess(folder)).toBe(false);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts b/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
new file mode 100644
index 0000000000..94c668b8cc
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
@@ -0,0 +1,248 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import type {
+  IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+import { PhasedCommandEngineBusyError, type RushConfiguration } from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestClientWrite, ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+
+const OPERATION_A: string = 'project-a (_phase:test)';
+const LOCK_RELEASED: string = "to release this repository's lock";
+const LOCK_FOLDERS: string = path.resolve(__dirname, '../../temp/test/router-native-lock');
+// On Windows, the lock file does not name its process, so the daemon cannot tell that it holds the lock itself.
+const unixIt: typeof it = process.platform === 'win32' ? it.skip : it;
+
+/** Stands in for the execution lease, which holds native Rush's repository lock, while another Rush process holds it. */
+class ExecutionLeaseProbe {
+  public attempts: number = 0;
+  public acquisitions: number = 0;
+  #held: boolean = true;
+
+  public constructor(fixture: ITestRoutingFixture) {
+    fixture.session.acquireExecutionLeaseAsync = async (): Promise<AsyncDisposable> => {
+      this.attempts++;
+      if (this.#held) throw new PhasedCommandEngineBusyError();
+      this.acquisitions++;
+      return { [Symbol.asyncDispose]: async (): Promise<void> => undefined };
+    };
+  }
+
+  /** The Rush process that held the lock exits. */
+  public free(): void {
+    this.#held = false;
+  }
+}
+
+function createFixture(): ITestRoutingFixture {
+  return createRoutingFixture(new Map([[OPERATION_A, new TestOperationRunner(OPERATION_A)]]));
+}
+
+/** Gives the fixture a common temp folder of its own, which is where native Rush's repository lock lives. */
+function useLockFolder(fixture: ITestRoutingFixture, name: string): string {
+  const folder: string = path.join(LOCK_FOLDERS, name);
+  fs.rmSync(folder, { recursive: true, force: true });
+  fs.mkdirSync(folder, { recursive: true });
+  const rushConfiguration: RushConfiguration = Object.create(fixture.session.rushConfiguration, {
+    commonTempFolder: { value: folder }
+  });
+  Object.defineProperty(fixture.session, 'rushConfiguration', { value: rushConfiguration });
+  return folder;
+}
+
+function createRequest(requestId: string, admission: IDaemonRequestAdmissionOptions): IDaemonPhasedRequest {
+  return {
+    admission,
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: [{ enabledState: true, operationId: OPERATION_A }],
+    requestId
+  };
+}
+
+function getQueuePositions(client: TestPhasedRequestClient): IDaemonRequestQueuePositionMessage[] {
+  return client.writes.flatMap(({ queuePosition }: ITestClientWrite) =>
+    queuePosition ? [queuePosition] : []
+  );
+}
+
+function waitMessage(requestId: string): IDaemonRequestQueuePositionMessage {
+  return {
+    kind: 'queuePosition',
+    payload: { position: 1, requestId, nativeLockHolder: expect.any(Object) }
+  };
+}
+
+async function waitUntilAsync(condition: () => boolean): Promise<void> {
+  while (!condition()) await new Promise<void>((resolve) => setTimeout(resolve, 10));
+}
+
+describe(`${PhasedRequestRouter.name} and native Rush's repository lock`, () => {
+  it('waits for another Rush process to release the lock, tells the client, and then runs the request', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const result: Promise<IDaemonPhasedRequestResult> = new PhasedRequestRouter(fixture.session).executeAsync(
+      createRequest('waiting', { waitTimeoutMs: 30_000 }),
+      client
+    );
+    await waitUntilAsync(() => probe.attempts >= 3);
+    expect(getQueuePositions(client)).toEqual([waitMessage('waiting')]);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+
+    probe.free();
+    await expect(result).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(probe.acquisitions).toBe(1);
+    expect(getQueuePositions(client)).toEqual([waitMessage('waiting')]);
+  });
+
+  it('fails a request whose wait timeout runs out, while the rest of its batch waits on', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const short: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('short', { waitTimeoutMs: 300 }),
+      new TestPhasedRequestClient('one')
+    );
+    const long: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('long', { waitTimeoutMs: 30_000 }),
+      new TestPhasedRequestClient('two')
+    );
+    await expect(short).resolves.toMatchObject({
+      admissionErrorCode: 'wait-timeout',
+      exitCode: 1,
+      errorMessage: expect.stringMatching(
+        new RegExp(
+          `^The request was not admitted within its 300ms wait timeout while waiting for .* ${LOCK_RELEASED}`
+        )
+      )
+    });
+    const attempts: number = probe.attempts;
+    await waitUntilAsync(() => probe.attempts > attempts);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+
+    probe.free();
+    await expect(long).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('tells a request that joins the waiting batch about the wait, and runs both requests together', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', { waitTimeoutMs: 30_000 }),
+      new TestPhasedRequestClient('one')
+    );
+    await waitUntilAsync(() => probe.attempts >= 2);
+    const joiningClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    const joining: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joining', { waitTimeoutMs: 30_000 }),
+      joiningClient
+    );
+    await waitUntilAsync(() => getQueuePositions(joiningClient).length > 0);
+    expect(getQueuePositions(joiningClient)).toEqual([waitMessage('joining')]);
+
+    probe.free();
+    await expect(first).resolves.toMatchObject({ exitCode: 0 });
+    await expect(joining).resolves.toMatchObject({ exitCode: 0 });
+    expect(probe.acquisitions).toBe(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('answers a request that is cancelled while it waits, never runs it, and stops trying the lock', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const result: Promise<IDaemonPhasedRequestResult> = new PhasedRequestRouter(fixture.session).executeAsync(
+      createRequest('cancelled', { waitTimeoutMs: 30_000 }),
+      client
+    );
+    await waitUntilAsync(() => probe.attempts >= 2);
+    client.abortController.abort();
+    await expect(result).resolves.toMatchObject({
+      aborted: true,
+      admissionErrorCode: 'aborted',
+      outcome: 'aborted'
+    });
+    const attempts: number = probe.attempts;
+    probe.free();
+    await new Promise<void>((resolve) => setTimeout(resolve, 600));
+    expect(probe.attempts).toBe(attempts);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+  });
+
+  it('answers a request that leaves the waiting batch only once, while the rest of the batch waits on', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const leavingClient: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+    const stayingClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+    let allowResult!: () => void;
+    const resultAllowed: Promise<void> = new Promise<void>((resolve) => (allowResult = resolve));
+    // The client takes its result slowly, so the batch tries the lock again before the client has it.
+    leavingClient.onWriteAsync = async ({ result }: ITestClientWrite): Promise<void> => {
+      if (result) await resultAllowed;
+    };
+    const leaving: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('leaving', { waitTimeoutMs: 30_000 }),
+      leavingClient
+    );
+    const staying: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('staying', { waitTimeoutMs: 30_000 }),
+      stayingClient
+    );
+    await waitUntilAsync(() => getQueuePositions(stayingClient).length > 0);
+    leavingClient.abortController.abort();
+    const attempts: number = probe.attempts;
+    await waitUntilAsync(() => probe.attempts >= attempts + 2);
+    allowResult();
+    await expect(leaving).resolves.toMatchObject({ aborted: true, outcome: 'aborted' });
+
+    probe.free();
+    await expect(staying).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(leavingClient.writes.filter(({ result }: ITestClientWrite) => result)).toHaveLength(1);
+    expect(getQueuePositions(leavingClient)).toEqual([waitMessage('leaving')]);
+  });
+
+  unixIt('fails at once when the daemon holds the lock itself, as waiting would not end', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+    const lockFolder: string = useLockFolder(fixture, 'daemon-holds-lock');
+    const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, 'rush');
+    expect(lock).toBeDefined();
+    try {
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient('one');
+      await expect(
+        new PhasedRequestRouter(fixture.session).executeAsync(
+          createRequest('in-process', { waitTimeoutMs: 2_000 }),
+          client
+        )
+      ).rejects.toBeInstanceOf(PhasedCommandEngineBusyError);
+      expect(probe.attempts).toBe(1);
+      expect(getQueuePositions(client)).toEqual([]);
+      expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    } finally {
+      lock?.release();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
new file mode 100644
index 0000000000..6b7b86585b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
@@ -0,0 +1,269 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGraph } from '@microsoft/rush-lib';
+import { formatNativeLockHolder } from '@rushstack/rush-client-core';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonNativeLockHolder
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  createNativeScriptGateAsync,
+  startNativeCommand,
+  type INativeCommand,
+  type INativeScriptGate
+} from './NativeEngineTestCommands';
+import { createWireEnvelope, DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import {
+  createFixtureAsync,
+  requestEnvironment,
+  runAsync,
+  runs,
+  type IFixture
+} from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+interface IGatedNativeCommand {
+  readonly native: INativeCommand;
+  readonly gate: INativeScriptGate;
+}
+
+describe('native production daemon engine, while a native Rush action holds the repository lock', () => {
+  it('waits at preparation and at iteration time, naming the action, and then runs', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const commands: IGatedNativeCommand[] = [];
+    try {
+      const first: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(first);
+      await sendRequestAsync(fixture, 'busy-initialization', ['build', '--only', 'b']);
+      expect(await readNativeLockHolderAsync(fixture.client, 'busy-initialization')).toEqual(
+        getExpectedHolder(first.native)
+      );
+      expect(fixture.session.operationGraph).toBeUndefined();
+      await first.gate.releaseAsync();
+      expect(await first.native.result).toMatchObject({ exitCode: 0 });
+      expect((await fixture.client.readTerminalAsync('busy-initialization')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      expect(graph).toBeDefined();
+
+      const second: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(second);
+      await sendRequestAsync(fixture, 'busy-iteration', ['build', '--only', 'b']);
+      expect(await readNativeLockHolderAsync(fixture.client, 'busy-iteration')).toEqual(
+        getExpectedHolder(second.native)
+      );
+      await second.gate.releaseAsync();
+      expect(await second.native.result).toMatchObject({ exitCode: 0 });
+      expect((await fixture.client.readTerminalAsync('busy-iteration')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      // The request waited to run an iteration of the graph that it had loaded, not to load a new one. The native
+      // rebuild of a left b up to date.
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'a:one:']);
+    } finally {
+      await releaseAllAsync(commands);
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('fails at once or on timeout, naming the action, when a request may not wait for the lock', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const commands: IGatedNativeCommand[] = [];
+    try {
+      const first: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(first);
+      await expectAdmissionFailuresAsync(fixture, 'initialization', first.native);
+      expect(fixture.session.operationGraph).toBeUndefined();
+      await first.gate.releaseAsync();
+      expect(await first.native.result).toMatchObject({ exitCode: 0 });
+      expect((await runAsync(fixture, 'retry', ['build', '--only', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+
+      const second: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(second);
+      await expectAdmissionFailuresAsync(fixture, 'iteration', second.native);
+      await second.gate.releaseAsync();
+      expect(await second.native.result).toMatchObject({ exitCode: 0 });
+      expect((await runAsync(fixture, 'retry-iteration', ['build', '--only', 'b'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(runs(fixture)).toEqual(['a:one:', 'b:one:', 'a:one:']);
+    } finally {
+      await releaseAllAsync(commands);
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('has requests behind the graph load spend their wait timeouts while the load waits for the lock', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    const commands: IGatedNativeCommand[] = [];
+    let behind: DaemonRequestWireClient | undefined;
+    try {
+      const first: IGatedNativeCommand = await startGatedNativeRebuildAsync(fixture.repoRoot);
+      commands.push(first);
+      await sendRequestAsync(fixture, 'loading', ['build', '--only', 'b']);
+      await readNativeLockHolderAsync(fixture.client, 'loading');
+
+      // Waiting for another Rush process is contention, not progress that pauses the followers' wait timeouts.
+      behind = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
+      await behind.handshakeAsync();
+      await behind.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('behind', 'build', fixture.repoRoot, {
+          admission: { waitTimeoutMs: 1000 },
+          argv: ['build', '--only', 'b'],
+          environment: requestEnvironment(),
+          commandOrigin: 'built-in'
+        })
+      });
+      expect((await behind.readTerminalAsync('behind')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage: expect.stringMatching(
+            /^The request was not admitted within its 1000ms wait timeout while waiting for another request's load/
+          )
+        }
+      });
+
+      await first.gate.releaseAsync();
+      expect(await first.native.result).toMatchObject({ exitCode: 0 });
+      expect((await fixture.client.readTerminalAsync('loading')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+    } finally {
+      await behind?.closeAsync();
+      await releaseAllAsync(commands);
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
+
+/** Starts a native rebuild of project `a` that holds Rush's repository lock until its gate is released. */
+async function startGatedNativeRebuildAsync(repoRoot: string): Promise<IGatedNativeCommand> {
+  const gate: INativeScriptGate = await createNativeScriptGateAsync(repoRoot, 'a');
+  const native: INativeCommand = startNativeCommand(repoRoot, [
+    'rebuild',
+    '--only',
+    'a',
+    '--parallelism',
+    '3'
+  ]);
+  try {
+    await Promise.race([
+      gate.entered,
+      native.result.then((result) => {
+        throw new Error(`Native action did not enter its script gate: ${JSON.stringify(result)}`);
+      })
+    ]);
+  } catch (error) {
+    await releaseAllAsync([{ native, gate }]);
+    throw error;
+  }
+  return { native, gate };
+}
+
+async function releaseAllAsync(commands: ReadonlyArray<IGatedNativeCommand>): Promise<void> {
+  for (const { native, gate } of commands) {
+    await gate.releaseAsync();
+    await native.result.catch(() => undefined);
+  }
+}
+
+/** Only Linux can tell which process holds the lock. The command line of `node -e` names no program. */
+function getExpectedHolder(native: INativeCommand): IDaemonNativeLockHolder {
+  return process.platform === 'linux' ? { pid: native.pid } : {};
+}
+
+async function expectAdmissionFailuresAsync(
+  fixture: IFixture,
+  stage: string,
+  native: INativeCommand
+): Promise<void> {
+  const holder: string = formatNativeLockHolder(getExpectedHolder(native));
+  const argv: string[] = ['build', '--only', 'b'];
+  expect(
+    (await runAsync(fixture, `${stage}-zero`, argv, { admission: { waitTimeoutMs: 0 } })).terminal
+  ).toMatchObject({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      admissionErrorCode: 'wait-timeout',
+      errorMessage:
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock. ` +
+        'Use --wait-timeout <seconds> to wait for it.'
+    }
+  });
+  expect(
+    (await runAsync(fixture, `${stage}-no-wait`, argv, { admission: { noWait: true } })).terminal
+  ).toMatchObject({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      admissionErrorCode: 'no-wait',
+      errorMessage:
+        `The request cannot be admitted immediately because ${holder} holds this repository's lock, and ` +
+        '--no-wait was specified.'
+    }
+  });
+  expect(
+    (await runAsync(fixture, `${stage}-timeout`, argv, { admission: { waitTimeoutMs: 300 } })).terminal
+  ).toMatchObject({
+    kind: 'requestResult',
+    payload: {
+      exitCode: 1,
+      admissionErrorCode: 'wait-timeout',
+      errorMessage:
+        `The request was not admitted within its 300ms wait timeout while waiting for ${holder} to release ` +
+        "this repository's lock. Use --wait-timeout <seconds> to wait longer."
+    }
+  });
+}
+
+async function sendRequestAsync(fixture: IFixture, requestId: string, argv: string[]): Promise<void> {
+  await fixture.client.sendControlAsync({
+    kind: 'requestStart',
+    payload: createWireEnvelope(requestId, argv[0], fixture.repoRoot, {
+      argv,
+      environment: requestEnvironment(),
+      commandOrigin: 'built-in'
+    })
+  });
+}
+
+/** Reads frames until the daemon says that the request waits for native Rush's repository lock. */
+async function readNativeLockHolderAsync(
+  client: DaemonRequestWireClient,
+  requestId: string
+): Promise<IDaemonNativeLockHolder> {
+  for (;;) {
+    const frame: IDaemonFrame = await client.readFrameAsync();
+    if (frame.kind !== DaemonFrameType.controlJson) continue;
+    const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+    if (message.kind === 'queuePosition' && message.payload.requestId === requestId) {
+      if (message.payload.nativeLockHolder) return message.payload.nativeLockHolder;
+    } else if (
+      (message.kind === 'requestResult' || message.kind === 'requestRejected') &&
+      message.payload.requestId === requestId
+    ) {
+      throw new Error(`The request ended without waiting for the lock: ${JSON.stringify(message)}`);
+    }
+  }
+}
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 517d9acaa7..45b7405745 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -671,59 +671,6 @@ process.exit(23);
     }
   });
 
-  it('refuses native lock contention at preparation and at iteration time, and accepts a later explicit retry', async () => {
-    const fixture: IFixture = await createFixtureAsync();
-    const gate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
-    let native: Promise<INativeCommandResult> | undefined;
-    try {
-      native = runNativeCommandAsync(fixture.repoRoot, ['rebuild', '--only', 'a', '--parallelism', '3']);
-      await Promise.race([
-        gate.entered,
-        native.then((result) => {
-          throw new Error(`Native action did not enter its script gate: ${JSON.stringify(result)}`);
-        })
-      ]);
-      expect(
-        (await runAsync(fixture, 'busy-initialization', ['build', '--only', 'b'])).terminal
-      ).toMatchObject({
-        kind: 'requestRejected',
-        payload: { message: expect.stringContaining('Another Rush command') }
-      });
-      expect(fixture.session.operationGraph).toBeUndefined();
-      await gate.releaseAsync();
-      expect(await native).toMatchObject({ exitCode: 0 });
-      expect((await runAsync(fixture, 'retry', ['build', '--only', 'b'])).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
-      const secondGate: INativeScriptGate = await createNativeScriptGateAsync(fixture.repoRoot, 'a');
-      try {
-        native = runNativeCommandAsync(fixture.repoRoot, ['rebuild', '--only', 'a', '--parallelism', '3']);
-        await Promise.race([
-          secondGate.entered,
-          native.then((result) => {
-            throw new Error(`Native action did not enter its script gate: ${JSON.stringify(result)}`);
-          })
-        ]);
-        expect((await runAsync(fixture, 'busy-iteration', ['build', '--only', 'b'])).terminal).toMatchObject({
-          kind: 'requestRejected',
-          payload: { message: expect.stringContaining('Another Rush command') }
-        });
-      } finally {
-        await secondGate.releaseAsync();
-        await native;
-      }
-      expect((await runAsync(fixture, 'retry-iteration', ['build', '--only', 'b'])).terminal).toMatchObject({
-        kind: 'requestResult',
-        payload: { exitCode: 0 }
-      });
-    } finally {
-      await gate.releaseAsync();
-      await native;
-      await fixture[Symbol.asyncDispose]();
-    }
-  });
-
   it('uses one native lease for a merged batch and excludes native actions throughout reconciliation and execution', async () => {
     const fixture: IFixture = await createFixtureAsync();
     const leaseRequested: IDeferred<void> = createDeferred();

From 577bcc116e82c42b0c51d9a0d46324da0bffbe2a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:58 +0000
Subject: [PATCH 180/265] [rush-sdk] Update the snapshot of rush-lib's exported
 names

Swarm integration step 165; original commit fc3bbd4be6 (merge of swarm/r01-t282-int at 4d0a5c5ec1).
Scope: task 282.

Brings 282 (branch swarm/r01-t282-int). Second agent: t02 board 5453. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 11 of 12. Gate: ch01 GATE OK board 5753 (tree 0b0bbf6b41)

Commits folded into this step (1):
- 4d0a5c5ec1 [rush-sdk] Update the snapshot of rush-lib's exported names

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../rush-sdk-export-snapshot_2026-09-29-13-45.json    | 11 +++++++++++
 .../src/test/__snapshots__/script.test.ts.snap        |  8 +++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@microsoft/rush/rush-sdk-export-snapshot_2026-09-29-13-45.json

diff --git a/common/changes/@microsoft/rush/rush-sdk-export-snapshot_2026-09-29-13-45.json b/common/changes/@microsoft/rush/rush-sdk-export-snapshot_2026-09-29-13-45.json
new file mode 100644
index 0000000000..bba1834b76
--- /dev/null
+++ b/common/changes/@microsoft/rush/rush-sdk-export-snapshot_2026-09-29-13-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap b/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
index e6cb906e49..ac25f219ff 100644
--- a/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
+++ b/libraries/rush-sdk/src/test/__snapshots__/script.test.ts.snap
@@ -41,6 +41,8 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   'PhasedCommandEngine',
   'PhasedCommandEngineBusyError',
   'PhasedCommandEngineConfigurationChangedError',
+  'PhasedCommandEngineProjectConfigurationError',
+  'PhasedCommandEngineUsageError',
   'PhasedCommandHooks',
   'PnpmOptionsConfiguration',
   'ProjectChangeAnalyzer',
@@ -69,6 +71,7 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   '_OperationStateFile',
   '_RushGlobalFolder',
   '_RushInternals',
+  '_formatIterationStartLines',
   '_printOperationStatus',
   '_rushSdk_loadInternalModule',
   'captureProjectConfigurationFingerprintAsync',
@@ -77,9 +80,12 @@ Loaded @microsoft/rush-lib from process.env._RUSH_LIB_PATH
   'createRushDiagnostic',
   'daemonEnvironmentVariables',
   'getWorkspaceFingerprintEnvironmentEntries',
+  'getWorkspaceHostEnvironment',
+  'getWorkspaceRequestOperationEnvironment',
   'parseReporterExtensionEventName',
   'resolveDaemonConfiguration',
-  'workspaceFingerprintIgnoredEnvironmentVariables'
+  'workspaceFingerprintIgnoredEnvironmentVariables',
+  'workspaceRequestScopedEnvironmentVariables'
 ]"
 `;
 

From 0cbc5e37d35561d0ed22e68f69771f4e26b74151 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 15:23:58 +0000
Subject: [PATCH 181/265] [rush-client-core] Connect as soon as the startup
 helper exits

Swarm integration step 166; original commit 86aaa686ff (merge of swarm/r07-t265 at d37f03a1a9).
Scope: task 265.

Brings 265 (branch swarm/r07-t265). Second agent: ch03 board 5514, board 5516. Evidence: ch01's GATE OK board 5753.

Batch E2d, item 12 of 12. Gate: ch01 GATE OK board 5753 (tree 0eba3f01f4)

Commits folded into this step (1):
- d37f03a1a9 [rush-client-core] Connect as soon as the startup helper exits

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../startup-helper-exit_2026-09-29.json       |  10 +
 libraries/rush-client-core/README.md          |   5 +-
 .../src/connectOrStartDaemon.ts               |  30 +-
 .../connectOrStartDaemonHelperExit.test.ts    | 268 ++++++++++++++++++
 4 files changed, 307 insertions(+), 6 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/startup-helper-exit_2026-09-29.json
 create mode 100644 libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/startup-helper-exit_2026-09-29.json b/common/changes/@rushstack/rush-client-core/startup-helper-exit_2026-09-29.json
new file mode 100644
index 0000000000..98434c6bf9
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/startup-helper-exit_2026-09-29.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A client that starts the daemon now connects as soon as its startup helper exits, instead of at the end of its current backoff step, which added up to 0.5 seconds to each cold start.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index b612787c81..91065ec849 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -119,7 +119,10 @@ a shell and retains that reservation until the daemon completes hello/ping readi
 independently of whether the requesting client survives. It waits for a live launcher for
 at least 120 seconds, even when the requesting client's own deadline is shorter, so a slow
 first start (for example while Windows scans newly installed files) is still handed off to
-later clients instead of leaving an abandoned reservation. Clients still await
+later clients instead of leaving an abandoned reservation. The starting client holds the start
+mutex, so it keeps a connection only after its helper releases the reservation, which the helper
+does just before it exits; it therefore retries as soon as its helper exits, not at the end of a
+backoff step. Clients still await
 hello/pong under bounded backoff. Stdout/stderr go to `<lockfilePath>.log`. No PID
 is killed. While holding the mutex with no startup reservation (or after taking over an
 abandoned one, see below), stale leftovers are reclaimed only when provably safe: a socket without an ownership record, or a corrupt
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 0b95918480..32d971af75 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -237,9 +237,13 @@ async function startDaemonAsync(
           `failed: Unable to start ${options.startCommand.command}; helper exited (${child.exitCode ?? child.signalCode}) before readiness`
         );
       }
-      await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
-        signal: options.abortSignal
-      });
+      const delayMs: number = Math.min(backoffMs, Math.max(1, deadline - Date.now()));
+      // This process holds the start mutex, so it keeps a connection only after the helper releases the
+      // reservation, which the helper does just before it exits 0. So wake when the helper exits instead of
+      // sleeping out the step, unless it had exited 0 before this attempt, which then saw the release.
+      await (helperSawReady
+        ? delayAsync(delayMs, undefined, { signal: options.abortSignal })
+        : delayUntilHelperExitAsync(helper, delayMs, options.abortSignal));
       backoffMs = Math.min(500, backoffMs * 2);
     }
     throw startupError(options, 'timed out awaiting hello/ping readiness');
@@ -477,8 +481,9 @@ async function tryConnectAsync(
   const client: DaemonClient | undefined = await tryConnectEndpointAsync(options, deadline);
   if (!client) return undefined;
   // Do not expose a just-started daemon to shutdown/restart until its startup reservation is resolved:
-  // by the helper, or here once the daemon is ready. This never waits for the start mutex, and a client
-  // holding it (including this process) resolves the reservation itself.
+  // by the helper, or here once the daemon is ready. This never waits for the start mutex. The mutex
+  // holder resolves an earlier reservation itself before it spawns a helper, then waits for that helper
+  // to release the new one.
   let usable: boolean = false;
   try {
     options.abortSignal?.throwIfAborted();
@@ -783,6 +788,21 @@ async function waitForHelperExitAsync(
   }
 }
 
+/** Waits `delayMs`, or until the startup helper exits if that is sooner, and then cancels the timer. */
+async function delayUntilHelperExitAsync(
+  helper: IStartupHelper,
+  delayMs: number,
+  abortSignal: AbortSignal | undefined
+): Promise<void> {
+  const timer: AbortController = new AbortController();
+  const signal: AbortSignal = abortSignal ? AbortSignal.any([abortSignal, timer.signal]) : timer.signal;
+  try {
+    await Promise.race([delayAsync(delayMs, undefined, { signal }), helper.closed]);
+  } finally {
+    timer.abort();
+  }
+}
+
 function startupError(options: IConnectOrStartDaemonOptions, reason: string): DaemonClientError {
   const sentence: string = /[.!?]$/.test(reason) ? reason : `${reason}.`;
   return new DaemonClientError(
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
new file mode 100644
index 0000000000..bb4522089b
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
@@ -0,0 +1,268 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClient } from '../DaemonClient';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+/** Times from `performance.now()`. */
+interface IStartupTimeline {
+  /** When each connection attempt by this process began. */
+  readonly attempts: number[];
+  /** How many failed attempts were held open until the startup helper closed. */
+  held: number;
+  /** When the startup helper that this process spawned closed. */
+  helperClosedAt?: number;
+}
+
+/**
+ * Records a startup timeline until `restore` is called. A connection attempt that begins at least
+ * `holdFailedAttemptsAfterMs` after the startup helper spawned, and fails while the helper runs, fails only
+ * once the helper has closed.
+ */
+function recordStartupTimeline(holdFailedAttemptsAfterMs: number = Infinity): {
+  timeline: IStartupTimeline;
+  restore: () => void;
+} {
+  const childProcess = jest.requireActual<typeof import('node:child_process')>('node:child_process');
+  const originalSpawn: typeof spawn = childProcess.spawn;
+  const originalConnectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync;
+  const timeline: IStartupTimeline = { attempts: [], held: 0 };
+  let helperSpawnedAt: number = Infinity;
+  let helperClosed: Promise<void> | undefined;
+  const observer = jest.spyOn(childProcess, 'spawn').mockImplementation((command, args, spawnOptions) => {
+    const child = originalSpawn(command, args, spawnOptions);
+    if (args?.includes(require.resolve('../runDaemonStartup'))) {
+      helperSpawnedAt = performance.now();
+      // This listener runs before the one that tells the client that the helper closed.
+      helperClosed = new Promise<void>((resolve) =>
+        child.once('close', () => {
+          timeline.helperClosedAt = performance.now();
+          resolve();
+        })
+      );
+    }
+    return child;
+  });
+  const connect = jest.spyOn(DaemonClient, 'connectAsync').mockImplementation(async (connectOptions) => {
+    const startedAt: number = performance.now();
+    timeline.attempts.push(startedAt);
+    try {
+      return await originalConnectAsync.call(DaemonClient, connectOptions);
+    } catch (error) {
+      if (
+        helperClosed &&
+        timeline.helperClosedAt === undefined &&
+        startedAt - helperSpawnedAt >= holdFailedAttemptsAfterMs
+      ) {
+        timeline.held++;
+        await helperClosed;
+      }
+      throw error;
+    }
+  });
+  return {
+    timeline,
+    restore: () => {
+      connect.mockRestore();
+      observer.mockRestore();
+    }
+  };
+}
+
+interface IPendingDelays {
+  /** The `node:timers/promises` delays that have begun but not yet settled. */
+  readonly pending: ReadonlySet<Promise<unknown>>;
+  readonly restore: () => void;
+}
+
+/** Tracks the delays that are pending until `restore` is called. */
+function trackPendingDelays(): IPendingDelays {
+  const timersPromises = jest.requireActual<typeof import('node:timers/promises')>('node:timers/promises');
+  const originalDelayAsync: typeof delayAsync = timersPromises.setTimeout;
+  const pending: Set<Promise<unknown>> = new Set();
+  const spy = jest.spyOn(timersPromises, 'setTimeout').mockImplementation((delayMs, value, delayOptions) => {
+    const delay: Promise<unknown> = originalDelayAsync(delayMs, value, delayOptions);
+    pending.add(delay);
+    const settle = (): void => {
+      pending.delete(delay);
+    };
+    void delay.then(settle, settle);
+    return delay;
+  });
+  return { pending, restore: () => spy.mockRestore() };
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe('detached daemon startup while the startup helper runs', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-helper-exit-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-helper-exit-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  it.each<{ signalUse: string; abortSignal: AbortSignal | undefined }>([
+    { signalUse: 'without', abortSignal: undefined },
+    { signalUse: 'with', abortSignal: new AbortController().signal }
+  ])(
+    'connects when its startup helper exits, not at the end of a backoff step ($signalUse an abort signal)',
+    async ({ abortSignal }) => {
+      // The daemon listens after a second, when this client and its helper both poll every 500 milliseconds.
+      // This client holds the start mutex, so it drops each connection until the helper releases the
+      // reservation and exits.
+      fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1000');
+      const delays: IPendingDelays = trackPendingDelays();
+      const { timeline, restore } = recordStartupTimeline();
+      try {
+        const client: DaemonClient = await connectOrStartDaemonAsync({ ...options, abortSignal });
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        // A backoff timer left running would keep a client process alive for the rest of its step.
+        expect(delays.pending.size).toBe(0);
+        await client.closeAsync();
+        const { attempts, helperClosedAt } = timeline;
+        expect(helperClosedAt).toBeDefined();
+        const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
+        expect(afterExit).toHaveLength(1);
+        expect(afterExit[0] - helperClosedAt!).toBeLessThan(100);
+      } finally {
+        restore();
+        delays.restore();
+      }
+    }
+  );
+
+  it('retries at once when its startup helper exits during a failed connection attempt', async () => {
+    // The daemon listens after a second. Attempts that fail from 300 milliseconds after the spawn end only
+    // once the helper has closed, so the helper exits while an attempt runs, not while this client sleeps.
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1000');
+    const { timeline, restore } = recordStartupTimeline(300);
+    try {
+      const client: DaemonClient = await connectOrStartDaemonAsync(options);
+      await client.closeAsync();
+      const { attempts, held, helperClosedAt } = timeline;
+      expect(held).toBe(1);
+      expect(helperClosedAt).toBeDefined();
+      const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
+      expect(afterExit).toHaveLength(1);
+      expect(afterExit[0] - helperClosedAt!).toBeLessThan(100);
+    } finally {
+      restore();
+    }
+  });
+
+  it('waits a whole backoff step between attempts once its startup helper has exited', async () => {
+    // The daemon reports another version, so this client never connects, but the helper sees it ready
+    // and exits.
+    const { timeline, restore } = recordStartupTimeline();
+    try {
+      await expect(
+        connectOrStartDaemonAsync({
+          ...options,
+          startupTimeoutMs: 3000,
+          startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'other'] }
+        })
+      ).rejects.toThrow('Daemon startup timed out awaiting hello/ping readiness.');
+      const { attempts, helperClosedAt } = timeline;
+      expect(helperClosedAt).toBeDefined();
+      const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
+      // Only the first attempt after the exit comes early. Each later one waits a whole step, so fewer
+      // than 10 fit in the rest of the deadline.
+      expect(afterExit.length).toBeGreaterThan(1);
+      expect(afterExit.length).toBeLessThan(10);
+    } finally {
+      restore();
+    }
+  }, 15000);
+
+  it('stops at once when aborted while it waits for its startup helper', async () => {
+    // The daemon waits before it listens, so this client sleeps between refused connection attempts.
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    const abort: AbortController = new AbortController();
+    const reason: Error = new Error('cancelled while the daemon starts');
+    const { timeline, restore } = recordStartupTimeline();
+    try {
+      const pending: Promise<unknown> = connectOrStartDaemonAsync({
+        ...options,
+        abortSignal: abort.signal
+      }).then(
+        () => new Error('Expected startup to be aborted.'),
+        (rejection: unknown) => rejection
+      );
+      const barrier: string = path.join(folder, 'prebind');
+      const deadline: number = Date.now() + 5000;
+      while (!fs.existsSync(barrier) && Date.now() < deadline) await delayAsync(20);
+      expect(fs.existsSync(barrier)).toBe(true);
+      // Abort 20 milliseconds after an attempt begins: a refused attempt ends at once, and each step lasts 50
+      // milliseconds or more.
+      const attemptCount: number = timeline.attempts.length;
+      while (timeline.attempts.length === attemptCount && Date.now() < deadline) await delayAsync(1);
+      expect(timeline.attempts.length).toBeGreaterThan(attemptCount);
+      await delayAsync(20);
+      abort.abort(reason);
+      const abortedAt: number = performance.now();
+      expect(await pending).toMatchObject({ name: 'AbortError', cause: reason });
+      expect(performance.now() - abortedAt).toBeLessThan(100);
+    } finally {
+      restore();
+    }
+  }, 10000);
+});

From 3b1e034550674b3a7ab187a54e9b975d2f384fbb Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 182/265] [rush-client-core] Connect as soon as another
 client's startup reservation is released

Swarm integration step 167; original commit 89f0590d86 (merge of swarm/r07-t281 at 9d4f376c20).
Scope: task 281.

Brings 281 (branch swarm/r07-t281). Second agent: t01 board 5657. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 1 of 17. Gate: ch01 GATE OK board 6389 (tree 69667597c6)

Commits folded into this step (1):
- 9d4f376c20 [rush-client-core] Connect as soon as another client's startup reservation is released

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...tartup-reservation-release_2026-09-29.json |  10 +
 libraries/rush-client-core/README.md          |   6 +-
 .../src/connectOrStartDaemon.ts               |  40 ++-
 .../src/test/PendingDelays.ts                 |  27 ++
 .../connectOrStartDaemonHelperExit.test.ts    |  24 +-
 ...ectOrStartDaemonReservationRelease.test.ts | 266 ++++++++++++++++++
 6 files changed, 345 insertions(+), 28 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/startup-reservation-release_2026-09-29.json
 create mode 100644 libraries/rush-client-core/src/test/PendingDelays.ts
 create mode 100644 libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/startup-reservation-release_2026-09-29.json b/common/changes/@rushstack/rush-client-core/startup-reservation-release_2026-09-29.json
new file mode 100644
index 0000000000..b1a58977e7
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/startup-reservation-release_2026-09-29.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A client that waits while another client starts the daemon now connects as soon as the startup reservation is released, instead of at the end of its current backoff step, which added up to 0.5 seconds to each concurrent cold start.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 91065ec849..e155b6abb4 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -122,8 +122,10 @@ first start (for example while Windows scans newly installed files) is still han
 later clients instead of leaving an abandoned reservation. The starting client holds the start
 mutex, so it keeps a connection only after its helper releases the reservation, which the helper
 does just before it exits; it therefore retries as soon as its helper exits, not at the end of a
-backoff step. Clients still await
-hello/pong under bounded backoff. Stdout/stderr go to `<lockfilePath>.log`. No PID
+backoff step. A client that waits for another client's start drops each connection while the
+reservation remains, so it checks the reservation every 25 milliseconds and retries as soon as it
+is released. Otherwise clients await hello/pong with a backoff that doubles from 50 to 500
+milliseconds. Stdout/stderr go to `<lockfilePath>.log`. No PID
 is killed. While holding the mutex with no startup reservation (or after taking over an
 abandoned one, see below), stale leftovers are reclaimed only when provably safe: a socket without an ownership record, or a corrupt
 record, once a connection attempt is refused (no listener exists); and, on Linux, a
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 32d971af75..1cfa5d2db3 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -68,6 +68,9 @@ const STARTUP_HELPER_READINESS_TIMEOUT_MS: number = 120_000;
 /** Matches the default of {@link DaemonClient.shutdownAsync}. */
 const DEFAULT_SHUTDOWN_TIMEOUT_MS: number = 15000;
 
+/** How often a client that waits for another client's startup checks whether a startup reservation remains. */
+const STARTUP_RESERVATION_POLL_MS: number = 25;
+
 /** A version-selected launch command supplied by the embedding application, never guessed by the core. @beta */
 export interface IDaemonStartCommand {
   readonly command: string;
@@ -177,13 +180,18 @@ async function startDaemonAsync(
   ensureDaemonRuntimeFolder(options.paths);
   let lock: IStartupLock | undefined;
   let backoffMs: number = 50;
+  // Whether a startup reservation remained when this client last checked.
+  let reserved: boolean = false;
   while (Date.now() < deadline) {
     options.abortSignal?.throwIfAborted();
     lock = await tryAcquireStartupLockAsync(options.paths);
     if (lock) break;
-    await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
-      signal: options.abortSignal
-    });
+    reserved = await delayUntilStartupReleasedAsync(
+      options.paths,
+      reserved,
+      Math.min(backoffMs, Math.max(1, deadline - Date.now())),
+      options.abortSignal
+    );
     backoffMs = Math.min(500, backoffMs * 2);
     const ready: DaemonClient | undefined = await tryConnectAsync(options, deadline);
     if (ready) return ready;
@@ -803,6 +811,32 @@ async function delayUntilHelperExitAsync(
   }
 }
 
+/**
+ * Waits `delayMs`, or until a startup reservation that this client saw is released if that is sooner. While another
+ * client holds the start mutex, this client drops each connection as long as a reservation remains (see
+ * `tryConnectAsync()`), and the reservation is released once the daemon completes hello/ping, so the next
+ * connection can be kept. Checks every {@link STARTUP_RESERVATION_POLL_MS} milliseconds, since a reservation can
+ * also appear during the wait. `wasReserved` tells whether a reservation remained at this client's previous check,
+ * which may have been in an earlier wait.
+ * @returns Whether a reservation remained at the last check.
+ */
+async function delayUntilStartupReleasedAsync(
+  paths: IDaemonPaths,
+  wasReserved: boolean,
+  delayMs: number,
+  abortSignal: AbortSignal | undefined
+): Promise<boolean> {
+  const end: number = Date.now() + delayMs;
+  let previous: boolean = wasReserved;
+  while (true) {
+    const reserved: boolean = readDaemonStartupReservation(paths) !== undefined;
+    const remainingMs: number = end - Date.now();
+    if ((previous && !reserved) || remainingMs <= 0) return reserved;
+    previous = reserved;
+    await delayAsync(Math.min(STARTUP_RESERVATION_POLL_MS, remainingMs), undefined, { signal: abortSignal });
+  }
+}
+
 function startupError(options: IConnectOrStartDaemonOptions, reason: string): DaemonClientError {
   const sentence: string = /[.!?]$/.test(reason) ? reason : `${reason}.`;
   return new DaemonClientError(
diff --git a/libraries/rush-client-core/src/test/PendingDelays.ts b/libraries/rush-client-core/src/test/PendingDelays.ts
new file mode 100644
index 0000000000..5f72e34b73
--- /dev/null
+++ b/libraries/rush-client-core/src/test/PendingDelays.ts
@@ -0,0 +1,27 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { setTimeout as delayAsync } from 'node:timers/promises';
+
+export interface IPendingDelays {
+  /** The `node:timers/promises` delays that have begun but not yet settled. */
+  readonly pending: ReadonlySet<Promise<unknown>>;
+  readonly restore: () => void;
+}
+
+/** Tracks the delays that are pending until `restore` is called. */
+export function trackPendingDelays(): IPendingDelays {
+  const timersPromises = jest.requireActual<typeof import('node:timers/promises')>('node:timers/promises');
+  const originalDelayAsync: typeof delayAsync = timersPromises.setTimeout;
+  const pending: Set<Promise<unknown>> = new Set();
+  const spy = jest.spyOn(timersPromises, 'setTimeout').mockImplementation((delayMs, value, delayOptions) => {
+    const delay: Promise<unknown> = originalDelayAsync(delayMs, value, delayOptions);
+    pending.add(delay);
+    const settle = (): void => {
+      pending.delete(delay);
+    };
+    void delay.then(settle, settle);
+    return delay;
+  });
+  return { pending, restore: () => spy.mockRestore() };
+}
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
index bb4522089b..8a323a5787 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
@@ -13,6 +13,7 @@ import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { DaemonClient } from '../DaemonClient';
 import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { trackPendingDelays, type IPendingDelays } from './PendingDelays';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 function readIfPresent(filePath: string): string {
@@ -84,29 +85,6 @@ function recordStartupTimeline(holdFailedAttemptsAfterMs: number = Infinity): {
   };
 }
 
-interface IPendingDelays {
-  /** The `node:timers/promises` delays that have begun but not yet settled. */
-  readonly pending: ReadonlySet<Promise<unknown>>;
-  readonly restore: () => void;
-}
-
-/** Tracks the delays that are pending until `restore` is called. */
-function trackPendingDelays(): IPendingDelays {
-  const timersPromises = jest.requireActual<typeof import('node:timers/promises')>('node:timers/promises');
-  const originalDelayAsync: typeof delayAsync = timersPromises.setTimeout;
-  const pending: Set<Promise<unknown>> = new Set();
-  const spy = jest.spyOn(timersPromises, 'setTimeout').mockImplementation((delayMs, value, delayOptions) => {
-    const delay: Promise<unknown> = originalDelayAsync(delayMs, value, delayOptions);
-    pending.add(delay);
-    const settle = (): void => {
-      pending.delete(delay);
-    };
-    void delay.then(settle, settle);
-    return delay;
-  });
-  return { pending, restore: () => spy.mockRestore() };
-}
-
 // A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
 describe('detached daemon startup while the startup helper runs', () => {
   let folder: string;
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts
new file mode 100644
index 0000000000..a8bbbb9c22
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonReservationRelease.test.ts
@@ -0,0 +1,266 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClient } from '../DaemonClient';
+import { getDaemonStartupFilePath, reserveDaemonStartup } from '../DaemonStartup';
+import * as StartupLock from '../StartupLock';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { trackPendingDelays, type IPendingDelays } from './PendingDelays';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+interface IFixture {
+  readonly child: ChildProcess;
+  /** The exit code is undefined when the process was killed by a signal. */
+  readonly result: Promise<{ code: number | undefined; stdout: string; stderr: string }>;
+}
+
+describe('detached daemon startup while another client starts the daemon', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+  let children: ChildProcess[];
+  let holder: IFixture;
+  /** Stops this client waiting when a test ends early. */
+  let abort: AbortController;
+  /** When each connection attempt by this process began, from `performance.now()`. */
+  let attempts: number[];
+  let connectSpy: jest.SpyInstance;
+
+  function run(fixture: string, args: string[]): IFixture {
+    const child: ChildProcess = spawn(
+      process.execPath,
+      [path.join(__dirname, 'fixtures', fixture), ...args],
+      {
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
+    );
+    children.push(child);
+    let stdout: string = '';
+    let stderr: string = '';
+    child.stdout!.on('data', (chunk: Buffer) => {
+      stdout += chunk.toString();
+    });
+    child.stderr!.on('data', (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+    return {
+      child,
+      result: once(child, 'close').then(([code]) => ({ code: code ?? undefined, stdout, stderr }))
+    };
+  }
+
+  async function waitUntilAsync(condition: () => boolean): Promise<void> {
+    const deadline: number = Date.now() + 10000;
+    while (!condition() && Date.now() < deadline) await delayAsync(5);
+    expect(condition()).toBe(true);
+  }
+
+  /** Reserves startup like the helper of the client that holds the start mutex. */
+  function reserveStartup(): void {
+    reserveDaemonStartup(paths, { pid: holder.child.pid!, startedAt: new Date().toISOString() });
+  }
+
+  function releaseStartup(): number {
+    fs.unlinkSync(getDaemonStartupFilePath(paths));
+    return performance.now();
+  }
+
+  /**
+   * Starts a fixture daemon, which listens after 250 milliseconds (or the number in the "startup-delay-ms" file),
+   * and not before the "hold-prebind" file is removed if it exists. No startup helper waits for it.
+   */
+  function startDaemon(): void {
+    run('daemon.js', [JSON.stringify(paths)]);
+  }
+
+  /**
+   * Waits until this client has begun its fifth connection attempt and 100 milliseconds more. Its backoff steps
+   * last 50, 100, 200 and 400 milliseconds, so it is then 100 milliseconds into a step of 500.
+   */
+  async function waitIntoLongStepAsync(): Promise<void> {
+    await waitUntilAsync(() => attempts.length >= 5);
+    await delayAsync(100);
+  }
+
+  beforeEach(async () => {
+    children = [];
+    attempts = [];
+    abort = new AbortController();
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-waiter-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-waiter-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      abortSignal: abort.signal,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+    const originalConnectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync;
+    connectSpy = jest.spyOn(DaemonClient, 'connectAsync').mockImplementation(async (connectOptions) => {
+      attempts.push(performance.now());
+      return await originalConnectAsync.call(DaemonClient, connectOptions);
+    });
+    // Another client holds the start mutex, so this one never starts a daemon.
+    holder = run('startLockHolder.js', [JSON.stringify(paths)]);
+    await waitUntilAsync(() => fs.existsSync(path.join(folder, 'lock-held')));
+  });
+
+  afterEach(async () => {
+    abort.abort();
+    connectSpy.mockRestore();
+    fs.writeFileSync(path.join(folder, 'release-lock'), '');
+    expect(await holder.result).toEqual({ code: 0, stdout: '', stderr: '' });
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await Promise.all(
+      children.map((child) =>
+        child.exitCode === null && child.signalCode === null ? once(child, 'close') : undefined
+      )
+    );
+    // A fixture daemon that fails a check records it here.
+    const failuresPath: string = path.join(folder, 'failures');
+    expect(fs.existsSync(failuresPath) ? fs.readFileSync(failuresPath, 'utf8') : '').toBe('');
+    await removeTestFolderAsync(folder);
+  });
+
+  it('connects as soon as the startup reservation is released, not at the end of a backoff step', async () => {
+    // The daemon is ready, but this client drops each connection while the reservation remains.
+    reserveStartup();
+    startDaemon();
+    await waitUntilAsync(() => fs.existsSync(paths.lockfilePath));
+    const delays: IPendingDelays = trackPendingDelays();
+    try {
+      const connecting: Promise<DaemonClient> = connectOrStartDaemonAsync(options);
+      await waitIntoLongStepAsync();
+      // Checking for the reservation does not connect: attempts still follow the backoff steps.
+      expect(attempts.length).toBeLessThanOrEqual(6);
+      const releasedAt: number = releaseStartup();
+      const client: DaemonClient = await connecting;
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      // A timer left running would keep a client process alive for the rest of its step.
+      expect(delays.pending.size).toBe(0);
+      await client.closeAsync();
+      const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt);
+      expect(afterRelease).toHaveLength(1);
+      expect(afterRelease[0] - releasedAt).toBeLessThan(100);
+    } finally {
+      delays.restore();
+    }
+  });
+
+  it('retries at once when the startup reservation is released between two waits', async () => {
+    // The reservation is released while this client tries the start mutex for a connection that it then drops,
+    // before its next wait begins.
+    reserveStartup();
+    startDaemon();
+    await waitUntilAsync(() => fs.existsSync(paths.lockfilePath));
+    const tryAcquireStartupLockAsync: typeof StartupLock.tryAcquireStartupLockAsync =
+      StartupLock.tryAcquireStartupLockAsync;
+    let releasedAt: number | undefined;
+    const lockSpy: jest.SpyInstance = jest
+      .spyOn(StartupLock, 'tryAcquireStartupLockAsync')
+      .mockImplementation(async (lockPaths: IDaemonPaths) => {
+        const lock: StartupLock.IStartupLock | undefined = await tryAcquireStartupLockAsync(lockPaths);
+        if (releasedAt === undefined && attempts.length >= 5) releasedAt = releaseStartup();
+        return lock;
+      });
+    try {
+      const client: DaemonClient = await connectOrStartDaemonAsync(options);
+      await client.closeAsync();
+    } finally {
+      lockSpy.mockRestore();
+    }
+    expect(releasedAt).toBeDefined();
+    const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt!);
+    expect(afterRelease).toHaveLength(1);
+    expect(afterRelease[0] - releasedAt!).toBeLessThan(100);
+  });
+
+  it('connects as soon as a startup reservation that appeared during a backoff step is released', async () => {
+    // Nothing listens and nothing is reserved when this client's step of 500 milliseconds begins.
+    fs.writeFileSync(path.join(folder, 'hold-prebind'), '');
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '0');
+    startDaemon();
+    await waitUntilAsync(() => fs.existsSync(path.join(folder, 'prebind')));
+    const connecting: Promise<DaemonClient> = connectOrStartDaemonAsync(options);
+    await waitUntilAsync(() => attempts.length >= 5);
+    await delayAsync(50);
+    reserveStartup();
+    fs.unlinkSync(path.join(folder, 'hold-prebind'));
+    await waitUntilAsync(() => fs.existsSync(paths.lockfilePath));
+    // This client checks every 25 milliseconds, so it has seen the reservation.
+    await delayAsync(60);
+    const releasedAt: number = releaseStartup();
+    const client: DaemonClient = await connecting;
+    await client.closeAsync();
+    const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt);
+    expect(afterRelease).toHaveLength(1);
+    expect(afterRelease[0] - releasedAt).toBeLessThan(100);
+  });
+
+  it('waits whole backoff steps after the startup reservation is released without a ready daemon', async () => {
+    reserveStartup();
+    const pending: Promise<unknown> = connectOrStartDaemonAsync(options).then(
+      () => new Error('Expected startup to be aborted.'),
+      (rejection: unknown) => rejection
+    );
+    await waitIntoLongStepAsync();
+    const releasedAt: number = releaseStartup();
+    await delayAsync(1000);
+    abort.abort();
+    expect(await pending).toMatchObject({ name: 'AbortError' });
+    const afterRelease: number[] = attempts.filter((attempt) => attempt >= releasedAt);
+    // One attempt at once, which nothing answers, and then one for each step of 500 milliseconds.
+    expect(afterRelease.length).toBeGreaterThanOrEqual(1);
+    expect(afterRelease[0] - releasedAt).toBeLessThan(100);
+    expect(afterRelease.length).toBeLessThanOrEqual(3);
+  });
+
+  it('stops at once when aborted while the startup reservation remains', async () => {
+    reserveStartup();
+    const reason: Error = new Error('cancelled while another client starts the daemon');
+    const pending: Promise<unknown> = connectOrStartDaemonAsync(options).then(
+      () => new Error('Expected startup to be aborted.'),
+      (rejection: unknown) => rejection
+    );
+    await waitIntoLongStepAsync();
+    abort.abort(reason);
+    const abortedAt: number = performance.now();
+    expect(await pending).toMatchObject({ name: 'AbortError', cause: reason });
+    expect(performance.now() - abortedAt).toBeLessThan(100);
+  });
+});

From ac86d34fbfeb76257ab945a749ecdb01f6b0053e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 183/265] [rush-client-core] Poll for daemon readiness every 50
 ms at startup

Swarm integration step 168; original commit 9c7783b122 (merge of o07/startup-helper-readiness-poll at 6a721681d2).
Scope: task 285.

Brings 285 (branch o07/startup-helper-readiness-poll). Second agent: t01 board 5736; o07 accepts board 5770. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 2 of 17. Gate: ch01 GATE OK board 6389 (tree 741b07706e)

Commits folded into this step (1):
- 6a721681d2 [rush-client-core] Poll for daemon readiness every 50 ms at startup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rtup-helper-readiness-poll_2026-09-29.json |  10 +
 libraries/rush-client-core/README.md          |   3 +-
 .../rush-client-core/src/DaemonStartup.ts     |  11 +-
 .../test/DaemonStartupReadinessPoll.test.ts   | 200 ++++++++++++++++++
 4 files changed, 220 insertions(+), 4 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/startup-helper-readiness-poll_2026-09-29.json
 create mode 100644 libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts

diff --git a/common/changes/@rushstack/rush-client-core/startup-helper-readiness-poll_2026-09-29.json b/common/changes/@rushstack/rush-client-core/startup-helper-readiness-poll_2026-09-29.json
new file mode 100644
index 0000000000..cb05d75c98
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/startup-helper-readiness-poll_2026-09-29.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "The daemon's startup helper now tries to connect every 50 ms while the daemon starts, instead of backing off to 500 ms, so a cold start no longer waits up to 0.5 seconds after the daemon is ready.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index e155b6abb4..36c7ba8160 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -116,7 +116,8 @@ reclaims only an absent/dead owner, spawns a detached startup helper, and reserv
 `<lockfilePath>.starting` for it (recording the helper's PID and start time) before
 handing it the explicit command. The helper spawns the launcher without
 a shell and retains that reservation until the daemon completes hello/ping readiness,
-independently of whether the requesting client survives. It waits for a live launcher for
+independently of whether the requesting client survives. It tries to connect every 50 ms, so it
+releases the reservation within about 50 ms of the daemon's readiness. It waits for a live launcher for
 at least 120 seconds, even when the requesting client's own deadline is shorter, so a slow
 first start (for example while Windows scans newly installed files) is still handed off to
 later clients instead of leaving an abandoned reservation. The starting client holds the start
diff --git a/libraries/rush-client-core/src/DaemonStartup.ts b/libraries/rush-client-core/src/DaemonStartup.ts
index db21e00d76..8acb4090af 100644
--- a/libraries/rush-client-core/src/DaemonStartup.ts
+++ b/libraries/rush-client-core/src/DaemonStartup.ts
@@ -150,6 +150,13 @@ function isNotFound(error: unknown): boolean {
   return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
 }
 
+/**
+ * The startup helper's wait between readiness attempts. Until the daemon publishes its endpoint, an attempt
+ * fails at once, so a short fixed wait costs little. The helper then releases the reservation within about this
+ * long of readiness, instead of up to a doubled backoff step later.
+ */
+const READINESS_POLL_INTERVAL_MS: number = 50;
+
 /**
  * Runs independently of the requesting client. Once spawn succeeds, only protocol readiness releases
  * the reservation: an arbitrary launcher may outlive its parent or spawn descendants.
@@ -181,7 +188,6 @@ export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Pro
   child.unref();
 
   const deadline: number = Date.now() + timeoutMs;
-  let backoffMs: number = 50;
   while (Date.now() < deadline) {
     // Sampled before connecting: a launcher can exit because another daemon published this endpoint first (for
     // example one that an abandoned reservation's helper launched before a client took the reservation over).
@@ -220,8 +226,7 @@ export async function runDaemonStartupAsync(options: IDaemonStartupOptions): Pro
         `Launcher exited (${child.exitCode ?? child.signalCode}) before protocol readiness; startup reservation retained.`
       );
     }
-    await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())));
-    backoffMs = Math.min(500, backoffMs * 2);
+    await delayAsync(Math.min(READINESS_POLL_INTERVAL_MS, Math.max(1, deadline - Date.now())));
   }
   throw new DaemonClientError(
     'startupFailed',
diff --git a/libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts b/libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts
new file mode 100644
index 0000000000..dbe0817ccd
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonStartupReadinessPoll.test.ts
@@ -0,0 +1,200 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  encodeDaemonControlMessage,
+  type DaemonControlMessage
+} from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameConnection, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClient } from '../DaemonClient';
+import { getDaemonStartupFilePath, reserveDaemonStartup, runDaemonStartupAsync } from '../DaemonStartup';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+// Late enough that a readiness backoff doubling from 50 ms would already wait 500 ms between attempts.
+const LISTEN_AFTER_MS: number = 1000;
+
+interface ILateReadiness {
+  readonly outcome: string;
+  /** When each connection attempt before the daemon listened started, in ms since the helper started. */
+  readonly failedAttemptStarts: number[];
+  /** From the daemon starting to listen to its first connection, in ms. */
+  readonly connectionDelayMs: number;
+  readonly reservationRemains: boolean;
+}
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(5);
+  }
+}
+
+function isProcessGone(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ESRCH') return true;
+    throw error;
+  }
+}
+
+function createReadyDaemon(onConnection: () => void, sockets: Set<net.Socket>): net.Server {
+  return net.createServer((socket) => {
+    onConnection();
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+    const connection: DaemonFrameConnection = new DaemonFrameConnection(socket);
+    connection.onFrame(async (frame) => {
+      if (frame.kind !== DaemonFrameType.controlJson) return;
+      const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+      let reply: DaemonControlMessage | undefined;
+      if (message.kind === 'hello') {
+        reply = {
+          kind: 'helloAck',
+          payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'test' }
+        };
+      } else if (message.kind === 'ping') {
+        reply = { kind: 'pong', payload: { uptimeMs: 1, daemonVersion: 'test' } };
+      }
+      if (reply) {
+        await connection.sendFrameAsync({
+          kind: DaemonFrameType.controlJson,
+          payload: encodeDaemonControlMessage(reply)
+        });
+      }
+    });
+  });
+}
+
+describe(`${runDaemonStartupAsync.name} readiness polling`, () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-startup-poll-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    await removeTestFolderAsync(folder);
+  });
+
+  /**
+   * Runs the helper against a launcher that stays alive while nothing listens, like a daemon that is still
+   * starting. The daemon starts listening right after the first failed attempt that began `LISTEN_AFTER_MS`
+   * after the helper, and answers hello and ping from then on.
+   */
+  async function runWithLateReadinessAsync(): Promise<ILateReadiness> {
+    const sockets: Set<net.Socket> = new Set();
+    let firstConnectionAt: number | undefined;
+    const server: net.Server = createReadyDaemon(() => {
+      firstConnectionAt ??= performance.now();
+    }, sockets);
+    let listenedAt: number | undefined;
+    const failedAttemptStarts: number[] = [];
+    const startedAt: number = performance.now();
+    const connectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync.bind(DaemonClient);
+    jest.spyOn(DaemonClient, 'connectAsync').mockImplementation(async (options) => {
+      const attemptStart: number = performance.now() - startedAt;
+      try {
+        return await connectAsync(options);
+      } catch (error) {
+        if (listenedAt === undefined) {
+          failedAttemptStarts.push(attemptStart);
+          if (attemptStart >= LISTEN_AFTER_MS) {
+            // listen() binds before it returns, so the endpoint accepts connections from here on.
+            server.listen(paths.socketPath);
+            listenedAt = performance.now();
+          }
+        }
+        throw error;
+      }
+    });
+
+    const launcherPidPath: string = path.join(folder, 'launcher-pid');
+    const exitNowPath: string = path.join(folder, 'exit-now');
+    const launcher: string = [
+      "const fs = require('fs');",
+      `fs.writeFileSync(${JSON.stringify(launcherPidPath)}, String(process.pid));`,
+      `setInterval(() => { if (fs.existsSync(${JSON.stringify(exitNowPath)})) process.exit(0); }, 5);`
+    ].join('\n');
+    try {
+      const token: string = reserveDaemonStartup(paths, {
+        pid: process.pid,
+        startedAt: new Date().toISOString()
+      });
+      const outcome: string = await runDaemonStartupAsync({
+        paths,
+        token,
+        timeoutMs: 10000,
+        startCommand: {
+          command: process.execPath,
+          args: ['-e', launcher],
+          cwd: folder,
+          environment: { PATH: process.env.PATH ?? '', SystemRoot: process.env.SystemRoot ?? '' }
+        }
+      }).then(
+        () => 'resolved',
+        (error: Error) => error.message
+      );
+      if (listenedAt === undefined || firstConnectionAt === undefined) {
+        throw new Error(`The daemon never listened or was never reached (${outcome}).`);
+      }
+      return {
+        outcome,
+        failedAttemptStarts,
+        connectionDelayMs: firstConnectionAt - listenedAt,
+        reservationRemains: fs.existsSync(getDaemonStartupFilePath(paths))
+      };
+    } finally {
+      fs.writeFileSync(exitNowPath, '');
+      if (fs.existsSync(launcherPidPath)) {
+        const launcherPid: number = Number(fs.readFileSync(launcherPidPath, 'utf8'));
+        await waitUntilAsync(() => isProcessGone(launcherPid), 'the launcher exits');
+      }
+      for (const socket of sockets) socket.destroy();
+      if (server.listening) await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  }
+
+  it('connects within one short poll after the daemon starts listening late in its start', async () => {
+    const result: ILateReadiness = await runWithLateReadinessAsync();
+
+    expect(result.outcome).toBe('resolved');
+    expect(result.reservationRemains).toBe(false);
+    expect(result.connectionDelayMs).toBeLessThan(150);
+  });
+
+  it('waits between readiness attempts instead of spinning', async () => {
+    const { outcome, failedAttemptStarts }: ILateReadiness = await runWithLateReadinessAsync();
+
+    expect(outcome).toBe('resolved');
+    const shortGaps: number[] = [];
+    for (let i: number = 1; i < failedAttemptStarts.length; i++) {
+      const gap: number = failedAttemptStarts[i] - failedAttemptStarts[i - 1];
+      if (gap < 25) shortGaps.push(Math.round(gap));
+    }
+    expect(failedAttemptStarts.length).toBeGreaterThan(1);
+    expect(shortGaps).toEqual([]);
+  });
+});

From cc562a686b3c9f005ad9729259e0e286a39c540e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 184/265] [rush-daemon] rush-daemon tests: stop successor
 daemons after each test, including one that timed out, and remove their logs

Swarm integration step 169; original commit c74de5ea69 (merge of swarm/r06-t246 at 727f48498c).
Scope: task 246.

Brings 246 (branch swarm/r06-t246). Second agent: o05 board 5671. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 3 of 17. Gate: ch01 GATE OK board 6389 (tree f4c767292c)

Commits folded into this step (1):
- 727f48498c rush-daemon tests: stop successor daemons after each test, including one that timed out, and remove their logs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t246-test-successors_2026-09-29-13-05.json | 11 ++++
 .../src/test/DaemonGraphTestFixture.ts        |  2 +
 .../src/test/NativeEngineTestFixture.ts       |  2 +
 .../src/test/TestDaemonHostCleanup.ts         | 55 +++++++++++++++++++
 .../src/test/WorkspaceLifecycleTestProcess.ts | 14 ++++-
 5 files changed, 81 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t246-test-successors_2026-09-29-13-05.json
 create mode 100644 libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts

diff --git a/common/changes/@rushstack/rush-daemon/r06-t246-test-successors_2026-09-29-13-05.json b/common/changes/@rushstack/rush-daemon/r06-t246-test-successors_2026-09-29-13-05.json
new file mode 100644
index 0000000000..ac886cb35d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t246-test-successors_2026-09-29-13-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Tests now close their daemon hosts and stop any successor daemon after each test, including a test that timed out, and remove the log that the successor left in the shared daemon runtime directory.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index a6d0c6d3e5..d66bc68b4e 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -31,6 +31,7 @@ import {
 } from './DaemonRequestWireTestUtilities';
 import { assertSuccessfulNativeBuild } from './NativeBuildTestResult';
 import { removeTestFolderAsync } from './TestProcessExit';
+import { trackTestDaemonHostAsync } from './TestDaemonHostCleanup';
 
 /**
  * How long a fixture script that waits for its test may run. Keep it longer than the timeout of every test that uses
@@ -200,6 +201,7 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
         return this.session;
       }
     });
+    await trackTestDaemonHostAsync(this.host);
   }
 
   public async restartAsync(): Promise<void> {
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
index 240d69b734..a663180973 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -18,6 +18,7 @@ import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResol
 import { RushDaemonHost } from '../RushDaemonHost';
 import { WorkspaceSession } from '../WorkspaceSession';
 import { removeTestFolderAsync } from './TestProcessExit';
+import { trackTestDaemonHostAsync } from './TestDaemonHostCleanup';
 import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import type {
   IDaemonRequestResolver,
@@ -359,6 +360,7 @@ if (input === 'failure') process.exitCode = 7;
         return session;
       }
     });
+    await trackTestDaemonHostAsync(host);
     const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
     await client.handshakeAsync();
     const runningHost: RushDaemonHost = host;
diff --git a/libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts b/libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts
new file mode 100644
index 0000000000..da6e427d9d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/TestDaemonHostCleanup.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { RushDaemonHost } from '../RushDaemonHost';
+import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
+
+/** Longer than a host's close, a successor's startup (15 s by default) and the successor's stop (15 s) together. */
+const STOP_TIMEOUT_MS: number = 60_000;
+
+const hosts: Set<RushDaemonHost> = new Set();
+let fileEnded: boolean = false;
+
+/**
+ * Closes `host` once the running test ends, and stops any successor daemon that the host started.
+ *
+ * @remarks
+ * A test that times out never reaches its own `finally`. Jest goes on to the next test while that test keeps running,
+ * so its host can still start a real successor, which would run for its whole idle timeout (900 s) with its socket,
+ * lockfile and log in the shared runtime directory. Jest does run `afterEach` after a timed-out test: that closes the
+ * host, waits for a restart that it began, and stops the successor. A host that starts after its test file's last
+ * hook is closed at once, and this rejects.
+ */
+export async function trackTestDaemonHostAsync(host: RushDaemonHost): Promise<void> {
+  if (!fileEnded) {
+    hosts.add(host);
+    return;
+  }
+  await stopHostAsync(host);
+  throw new Error('A daemon host started after its test file ended, so it was closed.');
+}
+
+async function stopHostAsync(host: RushDaemonHost): Promise<void> {
+  // The test reports its own close and restart failures; this only makes sure that nothing keeps running.
+  await host.closeAsync().catch(() => undefined);
+  await host.restartCompleted.catch(() => undefined);
+  await stopSuccessorAsync(host.paths);
+}
+
+async function stopTrackedHostsAsync(): Promise<void> {
+  const stopping: Promise<void>[] = Array.from(hosts, stopHostAsync);
+  hosts.clear();
+  const failures: unknown[] = (await Promise.allSettled(stopping)).flatMap((result) =>
+    result.status === 'rejected' ? [result.reason] : []
+  );
+  if (failures.length > 0) {
+    throw new AggregateError(failures, 'Failed to stop the daemons that a test left running.');
+  }
+}
+
+afterEach(stopTrackedHostsAsync, STOP_TIMEOUT_MS);
+
+afterAll(async () => {
+  fileEnded = true;
+  await stopTrackedHostsAsync();
+}, STOP_TIMEOUT_MS);
diff --git a/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts b/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts
index 4c073c1e27..97feaf8444 100644
--- a/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceLifecycleTestProcess.ts
@@ -4,7 +4,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import { DaemonClient, requestDaemonShutdownAsync } from '@rushstack/rush-client-core';
+import { DaemonClient, getDaemonLogFilePath, requestDaemonShutdownAsync } from '@rushstack/rush-client-core';
 import {
   readDaemonLockfile,
   type IDaemonLockfile,
@@ -12,10 +12,18 @@ import {
 } from '@rushstack/rush-daemon-transport';
 import { waitForTestProcessExitAsync } from './TestProcessExit';
 
-/** Waits on attested ownership removal, not an arbitrary sleep or mere connection close. */
+/**
+ * Stops the daemon that owns `paths` unless it is this process, then removes the log that the daemons for `paths`
+ * appended to. Waits on attested ownership removal, not an arbitrary sleep or mere connection close.
+ */
 export async function stopSuccessorAsync(paths: IDaemonPaths): Promise<void> {
   const owner: IDaemonLockfile | undefined = readDaemonLockfile(paths.lockfilePath);
-  if (!owner || owner.pid === process.pid) return;
+  if (owner && owner.pid !== process.pid) await stopOwnerAsync(paths, owner);
+  // Nothing else removes it. When the stop fails, it stays for diagnosis.
+  await fs.promises.rm(getDaemonLogFilePath(paths), { force: true });
+}
+
+async function stopOwnerAsync(paths: IDaemonPaths, owner: IDaemonLockfile): Promise<void> {
   const { pid: ownerPid, startedAt: ownerStartedAt } = owner;
   const client: DaemonClient = await DaemonClient.connectAsync({ socketPath: paths.socketPath });
   const removed: Promise<void> = new Promise((resolve, reject) => {

From 660c20eb1390a8a91818f4621fdcc78afbfa9a9e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 185/265] [rush-daemon] Test that the resolver rejects a
 command it never serves before it parses

Swarm integration step 170; original commit 844b73b77b (merge of swarm/r02-t270-int3 at 14813ec37f).
Refs: task 270 on 207.
Scope: task 270.

Brings 270 (branch swarm/r02-t270-int3). Second agent: r01 board 5473. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 4 of 17. Gate: ch01 GATE OK board 6389 (tree 5b6a1933dc)

Commits folded into this step (2):
- 86ba3f2c62 [rush-daemon] Restart for a phased custom command whose environment differs
- 14813ec37f [rush-daemon] Test that the resolver rejects a command it never serves before it parses (task 270 on 207)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-environment-restart_2026-09-29-13-00.json | 11 ++++
 .../src/DaemonRequestDispatcher.ts            | 16 +++++
 .../src/ProductionDaemonRequestResolver.ts    | 33 ++++++++--
 .../src/WorkspaceRequestLifecycle.ts          | 14 ++--
 .../ProductionDaemonCustomCommands.test.ts    | 27 +++++---
 ...roductionDaemonEnvironmentIdentity.test.ts | 57 ++++++++++++++++-
 .../WorkspaceEnvironmentRestartReason.test.ts | 64 +++++++++++++++++++
 7 files changed, 201 insertions(+), 21 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/custom-command-environment-restart_2026-09-29-13-00.json

diff --git a/common/changes/@rushstack/rush-daemon/custom-command-environment-restart_2026-09-29-13-00.json b/common/changes/@rushstack/rush-daemon/custom-command-environment-restart_2026-09-29-13-00.json
new file mode 100644
index 0000000000..cdd4642053
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/custom-command-environment-restart_2026-09-29-13-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Restart the daemon for a phased custom command whose environment differs from the daemon's, as for build, instead of running the command in-process. A global command is still rejected before its environment can restart the daemon.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index 39066eb9bf..31bdb54d7b 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -93,6 +93,22 @@ export class DaemonRequestDispatchError extends Error {
   }
 }
 
+/**
+ * A phased command request whose environment differs from the daemon's startup environment. A host lifecycle
+ * restarts the daemon from that environment, as it does for build. Without one, the client runs the command
+ * in-process.
+ */
+export class DaemonRequestEnvironmentError extends DaemonRequestDispatchError {
+  public constructor() {
+    super(
+      'unsupported',
+      'The request environment differs from the daemon startup environment. Restart the daemon from this ' +
+        'environment or use --no-daemon.'
+    );
+    this.name = 'DaemonRequestEnvironmentError';
+  }
+}
+
 /** Wire destination consumed by the shared request dispatcher. @beta */
 export interface IDaemonRequestDispatchClient {
   readonly abortSignal: AbortSignal;
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index d28f560f9b..c65411b684 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -27,6 +27,7 @@ import type {
 
 import {
   DaemonRequestDispatchError,
+  DaemonRequestEnvironmentError,
   type IDaemonRequestResolver,
   type IResolveDaemonRequestOptions,
   type ResolvedDaemonRequest
@@ -164,11 +165,14 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
    * Returns the identity of the bound engine's command when that engine can serve the request, so that the
    * lifecycle reuses it, and the request's own identity otherwise, so that the lifecycle reloads. A custom command
    * that the bound engine cannot serve, and whose own engine could not serve the bound engine's command, is
-   * unsupported.
+   * unsupported. A request whose environment differs from the startup environment is rejected only after its
+   * command line parses as a phased command, so that a lifecycle restarts the daemon only for such a command.
    */
   public async getCommandParameterIdentityAsync(options: IResolveDaemonRequestOptions): Promise<string> {
     const { envelope, workspaceSession } = options;
-    const parsed: IParsedCommand = await this.#parseCommandAsync(options);
+    this.#assertServedCommand(envelope);
+    const parsed: IParsedCommand = await this.#parseCommandLineAsync(options);
+    this.#assertStartupEnvironment(envelope);
     // Resolving the same request uses this parse instead of parsing the same command line again.
     this.#identityParses.set(options.abortSignal, parsed);
     const { command } = parsed;
@@ -321,15 +325,22 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     options: IResolveDaemonRequestOptions,
     identityParse?: IParsedCommand
   ): Promise<IParsedCommand> {
-    const { envelope, workspaceSession, abortSignal } = options;
     // Skips parsing for a command that the resolver never serves.
+    this.#assertServedCommand(options.envelope);
+    this.#assertStartupEnvironment(options.envelope);
+    return await this.#parseCommandLineAsync(options, identityParse);
+  }
+
+  /** Throws the error of `getUnsupportedCommandError`, if it returns one. */
+  #assertServedCommand(envelope: IDaemonRequestEnvelope): void {
     const unsupported: DaemonRequestDispatchError | undefined = this.getUnsupportedCommandError(envelope);
     if (unsupported) throw unsupported;
+  }
+
+  /** Rejects a request whose environment, or the daemon's own environment, differs from the startup environment. */
+  #assertStartupEnvironment(envelope: IDaemonRequestEnvelope): void {
     if (environmentIdentity(envelope.environment) !== this.#environmentIdentity) {
-      throw new DaemonRequestDispatchError(
-        'unsupported',
-        'The request environment differs from the daemon startup environment. Restart the daemon from this environment or use --no-daemon.'
-      );
+      throw new DaemonRequestEnvironmentError();
     }
     const changedNames: string[] = this.#getChangedStartupNames();
     if (changedNames.length > 0) {
@@ -339,6 +350,14 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           'may have changed process.env. Restart the daemon or use --no-daemon.'
       );
     }
+  }
+
+  /** Parses the command line of the request, unless `identityParse` is given, and checks the parsed command. */
+  async #parseCommandLineAsync(
+    options: IResolveDaemonRequestOptions,
+    identityParse?: IParsedCommand
+  ): Promise<IParsedCommand> {
+    const { envelope, workspaceSession, abortSignal } = options;
     let parsed: IParsedCommand | undefined = identityParse;
     if (!parsed) {
       const terminal: EngineTerminalProvider = new EngineTerminalProvider();
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index a502a58c8e..334825dda7 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -29,6 +29,7 @@ import type {
 
 import {
   DaemonRequestDispatchError,
+  DaemonRequestEnvironmentError,
   isDaemonGraphCommand,
   type DispatchWorkspaceRequestAsync,
   type IDaemonRequestDispatchClient,
@@ -609,7 +610,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       let commandIdentity: string | undefined;
       if (envelope.commandOrigin === 'custom') {
         // Only phased custom commands are served. Parsing before any input capture rejects a global command
-        // before it can reload or restart this workspace.
+        // before it can reload or restart this workspace. A phased command whose environment differs from this
+        // daemon's continues to the capture, which restarts the daemon for it, as it does for build.
         commandIdentity = await tryGetCustomCommandParameterIdentityAsync(this.#resolver, {
           envelope,
           workspaceSession: session,
@@ -1387,8 +1389,10 @@ async function getCommandParameterIdentityAsync(
 }
 
 /**
- * Parses a custom command before the input capture, or returns `undefined` for a usage error. The parse after the
- * capture answers that error only if the configuration is current (`getCommandParameterIdentityAsync`).
+ * Parses a custom command before the input capture, or returns `undefined` for a usage error or for an environment
+ * that differs from the daemon's. The parse after the capture answers a usage error only if the configuration is
+ * current (`getCommandParameterIdentityAsync`). The capture classifies an environment that differs, so the daemon
+ * restarts for the request, as it does for build; if the capture found no difference, that parse rejects it.
  */
 async function tryGetCustomCommandParameterIdentityAsync(
   resolver: IDaemonRequestResolver,
@@ -1397,7 +1401,9 @@ async function tryGetCustomCommandParameterIdentityAsync(
   try {
     return await getResolverLifecycle(resolver).getCommandParameterIdentityAsync(options);
   } catch (error) {
-    if (error instanceof DaemonRequestUsageError) return undefined;
+    if (error instanceof DaemonRequestUsageError || error instanceof DaemonRequestEnvironmentError) {
+      return undefined;
+    }
     throw error;
   }
 }
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
index 2bea5429f1..914f3b40b7 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonCustomCommands.test.ts
@@ -145,27 +145,36 @@ describe('native production daemon engine', () => {
     }
   });
 
-  it('rejects a global command before its environment can restart the daemon', async () => {
+  it('rejects a global command before its environment can restart the daemon, but not a phased command', async () => {
     const fixture: IFixture = await createFixtureAsync(false, 'direct', { customCommands: true });
     // A variable that is part of the workspace fingerprint environment.
     const environment: Record<string, string> = {
       ...requestEnvironment(),
       RUSHD_CUSTOM_COMMAND_TEST: 'changed'
     };
+    const restartRequired: Record<string, unknown> = {
+      kind: 'requestRejected',
+      payload: {
+        code: 'routingFailed',
+        message: expect.stringContaining('A new daemon process is required (environment)')
+      }
+    };
     try {
       expect(
         (await runAsync(fixture, 'global', ['hello'], { commandOrigin: 'custom', environment })).terminal
-      ).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
-      // A build with this environment needs a new daemon process, which this host cannot launch.
-      expect(
-        (await runAsync(fixture, 'build', ['build', '--only', 'a'], { environment })).terminal
       ).toMatchObject({
         kind: 'requestRejected',
-        payload: {
-          code: 'routingFailed',
-          message: expect.stringContaining('A new daemon process is required (environment)')
-        }
+        payload: { code: 'unsupported', message: expect.stringContaining('is not a phased command') }
       });
+      // A phased command with this environment needs a new daemon process, like build, which this host cannot
+      // launch.
+      expect(
+        (await runAsync(fixture, 'test', ['test', '--only', 'a'], { commandOrigin: 'custom', environment }))
+          .terminal
+      ).toMatchObject(restartRequired);
+      expect(
+        (await runAsync(fixture, 'build', ['build', '--only', 'a'], { environment })).terminal
+      ).toMatchObject(restartRequired);
       expect(runs(fixture)).toEqual([]);
     } finally {
       await fixture[Symbol.asyncDispose]();
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
index 645709e596..1f417dfd16 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
@@ -4,8 +4,9 @@
 import * as path from 'node:path';
 
 import { PhasedCommandEngine } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 
-import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
+import { DaemonRequestEnvironmentError, type IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IWorkspaceSession } from '../WorkspaceSession';
 import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
@@ -95,6 +96,60 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
     }
   });
 
+  it('parses a request whose environment differs before it rejects the request for its environment', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const options: IResolveDaemonRequestOptions = createOptions({ ...getEnvironment(), [ADDED_NAME]: 'x' });
+    // A lifecycle restarts the daemon for this error, so it must mean that the command line is phased.
+    const rejection: Promise<string> = resolver.getCommandParameterIdentityAsync(options);
+    await expect(rejection).rejects.toBeInstanceOf(DaemonRequestEnvironmentError);
+    await expect(rejection).rejects.toMatchObject({
+      code: 'unsupported',
+      message: expect.stringContaining('differs from the daemon startup environment')
+    });
+    expect(parse).toHaveBeenCalledTimes(1);
+    parse.mockRejectedValueOnce(new Error('"hello" is not a phased command.'));
+    await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toMatchObject({
+      name: 'DaemonRequestDispatchError',
+      code: 'unsupported',
+      message: expect.stringContaining('is not a phased command')
+    });
+    // Resolving checks the environment first, and has no parse of the rejected identity check to use.
+    await expect(resolver.resolveRequestAsync(options)).rejects.toBeInstanceOf(DaemonRequestEnvironmentError);
+    expect(parse).toHaveBeenCalledTimes(2);
+  });
+
+  it('rejects a command that it never serves before it parses or checks the environment', async () => {
+    const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+    const environment: Record<string, string> = { ...getEnvironment(), [ADDED_NAME]: 'x' };
+    const requests: [IDaemonRequestEnvelope, string][] = [
+      [
+        createWireEnvelope('rushx', 'build', process.cwd(), { environment, invocationKind: 'rushx' }),
+        'A rushx script is not a phased command request.'
+      ],
+      [
+        createWireEnvelope('list', 'list', process.cwd(), { environment }),
+        '"list" is a built-in command that is not phased.'
+      ]
+    ];
+    for (const [envelope, message] of requests) {
+      const options: IResolveDaemonRequestOptions = {
+        abortSignal: new AbortController().signal,
+        envelope,
+        workspaceSession: { rushConfiguration: {} } as IWorkspaceSession
+      };
+      // Not the environment error, for which a lifecycle would restart the daemon.
+      await expect(resolver.getCommandParameterIdentityAsync(options)).rejects.toMatchObject({
+        code: 'unsupported',
+        message
+      });
+      await expect(resolver.resolveRequestAsync(options)).rejects.toMatchObject({
+        code: 'unsupported',
+        message
+      });
+    }
+    expect(parse).not.toHaveBeenCalled();
+  });
+
   it('keeps the startup environment for a replacement session', async () => {
     const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
     const options: IResolveDaemonRequestOptions = createOptions(getEnvironment());
diff --git a/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
index c67ee0af9b..982b8ee253 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEnvironmentRestartReason.test.ts
@@ -127,3 +127,67 @@ it('tells the request that restarts the daemon for its environment, and each req
     }
   }
 });
+
+it('restarts the daemon for the environment of a phased custom command, but not for a global command', async () => {
+  const fixture = await DaemonGraphTestFixture.createAsync((created) => {
+    setDaemonPolicy(created, {});
+    created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+    created.write(
+      'common/config/rush/command-line.json',
+      JSON.stringify({
+        phases: [{ name: '_phase:compile', dependencies: { upstream: ['_phase:compile'] } }],
+        commands: [
+          { commandKind: 'phased', name: 'build', phases: ['_phase:compile'], enableParallelism: true },
+          {
+            commandKind: 'phased',
+            name: 'test',
+            summary: 'Tests',
+            phases: ['_phase:compile'],
+            enableParallelism: true
+          },
+          { commandKind: 'global', name: 'hello', summary: 'A global command', shellCommand: 'node -e ""' }
+        ]
+      })
+    );
+  });
+  const custom: Partial<IDaemonRequestEnvelope> = {
+    commandOrigin: 'custom',
+    environment: { ...fixture.environment, RUSHD_CUSTOM_RESTART_REASON: 'custom-value' }
+  };
+  try {
+    const before = await pongAsync(fixture);
+    expect((await fixture.runAsync(['hello'], custom)).terminal).toMatchObject({
+      kind: 'requestRejected',
+      payload: { code: 'unsupported', message: expect.stringContaining('is not a phased command') }
+    });
+    expect((await fixture.runAsync(['test', '--to', 'b'], custom)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: {
+        exitCode: 1,
+        retryAfterRestart: true,
+        restartReason: { kind: 'environmentChanged', variableNames: ['RUSHD_CUSTOM_RESTART_REASON'] }
+      }
+    });
+    expect(fixture.logs.filter((line: string) => line.startsWith('rushd: restarting for request '))).toEqual([
+      "rushd: restarting for request graph-2, whose environment differs from this daemon's in " +
+        'RUSHD_CUSTOM_RESTART_REASON'
+    ]);
+    const restarted = await fixture.host.restartCompleted;
+    expect(restarted?.pid).not.toBe(before.pid);
+    // The successor, which started with that environment, serves the request that the client retries.
+    expect((await fixture.runAsync(['test', '--to', 'b'], custom)).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    expect((await pongAsync(fixture)).pid).toBe(restarted?.pid);
+    expect(fixture.runs()).toEqual(['a', 'b']);
+  } finally {
+    try {
+      await fixture.host.closeAsync();
+      await fixture.host.restartCompleted;
+    } finally {
+      await stopSuccessorAsync(fixture.host.paths);
+      await fixture[Symbol.asyncDispose]();
+    }
+  }
+});

From b2cd1ada36ab9b613b9ab5d9144c1e7422ba131f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 186/265] [package-deps-hash] Note the sparse checkout cost of
 hidden attributes

Swarm integration step 171; original commit f018ef978e (merge of swarm/r07-t252-nit1 at 8d2e3406a6).
Scope: task 252, NIT 1.

Brings 252-nit1 (branch swarm/r07-t252-nit1). Second agent: t04 board 5680. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 5 of 17. Gate: ch01 GATE OK board 6389 (tree 6d6c2d6524)

Commits folded into this step (1):
- 8d2e3406a6 [package-deps-hash] Note the sparse checkout cost of hidden attributes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-state-cache-sparse-checkout_2026-09-29-14-52.json | 11 +++++++++++
 libraries/package-deps-hash/src/RepoStateCache.ts     |  5 +++++
 2 files changed, 16 insertions(+)
 create mode 100644 common/changes/@rushstack/package-deps-hash/repo-state-cache-sparse-checkout_2026-09-29-14-52.json

diff --git a/common/changes/@rushstack/package-deps-hash/repo-state-cache-sparse-checkout_2026-09-29-14-52.json b/common/changes/@rushstack/package-deps-hash/repo-state-cache-sparse-checkout_2026-09-29-14-52.json
new file mode 100644
index 0000000000..82da37a09d
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/repo-state-cache-sparse-checkout_2026-09-29-14-52.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Document that each `RepoStateCache` call examines every `.gitattributes` file that the index marks \"assume unchanged\" or \"skip worktree\", which in a sparse checkout without a sparse index includes every `.gitattributes` file outside the sparse checkout.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index 7666e82634..934e9884a5 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -196,6 +196,11 @@ function noop(): void {}
  * size Git refreshed in the copy but not in the index is rewritten with content that Git converts to the same
  * object, for example with other line endings.
  *
+ * Each call examines every `.gitattributes` file that the index marks "assume unchanged" or "skip worktree", with
+ * one file system call for each. In a sparse checkout without a sparse index, the index marks every
+ * `.gitattributes` file outside the sparse checkout "skip worktree", so each call examines all of them. A file that
+ * stays missing from the working tree, as these files do, doesn't cause the index to be copied again.
+ *
  * Repositories with submodules or a split index fall back to {@link getDetailedRepoStateAsync}, as does a cache
  * that fails repeatedly.
  * @beta

From b9cdacdc67f28da5439f18a94e48a0939cca586b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 187/265] [heft-rspack-plugin] Hold the thread pool in the
 Rspack and Webpack 4 watch flush tests

Swarm integration step 172; original commit ac1bad2b8d (merge of swarm/r01-t244-nit1 at fc6636a6bd).
Scope: task 244, NIT 1.

Brings 244-nit1 (branch swarm/r01-t244-nit1). Second agent: o08 board 5640. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 6 of 17. Gate: ch01 GATE OK board 6389 (tree 769bbeb001)

Commits folded into this step (1):
- fc6636a6bd Hold the thread pool in the Rspack and Webpack 4 watch flush tests

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/DeferredWatchFileSystem.test.ts  | 125 +++++++++++++++---
 .../src/DeferredWatchFileSystem.test.ts       | 125 +++++++++++++++---
 2 files changed, 210 insertions(+), 40 deletions(-)

diff --git a/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
index ee43996eb9..910ae68c01 100644
--- a/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
+++ b/heft-plugins/heft-rspack-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as child_process from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
@@ -29,10 +30,12 @@ interface IFlush {
 // Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
 const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
 
-// Enough work to keep a thread of the thread pool busy for about 100 ms.
+// Windows has no FIFOs, so there holdThreadPool() gives each thread about 100 ms of work instead, which can take
+// longer than flushAsync() waits on a machine whose CPUs are busy.
 const PBKDF2_ITERATIONS: number = 200000;
 
 describe(DeferredWatchFileSystem.name, () => {
+  let fifoPath: string | undefined;
   let folder: string;
   let watchOptions: WatchOptions;
   let onChange: jest.Mock<void, []>;
@@ -41,6 +44,24 @@ describe(DeferredWatchFileSystem.name, () => {
   let watcher: Watcher | undefined;
   let flushes: IFlush[];
   let compilationStartTimes: number[];
+  let releaseThreadPoolAsync: (() => Promise<void>) | undefined;
+
+  beforeAll(() => {
+    if (process.platform !== 'win32') {
+      const fifoFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-rspack-plugin-test-fifo-'));
+      fifoPath = path.join(fifoFolder, 'fifo');
+      child_process.execFileSync('mkfifo', [fifoPath]);
+    }
+  });
+
+  afterAll(() => {
+    if (fifoPath) {
+      // Not fs.rmSync(), which calls lstat on the FIFO. Until the next stat call, Node's fs.realpathSync() then
+      // returns some paths with their symlinks unresolved, and jest fails to require() a package that pnpm linked.
+      fs.unlinkSync(fifoPath);
+      fs.rmdirSync(path.dirname(fifoPath));
+    }
+  });
 
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-rspack-plugin-test-'));
@@ -51,9 +72,12 @@ describe(DeferredWatchFileSystem.name, () => {
     watcher = undefined;
     flushes = [];
     compilationStartTimes = [];
+    releaseThreadPoolAsync = undefined;
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    // For a test that failed while it held the thread pool
+    await releaseThreadPoolAsync?.();
     watcher?.close();
     fs.rmSync(folder, { recursive: true, force: true });
   });
@@ -116,11 +140,52 @@ describe(DeferredWatchFileSystem.name, () => {
   }
 
   /**
-   * Keeps every thread of the thread pool busy for a while, so that the `fs.readdir()` and `fs.lstat()` calls
-   * that the watcher makes next wait in the queue.
+   * Holds every thread of the thread pool until the returned function releases them, so that the `fs.readdir()`
+   * and `fs.lstat()` calls that the watcher makes next wait in the queue. The returned function resolves when the
+   * threads are free again. On Windows, the threads are only busy for a while (see `PBKDF2_ITERATIONS`).
    */
-  function occupyThreadPoolAsync(): Promise<void[]> {
+  function holdThreadPool(): () => Promise<void> {
     const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const releaseAsync: () => Promise<void> = fifoPath
+      ? holdThreadPoolWithFifo(fifoPath, threadCount)
+      : keepThreadPoolBusy(threadCount);
+    let releasePromise: Promise<void> | undefined;
+    releaseThreadPoolAsync = () => (releasePromise ??= releaseAsync());
+    return releaseThreadPoolAsync;
+  }
+
+  function holdThreadPoolWithFifo(fifo: string, threadCount: number): () => Promise<void> {
+    // Opening a FIFO for reading blocks the thread until something opens the FIFO for writing.
+    const fdPromises: Promise<number>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      fdPromises.push(
+        new Promise<number>((resolve, reject) => {
+          fs.open(fifo, 'r', (error, fd) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve(fd);
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      // Opening a FIFO for both reading and writing doesn't block on Linux or macOS, and it releases the threads.
+      // The FIFO stays open until every thread has opened it, so that none of them blocks again.
+      const writerFd: number = fs.openSync(fifo, 'r+');
+      try {
+        for (const fd of await Promise.all(fdPromises)) {
+          fs.closeSync(fd);
+        }
+      } finally {
+        fs.closeSync(writerFd);
+      }
+    };
+  }
+
+  function keepThreadPoolBusy(threadCount: number): () => Promise<void> {
     const tasks: Promise<void>[] = [];
     for (let i: number = 0; i < threadCount; i++) {
       tasks.push(
@@ -135,7 +200,20 @@ describe(DeferredWatchFileSystem.name, () => {
         })
       );
     }
-    return Promise.all(tasks);
+
+    return async () => {
+      await Promise.all(tasks);
+    };
+  }
+
+  /**
+   * Waits until a `flushAsync()` call that was just made is waiting for pending events. It checks for them for the
+   * first time on the second turn of the event loop after the call, so after three turns it is waiting.
+   */
+  async function waitForFlushToWaitAsync(): Promise<void> {
+    for (let i: number = 0; i < 3; i++) {
+      await setImmediateAsync();
+    }
   }
 
   it('returns false before watch() is called', async () => {
@@ -156,14 +234,16 @@ describe(DeferredWatchFileSystem.name, () => {
   itOnLinux('includes a file that was written just before the call', async () => {
     const file: string = createFile('a.js');
     await watchAndWaitForScanAsync([file]);
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     fs.writeFileSync(file, 'changed');
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
     expect(purge).toHaveBeenCalledWith(file);
-    await busyThreadPool;
     await setTimeoutAsync(50);
     expect(onChange).not.toHaveBeenCalled();
   });
@@ -171,17 +251,19 @@ describe(DeferredWatchFileSystem.name, () => {
   itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
     const file: string = createFile('a.js');
     await watchAndWaitForScanAsync([file]);
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     fs.writeFileSync(file, 'changed');
     await waitForAsync(() =>
       getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
     );
     expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
-    await busyThreadPool;
   });
 
   itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
@@ -218,14 +300,15 @@ describe(DeferredWatchFileSystem.name, () => {
 
       fs.writeFileSync(fileA, 'changed');
       await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
-      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
-      const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+      const releaseAsync: () => Promise<void> = holdThreadPool();
       fs.writeFileSync(fileB, 'changed');
-      await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+      const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      await waitForAsync(() => aggregatedCount > 0);
+      await releaseAsync();
+      await expect(flushPromise).resolves.toBe(true);
 
-      expect(aggregatedCount).toBeGreaterThanOrEqual(1);
       expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
-      await busyThreadPool;
       await setTimeoutAsync(50);
       expect(onChange).not.toHaveBeenCalled();
     }
@@ -263,15 +346,17 @@ describe(DeferredWatchFileSystem.name, () => {
     fs.mkdirSync(subfolder);
     const file: string = path.join(subfolder, 'a.js');
     fs.writeFileSync(file, 'new');
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     // A start time before the file was written, as for a file that changed during the compilation.
     watch([file], Date.now() - 60000);
     expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
-    await busyThreadPool;
   });
 
   it('returns false when the watcher is closed while it waits', async () => {
diff --git a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
index ec22d6fa84..3fd77c1e3f 100644
--- a/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
+++ b/heft-plugins/heft-webpack4-plugin/src/DeferredWatchFileSystem.test.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import * as child_process from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
@@ -29,10 +30,12 @@ interface IFlush {
 // Other platforms can deliver an event later, so the tests that depend on that timing run only on Linux.
 const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
 
-// Enough work to keep a thread of the thread pool busy for about 100 ms.
+// Windows has no FIFOs, so there holdThreadPool() gives each thread about 100 ms of work instead, which can take
+// longer than flushAsync() waits on a machine whose CPUs are busy.
 const PBKDF2_ITERATIONS: number = 200000;
 
 describe(DeferredWatchFileSystem.name, () => {
+  let fifoPath: string | undefined;
   let folder: string;
   let watchOptions: WatchOptions;
   let onChange: jest.Mock<void, []>;
@@ -41,6 +44,24 @@ describe(DeferredWatchFileSystem.name, () => {
   let watcher: IWatch | undefined;
   let flushes: IFlush[];
   let compilationStartTimes: number[];
+  let releaseThreadPoolAsync: (() => Promise<void>) | undefined;
+
+  beforeAll(() => {
+    if (process.platform !== 'win32') {
+      const fifoFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack4-plugin-test-fifo-'));
+      fifoPath = path.join(fifoFolder, 'fifo');
+      child_process.execFileSync('mkfifo', [fifoPath]);
+    }
+  });
+
+  afterAll(() => {
+    if (fifoPath) {
+      // Not fs.rmSync(), which calls lstat on the FIFO. Until the next stat call, Node's fs.realpathSync() then
+      // returns some paths with their symlinks unresolved, and jest fails to require() a package that pnpm linked.
+      fs.unlinkSync(fifoPath);
+      fs.rmdirSync(path.dirname(fifoPath));
+    }
+  });
 
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-webpack4-plugin-test-'));
@@ -51,9 +72,12 @@ describe(DeferredWatchFileSystem.name, () => {
     watcher = undefined;
     flushes = [];
     compilationStartTimes = [];
+    releaseThreadPoolAsync = undefined;
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    // For a test that failed while it held the thread pool
+    await releaseThreadPoolAsync?.();
     watcher?.close();
     fs.rmSync(folder, { recursive: true, force: true });
   });
@@ -116,11 +140,52 @@ describe(DeferredWatchFileSystem.name, () => {
   }
 
   /**
-   * Keeps every thread of the thread pool busy for a while, so that the `fs.readdir()` and `fs.lstat()` calls
-   * that the watcher makes next wait in the queue.
+   * Holds every thread of the thread pool until the returned function releases them, so that the `fs.readdir()`
+   * and `fs.lstat()` calls that the watcher makes next wait in the queue. The returned function resolves when the
+   * threads are free again. On Windows, the threads are only busy for a while (see `PBKDF2_ITERATIONS`).
    */
-  function occupyThreadPoolAsync(): Promise<void[]> {
+  function holdThreadPool(): () => Promise<void> {
     const threadCount: number = Number(process.env.UV_THREADPOOL_SIZE) || 4;
+    const releaseAsync: () => Promise<void> = fifoPath
+      ? holdThreadPoolWithFifo(fifoPath, threadCount)
+      : keepThreadPoolBusy(threadCount);
+    let releasePromise: Promise<void> | undefined;
+    releaseThreadPoolAsync = () => (releasePromise ??= releaseAsync());
+    return releaseThreadPoolAsync;
+  }
+
+  function holdThreadPoolWithFifo(fifo: string, threadCount: number): () => Promise<void> {
+    // Opening a FIFO for reading blocks the thread until something opens the FIFO for writing.
+    const fdPromises: Promise<number>[] = [];
+    for (let i: number = 0; i < threadCount; i++) {
+      fdPromises.push(
+        new Promise<number>((resolve, reject) => {
+          fs.open(fifo, 'r', (error, fd) => {
+            if (error) {
+              reject(error);
+            } else {
+              resolve(fd);
+            }
+          });
+        })
+      );
+    }
+
+    return async () => {
+      // Opening a FIFO for both reading and writing doesn't block on Linux or macOS, and it releases the threads.
+      // The FIFO stays open until every thread has opened it, so that none of them blocks again.
+      const writerFd: number = fs.openSync(fifo, 'r+');
+      try {
+        for (const fd of await Promise.all(fdPromises)) {
+          fs.closeSync(fd);
+        }
+      } finally {
+        fs.closeSync(writerFd);
+      }
+    };
+  }
+
+  function keepThreadPoolBusy(threadCount: number): () => Promise<void> {
     const tasks: Promise<void>[] = [];
     for (let i: number = 0; i < threadCount; i++) {
       tasks.push(
@@ -135,7 +200,20 @@ describe(DeferredWatchFileSystem.name, () => {
         })
       );
     }
-    return Promise.all(tasks);
+
+    return async () => {
+      await Promise.all(tasks);
+    };
+  }
+
+  /**
+   * Waits until a `flushAsync()` call that was just made is waiting for pending events. It checks for them for the
+   * first time on the second turn of the event loop after the call, so after three turns it is waiting.
+   */
+  async function waitForFlushToWaitAsync(): Promise<void> {
+    for (let i: number = 0; i < 3; i++) {
+      await setImmediateAsync();
+    }
   }
 
   it('returns false before watch() is called', async () => {
@@ -156,14 +234,16 @@ describe(DeferredWatchFileSystem.name, () => {
   itOnLinux('includes a file that was written just before the call', async () => {
     const file: string = createFile('a.js');
     await watchAndWaitForScanAsync([file]);
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     fs.writeFileSync(file, 'changed');
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
     expect(purge).toHaveBeenCalledWith([file]);
-    await busyThreadPool;
     await setTimeoutAsync(50);
     expect(onChange).not.toHaveBeenCalled();
   });
@@ -171,17 +251,19 @@ describe(DeferredWatchFileSystem.name, () => {
   itOnLinux('includes a file whose event arrived before the call but is not recorded yet', async () => {
     const file: string = createFile('a.js');
     await watchAndWaitForScanAsync([file]);
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     fs.writeFileSync(file, 'changed');
     await waitForAsync(() =>
       getDirectoryWatchers().some((directoryWatcher) => directoryWatcher._activeEvents.size > 0)
     );
     expect(watchFileSystem.watcher!.aggregatedChanges.size).toBe(0);
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
-    await busyThreadPool;
   });
 
   itOnLinux('includes a file that was written in the same poll phase as the call', async () => {
@@ -218,14 +300,15 @@ describe(DeferredWatchFileSystem.name, () => {
 
       fs.writeFileSync(fileA, 'changed');
       await waitForAsync(() => watchFileSystem.watcher!.aggregatedChanges.has(fileA));
-      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
-      const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+      const releaseAsync: () => Promise<void> = holdThreadPool();
       fs.writeFileSync(fileB, 'changed');
-      await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+      const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+      // The watcher reports a.js when its 20 ms aggregate timeout ends, while flushAsync() still waits for b.js.
+      await waitForAsync(() => aggregatedCount > 0);
+      await releaseAsync();
+      await expect(flushPromise).resolves.toBe(true);
 
-      expect(aggregatedCount).toBeGreaterThanOrEqual(1);
       expect(flushes).toEqual([{ changes: [fileA, fileB].sort(), removals: [] }]);
-      await busyThreadPool;
       await setTimeoutAsync(50);
       expect(onChange).not.toHaveBeenCalled();
     }
@@ -262,15 +345,17 @@ describe(DeferredWatchFileSystem.name, () => {
     fs.mkdirSync(subfolder);
     const file: string = path.join(subfolder, 'a.js');
     fs.writeFileSync(file, 'new');
-    const busyThreadPool: Promise<void[]> = occupyThreadPoolAsync();
+    const releaseAsync: () => Promise<void> = holdThreadPool();
 
     // A start time before the file was written, as for a file that changed during the compilation.
     watch([file], Date.now() - 60000);
     expect(getDirectoryWatchers().some((directoryWatcher) => directoryWatcher.scanning)).toBe(true);
-    await expect(watchFileSystem.flushAsync()).resolves.toBe(true);
+    const flushPromise: Promise<boolean> = watchFileSystem.flushAsync();
+    await waitForFlushToWaitAsync();
+    await releaseAsync();
+    await expect(flushPromise).resolves.toBe(true);
 
     expect(flushes).toEqual([{ changes: [file], removals: [] }]);
-    await busyThreadPool;
   });
 
   it('returns false when the watcher is closed while it waits', async () => {

From 9f069900b9b1627eb49b9c98be339741e7b695a3 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:31 +0000
Subject: [PATCH 188/265] [rush-lib] Add a beforeLogRequest hook for every
 telemetry entry

Swarm integration step 173; original commit 8cf6e7e168 (merge of swarm/r02-t284-e2e at a7a90d4780).
Scope: task 284, rushstack half.

Brings 284 (branch swarm/r02-t284-e2e). Second agent: m03 board 5723, carried over board 5898. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 7 of 17. Gate: ch01 GATE OK board 6389 (tree 1e5c84d2fa)

Commits folded into this step (1):
- a7a90d4780 [rush-lib] Add a beforeLogRequest hook for every telemetry entry

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../before-log-request_2026-09-29-14-30.json  | 11 +++
 common/reviews/api/rush-lib.api.md            |  1 +
 .../ProductionDaemonRequestResolver.test.ts   | 12 ++-
 .../rush-lib/src/api/PhasedCommandEngine.ts   | 42 ++++++---
 .../test/PhasedCommandEngineTelemetry.test.ts | 49 +++++++++++
 .../src/logic/operations/OperationGraph.ts    |  5 +-
 .../test/OperationGraphTelemetry.test.ts      | 88 +++++++++++++++++++
 .../pluginFramework/OperationGraphHooks.ts    | 19 ++++
 8 files changed, 211 insertions(+), 16 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/before-log-request_2026-09-29-14-30.json
 create mode 100644 libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts

diff --git a/common/changes/@microsoft/rush/before-log-request_2026-09-29-14-30.json b/common/changes/@microsoft/rush/before-log-request_2026-09-29-14-30.json
new file mode 100644
index 0000000000..8e09607a41
--- /dev/null
+++ b/common/changes/@microsoft/rush/before-log-request_2026-09-29-14-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add the `beforeLogRequest` operation graph hook, which runs before every telemetry entry of the graph is written, including the entry of a request that a long-lived host such as the Rush daemon served without an iteration. Plugins use it instead of `beforeLog` for data that does not describe an iteration, such as a flag that says that the plugin is active, so that the daemon's entries for up-to-date requests carry it too.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 28fd570b0e..5595162194 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1443,6 +1443,7 @@ export class OperationGraphHooks {
     IOperationRunnerContext & IOperationExecutionResult
     ], OperationStatus | undefined>;
     readonly beforeLog: SyncHook<ITelemetryData, void>;
+    readonly beforeLogRequest: SyncHook<ITelemetryData, void>;
     readonly configureIteration: SyncHook<[
     ReadonlyMap<Operation, IConfigurableOperation>,
     ReadonlyMap<Operation, IOperationExecutionResult>,
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 45b7405745..993c1ebf57 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1751,6 +1751,7 @@ fs.writeFileSync('lib/output.txt', input + '+' + fs.readFileSync('../a/lib/outpu
     const fixture: IFixture = await createFixtureAsync(false, 'direct', { telemetryEnabled: true });
     try {
       const beforeLogIndexes: unknown[] = [];
+      const beforeLogRequestIndexes: unknown[] = [];
       for (const [requestId, argv] of [
         ['initial', ['build', '--only', 'a']],
         ['repeat', ['build', '--only', 'a']],
@@ -1761,9 +1762,15 @@ fs.writeFileSync('lib/output.txt', input + '+' + fs.readFileSync('../a/lib/outpu
           payload: { exitCode: 0 }
         });
         if (requestId === 'initial') {
-          fixture.session.operationGraph!.hooks.beforeLog.tap('test', (data: ITelemetryData) => {
+          const { hooks } = fixture.session.operationGraph!;
+          hooks.beforeLog.tap('test', (data: ITelemetryData) => {
             beforeLogIndexes.push(data.extraData?.requestIndex);
           });
+          // Like a plugin that flags every entry that it is active, such as fstrace.
+          hooks.beforeLogRequest.tap('test', (data: ITelemetryData) => {
+            beforeLogRequestIndexes.push(data.extraData?.requestIndex);
+            data.extraData!.pluginActive = true;
+          });
         }
       }
       const entries: ITelemetryData[] = readTelemetryEntries(fixture.repoRoot);
@@ -1820,6 +1827,9 @@ fs.writeFileSync('lib/output.txt', input + '+' + fs.readFileSync('../a/lib/outpu
       }
       // The repeated request needed no iteration, so iteration-scoped beforeLog taps do not see its entry.
       expect(beforeLogIndexes).toEqual([3]);
+      // beforeLogRequest taps see every entry, and what they add is logged.
+      expect(beforeLogRequestIndexes).toEqual([2, 3]);
+      expect(entries.map(({ extraData }) => extraData!.pluginActive)).toEqual([undefined, true, true]);
       expect(runs(fixture)).toEqual(['a:one:', 'b:one:']);
     } finally {
       await fixture[Symbol.asyncDispose]();
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 1c5e2f4c08..49a22ba429 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -21,6 +21,7 @@ import { PhasedCommandEngineExecution } from '../logic/operations/PhasedCommandE
 import { createPhasedTelemetryData } from '../logic/operations/PhasedCommandTelemetry';
 import { type ITelemetryData, Telemetry } from '../logic/Telemetry';
 import { getRunAnyPhasedCommandBlocker } from '../pluginFramework/PhasedCommandHookTaps';
+import type { OperationGraphHooks } from '../pluginFramework/OperationGraphHooks';
 import type { RushSession } from '../pluginFramework/RushSession';
 import type { RushConfiguration } from './RushConfiguration';
 import { RushUserConfiguration } from './RushUserConfiguration';
@@ -47,11 +48,11 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
   readonly pluginNames: ReadonlyArray<string>;
   readonly isIncremental: boolean;
   /**
-   * Logs one request's telemetry entry the way a native iteration logs its own: `beforeLog` taps run first, then
-   * the entry is saved under `common/temp/telemetry` and passed to `flushTelemetry` taps. Disposing the engine waits
-   * up to 2 seconds for taps that are still running; a tap that takes longer, such as an upload over a stalled
-   * network, keeps running in the background, so that it cannot hold the host. Saving does nothing when telemetry
-   * is disabled for the repository.
+   * Logs one request's telemetry entry the way a native iteration logs its own: `beforeLogRequest` and `beforeLog`
+   * taps run first, then the entry is saved under `common/temp/telemetry` and passed to `flushTelemetry` taps.
+   * Disposing the engine waits up to 2 seconds for taps that are still running; a tap that takes longer, such as an
+   * upload over a stalled network, keeps running in the background, so that it cannot hold the host. Saving does
+   * nothing when telemetry is disabled for the repository.
    *
    * @remarks
    * `beforeLog` taps describe the latest iteration, so a host logs an iteration's entries before it starts the
@@ -67,8 +68,8 @@ export interface IPhasedCommandEngine extends AsyncDisposable {
 export interface IPhasedCommandEngineLogTelemetryOptions {
   /**
    * Whether a graph iteration served the request. If `false`, as for a request that the warm graph answered
-   * without an iteration, `beforeLog` taps are skipped, because they would describe an earlier iteration.
-   * Defaults to `true`.
+   * without an iteration, `beforeLog` taps are skipped, because they would describe an earlier iteration;
+   * `beforeLogRequest` taps still run. Defaults to `true`.
    */
   readonly servedByIteration?: boolean;
 }
@@ -298,13 +299,8 @@ export class PhasedCommandEngine {
       return {
         ...engine,
         acquireExecutionLeaseAsync: () => execution.acquireExecutionLeaseAsync(),
-        logTelemetry: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) => {
-          if (options?.servedByIteration !== false) {
-            operationGraph.hooks.beforeLog.call(data);
-          }
-          telemetry.log(data);
-          telemetry.flush();
-        },
+        logTelemetry: (data: ITelemetryData, options?: IPhasedCommandEngineLogTelemetryOptions) =>
+          logEngineTelemetry(operationGraph.hooks, telemetry, data, options),
         [Symbol.asyncDispose]: async () => {
           try {
             await execution[Symbol.asyncDispose]();
@@ -482,6 +478,24 @@ function rebasePerformanceEntry(entry: PerformanceEntry, timeOriginMs: number):
   };
 }
 
+/**
+ * Logs one request's telemetry entry for an engine: the graph's `beforeLogRequest` taps run first, then its
+ * `beforeLog` taps if an iteration served the request, then the entry is saved and flushed.
+ */
+export function logEngineTelemetry(
+  hooks: Pick<OperationGraphHooks, 'beforeLog' | 'beforeLogRequest'>,
+  telemetry: Pick<Telemetry, 'log' | 'flush'>,
+  data: ITelemetryData,
+  options: IPhasedCommandEngineLogTelemetryOptions | undefined
+): void {
+  hooks.beforeLogRequest.call(data);
+  if (options?.servedByIteration !== false) {
+    hooks.beforeLog.call(data);
+  }
+  telemetry.log(data);
+  telemetry.flush();
+}
+
 /**
  * Waits for pending `flushTelemetry` taps, but no longer than `timeoutMs`. As in the native CLI, a failed tap does
  * not fail the command.
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
index c304182674..13df5c22bd 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineTelemetry.test.ts
@@ -10,7 +10,9 @@ import { NoOpTerminalProvider } from '@rushstack/terminal';
 
 import {
   PhasedCommandEngine,
+  logEngineTelemetry,
   waitForTelemetryFlushAsync,
+  type IPhasedCommandEngineLogTelemetryOptions,
   type IPhasedCommandEngineTelemetryOptions,
   type IPhasedCommandEngineTelemetryRecord
 } from '../PhasedCommandEngine';
@@ -21,6 +23,7 @@ import type { ITelemetryData } from '../../logic/Telemetry';
 import { Operation } from '../../logic/operations/Operation';
 import { OperationStatus } from '../../logic/operations/OperationStatus';
 import { MockOperationRunner } from '../../logic/operations/test/MockOperationRunner';
+import { OperationGraphHooks } from '../../pluginFramework/OperationGraphHooks';
 
 describe(`${PhasedCommandEngine.name} telemetry`, () => {
   let folder: string;
@@ -216,6 +219,52 @@ describe(`${PhasedCommandEngine.name} telemetry`, () => {
   });
 });
 
+describe(logEngineTelemetry.name, () => {
+  // One tap is like a plugin that flags that it is active; the other reports what it did since the last iteration.
+  function logEntry(options: IPhasedCommandEngineLogTelemetryOptions | undefined): string[] {
+    const hooks: OperationGraphHooks = new OperationGraphHooks();
+    const events: string[] = [];
+    hooks.beforeLogRequest.tap('plugin flag', (data: ITelemetryData) => {
+      events.push('beforeLogRequest');
+      data.extraData!.pluginActive = true;
+    });
+    hooks.beforeLog.tap('iteration report', (data: ITelemetryData) => {
+      events.push(`beforeLog, pluginActive ${data.extraData!.pluginActive}`);
+      data.extraData!.iterationAuthSeconds = 2;
+    });
+    const data: ITelemetryData = { name: 'build', durationInSeconds: 1, result: 'Succeeded', extraData: {} };
+    logEngineTelemetry(
+      hooks,
+      {
+        log: (entry: ITelemetryData) => events.push(`log ${JSON.stringify(entry.extraData)}`),
+        flush: () => events.push('flush')
+      },
+      data,
+      options
+    );
+    return events;
+  }
+
+  it('runs only beforeLogRequest taps for a request that no iteration served', () => {
+    expect(logEntry({ servedByIteration: false })).toEqual([
+      'beforeLogRequest',
+      'log {"pluginActive":true}',
+      'flush'
+    ]);
+  });
+
+  it('runs beforeLogRequest taps, then beforeLog taps, for a request that an iteration served', () => {
+    for (const options of [{ servedByIteration: true }, {}, undefined]) {
+      expect(logEntry(options)).toEqual([
+        'beforeLogRequest',
+        'beforeLog, pluginActive true',
+        'log {"pluginActive":true,"iterationAuthSeconds":2}',
+        'flush'
+      ]);
+    }
+  });
+});
+
 describe(waitForTelemetryFlushAsync.name, () => {
   it('waits for taps that settle before the timeout', async () => {
     let settled: boolean = false;
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index 93ce469aba..be6c1a0e4c 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -1134,7 +1134,10 @@ export class OperationGraph implements IOperationGraph {
         });
       });
 
-      measureFn(`${PERF_PREFIX}:beforeLog`, () => this.hooks.beforeLog.call(logEntry));
+      measureFn(`${PERF_PREFIX}:beforeLog`, () => {
+        this.hooks.beforeLogRequest.call(logEntry);
+        this.hooks.beforeLog.call(logEntry);
+      });
       telemetry.log(logEntry);
     }
 
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts
new file mode 100644
index 0000000000..d8d6a11893
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphTelemetry.test.ts
@@ -0,0 +1,88 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { ITelemetryData } from '../../Telemetry';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+describe('OperationGraph telemetry', () => {
+  it("runs beforeLogRequest taps, then beforeLog taps, before it logs an iteration's entry", async () => {
+    const events: string[] = [];
+    const operation: Operation = new Operation({
+      runner: new MockOperationRunner('logged'),
+      logFilenameIdentifier: 'logged',
+      phase: mockPhase,
+      project: { packageName: 'logged' } as unknown as RushConfigurationProject
+    });
+    const graph: OperationGraph = new OperationGraph(new Set([operation]), {
+      quietMode: true,
+      debugMode: false,
+      parallelism: 1,
+      allowOversubscription: true,
+      destinations: [new MockWritable()],
+      abortController: new AbortController(),
+      telemetry: {
+        initialExtraData: {},
+        changedProjectsOnlyKey: undefined,
+        nameForLog: 'build',
+        log: ({ extraData }: ITelemetryData) => {
+          events.push(`log ${JSON.stringify(extraData)}`);
+        }
+      }
+    });
+    // Tapped first, to show that the hook, not the tap order, runs beforeLogRequest taps first.
+    graph.hooks.beforeLog.tap('iteration report', (data: ITelemetryData) => {
+      events.push(`beforeLog, pluginActive ${data.extraData!.pluginActive}`);
+      data.extraData!.iterationAuthSeconds = 2;
+    });
+    graph.hooks.beforeLogRequest.tap('plugin flag', (data: ITelemetryData) => {
+      events.push('beforeLogRequest');
+      data.extraData!.pluginActive = true;
+    });
+
+    await graph.executeAsync({});
+
+    expect(events).toEqual([
+      'beforeLogRequest',
+      'beforeLog, pluginActive true',
+      expect.stringMatching(/^log \{.*"pluginActive":true,"iterationAuthSeconds":2\}$/)
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
index bb0890a2e8..e1bbab6b58 100644
--- a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
+++ b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
@@ -181,9 +181,28 @@ export class OperationGraphHooks {
   /**
    * Hook invoked after executing an iteration, before the telemetry entry is written.
    * Allows the caller to augment or modify the log entry.
+   *
+   * @remarks
+   * Taps describe the iteration that just ran. A long-lived host such as the Rush daemon logs one entry for each
+   * request, and skips this hook for a request that it served without an iteration. Use `beforeLogRequest` for data
+   * that every entry needs.
    */
   public readonly beforeLog: SyncHook<ITelemetryData, void> = new SyncHook(['telemetryData'], 'beforeLog');
 
+  /**
+   * Hook invoked before any telemetry entry for this graph's work is written, including the entry of a request that
+   * a long-lived host such as the Rush daemon served without an iteration. Use it instead of `beforeLog` for data
+   * that does not describe an iteration, such as a flag that says that a plugin is active.
+   *
+   * @remarks
+   * A native command invokes this hook for each iteration's entry, before `beforeLog`. A long-lived host invokes it
+   * once for each request that it logs, and invokes `beforeLog` after it only if an iteration served the request.
+   */
+  public readonly beforeLogRequest: SyncHook<ITelemetryData, void> = new SyncHook(
+    ['telemetryData'],
+    'beforeLogRequest'
+  );
+
   /**
    * Hook invoked before executing a operation.
    */

From 910736d314cfbf527f981ad1bf84a11e2321d2ae Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:32 +0000
Subject: [PATCH 189/265] [heft] Don't start an extra watch run for a change a
 run already read

Swarm integration step 174; original commit eb0dff2f1d (merge of swarm/r03-t277 at 2ab272b8c5).
Scope: task 277.

Brings 277 (branch swarm/r03-t277). Second agent: ch05 board 6037, board 6038. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 8 of 17. Gate: ch01 GATE OK board 6389 (tree 775c0fe226)

Commits folded into this step (1):
- 2ab272b8c5 [heft] Don't start an extra watch run for a change a run already read

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/utilities/WatchFileSystemAdapter.ts   | 154 ++++++++-
 .../test/WatchFileSystemAdapter.test.ts       | 313 +++++++++++++++++-
 ...p-changes-a-run-read_2026-09-29-14-45.json |  11 +
 3 files changed, 471 insertions(+), 7 deletions(-)
 create mode 100644 common/changes/@rushstack/heft/heft-watch-skip-changes-a-run-read_2026-09-29-14-45.json

diff --git a/apps/heft/src/utilities/WatchFileSystemAdapter.ts b/apps/heft/src/utilities/WatchFileSystemAdapter.ts
index 9ac3f2df59..0f6b171847 100644
--- a/apps/heft/src/utilities/WatchFileSystemAdapter.ts
+++ b/apps/heft/src/utilities/WatchFileSystemAdapter.ts
@@ -129,6 +129,126 @@ interface ITimeEntry {
   safeTime: number;
 }
 
+/**
+ * What a run read. The run's watcher checks the changes that it reports against this.
+ */
+interface IRunInputs {
+  /**
+   * When the run started. The watcher reports files whose times are close to this time, or later.
+   */
+  baseline: number | undefined;
+  /**
+   * The time of each file that the run read, as the run recorded it
+   */
+  files: ReadonlyMap<string, number>;
+  /**
+   * The folders that the run read
+   */
+  contexts: ReadonlyMap<string, number>;
+  /**
+   * The times that the previous watcher had when the run started
+   */
+  times: ReadonlyMap<string, ITimeEntry> | undefined;
+}
+
+/**
+ * The fields of watchpack's internal `DirectoryWatcher` that {@link refreshPendingTimes} reads.
+ * They aren't part of watchpack's public API, so they are all optional.
+ */
+interface IDirectoryWatcherInternals {
+  path?: string;
+  /**
+   * The names of the files that have an OS event whose `fs.lstat()` hasn't finished yet. The change is
+   * recorded only when the `fs.lstat()` finishes.
+   */
+  _activeEvents?: Map<string, boolean>;
+}
+
+/**
+ * A watchpack instance with the internal state that {@link refreshPendingTimes} reads
+ */
+interface IWatchpackWithInternals extends Watchpack {
+  watcherManager?: {
+    directoryWatchers?: Map<string, IDirectoryWatcherInternals>;
+  };
+}
+
+const OUTDATED_ON_ATTACH_EXPLANATION: string = 'watch (outdated on attach)';
+// A new watcher's first scan reports each file whose mtime is later than the watcher's start time, less the file
+// system's accuracy. A watcher that attaches to the watcher of a folder that has already scanned reports the
+// folder in the same way. Watchpack's other explanations are for events from the file system.
+const SCAN_EXPLANATIONS: ReadonlySet<string> = new Set(['scan (file)', OUTDATED_ON_ATTACH_EXPLANATION]);
+
+function tryLstatSync(filePath: string): fs.Stats | undefined {
+  try {
+    return fs.lstatSync(filePath, { throwIfNoEntry: false });
+  } catch {
+    return undefined;
+  }
+}
+
+function getTimestamp(stats: fs.Stats): number {
+  return stats.mtime.getTime() || stats.ctime.getTime() || Date.now();
+}
+
+/**
+ * Watchpack records a file's new time only when its `fs.lstat()` after the file system's event finishes. If a
+ * run starts before then, the previous watcher's time for the file is from before the change. Read the time
+ * again, so that the run sees the change, and so that the run's watcher knows that the run saw it.
+ */
+function refreshPendingTimes(watcher: Watchpack, times: Map<string, ITimeEntry>): void {
+  const directoryWatchers: Map<string, IDirectoryWatcherInternals> | undefined = (
+    watcher as IWatchpackWithInternals
+  ).watcherManager?.directoryWatchers;
+  if (!(directoryWatchers instanceof Map)) {
+    return;
+  }
+
+  for (const { path: folderPath, _activeEvents: pendingNames } of directoryWatchers.values()) {
+    if (typeof folderPath !== 'string' || !(pendingNames instanceof Map)) {
+      continue;
+    }
+
+    for (const name of pendingNames.keys()) {
+      const filePath: string = path.join(folderPath, name);
+      const stats: fs.Stats | undefined = tryLstatSync(filePath);
+      if (!stats) {
+        times.delete(filePath);
+      } else if (!stats.isDirectory()) {
+        const timestamp: number = getTimestamp(stats);
+        times.set(filePath, { timestamp, safeTime: timestamp });
+      }
+    }
+  }
+}
+
+/**
+ * Returns false if the watcher reported the path only because the path's time is close to the run's start, and
+ * the run has already read the path as it is now.
+ */
+function isReportedChangeNew(filePath: string, explanation: string, inputs: IRunInputs): boolean {
+  if (!SCAN_EXPLANATIONS.has(explanation) || inputs.baseline === undefined) {
+    return true;
+  }
+
+  const stats: fs.Stats | undefined = tryLstatSync(filePath);
+  if (!stats) {
+    return true;
+  }
+
+  if (stats.isDirectory()) {
+    // The watcher of a folder that the run read reports the folder's files one by one
+    return explanation !== OUTDATED_ON_ATTACH_EXPLANATION || !inputs.contexts.has(filePath);
+  }
+
+  if (stats.ctimeMs >= inputs.baseline) {
+    return true;
+  }
+
+  const readTime: number | undefined = inputs.files.get(filePath) ?? inputs.times?.get(filePath)?.timestamp;
+  return readTime !== getTimestamp(stats);
+}
+
 /**
  * A filesystem adapter for use with the "fast-glob" package. This adapter tracks file system accesses
  * to initialize `watchpack`.
@@ -266,6 +386,7 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
       this.#watcher = undefined;
       const times: Map<string, ITimeEntry> = new Map();
       watcher.collectTimeInfoEntries(times, times);
+      refreshPendingTimes(watcher, times);
       // Close the previous watcher instead of only pausing it. A paused watcher keeps its directory watchers,
       // so every run would leak another set of them. A kept watcher also keeps its OS watch on a folder that
       // was deleted and recreated, and later watchers on that folder would share the dead watch, so edits in
@@ -286,11 +407,39 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
       return;
     }
 
+    const inputs: IRunInputs = {
+      baseline: this.#lastQueryTime,
+      files: this.#files,
+      contexts: this.#contexts,
+      times: this.#times
+    };
+
     const watcher: Watchpack = new Watchpack({
       aggregateTimeout: 0,
       followSymlinks: false
     });
 
+    // A file that changed just before the run started is reported again when the watcher starts, although the
+    // run has read the change. Call onChange only for a change that the run may not have seen.
+    let hasNewChange: boolean = false;
+    const onReportedChange = (filePath: string, modifiedTime: number, explanation: string): void => {
+      hasNewChange ||= isReportedChangeNew(filePath, explanation, inputs);
+    };
+    const onReportedRemove = (): void => {
+      hasNewChange = true;
+    };
+    const onAggregated = (): void => {
+      if (hasNewChange) {
+        watcher.off('change', onReportedChange);
+        watcher.off('remove', onReportedRemove);
+        watcher.off('aggregated', onAggregated);
+        onChange();
+      }
+    };
+    watcher.on('change', onReportedChange);
+    watcher.on('remove', onReportedRemove);
+    watcher.on('aggregated', onAggregated);
+
     this.#watcher = watcher;
     watcher.watch({
       files: this.#files.keys(),
@@ -299,12 +448,11 @@ export class WatchFileSystemAdapter implements IWatchFileSystemAdapter {
       startTime: this.#lastQueryTime
     });
 
+    // The watcher checks its reports against `inputs`, so the next run records into new maps
     this.#lastFiles = this.#files;
     this.#files = new Map();
-    this.#contexts.clear();
+    this.#contexts = new Map();
     this.#missing.clear();
-
-    watcher.once('aggregated', onChange);
   }
 
   /**
diff --git a/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
index b33befa908..654830796d 100644
--- a/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
+++ b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
@@ -10,7 +10,7 @@ import Watchpack from 'watchpack';
 import { Async } from '@rushstack/node-core-library';
 
 import { watchGlobAsync } from '../../plugins/FileGlobSpecifier';
-import { type IWatchedFileState, WatchFileSystemAdapter } from '../WatchFileSystemAdapter';
+import { type IWatchedFileState, type StatCallback, WatchFileSystemAdapter } from '../WatchFileSystemAdapter';
 
 const RUN_REQUEST_TIMEOUT_MS: number = 5000;
 // Long enough for a watcher to finish its first scan, and for events to arrive
@@ -20,16 +20,36 @@ const TEST_TIMEOUT_MS: number = 30000;
 // old mtimes so that a new watcher doesn't report a file as changed just because it was written right before
 // the watcher started.
 const BASE_MTIME_MS: number = Math.floor(Date.now() / 1000) * 1000 - 3600 * 1000 + 123;
+// A new watcher reports a file whose mtime is later than the watcher's start time. A file that gets an mtime in
+// the future is reported by the next run's watcher for certain.
+const FUTURE_MTIME_OFFSET_MS: number = 60 * 1000;
+// Long enough for file timestamps to show which of two events came first, even where they are coarse
+const TIMESTAMP_GAP_MS: number = 20;
+// A file that the glob doesn't match, in a folder that the glob reads
+const NOTES_PATH: string = 'src/sub/notes.txt';
+
+// Watchpack calls fs.lstat() through this graceful-fs instance
+const watcherFs: typeof fs = jest.requireActual(
+  require.resolve('graceful-fs', { paths: [path.dirname(require.resolve('watchpack/package.json'))] })
+);
+// The adapter's calls to fs.lstatSync() look up the function on this module when they are made
+const nodeFs: typeof fs = jest.requireActual('node:fs');
 
 interface IRunOptions {
   watch?: boolean;
-  beforeWatch?: () => void;
+  beforeWatch?: () => Promise<void> | void;
 }
 
 interface IRun {
   changed: string[];
   isRunRequested(): boolean;
   waitForRunRequestAsync(): Promise<boolean>;
+  /**
+   * Waits until the run's watcher has reported the path with the explanation, and has passed the report on
+   * in an 'aggregated' event. Then waits SETTLE_MS more, so that later events can arrive. Returns false if the
+   * watcher doesn't report the path.
+   */
+  waitForReportAsync(relativePath: string, explanation: string): Promise<boolean>;
 }
 
 describe(WatchFileSystemAdapter.name, () => {
@@ -65,10 +85,11 @@ describe(WatchFileSystemAdapter.name, () => {
     }
     changed.sort();
 
-    beforeWatch?.();
+    await beforeWatch?.();
 
     let requested: boolean = false;
     let onRequest: (() => void) | undefined;
+    const watcherCount: number = watchSpy.mock.contexts.length;
     if (watch) {
       adapter.watch(() => {
         requested = true;
@@ -76,6 +97,28 @@ describe(WatchFileSystemAdapter.name, () => {
       });
     }
 
+    // The reports of the run's watcher, as of its last 'aggregated' event
+    const reports: Set<string> = new Set();
+    let onReports: (() => void) | undefined;
+    const watcher: Watchpack | undefined = watchSpy.mock.contexts[watcherCount];
+    if (watcher) {
+      let newReports: string[] = [];
+      watcher.on('change', (filePath: string, modifiedTime: number, explanation: string) => {
+        newReports.push(`${explanation}: ${filePath}`);
+      });
+      watcher.on('remove', (filePath: string, explanation: string) => {
+        newReports.push(`${explanation}: ${filePath}`);
+      });
+      // Runs after the adapter's listener, which the adapter added first
+      watcher.on('aggregated', () => {
+        for (const report of newReports) {
+          reports.add(report);
+        }
+        newReports = [];
+        onReports?.();
+      });
+    }
+
     return {
       changed,
       isRunRequested: () => requested,
@@ -90,7 +133,22 @@ describe(WatchFileSystemAdapter.name, () => {
             clearTimeout(timeout);
             resolve(true);
           };
-        })
+        }),
+      waitForReportAsync: async (relativePath: string, explanation: string): Promise<boolean> => {
+        const report: string = `${explanation}: ${path.join(rootFolder, relativePath)}`;
+        const isReported: boolean = await new Promise<boolean>((resolve: (value: boolean) => void) => {
+          const timeout: NodeJS.Timeout = setTimeout(() => resolve(false), RUN_REQUEST_TIMEOUT_MS);
+          onReports = () => {
+            if (reports.has(report)) {
+              clearTimeout(timeout);
+              resolve(true);
+            }
+          };
+          onReports();
+        });
+        await Async.sleepAsync(SETTLE_MS);
+        return isReported;
+      }
     };
   }
 
@@ -103,6 +161,88 @@ describe(WatchFileSystemAdapter.name, () => {
     await Async.sleepAsync(SETTLE_MS);
   }
 
+  // Also writes the file at NOTES_PATH. Returns the second run, whose watcher has scanned the files without
+  // requesting a run. The next run collects that watcher's times.
+  async function startWatchingAsync(): Promise<IRun> {
+    writeFile(NOTES_PATH);
+    await startAsync();
+    const run2: IRun = await runAsync();
+    expect(run2.changed).toEqual([]);
+    await Async.sleepAsync(SETTLE_MS);
+    expect(run2.isRunRequested()).toBe(false);
+    return run2;
+  }
+
+  // Gives the file a future mtime, and waits until the run's watcher has recorded the change. Returns the mtime.
+  async function changeBeforeNextRunAsync(run: IRun, relativePath: string): Promise<number> {
+    const mtimeMs: number = Date.now() + FUTURE_MTIME_OFFSET_MS;
+    writeFile(relativePath, mtimeMs);
+    expect(await run.waitForRunRequestAsync()).toBe(true);
+    await Async.sleepAsync(SETTLE_MS);
+    return mtimeMs;
+  }
+
+  // Replaces watchpack's fs.lstat(). The handler calls lstatAsync() to do the fs.lstat() and give watchpack the
+  // result.
+  function interceptWatcherLstat(handler: (filePath: string, lstatAsync: () => Promise<void>) => void): void {
+    const lstat: (filePath: string, callback: StatCallback) => void = watcherFs.lstat;
+    jest.spyOn(watcherFs, 'lstat').mockImplementation(((filePath: string, callback: StatCallback) => {
+      handler(filePath, async () => {
+        await new Promise<void>((resolve: () => void) => {
+          lstat(filePath, (error, stats) => {
+            callback(error, stats);
+            resolve();
+          });
+        });
+      });
+    }) as unknown as typeof watcherFs.lstat);
+  }
+
+  // Holds watchpack's next fs.lstat() of the file, as a slow file system can. Resolves when watchpack calls it,
+  // with a function that finishes it.
+  function holdNextWatcherLstatAsync(relativePath: string): Promise<(() => void) | undefined> {
+    const heldPath: string = path.join(rootFolder, relativePath);
+    return new Promise((resolve: (finish: (() => void) | undefined) => void) => {
+      const timeout: NodeJS.Timeout = setTimeout(() => resolve(undefined), RUN_REQUEST_TIMEOUT_MS);
+      let isHolding: boolean = false;
+      interceptWatcherLstat((filePath: string, lstatAsync: () => Promise<void>) => {
+        if (filePath === heldPath && !isHolding) {
+          isHolding = true;
+          clearTimeout(timeout);
+          resolve(() => {
+            void lstatAsync();
+          });
+        } else {
+          void lstatAsync();
+        }
+      });
+    });
+  }
+
+  // Holds watchpack's fs.lstat() of the folder until watchpack has finished its fs.lstat() of each of the files
+  function holdWatcherFolderLstat(relativeFolderPath: string, fileNames: string[]): void {
+    const folderPath: string = path.join(rootFolder, relativeFolderPath);
+    const unreadFiles: Set<string> = new Set(fileNames.map((name: string) => path.join(folderPath, name)));
+    let finishFolderLstat: (() => Promise<void>) | undefined;
+    const finishWhenFilesAreRead = (): void => {
+      if (finishFolderLstat && unreadFiles.size === 0) {
+        void finishFolderLstat();
+        finishFolderLstat = undefined;
+      }
+    };
+    interceptWatcherLstat((filePath: string, lstatAsync: () => Promise<void>) => {
+      if (filePath === folderPath) {
+        finishFolderLstat = lstatAsync;
+        finishWhenFilesAreRead();
+      } else {
+        void lstatAsync().then(() => {
+          unreadFiles.delete(filePath);
+          finishWhenFilesAreRead();
+        });
+      }
+    });
+  }
+
   beforeEach(() => {
     rootFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'heft-watch-fs-'));
     writeCount = 0;
@@ -230,4 +370,169 @@ describe(WatchFileSystemAdapter.name, () => {
     },
     TEST_TIMEOUT_MS
   );
+
+  it(
+    'does not request a run for a file that changed before the run, but does for a later change',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      // The new watcher reports the file, because of its mtime. The glob doesn't match it, but the previous
+      // watcher's times show that it hasn't changed since the run started.
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+
+      writeFile('src/sub/b.ts');
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+      const run4: IRun = await runAsync();
+      expect(run4.changed).toEqual(['src/sub/b.ts']);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request another run for a watched file that changed before the run started',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, 'src/sub/b.ts');
+
+      const run3: IRun = await runAsync();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      expect(await run3.waitForReportAsync('src/sub/b.ts', 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request another run for a file that the first run read',
+    async () => {
+      writeFile('src/b.ts', Date.now() + FUTURE_MTIME_OFFSET_MS);
+      await Async.sleepAsync(TIMESTAMP_GAP_MS);
+
+      // There is no previous watcher, so only the time that the run read is known
+      const run1: IRun = await runAsync();
+      expect(run1.changed).toEqual(['src/b.ts']);
+      expect(await run1.waitForReportAsync('src/b.ts', 'scan (file)')).toBe(true);
+      expect(run1.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a file that is written again during the run, with the same mtime',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      const mtimeMs: number = await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      const run3: IRun = await runAsync({
+        // The wait makes the file's ctime later than the run's start
+        beforeWatch: () => Async.sleepAsync(TIMESTAMP_GAP_MS).then(() => writeFile(NOTES_PATH, mtimeMs))
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request a run for a file whose change the previous watcher had not finished reading',
+    async () => {
+      await startWatchingAsync();
+      const lstatHeld: Promise<(() => void) | undefined> = holdNextWatcherLstatAsync(NOTES_PATH);
+      writeFile(NOTES_PATH, Date.now() + FUTURE_MTIME_OFFSET_MS);
+      const finishLstat: (() => void) | undefined = await lstatHeld;
+      expect(finishLstat).toBeDefined();
+      await Async.sleepAsync(TIMESTAMP_GAP_MS);
+
+      // The run starts while the previous watcher still has the file's old time
+      const run3: IRun = await runAsync();
+      finishLstat?.();
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'reports a watched file whose change the previous watcher had not finished reading, in that run',
+    async () => {
+      await startWatchingAsync();
+      const lstatHeld: Promise<(() => void) | undefined> = holdNextWatcherLstatAsync('src/sub/b.ts');
+      writeFile('src/sub/b.ts', Date.now() + FUTURE_MTIME_OFFSET_MS);
+      const finishLstat: (() => void) | undefined = await lstatHeld;
+      expect(finishLstat).toBeDefined();
+      await Async.sleepAsync(TIMESTAMP_GAP_MS);
+
+      const run3: IRun = await runAsync();
+      finishLstat?.();
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      expect(await run3.waitForReportAsync('src/sub/b.ts', 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'does not request a run when a folder that the run read is reported as its watcher is attached',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      // The watcher of src attaches to the watcher of src/sub when its fs.lstat() of src/sub finishes. If
+      // src/sub's watcher has read a file with a new time by then, the watcher reports src/sub.
+      const run3: IRun = await runAsync({
+        beforeWatch: () => holdWatcherFolderLstat('src/sub', ['b.ts', 'notes.txt'])
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync('src/sub', 'watch (outdated on attach)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(false);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a file system event, even if the file looks unchanged',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      const mtimeMs: number = await changeBeforeNextRunAsync(run2, NOTES_PATH);
+      const run3: IRun = await runAsync();
+      expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
+
+      // Where timestamps are coarse, a file's ctime may be earlier than the run's start, although the file
+      // changed after it
+      const notesPath: string = path.join(rootFolder, NOTES_PATH);
+      const lstatSync: typeof fs.lstatSync = nodeFs.lstatSync;
+      jest.spyOn(nodeFs, 'lstatSync').mockImplementation(((
+        filePath: fs.PathLike,
+        options?: fs.StatSyncOptions
+      ) => {
+        const stats: fs.Stats | undefined = lstatSync(filePath, options) as fs.Stats | undefined;
+        if (stats && filePath === notesPath) {
+          stats.ctimeMs = BASE_MTIME_MS;
+        }
+        return stats;
+      }) as unknown as typeof fs.lstatSync);
+      writeFile(NOTES_PATH, mtimeMs);
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
+  it(
+    'requests a run for a watched file that is deleted during the run',
+    async () => {
+      await startWatchingAsync();
+
+      const run3: IRun = await runAsync({
+        beforeWatch: () => fs.unlinkSync(path.join(rootFolder, 'src/sub/b.ts'))
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForRunRequestAsync()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
 });
diff --git a/common/changes/@rushstack/heft/heft-watch-skip-changes-a-run-read_2026-09-29-14-45.json b/common/changes/@rushstack/heft/heft-watch-skip-changes-a-run-read_2026-09-29-14-45.json
new file mode 100644
index 0000000000..98fb62a282
--- /dev/null
+++ b/common/changes/@rushstack/heft/heft-watch-skip-changes-a-run-read_2026-09-29-14-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft",
+      "comment": "Fix an issue in watch mode where a file that changed shortly before a run started caused an extra run after that run, and where a change that the watcher was still reading when a run started was only included in the next run.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft",
+  "email": "selarkin@microsoft.com"
+}

From 52f68f162543945a7e50f1c0d2f339e32f6e1c40 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:32 +0000
Subject: [PATCH 190/265] [rush-daemon] Say that the client-gone check
 remembers the error

Swarm integration step 175; original commit fbc9b92a13 (merge of swarm/r03-t260-nit1 at 1848cdecf3).
Scope: task 260, NIT 1.

Brings 260-nit1 (branch swarm/r03-t260-nit1). Second agent: o01 board 5810. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 9 of 17. Gate: ch01 GATE OK board 6389 (tree 7b3d0639fb)

Commits folded into this step (1):
- 1848cdecf3 [rush-daemon] Say that the client-gone check remembers the error

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ushd-client-gone-doc-comment_2026-09-29-15-05.json | 11 +++++++++++
 libraries/rush-daemon/src/DaemonControlSession.ts     |  5 +++--
 2 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-client-gone-doc-comment_2026-09-29-15-05.json

diff --git a/common/changes/@rushstack/rush-daemon/rushd-client-gone-doc-comment_2026-09-29-15-05.json b/common/changes/@rushstack/rush-daemon/rushd-client-gone-doc-comment_2026-09-29-15-05.json
new file mode 100644
index 0000000000..8ed3addb1d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-client-gone-doc-comment_2026-09-29-15-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Document that the check for a client that went away remembers an EPIPE or ECONNRESET for later sends.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index e9edceaaa7..d5caef5707 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -541,8 +541,9 @@ export class DaemonControlSession {
 
   /**
    * Whether an error only means that the client went away: its connection failed with EPIPE or ECONNRESET, or had
-   * already failed so before this send found it closed. Pass the error as thrown: normalizing can wrap an error
-   * from another realm, such as a socket error under Jest, and drop its code.
+   * already failed so before this send found it closed. A call that sees EPIPE or ECONNRESET remembers it for
+   * those later sends. Pass the error as thrown: normalizing can wrap an error from another realm, such as a
+   * socket error under Jest, and drop its code.
    */
   #isClientGone(error: unknown): boolean {
     if (isClientGoneError(error)) {

From cfca39aa35888f5f696e2bf79a47f9df3cd5e672 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:32 +0000
Subject: [PATCH 191/265] [heft-webpack5-plugin] Name the Node version in a
 test comment

Swarm integration step 176; original commit 2c1e2f1036 (merge of swarm/r03-t217-nit2 at d2e5d575e0).
Scope: task 217, NIT 2.

Brings 217-nit2 (branch swarm/r03-t217-nit2). Second agent: o07 board 5844. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 10 of 17. Gate: ch01 GATE OK board 6389 (tree 4226f399c2)

Commits folded into this step (1):
- d2e5d575e0 [heft-webpack5-plugin] Name the Node version in a test comment

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...rred-watch-test-node-version_2026-09-29-15-05.json | 11 +++++++++++
 .../src/test/DeferredWatchFileSystem.test.ts          |  5 +++--
 2 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/heft-webpack5-plugin/deferred-watch-test-node-version_2026-09-29-15-05.json

diff --git a/common/changes/@rushstack/heft-webpack5-plugin/deferred-watch-test-node-version_2026-09-29-15-05.json b/common/changes/@rushstack/heft-webpack5-plugin/deferred-watch-test-node-version_2026-09-29-15-05.json
new file mode 100644
index 0000000000..f7027da948
--- /dev/null
+++ b/common/changes/@rushstack/heft-webpack5-plugin/deferred-watch-test-node-version_2026-09-29-15-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-webpack5-plugin",
+      "comment": "Name the Node version in the comment that says why the DeferredWatchFileSystem tests don't remove their FIFO with fs.rmSync().",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/heft-webpack5-plugin",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
index 35e6e1b48d..6a7fa063ac 100644
--- a/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
+++ b/heft-plugins/heft-webpack5-plugin/src/test/DeferredWatchFileSystem.test.ts
@@ -56,8 +56,9 @@ describe(DeferredWatchFileSystem.name, () => {
 
   afterAll(() => {
     if (fifoPath) {
-      // Not fs.rmSync(), which calls lstat on the FIFO. Until the next stat call, Node's fs.realpathSync() then
-      // returns some paths with their symlinks unresolved, and jest fails to require() a package that pnpm linked.
+      // Not fs.rmSync(). In Node 22, it calls lstat on the FIFO, and until the next stat call,
+      // Node's fs.realpathSync() then returns some paths with their symlinks unresolved, so jest fails to
+      // require() a package that pnpm linked.
       fs.unlinkSync(fifoPath);
       fs.rmdirSync(path.dirname(fifoPath));
     }

From 0d930c9d218fb348467ea2cff92d1e5d4807b4bd Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:32 +0000
Subject: [PATCH 192/265] [rush-client-core] Expect "did not answer" in the
 rush-daemon test of a live owner that does not answer (task 69(b), row 11
 fix)

Swarm integration step 177; original commit 08be97eef7 (merge of swarm/r04-t69b-int3 at 09ef179921).
Scope: task 69(b).

Brings 69b (branch swarm/r04-t69b-int3). Second agent: r01 board 6106, board 6108. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 11 of 17. Gate: ch01 GATE OK board 6389 (tree a1dc0fbf8c)

Commits folded into this step (3):
- 3f3c496bb1 Say what a live daemon owner that does not answer is doing (task 69(b))
- dc3460dec0 Stop waiting for a daemon that a signal keeps stopped (task 69(b), b3)
- 09ef179921 Expect "did not answer" in the rush-daemon test of a live owner that does not answer (task 69(b), row 11 fix)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  27 +-
 apps/rush-cli-client/src/daemonCommands.ts    |  89 +++-
 .../src/test/daemonLiveOwner.test.ts          | 257 ++++++++++
 ...-r04-t69b-live-owner_2026-09-29-10-38.json |  11 +
 ...4-t69b-stopped-owner_2026-09-29-11-40.json |  11 +
 ...-r04-t69b-live-owner_2026-09-29-10-38.json |  11 +
 ...4-t69b-stopped-owner_2026-09-29-11-40.json |  11 +
 .../swarm-r04-t69b-int3_2026-09-29-16-30.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   6 +
 libraries/rush-client-core/README.md          |  35 +-
 .../src/DaemonOwnerDiagnosis.ts               | 325 +++++++++++++
 .../rush-client-core/src/DaemonOwnership.ts   |  69 ++-
 .../rush-client-core/src/ProcessStartTime.ts  |  25 +
 .../src/StoppedDaemonOwner.ts                 |  96 ++++
 .../src/connectOrAwaitDaemonStartup.ts        |  97 +++-
 .../src/connectOrStartDaemon.ts               |  46 +-
 libraries/rush-client-core/src/index.ts       |   2 +
 .../src/test/DaemonOwnerDiagnosis.test.ts     | 353 ++++++++++++++
 .../src/test/StoppedDaemonOwner.test.ts       | 220 +++++++++
 .../src/test/connectOrStartDaemon.test.ts     |   8 +-
 .../connectOrStartDaemonLiveOwner.test.ts     | 448 ++++++++++++++++++
 .../test/NativeMutationCleanupFailure.test.ts |   2 +-
 22 files changed, 2113 insertions(+), 47 deletions(-)
 create mode 100644 apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-live-owner_2026-09-29-10-38.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t69b-live-owner_2026-09-29-10-38.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t69b-int3_2026-09-29-16-30.json
 create mode 100644 libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
 create mode 100644 libraries/rush-client-core/src/StoppedDaemonOwner.ts
 create mode 100644 libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
 create mode 100644 libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts
 create mode 100644 libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 9f60b01128..93a0410b03 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -73,7 +73,18 @@ waiting (`rush-client: The daemon is not ready yet. <live process>, so this comm
 for it instead of running Rush in-process.`; agent output shows "rushd is still starting; waiting for it"
 as the progress phase, and on a pipe writes it as a progress line that ends with `because <live process>`). If the daemon is still not ready, the command exits with code 1. The message
 gives the startup error with its `--no-daemon` hint, then the process that is still live, "so Rush was
-not run in-process", and a pointer to `rush-client daemon status`.
+not run in-process", and a pointer to `rush-client daemon status`. When the process that the daemon's
+ownership record names still runs but does not answer (on Linux, for example because a signal stopped
+it), the message instead says what that process is doing and that Rush was not run in-process, and its
+last line says what to do, for example `Resume it with "kill -CONT <pid>"; it then serves the next
+command.` On Linux, when that process has this workspace's ownership record open, as the daemon that
+wrote it does, and stays stopped (state T or t) while the client samples it for 1.5 s, the command does
+not wait for either deadline: it exits with code 1 and that message once the 1.5 s have passed. It names
+a signal to send only to a Rush daemon that has that record open; for any other process it says to end
+that process if it is this workspace's daemon, and else to delete the ownership record. Such a Rush
+daemon that still runs after its socket file was deleted also fails the command this way, with code 1
+and without running Rush in-process, once the client has waited 15 seconds for it to exit; its last line
+says that it may exit once its running requests finish.
 
 `--no-wait` fails immediately when daemon admission is unavailable.
 `--wait-timeout SECONDS` (or `--wait-timeout=SECONDS`) overrides the configured queue
@@ -546,7 +557,10 @@ reservation nor (outside Windows) a socket file remains; with any of these, the
 still says that it could not connect. When the endpoint
 refuses connections and its ownership record (`<key>.pid.json`) names a PID that no longer
 exists, the diagnostic adds that rushd exited without shutting down (an orderly shutdown
-removes the record) and that `daemon logs` may show why.
+removes the record) and that `daemon logs` may show why. When that PID still exists but the endpoint
+refuses connections or does not complete hello/ping, the diagnostic adds what that process is doing,
+on Linux for example `rushd (PID <pid>) still owns <key>.pid.json: it is stopped (state T), for example
+by SIGSTOP, and it started 5 min ago.`, and on the next line what to do about it.
 A client that lost its connection to that daemon, or that ran Rush in-process, removes the record
 when it reclaims the daemon, and appends a line that names the daemon to the launcher log. Until a
 daemon becomes ready again or `daemon stop --force` resets the workspace, the `No daemon is running`
@@ -595,6 +609,11 @@ attests a restart request, not completion of successor startup or success of a c
 followed by EOF. It reports `state: "shutdownAccepted"` with exit code 0; this
 does not assert successful workspace disposal. Stop is idempotent: when nothing
 listens at the endpoint and no daemon is starting, it reports `state: "notRunning"` with exit code 0.
+When nothing listens but the ownership record names a process that still runs, for example a daemon
+that removed its socket while it shuts down, stop first waits up to 15 seconds for that process to exit,
+and says so on stderr once it has waited a second. If it still runs then, stop exits with code 1 and
+says what that process is doing and what to do about it; a daemon that accepts the connection but does
+not complete hello/ping gets the same diagnostic.
 While a daemon is still starting (its startup helper still runs, or another client holds the start
 mutex), stop says so on stderr and waits up to 15 seconds for that daemon to become ready, then stops
 it as below; reporting `notRunning` would leave it running afterwards. If it is still not ready by then,
@@ -614,7 +633,9 @@ any remaining artifacts, such as an abandoned startup reservation, reporting the
 `state: "reset"` and the `removedPaths` (or `state: "notRunning"` if nothing was
 left behind). It holds the start mutex, proves that no listener is bound, and
 refuses (exit 1) while the recorded owner PID still exists and cannot be shown to
-be a reused PID. When the recorded owner PID no longer exists, the daemon exited without shutting
+be a reused PID, saying what that process is doing, that no process was killed, and what to do about it.
+It fails the same way, without killing that process, when that process accepts the connection but does
+not complete hello/ping, for example because a signal stopped it. When the recorded owner PID no longer exists, the daemon exited without shutting
 down and may have left operations running that only its records name, so the reset first stops them
 as the next daemon start would: SIGTERM, then SIGKILL 2 seconds later, to the daemon's own process
 group and to each operation process group that it recorded whose leader still has the recorded start
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index 4d2229f4a5..8ce8618a48 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -3,17 +3,21 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import {
   DaemonClient,
+  DaemonClientError,
   DaemonStartupPendingError,
   connectOrStartDaemonAsync,
   connectToStartingDaemonAsync,
+  describeLiveDaemonOwner,
   findReclaimedDaemonPid,
   inspectDaemonStartupReservation,
   requestDaemonShutdownAsync,
   resetDaemonArtifactsAsync,
   resolveDaemonStartupReservationAsync,
+  type DaemonOwnerHintPurpose,
   type IConnectOrStartDaemonOptions,
   type IDaemonStartupReservationInfo
 } from '@rushstack/rush-client-core';
@@ -35,6 +39,17 @@ import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotic
 import { writeStreamAsync } from './writeStreamAsync';
 
 const FORCE_STOP_WAIT_MS: number = 15000;
+/** How long stop waits for a daemon that no longer listens to exit, for example because it is shutting down. */
+const STOP_EXIT_WAIT_MS: number = 15000;
+/** Stop says that it waits only when the daemon is still there after this long. */
+const STOP_EXIT_NOTICE_MS: number = 1000;
+const STOP_EXIT_POLL_MS: number = 100;
+
+/**
+ * What a command that could not reach the daemon was for. `forceStop` is `daemon stop --force`: like a reset that a
+ * live owner refuses, it says that it killed no process.
+ */
+type ConnectionPurpose = DaemonOwnerHintPurpose | 'forceStop';
 
 export interface IDaemonCommandOptions {
   readonly argv: ReadonlyArray<string>;
@@ -112,7 +127,7 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
         ? await connectForStopAsync(connectionOptions)
         : command === 'status'
           ? await connectForStatusAsync(connectionOptions, options)
-          : await connectExistingAsync(connectionOptions, true);
+          : await connectExistingAsync(connectionOptions, true, command === 'stop' ? 'forceStop' : 'use');
   if (!client) {
     if (command === 'restart') {
       // Nothing to shut down: restart behaves like start.
@@ -124,6 +139,9 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
       }
       return;
     }
+    if (command === 'stop' && options.argv[1] !== '--force') {
+      await waitForUnreachableDaemonExitAsync(connectionOptions.paths);
+    }
     const reset: IForceResetResult | undefined =
       options.argv[1] === '--force' ? await forceResetAsync(connectionOptions) : undefined;
     await writeStatusAsync({
@@ -189,7 +207,7 @@ export async function executeDaemonCommandAsync(options: IDaemonCommandOptions):
  * waits for it to become ready and then stops it: reporting notRunning would leave it running afterwards.
  */
 async function connectForStopAsync(options: IConnectOrStartDaemonOptions): Promise<DaemonClient | undefined> {
-  const client: DaemonClient | undefined = await connectExistingAsync(options, true);
+  const client: DaemonClient | undefined = await connectExistingAsync(options, true, 'stop');
   if (client) return client;
   try {
     return await connectToStartingDaemonAsync({
@@ -212,7 +230,8 @@ async function connectForStopAsync(options: IConnectOrStartDaemonOptions): Promi
 /** Returns undefined when nothing listens at the endpoint and `allowAbsent` is set; other failures propagate. */
 async function connectExistingAsync(
   options: IConnectOrStartDaemonOptions,
-  allowAbsent: boolean
+  allowAbsent: boolean,
+  purpose: ConnectionPurpose
 ): Promise<DaemonClient | undefined> {
   try {
     return await DaemonClient.connectAsync({ socketPath: options.paths.socketPath });
@@ -224,7 +243,34 @@ async function connectExistingAsync(
     ) {
       return undefined;
     }
-    throw explainStartupReservation(explainExitedDaemon(error, options.paths), options.paths);
+    throw explainConnectionFailure(error, options.paths, purpose);
+  }
+}
+
+/**
+ * A daemon that no longer listens but still runs is shutting down, lost its socket, or is not running at all
+ * (a signal stopped it, for example). Stop waits for it to exit, and says what it is doing when it does not:
+ * reporting notRunning would leave it running.
+ */
+async function waitForUnreachableDaemonExitAsync(paths: IDaemonPaths): Promise<void> {
+  const deadline: number = Date.now() + STOP_EXIT_WAIT_MS;
+  let noticed: boolean = false;
+  let owner: string | undefined = describeLiveDaemonOwner(paths, 'stop');
+  while (owner !== undefined) {
+    const remainingMs: number = deadline - Date.now();
+    if (remainingMs <= 0) throw new Error(`Nothing listens at ${paths.socketPath}, but ${owner}`);
+    if (!noticed && remainingMs <= STOP_EXIT_WAIT_MS - STOP_EXIT_NOTICE_MS) {
+      noticed = true;
+      const description: string = owner.split('\n')[0].replace(/\.$/, '');
+      await writeStreamAsync(
+        process.stderr,
+        Buffer.from(
+          `rush-client: Nothing listens at ${paths.socketPath}, but ${description}, so stop waits up to ${Math.round(remainingMs / 1000)} s for it to exit.\n`
+        )
+      );
+    }
+    await delayAsync(Math.min(STOP_EXIT_POLL_MS, remainingMs));
+    owner = describeLiveDaemonOwner(paths, 'stop');
   }
 }
 
@@ -252,8 +298,41 @@ async function connectForStatusAsync(
         `${describeAbsentDaemon(options)}${describeReclaimedDaemon(paths)}`
       );
     }
-    throw explainStartupReservation(explainExitedDaemon(error, paths), paths);
+    throw explainConnectionFailure(error, paths, 'use');
+  }
+}
+
+function explainConnectionFailure(error: unknown, paths: IDaemonPaths, purpose: ConnectionPurpose): unknown {
+  return explainStartupReservation(
+    explainLiveOwner(explainExitedDaemon(error, paths), paths, purpose),
+    paths
+  );
+}
+
+/**
+ * Explains a connection that failed while the process that the ownership record names still runs: what that
+ * process is doing, for example that a signal stopped it, and what to do about it.
+ */
+function explainLiveOwner(error: unknown, paths: IDaemonPaths, purpose: ConnectionPurpose): unknown {
+  if (!isUnansweredConnection(error)) return error;
+  const hintPurpose: DaemonOwnerHintPurpose = purpose === 'forceStop' ? 'stop' : purpose;
+  const owner: string | undefined = describeLiveDaemonOwner(paths, hintPurpose);
+  if (owner === undefined) return error;
+  // The note ends the first line, which says what that process is doing.
+  const explained: string =
+    purpose === 'forceStop' ? owner.replace('\n', ' No process was killed.\n') : owner;
+  return new Error(`${error.message} ${explained}`, { cause: error });
+}
+
+/** The daemon refused the connection, or accepted it but did not complete hello/ping. */
+function isUnansweredConnection(error: unknown): error is Error {
+  if (error instanceof DaemonTransportError) {
+    return (
+      error.code === DaemonTransportErrorCode.connectionRefused ||
+      error.code === DaemonTransportErrorCode.connectionTimeout
+    );
   }
+  return error instanceof DaemonClientError && (error.code === 'timeout' || error.code === 'disconnected');
 }
 
 /**
diff --git a/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts b/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
new file mode 100644
index 0000000000..95b56d34db
--- /dev/null
+++ b/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
@@ -0,0 +1,257 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import { writeDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { executeDaemonCommandAsync } from '../daemonCommands';
+import * as connectionOptions from '../daemonConnectionOptions';
+
+function readState(pid: number): string | undefined {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  return stat.slice(stat.lastIndexOf(')') + 2)[0];
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Removes a test's folder. The sockets that killed daemons left there go first, without a stat: after a plain stat
+ * of a socket, which `fs.rmSync` makes, the next `require()` in this process could fail to find a package's
+ * dependencies (nodejs/node#65113).
+ */
+function removeFolder(folder: string): void {
+  for (const entry of fs.readdirSync(folder, { withFileTypes: true })) {
+    if (entry.isSocket()) fs.unlinkSync(path.join(folder, entry.name));
+  }
+  fs.rmSync(folder, { recursive: true });
+}
+
+/** Listens as rushd does, with the paths in its argument, never answers, and exits after the time in the last. */
+const FAKE_DAEMON_SCRIPT: string = [
+  'const [transport, protocol, paths, exitAfterMs] = process.argv.slice(2);',
+  'require(transport)',
+  '  .DaemonFrameListener.listenAsync(JSON.parse(paths), {',
+  '    protocolVersion: require(protocol).DAEMON_PROTOCOL_VERSION,',
+  '    onConnection: () => undefined',
+  '  })',
+  "  .then(() => console.log('listening'));",
+  'setTimeout(() => process.exit(0), Number(exitAfterMs));',
+  ''
+].join('\n');
+
+// It needs /proc to tell what the live owner is doing.
+(process.platform === 'linux' ? describe : describe.skip)(
+  'daemon commands and a live owner that does not answer',
+  () => {
+    let folder: string;
+    let paths: IDaemonPaths;
+    let children: ChildProcess[];
+    let stderr: string[];
+    let stdout: string[];
+
+    beforeEach(() => {
+      children = [];
+      stderr = [];
+      stdout = [];
+      folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-live-owner-'));
+      paths = {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      };
+      fs.writeFileSync(
+        path.join(folder, 'rush.json'),
+        JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
+      );
+      jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({ paths });
+      for (const [stream, lines] of [
+        [process.stderr, stderr],
+        [process.stdout, stdout]
+      ] as const) {
+        jest.spyOn(stream, 'write').mockImplementation(((
+          chunk: string | Uint8Array,
+          ...rest: unknown[]
+        ): boolean => {
+          lines.push(Buffer.from(chunk).toString());
+          (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+          return true;
+        }) as typeof stream.write);
+      }
+    });
+
+    afterEach(async () => {
+      jest.restoreAllMocks();
+      for (const child of children) {
+        if (child.exitCode !== null || child.signalCode !== null) continue;
+        const exited: Promise<unknown> = once(child, 'exit');
+        // Only this test's own children, by their PIDs: resume a stopped one so that it can exit.
+        process.kill(child.pid!, 'SIGCONT');
+        child.kill('SIGKILL');
+        await exited;
+      }
+      removeFolder(folder);
+    });
+
+    /**
+     * A process whose command line looks like rushd's, which listens as rushd does with `daemonPaths` (by
+     * default this workspace's), but never answers: it binds its socket under a private name, links the
+     * endpoint to it, then writes its ownership record and keeps it open. Its listen backlog accepts
+     * connections even while a signal stops it. This workspace's ownership record names it either way.
+     */
+    async function startFakeDaemonAsync(
+      exitAfterMs: number = 600_000,
+      daemonPaths: IDaemonPaths = paths
+    ): Promise<number> {
+      const script: string = path.join(folder, 'rush-daemon', 'fake.js');
+      fs.mkdirSync(path.dirname(script), { recursive: true });
+      fs.writeFileSync(script, FAKE_DAEMON_SCRIPT);
+      const child: ChildProcess = spawn(
+        process.execPath,
+        [
+          script,
+          require.resolve('@rushstack/rush-daemon-transport'),
+          require.resolve('@rushstack/rush-daemon-protocol'),
+          JSON.stringify(daemonPaths),
+          String(exitAfterMs)
+        ],
+        { stdio: ['ignore', 'pipe', 'ignore'] }
+      );
+      children.push(child);
+      await once(child.stdout!, 'data');
+      const pid: number = child.pid!;
+      if (daemonPaths !== paths) {
+        writeDaemonLockfile(paths.lockfilePath, {
+          pid,
+          protocolVersion: DAEMON_PROTOCOL_VERSION,
+          startedAt: new Date().toISOString(),
+          socketPath: paths.socketPath
+        });
+      }
+      return pid;
+    }
+
+    async function stopChildAsync(pid: number): Promise<void> {
+      process.kill(pid, 'SIGSTOP');
+      const deadline: number = Date.now() + 5000;
+      while (readState(pid) !== 'T') {
+        if (Date.now() >= deadline) throw new Error(`PID ${pid} did not stop.`);
+        await delayAsync(10);
+      }
+    }
+
+    async function runAsync(...argv: string[]): Promise<Error | undefined> {
+      return await executeDaemonCommandAsync({
+        argv,
+        environment: {},
+        rushJsonPath: path.join(folder, 'rush.json'),
+        rushVersion: '5.178.1'
+      }).then(
+        () => undefined,
+        (error: Error) => error
+      );
+    }
+
+    it('says that a signal stopped the daemon, and how to resume it, for status, stop and stop --force', async () => {
+      const pid: number = await startFakeDaemonAsync();
+      await stopChildAsync(pid);
+      const timeout: string = `Daemon at ${paths.socketPath} did not complete hello/ping readiness within 5000ms.`;
+      const description: string = `rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.`;
+      const owner: RegExp = new RegExp(`${description}\\n`);
+      const stopHint: string = `Resume it with "kill -CONT ${pid}", then run "rush-client daemon stop" again.`;
+
+      const status: Error | undefined = await runAsync('status');
+      expect(status?.message.startsWith(`${timeout} `)).toBe(true);
+      expect(status?.message).toMatch(owner);
+      expect(status?.message.split('\n')[1]).toBe(
+        `Resume it with "kill -CONT ${pid}"; it then serves the next command.`
+      );
+
+      const stop: Error | undefined = await runAsync('stop');
+      expect(stop?.message.startsWith(`${timeout} `)).toBe(true);
+      expect(stop?.message).toMatch(owner);
+      expect(stop?.message.split('\n')[1]).toBe(stopHint);
+
+      // Like a reset that a live owner refuses, it says that it killed nothing.
+      const forceStop: Error | undefined = await runAsync('stop', '--force');
+      expect(forceStop?.message.startsWith(`${timeout} `)).toBe(true);
+      expect(forceStop?.message).toMatch(new RegExp(`${description} No process was killed\\.\\n`));
+      expect(forceStop?.message.split('\n')[1]).toBe(stopHint);
+      expect(readState(pid)).toBe('T');
+      expect(stdout).toEqual([]);
+    }, 30000);
+
+    it("names no signal to send to a daemon that does not have this workspace's record open", async () => {
+      // For example the daemon of another workspace, whose PID an old record of this workspace names: it has
+      // only its own record open.
+      const pid: number = await startFakeDaemonAsync(600_000, {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'other.sock'),
+        lockfilePath: path.join(folder, 'other.pid.json')
+      });
+      await stopChildAsync(pid);
+
+      const status: Error | undefined = await runAsync('status');
+
+      expect(status?.message).toMatch(
+        new RegExp(
+          ` rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n`
+        )
+      );
+      expect(status?.message.split('\n')[1]).toBe(
+        `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon.`
+      );
+      expect(readState(pid)).toBe('T');
+      expect(stdout).toEqual([]);
+    }, 30000);
+
+    it('waits for a daemon that no longer listens to exit before stop reports that none runs', async () => {
+      const pid: number = await startFakeDaemonAsync(1500);
+      // It still runs, with its record open, but no client can reach it.
+      fs.unlinkSync(paths.socketPath);
+      const started: number = Date.now();
+
+      expect(await runAsync('stop')).toBeUndefined();
+
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1000);
+      expect(stderr).toHaveLength(1);
+      expect(stderr[0]).toMatch(
+        new RegExp(
+          `^rush-client: Nothing listens at ${escapeRegExp(paths.socketPath)}, but rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started \\d+ s ago, so stop waits up to 1[34] s for it to exit\\.\\n$`
+        )
+      );
+      expect(JSON.parse(stdout.join(''))).toMatchObject({
+        state: 'notRunning',
+        socketPath: paths.socketPath
+      });
+    }, 30000);
+
+    it('fails stop, saying what the daemon is doing, when a daemon that no longer listens does not exit', async () => {
+      const pid: number = await startFakeDaemonAsync();
+      fs.unlinkSync(paths.socketPath);
+
+      const error: Error | undefined = await runAsync('stop');
+
+      expect(error?.message).toMatch(
+        new RegExp(
+          `^Nothing listens at ${escapeRegExp(paths.socketPath)}, but rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started 1\\d s ago\\.\\n`
+        )
+      );
+      expect(error?.message.split('\n')[1]).toBe(
+        `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
+      );
+      expect(stderr).toHaveLength(1);
+      expect(stdout).toEqual([]);
+    }, 30000);
+  }
+);
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-live-owner_2026-09-29-10-38.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-live-owner_2026-09-29-10-38.json
new file mode 100644
index 0000000000..45b037d4ff
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-live-owner_2026-09-29-10-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When \"rush-client daemon status\", \"stop\" or \"restart\" cannot reach a daemon whose process still runs, say what that process is doing and how to resume or stop it; \"stop --force\" also says that it killed no process. \"rush-client daemon stop\" now waits up to 15 s for a daemon that no longer listens to exit, instead of reporting that none runs while it still does. A command no longer runs Rush in-process beside this workspace's Rush daemon (on Linux, the process that the ownership record names, which has that record open) when its socket file was deleted; it fails with what that daemon is doing.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json
new file mode 100644
index 0000000000..2bc49eab4d
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "On Linux, a command whose daemon a signal keeps stopped now fails after about 1.5 s, saying how to resume the daemon, instead of after about 30 s.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t69b-live-owner_2026-09-29-10-38.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t69b-live-owner_2026-09-29-10-38.json
new file mode 100644
index 0000000000..9001895171
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t69b-live-owner_2026-09-29-10-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When the process that the daemon ownership record names still runs but no daemon answers, say what that process is doing (on Linux, for example that a signal stopped it, that its socket is missing, or that it is not a Rush daemon) and what to do about it, instead of pointing to a reset that refuses while it runs. `connectOrAwaitDaemonStartupAsync()` no longer lets the caller run Rush in-process beside this workspace's Rush daemon (on Linux, the process that the ownership record names, which has that record open) when its socket file was deleted. Add `describeLiveDaemonOwner()`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json
new file mode 100644
index 0000000000..8930de74ac
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t69b-stopped-owner_2026-09-29-11-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "On Linux, stop waiting for a daemon that a signal or a tracer keeps stopped: when the recorded owner has the daemon ownership record open, as the daemon that wrote it does, and stays stopped for 1.5 s while the client samples it, fail with what that process is doing and how to resume it, instead of waiting for the startup deadline twice.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t69b-int3_2026-09-29-16-30.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t69b-int3_2026-09-29-16-30.json
new file mode 100644
index 0000000000..f12433045b
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t69b-int3_2026-09-29-16-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A test now expects the client's message for a live process that owns the daemon's files but does not answer, which says that the daemon did not answer.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 5c053eb327..f412a74fd9 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -70,6 +70,9 @@ export type DaemonClientOutcome = {
     readonly rejection: IDaemonRequestRejectedMessage['payload'];
 };
 
+// @beta
+export type DaemonOwnerHintPurpose = 'use' | 'stop';
+
 // @beta
 export class DaemonRestartFailedError extends DaemonClientError {
     constructor(startupError: DaemonClientError, restartReason: DaemonRestartReason);
@@ -87,6 +90,9 @@ export class DaemonStartupPendingError extends Error {
     constructor(message: string, options?: ErrorOptions);
 }
 
+// @beta
+export function describeLiveDaemonOwner(paths: IDaemonPaths, purpose: DaemonOwnerHintPurpose): string | undefined;
+
 // @beta
 export function executeWithDaemonRestartAsync(client: DaemonClient, connection: IConnectOrStartDaemonOptions, options: IExecuteWithDaemonRestartOptions): Promise<DaemonClientOutcome>;
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 36c7ba8160..e4c6894047 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -137,8 +137,27 @@ owner recorded (`reapReusedOwnerOperationGroupsAsync()`), with the proof of each
 `reclaimStaleDaemonAsync()` requires, but never the process group whose ID is the recorded PID, which
 the later process may lead. If they cannot be stopped, the start fails and removes nothing.
 Any other live PID with an unreachable socket fails
-closed, pointing to `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`),
-which removes the record, socket and reservation after the same no-listener/no-live-owner checks.
+closed, and never signals that process. The error says on its first line what that process is doing and
+on its last line what to do about it. On Linux the first line comes from `/proc`: whether the process
+looks like a Rush daemon (else its command line), its state (for example `it is stopped (state T), for
+example by SIGSTOP`), whether its socket is missing, and when it started. The last line, for example, says
+to resume a stopped daemon with `kill -CONT <pid>`, or to delete the record of a process that is not a
+Rush daemon. It names a signal to send only to a Rush daemon that has this workspace's ownership record
+open (from the links in `/proc/<pid>/fd`), as the daemon that wrote the record does for as long as it
+owns it, also after its socket file is deleted: the recorded PID could otherwise belong to another
+process, such as another workspace's daemon, which has only its own record open. For any other
+process, and outside Linux, it says to end that process if it is this workspace's daemon, and else to
+delete the record. A starting client waits for a live owner until its deadline, with one exception on Linux:
+when the recorded owner has the record open, as above, and every sample of its state over 1.5 s (one
+every 100 ms) reads stopped, by a signal (T) or a tracer (t), with the same start time, the client fails
+with that error once the 1.5 s have passed. Until something resumes that process, it cannot answer. The
+client samples it while its first connection attempt runs, and not at all when less than 1.5 s remains
+before its deadline. A shorter stop, such as Ctrl+Z and then `fg`, only delays the start, as before.
+`describeLiveDaemonOwner(paths, purpose)` returns the same two lines for the live process
+that the record names (`purpose` is `use` or `stop`), or `undefined` when there is none.
+`resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`) removes the record, socket and
+reservation after the same no-listener/no-live-owner checks, so it refuses while that process runs, and
+says the same.
 When the recorded PID no longer exists, the reset first stops the operations that the owner left
 running, as `reclaimStaleDaemonAsync()` does before the next start; when a process that started later
 has it, the reset stops the recorded operation process groups as the start does. Both report what they
@@ -208,10 +227,18 @@ another client that holds the start mutex. In-process Rush would take the reposi
 daemon's requests need. The wrapper instead keeps connecting (and starting, through the same mutex and
 reservation) until one more startup deadline has passed. If the daemon is still not ready, it rejects
 with `DaemonStartupPendingError`, which is not a `DaemonClientError`: the message is the startup error
-followed by the process that is still live, and `cause` is that error. When none remains, it rejects at
+followed by the process that is still live, and `cause` is that error. When the startup error is that
+the process that the ownership record names still runs but did not answer, the message instead leads
+with what that process is doing and ends with what to do about it, as above. When that error comes from a
+stopped owner at the endpoint (see above), and the owner is still stopped, the wrapper rejects so without
+waiting for another deadline. When none remains, it rejects at
 once with the original `DaemonClientError`, for example when auto-start is disabled and nothing listens,
 or when the helper has exited. An ownership record alone does not count, because a daemon publishes it
-only after binding. Other errors, such as `versionMismatch`, pass through unchanged. Before it keeps
+only after binding. The exception is a Rush daemon, named by the record, that still has that record open
+where no client can reach it, for example after its socket file was deleted (Linux only):
+it cannot become ready there, but in-process Rush would compete with it, so the wrapper rejects at once
+with `DaemonStartupPendingError`, whose message says what that daemon is doing, as above. Other errors,
+such as `versionMismatch`, pass through unchanged. Before it keeps
 waiting, it calls the optional `onAwaitStartup(owner, waitMs)` once, with the live process and the
 remaining wait, so that the caller can say why the command has not started yet.
 
diff --git a/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts b/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
new file mode 100644
index 0000000000..900b97563d
--- /dev/null
+++ b/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
@@ -0,0 +1,325 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from './DaemonClientError';
+import { tryGetProcessStartTimeMs, tryGetProcessState, type IProcessState } from './ProcessStartTime';
+
+/**
+ * What a hint about a live daemon owner is for: a command that uses the daemon (`use`), or one that stops it
+ * (`stop`).
+ * @beta
+ */
+export type DaemonOwnerHintPurpose = 'use' | 'stop';
+
+/** Reads what a diagnosis reports about a process. Only Linux `/proc` shows its state and command line. */
+export interface IOwnerProcessReaders {
+  readonly platform: NodeJS.Platform;
+  readonly now: () => number;
+  readonly readState: (pid: number) => IProcessState | undefined;
+  readonly readStartTimeMs: (pid: number) => number | undefined;
+  readonly readCommandLine: (pid: number) => ReadonlyArray<string> | undefined;
+  readonly isPresent: (filePath: string) => boolean;
+  /** Whether the process has the file at the path open; `undefined` when that cannot be read. */
+  readonly hasFileOpen: (pid: number, filePath: string) => boolean | undefined;
+}
+
+/** What a live process that a daemon ownership record names is doing. It never signals that process. */
+export interface IDaemonOwnerDiagnosis {
+  readonly pid: number;
+  readonly socketPath: string;
+  /** For example `rushd (PID 123)`, or `PID 123 ("sleep 600")` for a process that is not a Rush daemon. */
+  readonly subject: string;
+  /** Undefined when its command line cannot be read, for example outside Linux or after it exited. */
+  readonly isRushDaemon: boolean | undefined;
+  /**
+   * Whether it is a Rush daemon that has this workspace's ownership record open. A daemon opens the record that
+   * it wrote and keeps it open for as long as it owns it, also after its socket file is deleted. Only such a
+   * process is named in a signal hint: the recorded PID could otherwise belong to another process, for example
+   * after a PID reuse that the start-time check could not detect.
+   */
+  readonly isWorkspaceDaemon: boolean;
+  readonly state: IProcessState | undefined;
+  readonly isSocketMissing: boolean;
+  /** For example `: it is stopped (state T), for example by SIGSTOP, and it started 5 min ago`, or empty. */
+  readonly facts: string;
+}
+
+/** A process that a signal (state T) or a tracer (state t) keeps stopped. */
+export interface IStoppedProcess {
+  readonly pid: number;
+  /** When it started, which tells it from a later process with the same PID. */
+  readonly startTicks: number;
+}
+
+/**
+ * A live process owns this workspace's daemon files, but no daemon answered. The message says what that process
+ * is doing on its first line, and what to do about it on the next.
+ */
+export class LiveDaemonOwnerError extends DaemonClientError {
+  /** The first line of the message: what the process is doing. */
+  public readonly description: string;
+  /** The last line of the message: what to do about it. */
+  public readonly hint: string;
+  /** Set when that process has the ownership record open and stayed stopped while a client sampled it. */
+  public readonly stoppedProcess: IStoppedProcess | undefined;
+
+  public constructor(description: string, hint: string, stoppedProcess?: IStoppedProcess) {
+    super('startupFailed', `${description}\n${hint}`);
+    this.description = description;
+    this.hint = hint;
+    this.stoppedProcess = stoppedProcess;
+  }
+}
+
+const RUSH_DAEMON_PACKAGE_FOLDER: string = 'rush-daemon';
+const RUSH_DAEMON_BIN: string = 'rushd';
+const PATH_SEPARATOR_REGEXP: RegExp = /[\\/]+/;
+const MAX_COMMAND_LINE_LENGTH: number = 60;
+const SECONDS_PER_MINUTE: number = 60;
+const MINUTES_PER_HOUR: number = 60;
+
+export function getDefaultOwnerProcessReaders(): IOwnerProcessReaders {
+  return {
+    platform: process.platform,
+    now: Date.now,
+    readState: tryGetProcessState,
+    readStartTimeMs: tryGetProcessStartTimeMs,
+    readCommandLine: tryReadCommandLine,
+    isPresent,
+    hasFileOpen: tryHasFileOpen
+  };
+}
+
+/**
+ * What `pid`, which the ownership record at `paths.lockfilePath` names, is doing. Throws nothing: whatever cannot
+ * be read is left out.
+ */
+export function diagnoseDaemonOwner(
+  pid: number,
+  paths: IDaemonPaths,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders()
+): IDaemonOwnerDiagnosis {
+  const { socketPath, lockfilePath } = paths;
+  const commandLine: ReadonlyArray<string> | undefined = readers.readCommandLine(pid);
+  const isRushDaemon: boolean | undefined = commandLine && isRushDaemonCommandLine(commandLine);
+  const state: IProcessState | undefined = readers.readState(pid);
+  const startTimeMs: number | undefined = readers.readStartTimeMs(pid);
+  // Windows names a pipe, which leaves no file to check.
+  const isSocketMissing: boolean = readers.platform !== 'win32' && !readers.isPresent(socketPath);
+  const clauses: string[] = [];
+  if (isSocketMissing) clauses.push('its socket is missing, so no client can reach it');
+  const activity: string[] = [];
+  if (state) activity.push(describeState(state));
+  if (startTimeMs !== undefined) activity.push(`it started ${formatAge(readers.now() - startTimeMs)} ago`);
+  if (activity.length > 0) clauses.push(activity.join(', and '));
+  return {
+    pid,
+    socketPath,
+    subject: describeSubject(pid, isRushDaemon, commandLine),
+    isRushDaemon,
+    isWorkspaceDaemon: isRushDaemon === true && readers.hasFileOpen(pid, lockfilePath) === true,
+    state,
+    isSocketMissing,
+    facts: clauses.length > 0 ? `: ${clauses.join('; ')}` : ''
+  };
+}
+
+/** Describes an owner after the daemon did not answer at its endpoint. */
+export function describeUnresponsiveOwner(diagnosis: IDaemonOwnerDiagnosis): string {
+  const { socketPath, subject, facts } = diagnosis;
+  return diagnosis.isWorkspaceDaemon
+    ? `The daemon, ${subject}, did not answer at ${socketPath}${facts}.`
+    : `The daemon did not answer at ${socketPath}, and its ownership record names ${subject}${facts}.`;
+}
+
+/** Describes the owner that the ownership record at `lockfilePath` names. */
+export function describeRecordOwner(diagnosis: IDaemonOwnerDiagnosis, lockfilePath: string): string {
+  return `${diagnosis.subject} still owns ${lockfilePath}${diagnosis.facts}.`;
+}
+
+/**
+ * Says what makes the daemon answer again, or lets the next command start a new one. It names a signal to send
+ * only to a process that is proven to be this workspace's daemon.
+ */
+export function getDaemonOwnerHint(
+  diagnosis: IDaemonOwnerDiagnosis,
+  lockfilePath: string,
+  purpose: DaemonOwnerHintPurpose
+): string {
+  const { state } = diagnosis;
+  if (state?.code === 'Z' || state?.code === 'X') {
+    const parent: string = state.parentPid === undefined ? 'its parent process' : `PID ${state.parentPid}`;
+    return `The next command reclaims its files once ${parent} reaps it.`;
+  }
+  if (diagnosis.isRushDaemon === false) {
+    return `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${lockfilePath}; the next command then starts a new daemon.`;
+  }
+  if (!diagnosis.isWorkspaceDaemon) {
+    return `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${lockfilePath}. Either way, the next command then starts a new daemon.`;
+  }
+  return getRushDaemonHint(diagnosis, purpose);
+}
+
+/** The error for live owner `pid` after no daemon answered at `paths.socketPath`. */
+export function createUnresponsiveOwnerError(
+  pid: number,
+  paths: IDaemonPaths,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders(),
+  stoppedProcess?: IStoppedProcess
+): LiveDaemonOwnerError {
+  const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(pid, paths, readers);
+  return new LiveDaemonOwnerError(
+    describeUnresponsiveOwner(diagnosis),
+    getDaemonOwnerHint(diagnosis, paths.lockfilePath, 'use'),
+    stoppedProcess
+  );
+}
+
+function getRushDaemonHint(diagnosis: IDaemonOwnerDiagnosis, purpose: DaemonOwnerHintPurpose): string {
+  const { pid } = diagnosis;
+  switch (diagnosis.state?.code) {
+    case 'T':
+      if (diagnosis.isSocketMissing) {
+        return `Run "kill ${pid}", then "kill -CONT ${pid}": it then cancels its running requests and exits, and the next command starts a new daemon.`;
+      }
+      return purpose === 'stop'
+        ? `Resume it with "kill -CONT ${pid}", then run "rush-client daemon stop" again.`
+        : `Resume it with "kill -CONT ${pid}"; it then serves the next command.`;
+    case 't':
+      return 'It answers once the debugger or tracer lets it run.';
+    case 'D':
+      return 'It handles no signal until that wait ends; retry then.';
+    default:
+      return diagnosis.isSocketMissing
+        ? `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
+        : `It may be busy or shutting down; "rush-client daemon logs" shows its last lines. "kill ${pid}" asks it to cancel its running requests and exit; the next command then starts a new daemon.`;
+  }
+}
+
+function describeSubject(
+  pid: number,
+  isRushDaemon: boolean | undefined,
+  commandLine: ReadonlyArray<string> | undefined
+): string {
+  if (isRushDaemon) return `rushd (PID ${pid})`;
+  if (!commandLine) return `PID ${pid}`;
+  const joined: string = commandLine.join(' ');
+  const shown: string =
+    joined.length > MAX_COMMAND_LINE_LENGTH ? `${joined.slice(0, MAX_COMMAND_LINE_LENGTH - 3)}...` : joined;
+  return `PID ${pid} ("${shown}")`;
+}
+
+function describeState(state: IProcessState): string {
+  switch (state.code) {
+    case 'T':
+      return 'it is stopped (state T), for example by SIGSTOP';
+    case 't':
+      return 'it is stopped by a debugger or tracer (state t)';
+    case 'D':
+      return 'it is waiting in the kernel (state D), for example on a slow disk or network file system';
+    case 'Z': {
+      const parent: string =
+        state.parentPid === undefined ? 'its parent process' : `its parent process (PID ${state.parentPid})`;
+      return `it has exited, but ${parent} has not reaped it (state Z)`;
+    }
+    case 'R':
+      return 'it is running (state R)';
+    case 'S':
+      return 'it is waiting (state S)';
+    default:
+      return `it is in state ${state.code}`;
+  }
+}
+
+function formatAge(ageMs: number): string {
+  const seconds: number = Math.floor(Math.max(0, ageMs) / 1000);
+  if (seconds < SECONDS_PER_MINUTE) return `${seconds} s`;
+  const minutes: number = Math.floor(seconds / SECONDS_PER_MINUTE);
+  if (minutes < MINUTES_PER_HOUR) return `${minutes} min`;
+  return `${Math.floor(minutes / MINUTES_PER_HOUR)} h ${minutes % MINUTES_PER_HOUR} min`;
+}
+
+/**
+ * rushd runs as a `rushd` bin, or as node with its script in the `rush-daemon` package, for example
+ * `node …/rush-daemon/lib-commonjs/SelectedDaemonBootstrap.js --launch …`. Another argument that names that folder,
+ * or a script in a package that `rush-daemon` depends on (such as a tool that builds it), does not count.
+ */
+function isRushDaemonCommandLine(commandLine: ReadonlyArray<string>): boolean {
+  const [executable = '', ...args] = commandLine;
+  if (getFileName(executable) === RUSH_DAEMON_BIN) return true;
+  const script: string | undefined = args.find((arg) => !arg.startsWith('-'));
+  if (script === undefined) return false;
+  const segments: string[] = script.split(PATH_SEPARATOR_REGEXP);
+  const packageIndex: number = segments.lastIndexOf(RUSH_DAEMON_PACKAGE_FOLDER);
+  return (
+    segments[segments.length - 1] === RUSH_DAEMON_BIN ||
+    (packageIndex >= 0 &&
+      packageIndex < segments.length - 1 &&
+      !segments.slice(packageIndex + 1).includes('node_modules'))
+  );
+}
+
+function getFileName(filePath: string): string {
+  const segments: string[] = filePath.split(PATH_SEPARATOR_REGEXP);
+  return segments[segments.length - 1];
+}
+
+/** The arguments of `pid` on Linux; `undefined` elsewhere, or when they are unreadable or empty (a zombie). */
+function tryReadCommandLine(pid: number): ReadonlyArray<string> | undefined {
+  if (process.platform !== 'linux') return undefined;
+  let raw: string;
+  try {
+    raw = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8');
+  } catch {
+    return undefined;
+  }
+  const args: string[] = raw.split('\0').filter((arg) => arg.length > 0);
+  return args.length > 0 ? args : undefined;
+}
+
+/**
+ * Whether `pid` has the file at `filePath` open, on Linux: whether a link in `/proc/<pid>/fd` reads the file's real
+ * path. Such a link reads the current path of the file that the process opened, with " (deleted)" appended once
+ * that file is removed, so a file that took the path later does not count. Only the links are read, never the
+ * files that they lead to, which could block, for example on a network file system that does not answer.
+ */
+function tryHasFileOpen(pid: number, filePath: string): boolean | undefined {
+  if (process.platform !== 'linux') return undefined;
+  let realPath: string;
+  let descriptors: string[];
+  try {
+    realPath = fs.realpathSync.native(filePath);
+    descriptors = fs.readdirSync(`/proc/${pid}/fd`);
+  } catch {
+    return undefined;
+  }
+  return descriptors.some((descriptor) => tryReadLink(`/proc/${pid}/fd/${descriptor}`) === realPath);
+}
+
+function tryReadLink(linkPath: string): string | undefined {
+  try {
+    return fs.readlinkSync(linkPath);
+  } catch {
+    // For example a descriptor that was closed after it was listed.
+    return undefined;
+  }
+}
+
+/**
+ * The stat uses `{ bigint: true }`, which fills a stat array of its own. A plain stat of the socket would leave its
+ * type in the array that Node 22's cached `fs.realpathSync` reads (nodejs/node#65113), and the next `require()` in
+ * this process, for example of the daemon launcher after a failed command, could then load a package through its
+ * symbolic link and not find the package's dependencies.
+ */
+function isPresent(filePath: string): boolean {
+  try {
+    return fs.lstatSync(filePath, { bigint: true, throwIfNoEntry: false }) !== undefined;
+  } catch {
+    // Unknown is not missing.
+    return true;
+  }
+}
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index 7d657a12dd..46c3f118b3 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -17,6 +17,16 @@ import {
 } from '@rushstack/rush-daemon-transport';
 
 import { DaemonClientError } from './DaemonClientError';
+import {
+  createUnresponsiveOwnerError,
+  describeRecordOwner,
+  describeUnresponsiveOwner,
+  diagnoseDaemonOwner,
+  getDaemonOwnerHint,
+  LiveDaemonOwnerError,
+  type DaemonOwnerHintPurpose,
+  type IDaemonOwnerDiagnosis
+} from './DaemonOwnerDiagnosis';
 import { getDaemonStartupFilePath } from './DaemonStartup';
 import { isProcessStartedAfter } from './ProcessStartTime';
 import { clearReclaimedDaemonReport } from './ReclaimedDaemonLog';
@@ -105,6 +115,53 @@ export function isOwnerProcessAlive(owner: { readonly pid: number; readonly star
   return !(typeof owner.startedAt === 'string' && isProcessStartedAfter(owner.pid, owner.startedAt));
 }
 
+/**
+ * Describes the live process that this workspace's daemon ownership record names, for a command that could not
+ * use or stop the daemon: on the first line, what that process is doing (on Linux, for example that a signal
+ * stopped it), and on the second, what to do about it. It never signals that process.
+ * @returns `undefined` when there is no record, it cannot be read, or the process that it names is gone.
+ * @beta
+ */
+export function describeLiveDaemonOwner(
+  paths: IDaemonPaths,
+  purpose: DaemonOwnerHintPurpose
+): string | undefined {
+  const owner: DaemonOwnership | undefined = tryReadLiveOwner(paths);
+  if (!owner) return undefined;
+  const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(owner.pid, paths);
+  const description: string = describeRecordOwner(diagnosis, paths.lockfilePath);
+  return `${description}\n${getDaemonOwnerHint(diagnosis, paths.lockfilePath, purpose)}`;
+}
+
+/**
+ * The error for this workspace's daemon when it still runs but no client can reach it at the endpoint, for
+ * example because its socket file was deleted: the process that the ownership record names is rushd, and it has
+ * that record open, as a daemon does for as long as it owns it (which only Linux shows). Otherwise `undefined`.
+ */
+export function findUnreachableDaemon(paths: IDaemonPaths): LiveDaemonOwnerError | undefined {
+  const owner: DaemonOwnership | undefined = tryReadLiveOwner(paths);
+  if (!owner) return undefined;
+  const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(owner.pid, paths);
+  if (!diagnosis.isWorkspaceDaemon) return undefined;
+  return new LiveDaemonOwnerError(
+    describeUnresponsiveOwner(diagnosis),
+    getDaemonOwnerHint(diagnosis, paths.lockfilePath, 'use')
+  );
+}
+
+/**
+ * The recorded owner, or `undefined` when there is no readable record or the process that it names is gone.
+ */
+function tryReadLiveOwner(paths: IDaemonPaths): DaemonOwnership | undefined {
+  try {
+    const owner: DaemonOwnership | undefined = readDaemonOwnership(paths.lockfilePath);
+    return owner && isOwnerProcessAlive(owner) ? owner : undefined;
+  } catch {
+    // For example EPERM: a process that another user runs is no evidence about this workspace's daemon.
+    return undefined;
+  }
+}
+
 /**
  * Makes stale ownership reclaimable when that is provably safe. The caller must hold the start mutex and have
  * observed no startup reservation, or taken over one whose helper is gone. A daemon publishes its endpoint only
@@ -123,10 +180,7 @@ export async function reclaimAbandonedOwnershipAsync(
   const state: OwnershipState = inspectOwnership(paths.lockfilePath);
   if (state.kind === 'owned' && !isProcessAlive(state.owner.pid)) return;
   if (state.kind === 'owned' && !isProcessStartedAfter(state.owner.pid, state.owner.startedAt)) {
-    throw new DaemonClientError(
-      'startupFailed',
-      `PID ${state.owner.pid} still exists but the daemon is not ready. It may be a daemon that is still shutting down, or a reused PID; refusing to kill it or remove ${paths.lockfilePath}. ${DAEMON_RESET_HINT}`
-    );
+    throw createUnresponsiveOwnerError(state.owner.pid, paths);
   }
   if (state.kind === 'absent' && (process.platform === 'win32' || !fs.existsSync(paths.socketPath))) return;
   if (!(await isEndpointUnboundAsync(paths.socketPath))) {
@@ -194,9 +248,10 @@ async function tryResetDaemonArtifactsAsync(
     }
     const state: OwnershipState = inspectOwnership(paths.lockfilePath);
     if (state.kind === 'owned' && isOwnerProcessAlive(state.owner)) {
-      return new DaemonClientError(
-        'startupFailed',
-        `PID ${state.owner.pid} still owns ${paths.lockfilePath}; it may be a daemon that is shutting down. Wait for it to exit (or stop that process yourself), then retry. No process was killed.`
+      const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(state.owner.pid, paths);
+      return new LiveDaemonOwnerError(
+        `${describeRecordOwner(diagnosis, paths.lockfilePath)} No process was killed.`,
+        getDaemonOwnerHint(diagnosis, paths.lockfilePath, 'stop')
       );
     }
     // A reclaim removes the record and the socket itself, right after its own checks.
diff --git a/libraries/rush-client-core/src/ProcessStartTime.ts b/libraries/rush-client-core/src/ProcessStartTime.ts
index b2d318507b..e85c73b20b 100644
--- a/libraries/rush-client-core/src/ProcessStartTime.ts
+++ b/libraries/rush-client-core/src/ProcessStartTime.ts
@@ -7,6 +7,7 @@ import { performance } from 'node:perf_hooks';
 // USER_HZ is fixed at 100 on mainstream Linux ABIs; it is verified against this process before use.
 const USER_HZ: number = 100;
 const PROC_STAT_STATE_FIELD: number = 3;
+const PROC_STAT_PARENT_PID_FIELD: number = 4;
 const PROC_STAT_START_TIME_FIELD: number = 22;
 const MAX_CALIBRATION_ERROR_MS: number = 1000;
 /** A process that began this long after a record was written cannot be the record's writer. */
@@ -59,6 +60,30 @@ export function isProcessDefunct(pid: number): boolean {
   return state === 'Z' || state === 'X';
 }
 
+/** The scheduling state of a process, as Linux `/proc/<pid>/stat` shows it. */
+export interface IProcessState {
+  /** One letter, for example `R` (running), `S` (sleeping), `D` (waiting in the kernel) or `T` (stopped). */
+  readonly code: string;
+  readonly parentPid: number | undefined;
+  /** When it started, in clock ticks after boot, which tells it from a later process with the same PID. */
+  readonly startTicks?: number;
+}
+
+/** Returns the state of `pid` on Linux, or `undefined` when it cannot be read. */
+export function tryGetProcessState(pid: number): IProcessState | undefined {
+  if (process.platform !== 'linux') return undefined;
+  const fields: string[] | undefined = readStatFields(pid);
+  const code: string | undefined = fields?.[PROC_STAT_STATE_FIELD - 3];
+  if (!fields || !code) return undefined;
+  const parentPid: number = Number(fields[PROC_STAT_PARENT_PID_FIELD - 3]);
+  const startTicks: number = Number(fields[PROC_STAT_START_TIME_FIELD - 3]);
+  return {
+    code,
+    parentPid: Number.isSafeInteger(parentPid) && parentPid > 0 ? parentPid : undefined,
+    startTicks: Number.isSafeInteger(startTicks) && startTicks >= 0 ? startTicks : undefined
+  };
+}
+
 function readStartSeconds(pid: number | 'self'): number | undefined {
   const fields: string[] | undefined = readStatFields(pid);
   if (!fields) return undefined;
diff --git a/libraries/rush-client-core/src/StoppedDaemonOwner.ts b/libraries/rush-client-core/src/StoppedDaemonOwner.ts
new file mode 100644
index 0000000000..23acbce013
--- /dev/null
+++ b/libraries/rush-client-core/src/StoppedDaemonOwner.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import {
+  getDefaultOwnerProcessReaders,
+  type IOwnerProcessReaders,
+  type IStoppedProcess
+} from './DaemonOwnerDiagnosis';
+import { isOwnerProcessAlive, readDaemonOwnership, type DaemonOwnership } from './DaemonOwnership';
+import type { IProcessState } from './ProcessStartTime';
+
+/**
+ * How long the recorded owner must stay stopped before a client stops waiting for it. A stop under job control
+ * (Ctrl+Z, then `fg`), a STOP/CONT pair or a tracer that stops the process at each system call is shorter.
+ */
+export const STOPPED_OWNER_WINDOW_MS: number = 1500;
+const STOPPED_OWNER_SAMPLE_INTERVAL_MS: number = 100;
+
+/**
+ * The daemon owner that the record at `paths.lockfilePath` names, when it has that record open, as the daemon that
+ * wrote it does for as long as it owns it (also after its socket file was deleted), and every sample of its state
+ * over {@link STOPPED_OWNER_WINDOW_MS} reads T or t, with the same start time. Until something resumes it, it
+ * cannot answer, and while it lives, no client starts another daemon. On Linux only.
+ * @returns `undefined` otherwise, including when a sample cannot be read, when the process resumed or its PID
+ * now names another process, when less than that window remains before `deadline`, and once `signal` aborts.
+ * The first sample ends the sampling for any other owner, or none.
+ */
+export async function findStoppedDaemonOwnerAsync(
+  paths: IDaemonPaths,
+  deadline: number,
+  signal?: AbortSignal,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders()
+): Promise<IStoppedProcess | undefined> {
+  if (deadline - Date.now() < STOPPED_OWNER_WINDOW_MS) return undefined;
+  const stopped: IStoppedProcess | undefined = readStoppedDaemonOwner(paths, readers);
+  if (!stopped) return undefined;
+  const end: number = Date.now() + STOPPED_OWNER_WINDOW_MS;
+  while (Date.now() < end) {
+    try {
+      await delayAsync(Math.min(STOPPED_OWNER_SAMPLE_INTERVAL_MS, Math.max(1, end - Date.now())), undefined, {
+        signal
+      });
+    } catch {
+      // Aborted: the caller no longer waits for the answer.
+      return undefined;
+    }
+    if (!isStillStopped(stopped, readers)) return undefined;
+  }
+  return stopped;
+}
+
+/**
+ * Whether the record at `paths.lockfilePath` still names `stopped`, which still has that record open and is still
+ * stopped (state T or t, with the same start time).
+ */
+export function isDaemonOwnerStillStopped(
+  paths: IDaemonPaths,
+  stopped: IStoppedProcess,
+  readers: IOwnerProcessReaders = getDefaultOwnerProcessReaders()
+): boolean {
+  const current: IStoppedProcess | undefined = readStoppedDaemonOwner(paths, readers);
+  return current?.pid === stopped.pid && current.startTicks === stopped.startTicks;
+}
+
+function readStoppedDaemonOwner(
+  paths: IDaemonPaths,
+  readers: IOwnerProcessReaders
+): IStoppedProcess | undefined {
+  let owner: DaemonOwnership | undefined;
+  try {
+    owner = readDaemonOwnership(paths.lockfilePath);
+    if (!owner || !isOwnerProcessAlive(owner)) return undefined;
+  } catch {
+    // An unreadable record or a process of another user is no evidence of a stopped owner.
+    return undefined;
+  }
+  const state: IProcessState | undefined = readers.readState(owner.pid);
+  if (!state || !isStoppedState(state) || state.startTicks === undefined) return undefined;
+  // Only the daemon that wrote the record has it open, which ties the record to that process rather than to a
+  // reused PID.
+  if (readers.hasFileOpen(owner.pid, paths.lockfilePath) !== true) return undefined;
+  return { pid: owner.pid, startTicks: state.startTicks };
+}
+
+function isStillStopped(stopped: IStoppedProcess, readers: IOwnerProcessReaders): boolean {
+  const state: IProcessState | undefined = readers.readState(stopped.pid);
+  return state !== undefined && isStoppedState(state) && state.startTicks === stopped.startTicks;
+}
+
+function isStoppedState(state: IProcessState): boolean {
+  return state.code === 'T' || state.code === 't';
+}
diff --git a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
index 63ba816fb0..e62c081b9f 100644
--- a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
+++ b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
@@ -9,7 +9,8 @@ import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import type { DaemonClient } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
-import { isEndpointUnboundAsync } from './DaemonOwnership';
+import { LiveDaemonOwnerError, type IStoppedProcess } from './DaemonOwnerDiagnosis';
+import { findUnreachableDaemon, isEndpointUnboundAsync } from './DaemonOwnership';
 import { readDaemonStartupReservation, type IDaemonStartupReservation } from './DaemonStartup';
 import { getStartupHelperState } from './DaemonStartupReservation';
 import {
@@ -18,16 +19,27 @@ import {
   type IConnectOrStartDaemonOptions
 } from './connectOrStartDaemon';
 import { isStartupLockFilePresent, tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+import { isDaemonOwnerStillStopped } from './StoppedDaemonOwner';
+
+/** A live process that can still make this workspace's daemon ready. */
+interface ILiveStartupOwner {
+  /** A listener at the endpoint, a startup helper that still waits for its daemon, or a start mutex holder. */
+  readonly kind: 'listener' | 'helper' | 'starter';
+  /** For example "Its startup helper (PID 123) is still waiting for the daemon". */
+  readonly description: string;
+}
 
 /** Matches the default of {@link IConnectOrStartDaemonOptions.startupTimeoutMs}. */
 const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
 /** Keeps a retry that fails at once from spinning until the deadline. */
 const RETRY_DELAY_MS: number = 100;
+const NOT_RUN_IN_PROCESS: string =
+  'Rush was not run in-process, where it would compete with that daemon for the repository.';
 
 /**
- * Daemon startup did not finish in time, but a live process can still make the daemon ready. Unlike a
- * {@link DaemonClientError}, this does not mean that running Rush in-process is safe: it would compete with
- * that daemon for the repository.
+ * Daemon startup did not finish in time, but a live process can still make the daemon ready, or this workspace's
+ * daemon still runs where no client can reach it. Unlike a {@link DaemonClientError}, this does not mean that
+ * running Rush in-process is safe: it would compete with that daemon for the repository.
  * @beta
  */
 export class DaemonStartupPendingError extends Error {
@@ -57,6 +69,12 @@ export interface IConnectOrAwaitDaemonStartupOptions extends IConnectOrStartDaem
  * for one more startup deadline. If the daemon is still not ready, it rejects with a
  * {@link DaemonStartupPendingError}. It rejects with a {@link DaemonClientError} only when no such process
  * remains, so that the caller can run Rush in-process without competing with a daemon for the repository.
+ * When none remains but this workspace's daemon still runs where no client can reach it, for example after its
+ * socket file was deleted (on Linux: the process that the ownership record names is rushd and has that record
+ * open, as a daemon does for as long as it owns it), it rejects at once with a {@link DaemonStartupPendingError}
+ * that says what that daemon does. When the recorded owner has that record open, and a signal or a tracer kept it
+ * stopped while the last attempt sampled it (on Linux), it rejects with a {@link DaemonStartupPendingError}
+ * without waiting.
  * @beta
  */
 export async function connectOrAwaitDaemonStartupAsync(
@@ -77,16 +95,20 @@ async function awaitLiveStartupAsync(
   const deadline: number = Date.now() + (options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS);
   let lastError: DaemonClientError = firstError;
   for (let attempt: number = 0; ; attempt++) {
-    const owner: string | undefined = await findLiveStartupOwnerAsync(options.paths);
-    if (owner === undefined) throw lastError;
-    if (Date.now() >= deadline) {
-      throw new DaemonStartupPendingError(
-        `${lastError.message} ${owner}, so Rush was not run in-process, where it would compete with that daemon for the repository. "rush-client daemon status" reports when the daemon is ready.`,
-        { cause: lastError }
-      );
+    const owner: ILiveStartupOwner | undefined = await findLiveStartupOwnerAsync(options.paths);
+    if (owner === undefined) {
+      // This workspace's daemon can still run where no client reaches it, for example after its socket file was
+      // deleted. It cannot become ready there, but in-process Rush would still compete with it.
+      const unreachable: LiveDaemonOwnerError | undefined = findUnreachableDaemon(options.paths);
+      if (unreachable)
+        throw new DaemonStartupPendingError(describeLiveOwner(unreachable), { cause: lastError });
+      throw lastError;
+    }
+    if (Date.now() >= deadline || isStoppedListener(options.paths, lastError, owner)) {
+      throw new DaemonStartupPendingError(describePendingStartup(lastError, owner), { cause: lastError });
     }
     if (attempt === 0) {
-      options.onAwaitStartup?.(owner, deadline - Date.now());
+      options.onAwaitStartup?.(owner.description, deadline - Date.now());
     } else {
       await delayAsync(Math.min(RETRY_DELAY_MS, Math.max(1, deadline - Date.now())), undefined, {
         signal: options.abortSignal
@@ -104,6 +126,37 @@ async function awaitLiveStartupAsync(
   }
 }
 
+/**
+ * Whether the last attempt found the recorded owner stopped while it had the ownership record open, as the daemon
+ * that wrote it does, and it still is: until something resumes it, it cannot answer, so waiting would only delay the
+ * same error.
+ */
+function isStoppedListener(
+  paths: IDaemonPaths,
+  lastError: DaemonClientError,
+  owner: ILiveStartupOwner
+): boolean {
+  const stopped: IStoppedProcess | undefined =
+    lastError instanceof LiveDaemonOwnerError ? lastError.stoppedProcess : undefined;
+  return stopped !== undefined && owner.kind === 'listener' && isDaemonOwnerStillStopped(paths, stopped);
+}
+
+/**
+ * When a live process owns the daemon's files, the message leads with what that process is doing and ends with
+ * what to do about it. It then names a startup helper or a start mutex holder that it waited for, but not a
+ * listener at the endpoint: the first line already says that the daemon did not answer there.
+ */
+function describePendingStartup(lastError: DaemonClientError, owner: ILiveStartupOwner): string {
+  if (!(lastError instanceof LiveDaemonOwnerError)) {
+    return `${lastError.message} ${owner.description}, so ${NOT_RUN_IN_PROCESS} "rush-client daemon status" reports when the daemon is ready.`;
+  }
+  return describeLiveOwner(lastError, owner.kind === 'listener' ? '' : `${owner.description}, so `);
+}
+
+function describeLiveOwner(error: LiveDaemonOwnerError, reason: string = ''): string {
+  return `${error.description} ${reason}${NOT_RUN_IN_PROCESS}\n${error.hint}`;
+}
+
 /**
  * Connects to the daemon at this workspace's endpoint without starting one. When none listens but a live process
  * can still make one ready there (a listener that has not completed hello/ping yet, a recorded startup helper
@@ -126,17 +179,17 @@ export async function connectToStartingDaemonAsync(
   for (let attempt: number = 0; ; attempt++) {
     const client: DaemonClient | undefined = await tryConnectEndpointAsync(endpoint, deadline);
     if (client) return client;
-    const owner: string | undefined = await findLiveStartupOwnerAsync(options.paths);
+    const owner: ILiveStartupOwner | undefined = await findLiveStartupOwnerAsync(options.paths);
     if (owner === undefined) {
       // A startup that finished between the two checks leaves a ready daemon.
       return await tryConnectEndpointAsync(endpoint, Math.max(deadline, Date.now() + 1000));
     }
     if (Date.now() >= deadline) {
       throw new DaemonStartupPendingError(
-        `The daemon at ${options.paths.socketPath} is still starting after ${Math.round(timeoutMs / 1000)} s. ${owner}.`
+        `The daemon at ${options.paths.socketPath} is still starting after ${Math.round(timeoutMs / 1000)} s. ${owner.description}.`
       );
     }
-    if (attempt === 0) options.onAwaitStartup?.(owner, deadline - Date.now());
+    if (attempt === 0) options.onAwaitStartup?.(owner.description, deadline - Date.now());
     await delayAsync(Math.min(RETRY_DELAY_MS, Math.max(1, deadline - Date.now())), undefined, {
       signal: options.abortSignal
     });
@@ -152,10 +205,13 @@ function isStartupFailure(error: unknown): error is DaemonClientError {
  * An ownership record alone is not such evidence: a daemon publishes it only after it binds, so a record
  * next to an unbound endpoint belongs to a daemon that is shutting down or to a reused PID.
  */
-async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<string | undefined> {
+async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<ILiveStartupOwner | undefined> {
   if (!fs.existsSync(path.dirname(paths.lockfilePath))) return undefined;
   if (!(await isEndpointUnboundAsync(paths.socketPath))) {
-    return `A process listens at ${paths.socketPath} but was not ready in time`;
+    return {
+      kind: 'listener',
+      description: `A process listens at ${paths.socketPath} but was not ready in time`
+    };
   }
   let reservation: IDaemonStartupReservation | undefined;
   try {
@@ -164,7 +220,10 @@ async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<string |
     // An unreadable reservation is no evidence of a live helper.
   }
   if (reservation?.helper && getStartupHelperState(reservation) === 'running') {
-    return `Its startup helper (PID ${reservation.helper.pid}) is still waiting for the daemon`;
+    return {
+      kind: 'helper',
+      description: `Its startup helper (PID ${reservation.helper.pid}) is still waiting for the daemon`
+    };
   }
   // Without a lock file nothing holds the start mutex, and an idle `daemon stop` needs no `ps` run to tell.
   if (!isStartupLockFilePresent(paths)) return undefined;
@@ -175,7 +234,7 @@ async function findLiveStartupOwnerAsync(paths: IDaemonPaths): Promise<string |
     // A start mutex that cannot be checked is no evidence of a live starter.
     return undefined;
   }
-  if (!lock) return 'Another client is still starting the daemon';
+  if (!lock) return { kind: 'starter', description: 'Another client is still starting the daemon' };
   await lock.releaseAsync();
   return undefined;
 }
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index 1cfa5d2db3..c8eae54098 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -21,6 +21,7 @@ import {
 import { DaemonClient, type IDaemonClientConnectOptions } from './DaemonClient';
 import { DaemonClientError } from './DaemonClientError';
 import { getDaemonLogFilePath } from './DaemonLogFile';
+import { createUnresponsiveOwnerError, type IStoppedProcess } from './DaemonOwnerDiagnosis';
 import {
   DAEMON_RESET_HINT,
   hasErrorCode,
@@ -52,6 +53,7 @@ import {
   type DaemonStartupHelperState
 } from './DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
+import { findStoppedDaemonOwnerAsync } from './StoppedDaemonOwner';
 
 interface IStartupHelper {
   readonly child: ChildProcess;
@@ -143,7 +145,7 @@ async function connectOrStartAsync(
   options.abortSignal?.throwIfAborted();
   assertDaemonRuntimeFolderIsPrivate(options.paths);
   await waitForPreviousDaemonAsync(options.paths, options.previousDaemon, deadline, options.abortSignal);
-  const initial: DaemonClient | undefined = await tryConnectAsync(options, deadline);
+  const initial: DaemonClient | undefined = await tryConnectUnlessOwnerStoppedAsync(options, deadline);
   if (initial) return initial;
   if (previousStartsSuccessor && options.previousDaemon) {
     const successor: DaemonClient | undefined = await waitForPlannedSuccessorAsync(
@@ -482,6 +484,39 @@ async function replaceMismatchedDaemonAsync(
   return await tryConnectAsync(options, deadline);
 }
 
+/**
+ * Like {@link tryConnectAsync}, but when the recorded owner has the ownership record open, as the daemon that wrote
+ * it does, and a signal or a tracer keeps it stopped, it samples that process meanwhile, and throws what it is
+ * doing once it stayed stopped for 1.5 s: waiting longer for a daemon that cannot answer until something resumes
+ * it would only delay the same error. For any other owner, or none, the first sample ends the sampling, so a ready
+ * daemon or an endpoint that refuses connections costs no wait.
+ */
+async function tryConnectUnlessOwnerStoppedAsync(
+  options: IConnectOrStartDaemonOptions,
+  deadline: number
+): Promise<DaemonClient | undefined> {
+  const connecting: Promise<DaemonClient | undefined> = tryConnectAsync(options, deadline);
+  const sampling: AbortController = new AbortController();
+  const stoppedOwner: Promise<IStoppedProcess | undefined> = findStoppedDaemonOwnerAsync(
+    options.paths,
+    deadline,
+    options.abortSignal ? AbortSignal.any([options.abortSignal, sampling.signal]) : sampling.signal
+  );
+  try {
+    const client: DaemonClient | undefined = await connecting;
+    if (client) return client;
+    throwIfOwnerStopped(options.paths, await stoppedOwner);
+    return undefined;
+  } finally {
+    sampling.abort();
+    await stoppedOwner;
+  }
+}
+
+function throwIfOwnerStopped(paths: IDaemonPaths, stopped: IStoppedProcess | undefined): void {
+  if (stopped) throw createUnresponsiveOwnerError(stopped.pid, paths, undefined, stopped);
+}
+
 async function tryConnectAsync(
   options: IConnectOrStartDaemonOptions,
   deadline: number
@@ -580,6 +615,10 @@ async function waitForHandoffAsync(
       !isOwnerProcessAlive(owner)
     )
       return undefined;
+    throwIfOwnerStopped(
+      options.paths,
+      await findStoppedDaemonOwnerAsync(options.paths, deadline, options.abortSignal)
+    );
     await delayAsync(Math.min(backoffMs, Math.max(1, deadline - Date.now())), undefined, {
       signal: options.abortSignal
     });
@@ -594,10 +633,7 @@ async function waitForHandoffAsync(
 function assertNoLiveOwner(paths: IDaemonPaths): void {
   const owner: DaemonOwnership | undefined = readDaemonOwnership(paths.lockfilePath);
   if (!owner || !isOwnerProcessAlive(owner)) return;
-  throw new DaemonClientError(
-    'startupFailed',
-    `PID ${owner.pid} still exists but the daemon is not ready. It may be a daemon that is still shutting down, or a reused PID; refusing to kill it or remove ${paths.lockfilePath}. ${DAEMON_RESET_HINT}`
-  );
+  throw createUnresponsiveOwnerError(owner.pid, paths);
 }
 
 async function readHandoffOwnershipAsync(
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index e855b5640d..a4c70fd80c 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -21,10 +21,12 @@ export { DaemonClientError, type DaemonClientErrorCode } from './DaemonClientErr
 export { getDaemonLogFilePath } from './DaemonLogFile';
 export { findReclaimedDaemonPid } from './ReclaimedDaemonLog';
 export {
+  describeLiveDaemonOwner,
   resetDaemonArtifactsAsync,
   type IDaemonArtifactResetOptions,
   type IDaemonArtifactResetResult
 } from './DaemonOwnership';
+export type { DaemonOwnerHintPurpose } from './DaemonOwnerDiagnosis';
 export { assertDaemonRuntimeFolderIsPrivate } from './DaemonRuntimeFolder';
 export {
   inspectDaemonStartupReservation,
diff --git a/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts b/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
new file mode 100644
index 0000000000..304d811b0c
--- /dev/null
+++ b/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
@@ -0,0 +1,353 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameListener, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { DaemonClientError } from '../DaemonClientError';
+import {
+  createUnresponsiveOwnerError,
+  describeRecordOwner,
+  describeUnresponsiveOwner,
+  diagnoseDaemonOwner,
+  getDaemonOwnerHint,
+  getDefaultOwnerProcessReaders,
+  LiveDaemonOwnerError,
+  type IDaemonOwnerDiagnosis,
+  type IOwnerProcessReaders
+} from '../DaemonOwnerDiagnosis';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
+
+const PID: number = 4242;
+const SOCKET: string = '/run/user/1000/rush/abc.sock';
+const LOCKFILE: string = '/run/user/1000/rush/abc.pid.json';
+const PATHS: IDaemonPaths = {
+  runtimeDir: '/run/user/1000/rush',
+  socketPath: SOCKET,
+  lockfilePath: LOCKFILE
+};
+const NOW: number = Date.parse('2026-09-29T10:00:00.000Z');
+const RUSHD: string[] = ['/usr/bin/node', '/x/node_modules/@rushstack/rush-daemon/lib-commonjs/start.js'];
+const HEDGED_HINT: string = `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${LOCKFILE}. Either way, the next command then starts a new daemon.`;
+
+function readers(overrides: Partial<IOwnerProcessReaders> = {}): IOwnerProcessReaders {
+  return {
+    platform: 'linux',
+    now: () => NOW,
+    readState: () => ({ code: 'S', parentPid: 1 }),
+    readStartTimeMs: () => NOW - 3 * 60_000,
+    readCommandLine: () => RUSHD,
+    isPresent: () => true,
+    hasFileOpen: (pid: number, filePath: string) => pid === PID && filePath === LOCKFILE,
+    ...overrides
+  };
+}
+
+function diagnose(overrides: Partial<IOwnerProcessReaders> = {}): IDaemonOwnerDiagnosis {
+  return diagnoseDaemonOwner(PID, PATHS, readers(overrides));
+}
+
+function hint(diagnosis: IDaemonOwnerDiagnosis, purpose: 'use' | 'stop' = 'use'): string {
+  return getDaemonOwnerHint(diagnosis, LOCKFILE, purpose);
+}
+
+describe('diagnoseDaemonOwner', () => {
+  it('says that a signal stopped the daemon, and how to resume it', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({ readState: () => ({ code: 'T', parentPid: 1 }) });
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon, rushd (PID ${PID}), did not answer at ${SOCKET}: it is stopped (state T), for example by SIGSTOP, and it started 3 min ago.`
+    );
+    expect(hint(diagnosis)).toBe(`Resume it with "kill -CONT ${PID}"; it then serves the next command.`);
+    expect(hint(diagnosis, 'stop')).toBe(
+      `Resume it with "kill -CONT ${PID}", then run "rush-client daemon stop" again.`
+    );
+  });
+
+  it('asks a stopped daemon without a socket to exit once it resumes', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({
+      readState: () => ({ code: 'T', parentPid: 1 }),
+      isPresent: () => false
+    });
+    expect(describeRecordOwner(diagnosis, LOCKFILE)).toBe(
+      `rushd (PID ${PID}) still owns ${LOCKFILE}: its socket is missing, so no client can reach it; it is stopped (state T), for example by SIGSTOP, and it started 3 min ago.`
+    );
+    expect(hint(diagnosis, 'use')).toBe(hint(diagnosis, 'stop'));
+    expect(hint(diagnosis)).toBe(
+      `Run "kill ${PID}", then "kill -CONT ${PID}": it then cancels its running requests and exits, and the next command starts a new daemon.`
+    );
+  });
+
+  it.each([
+    [
+      't',
+      'it is stopped by a debugger or tracer (state t)',
+      'It answers once the debugger or tracer lets it run.'
+    ],
+    [
+      'D',
+      'it is waiting in the kernel (state D), for example on a slow disk or network file system',
+      'It handles no signal until that wait ends; retry then.'
+    ]
+  ])('describes state %s', (code: string, description: string, expectedHint: string) => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({ readState: () => ({ code, parentPid: 1 }) });
+    expect(diagnosis.facts).toBe(`: ${description}, and it started 3 min ago`);
+    expect(hint(diagnosis)).toBe(expectedHint);
+  });
+
+  it('names the parent that has not reaped an owner that exited', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({
+      readState: () => ({ code: 'Z', parentPid: 77 }),
+      // A zombie has no command line.
+      readCommandLine: () => undefined
+    });
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID}: it has exited, but its parent process (PID 77) has not reaped it (state Z), and it started 3 min ago.`
+    );
+    expect(hint(diagnosis)).toBe('The next command reclaims its files once PID 77 reaps it.');
+  });
+
+  it('tells a busy daemon from one that lost its socket', () => {
+    const busy: IDaemonOwnerDiagnosis = diagnose({ readState: () => ({ code: 'R', parentPid: 1 }) });
+    expect(busy.facts).toBe(': it is running (state R), and it started 3 min ago');
+    expect(hint(busy)).toBe(
+      `It may be busy or shutting down; "rush-client daemon logs" shows its last lines. "kill ${PID}" asks it to cancel its running requests and exit; the next command then starts a new daemon.`
+    );
+    const socketless: IDaemonOwnerDiagnosis = diagnose({ isPresent: () => false });
+    expect(socketless.facts).toBe(
+      `: its socket is missing, so no client can reach it; it is waiting (state S), and it started 3 min ago`
+    );
+    expect(hint(socketless)).toBe(
+      `It may exit on its own once its running requests finish; "kill ${PID}" asks it to cancel them and exit. The next command then starts a new daemon.`
+    );
+  });
+
+  it('says so when the owner is not a Rush daemon, and shows its command line', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose({ readCommandLine: () => ['sleep', '600'] });
+    expect(diagnosis.isRushDaemon).toBe(false);
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID} ("sleep 600"): it is waiting (state S), and it started 3 min ago.`
+    );
+    expect(hint(diagnosis, 'stop')).toBe(
+      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${LOCKFILE}; the next command then starts a new daemon.`
+    );
+    const long: IDaemonOwnerDiagnosis = diagnose({ readCommandLine: () => ['x'.repeat(40), 'y'.repeat(40)] });
+    expect(long.subject).toBe(`PID ${PID} ("${'x'.repeat(40)} ${'y'.repeat(16)}...")`);
+  });
+
+  it("names no signal for a Rush daemon that does not have this workspace's record open", () => {
+    for (const hasFileOpen of [(): false => false, (): undefined => undefined]) {
+      const diagnosis: IDaemonOwnerDiagnosis = diagnose({
+        readState: () => ({ code: 'T', parentPid: 1 }),
+        hasFileOpen
+      });
+      expect(diagnosis.isRushDaemon).toBe(true);
+      expect(diagnosis.isWorkspaceDaemon).toBe(false);
+      expect(describeUnresponsiveOwner(diagnosis)).toBe(
+        `The daemon did not answer at ${SOCKET}, and its ownership record names rushd (PID ${PID}): it is stopped (state T), for example by SIGSTOP, and it started 3 min ago.`
+      );
+      expect(hint(diagnosis)).toBe(HEDGED_HINT);
+      expect(hint(diagnosis, 'stop')).toBe(HEDGED_HINT);
+    }
+  });
+
+  it.each([
+    [['node', '/home/u/.rush/node-v22/@rushstack/rush-daemon/lib-commonjs/start.js'], true],
+    [
+      [
+        '/usr/bin/node',
+        '/r/common/temp/node_modules/.pnpm/@rushstack+rush-daemon@0.1.0/node_modules/@rushstack/rush-daemon/lib-commonjs/SelectedDaemonBootstrap.js',
+        '--launch',
+        '/r/package.json',
+        '5.179.0',
+        '/r'
+      ],
+      true
+    ],
+    [['node', '--max-old-space-size=4096', '/w/libraries/rush-daemon/lib-commonjs/start.js'], true],
+    [['C:\\node.exe', 'C:\\x\\rush-daemon\\lib-commonjs\\start.js'], true],
+    [['rushd'], true],
+    [['/usr/local/bin/rushd', '--foreground'], true],
+    [['node', '/w/common/temp/node_modules/.bin/rushd'], true],
+    [['node', '/home/u/src/my-rush-daemon/start.js'], false],
+    [['node', '/home/u/src/rush-daemon-protocol/lib/index.js'], false],
+    // A tool that builds or tests the rush-daemon package is not a Rush daemon.
+    [['node', '/w/libraries/rush-daemon/node_modules/.bin/../@rushstack/heft/bin/heft', 'build'], false],
+    [['node', '/w/libraries/rush-daemon/node_modules/jest/bin/jest.js'], false],
+    [
+      ['node', '/w/common/temp/heft/lib/start.js', '--cwd', '/w/libraries/rush-daemon/lib-commonjs/start.js'],
+      false
+    ],
+    [['/w/libraries/rush-daemon/node_modules/.bin/tsc'], false],
+    [['node', '/w/libraries/rush-daemon'], false],
+    [['node', '--inspect'], false],
+    [[], false]
+  ])('recognizes a Rush daemon by its command line %j', (commandLine: string[], expected: boolean) => {
+    expect(diagnose({ readCommandLine: () => commandLine }).isRushDaemon).toBe(expected);
+  });
+
+  it('reports only what it can read', () => {
+    const unknown: Partial<IOwnerProcessReaders> = {
+      readState: () => undefined,
+      readStartTimeMs: () => undefined,
+      readCommandLine: () => undefined
+    };
+    const diagnosis: IDaemonOwnerDiagnosis = diagnose(unknown);
+    expect(diagnosis.isRushDaemon).toBeUndefined();
+    expect(describeUnresponsiveOwner(diagnosis)).toBe(
+      `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID}.`
+    );
+    expect(hint(diagnosis)).toBe(HEDGED_HINT);
+    // Windows names a pipe, which leaves no file to check.
+    const windows: IDaemonOwnerDiagnosis = diagnose({
+      ...unknown,
+      platform: 'win32',
+      isPresent: () => false,
+      hasFileOpen: () => undefined
+    });
+    expect(windows.facts).toBe('');
+    expect(hint(windows, 'stop')).toBe(HEDGED_HINT);
+  });
+
+  it.each([
+    [-5000, '0 s'],
+    [59_999, '59 s'],
+    [60_000, '1 min'],
+    [3_599_999, '59 min'],
+    [2 * 3_600_000 + 5 * 60_000, '2 h 5 min']
+  ])('formats an age of %d ms as %s', (ageMs: number, expected: string) => {
+    expect(diagnose({ readStartTimeMs: () => NOW - ageMs }).facts).toBe(
+      `: it is waiting (state S), and it started ${expected} ago`
+    );
+  });
+
+  it('builds the error that a client throws when the owner did not answer', () => {
+    const error: LiveDaemonOwnerError = createUnresponsiveOwnerError(
+      PID,
+      PATHS,
+      readers({ readState: () => ({ code: 'T', parentPid: 1 }) })
+    );
+    expect(error).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect(error.code).toBe('startupFailed');
+    expect(error.message).toBe(`${error.description}\n${error.hint}`);
+    expect(error.description).toContain(
+      `rushd (PID ${PID}), did not answer at ${SOCKET}: it is stopped (state T)`
+    );
+    expect(error.hint).toContain(`kill -CONT ${PID}`);
+  });
+
+  (process.platform === 'linux' ? it : it.skip)('reads this process from /proc', () => {
+    const diagnosis: IDaemonOwnerDiagnosis = diagnoseDaemonOwner(
+      process.pid,
+      { socketPath: __filename, lockfilePath: __filename },
+      getDefaultOwnerProcessReaders()
+    );
+    expect(diagnosis.isRushDaemon).toBe(false);
+    expect(diagnosis.isWorkspaceDaemon).toBe(false);
+    expect(diagnosis.isSocketMissing).toBe(false);
+    expect(diagnosis.subject).toMatch(new RegExp(`^PID ${process.pid} \\(".+"\\)$`));
+    expect(diagnosis.facts).toMatch(
+      /^: it is (running|waiting) \(state [RS]\), and it started \d+ (s|min) ago$/
+    );
+  });
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'proves from /proc which process has a daemon ownership record open',
+    async () => {
+      const { hasFileOpen } = getDefaultOwnerProcessReaders();
+      const folder: string = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'rush-owner-'));
+      const link: string = `${folder}-link`;
+      await fs.promises.symlink(folder, link);
+      const paths: IDaemonPaths = {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'd.pid.json')
+      };
+      const otherFile: string = path.join(folder, 'other.pid.json');
+      await fs.promises.writeFile(otherFile, '');
+      let listener: DaemonFrameListener | undefined;
+      let other: ChildProcess | undefined;
+      try {
+        // As rushd does: it publishes its socket, then writes its record and keeps it open.
+        listener = await DaemonFrameListener.listenAsync(paths, {
+          protocolVersion: DAEMON_PROTOCOL_VERSION,
+          onConnection: () => undefined
+        });
+        expect(hasFileOpen(process.pid, paths.lockfilePath)).toBe(true);
+        // The kernel names the file by its real path.
+        expect(hasFileOpen(process.pid, path.join(link, 'd.pid.json'))).toBe(true);
+        expect(hasFileOpen(process.pid, otherFile)).toBe(false);
+        await fs.promises.unlink(paths.socketPath);
+        expect(hasFileOpen(process.pid, paths.lockfilePath)).toBe(true);
+        // Another process, which has another file open.
+        other = spawn(
+          process.execPath,
+          [
+            '-e',
+            "require('node:fs').openSync(process.argv[1], 'r'); console.log('open'); setInterval(() => {}, 1000)",
+            otherFile
+          ],
+          { stdio: ['ignore', 'pipe', 'ignore'] }
+        );
+        await once(other.stdout!, 'data');
+        expect(hasFileOpen(other.pid!, otherFile)).toBe(true);
+        expect(hasFileOpen(other.pid!, paths.lockfilePath)).toBe(false);
+        // A file that took the record's path later is not the one that this process has open.
+        await fs.promises.unlink(paths.lockfilePath);
+        await fs.promises.writeFile(paths.lockfilePath, '{}');
+        expect(hasFileOpen(process.pid, paths.lockfilePath)).toBe(false);
+      } finally {
+        await listener?.closeAsync();
+        if (other && other.exitCode === null && other.signalCode === null) {
+          const exited: Promise<unknown> = once(other, 'exit');
+          // Only the process that this test started, by its PID.
+          other.kill('SIGKILL');
+          await exited;
+        }
+      }
+      expect(hasFileOpen(process.pid, otherFile)).toBe(false);
+      expect(hasFileOpen(process.pid, path.join(folder, 'missing'))).toBeUndefined();
+      await fs.promises.rm(link);
+      await fs.promises.rm(folder, { recursive: true, force: true });
+    }
+  );
+
+  // A failed command can load the daemon launcher only after the diagnosis found the socket.
+  (process.platform === 'win32' ? it.skip : it)(
+    'leaves require() resolving symlinks after it finds the socket',
+    async () => {
+      // Short, as a socket path must be.
+      const folder: string = await fs.promises.mkdtemp('/tmp/rush-owner-require-');
+      try {
+        const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+          folder,
+          [
+            "const net = require('node:net');",
+            'const [modulePath, socketPath, lockfilePath] = args;',
+            'const server = net.createServer();',
+            'await new Promise((resolve) => server.listen(socketPath, resolve));',
+            'const { diagnoseDaemonOwner } = require(modulePath);',
+            "const paths = { runtimeDir: '', socketPath, lockfilePath };",
+            'process.stdout.write(`${diagnoseDaemonOwner(process.pid, paths).isSocketMissing} `);',
+            'server.close();'
+          ].join('\n'),
+          [
+            require.resolve('../DaemonOwnerDiagnosis'),
+            path.join(folder, 'd.sock'),
+            path.join(folder, 'd.pid.json')
+          ]
+        );
+
+        expect(result).toEqual({ status: 0, stdout: 'false found', stderr: '' });
+      } finally {
+        await fs.promises.rm(folder, { recursive: true, force: true });
+      }
+    }
+  );
+});
diff --git a/libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts b/libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts
new file mode 100644
index 0000000000..e5b05dccdb
--- /dev/null
+++ b/libraries/rush-client-core/src/test/StoppedDaemonOwner.test.ts
@@ -0,0 +1,220 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import type { IOwnerProcessReaders, IStoppedProcess } from '../DaemonOwnerDiagnosis';
+import type { IProcessState } from '../ProcessStartTime';
+import {
+  findStoppedDaemonOwnerAsync,
+  isDaemonOwnerStillStopped,
+  STOPPED_OWNER_WINDOW_MS
+} from '../StoppedDaemonOwner';
+import { recordDaemonOwner } from './OrphanedOperation';
+
+const START_TICKS: number = 4242;
+const STOPPED: IProcessState = { code: 'T', parentPid: 1, startTicks: START_TICKS };
+const TRACED: IProcessState = { code: 't', parentPid: 1, startTicks: START_TICKS };
+const WAITING: IProcessState = { code: 'S', parentPid: 1, startTicks: START_TICKS };
+
+describe('StoppedDaemonOwner', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-stopped-owner-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    // The record names this live process; the readers say what it is doing.
+    recordDaemonOwner(paths, process.pid);
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  /** A `readState` that returns `states` in turn, and then the last one. */
+  function statesReader(
+    states: ReadonlyArray<IProcessState | undefined>
+  ): jest.Mock<IProcessState | undefined, [number]> {
+    let next: number = 0;
+    return jest.fn((pid: number) => states[Math.min(next++, states.length - 1)]);
+  }
+
+  function readers(overrides: Partial<IOwnerProcessReaders> = {}): IOwnerProcessReaders {
+    return {
+      platform: 'linux',
+      now: Date.now,
+      readState: () => STOPPED,
+      readStartTimeMs: () => undefined,
+      readCommandLine: () => undefined,
+      isPresent: () => true,
+      hasFileOpen: (pid: number, filePath: string) => pid === process.pid && filePath === paths.lockfilePath,
+      ...overrides
+    };
+  }
+
+  async function findAsync(
+    overrides: Partial<IOwnerProcessReaders>,
+    deadline: number = Date.now() + 15000,
+    signal?: AbortSignal
+  ): Promise<{ stopped: IStoppedProcess | undefined; elapsedMs: number }> {
+    const start: number = Date.now();
+    const stopped: IStoppedProcess | undefined = await findStoppedDaemonOwnerAsync(
+      paths,
+      deadline,
+      signal,
+      readers(overrides)
+    );
+    return { stopped, elapsedMs: Date.now() - start };
+  }
+
+  describe('findStoppedDaemonOwnerAsync', () => {
+    it('finds an owner that has the record open and stays stopped for the whole window', async () => {
+      const readState: jest.Mock = statesReader([STOPPED]);
+
+      const { stopped, elapsedMs } = await findAsync({ readState });
+
+      expect(stopped).toEqual({ pid: process.pid, startTicks: START_TICKS });
+      expect(elapsedMs).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS);
+      expect(readState.mock.calls.length).toBeGreaterThanOrEqual(3);
+      expect(readState.mock.calls.every(([pid]) => pid === process.pid)).toBe(true);
+    });
+
+    it('finds an owner that a tracer keeps stopped (state t)', async () => {
+      expect((await findAsync({ readState: () => TRACED })).stopped).toEqual({
+        pid: process.pid,
+        startTicks: START_TICKS
+      });
+    });
+
+    it('ends at the first sample that shows the owner resumed', async () => {
+      const readState: jest.Mock = statesReader([STOPPED, STOPPED, STOPPED, WAITING, STOPPED]);
+
+      const { stopped, elapsedMs } = await findAsync({ readState });
+
+      expect(stopped).toBeUndefined();
+      expect(readState).toHaveBeenCalledTimes(4);
+      expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+    });
+
+    it('ends when the PID names a process with another start time', async () => {
+      const readState: jest.Mock = statesReader([
+        STOPPED,
+        STOPPED,
+        { ...STOPPED, startTicks: START_TICKS + 1 }
+      ]);
+
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      expect(readState).toHaveBeenCalledTimes(3);
+    });
+
+    it('ends when a sample cannot be read', async () => {
+      const readState: jest.Mock = statesReader([STOPPED, undefined, STOPPED]);
+
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      expect(readState).toHaveBeenCalledTimes(2);
+    });
+
+    it('does not sample an owner that is not stopped or whose start time is unknown', async () => {
+      for (const state of [WAITING, { code: 'T', parentPid: 1 }, undefined]) {
+        const readState: jest.Mock = statesReader([state, STOPPED]);
+        const hasFileOpen: jest.Mock = jest.fn(() => true);
+
+        const { stopped, elapsedMs } = await findAsync({ readState, hasFileOpen });
+
+        expect(stopped).toBeUndefined();
+        expect(readState).toHaveBeenCalledTimes(1);
+        expect(hasFileOpen).not.toHaveBeenCalled();
+        expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+      }
+    });
+
+    it('does not sample an owner that does not provably have the record open', async () => {
+      // For example the daemon of another workspace, whose PID an old record names, or no /proc/<pid>/fd.
+      for (const isOpen of [false, undefined]) {
+        const readState: jest.Mock = statesReader([STOPPED]);
+        const hasFileOpen: jest.Mock = jest.fn(() => isOpen);
+
+        const { stopped, elapsedMs } = await findAsync({ readState, hasFileOpen });
+
+        expect(stopped).toBeUndefined();
+        expect(hasFileOpen.mock.calls).toEqual([[process.pid, paths.lockfilePath]]);
+        expect(readState).toHaveBeenCalledTimes(1);
+        expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+      }
+    });
+
+    it('needs a readable record that names a live process', async () => {
+      const readState: jest.Mock = statesReader([STOPPED]);
+
+      fs.unlinkSync(paths.lockfilePath);
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      fs.writeFileSync(paths.lockfilePath, 'not json');
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+      const exitedPid: number = spawnSync(process.execPath, ['-e', '']).pid;
+      recordDaemonOwner(paths, exitedPid);
+      expect((await findAsync({ readState })).stopped).toBeUndefined();
+
+      expect(readState).not.toHaveBeenCalled();
+    });
+
+    it('does not sample when less than the window remains before the deadline', async () => {
+      const readState: jest.Mock = statesReader([STOPPED]);
+
+      const { stopped } = await findAsync({ readState }, Date.now() + STOPPED_OWNER_WINDOW_MS - 100);
+
+      expect(stopped).toBeUndefined();
+      expect(readState).not.toHaveBeenCalled();
+    });
+
+    it('stops sampling once the signal aborts', async () => {
+      const aborted: AbortController = new AbortController();
+      aborted.abort();
+      expect((await findAsync({}, undefined, aborted.signal)).stopped).toBeUndefined();
+
+      const later: AbortController = new AbortController();
+      setTimeout(() => later.abort(), 200);
+      const { stopped, elapsedMs } = await findAsync({}, undefined, later.signal);
+
+      expect(stopped).toBeUndefined();
+      expect(elapsedMs).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+    });
+  });
+
+  describe('isDaemonOwnerStillStopped', () => {
+    const stopped: IStoppedProcess = { pid: process.pid, startTicks: START_TICKS };
+
+    it('holds while the record names the same stopped process, which has the record open', () => {
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers())).toBe(true);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ readState: () => TRACED }))).toBe(true);
+    });
+
+    it('ends once that process resumes, exits or no longer has the record open, or the record changes', () => {
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ readState: () => WAITING }))).toBe(false);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ readState: () => undefined }))).toBe(false);
+      expect(
+        isDaemonOwnerStillStopped(
+          paths,
+          stopped,
+          readers({ readState: () => ({ ...STOPPED, startTicks: START_TICKS + 1 }) })
+        )
+      ).toBe(false);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ hasFileOpen: () => false }))).toBe(false);
+
+      // The record names another live process, even one that is stopped and has the record open.
+      recordDaemonOwner(paths, process.ppid);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers({ hasFileOpen: () => true }))).toBe(false);
+      fs.unlinkSync(paths.lockfilePath);
+      expect(isDaemonOwnerStillStopped(paths, stopped, readers())).toBe(false);
+    });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 0022b545b4..0b68abce4a 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -1786,10 +1786,12 @@ describe('detached daemon startup', () => {
   it('never reclaims a live PID that may still own the record', async () => {
     const record: string = JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
     fs.writeFileSync(paths.lockfilePath, record);
-    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('or a reused PID');
-    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow('daemon stop --force');
+    // The error names that process and says when removing the record is safe.
+    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow(`PID ${process.pid}`);
+    await expect(connectOrStartDaemonAsync(options)).rejects.toThrow(`delete ${paths.lockfilePath}`);
     expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
-    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow(`PID ${process.pid} still owns`);
+    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow(`still owns ${paths.lockfilePath}`);
+    await expect(resetDaemonArtifactsAsync(paths)).rejects.toThrow('No process was killed.');
     expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
   });
 
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
new file mode 100644
index 0000000000..f895b5cc33
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
@@ -0,0 +1,448 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import { DaemonClientError } from '../DaemonClientError';
+import { LiveDaemonOwnerError } from '../DaemonOwnerDiagnosis';
+import { describeLiveDaemonOwner, resetDaemonArtifactsAsync } from '../DaemonOwnership';
+import { DaemonStartupPendingError, connectOrAwaitDaemonStartupAsync } from '../connectOrAwaitDaemonStartup';
+import type { IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { STOPPED_OWNER_WINDOW_MS } from '../StoppedDaemonOwner';
+import { recordDaemonOwner } from './OrphanedOperation';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+const NOT_RUN_IN_PROCESS: string =
+  'Rush was not run in-process, where it would compete with that daemon for the repository.';
+
+/** Listens as rushd does, with the paths in its last argument, and never answers. */
+const FAKE_DAEMON_SCRIPT: string = [
+  'const [transport, protocol, paths] = process.argv.slice(2);',
+  'require(transport)',
+  '  .DaemonFrameListener.listenAsync(JSON.parse(paths), {',
+  '    protocolVersion: require(protocol).DAEMON_PROTOCOL_VERSION,',
+  '    onConnection: () => undefined',
+  '  })',
+  "  .then(() => console.log('listening'));",
+  ''
+].join('\n');
+
+async function rejectionOf(promise: Promise<unknown>): Promise<Error> {
+  return await promise.then(
+    () => new Error('Expected a rejection.'),
+    (error: Error) => error
+  );
+}
+
+function readState(pid: number): string | undefined {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  return stat.slice(stat.lastIndexOf(')') + 2)[0];
+}
+
+/** Field 22 of `/proc/<pid>/stat`: when the process started, in clock ticks after boot. */
+function readStartTicks(pid: number): number {
+  const stat: string = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+  return Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19]);
+}
+
+async function waitForStateAsync(pid: number, code: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (readState(pid) !== code) {
+    if (Date.now() >= deadline) throw new Error(`PID ${pid} did not reach state ${code}.`);
+    await delayAsync(10);
+  }
+}
+
+async function waitForFileAsync(filePath: string): Promise<void> {
+  const deadline: number = Date.now() + 10000;
+  while (!fs.existsSync(filePath)) {
+    if (Date.now() >= deadline) throw new Error(`${filePath} was not written.`);
+    await delayAsync(10);
+  }
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Unlinks the sockets that killed daemons left in `folder`, without a stat: after a plain stat of a socket, which
+ * removing the folder would make, the next `require()` in this process could fail to find a package's dependencies
+ * (nodejs/node#65113).
+ */
+function unlinkSockets(folder: string): void {
+  for (const entry of fs.readdirSync(folder, { withFileTypes: true })) {
+    if (entry.isSocket()) fs.unlinkSync(path.join(folder, entry.name));
+  }
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit. It needs
+// /proc to tell what the live owner is doing.
+(process.platform === 'linux' ? describe : describe.skip)('a live daemon owner that does not answer', () => {
+  let folder: string;
+  let paths: IDaemonPaths;
+  let options: IConnectOrStartDaemonOptions;
+  let children: ChildProcess[];
+
+  beforeEach(() => {
+    children = [];
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-live-owner-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 1500,
+      timeoutMs: 200,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    for (const child of children) {
+      if (child.exitCode !== null || child.signalCode !== null) continue;
+      // Only this test's own children, by their PIDs: resume a stopped one so that it can exit.
+      process.kill(child.pid!, 'SIGCONT');
+      child.kill('SIGKILL');
+      await waitForTestProcessExitAsync(child.pid!);
+    }
+    // No daemon was started or replaced.
+    expect(fs.existsSync(path.join(folder, 'starts'))).toBe(false);
+    unlinkSockets(folder);
+    await removeTestFolderAsync(folder);
+  });
+
+  /**
+   * A process whose command line looks like rushd's, which listens as rushd does with `daemonPaths` (by default
+   * this workspace's), but never answers: it binds its socket under a private name, links the endpoint to it,
+   * then writes its ownership record and keeps it open. Its listen backlog accepts connections even while a
+   * signal stops it.
+   */
+  async function startFakeDaemonAsync(daemonPaths: IDaemonPaths = paths): Promise<number> {
+    const script: string = path.join(folder, 'rush-daemon', 'fake.js');
+    fs.mkdirSync(path.dirname(script), { recursive: true });
+    fs.writeFileSync(script, FAKE_DAEMON_SCRIPT);
+    const child: ChildProcess = await startChildAsync(process.execPath, [
+      script,
+      require.resolve('@rushstack/rush-daemon-transport'),
+      require.resolve('@rushstack/rush-daemon-protocol'),
+      JSON.stringify(daemonPaths)
+    ]);
+    await once(child.stdout!, 'data');
+    return child.pid!;
+  }
+
+  /** The paths of another workspace's daemon, in the same runtime folder. */
+  function getOtherWorkspacePaths(): IDaemonPaths {
+    return {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'other.sock'),
+      lockfilePath: path.join(folder, 'other.pid.json')
+    };
+  }
+
+  async function startChildAsync(command: string, args: string[]): Promise<ChildProcess> {
+    const child: ChildProcess = spawn(command, args, { stdio: ['ignore', 'pipe', 'ignore'] });
+    children.push(child);
+    await once(child, 'spawn');
+    return child;
+  }
+
+  async function stopChildAsync(pid: number): Promise<void> {
+    process.kill(pid, 'SIGSTOP');
+    await waitForStateAsync(pid, 'T');
+  }
+
+  function resumeHint(pid: number): string {
+    return `Resume it with "kill -CONT ${pid}"; it then serves the next command.`;
+  }
+
+  it('says that a signal stopped the daemon and how to resume it, without running Rush in-process', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+    const onAwaitStartup: jest.Mock = jest.fn();
+
+    // A deadline shorter than the 1.5 s for which a client samples a stopped daemon leaves no time to sample
+    // it, so this waits for two such deadlines, as a client did before it sampled.
+    const error: Error = await rejectionOf(
+      connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 1000, onAwaitStartup })
+    );
+
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error).not.toBeInstanceOf(DaemonClientError);
+    expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\. ${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(resumeHint(pid));
+    expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toBeUndefined();
+    expect(onAwaitStartup.mock.calls).toEqual([
+      [`A process listens at ${paths.socketPath} but was not ready in time`, expect.any(Number)]
+    ]);
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  it('stops waiting for a daemon that stays stopped, without running Rush in-process', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const start: number = Date.now();
+
+    const error: Error = await rejectionOf(
+      connectOrAwaitDaemonStartupAsync({
+        ...options,
+        startupTimeoutMs: 15000,
+        timeoutMs: 2000,
+        onAwaitStartup
+      })
+    );
+
+    // The first connection attempt times out after 2 s, and the 1.5 s for which the client samples the daemon
+    // overlap it. Sampling after that attempt would take about 3.5 s; not sampling, two 15 s deadlines.
+    const elapsedMs: number = Date.now() - start;
+    expect(elapsedMs).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS);
+    expect(elapsedMs).toBeLessThan(3000);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
+    expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toEqual({
+      pid,
+      startTicks: readStartTicks(pid)
+    });
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\. ${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n${escapeRegExp(resumeHint(pid))}$`
+      )
+    );
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  it('stops waiting once a signal stops the daemon that it waits for', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const start: number = Date.now();
+
+    const rejected: Promise<Error> = rejectionOf(
+      connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 10000, onAwaitStartup })
+    );
+    await delayAsync(500);
+    await stopChildAsync(pid);
+    const error: Error = await rejected;
+
+    // Well before its first 10 s deadline.
+    expect(Date.now() - start).toBeLessThan(7000);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toEqual({
+      pid,
+      startTicks: readStartTicks(pid)
+    });
+    expect(error.message.split('\n')[1]).toBe(resumeHint(pid));
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+  }, 30000);
+
+  it('keeps waiting for another client that holds the start mutex while the owner stays stopped', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+    // The daemon still runs, with its record open, but nothing listens at the endpoint.
+    fs.unlinkSync(paths.socketPath);
+    await startChildAsync(process.execPath, [
+      path.join(__dirname, 'fixtures/startLockHolder.js'),
+      JSON.stringify(paths)
+    ]);
+    await waitForFileAsync(path.join(folder, 'lock-held'));
+    const onAwaitStartup: jest.Mock = jest.fn();
+    const start: number = Date.now();
+
+    const error: Error = await rejectionOf(
+      connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 3000, onAwaitStartup })
+    );
+
+    // Only a stopped owner at the endpoint ends the wait early: that client may still start a daemon.
+    expect(Date.now() - start).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS + 2500);
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error.message).toContain(
+      'Another client is still starting the daemon, so Rush was not run in-process'
+    );
+    expect(onAwaitStartup.mock.calls).toEqual([
+      ['Another client is still starting the daemon', expect.any(Number)]
+    ]);
+    fs.writeFileSync(path.join(folder, 'release-lock'), '');
+  }, 30000);
+
+  it('keeps waiting while the stopped process that the record names does not have the record open', async () => {
+    // This process listens at the endpoint without answering. The process that this workspace's record names,
+    // stopped, is another workspace's daemon, which has only its own record open.
+    const server: net.Server = net.createServer((socket: net.Socket) => socket.on('error', () => undefined));
+    server.listen(paths.socketPath);
+    await once(server, 'listening');
+    try {
+      const pid: number = await startFakeDaemonAsync(getOtherWorkspacePaths());
+      await stopChildAsync(pid);
+      recordDaemonOwner(paths, pid);
+      const onAwaitStartup: jest.Mock = jest.fn();
+
+      const error: Error = await rejectionOf(
+        connectOrAwaitDaemonStartupAsync({ ...options, startupTimeoutMs: 3000, onAwaitStartup })
+      );
+
+      expect(error).toBeInstanceOf(DaemonStartupPendingError);
+      expect(error.message).toMatch(
+        new RegExp(
+          `^The daemon did not answer at ${escapeRegExp(paths.socketPath)}, and its ownership record names rushd \\(PID ${pid}\\): it is stopped \\(state T\\)`
+        )
+      );
+      expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toBeUndefined();
+      expect(onAwaitStartup).toHaveBeenCalledTimes(1);
+    } finally {
+      server.close();
+    }
+  }, 30000);
+
+  it('does not run Rush in-process beside a daemon that lost its socket', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    // The daemon still runs, with its record open, but no client can reach it.
+    fs.unlinkSync(paths.socketPath);
+    const onAwaitStartup: jest.Mock = jest.fn();
+
+    const error: Error = await rejectionOf(connectOrAwaitDaemonStartupAsync({ ...options, onAwaitStartup }));
+
+    // Nothing can make the daemon ready, but it still runs, so the caller must not run Rush in-process.
+    expect(error).toBeInstanceOf(DaemonStartupPendingError);
+    expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started \\d+ s ago\\. ${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
+    );
+    expect(onAwaitStartup).not.toHaveBeenCalled();
+    expect(readDaemonRecordPid()).toBe(pid);
+  }, 30000);
+
+  it("names no signal to send to a daemon that does not have this workspace's record open", async () => {
+    // For example the daemon of another workspace, whose PID an old record of this workspace names: it has only its
+    // own record open. Nothing shows that it is this workspace's daemon, so the caller may run Rush in-process.
+    const pid: number = await startFakeDaemonAsync(getOtherWorkspacePaths());
+    await stopChildAsync(pid);
+    recordDaemonOwner(paths, pid);
+
+    const error: Error = await rejectionOf(connectOrAwaitDaemonStartupAsync(options));
+
+    expect(error).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon did not answer at ${escapeRegExp(paths.socketPath)}, and its ownership record names rushd \\(PID ${pid}\\): its socket is missing, so no client can reach it; it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon.`
+    );
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
+  it('names the parent that has not reaped an owner that exited', async () => {
+    // "sleep 0" exits at once, and the shell, now "sleep 600", never reaps it.
+    const parent: ChildProcess = await startChildAsync('sh', ['-c', 'sleep 0 & echo $!; exec sleep 600']);
+    const [output] = await once(parent.stdout!, 'data');
+    const zombie: number = Number(String(output));
+    await waitForStateAsync(zombie, 'Z');
+    recordDaemonOwner(paths, zombie);
+
+    const error: Error = await rejectionOf(connectOrAwaitDaemonStartupAsync(options));
+
+    expect(error).toBeInstanceOf(LiveDaemonOwnerError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^The daemon did not answer at ${escapeRegExp(paths.socketPath)}, and its ownership record names PID ${zombie}: its socket is missing, so no client can reach it; it has exited, but its parent process \\(PID ${parent.pid}\\) has not reaped it \\(state Z\\), and it started \\d+ s ago\\.\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `The next command reclaims its files once PID ${parent.pid} reaps it.`
+    );
+
+    // Once that parent is gone, another process reaps it, and it no longer owns anything.
+    const exited: Promise<unknown> = once(parent, 'exit');
+    parent.kill('SIGKILL');
+    await exited;
+    const deadline: number = Date.now() + 5000;
+    while (fs.existsSync(`/proc/${zombie}`)) {
+      if (Date.now() >= deadline) throw new Error(`PID ${zombie} was not reaped.`);
+      await delayAsync(10);
+    }
+    expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
+  }, 30000);
+
+  it('names a process that is not a daemon when a reset refuses to remove its record', async () => {
+    const pid: number = (await startChildAsync('sleep', ['600'])).pid!;
+    recordDaemonOwner(paths, pid);
+
+    const error: Error = await rejectionOf(resetDaemonArtifactsAsync(paths));
+
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect(error.message).toMatch(
+      new RegExp(
+        `^PID ${pid} \\("sleep 600"\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is waiting \\(state S\\), and it started \\d+ s ago\\. No process was killed\\.\\n`
+      )
+    );
+    expect(error.message.split('\n')[1]).toBe(
+      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${paths.lockfilePath}; the next command then starts a new daemon.`
+    );
+    expect(readDaemonRecordPid()).toBe(pid);
+    expect(readState(pid)).toBe('S');
+  });
+
+  it('describes the live owner for a command that could not stop the daemon', async () => {
+    expect(describeLiveDaemonOwner(paths, 'stop')).toBeUndefined();
+    const pid: number = await startFakeDaemonAsync();
+    await stopChildAsync(pid);
+
+    expect(describeLiveDaemonOwner(paths, 'stop')).toMatch(
+      new RegExp(
+        `^rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\nResume it with "kill -CONT ${pid}", then run "rush-client daemon stop" again\\.$`
+      )
+    );
+
+    // Nothing to describe once that process is gone (and reaped), or when the record cannot be read.
+    const child: ChildProcess = children[0];
+    const exited: Promise<unknown> = once(child, 'exit');
+    process.kill(pid, 'SIGCONT');
+    child.kill('SIGKILL');
+    await exited;
+    expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
+    fs.writeFileSync(paths.lockfilePath, 'not json');
+    expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
+  });
+
+  function readDaemonRecordPid(): number {
+    return JSON.parse(fs.readFileSync(paths.lockfilePath, 'utf8')).pid;
+  }
+});
diff --git a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
index c64a429c1b..5a2a2b2503 100644
--- a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
+++ b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
@@ -143,7 +143,7 @@ jest.setTimeout(30_000);
             environment: fixture.environment
           }
         })
-      ).rejects.toThrow(/still exists|deadline/);
+      ).rejects.toThrow(/did not answer|deadline/);
       expect(fs.existsSync(marker)).toBe(false);
       expect(readDaemonLockfile(fixture.host.paths.lockfilePath)).toEqual(originalOwner);
       expect(

From 1ef258f07e04ad5c978745a418156b00bcfb67e1 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:32 +0000
Subject: [PATCH 193/265] [rush-lib] Fail a lock-wait test that never stops
 trying instead of hanging Jest

Swarm integration step 178; original commit 0052544761 (merge of swarm/o04-t245-nit1 at 3543843763).
Scope: task 245, NIT 1.

Brings 245-nit1 (branch swarm/o04-t245-nit1). Second agent: r04 board 6056. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 12 of 17. Gate: ch01 GATE OK board 6389 (tree 47e7bee143)

Commits folded into this step (3):
- 66af75ee6f Wait for the repository lock when rush-client runs a command in-process after it tried the daemon, and name the holder (task 245)
- 6fb1d10df0 Test that an engine host leaves the lock wait alone, and keep a failing released-lock test from ending its file (task 245)
- 3543843763 Fail a lock-wait test that never stops trying instead of hanging Jest

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  16 +-
 apps/rush-cli-client/src/inProcessLockWait.ts |  49 ++++
 apps/rush-cli-client/src/launchClient.ts      |  44 +++-
 apps/rush-cli-client/src/lazyRushModules.ts   |   5 +
 .../src/test/inProcessLockWait.test.ts        | 218 +++++++++++++++++
 ...y-lock-wait-test-cap_2026-09-29-15-40.json |  11 +
 ...in-process-lock-wait_2026-09-29-13-55.json |  11 +
 ...in-process-lock-wait_2026-09-29-13-55.json |  11 +
 common/reviews/api/rush-lib.api.md            |   2 +
 .../src/api/EnvironmentConfiguration.ts       |  14 ++
 .../rush-lib/src/cli/RushCommandLineParser.ts |   8 +
 .../src/cli/actions/BaseRushAction.ts         |  14 +-
 .../cli/test/RushCommandLineParser.test.ts    | 145 ++++++++++-
 .../rush-lib/src/logic/RepositoryLockWait.ts  | 182 ++++++++++++++
 .../src/logic/test/RepositoryLockWait.test.ts | 229 ++++++++++++++++++
 15 files changed, 947 insertions(+), 12 deletions(-)
 create mode 100644 apps/rush-cli-client/src/inProcessLockWait.ts
 create mode 100644 apps/rush-cli-client/src/test/inProcessLockWait.test.ts
 create mode 100644 common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json
 create mode 100644 common/changes/@microsoft/rush/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json
 create mode 100644 libraries/rush-lib/src/logic/RepositoryLockWait.ts
 create mode 100644 libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 93a0410b03..d367cd7b81 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -86,6 +86,19 @@ daemon that still runs after its socket file was deleted also fails the command
 and without running Rush in-process, once the client has waited 15 seconds for it to exit; its last line
 says that it may exit once its running requests finish.
 
+When the client runs Rush in-process after it tried the daemon, because it could not reach one or because the
+daemon handed the request back, and another Rush process holds the repository's lock, such as the daemon while it
+builds for another request, Rush waits for the lock instead of failing at once with "Another Rush command is
+already running in this repository." It waits only for what is left of the request's wait timeout (see below),
+counted from when the client sent the request, or from when it gave up on the daemon if it could not reach one;
+the built-in 30-second default applies. It writes one stderr line when it starts to wait (`Waiting up to 28 s for
+the Rush daemon (PID 4242) to release this repository's lock.`). If the lock is still held at the deadline, the
+command fails as before, and the error names the holder (`The Rush daemon (PID 4242) still holds this repository's
+lock.`). With `--no-wait` or a zero timeout, Rush tries once and names the holder. On Windows the lock file does not
+name a process, so Rush says "another Rush process". Rush that routing keeps in-process (such as `--no-daemon`,
+`RUSH_DAEMON=0` or CI), `rushx-client`, and a workspace that selects another Rush release than the one the client
+bundles fail at once, as native Rush does.
+
 `--no-wait` fails immediately when daemon admission is unavailable.
 `--wait-timeout SECONDS` (or `--wait-timeout=SECONDS`) overrides the configured queue
 timeout; finite nonnegative decimal seconds up to 2147483.647 are accepted and
@@ -138,7 +151,8 @@ these and of a timeout names the process. A request never waits for a lock that
 daemon itself holds for another request: it fails at once, as before.
 
 Admission controls also apply to experimental graph requests, but not
-`start|stop|restart|status|logs`. They affect daemon admission only; native fallback
+`start|stop|restart|status|logs`. They affect daemon admission, and how long Rush that runs in-process after
+the client tried the daemon waits for the repository's lock (see above); otherwise native fallback
 retains native command behavior. Waiting positions are shown on interactive stderr,
 and a wait for a daemon restart (see below) or for another Rush process on a pipe
 too. Admission failures report their typed reason and a nonzero exit code.
diff --git a/apps/rush-cli-client/src/inProcessLockWait.ts b/apps/rush-cli-client/src/inProcessLockWait.ts
new file mode 100644
index 0000000000..404a2b82af
--- /dev/null
+++ b/apps/rush-cli-client/src/inProcessLockWait.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestAdmissionOptions } from '@rushstack/rush-daemon-protocol';
+
+import { loadEnvironmentConfiguration } from './lazyRushModules';
+
+/**
+ * How long Rush, when the client runs it in-process after it tried the daemon, waits for another Rush process to
+ * release the repository's lock, instead of failing at once as it does when it runs without the client.
+ */
+export interface IInProcessLockWait {
+  /**
+   * When the request's wait began, in milliseconds since the Unix epoch: when the client sent the request to the
+   * daemon, or, if the client could not reach a daemon, when it gave up on the daemon.
+   */
+  readonly startedAtMs: number;
+  /** The request's admission options, whose wait timeout also ends the wait for the lock. */
+  readonly admission: IDaemonRequestAdmissionOptions | undefined;
+  /** The process ID of the daemon that handed the command back, so that Rush can name it if it holds the lock. */
+  readonly daemonPid: number | undefined;
+}
+
+/**
+ * Returns the time until which Rush waits for the repository's lock: the request's wait timeout after its wait began,
+ * so that the time that the request already waited on the daemon counts. With `--no-wait` or a zero timeout, Rush
+ * tries once, as it does without the client, and names the process that holds the lock.
+ */
+export function getInProcessLockWaitDeadlineMs(wait: IInProcessLockWait): number {
+  const { admission, startedAtMs } = wait;
+  // The client always sends a timeout unless it sends noWait.
+  const waitTimeoutMs: number = admission?.noWait ? 0 : (admission?.waitTimeoutMs ?? 0);
+  return Math.floor(startedAtMs + waitTimeoutMs);
+}
+
+/**
+ * Asks the Rush that the client runs in-process to wait for the repository's lock. Rush reads and removes these
+ * variables when it starts, so its operations do not inherit them. Only the Rush release that the client bundles
+ * reads them.
+ */
+export function setInProcessLockWait(environment: NodeJS.ProcessEnv, wait: IInProcessLockWait): void {
+  const { EnvironmentVariableNames } = loadEnvironmentConfiguration();
+  environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE] = `${getInProcessLockWaitDeadlineMs(wait)}`;
+  if (wait.daemonPid === undefined) {
+    delete environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID];
+  } else {
+    environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID] = `${wait.daemonPid}`;
+  }
+}
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 33ab8a2f74..834283dc35 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -18,7 +18,8 @@ import {
   reclaimCrashedDaemonAsync,
   type DaemonClient,
   type DaemonClientOutcome,
-  type IConnectOrStartDaemonOptions
+  type IConnectOrStartDaemonOptions,
+  type IDaemonRestartNotice
 } from '@rushstack/rush-client-core';
 import type { DaemonVerbosity, IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
@@ -50,6 +51,7 @@ import {
   type IDaemonRequestNoticeHandlers
 } from './daemonRestartNotice';
 import { formatInProcessFallbackMessage } from './inProcessFallback';
+import { setInProcessLockWait, type IInProcessLockWait } from './inProcessLockWait';
 import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
 import {
   getBundledRushVersion,
@@ -205,7 +207,12 @@ export async function launchClientAsync(
     agentRenderer?.dispose();
     output.release();
     process.stderr.write(formatInProcessFallbackMessage(error.message, clientName));
-    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
+    // No daemon admitted the request, so its whole wait timeout is left.
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath, {
+      startedAtMs: Date.now(),
+      admission: request.admission,
+      daemonPid: undefined
+    });
     return;
   }
   const abort: AbortController = new AbortController();
@@ -259,6 +266,11 @@ export async function launchClientAsync(
     writeAsync: (bytes, stream) => (stream === 'stderr' ? output.stderr : output.stdout).writeAsync(bytes)
   });
   let outcome: DaemonClientOutcome | undefined;
+  // If the daemon hands the request back, Rush waits in-process for the repository's lock only for what is left of
+  // the request's wait timeout, which counts from here.
+  const requestStartedAtMs: number = Date.now();
+  // After a restart, the daemon that the request followed it to hands the request back, not the first one.
+  const restarts: IDaemonRestartNotice[] = [];
   const discoveryLines: string[] = [];
   const writeDiscoveryAsync = async (): Promise<void> => {
     if (discoveryLines.length > 0) {
@@ -304,7 +316,10 @@ export async function launchClientAsync(
         requestNotices.onRequestProgress();
         return agentRenderer ? agentRenderer.onEvent(event) : renderer.writeEventAsync(event);
       },
-      onRestartAsync: requestNotices.onRestartAsync,
+      onRestartAsync: async (notice) => {
+        restarts.push(notice);
+        await requestNotices.onRestartAsync(notice);
+      },
       onQueuePositionAsync: requestNotices.onQueuePositionAsync,
       onInputAdmittedAsync: requestNotices.onInputAdmittedAsync,
       stdin: process.stdin,
@@ -386,7 +401,12 @@ export async function launchClientAsync(
     agentRenderer?.dispose();
     output.release();
     process.stderr.write(formatInProcessFallbackMessage(outcome.message ?? outcome.reason, clientName));
-    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath);
+    await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath, {
+      startedAtMs: requestStartedAtMs,
+      admission: request.admission,
+      daemonPid:
+        restarts.length > 0 ? restarts[restarts.length - 1].successorPid : (await client.status).pid
+    });
   }
 }
 
@@ -398,7 +418,8 @@ async function launchInProcessAsync(
   argv: ReadonlyArray<string>,
   rushx: boolean,
   selectedVersion: string,
-  rushJsonPath: string | undefined
+  rushJsonPath: string | undefined,
+  lockWait?: IInProcessLockWait
 ): Promise<void> {
   if (rushJsonPath) {
     let paths: IDaemonPaths | undefined;
@@ -417,10 +438,15 @@ async function launchInProcessAsync(
       await reclaimCrashedDaemonAsync(paths, { onOrphansReaped });
     }
   }
-  launchInProcess(argv, rushx, selectedVersion);
+  launchInProcess(argv, rushx, selectedVersion, lockWait);
 }
 
-function launchInProcess(argv: ReadonlyArray<string>, rushx: boolean, selectedVersion: string): void {
+function launchInProcess(
+  argv: ReadonlyArray<string>,
+  rushx: boolean,
+  selectedVersion: string,
+  lockWait: IInProcessLockWait | undefined
+): void {
   const executable: string = rushx ? 'rushx' : 'rush';
   const rushFolder: string = path.dirname(require.resolve('@microsoft/rush/package.json'));
   process.argv = [process.execPath, path.join(rushFolder, 'bin', executable), ...argv];
@@ -430,6 +456,10 @@ function launchInProcess(argv: ReadonlyArray<string>, rushx: boolean, selectedVe
     for (const name of [...Object.values(daemonEnvironmentVariables), 'RUSH_DAEMON_EXPERIMENTAL']) {
       delete process.env[name];
     }
+  } else if (lockWait && !rushx) {
+    // Rush waits for the repository's lock as the daemon would have. Other releases would pass the variables on to
+    // their operations instead of removing them.
+    setInProcessLockWait(process.env, lockWait);
   }
   require('@microsoft/rush/lib/start');
 }
diff --git a/apps/rush-cli-client/src/lazyRushModules.ts b/apps/rush-cli-client/src/lazyRushModules.ts
index d10c8774de..6469b73710 100644
--- a/apps/rush-cli-client/src/lazyRushModules.ts
+++ b/apps/rush-cli-client/src/lazyRushModules.ts
@@ -8,6 +8,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import type * as RushLibModule from '@microsoft/rush-lib';
+import type * as EnvironmentConfigurationModule from '@microsoft/rush-lib/lib/api/EnvironmentConfiguration';
 import type * as MinimalRushConfigurationModule from '@microsoft/rush/lib/MinimalRushConfiguration';
 import type * as VersionSelectedDaemonLauncherModule from '@rushstack/rush-daemon/lib/VersionSelectedDaemonLauncher';
 
@@ -15,6 +16,10 @@ export function loadRushLib(): typeof RushLibModule {
   return require('@microsoft/rush-lib');
 }
 
+export function loadEnvironmentConfiguration(): typeof EnvironmentConfigurationModule {
+  return require('@microsoft/rush-lib/lib/api/EnvironmentConfiguration');
+}
+
 export function loadMinimalRushConfiguration(): typeof MinimalRushConfigurationModule {
   return require('@microsoft/rush/lib/MinimalRushConfiguration');
 }
diff --git a/apps/rush-cli-client/src/test/inProcessLockWait.test.ts b/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
new file mode 100644
index 0000000000..c56b4932b3
--- /dev/null
+++ b/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
@@ -0,0 +1,218 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush/lib/start', () => ({}));
+jest.mock('@rushstack/rush-client-core', () => ({
+  ...jest.requireActual('@rushstack/rush-client-core'),
+  connectOrAwaitDaemonStartupAsync: jest.fn(),
+  executeWithDaemonRestartAsync: jest.fn()
+}));
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DaemonClientError,
+  connectOrAwaitDaemonStartupAsync,
+  executeWithDaemonRestartAsync,
+  type DaemonClient
+} from '@rushstack/rush-client-core';
+
+import * as connectionOptions from '../daemonConnectionOptions';
+import { getInProcessLockWaitDeadlineMs, setInProcessLockWait } from '../inProcessLockWait';
+import { getBundledRushVersion } from '../lazyRushModules';
+import { launchClientAsync } from '../launchClient';
+
+// Rush reads these names from EnvironmentVariableNames in @microsoft/rush-lib.
+const DEADLINE: string = '_RUSH_LOCK_WAIT_DEADLINE';
+const DAEMON_PID: string = '_RUSH_LOCK_WAIT_DAEMON_PID';
+
+// Rushx keeps a script that has a terminal in-process, so the rushx test hides the test runner's terminal.
+function hideTerminal(): () => void {
+  const streams: object[] = [process.stdin, process.stdout, process.stderr];
+  const descriptors: (PropertyDescriptor | undefined)[] = streams.map((stream) =>
+    Object.getOwnPropertyDescriptor(stream, 'isTTY')
+  );
+  for (const stream of streams) {
+    Object.defineProperty(stream, 'isTTY', { value: undefined, configurable: true, writable: true });
+  }
+  return () => {
+    streams.forEach((stream, index) => {
+      const descriptor: PropertyDescriptor | undefined = descriptors[index];
+      if (descriptor) Object.defineProperty(stream, 'isTTY', descriptor);
+      else delete (stream as { isTTY?: boolean }).isTTY;
+    });
+  };
+}
+
+describe(getInProcessLockWaitDeadlineMs.name, () => {
+  it('counts the wait timeout from when the wait began', () => {
+    expect(
+      getInProcessLockWaitDeadlineMs({
+        startedAtMs: 1000,
+        admission: { waitTimeoutMs: 30000, waitTimeoutIsDefault: true },
+        daemonPid: 42
+      })
+    ).toBe(31000);
+    expect(
+      getInProcessLockWaitDeadlineMs({ startedAtMs: 1000, admission: { waitTimeoutMs: 60500 }, daemonPid: 42 })
+    ).toBe(61500);
+  });
+
+  it('does not wait with --no-wait, a zero timeout, or no admission options', () => {
+    for (const admission of [{ noWait: true }, { waitTimeoutMs: 0 }, undefined]) {
+      expect(getInProcessLockWaitDeadlineMs({ startedAtMs: 1000, admission, daemonPid: 42 })).toBe(1000);
+    }
+  });
+});
+
+describe(setInProcessLockWait.name, () => {
+  it('sets the deadline and the daemon PID', () => {
+    const environment: NodeJS.ProcessEnv = { PATH: '/bin' };
+    setInProcessLockWait(environment, { startedAtMs: 1000, admission: { waitTimeoutMs: 5000 }, daemonPid: 42 });
+    expect(environment).toEqual({ PATH: '/bin', [DEADLINE]: '6000', [DAEMON_PID]: '42' });
+  });
+
+  it('removes a daemon PID that no daemon handed over', () => {
+    const environment: NodeJS.ProcessEnv = { [DAEMON_PID]: '7' };
+    setInProcessLockWait(environment, { startedAtMs: 1000, admission: { noWait: true }, daemonPid: undefined });
+    expect(environment).toEqual({ [DEADLINE]: '1000' });
+  });
+});
+
+describe('rush-client asks in-process Rush to wait for the repository lock after it tried the daemon (task 245)', () => {
+  const SENT_AT_MS: number = 1_000_000;
+  let folder: string;
+  let originalArgv: string[];
+  let originalEnvironment: NodeJS.ProcessEnv;
+  let now: jest.SpyInstance<number, []>;
+
+  function writeRushJson(rushVersion: string): void {
+    fs.writeFileSync(
+      path.join(folder, 'rush.json'),
+      JSON.stringify({ rushVersion, pnpmVersion: '10.27.0', projects: [] })
+    );
+  }
+
+  function mockDaemon(pid: number): void {
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
+      status: Promise.resolve({ pid }),
+      closeAsync: async () => undefined
+    } as unknown as DaemonClient);
+  }
+
+  /** The daemon takes 20 s to hand the request back. */
+  function mockHandBack(successorPid?: number): void {
+    jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => {
+      now.mockReturnValue(SENT_AT_MS + 20000);
+      if (successorPid !== undefined) {
+        await options.onRestartAsync?.({ restart: 1, reason: undefined, successorPid });
+      }
+      return { kind: 'fallback', reason: 'unsupported', message: 'The daemon cannot run this command.' };
+    });
+  }
+
+  function getLockWait(): { deadline?: string; daemonPid?: string } {
+    return { deadline: process.env[DEADLINE], daemonPid: process.env[DAEMON_PID] };
+  }
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-lock-wait-'));
+    originalArgv = process.argv;
+    originalEnvironment = process.env;
+    writeRushJson(getBundledRushVersion());
+    jest.spyOn(connectionOptions, 'getDaemonConnectionOptionsAsync').mockResolvedValue({
+      paths: {
+        runtimeDir: folder,
+        socketPath: path.join(folder, 'd.sock'),
+        lockfilePath: path.join(folder, 'daemon.pid.json')
+      }
+    });
+    jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    jest.spyOn(process, 'cwd').mockReturnValue(folder);
+    now = jest.spyOn(Date, 'now').mockReturnValue(SENT_AT_MS);
+    process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
+    process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
+    for (const name of ['RUSH_LOG_LEVEL', 'RUSH_PREVIEW_VERSION', DEADLINE, DAEMON_PID]) delete process.env[name];
+  });
+
+  afterEach(() => {
+    process.argv = originalArgv;
+    process.env = originalEnvironment;
+    jest.restoreAllMocks();
+    jest.mocked(connectOrAwaitDaemonStartupAsync).mockReset();
+    jest.mocked(executeWithDaemonRestartAsync).mockReset();
+    fs.rmSync(folder, { recursive: true });
+  });
+
+  it('for what is left of the wait timeout when the daemon hands the request back', async () => {
+    mockDaemon(42);
+    mockHandBack();
+    await launchClientAsync(false);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 30000}`, daemonPid: '42' });
+  });
+
+  it('naming the daemon that the request followed a restart to', async () => {
+    mockDaemon(42);
+    mockHandBack(43);
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 30000}`, daemonPid: '43' });
+  });
+
+  it('for the explicit wait timeout, and not at all with --no-wait', async () => {
+    mockDaemon(42);
+    mockHandBack();
+    process.argv = [process.execPath, 'rush-client', 'build', '--wait-timeout', '90', '--to', 'project'];
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 90000}`, daemonPid: '42' });
+
+    now.mockReturnValue(SENT_AT_MS);
+    process.argv = [process.execPath, 'rush-client', 'build', '--no-wait', '--to', 'project'];
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS}`, daemonPid: '42' });
+  });
+
+  it('for the whole wait timeout when it cannot reach a daemon', async () => {
+    jest
+      .mocked(connectOrAwaitDaemonStartupAsync)
+      .mockRejectedValue(new DaemonClientError('startupFailed', 'No ready daemon; auto-start is disabled.'));
+    await launchClientAsync(false);
+    expect(getLockWait()).toEqual({ deadline: `${SENT_AT_MS + 30000}`, daemonPid: undefined });
+  });
+
+  it('not when the command runs in-process without the daemon', async () => {
+    process.env.RUSH_DAEMON = '0';
+    await launchClientAsync(false);
+    expect(connectOrAwaitDaemonStartupAsync).not.toHaveBeenCalled();
+    expect(getLockWait()).toEqual({});
+  });
+
+  it('not for rushx, whose script would inherit the variables', async () => {
+    const restoreTerminal: () => void = hideTerminal();
+    try {
+      mockDaemon(42);
+      mockHandBack();
+      process.argv = [process.execPath, 'rushx-client', 'sample'];
+      delete process.env.RUSH_REPORTER;
+      await launchClientAsync(true);
+      expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+      expect(process.argv[1]).toBe(
+        path.join(path.dirname(require.resolve('@microsoft/rush/package.json')), 'bin/rushx')
+      );
+      expect(getLockWait()).toEqual({});
+    } finally {
+      restoreTerminal();
+    }
+  });
+
+  it('not when the workspace selects another Rush release, which would not remove the variables', async () => {
+    writeRushJson('5.178.1');
+    mockDaemon(42);
+    mockHandBack();
+    await launchClientAsync(false);
+    expect(executeWithDaemonRestartAsync).toHaveBeenCalledTimes(1);
+    expect(getLockWait()).toEqual({});
+  });
+});
diff --git a/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json b/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json
new file mode 100644
index 0000000000..41fa6e17d4
--- /dev/null
+++ b/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@microsoft/rush/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json b/common/changes/@microsoft/rush/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json
new file mode 100644
index 0000000000..9e136c0a5c
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When `rush-client` runs a command in-process after it tried the Rush daemon, and another Rush process, such as the daemon while it builds for another request, holds the repository's lock, the command now waits for the lock for what is left of the request's wait timeout instead of failing at once with \"Another Rush command is already running in this repository.\" It says on stderr which process it waits for, and if the lock is still held at the deadline, its error names that process. Rush run without `rush-client` still fails at once.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json b/common/changes/@rushstack/rush-cli-client/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json
new file mode 100644
index 0000000000..cca5f362e6
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-o04-t245-in-process-lock-wait_2026-09-29-13-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the daemon hands a command back, or `rush-client` cannot reach a daemon, the in-process Rush that runs the command now waits for another Rush process to release the repository's lock, for what is left of the request's wait timeout (`--wait-timeout`, the configured queue timeout, or the 30-second default), instead of failing at once with \"Another Rush command is already running in this repository.\" `--no-wait` and a zero timeout still fail at once, now naming the process that holds the lock.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 5595162194..ecca1f0a95 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -313,6 +313,8 @@ export const EnvironmentVariableNames: {
     readonly RUSH_TAR_BINARY_PATH: "RUSH_TAR_BINARY_PATH";
     readonly _RUSH_RECURSIVE_RUSHX_CALL: "_RUSH_RECURSIVE_RUSHX_CALL";
     readonly _RUSH_LIB_PATH: "_RUSH_LIB_PATH";
+    readonly _RUSH_LOCK_WAIT_DEADLINE: "_RUSH_LOCK_WAIT_DEADLINE";
+    readonly _RUSH_LOCK_WAIT_DAEMON_PID: "_RUSH_LOCK_WAIT_DAEMON_PID";
     readonly RUSH_INVOKED_FOLDER: "RUSH_INVOKED_FOLDER";
     readonly RUSH_INVOKED_ARGS: "RUSH_INVOKED_ARGS";
     readonly RUSH_QUIET_MODE: "RUSH_QUIET_MODE";
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index 0632a9fb8c..cf8d2a071b 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -237,6 +237,20 @@ export const EnvironmentVariableNames = {
    */
   _RUSH_LIB_PATH: '_RUSH_LIB_PATH',
 
+  /**
+   * Internal variable that `rush-client` sets when it runs Rush in-process after it tried the Rush daemon: the time,
+   * in milliseconds since the Unix epoch, until which the command waits for another Rush process to release the
+   * repository's lock, instead of failing at once. Rush reads and removes it when it starts.
+   */
+  _RUSH_LOCK_WAIT_DEADLINE: '_RUSH_LOCK_WAIT_DEADLINE',
+
+  /**
+   * Internal variable that `rush-client` sets with `_RUSH_LOCK_WAIT_DEADLINE`: the process ID of the Rush daemon
+   * that handed the command back, so that Rush can name the daemon when it holds the repository's lock.
+   * Rush reads and removes it when it starts.
+   */
+  _RUSH_LOCK_WAIT_DAEMON_PID: '_RUSH_LOCK_WAIT_DAEMON_PID',
+
   /**
    * When Rush executes shell scripts, it sometimes changes the working directory to be a project folder or
    * the repository root folder.  The original working directory (where the Rush command was invoked) is assigned
diff --git a/libraries/rush-lib/src/cli/RushCommandLineParser.ts b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
index edc6e2d64b..f9b5fdce41 100644
--- a/libraries/rush-lib/src/cli/RushCommandLineParser.ts
+++ b/libraries/rush-lib/src/cli/RushCommandLineParser.ts
@@ -77,6 +77,7 @@ import { measureAsyncFn } from '../utilities/performance';
 import { waitForStreamsToFlushAsync } from '../utilities/streamUtilities';
 import type { StandardOutputClosure } from '../utilities/StandardOutputClosure';
 import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
+import { consumeRepositoryLockWait, type IRepositoryLockWait } from '../logic/RepositoryLockWait';
 import {
   _correlateRushSessionError,
   _flushRushSessionReporterAsync,
@@ -190,6 +191,11 @@ export class RushCommandLineParser extends CommandLineParser {
   public readonly rushConfiguration!: RushConfiguration;
   public readonly rushSession: RushSession;
   public readonly pluginManager: PluginManager;
+  /**
+   * The wait for the repository lock that `rush-client` asked for when it ran this command in-process after it tried
+   * the Rush daemon. A parser that serves an engine host never has one.
+   */
+  public readonly repositoryLockWait: IRepositoryLockWait | undefined;
 
   readonly #debugParameter: CommandLineFlagParameter;
   readonly #quietParameter: CommandLineFlagParameter;
@@ -260,6 +266,8 @@ export class RushCommandLineParser extends CommandLineParser {
     });
 
     this.#rushOptions = this.#normalizeOptions(options || {});
+    // An engine host's process environment is not the request's, and rush-client never sets these variables in it.
+    this.repositoryLockWait = this.#rushOptions.engine ? undefined : consumeRepositoryLockWait(process.env);
     const { cwd, alreadyReportedNodeTooNewError, builtInPluginConfigurations, reporter } = this.#rushOptions;
     this.#jsonFileLoadCache = this.#rushOptions.engine
       ? getEngineJsonFileLoadCache(this.#rushOptions.engine.rushConfiguration)
diff --git a/libraries/rush-lib/src/cli/actions/BaseRushAction.ts b/libraries/rush-lib/src/cli/actions/BaseRushAction.ts
index 1f40359f14..bdbd78fdc4 100644
--- a/libraries/rush-lib/src/cli/actions/BaseRushAction.ts
+++ b/libraries/rush-lib/src/cli/actions/BaseRushAction.ts
@@ -4,12 +4,13 @@
 import * as path from 'node:path';
 
 import { CommandLineAction, type ICommandLineActionOptions } from '@rushstack/ts-command-line';
-import { AlreadyReportedError, LockFile } from '@rushstack/node-core-library';
+import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { Colorize, type ITerminal } from '@rushstack/terminal';
 import type { IScopedReporter } from '@rushstack/rush-reporter';
 
 import type { RushConfiguration } from '../../api/RushConfiguration';
 import { EventHooksManager } from '../../logic/EventHooksManager';
+import { acquireRepositoryLockAsync, type IRepositoryLockResult } from '../../logic/RepositoryLockWait';
 import { RushCommandLineParser } from '../RushCommandLineParser';
 import { Utilities } from '../../utilities/Utilities';
 import type { RushGlobalFolder } from '../../api/RushGlobalFolder';
@@ -69,8 +70,15 @@ export abstract class BaseConfiglessRushAction extends CommandLineAction impleme
 
     if (this.rushConfiguration) {
       if (!this.#safeForSimultaneousRushProcesses) {
-        if (!LockFile.tryAcquire(this.rushConfiguration.commonTempFolder, 'rush')) {
-          const message: string = 'Another Rush command is already running in this repository.';
+        const { lock, holderSentence }: IRepositoryLockResult = await acquireRepositoryLockAsync({
+          lockFolder: this.rushConfiguration.commonTempFolder,
+          wait: this.parser.repositoryLockWait,
+          terminal: this.terminal
+        });
+        if (!lock) {
+          const message: string =
+            'Another Rush command is already running in this repository.' +
+            (holderSentence ? ` ${holderSentence}` : '');
           if (_isRushSessionOperationStreamEnabled(this.rushSession)) {
             this.terminal.writeErrorLine(message);
             throw new AlreadyReportedError();
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
index ad41a46960..8fc01c5070 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
@@ -33,10 +33,13 @@ import { FileSystem, JsonFile, LockFile, Path } from '@rushstack/node-core-libra
 import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
 import type { IReporterEmitEventInput, IReporterEventSink } from '@rushstack/rush-reporter';
 import type { CommandLineAction } from '@rushstack/ts-command-line';
+import { RushConfiguration } from '../../api/RushConfiguration';
 import { Autoinstaller } from '../../logic/Autoinstaller';
 import type { IOperationGraphRequestResult } from '../../logic/operations/IOperationGraph';
 import { OperationStatus } from '../../logic/operations/OperationStatus';
+import type { IRepositoryLockWait } from '../../logic/RepositoryLockWait';
 import type { ITelemetryData } from '../../logic/Telemetry';
+import type { RushCommandLineParser as RushCommandLineParserType } from '../RushCommandLineParser';
 import {
   getCommandLineParserInstanceAsync,
   setSpawnMock,
@@ -47,7 +50,7 @@ import {
   type IEnvironmentConfigIsolation
 } from './TestUtils';
 import { IS_WINDOWS } from '../../utilities/executionUtilities';
-import { AnsiEscape } from '@rushstack/terminal';
+import { AnsiEscape, StringBufferTerminalProvider } from '@rushstack/terminal';
 
 // Ordinals into the `mock.calls` array referencing each of the arguments to `spawn`. Note that
 // the exact structure of these arguments differs between Windows and non-Windows platforms, so
@@ -294,6 +297,146 @@ describe('RushCommandLineParser', () => {
           }
         });
 
+        it('waits for the lock until the deadline that rush-client set, and names the daemon that holds it', async () => {
+          const daemonPid: number = process.pid + 1;
+          const deadlineMs: number = Date.now() + 60000;
+          process.env._RUSH_LOCK_WAIT_DEADLINE = `${deadlineMs}`;
+          process.env._RUSH_LOCK_WAIT_DAEMON_PID = `${daemonPid}`;
+          const reporterSink: CapturingReporterSink = new CapturingReporterSink();
+          const lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire> = jest
+            .spyOn(LockFile, 'tryAcquire')
+            .mockReturnValue(undefined);
+          const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
+            .spyOn(process, 'exit')
+            .mockImplementation(() => undefined as never);
+          try {
+            const { parser } = await getCommandLineParserInstanceAsync(
+              'basicAndRunBuildActionRepo',
+              'build',
+              {
+                eventSink: reporterSink,
+                sessionId: 'parser-lock-wait-expired',
+                operationStreamEnabled: true
+              }
+            );
+            // The command's operations must not inherit the wait.
+            expect(process.env._RUSH_LOCK_WAIT_DEADLINE).toBeUndefined();
+            expect(process.env._RUSH_LOCK_WAIT_DAEMON_PID).toBeUndefined();
+            expect(parser.repositoryLockWait).toEqual({ deadlineMs, daemonPid });
+            // A deadline that starts now does not depend on how long the parser took to start.
+            const shortDeadlineMs: number = Date.now() + 300;
+            (parser as unknown as { repositoryLockWait: IRepositoryLockWait }).repositoryLockWait = {
+              deadlineMs: shortDeadlineMs,
+              daemonPid
+            };
+            FileSystem.writeFile(
+              `${parser.rushConfiguration.commonTempFolder}/rush#${daemonPid}.lock`,
+              'start time',
+              { ensureFolderExists: true }
+            );
+
+            await parser.executeAsync();
+            await new Promise<void>((resolve: () => void) => setImmediate(resolve));
+
+            expect(Date.now()).toBeGreaterThanOrEqual(shortDeadlineMs);
+            expect(lockSpy.mock.calls.filter(([, resourceName]) => resourceName === 'rush').length).toBeGreaterThan(
+              1
+            );
+            const messages: unknown[] = reporterSink.inputs
+              .filter(({ type }) => type === 'messageEmitted')
+              .map(({ payload }) => payload);
+            expect(messages).toContainEqual(
+              expect.objectContaining({
+                severity: 'warning',
+                text: expect.stringContaining(
+                  `Waiting up to 1 s for the Rush daemon (PID ${daemonPid}) to release this repository's lock.`
+                )
+              })
+            );
+            expect(messages).toContainEqual(
+              expect.objectContaining({
+                severity: 'error',
+                text: expect.stringContaining(
+                  'Another Rush command is already running in this repository. ' +
+                    `The Rush daemon (PID ${daemonPid}) still holds this repository's lock.`
+                )
+              })
+            );
+          } finally {
+            delete process.env._RUSH_LOCK_WAIT_DEADLINE;
+            delete process.env._RUSH_LOCK_WAIT_DAEMON_PID;
+            exitSpy.mockRestore();
+            lockSpy.mockRestore();
+          }
+        });
+
+        it('runs the command once the lock is released before the deadline that rush-client set', async () => {
+          process.env._RUSH_LOCK_WAIT_DEADLINE = `${Date.now() + 60000}`;
+          const reporterSink: CapturingReporterSink = new CapturingReporterSink();
+          const lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire> = jest
+            .spyOn(LockFile, 'tryAcquire')
+            .mockReturnValueOnce(undefined)
+            .mockReturnValueOnce(undefined);
+          // A command that fails exits the process, which would end this test file instead of this test.
+          const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
+            .spyOn(process, 'exit')
+            .mockImplementation(() => undefined as never);
+          try {
+            const { parser } = await getCommandLineParserInstanceAsync(
+              'basicAndRunBuildActionRepo',
+              'build',
+              {
+                eventSink: reporterSink,
+                sessionId: 'parser-lock-wait-released',
+                operationStreamEnabled: true
+              }
+            );
+
+            await expect(parser.executeAsync()).resolves.toEqual(true);
+
+            expect(exitSpy).not.toHaveBeenCalled();
+            expect(lockSpy.mock.calls.filter(([, resourceName]) => resourceName === 'rush')).toHaveLength(3);
+            expect(reporterSink.inputs).toContainEqual(
+              expect.objectContaining({
+                type: 'messageEmitted',
+                payload: expect.objectContaining({
+                  severity: 'warning',
+                  text: expect.stringMatching(
+                    /Waiting up to \d+ s for another Rush process to release this repository's lock\./
+                  )
+                })
+              })
+            );
+            expect(reporterSink.inputs.at(-3)?.payload).toMatchObject({ succeeded: true, exitCode: 0 });
+          } finally {
+            delete process.env._RUSH_LOCK_WAIT_DEADLINE;
+            exitSpy.mockRestore();
+            lockSpy.mockRestore();
+          }
+        });
+
+        it('leaves the wait that rush-client set alone in an engine host, whose environment is not the request', async () => {
+          process.env._RUSH_LOCK_WAIT_DEADLINE = '1000';
+          process.env._RUSH_LOCK_WAIT_DAEMON_PID = '42';
+          try {
+            const { RushCommandLineParser } = await import('../RushCommandLineParser');
+            const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+              `${__dirname}/basicAndRunBuildActionRepo/rush.json`
+            );
+            const parser: RushCommandLineParserType = new RushCommandLineParser({
+              cwd: rushConfiguration.rushJsonFolder,
+              engine: { rushConfiguration, terminalProvider: new StringBufferTerminalProvider() }
+            });
+
+            expect(parser.repositoryLockWait).toBeUndefined();
+            expect(process.env._RUSH_LOCK_WAIT_DEADLINE).toBe('1000');
+            expect(process.env._RUSH_LOCK_WAIT_DAEMON_PID).toBe('42');
+          } finally {
+            delete process.env._RUSH_LOCK_WAIT_DEADLINE;
+            delete process.env._RUSH_LOCK_WAIT_DAEMON_PID;
+          }
+        });
+
         it('invokes afterExecuteRequestAsync once, after afterExecuteIterationAsync, with the command results', async () => {
           const { parser } = await getCommandLineParserInstanceAsync('basicAndRunBuildActionRepo', 'build');
           const hookOrder: string[] = [];
diff --git a/libraries/rush-lib/src/logic/RepositoryLockWait.ts b/libraries/rush-lib/src/logic/RepositoryLockWait.ts
new file mode 100644
index 0000000000..036c0e5e49
--- /dev/null
+++ b/libraries/rush-lib/src/logic/RepositoryLockWait.ts
@@ -0,0 +1,182 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import { Async, FileSystem, type FileSystemStats, LockFile } from '@rushstack/node-core-library';
+import type { ITerminal } from '@rushstack/terminal';
+
+import { EnvironmentVariableNames } from '../api/EnvironmentConfiguration';
+
+/** The resource name of Rush's repository lock, which Rush takes in the common temp folder. */
+const REPOSITORY_LOCK_NAME: string = 'rush';
+/** The name of each lock file of the repository lock on Linux and macOS. On Windows, `rush.lock` names no process. */
+const LOCK_FILE_NAME_REGEXP: RegExp = /^rush#(\d+)\.lock$/;
+/** How often a command that waits tries again to take the lock, as `LockFile.acquireAsync` does. */
+const RETRY_INTERVAL_MS: number = 100;
+const WHOLE_NUMBER_REGEXP: RegExp = /^\d{1,15}$/;
+
+/**
+ * A wait for the repository lock that `rush-client` asks for when it runs Rush in-process after it tried the daemon.
+ */
+export interface IRepositoryLockWait {
+  /** The time, in milliseconds since the Unix epoch, until which the command waits for the lock. */
+  readonly deadlineMs: number;
+  /** The process ID of the Rush daemon that handed the command back. */
+  readonly daemonPid?: number;
+}
+
+/**
+ * Reads the wait for the repository lock that `rush-client` asked for, and removes its variables from `environment`,
+ * so that neither the command's operations nor any Rush process that they start inherit it.
+ *
+ * @returns undefined if `rush-client` asked for no wait, or if its deadline is not a whole number.
+ */
+export function consumeRepositoryLockWait(
+  environment: NodeJS.ProcessEnv = process.env
+): IRepositoryLockWait | undefined {
+  const deadline: string | undefined = environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE];
+  const daemonPid: string | undefined = environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID];
+  delete environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE];
+  delete environment[EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID];
+  const deadlineMs: number | undefined = parseWholeNumber(deadline);
+  if (deadlineMs === undefined) {
+    return undefined;
+  }
+  const pid: number | undefined = parseWholeNumber(daemonPid);
+  return pid ? { deadlineMs, daemonPid: pid } : { deadlineMs };
+}
+
+/**
+ * Describes the process that holds Rush's repository lock in `lockFolder`: "the Rush daemon (PID 4242)" if it is
+ * `daemonPid`, "another Rush process (PID 17)", or "another Rush process" if no lock file names it.
+ *
+ * @remarks
+ * On Linux and macOS, a process that tries to take the lock writes `rush#<pid>.lock`, and deletes it again if it
+ * fails, so at rest only the process that holds the lock has a lock file with content. If several do, the oldest
+ * one is named. On Windows, the lock file names no process. This only reads files.
+ */
+export function describeRepositoryLockHolder(
+  lockFolder: string,
+  daemonPid: number | undefined,
+  ownPid: number = process.pid
+): string {
+  const pid: number | undefined = findRepositoryLockHolderPid(lockFolder, ownPid);
+  if (pid === undefined) {
+    return 'another Rush process';
+  }
+  return pid === daemonPid ? `the Rush daemon (PID ${pid})` : `another Rush process (PID ${pid})`;
+}
+
+/** The outcome of {@link acquireRepositoryLockAsync}. */
+export interface IRepositoryLockResult {
+  /** The lock, if this process took it. */
+  readonly lock: LockFile | undefined;
+  /**
+   * If this process did not take the lock, and `rush-client` asked for a wait, the sentence that names the process
+   * that holds it, for example "The Rush daemon (PID 4242) still holds this repository's lock."
+   */
+  readonly holderSentence?: string;
+}
+
+/** The options of {@link acquireRepositoryLockAsync}. */
+export interface IAcquireRepositoryLockOptions {
+  /** The folder of the lock, which is the common temp folder. */
+  readonly lockFolder: string;
+  /** The wait that `rush-client` asked for. Without one, this tries once to take the lock, as Rush always has. */
+  readonly wait: IRepositoryLockWait | undefined;
+  /** Receives, as a warning, the line that says what the command waits for. */
+  readonly terminal: ITerminal;
+  /** Tries once to take the lock. Defaults to `LockFile.tryAcquire`. */
+  readonly tryAcquire?: (lockFolder: string) => LockFile | undefined;
+  /** Returns the current time in milliseconds since the Unix epoch. Defaults to `Date.now`. */
+  readonly now?: () => number;
+  /** Waits before the next attempt. Defaults to `Async.sleepAsync`. */
+  readonly sleepAsync?: (ms: number) => Promise<void>;
+  /** This process's ID, whose own lock file never names the holder. Defaults to `process.pid`. */
+  readonly ownPid?: number;
+}
+
+/**
+ * Takes Rush's repository lock. Without a wait, this tries once. With a wait whose deadline has not passed, it writes
+ * a line that names the process that holds the lock, then tries again every 100 ms until it takes the lock or the
+ * deadline passes. Errors other than a held lock are thrown, as `LockFile.tryAcquire` throws them.
+ */
+export async function acquireRepositoryLockAsync(
+  options: IAcquireRepositoryLockOptions
+): Promise<IRepositoryLockResult> {
+  const {
+    lockFolder,
+    wait,
+    terminal,
+    tryAcquire = tryAcquireRepositoryLock,
+    now = Date.now,
+    sleepAsync = Async.sleepAsync,
+    ownPid = process.pid
+  } = options;
+  let lock: LockFile | undefined = tryAcquire(lockFolder);
+  if (lock || !wait) {
+    return { lock };
+  }
+  let remainingMs: number = wait.deadlineMs - now();
+  const waits: boolean = remainingMs > 0;
+  if (waits) {
+    const holder: string = describeRepositoryLockHolder(lockFolder, wait.daemonPid, ownPid);
+    terminal.writeWarningLine(
+      `Waiting up to ${Math.ceil(remainingMs / 1000)} s for ${holder} to release this repository's lock.`
+    );
+  }
+  while (remainingMs > 0) {
+    await sleepAsync(Math.min(RETRY_INTERVAL_MS, remainingMs));
+    lock = tryAcquire(lockFolder);
+    if (lock) {
+      return { lock };
+    }
+    remainingMs = wait.deadlineMs - now();
+  }
+  const holder: string = describeRepositoryLockHolder(lockFolder, wait.daemonPid, ownPid);
+  const holds: string = waits ? 'still holds' : 'holds';
+  return { lock, holderSentence: `${capitalize(holder)} ${holds} this repository's lock.` };
+}
+
+function tryAcquireRepositoryLock(lockFolder: string): LockFile | undefined {
+  return LockFile.tryAcquire(lockFolder, REPOSITORY_LOCK_NAME);
+}
+
+function findRepositoryLockHolderPid(lockFolder: string, ownPid: number): number | undefined {
+  let names: string[];
+  try {
+    names = FileSystem.readFolderItemNames(lockFolder);
+  } catch {
+    return undefined;
+  }
+  let holderPid: number | undefined;
+  let holderWrittenMs: number = Infinity;
+  for (const name of names) {
+    const pid: number = Number(LOCK_FILE_NAME_REGEXP.exec(name)?.[1]);
+    if (!Number.isSafeInteger(pid) || pid === ownPid) {
+      continue;
+    }
+    let stats: FileSystemStats;
+    try {
+      stats = FileSystem.getStatistics(path.join(lockFolder, name));
+    } catch {
+      // The process released the lock and deleted its lock file.
+      continue;
+    }
+    // An empty lock file belongs to a process that has only begun to try to take the lock.
+    if (stats.size > 0 && stats.mtimeMs < holderWrittenMs) {
+      holderPid = pid;
+      holderWrittenMs = stats.mtimeMs;
+    }
+  }
+  return holderPid;
+}
+
+function parseWholeNumber(value: string | undefined): number | undefined {
+  return value !== undefined && WHOLE_NUMBER_REGEXP.test(value) ? Number(value) : undefined;
+}
+
+function capitalize(text: string): string {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
diff --git a/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts b/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
new file mode 100644
index 0000000000..21a030b67d
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
@@ -0,0 +1,229 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { FileSystem, type LockFile } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
+import {
+  acquireRepositoryLockAsync,
+  consumeRepositoryLockWait,
+  describeRepositoryLockHolder,
+  type IRepositoryLockResult,
+  type IRepositoryLockWait
+} from '../RepositoryLockWait';
+
+const TEMP_FOLDER: string = path.resolve(__dirname, '../../../temp/test/RepositoryLockWait');
+const DEADLINE: string = EnvironmentVariableNames._RUSH_LOCK_WAIT_DEADLINE;
+const DAEMON_PID: string = EnvironmentVariableNames._RUSH_LOCK_WAIT_DAEMON_PID;
+const OWN_PID: number = 100;
+const DAEMON: number = 4242;
+const HELD_LOCK: LockFile = { release: () => undefined } as unknown as LockFile;
+
+function writeLockFile(folder: string, name: string, content: string, writtenAtSeconds: number): void {
+  const filePath: string = path.join(folder, name);
+  FileSystem.writeFile(filePath, content, { ensureFolderExists: true });
+  fs.utimesSync(filePath, writtenAtSeconds, writtenAtSeconds);
+}
+
+function createLockFolder(name: string): string {
+  const folder: string = path.join(TEMP_FOLDER, name);
+  FileSystem.ensureEmptyFolder(folder);
+  return folder;
+}
+
+describe(consumeRepositoryLockWait.name, () => {
+  it('returns undefined when rush-client asked for no wait', () => {
+    const environment: NodeJS.ProcessEnv = { PATH: '/bin' };
+    expect(consumeRepositoryLockWait(environment)).toBeUndefined();
+    expect(environment).toEqual({ PATH: '/bin' });
+  });
+
+  it('reads the deadline and the daemon PID, and removes both variables', () => {
+    const environment: NodeJS.ProcessEnv = { PATH: '/bin', [DEADLINE]: '1700000030000', [DAEMON_PID]: '4242' };
+    expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 1700000030000, daemonPid: 4242 });
+    expect(environment).toEqual({ PATH: '/bin' });
+  });
+
+  it('reads a deadline without a daemon PID', () => {
+    const environment: NodeJS.ProcessEnv = { [DEADLINE]: '0' };
+    expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 0 });
+    expect(environment).toEqual({});
+  });
+
+  it.each(['', 'soon', '-1', '1.5', '1e12', ' 17', '1234567890123456'])(
+    'ignores the deadline %p, and still removes both variables',
+    (deadline: string) => {
+      const environment: NodeJS.ProcessEnv = { [DEADLINE]: deadline, [DAEMON_PID]: '4242' };
+      expect(consumeRepositoryLockWait(environment)).toBeUndefined();
+      expect(environment).toEqual({});
+    }
+  );
+
+  it.each(['0', 'daemon', '-4242', '42.5'])('drops the daemon PID %p', (daemonPid: string) => {
+    const environment: NodeJS.ProcessEnv = { [DEADLINE]: '5000', [DAEMON_PID]: daemonPid };
+    expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 5000 });
+    expect(environment).toEqual({});
+  });
+});
+
+describe(describeRepositoryLockHolder.name, () => {
+  it('names the daemon when its lock file holds the lock', () => {
+    const folder: string = createLockFolder('daemon');
+    writeLockFile(folder, `rush#${DAEMON}.lock`, 'start time', 1000);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('the Rush daemon (PID 4242)');
+  });
+
+  it('names another process when the daemon does not hold the lock', () => {
+    const folder: string = createLockFolder('other');
+    writeLockFile(folder, 'rush#17.lock', 'start time', 1000);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('another Rush process (PID 17)');
+    expect(describeRepositoryLockHolder(folder, undefined, OWN_PID)).toBe('another Rush process (PID 17)');
+  });
+
+  it('names the process with the oldest lock file, and ignores empty files, its own, and other locks', () => {
+    const folder: string = createLockFolder('several');
+    writeLockFile(folder, `rush#${OWN_PID}.lock`, 'start time', 500);
+    writeLockFile(folder, 'rush#20.lock', '', 600);
+    writeLockFile(folder, 'autoinstaller#21.lock', 'start time', 700);
+    writeLockFile(folder, 'rush#22.lock', 'start time', 2000);
+    writeLockFile(folder, `rush#${DAEMON}.lock`, 'start time', 1000);
+    writeLockFile(folder, 'rush.lock', 'start time', 400);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('the Rush daemon (PID 4242)');
+  });
+
+  it('names no PID when no lock file names the holder', () => {
+    const folder: string = createLockFolder('windows');
+    writeLockFile(folder, 'rush.lock', '', 1000);
+    expect(describeRepositoryLockHolder(folder, DAEMON, OWN_PID)).toBe('another Rush process');
+    expect(describeRepositoryLockHolder(path.join(folder, 'missing'), DAEMON, OWN_PID)).toBe(
+      'another Rush process'
+    );
+  });
+});
+
+describe(acquireRepositoryLockAsync.name, () => {
+  interface IAttempt {
+    readonly result: IRepositoryLockResult;
+    readonly attempts: number;
+    readonly sleeps: number[];
+    readonly warnings: string;
+  }
+
+  // Far more than any wait below needs; the longest takes 14 attempts.
+  const MAX_ATTEMPTS: number = 1000;
+
+  let folder: string;
+
+  beforeAll(() => {
+    folder = createLockFolder('acquire');
+    writeLockFile(folder, `rush#${DAEMON}.lock`, 'start time', 1000);
+  });
+
+  /** Tries to take the lock with a clock that starts at 0 and that only sleeping advances. */
+  async function acquireAsync(
+    wait: IRepositoryLockWait | undefined,
+    freeAfterAttempts: number = Infinity
+  ): Promise<IAttempt> {
+    let nowMs: number = 0;
+    let attempts: number = 0;
+    const sleeps: number[] = [];
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const result: IRepositoryLockResult = await acquireRepositoryLockAsync({
+      lockFolder: folder,
+      wait,
+      terminal: new Terminal(terminalProvider),
+      tryAcquire: (lockFolder: string) => {
+        expect(lockFolder).toBe(folder);
+        // The fake sleep never yields to a timer, so a wait that never ended would hang Jest instead of failing.
+        if (++attempts > MAX_ATTEMPTS) {
+          throw new Error(`tryAcquire was called ${attempts} times`);
+        }
+        return attempts > freeAfterAttempts ? HELD_LOCK : undefined;
+      },
+      now: () => nowMs,
+      sleepAsync: async (ms: number) => {
+        sleeps.push(ms);
+        nowMs += ms;
+      },
+      ownPid: OWN_PID
+    });
+    return { result, attempts, sleeps, warnings: terminalProvider.getWarningOutput() };
+  }
+
+  it('tries once without a wait', async () => {
+    expect(await acquireAsync(undefined)).toEqual({
+      result: { lock: undefined },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+    expect(await acquireAsync(undefined, 0)).toEqual({
+      result: { lock: HELD_LOCK },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+  });
+
+  it('does not wait when the lock is free', async () => {
+    expect(await acquireAsync({ deadlineMs: 30000, daemonPid: DAEMON }, 0)).toEqual({
+      result: { lock: HELD_LOCK },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+  });
+
+  it('tries once and names the holder when the deadline has passed', async () => {
+    expect(await acquireAsync({ deadlineMs: 0, daemonPid: DAEMON })).toEqual({
+      result: {
+        lock: undefined,
+        holderSentence: "The Rush daemon (PID 4242) holds this repository's lock."
+      },
+      attempts: 1,
+      sleeps: [],
+      warnings: ''
+    });
+  });
+
+  it('waits until the holder releases the lock', async () => {
+    const { result, attempts, sleeps, warnings } = await acquireAsync({ deadlineMs: 30000, daemonPid: DAEMON }, 3);
+    expect(result).toEqual({ lock: HELD_LOCK });
+    expect(attempts).toBe(4);
+    expect(sleeps).toEqual([100, 100, 100]);
+    expect(warnings).toBe(
+      "Waiting up to 30 s for the Rush daemon (PID 4242) to release this repository's lock.[n]"
+    );
+  });
+
+  it('stops at the deadline and says that the holder still holds the lock', async () => {
+    const { result, attempts, sleeps, warnings } = await acquireAsync({ deadlineMs: 1250, daemonPid: 17 });
+    expect(result).toEqual({
+      lock: undefined,
+      holderSentence: "Another Rush process (PID 4242) still holds this repository's lock."
+    });
+    expect(attempts).toBe(14);
+    expect(sleeps).toEqual([...Array(12).fill(100), 50]);
+    expect(warnings).toBe(
+      "Waiting up to 2 s for another Rush process (PID 4242) to release this repository's lock.[n]"
+    );
+  });
+
+  it('passes on an error from an attempt', async () => {
+    const error: Error = new Error('EACCES');
+    await expect(
+      acquireRepositoryLockAsync({
+        lockFolder: folder,
+        wait: { deadlineMs: Date.now() + 30000 },
+        terminal: new Terminal(new StringBufferTerminalProvider()),
+        tryAcquire: () => {
+          throw error;
+        }
+      })
+    ).rejects.toBe(error);
+  });
+});

From 56a45d7170ca1cd888e777752610f988912cebe6 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:32 +0000
Subject: [PATCH 194/265] [rush-client-core] Stat the socket with bigint in the
 reset's reclaim

Swarm integration step 179; original commit d7fd156874 (merge of swarm/r01-t286-int at 2fe648fb95).
Scope: task 286.

Brings 286 (branch swarm/r01-t286-int). Second agent: r04 board 5816, carried over board 5841. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 13 of 17. Gate: ch01 GATE OK board 6389 (tree d23bf8ab05)

Commits folded into this step (1):
- 2fe648fb95 [rush-client-core] Stat the socket with bigint in the reset's reclaim

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t-socket-bigint-stat_2026-09-29-14-55.json | 11 +++++++
 libraries/rush-client-core/README.md          |  2 ++
 .../rush-client-core/src/DaemonOwnership.ts   |  7 +++-
 .../src/test/DaemonArtifactReset.test.ts      | 33 +++++++++++++++++++
 4 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/reset-socket-bigint-stat_2026-09-29-14-55.json

diff --git a/common/changes/@rushstack/rush-client-core/reset-socket-bigint-stat_2026-09-29-14-55.json b/common/changes/@rushstack/rush-client-core/reset-socket-bigint-stat_2026-09-29-14-55.json
new file mode 100644
index 0000000000..d79e85676a
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/reset-socket-bigint-stat_2026-09-29-14-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When `resetDaemonArtifactsAsync()` reclaims a daemon that exited without shutting down, it now stats the daemon's socket with `{ bigint: true }`. Before, a `require()` that the same process made while the reset awaited the reclaim could load a package through its symlink and fail to find the package's dependencies.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index e4c6894047..77f8347345 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -163,6 +163,8 @@ running, as `reclaimStaleDaemonAsync()` does before the next start; when a proce
 has it, the reset stops the recorded operation process groups as the start does. Both report what they
 stop to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings). The reset removes
 nothing when they cannot be stopped, and it never signals a process otherwise.
+The reset stats the socket with `{ bigint: true }`. After a plain stat of a socket, a `require()` in the
+same process, made while the reset awaits the reclaim, would not resolve symlinks.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
 readiness. The explicit launcher's cwd is unchanged. If the daemon exits after its helper saw it ready
 but before the starting client connected, for example because `rush-client daemon stop` stopped it,
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index 46c3f118b3..9b210c643b 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -357,8 +357,13 @@ async function tryReclaimOwnerAsync(
   }
 }
 
+/**
+ * A plain stat of the socket would leave its file type in Node's shared stat array, which Node's cached realpath
+ * reads (nodejs/node#65113): while the reclaim awaits its connection probe, a require() in this process would not
+ * resolve symlinks. A bigint stat fills another array.
+ */
 function isPresent(filePath: string): boolean {
-  return fs.lstatSync(filePath, { throwIfNoEntry: false }) !== undefined;
+  return fs.lstatSync(filePath, { bigint: true, throwIfNoEntry: false }) !== undefined;
 }
 
 /** Resolves true only when a connection attempt proves that nothing listens at the endpoint. */
diff --git a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
index aff7842bb5..275a950deb 100644
--- a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
@@ -26,8 +26,10 @@ import {
   startOrphanedOperationAsync,
   stopOperationIfRunning
 } from './OrphanedOperation';
+import { runThenRequireSymlinkedPackage, type IRequireAfterScriptResult } from './SymlinkedPackageRequire';
 
 const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
 
 function getDaemonPaths(runtimeDir: string): IDaemonPaths {
   return {
@@ -89,6 +91,37 @@ describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutti
     expect(reaps).toHaveLength(1);
   });
 
+  // For example, a host that serves other requests while it awaits the reset. Jest resolves modules itself, so a
+  // Node process of its own makes the calls.
+  posixIt('leaves require() resolving symlinks while it awaits the reclaim of a stale socket', async () => {
+    const daemonPid: number = await startExitedProcessAsync();
+    await leaveStaleSocketAsync(paths.socketPath);
+    recordDaemonOwner(paths, daemonPid);
+    const result: IRequireAfterScriptResult = runThenRequireSymlinkedPackage(
+      folder,
+      [
+        'const [modulePath, pathsJson] = args;',
+        "const net = require('node:net');",
+        "const path = require('node:path');",
+        'const { resetDaemonArtifactsAsync } = require(modulePath);',
+        'const connect = net.Socket.prototype.connect;',
+        'let connections = 0;',
+        // The first connection finds the endpoint unbound. The reset awaits the second, the reclaim's probe.
+        'net.Socket.prototype.connect = function (...connectArgs) {',
+        '  if (++connections === 2) {',
+        "    try { process.stdout.write(`${require('./app/node_modules/symlinked-package')}\\n`); }",
+        '    catch (error) { process.stdout.write(`${error.code}\\n`); }',
+        '  }',
+        '  return connect.apply(this, connectArgs);',
+        '};',
+        'const { removedPaths } = await resetDaemonArtifactsAsync(JSON.parse(pathsJson));',
+        "process.stdout.write(`${removedPaths.map((removed) => path.basename(removed)).join(' ')}\\n`);"
+      ].join('\n'),
+      [require.resolve('../DaemonOwnership'), JSON.stringify(paths)]
+    );
+    expect(result).toEqual({ status: 0, stdout: 'found\ndaemon.pid.json d.sock\nfound', stderr: '' });
+  });
+
   linuxIt(
     'stops a recorded operation group but never one whose leader has another start time, and removes the records',
     async () => {

From 170f38ded8b96bf43e6eaf1933a704c2e65f98cb Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:33 +0000
Subject: [PATCH 195/265] [rush-daemon-transport] Tie a leaderless operation
 group to its daemon

Swarm integration step 180; original commit e4b8c90ad1 (merge of swarm/r06-t248-int at bc8c24c0d6).
Scope: task 248.

Brings 248 (branch swarm/r06-t248-int). Second agent: t05 board 6010. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 14 of 17. Gate: ch01 GATE OK board 6389 (tree 3817b624bc)

Commits folded into this step (1):
- 5902e05327 rush-daemon-transport: tie a leaderless operation group to its daemon

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  6 +-
 ...248-operation-marker_2026-09-29-15-30.json | 11 +++
 ...248-operation-marker_2026-09-29-15-30.json | 11 +++
 ...248-operation-marker_2026-09-29-15-30.json | 11 +++
 ...248-operation-marker_2026-09-29-15-30.json | 11 +++
 .../reviews/api/rush-daemon-transport.api.md  |  3 +
 .../src/DaemonOperationGroupMarker.ts         | 37 +++++++
 .../src/DaemonOperationGroupProof.ts          | 46 +++++++++
 .../src/DaemonOperationGroupReaper.ts         | 44 +++------
 .../src/DaemonOperationGroupRecorder.ts       |  7 ++
 .../src/DaemonProcessGroup.ts                 |  4 +-
 .../src/DaemonProcessStat.ts                  | 15 +++
 .../src/DaemonReusedOwnerReap.ts              |  5 +-
 libraries/rush-daemon-transport/src/index.ts  |  1 +
 .../src/test/FakeProcessTable.ts              | 67 +++++++++++++
 .../src/test/OperationGroupMarker.test.ts     | 64 +++++++++++++
 .../test/OperationGroupMarkerProof.test.ts    | 96 +++++++++++++++++++
 .../src/test/OperationGroupMarkerReap.test.ts | 96 +++++++++++++++++++
 .../test/OperationMarkerInheritance.test.ts   | 41 ++++++++
 .../src/test/OrphanReaperFixture.ts           | 29 +-----
 libraries/rush-daemon/README.md               |  5 +-
 .../src/GlobalCommandExecutionContext.ts      | 11 ++-
 .../rush-daemon/src/GlobalCommandRequest.ts   | 18 ++++
 .../test/GlobalCommandRequestRouter.test.ts   | 62 ++++++++++++
 ...roductionDaemonEnvironmentIdentity.test.ts | 36 ++++++-
 .../src/api/WorkspaceInputFingerprint.ts      | 33 +++++--
 .../test/WorkspaceInputFingerprint.test.ts    | 29 +++++-
 ...TrimRushEnvironmentVariablesPlugin.test.ts |  2 +
 .../src/utilities/test/Utilities.test.ts      | 18 ++++
 29 files changed, 742 insertions(+), 77 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index d367cd7b81..019a8954be 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -653,13 +653,15 @@ not complete hello/ping, for example because a signal stopped it. When the recor
 down and may have left operations running that only its records name, so the reset first stops them
 as the next daemon start would: SIGTERM, then SIGKILL 2 seconds later, to the daemon's own process
 group and to each operation process group that it recorded whose leader still has the recorded start
-time (or has exited, while every live member of the group is in the group's own session). When a
+time (or has exited, while every live member of the group is in the group's own session and one of
+them still has the `RUSHD_OPERATION_GROUPS` variable that the daemon gives the processes it starts). When a
 process that started after the record was written has the recorded PID now, the daemon exited the same
 way, so the reset stops the operation process groups that it recorded the same way, but never the
 process group whose ID is that PID, which the later process may lead. It prints the
 line shown above for a lost connection and reports what it stopped in `orphansReaped` (`daemonPid`,
 `processGroupIds`, `outcome`). A recorded group that it cannot prove, such as a PID that a later
-process now has, is not signalled; its record is removed with the others. If the operations cannot be
+process now has, or a group whose leader has exited under a daemon from a release that did not set
+`RUSHD_OPERATION_GROUPS`, is not signalled; its record is removed with the others. If the operations cannot be
 stopped, it exits with code 1 and removes nothing. While another process reclaims the same files it
 also exits with code 1, except that after a shutdown it re-checks for up to 15 seconds. Otherwise it
 never signals a process. Automatic startup already reclaims
diff --git a/common/changes/@microsoft/rush/swarm-r06-t248-operation-marker_2026-09-29-15-30.json b/common/changes/@microsoft/rush/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
new file mode 100644
index 0000000000..8abd2d16a3
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "`RUSHD_OPERATION_GROUPS` is now one of the workspace fingerprint's ignored variables and one of its request-scoped variables. `getWorkspaceRequestOperationEnvironment()` takes it from the host, never from the request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r06-t248-operation-marker_2026-09-29-15-30.json b/common/changes/@rushstack/rush-cli-client/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
new file mode 100644
index 0000000000..a4943dfd5d
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "The README now says that a recorded operation group whose leader has exited is stopped only if one of its members still carries the daemon's `RUSHD_OPERATION_GROUPS` value.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t248-operation-marker_2026-09-29-15-30.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
new file mode 100644
index 0000000000..68cf80244e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add `DAEMON_OPERATION_GROUPS_ENV_VAR` (`RUSHD_OPERATION_GROUPS`). On Linux, a daemon that records its operation process groups sets it in its own environment, so the processes that it starts carry it. After the daemon dies, a recorded group whose leader has exited is stopped only if one of its live members still carries that daemon's value. A later process that got the recorded ID and called `setsid()` is no longer stopped. A daemon from an earlier release sets no value, so the first reclaim after an upgrade leaves its groups whose leader has exited running.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r06-t248-operation-marker_2026-09-29-15-30.json b/common/changes/@rushstack/rush-daemon/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
new file mode 100644
index 0000000000..e895dc22fa
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r06-t248-operation-marker_2026-09-29-15-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The child processes of global commands, such as `rushx` scripts and native mutations, now get the daemon's own `RUSHD_OPERATION_GROUPS` or none, never the request's value.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index 3729926e7d..b9dccb7d55 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -17,6 +17,9 @@ export function computeDaemonWorkspaceKey(input: IWorkspaceKeyInput): string;
 // @beta
 export function connectDaemonAsync(socketPath: string, options?: IDaemonConnectorOptions): Promise<DaemonFrameConnection>;
 
+// @beta
+export const DAEMON_OPERATION_GROUPS_ENV_VAR: 'RUSHD_OPERATION_GROUPS';
+
 // @beta
 export const DAEMON_RUNTIME_DIR_ENV_VAR: 'RUSHD_RUNTIME_DIR';
 
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts
new file mode 100644
index 0000000000..ade5417e31
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupMarker.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+const ENTRY_SEPARATOR: string = '=';
+
+/**
+ * The environment variable that marks every process a daemon starts while it records operation process groups.
+ *
+ * @remarks
+ * On Linux, a daemon sets it in its own `process.env` to the folder in which it records its operations' process
+ * groups, so every process that it starts, and every descendant that keeps its environment, carries it. After
+ * the daemon dies, a recorded group whose leader has exited is signaled only if one of its live members still
+ * carries the marker of that folder: without it, a later process that got the recorded pid and called `setsid()`
+ * would pass for the operation. A host that builds a child's environment from a request instead of from its own
+ * `process.env` passes on its own value, never the request's. The variable is not part of a daemon's identity.
+ *
+ * @beta
+ */
+export const DAEMON_OPERATION_GROUPS_ENV_VAR: 'RUSHD_OPERATION_GROUPS' = 'RUSHD_OPERATION_GROUPS';
+
+/** Removes the marker that {@link markOperationGroups} set, unless something else has replaced it. */
+export type UnmarkOperationGroups = () => void;
+
+/** The environment entry (`NAME=value`) that marks the operations whose groups are recorded in `folder`. */
+export function getOperationGroupsMarker(folder: string): string {
+  return `${DAEMON_OPERATION_GROUPS_ENV_VAR}${ENTRY_SEPARATOR}${folder}`;
+}
+
+/** Marks the processes that this process starts from now on as operations recorded in `folder`. */
+export function markOperationGroups(folder: string): UnmarkOperationGroups {
+  process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = folder;
+  return () => {
+    if (process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] === folder) {
+      delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+    }
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts
new file mode 100644
index 0000000000..3f9918536e
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupProof.ts
@@ -0,0 +1,46 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import type { IProcessStat } from './DaemonProcessStat';
+import { isSignalableGroup } from './DaemonReapOptions';
+import type { IReapContext } from './DaemonReapOptions';
+
+function isSameLeader(leader: IProcessStat, record: IOperationGroupRecord): boolean {
+  const { groupId } = record;
+  return leader.startTime === record.startTime && leader.groupId === groupId && leader.sessionId === groupId;
+}
+
+// Every group lives inside one session. A group whose session is its own id was created by setsid() of
+// the recorded leader, or of a reused pid that also called setsid(), which needs the pid space to wrap.
+// So one live member must also carry the marker that the daemon gives every process it starts: a reused
+// pid's session has no reason to. A shell job's group lives in its shell's session and is rejected. A stale
+// record's group usually has no process at all, which kill() proves without reading every process's record.
+function isLeaderlessOperationGroup(groupId: number, context: IReapContext, marker: string): boolean {
+  if (!context.ops.mayHaveMembers(groupId)) return false;
+  const members: IProcessStat[] = context.ops.listLiveGroupMembers(groupId);
+  return (
+    members.every((member: IProcessStat) => member.sessionId === groupId) &&
+    members.some((member: IProcessStat) => context.ops.hasEnvironmentEntry(member.pid, marker))
+  );
+}
+
+// A zombie leader has exited, and only its parent can remove it, so it proves nothing about its group.
+function readLiveLeader(groupId: number, context: IReapContext): IProcessStat | undefined {
+  const leader: IProcessStat | undefined = context.ops.readProcessStat(groupId);
+  return leader?.exited ? undefined : leader;
+}
+
+/**
+ * `true` when `record` provably still names an operation of the dead daemon whose records carry `marker`
+ * (see `getOperationGroupsMarker`), so that its group may be signaled.
+ */
+export function isProvenOperationGroup(
+  record: IOperationGroupRecord,
+  context: IReapContext,
+  marker: string
+): boolean {
+  if (!isSignalableGroup(record.groupId, context)) return false;
+  const leader: IProcessStat | undefined = readLiveLeader(record.groupId, context);
+  return leader ? isSameLeader(leader, record) : isLeaderlessOperationGroup(record.groupId, context, marker);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index e4c6e2e5d2..f2e5a21081 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -3,6 +3,8 @@
 
 import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
 import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
+import { getOperationGroupsMarker } from './DaemonOperationGroupMarker';
+import { isProvenOperationGroup } from './DaemonOperationGroupProof';
 import {
   getOperationGroupsFolder,
   readOperationGroupRecords,
@@ -10,8 +12,7 @@ import {
 } from './DaemonOperationGroups';
 import type { IOperationGroupRecord } from './DaemonOperationGroups';
 import { isOwnedEntry } from './DaemonOwnedEntry';
-import type { IProcessStat } from './DaemonProcessStat';
-import { createReapContext, isSignalableGroup, reportOrphansReaped } from './DaemonReapOptions';
+import { createReapContext, reportOrphansReaped } from './DaemonReapOptions';
 import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
 import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
 
@@ -19,33 +20,6 @@ const NO_MEMBERS: number = 0;
 const LIST_SEPARATOR: string = ', ';
 const NOTHING_REAPED: DaemonOrphanReapOutcome = 'none';
 
-function isSameLeader(leader: IProcessStat, record: IOperationGroupRecord): boolean {
-  const { groupId } = record;
-  return leader.startTime === record.startTime && leader.groupId === groupId && leader.sessionId === groupId;
-}
-
-// Every group lives inside one session. A group whose session is its own id was created by setsid() of
-// the recorded leader (or of a reused pid that also called setsid(), which needs the pid space to wrap);
-// a shell job's group lives in its shell's session and is rejected. A stale record's group usually has no
-// process at all, which kill() proves without reading every process's record.
-function isLeaderlessOperationGroup(groupId: number, context: IReapContext): boolean {
-  if (!context.ops.mayHaveMembers(groupId)) return false;
-  const members: IProcessStat[] = context.ops.listLiveGroupMembers(groupId);
-  return members.length > NO_MEMBERS && members.every((member: IProcessStat) => member.sessionId === groupId);
-}
-
-// A zombie leader has exited, and only its parent can remove it, so it proves nothing about its group.
-function readLiveLeader(groupId: number, context: IReapContext): IProcessStat | undefined {
-  const leader: IProcessStat | undefined = context.ops.readProcessStat(groupId);
-  return leader?.exited ? undefined : leader;
-}
-
-function isProvenOperationGroup(record: IOperationGroupRecord, context: IReapContext): boolean {
-  if (!isSignalableGroup(record.groupId, context)) return false;
-  const leader: IProcessStat | undefined = readLiveLeader(record.groupId, context);
-  return leader ? isSameLeader(leader, record) : isLeaderlessOperationGroup(record.groupId, context);
-}
-
 async function terminateAndLogAsync(
   context: IReapContext,
   groupIds: number[]
@@ -64,8 +38,9 @@ async function reapRecordedGroupsAsync(
   folder: string,
   context: IReapContext
 ): Promise<DaemonOrphanReapOutcome> {
+  const marker: string = getOperationGroupsMarker(folder);
   const groupIds: number[] = readOperationGroupRecords(folder)
-    .filter((record: IOperationGroupRecord) => isProvenOperationGroup(record, context))
+    .filter((record: IOperationGroupRecord) => isProvenOperationGroup(record, context, marker))
     .map((record: IOperationGroupRecord) => record.groupId);
   const outcome: DaemonOrphanReapOutcome =
     groupIds.length > NO_MEMBERS ? await terminateAndLogAsync(context, groupIds) : NOTHING_REAPED;
@@ -80,9 +55,12 @@ async function reapRecordedGroupsAsync(
  * @remarks
  * A record is signaled only when it provably still names the daemon's operation: its leader is alive with
  * the recorded start time and still leads group and session `groupId` (a reused pid has another start
- * time), or its leader has exited (a zombie leader has too) and every live member of the group is in
- * session `groupId`. Unproven records are dropped without a signal. Records survive a failed reap, so the
- * next reclaim retries.
+ * time), or its leader has exited (a zombie leader has too), every live member of the group is in
+ * session `groupId`, and at least one of them carries the daemon's marker (`RUSHD_OPERATION_GROUPS` set to
+ * the record folder; see `startOperationGroupRecording`). Unproven records are dropped without a signal.
+ * A daemon from a release before that marker sets none, so the first reclaim after an upgrade drops its
+ * recorded groups whose leader has exited and leaves them running.
+ * Records survive a failed reap, so the next reclaim retries.
  * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
  * Call only under the reclaim mutex, after the daemon has been proven dead, or its pid proven reused
  * (`deadPidReused`).
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
index 9ea4368ddb..5763a23327 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
@@ -4,6 +4,8 @@
 import type { ChildProcess } from 'node:child_process';
 import * as diagnosticsChannel from 'node:diagnostics_channel';
 
+import { markOperationGroups } from './DaemonOperationGroupMarker';
+import type { UnmarkOperationGroups } from './DaemonOperationGroupMarker';
 import {
   removeOperationGroupRecord,
   removeOperationGroupRecords,
@@ -55,9 +57,13 @@ function recordWhileRunning(child: ChildProcess, folder: string): void {
  *
  * @remarks
  * Linux only: records need `/proc` start times to rule out pid reuse. Elsewhere this records nothing.
+ * While it records, `process.env` carries `RUSHD_OPERATION_GROUPS` set to `folder`, which every process
+ * started from then on inherits unless it is given an environment without it; a successor signals a recorded
+ * group whose leader has exited only when one of its live members carries it.
  */
 export function startOperationGroupRecording(folder: string): StopOperationGroupRecording {
   if (readProcessStat(process.pid) === undefined) return () => undefined;
+  const unmark: UnmarkOperationGroups = markOperationGroups(folder);
   const onChildProcess = (message: unknown): void => {
     const child: ChildProcess = (message as IChildProcessMessage).process;
     child.once(SPAWN_EVENT, () => recordWhileRunning(child, folder));
@@ -65,6 +71,7 @@ export function startOperationGroupRecording(folder: string): StopOperationGroup
   diagnosticsChannel.subscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
   return () => {
     diagnosticsChannel.unsubscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
+    unmark();
     bestEffort(() => removeOperationGroupRecords(folder));
   };
 }
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
index f64101d363..fa3a997bf3 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
@@ -6,7 +6,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { hasLiveGroupMember, mayHaveGroupMembers } from './DaemonGroupMemberScan';
 import { isDaemonProcessAlive } from './DaemonLockfile';
-import { listLiveGroupMembers, readProcessStat } from './DaemonProcessStat';
+import { hasEnvironmentEntry, listLiveGroupMembers, readProcessStat } from './DaemonProcessStat';
 import type { IProcessStat } from './DaemonProcessStat';
 
 const NO_SIGNAL: number = 0;
@@ -32,6 +32,7 @@ export interface IDaemonProcessGroupOps {
   readonly readProcessStat: (pid: number) => IProcessStat | undefined;
   /** The processes in a group that have not exited. */
   readonly listLiveGroupMembers: (groupId: number) => IProcessStat[];
+  readonly hasEnvironmentEntry: (pid: number, entry: string) => boolean;
   readonly delayAsync: (ms: number) => Promise<void>;
   readonly now: () => number;
   readonly log: (message: string) => void;
@@ -90,6 +91,7 @@ export const POSIX_PROCESS_GROUP_OPS: IDaemonProcessGroupOps = {
   ownGroupId,
   readProcessStat,
   listLiveGroupMembers,
+  hasEnvironmentEntry,
   delayAsync: async (ms: number) => {
     await delayAsync(ms);
   },
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
index f0e5e30746..db32b01841 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
@@ -5,6 +5,8 @@ import * as fs from 'node:fs';
 
 const PROC_ROOT: string = '/proc';
 const STAT_FILE_NAME: string = 'stat';
+const ENVIRON_FILE_NAME: string = 'environ';
+const ENTRY_TERMINATOR: string = '\0';
 const UTF8: BufferEncoding = 'utf8';
 const COMM_END: string = ')';
 const FIELD_SEPARATOR: string = ' ';
@@ -81,3 +83,16 @@ export function listLiveGroupMembers(groupId: number): IProcessStat[] {
     .map(readProcessStat)
     .filter((stat: IProcessStat | undefined): stat is IProcessStat => isLiveMemberOf(groupId, stat));
 }
+
+/**
+ * `true` when the environment that process `pid` started with holds exactly `entry` (`NAME=value`); `false`
+ * when it does not, or when it cannot be read: the process is gone or another user's, or there is no `/proc`.
+ */
+export function hasEnvironmentEntry(pid: number, entry: string): boolean {
+  try {
+    const environ: string = fs.readFileSync(`${PROC_ROOT}/${pid}/${ENVIRON_FILE_NAME}`, UTF8);
+    return environ.split(ENTRY_TERMINATOR).includes(entry);
+  } catch {
+    return false;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts b/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
index 4bb46bec4e..eea4a4ccd2 100644
--- a/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReusedOwnerReap.ts
@@ -17,8 +17,9 @@ import type { IDaemonReclaimOptions } from './DaemonReclaimOptions';
  * would have written a later one. Once the lockfile is removed, no reclaim finds these records, since a live
  * PID's record folder is left alone, so call this before removing it.
  * A record is signaled only with the proof that a dead daemon's records require: its leader is alive with the
- * recorded start time and leads its own group and session, or its leader has exited and every live member of
- * the group is in the group's own session. Group `ownerPid`, which the later process may lead, is never
+ * recorded start time and leads its own group and session, or its leader has exited, every live member of
+ * the group is in the group's own session, and one of them carries the daemon's `RUSHD_OPERATION_GROUPS`
+ * marker (see `DAEMON_OPERATION_GROUPS_ENV_VAR`). Group `ownerPid`, which the later process may lead, is never
  * signaled. Unproven records are dropped without a signal, and records survive a failed reap. Each set of
  * stopped groups is reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process
  * warning. Nothing is read, reaped or removed unless the runtime directory is a private directory of this
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index fa5e01686e..25c60f30bd 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -25,6 +25,7 @@ export {
   writeDaemonLockfile,
   type IDaemonLockfile
 } from './DaemonLockfile';
+export { DAEMON_OPERATION_GROUPS_ENV_VAR } from './DaemonOperationGroupMarker';
 export { tryAcquireReclaimLock, type DaemonReclaimLockOutcome } from './DaemonReclaimLock';
 export {
   DAEMON_RUNTIME_DIR_ENV_VAR,
diff --git a/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts b/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
new file mode 100644
index 0000000000..6a63c9e7eb
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const ANY_LOCKFILE: string = '';
+
+/** Describes the processes of a fake process table. */
+export interface IFakeProcessSpec {
+  /** The signal after which every group is gone; omitted means they never exit. */
+  readonly exitsOn?: NodeJS.Signals;
+  /** Processes outside the dead daemon's own group, such as detached operation trees. */
+  readonly processes?: readonly IProcessStat[];
+  /**
+   * The only environment entry that each listed pid carries, or `undefined` for none. Every other process carries
+   * the marker of the dead daemon's record folder, as the processes that the daemon started do.
+   */
+  readonly markers?: ReadonlyMap<number, string | undefined>;
+}
+
+/** The state of a fake process table that decides which of its processes are alive. */
+export interface IFakeProcessTable {
+  readonly spec: IFakeProcessSpec;
+  readonly signals: readonly NodeJS.Signals[];
+}
+
+/** `true` once the table's processes have received the signal after which they are gone. */
+export function hasExited(table: IFakeProcessTable): boolean {
+  return table.signals.some((signal: NodeJS.Signals) => signal === table.spec.exitsOn);
+}
+
+/** The table's processes, or none once they are gone. */
+export function liveProcesses(table: IFakeProcessTable): readonly IProcessStat[] {
+  return hasExited(table) ? [] : (table.spec.processes ?? []);
+}
+
+// Every record folder of daemon `daemonPid` is `<lockfile path>.groups-<daemonPid>`.
+function isMarkerOf(daemonPid: number, entry: string): boolean {
+  const folderSuffix: string = getOperationGroupsFolder(ANY_LOCKFILE, daemonPid);
+  return entry.startsWith(getOperationGroupsMarker(ANY_LOCKFILE)) && entry.endsWith(folderSuffix);
+}
+
+function hasEnvironmentEntry(
+  table: IFakeProcessTable,
+  daemonPid: number,
+  pid: number,
+  entry: string
+): boolean {
+  const { markers } = table.spec;
+  return markers?.has(pid) === true ? markers.get(pid) === entry : isMarkerOf(daemonPid, entry);
+}
+
+/** The process-reading ops of a fake table in which `daemonPid` is the dead daemon. */
+export function createProcessOps(
+  table: IFakeProcessTable,
+  daemonPid: number
+): Pick<IDaemonProcessGroupOps, 'readProcessStat' | 'listLiveGroupMembers' | 'hasEnvironmentEntry'> {
+  return {
+    readProcessStat: (pid: number) => liveProcesses(table).find((stat: IProcessStat) => stat.pid === pid),
+    listLiveGroupMembers: (groupId: number) =>
+      liveProcesses(table).filter((stat: IProcessStat) => stat.groupId === groupId && !stat.exited),
+    hasEnvironmentEntry: (pid: number, entry: string) => hasEnvironmentEntry(table, daemonPid, pid, entry)
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts
new file mode 100644
index 0000000000..98e11d53c7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupMarker.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR, getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import type { StopOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { hasEnvironmentEntry } from '../DaemonProcessStat';
+
+import { identifyStarted, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const NAME: string = 'RUSHD_TEST_ENVIRONMENT_ENTRY';
+const VALUE: string = '/tmp/rushd-1000/key.pid.json.groups-4242';
+const FOREIGN_FOLDER: string = '/elsewhere.groups-4242';
+const ENTRY: string = `${NAME}=${VALUE}`;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+  delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+});
+
+function recordingFolder(): string {
+  return getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+}
+
+linuxIt('marks the processes started while it records, and removes only its own marker', () => {
+  const folder: string = recordingFolder();
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  expect(process.env[DAEMON_OPERATION_GROUPS_ENV_VAR]).toBe(folder);
+  expect(getOperationGroupsMarker(folder)).toBe(`${DAEMON_OPERATION_GROUPS_ENV_VAR}=${folder}`);
+  stop();
+  expect(process.env[DAEMON_OPERATION_GROUPS_ENV_VAR]).toBeUndefined();
+  const stopAgain: StopOperationGroupRecording = startOperationGroupRecording(recordingFolder());
+  process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = FOREIGN_FOLDER;
+  stopAgain();
+  expect(process.env[DAEMON_OPERATION_GROUPS_ENV_VAR]).toBe(FOREIGN_FOLDER);
+});
+
+linuxIt('finds only an exact entry of the environment that a process started with', async () => {
+  const child: ChildProcess = spawn(process.execPath, SLEEP_ARGS, {
+    env: { [NAME]: VALUE },
+    stdio: 'ignore'
+  });
+  await once(child, 'spawn');
+  const pid: number = Number(child.pid);
+  started = identifyStarted([pid]);
+  expect(hasEnvironmentEntry(pid, ENTRY)).toBe(true);
+  for (const entry of [`${NAME}=${FOREIGN_FOLDER}`, `${NAME}=`, NAME, `${ENTRY}/`, VALUE]) {
+    expect(hasEnvironmentEntry(pid, entry)).toBe(false);
+  }
+  child.kill('SIGKILL');
+  expect(await waitUntilAsync(() => isGone(pid))).toBe(true);
+  expect(hasEnvironmentEntry(pid, ENTRY)).toBe(false);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts
new file mode 100644
index 0000000000..435c2eb7c9
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerProof.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import {
+  OPERATION_CHILD,
+  OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+type Markers = ReadonlyMap<number, string | undefined>;
+type MarkersOf = (lockfilePath: string) => Markers;
+
+interface IReap {
+  readonly outcome: string;
+  readonly fake: IFakeGroup;
+}
+
+const NEXT_PID: number = 1;
+const OTHER_DAEMON_PID: number = DEAD_PID + NEXT_PID;
+const OTHER_WORKSPACE_SUFFIX: string = '.other';
+const NO_FOLDER: string = '';
+// A group whose leader has exited, with two live members in its session.
+const LEADERLESS: readonly IProcessStat[] = [
+  ...operationTree(OPERATION_GROUP, false),
+  stat(OPERATION_CHILD + NEXT_PID, OPERATION_GROUP)
+];
+
+function unmarked(processes: readonly IProcessStat[]): Map<number, string | undefined> {
+  return new Map(processes.map((member: IProcessStat) => [member.pid, undefined]));
+}
+
+function deadDaemonMarker(lockfilePath: string): string {
+  return getOperationGroupsMarker(getOperationGroupsFolder(lockfilePath, DEAD_PID));
+}
+
+async function reapAsync(processes: readonly IProcessStat[], markersOf: MarkersOf): Promise<IReap> {
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  const fake: IFakeGroup = createFakeGroup({
+    exitsOn: 'SIGTERM',
+    processes,
+    markers: markersOf(lockfilePath)
+  });
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options);
+  expect(recordsRemain(lockfilePath)).toBe(false);
+  return { outcome, fake };
+}
+
+it("never signals a leaderless group none of whose members carries the dead daemon's marker", async () => {
+  const { outcome, fake } = await reapAsync(LEADERLESS, () => unmarked(LEADERLESS));
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+it.each<[string, (lockfilePath: string) => string]>([
+  [
+    'another daemon beside the same lockfile',
+    (lockfilePath: string) =>
+      getOperationGroupsMarker(getOperationGroupsFolder(lockfilePath, OTHER_DAEMON_PID))
+  ],
+  [
+    'the same daemon pid in another workspace',
+    (lockfilePath: string) => deadDaemonMarker(`${lockfilePath}${OTHER_WORKSPACE_SUFFIX}`)
+  ],
+  ['no folder at all', () => getOperationGroupsMarker(NO_FOLDER)]
+])('never signals a leaderless group whose member carries the marker of %s', async (name, markerOf) => {
+  const markersOf: MarkersOf = (lockfilePath: string) =>
+    new Map([...unmarked(LEADERLESS), [OPERATION_CHILD, markerOf(lockfilePath)]]);
+  const { outcome, fake } = await reapAsync(LEADERLESS, markersOf);
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+});
+
+it("signals a leaderless group when one of its members carries the dead daemon's marker", async () => {
+  const markersOf: MarkersOf = (lockfilePath: string) =>
+    new Map([...unmarked(LEADERLESS), [OPERATION_CHILD, deadDaemonMarker(lockfilePath)]]);
+  const { outcome, fake } = await reapAsync(LEADERLESS, markersOf);
+  expect(outcome).toBe('terminated');
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+});
+
+it('still signals a group whose leader is alive with the recorded start time without any marker', async () => {
+  const tree: readonly IProcessStat[] = operationTree(OPERATION_GROUP);
+  const { outcome, fake } = await reapAsync(tree, () => unmarked(tree));
+  expect(outcome).toBe('terminated');
+  expect(fake.targets).toEqual([OPERATION_GROUP]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts
new file mode 100644
index 0000000000..fcc4d429d4
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupMarkerReap.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Readable } from 'node:stream';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { RECORDED_START } from './OperationGroupFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A detached shell leads a new session and group, starts a member in them, prints its pid and exits, which
+// leaves the group without its leader, as an operation whose shell has exited does.
+const LEADERLESS_SCRIPT: string = 'sleep 600 </dev/null >/dev/null 2>&1 & echo $!';
+const SHELL_OPTIONS: { detached: true; stdio: ['ignore', 'pipe', 'ignore'] } = {
+  detached: true,
+  stdio: ['ignore', 'pipe', 'ignore']
+};
+const GRACE_MS: number = 500;
+const OTHER_WORKSPACE_SUFFIX: string = '.other';
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface ILeaderlessGroup {
+  readonly groupId: number;
+  readonly member: number;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function startLeaderlessGroupAsync(marker: string | undefined): Promise<ILeaderlessGroup> {
+  const env: NodeJS.ProcessEnv = { PATH: process.env.PATH, [DAEMON_OPERATION_GROUPS_ENV_VAR]: marker };
+  const shell: ChildProcess = spawn('/bin/sh', ['-c', LEADERLESS_SCRIPT], { ...SHELL_OPTIONS, env });
+  const exited: Promise<unknown[]> = once(shell, 'exit');
+  const [chunk] = (await once(shell.stdout as Readable, 'data')) as [Buffer];
+  const member: number = Number(chunk.toString().trim());
+  started = identifyStarted([member]);
+  await exited;
+  const groupId: number = Number(shell.pid);
+  expect(await waitUntilAsync(() => isGone(groupId))).toBe(true);
+  return { groupId, member };
+}
+
+function deadDaemonFolder(lockfilePath: string): string {
+  return getOperationGroupsFolder(lockfilePath, DEAD_PID);
+}
+
+// Records a real leaderless group for the dead daemon, whose member has the marker `markerOf(lockfilePath)`.
+async function reapWithMarkerAsync(markerOf: (lockfilePath: string) => string | undefined): Promise<string> {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = deadDaemonFolder(lockfilePath);
+  const { groupId, member } = await startLeaderlessGroupAsync(markerOf(lockfilePath));
+  expect(isAlive(member)).toBe(true);
+  fs.mkdirSync(folder, { recursive: true });
+  writeOperationGroupRecord(folder, { groupId, startTime: RECORDED_START });
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, OPTIONS);
+  expect(fs.existsSync(folder)).toBe(false);
+  return outcome;
+}
+
+linuxIt('never signals a real leaderless group whose live member has no marker', async () => {
+  await expect(reapWithMarkerAsync(() => undefined)).resolves.toBe('none');
+  expect(started.map(({ pid }) => isAlive(pid))).toEqual([true]);
+});
+
+linuxIt(
+  'never signals a real leaderless group whose live member has the marker of another workspace',
+  async () => {
+    const otherWorkspaceFolder = (lockfilePath: string): string =>
+      deadDaemonFolder(`${lockfilePath}${OTHER_WORKSPACE_SUFFIX}`);
+    await expect(reapWithMarkerAsync(otherWorkspaceFolder)).resolves.toBe('none');
+    expect(started.map(({ pid }) => isAlive(pid))).toEqual([true]);
+  }
+);
+
+linuxIt("signals a real leaderless group whose live member has the dead daemon's marker", async () => {
+  await expect(reapWithMarkerAsync(deadDaemonFolder)).resolves.toBe('terminated');
+  expect(await waitUntilAsync(() => !started.some(({ pid }) => isAlive(pid)))).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts b/libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts
new file mode 100644
index 0000000000..caf5a5d3e0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationMarkerInheritance.test.ts
@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { hasEnvironmentEntry } from '../DaemonProcessStat';
+
+import { killFakeDaemonAsync, startFakeDaemonAsync } from './FakeOperationDaemonFixture';
+import type { IFakeDaemon } from './FakeOperationDaemonFixture';
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  // The fake daemon's operations outlive it.
+  killStillRunning(started);
+  started = [];
+});
+
+linuxIt(
+  'gives the operations of a recording daemon, and their children, the marker of its records',
+  async () => {
+    const paths: IDaemonPaths = createTestDaemonPaths();
+    const fake: IFakeDaemon = await startFakeDaemonAsync(paths);
+    const daemonPid: number = Number(fake.daemon.pid);
+    started = identifyStarted([daemonPid, ...fake.pids]);
+    const marker: string = getOperationGroupsMarker(getOperationGroupsFolder(paths.lockfilePath, daemonPid));
+    const otherMarker: string = getOperationGroupsMarker(
+      getOperationGroupsFolder(paths.lockfilePath, process.pid)
+    );
+    expect(fake.pids.map((pid: number) => hasEnvironmentEntry(pid, marker))).toEqual(
+      fake.pids.map(() => true)
+    );
+    expect(fake.pids.some((pid: number) => hasEnvironmentEntry(pid, otherMarker))).toBe(false);
+    await killFakeDaemonAsync(fake);
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
index 4a13daf393..8ef4a42fb6 100644
--- a/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
+++ b/libraries/rush-daemon-transport/src/test/OrphanReaperFixture.ts
@@ -5,6 +5,9 @@ import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
 import type { IProcessStat } from '../DaemonProcessStat';
 import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
 
+import { createProcessOps, hasExited, liveProcesses } from './FakeProcessTable';
+import type { IFakeProcessSpec } from './FakeProcessTable';
+
 /** The pid of the fake dead daemon, which is also its process group id. */
 export const DEAD_PID: number = 4242;
 /** The fake caller's own pid (and, by default, its process group id). */
@@ -22,29 +25,17 @@ export interface IFakeGroup {
 }
 
 /** Describes the fake process table. */
-export interface IFakeGroupSpec {
+export interface IFakeGroupSpec extends IFakeProcessSpec {
   readonly daemonAlive?: boolean;
-  /** The signal after which every group is gone; omitted means they never exit. */
-  readonly exitsOn?: NodeJS.Signals;
   readonly ownGroupId?: number;
   readonly unknownOwnGroup?: boolean;
   readonly anyGroupExists?: boolean;
-  /** Processes outside the dead daemon's own group, such as detached operation trees. */
-  readonly processes?: readonly IProcessStat[];
 }
 
 interface IFakeTable extends Omit<IFakeGroup, 'options'> {
   readonly spec: IFakeGroupSpec;
 }
 
-function hasExited(table: IFakeTable): boolean {
-  return table.signals.some((signal: NodeJS.Signals) => signal === table.spec.exitsOn);
-}
-
-function liveProcesses(table: IFakeTable): readonly IProcessStat[] {
-  return hasExited(table) ? [] : (table.spec.processes ?? []);
-}
-
 function isKnownGroup(table: IFakeTable, groupId: number): boolean {
   return table.spec.anyGroupExists === true || groupId === DEAD_PID;
 }
@@ -54,16 +45,6 @@ function groupExists(table: IFakeTable, groupId: number): boolean {
   return !hasExited(table) && (isKnownGroup(table, groupId) || inTable);
 }
 
-function createProcessOps(
-  table: IFakeTable
-): Pick<IDaemonProcessGroupOps, 'readProcessStat' | 'listLiveGroupMembers'> {
-  return {
-    readProcessStat: (pid: number) => liveProcesses(table).find((stat: IProcessStat) => stat.pid === pid),
-    listLiveGroupMembers: (groupId: number) =>
-      liveProcesses(table).filter((stat: IProcessStat) => stat.groupId === groupId && !stat.exited)
-  };
-}
-
 function createGroupOps(table: IFakeTable): IDaemonProcessGroupOps {
   const { spec } = table;
   let clock: number = CLOCK_START;
@@ -76,7 +57,7 @@ function createGroupOps(table: IFakeTable): IDaemonProcessGroupOps {
       table.signals.push(signal);
     },
     ownGroupId: () => (spec.unknownOwnGroup === true ? undefined : (spec.ownGroupId ?? SELF_PID)),
-    ...createProcessOps(table),
+    ...createProcessOps(table, DEAD_PID),
     delayAsync: async (ms: number) => {
       clock += ms;
     },
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 52dbc51fc1..a00dd1480f 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -123,7 +123,10 @@ so running a command from a project subfolder or another shell reuses the warm w
 inputs, including every other `RUSH_*` variable, `NODE_*`, npm/pnpm configuration, `PATH` and `HOME`, remain
 unchanged and are checked normally. Each phased operation process takes the ignored variables from the request
 that selected it (`getWorkspaceRequestOperationEnvironment()`) and hashes its `dependsOnEnvVars` from that
-environment, so it sees the submitting shell's values, as a native command would. The rest of that environment is
+environment, so it sees the submitting shell's values, as a native command would. The exception is
+`RUSHD_OPERATION_GROUPS`: on Linux the daemon sets it in its own `process.env` to mark the processes that it
+starts (`DAEMON_OPERATION_GROUPS_ENV_VAR` of rush-daemon-transport), so operations and the child processes of
+global commands get the daemon's value, or none, never the request's. The rest of that environment is
 the daemon's `process.env` when the operation starts, so it includes variables that a plugin sets in the same
 iteration's `beforeExecuteIterationAsync`; state hashes use the values from when the iteration was scheduled, before
 those hooks run, as native Rush does.
diff --git a/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts b/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
index c2cffbb35a..fe3ac552b6 100644
--- a/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
+++ b/libraries/rush-daemon/src/GlobalCommandExecutionContext.ts
@@ -10,6 +10,7 @@ import { Terminal, TerminalProviderSeverity } from '@rushstack/terminal';
 import type { ITerminal, ITerminalProvider } from '@rushstack/terminal';
 
 import {
+  applyDaemonOperationGroupsMarker,
   createGlobalCommandEnvironment,
   resolveGlobalCommandEnvironment,
   resolveGlobalCommandWorkingDirectory,
@@ -41,7 +42,10 @@ const CHILD_OUTPUT_DRAIN_IDLE_TIMEOUT_MS: number = 250;
 export interface IGlobalCommandSpawnOptions {
   /** An absolute directory, physically confined to the workspace. Explicit Windows path spelling is preserved. */
   readonly cwd?: string;
-  /** A complete child environment; cannot be combined with environmentOverlay. */
+  /**
+   * A complete child environment; cannot be combined with environmentOverlay. Either way, the child gets the daemon's
+   * own `RUSHD_OPERATION_GROUPS`, or none, instead of the request's.
+   */
   readonly environment?: Readonly<NodeJS.ProcessEnv>;
   readonly environmentOverlay?: Readonly<NodeJS.ProcessEnv>;
   readonly forwardInput?: boolean;
@@ -262,10 +266,11 @@ export class GlobalCommandExecutionContext implements IGlobalCommandExecutionCon
     const child: childProcess.ChildProcessWithoutNullStreams = childProcess.spawn(command, [...args], {
       cwd: process.platform === 'win32' ? (options.cwd ?? canonicalCwd) : canonicalCwd,
       detached: SubprocessTerminator.RECOMMENDED_OPTIONS.detached,
-      env:
+      env: applyDaemonOperationGroupsMarker(
         options.environment === undefined
           ? createGlobalCommandEnvironment(this.environment, options.environmentOverlay)
-          : resolveGlobalCommandEnvironment(options.environment),
+          : resolveGlobalCommandEnvironment(options.environment)
+      ),
       shell: options.shell,
       stdio: 'pipe',
       windowsHide: options.windowsHide
diff --git a/libraries/rush-daemon/src/GlobalCommandRequest.ts b/libraries/rush-daemon/src/GlobalCommandRequest.ts
index bb3b1f4360..0d7a148378 100644
--- a/libraries/rush-daemon/src/GlobalCommandRequest.ts
+++ b/libraries/rush-daemon/src/GlobalCommandRequest.ts
@@ -12,6 +12,7 @@ import type {
   DaemonTerminalRequirement,
   IDaemonRequestAdmissionOptions
 } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transport';
 
 import { freezeDaemonRequestAdmissionOptions } from './WorkspaceRequestAdmission';
 import type { IWorkspaceSession } from './WorkspaceSession';
@@ -131,6 +132,23 @@ export function resolveGlobalCommandEnvironment(environment: Readonly<NodeJS.Pro
   return createEnvironmentMap(environment).toObject();
 }
 
+/**
+ * Returns a copy of a child environment built from a request, with the daemon's own marker of the processes that it
+ * starts (`RUSHD_OPERATION_GROUPS`), or without one when the daemon has none, whatever the request's value is.
+ */
+export function applyDaemonOperationGroupsMarker(
+  environment: Readonly<NodeJS.ProcessEnv>
+): NodeJS.ProcessEnv {
+  const environmentMap: EnvironmentMap = new EnvironmentMap(environment);
+  const marker: string | undefined = process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+  if (marker === undefined) {
+    environmentMap.unset(DAEMON_OPERATION_GROUPS_ENV_VAR);
+  } else {
+    environmentMap.set(DAEMON_OPERATION_GROUPS_ENV_VAR, marker);
+  }
+  return environmentMap.toObject();
+}
+
 function validateCommandOrigin(value: DaemonRushCommandOrigin): void {
   if (value !== 'built-in' && value !== 'custom') {
     throw new Error('Global command origin is not recognized.');
diff --git a/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts b/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
index 4fe768425a..6a4a6f1f82 100644
--- a/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
+++ b/libraries/rush-daemon/src/test/GlobalCommandRequestRouter.test.ts
@@ -12,6 +12,7 @@ import type {
   IDaemonSetRawModeMessage,
   IDaemonTerminalPolicyResult
 } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transport';
 
 import { DaemonRequiresInProcessError } from '../DaemonTerminalPolicy';
 import type {
@@ -374,6 +375,67 @@ describe(GlobalCommandRequestRouter.name, () => {
     expect(request.environment.get('CHILD_CONTEXT')).toBe('request');
   });
 
+  describe('the marker of the processes that the daemon starts', () => {
+    const HOST_MARKER: string = '/tmp/rushd-test/key.pid.json.groups-4242';
+    const REQUEST_MARKER: string = '/tmp/rushd-test/outer.pid.json.groups-5151';
+    const originalMarker: string | undefined = process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+    afterEach(() => {
+      if (originalMarker === undefined) delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      else process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = originalMarker;
+    });
+
+    // Runs a child of a request that carries another daemon's marker, and returns the child's marker.
+    async function readChildMarkerAsync(
+      hostMarker: string | undefined,
+      options: IGlobalCommandSpawnOptions
+    ): Promise<string | null> {
+      if (hostMarker === undefined) delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      else process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = hostMarker;
+      const router: GlobalCommandRequestRouter = new GlobalCommandRequestRouter(
+        new TestWorkspaceSession(TEST_REPO_ROOT)
+      );
+      const client: TestGlobalCommandClient = new TestGlobalCommandClient();
+      const requestEnvironment: NodeJS.ProcessEnv = { [DAEMON_OPERATION_GROUPS_ENV_VAR]: REQUEST_MARKER };
+      await router.executeAsync(
+        router.resolveRequest(createRequestOptions('marker', FIRST_CWD, requestEnvironment, 80)),
+        async (context: IGlobalCommandExecutionContext): Promise<IGlobalCommandExecutionResult> => {
+          const child = context.spawnChild(
+            process.execPath,
+            [
+              '-e',
+              `process.stdout.write(JSON.stringify(process.env.${DAEMON_OPERATION_GROUPS_ENV_VAR} ?? null))`
+            ],
+            options
+          );
+          await new Promise<void>((resolve, reject) => {
+            child.once('error', reject);
+            child.once('close', () => resolve());
+          });
+          return { exitCode: 0 };
+        },
+        client
+      );
+      return JSON.parse(
+        client.chunks
+          .filter(({ stream }) => stream === 'stdout')
+          .map(({ text }) => text)
+          .join('')
+      );
+    }
+
+    it.each<[string, IGlobalCommandSpawnOptions]>([
+      ['the request environment', {}],
+      ['an overlay that sets it', { environmentOverlay: { [DAEMON_OPERATION_GROUPS_ENV_VAR]: 'overlay' } }],
+      [
+        'a complete environment that sets it',
+        { environment: { [DAEMON_OPERATION_GROUPS_ENV_VAR]: 'complete' } }
+      ]
+    ])("gives a child of %s the daemon's own marker, or none", async (name, options) => {
+      await expect(readChildMarkerAsync(HOST_MARKER, options)).resolves.toBe(HOST_MARKER);
+      await expect(readChildMarkerAsync(undefined, options)).resolves.toBeNull();
+    });
+  });
+
   (process.platform === 'win32' ? it.skip : it)(
     'cleans a completed child process group before forgetting it',
     async () => {
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
index 1f417dfd16..c5ccf90258 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
@@ -3,8 +3,13 @@
 
 import * as path from 'node:path';
 
-import { PhasedCommandEngine } from '@microsoft/rush-lib';
+import {
+  PhasedCommandEngine,
+  workspaceFingerprintIgnoredEnvironmentVariables,
+  workspaceRequestScopedEnvironmentVariables
+} from '@microsoft/rush-lib';
 import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transport';
 
 import { DaemonRequestEnvironmentError, type IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
@@ -96,6 +101,35 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
     }
   });
 
+  it('keeps serving while the daemon sets, changes or clears the marker of the processes that it starts', async () => {
+    const originalMarker: string | undefined = process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+    try {
+      process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = '/tmp/rushd-test/key.pid.json.groups-1';
+      const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
+      const startupEnvironment: Record<string, string> = getEnvironment();
+      const options: IResolveDaemonRequestOptions = createOptions(startupEnvironment);
+      process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = '/tmp/rushd-test/key.pid.json.groups-2';
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      await expect(resolver.getCommandParameterIdentityAsync(options)).resolves.toBe('parameters');
+      // A client that an operation of another daemon runs has that daemon's marker.
+      const outerMarker: string = '/tmp/rushd-test/outer.pid.json.groups-3';
+      await expect(
+        resolver.getCommandParameterIdentityAsync(
+          createOptions({ ...startupEnvironment, [DAEMON_OPERATION_GROUPS_ENV_VAR]: outerMarker })
+        )
+      ).resolves.toBe('parameters');
+    } finally {
+      if (originalMarker === undefined) delete process.env[DAEMON_OPERATION_GROUPS_ENV_VAR];
+      else process.env[DAEMON_OPERATION_GROUPS_ENV_VAR] = originalMarker;
+    }
+  });
+
+  it("names the transport's marker in rush-lib's ignored and request-scoped variables", () => {
+    expect(workspaceFingerprintIgnoredEnvironmentVariables.has(DAEMON_OPERATION_GROUPS_ENV_VAR)).toBe(true);
+    expect(workspaceRequestScopedEnvironmentVariables.has(DAEMON_OPERATION_GROUPS_ENV_VAR)).toBe(true);
+  });
+
   it('parses a request whose environment differs before it rejects the request for its environment', async () => {
     const resolver: ProductionDaemonRequestResolver = new ProductionDaemonRequestResolver();
     const options: IResolveDaemonRequestOptions = createOptions({ ...getEnvironment(), [ADDED_NAME]: 'x' });
diff --git a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
index 8ac6ef7aa1..1feee0e144 100644
--- a/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
+++ b/libraries/rush-lib/src/api/WorkspaceInputFingerprint.ts
@@ -16,6 +16,9 @@ import { getDaemonIpcImplementationIdentityAsync } from '../logic/operations/Dae
 import { AutoinstallerPluginLoader } from '../pluginFramework/PluginLoader/AutoinstallerPluginLoader';
 import { getFileStamp, getSettledBeforeNs, isFileStatSettled } from '../utilities/FileContentStamp';
 
+// `DAEMON_OPERATION_GROUPS_ENV_VAR` of @rushstack/rush-daemon-transport, which rush-lib does not depend on.
+const OPERATION_GROUPS_VARIABLE: string = 'RUSHD_OPERATION_GROUPS';
+
 /** Stable inputs which distinguish reusable, reloadable, and process-bound workspace state. @alpha */
 export interface IWorkspaceInputFingerprint {
   readonly configurationHash: string;
@@ -81,6 +84,8 @@ export interface IWorkspaceInputFingerprintOptions {
  * - `RUSH_PARALLELISM`, which a long-lived host applies to each request as its `--parallelism` default
  * - temporary and runtime folders, which are often set per session, job or sandbox: `TMPDIR`, `TMP`, `TEMP` and
  *   `XDG_RUNTIME_DIR`, and `RUSHD_RUNTIME_DIR`, which only selects the folder where a client meets its daemon
+ * - `RUSHD_OPERATION_GROUPS`, which a daemon on Linux sets in its own environment after it starts, to mark the
+ *   processes that it starts, so that a later daemon can tell which process groups the daemon left running
  *
  * Every other variable remains a process-bound input, including the remaining `RUSH_*` settings (such as
  * `RUSH_BUILD_CACHE_*` and the daemon's own `RUSH_DAEMON_*` resource settings), `NODE_*`, npm/pnpm
@@ -91,8 +96,9 @@ export interface IWorkspaceInputFingerprintOptions {
  * A long-lived host that ignores these variables must not give the processes it launches the values of the
  * client that started it. Each operation instead takes every one of these variables from the request that it
  * serves ({@link getWorkspaceRequestOperationEnvironment}), and does not receive the variable when that
- * request does not define it. The host's own process also drops {@link workspaceRequestScopedEnvironmentVariables},
- * because code running inside it reads them from `process.env`.
+ * request does not define it, except `RUSHD_OPERATION_GROUPS`, which names the host and is taken from it. The
+ * host's own process also drops {@link workspaceRequestScopedEnvironmentVariables}, because code running inside
+ * it reads them from `process.env`.
  *
  * @alpha
  */
@@ -173,7 +179,8 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
   'TMP',
   'TEMP',
   'XDG_RUNTIME_DIR',
-  'RUSHD_RUNTIME_DIR'
+  'RUSHD_RUNTIME_DIR',
+  OPERATION_GROUPS_VARIABLE
 ]);
 
 /**
@@ -188,7 +195,8 @@ export const workspaceFingerprintIgnoredEnvironmentVariables: ReadonlySet<string
  * `CLAUDE_CODE_MESSAGING_TOKEN` is that session's own credential. Likewise, the first client's `TMPDIR`,
  * `XDG_RUNTIME_DIR`, `CLAUDE_JOB_DIR` or `CLAUDE_CODE_MESSAGING_SOCKET` may be removed when that client's session
  * or job ends, while the host lives on. (`TMP` and `TEMP` stay, because Windows has no usable default for them.)
- * On Windows, names are matched case-insensitively.
+ * A client that an operation of another daemon runs has that daemon's `RUSHD_OPERATION_GROUPS`, which a host must
+ * not pass on as its own. On Windows, names are matched case-insensitively.
  *
  * @alpha
  */
@@ -205,7 +213,8 @@ export const workspaceRequestScopedEnvironmentVariables: ReadonlySet<string> = n
   'TRACESTATE',
   'ODSP_TELEMETRY_TAG',
   'TMPDIR',
-  'XDG_RUNTIME_DIR'
+  'XDG_RUNTIME_DIR',
+  OPERATION_GROUPS_VARIABLE
 ]);
 
 /**
@@ -260,8 +269,9 @@ export function getWorkspaceHostEnvironment(
  * Every variable in {@link workspaceFingerprintIgnoredEnvironmentVariables} takes the request's value, and is
  * omitted when the request does not define it, so that the operation sees its own requester's session, terminal
  * and credential-helper variables. Every other variable comes from the host, whose environment matches the
- * request's for identity. A host returns the result from `IOperationGraphIterationOptions.getOperationEnvironment`.
- * On Windows, names are matched case-insensitively.
+ * request's for identity, and so does `RUSHD_OPERATION_GROUPS`, which marks the processes that the host starts
+ * and is omitted when the host does not define it. A host returns the result from
+ * `IOperationGraphIterationOptions.getOperationEnvironment`. On Windows, names are matched case-insensitively.
  *
  * @alpha
  */
@@ -270,8 +280,13 @@ export function getWorkspaceRequestOperationEnvironment(
   requestEnvironment: Readonly<Record<string, string | undefined>>
 ): Record<string, string> {
   const isWindows: boolean = process.platform === 'win32';
-  const isRequestValue = (name: string): boolean =>
-    workspaceFingerprintIgnoredEnvironmentVariables.has(isWindows ? name.toUpperCase() : name);
+  const isRequestValue = (name: string): boolean => {
+    const normalizedName: string = isWindows ? name.toUpperCase() : name;
+    return (
+      normalizedName !== OPERATION_GROUPS_VARIABLE &&
+      workspaceFingerprintIgnoredEnvironmentVariables.has(normalizedName)
+    );
+  };
   const environment: Record<string, string> = {};
   for (const [name, value] of Object.entries(hostEnvironment)) {
     if (value !== undefined && !isRequestValue(name)) environment[name] = value;
diff --git a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
index ac6a2157ea..bab878b8dc 100644
--- a/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
+++ b/libraries/rush-lib/src/api/test/WorkspaceInputFingerprint.test.ts
@@ -241,10 +241,16 @@ describe('workspace input fingerprints', () => {
         { PATH: `${base.PATH}${path.delimiter}${base.PATH}` },
         { TERM: undefined, PWD: undefined },
         { TMPDIR: '/scratch/job-1', XDG_RUNTIME_DIR: '/run/user/1000' },
-        { TMP: 'C:\\Temp\\2', TEMP: 'C:\\Temp\\2', RUSHD_RUNTIME_DIR: '/run/rush' }
+        { TMP: 'C:\\Temp\\2', TEMP: 'C:\\Temp\\2', RUSHD_RUNTIME_DIR: '/run/rush' },
+        // The marker that a daemon gives the processes it starts, such as a client that an operation runs
+        { RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/key-a.pid.json.groups-4242' },
+        { RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/key-b.pid.json.groups-5151' }
       ]) {
         expect(await getHashAsync({ ...base, ...volatile })).toBe(baseHash);
       }
+      expect(
+        getWorkspaceFingerprintEnvironmentEntries({ ...base, RUSHD_OPERATION_GROUPS: '/tmp/x.groups-1' })
+      ).toEqual(getWorkspaceFingerprintEnvironmentEntries(base));
       for (const relevant of [
         { FOO: '1' },
         // Declaring a plugin daemon-compatible changes which plugins the engine applies.
@@ -299,6 +305,8 @@ describe('workspace input fingerprints', () => {
       XDG_RUNTIME_DIR: '/run/user/1000',
       TEMP: 'C:\\Temp',
       RUSHD_RUNTIME_DIR: '/run/rush',
+      // A client that an operation of another daemon runs carries that daemon's marker.
+      RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/other.pid.json.groups-4242',
       UNSET: undefined
     };
     expect(getWorkspaceHostEnvironment(environment)).toEqual({
@@ -365,6 +373,25 @@ describe('workspace input fingerprints', () => {
     });
   });
 
+  it("gives operations the host's marker of the processes that it starts, never the request's", () => {
+    const hostMarker: string = '/tmp/rushd-1000/key.pid.json.groups-4242';
+    const requestEnvironment: Record<string, string | undefined> = {
+      HOME: '/home/other',
+      RUSHD_OPERATION_GROUPS: '/tmp/rushd-1000/outer.pid.json.groups-5151',
+      WT_SESSION: 'wt-B'
+    };
+    expect(
+      getWorkspaceRequestOperationEnvironment(
+        { HOME: '/home/user', RUSHD_OPERATION_GROUPS: hostMarker },
+        requestEnvironment
+      )
+    ).toEqual({ HOME: '/home/user', RUSHD_OPERATION_GROUPS: hostMarker, WT_SESSION: 'wt-B' });
+    expect(getWorkspaceRequestOperationEnvironment({ HOME: '/home/user' }, requestEnvironment)).toEqual({
+      HOME: '/home/user',
+      WT_SESSION: 'wt-B'
+    });
+  });
+
   it('matches request variable names case-insensitively on Windows', () => {
     const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
     const mixedCaseSessionVariable: string = 'Copilot_Agent_Session_Id';
diff --git a/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts
index e5877cb9a1..b59fb31037 100644
--- a/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/TrimRushEnvironmentVariablesPlugin.test.ts
@@ -85,6 +85,7 @@ describe(TrimRushEnvironmentVariablesPlugin.name, () => {
       RUSH_TEMP_FOLDER: 'some-temp-folder',
       rush_someMixedCaseVar: 'should also be trimmed',
       RUSHSTACK_FILE_ERROR_BASE_FOLDER: 'should be preserved',
+      RUSHD_OPERATION_GROUPS: 'should be preserved',
       PATH: process.env.PATH,
       SOME_OTHER_VAR: 'should be preserved'
     };
@@ -94,6 +95,7 @@ describe(TrimRushEnvironmentVariablesPlugin.name, () => {
     expect(env.RUSH_TEMP_FOLDER).toBeUndefined();
     expect(env.rush_someMixedCaseVar).toBeUndefined();
     expect(env.RUSHSTACK_FILE_ERROR_BASE_FOLDER).toBe('should be preserved');
+    expect(env.RUSHD_OPERATION_GROUPS).toBe('should be preserved');
     expect(env.SOME_OTHER_VAR).toBe('should be preserved');
   });
 });
diff --git a/libraries/rush-lib/src/utilities/test/Utilities.test.ts b/libraries/rush-lib/src/utilities/test/Utilities.test.ts
index b69fad4d4d..7ab68d6f0a 100644
--- a/libraries/rush-lib/src/utilities/test/Utilities.test.ts
+++ b/libraries/rush-lib/src/utilities/test/Utilities.test.ts
@@ -381,6 +381,24 @@ describe(Utilities.name, () => {
           REQUEST_VALUE: 'request'
         });
       });
+
+      it("passes the daemon's marker of the processes that it starts to lifecycle commands", () => {
+        const spawn = jest
+          .fn<ChildProcess, [string, ReadonlyArray<string>, SpawnOptions]>()
+          .mockReturnValue(new ChildProcess());
+        const marker: string = '/tmp/rushd-1000/workspace.lock.groups-42';
+        Utilities.executeLifecycleCommandAsync('echo request', {
+          rushConfiguration: undefined,
+          workingDirectory: process.cwd(),
+          initCwd: process.cwd(),
+          handleOutput: false,
+          environmentPathOptions: {},
+          initialEnvironment: { RUSH_DAEMON: '1', RUSHD_OPERATION_GROUPS: marker },
+          stdio: 'pipe',
+          spawn
+        });
+        expect(spawn.mock.calls[0][2].env).toMatchObject({ RUSHD_OPERATION_GROUPS: marker });
+      });
     });
   });
 });

From ce90b7568db1a60d3efdda0f811130bdefe6e338 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:33 +0000
Subject: [PATCH 196/265] [rush-lib] [rush-daemon] Say which command sets each
 differing parameter

Swarm integration step 181; original commit 391fd82eae (merge of swarm/r02-t280-int at a2f90aa6bb).
Scope: task 280.

Brings 280 (branch swarm/r02-t280-int). Second agent: o08 board 5915, board 5974. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 15 of 17. Gate: ch01 GATE OK board 6389 (tree bd832486ca)

Commits folded into this step (1):
- 98877816c0 [rush-lib] [rush-daemon] Say which command sets each differing parameter

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...sharing-names-setter_2026-09-29-15-01.json |  11 ++
 ...sharing-names-setter_2026-09-29-15-01.json |  11 ++
 common/reviews/api/rush-lib.api.md            |   8 +-
 .../src/ProductionDaemonRequestResolver.ts    |  56 ++++++++--
 .../src/test/WorkspaceEngineSharing.test.ts   |  79 +++++++++++++-
 .../rush-lib/src/api/PhasedCommandEngine.ts   | 101 +++++++++++++++---
 .../test/PhasedCommandEngineSharing.test.ts   |  93 +++++++++++++---
 .../cli/scriptActions/PhasedScriptAction.ts   |  20 ++--
 libraries/rush-lib/src/index.ts               |   1 +
 9 files changed, 332 insertions(+), 48 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/daemon-sharing-names-setter_2026-09-29-15-01.json
 create mode 100644 common/changes/@rushstack/rush-daemon/daemon-sharing-names-setter_2026-09-29-15-01.json

diff --git a/common/changes/@microsoft/rush/daemon-sharing-names-setter_2026-09-29-15-01.json b/common/changes/@microsoft/rush/daemon-sharing-names-setter_2026-09-29-15-01.json
new file mode 100644
index 0000000000..4b98d552f5
--- /dev/null
+++ b/common/changes/@microsoft/rush/daemon-sharing-names-setter_2026-09-29-15-01.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "When a daemon engine can't serve a request because the parameters differ, the reason now says which command sets each parameter that differs, or that both set it to different values, for example `only \"test\" sets --production for \"_phase:compile\"`. `PhasedCommandEngine.getEngineSharingBlocker` takes optional labels (`IPhasedCommandEngineSharingLabels`) that name the two commands in the reason.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/daemon-sharing-names-setter_2026-09-29-15-01.json b/common/changes/@rushstack/rush-daemon/daemon-sharing-names-setter_2026-09-29-15-01.json
new file mode 100644
index 0000000000..ccc31c68a9
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/daemon-sharing-names-setter_2026-09-29-15-01.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a custom command can't use the daemon because neither engine could serve the other command, the message now says which command sets each parameter that differs. Two requests of the same command are called \"an earlier\" and \"this\" one, and a reason that is the same both ways is given once.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index ecca1f0a95..761ad531c3 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1027,6 +1027,12 @@ export interface IPhasedCommandEngineRequestSettings {
     readonly quietMode: boolean;
 }
 
+// @alpha
+export interface IPhasedCommandEngineSharingLabels {
+    readonly engine: string;
+    readonly request: string;
+}
+
 // @alpha
 export interface IPhasedCommandEngineTelemetryOptions {
     readonly durationInSeconds: number;
@@ -1605,7 +1611,7 @@ export class PhasedCommandEngine {
     readonly commandName: string;
     createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine>;
     createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData;
-    getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession): string | undefined;
+    getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession, labels?: IPhasedCommandEngineSharingLabels): string | undefined;
     readonly isIncremental: boolean;
     // (undocumented)
     readonly parameterIdentity: string;
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index c65411b684..b7d2099d4c 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -13,6 +13,7 @@ import {
   PhasedCommandEngineUsageError,
   type IPhasedCommandEngine,
   type IPhasedCommandEngineLogTelemetryOptions,
+  type IPhasedCommandEngineSharingLabels,
   type IInputsSnapshot,
   type IOperationGraph,
   type ITelemetryData,
@@ -178,20 +179,21 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     const { command } = parsed;
     const engine: IBoundEngine | undefined = await this.#tryGetBoundEngineAsync(workspaceSession);
     if (!engine) return command.parameterIdentity;
-    const blocker: string | undefined = getEngineSharingBlocker(engine, command);
+    const engineName: string = engine.command.commandName;
+    const requestName: string = command.commandName;
+    const labels: IPhasedCommandEngineSharingLabels | undefined = getSharingLabels(engineName, requestName);
+    const blocker: string | undefined = getEngineSharingBlocker(engine, command, labels);
     if (blocker === undefined) return engine.command.parameterIdentity;
     if (envelope.commandOrigin === 'custom') {
       const reverseBlocker: string | undefined = getEngineSharingBlocker(
         { command, rushSession: engine.rushSession },
-        engine.command
+        engine.command,
+        labels && { engine: labels.request, request: labels.engine }
       );
       if (reverseBlocker !== undefined) {
-        const engineName: string = engine.command.commandName;
         throw new DaemonRequestDispatchError(
           'unsupported',
-          `The daemon's engine, created by "${engineName}", cannot serve "${command.commandName}" because ` +
-            `${blocker}, and an engine created by "${command.commandName}" could not serve "${engineName}" ` +
-            `because ${reverseBlocker}.`
+          describeUnsharedEngines(engineName, requestName, blocker, reverseBlocker)
         );
       }
     }
@@ -541,10 +543,48 @@ function environmentIdentity(environment: Readonly<Record<string, string | undef
 }
 
 /** Explains why `engine` cannot serve `request`, or returns undefined if it can. */
-function getEngineSharingBlocker(engine: IBoundEngine, request: PhasedCommandEngine): string | undefined {
+function getEngineSharingBlocker(
+  engine: IBoundEngine,
+  request: PhasedCommandEngine,
+  labels?: IPhasedCommandEngineSharingLabels
+): string | undefined {
   if (engine.command.parameterIdentity === request.parameterIdentity) return undefined;
   if (!engine.rushSession) return 'the engine has no Rush session';
-  return engine.command.getEngineSharingBlocker(request, engine.rushSession);
+  return engine.command.getEngineSharingBlocker(request, engine.rushSession, labels);
+}
+
+/**
+ * How the reasons name the command that created the daemon's engine and the requested command if both have the same
+ * name, or undefined for the quoted names.
+ */
+function getSharingLabels(
+  engineName: string,
+  requestName: string
+): IPhasedCommandEngineSharingLabels | undefined {
+  return engineName === requestName
+    ? { engine: `the earlier "${engineName}"`, request: `this "${requestName}"` }
+    : undefined;
+}
+
+/**
+ * Why neither the daemon's engine nor an engine created by the requested command could serve the other's command.
+ * If both reasons are the same, it gives the reason once.
+ */
+function describeUnsharedEngines(
+  engineName: string,
+  requestName: string,
+  blocker: string,
+  reverseBlocker: string
+): string {
+  const sameName: boolean = engineName === requestName;
+  const creator: string = sameName ? `an earlier "${engineName}"` : `"${engineName}"`;
+  const served: string = sameName ? 'the earlier one' : `"${engineName}"`;
+  const request: string = sameName ? `this "${requestName}"` : `"${requestName}"`;
+  const unserved: string = `The daemon's engine, created by ${creator}, cannot serve ${request}`;
+  return blocker === reverseBlocker
+    ? `${unserved}, and an engine created by ${request} could not serve ${served} either, because ${blocker}.`
+    : `${unserved} because ${blocker}, and an engine created by ${request} could not serve ${served} ` +
+        `because ${reverseBlocker}.`;
 }
 
 /** Whether a parse has exactly the inputs that parsing the command line of this request would have. */
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
index 4490cb0673..de58dc151e 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineSharing.test.ts
@@ -15,7 +15,10 @@ jest.setTimeout(60_000);
 
 const custom: Partial<IDaemonRequestEnvelope> = { commandOrigin: 'custom' };
 
-/** build runs compile; test and retest run compile and test. `--production` changes the compile commands. */
+/**
+ * build runs compile; test, retest and verify run compile and test. `--production` changes the compile commands, and
+ * `--update-snapshots` the test commands.
+ */
 function configureCommands(fixture: DaemonGraphTestFixture): void {
   fixture.write(
     'common/config/rush/command-line.json',
@@ -47,6 +50,14 @@ function configureCommands(fixture: DaemonGraphTestFixture): void {
           phases: ['_phase:compile', '_phase:test'],
           incremental: false,
           enableParallelism: true
+        },
+        {
+          commandKind: 'phased',
+          name: 'verify',
+          summary: 'Builds and tests, like test',
+          phases: ['_phase:compile', '_phase:test'],
+          incremental: true,
+          enableParallelism: true
         }
       ],
       parameters: [
@@ -54,8 +65,15 @@ function configureCommands(fixture: DaemonGraphTestFixture): void {
           parameterKind: 'flag',
           longName: '--production',
           description: 'Production build',
-          associatedCommands: ['build', 'test', 'retest'],
+          associatedCommands: ['build', 'test', 'retest', 'verify'],
           associatedPhases: ['_phase:compile']
+        },
+        {
+          parameterKind: 'flag',
+          longName: '--update-snapshots',
+          description: 'Updates the snapshots of the tests',
+          associatedCommands: ['test', 'retest'],
+          associatedPhases: ['_phase:test']
         }
       ]
     })
@@ -179,8 +197,8 @@ describe('engine sharing between phased commands', () => {
       );
       expectUnsupported(
         await fixture.runAsync(['test', '--only', 'a', '--production'], custom),
-        'could not serve "build" because "build" has different parameters for its phases ' +
-          '(--production for "_phase:compile")'
+        'could not serve "build" because the parameters of their phases differ ' +
+          '(only "test" sets --production for "_phase:compile").'
       );
       expect(fixture.session.operationGraph).toBe(buildGraph);
       expect(fixture.host.workspaceGeneration).toBe(buildGeneration);
@@ -191,6 +209,59 @@ describe('engine sharing between phased commands', () => {
       expect(fixture.runs()).toEqual(['a', 'b', 'test-a']);
     }));
 
+  /**
+   * Runs the custom command `first` and then `second`, which neither's engine can serve, and expects `message` for
+   * `second` without a reload.
+   */
+  async function expectUnsupportedWithoutReloadAsync(
+    first: string[],
+    second: string[],
+    message: string
+  ): Promise<void> {
+    await withFixtureAsync(async (fixture) => {
+      expectSuccess(await fixture.runAsync([...first, '--only', 'a'], custom), true);
+      const graph: IOperationGraph | undefined = fixture.session.operationGraph;
+      const generation: number = fixture.host.workspaceGeneration;
+
+      expectUnsupported(await fixture.runAsync([...second, '--only', 'a'], custom), message);
+      expect(fixture.session.operationGraph).toBe(graph);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+      expect(fixture.runs()).toEqual(['a', 'test-a']);
+    });
+  }
+
+  /** The reason why neither of two requests of test could serve the other, if only `setter` sets a parameter. */
+  function getSameCommandMessage(setter: string): string {
+    return (
+      `The daemon's engine, created by an earlier "test", cannot serve this "test", and an engine created by ` +
+      `this "test" could not serve the earlier one either, because the parameters of their phases differ ` +
+      `(only ${setter} sets --update-snapshots for "_phase:test").`
+    );
+  }
+
+  it('names the earlier request of a custom command that sets a parameter that this request does not', () =>
+    expectUnsupportedWithoutReloadAsync(
+      ['test', '--update-snapshots'],
+      ['test'],
+      getSameCommandMessage('the earlier "test"')
+    ));
+
+  it('names this request of a custom command when it sets a parameter that the earlier request did not', () =>
+    expectUnsupportedWithoutReloadAsync(
+      ['test'],
+      ['test', '--update-snapshots'],
+      getSameCommandMessage('this "test"')
+    ));
+
+  it('gives the reason once when neither of two custom commands could serve the other for the same reason', () =>
+    expectUnsupportedWithoutReloadAsync(
+      ['test', '--production'],
+      ['verify'],
+      `The daemon's engine, created by "test", cannot serve "verify", and an engine created by "verify" could ` +
+        `not serve "test" either, because the parameters of their phases differ ` +
+        `(only "test" sets --production for "_phase:compile").`
+    ));
+
   it('shares no engine between commands while a plugin taps runAnyPhasedCommand', () =>
     withFixtureAsync(async (fixture) => {
       expectSuccess(await fixture.runAsync(['build', '--to', 'b']));
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 49a22ba429..6bf603fcb0 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -140,6 +140,18 @@ export interface IPhasedCommandEngineRequestSettings {
   readonly isIncrementalBuildAllowed: boolean;
 }
 
+/**
+ * How the reason that `PhasedCommandEngine.getEngineSharingBlocker` returns names the command that created the engine
+ * and the requested command, for example `"build"` or `the earlier "test"`.
+ * @alpha
+ */
+export interface IPhasedCommandEngineSharingLabels {
+  /** Names the command that created the engine. */
+  readonly engine: string;
+  /** Names the requested command. */
+  readonly request: string;
+}
+
 /**
  * A parsed native phased command, such as build, rebuild or a phased command from command-line.json.
  * Parsing never runs scripts or changes cwd/process.env.
@@ -372,22 +384,33 @@ export class PhasedCommandEngine {
    * (`IPhasedCommandEngineRequestSettings.isIncrementalBuildAllowed`). An engine that runs persistent
    * IPC runners (`daemon.usePersistentIpcRunners`) does not serve it, because those runners serve only
    * incremental commands.
+   *
+   * If the parameters differ, the reason names each parameter and which command sets it, or that both set it to
+   * different values. `labels` names the two commands in the reason. By default, they are the quoted command names,
+   * or `the engine's "name"` and `the requested "name"` if both commands have the same name.
    */
-  public getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession): string | undefined {
+  public getEngineSharingBlocker(
+    request: PhasedCommandEngine,
+    rushSession: RushSession,
+    labels?: IPhasedCommandEngineSharingLabels
+  ): string | undefined {
     const { commandName } = this;
     const requestName: string = request.commandName;
     const sameCommand: boolean = requestName === commandName;
+    const sharingLabels: IPhasedCommandEngineSharingLabels =
+      labels ?? getDefaultSharingLabels(commandName, requestName);
+    const { engine: engineLabel, request: requestLabel } = sharingLabels;
     if (!sameCommand && !this.isIncremental) {
-      return `"${commandName}" is not incremental`;
+      return `${engineLabel} is not incremental`;
     }
     if (!request.isIncremental && this._action.usesPersistentIpcRunners) {
-      return `"${requestName}" is not incremental, and "${commandName}" runs persistent IPC runners`;
+      return `${requestLabel} is not incremental, and ${engineLabel} runs persistent IPC runners`;
     }
     const enginePhases: IEnginePhaseNames = this._action.getEnginePhaseNames();
     const requestPhases: IEnginePhaseNames = request._action.getEnginePhaseNames();
     for (const phaseName of requestPhases.selected) {
       if (!enginePhases.complete.has(phaseName)) {
-        return `the graph of "${commandName}" does not have every operation of the "${phaseName}" phase`;
+        return `the graph of ${engineLabel} does not have every operation of the "${phaseName}" phase`;
       }
     }
     const { reachable } = requestPhases;
@@ -396,9 +419,10 @@ export class PhasedCommandEngine {
     ) {
       const differences: string = describeDifferences(
         this._action.getEngineGraphIdentityParts(reachable),
-        request._action.getEngineGraphIdentityParts(reachable)
+        request._action.getEngineGraphIdentityParts(reachable),
+        sharingLabels
       );
-      return `"${requestName}" has different parameters for its phases${differences}`;
+      return `the parameters of their phases differ${differences}`;
     }
     if (sameCommand) {
       if (
@@ -409,9 +433,10 @@ export class PhasedCommandEngine {
       }
       const differences: string = describeDifferences(
         this._action.getEngineCustomParameterIdentityParts(reachable),
-        request._action.getEngineCustomParameterIdentityParts(reachable)
+        request._action.getEngineCustomParameterIdentityParts(reachable),
+        sharingLabels
       );
-      return `"${requestName}" has different parameters${differences}`;
+      return `their parameters differ${differences}`;
     }
     let samePlugins: boolean;
     try {
@@ -422,7 +447,7 @@ export class PhasedCommandEngine {
       return `a plugin manifest could not be read: ${(error as Error).message}`;
     }
     if (!samePlugins) {
-      return `different plugins are associated with "${requestName}" and "${commandName}"`;
+      return `different plugins are associated with ${requestLabel} and ${engineLabel}`;
     }
     const { runAnyPhasedCommand, runPhasedCommand } = rushSession.hooks;
     const runAnyPhasedCommandBlocker: string | undefined = getRunAnyPhasedCommandBlocker(runAnyPhasedCommand);
@@ -524,20 +549,64 @@ export async function waitForTelemetryFlushAsync(
 }
 
 /**
- * Names the parts whose values differ between the engine's command and the request, as " (a, b)". It returns an
- * empty string if every part is the same, which happens only if two commands add the same arguments in another order.
+ * The labels of `getEngineSharingBlocker` by default: the quoted command names, or `the engine's "name"` and
+ * `the requested "name"` if both commands have the same name.
+ */
+function getDefaultSharingLabels(engineName: string, requestName: string): IPhasedCommandEngineSharingLabels {
+  return engineName === requestName
+    ? { engine: `the engine's "${engineName}"`, request: `the requested "${requestName}"` }
+    : { engine: `"${engineName}"`, request: `"${requestName}"` };
+}
+
+/**
+ * Names the parts that differ between the engine's command and the request, and which command sets each, as
+ * ` (only "a" sets --x; both set --y and --z, to different values)`. Each map has only the parts that its command
+ * sets. The groups of the two commands are in the order of their labels, and the group of the parts that both
+ * set comes last, so the text is the same whichever command created the engine. It returns an empty string if
+ * every part is the same, which happens only if two commands add the same arguments in another order.
  */
 function describeDifferences(
   engineParts: ReadonlyMap<string, string>,
-  requestParts: ReadonlyMap<string, string>
+  requestParts: ReadonlyMap<string, string>,
+  labels: IPhasedCommandEngineSharingLabels
 ): string {
-  const names: string[] = [];
+  const onlyEngine: string[] = [];
+  const onlyRequest: string[] = [];
+  const both: string[] = [];
   for (const name of new Set([...engineParts.keys(), ...requestParts.keys()])) {
-    if (engineParts.get(name) !== requestParts.get(name)) {
-      names.push(name);
+    const engineValue: string | undefined = engineParts.get(name);
+    const requestValue: string | undefined = requestParts.get(name);
+    if (engineValue === requestValue) {
+      continue;
     }
+    if (requestValue === undefined) {
+      onlyEngine.push(name);
+    } else if (engineValue === undefined) {
+      onlyRequest.push(name);
+    } else {
+      both.push(name);
+    }
+  }
+  const groups: [string, string[]][] = [
+    [labels.engine, onlyEngine],
+    [labels.request, onlyRequest]
+  ];
+  if (labels.request < labels.engine) {
+    groups.reverse();
   }
-  return names.length > 0 ? ` (${names.sort().join(', ')})` : '';
+  const descriptions: string[] = groups
+    .filter(([, names]) => names.length > 0)
+    .map(([label, names]) => `only ${label} sets ${formatNameList(names)}`);
+  if (both.length > 0) {
+    descriptions.push(`both set ${formatNameList(both)}, to different values`);
+  }
+  return descriptions.length > 0 ? ` (${descriptions.join('; ')})` : '';
+}
+
+/** Sorts the names and joins them as "a", "a and b" or "a, b and c". */
+function formatNameList(names: string[]): string {
+  const sorted: string[] = [...names].sort();
+  return sorted.length > 1 ? `${sorted.slice(0, -1).join(', ')} and ${sorted[sorted.length - 1]}` : sorted[0];
 }
 
 /** Warns about the names in a daemon plugin list that match no plugin configured in rush-plugins.json. */
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
index 4a85918e0e..5723c5ab8a 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngineSharing.test.ts
@@ -7,7 +7,7 @@ import * as path from 'node:path';
 
 import { NoOpTerminalProvider } from '@rushstack/terminal';
 
-import { PhasedCommandEngine } from '../PhasedCommandEngine';
+import { PhasedCommandEngine, type IPhasedCommandEngineSharingLabels } from '../PhasedCommandEngine';
 import { RushConfiguration } from '../RushConfiguration';
 import { Rush } from '../Rush';
 import { RushSession } from '../../pluginFramework/RushSession';
@@ -82,7 +82,15 @@ describe(`${PhasedCommandEngine.name} engine sharing`, () => {
         { name: 'retest', phases: ['_phase:compile', '_phase:test'], incremental: false },
         { name: 'lint', phases: ['_phase:lint'], incremental: true },
         // Lists the test phase without the compile phase that it depends on in the same project.
-        { name: 'unit', phases: ['_phase:test'], incremental: true }
+        { name: 'unit', phases: ['_phase:test'], incremental: true },
+        // Like build, with the settings of command-line.json that are not the defaults.
+        {
+          name: 'quickbuild',
+          phases: ['_phase:compile'],
+          incremental: true,
+          disableBuildCache: true,
+          allowOversubscription: false
+        }
       ].map((command) => ({
         ...command,
         commandKind: 'phased',
@@ -94,7 +102,15 @@ describe(`${PhasedCommandEngine.name} engine sharing`, () => {
           parameterKind: 'flag',
           longName: '--production',
           description: 'Changes the commands of the compile phase',
-          associatedCommands: ['build', 'test', 'retest', 'lint'],
+          associatedCommands: ['build', 'test', 'retest', 'lint', 'quickbuild'],
+          associatedPhases: ['_phase:compile']
+        },
+        {
+          parameterKind: 'string',
+          longName: '--target',
+          argumentName: 'TARGET',
+          description: 'Changes the commands of the compile phase',
+          associatedCommands: ['build', 'test', 'retest', 'lint', 'quickbuild'],
           associatedPhases: ['_phase:compile']
         },
         {
@@ -173,44 +189,95 @@ describe(`${PhasedCommandEngine.name} engine sharing`, () => {
       expect(await getIpcBlockerAsync(['build'], ['build', '--to', 'b'])).toBeUndefined();
       expect(await getIpcBlockerAsync(['rebuild'], ['rebuild', '--only', 'a'])).toBeUndefined();
       expect(await getIpcBlockerAsync(['rebuild'], ['build'])).toBe('"rebuild" is not incremental');
+      const build: PhasedCommandEngine = await parseAsync(['build'], withIpc);
+      expect(
+        build.getEngineSharingBlocker(await parseAsync(['rebuild'], withIpc), createRushSession(), {
+          engine: 'the engine',
+          request: 'the request'
+        })
+      ).toBe('the request is not incremental, and the engine runs persistent IPC runners');
     } finally {
       write('rush.json', rushJson);
     }
   });
 
   it('compares the arguments of the phases that the request can run', async () => {
-    const different: string = 'has different parameters for its phases';
-    const production: string = '(--production for "_phase:compile")';
+    const differ: string = 'the parameters of their phases differ';
+    const production: string = '--production for "_phase:compile"';
     expect(await getBlockerAsync(['test'], ['build', '--production'])).toBe(
-      `"build" ${different} ${production}`
+      `${differ} (only "build" sets ${production})`
     );
     expect(await getBlockerAsync(['build', '--production'], ['rebuild'])).toBe(
-      `"rebuild" ${different} ${production}`
+      `${differ} (only "build" sets ${production})`
     );
     expect(await getBlockerAsync(['build', '--production'], ['rebuild', '--production'])).toBeUndefined();
     // --coverage changes only the test phase, which build cannot run.
     expect(await getBlockerAsync(['test', '--coverage'], ['build'])).toBeUndefined();
     expect(await getBlockerAsync(['test', '--coverage'], ['retest'])).toBe(
-      `"retest" ${different} (--coverage for "_phase:test")`
+      `${differ} (only "test" sets --coverage for "_phase:test")`
     );
     expect(await getBlockerAsync(['test', '--coverage'], ['test', '--production'])).toBe(
-      `"test" ${different} (--coverage for "_phase:test", --production for "_phase:compile")`
+      `${differ} (only the engine's "test" sets --coverage for "_phase:test"; ` +
+        `only the requested "test" sets ${production})`
     );
     // --changed-projects-only changes how the graph enables operations.
     expect(await getBlockerAsync(['build', '--changed-projects-only'], ['rebuild'])).toBe(
-      `"rebuild" ${different} (--changed-projects-only)`
+      `${differ} (only "build" sets --changed-projects-only)`
     );
     expect(await getBlockerAsync(['build'], ['build', '--changed-projects-only'])).toBe(
-      `"build" ${different} (--changed-projects-only)`
+      `${differ} (only the requested "build" sets --changed-projects-only)`
+    );
+  });
+
+  it('names the command that sets each parameter that differs, or that both set it', async () => {
+    const differ: string = 'the parameters of their phases differ';
+    expect(await getBlockerAsync(['build', '--target', 'es5'], ['build', '--target', 'es2020'])).toBe(
+      `${differ} (both set --target for "_phase:compile", to different values)`
+    );
+    // An unset flag of the parser (--quiet) is false, and command-line.json sets its settings only if they are not
+    // the defaults. Two commands that can serve each other get the same text in both directions.
+    const expected: string =
+      `${differ} (only "build" sets --quiet; only "quickbuild" sets --production for "_phase:compile", ` +
+      'allowOversubscription to false in command-line.json and disableBuildCache to true in command-line.json)';
+    expect(await getBlockerAsync(['--quiet', 'build'], ['quickbuild', '--production'])).toBe(expected);
+    expect(await getBlockerAsync(['quickbuild', '--production'], ['--quiet', 'build'])).toBe(expected);
+  });
+
+  it('names the commands with the labels that the host passes', async () => {
+    const rushSession: RushSession = createRushSession();
+    const first: PhasedCommandEngine = await parseAsync(['test', '--coverage', '--target', 'es5']);
+    const second: PhasedCommandEngine = await parseAsync(['test', '--production', '--target', 'es2020']);
+    const firstLabel: string = 'the first "test"';
+    const secondLabel: string = 'the second "test"';
+    // The groups are in the order of the labels, whichever command created the engine.
+    const expected: string =
+      `the parameters of their phases differ (only ${firstLabel} sets --coverage for "_phase:test"; ` +
+      `only ${secondLabel} sets --production for "_phase:compile"; ` +
+      'both set --target for "_phase:compile", to different values)';
+    expect(
+      first.getEngineSharingBlocker(second, rushSession, { engine: firstLabel, request: secondLabel })
+    ).toBe(expected);
+    expect(
+      second.getEngineSharingBlocker(first, rushSession, { engine: secondLabel, request: firstLabel })
+    ).toBe(expected);
+    const labels: IPhasedCommandEngineSharingLabels = { engine: 'the engine', request: 'the request' };
+    const build: PhasedCommandEngine = await parseAsync(['build']);
+    const rebuild: PhasedCommandEngine = await parseAsync(['rebuild']);
+    expect(rebuild.getEngineSharingBlocker(build, rushSession, labels)).toBe('the engine is not incremental');
+    expect(build.getEngineSharingBlocker(await parseAsync(['test']), rushSession, labels)).toBe(
+      'the graph of the engine does not have every operation of the "_phase:test" phase'
     );
   });
 
   it('serves the same command only with the same values of the parameters that no phase has', async () => {
     expect(await getBlockerAsync(['test', '--report', 'x.json'], ['test'])).toBe(
-      '"test" has different parameters (--report)'
+      `their parameters differ (only the engine's "test" sets --report)`
+    );
+    expect(await getBlockerAsync(['test'], ['test', '--report', 'x.json'])).toBe(
+      `their parameters differ (only the requested "test" sets --report)`
     );
     expect(await getBlockerAsync(['test', '--report', 'x.json'], ['test', '--report', 'y.json'])).toBe(
-      '"test" has different parameters (--report)'
+      'their parameters differ (both set --report, to different values)'
     );
     expect(
       await getBlockerAsync(['test', '--report', 'x.json'], ['test', '--only', 'a', '--report', 'x.json'])
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index 2e4dc9781e..da5cc3fea2 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -520,12 +520,16 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
   }
 
   /**
-   * The contents of `getEngineGraphIdentity` for the specified phases, keyed by what each describes, so that the
-   * parameters and settings that differ between two commands can be named: `--name for "phase"` for the arguments
-   * that a phase's parameter adds, the name of a global or built-in parameter, or `name in command-line.json`.
+   * The contents of `getEngineGraphIdentity` for the specified phases that the command sets, keyed by what each
+   * describes, so that the parameters and settings that differ between two commands can be named, with the
+   * commands that set them: `--name for "phase"` for the arguments that a phase's parameter adds, the name of a
+   * global or built-in parameter, or `name to value in command-line.json` for a setting that is not the default.
+   * A parameter that the command does not set (false, empty or absent) has no part.
    */
   public getEngineGraphIdentityParts(phaseNames: ReadonlySet<string>): ReadonlyMap<string, string> {
-    const parts: Map<string, string> = new Map(Object.entries(this.parser.getParameterStringMap()));
+    const parts: Map<string, string> = new Map(
+      Object.entries(this.parser.getParameterStringMap()).filter(([, value]) => isParameterValueSet(value))
+    );
     for (const phaseName of phaseNames) {
       for (const parameter of this.#phases.get(phaseName)?.associatedParameters ?? []) {
         const argumentList: string[] = [];
@@ -538,8 +542,12 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     for (const [name, value] of this.#getEngineGraphBuiltInParameters()) {
       parts.set(name, value);
     }
-    parts.set('disableBuildCache in command-line.json', String(this.#disableBuildCache));
-    parts.set('allowOversubscription in command-line.json', String(this.#allowOversubscription));
+    if (this.#disableBuildCache) {
+      parts.set('disableBuildCache to true in command-line.json', 'true');
+    }
+    if (!this.#allowOversubscription) {
+      parts.set('allowOversubscription to false in command-line.json', 'false');
+    }
     return parts;
   }
 
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index e32fdf5bb4..01dbdbb25f 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -185,6 +185,7 @@ export {
   type IPhasedCommandEngine,
   type IPhasedCommandEngineRequestSettings,
   type IPhasedCommandEngineLogTelemetryOptions,
+  type IPhasedCommandEngineSharingLabels,
   type IPhasedCommandEngineTelemetryOptions,
   type IPhasedCommandEngineTelemetryRecord,
   type IParsePhasedCommandOptions

From 0164704e0f6dbe867aacbe6c9cf1a561807e83c4 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:33 +0000
Subject: [PATCH 197/265] [rush-lib] Hash inputs saved near the snapshot in
 process before Git

Swarm integration step 182; original commit 8fd4f36a23 (merge of swarm/r07-t288 at 3378c1d80e).
Scope: task 288.

Brings 288 (branch swarm/r07-t288). Second agent: m03 board 5994, board 5995. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 16 of 17. Gate: ch01 GATE OK board 6389 (tree aa48fefa04)

Commits folded into this step (1):
- 3378c1d80e [rush-lib] Hash inputs saved near the snapshot in process before Git

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-snapshot-hash-check_2026-09-29-15-16.json |  11 ++
 .../operations/InputFilesStatSignature.ts     |  62 +++++++-
 .../test/CacheableOperationPlugin.test.ts     |   3 +-
 .../test/InputFilesStatSignature.test.ts      | 132 +++++++++++++++++-
 4 files changed, 204 insertions(+), 4 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/in-process-snapshot-hash-check_2026-09-29-15-16.json

diff --git a/common/changes/@microsoft/rush/in-process-snapshot-hash-check_2026-09-29-15-16.json b/common/changes/@microsoft/rush/in-process-snapshot-hash-check_2026-09-29-15-16.json
new file mode 100644
index 0000000000..cd81d68caf
--- /dev/null
+++ b/common/changes/@microsoft/rush/in-process-snapshot-hash-check_2026-09-29-15-16.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "After an operation runs, Rush checks whether its input files that were saved within about 2 seconds of the inputs snapshot still have their snapshot hashes. Rush now hashes these files itself (up to 1 MiB each), and starts `git hash-object` only for the files whose content on disk does not have its snapshot hash, for example because a clean filter such as line ending conversion or Git LFS applies to them. Before, Rush started Git once for each such operation, which cost about 2 ms per operation.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
index a354ba6734..05510c71fd 100644
--- a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -11,11 +11,26 @@ import { hashFilesAsync } from '@rushstack/package-deps-hash';
 /**
  * How far outside of the snapshot window a file time may be and still count as a save during the window.
  * File times can trail `Date.now()` by a clock tick (about 16 ms on Windows), or by up to 2 seconds on file systems
- * with coarse time stamps (FAT). A file that is flagged by mistake only costs a `git hash-object` call.
+ * with coarse time stamps (FAT). A file that is flagged by mistake is usually only read and hashed again
+ * (see `haveSnapshotHashesChangedAsync`).
  */
 export const FILE_TIME_TOLERANCE_MS: number = 2000;
 const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1000000);
 
+/**
+ * The largest file that `haveSnapshotHashesChangedAsync` hashes itself. Git hashes larger files, since hashing
+ * them could take longer than starting Git, and would block the event loop.
+ */
+export const MAX_IN_PROCESS_HASH_FILE_SIZE: number = 1024 * 1024;
+
+/**
+ * The algorithm of a Git object hash, by the number of its hexadecimal digits.
+ */
+const GIT_HASH_ALGORITHM_BY_LENGTH: ReadonlyMap<number, string> = new Map([
+  [40, 'sha1'],
+  [64, 'sha256']
+]);
+
 function millisecondsToNanoseconds(timeMs: number): bigint {
   return BigInt(Math.floor(timeMs)) * NANOSECONDS_PER_MILLISECOND;
 }
@@ -180,10 +195,40 @@ export function haveInputFilesChanged(state: IInputFilesState, isNewInput: IsNew
   return newEntryPaths.length > 0 && isNewInput(newEntryPaths);
 }
 
+/**
+ * Returns the Git blob hash of the content that a file has on disk, computed with the algorithm of
+ * `expectedHash`, or undefined if it is not hashed in process. Unlike `git hash-object`, it applies no clean
+ * filters (e.g. line ending conversion), so a mismatch does not show that the file changed.
+ */
+function tryGetBlobHash(filePath: string, expectedHash: string): string | undefined {
+  const algorithm: string | undefined = GIT_HASH_ALGORITHM_BY_LENGTH.get(expectedHash.length);
+  if (!algorithm) {
+    return undefined;
+  }
+  let content: Buffer;
+  try {
+    // Not a folder or a FIFO, which cannot be read like a file
+    const stats: fs.Stats | undefined = fs.statSync(filePath, { throwIfNoEntry: false });
+    if (!stats?.isFile() || stats.size > MAX_IN_PROCESS_HASH_FILE_SIZE) {
+      return undefined;
+    }
+    content = fs.readFileSync(filePath);
+  } catch {
+    return undefined;
+  }
+  return crypto.createHash(algorithm).update(`blob ${content.length}\0`).update(content).digest('hex');
+}
+
 /**
  * Returns true if the current Git hash of any of the specified files differs from its hash in the inputs
  * snapshot. If Git was not found or the files cannot be hashed, conservatively returns true.
  *
+ * @remarks
+ * Each file is hashed in process first, which is much cheaper than starting Git. If the content that a file has on
+ * disk has its snapshot hash, the file is unchanged, since Git's usual clean filters (line ending conversion,
+ * `ident` and Git LFS) leave content that they already cleaned as it is. Only the other files are hashed with
+ * `git hash-object`, which applies the clean filters, as the inputs snapshot did.
+ *
  * @param gitPath - The path of the Git executable, if it was found
  * @param rootDirectory - The repository root that the file paths are relative to
  * @param filePaths - The files to hash, e.g. the `filesChangedDuringSnapshot` of an `IInputFilesState`
@@ -198,8 +243,21 @@ export async function haveSnapshotHashesChangedAsync(
   if (!gitPath || !snapshotHashes) {
     return true;
   }
+  const filePathsToHashWithGit: string[] = [];
+  for (const filePath of filePaths) {
+    const snapshotHash: string | undefined = snapshotHashes.get(filePath);
+    if (snapshotHash === undefined) {
+      return true;
+    }
+    if (tryGetBlobHash(path.resolve(rootDirectory, filePath), snapshotHash) !== snapshotHash) {
+      filePathsToHashWithGit.push(filePath);
+    }
+  }
+  if (filePathsToHashWithGit.length === 0) {
+    return false;
+  }
   try {
-    for (const [filePath, hash] of await hashFilesAsync(rootDirectory, filePaths, gitPath)) {
+    for (const [filePath, hash] of await hashFilesAsync(rootDirectory, filePathsToHashWithGit, gitPath)) {
       if (snapshotHashes.get(filePath) !== hash) {
         return true;
       }
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index 2f5f0a63ed..34cf288b51 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -426,7 +426,8 @@ describe(CacheableOperationPlugin.name, () => {
 
       expect(testGraph.executions).toEqual(['a', 'b']);
       expect(testGraph.cacheWrites).toEqual(['a', 'b']);
-      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+      // The file has its snapshot hash, so Git is not asked about it
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
     });
 
     it('does not hash files that were saved before the snapshot started', async () => {
diff --git a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
index ca626bcc18..45d8d1bf3a 100644
--- a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
@@ -1,18 +1,30 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+jest.mock('@rushstack/package-deps-hash', () => {
+  const actual: typeof import('@rushstack/package-deps-hash') = jest.requireActual(
+    '@rushstack/package-deps-hash'
+  );
+  return { ...actual, hashFilesAsync: jest.fn(actual.hashFilesAsync) };
+});
+
 import * as child_process from 'node:child_process';
+import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
+import { hashFilesAsync } from '@rushstack/package-deps-hash';
+
 import {
   captureInputFilesState,
   FILE_TIME_TOLERANCE_MS,
   getNewFolderEntries,
   hasUntrackedGitFiles,
   haveInputFilesChanged,
-  type IInputFilesState
+  haveSnapshotHashesChangedAsync,
+  type IInputFilesState,
+  MAX_IN_PROCESS_HASH_FILE_SIZE
 } from '../InputFilesStatSignature';
 
 describe('InputFilesStatSignature', () => {
@@ -181,6 +193,124 @@ describe('InputFilesStatSignature', () => {
     });
   });
 
+  describe(haveSnapshotHashesChangedAsync.name, () => {
+    const gitPath: string = 'git';
+    const pathA: string = 'src/a.ts';
+    const pathB: string = 'src/b.ts';
+
+    function getBlobHash(content: string | Buffer, algorithm: string = 'sha1'): string {
+      return crypto
+        .createHash(algorithm)
+        .update(`blob ${Buffer.byteLength(content)}\0`)
+        .update(content)
+        .digest('hex');
+    }
+
+    function haveHashesChangedAsync(
+      snapshotHashes: ReadonlyMap<string, string>,
+      filePaths: ReadonlyArray<string>
+    ): Promise<boolean> {
+      return haveSnapshotHashesChangedAsync(gitPath, tempFolder, filePaths, snapshotHashes);
+    }
+
+    const hashA: string = getBlobHash('export const a = 1;');
+    const hashB: string = getBlobHash('export const b = 1;');
+
+    beforeEach(() => {
+      jest.mocked(hashFilesAsync).mockClear();
+    });
+
+    it('does not start Git if every file has its snapshot hash', async () => {
+      const snapshotHashes: Map<string, string> = new Map([
+        [pathA, hashA],
+        [pathB, hashB]
+      ]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA, pathB])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('does not start Git for an unchanged file that was saved in the second before the snapshot started', async () => {
+      const { mtimeMs, ctimeMs } = fs.statSync(fileA);
+      const { filesChangedDuringSnapshot } = captureAt(Math.max(mtimeMs, ctimeMs) + 1000, fileA);
+      expect(filesChangedDuringSnapshot).toEqual([path.relative(tempFolder, fileA)]);
+
+      const snapshotHashes: Map<string, string> = new Map([[filesChangedDuringSnapshot[0], hashA]]);
+      expect(await haveHashesChangedAsync(snapshotHashes, filesChangedDuringSnapshot)).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('asks Git only about the files that do not have their snapshot hashes', async () => {
+      fs.writeFileSync(fileB, 'export const b = 2;');
+      const snapshotHashes: Map<string, string> = new Map([
+        [pathA, hashA],
+        [pathB, hashB]
+      ]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA, pathB])).toBe(true);
+      expect(jest.mocked(hashFilesAsync).mock.calls).toEqual([[tempFolder, [pathB], gitPath]]);
+    });
+
+    it('uses the hash from Git, which applies clean filters, for a file that does not have its snapshot hash', async () => {
+      child_process.execFileSync(gitPath, ['init', '-q'], { cwd: tempFolder, stdio: 'ignore' });
+      fs.writeFileSync(path.join(tempFolder, '.gitattributes'), '*.ts text\n');
+      // Git stores the file with LF line endings
+      const snapshotHashes: Map<string, string> = new Map([[pathA, getBlobHash('export const a = 1;\n')]]);
+
+      fs.writeFileSync(fileA, 'export const a = 1;\r\n');
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+
+      fs.writeFileSync(fileA, 'export const a = 2;\r\n');
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA])).toBe(true);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(2);
+    });
+
+    it('reports a change without starting Git if a file has no snapshot hash', async () => {
+      expect(await haveHashesChangedAsync(new Map([[pathA, hashA]]), [pathA, pathB])).toBe(true);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it('hashes a file with the algorithm of its snapshot hash', async () => {
+      const snapshotHashes: Map<string, string> = new Map([
+        [pathA, getBlobHash('export const a = 1;', 'sha256')]
+      ]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+    });
+
+    it(`asks Git about a file larger than ${MAX_IN_PROCESS_HASH_FILE_SIZE} bytes`, async () => {
+      const largestContent: Buffer = Buffer.alloc(MAX_IN_PROCESS_HASH_FILE_SIZE, 'a');
+      fs.writeFileSync(fileA, largestContent);
+      const largestHashes: Map<string, string> = new Map([[pathA, getBlobHash(largestContent)]]);
+      expect(await haveHashesChangedAsync(largestHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+
+      const largerContent: Buffer = Buffer.alloc(MAX_IN_PROCESS_HASH_FILE_SIZE + 1, 'a');
+      fs.writeFileSync(fileA, largerContent);
+      const largerHashes: Map<string, string> = new Map([[pathA, getBlobHash(largerContent)]]);
+      expect(await haveHashesChangedAsync(largerHashes, [pathA])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+    });
+
+    it('reports a change if a file was deleted', async () => {
+      fs.unlinkSync(fileA);
+      expect(await haveHashesChangedAsync(new Map([[pathA, hashA]]), [pathA])).toBe(true);
+    });
+
+    // E.g. a FIFO, which would block the event loop if it were read in process
+    (process.platform === 'win32' ? it.skip : it)('asks Git about a path that is not a file', async () => {
+      const devicePath: string = '/dev/null';
+      const snapshotHashes: Map<string, string> = new Map([[devicePath, getBlobHash('')]]);
+      expect(await haveHashesChangedAsync(snapshotHashes, [devicePath])).toBe(false);
+      expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
+    });
+
+    it('reports a change if Git was not found', async () => {
+      expect(
+        await haveSnapshotHashesChangedAsync(undefined, tempFolder, [pathA], new Map([[pathA, hashA]]))
+      ).toBe(true);
+    });
+  });
+
   describe(hasUntrackedGitFiles.name, () => {
     const gitPath: string = 'git';
 

From ea2c82856edf791b90e8a438731ef905b8ce1eee Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 17:59:33 +0000
Subject: [PATCH 198/265] [rush-daemon] Add tests for the record stage, lock
 retry delay and restart waits

Swarm integration step 183; original commit cbaf4d0e86 (merge of swarm/r03-t296 at 139fbbfed2).
Scope: task 296.

Brings 296 (branch swarm/r03-t296). Second agent: ch03 board 6100, board 6101. Evidence: ch01's GATE OK board 6389.

Batch E2e, item 17 of 17. Gate: ch01 GATE OK board 6389 (tree 5e2dc25715)

Commits folded into this step (1):
- 139fbbfed2 Add tests for the record stage, lock retry delay and restart waits

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/nativeLockWaitNotice.test.ts     |  8 +++
 ...ait-with-lock-holder_2026-09-29-15-56.json | 11 ++++
 ...tage-and-retry-delay_2026-09-29-15-56.json | 11 ++++
 .../test/OperationOutputFingerprints.test.ts  | 17 ++++++
 .../PhasedRequestRouterNativeLock.test.ts     | 57 +++++++++++++++++++
 5 files changed, 104 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/rush-client-restart-wait-with-lock-holder_2026-09-29-15-56.json
 create mode 100644 common/changes/@rushstack/rush-daemon/rushd-pin-record-stage-and-retry-delay_2026-09-29-15-56.json

diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
index 1ce5e77b81..35db00474c 100644
--- a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -142,6 +142,14 @@ describe(withNativeLockWaitNotices.name, () => {
         'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
           'common/config/rush/pnpm-lock.yaml changed.\n'
       ]
+    ],
+    [
+      'a wait for a restart that also names a process that holds the lock',
+      (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(1, LOCKFILE, {}, INSTALL),
+      [
+        'stderr: rush-client: waiting for 1 running request to finish; the daemon (PID 7) then restarts, because ' +
+          'common/config/rush/pnpm-lock.yaml changed.\n'
+      ]
     ]
   ])('stops when the request gets %s, whose own notice it gives', async (name, endAsync, notices) => {
     const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: true });
diff --git a/common/changes/@rushstack/rush-cli-client/rush-client-restart-wait-with-lock-holder_2026-09-29-15-56.json b/common/changes/@rushstack/rush-cli-client/rush-client-restart-wait-with-lock-holder_2026-09-29-15-56.json
new file mode 100644
index 0000000000..521b677eec
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/rush-client-restart-wait-with-lock-holder_2026-09-29-15-56.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Add a test: a queue position that has a restart reason is shown as a wait for the restart, even if it also names a process that holds the repository lock.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/rushd-pin-record-stage-and-retry-delay_2026-09-29-15-56.json b/common/changes/@rushstack/rush-daemon/rushd-pin-record-stage-and-retry-delay_2026-09-29-15-56.json
new file mode 100644
index 0000000000..9c833b3656
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/rushd-pin-record-stage-and-retry-delay_2026-09-29-15-56.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Add tests: output fingerprints are recorded after Rush's own result taps, and a batch that waits for the repository lock tries it again when the first of its wait timeouts runs out.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
index e491ee1655..50afbde83c 100644
--- a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
@@ -453,6 +453,23 @@ describe(OperationOutputFingerprints.name, () => {
       expect(digester.takeCalls()).toEqual(['digest a', 'digest b']);
     });
 
+    it("records a result after Rush's own taps, which use stages up to 1, with the status that they leave", async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, digester);
+      // A tap of Rush can still change the status of a result, e.g. to one that the graph does not skip.
+      graph.hooks.afterExecuteOperationAsync.tap(
+        { name: 'LastRushTap', stage: 1 },
+        (record: IOperationRunnerContext & IOperationExecutionResult) => {
+          const name: string = record.operation.associatedProject.packageName;
+          digester.calls.push(`tap ${name}`);
+          if (name === 'a') {
+            record.status = OperationStatus.SuccessWithWarning;
+          }
+        }
+      );
+      await graph.runAsync('a', 'b');
+      expect(digester.takeCalls()).toEqual(['tap a', 'tap b', 'digest b']);
+    });
+
     it('keeps the fingerprint of an operation that was skipped while it was disabled', async () => {
       const graph: TestGraph = new TestGraph(root, { a: 1, b: 2 }, digester);
       await graph.runAsync('a', 'b');
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts b/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
index 94c668b8cc..061ac1b128 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouterNativeLock.test.ts
@@ -94,6 +94,24 @@ async function waitUntilAsync(condition: () => boolean): Promise<void> {
   while (!condition()) await new Promise<void>((resolve) => setTimeout(resolve, 10));
 }
 
+/** Runs what is due on jest's fake clock, without moving it, until `condition` holds. */
+async function settleUntilAsync(condition: () => boolean): Promise<void> {
+  for (let turn: number = 0; !condition(); turn++) {
+    if (turn === 100) throw new Error('The condition does not hold without moving the fake clock.');
+    await jest.advanceTimersByTimeAsync(0);
+  }
+}
+
+/** Returns a function that says whether `promise` has settled. */
+function trackSettled(promise: Promise<unknown>): () => boolean {
+  let settled: boolean = false;
+  const settle = (): void => {
+    settled = true;
+  };
+  promise.then(settle, settle);
+  return () => settled;
+}
+
 describe(`${PhasedRequestRouter.name} and native Rush's repository lock`, () => {
   it('waits for another Rush process to release the lock, tells the client, and then runs the request', async () => {
     const fixture: ITestRoutingFixture = createFixture();
@@ -144,6 +162,45 @@ describe(`${PhasedRequestRouter.name} and native Rush's repository lock`, () =>
     expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
   });
 
+  it('tries the lock again for the batch when the first of its wait timeouts runs out', async () => {
+    jest.useFakeTimers();
+    try {
+      const fixture: ITestRoutingFixture = createFixture();
+      const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const longClient: TestPhasedRequestClient = new TestPhasedRequestClient('two');
+      const short: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        createRequest('short', { waitTimeoutMs: 100 }),
+        new TestPhasedRequestClient('one')
+      );
+      const long: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+        createRequest('long', { waitTimeoutMs: 30_000 }),
+        longClient
+      );
+      const isShortSettled: () => boolean = trackSettled(short);
+      const isLongSettled: () => boolean = trackSettled(long);
+      // Both requests wait in one batch, which has tried the lock once. The long request would try it again in
+      // 250ms, but the wait timeout of the short one runs out in 100ms.
+      await settleUntilAsync(() => getQueuePositions(longClient).length > 0);
+      expect(probe.attempts).toBe(1);
+
+      await jest.advanceTimersByTimeAsync(99);
+      expect(probe.attempts).toBe(1);
+      await jest.advanceTimersByTimeAsync(1);
+      await settleUntilAsync(isShortSettled);
+      expect(probe.attempts).toBe(2);
+      await expect(short).resolves.toMatchObject({ admissionErrorCode: 'wait-timeout', exitCode: 1 });
+
+      probe.free();
+      await jest.advanceTimersByTimeAsync(250);
+      await settleUntilAsync(isLongSettled);
+      await expect(long).resolves.toMatchObject({ exitCode: 0, outcome: 'success' });
+      expect(probe.attempts).toBe(3);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
   it('tells a request that joins the waiting batch about the wait, and runs both requests together', async () => {
     const fixture: ITestRoutingFixture = createFixture();
     const probe: ExecutionLeaseProbe = new ExecutionLeaseProbe(fixture);

From d861e193cbd15fca8a7fb9e6ab43bb01400a4b27 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 199/265] [rush-client-core] Make a startup helper test
 deterministic

Swarm integration step 184; original commit 8b6f28ce62 (merge of swarm/r07-t265-nit1 at 95567746a8).
Scope: task 265, NIT 1.

Brings 265-nit1 (branch swarm/r07-t265-nit1). Second agent: o07 board 6628, board 6632. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 1 of 15. Gate: ch01 GATE OK board 6977 (tree 2c32bc7443)

Commits folded into this step (1):
- 95567746a8 [rush-client-core] Make a startup helper test deterministic

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...tup-helper-exit-test_2026-09-29-18-10.json | 10 +++++++
 .../src/test/PendingDelays.ts                 | 17 +++++++++--
 .../connectOrStartDaemonHelperExit.test.ts    | 29 ++++++++++++++-----
 3 files changed, 47 insertions(+), 9 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/startup-helper-exit-test_2026-09-29-18-10.json

diff --git a/common/changes/@rushstack/rush-client-core/startup-helper-exit-test_2026-09-29-18-10.json b/common/changes/@rushstack/rush-client-core/startup-helper-exit-test_2026-09-29-18-10.json
new file mode 100644
index 0000000000..0d72e28ab2
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/startup-helper-exit-test_2026-09-29-18-10.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Make a startup test deterministic: while the startup helper runs, the client's backoff steps now last until they are aborted, so only the helper's exit can wake the client.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core"
+}
diff --git a/libraries/rush-client-core/src/test/PendingDelays.ts b/libraries/rush-client-core/src/test/PendingDelays.ts
index 5f72e34b73..a0225347ba 100644
--- a/libraries/rush-client-core/src/test/PendingDelays.ts
+++ b/libraries/rush-client-core/src/test/PendingDelays.ts
@@ -9,13 +9,26 @@ export interface IPendingDelays {
   readonly restore: () => void;
 }
 
+export interface IPendingDelaysOptions {
+  /**
+   * Whether a delay of `delayMs` that begins now lasts until its signal aborts instead, however long that is.
+   */
+  readonly hold?: (delayMs: number | undefined) => boolean;
+}
+
+// The longest delay that Node's timers accept.
+const MAX_DELAY_MS: number = 2 ** 31 - 1;
+
 /** Tracks the delays that are pending until `restore` is called. */
-export function trackPendingDelays(): IPendingDelays {
+export function trackPendingDelays(options: IPendingDelaysOptions = {}): IPendingDelays {
   const timersPromises = jest.requireActual<typeof import('node:timers/promises')>('node:timers/promises');
   const originalDelayAsync: typeof delayAsync = timersPromises.setTimeout;
   const pending: Set<Promise<unknown>> = new Set();
   const spy = jest.spyOn(timersPromises, 'setTimeout').mockImplementation((delayMs, value, delayOptions) => {
-    const delay: Promise<unknown> = originalDelayAsync(delayMs, value, delayOptions);
+    // A held delay doesn't keep the process alive.
+    const delay: Promise<unknown> = options.hold?.(delayMs)
+      ? originalDelayAsync(MAX_DELAY_MS, value, { ...delayOptions, ref: false })
+      : originalDelayAsync(delayMs, value, delayOptions);
     pending.add(delay);
     const settle = (): void => {
       pending.delete(delay);
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
index 8a323a5787..6493ee7f84 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonHelperExit.test.ts
@@ -26,6 +26,8 @@ interface IStartupTimeline {
   readonly attempts: number[];
   /** How many failed attempts were held open until the startup helper closed. */
   held: number;
+  /** When the startup helper that this process spawned started. */
+  helperSpawnedAt?: number;
   /** When the startup helper that this process spawned closed. */
   helperClosedAt?: number;
 }
@@ -43,12 +45,11 @@ function recordStartupTimeline(holdFailedAttemptsAfterMs: number = Infinity): {
   const originalSpawn: typeof spawn = childProcess.spawn;
   const originalConnectAsync: typeof DaemonClient.connectAsync = DaemonClient.connectAsync;
   const timeline: IStartupTimeline = { attempts: [], held: 0 };
-  let helperSpawnedAt: number = Infinity;
   let helperClosed: Promise<void> | undefined;
   const observer = jest.spyOn(childProcess, 'spawn').mockImplementation((command, args, spawnOptions) => {
     const child = originalSpawn(command, args, spawnOptions);
     if (args?.includes(require.resolve('../runDaemonStartup'))) {
-      helperSpawnedAt = performance.now();
+      timeline.helperSpawnedAt = performance.now();
       // This listener runs before the one that tells the client that the helper closed.
       helperClosed = new Promise<void>((resolve) =>
         child.once('close', () => {
@@ -68,7 +69,7 @@ function recordStartupTimeline(holdFailedAttemptsAfterMs: number = Infinity): {
       if (
         helperClosed &&
         timeline.helperClosedAt === undefined &&
-        startedAt - helperSpawnedAt >= holdFailedAttemptsAfterMs
+        startedAt - timeline.helperSpawnedAt! >= holdFailedAttemptsAfterMs
       ) {
         timeline.held++;
         await helperClosed;
@@ -144,12 +145,25 @@ describe('detached daemon startup while the startup helper runs', () => {
   ])(
     'connects when its startup helper exits, not at the end of a backoff step ($signalUse an abort signal)',
     async ({ abortSignal }) => {
-      // The daemon listens after a second, when this client and its helper both poll every 500 milliseconds.
-      // This client holds the start mutex, so it drops each connection until the helper releases the
-      // reservation and exits.
+      // The daemon listens after a second. This client holds the start mutex, so it drops each connection
+      // until the helper releases the reservation, just before the helper exits. A connection that begins in
+      // between is kept: a backoff step that ended there would connect this client before it sees the helper
+      // close. Here each step of 500 milliseconds or less that begins while the helper runs lasts until it is
+      // aborted, so only the helper's exit can wake this client.
       fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1000');
-      const delays: IPendingDelays = trackPendingDelays();
       const { timeline, restore } = recordStartupTimeline();
+      let heldSteps: number = 0;
+      const delays: IPendingDelays = trackPendingDelays({
+        hold: (delayMs) => {
+          const hold: boolean =
+            delayMs !== undefined &&
+            delayMs <= 500 &&
+            timeline.helperSpawnedAt !== undefined &&
+            timeline.helperClosedAt === undefined;
+          if (hold) heldSteps++;
+          return hold;
+        }
+      });
       try {
         const client: DaemonClient = await connectOrStartDaemonAsync({ ...options, abortSignal });
         await new Promise<void>((resolve) => setImmediate(resolve));
@@ -157,6 +171,7 @@ describe('detached daemon startup while the startup helper runs', () => {
         expect(delays.pending.size).toBe(0);
         await client.closeAsync();
         const { attempts, helperClosedAt } = timeline;
+        expect(heldSteps).toBe(1);
         expect(helperClosedAt).toBeDefined();
         const afterExit: number[] = attempts.filter((attempt) => attempt >= helperClosedAt!);
         expect(afterExit).toHaveLength(1);

From 8363b8733fbdc25eac92b429daac3598e125d190 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 200/265] [heft] Add watch tests for an older mtime and a
 folder a run didn't read

Swarm integration step 185; original commit 438ca1c7b5 (merge of swarm/r03-t277-nit1 at 1eddd88d84).
Scope: task 277, NIT 1.

Brings 277-nit1 (branch swarm/r03-t277-nit1). Second agent: ch05 board 6243. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 2 of 15. Gate: ch01 GATE OK board 6977 (tree e522b4c5e1)

Commits folded into this step (1):
- 1eddd88d84 [heft] Add watch tests for an older mtime and a folder a run didn't read

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../test/WatchFileSystemAdapter.test.ts       | 82 +++++++++++++++----
 ...me-and-unread-folder_2026-09-29-16-37.json | 11 +++
 2 files changed, 77 insertions(+), 16 deletions(-)
 create mode 100644 common/changes/@rushstack/heft/heft-watch-tests-for-older-mtime-and-unread-folder_2026-09-29-16-37.json

diff --git a/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
index 654830796d..287a8403e2 100644
--- a/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
+++ b/apps/heft/src/utilities/test/WatchFileSystemAdapter.test.ts
@@ -37,6 +37,8 @@ const nodeFs: typeof fs = jest.requireActual('node:fs');
 
 interface IRunOptions {
   watch?: boolean;
+  // The glob that the run reads. The default reads every folder under src.
+  pattern?: string;
   beforeWatch?: () => Promise<void> | void;
 }
 
@@ -71,9 +73,9 @@ describe(WatchFileSystemAdapter.name, () => {
 
   // Drives the adapter the way TaskOperationRunner does in watch mode
   async function runAsync(options: IRunOptions = {}): Promise<IRun> {
-    const { watch = true, beforeWatch } = options;
+    const { watch = true, pattern = 'src/**/*.ts', beforeWatch } = options;
     adapter.setBaseline();
-    const states: Map<string, IWatchedFileState> = await watchGlobAsync('src/**/*.ts', {
+    const states: Map<string, IWatchedFileState> = await watchGlobAsync(pattern, {
       cwd: rootFolder,
       fs: adapter
     });
@@ -182,6 +184,24 @@ describe(WatchFileSystemAdapter.name, () => {
     return mtimeMs;
   }
 
+  // From now on, the adapter sees a ctime for the file that is earlier than the run's start. A file that changed
+  // after the run started can have such a ctime where timestamps are coarse, or where the clock that sets them
+  // lags Date.now().
+  function backdateCtime(relativePath: string): void {
+    const backdatedPath: string = path.join(rootFolder, relativePath);
+    const lstatSync: typeof fs.lstatSync = nodeFs.lstatSync;
+    jest.spyOn(nodeFs, 'lstatSync').mockImplementation(((
+      filePath: fs.PathLike,
+      options?: fs.StatSyncOptions
+    ) => {
+      const stats: fs.Stats | undefined = lstatSync(filePath, options) as fs.Stats | undefined;
+      if (stats && filePath === backdatedPath) {
+        stats.ctimeMs = BASE_MTIME_MS;
+      }
+      return stats;
+    }) as unknown as typeof fs.lstatSync);
+  }
+
   // Replaces watchpack's fs.lstat(). The handler calls lstatAsync() to do the fs.lstat() and give watchpack the
   // result.
   function interceptWatcherLstat(handler: (filePath: string, lstatAsync: () => Promise<void>) => void): void {
@@ -437,6 +457,27 @@ describe(WatchFileSystemAdapter.name, () => {
     TEST_TIMEOUT_MS
   );
 
+  it(
+    'requests a run for a watched file whose mtime moves back after the run read it',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      const mtimeMs: number = await changeBeforeNextRunAsync(run2, 'src/sub/b.ts');
+
+      const run3: IRun = await runAsync({
+        beforeWatch: () => {
+          // Earlier than the mtime that the run read, but later than the watcher's start, so that the watcher
+          // reports the file
+          writeFile('src/sub/b.ts', mtimeMs - FUTURE_MTIME_OFFSET_MS / 2);
+          backdateCtime('src/sub/b.ts');
+        }
+      });
+      expect(run3.changed).toEqual(['src/sub/b.ts']);
+      expect(await run3.waitForReportAsync('src/sub/b.ts', 'scan (file)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
   it(
     'does not request a run for a file whose change the previous watcher had not finished reading',
     async () => {
@@ -494,6 +535,28 @@ describe(WatchFileSystemAdapter.name, () => {
     TEST_TIMEOUT_MS
   );
 
+  it(
+    'requests a run when a folder that the run did not read is reported as its watcher is attached',
+    async () => {
+      const run2: IRun = await startWatchingAsync();
+      await changeBeforeNextRunAsync(run2, NOTES_PATH);
+
+      // The run reads src and src/sub/b.ts, but not src/sub, so the watcher doesn't report the files in src/sub
+      // one by one. The watcher of src attaches to the watcher that src/sub has for b.ts, and reports src/sub.
+      const run3: IRun = await runAsync({
+        pattern: 'src/*.ts',
+        beforeWatch: () => {
+          adapter.getStateAndTrack(path.join(rootFolder, 'src/sub/b.ts'));
+          holdWatcherFolderLstat('src/sub', ['b.ts', 'notes.txt']);
+        }
+      });
+      expect(run3.changed).toEqual([]);
+      expect(await run3.waitForReportAsync('src/sub', 'watch (outdated on attach)')).toBe(true);
+      expect(run3.isRunRequested()).toBe(true);
+    },
+    TEST_TIMEOUT_MS
+  );
+
   it(
     'requests a run for a file system event, even if the file looks unchanged',
     async () => {
@@ -502,20 +565,7 @@ describe(WatchFileSystemAdapter.name, () => {
       const run3: IRun = await runAsync();
       expect(await run3.waitForReportAsync(NOTES_PATH, 'scan (file)')).toBe(true);
 
-      // Where timestamps are coarse, a file's ctime may be earlier than the run's start, although the file
-      // changed after it
-      const notesPath: string = path.join(rootFolder, NOTES_PATH);
-      const lstatSync: typeof fs.lstatSync = nodeFs.lstatSync;
-      jest.spyOn(nodeFs, 'lstatSync').mockImplementation(((
-        filePath: fs.PathLike,
-        options?: fs.StatSyncOptions
-      ) => {
-        const stats: fs.Stats | undefined = lstatSync(filePath, options) as fs.Stats | undefined;
-        if (stats && filePath === notesPath) {
-          stats.ctimeMs = BASE_MTIME_MS;
-        }
-        return stats;
-      }) as unknown as typeof fs.lstatSync);
+      backdateCtime(NOTES_PATH);
       writeFile(NOTES_PATH, mtimeMs);
       expect(await run3.waitForRunRequestAsync()).toBe(true);
     },
diff --git a/common/changes/@rushstack/heft/heft-watch-tests-for-older-mtime-and-unread-folder_2026-09-29-16-37.json b/common/changes/@rushstack/heft/heft-watch-tests-for-older-mtime-and-unread-folder_2026-09-29-16-37.json
new file mode 100644
index 0000000000..4a90bce25a
--- /dev/null
+++ b/common/changes/@rushstack/heft/heft-watch-tests-for-older-mtime-and-unread-folder_2026-09-29-16-37.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft",
+      "comment": "Add tests: in watch mode, a watched file whose mtime moves back after a run read it still requests a run, and so does the report of a folder that the run did not read.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/heft",
+  "email": "selarkin@microsoft.com"
+}

From 741c33e4519ddf7f1267e2d0c1e870bfc6a4930a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 201/265] [rush-daemon] Start a served script while a reload
 waits for a build

Swarm integration step 186; original commit f47e9b019f (merge of swarm/r07-t290 at 8e82b1f9fc).
Scope: task 290.

Brings 290 (branch swarm/r07-t290). Second agent: t03 board 6281. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 3 of 15. Gate: ch01 GATE OK board 6977 (tree ba7ed8ae40)

Commits folded into this step (1):
- 8e82b1f9fc [rush-daemon] Start a served script while a reload waits for a build

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ript-ahead-of-reload_2026-09-29-16-30.json |  10 +
 common/reviews/api/rush-daemon.api.md         |   1 +
 libraries/rush-daemon/src/RequestScheduler.ts |  40 ++-
 .../src/WorkspaceRequestAdmission.ts          |  21 +-
 .../src/WorkspaceRequestLifecycle.ts          |  15 +-
 .../src/test/RequestScheduler.test.ts         | 182 +++++++++++++
 ...kspaceServedScriptBehindTransition.test.ts | 255 ++++++++++++++++++
 7 files changed, 513 insertions(+), 11 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/served-script-ahead-of-reload_2026-09-29-16-30.json
 create mode 100644 libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/served-script-ahead-of-reload_2026-09-29-16-30.json b/common/changes/@rushstack/rush-daemon/served-script-ahead-of-reload_2026-09-29-16-30.json
new file mode 100644
index 0000000000..560e0447d5
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/served-script-ahead-of-reload_2026-09-29-16-30.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Start a served rushx script at once, on the current workspace generation, while a build waits behind a running build to reload the graph. Add the `admitAheadOfQueue` option to `RequestScheduler.acquireAsync`.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 9907efaae6..71a7a43134 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -458,6 +458,7 @@ export interface IRequestLease {
 // @public
 export interface IRequestSchedulerAcquireOptions {
     abortSignal?: AbortSignal;
+    admitAheadOfQueue?: boolean;
     exclusivityClass: RequestExclusivityClass;
     noWait?: boolean;
     onQueuePositionChanged?: (position: number) => void;
diff --git a/libraries/rush-daemon/src/RequestScheduler.ts b/libraries/rush-daemon/src/RequestScheduler.ts
index eb84e15d00..198b38a67e 100644
--- a/libraries/rush-daemon/src/RequestScheduler.ts
+++ b/libraries/rush-daemon/src/RequestScheduler.ts
@@ -71,6 +71,19 @@ export interface IRequestSchedulerAcquireOptions {
    * the scheduler reports the error as a process warning and continues processing the queue.
    */
   onQueuePositionChanged?: (position: number) => void;
+
+  /**
+   * Admit a shared request at once, ahead of the queued requests, if it is compatible with every active request and
+   * one of them was admitted in queue order, so that the queued requests wait for that one anyway. Otherwise the
+   * request waits in queue order like any other.
+   *
+   * @remarks
+   * For a short request that should not wait behind a queued request that itself waits for a long one, such as a
+   * rushx script, which needs its lease only until it starts, behind a reload that waits for a running build. Such
+   * requests cannot keep the queued requests waiting indefinitely: once every active request was admitted ahead of
+   * the queue, later ones wait in it.
+   */
+  admitAheadOfQueue?: boolean;
 }
 
 /**
@@ -93,6 +106,8 @@ interface IQueuedRequest {
 
 interface ILeaseState {
   exclusivityClass: RequestExclusivityClass;
+  /** Whether the lease was admitted ahead of queued requests; see `admitAheadOfQueue`. */
+  readonly aheadOfQueue: boolean;
   onPreempted: (() => void) | undefined;
   /** Whether `onPreempted` was called, so that the lease's owner is stopping its work. */
   preempted: boolean;
@@ -105,7 +120,9 @@ interface ILeaseState {
  *
  * Requests of the same shared class may execute concurrently. Different shared classes are serialized because
  * they access different consistency views of the workspace. Exclusive requests execute alone. Once an exclusive
- * request reaches the queue, it gates all requests behind it until it has executed.
+ * request reaches the queue, it gates all requests behind it until it has executed. The one exception is a shared
+ * request that asks to be admitted ahead of the queue (`admitAheadOfQueue`) while a compatible request that was
+ * admitted in queue order is still active.
  *
  * @public
  */
@@ -113,6 +130,8 @@ export class RequestScheduler {
   readonly #queue: IQueuedRequest[] = [];
   #activeClass: RequestExclusivityClass | undefined;
   #activeRequestCount: number = 0;
+  /** How many of the active leases were admitted ahead of queued requests. */
+  #aheadOfQueueCount: number = 0;
   readonly #activeLeaseStates: Set<ILeaseState> = new Set();
   readonly #leaseStates: WeakMap<IRequestLease, ILeaseState> = new WeakMap();
 
@@ -184,7 +203,8 @@ export class RequestScheduler {
   }
 
   /**
-   * Waits until the request is compatible with all active requests and earlier queued requests.
+   * Waits until the request is compatible with all active requests and earlier queued requests. With
+   * `admitAheadOfQueue`, compatibility with the active requests can be enough; see that option.
    */
   public acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease> {
     try {
@@ -202,8 +222,13 @@ export class RequestScheduler {
       );
     }
 
-    if (this.#queue.length === 0 && this.#canAdmit(options.exclusivityClass)) {
-      return Promise.resolve(this.#createLease(options.exclusivityClass));
+    if (this.#canAdmit(options.exclusivityClass)) {
+      if (this.#queue.length === 0) {
+        return Promise.resolve(this.#createLease(options.exclusivityClass, false));
+      }
+      if (options.admitAheadOfQueue && this.#activeRequestCount > this.#aheadOfQueueCount) {
+        return Promise.resolve(this.#createLease(options.exclusivityClass, true));
+      }
     }
 
     if (options.noWait) {
@@ -273,12 +298,14 @@ export class RequestScheduler {
     return exclusivityClass !== RequestExclusivityClass.Exclusive && exclusivityClass === this.#activeClass;
   }
 
-  #createLease(exclusivityClass: RequestExclusivityClass): IRequestLease {
+  #createLease(exclusivityClass: RequestExclusivityClass, aheadOfQueue: boolean): IRequestLease {
     this.#activeClass = exclusivityClass;
     this.#activeRequestCount++;
+    if (aheadOfQueue) this.#aheadOfQueueCount++;
 
     const state: ILeaseState = {
       exclusivityClass,
+      aheadOfQueue,
       onPreempted: undefined,
       preempted: false,
       released: false,
@@ -297,6 +324,7 @@ export class RequestScheduler {
         state.onPreempted = undefined;
         this.#activeLeaseStates.delete(state);
         this.#activeRequestCount--;
+        if (state.aheadOfQueue) this.#aheadOfQueueCount--;
         if (this.#activeRequestCount === 0) {
           this.#activeClass = undefined;
         }
@@ -321,7 +349,7 @@ export class RequestScheduler {
 
       this.#queue.shift();
       this.#cleanupQueuedRequest(request);
-      request.resolve(this.#createLease(request.options.exclusivityClass));
+      request.resolve(this.#createLease(request.options.exclusivityClass, false));
       admittedRequest = true;
     }
 
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 5eebed223e..1716181007 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -517,10 +517,16 @@ export class RequestAdmissionController {
    * indefinitely. The timeout is still spent while the transition itself waits for another request, so a transition
    * that cannot start does not hold its followers either. Unspent time carries over to later waits of this request.
    * `noWait` still fails at once.
+   *
+   * With `admitAheadOfQueue`, a request that the transition's owner waits for anyway, such as a running build, lets
+   * this request be admitted at once, ahead of the owner and of the requests that wait behind it; see
+   * `IRequestSchedulerAcquireOptions.admitAheadOfQueue`. The lifecycle sets it for a rushx script while the owner of
+   * a reload has yet to replace the current generation, which the script needs only to start.
    */
   public async acquireBehindTransitionAsync(
     scheduler: RequestScheduler,
-    transition: AdmissionProgress
+    transition: AdmissionProgress,
+    admitAheadOfQueue: boolean = false
   ): Promise<IRequestLease> {
     const waitingFor: string = "another request's load or reload of the workspace graph";
     const remainingMs: number | undefined = this.#remainingMs;
@@ -530,7 +536,10 @@ export class RequestAdmissionController {
         scheduler,
         RequestExclusivityClass.SharedBuild,
         remainingMs,
-        waitingFor
+        waitingFor,
+        this.#abortController.signal,
+        reportQueuePosition,
+        admitAheadOfQueue
       );
     }
     const exhausted: AbortController = new AbortController();
@@ -552,7 +561,9 @@ export class RequestAdmissionController {
         RequestExclusivityClass.SharedBuild,
         undefined,
         waitingFor,
-        AbortSignal.any([this.#abortController.signal, exhausted.signal])
+        AbortSignal.any([this.#abortController.signal, exhausted.signal]),
+        reportQueuePosition,
+        admitAheadOfQueue
       );
     } catch (error) {
       budget.stop();
@@ -582,7 +593,8 @@ export class RequestAdmissionController {
     waitTimeoutMs: number | undefined,
     waitingFor: string,
     abortSignal: AbortSignal = this.#abortController.signal,
-    reportPosition: ReportQueuePosition = reportQueuePosition
+    reportPosition: ReportQueuePosition = reportQueuePosition,
+    admitAheadOfQueue: boolean = false
   ): Promise<IRequestLease> {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
@@ -590,6 +602,7 @@ export class RequestAdmissionController {
     try {
       lease = await scheduler.acquireAsync({
         abortSignal,
+        admitAheadOfQueue,
         exclusivityClass,
         noWait: this.#admission?.noWait,
         onQueuePositionChanged: writer ? (position: number) => reportPosition(writer, position) : undefined,
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 334825dda7..d6f32b9108 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -206,6 +206,14 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   #lastReloadTier: WorkspaceInputChangeTier = WorkspaceInputChangeTier.Reuse;
   #installationChange: IDaemonInstallationChange | undefined;
   #transitioning: boolean = false;
+  /**
+   * Whether a served rushx script may be admitted ahead of the transition while its owner waits for `#gate`: only if
+   * the owner reloads the graph, which leaves scripts running, rather than restarting the daemon or running a native
+   * mutation, which would end them with this process. The script then starts on the current generation, as it would
+   * have before the reload was requested; it reads its package.json when it runs. Each owner sets it, and it is read
+   * only while `#transitioning`.
+   */
+  #scriptsMayPassTransition: boolean = false;
   /** Active while the transition owner holds the exclusive gate and loads or reloads the workspace graph. */
   readonly #transitionProgress: AdmissionProgress = new AdmissionProgress();
   #cleanupFailure: unknown;
@@ -498,7 +506,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     let lease: IRequestLease =
       admittedLease ??
       (this.#transitioning
-        ? await admission.acquireBehindTransitionAsync(this.#gate, this.#transitionProgress)
+        ? await admission.acquireBehindTransitionAsync(
+            this.#gate,
+            this.#transitionProgress,
+            this.#scriptsMayPassTransition && isRushxInvocation(envelope)
+          )
         : await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
     let ownsTransition: boolean = false;
     try {
@@ -675,6 +687,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs, shared);
       }
       this.#transitioning = ownsTransition = true;
+      this.#scriptsMayPassTransition = tier === WorkspaceInputChangeTier.Reload && !isMutation(envelope);
       this.#cancelObservers();
       lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
       this.#transitionProgress.setActive(true);
diff --git a/libraries/rush-daemon/src/test/RequestScheduler.test.ts b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
index 8c37d84cd4..e6092f2005 100644
--- a/libraries/rush-daemon/src/test/RequestScheduler.test.ts
+++ b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
@@ -258,6 +258,188 @@ describe(RequestScheduler.name, () => {
   });
 });
 
+describe('admission ahead of the queue', () => {
+  it('admits a compatible request ahead of a queued writer that waits for a request admitted in order', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const writerPositions: number[] = [];
+    let writerAdmitted: boolean = false;
+    const writerPromise: Promise<IRequestLease> = scheduler
+      .acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive,
+        onQueuePositionChanged: (position) => writerPositions.push(position)
+      })
+      .then((lease) => {
+        writerAdmitted = true;
+        return lease;
+      });
+
+    const script: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+    expect(scheduler.activeRequestCount).toBe(2);
+    expect(scheduler.queuedRequestCount).toBe(1);
+    expect(writerPositions).toEqual([1]);
+
+    // The writer now waits for the script too, but no longer than for the build.
+    build.release();
+    await Promise.resolve();
+    expect(writerAdmitted).toBe(false);
+    script.release();
+    const writer: IRequestLease = await writerPromise;
+    expect(writerAdmitted).toBe(true);
+    writer.release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('forgets a request that it admitted ahead of the queue once that request is released', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    for (let round: number = 0; round < 2; round++) {
+      const build: IRequestLease = await scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.SharedBuild
+      });
+      const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+        exclusivityClass: RequestExclusivityClass.Exclusive
+      });
+      const script: IRequestLease = await scheduler.acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        noWait: true
+      });
+      script.release();
+      build.release();
+      (await writerPromise).release();
+    }
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('queues a request in order once every active request was admitted ahead of the queue', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const admissionOrder: string[] = [];
+    const writerPromise: Promise<IRequestLease> = scheduler
+      .acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive })
+      .then((lease) => {
+        admissionOrder.push('writer');
+        return lease;
+      });
+    const first: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+    build.release();
+
+    // Otherwise a stream of such requests could keep the writer waiting indefinitely.
+    await expect(
+      scheduler.acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        noWait: true
+      })
+    ).rejects.toMatchObject({ code: RequestSchedulerErrorCode.NoWait });
+    const secondPositions: number[] = [];
+    const secondPromise: Promise<IRequestLease> = scheduler
+      .acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        onQueuePositionChanged: (position) => secondPositions.push(position)
+      })
+      .then((lease) => {
+        admissionOrder.push('second');
+        return lease;
+      });
+    expect(secondPositions).toEqual([2]);
+
+    first.release();
+    const writer: IRequestLease = await writerPromise;
+    await Promise.resolve();
+    expect(admissionOrder).toEqual(['writer']);
+    writer.release();
+    const second: IRequestLease = await secondPromise;
+    expect(admissionOrder).toEqual(['writer', 'second']);
+    second.release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it.each([
+    ['an exclusive request', RequestExclusivityClass.Exclusive],
+    ['a request of another shared class', RequestExclusivityClass.SharedRead]
+  ])('does not admit a request ahead of the queue while %s is active', async (activeName, activeClass) => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const active: IRequestLease = await scheduler.acquireAsync({ exclusivityClass: activeClass });
+    const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+
+    await expect(
+      scheduler.acquireAsync({
+        admitAheadOfQueue: true,
+        exclusivityClass: RequestExclusivityClass.SharedBuild,
+        noWait: true
+      })
+    ).rejects.toMatchObject({ code: RequestSchedulerErrorCode.NoWait });
+
+    active.release();
+    (await writerPromise).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('counts a request that it admitted from the queue as admitted in order', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const exclusive: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    const buildPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    exclusive.release();
+    const build: IRequestLease = await buildPromise;
+    const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+
+    const script: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+
+    script.release();
+    build.release();
+    (await writerPromise).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('admits a request that asks to pass the queue in order when nothing is queued', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const script: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    // It was admitted in order, so a later request may pass a writer that waits for it.
+    const writerPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    const later: IRequestLease = await scheduler.acquireAsync({
+      admitAheadOfQueue: true,
+      exclusivityClass: RequestExclusivityClass.SharedBuild,
+      noWait: true
+    });
+
+    script.release();
+    later.release();
+    (await writerPromise).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+});
+
 describe('preemptible leases', () => {
   it('preempts a marked lease once a request that it blocks waits, and only once', async () => {
     const scheduler: RequestScheduler = new RequestScheduler();
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts
new file mode 100644
index 0000000000..455b8f1930
--- /dev/null
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptBehindTransition.test.ts
@@ -0,0 +1,255 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+/**
+ * Composes its resolvers as the production host does, so it serves rushx scripts. c builds until the test removes
+ * the `hold` marker. Project a's `hello` script records that it ran, and exits.
+ */
+function createHeldFixtureAsync(
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
+    created.servesRushx = true;
+    created.write('hold', '');
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: { '_phase:compile': 'node build.cjs', hello: 'node hello.cjs' }
+      })
+    );
+    created.write('a/hello.cjs', "require('node:fs').appendFileSync('../runs.txt','hello\\n');");
+    created.write(
+      'c/build.cjs',
+      "const fs=require('node:fs');fs.appendFileSync('../runs.txt','c\\n');" +
+        "const t=setInterval(()=>{if(!fs.existsSync('../hold'))clearInterval(t);},20);"
+    );
+    configure?.(created);
+  });
+}
+
+async function waitForAsync(predicate: () => boolean): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate() && Date.now() < deadline) await delayAsync(20);
+}
+
+function isQueuePosition(frame: IDaemonFrame): boolean {
+  if (frame.kind !== DaemonFrameType.controlJson) return false;
+  const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+  return message.kind === 'queuePosition';
+}
+
+async function readUntilQueuedAsync(client: DaemonRequestWireClient): Promise<void> {
+  while (!isQueuePosition(await client.readFrameAsync()));
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await delayAsync(0);
+  return settled;
+}
+
+/** Runs a's `hello` script as rush-client sends it for `rushx hello`. */
+function runHelloAsync(
+  fixture: DaemonGraphTestFixture,
+  admission: IDaemonRequestEnvelope['admission']
+): Promise<ITerminalExchange> {
+  return fixture.runAsync(['hello'], helloOverrides(fixture, admission));
+}
+
+function helloOverrides(
+  fixture: DaemonGraphTestFixture,
+  admission: IDaemonRequestEnvelope['admission']
+): Partial<IDaemonRequestEnvelope> {
+  return { commandOrigin: 'custom', invocationKind: 'rushx', cwd: path.join(fixture.folder, 'a'), admission };
+}
+
+interface IHeldTransition {
+  /** The rebuild, which runs c until the test removes the `hold` marker. */
+  readonly running: Promise<ITerminalExchange>;
+  /** The request that owns the transition. It waits for the rebuild. */
+  readonly owner: Promise<ITerminalExchange>;
+  readonly client: DaemonRequestWireClient;
+}
+
+/**
+ * Starts the rebuild, then `argv`, and returns once `argv` waits behind the rebuild. `change` runs after the rebuild
+ * captured the workspace's inputs.
+ */
+async function holdTransitionAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  waitTimeoutMs: number,
+  change?: () => void
+): Promise<IHeldTransition> {
+  const running: Promise<ITerminalExchange> = fixture.runAsync(['rebuild', '--to', 'c']);
+  // A failed expectation leaves the rebuild and the owner unread until the test closes their connections.
+  running.catch(() => undefined);
+  await waitForAsync(() => fixture.runs().includes('c'));
+  change?.();
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const envelope: IDaemonRequestEnvelope = fixture.envelope(argv, { admission: { waitTimeoutMs } });
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  await readUntilQueuedAsync(client);
+  const owner: Promise<ITerminalExchange> = client.readTerminalAsync(envelope.requestId);
+  owner.catch(() => undefined);
+  return { running, owner, client };
+}
+
+describe('a served rushx script while a transition waits for a running build', () => {
+  it('starts at once, on the current generation, while a build waits to reload the graph', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      // The build reloads the graph, since the rebuild bound the engine, so it owns that transition while it waits.
+      transition = await holdTransitionAsync(fixture, ['build', '--to', 'c'], 60_000);
+      const { running, owner } = transition;
+      const generation: number = fixture.host.workspaceGeneration;
+
+      // A request that follows a transition is admitted one way with a wait timeout and another way without one.
+      for (const admission of [{ waitTimeoutMs: 5_000 }, { noWait: true }]) {
+        const { frames, terminal } = await runHelloAsync(fixture, admission);
+        expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+        expect(frames.filter(isQueuePosition)).toEqual([]);
+      }
+      // Only scripts pass the build. A graph request that the current generation could answer at once, and a rebuild
+      // that could reuse it, wait behind the build.
+      for (const argv of [
+        ['daemon', 'graph', 'status'],
+        ['rebuild', '--to', 'c']
+      ]) {
+        expect((await fixture.runAsync(argv, { admission: { noWait: true } })).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'no-wait' }
+        });
+      }
+      // The rebuild and the build still wait for the marker.
+      expect(fixture.runs()).toEqual(['c', 'hello', 'hello']);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+      expect(await isSettledAsync(running)).toBe(false);
+      expect(await isSettledAsync(owner)).toBe(false);
+
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect((await owner).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.client.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('waits while the reload replaces the generation, and then starts on the new one', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    let script: DaemonRequestWireClient | undefined;
+    let releaseReload: () => void = () => undefined;
+    const reloadReleased: Promise<void> = new Promise((resolve) => (releaseReload = resolve));
+    try {
+      transition = await holdTransitionAsync(fixture, ['build', '--to', 'c'], 60_000);
+      const { running, owner } = transition;
+      const generation: number = fixture.host.workspaceGeneration;
+      let reloading: boolean = false;
+      fixture.beforeCreateSessionAsync = async () => {
+        reloading = true;
+        await reloadReleased;
+      };
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      await waitForAsync(() => reloading);
+      expect(reloading).toBe(true);
+
+      // The build holds the gate while it replaces the generation, so the script waits for it.
+      script = await fixture.connectAsync();
+      const hello: IDaemonRequestEnvelope = fixture.envelope(
+        ['hello'],
+        helloOverrides(fixture, { waitTimeoutMs: 5_000 })
+      );
+      await script.sendControlAsync({ kind: 'requestStart', payload: hello });
+      await readUntilQueuedAsync(script);
+      await delayAsync(200);
+      expect(fixture.runs()).not.toContain('hello');
+
+      releaseReload();
+      expect((await script.readTerminalAsync(hello.requestId)).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0 }
+      });
+      expect((await owner).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.runs()).toContain('hello');
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      releaseReload();
+      fs.rmSync(hold, { force: true });
+      await script?.closeAsync();
+      await transition?.client.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('still waits behind a native install that reloads the graph, since the script would end with this process', async () => {
+    const fixture: DaemonGraphTestFixture = await createHeldFixtureAsync((created) => {
+      // The install is never admitted, so no successor is launched.
+      created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+    });
+    const hold: string = path.join(fixture.folder, 'hold');
+    let transition: IHeldTransition | undefined;
+    try {
+      // A changed project configuration gives the install the tier of a build's reload.
+      transition = await holdTransitionAsync(fixture, ['install'], 3_000, () => {
+        const packageJsonPath: string = path.join(fixture.folder, 'b/package.json');
+        const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+      });
+      const { running, owner } = transition;
+
+      const { frames, terminal } = await runHelloAsync(fixture, { waitTimeoutMs: 500 });
+      expect(terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      expect(frames.filter(isQueuePosition)).not.toEqual([]);
+      expect(fixture.runs()).toEqual(['c']);
+
+      expect((await owner).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+      });
+      fs.rmSync(hold);
+      expect((await running).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.runs()).not.toContain('hello');
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await transition?.client.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});

From bf39f11a0f211d1418206b6cc1fc6e2de94558cc Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 202/265] [rush-daemon] Expect no lock holder PID where the
 platform cannot tell it

Swarm integration step 187; original commit 69787dffd8 (merge of swarm/o04-t302-e2f-nit3 at cf7a0237e8).
Scope: task 302 + NIT 3.

Brings 302-nit3 (branch swarm/o04-t302-e2f-nit3). Second agent: ch05 board 6776; ADDENDUM 3 CONFIRMED board 6814, board 6815. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 4 of 15. Gate: ch01 GATE OK board 6977 (tree 90adcaf963)

Commits folded into this step (4):
- a00afd9851 [rush-daemon] Let served rushx scripts pass a reload that waits for another Rush process (task 302)
- b2565319fb [rush-daemon] Test a served rushx script while a new daemon's first build waits for another Rush process (task 302)
- ec4000d620 Cover a passed rushx script that is handed back before it starts
- cf7a0237e8 Expect no lock holder PID where the platform cannot tell it

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-t302-script-passage_2026-09-29-16-45.json |  11 +
 libraries/rush-daemon/README.md               |   6 +-
 .../src/WorkspaceRequestAdmission.ts          |  85 +++-
 .../src/WorkspaceRequestLifecycle.ts          |  68 ++-
 .../src/test/DaemonGraphTestFixture.ts        |   8 +-
 .../test/ServedScriptNativeLockWait.test.ts   | 458 ++++++++++++++++++
 6 files changed, 610 insertions(+), 26 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-o04-t302-script-passage_2026-09-29-16-45.json
 create mode 100644 libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-o04-t302-script-passage_2026-09-29-16-45.json b/common/changes/@rushstack/rush-daemon/swarm-o04-t302-script-passage_2026-09-29-16-45.json
new file mode 100644
index 0000000000..cc58053ed8
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-o04-t302-script-passage_2026-09-29-16-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A served rushx script no longer waits for a reload that waits for another Rush process, such as `rush install`, to release the repository's lock. It starts at once on the current generation, as it did before that wait was added, and the reload waits for it only until it has started. After an edit to `rush.json` or `common/config/rush/experiments.json`, the client runs it in-process at once instead, as it would if no reload were running. Before, the script waited behind the reload until its own wait timeout ended, and then failed without running.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index a00dd1480f..9cbf7dddd7 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -188,7 +188,11 @@ another whenever that process changes. `--no-wait` and a zero timeout fail at on
 default timeout also limits this wait, because the other process can run for any length of time; a request that
 waits longer fails with an admission failure that names the process and suggests `--wait-timeout`. A cancelled
 request stops waiting and never runs. When the daemon itself holds the lock for another request, the request still
-fails at once, and the experimental graph request's lease does not wait.
+fails at once, and the experimental graph request's lease does not wait. A served Rushx script does not wait for a
+reload that waits for such a process, since the script does not need the reload: it resolves and starts on the
+current generation at once, as it would have before the reload began, and the reload waits for it only until it
+has started. After an edit to `rush.json` or `common/config/rush/experiments.json`, the client runs it in-process
+at once instead, as it would if no reload were running.
 
 A dirty native lock left by another command invalidates retained successes so the native
 incremental/cache pipeline can reconcile possibly changed ignored outputs. Declared `outputFolderNames` are also
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 1716181007..09d38629df 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -187,6 +187,41 @@ export class ServedScriptScheduler extends RequestScheduler {
   }
 }
 
+/**
+ * Lets the rushx scripts that a daemon runs pass a graph transition while it waits for another Rush process, which
+ * may run for any length of time. While the passage is open, a script is admitted at once with a lease of its own,
+ * which it holds until it starts, instead of waiting for the transition. Closing the passage waits until every
+ * script that passed it has started or failed, so that none of them starts on a generation that has been replaced.
+ */
+export class ScriptPassage {
+  readonly #scheduler: RequestScheduler = new RequestScheduler();
+  #opened: AbortController = new AbortController();
+
+  public get isOpen(): boolean {
+    return this.#opened.signal.aborted;
+  }
+
+  /** Aborted when the passage next opens, so that a script that waits for the transition can pass instead. */
+  public get opened(): AbortSignal {
+    return this.#opened.signal;
+  }
+
+  public open(): void {
+    this.#opened.abort();
+  }
+
+  /** Admits a script while the passage is open. */
+  public passAsync(admission: RequestAdmissionController): Promise<IRequestLease> {
+    return admission.acquireAsync(this.#scheduler, RequestExclusivityClass.SharedBuild);
+  }
+
+  /** Closes the passage and waits until every script that passed it has released its lease. */
+  public async closeAsync(): Promise<void> {
+    if (this.isOpen) this.#opened = new AbortController();
+    (await this.#scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive })).release();
+  }
+}
+
 class QueuePositionWriter {
   readonly #abortController: AbortController;
   readonly #requestId: string;
@@ -523,24 +558,49 @@ export class RequestAdmissionController {
    * `IRequestSchedulerAcquireOptions.admitAheadOfQueue`. The lifecycle sets it for a rushx script while the owner of
    * a reload has yet to replace the current generation, which the script needs only to start.
    */
+  public acquireBehindTransitionAsync(
+    scheduler: RequestScheduler,
+    transition: AdmissionProgress,
+    admitAheadOfQueue?: boolean
+  ): Promise<IRequestLease>;
+  /**
+   * Waits as the other overload does, but only until `stopWaiting` is aborted, and then returns undefined. The time
+   * that the request waited is spent as it would be if it had been admitted then.
+   */
+  public acquireBehindTransitionAsync(
+    scheduler: RequestScheduler,
+    transition: AdmissionProgress,
+    admitAheadOfQueue: boolean,
+    stopWaiting: AbortSignal
+  ): Promise<IRequestLease | undefined>;
   public async acquireBehindTransitionAsync(
     scheduler: RequestScheduler,
     transition: AdmissionProgress,
-    admitAheadOfQueue: boolean = false
-  ): Promise<IRequestLease> {
+    admitAheadOfQueue: boolean = false,
+    stopWaiting?: AbortSignal
+  ): Promise<IRequestLease | undefined> {
     const waitingFor: string = "another request's load or reload of the workspace graph";
     const remainingMs: number | undefined = this.#remainingMs;
     const waitTimeoutMs: number | undefined = this.#configuredWaitTimeoutMs;
+    const abortSignals: AbortSignal[] = stopWaiting
+      ? [this.#abortController.signal, stopWaiting]
+      : [this.#abortController.signal];
+    const stoppedWaiting = (): boolean => !!stopWaiting?.aborted && !this.#abortController.signal.aborted;
     if (remainingMs === undefined || waitTimeoutMs === undefined) {
-      return await this.#acquireAsync(
-        scheduler,
-        RequestExclusivityClass.SharedBuild,
-        remainingMs,
-        waitingFor,
-        this.#abortController.signal,
-        reportQueuePosition,
-        admitAheadOfQueue
-      );
+      try {
+        return await this.#acquireAsync(
+          scheduler,
+          RequestExclusivityClass.SharedBuild,
+          remainingMs,
+          waitingFor,
+          AbortSignal.any(abortSignals),
+          reportQueuePosition,
+          admitAheadOfQueue
+        );
+      } catch (error) {
+        if (stoppedWaiting()) return undefined;
+        throw error;
+      }
     }
     const exhausted: AbortController = new AbortController();
     let pausedLimitReached: boolean = false;
@@ -561,12 +621,13 @@ export class RequestAdmissionController {
         RequestExclusivityClass.SharedBuild,
         undefined,
         waitingFor,
-        AbortSignal.any([this.#abortController.signal, exhausted.signal]),
+        AbortSignal.any([...abortSignals, exhausted.signal]),
         reportQueuePosition,
         admitAheadOfQueue
       );
     } catch (error) {
       budget.stop();
+      if (stoppedWaiting() && !exhausted.signal.aborted) return undefined;
       if (!exhausted.signal.aborted || this.#abortController.signal.aborted) throw error;
       // A zero timeout has no paused allowance, so it fails at once without reaching a limit worth naming.
       const message: string =
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index d6f32b9108..98cf06455d 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -50,6 +50,7 @@ import {
 import {
   AdmissionProgress,
   RequestAdmissionController,
+  ScriptPassage,
   ServedScriptScheduler,
   getRequestAdmissionErrorCode,
   getWorkspaceRequestScheduler
@@ -167,6 +168,12 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
    * taking `#gate` exclusively, when no other script can start.
    */
   readonly #scripts: ServedScriptScheduler = new ServedScriptScheduler();
+  /**
+   * Open while a reload waits for another Rush process to release the repository's lock, which may take any length of
+   * time: a served rushx script that arrives or waits then passes the reload, and resolves and starts on the current
+   * generation, as it would have before the reload began. The reload waits for it only until it has started.
+   */
+  readonly #scriptPassage: ScriptPassage = new ScriptPassage();
   readonly #restartArbiter: WorkspaceRestartArbiter = new WorkspaceRestartArbiter();
   readonly #abortController: AbortController = new AbortController();
   readonly #observers: Set<AbortController> = new Set();
@@ -356,7 +363,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             onResultDrained = () => this.#yieldAfterResult(prepared.lease, ticket, preemption);
           }
           if (isRushxInvocation(envelope)) {
-            // Never waits: exclusive holders of this lease also hold `#gate` exclusively, and this request holds it.
+            // Never waits: exclusive holders of this lease also hold `#gate` exclusively, and this request holds it, or
+            // passed a reload that holds it and waits for this request to start (see `#scriptPassage`).
             scriptLease = await admission.acquireAsync(this.#scripts, RequestExclusivityClass.SharedBuild);
           }
           // Routing boundaries spend a copy of the remaining budget, so a retry after dispatch starts from this one.
@@ -505,13 +513,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   ): Promise<IPreparedGeneration> {
     let lease: IRequestLease =
       admittedLease ??
-      (this.#transitioning
-        ? await admission.acquireBehindTransitionAsync(
-            this.#gate,
-            this.#transitionProgress,
-            this.#scriptsMayPassTransition && isRushxInvocation(envelope)
-          )
-        : await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
+      (isRushxInvocation(envelope)
+        ? await this.#admitScriptAsync(admission)
+        : this.#transitioning
+          ? await admission.acquireBehindTransitionAsync(this.#gate, this.#transitionProgress)
+          : await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild));
     let ownsTransition: boolean = false;
     try {
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
@@ -782,10 +788,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       const loading: boolean = this.#transitionProgress.active;
       this.#transitionProgress.setActive(false);
       try {
-        nativeLock = await admission.acquireNativeLockAsync(
-          () => tryAcquireNativeLock(lockFolder),
-          () => findNativeLockHolder(lockFolder)
-        );
+        nativeLock = await this.#acquireReloadLockAsync(admission, lockFolder);
       } catch (error) {
         workspaceLease.release();
         throw error;
@@ -893,6 +896,47 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Admits a served rushx script with a `#gate` lease, or with a `#scriptPassage` lease while the passage is open. A
+   * script that waits behind a transition may be admitted ahead of a reload's owner that still waits for `#gate` (see
+   * `#scriptsMayPassTransition`), and passes once the passage opens.
+   */
+  async #admitScriptAsync(admission: RequestAdmissionController): Promise<IRequestLease> {
+    for (;;) {
+      if (this.#scriptPassage.isOpen) return await this.#scriptPassage.passAsync(admission);
+      if (!this.#transitioning)
+        return await admission.acquireAsync(this.#gate, RequestExclusivityClass.SharedBuild);
+      const lease: IRequestLease | undefined = await admission.acquireBehindTransitionAsync(
+        this.#gate,
+        this.#transitionProgress,
+        this.#scriptsMayPassTransition,
+        this.#scriptPassage.opened
+      );
+      if (lease) return lease;
+    }
+  }
+
+  /**
+   * Takes native Rush's repository lock for a reload. While another Rush process holds it, served rushx scripts pass
+   * the reload (see `#scriptPassage`), and the reload then waits until each of them has started or failed.
+   */
+  async #acquireReloadLockAsync(
+    admission: RequestAdmissionController,
+    lockFolder: string
+  ): Promise<LockFile> {
+    const lock: LockFile | undefined = tryAcquireNativeLock(lockFolder);
+    if (lock) return lock;
+    this.#scriptPassage.open();
+    try {
+      return await admission.acquireNativeLockAsync(
+        () => tryAcquireNativeLock(lockFolder),
+        () => findNativeLockHolder(lockFolder)
+      );
+    } finally {
+      await this.#scriptPassage.closeAsync();
+    }
+  }
+
   /**
    * Waits, while holding `#gate` exclusively, until no served rushx script is running; none can start meanwhile.
    * This is contention, not graph-load progress, so requests queued behind it spend their wait timeouts. The client
diff --git a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
index d66bc68b4e..206eb796aa 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphTestFixture.ts
@@ -67,6 +67,11 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
   public afterCreateSessionAsync: (() => Promise<void>) | undefined;
   /** Also serves rushx package scripts, like the production host. Set it in `createAsync`'s `configure`. */
   public servesRushx: boolean = false;
+  /**
+   * Wraps the resolver that the host serves requests with. The wrapper also serves later generations if it keeps the
+   * resolver's `workspaceLifecycle` (see `wrapWorkspaceResolverLifecycle`). Set it in `createAsync`'s `configure`.
+   */
+  public wrapResolver: ((resolver: IDaemonRequestResolver) => IDaemonRequestResolver) | undefined;
   public readonly folder: string = fs.realpathSync.native(
     fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-graph-'))
   );
@@ -176,9 +181,10 @@ export class DaemonGraphTestFixture implements AsyncDisposable {
 
   private async _startAsync(): Promise<void> {
     const production: IDaemonRequestResolver = new ProductionDaemonRequestResolver();
-    const resolver: IDaemonRequestResolver = this.servesRushx
+    const served: IDaemonRequestResolver = this.servesRushx
       ? new RushDaemonRequestResolver(production)
       : production;
+    const resolver: IDaemonRequestResolver = this.wrapResolver?.(served) ?? served;
     this.host = await RushDaemonHost.startAsync({
       repoRoot: this.folder,
       rushVersion: Rush.version,
diff --git a/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
new file mode 100644
index 0000000000..d2ed4fb5c9
--- /dev/null
+++ b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
@@ -0,0 +1,458 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonNativeLockHolder,
+  type IDaemonRequestEnvelope,
+  type IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import type {
+  IDaemonRequestResolver,
+  IResolveDaemonRequestOptions,
+  ResolvedDaemonRequest
+} from '../DaemonRequestDispatcher';
+import type { WorkspaceSession } from '../WorkspaceSession';
+import {
+  isRushxInvocation,
+  wrapWorkspaceResolverLifecycle,
+  type IWorkspaceResolverLifecycle
+} from '../WorkspaceResolverLifecycle';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import {
+  createDeferred,
+  type DaemonRequestWireClient,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_A: string[] = ['build', '--to', 'a', '--parallelism', '3'];
+/** Longer than any wait in these tests, so that only the reload's own progress ends it. */
+const RELOAD_WAIT_TIMEOUT_MS: number = 40_000;
+
+function delayAsync(ms: number): Promise<void> {
+  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+}
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+/** Project a's `quick` script appends `quick` to runs.txt and exits. */
+function createFixtureAsync(
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created) => {
+    created.servesRushx = true;
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: { '_phase:compile': 'node build.cjs', quick: 'node quick.cjs' }
+      })
+    );
+    created.write('a/quick.cjs', "require('node:fs').appendFileSync('../runs.txt','quick\\n');");
+    configure?.(created);
+  });
+}
+
+function countScriptRuns(fixture: DaemonGraphTestFixture): number {
+  return fixture.runs().filter((line: string) => line === 'quick').length;
+}
+
+function getScriptEnvelope(
+  fixture: DaemonGraphTestFixture,
+  waitTimeoutMs: number
+): Partial<IDaemonRequestEnvelope> {
+  return {
+    commandOrigin: 'custom',
+    invocationKind: 'rushx',
+    cwd: path.join(fixture.folder, 'a'),
+    admission: { waitTimeoutMs }
+  };
+}
+
+let configurationChanges: number = 0;
+
+/** Changes project c's configuration, so that the next build reloads the graph. */
+function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
+  const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+  const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  fs.writeFileSync(
+    packageJsonPath,
+    JSON.stringify({ ...packageJson, description: `changed ${++configurationChanges}` })
+  );
+}
+
+/** Writes rush.json's default `projectFolderMaxDepth` into it, which changes the file but not the workspace. */
+function changeRushJson(fixture: DaemonGraphTestFixture): void {
+  const rushJsonPath: string = path.join(fixture.folder, 'rush.json');
+  const rushJson: Record<string, unknown> = JSON.parse(fs.readFileSync(rushJsonPath, 'utf8'));
+  fs.writeFileSync(rushJsonPath, JSON.stringify({ ...rushJson, projectFolderMaxDepth: 2 }));
+}
+
+interface ILockHolder {
+  readonly pid: number;
+  releaseAsync(): Promise<void>;
+}
+
+/** Holds native Rush's repository lock in another process, as `rush install` would, until it is released. */
+async function holdRepositoryLockAsync(fixture: DaemonGraphTestFixture): Promise<ILockHolder> {
+  const script: string = [
+    `const { LockFile } = require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))});`,
+    `const lock = LockFile.tryAcquire(${JSON.stringify(path.join(fixture.folder, 'common/temp'))}, 'rush');`,
+    "process.stdout.write(lock ? 'held' : 'busy');",
+    'process.stdin.resume();',
+    "process.stdin.on('end', () => { lock?.release(); process.exit(0); });"
+  ].join('\n');
+  const child: ChildProcess = spawn(process.execPath, ['-e', script], { stdio: ['pipe', 'pipe', 'inherit'] });
+  const releaseAsync = async (): Promise<void> => {
+    if (child.exitCode !== null || child.signalCode !== null) return;
+    const closed: Promise<unknown[]> = once(child, 'close');
+    child.stdin!.end();
+    await closed;
+  };
+  try {
+    const [output] = await once(child.stdout!, 'data');
+    expect(String(output)).toBe('held');
+  } catch (error) {
+    await releaseAsync();
+    throw error;
+  }
+  return { pid: child.pid!, releaseAsync };
+}
+
+interface IStreamedRequest {
+  readonly exchange: Promise<ITerminalExchange>;
+  /** The payloads of the queue positions that the daemon has reported so far. */
+  readonly positionPayloads: ReadonlyArray<IDaemonRequestQueuePositionMessage['payload']>;
+  readonly settled: () => boolean;
+}
+
+/** Starts a request, recording its queue positions as they arrive. */
+async function startRequestAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope>
+): Promise<IStreamedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const payload: IDaemonRequestEnvelope = fixture.envelope(argv, overrides);
+  await client.sendControlAsync({ kind: 'requestStart', payload });
+  const positionPayloads: IDaemonRequestQueuePositionMessage['payload'][] = [];
+  let settled: boolean = false;
+  const readAsync = async (): Promise<ITerminalExchange> => {
+    const frames: IDaemonFrame[] = [];
+    try {
+      for (;;) {
+        const frame: IDaemonFrame = await client.readFrameAsync();
+        frames.push(frame);
+        if (frame.kind !== DaemonFrameType.controlJson) continue;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'queuePosition') positionPayloads.push(message.payload);
+        if (message.kind === 'requestResult' && message.payload.requestId === payload.requestId) {
+          return { frames, terminal: message };
+        }
+      }
+    } finally {
+      settled = true;
+      await client.closeAsync();
+    }
+  };
+  const exchange: Promise<ITerminalExchange> = readAsync();
+  // A failed expectation leaves the exchange unread until the fixture closes the connection.
+  exchange.catch(() => undefined);
+  return { exchange, positionPayloads, settled: () => settled };
+}
+
+/** Changes the configuration and starts a build that reloads the graph for it. */
+async function startReloadAsync(fixture: DaemonGraphTestFixture): Promise<IStreamedRequest> {
+  changeProjectConfiguration(fixture);
+  return await startRequestAsync(fixture, BUILD_A, { admission: { waitTimeoutMs: RELOAD_WAIT_TIMEOUT_MS } });
+}
+
+/** What the daemon says about `holder`. Only Linux can tell which process holds the lock. */
+function getExpectedHolder(holder: ILockHolder): IDaemonNativeLockHolder {
+  return process.platform === 'linux' ? { pid: holder.pid } : {};
+}
+
+async function waitForLockWaitAsync(reload: IStreamedRequest, holder: ILockHolder): Promise<void> {
+  const expected: IDaemonNativeLockHolder = getExpectedHolder(holder);
+  await waitForAsync(
+    () =>
+      reload.settled() ||
+      reload.positionPayloads.some((p) => isDeepStrictEqual(p.nativeLockHolder, expected)),
+    'the reload to wait for the repository lock'
+  );
+  expect(reload.settled()).toBe(false);
+}
+
+interface IHold {
+  readonly reached: Promise<void>;
+  release(): void;
+}
+
+/** Holds the next time that the reload of the current generation quiesces its warm set, as it does before the lock. */
+function holdQuiesce(fixture: DaemonGraphTestFixture): IHold {
+  const session: WorkspaceSession = fixture.session;
+  const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+  const reached: IDeferred<void> = createDeferred<void>();
+  const released: IDeferred<void> = createDeferred<void>();
+  jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementationOnce(async () => {
+    reached.resolve();
+    await released.promise;
+    await quiesceAsync();
+  });
+  return { reached: reached.promise, release: () => released.resolve() };
+}
+
+/** Holds the next rushx request that a {@link HeldScriptResolver} resolves, until the test releases it. */
+class ScriptResolutionHold {
+  #next: { readonly reached: IDeferred<void>; readonly released: IDeferred<void> } | undefined;
+
+  public arm(): IHold {
+    const next: { readonly reached: IDeferred<void>; readonly released: IDeferred<void> } = {
+      reached: createDeferred<void>(),
+      released: createDeferred<void>()
+    };
+    this.#next = next;
+    return { reached: next.reached.promise, release: () => next.released.resolve() };
+  }
+
+  public async waitAsync(): Promise<void> {
+    const next: { readonly reached: IDeferred<void>; readonly released: IDeferred<void> } | undefined =
+      this.#next;
+    this.#next = undefined;
+    if (!next) return;
+    next.reached.resolve();
+    await next.released.promise;
+  }
+}
+
+class HeldScriptResolver implements IDaemonRequestResolver {
+  public readonly workspaceLifecycle: IWorkspaceResolverLifecycle | undefined;
+  readonly #resolver: IDaemonRequestResolver;
+  readonly #hold: ScriptResolutionHold;
+
+  public constructor(resolver: IDaemonRequestResolver, hold: ScriptResolutionHold) {
+    this.#resolver = resolver;
+    this.#hold = hold;
+    this.workspaceLifecycle = wrapWorkspaceResolverLifecycle(
+      resolver,
+      (replacement: IDaemonRequestResolver) => new HeldScriptResolver(replacement, hold)
+    );
+  }
+
+  public async resolveRequestAsync(options: IResolveDaemonRequestOptions): Promise<ResolvedDaemonRequest> {
+    if (isRushxInvocation(options.envelope)) await this.#hold.waitAsync();
+    return await this.#resolver.resolveRequestAsync(options);
+  }
+
+  public async [Symbol.asyncDispose](): Promise<void> {
+    await this.#resolver[Symbol.asyncDispose]?.();
+  }
+}
+
+describe('a served rushx script while a reload waits for another Rush process', () => {
+  it('starts at once on the current generation while the reload waits for the lock, but not while it loads', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    let loading: IHold | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+
+      // The script used to wait behind the reload until its own wait timeout ended, and never ran (#302).
+      expectSuccess(await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000)));
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(reload.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      await holder.releaseAsync();
+      expectSuccess(await reload.exchange);
+      const reloadedGeneration: number = fixture.host.workspaceGeneration;
+      expect(reloadedGeneration).toBeGreaterThan(generation);
+
+      // A reload that is loading the graph, and not waiting for another process, still holds the script.
+      loading = holdQuiesce(fixture);
+      const nextReload: IStreamedRequest = await startReloadAsync(fixture);
+      await loading.reached;
+      const script: IStreamedRequest = await startRequestAsync(
+        fixture,
+        ['quick'],
+        getScriptEnvelope(fixture, 2000)
+      );
+      await delayAsync(1000);
+      expect(script.settled()).toBe(false);
+      expect(countScriptRuns(fixture)).toBe(1);
+      loading.release();
+      expectSuccess(await nextReload.exchange);
+      expectSuccess(await script.exchange);
+      expect(countScriptRuns(fixture)).toBe(2);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(reloadedGeneration);
+    } finally {
+      // A failed expectation must not leave the reload held, or disposing the fixture would wait for it.
+      loading?.release();
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a script that waits behind the reload pass once the reload waits for the lock', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    let loading: IHold | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      loading = holdQuiesce(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await loading.reached;
+      const script: IStreamedRequest = await startRequestAsync(
+        fixture,
+        ['quick'],
+        getScriptEnvelope(fixture, 2000)
+      );
+      await waitForAsync(() => script.positionPayloads.length > 0, 'the script to wait behind the reload');
+
+      loading.release();
+      await waitForLockWaitAsync(reload, holder);
+      expectSuccess(await script.exchange);
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(reload.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      await holder.releaseAsync();
+      expectSuccess(await reload.exchange);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      loading?.release();
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('replaces the generation only after each script that passed the reload has started', async () => {
+    const resolution: ScriptResolutionHold = new ScriptResolutionHold();
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync((created) => {
+      created.wrapResolver = (resolver: IDaemonRequestResolver) =>
+        new HeldScriptResolver(resolver, resolution);
+    });
+    let holder: ILockHolder | undefined;
+    let resolving: IHold | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+
+      resolving = resolution.arm();
+      let resolvingReached: boolean = false;
+      void resolving.reached.then(() => {
+        resolvingReached = true;
+      });
+      const script: IStreamedRequest = await startRequestAsync(
+        fixture,
+        ['quick'],
+        getScriptEnvelope(fixture, 5000)
+      );
+      await waitForAsync(() => resolvingReached || script.settled(), 'the script to pass the reload');
+      expect(script.settled()).toBe(false);
+      await holder.releaseAsync();
+      // The reload tries the lock every 250 ms. Once it has it, it waits for the script that is still resolving.
+      await delayAsync(1000);
+      expect(reload.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      resolving.release();
+      expectSuccess(await script.exchange);
+      expectSuccess(await reload.exchange);
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      resolving?.release();
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('starts at once while the first build of a new daemon waits for the lock', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    try {
+      holder = await holdRepositoryLockAsync(fixture);
+      // The first build loads the graph through the same reload, so the script resolves on the session it created.
+      const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: RELOAD_WAIT_TIMEOUT_MS }
+      });
+      await waitForLockWaitAsync(build, holder);
+      const generation: number = fixture.host.workspaceGeneration;
+
+      expectSuccess(await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000)));
+      expect(countScriptRuns(fixture)).toBe(1);
+      expect(build.settled()).toBe(false);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      await holder.releaseAsync();
+      expectSuccess(await build.exchange);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('replaces the generation after a script that passed the reload is handed back before it starts', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      const generation: number = fixture.host.workspaceGeneration;
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+
+      // After an edit to rush.json, the resolver hands the script back, and the client runs it in-process.
+      changeRushJson(fixture);
+      const { terminal } = await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000));
+      expect(terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+      expect(countScriptRuns(fixture)).toBe(0);
+      expect(reload.settled()).toBe(false);
+
+      // The script never started, so the reload would wait for it forever if its pass outlived the request.
+      await holder.releaseAsync();
+      await waitForAsync(() => reload.settled(), 'the reload to finish');
+      expectSuccess(await reload.exchange);
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+    } finally {
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});

From 1adb165c28265bc76f807b3a883a677877a6b12d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 203/265] [rush-lib] Run the initial command after a success
 with warnings that fail the build

Swarm integration step 188; original commit 3679a012f2 (merge of swarm/r02-t298 at 52823aeb65).
Refs: task 298.
Scope: task 298.

Brings 298 (branch swarm/r02-t298). Second agent: t07 board 6266. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 5 of 15. Gate: ch01 GATE OK board 6977 (tree 949aea6f61)

Commits folded into this step (1):
- 52823aeb65 [rush-lib] Run the initial command after a success with warnings that fail the build (task 298)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...r02-t298-warned-base_2026-09-29-16-26.json |  11 ++
 .../IncrementalExecutionGuardPlugin.ts        |  40 +++++--
 .../IncrementalExecutionGuardPlugin.test.ts   | 112 +++++++++++++++++-
 3 files changed, 151 insertions(+), 12 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r02-t298-warned-base_2026-09-29-16-26.json

diff --git a/common/changes/@microsoft/rush/swarm-r02-t298-warned-base_2026-09-29-16-26.json b/common/changes/@microsoft/rush/swarm-r02-t298-warned-base_2026-09-29-16-26.json
new file mode 100644
index 0000000000..666f51ca05
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r02-t298-warned-base_2026-09-29-16-26.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix an issue where the Rush daemon could report success for a build whose warnings fail it. After a run with such warnings, the next run of that operation used its incremental command, which might not report the warnings again, e.g. that of a linter that caches which files passed. The next run of that operation now uses its initial command, so the build keeps failing until the warnings are fixed, as `rush build` does without the Rush daemon.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index bfe356b241..ef9aa4a401 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -237,8 +237,10 @@ export function getIncrementalInputChangeReason(
  * An operation runs its incremental command only if all of these hold, and its initial command otherwise:
  *
  * 1. Its last result in this graph is a success of its own command, not a result restored from the build cache, a
- *    failure, or a run that was interrupted or whose input files changed while it ran. A native Rush command that
- *    ran in the workspace since then forgets every such result.
+ *    failure, a success with warnings that fail the build, or a run that was interrupted or whose input files changed
+ *    while it ran. A native Rush command that ran in the workspace since then forgets every such result. The
+ *    incremental command might not report the warnings of files that it does not build again (e.g. a linter that
+ *    caches which files passed), so a build that fails for them could otherwise succeed while they are still there.
  * 2. Its inputs changed as {@link getIncrementalInputChangeReason} allows.
  * 3. If that run was in a process that keeps watching the input files, such as a warm worker, none of the folders
  *    that held its input files was deleted or recreated since that run. A watcher can miss changes in such a folder,
@@ -296,6 +298,16 @@ interface IRecordState {
 
 function applyToGraph(graph: IOperationGraph): void {
   const baseByOperation: Map<Operation, IIncrementalBase> = new Map();
+  // Operations without a base because the last run of their own command reported warnings that fail the build.
+  const warnedOperations: Set<Operation> = new Set();
+  const forgetBase = (operation: Operation): void => {
+    baseByOperation.delete(operation);
+    warnedOperations.delete(operation);
+  };
+  const forgetAllBases = (): void => {
+    baseByOperation.clear();
+    warnedOperations.clear();
+  };
   // Callers that pass `outputsMayBeBundles` add an entry only after their incremental command renamed a
   // content-hashed output. An operation keeps its runner for the life of the graph.
   const cleanOnlyReasonByOperation: Map<Operation, string> = new Map();
@@ -310,7 +322,7 @@ function applyToGraph(graph: IOperationGraph): void {
       const { inputsSnapshot, getOperationEnvironment } = iterationOptions;
       if (!inputsSnapshot) {
         // Without a snapshot the inputs of later runs cannot be compared with those of this one.
-        baseByOperation.clear();
+        forgetAllBases();
         return;
       }
       for (const record of records.values()) {
@@ -359,7 +371,9 @@ function applyToGraph(graph: IOperationGraph): void {
     }
     const base: IIncrementalBase | undefined = baseByOperation.get(operation);
     if (!base) {
-      return 'its outputs were not built by a successful run of its own command in this process';
+      return warnedOperations.has(operation)
+        ? 'its last run reported warnings, which its incremental command might not report again'
+        : 'its outputs were not built by a successful run of its own command in this process';
     }
     let changedFolders: string[] | undefined;
     if (base.inputFolders) {
@@ -508,7 +522,7 @@ function applyToGraph(graph: IOperationGraph): void {
             return;
           default:
             // E.g. restored from the build cache, or executed by a runner that does not report its command.
-            baseByOperation.delete(operation);
+            forgetBase(operation);
             return;
         }
       }
@@ -522,9 +536,17 @@ function applyToGraph(graph: IOperationGraph): void {
         (status !== OperationStatus.Success && status !== OperationStatus.SuccessWithWarning) ||
         isResultUnverifiable(record)
       ) {
-        baseByOperation.delete(operation);
+        forgetBase(operation);
+        return;
+      }
+      if (status === OperationStatus.SuccessWithWarning && !operation.runner?.warningsAreAllowed) {
+        // A native `rush build` neither skips nor caches such a result, so its next build fails again. The initial
+        // command keeps that, because it reports the warnings again.
+        forgetBase(operation);
+        warnedOperations.add(operation);
         return;
       }
+      warnedOperations.delete(operation);
 
       const { verifiedOutputs } = recordState;
       const outputsPromise: Promise<IOutputState> = verifiedOutputs
@@ -555,18 +577,18 @@ function applyToGraph(graph: IOperationGraph): void {
         return;
       }
       if (reason === NATIVE_COMMAND_INVALIDATION_REASON) {
-        baseByOperation.clear();
+        forgetAllBases();
         return;
       }
       for (const operation of operations) {
-        baseByOperation.delete(operation);
+        forgetBase(operation);
       }
     }
   );
 
   graph.hooks.beforeDeleteResults.tap(PLUGIN_NAME, (operations: ReadonlySet<Operation>): void => {
     for (const operation of operations) {
-      baseByOperation.delete(operation);
+      forgetBase(operation);
     }
   });
 }
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 4b4be303c2..af62a7f263 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -165,6 +165,10 @@ interface IWorkspaceOptions {
    * If set, each inputs snapshot records when it began reading the working tree, like one that Git computes.
    */
   readonly recordsWorkingTreeReadStartTime?: boolean;
+  /**
+   * If set, the build phase allows warnings, like `allowWarningsOnSuccess` in command-line.json.
+   */
+  readonly allowWarningsOnSuccess?: boolean;
 }
 
 interface ITestIteration {
@@ -377,11 +381,13 @@ async function createWorkspaceAsync(
     legacySkipOptions,
     hasIncrementalExecutionGuard = true,
     watchesInputs,
-    recordsWorkingTreeReadStartTime
+    recordsWorkingTreeReadStartTime,
+    allowWarningsOnSuccess
   }: IWorkspaceOptions = {}
 ): Promise<ITestWorkspace> {
   const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
   workspaceFolders.push(rootFolder);
+  const phase: IPhase = allowWarningsOnSuccess ? { ...buildPhase, allowWarningsOnSuccess } : buildPhase;
 
   const writeFile = (relativePath: string, content: string): void => {
     const filePath: string = `${rootFolder}/${relativePath}`;
@@ -500,14 +506,14 @@ async function createWorkspaceAsync(
       return build(projectFolder, !!isBundle, kind === 'incremental');
     };
     const operation: Operation = new Operation({
-      phase: buildPhase,
+      phase,
       project,
       settings,
       logFilenameIdentifier: '_phase_build',
       runner: spec.pluginRunner
         ? new PluginOperationRunner(name, runBuild, spec.pluginRunner === 'reported')
         : new ShellOperationRunner({
-            phase: buildPhase,
+            phase,
             rushProject: project,
             displayName: name,
             initialCommand: INITIAL_COMMAND,
@@ -1155,6 +1161,106 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     );
   });
 
+  describe('after a success with warnings', () => {
+    const warningsReason: string =
+      'Not using the incremental command because its last run reported warnings, which its incremental command might not report again.';
+    const noBaseReason: string =
+      'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.';
+
+    it('runs the initial command until a run reports no warnings, if they fail the build', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      const warned: ITestIteration = await workspace.executeAsync();
+      expect(warned.commands).toEqual(['a:incremental']);
+      expect(warned.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+
+      // The incremental command might not report the warnings again, e.g. that of a linter that caches which files
+      // passed, so the build could succeed while they are still there. A native `rush build` would fail again.
+      const unchanged: ITestIteration = await workspace.executeAsync();
+      expect(unchanged.commands).toEqual(['a:initial']);
+      expect(unchanged.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      expect(unchanged.output).toContain(warningsReason);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const fixed: ITestIteration = await workspace.executeAsync();
+      expect(fixed.commands).toEqual(['a:initial']);
+      expect(fixed.getStatus('a')).toBe(OperationStatus.Success);
+      expect(fixed.output).toContain(warningsReason);
+
+      workspace.writeFile('a/src/sub/two.ts', 'two 2');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+    });
+
+    it('runs the initial command after its initial command reported warnings, if they fail the build', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      const warned: ITestIteration = await workspace.executeAsync();
+      expect(warned.commands).toEqual(['a:initial']);
+      expect(warned.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+
+      const unchanged: ITestIteration = await workspace.executeAsync();
+      expect(unchanged.commands).toEqual(['a:initial']);
+      expect(unchanged.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      expect(unchanged.output).toContain(warningsReason);
+    });
+
+    it.each<[string, IWorkspaceOptions, boolean]>([
+      ['the phase allows warnings', { allowWarningsOnSuccess: true }, false],
+      ['RUSH_ALLOW_WARNINGS_IN_SUCCESSFUL_BUILD allows warnings', {}, true]
+    ])(
+      'runs the incremental command if %s',
+      async (name: string, options: IWorkspaceOptions, allowWarningsInSuccessfulBuild: boolean) => {
+        jest
+          .spyOn(EnvironmentConfiguration, 'allowWarningsInSuccessfulBuild', 'get')
+          .mockReturnValue(allowWarningsInSuccessfulBuild);
+        const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], options);
+        await workspace.executeAsync();
+
+        workspace.writeFile('a/src/one.ts', 'one warning');
+        expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+        // The warnings do not fail the build.
+        const unchanged: ITestIteration = await workspace.executeAsync();
+        expect(unchanged.commands).toEqual(['a:incremental']);
+        expect(unchanged.getStatus('a')).toBe(OperationStatus.SuccessWithWarning);
+      }
+    );
+
+    it('forgets that the last run reported warnings after a native command', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      await workspace.executeAsync();
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      await workspace.executeAsync();
+
+      workspace.graph.invalidateOperations(undefined, NATIVE_COMMAND_INVALIDATION_REASON);
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(noBaseReason);
+      expect(next.output).not.toContain(warningsReason);
+    });
+
+    it('forgets that the last run reported warnings after a failure', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
+      await workspace.executeAsync();
+      workspace.writeFile('a/src/one.ts', 'one warning');
+      await workspace.executeAsync();
+
+      workspace.writeFile('a/src/one.ts', 'error');
+      const failed: ITestIteration = await workspace.executeAsync();
+      expect(failed.commands).toEqual(['a:initial']);
+      expect(failed.getStatus('a')).toBe(OperationStatus.Failure);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const fixed: ITestIteration = await workspace.executeAsync();
+      expect(fixed.commands).toEqual(['a:initial']);
+      expect(fixed.output).toContain(noBaseReason);
+      expect(fixed.output).not.toContain(warningsReason);
+    });
+  });
+
   it('runs the initial command after a command that was terminated, but not for operations that did not start', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([
       { name: 'a' },

From e15175529e173e89b7f6c6f7971eb9ff8b9f1d23 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 204/265] [rush-daemon] Test the verdict's client key and
 installer failures

Swarm integration step 189; original commit 8c21e38527 (merge of swarm/o05-t59-nit1 at f783a096f8).
Scope: task 59 a1 + NIT.

Brings 59-nit1 (branch swarm/o05-t59-nit1). Second agent: o08 board 6377, board 6740. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 6 of 15. Gate: ch01 GATE OK board 6977 (tree 0dd062096f)

Commits folded into this step (3):
- dd46f9a942 [rush-daemon] Remember why no selected daemon can serve this client
- c0f519ddb0 [rush-daemon] Keep cached-only selection independent of the verdict
- f783a096f8 [rush-daemon] Test the verdict's client key and installer failures

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-unavailable-verdict_2026-09-29-16-55.json |  11 +
 ...ection-verdict-tests_2026-09-29-18-15.json |  11 +
 .../src/VersionSelectedDaemonLauncher.ts      | 361 +++++++++++--
 .../VersionSelectedDaemonLauncher.test.ts     | 507 +++++++++++++++++-
 4 files changed, 846 insertions(+), 44 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/version-selection-unavailable-verdict_2026-09-29-16-55.json
 create mode 100644 common/changes/@rushstack/rush-daemon/version-selection-verdict-tests_2026-09-29-18-15.json

diff --git a/common/changes/@rushstack/rush-daemon/version-selection-unavailable-verdict_2026-09-29-16-55.json b/common/changes/@rushstack/rush-daemon/version-selection-unavailable-verdict_2026-09-29-16-55.json
new file mode 100644
index 0000000000..b026a2dbe9
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/version-selection-unavailable-verdict_2026-09-29-16-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Remember for a day that no cached or published daemon can serve this client for the selected Rush version (for an hour after a failed registry lookup), and end each registry lookup after 30 s.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/version-selection-verdict-tests_2026-09-29-18-15.json b/common/changes/@rushstack/rush-daemon/version-selection-verdict-tests_2026-09-29-18-15.json
new file mode 100644
index 0000000000..9d3b8b5f30
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/version-selection-verdict-tests_2026-09-29-18-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that the version-selection verdict names the client that reached it, and that an installer failure records no verdict.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts b/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
index f5c82ab50b..cb8f63d476 100644
--- a/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
+++ b/libraries/rush-daemon/src/VersionSelectedDaemonLauncher.ts
@@ -3,17 +3,26 @@
 
 import { spawn, type ChildProcess } from 'node:child_process';
 import { once } from 'node:events';
+import type { BigIntStats } from 'node:fs';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 
-import { _FlagFile, getWorkspaceHostEnvironment } from '@microsoft/rush-lib';
+import { _FlagFile, EnvironmentVariableNames, getWorkspaceHostEnvironment } from '@microsoft/rush-lib';
 import { EnvironmentConfiguration } from '@microsoft/rush-lib/lib/api/EnvironmentConfiguration';
 import {
   DependencySpecifier,
   DependencySpecifierType
 } from '@microsoft/rush-lib/lib/logic/DependencySpecifier';
 import { Utilities } from '@microsoft/rush-lib/lib/utilities/Utilities';
-import { FileSystem, JsonFile, PackageJsonLookup, User } from '@rushstack/node-core-library';
+import {
+  Executable,
+  FileSystem,
+  JsonFile,
+  PackageJsonLookup,
+  SubprocessTerminator,
+  User,
+  type IWaitForExitResult
+} from '@rushstack/node-core-library';
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonStartCommand } from '@rushstack/rush-client-core';
 
@@ -25,6 +34,14 @@ import {
 
 const DAEMON_PACKAGE: string = '@rushstack/rush-daemon';
 
+/** How long a registry answer that leaves no usable launcher for an engine stands before the registry is asked again. */
+const UNAVAILABLE_VERDICT_TTL_MS: number = 24 * 60 * 60 * 1000;
+/** How long a failed or unfinished registry lookup stands, so an unreachable registry costs one deadline per period. */
+const REGISTRY_FAILURE_VERDICT_TTL_MS: number = 60 * 60 * 1000;
+/** npm's --fetch-timeout does not cover the TCP connect: against a black-holed registry, `npm view` took 133 s. */
+const DEFAULT_REGISTRY_TIMEOUT_MS: number = 30 * 1000;
+const VERDICT_SCHEMA_VERSION: number = 1;
+
 export interface IDaemonLauncherContext {
   readonly repoRoot: string;
   readonly rushVersion: string;
@@ -35,16 +52,48 @@ export interface IVersionSelectedDaemonLaunch extends IInstalledDaemonLauncher {
   readonly startCommand: IDaemonStartCommand;
 }
 
+export interface ISelectDaemonLauncherOptions {
+  /** When false, selects only among cached installations and never queries the registry. */
+  readonly allowInstall?: boolean;
+  /** Stops a registry lookup that has not finished after this many milliseconds. */
+  readonly registryTimeoutMs?: number;
+}
+
 export class DaemonLauncherUnavailableError extends Error {
   public readonly installation: IInstalledDaemonLauncher | undefined;
+  /** Why no launcher is available: the message without its fixed prefix and suffix. */
+  public readonly reason: string;
 
   public constructor(rushVersion: string, reason: string, installation?: IInstalledDaemonLauncher) {
     super(`Cannot launch selected Rush ${rushVersion}: ${reason} Use native Rush instead.`);
     this.name = 'DaemonLauncherUnavailableError';
+    this.reason = reason;
     this.installation = installation;
   }
 }
 
+/** A registry lookup that failed or did not finish, as opposed to an answer from the registry. */
+class RegistryLookupError extends DaemonLauncherUnavailableError {}
+
+interface IIncompatibleInstallationRecord {
+  readonly folderName: string;
+  /** Changes whenever the installer writes the installation's last-install marker. */
+  readonly markerIdentity: string;
+  readonly installation: IInstalledDaemonLauncher;
+}
+
+/** Why the last selection for an engine found no usable launcher, and what it saw in the cache. */
+interface IUnavailableVerdict {
+  readonly schemaVersion: number;
+  readonly rushVersion: string;
+  readonly client: string;
+  readonly checkedAt: string;
+  readonly expiresAt: string;
+  readonly reason: string;
+  readonly installation?: IInstalledDaemonLauncher;
+  readonly incompatibleInstallations: ReadonlyArray<IIncompatibleInstallationRecord>;
+}
+
 /** Native-style, node-specific cache, resolved against the captured environment without mutating process.env. */
 export function getDaemonVersionCacheFolder(environment: Readonly<NodeJS.ProcessEnv>): string {
   const globalFolder: string =
@@ -96,33 +145,43 @@ export async function inspectDaemonLauncherAsync(
     captureExitCodeAndSignal: true
   });
   if (exitCode !== 0 || signal) throw new Error(`Daemon version attestation failed: ${stderr}`);
-  const installation: IInstalledDaemonLauncher = JSON.parse(stdout);
-  if (
-    typeof installation.rushVersion !== 'string' ||
-    typeof installation.daemonVersion !== 'string' ||
-    typeof installation.launcherPath !== 'string' ||
-    typeof installation.rushLibEntryPoint !== 'string' ||
-    !installation.protocolVersion ||
-    !Number.isSafeInteger(installation.protocolVersion.major) ||
-    !Number.isSafeInteger(installation.protocolVersion.minor) ||
-    typeof installation.daemonPackageJsonPath !== 'string' ||
-    typeof installation.canLaunchRequests !== 'boolean'
-  ) {
+  const installation: unknown = JSON.parse(stdout);
+  if (!isInstalledDaemonLauncher(installation)) {
     throw new Error('Daemon version attestation returned an invalid result.');
   }
   return installation;
 }
 
+function isInstalledDaemonLauncher(installation: unknown): installation is IInstalledDaemonLauncher {
+  return (
+    isRecord(installation) &&
+    typeof installation.rushVersion === 'string' &&
+    typeof installation.daemonVersion === 'string' &&
+    typeof installation.launcherPath === 'string' &&
+    typeof installation.rushLibEntryPoint === 'string' &&
+    isRecord(installation.protocolVersion) &&
+    Number.isSafeInteger(installation.protocolVersion.major) &&
+    Number.isSafeInteger(installation.protocolVersion.minor) &&
+    typeof installation.daemonPackageJsonPath === 'string' &&
+    typeof installation.canLaunchRequests === 'boolean'
+  );
+}
+
 /**
  * Reuses a verified available installation or installs a daemon release that pins the exact requested engine.
  * Unlike RushVersionSelector.ensureRushVersionInstalledAsync(), this never executes a Rush command.
  * Registry selection uses the newest release declaring that exact engine dependency, without overrides.
  * Installation runs the native Rush installer in an isolated process and keeps its mutex outside the
  * directory that the installer replaces. Cached-only selection never queries the registry.
+ *
+ * When the registry path finds no usable launcher, the cache folder keeps that verdict: for a day after an answer
+ * from the registry, and for an hour after a lookup that failed or did not finish. While the verdict stands and the
+ * engine's cached installations are the ones it saw, selection fails at once with the same error, without
+ * attesting those installations again or asking the registry. Cached-only selection neither reads nor writes it.
  */
 export async function selectDaemonLauncherAsync(
   input: IDaemonLauncherContext,
-  options: { readonly allowInstall?: boolean } = {}
+  options: ISelectDaemonLauncherOptions = {}
 ): Promise<IVersionSelectedDaemonLaunch> {
   const override: string | undefined = EnvironmentConfiguration._getRushGlobalFolderOverride(
     input.environment
@@ -149,10 +208,18 @@ export async function selectDaemonLauncherAsync(
   const bundledPackage: string | undefined =
     PackageJsonLookup.instance.tryGetPackageJsonFilePathFor(__dirname);
   if (!bundledPackage) throw new Error('Cannot locate the bundled daemon package.');
-  if (readDaemonInstallationMetadata(bundledPackage).rushVersion === context.rushVersion) {
+  const bundled: IDaemonInstallationMetadata = readDaemonInstallationMetadata(bundledPackage);
+  if (bundled.rushVersion === context.rushVersion) {
     return createLaunch(await inspectDaemonLauncherAsync(bundledPackage, context), context);
   }
-  let incompatible: IInstalledDaemonLauncher | undefined;
+  // A verdict holds only for the client that reached it; another client may accept other launchers.
+  const client: string = `${bundled.daemonVersion} protocol ${DAEMON_PROTOCOL_VERSION.major}.${DAEMON_PROTOCOL_VERSION.minor}`;
+  const verdictPath: string = path.join(cacheFolder, `unavailable-${context.rushVersion}.json`);
+  const verdict: IUnavailableVerdict | undefined =
+    options.allowInstall === false
+      ? undefined
+      : await tryReadLiveVerdictAsync(verdictPath, context.rushVersion, client);
+  const incompatible: IIncompatibleInstallationRecord[] = [];
   if (await FileSystem.existsAsync(cacheFolder)) {
     for (const entry of await fs.readdir(cacheFolder, { withFileTypes: true })) {
       if (!entry.isDirectory() || !entry.name.startsWith('daemon-')) continue;
@@ -175,25 +242,69 @@ export async function selectDaemonLauncherAsync(
       if (metadata.daemonVersion !== version)
         throw new Error(`Daemon cache version does not match ${folder}.`);
       if (metadata.rushVersion !== context.rushVersion) continue;
-      const installed: IInstalledDaemonLauncher = await inspectDaemonLauncherAsync(packagePath, context);
+      const markerIdentity: string = await getMarkerIdentityAsync(marker.path);
+      const installed: IInstalledDaemonLauncher =
+        verdict?.incompatibleInstallations.find(
+          (record) => record.folderName === entry.name && record.markerIdentity === markerIdentity
+        )?.installation ?? (await inspectDaemonLauncherAsync(packagePath, context));
       if (supportsClient(installed)) return createLaunch(installed, context);
-      incompatible = installed;
+      incompatible.push({ folderName: entry.name, markerIdentity, installation: installed });
     }
   }
   if (options.allowInstall === false) {
-    if (incompatible) return createLaunch(incompatible, context);
+    if (incompatible.length) return createLaunch(incompatible[incompatible.length - 1].installation, context);
     throw new DaemonLauncherUnavailableError(
       context.rushVersion,
       'No matching installed daemon launcher is available.'
     );
   }
-  const versions: unknown = await npmViewAsync(DAEMON_PACKAGE, 'versions', context);
+  if (verdict && isSameInstallationSet(verdict.incompatibleInstallations, incompatible)) {
+    throw new DaemonLauncherUnavailableError(context.rushVersion, verdict.reason, verdict.installation);
+  }
+  try {
+    return await installFromRegistryAsync(
+      context,
+      cacheFolder,
+      options.registryTimeoutMs ?? DEFAULT_REGISTRY_TIMEOUT_MS
+    );
+  } catch (error) {
+    if (error instanceof DaemonLauncherUnavailableError) {
+      await tryWriteVerdictAsync(verdictPath, {
+        schemaVersion: VERDICT_SCHEMA_VERSION,
+        rushVersion: context.rushVersion,
+        client,
+        ttlMs:
+          error instanceof RegistryLookupError ? REGISTRY_FAILURE_VERDICT_TTL_MS : UNAVAILABLE_VERDICT_TTL_MS,
+        reason: error.reason,
+        installation: error.installation,
+        incompatibleInstallations: await addInstalledRecordAsync(
+          incompatible,
+          error.installation,
+          cacheFolder
+        )
+      });
+    }
+    throw error;
+  }
+}
+
+async function installFromRegistryAsync(
+  context: IDaemonLauncherContext,
+  cacheFolder: string,
+  registryTimeoutMs: number
+): Promise<IVersionSelectedDaemonLaunch> {
+  const versions: unknown = await npmViewAsync(DAEMON_PACKAGE, 'versions', context, registryTimeoutMs);
   const candidates: unknown[] = Array.isArray(versions) ? versions : [versions];
   // npm view returns its versions field in semver order; no second version parser is needed here.
   for (const candidate of candidates.reverse()) {
     if (typeof candidate !== 'string') throw new Error('npm returned an invalid daemon version list.');
     assertExactDaemonVersion(candidate);
-    const metadata: unknown = await npmViewAsync(`${DAEMON_PACKAGE}@${candidate}`, undefined, context);
+    const metadata: unknown = await npmViewAsync(
+      `${DAEMON_PACKAGE}@${candidate}`,
+      undefined,
+      context,
+      registryTimeoutMs
+    );
     if (!isRecord(metadata) || metadata.name !== DAEMON_PACKAGE || metadata.version !== candidate) {
       throw new Error(`npm returned invalid metadata for ${DAEMON_PACKAGE}@${candidate}.`);
     }
@@ -236,6 +347,109 @@ export async function selectDaemonLauncherAsync(
   );
 }
 
+async function getMarkerIdentityAsync(markerPath: string): Promise<string> {
+  const stats: BigIntStats = await fs.stat(markerPath, { bigint: true });
+  return `${stats.size}:${stats.mtimeNs}:${stats.ino}`;
+}
+
+function isSameInstallationSet(
+  recorded: ReadonlyArray<IIncompatibleInstallationRecord>,
+  current: ReadonlyArray<IIncompatibleInstallationRecord>
+): boolean {
+  return (
+    recorded.length === current.length &&
+    current.every((installation) =>
+      recorded.some(
+        (record) =>
+          record.folderName === installation.folderName &&
+          record.markerIdentity === installation.markerIdentity
+      )
+    )
+  );
+}
+
+/** Adds the installation that the registry path installed and attested, so the next selection accepts the verdict. */
+async function addInstalledRecordAsync(
+  incompatible: ReadonlyArray<IIncompatibleInstallationRecord>,
+  installation: IInstalledDaemonLauncher | undefined,
+  cacheFolder: string
+): Promise<IIncompatibleInstallationRecord[]> {
+  const records: IIncompatibleInstallationRecord[] = [...incompatible];
+  if (!installation || supportsClient(installation)) return records;
+  const folderName: string = `daemon-${installation.daemonVersion}`;
+  if (records.some((record) => record.folderName === folderName)) return records;
+  const marker: _FlagFile = new _FlagFile(path.join(cacheFolder, folderName), 'last-install', {
+    node: process.versions.node,
+    daemonVersion: installation.daemonVersion
+  });
+  if (await marker.isValidAsync()) {
+    records.push({ folderName, markerIdentity: await getMarkerIdentityAsync(marker.path), installation });
+  }
+  return records;
+}
+
+async function tryReadLiveVerdictAsync(
+  verdictPath: string,
+  rushVersion: string,
+  client: string
+): Promise<IUnavailableVerdict | undefined> {
+  let verdict: unknown;
+  try {
+    verdict = JSON.parse(await fs.readFile(verdictPath, 'utf8'));
+  } catch {
+    return undefined;
+  }
+  if (!isRecord(verdict)) return undefined;
+  const now: number = Date.now();
+  const checkedAt: number = typeof verdict.checkedAt === 'string' ? Date.parse(verdict.checkedAt) : NaN;
+  const expiresAt: number = typeof verdict.expiresAt === 'string' ? Date.parse(verdict.expiresAt) : NaN;
+  if (
+    verdict.schemaVersion !== VERDICT_SCHEMA_VERSION ||
+    verdict.rushVersion !== rushVersion ||
+    verdict.client !== client ||
+    // A clock that moved back since the check cannot say how old the verdict is.
+    !(checkedAt <= now && now < expiresAt) ||
+    typeof verdict.reason !== 'string' ||
+    (verdict.installation !== undefined && !isInstalledDaemonLauncher(verdict.installation)) ||
+    !Array.isArray(verdict.incompatibleInstallations) ||
+    !verdict.incompatibleInstallations.every(
+      (record: unknown) =>
+        isRecord(record) &&
+        typeof record.folderName === 'string' &&
+        typeof record.markerIdentity === 'string' &&
+        isInstalledDaemonLauncher(record.installation) &&
+        // A recorded attestation only ever stands in for a refusal, never for a launch.
+        !supportsClient(record.installation)
+    )
+  ) {
+    return undefined;
+  }
+  return verdict as unknown as IUnavailableVerdict;
+}
+
+async function tryWriteVerdictAsync(
+  verdictPath: string,
+  input: Omit<IUnavailableVerdict, 'checkedAt' | 'expiresAt'> & { readonly ttlMs: number }
+): Promise<void> {
+  const { ttlMs, ...fields } = input;
+  const now: number = Date.now();
+  const verdict: IUnavailableVerdict = {
+    ...fields,
+    checkedAt: new Date(now).toISOString(),
+    expiresAt: new Date(now + ttlMs).toISOString()
+  };
+  // Readers never see a partial file: each writer renames its own complete copy into place.
+  const temporaryPath: string = `${verdictPath}.${process.pid}-${now}.tmp`;
+  try {
+    await fs.mkdir(path.dirname(verdictPath), { recursive: true });
+    await fs.writeFile(temporaryPath, JSON.stringify(verdict, undefined, 2));
+    await fs.rename(temporaryPath, verdictPath);
+  } catch {
+    // The verdict only saves time; without it, the next selection checks again.
+    await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+  }
+}
+
 function supportsClient(installation: IInstalledDaemonLauncher): boolean {
   return (
     installation.protocolVersion.major === DAEMON_PROTOCOL_VERSION.major &&
@@ -269,34 +483,97 @@ function createLaunch(
 async function npmViewAsync(
   specifier: string,
   field: string | undefined,
-  context: IDaemonLauncherContext
+  context: IDaemonLauncherContext,
+  timeoutMs: number
 ): Promise<unknown> {
   const configFolder: string = path.join(context.repoRoot, 'common', 'config', 'rush');
-  const { stdout, stderr, exitCode, signal } = await Utilities.executeCommandAndCaptureOutputAsync({
-    command: 'npm',
-    args: [
-      'view',
-      specifier,
-      ...(field ? [field] : []),
-      '--json',
-      '--fetch-retries=0',
-      '--fetch-timeout=30000',
-      '--no-update-notifier'
-    ],
-    workingDirectory: (await FileSystem.existsAsync(configFolder)) ? configFolder : context.repoRoot,
-    environment: { ...context.environment },
-    keepEnvironment: false,
-    captureExitCodeAndSignal: true
-  });
-  if (exitCode !== 0 || signal) {
-    throw new DaemonLauncherUnavailableError(
+  let timedOut: boolean = false;
+  let result: IWaitForExitResult<string>;
+  try {
+    // No shell: a POSIX shell need not exec its command, and stopping only the shell would leave npm running
+    // with the output pipes open, so the wait would last as long as npm's own connect timeout.
+    const child: ChildProcess = Executable.spawn(
+      'npm',
+      [
+        'view',
+        specifier,
+        ...(field ? [field] : []),
+        '--json',
+        '--fetch-retries=0',
+        '--fetch-timeout=30000',
+        '--no-update-notifier'
+      ],
+      {
+        currentWorkingDirectory: (await FileSystem.existsAsync(configFolder))
+          ? configFolder
+          : context.repoRoot,
+        environment: getRushCommandEnvironment(context.environment),
+        stdio: ['ignore', 'pipe', 'pipe']
+      }
+    );
+    const timer: NodeJS.Timeout = setTimeout(() => {
+      if (child.exitCode !== null || child.signalCode !== null) return;
+      timedOut = true;
+      stopRegistryLookup(child);
+    }, timeoutMs);
+    try {
+      result = await Executable.waitForExitAsync(child, { encoding: 'utf8' });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch (error) {
+    throw new RegistryLookupError(
+      context.rushVersion,
+      `Registry lookup for ${specifier} failed: ${(error as Error).message}`
+    );
+  }
+  if (timedOut) {
+    throw new RegistryLookupError(
       context.rushVersion,
-      `Registry lookup for ${specifier} failed: ${stderr}`
+      `Registry lookup for ${specifier} did not finish within ${timeoutMs / 1000} s.`
     );
   }
+  const { stdout, stderr, exitCode, signal } = result;
+  if (exitCode !== 0 || signal) {
+    throw new RegistryLookupError(context.rushVersion, `Registry lookup for ${specifier} failed: ${stderr}`);
+  }
   return JSON.parse(stdout);
 }
 
+function stopRegistryLookup(child: ChildProcess): void {
+  if (process.platform === 'win32') {
+    // There npm is a batch file, so the child is cmd.exe; end npm with it.
+    try {
+      SubprocessTerminator.killProcessTree(child, { detached: false });
+      return;
+    } catch {
+      // Fall back to ending the child alone.
+    }
+  }
+  child.kill('SIGKILL');
+}
+
+/** The environment that Utilities gives a Rush command, which is what npm view ran with before it had a deadline. */
+function getRushCommandEnvironment(environment: Readonly<NodeJS.ProcessEnv>): NodeJS.ProcessEnv {
+  const result: NodeJS.ProcessEnv = {};
+  for (const key of Object.getOwnPropertyNames(environment)) {
+    const value: string | undefined = environment[key];
+    if (value === undefined) continue;
+    const normalizedKey: string =
+      process.platform === 'win32' && !/^pnpm_config_\/\//i.test(key) ? key.toUpperCase() : key;
+    if (
+      normalizedKey === 'INIT_CWD' ||
+      /^NPM_CONFIG_/.test(normalizedKey) ||
+      normalizedKey.startsWith('RUSH_DAEMON')
+    ) {
+      continue;
+    }
+    result[normalizedKey] = value;
+  }
+  result[EnvironmentVariableNames._RUSH_RECURSIVE_RUSHX_CALL] = '1';
+  return result;
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index d9f601a9cd..6fde0beb32 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -7,6 +7,7 @@ import * as path from 'node:path';
 
 import { Rush } from '@microsoft/rush-lib';
 import { Utilities } from '@microsoft/rush-lib/lib/utilities/Utilities';
+import { PackageJsonLookup } from '@rushstack/node-core-library';
 import {
   connectOrStartDaemonAsync,
   requestDaemonShutdownAsync,
@@ -19,13 +20,16 @@ import {
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import type { IInstalledDaemonLauncher } from '../DaemonInstallation';
 import {
   selectDaemonLauncherAsync,
+  getDaemonVersionCacheFolder,
   getSelectedDaemonStartCommand,
   DaemonLauncherUnavailableError,
-  type IDaemonLauncherContext
+  type IDaemonLauncherContext,
+  type ISelectDaemonLauncherOptions
 } from '../VersionSelectedDaemonLauncher';
-import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+import { isTestProcessRunning, removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 describe('version-selected daemon launcher', () => {
   let repoRoot: string;
@@ -288,6 +292,505 @@ describe('version-selected daemon launcher', () => {
     240000
   );
 
+  describe('when no cached or published launcher can serve this client', () => {
+    const requestedVersion: string = '5.178.1';
+    const oldProtocol: { major: number; minor: number } = { major: 0, minor: 2 };
+    const dayMs: number = 24 * 60 * 60 * 1000;
+    const hourMs: number = 60 * 60 * 1000;
+    let registryFolder: string;
+    let cacheFolder: string;
+    let verdictPath: string;
+    let requested: IDaemonLauncherContext;
+
+    interface INpmCall {
+      readonly args: string[];
+      readonly pid: number;
+      readonly env: Record<string, string>;
+    }
+
+    interface IVerdictJson {
+      schemaVersion: number;
+      rushVersion: string;
+      client: string;
+      checkedAt: string;
+      expiresAt: string;
+      reason: string;
+      installation?: IInstalledDaemonLauncher;
+      incompatibleInstallations: { folderName: string; markerIdentity: string; installation: unknown }[];
+    }
+
+    function writeFakeDaemon(
+      root: string,
+      daemonVersion: string,
+      protocolVersion: { major: number; minor: number },
+      canLaunchRequests: boolean
+    ): void {
+      const files: Record<string, string> = {
+        '@rushstack/rush-daemon/package.json': JSON.stringify({
+          name: '@rushstack/rush-daemon',
+          version: daemonVersion,
+          main: 'index.js',
+          bin: { rushd: 'bin/rushd.js' }
+        }),
+        '@rushstack/rush-daemon/bin/rushd.js': '',
+        '@rushstack/rush-daemon/index.js': canLaunchRequests
+          ? 'for (const name of ["serveRushDaemonAsync", "ProductionDaemonRequestResolver", "RushDaemonRequestResolver"]) exports[name] = function () {};\n'
+          : '',
+        '@microsoft/rush-lib/package.json': JSON.stringify({
+          name: '@microsoft/rush-lib',
+          version: requestedVersion,
+          main: 'index.js'
+        }),
+        // Only an attestation loads this engine, so the log counts attestations.
+        '@microsoft/rush-lib/index.js':
+          `require('fs').appendFileSync(${JSON.stringify(path.join(registryFolder, 'probes.log'))}, 'probe\\n');\n` +
+          `exports.Rush = { version: ${JSON.stringify(requestedVersion)} };\n` +
+          (canLaunchRequests ? 'exports.resolveDaemonConfiguration = function () {};\n' : ''),
+        '@rushstack/rush-daemon-protocol/package.json': JSON.stringify({
+          name: '@rushstack/rush-daemon-protocol',
+          version: '0.0.0',
+          main: 'index.js'
+        }),
+        '@rushstack/rush-daemon-protocol/index.js': `exports.DAEMON_PROTOCOL_VERSION = ${JSON.stringify(protocolVersion)};\n`
+      };
+      for (const [file, content] of Object.entries(files)) {
+        const filePath: string = path.join(root, 'node_modules', file);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, content);
+      }
+    }
+
+    function writeCachedDaemon(
+      daemonVersion: string,
+      protocolVersion: { major: number; minor: number },
+      canLaunchRequests: boolean
+    ): void {
+      const folder: string = path.join(cacheFolder, `daemon-${daemonVersion}`);
+      writeFakeDaemon(folder, daemonVersion, protocolVersion, canLaunchRequests);
+      fs.writeFileSync(
+        path.join(folder, 'last-install.flag'),
+        JSON.stringify({ node: process.versions.node, daemonVersion })
+      );
+    }
+
+    function publish(versions: Record<string, string>): void {
+      fs.writeFileSync(
+        path.join(registryFolder, 'registry.json'),
+        JSON.stringify({
+          versions: Object.keys(versions),
+          packages: Object.fromEntries(
+            Object.entries(versions).map(([version, rushVersion]) => [
+              version,
+              {
+                name: '@rushstack/rush-daemon',
+                version,
+                dependencies: { '@microsoft/rush-lib': rushVersion },
+                bin: { rushd: 'bin/rushd.js' }
+              }
+            ])
+          )
+        })
+      );
+    }
+
+    function setRegistryMode(mode: 'answer' | 'fail' | 'hang'): void {
+      fs.writeFileSync(path.join(registryFolder, 'mode.txt'), mode);
+    }
+
+    function readNpmCalls(): INpmCall[] {
+      const log: string = path.join(registryFolder, 'calls.log');
+      return fs.existsSync(log)
+        ? fs
+            .readFileSync(log, 'utf8')
+            .split('\n')
+            .filter((line) => line)
+            .map((line) => JSON.parse(line))
+        : [];
+    }
+
+    function countProbes(): number {
+      const log: string = path.join(registryFolder, 'probes.log');
+      return fs.existsSync(log)
+        ? fs
+            .readFileSync(log, 'utf8')
+            .split('\n')
+            .filter((line) => line).length
+        : 0;
+    }
+
+    function readVerdict(): IVerdictJson {
+      return JSON.parse(fs.readFileSync(verdictPath, 'utf8'));
+    }
+
+    function describeNpmCalls(calls: INpmCall[]): string[] {
+      return calls.map((call) => call.args.filter((arg) => !arg.startsWith('--')).join(' '));
+    }
+
+    async function selectFailureAsync(
+      options?: ISelectDaemonLauncherOptions,
+      input: IDaemonLauncherContext = requested
+    ): Promise<DaemonLauncherUnavailableError> {
+      const failure: unknown = await selectDaemonLauncherAsync(input, options).then(
+        () => undefined,
+        (error: unknown) => error
+      );
+      if (!(failure instanceof DaemonLauncherUnavailableError)) {
+        throw new Error(`Expected DaemonLauncherUnavailableError, not ${String(failure)}`);
+      }
+      return failure;
+    }
+
+    function expectedRefusal(daemonVersion: string): string {
+      return (
+        `Cannot launch selected Rush ${requestedVersion}: Daemon ${daemonVersion} attests protocol ` +
+        `${oldProtocol.major}.${oldProtocol.minor}; this client requires ` +
+        `${DAEMON_PROTOCOL_VERSION.major}.${DAEMON_PROTOCOL_VERSION.minor} and default request-launch APIs. ` +
+        'Use native Rush instead.'
+      );
+    }
+
+    beforeEach(() => {
+      registryFolder = path.join(repoRoot, 'registry');
+      const binFolder: string = path.join(repoRoot, 'bin');
+      fs.mkdirSync(binFolder, { recursive: true });
+      fs.mkdirSync(registryFolder, { recursive: true });
+      const npmScript: string = path.join(binFolder, 'npm.js');
+      fs.writeFileSync(
+        npmScript,
+        `'use strict';
+const fs = require('fs');
+const path = require('path');
+const registry = process.env.FAKE_NPM_REGISTRY;
+const args = process.argv.slice(2);
+const env = {};
+for (const name of ['INIT_CWD', 'NPM_CONFIG_FAKE', 'RUSH_DAEMON_FAKE', '_RUSH_RECURSIVE_RUSHX_CALL', 'FAKE_PASS']) {
+  env[name] = process.env[name];
+}
+fs.appendFileSync(path.join(registry, 'calls.log'), JSON.stringify({ args, pid: process.pid, env }) + '\\n');
+const mode = fs.readFileSync(path.join(registry, 'mode.txt'), 'utf8');
+const data = JSON.parse(fs.readFileSync(path.join(registry, 'registry.json'), 'utf8'));
+if (args[0] === 'install') {
+  const version = JSON.parse(fs.readFileSync('package.json', 'utf8')).dependencies['@rushstack/rush-daemon'];
+  fs.cpSync(path.join(registry, 'packages', version), process.cwd(), { recursive: true });
+} else if (mode === 'fail') {
+  process.stderr.write('npm error code E503\\n');
+  process.exitCode = 1;
+} else if (mode === 'hang') {
+  // Like a registry that drops packets: npm neither answers nor exits.
+  fs.writeFileSync(path.join(registry, 'hung.pid'), String(process.pid));
+  setTimeout(() => {}, 120000);
+} else {
+  const at = args[1].lastIndexOf('@');
+  process.stdout.write(JSON.stringify(at > 0 ? data.packages[args[1].slice(at + 1)] : data.versions));
+}
+`
+      );
+      // The launcher must stop npm itself, so the POSIX wrapper replaces its shell with node.
+      fs.writeFileSync(
+        path.join(binFolder, 'npm'),
+        `#!/bin/sh\nexec "${process.execPath}" "${npmScript}" "$@"\n`,
+        { mode: 0o755 }
+      );
+      fs.writeFileSync(path.join(binFolder, 'npm.cmd'), `@"${process.execPath}" "%~dp0npm.js" %*\r\n`);
+      setRegistryMode('answer');
+      publish({ '0.4.1': requestedVersion, '0.5.0': '5.179.0' });
+      writeFakeDaemon(path.join(registryFolder, 'packages', '0.4.1'), '0.4.1', oldProtocol, false);
+      fs.writeFileSync(
+        path.join(repoRoot, 'rush.json'),
+        JSON.stringify({ rushVersion: requestedVersion, pnpmVersion: '10.27.0', projects: [] })
+      );
+      requested = {
+        ...context,
+        rushVersion: requestedVersion,
+        environment: {
+          ...Object.fromEntries(
+            Object.entries(context.environment).filter(([name]) => !/^path$/i.test(name))
+          ),
+          PATH: [binFolder, process.env.PATH ?? process.env.Path].join(path.delimiter),
+          FAKE_NPM_REGISTRY: registryFolder
+        }
+      };
+      cacheFolder = getDaemonVersionCacheFolder(requested.environment);
+      verdictPath = path.join(cacheFolder, `unavailable-${requestedVersion}.json`);
+    });
+
+    it('records why no launcher is usable, and the next selection neither attests nor asks the registry', async () => {
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      expect(first.message).toBe(expectedRefusal('0.4.1'));
+      expect(first.installation).toMatchObject({ daemonVersion: '0.4.1', rushVersion: requestedVersion });
+      expect(describeNpmCalls(readNpmCalls())).toEqual([
+        'view @rushstack/rush-daemon versions',
+        'view @rushstack/rush-daemon@0.5.0',
+        'view @rushstack/rush-daemon@0.4.1',
+        'install'
+      ]);
+      expect(countProbes()).toBe(1);
+      const verdict: IVerdictJson = readVerdict();
+      expect(verdict.client).toBe(
+        `${PackageJsonLookup.loadOwnPackageJson(__dirname).version} protocol ` +
+          `${DAEMON_PROTOCOL_VERSION.major}.${DAEMON_PROTOCOL_VERSION.minor}`
+      );
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(dayMs);
+      expect(verdict.incompatibleInstallations.map((record) => record.folderName)).toEqual(['daemon-0.4.1']);
+
+      for (let attempt: number = 0; attempt < 2; attempt++) {
+        const again: DaemonLauncherUnavailableError = await selectFailureAsync();
+        expect(again.message).toBe(first.message);
+        expect(again.installation).toEqual(first.installation);
+      }
+      expect(readNpmCalls()).toHaveLength(4);
+      expect(countProbes()).toBe(1);
+      expect(readVerdict()).toEqual(verdict);
+    }, 60000);
+
+    it('records that no published release pins the engine', async () => {
+      publish({ '0.5.0': '5.179.0' });
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      expect(first.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: No published daemon release pins that exact Rush engine. Use native Rush instead.`
+      );
+      expect(first.installation).toBeUndefined();
+      expect(readNpmCalls()).toHaveLength(2);
+      const verdict: IVerdictJson = readVerdict();
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(dayMs);
+      expect(verdict.incompatibleInstallations).toEqual([]);
+
+      expect((await selectFailureAsync()).message).toBe(first.message);
+      expect(readNpmCalls()).toHaveLength(2);
+    }, 60000);
+
+    it('records no verdict when the installer fails, so the next selection asks the registry again', async () => {
+      // The registry lists 0.4.1 but cannot deliver it, so every npm install attempt fails.
+      fs.rmSync(path.join(registryFolder, 'packages', '0.4.1'), { recursive: true });
+      const lookup: string[] = [
+        'view @rushstack/rush-daemon versions',
+        'view @rushstack/rush-daemon@0.5.0',
+        'view @rushstack/rush-daemon@0.4.1'
+      ];
+      let callsBefore: number = 0;
+      for (let attempt: number = 0; attempt < 2; attempt++) {
+        const failure: unknown = await selectDaemonLauncherAsync(requested).then(
+          () => undefined,
+          (error: unknown) => error
+        );
+        expect(failure).toBeInstanceOf(Error);
+        expect(failure).not.toBeInstanceOf(DaemonLauncherUnavailableError);
+        expect((failure as Error).message).toBe('Installing @rushstack/rush-daemon@0.4.1 failed (1).');
+        expect(fs.existsSync(verdictPath)).toBe(false);
+        // Each selection asks the registry again. The installer decides how many times it tries.
+        const calls: string[] = describeNpmCalls(readNpmCalls()).slice(callsBefore);
+        expect(calls.slice(0, lookup.length)).toEqual(lookup);
+        expect(new Set(calls.slice(lookup.length))).toEqual(new Set(['install']));
+        callsBefore += calls.length;
+      }
+      expect(countProbes()).toBe(0);
+    }, 60000);
+
+    it('keeps a failed registry lookup for an hour', async () => {
+      setRegistryMode('fail');
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      expect(first.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: Registry lookup for @rushstack/rush-daemon failed: npm error code E503\n Use native Rush instead.`
+      );
+      const verdict: IVerdictJson = readVerdict();
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(hourMs);
+
+      setRegistryMode('answer');
+      expect((await selectFailureAsync()).message).toBe(first.message);
+      expect(readNpmCalls()).toHaveLength(1);
+    }, 60000);
+
+    it('ends a registry lookup at its deadline, then keeps that failure for an hour', async () => {
+      setRegistryMode('hang');
+      const started: number = Date.now();
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync({ registryTimeoutMs: 1000 });
+      expect(Date.now() - started).toBeLessThan(20000);
+      expect(first.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: Registry lookup for @rushstack/rush-daemon did not finish within 1 s. Use native Rush instead.`
+      );
+      const npmPid: number = Number(fs.readFileSync(path.join(registryFolder, 'hung.pid'), 'utf8'));
+      expect(readNpmCalls().map((call) => call.pid)).toEqual([npmPid]);
+      expect(isTestProcessRunning(npmPid)).toBe(false);
+      const verdict: IVerdictJson = readVerdict();
+      expect(Date.parse(verdict.expiresAt) - Date.parse(verdict.checkedAt)).toBe(hourMs);
+
+      expect((await selectFailureAsync({ registryTimeoutMs: 1000 })).message).toBe(first.message);
+      expect(readNpmCalls()).toHaveLength(1);
+    }, 60000);
+
+    it('reports a missing npm as a failed registry lookup', async () => {
+      const emptyFolder: string = path.join(repoRoot, 'empty-bin');
+      fs.mkdirSync(emptyFolder);
+      const failure: DaemonLauncherUnavailableError = await selectFailureAsync(undefined, {
+        ...requested,
+        environment: { ...requested.environment, PATH: emptyFolder }
+      });
+      expect(failure.message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: Registry lookup for @rushstack/rush-daemon failed: The executable file was not found: "npm" Use native Rush instead.`
+      );
+      expect(Date.parse(readVerdict().expiresAt) - Date.parse(readVerdict().checkedAt)).toBe(hourMs);
+    }, 60000);
+
+    it('gives npm the environment that Rush gives its commands', async () => {
+      await selectFailureAsync(undefined, {
+        ...requested,
+        environment: {
+          ...requested.environment,
+          INIT_CWD: repoRoot,
+          NPM_CONFIG_FAKE: 'dropped',
+          RUSH_DAEMON_FAKE: 'dropped',
+          FAKE_PASS: 'kept'
+        }
+      });
+      const views: INpmCall[] = readNpmCalls().filter((call) => call.args[0] === 'view');
+      expect(views).toHaveLength(3);
+      for (const call of views) {
+        expect(call.env).toEqual({ _RUSH_RECURSIVE_RUSHX_CALL: '1', FAKE_PASS: 'kept' });
+      }
+    }, 60000);
+
+    it.each<[string, (verdict: IVerdictJson) => IVerdictJson | string]>([
+      ['has expired', (verdict) => ({ ...verdict, expiresAt: new Date(Date.now() - 1000).toISOString() })],
+      [
+        'was reached at a later clock time',
+        (verdict) => ({
+          ...verdict,
+          checkedAt: new Date(Date.now() + hourMs).toISOString(),
+          expiresAt: new Date(Date.now() + 2 * hourMs).toISOString()
+        })
+      ],
+      ['belongs to another client', (verdict) => ({ ...verdict, client: `${verdict.client}-other` })],
+      ['belongs to another engine', (verdict) => ({ ...verdict, rushVersion: '5.179.0' })],
+      ['has another schema', (verdict) => ({ ...verdict, schemaVersion: verdict.schemaVersion + 1 })],
+      ['is not JSON', () => '{'],
+      ['gives no reason', (verdict) => JSON.stringify({ ...verdict, reason: undefined })],
+      [
+        'records a malformed attestation',
+        (verdict) => ({
+          ...verdict,
+          incompatibleInstallations: verdict.incompatibleInstallations.map((record) => ({
+            ...record,
+            installation: {}
+          }))
+        })
+      ],
+      [
+        'records a launcher that would serve this client',
+        (verdict) => ({
+          ...verdict,
+          incompatibleInstallations: verdict.incompatibleInstallations.map((record) => ({
+            ...record,
+            installation: {
+              ...(record.installation as IInstalledDaemonLauncher),
+              protocolVersion: DAEMON_PROTOCOL_VERSION,
+              canLaunchRequests: true
+            }
+          }))
+        })
+      ]
+    ])(
+      'checks again when the verdict %s',
+      async (name, change) => {
+        const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+        const changed: IVerdictJson | string = change(readVerdict());
+        fs.writeFileSync(verdictPath, typeof changed === 'string' ? changed : JSON.stringify(changed));
+        const probes: number = countProbes();
+
+        expect((await selectFailureAsync()).message).toBe(first.message);
+        expect(describeNpmCalls(readNpmCalls().slice(4))).toEqual([
+          'view @rushstack/rush-daemon versions',
+          'view @rushstack/rush-daemon@0.5.0',
+          'view @rushstack/rush-daemon@0.4.1'
+        ]);
+        expect(countProbes()).toBe(probes + 2);
+        const rewritten: IVerdictJson = readVerdict();
+        expect(Date.parse(rewritten.expiresAt) - Date.parse(rewritten.checkedAt)).toBe(dayMs);
+        expect(Date.parse(rewritten.checkedAt)).toBeLessThanOrEqual(Date.now());
+      },
+      60000
+    );
+
+    it.each<[string, () => void, number]>([
+      [
+        'an installation is reinstalled',
+        () => {
+          const marker: string = path.join(cacheFolder, 'daemon-0.4.1', 'last-install.flag');
+          const content: string = fs.readFileSync(marker, 'utf8');
+          fs.rmSync(marker);
+          fs.writeFileSync(marker, content);
+          fs.utimesSync(marker, new Date(2000, 0, 1), new Date(2000, 0, 1));
+        },
+        2
+      ],
+      ['another installation pins the engine', () => writeCachedDaemon('0.4.0', oldProtocol, false), 2],
+      [
+        'an installation is removed',
+        () => fs.rmSync(path.join(cacheFolder, 'daemon-0.4.1'), { recursive: true }),
+        1
+      ]
+    ])(
+      'checks again when %s',
+      async (name, change, newProbes) => {
+        const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+        change();
+        const probes: number = countProbes();
+        expect((await selectFailureAsync()).message).toBe(first.message);
+        // A changed installation is attested again rather than trusted from the verdict.
+        expect(countProbes()).toBe(probes + newProbes);
+        expect(describeNpmCalls(readNpmCalls().slice(4)).slice(0, 3)).toEqual([
+          'view @rushstack/rush-daemon versions',
+          'view @rushstack/rush-daemon@0.5.0',
+          'view @rushstack/rush-daemon@0.4.1'
+        ]);
+        const callsAfterRecheck: number = readNpmCalls().length;
+        expect((await selectFailureAsync()).message).toBe(first.message);
+        expect(readNpmCalls()).toHaveLength(callsAfterRecheck);
+      },
+      60000
+    );
+
+    it('still launches a usable installation that appears while a verdict stands', async () => {
+      await selectFailureAsync();
+      writeCachedDaemon('0.6.0', DAEMON_PROTOCOL_VERSION, true);
+      const selected = await selectDaemonLauncherAsync(requested);
+      expect(selected).toMatchObject({ daemonVersion: '0.6.0', rushVersion: requestedVersion });
+      expect(readNpmCalls()).toHaveLength(4);
+    }, 60000);
+
+    it('selects among cached installations as before when it may not install', async () => {
+      const first: DaemonLauncherUnavailableError = await selectFailureAsync();
+      const probes: number = countProbes();
+      const cachedOnly: DaemonLauncherUnavailableError = await selectFailureAsync({ allowInstall: false });
+      expect(cachedOnly.message).toBe(first.message);
+      expect(cachedOnly.installation).toEqual(first.installation);
+      expect(countProbes()).toBe(probes + 1);
+
+      fs.rmSync(cacheFolder, { recursive: true });
+      expect((await selectFailureAsync({ allowInstall: false })).message).toBe(
+        `Cannot launch selected Rush ${requestedVersion}: No matching installed daemon launcher is available. Use native Rush instead.`
+      );
+      expect(fs.existsSync(verdictPath)).toBe(false);
+      expect(readNpmCalls()).toHaveLength(4);
+    }, 60000);
+
+    it('gives the cached outcome, not a verdict, when it may not install', async () => {
+      await selectFailureAsync();
+      fs.rmSync(verdictPath);
+      setRegistryMode('fail');
+      const failed: DaemonLauncherUnavailableError = await selectFailureAsync();
+      const verdict: IVerdictJson = readVerdict();
+      expect(verdict.reason).toBe(failed.reason);
+      expect(verdict.incompatibleInstallations.map((record) => record.folderName)).toEqual(['daemon-0.4.1']);
+      const probes: number = countProbes();
+
+      const cachedOnly: DaemonLauncherUnavailableError = await selectFailureAsync({ allowInstall: false });
+      expect(cachedOnly.message).toBe(expectedRefusal('0.4.1'));
+      expect(countProbes()).toBe(probes + 1);
+      expect(readNpmCalls()).toHaveLength(5);
+      expect(readVerdict()).toEqual(verdict);
+    }, 60000);
+  });
+
   it.each(['latest', '../escape', '^5.178.1'])('rejects non-exact Rush specifier %s', async (rushVersion) => {
     await expect(selectDaemonLauncherAsync({ ...context, rushVersion })).rejects.toThrow('exact');
   });

From 2aed82dbaf03660024479b0645d3c91d8bfb9e22 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:07 +0000
Subject: [PATCH 205/265] [rush-daemon] Expect only the live-owner message in
 NativeMutationCleanupFailure (69(b), r01's V6 NIT)

Swarm integration step 190; original commit cd5bf15ec1 (merge of swarm/r04-t69b-nit6-e2f at b728c792cc).
Scope: task 69(b), NIT 6.

Brings 69b-nit6 (branch swarm/r04-t69b-nit6-e2f). Second agent: r01 board 6312, r02 board 6351. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 7 of 15. Gate: ch01 GATE OK board 6977 (tree 71453abc20)

Commits folded into this step (1):
- b728c792cc Expect only the live-owner message in NativeMutationCleanupFailure (69(b), r01's V6 NIT)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../swarm-r04-t69b-nit6_2026-09-29-17-20.json         | 11 +++++++++++
 .../src/test/NativeMutationCleanupFailure.test.ts     |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t69b-nit6_2026-09-29-17-20.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t69b-nit6_2026-09-29-17-20.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t69b-nit6_2026-09-29-17-20.json
new file mode 100644
index 0000000000..cad03e83fd
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t69b-nit6_2026-09-29-17-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A test now expects only the client's message for a live process that owns the daemon's files but does not answer, so it fails if the client skips its owner check.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
index 5a2a2b2503..ea6360e3d1 100644
--- a/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
+++ b/libraries/rush-daemon/src/test/NativeMutationCleanupFailure.test.ts
@@ -131,6 +131,7 @@ jest.setTimeout(30_000);
       expect(fixture.runs()).toEqual([]);
 
       const marker: string = path.join(fixture.folder, 'unexpected-starter');
+      // The retained owner is alive, so a deadline error here would mean that the client skipped its owner check.
       await expect(
         connectOrStartDaemonAsync({
           paths: fixture.host.paths,
@@ -143,7 +144,7 @@ jest.setTimeout(30_000);
             environment: fixture.environment
           }
         })
-      ).rejects.toThrow(/did not answer|deadline/);
+      ).rejects.toThrow(`did not answer at ${fixture.host.paths.socketPath}`);
       expect(fs.existsSync(marker)).toBe(false);
       expect(readDaemonLockfile(fixture.host.paths.lockfilePath)).toEqual(originalOwner);
       expect(

From ba5524bf73c459eb9a3030497e6b9547ac052a8b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:08 +0000
Subject: [PATCH 206/265] [rush-cli-client] Give the parser's lock-wait tests
 their own timeout and attempt cap

Swarm integration step 191; original commit bae1e98076 (merge of swarm/o04-t245-nit2 at 10f1b94a5d).
Scope: task 245, NIT 2.

Brings 245-nit2 (branch swarm/o04-t245-nit2). Second agent: r04 board 6738, board 6739. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 8 of 15. Gate: ch01 GATE OK board 6977 (tree 25f63bd371)

Commits folded into this step (2):
- bcee03a5a9 Format the lock-wait lines that Prettier 3.6.2 would rewrap
- 10f1b94a5d Give the parser's lock-wait tests their own timeout and attempt cap

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/src/launchClient.ts      |  3 +--
 .../src/test/inProcessLockWait.test.ts        | 21 +++++++++++++++----
 ...y-lock-wait-prettier_2026-09-29-17-57.json | 11 ++++++++++
 ...y-lock-wait-test-cap_2026-09-29-15-40.json |  2 +-
 ...y-lock-wait-prettier_2026-09-29-17-57.json | 11 ++++++++++
 .../cli/test/RushCommandLineParser.test.ts    | 19 +++++++++++------
 .../src/logic/test/RepositoryLockWait.test.ts | 11 ++++++++--
 7 files changed, 63 insertions(+), 15 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/repository-lock-wait-prettier_2026-09-29-17-57.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/repository-lock-wait-prettier_2026-09-29-17-57.json

diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 834283dc35..1697f811fa 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -404,8 +404,7 @@ export async function launchClientAsync(
     await launchInProcessAsync(route.nativeArgv, rushx, selectedVersion, rushJsonPath, {
       startedAtMs: requestStartedAtMs,
       admission: request.admission,
-      daemonPid:
-        restarts.length > 0 ? restarts[restarts.length - 1].successorPid : (await client.status).pid
+      daemonPid: restarts.length > 0 ? restarts[restarts.length - 1].successorPid : (await client.status).pid
     });
   }
 }
diff --git a/apps/rush-cli-client/src/test/inProcessLockWait.test.ts b/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
index c56b4932b3..55d231640a 100644
--- a/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
+++ b/apps/rush-cli-client/src/test/inProcessLockWait.test.ts
@@ -56,7 +56,11 @@ describe(getInProcessLockWaitDeadlineMs.name, () => {
       })
     ).toBe(31000);
     expect(
-      getInProcessLockWaitDeadlineMs({ startedAtMs: 1000, admission: { waitTimeoutMs: 60500 }, daemonPid: 42 })
+      getInProcessLockWaitDeadlineMs({
+        startedAtMs: 1000,
+        admission: { waitTimeoutMs: 60500 },
+        daemonPid: 42
+      })
     ).toBe(61500);
   });
 
@@ -70,13 +74,21 @@ describe(getInProcessLockWaitDeadlineMs.name, () => {
 describe(setInProcessLockWait.name, () => {
   it('sets the deadline and the daemon PID', () => {
     const environment: NodeJS.ProcessEnv = { PATH: '/bin' };
-    setInProcessLockWait(environment, { startedAtMs: 1000, admission: { waitTimeoutMs: 5000 }, daemonPid: 42 });
+    setInProcessLockWait(environment, {
+      startedAtMs: 1000,
+      admission: { waitTimeoutMs: 5000 },
+      daemonPid: 42
+    });
     expect(environment).toEqual({ PATH: '/bin', [DEADLINE]: '6000', [DAEMON_PID]: '42' });
   });
 
   it('removes a daemon PID that no daemon handed over', () => {
     const environment: NodeJS.ProcessEnv = { [DAEMON_PID]: '7' };
-    setInProcessLockWait(environment, { startedAtMs: 1000, admission: { noWait: true }, daemonPid: undefined });
+    setInProcessLockWait(environment, {
+      startedAtMs: 1000,
+      admission: { noWait: true },
+      daemonPid: undefined
+    });
     expect(environment).toEqual({ [DEADLINE]: '1000' });
   });
 });
@@ -134,7 +146,8 @@ describe('rush-client asks in-process Rush to wait for the repository lock after
     now = jest.spyOn(Date, 'now').mockReturnValue(SENT_AT_MS);
     process.argv = [process.execPath, 'rush-client', 'build', '--to', 'project'];
     process.env = { ...originalEnvironment, CI: 'false', RUSH_DAEMON: '1', RUSH_REPORTER: 'legacy' };
-    for (const name of ['RUSH_LOG_LEVEL', 'RUSH_PREVIEW_VERSION', DEADLINE, DAEMON_PID]) delete process.env[name];
+    for (const name of ['RUSH_LOG_LEVEL', 'RUSH_PREVIEW_VERSION', DEADLINE, DAEMON_PID])
+      delete process.env[name];
   });
 
   afterEach(() => {
diff --git a/common/changes/@microsoft/rush/repository-lock-wait-prettier_2026-09-29-17-57.json b/common/changes/@microsoft/rush/repository-lock-wait-prettier_2026-09-29-17-57.json
new file mode 100644
index 0000000000..2aa183280b
--- /dev/null
+++ b/common/changes/@microsoft/rush/repository-lock-wait-prettier_2026-09-29-17-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Format the repository lock wait tests with Prettier.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json b/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json
index 41fa6e17d4..08d49e2635 100644
--- a/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json
+++ b/common/changes/@microsoft/rush/repository-lock-wait-test-cap_2026-09-29-15-40.json
@@ -2,7 +2,7 @@
   "changes": [
     {
       "packageName": "@microsoft/rush",
-      "comment": "",
+      "comment": "Make the repository lock wait tests fail, not hang, when a wait never ends.",
       "type": "none"
     }
   ],
diff --git a/common/changes/@rushstack/rush-cli-client/repository-lock-wait-prettier_2026-09-29-17-57.json b/common/changes/@rushstack/rush-cli-client/repository-lock-wait-prettier_2026-09-29-17-57.json
new file mode 100644
index 0000000000..deaa87527b
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/repository-lock-wait-prettier_2026-09-29-17-57.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Format the in-process lock wait and its test with Prettier.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
index 8fc01c5070..db15266114 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParser.test.ts
@@ -297,15 +297,22 @@ describe('RushCommandLineParser', () => {
           }
         });
 
+        // The file's default timeout is about 17 minutes, so each lock-wait test, which takes a few seconds, sets
+        // its own: a wait that never ends then fails the test in a minute.
         it('waits for the lock until the deadline that rush-client set, and names the daemon that holds it', async () => {
           const daemonPid: number = process.pid + 1;
           const deadlineMs: number = Date.now() + 60000;
           process.env._RUSH_LOCK_WAIT_DEADLINE = `${deadlineMs}`;
           process.env._RUSH_LOCK_WAIT_DAEMON_PID = `${daemonPid}`;
           const reporterSink: CapturingReporterSink = new CapturingReporterSink();
+          let attempts: number = 0;
           const lockSpy: jest.SpiedFunction<typeof LockFile.tryAcquire> = jest
             .spyOn(LockFile, 'tryAcquire')
-            .mockReturnValue(undefined);
+            .mockImplementation(() => {
+              // The wait below tries every 100 ms for 300 ms. One that never stopped would outlive this test.
+              if (++attempts > 100) throw new Error(`tryAcquire was called ${attempts} times`);
+              return undefined;
+            });
           const exitSpy: jest.SpiedFunction<typeof process.exit> = jest
             .spyOn(process, 'exit')
             .mockImplementation(() => undefined as never);
@@ -339,9 +346,9 @@ describe('RushCommandLineParser', () => {
             await new Promise<void>((resolve: () => void) => setImmediate(resolve));
 
             expect(Date.now()).toBeGreaterThanOrEqual(shortDeadlineMs);
-            expect(lockSpy.mock.calls.filter(([, resourceName]) => resourceName === 'rush').length).toBeGreaterThan(
-              1
-            );
+            expect(
+              lockSpy.mock.calls.filter(([, resourceName]) => resourceName === 'rush').length
+            ).toBeGreaterThan(1);
             const messages: unknown[] = reporterSink.inputs
               .filter(({ type }) => type === 'messageEmitted')
               .map(({ payload }) => payload);
@@ -368,7 +375,7 @@ describe('RushCommandLineParser', () => {
             exitSpy.mockRestore();
             lockSpy.mockRestore();
           }
-        });
+        }, 60000);
 
         it('runs the command once the lock is released before the deadline that rush-client set', async () => {
           process.env._RUSH_LOCK_WAIT_DEADLINE = `${Date.now() + 60000}`;
@@ -413,7 +420,7 @@ describe('RushCommandLineParser', () => {
             exitSpy.mockRestore();
             lockSpy.mockRestore();
           }
-        });
+        }, 60000);
 
         it('leaves the wait that rush-client set alone in an engine host, whose environment is not the request', async () => {
           process.env._RUSH_LOCK_WAIT_DEADLINE = '1000';
diff --git a/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts b/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
index 21a030b67d..2ecce772c6 100644
--- a/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
+++ b/libraries/rush-lib/src/logic/test/RepositoryLockWait.test.ts
@@ -43,7 +43,11 @@ describe(consumeRepositoryLockWait.name, () => {
   });
 
   it('reads the deadline and the daemon PID, and removes both variables', () => {
-    const environment: NodeJS.ProcessEnv = { PATH: '/bin', [DEADLINE]: '1700000030000', [DAEMON_PID]: '4242' };
+    const environment: NodeJS.ProcessEnv = {
+      PATH: '/bin',
+      [DEADLINE]: '1700000030000',
+      [DAEMON_PID]: '4242'
+    };
     expect(consumeRepositoryLockWait(environment)).toEqual({ deadlineMs: 1700000030000, daemonPid: 4242 });
     expect(environment).toEqual({ PATH: '/bin' });
   });
@@ -191,7 +195,10 @@ describe(acquireRepositoryLockAsync.name, () => {
   });
 
   it('waits until the holder releases the lock', async () => {
-    const { result, attempts, sleeps, warnings } = await acquireAsync({ deadlineMs: 30000, daemonPid: DAEMON }, 3);
+    const { result, attempts, sleeps, warnings } = await acquireAsync(
+      { deadlineMs: 30000, daemonPid: DAEMON },
+      3
+    );
     expect(result).toEqual({ lock: HELD_LOCK });
     expect(attempts).toBe(4);
     expect(sleeps).toEqual([100, 100, 100]);

From f22fb1791652c037c0b9606823e3f5e0b6379f3d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:08 +0000
Subject: [PATCH 207/265] [rush-client-core] Wait 1 s, not 5, for an exited
 daemon to be reaped, and say the 15 s wait beside it

Swarm integration step 192; original commit 5e2426928b (merge of swarm/r04-t297-e2f at bf10278489).
Refs: task 297, item 2.
Scope: task 297.

Brings 297 (branch swarm/r04-t297-e2f). Second agent: r02 board 6476. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 9 of 15. Gate: ch01 GATE OK board 6977 (tree 9e0fc767bc)

Commits folded into this step (5):
- f4f37dc46b Stop waiting for a stopped daemon to exit in `daemon stop` (task 297, item 4)
- 30390aa788 Say that each command waits 15 s beside a live owner that is not proven (task 297, item 1)
- c8b0aabcf9 Put "Rush was not run in-process" on a line of its own beside a live daemon owner (task 297, item 3)
- 80143129d9 Say when the Rush process that holds the repository lock is stopped (task 297, item 5)
- bf10278489 Wait 1 s, not 5, for an exited daemon to be reaped, and say the 15 s wait beside it (task 297, item 2)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                | 29 ++++++++---
 apps/rush-cli-client/src/daemonCommands.ts    | 10 +++-
 .../src/test/AgentProgressRenderer.test.ts    | 19 +++++++
 .../src/test/daemonLiveOwner.test.ts          | 27 +++++++++-
 ...04-t297-not-run-line_2026-09-29-16-30.json | 11 ++++
 ...t297-owner-wait-hint_2026-09-29-16-20.json | 11 ++++
 ...m-r04-t297-reap-wait_2026-09-29-16-50.json | 11 ++++
 ...7-stop-stopped-owner_2026-09-29-16-10.json | 11 ++++
 ...-stopped-lock-holder_2026-09-29-16-45.json | 11 ++++
 ...04-t297-not-run-line_2026-09-29-16-30.json | 11 ++++
 ...t297-owner-wait-hint_2026-09-29-16-20.json | 11 ++++
 ...m-r04-t297-reap-wait_2026-09-29-16-50.json | 11 ++++
 ...7-stop-stopped-owner_2026-09-29-16-10.json | 11 ++++
 ...-stopped-lock-holder_2026-09-29-16-45.json | 11 ++++
 common/reviews/api/rush-client-core.api.md    |  3 ++
 libraries/rush-client-core/README.md          | 23 ++++++---
 .../src/DaemonOwnerDiagnosis.ts               | 31 ++++++++++--
 .../src/ExitedDaemonReclaim.ts                | 28 +++++++----
 .../rush-client-core/src/NativeLockHolder.ts  | 12 +++--
 .../src/StoppedDaemonOwner.ts                 | 13 +++++
 .../src/connectOrAwaitDaemonStartup.ts        | 11 ++--
 libraries/rush-client-core/src/index.ts       |  1 +
 .../src/test/DaemonDisconnect.test.ts         |  3 +-
 .../src/test/DaemonOwnerDiagnosis.test.ts     | 10 ++--
 .../src/test/ExitedDaemonReclaim.test.ts      | 20 +++++++-
 .../src/test/NativeLockHolder.test.ts         | 50 ++++++++++++++++++-
 .../connectOrStartDaemonLiveOwner.test.ts     | 37 ++++++++++----
 27 files changed, 384 insertions(+), 53 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t297-not-run-line_2026-09-29-16-30.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t297-reap-wait_2026-09-29-16-50.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t297-not-run-line_2026-09-29-16-30.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t297-reap-wait_2026-09-29-16-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 019a8954be..bdd8a0fe8d 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -75,16 +75,21 @@ as the progress phase, and on a pipe writes it as a progress line that ends with
 gives the startup error with its `--no-daemon` hint, then the process that is still live, "so Rush was
 not run in-process", and a pointer to `rush-client daemon status`. When the process that the daemon's
 ownership record names still runs but does not answer (on Linux, for example because a signal stopped
-it), the message instead says what that process is doing and that Rush was not run in-process, and its
-last line says what to do, for example `Resume it with "kill -CONT <pid>"; it then serves the next
-command.` On Linux, when that process has this workspace's ownership record open, as the daemon that
+it), the message instead says what that process is doing, then on a line of its own that Rush was not
+run in-process, and its last line says what to do, for example `Resume it with "kill -CONT <pid>"; it
+then serves the next command.` On Linux, when that process has this workspace's ownership record open, as the daemon that
 wrote it does, and stays stopped (state T or t) while the client samples it for 1.5 s, the command does
 not wait for either deadline: it exits with code 1 and that message once the 1.5 s have passed. It names
 a signal to send only to a Rush daemon that has that record open; for any other process it says to end
-that process if it is this workspace's daemon, and else to delete the ownership record. Such a Rush
+that process if it is this workspace's daemon, and else to delete the ownership record, and that until
+then each command that uses the daemon first waits 15 s for a daemon to answer. Such a Rush
 daemon that still runs after its socket file was deleted also fails the command this way, with code 1
 and without running Rush in-process, once the client has waited 15 seconds for it to exit; its last line
-says that it may exit once its running requests finish.
+says that it may exit once its running requests finish. When the process that the ownership record names
+has exited but is not reaped yet (on Linux, state Z), nothing live can make the daemon ready, so the
+command runs Rush in-process once its startup deadline (15 s) has passed. The last line of its message
+names the parent that has not reaped that process, and says that until then each command that uses the
+daemon first waits 15 s for a daemon to answer.
 
 When the client runs Rush in-process after it tried the daemon, because it could not reach one or because the
 daemon handed the request back, and another Rush process holds the repository's lock, such as the daemon while it
@@ -145,7 +150,10 @@ length of time. Stderr, on a terminal and on a pipe, names the process at once
 (`rush-client: waiting for another Rush process (PID 12345: rush install) to release
 this repository's lock.`), and again with the time waited every 10 seconds
 (`still waiting after 10s for …`); agent output shows it as the progress phase. Only
-Linux tells the PID and command; elsewhere the line says `another Rush process`.
+Linux tells the PID and command; elsewhere the line says `another Rush process`. On
+Linux, the name also says when that process is stopped, since it cannot release the
+lock until something resumes it (`another Rush process (PID 12345: rush install; it is
+stopped (state T), for example by SIGSTOP)`).
 `--no-wait` and `--wait-timeout 0` fail at once, and the admission failure line of
 these and of a timeout names the process. A request never waits for a lock that the
 daemon itself holds for another request: it fails at once, as before.
@@ -406,7 +414,9 @@ ownership record and socket, as the next daemon start would, so a rerun, with or
 `--no-daemon`, does not race them.
 Rush run in-process, with `--no-daemon` or as a fallback, first does the same when the ownership
 record names a daemon that no longer runs, for example when the client that ran the command was
-killed along with the daemon. Each of these reclaims, and the ones that `daemon start`, an automatic
+killed along with the daemon. On Linux that includes a daemon that has exited but is not reaped yet:
+the client waits up to 1 second for it to be reaped, and else runs Rush without the reclaim, which a
+later command does once the daemon's parent reaps it. Each of these reclaims, and the ones that `daemon start`, an automatic
 start and `daemon stop --force` do, prints one line that says what it stopped, for example:
 
 ```
@@ -627,7 +637,10 @@ When nothing listens but the ownership record names a process that still runs, f
 that removed its socket while it shuts down, stop first waits up to 15 seconds for that process to exit,
 and says so on stderr once it has waited a second. If it still runs then, stop exits with code 1 and
 says what that process is doing and what to do about it; a daemon that accepts the connection but does
-not complete hello/ping gets the same diagnostic.
+not complete hello/ping gets the same diagnostic. On Linux, stop does not wait for a Rush daemon that
+has this workspace's ownership record open and stays stopped (state T or t) while stop samples it for
+1.5 s, because it cannot exit before something resumes it: stop exits with code 1 and that diagnostic
+once the 1.5 s have passed.
 While a daemon is still starting (its startup helper still runs, or another client holds the start
 mutex), stop says so on stderr and waits up to 15 seconds for that daemon to become ready, then stops
 it as below; reporting `notRunning` would leave it running afterwards. If it is still not ready by then,
diff --git a/apps/rush-cli-client/src/daemonCommands.ts b/apps/rush-cli-client/src/daemonCommands.ts
index 8ce8618a48..2d7afc8792 100644
--- a/apps/rush-cli-client/src/daemonCommands.ts
+++ b/apps/rush-cli-client/src/daemonCommands.ts
@@ -14,6 +14,7 @@ import {
   describeLiveDaemonOwner,
   findReclaimedDaemonPid,
   inspectDaemonStartupReservation,
+  isDaemonOwnerStoppedAsync,
   requestDaemonShutdownAsync,
   resetDaemonArtifactsAsync,
   resolveDaemonStartupReservationAsync,
@@ -250,13 +251,20 @@ async function connectExistingAsync(
 /**
  * A daemon that no longer listens but still runs is shutting down, lost its socket, or is not running at all
  * (a signal stopped it, for example). Stop waits for it to exit, and says what it is doing when it does not:
- * reporting notRunning would leave it running.
+ * reporting notRunning would leave it running. It does not wait for this workspace's daemon while a signal or a
+ * tracer keeps it stopped, because it cannot exit before something resumes it.
  */
 async function waitForUnreachableDaemonExitAsync(paths: IDaemonPaths): Promise<void> {
   const deadline: number = Date.now() + STOP_EXIT_WAIT_MS;
   let noticed: boolean = false;
   let owner: string | undefined = describeLiveDaemonOwner(paths, 'stop');
   while (owner !== undefined) {
+    if (await isDaemonOwnerStoppedAsync(paths, deadline)) {
+      // The sampling took 1.5 s: say what the process is doing now.
+      owner = describeLiveDaemonOwner(paths, 'stop');
+      if (owner === undefined) return;
+      throw new Error(`Nothing listens at ${paths.socketPath}, but ${owner}`);
+    }
     const remainingMs: number = deadline - Date.now();
     if (remainingMs <= 0) throw new Error(`Nothing listens at ${paths.socketPath}, but ${owner}`);
     if (!noticed && remainingMs <= STOP_EXIT_WAIT_MS - STOP_EXIT_NOTICE_MS) {
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 8d416a005e..2518bc3dda 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -442,6 +442,25 @@ describe(AgentProgressRenderer.name, () => {
     expect(output).toEqual(['  second line\nrush build: FAILURE in 0.0s · first line\n']);
   });
 
+  it('keeps the age of a daemon that did not answer, and that Rush was not run in-process, whole', () => {
+    // As the client words it for a stopped daemon, with a socket path as long as a Unix socket path can be.
+    const socketPath: string = `/${'s'.repeat(100)}.sock`;
+    const description: string =
+      `The daemon, rushd (PID 4194304), did not answer at ${socketPath}: it is stopped (state T), ` +
+      'for example by SIGSTOP, and it started 59 min ago.';
+    const notRun: string =
+      'Rush was not run in-process, where it would compete with that daemon for the repository.';
+    const hint: string = 'Resume it with "kill -CONT 4194304"; it then serves the next command.';
+    const { renderer, output } = createRenderer(false);
+    expect(renderer.finish({ exitCode: 1, errorMessage: [description, notRun, hint].join('\n') })).toBe(true);
+    expect(output.join('').split('\n')).toEqual([
+      `  ${notRun}`,
+      `  ${hint}`,
+      `rush build: FAILURE in 0.0s · ${description}`,
+      ''
+    ]);
+  });
+
   it('elides the middle of an error message with thousands of lines and keeps its last lines', () => {
     const { renderer, output } = createRenderer(false);
     const diagnostics: string[] = Array.from({ length: 1745 }, (unused, index) => `debug line ${index}`);
diff --git a/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts b/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
index 95b56d34db..68439a4159 100644
--- a/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
+++ b/apps/rush-cli-client/src/test/daemonLiveOwner.test.ts
@@ -209,7 +209,7 @@ const FAKE_DAEMON_SCRIPT: string = [
         )
       );
       expect(status?.message.split('\n')[1]).toBe(
-        `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon.`
+        `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
       );
       expect(readState(pid)).toBe('T');
       expect(stdout).toEqual([]);
@@ -253,5 +253,30 @@ const FAKE_DAEMON_SCRIPT: string = [
       expect(stderr).toHaveLength(1);
       expect(stdout).toEqual([]);
     }, 30000);
+
+    it('fails stop without waiting 15 s when a daemon that no longer listens stays stopped', async () => {
+      const pid: number = await startFakeDaemonAsync();
+      fs.unlinkSync(paths.socketPath);
+      await stopChildAsync(pid);
+      const started: number = Date.now();
+
+      const error: Error | undefined = await runAsync('stop');
+
+      // It samples the stopped daemon for 1.5 s, which cannot exit before something resumes it.
+      expect(Date.now() - started).toBeGreaterThanOrEqual(1500);
+      expect(Date.now() - started).toBeLessThan(5000);
+      expect(error?.message).toMatch(
+        new RegExp(
+          `^Nothing listens at ${escapeRegExp(paths.socketPath)}, but rushd \\(PID ${pid}\\) still owns ${escapeRegExp(paths.lockfilePath)}: its socket is missing, so no client can reach it; it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n`
+        )
+      );
+      expect(error?.message.split('\n')[1]).toBe(
+        `Run "kill ${pid}", then "kill -CONT ${pid}": it then cancels its running requests and exits, and the next command starts a new daemon.`
+      );
+      // It printed no line that says that it waits for the daemon to exit.
+      expect(stderr).toEqual([]);
+      expect(stdout).toEqual([]);
+      expect(readState(pid)).toBe('T');
+    }, 30000);
   }
 );
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-not-run-line_2026-09-29-16-30.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-not-run-line_2026-09-29-16-30.json
new file mode 100644
index 0000000000..22e4d0f2d5
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-not-run-line_2026-09-29-16-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent mode, when the daemon does not answer and the process that owns its files still runs, the summary line now keeps how long ago that process started, and \"Rush was not run in-process\" follows on a line of its own instead of being cut from the middle of the summary line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json
new file mode 100644
index 0000000000..bf6f17a233
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Beside a process that owns the daemon's files but is not a Rush daemon, or is not proven to be this workspace's daemon, the hint now says that each command that uses the daemon first waits 15 s for a daemon to answer until that is resolved.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-reap-wait_2026-09-29-16-50.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-reap-wait_2026-09-29-16-50.json
new file mode 100644
index 0000000000..7c37156f3e
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-reap-wait_2026-09-29-16-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When the daemon has exited but its parent has not reaped it, Rush that runs in-process now waits up to 1 second for it to be reaped instead of 5, and the fallback message says that until then each command that uses the daemon first waits 15 s for a daemon to answer.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json
new file mode 100644
index 0000000000..cfb0429662
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "On Linux, `rush-client daemon stop` no longer waits 15 s for a daemon that no longer listens to exit while a signal or a tracer keeps it stopped, which it cannot do before something resumes it; it fails after about 1.5 s, saying what that daemon is doing and how to end it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json
new file mode 100644
index 0000000000..208d8d73af
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "On Linux, while a request waits for another Rush process to release the repository lock, the wait line and the admission failure now say when that process is stopped, since it cannot release the lock until something resumes it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t297-not-run-line_2026-09-29-16-30.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-not-run-line_2026-09-29-16-30.json
new file mode 100644
index 0000000000..6c1c1d0be3
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-not-run-line_2026-09-29-16-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When the daemon did not answer and the process that its ownership record names still runs, the error message now says on a line of its own that Rush was not run in-process, so that a caller that shortens long lines still shows how long ago that process started.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json
new file mode 100644
index 0000000000..617ee1dedb
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-owner-wait-hint_2026-09-29-16-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When the process that the daemon ownership record names is not a Rush daemon, or is not proven to be this workspace's daemon, the hint now also says that until the record is deleted or that process is ended, each command that uses the daemon first waits 15 s for a daemon to answer.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t297-reap-wait_2026-09-29-16-50.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-reap-wait_2026-09-29-16-50.json
new file mode 100644
index 0000000000..5d405ddfe7
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-reap-wait_2026-09-29-16-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "A reclaim of an exited daemon now waits up to 1 second, instead of 5, for a process that has exited but is not reaped yet, and the hint for such a process now says that until its parent reaps it, each command that uses the daemon first waits 15 s for a daemon to answer.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json
new file mode 100644
index 0000000000..7cca858e3b
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-stop-stopped-owner_2026-09-29-16-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Add `isDaemonOwnerStoppedAsync()`, which tells whether this workspace's daemon stays stopped by a signal or a tracer while the client samples it for 1.5 s, so that a command that waits for the daemon to exit can stop waiting.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json
new file mode 100644
index 0000000000..6c30dd3a96
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r04-t297-stopped-lock-holder_2026-09-29-16-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "On Linux, `formatNativeLockHolder` now says when the Rush process that holds the repository lock is stopped, for example `another Rush process (PID 12345: rush install; it is stopped (state T), for example by SIGSTOP)`, since that process cannot release the lock until something resumes it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index f412a74fd9..006e23201f 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -239,6 +239,9 @@ export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOp
 // @beta
 export function inspectDaemonStartupReservation(paths: IDaemonPaths): IDaemonStartupReservationInfo | undefined;
 
+// @beta
+export function isDaemonOwnerStoppedAsync(paths: IDaemonPaths, deadline: number): Promise<boolean>;
+
 // @beta
 export function reclaimCrashedDaemonAsync(paths: IDaemonPaths, options?: IDaemonReclaimOptions): Promise<void>;
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 77f8347345..3542634cad 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -71,7 +71,9 @@ waits for a Rush process that the daemon does not run to release the repository'
 `findNativeLockHolder` finds it the way the daemon does, from the `rush#<pid>.lock` files in the
 common temp folder: on Linux, the live process with the oldest one, and its program and action
 from `/proc`, such as `rush install`, never its other arguments; elsewhere, nothing.
-`formatNativeLockHolder` words it, for example `another Rush process (PID 12345: rush install)`. After each hand-off
+`formatNativeLockHolder` words it, for example `another Rush process (PID 12345: rush install)`. On Linux, it also
+reads that process's state, and says when it is stopped, for example `another Rush process (PID 12345: rush install;
+it is stopped (state T), for example by SIGSTOP)`, since a stopped process cannot release the lock. After each hand-off
 to a ready successor, the optional `onRestartAsync` callback gets the restart number, the
 reason (`undefined` when the daemon gave none, as older daemons do) and the successor's PID,
 before the request is resubmitted.
@@ -96,8 +98,9 @@ passed to the connection's optional `onOrphansReaped(reap)` (the daemon's PID, t
 and whether they were `terminated` or `killed`), so that the caller can say so in its own words;
 without it, each is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. The reclaim before
 a daemon start reports the same way. It waits up to 5 seconds while another client holds the start
-mutex, or while the exited process is not reaped yet. If the reclaim fails or times out, the
-message is the same, and the next daemon start reclaims the daemon instead.
+mutex, and up to 1 second while the exited process is not reaped yet: its parent, usually init or a
+subreaper, reaps it at once, and one that has not by then may never do so. If the reclaim fails or
+times out, the message is the same, and the next daemon start reclaims the daemon instead.
 If the process still runs, the message says that only the connection closed. After the abort
 signal fires, the error is unchanged, so the caller reports the cancellation.
 
@@ -147,7 +150,10 @@ open (from the links in `/proc/<pid>/fd`), as the daemon that wrote the record d
 owns it, also after its socket file is deleted: the recorded PID could otherwise belong to another
 process, such as another workspace's daemon, which has only its own record open. For any other
 process, and outside Linux, it says to end that process if it is this workspace's daemon, and else to
-delete the record. A starting client waits for a live owner until its deadline, with one exception on Linux:
+delete the record, and that until then each command that uses the daemon first waits 15 s (the default
+startup deadline) for a daemon to answer. For a process that has exited but is not reaped yet (state Z),
+it names the parent that has not reaped it, says that the next command reclaims the daemon's files once
+that parent does, and says the same about the 15 s. A starting client waits for a live owner until its deadline, with one exception on Linux:
 when the recorded owner has the record open, as above, and every sample of its state over 1.5 s (one
 every 100 ms) reads stopped, by a signal (T) or a tracer (t), with the same start time, the client fails
 with that error once the 1.5 s have passed. Until something resumes that process, it cannot answer. The
@@ -155,6 +161,9 @@ client samples it while its first connection attempt runs, and not at all when l
 before its deadline. A shorter stop, such as Ctrl+Z and then `fg`, only delays the start, as before.
 `describeLiveDaemonOwner(paths, purpose)` returns the same two lines for the live process
 that the record names (`purpose` is `use` or `stop`), or `undefined` when there is none.
+`isDaemonOwnerStoppedAsync(paths, deadline)` samples that process in the same way, and resolves `true`
+only when it has the record open and stays stopped for the 1.5 s; `rush-client daemon stop` uses it to
+stop waiting for such a daemon to exit.
 `resetDaemonArtifactsAsync()` (`rush-client daemon stop --force`) removes the record, socket and
 reservation after the same no-listener/no-live-owner checks, so it refuses while that process runs, and
 says the same.
@@ -231,7 +240,8 @@ reservation) until one more startup deadline has passed. If the daemon is still
 with `DaemonStartupPendingError`, which is not a `DaemonClientError`: the message is the startup error
 followed by the process that is still live, and `cause` is that error. When the startup error is that
 the process that the ownership record names still runs but did not answer, the message instead leads
-with what that process is doing and ends with what to do about it, as above. When that error comes from a
+with what that process is doing, says on the next line that Rush was not run in-process, and ends with
+what to do about it, as above. When that error comes from a
 stopped owner at the endpoint (see above), and the owner is still stopped, the wrapper rejects so without
 waiting for another deadline. When none remains, it rejects at
 once with the original `DaemonClientError`, for example when auto-start is disabled and nothing listens,
@@ -257,7 +267,8 @@ client does for `--no-daemon` and for each fallback. A daemon that crashed or wa
 a command leaves its operations running, and they could overwrite the in-process command's outputs.
 When the ownership record names a PID that no longer exists (on Linux, also an exited process that is
 not reaped yet), it reclaims that daemon as described above for a lost connection: under the start
-mutex, only when no startup is reserved, and waiting up to 5 seconds. It does nothing when there is no
+mutex, only when no startup is reserved, and waiting up to 5 seconds for the mutex and up to 1 second
+for the exited process to be reaped. It does nothing when there is no
 record, when a process with the recorded PID runs, or when the runtime folder is not private, and it
 never throws. Its optional `options.onOrphansReaped` receives what it stopped, as above.
 
diff --git a/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts b/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
index 900b97563d..e628addd35 100644
--- a/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
+++ b/libraries/rush-client-core/src/DaemonOwnerDiagnosis.ts
@@ -81,6 +81,13 @@ const PATH_SEPARATOR_REGEXP: RegExp = /[\\/]+/;
 const MAX_COMMAND_LINE_LENGTH: number = 60;
 const SECONDS_PER_MINUTE: number = 60;
 const MINUTES_PER_HOUR: number = 60;
+/**
+ * Beside an owner that is not proven to be this workspace's daemon, including one that exited but is not reaped
+ * yet, each command that uses the daemon waits for one to answer until its startup deadline, 15 s unless the
+ * client sets another.
+ */
+const WAIT_UNTIL_THEN: string =
+  'Until then, each command that uses the daemon first waits 15 s for a daemon to answer.';
 
 export function getDefaultOwnerProcessReaders(): IOwnerProcessReaders {
   return {
@@ -153,13 +160,13 @@ export function getDaemonOwnerHint(
   const { state } = diagnosis;
   if (state?.code === 'Z' || state?.code === 'X') {
     const parent: string = state.parentPid === undefined ? 'its parent process' : `PID ${state.parentPid}`;
-    return `The next command reclaims its files once ${parent} reaps it.`;
+    return `The next command reclaims its files once ${parent} reaps it. ${WAIT_UNTIL_THEN}`;
   }
   if (diagnosis.isRushDaemon === false) {
-    return `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${lockfilePath}; the next command then starts a new daemon.`;
+    return `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${lockfilePath}; the next command then starts a new daemon. ${WAIT_UNTIL_THEN}`;
   }
   if (!diagnosis.isWorkspaceDaemon) {
-    return `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${lockfilePath}. Either way, the next command then starts a new daemon.`;
+    return `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${lockfilePath}. Either way, the next command then starts a new daemon. ${WAIT_UNTIL_THEN}`;
   }
   return getRushDaemonHint(diagnosis, purpose);
 }
@@ -213,12 +220,26 @@ function describeSubject(
   return `PID ${pid} ("${shown}")`;
 }
 
-function describeState(state: IProcessState): string {
-  switch (state.code) {
+/**
+ * Says that a process is stopped, by a signal (state T) or by a debugger or tracer (state t), for example
+ * `it is stopped (state T), for example by SIGSTOP`. Returns `undefined` for any other state: a stopped process does
+ * nothing, such as answer or release a lock, until something resumes it.
+ */
+export function describeStoppedState(state: IProcessState | undefined): string | undefined {
+  switch (state?.code) {
     case 'T':
       return 'it is stopped (state T), for example by SIGSTOP';
     case 't':
       return 'it is stopped by a debugger or tracer (state t)';
+    default:
+      return undefined;
+  }
+}
+
+function describeState(state: IProcessState): string {
+  const stopped: string | undefined = describeStoppedState(state);
+  if (stopped !== undefined) return stopped;
+  switch (state.code) {
     case 'D':
       return 'it is waiting in the kernel (state D), for example on a slow disk or network file system';
     case 'Z': {
diff --git a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
index dfa3315939..f1e479cf1e 100644
--- a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
+++ b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
@@ -19,10 +19,17 @@ import { logReclaimedDaemon } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 /**
- * How long to wait while another client reclaims the exited daemon, or while its exited process is not reaped
- * yet. A reclaim sends SIGTERM to orphaned operations, then SIGKILL to those still running 2 seconds later.
+ * How long to wait while another client reclaims the exited daemon. A reclaim sends SIGTERM to orphaned
+ * operations, then SIGKILL to those still running 2 seconds later.
  */
 const RECLAIM_WAIT_MS: number = 5000;
+/**
+ * How long to wait while the exited daemon's process is not reaped yet. Its parent, usually init or a subreaper,
+ * reaps it at once. A parent that has not reaped it within a second may never do so, for example PID 1 in a
+ * container that does not reap the processes it adopts, and each command that runs Rush in-process until then
+ * would wait all of it.
+ */
+const REAP_WAIT_MS: number = 1000;
 const RECLAIM_POLL_INTERVAL_MS: number = 50;
 
 /** A daemon process that has exited, and the workspace files that may still name it. */
@@ -42,9 +49,10 @@ export interface IExitedDaemon {
  * Call it before Rush runs in-process. Like the next daemon start, it terminates the daemon's orphaned
  * operation process groups and removes the ownership record and socket. Each set of groups that it stops is
  * reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. It does so
- * only under the start mutex and when no startup is reserved, and it waits up to 5 seconds while another client
- * holds the mutex or while the exited process is not reaped yet. It does nothing when there is no record, when
- * a process with the recorded PID runs, or when the runtime folder is not private, and it never throws.
+ * only under the start mutex and when no startup is reserved. It waits up to 5 seconds while another client
+ * holds the mutex, and up to 1 second while the exited process is not reaped yet. It does nothing when there is
+ * no record, when a process with the recorded PID runs, or when the runtime folder is not private, and it never
+ * throws.
  *
  * A reclaim appends a line that names the daemon to the launcher log, so that `rush-client daemon status` can
  * still say that it exited without shutting down once its ownership record is gone.
@@ -74,17 +82,19 @@ export async function reclaimCrashedDaemonAsync(
  * the next daemon start would (`options.onOrphansReaped` or `RUSH_DAEMON_ORPHANS_REAPED` warnings say what was
  * stopped). Best effort: it acts only while the ownership record names that daemon, under the start mutex, and
  * when no startup is reserved. While another client holds the mutex, for example to reclaim the same daemon,
- * it waits. A reclaim is logged ({@link logReclaimedDaemon}).
+ * it waits up to 5 seconds, and it waits up to 1 second for the exited process to be reaped. A reclaim is
+ * logged ({@link logReclaimedDaemon}).
  */
 export async function reclaimExitedDaemonAsync(
   daemon: IExitedDaemon,
   options?: IDaemonReclaimOptions
 ): Promise<void> {
-  const deadline: number = Date.now() + RECLAIM_WAIT_MS;
+  const startedAt: number = Date.now();
   try {
     while (isRecordedOwner(daemon)) {
       // The reclaim refuses a PID that still exists, which includes an exited process that is not reaped yet.
-      if (!isProcessDefunct(daemon.pid)) {
+      const isDefunct: boolean = isProcessDefunct(daemon.pid);
+      if (!isDefunct) {
         const lock: IStartupLock | undefined = await tryAcquireStartupLockAsync(daemon.paths);
         if (lock) {
           try {
@@ -98,7 +108,7 @@ export async function reclaimExitedDaemonAsync(
           return;
         }
       }
-      if (Date.now() >= deadline) return;
+      if (Date.now() - startedAt >= (isDefunct ? REAP_WAIT_MS : RECLAIM_WAIT_MS)) return;
       await delayAsync(RECLAIM_POLL_INTERVAL_MS);
     }
   } catch {
diff --git a/libraries/rush-client-core/src/NativeLockHolder.ts b/libraries/rush-client-core/src/NativeLockHolder.ts
index 470be7a7b6..6b8a91d3f0 100644
--- a/libraries/rush-client-core/src/NativeLockHolder.ts
+++ b/libraries/rush-client-core/src/NativeLockHolder.ts
@@ -6,7 +6,8 @@ import * as path from 'node:path';
 
 import type { IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
 
-import { tryGetProcessStartTimeMs } from './ProcessStartTime';
+import { describeStoppedState } from './DaemonOwnerDiagnosis';
+import { tryGetProcessStartTimeMs, tryGetProcessState } from './ProcessStartTime';
 
 /** The name of each lock file that LockFile.acquire(folder, 'rush') writes on Linux and macOS. */
 const LOCK_FILE_PATTERN: RegExp = /^rush#(\d+)\.lock$/;
@@ -63,13 +64,18 @@ export function formatNativeLockCommand(argv: readonly string[]): string | undef
 
 /**
  * Describes the Rush process that holds the repository lock, for example
- * `another Rush process (PID 12345: rush install)`, naming only what is known.
+ * `another Rush process (PID 12345: rush install)`, naming only what is known. On Linux, it also says when that
+ * process is stopped, which keeps it from releasing the lock until something resumes it, for example
+ * `another Rush process (PID 12345: rush install; it is stopped (state T), for example by SIGSTOP)`.
  * @beta
  */
 export function formatNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): string {
   const pid: string | undefined = holder?.pid === undefined ? undefined : `PID ${holder.pid}`;
   const details: string = [pid, holder?.command].filter((detail) => detail !== undefined).join(': ');
-  return details ? `${HOLDER_DESCRIPTION} (${details})` : HOLDER_DESCRIPTION;
+  const stopped: string | undefined =
+    holder?.pid === undefined ? undefined : describeStoppedState(tryGetProcessState(holder.pid));
+  if (!details) return HOLDER_DESCRIPTION;
+  return stopped ? `${HOLDER_DESCRIPTION} (${details}; ${stopped})` : `${HOLDER_DESCRIPTION} (${details})`;
 }
 
 function readLockFileCandidates(lockFolder: string, ownPid: number): ILockFileCandidate[] {
diff --git a/libraries/rush-client-core/src/StoppedDaemonOwner.ts b/libraries/rush-client-core/src/StoppedDaemonOwner.ts
index 23acbce013..f00d110ecf 100644
--- a/libraries/rush-client-core/src/StoppedDaemonOwner.ts
+++ b/libraries/rush-client-core/src/StoppedDaemonOwner.ts
@@ -53,6 +53,19 @@ export async function findStoppedDaemonOwnerAsync(
   return stopped;
 }
 
+/**
+ * Whether this workspace's daemon cannot exit or answer before something resumes it: on Linux, the process that
+ * the ownership record at `paths.lockfilePath` names has that record open, as the daemon that wrote it does, and
+ * every sample of its state over 1.5 seconds reads stopped, by a signal (T) or a tracer (t), with the same start
+ * time. `rush-client daemon stop` uses it to stop waiting for such a daemon to exit.
+ * @returns `false` otherwise, including outside Linux, and at once when less than 1.5 seconds remain before
+ * `deadline`. The first sample ends the sampling for any other owner, or none.
+ * @beta
+ */
+export async function isDaemonOwnerStoppedAsync(paths: IDaemonPaths, deadline: number): Promise<boolean> {
+  return (await findStoppedDaemonOwnerAsync(paths, deadline)) !== undefined;
+}
+
 /**
  * Whether the record at `paths.lockfilePath` still names `stopped`, which still has that record open and is still
  * stopped (state T or t, with the same start time).
diff --git a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
index e62c081b9f..764dcb7ff3 100644
--- a/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
+++ b/libraries/rush-client-core/src/connectOrAwaitDaemonStartup.ts
@@ -143,8 +143,9 @@ function isStoppedListener(
 
 /**
  * When a live process owns the daemon's files, the message leads with what that process is doing and ends with
- * what to do about it. It then names a startup helper or a start mutex holder that it waited for, but not a
- * listener at the endpoint: the first line already says that the daemon did not answer there.
+ * what to do about it. The line between says that Rush was not run in-process, and first names a startup helper or
+ * a start mutex holder that it waited for, but not a listener at the endpoint: the first line already says that the
+ * daemon did not answer there.
  */
 function describePendingStartup(lastError: DaemonClientError, owner: ILiveStartupOwner): string {
   if (!(lastError instanceof LiveDaemonOwnerError)) {
@@ -153,8 +154,12 @@ function describePendingStartup(lastError: DaemonClientError, owner: ILiveStartu
   return describeLiveOwner(lastError, owner.kind === 'listener' ? '' : `${owner.description}, so `);
 }
 
+/**
+ * What the live owner is doing, that Rush was not run in-process, and what to do about it, each on a line of its
+ * own, so that a caller that shortens long lines, as agent output does, still shows all three.
+ */
 function describeLiveOwner(error: LiveDaemonOwnerError, reason: string = ''): string {
-  return `${error.description} ${reason}${NOT_RUN_IN_PROCESS}\n${error.hint}`;
+  return `${error.description}\n${reason}${NOT_RUN_IN_PROCESS}\n${error.hint}`;
 }
 
 /**
diff --git a/libraries/rush-client-core/src/index.ts b/libraries/rush-client-core/src/index.ts
index a4c70fd80c..7d58878bb5 100644
--- a/libraries/rush-client-core/src/index.ts
+++ b/libraries/rush-client-core/src/index.ts
@@ -54,3 +54,4 @@ export {
   type IDaemonStartCommand
 } from './connectOrStartDaemon';
 export { findNativeLockHolder, formatNativeLockHolder } from './NativeLockHolder';
+export { isDaemonOwnerStoppedAsync } from './StoppedDaemonOwner';
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
index 3bf6ac8729..0202461b79 100644
--- a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -225,7 +225,8 @@ describe(explainLostConnectionAsync.name, () => {
       ).finally(() => {
         settled = true;
       });
-      await delayAsync(300);
+      // The reclaim waits up to 1 s for the process to be reaped.
+      await delayAsync(100);
       expect(settled).toBe(false);
       expect(fs.existsSync(paths.lockfilePath)).toBe(true);
       // Once its parent exits, init or a subreaper reaps it.
diff --git a/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts b/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
index 304d811b0c..8ce9fff1a7 100644
--- a/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonOwnerDiagnosis.test.ts
@@ -34,7 +34,7 @@ const PATHS: IDaemonPaths = {
 };
 const NOW: number = Date.parse('2026-09-29T10:00:00.000Z');
 const RUSHD: string[] = ['/usr/bin/node', '/x/node_modules/@rushstack/rush-daemon/lib-commonjs/start.js'];
-const HEDGED_HINT: string = `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${LOCKFILE}. Either way, the next command then starts a new daemon.`;
+const HEDGED_HINT: string = `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${LOCKFILE}. Either way, the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`;
 
 function readers(overrides: Partial<IOwnerProcessReaders> = {}): IOwnerProcessReaders {
   return {
@@ -109,7 +109,9 @@ describe('diagnoseDaemonOwner', () => {
     expect(describeUnresponsiveOwner(diagnosis)).toBe(
       `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID}: it has exited, but its parent process (PID 77) has not reaped it (state Z), and it started 3 min ago.`
     );
-    expect(hint(diagnosis)).toBe('The next command reclaims its files once PID 77 reaps it.');
+    expect(hint(diagnosis)).toBe(
+      'The next command reclaims its files once PID 77 reaps it. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.'
+    );
   });
 
   it('tells a busy daemon from one that lost its socket', () => {
@@ -134,8 +136,10 @@ describe('diagnoseDaemonOwner', () => {
       `The daemon did not answer at ${SOCKET}, and its ownership record names PID ${PID} ("sleep 600"): it is waiting (state S), and it started 3 min ago.`
     );
     expect(hint(diagnosis, 'stop')).toBe(
-      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${LOCKFILE}; the next command then starts a new daemon.`
+      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${LOCKFILE}; the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
     );
+    // A command that uses the daemon, and runs Rush in-process after that wait, gets the same hint.
+    expect(hint(diagnosis)).toBe(hint(diagnosis, 'stop'));
     const long: IDaemonOwnerDiagnosis = diagnose({ readCommandLine: () => ['x'.repeat(40), 'y'.repeat(40)] });
     expect(long.subject).toBe(`PID ${PID} ("${'x'.repeat(40)} ${'y'.repeat(16)}...")`);
   });
diff --git a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
index 59e577c417..74bc4d605a 100644
--- a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
+++ b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
@@ -116,7 +116,8 @@ describe(reclaimCrashedDaemonAsync.name, () => {
       const reclaimed: Promise<void> = reclaimCrashedDaemonAsync(paths).finally(() => {
         settled = true;
       });
-      await delayAsync(300);
+      // It waits up to 1 s for the process to be reaped.
+      await delayAsync(100);
       expect(settled).toBe(false);
       expect(fs.existsSync(paths.lockfilePath)).toBe(true);
       // Once its parent exits, init or a subreaper reaps it.
@@ -126,6 +127,23 @@ describe(reclaimCrashedDaemonAsync.name, () => {
     });
   });
 
+  linuxIt('gives up after 1 s on a crashed daemon that is not reaped, and keeps its files', async () => {
+    await withUnreapedChildAsync(async (child) => {
+      const deadline: number = Date.now() + 5000;
+      while (!isProcessDefunct(child) && Date.now() < deadline) await delayAsync(20);
+      recordDaemonOwner(paths, child);
+      const startedAt: number = Date.now();
+      await reclaimCrashedDaemonAsync(paths);
+      const waitedMs: number = Date.now() - startedAt;
+      // Its parent never reaps it, so a longer wait would only delay the command.
+      expect(waitedMs).toBeGreaterThanOrEqual(1000);
+      expect(waitedMs).toBeLessThan(4000);
+      expect(isProcessDefunct(child)).toBe(true);
+      expect(fs.existsSync(paths.lockfilePath)).toBe(true);
+      expect(warning).not.toHaveBeenCalled();
+    });
+  });
+
   linuxIt('does not act on the records in a runtime folder that is not private', async () => {
     const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
     recordDaemonOwner(paths, daemonPid);
diff --git a/libraries/rush-client-core/src/test/NativeLockHolder.test.ts b/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
index b61232adcc..3042e7c627 100644
--- a/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
+++ b/libraries/rush-client-core/src/test/NativeLockHolder.test.ts
@@ -7,10 +7,13 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { findNativeLockHolder, formatNativeLockCommand, formatNativeLockHolder } from '../NativeLockHolder';
+import { tryGetProcessState } from '../ProcessStartTime';
 
 const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
 const TEST_FOLDER: string = path.resolve(__dirname, '../../temp/test/native-lock-holder');
 const HOUR_MS: number = 60 * 60 * 1000;
+/** No process has this PID: Linux gives PIDs below 4194304, the most that pid_max can be. */
+const NO_SUCH_PID: number = 4194304;
 
 function createLockFolder(name: string): string {
   const folder: string = path.join(TEST_FOLDER, name);
@@ -51,6 +54,18 @@ async function stopProgramAsync(child: ChildProcess): Promise<void> {
   await closed;
 }
 
+/** Waits until the state of `pid` in /proc satisfies `isExpected`. */
+async function waitForStateAsync(
+  pid: number,
+  isExpected: (code: string | undefined) => boolean
+): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!isExpected(tryGetProcessState(pid)?.code)) {
+    if (Date.now() > deadline) throw new Error(`PID ${pid} stayed in state ${tryGetProcessState(pid)?.code}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
 async function getExitedPidAsync(): Promise<number> {
   const exited: ChildProcess = spawn(process.execPath, ['-e', ''], { stdio: 'ignore' });
   await once(exited, 'close');
@@ -59,14 +74,45 @@ async function getExitedPidAsync(): Promise<number> {
 
 describe(formatNativeLockHolder.name, () => {
   it.each([
-    [{ pid: 12345, command: 'rush install' }, 'another Rush process (PID 12345: rush install)'],
-    [{ pid: 12345 }, 'another Rush process (PID 12345)'],
+    [
+      { pid: NO_SUCH_PID, command: 'rush install' },
+      `another Rush process (PID ${NO_SUCH_PID}: rush install)`
+    ],
+    [{ pid: NO_SUCH_PID }, `another Rush process (PID ${NO_SUCH_PID})`],
     [{ command: 'rush install' }, 'another Rush process (rush install)'],
     [{}, 'another Rush process'],
     [undefined, 'another Rush process']
   ])('names %j as %j', (holder, expected) => {
     expect(formatNativeLockHolder(holder)).toBe(expected);
   });
+
+  linuxIt(
+    'says that the process is stopped for as long as it is, since it cannot release the lock',
+    async () => {
+      const folder: string = createLockFolder('stopped');
+      const holder: ChildProcess = await startProgramAsync(folder, 'rush', ['install']);
+      const pid: number = holder.pid!;
+      try {
+        holder.kill('SIGSTOP');
+        await waitForStateAsync(pid, (code) => code === 'T');
+        expect(formatNativeLockHolder({ pid, command: 'rush install' })).toBe(
+          `another Rush process (PID ${pid}: rush install; it is stopped (state T), for example by SIGSTOP)`
+        );
+        expect(formatNativeLockHolder({ pid })).toBe(
+          `another Rush process (PID ${pid}; it is stopped (state T), for example by SIGSTOP)`
+        );
+
+        holder.kill('SIGCONT');
+        await waitForStateAsync(pid, (code) => code !== 'T');
+        expect(formatNativeLockHolder({ pid, command: 'rush install' })).toBe(
+          `another Rush process (PID ${pid}: rush install)`
+        );
+      } finally {
+        holder.kill('SIGCONT');
+        await stopProgramAsync(holder);
+      }
+    }
+  );
 });
 
 describe(formatNativeLockCommand.name, () => {
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
index f895b5cc33..6c90fd7507 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonLiveOwner.test.ts
@@ -17,7 +17,7 @@ import { LiveDaemonOwnerError } from '../DaemonOwnerDiagnosis';
 import { describeLiveDaemonOwner, resetDaemonArtifactsAsync } from '../DaemonOwnership';
 import { DaemonStartupPendingError, connectOrAwaitDaemonStartupAsync } from '../connectOrAwaitDaemonStartup';
 import type { IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
-import { STOPPED_OWNER_WINDOW_MS } from '../StoppedDaemonOwner';
+import { STOPPED_OWNER_WINDOW_MS, isDaemonOwnerStoppedAsync } from '../StoppedDaemonOwner';
 import { recordDaemonOwner } from './OrphanedOperation';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
@@ -198,10 +198,10 @@ function unlinkSockets(folder: string): void {
     expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
     expect(error.message).toMatch(
       new RegExp(
-        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\. ${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
       )
     );
-    expect(error.message.split('\n')[1]).toBe(resumeHint(pid));
+    expect(error.message.split('\n')[2]).toBe(resumeHint(pid));
     expect((error.cause as LiveDaemonOwnerError).stoppedProcess).toBeUndefined();
     expect(onAwaitStartup.mock.calls).toEqual([
       [`A process listens at ${paths.socketPath} but was not ready in time`, expect.any(Number)]
@@ -237,7 +237,7 @@ function unlinkSockets(folder: string): void {
     });
     expect(error.message).toMatch(
       new RegExp(
-        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\. ${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n${escapeRegExp(resumeHint(pid))}$`
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: it is stopped \\(state T\\), for example by SIGSTOP, and it started \\d+ s ago\\.\\n${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n${escapeRegExp(resumeHint(pid))}$`
       )
     );
     expect(onAwaitStartup).not.toHaveBeenCalled();
@@ -263,7 +263,7 @@ function unlinkSockets(folder: string): void {
       pid,
       startTicks: readStartTicks(pid)
     });
-    expect(error.message.split('\n')[1]).toBe(resumeHint(pid));
+    expect(error.message.split('\n')[2]).toBe(resumeHint(pid));
     expect(onAwaitStartup).not.toHaveBeenCalled();
   }, 30000);
 
@@ -338,10 +338,10 @@ function unlinkSockets(folder: string): void {
     expect(error.cause).toBeInstanceOf(LiveDaemonOwnerError);
     expect(error.message).toMatch(
       new RegExp(
-        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started \\d+ s ago\\. ${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
+        `^The daemon, rushd \\(PID ${pid}\\), did not answer at ${escapeRegExp(paths.socketPath)}: its socket is missing, so no client can reach it; it is (waiting|running) \\(state [SR]\\), and it started \\d+ s ago\\.\\n${escapeRegExp(NOT_RUN_IN_PROCESS)}\\n`
       )
     );
-    expect(error.message.split('\n')[1]).toBe(
+    expect(error.message.split('\n')[2]).toBe(
       `It may exit on its own once its running requests finish; "kill ${pid}" asks it to cancel them and exit. The next command then starts a new daemon.`
     );
     expect(onAwaitStartup).not.toHaveBeenCalled();
@@ -364,7 +364,7 @@ function unlinkSockets(folder: string): void {
       )
     );
     expect(error.message.split('\n')[1]).toBe(
-      `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon.`
+      `It may be busy, stopped or shutting down, or not this workspace's daemon; "rush-client daemon logs" shows the daemon's last lines. If it is this workspace's daemon, end that process; if it is not, delete ${paths.lockfilePath}. Either way, the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
     );
     expect(readState(pid)).toBe('T');
   }, 30000);
@@ -386,7 +386,7 @@ function unlinkSockets(folder: string): void {
       )
     );
     expect(error.message.split('\n')[1]).toBe(
-      `The next command reclaims its files once PID ${parent.pid} reaps it.`
+      `The next command reclaims its files once PID ${parent.pid} reaps it. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
     );
 
     // Once that parent is gone, another process reaps it, and it no longer owns anything.
@@ -414,7 +414,7 @@ function unlinkSockets(folder: string): void {
       )
     );
     expect(error.message.split('\n')[1]).toBe(
-      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${paths.lockfilePath}; the next command then starts a new daemon.`
+      `It does not look like a Rush daemon. If no daemon runs for this workspace, delete ${paths.lockfilePath}; the next command then starts a new daemon. Until then, each command that uses the daemon first waits 15 s for a daemon to answer.`
     );
     expect(readDaemonRecordPid()).toBe(pid);
     expect(readState(pid)).toBe('S');
@@ -442,6 +442,23 @@ function unlinkSockets(folder: string): void {
     expect(describeLiveDaemonOwner(paths, 'use')).toBeUndefined();
   });
 
+  it('tells a command that waits for the daemon to exit whether the daemon stays stopped', async () => {
+    const pid: number = await startFakeDaemonAsync();
+    let start: number = Date.now();
+
+    // The first sample ends the sampling for a daemon that is not stopped.
+    expect(await isDaemonOwnerStoppedAsync(paths, start + 15000)).toBe(false);
+    expect(Date.now() - start).toBeLessThan(STOPPED_OWNER_WINDOW_MS);
+
+    await stopChildAsync(pid);
+    start = Date.now();
+    expect(await isDaemonOwnerStoppedAsync(paths, start + 15000)).toBe(true);
+    expect(Date.now() - start).toBeGreaterThanOrEqual(STOPPED_OWNER_WINDOW_MS);
+    // Too little time before the deadline to sample it.
+    expect(await isDaemonOwnerStoppedAsync(paths, Date.now() + STOPPED_OWNER_WINDOW_MS - 100)).toBe(false);
+    expect(readState(pid)).toBe('T');
+  }, 30000);
+
   function readDaemonRecordPid(): number {
     return JSON.parse(fs.readFileSync(paths.lockfilePath, 'utf8')).pid;
   }

From 76e241755413ba535a1d603378c5cd78ecccf19a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:08 +0000
Subject: [PATCH 208/265] [rush-lib] Test a blocked verified skip in a later
 iteration

Swarm integration step 193; original commit 561aa4396b (merge of swarm/r01-t303-nit1 at 8bd2a79c01).
Refs: task 303.
Scope: task 303 + NIT 1.

Brings 303-nit1 (branch swarm/r01-t303-nit1). Second agent: o02 board 6490, board 6644, board 6648. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 10 of 15. Gate: ch01 GATE OK board 6977 (tree 242fb8a163)

Commits folded into this step (2):
- 6e5e31539a rush-lib: trust plugin skips verified against the build cache (task 303)
- 8bd2a79c01 rush-lib: test a blocked verified skip in a later iteration (task 303)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...erified-plugin-skips_2026-09-29-17-51.json |  11 +
 .../operations/CacheableOperationPlugin.ts    |  23 +-
 .../operations/RetainedResultVerification.ts  |  49 +++
 ...ableOperationPluginRetainedResults.test.ts | 366 +++++++++++++++++-
 4 files changed, 439 insertions(+), 10 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/verified-plugin-skips_2026-09-29-17-51.json

diff --git a/common/changes/@microsoft/rush/verified-plugin-skips_2026-09-29-17-51.json b/common/changes/@microsoft/rush/verified-plugin-skips_2026-09-29-17-51.json
new file mode 100644
index 0000000000..403c620ee0
--- /dev/null
+++ b/common/changes/@microsoft/rush/verified-plugin-skips_2026-09-29-17-51.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Let a plugin that skips an operation mark the skip as verified against the operation's build cache entry (`markSkipVerified`), so that the consumers of the operation can still write to the build cache, and let plugins read the state hash at which the build cache trusted a result (`getTrustedStateHash`).",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 1e24e52fbf..31e9b550d7 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -52,8 +52,10 @@ import type { IConfigurableOperation, IOperationExecutionResult } from './IOpera
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
 import {
   enableUnverifiedRetainedOperations,
+  getVerifiedSkipStateHash,
   markInputFilesChecked,
-  markResultUnverifiable
+  markResultUnverifiable,
+  setTrustedStateHash
 } from './RetainedResultVerification';
 import { isBuildCacheReadSkipped, wasExecutedIncrementally } from './IncrementalExecutionState';
 
@@ -781,11 +783,21 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
           switch (record.status) {
             case OperationStatus.Skipped: {
               // Skipping generally means we cannot guarantee integrity, so prevent cache writes in dependents.
-              // The exception is an operation that was not re-run because a previous iteration of this graph
+              // The exceptions are an operation that was not re-run because a previous iteration of this graph
               // produced a trusted result at exactly the same state hash (e.g. a result retained by a
-              // long-lived graph such as the Rush daemon). Since the state hash of an operation covers the
-              // state hashes of all of its dependencies, a consumer's cache key fully describes this input.
-              if (blockCacheWrite || trustedStateHashByOperation.get(operation) !== record.getStateHash()) {
+              // long-lived graph such as the Rush daemon), and an operation that a plugin skipped because it
+              // verified that the outputs are those of the build cache entry at exactly this state hash (see
+              // markSkipVerified). Since the state hash of an operation covers the state hashes of all of its
+              // dependencies, a consumer's cache key fully describes this input.
+              if (!blockCacheWrite && getVerifiedSkipStateHash(record) === record.getStateHash()) {
+                // Trusted as if the outputs were restored from that build cache entry.
+                trustedStateHashByOperation.set(operation, record.getStateHash());
+                incrementalStateHashByOperation.delete(operation);
+                setTrustedStateHash(record, record.getStateHash());
+              } else if (
+                blockCacheWrite ||
+                trustedStateHashByOperation.get(operation) !== record.getStateHash()
+              ) {
                 blockCacheWrite = true;
                 trustedStateHashByOperation.delete(operation);
                 incrementalStateHashByOperation.delete(operation);
@@ -822,6 +834,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                   incrementalStateHashByOperation.set(operation, record.getStateHash());
                 } else {
                   incrementalStateHashByOperation.delete(operation);
+                  setTrustedStateHash(record, record.getStateHash());
                 }
               } else {
                 trustedStateHashByOperation.delete(operation);
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
index 19b7821ff0..486f4aeba7 100644
--- a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -7,6 +7,8 @@ import { type OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 
 const unverifiableResults: WeakSet<IOperationExecutionResult> = new WeakSet();
 const resultsWithCheckedInputFiles: WeakSet<IOperationExecutionResult> = new WeakSet();
+const verifiedSkipStateHashByResult: WeakMap<IOperationExecutionResult, string> = new WeakMap();
+const trustedStateHashByResult: WeakMap<IOperationExecutionResult, string> = new WeakMap();
 
 /**
  * Records that the outputs of a result of the executing iteration may not match its state hash, e.g. because input
@@ -48,6 +50,53 @@ export function areInputFilesChecked(result: IOperationExecutionResult): boolean
   return resultsWithCheckedInputFiles.has(result);
 }
 
+/**
+ * Records that a plugin which reports the result as skipped verified that the outputs of the operation are exactly
+ * those of its build cache entry at the given state hash, e.g. because they were restored from that entry or written
+ * to it, and have not changed since. If that is the state hash of the result, `CacheableOperationPlugin` trusts the
+ * skipped result as it trusts a result restored from the build cache, so it does not block the cache writes of the
+ * consumers of the operation.
+ *
+ * @remarks
+ * Call this from the `beforeExecuteOperationAsync` tap that returns `OperationStatus.Skipped` for the result.
+ */
+export function markSkipVerified(result: IOperationExecutionResult, stateHash: string): void {
+  verifiedSkipStateHashByResult.set(result, stateHash);
+}
+
+/**
+ * Returns the state hash that was passed to `markSkipVerified` for the result, if any.
+ */
+export function getVerifiedSkipStateHash(result: IOperationExecutionResult): string | undefined {
+  return verifiedSkipStateHashByResult.get(result);
+}
+
+/**
+ * Records the state hash at which `CacheableOperationPlugin` trusts the result of the executing iteration as a
+ * complete result that the build cache entries of consumers may be written against.
+ *
+ * @remarks
+ * Only `CacheableOperationPlugin` calls this.
+ */
+export function setTrustedStateHash(result: IOperationExecutionResult, stateHash: string): void {
+  trustedStateHashByResult.set(result, stateHash);
+}
+
+/**
+ * Returns the state hash at which `CacheableOperationPlugin` trusted the result in the executing iteration as a
+ * complete result that the build cache entries of consumers may be written against: its outputs were produced,
+ * restored from the build cache, or verified by the plugin that skipped it, while cache writes were allowed for the
+ * operation, and they are not the outputs of an incremental command. Returns undefined otherwise, including for a
+ * result that a previous iteration of a long-lived graph retained.
+ *
+ * @remarks
+ * Call this from an `afterExecuteOperationAsync` tap with a stage greater than 0, which runs after
+ * `CacheableOperationPlugin` decided whether to trust the result.
+ */
+export function getTrustedStateHash(result: IOperationExecutionResult): string | undefined {
+  return trustedStateHashByResult.get(result);
+}
+
 /**
  * Re-enables selected operations whose result retained by a previous iteration of a long-lived graph
  * (e.g. the Rush daemon) is current by state hash, but not verified at that state hash, so that they are restored
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
index 8b3824c345..3ebfb50b83 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPluginRetainedResults.test.ts
@@ -63,6 +63,7 @@ import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRun
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import { setCommandExecution, skipBuildCacheRead } from '../IncrementalExecutionState';
+import { getTrustedStateHash, markSkipVerified } from '../RetainedResultVerification';
 import { NullOperationRunner } from '../NullOperationRunner';
 
 const mockPhase: IPhase = {
@@ -84,14 +85,25 @@ class CacheableMockRunner implements IOperationRunner {
   public readonly name: string;
   readonly #executions: string[];
   readonly #incrementalNames: ReadonlySet<string>;
-
-  public constructor(name: string, executions: string[], incrementalNames: ReadonlySet<string>) {
+  readonly #failingNames: ReadonlySet<string>;
+
+  public constructor(
+    name: string,
+    executions: string[],
+    incrementalNames: ReadonlySet<string>,
+    failingNames: ReadonlySet<string>
+  ) {
     this.name = name;
     this.#executions = executions;
     this.#incrementalNames = incrementalNames;
+    this.#failingNames = failingNames;
   }
 
   public async executeAsync(context: IOperationRunnerContext): Promise<OperationStatus> {
+    if (this.#failingNames.has(this.name)) {
+      this.#executions.push(`${this.name}:failed`);
+      return OperationStatus.Failure;
+    }
     if (this.#incrementalNames.has(this.name)) {
       // Like a ShellOperationRunner whose incremental execution guard allowed its incremental command
       setCommandExecution(context, { kind: 'incremental', hasIncrementalCommand: true });
@@ -126,9 +138,28 @@ interface ITestGraph {
    * The names of the operations whose runner executes its incremental command
    */
   incrementalNames: Set<string>;
+  /**
+   * The names of the operations whose runner fails
+   */
+  failingNames: Set<string>;
+  /**
+   * The names of the operations whose build cache entry cannot be written
+   */
+  failingWrites: Set<string>;
+  /**
+   * What an `afterExecuteOperationAsync` tap with a later stage than `CacheableOperationPlugin` saw for each
+   * operation in the last iteration
+   */
+  results: Map<string, IRecordedResult>;
   executeAsync(isIncrementalBuildAllowed?: boolean): Promise<IExecutionResult>;
 }
 
+interface IRecordedResult {
+  status: OperationStatus;
+  stateHash: string;
+  trustedStateHash: string | undefined;
+}
+
 interface ITestGraphOptions {
   /**
    * The names of the operations that have no script, like a phase whose script is missing
@@ -148,6 +179,20 @@ interface ITestGraphOptions {
    * If true, enables cobuilds with a lock provider that grants every lock and has no completed states.
    */
   cobuild?: boolean;
+  /**
+   * The operations whose skipped results the emulated change detection plugin marks as verified, each with the
+   * state hash that it marks, or undefined for the state hash of the operation in the iteration.
+   */
+  verifiedSkips?: ReadonlyMap<string, string | undefined>;
+  /**
+   * If set, emulates a plugin that reports a selected operation as restored from the build cache if its name is in
+   * this set and the build cache has no entry for it, because the plugin restored its outputs from elsewhere.
+   */
+  pluginFromCache?: ReadonlySet<string>;
+  /**
+   * The build cache entries, to share them with another test graph. By default, each test graph has its own.
+   */
+  cacheEntries?: Set<string>;
 }
 
 /**
@@ -155,14 +200,24 @@ interface ITestGraphOptions {
  * The mock build cache stores an entry per operation and state hash, and restores it if it exists.
  */
 async function createTestGraphAsync(names: string[], options: ITestGraphOptions = {}): Promise<ITestGraph> {
-  const { dependencies, cacheWriteEnabled = true, upToDate, cobuild } = options;
+  const {
+    dependencies,
+    cacheWriteEnabled = true,
+    upToDate,
+    cobuild,
+    verifiedSkips,
+    pluginFromCache,
+    cacheEntries = new Set()
+  } = options;
   const executions: string[] = [];
   const checks: string[] = [];
   const cacheWrites: string[] = [];
   const cacheRestores: string[] = [];
   const cobuildLocks: string[] = [];
   const incrementalNames: Set<string> = new Set();
-  const cacheEntries: Set<string> = new Set();
+  const failingNames: Set<string> = new Set();
+  const failingWrites: Set<string> = new Set();
+  const results: Map<string, IRecordedResult> = new Map();
   const localHashes: Map<string, string> = new Map();
   const operations: Map<string, Operation> = new Map();
   const projectConfigurations: Map<RushConfigurationProject, RushProjectConfiguration> = new Map();
@@ -180,7 +235,7 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     const operation: Operation = new Operation({
       runner: options.noOpNames?.has(name)
         ? new NullOperationRunner({ name, result: OperationStatus.NoOp, silent: true })
-        : new CacheableMockRunner(name, executions, incrementalNames),
+        : new CacheableMockRunner(name, executions, incrementalNames, failingNames),
       logFilenameIdentifier: name,
       phase: mockPhase,
       project
@@ -213,6 +268,9 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
         return restored;
       },
       trySetCacheEntryAsync: async () => {
+        if (failingWrites.has(name)) {
+          return false;
+        }
         cacheWrites.push(name);
         cacheEntries.add(getCacheKey());
         return true;
@@ -294,10 +352,38 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
         }
         // The build cache does not handle operations that another plugin skipped.
         (record.operation.runner as CacheableMockRunner).cacheable = false;
+        if (verifiedSkips?.has(name)) {
+          markSkipVerified(record, verifiedSkips.get(name) ?? record.getStateHash());
+        }
         return OperationStatus.Skipped;
       }
     );
   }
+  if (pluginFromCache) {
+    graph.hooks.beforeExecuteOperationAsync.tapPromise(
+      // After the build cache is read
+      { name: 'TestRestorePlugin', stage: 10 },
+      async (
+        record: IOperationRunnerContext & IOperationExecutionResult
+      ): Promise<OperationStatus | undefined> => {
+        if (record.silent || !pluginFromCache.has(record.operation.name)) {
+          return;
+        }
+        return OperationStatus.FromCache;
+      }
+    );
+  }
+  graph.hooks.afterExecuteOperationAsync.tap(
+    // After CacheableOperationPlugin decided whether to trust the result
+    { name: 'TestTrustObserverPlugin', stage: 100 },
+    (record: IOperationRunnerContext & IOperationExecutionResult): void => {
+      results.set(record.operation.name, {
+        status: record.status,
+        stateHash: record.getStateHash(),
+        trustedStateHash: getTrustedStateHash(record)
+      });
+    }
+  );
 
   const inputsSnapshot: IInputsSnapshot = {
     hashes: new Map(),
@@ -317,12 +403,16 @@ async function createTestGraphAsync(names: string[], options: ITestGraphOptions
     cobuildLocks,
     checks,
     incrementalNames,
+    failingNames,
+    failingWrites,
+    results,
     executeAsync: async (isIncrementalBuildAllowed?: boolean) => {
       executions.length = 0;
       cacheWrites.length = 0;
       cacheRestores.length = 0;
       cobuildLocks.length = 0;
       checks.length = 0;
+      results.clear();
       return await graph.executeAsync({ inputsSnapshot, isIncrementalBuildAllowed });
     }
   };
@@ -850,3 +940,269 @@ describe(`${CacheableOperationPlugin.name} retained results`, () => {
     expect(testGraph.executions).toEqual([]);
   });
 });
+
+// Skipped results that a plugin verified, and the state hash at which each result is trusted.
+describe(`${CacheableOperationPlugin.name} verified skipped results`, () => {
+  function expectTrusted(testGraph: ITestGraph, name: string): void {
+    const result: IRecordedResult | undefined = testGraph.results.get(name);
+    expect(result?.trustedStateHash).toBeDefined();
+    expect(result?.trustedStateHash).toBe(result?.stateHash);
+  }
+
+  function expectNotTrusted(testGraph: ITestGraph, name: string): void {
+    expect(testGraph.results.has(name)).toBe(true);
+    expect(testGraph.results.get(name)?.trustedStateHash).toBeUndefined();
+  }
+
+  it('writes the consumers of skipped results that a plugin verified, in the first iteration of a graph', async () => {
+    // "lib" <- "tool" <- "app"
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool']),
+      verifiedSkips: new Map([
+        ['lib', undefined],
+        ['tool', undefined]
+      ])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['lib', 'tool', 'app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+  });
+
+  it('does not write the consumers of a skipped result that a plugin verified at another state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool']),
+      verifiedSkips: new Map([
+        ['lib', undefined],
+        ['tool', 'another-state-hash']
+      ])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not write the consumers of skipped results that no plugin verified', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('does not trust a verified skipped result whose dependency blocks cache writes', async () => {
+    // "lib" was skipped without verification, so "tool" was verified against outputs that may not match.
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate: new Set(['lib', 'tool']),
+      verifiedSkips: new Map([['tool', undefined]])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+    expectNotTrusted(testGraph, 'tool');
+  });
+
+  it('does not trust a verified skipped result whose dependency blocked cache writes after that dependency runs again', async () => {
+    // "lib" was skipped without verification, so "tool" was verified against outputs that may not match.
+    const upToDate: Set<string> = new Set(['lib', 'tool']);
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate,
+      verifiedSkips: new Map([['tool', undefined]])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+
+    // The daemon invalidates "lib", which runs again at the same state hash. "tool" keeps the result that was
+    // verified against the unverified outputs of "lib", so "app", which was built against it, is not written.
+    upToDate.delete('lib');
+    testGraph.graph.invalidateOperations([testGraph.operations.get('lib')!], 'daemon graph invalidate');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['lib']);
+    expect(testGraph.executions).toEqual(['lib']);
+    expect(testGraph.cacheWrites).toEqual(['lib']);
+  });
+
+  it('does not write the consumers of a verified skipped result whose dependency the request did not select', async () => {
+    const upToDate: Set<string> = new Set();
+    const verifiedSkips: Map<string, string | undefined> = new Map();
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate,
+      verifiedSkips
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['lib', 'tool', 'app']);
+
+    // Edit "tool", which the plugin verifies, then --impacted-by tool: "app" can read the unverified outputs of
+    // "lib" through "tool".
+    testGraph.localHashes.set('tool', 'tool-v2');
+    upToDate.add('tool');
+    verifiedSkips.set('tool', undefined);
+    testGraph.operations.get('lib')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['tool', 'app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual([]);
+  });
+
+  it('keeps trusting skipped results that a plugin verified in later iterations of a long-lived graph', async () => {
+    const upToDate: Set<string> = new Set(['lib', 'tool', 'app']);
+    const testGraph: ITestGraph = await createTestGraphAsync(['lib', 'tool', 'app'], {
+      upToDate,
+      verifiedSkips: new Map([
+        ['lib', undefined],
+        ['tool', undefined],
+        ['app', undefined]
+      ])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual([]);
+
+    // Edit "app": its dependencies are trusted, so its cache entry is written.
+    testGraph.localHashes.set('app', 'app-v2');
+    upToDate.delete('app');
+    await testGraph.executeAsync();
+    expect(testGraph.checks).toEqual(['app']);
+    expect(testGraph.executions).toEqual(['app']);
+    expect(testGraph.cacheWrites).toEqual(['app']);
+  });
+
+  it('reports the state hash of results built while cache writes are allowed', async () => {
+    // "a" <- "b"
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+    expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+    expectTrusted(testGraph, 'a');
+    expectTrusted(testGraph, 'b');
+  });
+
+  it('reports the state hash of results restored from the build cache', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+    testGraph.localHashes.set('a', 'a-v2');
+    await testGraph.executeAsync();
+
+    // Revert "a": both have entries from the first iteration.
+    testGraph.localHashes.set('a', 'a-v1');
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['a', 'b']);
+    expectTrusted(testGraph, 'a');
+    expectTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash for a skipped result that no plugin verified, or for its consumers', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { upToDate: new Set(['a']) });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash for a failed result', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    testGraph.failingNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Failure);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for an incremental result, or for the results built against it', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+
+    // Edit "a", which runs its incremental command.
+    testGraph.localHashes.set('a', 'a-v2');
+    testGraph.incrementalNames.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a:incremental', 'b']);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash when cache writes are disabled', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], { cacheWriteEnabled: false });
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['a', 'b']);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('reports the state hash of a skipped result that a plugin verified at that state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], {
+      upToDate: new Set(['a']),
+      verifiedSkips: new Map([['a', undefined]])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Skipped);
+    expectTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a skipped result that a plugin verified at another state hash', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], {
+      upToDate: new Set(['a']),
+      verifiedSkips: new Map([['a', 'another-state-hash']])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Skipped);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('reports the state hash of a result that a plugin restored while cache writes are allowed', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a'], { pluginFromCache: new Set(['a']) });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual([]);
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.FromCache);
+    expectTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a result that a plugin restored while a dependency blocks cache writes', async () => {
+    // "x" <- "a"
+    const testGraph: ITestGraph = await createTestGraphAsync(['x', 'a'], {
+      upToDate: new Set(['x']),
+      pluginFromCache: new Set(['a'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.FromCache);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a result restored from the build cache while a dependency blocks cache writes', async () => {
+    // "x" <- "b"
+    const cacheEntries: Set<string> = new Set();
+    const firstGraph: ITestGraph = await createTestGraphAsync(['x', 'b'], { cacheEntries });
+    await firstGraph.executeAsync();
+    expect(firstGraph.cacheWrites).toEqual(['x', 'b']);
+
+    // A new graph with the same build cache, in which a plugin skips "x" without verifying it
+    const testGraph: ITestGraph = await createTestGraphAsync(['x', 'b'], {
+      cacheEntries,
+      upToDate: new Set(['x'])
+    });
+    await testGraph.executeAsync();
+    expect(testGraph.cacheRestores).toEqual(['b']);
+    expectNotTrusted(testGraph, 'b');
+  });
+
+  it('does not report a state hash for a result whose build cache entry could not be written', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a']);
+    testGraph.failingWrites.add('a');
+    await testGraph.executeAsync();
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.SuccessWithWarning);
+    expectNotTrusted(testGraph, 'a');
+  });
+
+  it('does not report a state hash for a result retained by a previous iteration, or for its consumers', async () => {
+    const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+    await testGraph.executeAsync();
+
+    // Edit "b", then --only b
+    testGraph.localHashes.set('b', 'b-v2');
+    testGraph.operations.get('a')!.enabled = false;
+    await testGraph.executeAsync();
+    expect(testGraph.executions).toEqual(['b']);
+    expect(testGraph.results.get('a')?.status).toBe(OperationStatus.Skipped);
+    expectNotTrusted(testGraph, 'a');
+    expectNotTrusted(testGraph, 'b');
+  });
+});

From 6521defd6f3d4e83c4d9eab7a5cfe53df3d25ef5 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:08 +0000
Subject: [PATCH 209/265] [rush-lib] Test that a build cache receipt checks the
 archived files and .rush/temp

Swarm integration step 194; original commit 75fd2a1ee3 (merge of swarm/r03-t128-nit1 at cfdc0e45a2).
Scope: task 128 + NIT 1.

Brings 128-nit1 (branch swarm/r03-t128-nit1). Second agent: t06 board 6570, board 6707. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 11 of 15. Gate: ch01 GATE OK board 6977 (tree 60218ceaf1)

Commits folded into this step (2):
- 3f735ef49f Skip a build cache restore when the outputs already match the entry
- cfdc0e45a2 Test that a build cache receipt checks the archived files and .rush/temp

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...cache-output-receipt_2026-09-29-18-00.json |  11 +
 ...-cache-receipt-tests_2026-09-29-19-08.json |  11 +
 .../logic/buildCache/OperationBuildCache.ts   | 110 +++-
 .../logic/buildCache/OutputFolderReceipt.ts   | 443 ++++++++++++++++
 .../test/OperationBuildCacheReceipt.test.ts   | 474 ++++++++++++++++++
 .../test/OutputFolderReceipt.test.ts          | 126 +++++
 6 files changed, 1173 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/build-cache-output-receipt_2026-09-29-18-00.json
 create mode 100644 common/changes/@microsoft/rush/build-cache-receipt-tests_2026-09-29-19-08.json
 create mode 100644 libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts
 create mode 100644 libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
 create mode 100644 libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts

diff --git a/common/changes/@microsoft/rush/build-cache-output-receipt_2026-09-29-18-00.json b/common/changes/@microsoft/rush/build-cache-output-receipt_2026-09-29-18-00.json
new file mode 100644
index 0000000000..7993e3d6fa
--- /dev/null
+++ b/common/changes/@microsoft/rush/build-cache-output-receipt_2026-09-29-18-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Skip restoring an operation's output folders from the local build cache when they already hold exactly the files of the cache entry, as recorded by a receipt in the project's `.rush/temp` folder when the entry was last restored or written.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/build-cache-receipt-tests_2026-09-29-19-08.json b/common/changes/@microsoft/rush/build-cache-receipt-tests_2026-09-29-19-08.json
new file mode 100644
index 0000000000..5e4858c54a
--- /dev/null
+++ b/common/changes/@microsoft/rush/build-cache-receipt-tests_2026-09-29-19-08.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add tests: a build cache receipt is not written when the output folders do not hold the files that were just archived, and there is no receipt when an output folder contains the project's `.rush/temp` folder.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
index bfcd964a6f..09943d5bbd 100644
--- a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
+++ b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
@@ -14,6 +14,7 @@ import type { FileSystemBuildCacheProvider } from './FileSystemBuildCacheProvide
 import { TarExecutable } from '../../utilities/TarExecutable';
 import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
 import type { IBaseOperationExecutionResult } from '../operations/IOperationExecutionResult';
+import { OutputFolderReceipt, type PendingOutputFolderReceipt } from './OutputFolderReceipt';
 
 /**
  * How long to wait to acquire the per-cache-entry download lock (see
@@ -138,8 +139,13 @@ export class OperationBuildCache {
   readonly #cacheId: string | undefined;
   readonly #excludeAppleDoubleFiles: boolean;
   readonly #useDirectFileTransfersForBuildCache: boolean;
+  readonly #receipt: OutputFolderReceipt | undefined;
 
-  private constructor(cacheId: string | undefined, options: IProjectBuildCacheOptions) {
+  private constructor(
+    cacheId: string | undefined,
+    options: IProjectBuildCacheOptions,
+    receipt?: OutputFolderReceipt
+  ) {
     const {
       buildCacheConfiguration: {
         localCacheProvider,
@@ -161,6 +167,7 @@ export class OperationBuildCache {
     this.#cacheId = cacheId;
     this.#excludeAppleDoubleFiles = excludeAppleDoubleFiles && process.platform === 'darwin';
     this.#useDirectFileTransfersForBuildCache = useDirectFileTransfersForBuildCache;
+    this.#receipt = receipt;
   }
 
   public get cacheId(): string | undefined {
@@ -198,7 +205,14 @@ export class OperationBuildCache {
       useDirectFileTransfersForBuildCache
     };
     const cacheId: string | undefined = _getCacheId(buildCacheOptions);
-    return new OperationBuildCache(cacheId, buildCacheOptions);
+    // Only an operation's own build cache has a receipt, because the receipt is kept per operation.
+    const receipt: OutputFolderReceipt | undefined = OutputFolderReceipt.tryCreate({
+      projectFolder: buildCacheOptions.project.projectFolder,
+      projectRushTempFolder: buildCacheOptions.project.projectRushTempFolder,
+      logFilenameIdentifier: executionResult.operation.logFilenameIdentifier,
+      outputFolderNames: outputFolders
+    });
+    return new OperationBuildCache(cacheId, buildCacheOptions, receipt);
   }
 
   public async tryRestoreFromCacheAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean> {
@@ -215,6 +229,18 @@ export class OperationBuildCache {
 
     let localCacheEntryPath: string | undefined =
       await this.#localBuildCacheProvider.tryGetCacheEntryPathByIdAsync(terminal, cacheId);
+    if (
+      localCacheEntryPath &&
+      (await this.#tryReceiptActionAsync(terminal, 'read', (receipt: OutputFolderReceipt) =>
+        receipt.isMatchAsync(cacheId)
+      ))
+    ) {
+      terminal.writeLine('Build cache hit.');
+      terminal.writeVerboseLine(`Cache key: ${cacheId}`);
+      terminal.writeLine('The output folders already match this cache entry; nothing to restore.');
+      return true;
+    }
+
     let cloudCacheHit: boolean = false;
     let updateLocalCacheSuccess: boolean | undefined;
     if (!localCacheEntryPath && this.#cloudBuildCacheProvider) {
@@ -333,6 +359,11 @@ export class OperationBuildCache {
 
     const projectFolderPath: string = this.#project.projectFolder;
 
+    // The receipt describes the output folders, so it must not outlive them, even if the restore fails.
+    await this.#tryReceiptActionAsync(terminal, 'delete', (receipt: OutputFolderReceipt) =>
+      receipt.deleteAsync()
+    );
+
     // Purge output folders
     terminal.writeVerboseLine(`Clearing cached folders: ${this.#projectOutputFolderNames.join(', ')}`);
     await Promise.all(
@@ -353,6 +384,7 @@ export class OperationBuildCache {
       if (tarExitCode === 0) {
         restoreSuccess = true;
         terminal.writeLine('Successfully restored output from the build cache.');
+        await this.#tryWriteRestoredReceiptAsync(terminal, cacheId);
       } else {
         terminal.writeWarningLine(
           'Unable to restore output from the build cache. ' +
@@ -380,6 +412,21 @@ export class OperationBuildCache {
       return false;
     }
 
+    // The stamp comes before the output folders are read, so a change to them while they are archived keeps the
+    // receipt from being written.
+    const pendingReceipt: PendingOutputFolderReceipt | undefined = await this.#tryBeginReceiptAsync(terminal);
+    try {
+      return await this.#trySetCacheEntryWithReceiptAsync(terminal, cacheId, pendingReceipt);
+    } finally {
+      await this.#tryDisposeReceiptAsync(terminal, pendingReceipt);
+    }
+  }
+
+  async #trySetCacheEntryWithReceiptAsync(
+    terminal: ITerminal,
+    cacheId: string,
+    pendingReceipt: PendingOutputFolderReceipt | undefined
+  ): Promise<boolean> {
     const filesToCache: IPathsToCache | undefined = await this._tryCollectPathsToCacheAsync(terminal);
     if (!filesToCache) {
       return false;
@@ -426,6 +473,7 @@ export class OperationBuildCache {
           throw moveError;
         }
         localCacheEntryPath = finalLocalCacheEntryPath;
+        await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId, filesToCache.outputFilePaths);
       } else {
         terminal.writeWarningLine(
           `"tar" exited with code ${tarExitCode} while attempting to create the cache entry. ` +
@@ -578,4 +626,62 @@ export class OperationBuildCache {
   #getTarLogFilePath(cacheId: string, mode: 'tar' | 'untar'): string {
     return path.join(this.#project.projectRushTempFolder, `${cacheId}.${mode}.log`);
   }
+
+  // The stamp comes after the untar, so a change to the output folders after it keeps the receipt from being
+  // written, or from matching later.
+  async #tryWriteRestoredReceiptAsync(terminal: ITerminal, cacheId: string): Promise<void> {
+    const pendingReceipt: PendingOutputFolderReceipt | undefined = await this.#tryBeginReceiptAsync(terminal);
+    try {
+      await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId);
+    } finally {
+      await this.#tryDisposeReceiptAsync(terminal, pendingReceipt);
+    }
+  }
+
+  async #tryBeginReceiptAsync(terminal: ITerminal): Promise<PendingOutputFolderReceipt | undefined> {
+    return await this.#tryReceiptActionAsync(terminal, 'write', (receipt: OutputFolderReceipt) =>
+      receipt.beginAsync()
+    );
+  }
+
+  async #tryCommitReceiptAsync(
+    terminal: ITerminal,
+    pendingReceipt: PendingOutputFolderReceipt | undefined,
+    cacheId: string,
+    archivedFilePaths?: ReadonlyArray<string>
+  ): Promise<void> {
+    if (pendingReceipt) {
+      const reason: string | undefined = await this.#tryReceiptActionAsync(terminal, 'write', () =>
+        pendingReceipt.tryCommitAsync(cacheId, archivedFilePaths)
+      );
+      if (reason) {
+        terminal.writeVerboseLine(`Not writing a build cache receipt: ${reason}.`);
+      }
+    }
+  }
+
+  async #tryDisposeReceiptAsync(
+    terminal: ITerminal,
+    pendingReceipt: PendingOutputFolderReceipt | undefined
+  ): Promise<void> {
+    await this.#tryReceiptActionAsync(terminal, 'clean up', async () => await pendingReceipt?.disposeAsync());
+  }
+
+  // A receipt only saves work, so if it can't be read or written, the build cache works as it would without one.
+  async #tryReceiptActionAsync<T>(
+    terminal: ITerminal,
+    verb: 'read' | 'write' | 'delete' | 'clean up',
+    action: (receipt: OutputFolderReceipt) => Promise<T>
+  ): Promise<T | undefined> {
+    const receipt: OutputFolderReceipt | undefined = this.#receipt;
+    if (!receipt) {
+      return undefined;
+    }
+    try {
+      return await action(receipt);
+    } catch (error) {
+      terminal.writeVerboseLine(`Unable to ${verb} the build cache receipt "${receipt.filePath}": ${error}`);
+      return undefined;
+    }
+  }
 }
diff --git a/libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts b/libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts
new file mode 100644
index 0000000000..7f9c375b52
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/OutputFolderReceipt.ts
@@ -0,0 +1,443 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { createHash, randomBytes, type Hash } from 'node:crypto';
+import * as fs from 'node:fs';
+import { appendFile, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import * as path from 'node:path';
+
+import { Async, FileSystem } from '@rushstack/node-core-library';
+
+const RECEIPT_VERSION: 1 = 1;
+const STAMP_MAX_WAIT_MS: number = 100;
+const STAMP_RETRY_DELAY_MS: number = 1;
+const STAMP_BYTE: Uint8Array = new Uint8Array(1);
+
+/**
+ * A time on the file system clock. A file or folder that last changed before the stamp was taken has modification
+ * and status change times earlier than the stamp. One that changes afterwards gets times at or after the stamp.
+ */
+export interface IOutputFolderStamp {
+  /**
+   * The time, in nanoseconds.
+   */
+  readonly timeNs: bigint;
+  /**
+   * The device of the file that the stamp was taken from. Times on another device may come from another clock.
+   */
+  readonly dev: bigint;
+}
+
+/**
+ * The files and folders in the output folders of an operation.
+ */
+export interface IOutputFolderListing {
+  /**
+   * Covers the path, device, identity and mode of every file and folder, and the size, modification time and status
+   * change time of every file. Any change to a file's content changes its status change time.
+   */
+  readonly digest: string;
+  /**
+   * The project-relative paths of the files, sorted, in the form that the build cache archives them.
+   */
+  readonly files: ReadonlyArray<string>;
+  /**
+   * If defined, a receipt must not certify the listing, and this says why: a restore from the build cache would not
+   * leave the same tree, or (if the listing was given a stamp) something changed at or after the stamp.
+   */
+  readonly uncertifiableReason: string | undefined;
+}
+
+/**
+ * The options for {@link OutputFolderReceipt.tryCreate}.
+ */
+export interface IOutputFolderReceiptOptions {
+  /**
+   * The absolute path of the project folder.
+   */
+  projectFolder: string;
+  /**
+   * The absolute path of the project's `.rush/temp` folder, where the receipt is written.
+   */
+  projectRushTempFolder: string;
+  /**
+   * Identifies the operation, e.g. `_phase_build`.
+   */
+  logFilenameIdentifier: string;
+  /**
+   * The project-relative output folders of the operation, including its metadata folder.
+   */
+  outputFolderNames: ReadonlyArray<string>;
+}
+
+interface IOutputFolderReceiptJson {
+  version: number;
+  cacheId: string;
+  outputFolderNames: string[];
+  listingDigest: string;
+}
+
+/**
+ * Whether a file or folder may have changed at or after the stamp. If it did, a later change within the same clock
+ * tick would not change its times.
+ */
+export function isNewerThanStamp(
+  stats: Pick<fs.BigIntStats, 'dev' | 'mtimeNs' | 'ctimeNs'>,
+  stamp: IOutputFolderStamp
+): boolean {
+  return stats.dev !== stamp.dev || stats.mtimeNs >= stamp.timeNs || stats.ctimeNs >= stamp.timeNs;
+}
+
+/**
+ * Creates a file and takes a stamp from it. It waits until the file system clock has moved past the file's creation,
+ * so every file that changed before this call has times strictly earlier than the stamp, even on a file system with
+ * coarse timestamps.
+ *
+ * @param filePath - The file to create. It must not exist. It is left in place, for the caller to reuse or delete.
+ * @returns The stamp, or `undefined` if the clock didn't move within 100 ms.
+ */
+export async function createStampAsync(filePath: string): Promise<IOutputFolderStamp | undefined> {
+  await writeFile(filePath, '', { flag: 'wx' });
+  const created: fs.BigIntStats = await stat(filePath, { bigint: true });
+  const createdNs: bigint = created.mtimeNs > created.ctimeNs ? created.mtimeNs : created.ctimeNs;
+  const deadline: number = Date.now() + STAMP_MAX_WAIT_MS;
+  do {
+    // Each write closes its handle before the file is stat'ed: on Windows, a file's times are only certain to be
+    // current once the handle that changed it is closed.
+    await appendFile(filePath, STAMP_BYTE);
+    const stats: fs.BigIntStats = await stat(filePath, { bigint: true });
+    const timeNs: bigint = stats.mtimeNs < stats.ctimeNs ? stats.mtimeNs : stats.ctimeNs;
+    if (timeNs > createdNs) {
+      return { timeNs, dev: stats.dev };
+    }
+    await Async.sleepAsync(STAMP_RETRY_DELAY_MS);
+  } while (Date.now() < deadline);
+  return undefined;
+}
+
+/**
+ * Lists the files and folders in the output folders of an operation, in the same order and form as the build cache
+ * collects them. A symbolic link or other special file, a folder with no file under it, or an entry that is deleted
+ * or replaced while it is listed makes the listing uncertifiable.
+ *
+ * @param projectFolder - The absolute path of the project folder
+ * @param outputFolderNames - The project-relative output folders of the operation
+ * @param stamp - If given, an entry that is newer than the stamp makes the listing uncertifiable
+ */
+export async function listOutputFoldersAsync(
+  projectFolder: string,
+  outputFolderNames: ReadonlyArray<string>,
+  stamp?: IOutputFolderStamp
+): Promise<IOutputFolderListing> {
+  const entries: string[] = [];
+  const files: string[] = [];
+  let uncertifiableReason: string | undefined;
+
+  // Adds the entry, and returns whether it's a file or a folder, or undefined if the listing is uncertifiable.
+  function addEntry(relativePath: string, stats: fs.BigIntStats | undefined): 'file' | 'folder' | undefined {
+    if (!stats) {
+      uncertifiableReason = `"${relativePath}" was deleted while it was listed`;
+    } else if (stamp && isNewerThanStamp(stats, stamp)) {
+      uncertifiableReason = `"${relativePath}" changed while the receipt was being written`;
+    } else if (stats.isDirectory()) {
+      entries.push(`d ${relativePath} ${stats.dev} ${stats.ino} ${stats.mode}`);
+      return 'folder';
+    } else if (stats.isFile()) {
+      entries.push(
+        `f ${relativePath} ${stats.dev} ${stats.ino} ${stats.size} ${stats.mode} ${stats.mtimeNs} ${stats.ctimeNs}`
+      );
+      files.push(relativePath);
+      return 'file';
+    } else {
+      uncertifiableReason = `"${relativePath}" is a symbolic link or another special file`;
+    }
+    return undefined;
+  }
+
+  // Lists a folder's children, and returns the number of files under it.
+  async function listFolderAsync(relativePath: string, diskPath: string): Promise<number> {
+    let children: fs.Dirent[];
+    try {
+      children = await readdir(diskPath, { withFileTypes: true });
+    } catch (error) {
+      if (!FileSystem.isNotExistError(error as Error)) {
+        throw error;
+      }
+      uncertifiableReason = `"${relativePath}" was deleted or replaced while it was listed`;
+      return 0;
+    }
+
+    let fileCount: number = 0;
+    for (const { name } of children) {
+      const childRelativePath: string = `${relativePath}/${name}`;
+      const childDiskPath: string = `${diskPath}/${name}`;
+      const childStats: fs.BigIntStats | undefined = fs.lstatSync(childDiskPath, {
+        bigint: true,
+        throwIfNoEntry: false
+      });
+      const kind: 'file' | 'folder' | undefined = addEntry(childRelativePath, childStats);
+      if (kind === 'file') {
+        fileCount++;
+      } else if (kind === 'folder') {
+        fileCount += await listFolderAsync(childRelativePath, childDiskPath);
+      }
+      if (uncertifiableReason) {
+        return fileCount;
+      }
+    }
+
+    if (fileCount === 0) {
+      // The build cache archives only files, so a restore would not recreate this folder.
+      uncertifiableReason = `"${relativePath}" has no files in it`;
+    }
+    return fileCount;
+  }
+
+  for (const folderName of outputFolderNames) {
+    const diskPath: string = `${projectFolder}/${folderName}`;
+    const stats: fs.BigIntStats | undefined = fs.lstatSync(diskPath, { bigint: true, throwIfNoEntry: false });
+    if (!stats) {
+      entries.push(`missing ${folderName}`);
+    } else if (!stats.isDirectory()) {
+      uncertifiableReason = `"${folderName}" is not a folder`;
+    } else if (addEntry(folderName, stats)) {
+      await listFolderAsync(folderName, diskPath);
+    }
+    if (uncertifiableReason) {
+      break;
+    }
+  }
+
+  entries.sort();
+  files.sort();
+  const hash: Hash = createHash('sha1');
+  for (const entry of entries) {
+    // File names can't contain a NUL character, so entries can't run into each other.
+    hash.update(entry);
+    hash.update('\0');
+  }
+
+  return { digest: hash.digest('hex'), files, uncertifiableReason };
+}
+
+interface IPendingOutputFolderReceiptOptions {
+  filePath: string;
+  tempFilePath: string;
+  projectFolder: string;
+  outputFolderNames: ReadonlyArray<string>;
+  stamp: IOutputFolderStamp | undefined;
+}
+
+/**
+ * A receipt that has its stamp and its temporary file, and hasn't been written yet.
+ */
+export class PendingOutputFolderReceipt {
+  readonly #options: IPendingOutputFolderReceiptOptions;
+  #isCommitted: boolean = false;
+
+  public constructor(options: IPendingOutputFolderReceiptOptions) {
+    this.#options = options;
+  }
+
+  /**
+   * Lists the output folders and writes the receipt, unless the listing is uncertifiable or its files are not the
+   * files in the cache entry.
+   *
+   * @param cacheId - The cache entry that the output folders hold
+   * @param archivedFilePaths - The files in the cache entry, if it was just written from the output folders
+   * @returns `undefined` if the receipt was written, or else why not
+   */
+  public async tryCommitAsync(
+    cacheId: string,
+    archivedFilePaths?: ReadonlyArray<string>
+  ): Promise<string | undefined> {
+    const { filePath, tempFilePath, projectFolder, outputFolderNames, stamp } = this.#options;
+    if (!stamp) {
+      return 'the file system clock did not advance';
+    }
+
+    const listing: IOutputFolderListing = await listOutputFoldersAsync(
+      projectFolder,
+      outputFolderNames,
+      stamp
+    );
+    if (listing.uncertifiableReason !== undefined) {
+      return listing.uncertifiableReason;
+    }
+    if (archivedFilePaths && !areArraysEqual(listing.files, archivedFilePaths)) {
+      return 'the output folders do not hold the same files as the cache entry';
+    }
+
+    const receipt: IOutputFolderReceiptJson = {
+      version: RECEIPT_VERSION,
+      cacheId,
+      outputFolderNames: [...outputFolderNames],
+      listingDigest: listing.digest
+    };
+    await writeFile(tempFilePath, JSON.stringify(receipt, undefined, 2));
+    await rename(tempFilePath, filePath);
+    this.#isCommitted = true;
+    return undefined;
+  }
+
+  /**
+   * Deletes the temporary file, unless the receipt was written.
+   */
+  public async disposeAsync(): Promise<void> {
+    if (!this.#isCommitted) {
+      await deleteFileIfExistsAsync(this.#options.tempFilePath);
+    }
+  }
+}
+
+/**
+ * A file in the project's `.rush/temp` folder that says: the output folders of this operation hold exactly the files
+ * of this build cache entry. The build cache writes it after it restores or writes the entry, and trusts it only if
+ * the output folders are listed again with the same result. It never needs to be deleted when the outputs change:
+ * any change to a file or folder that it lists gives that entry a status change time at or after the receipt's stamp,
+ * which is later than every time in the receipt.
+ */
+export class OutputFolderReceipt {
+  /**
+   * The path of the receipt file.
+   */
+  public readonly filePath: string;
+  readonly #projectFolder: string;
+  readonly #outputFolderNames: ReadonlyArray<string>;
+
+  private constructor(filePath: string, projectFolder: string, outputFolderNames: ReadonlyArray<string>) {
+    this.filePath = filePath;
+    this.#projectFolder = projectFolder;
+    this.#outputFolderNames = outputFolderNames;
+  }
+
+  /**
+   * Returns the receipt for an operation's output folders, or `undefined` if it can't have one: if one of its
+   * output folders contains the project's `.rush/temp` folder, or if a folder name is absolute or contains `..`.
+   */
+  public static tryCreate(options: IOutputFolderReceiptOptions): OutputFolderReceipt | undefined {
+    const { projectFolder, projectRushTempFolder, logFilenameIdentifier, outputFolderNames } = options;
+    if (!logFilenameIdentifier) {
+      return undefined;
+    }
+
+    const filePath: string = path.join(
+      projectRushTempFolder,
+      `build-cache-receipt_${logFilenameIdentifier}.json`
+    );
+    for (const folderName of outputFolderNames) {
+      if (path.isAbsolute(folderName) || folderName.split(/[\\/]/).includes('..')) {
+        return undefined;
+      }
+      const folderPath: string = path.resolve(projectFolder, folderName);
+      if (
+        isInFolder(projectRushTempFolder, folderPath) ||
+        folderPath.toLowerCase().startsWith(filePath.toLowerCase())
+      ) {
+        return undefined;
+      }
+    }
+
+    return new OutputFolderReceipt(filePath, projectFolder, [...outputFolderNames]);
+  }
+
+  /**
+   * Whether the receipt says that the output folders hold exactly the given cache entry, and a new listing of the
+   * output folders matches the receipt's.
+   */
+  public async isMatchAsync(cacheId: string): Promise<boolean> {
+    let json: string;
+    try {
+      json = await readFile(this.filePath, 'utf8');
+    } catch (error) {
+      if (FileSystem.isNotExistError(error as Error)) {
+        return false;
+      }
+      throw error;
+    }
+
+    const receipt: Partial<IOutputFolderReceiptJson> | undefined = tryParseReceipt(json);
+    if (
+      receipt?.version !== RECEIPT_VERSION ||
+      receipt.cacheId !== cacheId ||
+      !areArraysEqual(receipt.outputFolderNames, this.#outputFolderNames)
+    ) {
+      return false;
+    }
+
+    const listing: IOutputFolderListing = await listOutputFoldersAsync(
+      this.#projectFolder,
+      this.#outputFolderNames
+    );
+    return listing.uncertifiableReason === undefined && listing.digest === receipt.listingDigest;
+  }
+
+  /**
+   * Deletes the receipt, if it exists.
+   */
+  public async deleteAsync(): Promise<void> {
+    await deleteFileIfExistsAsync(this.filePath);
+  }
+
+  /**
+   * Starts a new receipt by taking its stamp. Call it before the step whose result the receipt will describe starts
+   * to read or write the output folders, and dispose of the result when that step is done.
+   */
+  public async beginAsync(): Promise<PendingOutputFolderReceipt> {
+    await FileSystem.ensureFolderAsync(path.dirname(this.filePath));
+    const tempFilePath: string = `${this.filePath}.${randomBytes(8).toString('hex')}.tmp`;
+    let stamp: IOutputFolderStamp | undefined;
+    try {
+      stamp = await createStampAsync(tempFilePath);
+    } catch (error) {
+      await deleteFileIfExistsAsync(tempFilePath);
+      throw error;
+    }
+    return new PendingOutputFolderReceipt({
+      filePath: this.filePath,
+      tempFilePath,
+      projectFolder: this.#projectFolder,
+      outputFolderNames: this.#outputFolderNames,
+      stamp
+    });
+  }
+}
+
+function tryParseReceipt(json: string): Partial<IOutputFolderReceiptJson> | undefined {
+  try {
+    const value: unknown = JSON.parse(json);
+    return typeof value === 'object' && value !== null
+      ? (value as Partial<IOutputFolderReceiptJson>)
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function areArraysEqual(array1: ReadonlyArray<unknown> | undefined, array2: ReadonlyArray<unknown>): boolean {
+  return (
+    Array.isArray(array1) &&
+    array1.length === array2.length &&
+    array1.every((value: unknown, index: number) => value === array2[index])
+  );
+}
+
+// Whether the path is the folder or inside it. Compared without case, since the file system may ignore it.
+function isInFolder(childPath: string, folderPath: string): boolean {
+  const relativePath: string = path.relative(folderPath.toLowerCase(), childPath.toLowerCase());
+  return !(
+    relativePath === '..' ||
+    relativePath.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativePath)
+  );
+}
+
+async function deleteFileIfExistsAsync(filePath: string): Promise<void> {
+  try {
+    await unlink(filePath);
+  } catch (error) {
+    if (!FileSystem.isNotExistError(error as Error)) {
+      throw error;
+    }
+  }
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
new file mode 100644
index 0000000000..0d78b433fa
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
@@ -0,0 +1,474 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { ICreateArchiveOptions, IUntarOptions, TarExecutable } from '../../../utilities/TarExecutable';
+import type { IBaseOperationExecutionResult } from '../../operations/IOperationExecutionResult';
+import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
+
+const HIT_LINE: string = 'Build cache hit.';
+const SKIP_LINE: string = 'The output folders already match this cache entry; nothing to restore.';
+const METADATA_FOLDER: string = '.rush/temp/operation/_phase_build';
+const RECEIPT: string = '.rush/temp/build-cache-receipt__phase_build.json';
+const CACHE_ID: string = 'acme-hash1';
+
+// A fake cache entry: the project-relative path and content of each file.
+type FakeArchive = Record<string, string>;
+
+const ENTRY: FakeArchive = {
+  'lib/out.txt': 'out',
+  'lib/nested/deep/data.json': '{"a":1}',
+  [`${METADATA_FOLDER}/state.json`]: '{}'
+};
+
+interface ISubjectOptions {
+  stateHash?: string;
+  outputFolderNames?: string[];
+}
+
+interface IRestoreResult {
+  result: boolean;
+  output: string;
+}
+
+describe('OperationBuildCache receipts', () => {
+  let rootFolder: string;
+  let projectFolder: string;
+  let cacheFolder: string;
+  let untarHook: ((outputFolderPath: string) => void) | undefined;
+  let tarHook: ((projectFolderPath: string) => void) | undefined;
+  let untarMock: jest.Mock<Promise<number>, [IUntarOptions]>;
+  let createArchiveMock: jest.Mock<Promise<number>, [ICreateArchiveOptions]>;
+
+  beforeEach(() => {
+    rootFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-build-cache-receipt-'));
+    projectFolder = path.join(rootFolder, 'project');
+    cacheFolder = path.join(rootFolder, 'cache');
+    fs.mkdirSync(projectFolder);
+    fs.mkdirSync(cacheFolder);
+    untarHook = undefined;
+    tarHook = undefined;
+
+    untarMock = jest.fn(async ({ archivePath, outputFolderPath }: IUntarOptions) => {
+      const archive: FakeArchive = JSON.parse(fs.readFileSync(archivePath, 'utf8'));
+      writeFiles(outputFolderPath, archive);
+      untarHook?.(outputFolderPath);
+      return 0;
+    });
+    createArchiveMock = jest.fn(async ({ archivePath, paths, project }: ICreateArchiveOptions) => {
+      const archive: FakeArchive = {};
+      for (const relativePath of paths) {
+        archive[relativePath] = fs.readFileSync(path.join(project.projectFolder, relativePath), 'utf8');
+      }
+      tarHook?.(project.projectFolder);
+      fs.writeFileSync(archivePath, JSON.stringify(archive));
+      return 0;
+    });
+    _setTarUtilityPromiseForTesting(
+      Promise.resolve({
+        tryUntarAsync: untarMock,
+        tryCreateArchiveFromProjectPathsAsync: createArchiveMock
+      } as unknown as TarExecutable)
+    );
+  });
+
+  afterEach(() => {
+    _setTarUtilityPromiseForTesting(undefined);
+    fs.rmSync(rootFolder, { recursive: true, force: true });
+  });
+
+  function writeFiles(folderPath: string, files: FakeArchive): void {
+    for (const [relativePath, content] of Object.entries(files)) {
+      const filePath: string = path.join(folderPath, relativePath);
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, content);
+    }
+  }
+
+  function getProject(): RushConfigurationProject {
+    return {
+      packageName: 'acme',
+      projectFolder,
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp')
+    } as unknown as RushConfigurationProject;
+  }
+
+  function getBuildCacheConfiguration(): BuildCacheConfiguration {
+    return {
+      buildCacheEnabled: true,
+      cacheWriteEnabled: true,
+      getCacheEntryId: ({ projectName, projectStateHash }: IGenerateCacheEntryIdOptions) =>
+        `${projectName}-${projectStateHash}`,
+      localCacheProvider: {
+        getCacheEntryPath: (cacheId: string) => path.join(cacheFolder, cacheId),
+        tryGetCacheEntryPathByIdAsync: async (terminal: ITerminal, cacheId: string) => {
+          const cacheEntryPath: string = path.join(cacheFolder, cacheId);
+          return fs.existsSync(cacheEntryPath) ? cacheEntryPath : undefined;
+        }
+      },
+      cloudCacheProvider: undefined
+    } as unknown as BuildCacheConfiguration;
+  }
+
+  function createSubject(options: ISubjectOptions = {}): OperationBuildCache {
+    const { stateHash = 'hash1', outputFolderNames = ['lib'] } = options;
+    const project: RushConfigurationProject = getProject();
+    const executionResult: IBaseOperationExecutionResult = {
+      operation: {
+        settings: { outputFolderNames },
+        associatedProject: project,
+        associatedPhase: { name: '_phase:build' },
+        logFilenameIdentifier: '_phase_build'
+      },
+      metadataFolderPath: METADATA_FOLDER,
+      getStateHash: () => stateHash
+    } as unknown as IBaseOperationExecutionResult;
+    return OperationBuildCache.forOperation(executionResult, {
+      buildCacheConfiguration: getBuildCacheConfiguration(),
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+  }
+
+  function seedEntry(cacheId: string = CACHE_ID, archive: FakeArchive = ENTRY): void {
+    fs.writeFileSync(path.join(cacheFolder, cacheId), JSON.stringify(archive));
+  }
+
+  async function restoreAsync(
+    subject: OperationBuildCache,
+    specifiedCacheId?: string
+  ): Promise<IRestoreResult> {
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const result: boolean = await subject.tryRestoreFromCacheAsync(
+      new Terminal(terminalProvider),
+      specifiedCacheId
+    );
+    return { result, output: terminalProvider.getOutput() };
+  }
+
+  async function setCacheEntryAsync(subject: OperationBuildCache): Promise<boolean> {
+    return await subject.trySetCacheEntryAsync(new Terminal(new StringBufferTerminalProvider()));
+  }
+
+  // The identity, modification time and status change time of every file in the entry.
+  function statOutputs(): Record<string, bigint[]> {
+    const result: Record<string, bigint[]> = {};
+    for (const relativePath of Object.keys(ENTRY)) {
+      const { ino, mtimeNs, ctimeNs } = fs.statSync(path.join(projectFolder, relativePath), { bigint: true });
+      result[relativePath] = [ino, mtimeNs, ctimeNs];
+    }
+    return result;
+  }
+
+  function hasReceipt(): boolean {
+    return fs.existsSync(path.join(projectFolder, RECEIPT));
+  }
+
+  function getReceiptTempFiles(): string[] {
+    const rushTempFolder: string = path.join(projectFolder, '.rush', 'temp');
+    return fs.existsSync(rushTempFolder)
+      ? fs.readdirSync(rushTempFolder).filter((name: string) => name.endsWith('.tmp'))
+      : [];
+  }
+
+  // Restores the entry, so that the project has a receipt for it.
+  async function restoreWithReceiptAsync(subject: OperationBuildCache): Promise<void> {
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(hasReceipt()).toBe(true);
+  }
+
+  it('T1: skips a second restore of the same entry, and leaves every output as it was', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    const before: Record<string, bigint[]> = statOutputs();
+
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).toContain(HIT_LINE);
+    expect(output).toContain(SKIP_LINE);
+    expect(statOutputs()).toEqual(before);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T2: restores again if an output was rewritten with the same content', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.writeFileSync(path.join(projectFolder, 'lib/out.txt'), ENTRY['lib/out.txt']);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it.each([
+    ['a file was added', () => fs.writeFileSync(path.join(projectFolder, 'lib/added.txt'), 'added')],
+    ['a file was deleted', () => fs.unlinkSync(path.join(projectFolder, 'lib/nested/deep/data.json'))],
+    ['an empty folder was added', () => fs.mkdirSync(path.join(projectFolder, 'lib/empty'))]
+  ])('T3: restores again if %s', async (description: string, change: () => void) => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    change();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T4: restores another entry for another state hash', async () => {
+    seedEntry();
+    seedEntry('acme-hash2');
+    await restoreWithReceiptAsync(createSubject());
+
+    const { result, output } = await restoreAsync(createSubject({ stateHash: 'hash2' }));
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T4: restores another entry for a specified cache id', async () => {
+    seedEntry();
+    seedEntry('acme-other');
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    const { result, output } = await restoreAsync(subject, 'acme-other');
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(JSON.parse(fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8')).cacheId).toBe('acme-other');
+  });
+
+  it('T5: does not skip if the entry is gone from the local cache', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.unlinkSync(path.join(cacheFolder, CACHE_ID));
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(false);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('T6: restores again after a same-size rewrite whose modification time was put back', async () => {
+    const mtime: Date = new Date('2020-01-01T00:00:00Z');
+    untarHook = (outputFolderPath: string) =>
+      fs.utimesSync(path.join(outputFolderPath, 'lib/out.txt'), mtime, mtime);
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+    const filePath: string = path.join(projectFolder, 'lib/out.txt');
+    const before: fs.BigIntStats = fs.statSync(filePath, { bigint: true });
+
+    fs.writeFileSync(filePath, ENTRY['lib/out.txt'].toUpperCase());
+    fs.utimesSync(filePath, mtime, mtime);
+    const after: fs.BigIntStats = fs.statSync(filePath, { bigint: true });
+    expect([after.ino, after.size, after.mode, after.mtimeNs]).toEqual([
+      before.ino,
+      before.size,
+      before.mode,
+      before.mtimeNs
+    ]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(filePath, 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T7: writes no receipt if an output has a time after the stamp', async () => {
+    const future: Date = new Date(Date.now() + 60 * 60 * 1000);
+    untarHook = (outputFolderPath: string) =>
+      fs.utimesSync(path.join(outputFolderPath, 'lib/out.txt'), future, future);
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T8: writes a receipt when it writes an entry, and then skips its restore', async () => {
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(JSON.parse(fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8'))).toEqual({
+      version: 1,
+      cacheId: CACHE_ID,
+      outputFolderNames: ['lib', METADATA_FOLDER],
+      listingDigest: expect.stringMatching(/^[0-9a-f]{40}$/)
+    });
+    expect(getReceiptTempFiles()).toEqual([]);
+    const before: Record<string, bigint[]> = statOutputs();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).not.toHaveBeenCalled();
+    expect(output).toContain(SKIP_LINE);
+    expect(statOutputs()).toEqual(before);
+  });
+
+  it('T9: writes no receipt if an output changes while the entry is written', async () => {
+    tarHook = (projectFolderPath: string) =>
+      fs.appendFileSync(path.join(projectFolderPath, 'lib/out.txt'), '!');
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T10: deletes the receipt before a restore that fails', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.appendFileSync(path.join(projectFolder, 'lib/out.txt'), '!');
+    untarMock.mockResolvedValueOnce(1);
+    const { result } = await restoreAsync(subject);
+
+    expect(result).toBe(false);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(hasReceipt()).toBe(false);
+  });
+
+  it('T11: restores again for the same cache id with other output folders', async () => {
+    seedEntry();
+    await restoreWithReceiptAsync(createSubject());
+
+    const { result, output } = await restoreAsync(createSubject({ outputFolderNames: ['lib', 'dist'] }));
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T12: restores again, without throwing, if the receipt is not valid JSON', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+
+    fs.writeFileSync(path.join(projectFolder, RECEIPT), '{ not JSON');
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T13: writes no receipt if an output folder contains the receipt folder', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject({ outputFolderNames: ['lib', '.rush'] });
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T14: restores again after the operation writes an output', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    await restoreWithReceiptAsync(subject);
+    expect((await restoreAsync(subject)).output).toContain(SKIP_LINE);
+
+    fs.writeFileSync(path.join(projectFolder, 'lib/out.txt'), 'rebuilt');
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T16: writes no receipt for an entry written while an output folder has an empty folder', async () => {
+    writeFiles(projectFolder, ENTRY);
+    fs.mkdirSync(path.join(projectFolder, 'lib/empty'));
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T17: writes no receipt if an output folder has a symbolic link', async () => {
+    untarHook = (outputFolderPath: string) =>
+      fs.symlinkSync(
+        path.join(outputFolderPath, 'lib/nested'),
+        path.join(outputFolderPath, 'lib/link'),
+        'junction'
+      );
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(fs.lstatSync(path.join(projectFolder, 'lib/link')).isSymbolicLink()).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
+  it('T18: writes no receipt for a build cache that is not for an operation', async () => {
+    seedEntry();
+    const subject: OperationBuildCache = OperationBuildCache.getOperationBuildCache({
+      buildCacheConfiguration: getBuildCacheConfiguration(),
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      project: getProject(),
+      phaseName: '_phase:build',
+      projectOutputFolderNames: ['lib', METADATA_FOLDER],
+      operationStateHash: 'hash1',
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
new file mode 100644
index 0000000000..db87620898
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
@@ -0,0 +1,126 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  createStampAsync,
+  isNewerThanStamp,
+  OutputFolderReceipt,
+  type IOutputFolderStamp,
+  type PendingOutputFolderReceipt
+} from '../OutputFolderReceipt';
+
+describe(isNewerThanStamp.name, () => {
+  const stamp: IOutputFolderStamp = { timeNs: 1000n, dev: 7n };
+
+  it('T15: does not count a file whose times are both before the stamp', () => {
+    expect(isNewerThanStamp({ dev: 7n, mtimeNs: 999n, ctimeNs: 999n }, stamp)).toBe(false);
+  });
+
+  it.each([
+    ['its modification time equals the stamp', { dev: 7n, mtimeNs: 1000n, ctimeNs: 999n }],
+    ['its status change time equals the stamp', { dev: 7n, mtimeNs: 999n, ctimeNs: 1000n }],
+    ['its modification time is after the stamp', { dev: 7n, mtimeNs: 1001n, ctimeNs: 999n }],
+    ['it is on another device', { dev: 8n, mtimeNs: 1n, ctimeNs: 1n }]
+  ])(
+    'T15: counts a file if %s',
+    (description: string, stats: { dev: bigint; mtimeNs: bigint; ctimeNs: bigint }) => {
+      expect(isNewerThanStamp(stats, stamp)).toBe(true);
+    }
+  );
+});
+
+describe(createStampAsync.name, () => {
+  let folder: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-folder-receipt-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  it('T19: takes a stamp that is strictly after the times of a file written just before it', async () => {
+    const folderDev: bigint = fs.statSync(folder, { bigint: true }).dev;
+    for (let i: number = 0; i < 20; i++) {
+      const filePath: string = path.join(folder, `file-${i}.txt`);
+      fs.writeFileSync(filePath, `content ${i}`);
+      const stamp: IOutputFolderStamp | undefined = await createStampAsync(
+        path.join(folder, `stamp-${i}.tmp`)
+      );
+      const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+      expect({
+        isDefined: !!stamp,
+        isBeforeStamp: !!stamp && mtimeNs < stamp.timeNs && ctimeNs < stamp.timeNs
+      }).toEqual({
+        isDefined: true,
+        isBeforeStamp: true
+      });
+      expect(stamp?.dev).toBe(folderDev);
+    }
+  });
+
+  it('fails if the file already exists', async () => {
+    const filePath: string = path.join(folder, 'stamp.tmp');
+    fs.writeFileSync(filePath, '');
+    await expect(createStampAsync(filePath)).rejects.toThrow(/EEXIST/);
+  });
+});
+
+describe(OutputFolderReceipt.name, () => {
+  let projectFolder: string;
+  let projectRushTempFolder: string;
+
+  beforeEach(() => {
+    projectFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-output-folder-receipt-'));
+    projectRushTempFolder = path.join(projectFolder, '.rush', 'temp');
+  });
+
+  afterEach(() => {
+    fs.rmSync(projectFolder, { recursive: true, force: true });
+  });
+
+  function tryCreateReceipt(outputFolderNames: string[]): OutputFolderReceipt | undefined {
+    return OutputFolderReceipt.tryCreate({
+      projectFolder,
+      projectRushTempFolder,
+      logFilenameIdentifier: '_phase_build',
+      outputFolderNames
+    });
+  }
+
+  it('T20: writes no receipt if the output folders do not hold the files that were just archived', async () => {
+    fs.mkdirSync(path.join(projectFolder, 'lib'));
+    fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
+    fs.writeFileSync(path.join(projectFolder, 'lib/b.txt'), 'b');
+    const receipt: OutputFolderReceipt = tryCreateReceipt(['lib'])!;
+    const pendingReceipt: PendingOutputFolderReceipt = await receipt.beginAsync();
+
+    const reason: string | undefined = await pendingReceipt.tryCommitAsync('acme-hash1', ['lib/a.txt']);
+
+    expect(reason).toBe('the output folders do not hold the same files as the cache entry');
+    expect(fs.existsSync(receipt.filePath)).toBe(false);
+    expect(fs.readdirSync(projectRushTempFolder)).toEqual([
+      expect.stringMatching(/^build-cache-receipt__phase_build\.json\.[0-9a-f]+\.tmp$/)
+    ]);
+    await pendingReceipt.disposeAsync();
+    expect(fs.readdirSync(projectRushTempFolder)).toEqual([]);
+  });
+
+  it.each([['.rush'], ['.'], ['.rush/temp']])(
+    'T21: has no receipt if the output folder "%s" contains the .rush/temp folder',
+    (folderName: string) => {
+      expect(tryCreateReceipt(['lib', folderName])).toBeUndefined();
+    }
+  );
+
+  it('T21: has a receipt if no output folder contains the .rush/temp folder', () => {
+    expect(tryCreateReceipt(['lib', '.rush/temp/operation/_phase_build'])).toBeInstanceOf(
+      OutputFolderReceipt
+    );
+  });
+});

From 2e98204083d62ebe2bd013bffdb360bc8aab600d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:08 +0000
Subject: [PATCH 210/265] [rush-daemon] Keep the lock holder's command when it
 exits

Swarm integration step 195; original commit 103bf2ec75 (merge of swarm/r04-t306-e2f at 76ad7be8c9).
Scope: task 306.

Brings 306 (branch swarm/r04-t306-e2f). Second agent: t07 board 6624, board 6627. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 12 of 15. Gate: ch01 GATE OK board 6977 (tree 013f639c5f)

Commits folded into this step (2):
- 1320c7daa0 [rush-cli-client] Do not write another lock-wait line when the lock holder exits
- 76ad7be8c9 [rush-daemon] Keep the lock holder's command when it exits

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/nativeLockWaitNotice.ts               | 13 ++++++++-
 .../src/test/nativeLockWaitNotice.test.ts     | 29 +++++++++++++++++++
 ...306-lock-holder-exit_2026-09-29-17-45.json | 11 +++++++
 ...306-lock-holder-exit_2026-09-29-17-55.json | 11 +++++++
 .../src/WorkspaceRequestAdmission.ts          | 14 +++++++--
 .../src/test/NativeLockAdmission.test.ts      | 20 +++++++++++++
 6 files changed, 95 insertions(+), 3 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t306-lock-holder-exit_2026-09-29-17-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t306-lock-holder-exit_2026-09-29-17-55.json

diff --git a/apps/rush-cli-client/src/nativeLockWaitNotice.ts b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
index a299436557..20db793eac 100644
--- a/apps/rush-cli-client/src/nativeLockWaitNotice.ts
+++ b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
@@ -96,7 +96,7 @@ export function withNativeLockWaitNotices(
       // This ends a wait for a daemon restart, if the request waited for one; it waits for the lock instead.
       handlers.onRequestProgress();
       const key: string = `${nativeLockHolder.pid}:${nativeLockHolder.command}`;
-      if (wait?.key === key) return;
+      if (wait?.key === key || isSameProcessWithoutCommand(wait?.holder, nativeLockHolder)) return;
       const state: INativeLockWaitState = (wait ??= {
         startedAtMs: now(),
         holder: nativeLockHolder,
@@ -123,3 +123,14 @@ export function withNativeLockWaitNotices(
     }
   };
 }
+
+/**
+ * Whether `found` is the process that `named` names, but without its command. A process's command can no longer be
+ * read once it exits, yet it holds the lock until it is reaped, so the daemon can report it once more that way.
+ */
+function isSameProcessWithoutCommand(
+  named: IDaemonNativeLockHolder | undefined,
+  found: IDaemonNativeLockHolder
+): boolean {
+  return found.pid !== undefined && found.command === undefined && named?.pid === found.pid;
+}
diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
index 35db00474c..8cf914f1fa 100644
--- a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -113,6 +113,21 @@ describe(withNativeLockWaitNotices.name, () => {
       ]);
       expect(calls.join('')).not.toContain('admission failed');
     });
+
+    it('keeps naming the command of a process whose command can no longer be read, as once it exits', async () => {
+      const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY: false, rushx });
+      await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+      advance(1000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { pid: INSTALL.pid });
+      advance(NATIVE_LOCK_WAIT_REPEAT_MS - 1000);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { pid: UPDATE.pid });
+      handlers.dispose();
+      expect(calls).toEqual([
+        `stderr: ${client}: waiting for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 10s for ${INSTALL_LOCK}.\n`,
+        `stderr: ${client}: still waiting after 10s for another Rush process (PID 52) to release this repository's lock.\n`
+      ]);
+    });
   });
 
   it.each([
@@ -198,4 +213,18 @@ describe(withNativeLockWaitNotices.name, () => {
     await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
     expect(calls).toEqual([`announce: waiting for ${INSTALL_LOCK}`, `announce: waiting for ${UPDATE_LOCK}`]);
   });
+
+  it('announces a process once when its command can no longer be read, and names a command read later', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: INSTALL.pid });
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: UPDATE.pid });
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    handlers.dispose();
+    expect(calls).toEqual([
+      `announce: waiting for ${INSTALL_LOCK}`,
+      "announce: waiting for another Rush process (PID 52) to release this repository's lock",
+      `announce: waiting for ${UPDATE_LOCK}`
+    ]);
+  });
 });
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t306-lock-holder-exit_2026-09-29-17-45.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t306-lock-holder-exit_2026-09-29-17-45.json
new file mode 100644
index 0000000000..39c58b171a
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t306-lock-holder-exit_2026-09-29-17-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "While a request waits for another Rush process to release the repository's lock, do not write another line without the process's command when that process exits.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t306-lock-holder-exit_2026-09-29-17-55.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t306-lock-holder-exit_2026-09-29-17-55.json
new file mode 100644
index 0000000000..cdad3932cb
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t306-lock-holder-exit_2026-09-29-17-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "While a request waits for another Rush process to release the repository's lock, keep naming that process's command once it exits, in the queue position and in the wait-timeout failure, since it holds the lock until it is reaped.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 09d38629df..6ae863b8ed 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -97,6 +97,17 @@ function formatSeconds(ms: number): string {
   return `${Math.round(ms / 100) / 10}s`;
 }
 
+/**
+ * Whether `found`, what can be found out now about the process that holds native Rush's repository lock, replaces
+ * `known`, the process that the client was told about. A process that cannot be identified, for instance once the one
+ * that was found exits, does not replace it. Nor does the same process without its command: a process's command can
+ * no longer be read once it exits, yet it holds the lock until it is reaped.
+ */
+function replacesNativeLockHolder(known: IDaemonNativeLockHolder, found: IDaemonNativeLockHolder): boolean {
+  if (found.pid === undefined) return known.pid === undefined;
+  return found.pid !== known.pid || found.command !== undefined;
+}
+
 /** Describes time that did not count against a request's wait timeout, unless it rounds to nothing. */
 function formatUncountedTime(pausedMs: number, spentWhile: string): string {
   const seconds: string = formatSeconds(pausedMs);
@@ -815,8 +826,7 @@ export class RequestAdmissionController {
           : Math.min(NATIVE_LOCK_RETRY_MS, Math.max(0, budgetMs - (Date.now() - startMs)));
       },
       update: (foundHolder: IDaemonNativeLockHolder): RequestSchedulerError | undefined => {
-        // A process that cannot be identified, for instance once the one that was found exits, does not replace it.
-        if (foundHolder.pid !== undefined || holder.pid === undefined) holder = foundHolder;
+        if (replacesNativeLockHolder(holder, foundHolder)) holder = foundHolder;
         const error: RequestSchedulerError | undefined = this.#getNativeLockWaitError(
           formatNativeLockHolder(holder),
           Date.now() - startMs,
diff --git a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
index 10e6ea7bcc..606d09516a 100644
--- a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
@@ -255,6 +255,26 @@ describe(`${RequestAdmissionController.name} and native Rush's repository lock`,
     expect(messages).toEqual([waitMessage(HOLDER), waitMessage({ pid: 5151 })]);
   });
 
+  it('keeps the command of a holder that exits, since it holds the lock until it is reaped', async () => {
+    const { controller, messages } = createController({ waitTimeoutMs: 1000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    // Its command can no longer be read.
+    probe.hold({ pid: HOLDER.pid });
+    await jest.advanceTimersByTimeAsync(1000 - POLL_MS);
+    expect({ messages, error: acquisition.error }).toMatchObject({
+      messages: [waitMessage(HOLDER)],
+      error: {
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message: expect.stringContaining(
+          "another Rush process (PID 4242: rush install) to release this repository's"
+        )
+      }
+    });
+  });
+
   it('names another Rush process when it cannot tell which process holds the lock', async () => {
     probe.hold({});
     const { controller, messages } = createController({ waitTimeoutMs: POLL_MS });

From 6ee80419fa62fadc9220bdb75424eacb14ad2b47 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:08 +0000
Subject: [PATCH 211/265] [rush-client-core] Fix the note on a restarted
 daemon's descriptors

Swarm integration step 196; original commit 23ae5f9f33 (merge of swarm/r06-t299-e2f at af7ff177de).
Refs: task 299.
Scope: task 299.

Brings 299 (branch swarm/r06-t299-e2f). Second agent: t07 board 6547, board 6548. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 13 of 15. Gate: ch01 GATE OK board 6977 (tree 71168d5c10)

Commits folded into this step (3):
- d7d3f44d2a [rush-client-core] Close inherited descriptors before starting the daemon (task 299)
- 7952ac60de [rush-client-core] Note that an earlier release's daemon keeps what it inherited (task 299)
- af7ff177de [rush-client-core] Fix the note on a restarted daemon's descriptors (task 299)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...nherited-descriptors_2026-09-29-16-50.json |  11 +
 libraries/rush-client-core/README.md          |  10 +-
 .../src/InheritedFileDescriptors.ts           |  77 +++++++
 .../rush-client-core/src/runDaemonStartup.ts  |   9 +
 .../src/test/InheritedFileDescriptors.test.ts | 198 ++++++++++++++++++
 ...tOrStartDaemonInheritedDescriptors.test.ts | 133 ++++++++++++
 .../src/test/fixtures/inheritedDescriptors.ts |  21 ++
 7 files changed, 458 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t299-inherited-descriptors_2026-09-29-16-50.json
 create mode 100644 libraries/rush-client-core/src/InheritedFileDescriptors.ts
 create mode 100644 libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts
 create mode 100644 libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts
 create mode 100644 libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts

diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t299-inherited-descriptors_2026-09-29-16-50.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t299-inherited-descriptors_2026-09-29-16-50.json
new file mode 100644
index 0000000000..4d35b23971
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t299-inherited-descriptors_2026-09-29-16-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "On Linux, the daemon startup helper now closes the file descriptors that it inherited without close-on-exec before it starts the daemon. The daemon no longer holds, for as long as it runs, a pipe or lock file that the client's caller left open, such as the pipe of a bash process substitution (`rush-client build 2> >(sed …)`), whose reader waited for the daemon to exit. A daemon that a client from an earlier release started still holds what it inherited. If the daemon is from an earlier release too, so does the successor that it starts when it restarts itself.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 3542634cad..abd6ef98b7 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -120,7 +120,15 @@ reclaims only an absent/dead owner, spawns a detached startup helper, and reserv
 handing it the explicit command. The helper spawns the launcher without
 a shell and retains that reservation until the daemon completes hello/ping readiness,
 independently of whether the requesting client survives. It tries to connect every 50 ms, so it
-releases the reservation within about 50 ms of the daemon's readiness. It waits for a live launcher for
+releases the reservation within about 50 ms of the daemon's readiness. On Linux, the helper first
+closes the file descriptors that it inherited without close-on-exec, other than its IPC channel, so
+that the daemon does not hold them for as long as it runs: for example the pipe of a bash process
+substitution (`rush-client build 2> >(sed …)`), whose reader would otherwise wait for the daemon to
+exit, or a lock file that a script opened. On other platforms it closes nothing. A daemon that a
+client from an earlier release started still holds what it inherited. If the daemon is from an
+earlier release too, so does the successor that it starts when it restarts itself (after an
+environment change, for example), because it starts that successor through its own helper. The
+helper waits for a live launcher for
 at least 120 seconds, even when the requesting client's own deadline is shorter, so a slow
 first start (for example while Windows scans newly installed files) is still handed off to
 later clients instead of leaving an abandoned reservation. The starting client holds the start
diff --git a/libraries/rush-client-core/src/InheritedFileDescriptors.ts b/libraries/rush-client-core/src/InheritedFileDescriptors.ts
new file mode 100644
index 0000000000..365e4e9528
--- /dev/null
+++ b/libraries/rush-client-core/src/InheritedFileDescriptors.ts
@@ -0,0 +1,77 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+/** The open file flag that Linux reports in /proc/self/fdinfo for a descriptor marked close-on-exec. */
+const LINUX_O_CLOEXEC: number = 0o2000000;
+
+/**
+ * Lists the file descriptors above stderr that a program this process starts would inherit: those not marked
+ * close-on-exec, other than the IPC channel.
+ *
+ * @remarks
+ * Node marks descriptors 0 through 15 close-on-exec when it starts, and then each later one up to the first that
+ * is closed. A descriptor after that gap stays inheritable, for example the pipe of a bash process substitution
+ * (`2> >(sed …)`, usually descriptor 63) or a lock file that a script opened with `exec 200>file`.
+ *
+ * Returns `undefined` when it cannot tell: on any platform but Linux, or when /proc/self/fdinfo does not show
+ * close-on-exec on a descriptor that Node opened (Node opens every descriptor close-on-exec).
+ */
+export function listInheritedFileDescriptors(): number[] | undefined {
+  if (process.platform !== 'linux') return undefined;
+  const probe: number = fs.openSync('/dev/null', 'r');
+  try {
+    const probeFlags: number | undefined = readFileDescriptorFlags(probe);
+    if (probeFlags === undefined || !isCloseOnExec(probeFlags)) return undefined;
+  } finally {
+    fs.closeSync(probe);
+  }
+  // @types/node does not declare the descriptor of the IPC channel.
+  const channelFd: number | undefined = (process.channel as { fd?: number } | undefined)?.fd;
+  const inherited: number[] = [];
+  for (const entry of fs.readdirSync('/proc/self/fd')) {
+    const fd: number = Number(entry);
+    if (fd <= 2 || fd === channelFd) continue;
+    const flags: number | undefined = readFileDescriptorFlags(fd);
+    // For example the descriptor that listed the folder, which is closed by now.
+    if (flags === undefined) continue;
+    if (!isCloseOnExec(flags)) inherited.push(fd);
+  }
+  return inherited;
+}
+
+/**
+ * Closes the file descriptors that {@link listInheritedFileDescriptors} lists, so that a program this process
+ * starts does not inherit them, and returns them. Returns `undefined`, and closes nothing, where they cannot be
+ * listed.
+ */
+export function closeInheritedFileDescriptors(): number[] | undefined {
+  const inherited: number[] | undefined = listInheritedFileDescriptors();
+  for (const fd of inherited ?? []) {
+    try {
+      fs.closeSync(fd);
+    } catch {
+      // Linux releases a descriptor even when closing it reports an error.
+    }
+  }
+  return inherited;
+}
+
+/** Whether the flags include O_CLOEXEC, which is a single bit. */
+function isCloseOnExec(flags: number): boolean {
+  return Math.floor(flags / LINUX_O_CLOEXEC) % 2 === 1;
+}
+
+/** Reads the open file flags of a descriptor of this process, or `undefined` if it is not open. */
+function readFileDescriptorFlags(fd: number): number | undefined {
+  let fdinfo: string;
+  try {
+    fdinfo = fs.readFileSync(`/proc/self/fdinfo/${fd}`, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+    throw error;
+  }
+  const match: RegExpMatchArray | null = fdinfo.match(/^flags:\s*([0-7]+)$/m);
+  return match ? parseInt(match[1], 8) : undefined;
+}
diff --git a/libraries/rush-client-core/src/runDaemonStartup.ts b/libraries/rush-client-core/src/runDaemonStartup.ts
index e71da1359f..6c141218b1 100644
--- a/libraries/rush-client-core/src/runDaemonStartup.ts
+++ b/libraries/rush-client-core/src/runDaemonStartup.ts
@@ -2,6 +2,15 @@
 // See LICENSE in the project root for license information.
 
 import { runDaemonStartupAsync, type IDaemonStartupOptions } from './DaemonStartup';
+import { closeInheritedFileDescriptors } from './InheritedFileDescriptors';
+
+// The daemon would otherwise hold, for as long as it runs, what the client's caller left open without
+// close-on-exec: for example a pipe that a shell waits to reach end-of-file, or a lock file.
+try {
+  closeInheritedFileDescriptors();
+} catch (error) {
+  process.stderr.write(`Unable to close inherited file descriptors: ${(error as Error).stack}\n`);
+}
 
 process.once('message', (options: IDaemonStartupOptions) => {
   process.channel?.unref();
diff --git a/libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts b/libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts
new file mode 100644
index 0000000000..31b9e5679a
--- /dev/null
+++ b/libraries/rush-client-core/src/test/InheritedFileDescriptors.test.ts
@@ -0,0 +1,198 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess, type StdioOptions } from 'node:child_process';
+import { once } from 'node:events';
+import fs from 'node:fs';
+import type { Socket } from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { listInheritedFileDescriptors } from '../InheritedFileDescriptors';
+import { removeTestFolderAsync } from './TestProcessExit';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+const LINUX_O_CLOEXEC: number = 0o2000000;
+// Each after a gap in the child's table, like the pipe of bash's `2> >(…)`, so Node does not mark it close-on-exec.
+const CHANNEL_FD: number = 40;
+const PIPE_FD: number = 63;
+const FILE_FD: number = 200;
+
+/** Whether each descriptor of a process is marked close-on-exec, from its /proc folder. */
+function readCloseOnExec(pid: number): Map<number, boolean> {
+  const descriptors: Map<number, boolean> = new Map();
+  for (const entry of fs.readdirSync(`/proc/${pid}/fd`)) {
+    let fdinfo: string;
+    try {
+      fdinfo = fs.readFileSync(`/proc/${pid}/fdinfo/${entry}`, 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    const flags: number = parseInt(/^flags:\s*([0-7]+)$/m.exec(fdinfo)![1], 8);
+    descriptors.set(Number(entry), Math.floor(flags / LINUX_O_CLOEXEC) % 2 === 1);
+  }
+  return descriptors;
+}
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(10);
+  }
+}
+
+/** The child's next message. Fails at once if the child exits first, for example because it closed its channel. */
+function receiveAsync<T>(child: ChildProcess): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const onExit = (code: number | null, signal: NodeJS.Signals | null): void =>
+      reject(new Error(`The child exited (${code ?? signal}) before it answered.`));
+    child.once('exit', onExit);
+    child.once('message', (message: T) => {
+      child.off('exit', onExit);
+      resolve(message);
+    });
+  });
+}
+
+describe('inherited file descriptors', () => {
+  let folder: string;
+  let running: { child: ChildProcess; closed: Promise<unknown[]> } | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-inherited-fds-'));
+    running = undefined;
+  });
+
+  afterEach(async () => {
+    if (running) {
+      // Without its channel, the child has nothing left to wait for and exits.
+      if (running.child.connected) running.child.disconnect();
+      await running.closed;
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  linuxIt(
+    'closes the descriptors that a started program would inherit, and keeps its own and its IPC channel',
+    async () => {
+      const stdio: (string | number)[] = new Array(FILE_FD + 1).fill('ignore');
+      stdio[2] = 'pipe';
+      stdio[CHANNEL_FD] = 'ipc';
+      stdio[PIPE_FD] = 'pipe';
+      const lockFd: number = fs.openSync(path.join(folder, 'lock'), 'w');
+      let child: ChildProcess;
+      try {
+        stdio[FILE_FD] = lockFd;
+        child = spawn(
+          process.execPath,
+          [path.join(__dirname, 'fixtures/inheritedDescriptors.js'), path.join(folder, 'own')],
+          { stdio: stdio as StdioOptions }
+        );
+      } finally {
+        fs.closeSync(lockFd);
+      }
+      running = { child, closed: once(child, 'close') };
+      let stderr: string = '';
+      child.stderr!.on('data', (chunk: Buffer) => {
+        stderr += chunk.toString();
+      });
+      const pipe: Socket = child.stdio[PIPE_FD] as Socket;
+      let pipeEnded: boolean = false;
+      pipe.once('end', () => {
+        pipeEnded = true;
+      });
+      pipe.resume();
+
+      const { ownFd } = await receiveAsync<{ ownFd: number }>(child);
+      const before: Map<number, boolean> = readCloseOnExec(child.pid!);
+      expect([CHANNEL_FD, PIPE_FD, FILE_FD, ownFd].map((fd) => before.get(fd))).toEqual([
+        false,
+        false,
+        false,
+        true
+      ]);
+
+      child.send('close');
+      const { closed } = await receiveAsync<{ closed: number[] }>(child);
+      expect(closed).toEqual(expect.arrayContaining([PIPE_FD, FILE_FD]));
+      // Nothing that was close-on-exec.
+      expect(closed.filter((fd) => before.get(fd) !== false)).toEqual([]);
+      const after: Map<number, boolean> = readCloseOnExec(child.pid!);
+      expect([...after].filter(([fd, closeOnExec]) => fd > 2 && fd !== CHANNEL_FD && !closeOnExec)).toEqual(
+        []
+      );
+      expect([after.has(CHANNEL_FD), after.has(ownFd)]).toEqual([true, true]);
+      // The pipe's reader sees end-of-file while the child still runs.
+      await waitUntilAsync(() => pipeEnded, 'the pipe ends');
+      expect(child.exitCode).toBeNull();
+
+      child.send('exit');
+      const [code] = await running.closed;
+      expect({ code, stderr, own: fs.readFileSync(path.join(folder, 'own'), 'utf8') }).toEqual({
+        code: 0,
+        stderr: '',
+        own: 'still open'
+      });
+    },
+    20000
+  );
+
+  describe('in this process', () => {
+    const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+    const channel: PropertyDescriptor | undefined = Object.getOwnPropertyDescriptor(process, 'channel');
+
+    beforeEach(() => {
+      // Jest gives the tests a copy of the process, whose copy of the IPC channel cannot report its descriptor.
+      Object.defineProperty(process, 'channel', { value: undefined, configurable: true });
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+      Object.defineProperty(process, 'platform', platform);
+      if (channel) {
+        Object.defineProperty(process, 'channel', channel);
+      } else {
+        delete (process as { channel?: unknown }).channel;
+      }
+    });
+
+    linuxIt('lists them where /proc/self/fdinfo reports close-on-exec, as Linux does', () => {
+      expect(listInheritedFileDescriptors()).toEqual(expect.any(Array));
+    });
+
+    it('lists nothing on a platform other than Linux', () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      const openSync: jest.SpyInstance = jest.spyOn(fs, 'openSync');
+      expect(listInheritedFileDescriptors()).toBeUndefined();
+      expect(openSync).not.toHaveBeenCalled();
+    });
+
+    // Where /proc is missing or reports something else, it would otherwise close descriptors that Node uses.
+    const fdinfoReaders: [string, (fdinfoPath: string) => string][] = [
+      ['has no close-on-exec flag for a descriptor that Node opened', () => 'pos:\t0\nflags:\t0100002\n'],
+      ['has no flags', () => 'pos:\t0\n'],
+      [
+        'is missing',
+        (fdinfoPath: string) => {
+          throw Object.assign(new Error(`ENOENT: no such file or directory, open '${fdinfoPath}'`), {
+            code: 'ENOENT'
+          });
+        }
+      ]
+    ];
+    linuxIt.each(fdinfoReaders)('lists nothing when /proc/self/fdinfo %s', (kind, readFdinfo) => {
+      const readFileSync: typeof fs.readFileSync = fs.readFileSync;
+      jest
+        .spyOn(fs, 'readFileSync')
+        .mockImplementation(((filePath: string, options: BufferEncoding) =>
+          String(filePath).startsWith('/proc/self/fdinfo/')
+            ? readFdinfo(String(filePath))
+            : readFileSync(filePath, options)) as typeof fs.readFileSync);
+      expect(listInheritedFileDescriptors()).toBeUndefined();
+    });
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts
new file mode 100644
index 0000000000..18d1374c30
--- /dev/null
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonInheritedDescriptors.test.ts
@@ -0,0 +1,133 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn, type ChildProcess, type StdioOptions } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Socket } from 'node:net';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+const linuxIt: typeof it = process.platform === 'linux' ? it : it.skip;
+
+// Where bash puts the pipe of `2> >(…)`, and where a script might open its lock file (`exec 200>lockfile`).
+const PIPE_FD: number = 63;
+const FILE_FD: number = 200;
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+async function waitUntilAsync(condition: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 5000;
+  while (!condition()) {
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting until ${description}.`);
+    await delayAsync(10);
+  }
+}
+
+describe('detached daemon startup from a client that inherited descriptors without close-on-exec', () => {
+  let folder: string;
+  let options: IConnectOrStartDaemonOptions;
+  let starter: { exited: Promise<unknown[]>; pipe: Socket } | undefined;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-inherited-'));
+    const paths: IDaemonPaths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+    starter = undefined;
+  });
+
+  afterEach(async () => {
+    if (starter) {
+      await starter.exited;
+      starter.pipe.destroy();
+    }
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(fs.readFileSync(path.join(folder, 'parents'), 'utf8').trim().split('\n'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  }, 15000);
+
+  linuxIt(
+    'starts a daemon that holds neither a pipe nor a file of the client, so the pipe ends with the client',
+    async () => {
+      const stdio: (string | number)[] = new Array(FILE_FD + 1).fill('ignore');
+      stdio[2] = 'pipe';
+      stdio[PIPE_FD] = 'pipe';
+      const lockFd: number = fs.openSync(path.join(folder, 'lock'), 'w');
+      let child: ChildProcess;
+      try {
+        stdio[FILE_FD] = lockFd;
+        child = spawn(
+          process.execPath,
+          [path.join(__dirname, 'fixtures/starter.js'), JSON.stringify(options)],
+          { stdio: stdio as StdioOptions }
+        );
+      } finally {
+        fs.closeSync(lockFd);
+      }
+      const pipe: Socket = child.stdio[PIPE_FD] as Socket;
+      starter = { exited: once(child, 'exit'), pipe };
+      let pipeEnded: boolean = false;
+      pipe.once('end', () => {
+        pipeEnded = true;
+      });
+      pipe.resume();
+      let stderr: string = '';
+      child.stderr!.on('data', (chunk: Buffer) => {
+        stderr += chunk.toString();
+      });
+      const stderrEnded: Promise<unknown[]> = once(child.stderr!, 'end');
+
+      const [code] = await starter.exited;
+      await stderrEnded;
+      expect({ code, stderr }).toEqual({ code: 0, stderr: '' });
+      const daemonPid: number = Number(fs.readFileSync(path.join(folder, 'starts'), 'utf8'));
+      const daemonFds: string[] = fs.readdirSync(`/proc/${daemonPid}/fd`);
+      expect(daemonFds).toContain('1');
+      expect(daemonFds.filter((fd) => fd === String(PIPE_FD) || fd === String(FILE_FD))).toEqual([]);
+      // Its reader sees end-of-file while the daemon still runs.
+      await waitUntilAsync(() => pipeEnded, 'the pipe ends');
+      expect(fs.existsSync(path.join(folder, `stopped-${daemonPid}`))).toBe(false);
+    },
+    30000
+  );
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts b/libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts
new file mode 100644
index 0000000000..e4e234a38c
--- /dev/null
+++ b/libraries/rush-client-core/src/test/fixtures/inheritedDescriptors.ts
@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { closeInheritedFileDescriptors } from '../../InheritedFileDescriptors';
+
+// Node opens it close-on-exec, like every descriptor that it opens itself.
+const ownFd: number = fs.openSync(process.argv[2], 'w');
+
+process.once('message', () => {
+  const closed: number[] | undefined = closeInheritedFileDescriptors();
+  fs.writeSync(ownFd, 'still open');
+  process.send!({ closed });
+  // The test inspects this process before it lets it exit.
+  process.once('message', () => {
+    fs.closeSync(ownFd);
+    process.disconnect();
+  });
+});
+process.send!({ ownFd });

From 2a34bd593c5fc7f7bff0edf73d0311653fcc6b11 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:09 +0000
Subject: [PATCH 212/265] [rush-daemon-protocol] Send a queued request to a new
 daemon once if rushd exits first

Swarm integration step 197; original commit 2c271c9660 (merge of o07/t145-queued-request-resend at 8057e41829).
Scope: task 145.

Brings 145 (branch o07/t145-queued-request-resend). Second agent: t05 board 6718, board 6719. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 14 of 15. Gate: ch01 GATE OK board 6977 (tree ebea9196f8)

Commits folded into this step (1):
- 8057e41829 Send a queued request to a new daemon once if rushd exits first

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  10 +
 .../src/daemonRestartNotice.ts                |  18 +-
 .../src/test/daemonRestartNotice.test.ts      |  56 +++
 ...ueued-request-resend_2026-09-29-17-10.json |  11 +
 ...ueued-request-resend_2026-09-29-17-10.json |  11 +
 ...ueued-request-resend_2026-09-29-17-10.json |  11 +
 ...ueued-request-resend_2026-09-29-17-10.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   5 +-
 .../reviews/api/rush-daemon-protocol.api.md   |  17 +-
 common/reviews/api/rush-daemon.api.md         |   2 +
 libraries/rush-client-core/README.md          |  19 +
 .../rush-client-core/src/DaemonClient.ts      |  73 +++-
 .../rush-client-core/src/DaemonClientError.ts |   9 +-
 .../rush-client-core/src/DaemonDisconnect.ts  |  35 +-
 .../src/executeWithDaemonRestart.ts           | 207 +++++++--
 .../src/test/DaemonClient.test.ts             | 192 +++++++++
 .../src/test/DaemonDisconnect.test.ts         |  24 ++
 .../src/test/QueuedRequestResend.test.ts      | 290 +++++++++++++
 .../src/test/fixtures/daemon.ts               |  35 +-
 libraries/rush-daemon-protocol/README.md      |   5 +
 .../src/ControlMessageValidation.ts           |   1 +
 .../src/DaemonClientCaps.ts                   |   5 +
 .../src/DaemonControlKinds.ts                 |   2 +
 .../src/DaemonControlMessage.ts               |   4 +-
 .../src/DaemonProtocolVersion.ts              |   9 +-
 .../src/DaemonRequestControl.ts               |  10 +
 .../RequestLifecycleCapabilityValidation.ts   |  10 +
 .../src/SubscribeControlValidation.ts         |   4 +-
 libraries/rush-daemon-protocol/src/index.ts   |   6 +-
 .../src/test/RequestStartedControl.test.ts    |  48 +++
 libraries/rush-daemon/README.md               |   7 +
 .../rush-daemon/src/DaemonControlSession.ts   |   6 +
 .../src/DaemonRequestDispatcher.ts            |  16 +-
 .../src/DaemonWireRequestClient.ts            |  30 +-
 .../rush-daemon/src/PhasedRequestClient.ts    |  12 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |   9 +-
 .../rush-daemon/src/RequestStartedNotice.ts   |  19 +
 .../src/WorkspaceRequestLifecycle.ts          |  13 +-
 .../src/test/DaemonRequestStarted.test.ts     | 403 ++++++++++++++++++
 .../test/DaemonRequestWireTestUtilities.ts    |   6 +-
 40 files changed, 1562 insertions(+), 99 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/queued-request-resend_2026-09-29-17-10.json
 create mode 100644 common/changes/@rushstack/rush-client-core/queued-request-resend_2026-09-29-17-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/queued-request-resend_2026-09-29-17-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon/queued-request-resend_2026-09-29-17-10.json
 create mode 100644 libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts
 create mode 100644 libraries/rush-daemon/src/RequestStartedNotice.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index bdd8a0fe8d..41fbabd300 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -428,6 +428,16 @@ needed SIGKILL. While agent mode shows its progress lines, the line is written a
 If rushd still runs, it says that only the connection closed. Ctrl+C and an orderly `daemon stop`
 or `daemon restart` still end a command as cancelled (exit code 130).
 
+A command that was still waiting in rushd's queue when rushd exited has not run, if rushd says
+when it starts a command (protocol 0.14) and had not said so. The client then sends it to a new
+daemon once, within its `--wait-timeout`, and before that daemon starts it prints one line on
+stderr (or above the agent progress rows): `rush-client: rushd (PID <pid>) exited while the
+command was queued; sending the command to a new daemon.` If the new daemon does not start,
+the command fails after that line with the startup error. If the connection to the new daemon
+is lost too, the diagnostic begins "Daemon disconnected before delivering a result; the command
+was already sent to a new daemon once." Commands that waited together reach the new daemon in
+the order in which their clients noticed that rushd exited, not in their order in the queue.
+
 While a command runs, the client checks that rushd still responds. Once rushd has sent nothing
 for 10 s, the client pings it. Once it has sent nothing for 30 s, not even the reply, for example
 because its process was stopped, the client says so at once and says what that means:
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index 8daf35cb83..bd374e3f80 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -38,15 +38,19 @@ function formatRestartedCause(reason: DaemonRestartReason | undefined): string |
 }
 
 /**
- * Returns the line that tells the user why the daemon restarted during a command, or `undefined` for a restart
- * that needs no explanation.
+ * Returns the line that tells the user why the daemon restarted during a command, or why the command is sent to a
+ * new daemon, or `undefined` for a restart that needs no explanation.
  */
 export function formatDaemonRestartNotice(notice: IDaemonRestartNotice, rushx: boolean): string | undefined {
-  const { reason, successorPid } = notice;
+  const { reason, successorPid, exitedPid } = notice;
+  const pid: string = successorPid === undefined ? '' : ` (PID ${successorPid})`;
+  const prefix: string = rushx ? 'rushx-client' : 'rush-client';
+  if (exitedPid !== undefined) {
+    return `${prefix}: rushd (PID ${exitedPid}) exited while the command was queued; sending the command to a new daemon${pid}.`;
+  }
   const cause: string | undefined = formatRestartedCause(reason);
   if (cause === undefined) return undefined;
-  const pid: string = successorPid === undefined ? '' : ` (PID ${successorPid})`;
-  return `${rushx ? 'rushx-client' : 'rush-client'}: ${cause}; restarted the daemon${pid}.`;
+  return `${prefix}: ${cause}; restarted the daemon${pid}.`;
 }
 
 /**
@@ -298,7 +302,9 @@ export function createDaemonRequestNoticeHandlers(
       writtenWaitReason = undefined;
       if (!isRestartCauseWritten(waitReason, notice.reason)) await writeRestartNoticeAsync(notice);
       // The phase still says that the request waits for the previous daemon.
-      if (agentRenderer && showedRestartWait) agentRenderer.setPhase(RESUBMITTED_PHASE);
+      if (agentRenderer && (showedRestartWait || notice.exitedPid !== undefined)) {
+        agentRenderer.setPhase(RESUBMITTED_PHASE);
+      }
       showedRestartWait = false;
     },
     onQueuePositionAsync: async (
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index b4b67a7341..a598e96cc4 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -78,6 +78,22 @@ describe(formatDaemonRestartNotice.name, () => {
     );
   });
 
+  it('names the daemon that exited while the command was queued, and the new daemon if it is known', () => {
+    expect(
+      formatDaemonRestartNotice(
+        { restart: 1, reason: undefined, successorPid: undefined, exitedPid: 41 },
+        false
+      )
+    ).toBe(
+      'rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.'
+    );
+    expect(
+      formatDaemonRestartNotice({ restart: 2, reason: NEWER_REASON, successorPid: 42, exitedPid: 41 }, true)
+    ).toBe(
+      'rushx-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon (PID 42).'
+    );
+  });
+
   it('says nothing about restarts that need no explanation', () => {
     expect(
       formatDaemonRestartNotice({ restart: 1, reason: undefined, successorPid: 42 }, false)
@@ -521,6 +537,34 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       }
     });
 
+    it('says that the command is sent to a new daemon after rushd exited, even during a restart wait', async () => {
+      const resent: string =
+        `stderr: ${client}: rushd (PID 41) exited while the command was queued; sending the command to a new ` +
+        'daemon.\n';
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(1, REMOVED, {});
+        await handlers.onRestartAsync({
+          restart: 1,
+          reason: undefined,
+          successorPid: undefined,
+          exitedPid: 41
+        });
+        await handlers.onQueuePositionAsync(1, LOCKFILE, {});
+        advance(RESTART_WAIT_REPEAT_MS * 2);
+        handlers.dispose();
+        expect(calls.slice(0, 3)).toEqual([
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon (PID 41) then restarts, because ` +
+            'its installation at /snapshots/s9 was removed.\n',
+          resent,
+          `stderr: ${client}: waiting for 1 running request to finish; the daemon then restarts, because ` +
+            'common/config/rush/pnpm-lock.yaml changed.\n'
+        ]);
+        // The wait for the exited daemon ended with the notice, and the new daemon's PID is not known yet.
+        expect(calls.slice(3).some((call: string) => call.includes('(PID 41)'))).toBe(false);
+      }
+    });
+
     it('gives no restart notice when a wait line since the last restart gave its cause (task 222)', async () => {
       const cases: [DaemonRestartReason, IDaemonRestartWaitDetails, DaemonRestartReason][] = [
         [
@@ -685,6 +729,18 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     }
   });
 
+  it('gives the agent a note and the resubmitted phase when the command is sent to a new daemon', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1);
+    await handlers.onRestartAsync({ restart: 1, reason: undefined, successorPid: undefined, exitedPid: 41 });
+    handlers.dispose();
+    expect(calls).toEqual([
+      'position: 1',
+      'note: rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.',
+      `phase: ${RESUBMITTED_PHASE}`
+    ]);
+  });
+
   it('keeps the agent phase after a restart that the request did not wait for', async () => {
     const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
     await handlers.onQueuePositionAsync(1);
diff --git a/common/changes/@rushstack/rush-cli-client/queued-request-resend_2026-09-29-17-10.json b/common/changes/@rushstack/rush-cli-client/queued-request-resend_2026-09-29-17-10.json
new file mode 100644
index 0000000000..e8edc553a0
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/queued-request-resend_2026-09-29-17-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Say so when a command is sent to a new daemon because rushd exited while the command was queued.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/queued-request-resend_2026-09-29-17-10.json b/common/changes/@rushstack/rush-client-core/queued-request-resend_2026-09-29-17-10.json
new file mode 100644
index 0000000000..08fd307999
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/queued-request-resend_2026-09-29-17-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Send a request to a new daemon once when the daemon exits while the request is still queued, and pass the exited daemon's PID to `onRestartAsync` as `exitedPid`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/queued-request-resend_2026-09-29-17-10.json b/common/changes/@rushstack/rush-daemon-protocol/queued-request-resend_2026-09-29-17-10.json
new file mode 100644
index 0000000000..76aee1826e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/queued-request-resend_2026-09-29-17-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Advertise protocol minor 14 (`DAEMON_REQUEST_STARTED_PROTOCOL_MINOR`): a daemon tells a client that subscribes with `supportsRequestStarted` when its request has left every queue, with the new `requestStarted` control message.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/queued-request-resend_2026-09-29-17-10.json b/common/changes/@rushstack/rush-daemon/queued-request-resend_2026-09-29-17-10.json
new file mode 100644
index 0000000000..987b061fe9
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/queued-request-resend_2026-09-29-17-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Tell a client that subscribed with `supportsRequestStarted` when its request has left every queue, before anything from the request is applied, and go on only once that notice is written.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 006e23201f..27f061be22 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -43,6 +43,7 @@ export class DaemonClient {
     static connectAsync(options: IDaemonClientConnectOptions): Promise<DaemonClient>;
     executeAsync(options: IDaemonClientExecuteOptions): Promise<DaemonClientOutcome>;
     get protocolVersion(): IDaemonProtocolVersion;
+    get queuedWithoutStarting(): boolean;
     shutdownAsync(timeoutMs?: number): Promise<IDaemonShutdownAckMessage['payload']>;
     get status(): Promise<IDaemonPongMessage['payload']>;
 }
@@ -171,7 +172,8 @@ export interface IDaemonClientExecuteOptions {
     // (undocumented)
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
     readonly onInputAdmittedAsync?: () => Promise<void>;
-    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails, nativeLockHolder?: IDaemonNativeLockHolder) => Promise<void>;
+    readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails,
+    nativeLockHolder?: IDaemonNativeLockHolder) => Promise<void>;
     // (undocumented)
     readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
     // (undocumented)
@@ -194,6 +196,7 @@ export interface IDaemonClientLivenessOptions {
 
 // @beta
 export interface IDaemonRestartNotice {
+    readonly exitedPid?: number;
     readonly reason: DaemonRestartReason | undefined;
     readonly restart: number;
     readonly successorPid: number | undefined;
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 9456141c90..bb2cbbf892 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -27,6 +27,7 @@ export const DAEMON_CONTROL_MESSAGE_KINDS: readonly [
 'terminalPolicy',
 'queuePosition',
 'requestStart',
+'requestStarted',
 'requestCancel',
 'requestRejected',
 'requestResult',
@@ -82,6 +83,9 @@ export const DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR: number;
 // @beta
 export const DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR: number;
 
+// @beta
+export const DAEMON_REQUEST_STARTED_PROTOCOL_MINOR: number;
+
 // @beta
 export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number;
 
@@ -95,7 +99,7 @@ export const DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR: number;
 export type DaemonCommandOutcome = 'success' | 'success-with-warning' | 'failure' | 'aborted';
 
 // @beta
-export type DaemonControlMessage = IDaemonHelloMessage | IDaemonHelloAckMessage | IDaemonSubscribeMessage | IDaemonUnsubscribeMessage | IDaemonPingMessage | IDaemonPongMessage | IDaemonShutdownMessage | IDaemonShutdownAckMessage | IDaemonErrorMessage | IDaemonSetRawModeMessage | IDaemonStdinEndMessage | IDaemonStdinReadyMessage | IDaemonRawModeChangedMessage | IDaemonTerminalPolicyMessage | IDaemonRequestQueuePositionMessage | IDaemonRequestStartMessage | IDaemonRequestCancelMessage | IDaemonRequestRejectedMessage | IDaemonRequestResultMessage;
+export type DaemonControlMessage = IDaemonHelloMessage | IDaemonHelloAckMessage | IDaemonSubscribeMessage | IDaemonUnsubscribeMessage | IDaemonPingMessage | IDaemonPongMessage | IDaemonShutdownMessage | IDaemonShutdownAckMessage | IDaemonErrorMessage | IDaemonSetRawModeMessage | IDaemonStdinEndMessage | IDaemonStdinReadyMessage | IDaemonRawModeChangedMessage | IDaemonTerminalPolicyMessage | IDaemonRequestQueuePositionMessage | IDaemonRequestStartMessage | IDaemonRequestStartedMessage | IDaemonRequestCancelMessage | IDaemonRequestRejectedMessage | IDaemonRequestResultMessage;
 
 // @beta
 export type DaemonControlMessageKind = (typeof DAEMON_CONTROL_MESSAGE_KINDS)[number];
@@ -242,6 +246,7 @@ export interface IDaemonClientCaps {
     readonly supportsInteractiveIO?: boolean;
     readonly supportsRequestAdmission?: boolean;
     readonly supportsRequestLifecycle?: boolean;
+    readonly supportsRequestStarted?: boolean;
     readonly verbosity?: DaemonVerbosity;
 }
 
@@ -613,6 +618,16 @@ export interface IDaemonRequestResultMessage {
     readonly payload: IDaemonCommandResult | IDaemonPhasedRequestResult;
 }
 
+// @beta
+export interface IDaemonRequestStartedMessage {
+    // (undocumented)
+    readonly kind: 'requestStarted';
+    // (undocumented)
+    readonly payload: {
+        readonly requestId: string;
+    };
+}
+
 // @beta
 export interface IDaemonRequestStartMessage {
     // (undocumented)
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 71a7a43134..8abf5d7957 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -190,6 +190,7 @@ export interface IDaemonRequestDispatchClient {
     writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
     // (undocumented)
     writeQueuePositionAsync(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+    writeRequestStartedAsync?(): Promise<void>;
     // (undocumented)
     writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void>;
     // (undocumented)
@@ -415,6 +416,7 @@ export interface IPhasedRequestClient {
     writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
     writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
     writeQueuePositionAsync?(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+    writeRequestStartedAsync?(): Promise<void>;
     writeResultAsync(result: IDaemonPhasedRequestResult): Promise<void>;
     writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
 }
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index abd6ef98b7..7c2f669c50 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -78,6 +78,21 @@ to a ready successor, the optional `onRestartAsync` callback gets the restart nu
 reason (`undefined` when the daemon gave none, as older daemons do) and the successor's PID,
 before the request is resubmitted.
 
+If the daemon exits while the request waits in its queue, the request has not run when
+`DaemonClient.queuedWithoutStarting` is true: the daemon reported a queue position and says
+when it starts a request (protocol 0.14), but has not said so, no output, event, terminal
+control or stdin admission arrived, and the client did not ask it to cancel. Before the
+client fails the request for a closed connection, it handles the frames that it had received
+by then, so a `requestStarted` that arrived just before the daemon exited still counts.
+`executeWithDaemonRestartAsync()` then sends the request to a new daemon, started as
+`connectOrStartDaemonAsync()` would after the exited daemon is reclaimed (see below), once per
+call and within the request's admission deadline. Before that daemon starts, `onRestartAsync`
+gets the exited daemon's PID as `exitedPid`, with no `successorPid`. The request is not sent
+again if the connection cannot start a daemon or the admission deadline has passed. Each
+client that waited sends its own request, so the requests reach the new daemon in the order
+in which their clients noticed the exit, not in the order of the exited daemon's queue; two
+requests that each needed the workspace to themselves may run in the other order.
+
 A connection lost before the result stays a `disconnected` `DaemonClientError`. Its message
 starts with "Daemon disconnected before delivering a result; the command was not retried."
 and `executeWithDaemonRestartAsync()` appends what happened to the daemon that served the
@@ -103,6 +118,10 @@ subreaper, reaps it at once, and one that has not by then may never do so. If th
 times out, the message is the same, and the next daemon start reclaims the daemon instead.
 If the process still runs, the message says that only the connection closed. After the abort
 signal fires, the error is unchanged, so the caller reports the cancellation.
+A request that waited in the queue of the daemon that exited is instead sent to a new daemon
+(see above). If it cannot be, the message says that the daemon exited while the command was
+queued. If the connection to the new daemon is lost too, the message starts with "Daemon
+disconnected before delivering a result; the command was already sent to a new daemon once."
 
 `connectOrStartDaemonAsync()` accepts an **explicit, version-selected** executable,
 arguments, environment and cwd. It does not discover or install a Rush version.
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index f624d27f3a..ca9a62a1f7 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -10,6 +10,7 @@ import {
   DAEMON_LIFECYCLE_PROTOCOL_MINOR,
   DAEMON_PROTOCOL_VERSION,
   DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR,
   DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR,
   DaemonFrameType,
   DaemonProtocolError,
@@ -219,6 +220,9 @@ export class DaemonClient {
   #observedExecution: boolean = false;
   #inputEnded: boolean = false;
   #supportsInputLifecycle: boolean = false;
+  #supportsRequestStarted: boolean = false;
+  #queued: boolean = false;
+  #requestStarted: boolean = false;
   #inputAcknowledgement: IDeferred<void> | undefined;
   #inputTail: Promise<void> = Promise.resolve();
   #rawModeChanged: boolean = false;
@@ -230,6 +234,8 @@ export class DaemonClient {
   /** When the client last received a frame, or finished handling one, as a `performance.now()` value. */
   #lastHeardAtMs: number = 0;
   #frameInFlight: boolean = false;
+  /** The handling of the last frame that the transport handed over. */
+  #frameHandled: Promise<void> = Promise.resolve();
   #livenessTimer: ReturnType<typeof setInterval> | undefined;
   #pingPending: boolean = false;
   #silenceReported: boolean = false;
@@ -237,21 +243,24 @@ export class DaemonClient {
   private constructor(connection: DaemonFrameConnection, options: IDaemonClientConnectOptions) {
     this.#connection = connection;
     this.#connectOptions = options;
-    connection.onFrame((frame) => this.#receiveFrameAsync(frame));
+    connection.onFrame((frame) => (this.#frameHandled = this.#receiveFrameAsync(frame)));
     connection.onClosed((error) => {
       if (this.#shutdown && this.#shutdownAcknowledged && !error) {
         this.#shutdown.resolve(undefined);
         return;
       }
-      this.#fail(
+      const lost: Error =
         error ??
-          new DaemonClientError(
-            'disconnected',
-            this.#shutdown
-              ? 'Daemon disconnected before acknowledging shutdown.'
-              : DAEMON_DISCONNECTED_MESSAGE
-          )
-      );
+        new DaemonClientError(
+          'disconnected',
+          this.#shutdown ? 'Daemon disconnected before acknowledging shutdown.' : DAEMON_DISCONNECTED_MESSAGE
+        );
+      if (!this.queuedWithoutStarting) {
+        this.#fail(lost);
+        return;
+      }
+      // A frame that arrived before the close may still say that the request left the queue.
+      void this.#settleReceivedFramesAsync().then(() => this.#fail(lost));
     });
   }
 
@@ -302,6 +311,25 @@ export class DaemonClient {
     return this.#peerProtocolVersion!;
   }
 
+  /**
+   * Whether the request waited in the daemon's queue and is known not to have started: the daemon reported a queue
+   * position and says when it starts a request (protocol 0.14), but has not said so, no output, event, terminal
+   * control or stdin admission arrived, and the client did not ask it to cancel. If the daemon exits then, the
+   * request has not run.
+   */
+  public get queuedWithoutStarting(): boolean {
+    return (
+      this.#supportsRequestStarted &&
+      this.#queued &&
+      !this.#requestStarted &&
+      !this.#observedExecution &&
+      !this.#inputAdmitted &&
+      !this.#inputStarted &&
+      !this.#rawModeChanged &&
+      !this.#cancelSent
+    );
+  }
+
   /**
    * Requests shutdown on a fresh connection and waits for acknowledgement followed by EOF.
    * @remarks This confirms acceptance and connection closure, not successful workspace cleanup.
@@ -455,6 +483,22 @@ export class DaemonClient {
     }
   }
 
+  /**
+   * Waits until the client has handled the frames that it received before its connection closed, or until one of
+   * them shows that the request left the queue. The transport hands decoded frames over without waiting for I/O, so
+   * once no frame is in flight after a turn of the event loop, none is left.
+   */
+  async #settleReceivedFramesAsync(): Promise<void> {
+    while (this.queuedWithoutStarting) {
+      if (this.#frameInFlight) {
+        await this.#frameHandled.catch(() => undefined);
+      } else {
+        await new Promise<void>((resolve) => setImmediate(resolve));
+        if (!this.#frameInFlight) return;
+      }
+    }
+  }
+
   #startLivenessCheck(options: IDaemonClientLivenessOptions | undefined): void {
     if (!options || this.protocolVersion.minor < DAEMON_KEEPALIVE_PROTOCOL_MINOR) return;
     const pingAfterMs: number = options.pingAfterMs ?? DEFAULT_PING_AFTER_MS;
@@ -543,6 +587,7 @@ export class DaemonClient {
       this.#supportsInputLifecycle =
         this.#peerProtocolVersion.minor >= DAEMON_INPUT_LIFECYCLE_PROTOCOL_MINOR &&
         this.#connectOptions.capabilities?.supportsInputLifecycle !== false;
+      this.#supportsRequestStarted = this.#peerProtocolVersion.minor >= DAEMON_REQUEST_STARTED_PROTOCOL_MINOR;
       await this.#sendControlAsync({
         kind: 'subscribe',
         payload: {
@@ -551,7 +596,8 @@ export class DaemonClient {
           supportsInteractiveIO: true,
           supportsInputLifecycle: this.#supportsInputLifecycle,
           supportsRequestAdmission: true,
-          supportsRequestLifecycle: true
+          supportsRequestLifecycle: true,
+          supportsRequestStarted: this.#supportsRequestStarted
         }
       });
       await this.#sendControlAsync({
@@ -637,7 +683,14 @@ export class DaemonClient {
           throw new DaemonProtocolError('malformedControlMessage', 'Unexpected stdin write acknowledgement.');
         }
         return;
+      case 'requestStarted':
+        if (!this.#supportsRequestStarted) {
+          throw new DaemonProtocolError('malformedControlMessage', 'Unexpected request start notice.');
+        }
+        this.#requestStarted = true;
+        return;
       case 'queuePosition': {
+        this.#queued = true;
         const { position, restartReason, scriptCount, restartsForAnotherRequest, nativeLockHolder } =
           message.payload;
         await execution.onQueuePositionAsync?.(
diff --git a/libraries/rush-client-core/src/DaemonClientError.ts b/libraries/rush-client-core/src/DaemonClientError.ts
index 3b32286fa8..b08b984e32 100644
--- a/libraries/rush-client-core/src/DaemonClientError.ts
+++ b/libraries/rush-client-core/src/DaemonClientError.ts
@@ -8,7 +8,14 @@ export type DaemonClientErrorCode = 'timeout' | 'versionMismatch' | 'disconnecte
 export const DAEMON_DISCONNECTED_MESSAGE: string =
   'Daemon disconnected before delivering a result; the command was not retried.';
 
-/** An actionable client failure. Never replay a request following a disconnect. @beta */
+/**
+ * Replaces {@link DAEMON_DISCONNECTED_MESSAGE} when the command was sent to a new daemon because the previous one
+ * exited while the command was queued.
+ */
+export const DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE: string =
+  'Daemon disconnected before delivering a result; the command was already sent to a new daemon once.';
+
+/** An actionable client failure. A request is sent again after a disconnect only when it never ran. @beta */
 export class DaemonClientError extends Error {
   public readonly code: DaemonClientErrorCode;
 
diff --git a/libraries/rush-client-core/src/DaemonDisconnect.ts b/libraries/rush-client-core/src/DaemonDisconnect.ts
index 0d8ac725b6..b41e50db8b 100644
--- a/libraries/rush-client-core/src/DaemonDisconnect.ts
+++ b/libraries/rush-client-core/src/DaemonDisconnect.ts
@@ -65,10 +65,26 @@ export async function observeServingDaemonAsync(
   };
 }
 
+/**
+ * The explanation of a connection lost while the request waited in the queue of a daemon that then exited, so that
+ * the request has not run. `executeWithDaemonRestartAsync` sends such a request to a new daemon once.
+ */
+export class DaemonExitedWhileQueuedError extends DaemonClientError {
+  /** The process ID of the daemon that exited. */
+  public readonly daemonPid: number;
+
+  public constructor(daemonPid: number, message: string, options?: ErrorOptions) {
+    super('disconnected', message, options);
+    this.daemonPid = daemonPid;
+  }
+}
+
 /**
  * Explains a connection lost before a request's result by what happened to the daemon process: whether it
- * exited, the fatal error its launcher log recorded, and how to recover. The request is never replayed.
- * Other errors are returned unchanged.
+ * exited, the fatal error its launcher log recorded, and how to recover. This never sends the request again.
+ * Other errors are returned unchanged. With `queuedWithoutStarting` (see `DaemonClient.queuedWithoutStarting`),
+ * the explanation of a daemon that exited says that the command was queued, and is a
+ * {@link DaemonExitedWhileQueuedError}.
  * @remarks If the daemon exited, this first reclaims it as the next daemon start would, so that running the
  * command again, with or without the daemon, cannot race the operations the daemon left running.
  */
@@ -76,7 +92,8 @@ export async function explainLostConnectionAsync(
   error: unknown,
   daemon: IServingDaemon | undefined,
   request: IDaemonRequestEnvelope,
-  reclaimOptions?: IDaemonReclaimOptions
+  reclaimOptions?: IDaemonReclaimOptions,
+  queuedWithoutStarting: boolean = false
 ): Promise<unknown> {
   if (!daemon || !isConnectionLoss(error)) return error;
   const exited: boolean | undefined = await waitForExitAsync(daemon);
@@ -92,14 +109,14 @@ export async function explainLostConnectionAsync(
   await reclaimExitedDaemonAsync(daemon, reclaimOptions);
   const client: string = request.invocationKind === 'rushx' ? 'rushx-client' : 'rush-client';
   const message: string =
-    `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${daemon.pid}) exited while it ran the command; ` +
+    `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${daemon.pid}) exited while ` +
+    `${queuedWithoutStarting ? 'the command was queued' : 'it ran the command'}; ` +
     `"rush-client daemon logs" ${loggedError ? 'shows' : 'may show'} why. Run the command again; ` +
     `if the daemon exits again, run the command with "${client} --no-daemon".`;
-  return new DaemonClientError(
-    'disconnected',
-    loggedError ? `${message}\nThe daemon log reports: ${loggedError}` : message,
-    { cause: error }
-  );
+  const explanation: string = loggedError ? `${message}\nThe daemon log reports: ${loggedError}` : message;
+  return queuedWithoutStarting
+    ? new DaemonExitedWhileQueuedError(daemon.pid, explanation, { cause: error })
+    : new DaemonClientError('disconnected', explanation, { cause: error });
 }
 
 /**
diff --git a/libraries/rush-client-core/src/executeWithDaemonRestart.ts b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
index 86fb9b2a60..4ccd8e0c2d 100644
--- a/libraries/rush-client-core/src/executeWithDaemonRestart.ts
+++ b/libraries/rush-client-core/src/executeWithDaemonRestart.ts
@@ -6,15 +6,25 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import {
   DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR,
   type DaemonRestartReason,
-  type IDaemonRequestAdmissionOptions
+  type IDaemonRequestAdmissionOptions,
+  type IDaemonRequestEnvelope
 } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile, type IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
-import { connectToPlannedSuccessorAsync, type IConnectOrStartDaemonOptions } from './connectOrStartDaemon';
+import {
+  connectOrStartDaemonAsync,
+  connectToPlannedSuccessorAsync,
+  type IConnectOrStartDaemonOptions
+} from './connectOrStartDaemon';
 import { captureDaemonRequest } from './captureDaemonRequest';
 import type { DaemonClient, DaemonClientOutcome, IDaemonClientExecuteOptions } from './DaemonClient';
-import { DaemonClientError } from './DaemonClientError';
 import {
+  DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE,
+  DAEMON_DISCONNECTED_MESSAGE,
+  DaemonClientError
+} from './DaemonClientError';
+import {
+  DaemonExitedWhileQueuedError,
   explainLostConnectionAsync,
   observeServingDaemonAsync,
   type IServingDaemon
@@ -31,16 +41,23 @@ const RETRY_JITTER_MAX_MS: number = 1000;
 const DEFAULT_STARTUP_TIMEOUT_MS: number = 15000;
 
 /**
- * A daemon restart that a request followed.
+ * A new daemon that a request followed: a successor that a daemon restart started, or, with `exitedPid`, a new daemon
+ * that the request is sent to because the previous one exited while the request waited in its queue. That notice
+ * comes before the new daemon starts, so that the wait for it is not silent.
  * @beta
  */
 export interface IDaemonRestartNotice {
-  /** 1 for the first restart that the request followed. */
+  /** 1 for the first new daemon that the request followed. */
   readonly restart: number;
-  /** Why the previous daemon asked for the restart; `undefined` when it did not say. */
+  /** Why the previous daemon asked for the restart; `undefined` when it did not say, or with `exitedPid`. */
   readonly reason: DaemonRestartReason | undefined;
-  /** The process ID of the daemon that the request is sent to next. */
+  /** The process ID of the daemon that the request is sent to next; `undefined` with `exitedPid`. */
   readonly successorPid: number | undefined;
+  /**
+   * Set when the previous daemon exited while the request waited in its queue, before it started the request: that
+   * daemon's process ID.
+   */
+  readonly exitedPid?: number;
 }
 
 /**
@@ -48,7 +65,7 @@ export interface IDaemonRestartNotice {
  * @beta
  */
 export interface IExecuteWithDaemonRestartOptions extends IDaemonClientExecuteOptions {
-  /** Called after a successor daemon is ready, before the request is sent to it. */
+  /** Called after a new daemon is ready, before the request is sent to it. */
   readonly onRestartAsync?: (notice: IDaemonRestartNotice) => Promise<void>;
 }
 
@@ -69,14 +86,19 @@ export class DaemonRestartFailedError extends DaemonClientError {
 }
 
 /**
- * Executes on a ready client, retrying only for a typed pre-execution restart.
- * Preserves the original request, callbacks and unread input; never retries connection loss.
+ * Executes on a ready client, retrying for a typed pre-execution restart, and once for a daemon that exited while
+ * the request waited in its queue.
+ * Preserves the original request, callbacks and unread input; retries no other connection loss.
  * Restarts are retried with jittered backoff inside the request's explicit admission deadline, if any (a
  * client-default timeout applies to each daemon separately); once the retries or the deadline are exhausted,
  * a `fallback` outcome lets the caller run in-process instead.
  * The connection options must select the request's expected daemon and startup environment.
  * A connection lost before the result is reported as a `disconnected` error that says whether the daemon
  * process exited, what its launcher log recorded and how to recover, unless the request was aborted first.
+ * If the daemon exited while the request waited in its queue and had not started it (see
+ * {@link DaemonClient.queuedWithoutStarting}), the request is instead sent to a new daemon, started as
+ * `connectOrStartDaemonAsync` would. Before that daemon starts, `onRestartAsync` gets the exited daemon's PID as
+ * `exitedPid`. That happens once per call, and within an explicit admission deadline.
  * @beta
  */
 export async function executeWithDaemonRestartAsync(
@@ -97,10 +119,46 @@ export async function executeWithDaemonRestartAsync(
   const waitTimeoutMs: number | undefined = admission?.waitTimeoutIsDefault
     ? undefined
     : admission?.waitTimeoutMs;
+  const attempts: IRequestAttempts = {
+    connection,
+    execution: { ...execution, abortSignal },
+    onRestartAsync,
+    getRemainingMs: () =>
+      waitTimeoutMs === undefined ? undefined : waitTimeoutMs - (Date.now() - startedAt),
+    followed: 0
+  };
+  try {
+    return await followRestartsAsync(client, execution.request, attempts);
+  } catch (error) {
+    if (!(error instanceof DaemonExitedWhileQueuedError)) throw error;
+    return await resendAfterExitAsync(error, attempts);
+  }
+}
+
+/** One call's state across the daemons that its request is sent to. */
+interface IRequestAttempts {
+  readonly connection: IConnectOrStartDaemonOptions;
+  /** The execution options, with an abort signal that also observes the connection's. */
+  readonly execution: IDaemonClientExecuteOptions;
+  readonly onRestartAsync: IExecuteWithDaemonRestartOptions['onRestartAsync'];
+  /** The time left before the explicit admission deadline, or `undefined` without one. */
+  readonly getRemainingMs: () => number | undefined;
+  /** How many new daemons the request has followed. */
+  followed: number;
+}
+
+/** Sends `request` to `client`, then to each successor that a typed pre-execution restart names. */
+async function followRestartsAsync(
+  client: DaemonClient,
+  request: IDaemonRequestEnvelope,
+  attempts: IRequestAttempts
+): Promise<DaemonClientOutcome> {
+  const { connection, execution, onRestartAsync, getRemainingMs } = attempts;
+  const { abortSignal } = execution;
   let owner: IDaemonLockfile | undefined = await attestOwnerAsync(client, connection);
   let outcome: DaemonClientOutcome = await executeOnDaemonAsync(client, connection, {
     ...execution,
-    abortSignal
+    request
   });
   let previous: DaemonClient | undefined;
   try {
@@ -113,8 +171,6 @@ export async function executeWithDaemonRestartAsync(
         );
       }
       if (abortSignal?.aborted) return abortedOutcome(execution);
-      const getRemainingMs = (): number | undefined =>
-        waitTimeoutMs === undefined ? undefined : waitTimeoutMs - (Date.now() - startedAt);
       if (retry > MAX_RESTART_RETRIES || isExpired(getRemainingMs())) {
         return restartExhaustedOutcome(retry - 1);
       }
@@ -139,13 +195,7 @@ export async function executeWithDaemonRestartAsync(
           abortSignal
         });
       } catch (error) {
-        if (
-          abortSignal?.aborted &&
-          (error === abortSignal.reason ||
-            (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ABORT_ERR'))
-        ) {
-          return abortedOutcome(execution);
-        }
+        if (isAbortError(error, abortSignal)) return abortedOutcome(execution);
         // A startup error after the admission deadline expired is the deadline, not a new failure mode.
         if (boundedByAdmission && error instanceof DaemonClientError && isExpired(getRemainingMs())) {
           return restartExhaustedOutcome(retry);
@@ -162,17 +212,15 @@ export async function executeWithDaemonRestartAsync(
       const remainingMs: number | undefined = getRemainingMs();
       if (isExpired(remainingMs)) return restartExhaustedOutcome(retry);
       owner = await attestOwnerAsync(successor, connection);
-      await onRestartAsync?.({ restart: retry, reason, successorPid: (await successor.status).pid });
+      attempts.followed++;
+      await onRestartAsync?.({
+        restart: attempts.followed,
+        reason,
+        successorPid: (await successor.status).pid
+      });
       outcome = await executeOnDaemonAsync(successor, connection, {
         ...execution,
-        abortSignal,
-        request:
-          remainingMs === undefined
-            ? execution.request
-            : captureDaemonRequest({
-                ...execution.request,
-                admission: { ...execution.request.admission, waitTimeoutMs: Math.floor(remainingMs) }
-              })
+        request: withRemainingAdmission(execution.request, remainingMs)
       });
     }
     return outcome;
@@ -181,6 +229,76 @@ export async function executeWithDaemonRestartAsync(
   }
 }
 
+/**
+ * Sends the request to a new daemon once, after the daemon that had it exited while the request waited in its
+ * queue. Throws `exit` if the connection cannot start a daemon, or if the admission deadline expires first.
+ */
+async function resendAfterExitAsync(
+  exit: DaemonExitedWhileQueuedError,
+  attempts: IRequestAttempts
+): Promise<DaemonClientOutcome> {
+  const { connection, execution, onRestartAsync, getRemainingMs } = attempts;
+  const { abortSignal } = execution;
+  if (abortSignal?.aborted) return abortedOutcome(execution);
+  if (!connection.startCommand && !connection.resolveStartCommandAsync) throw exit;
+  const remainingMs: number | undefined = getRemainingMs();
+  if (isExpired(remainingMs)) throw exit;
+  const startupTimeoutMs: number = connection.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+  const limitedByAdmission: boolean = remainingMs !== undefined && remainingMs < startupTimeoutMs;
+  attempts.followed++;
+  await onRestartAsync?.({
+    restart: attempts.followed,
+    reason: undefined,
+    successorPid: undefined,
+    exitedPid: exit.daemonPid
+  });
+  let successor: DaemonClient;
+  try {
+    // The daemon that exited planned no successor, and explaining its exit reclaimed its files.
+    successor = await connectOrStartDaemonAsync({
+      ...connection,
+      startupTimeoutMs: limitedByAdmission ? Math.max(1, Math.ceil(remainingMs!)) : startupTimeoutMs,
+      abortSignal
+    });
+  } catch (error) {
+    if (isAbortError(error, abortSignal)) return abortedOutcome(execution);
+    if (limitedByAdmission && error instanceof DaemonClientError && isExpired(getRemainingMs())) throw exit;
+    throw error instanceof DaemonClientError
+      ? new DaemonClientError(
+          error.code,
+          `rushd (PID ${exit.daemonPid}) exited while the command was queued, and a new daemon did not start: ` +
+            error.message,
+          { cause: error }
+        )
+      : error;
+  }
+  try {
+    const resendRemainingMs: number | undefined = getRemainingMs();
+    if (isExpired(resendRemainingMs)) throw exit;
+    return await followRestartsAsync(
+      successor,
+      withRemainingAdmission(execution.request, resendRemainingMs),
+      attempts
+    );
+  } catch (error) {
+    throw error === exit ? error : withResentMessage(error);
+  } finally {
+    await successor.closeAsync().catch(() => undefined);
+  }
+}
+
+/** A lost connection after the resend says that the command was sent to a new daemon, not that it was not retried. */
+function withResentMessage(error: unknown): unknown {
+  if (!(error instanceof DaemonClientError) || !error.message.startsWith(DAEMON_DISCONNECTED_MESSAGE)) {
+    return error;
+  }
+  return new DaemonClientError(
+    error.code,
+    DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE + error.message.slice(DAEMON_DISCONNECTED_MESSAGE.length),
+    { cause: error.cause ?? error }
+  );
+}
+
 /** Executes one attempt; a lost connection is explained by what happened to the daemon that served it. */
 async function executeOnDaemonAsync(
   client: DaemonClient,
@@ -193,12 +311,37 @@ async function executeOnDaemonAsync(
   } catch (error) {
     // After cancellation the caller reports the cancellation, whatever the connection did afterwards.
     if (execution.abortSignal?.aborted) throw error;
-    throw await explainLostConnectionAsync(error, daemon, execution.request, {
-      onOrphansReaped: connection.onOrphansReaped
-    });
+    throw await explainLostConnectionAsync(
+      error,
+      daemon,
+      execution.request,
+      { onOrphansReaped: connection.onOrphansReaped },
+      client.queuedWithoutStarting
+    );
   }
 }
 
+/** The request with an explicit admission deadline of `remainingMs`, or unchanged without one. */
+function withRemainingAdmission(
+  request: IDaemonRequestEnvelope,
+  remainingMs: number | undefined
+): IDaemonRequestEnvelope {
+  return remainingMs === undefined
+    ? request
+    : captureDaemonRequest({
+        ...request,
+        admission: { ...request.admission, waitTimeoutMs: Math.floor(remainingMs) }
+      });
+}
+
+function isAbortError(error: unknown, abortSignal: AbortSignal | undefined): boolean {
+  return (
+    !!abortSignal?.aborted &&
+    (error === abortSignal.reason ||
+      (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ABORT_ERR'))
+  );
+}
+
 function isExpired(remainingMs: number | undefined): boolean {
   return remainingMs !== undefined && remainingMs <= 0;
 }
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index 7209d31b34..a60490dc89 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -6,11 +6,13 @@ import { PassThrough } from 'node:stream';
 import {
   DAEMON_KEEPALIVE_PROTOCOL_MINOR,
   DAEMON_PROTOCOL_VERSION,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR,
   DaemonFrameType,
   decodeDaemonControlMessage,
   decodeDaemonStdinChunk,
   encodeDaemonControlMessage,
   encodeDaemonEventFrame,
+  encodeDaemonFrame,
   encodeDaemonLogChunk,
   type DaemonControlMessage,
   type IDaemonProtocolVersion,
@@ -493,6 +495,196 @@ describe('DaemonClient', () => {
     expect(seen).toEqual(['queued', 'admitted', 'stdin a', 'stdin b']);
   });
 
+  it.each([
+    [DAEMON_KEEPALIVE_PROTOCOL_MINOR, false],
+    [DAEMON_REQUEST_STARTED_PROTOCOL_MINOR, true]
+  ])('subscribes to a protocol 0.%s daemon with supportsRequestStarted %s', async (minor, supported) => {
+    peerVersion = { major: 0, minor };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await client.closeAsync();
+    const subscribe: DaemonControlMessage | undefined = controls.find(
+      (message) => message.kind === 'subscribe'
+    );
+    expect(subscribe?.payload).toMatchObject({ supportsRequestStarted: supported });
+  });
+
+  it('rejects requestStarted from a daemon that did not negotiate it', async () => {
+    peerVersion = { major: 0, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR };
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      await sendAsync({ kind: 'requestStarted', payload: { requestId: message.payload.requestId } });
+    };
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await expect(client.executeAsync({ request: request() })).rejects.toThrow(
+      'Unexpected request start notice.'
+    );
+  });
+
+  describe('queuedWithoutStarting', () => {
+    /** The queue position that the daemon sends last, after which the test closes the connection. */
+    const BARRIER_POSITION: number = 9;
+    type Step = 'started' | 'output' | 'event' | 'input' | 'rawMode';
+
+    async function sendStepAsync(step: Step, requestId: string): Promise<void> {
+      switch (step) {
+        case 'started':
+          await sendAsync({ kind: 'requestStarted', payload: { requestId } });
+          return;
+        case 'output':
+          await connection!.sendFrameAsync({
+            kind: DaemonFrameType.logStdout,
+            payload: encodeDaemonLogChunk({ operationId: requestId, chunk: Buffer.from('ran') })
+          });
+          return;
+        case 'event':
+          await connection!.sendFrameAsync({
+            kind: DaemonFrameType.event,
+            payload: encodeDaemonEventFrame({
+              protocolVersion: { major: 0, minor: 1 },
+              eventId: 'event',
+              sessionId: 'test',
+              sequence: 1,
+              timestamp: new Date().toISOString(),
+              source: { packageName: 'test', packageVersion: '1.0.0' },
+              privacy: 'public',
+              required: true,
+              type: 'commandStarted',
+              payload: {}
+            })
+          });
+          return;
+        case 'input':
+          await sendAsync({ kind: 'stdinReady', payload: { requestId } });
+          return;
+        case 'rawMode':
+          await sendAsync({ kind: 'setRawMode', payload: { requestId, enabled: true } });
+          return;
+      }
+    }
+
+    /**
+     * Runs a request that the daemon answers with `steps`, then a queue position, and then by closing the connection
+     * once the client handled that queue position, or with `cancel`, once the client asked to cancel.
+     */
+    async function runUntilLostAsync(
+      steps: ReadonlyArray<Step>,
+      cancel: boolean = false
+    ): Promise<DaemonClient> {
+      const abort: AbortController = new AbortController();
+      let barrierSeen: () => void = () => {};
+      const barrier: Promise<void> = new Promise((resolve) => {
+        barrierSeen = resolve;
+      });
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') {
+          const { requestId } = message.payload;
+          for (const step of steps) await sendStepAsync(step, requestId);
+          await sendAsync({ kind: 'queuePosition', payload: { position: BARRIER_POSITION, requestId } });
+          await barrier;
+          if (!cancel) await connection!.closeAsync();
+        } else if (message.kind === 'requestCancel') {
+          await connection!.closeAsync();
+        }
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      await expect(
+        client.executeAsync({
+          request: { ...request(), terminal: { ...request().terminal, acceptsStdin: true } },
+          stdin: new PassThrough(),
+          abortSignal: abort.signal,
+          setRawMode: () => {},
+          onStdoutAsync: async () => {},
+          onEventAsync: async () => {},
+          onQueuePositionAsync: async (position) => {
+            if (position !== BARRIER_POSITION) return;
+            if (cancel) abort.abort();
+            barrierSeen();
+          }
+        })
+      ).rejects.toThrow();
+      return client;
+    }
+
+    it('is true once the daemon reported a queue position and nothing else', async () => {
+      expect((await runUntilLostAsync([])).queuedWithoutStarting).toBe(true);
+    });
+
+    it('is false before the daemon reported a queue position', async () => {
+      onRequest = async (message) => {
+        if (message.kind === 'requestStart') await connection!.closeAsync();
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      await expect(client.executeAsync({ request: request() })).rejects.toThrow('not retried');
+      expect(client.queuedWithoutStarting).toBe(false);
+    });
+
+    it.each<Step>(['started', 'output', 'event', 'input', 'rawMode'])(
+      'is false after the daemon sent %s',
+      async (step: Step) => {
+        expect((await runUntilLostAsync([step])).queuedWithoutStarting).toBe(false);
+      }
+    );
+
+    it('is false after the client asked the daemon to cancel', async () => {
+      expect((await runUntilLostAsync([], true)).queuedWithoutStarting).toBe(false);
+    });
+
+    it('is false for a daemon that does not say when it starts a request', async () => {
+      peerVersion = { major: 0, minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR };
+      expect((await runUntilLostAsync([])).queuedWithoutStarting).toBe(false);
+    });
+
+    /**
+     * Runs a request that the daemon answers with `messages` in one write, after which it closes the connection. The
+     * client takes `QUEUE_POSITION_HANDLER_MS` to handle a queue position, so the connection closes while the frames
+     * after it wait in the transport. Returns whether the request counted as queued when it failed.
+     */
+    async function queuedWhenLostAsync(
+      messages: (requestId: string) => ReadonlyArray<DaemonControlMessage>
+    ): Promise<boolean> {
+      const QUEUE_POSITION_HANDLER_MS: number = 200;
+      onRequest = async (message) => {
+        if (message.kind !== 'requestStart') return;
+        const frames: Buffer[] = messages(message.payload.requestId).map((control: DaemonControlMessage) =>
+          Buffer.from(
+            encodeDaemonFrame({
+              kind: DaemonFrameType.controlJson,
+              payload: encodeDaemonControlMessage(control)
+            })
+          )
+        );
+        connection!.socket.write(Buffer.concat(frames));
+        await connection!.closeAsync();
+      };
+      const client = await DaemonClient.connectAsync({ socketPath: address });
+      await expect(
+        client.executeAsync({
+          request: request(),
+          onQueuePositionAsync: () => new Promise((resolve) => setTimeout(resolve, QUEUE_POSITION_HANDLER_MS))
+        })
+      ).rejects.toThrow('not retried');
+      return client.queuedWithoutStarting;
+    }
+
+    it('handles a start notice that arrived before the connection closed before it fails the request', async () => {
+      expect(
+        await queuedWhenLostAsync((requestId: string) => [
+          { kind: 'queuePosition', payload: { position: 1, requestId } },
+          { kind: 'requestStarted', payload: { requestId } }
+        ])
+      ).toBe(false);
+    });
+
+    it('is true when the frames that arrived before the connection closed say only that the request waits', async () => {
+      expect(
+        await queuedWhenLostAsync((requestId: string) => [
+          { kind: 'queuePosition', payload: { position: 2, requestId } },
+          { kind: 'queuePosition', payload: { position: 1, requestId } }
+        ])
+      ).toBe(true);
+    });
+  });
+
   it('forwards raw stdin only after acknowledgement and restores raw mode', async () => {
     const stdin = new PassThrough();
     const rawModes: boolean[] = [];
diff --git a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
index 0202461b79..d391be745e 100644
--- a/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonDisconnect.test.ts
@@ -18,6 +18,7 @@ import {
 import { captureDaemonRequest } from '../captureDaemonRequest';
 import { DAEMON_DISCONNECTED_MESSAGE, DaemonClientError } from '../DaemonClientError';
 import {
+  DaemonExitedWhileQueuedError,
   explainLostConnectionAsync,
   findLoggedFatalError,
   observeServingDaemonAsync,
@@ -146,6 +147,29 @@ describe(explainLostConnectionAsync.name, () => {
     expect(await explainLostConnectionAsync(lost, undefined, request)).toBe(lost);
   });
 
+  it('says that the command was queued when the daemon exited before it started the request', async () => {
+    // A process that has exited.
+    const exitedPid: number = spawnSync(process.execPath, ['-e', '']).pid!;
+    const closed: DaemonTransportError = getLostConnection();
+    const explained: unknown = await explainLostConnectionAsync(
+      closed,
+      getServingDaemon(exitedPid),
+      request,
+      undefined,
+      true
+    );
+    expect(explained).toBeInstanceOf(DaemonExitedWhileQueuedError);
+    expect(explained).toMatchObject({
+      code: 'disconnected',
+      cause: closed,
+      daemonPid: exitedPid,
+      message: getExitMessage(exitedPid).replace('while it ran the command', 'while the command was queued')
+    });
+    const ran: unknown = await explainLostConnectionAsync(closed, getServingDaemon(exitedPid), request);
+    expect(ran).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+    expect(ran).toMatchObject({ code: 'disconnected', message: getExitMessage(exitedPid) });
+  });
+
   linuxIt('treats a daemon that exited but is not reaped yet as exited', async () => {
     await withUnreapedChildAsync(async (child) => {
       const deadline: number = Date.now() + 5000;
diff --git a/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts b/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
new file mode 100644
index 0000000000..4135125138
--- /dev/null
+++ b/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
@@ -0,0 +1,290 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+
+import { captureDaemonRequest } from '../captureDaemonRequest';
+import type { DaemonClient, DaemonClientOutcome } from '../DaemonClient';
+import {
+  DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE,
+  DAEMON_DISCONNECTED_MESSAGE,
+  DaemonClientError
+} from '../DaemonClientError';
+import { DaemonExitedWhileQueuedError } from '../DaemonDisconnect';
+import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
+import { executeWithDaemonRestartAsync, type IDaemonRestartNotice } from '../executeWithDaemonRestart';
+import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
+
+function readIfPresent(filePath: string): string {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : '';
+}
+
+// A file of its own, since connectOrStartDaemon.test.ts is close to the 2,000-line max-lines limit.
+describe('a request that waited in the queue of a daemon that exited', () => {
+  let folder: string;
+  let options: IConnectOrStartDaemonOptions;
+
+  /** The lines of the file that fixture daemons write in the test folder. */
+  function readLines(name: string): string[] {
+    return fs.readFileSync(path.join(folder, name), 'utf8').trim().split('\n');
+  }
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-resend-'));
+    const paths: IDaemonPaths = {
+      runtimeDir: folder,
+      socketPath:
+        process.platform === 'win32'
+          ? `\\\\.\\pipe\\rush-client-resend-${path.basename(folder)}`
+          : path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+    const environment = captureDaemonRequest({
+      argv: [],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot },
+      terminal: { isTTY: false, supportsColor: false }
+    }).environment;
+    options = {
+      paths,
+      expectedDaemonVersion: 'fixture',
+      startupTimeoutMs: 7000,
+      startCommand: {
+        command: process.execPath,
+        args: [path.join(__dirname, 'fixtures/daemon.js'), JSON.stringify(paths)],
+        cwd: folder,
+        environment
+      }
+    };
+  });
+
+  afterEach(async () => {
+    if (fs.existsSync(path.join(folder, 'starts'))) {
+      fs.writeFileSync(path.join(folder, 'stop'), '');
+      const pids: string[] = readLines('starts');
+      await Promise.all(pids.map((pid) => waitForTestProcessExitAsync(Number(pid))));
+      expect(pids.every((pid) => fs.existsSync(path.join(folder, `stopped-${pid}`)))).toBe(true);
+    }
+    // A fixture daemon that fails a check records it here.
+    expect(readIfPresent(path.join(folder, 'failures'))).toBe('');
+    if (fs.existsSync(path.join(folder, 'parents'))) {
+      const parents = new Set(readLines('parents'));
+      await Promise.all([...parents].map((pid) => waitForTestProcessExitAsync(Number(pid))));
+    }
+    await removeTestFolderAsync(folder);
+  });
+
+  /** The connection options of a fixture daemon that behaves as `mode` says. */
+  function withMode(mode: string): IConnectOrStartDaemonOptions {
+    return {
+      ...options,
+      startCommand: { ...options.startCommand!, args: [...options.startCommand!.args, 'fixture', mode] }
+    };
+  }
+
+  function captureRequest(): IDaemonRequestEnvelope {
+    return captureDaemonRequest({
+      argv: ['test'],
+      commandName: 'test',
+      commandOrigin: 'custom',
+      cwd: folder,
+      environment: {},
+      terminal: { isTTY: false, supportsColor: false }
+    });
+  }
+
+  function exitedMessage(pid: number): string {
+    return (
+      `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while it ran the command; ` +
+      '"rush-client daemon logs" shows why. Run the command again; ' +
+      'if the daemon exits again, run the command with "rush-client --no-daemon".'
+    );
+  }
+
+  const queuedMessage = (prefix: string, pid: number): string =>
+    `${prefix} rushd (PID ${pid}) exited while the command was queued; "rush-client daemon logs" shows why. ` +
+    'Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".\n' +
+    'The daemon log reports: Error: fixture daemon crash while running the request';
+
+  function withWaitTimeout(waitTimeoutMs: number): IDaemonRequestEnvelope {
+    return captureDaemonRequest({ ...captureRequest(), admission: { waitTimeoutMs } });
+  }
+
+  it('tells the caller which daemon exited before it starts a new daemon, and sends the request there once', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    const notices: IDaemonRestartNotice[] = [];
+    const outcome: DaemonClientOutcome = await executeWithDaemonRestartAsync(client, connection, {
+      request: captureRequest(),
+      onRestartAsync: async (notice) => {
+        // No new daemon has started yet.
+        expect(readLines('starts')).toHaveLength(1);
+        expect(readLines('requests')).toHaveLength(1);
+        notices.push(notice);
+      }
+    });
+    expect(outcome).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    expect(readLines('starts').map(Number)).toEqual([pid, expect.any(Number)]);
+    expect(notices).toEqual([{ restart: 1, reason: undefined, successorPid: undefined, exitedPid: pid }]);
+    expect(readLines('requests')).toHaveLength(2);
+  });
+
+  it('passes on what remains of an explicit wait deadline', async () => {
+    const waitTimeoutMs: number = 10000;
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    expect(
+      await executeWithDaemonRestartAsync(client, connection, { request: withWaitTimeout(waitTimeoutMs) })
+    ).toMatchObject({ kind: 'result', result: { exitCode: 0 } });
+    const waits: number[] = readLines('waits').map(Number);
+    expect(waits).toHaveLength(2);
+    expect(waits[0]).toBe(waitTimeoutMs);
+    expect(waits[1]).toBeLessThan(waitTimeoutMs);
+    expect(waits[1]).toBeGreaterThan(0);
+  });
+
+  it('sends the request only once when the new daemon also exits while the request waits', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const notices: IDaemonRestartNotice[] = [];
+    const error: unknown = await executeWithDaemonRestartAsync(client, connection, {
+      request: captureRequest(),
+      onRestartAsync: async (notice) => {
+        notices.push(notice);
+      }
+    }).catch((failure: unknown) => failure);
+    const starts: number[] = readLines('starts').map(Number);
+    expect(starts).toHaveLength(2);
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect(error).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+    expect(error).toMatchObject({
+      code: 'disconnected',
+      message: queuedMessage(DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE, starts[1])
+    });
+    expect(notices).toHaveLength(1);
+    expect(readLines('requests')).toHaveLength(2);
+  });
+
+  it('does not send the request again once the daemon said that it started the request', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-after-start-notice');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message:
+        `${exitedMessage(pid!)}\n` +
+        'The daemon log reports: Error: fixture daemon crash while running the request'
+    });
+    expect(readLines('starts')).toHaveLength(1);
+  });
+
+  it('does not send the request again while the daemon that closed the connection still runs', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('close-while-queued');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(client, connection, { request: captureRequest() })
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message: `${DAEMON_DISCONNECTED_MESSAGE} The connection to rushd (PID ${pid}) closed, but the daemon is still running; run the command again.`
+    });
+    expect(readLines('starts')).toHaveLength(1);
+    expect(readLines('requests')).toHaveLength(1);
+  });
+
+  it('does not send the request again without a way to start a daemon', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(
+        client,
+        { ...connection, startCommand: undefined },
+        { request: captureRequest() }
+      )
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message: queuedMessage(DAEMON_DISCONNECTED_MESSAGE, pid!)
+    });
+    expect(readLines('starts')).toHaveLength(1);
+  });
+
+  it('does not send the request again once its explicit wait deadline expired', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    await expect(
+      executeWithDaemonRestartAsync(client, connection, { request: withWaitTimeout(1) })
+    ).rejects.toMatchObject({
+      code: 'disconnected',
+      message: queuedMessage(DAEMON_DISCONNECTED_MESSAGE, pid!)
+    });
+    expect(readLines('starts')).toHaveLength(1);
+  });
+
+  it('returns the aborted result when the request is cancelled while a new daemon starts', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    // The new daemon waits before it listens.
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '1500');
+    const abort: AbortController = new AbortController();
+    const notices: IDaemonRestartNotice[] = [];
+    const pending: Promise<DaemonClientOutcome> = executeWithDaemonRestartAsync(client, connection, {
+      request: captureRequest(),
+      abortSignal: abort.signal,
+      onRestartAsync: async (notice) => {
+        notices.push(notice);
+      }
+    });
+    const deadline: number = Date.now() + 5000;
+    while (readLines('starts').length < 2 && Date.now() < deadline) await delayAsync(20);
+    expect(readLines('starts')).toHaveLength(2);
+    expect(notices).toHaveLength(1);
+    abort.abort();
+    expect(await pending).toMatchObject({
+      kind: 'result',
+      result: { exitCode: 130, outcome: 'aborted', aborted: true }
+    });
+    expect(readLines('requests')).toHaveLength(1);
+  });
+
+  it('says that a new daemon did not start', async () => {
+    const connection: IConnectOrStartDaemonOptions = withMode('crash-while-queued-once');
+    const client: DaemonClient = await connectOrStartDaemonAsync(connection);
+    const { pid } = await client.status;
+    // The new daemon waits longer before it listens than the client waits for it.
+    fs.writeFileSync(path.join(folder, 'startup-delay-ms'), '2000');
+    const notices: IDaemonRestartNotice[] = [];
+    const error: unknown = await executeWithDaemonRestartAsync(
+      client,
+      { ...connection, startupTimeoutMs: 300 },
+      {
+        request: captureRequest(),
+        onRestartAsync: async (notice) => {
+          notices.push(notice);
+        }
+      }
+    ).catch((failure: unknown) => failure);
+    // The failure follows the notice that the command is sent to a new daemon.
+    expect(notices).toEqual([{ restart: 1, reason: undefined, successorPid: undefined, exitedPid: pid }]);
+    expect(error).toBeInstanceOf(DaemonClientError);
+    expect((error as DaemonClientError).message).toMatch(
+      new RegExp(
+        `^rushd \\(PID ${pid}\\) exited while the command was queued, and a new daemon did not start: .`
+      )
+    );
+    expect((error as DaemonClientError).cause).toBeInstanceOf(DaemonClientError);
+    expect(readLines('requests')).toHaveLength(1);
+  });
+});
diff --git a/libraries/rush-client-core/src/test/fixtures/daemon.ts b/libraries/rush-client-core/src/test/fixtures/daemon.ts
index 55dc111795..b2fe84f360 100644
--- a/libraries/rush-client-core/src/test/fixtures/daemon.ts
+++ b/libraries/rush-client-core/src/test/fixtures/daemon.ts
@@ -9,7 +9,8 @@ import {
   DAEMON_PROTOCOL_VERSION,
   DaemonFrameType,
   decodeDaemonControlMessage,
-  encodeDaemonControlMessage
+  encodeDaemonControlMessage,
+  type DaemonControlMessage
 } from '@rushstack/rush-daemon-protocol';
 import {
   DaemonFrameListener,
@@ -106,6 +107,31 @@ async function mainAsync(): Promise<void> {
               `${message.payload.admission.waitTimeoutMs}\n`
             );
           }
+          // Like a daemon that exits, or closes the connection, while the request waits in its queue. The "-once"
+          // mode does so only in the first daemon; "crash-after-start-notice" first says that the request started.
+          const queuedCrashesPath: string = path.join(folder, 'queued-crashes');
+          if (
+            mode === 'crash-while-queued' ||
+            (mode === 'crash-while-queued-once' && !fs.existsSync(queuedCrashesPath)) ||
+            mode === 'crash-after-start-notice' ||
+            mode === 'close-while-queued'
+          ) {
+            const { requestId } = message.payload;
+            await sendControlAsync(connection, {
+              kind: 'queuePosition',
+              payload: { position: 1, requestId }
+            });
+            if (mode === 'crash-after-start-notice') {
+              await sendControlAsync(connection, { kind: 'requestStarted', payload: { requestId } });
+            }
+            if (mode === 'close-while-queued') {
+              await connection.closeAsync();
+              return;
+            }
+            fs.appendFileSync(queuedCrashesPath, 'c');
+            exitAbruptly();
+            return;
+          }
           const restartCount: number = fs.existsSync(path.join(folder, 'restarted'))
             ? fs.readFileSync(path.join(folder, 'restarted'), 'utf8').length
             : 0;
@@ -264,6 +290,13 @@ async function mainAsync(): Promise<void> {
   }
 }
 
+function sendControlAsync(connection: DaemonFrameConnection, message: DaemonControlMessage): Promise<void> {
+  return connection.sendFrameAsync({
+    kind: DaemonFrameType.controlJson,
+    payload: encodeDaemonControlMessage(message)
+  });
+}
+
 /** How long the daemon waits before it listens: 250 milliseconds, or the number in the "startup-delay-ms" file. */
 function readStartupDelayMs(folder: string): number {
   return readNumber(folder, 'startup-delay-ms', 250);
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index cd6841545e..458306b758 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -85,6 +85,11 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   responds, and gets a `pong` as before. A daemon that is closing the session ignores a `ping` rather than
   answering it with a protocol `error`, which could reach the client ahead of the request's typed result.
   Clients must negotiate `DAEMON_KEEPALIVE_PROTOCOL_MINOR` before they ping during a request.
+- **Request started (0.14)** - a client that negotiated `DAEMON_REQUEST_STARTED_PROTOCOL_MINOR` may subscribe
+  with `supportsRequestStarted: true`. The daemon then sends it `requestStarted` once per request, when the
+  request has left every queue and before anything from it is applied, so the notice precedes the request's
+  output, events and terminal control. A daemon that exits after a `queuePosition` but before `requestStarted`
+  has not run the request. A daemon answers a `requestStarted` that a client sends with a protocol `error`.
 
 Part of the Rush 6 / rushd re-architecture:
 [microsoft/rushstack#5894](https://github.com/microsoft/rushstack/issues/5894).
diff --git a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
index e9f4816306..30c52fc49e 100644
--- a/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
+++ b/libraries/rush-daemon-protocol/src/ControlMessageValidation.ts
@@ -69,6 +69,7 @@ const VALIDATORS_BY_KIND: Record<string, ControlValidator> = {
   terminalPolicy: validateTerminalPolicyControl,
   queuePosition: validateRequestQueuePositionControl,
   requestStart: validateRequestStartControl,
+  requestStarted: validateRequestCancelControl,
   requestCancel: validateRequestCancelControl,
   requestRejected: validateRequestRejectedControl,
   requestResult: validateRequestResultControl,
diff --git a/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts b/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts
index 77237f3304..82d6f7b0ab 100644
--- a/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonClientCaps.ts
@@ -24,6 +24,11 @@ export interface IDaemonClientCaps {
   readonly supportsRequestAdmission?: boolean;
   /** Whether the client supports the request start, cancellation, and terminal outcome controls. */
   readonly supportsRequestLifecycle?: boolean;
+  /**
+   * Whether the client accepts `requestStarted`, which says when the daemon starts to execute the request. Only
+   * negotiated from `DAEMON_REQUEST_STARTED_PROTOCOL_MINOR` on.
+   */
+  readonly supportsRequestStarted?: boolean;
   /** The verbosity subset this client receives. Defaults to `normal`. */
   readonly verbosity?: DaemonVerbosity;
   /** The client's terminal width in columns, when known. */
diff --git a/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts b/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts
index 7836f1561a..e2f373850a 100644
--- a/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonControlKinds.ts
@@ -15,6 +15,7 @@ export const DAEMON_CONTROL_MESSAGE_KINDS: readonly [
   'terminalPolicy',
   'queuePosition',
   'requestStart',
+  'requestStarted',
   'requestCancel',
   'requestRejected',
   'requestResult',
@@ -35,6 +36,7 @@ export const DAEMON_CONTROL_MESSAGE_KINDS: readonly [
   'terminalPolicy',
   'queuePosition',
   'requestStart',
+  'requestStarted',
   'requestCancel',
   'requestRejected',
   'requestResult',
diff --git a/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts b/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
index 35c4aedbd9..4514e2b60a 100644
--- a/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonControlMessage.ts
@@ -18,7 +18,8 @@ import type {
   IDaemonRequestCancelMessage,
   IDaemonRequestRejectedMessage,
   IDaemonRequestResultMessage,
-  IDaemonRequestStartMessage
+  IDaemonRequestStartMessage,
+  IDaemonRequestStartedMessage
 } from './DaemonRequestControl';
 
 /** The empty payload of control messages that carry no data. @beta */
@@ -91,6 +92,7 @@ export type DaemonControlMessage =
   | IDaemonTerminalPolicyMessage
   | IDaemonRequestQueuePositionMessage
   | IDaemonRequestStartMessage
+  | IDaemonRequestStartedMessage
   | IDaemonRequestCancelMessage
   | IDaemonRequestRejectedMessage
   | IDaemonRequestResultMessage;
diff --git a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
index 1a67644dcf..eaf357a7f2 100644
--- a/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonProtocolVersion.ts
@@ -42,6 +42,13 @@ export const DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR: number = 12;
  */
 export const DAEMON_KEEPALIVE_PROTOCOL_MINOR: number = 13;
 
+/**
+ * The first protocol minor whose daemons send `requestStarted` when they start to execute a request, to a client
+ * that subscribes with `supportsRequestStarted`. Until then the request has not run, so a client whose daemon exits
+ * first may send it to another daemon. @beta
+ */
+export const DAEMON_REQUEST_STARTED_PROTOCOL_MINOR: number = 14;
+
 /**
  * A rushd wire protocol version.
  *
@@ -75,7 +82,7 @@ export interface IDaemonProtocolVersion {
  */
 export const DAEMON_PROTOCOL_VERSION: IDaemonProtocolVersion = {
   major: 0,
-  minor: DAEMON_KEEPALIVE_PROTOCOL_MINOR
+  minor: DAEMON_REQUEST_STARTED_PROTOCOL_MINOR
 };
 
 /**
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts b/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts
index c27e37ac34..ea7540596a 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestControl.ts
@@ -24,6 +24,16 @@ export interface IDaemonRequestCancelMessage {
   readonly payload: { readonly requestId: string };
 }
 
+/**
+ * Says that the daemon starts to execute one request: before this, the request has only waited or been prepared, and
+ * has not run. Sent at most once per request, and only to a client that subscribed with `supportsRequestStarted`.
+ * @beta
+ */
+export interface IDaemonRequestStartedMessage {
+  readonly kind: 'requestStarted';
+  readonly payload: { readonly requestId: string };
+}
+
 /** Terminates a request that could not be routed or started. @beta */
 export interface IDaemonRequestRejectedMessage {
   readonly kind: 'requestRejected';
diff --git a/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts b/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts
index 8f915ed159..f5cd05acd5 100644
--- a/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestLifecycleCapabilityValidation.ts
@@ -25,3 +25,13 @@ export function validateRequestLifecycleCapability(payload: Record<string, unkno
     );
   }
 }
+
+/** Validates optional negotiation of the `requestStarted` notice. @internal */
+export function validateRequestStartedCapability(payload: Record<string, unknown>): void {
+  if (payload.supportsRequestStarted !== undefined && typeof payload.supportsRequestStarted !== 'boolean') {
+    throw new DaemonProtocolError(
+      'malformedControlMessage',
+      'Subscribe message payload.supportsRequestStarted must be a boolean.'
+    );
+  }
+}
diff --git a/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts b/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts
index 493108f729..826c9f9f38 100644
--- a/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/SubscribeControlValidation.ts
@@ -7,7 +7,8 @@ import { validateInteractiveCapability } from './InteractiveControlValidation';
 import { validateRequestAdmissionCapability } from './RequestAdmissionControlValidation';
 import {
   validateInputLifecycleCapability,
-  validateRequestLifecycleCapability
+  validateRequestLifecycleCapability,
+  validateRequestStartedCapability
 } from './RequestLifecycleCapabilityValidation';
 
 export function validateSubscribeControl(payload: Record<string, unknown>): void {
@@ -21,6 +22,7 @@ export function validateSubscribeControl(payload: Record<string, unknown>): void
   validateInputLifecycleCapability(payload);
   validateRequestAdmissionCapability(payload);
   validateRequestLifecycleCapability(payload);
+  validateRequestStartedCapability(payload);
   requireSubscribeVerbosity(payload);
 }
 
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 63049831eb..070095ca9a 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -29,6 +29,7 @@ export { DAEMON_INVOCATION_KIND_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_KEEPALIVE_PROTOCOL_MINOR, DAEMON_LIFECYCLE_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR, DAEMON_PROTOCOL_VERSION } from './DaemonProtocolVersion';
+export { DAEMON_REQUEST_STARTED_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_RUNTIME_FOLDER_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_SHUTDOWN_ACTIVE_REQUESTS_PROTOCOL_MINOR } from './DaemonProtocolVersion';
 export { DAEMON_WORKSPACE_RESTART_PROTOCOL_MINOR } from './DaemonProtocolVersion';
@@ -64,7 +65,7 @@ export { MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS } from './DaemonRequestAdmission';
 export { validateDaemonRequestAdmissionOptions } from './DaemonRequestAdmissionValidation';
 export type { DaemonRequestRejectionCode, IDaemonRequestCancelMessage } from './DaemonRequestControl';
 export type { IDaemonRequestRejectedMessage, IDaemonRequestResultMessage } from './DaemonRequestControl';
-export type { IDaemonRequestStartMessage } from './DaemonRequestControl';
+export type { IDaemonRequestStartedMessage, IDaemonRequestStartMessage } from './DaemonRequestControl';
 export type { IDaemonRequestEnvelope, IDaemonRequestTerminal } from './DaemonRequestEnvelope';
 export type { DaemonInvocationKind } from './DaemonInvocationKind';
 export type { DaemonRequestAdmissionErrorCode } from './DaemonRequestAdmission';
@@ -72,10 +73,9 @@ export type { IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { IDaemonRequestQueuePositionMessage } from './DaemonRequestAdmission';
 export type { IDaemonNativeLockHolder } from './DaemonNativeLockHolder';
 export type { DaemonRushCommandOrigin } from './DaemonRushCommand';
-export { RUSHD_GRAPH_SNAPSHOT } from './DaemonGraphSnapshot';
+export { RUSHD_GRAPH_SNAPSHOT, type IDaemonUninitializedGraphSnapshot } from './DaemonGraphSnapshot';
 export type { IDaemonGraphInvalidations, IDaemonGraphOperation } from './DaemonGraphSnapshot';
 export type { IDaemonGraphSnapshotPayload, IDaemonInitializedGraphSnapshot } from './DaemonGraphSnapshot';
-export type { IDaemonUninitializedGraphSnapshot } from './DaemonGraphSnapshot';
 export type { DaemonTerminalPolicyDecision, DaemonTerminalPolicyReason } from './DaemonTerminalPolicy';
 export type { DaemonTerminalRequirement, IDaemonTerminalPolicyResult } from './DaemonTerminalPolicy';
 export { decodeDaemonStdinChunk, encodeDaemonStdinChunk, type IDaemonStdinChunk } from './StdinFrameCodec';
diff --git a/libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts b/libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts
new file mode 100644
index 0000000000..a96d5c193d
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/RequestStartedControl.test.ts
@@ -0,0 +1,48 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import { validateDaemonControlMessage } from '../ControlMessageValidation';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import {
+  DAEMON_KEEPALIVE_PROTOCOL_MINOR,
+  DAEMON_PROTOCOL_VERSION,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR
+} from '../DaemonProtocolVersion';
+
+const REQUEST_ID: string = 'started-request';
+
+it('is a minor after keepalive, and the one this package implements', () => {
+  expect(DAEMON_REQUEST_STARTED_PROTOCOL_MINOR).toBeGreaterThan(DAEMON_KEEPALIVE_PROTOCOL_MINOR);
+  expect(DAEMON_PROTOCOL_VERSION.minor).toBe(DAEMON_REQUEST_STARTED_PROTOCOL_MINOR);
+});
+
+it('round-trips requestStarted', () => {
+  const message: DaemonControlMessage = { kind: 'requestStarted', payload: { requestId: REQUEST_ID } };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it('requires a valid request identifier for requestStarted', () => {
+  const kind: string = 'requestStarted';
+  expect(() => validateDaemonControlMessage({ kind, payload: {} })).toThrow();
+  expect(() => validateDaemonControlMessage({ kind, payload: { requestId: '' } })).toThrow();
+  expect(() => validateDaemonControlMessage({ kind, payload: { requestId: ' invalid ' } })).toThrow();
+});
+
+it.each([true, false, undefined])('accepts the requestStarted capability %s', (supportsRequestStarted) => {
+  expect(() =>
+    validateDaemonControlMessage({
+      kind: 'subscribe',
+      payload: { isTTY: false, supportsRequestStarted }
+    })
+  ).not.toThrow();
+});
+
+it('rejects an invalid requestStarted capability', () => {
+  expect(() =>
+    validateDaemonControlMessage({
+      kind: 'subscribe',
+      payload: { isTTY: false, supportsRequestStarted: 'yes' }
+    })
+  ).toThrow('supportsRequestStarted');
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 9cbf7dddd7..ffa0e8c9ff 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -194,6 +194,13 @@ current generation at once, as it would have before the reload began, and the re
 has started. After an edit to `rush.json` or `common/config/rush/experiments.json`, the client runs it in-process
 at once instead, as it would if no reload were running.
 
+A client that subscribes with `supportsRequestStarted` (protocol 0.14) gets `requestStarted` once its request has left
+every queue, before anything from the request is applied. A phased batch sends it to each participant after the native
+lock, the wait for connecting clients and input reconciliation, and before it applies the requests' settings and
+selections, closes runners for a rebuild or schedules the iteration; a global command, Rushx script or graph request
+gets it just before it runs. The daemon goes on only once the notice is written, so a client whose daemon exited
+before the notice knows that its request did not run. A notice that cannot be written does not fail the request.
+
 A dirty native lock left by another command invalidates retained successes so the native
 incremental/cache pipeline can reconcile possibly changed ignored outputs. Declared `outputFolderNames` are also
 fingerprinted (one `stat` per folder: existence, identity and modification time) when an operation succeeds or is
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index d5caef5707..0be663ad8d 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -10,6 +10,7 @@ import {
   DAEMON_PROTOCOL_VERSION,
   DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR,
   DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR,
+  DAEMON_REQUEST_STARTED_PROTOCOL_MINOR,
   DaemonFrameType,
   DaemonProtocolError,
   decodeDaemonControlMessage,
@@ -111,6 +112,7 @@ export class DaemonControlSession {
   #peerSupportsDaemonLifecycle: boolean = false;
   #peerSupportsRequestAdmission: boolean = false;
   #peerSupportsRequestLifecycle: boolean = false;
+  #peerSupportsRequestStarted: boolean = false;
   #sendQueue: Promise<void> = Promise.resolve();
   #sessionId: string | undefined;
   #subscribed: boolean = false;
@@ -263,6 +265,7 @@ export class DaemonControlSession {
     this.#peerSupportsDaemonLifecycle = peerMinor >= DAEMON_LIFECYCLE_PROTOCOL_MINOR;
     this.#peerSupportsRequestAdmission = peerMinor >= DAEMON_REQUEST_ADMISSION_PROTOCOL_MINOR;
     this.#peerSupportsRequestLifecycle = peerMinor >= DAEMON_REQUEST_LIFECYCLE_PROTOCOL_MINOR;
+    this.#peerSupportsRequestStarted = peerMinor >= DAEMON_REQUEST_STARTED_PROTOCOL_MINOR;
     this.#send(outcome.ack);
   }
 
@@ -278,6 +281,8 @@ export class DaemonControlSession {
       this.#peerSupportsRequestAdmission && payload.supportsRequestAdmission === true;
     this.#peerSupportsRequestLifecycle =
       this.#peerSupportsRequestLifecycle && payload.supportsRequestLifecycle === true;
+    this.#peerSupportsRequestStarted =
+      this.#peerSupportsRequestStarted && payload.supportsRequestStarted === true;
     this.#peerSupportsInputLifecycle =
       this.#peerSupportsInputLifecycle && payload.supportsInputLifecycle === true;
     this.#interactiveConnection.setEnabled(
@@ -357,6 +362,7 @@ export class DaemonControlSession {
       sendFrameAsync: (frame: IDaemonFrame) => this.#enqueueFrameAsync(frame),
       sessionId,
       supportsRequestAdmission: this.#peerSupportsRequestAdmission,
+      supportsRequestStarted: this.#peerSupportsRequestStarted,
       waitForConnectingClientsAsync: connectingClients && (() => connectingClients.waitAsync())
     });
     const state: IRequestState = {
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index 31bdb54d7b..f6e2c295e5 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -18,6 +18,7 @@ import type { IResolvedGlobalCommandRequest } from './GlobalCommandRequest';
 import type { IInteractiveRequestSession } from './InteractiveRequestInputRouter';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { PhasedRequestRouter } from './PhasedRequestRouter';
+import { writeRequestStartedAsync } from './RequestStartedNotice';
 import type { IGlobalCommandRequestClient } from './GlobalCommandRequestClient';
 import type { IPhasedRequestTelemetrySink } from './PhasedRequestTelemetry';
 import type { IWorkspaceSession } from './WorkspaceSession';
@@ -127,6 +128,8 @@ export interface IDaemonRequestDispatchClient {
   writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
   writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
   writeQueuePositionAsync(message: IDaemonRequestQueuePositionMessage): Promise<void>;
+  /** {@inheritDoc IPhasedRequestClient.writeRequestStartedAsync} */
+  writeRequestStartedAsync?(): Promise<void>;
   writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void>;
   writeTerminalChunkAsync(stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
   writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
@@ -208,10 +211,15 @@ export class DaemonRequestDispatcher implements AsyncDisposable {
 async function dispatchWorkspaceRequestAsync(
   options: IDispatchWorkspaceRequestOptions
 ): Promise<IDaemonCommandResult | undefined> {
-  const { envelope, client, workspaceSession, resolver, onExecutionStarting, lifecycleInfo } = options;
+  const { envelope, client, workspaceSession, resolver, lifecycleInfo } = options;
+  // Runs just before the request can have an effect. The client knows that the request may have run before it does.
+  const startExecutionAsync = async (): Promise<void> => {
+    options.onExecutionStarting?.();
+    await writeRequestStartedAsync(client);
+  };
   workspaceSession.assertActive?.();
   if (isDaemonGraphCommand(envelope)) {
-    onExecutionStarting?.();
+    await startExecutionAsync();
     await new DaemonGraphRequestRouter(workspaceSession).executeAsync(envelope, client);
     return undefined;
   }
@@ -237,7 +245,7 @@ async function dispatchWorkspaceRequestAsync(
       resolved.request,
       createPhasedClient(client),
       resolved.exactSelection,
-      onExecutionStarting,
+      options.onExecutionStarting,
       resolved.requestSettings,
       resolved.telemetry,
       lifecycleInfo?.receivedTimeMs ?? client.receivedTimeMs,
@@ -262,7 +270,7 @@ async function dispatchWorkspaceRequestAsync(
     request,
     async (context) => {
       workspaceSession.assertActive?.();
-      onExecutionStarting?.();
+      await startExecutionAsync();
       return await resolved.executor(context);
     },
     createGlobalClient(client)
diff --git a/libraries/rush-daemon/src/DaemonWireRequestClient.ts b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
index 4f7db611f6..2eb4c3b326 100644
--- a/libraries/rush-daemon/src/DaemonWireRequestClient.ts
+++ b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
@@ -31,6 +31,8 @@ export interface IDaemonWireRequestClientOptions {
   readonly sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
   readonly sessionId: string;
   readonly supportsRequestAdmission: boolean;
+  /** Whether the client accepts `requestStarted`; see {@link DaemonWireRequestClient.writeRequestStartedAsync}. */
+  readonly supportsRequestStarted?: boolean;
   /** Waits for the daemon's other connections that have not sent a request yet. Resolves at once if omitted. */
   readonly waitForConnectingClientsAsync?: () => Promise<void>;
 }
@@ -41,7 +43,9 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
   readonly #requestId: string;
   readonly #sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly #sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
+  readonly #supportsRequestStarted: boolean;
   readonly #waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
+  #startedSent: boolean = false;
   #terminalOutcomeSent: boolean = false;
 
   public readonly abortSignal: AbortSignal;
@@ -60,6 +64,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     this.#sendFrameAsync = options.sendFrameAsync;
     this.sessionId = options.sessionId;
     this.supportsRequestAdmission = options.supportsRequestAdmission;
+    this.#supportsRequestStarted = options.supportsRequestStarted === true;
     this.#waitForConnectingClientsAsync = options.waitForConnectingClientsAsync;
   }
 
@@ -98,9 +103,17 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     return this.#sendControlAsync(message);
   }
 
-  public writeResultAsync(
-    result: IDaemonCommandResult | IDaemonPhasedRequestResult
-  ): Promise<void> {
+  /**
+   * Tells a client that subscribed with `supportsRequestStarted` that the request left every queue, once. Frames
+   * are sent in order, so this precedes the request's output.
+   */
+  public writeRequestStartedAsync(): Promise<void> {
+    if (!this.#supportsRequestStarted || this.#startedSent) return Promise.resolve();
+    this.#startedSent = true;
+    return this.#sendControlAsync({ kind: 'requestStarted', payload: { requestId: this.#requestId } });
+  }
+
+  public writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void> {
     this.#claimTerminalOutcome();
     return this.#sendControlAsync({ kind: 'requestResult', payload: result });
   }
@@ -110,10 +123,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     return this.#sendControlAsync({ kind: 'terminalPolicy', payload: result });
   }
 
-  public writeRejectionAsync(
-    code: DaemonRequestRejectionCode,
-    message: string
-  ): Promise<void> {
+  public writeRejectionAsync(code: DaemonRequestRejectionCode, message: string): Promise<void> {
     this.#claimTerminalOutcome();
     return this.#sendControlAsync({
       kind: 'requestRejected',
@@ -121,11 +131,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     });
   }
 
-  #writeLogAsync(
-    operationId: string,
-    stream: 'stdout' | 'stderr',
-    chunk: Uint8Array
-  ): Promise<void> {
+  #writeLogAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void> {
     return this.#sendFrameAsync({
       kind: stream === 'stdout' ? DaemonFrameType.logStdout : DaemonFrameType.logStderr,
       payload: encodeDaemonLogChunk({ chunk, operationId })
diff --git a/libraries/rush-daemon/src/PhasedRequestClient.ts b/libraries/rush-daemon/src/PhasedRequestClient.ts
index 5edbbda63f..5ac1665aad 100644
--- a/libraries/rush-daemon/src/PhasedRequestClient.ts
+++ b/libraries/rush-daemon/src/PhasedRequestClient.ts
@@ -41,11 +41,7 @@ export interface IPhasedRequestClient {
   writeEventAsync(event: IDaemonEventEnvelope): Promise<void>;
 
   /** Writes one operation-scoped output chunk through the client's backpressured destination. */
-  writeLogChunkAsync(
-    operationId: string,
-    stream: 'stdout' | 'stderr',
-    chunk: Uint8Array
-  ): Promise<void>;
+  writeLogChunkAsync(operationId: string, stream: 'stdout' | 'stderr', chunk: Uint8Array): Promise<void>;
 
   /** Signals that the client must execute this request in-process instead. */
   writeTerminalPolicyAsync(result: IDaemonTerminalPolicyResult): Promise<void>;
@@ -56,6 +52,12 @@ export interface IPhasedRequestClient {
   /** Writes the request's current one-based scheduler queue position. */
   writeQueuePositionAsync?(message: IDaemonRequestQueuePositionMessage): Promise<void>;
 
+  /**
+   * Tells the client that the request left every queue, if the client asked to be told. The daemon waits for the
+   * write before it applies anything from the request. Hosts that omit it never tell the client.
+   */
+  writeRequestStartedAsync?(): Promise<void>;
+
   /**
    * Resolves once the daemon's other clients that are still connecting have sent their requests, or are not about
    * to send one. The wait is short and capped.
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 02cf17bd94..f0de57f924 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -32,6 +32,7 @@ import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
 import { PhasedIterationDemand } from './PhasedIterationDemand';
 import { writePhasedRequestSummaryAsync } from './PhasedRequestSummary';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
+import { writeRequestStartedAsync } from './RequestStartedNotice';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
 import { DaemonShutdownError, getDaemonShutdownReason } from './DaemonShutdownError';
 import type { IInteractiveRequestSession } from './InteractiveRequestInputRouter';
@@ -553,6 +554,8 @@ class PhasedRequestBatchCoordinator {
         return;
       }
 
+      // Each client learns that its request left the queue before the batch applies anything from it.
+      await Promise.all(participants.map((entry: IBatchEntry) => writeRequestStartedAsync(entry.client)));
       applyRequestSettings(this.#graph, participants[0].requestSettings);
       applySelections(
         this.#graph,
@@ -708,11 +711,7 @@ class PhasedRequestBatchCoordinator {
       }
     }
 
-    if (
-      entry.executionStarted &&
-      this.#currentBatch?.includes(entry) &&
-      this.#hasLiveBatchParticipant()
-    ) {
+    if (entry.executionStarted && this.#currentBatch?.includes(entry) && this.#hasLiveBatchParticipant()) {
       // Other live participants still need the shared work: detach this client and answer it now.
       this.#finishDetachedEntry(entry);
       if (entry.participated) {
diff --git a/libraries/rush-daemon/src/RequestStartedNotice.ts b/libraries/rush-daemon/src/RequestStartedNotice.ts
new file mode 100644
index 0000000000..b19ec527af
--- /dev/null
+++ b/libraries/rush-daemon/src/RequestStartedNotice.ts
@@ -0,0 +1,19 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/** A request's client that the daemon can tell that the request left the queue. */
+export interface IRequestStartedClient {
+  writeRequestStartedAsync?(): Promise<void>;
+}
+
+/**
+ * Tells the client that its request left the queue, and waits until the frame is written, so that the client learns
+ * it before the request can have an effect. A failed write is left to the request's later frames, which report it.
+ */
+export async function writeRequestStartedAsync(client: IRequestStartedClient): Promise<void> {
+  try {
+    await client.writeRequestStartedAsync?.();
+  } catch {
+    // The client is gone, or it will see the connection close.
+  }
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 98cf06455d..731c2375f4 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -569,7 +569,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
                 this.#createRestartRecheck(session, controlEnvelope, current, false)
               );
               if (this.#restartPending) throw new RestartPendingBeforeExecution();
-              if (!drained) return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
+              if (!drained)
+                return await this.#prepareAsync(envelope, client, admission, ticket, receivedTimeMs);
             }
             this.#cancelObservers();
             lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
@@ -597,8 +598,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           if (
             currentTier !== WorkspaceInputChangeTier.Reuse ||
             (this.#boundSession &&
-              this.#projectFingerprint !==
-                (await this.#captureProjectFingerprintAsync(session)))
+              this.#projectFingerprint !== (await this.#captureProjectFingerprintAsync(session)))
           ) {
             throw new Error(
               'Graph inputs changed. Load the new generation with a supported build request; no operation was scheduled or executed.'
@@ -638,7 +638,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       }
       // The client changes the workspace before it sends a request, so any capture that started after the request
       // was received sees those changes. Captures that must detect changes made during a transition stay strict.
-      let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope, receivedTimeMs);
+      let fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(
+        session,
+        envelope,
+        receivedTimeMs
+      );
       let tier: WorkspaceInputChangeTier = this.#classify(fingerprint, isMutation(envelope));
       let projectFingerprint: string | undefined;
       if (tier !== WorkspaceInputChangeTier.Restart && !isMutation(envelope)) {
@@ -1551,6 +1555,7 @@ function createLifecycleClient(
       return client.writeLogChunkAsync(operationId, stream, chunk);
     },
     writeQueuePositionAsync: (message) => client.writeQueuePositionAsync(message),
+    writeRequestStartedAsync: client.writeRequestStartedAsync && (() => client.writeRequestStartedAsync!()),
     writeTerminalChunkAsync: (stream, chunk) => {
       state.began = true;
       return client.writeTerminalChunkAsync(stream, chunk);
diff --git a/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
new file mode 100644
index 0000000000..9aa0de6ad6
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
@@ -0,0 +1,403 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { OperationStatus } from '@microsoft/rush-lib';
+import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
+import { DaemonFrameType, decodeDaemonControlMessage } from '@rushstack/rush-daemon-protocol';
+import type {
+  DaemonControlMessage,
+  IDaemonFrame,
+  IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+import type { ITerminal } from '@rushstack/terminal';
+
+import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { TestWorkspaceSession } from './TestWorkspaceSession';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import {
+  CallbackDaemonRequestResolver,
+  DaemonRequestWireClient,
+  createDeferred,
+  createWireEnvelope
+} from './DaemonRequestWireTestUtilities';
+import type { IDeferred, ITerminalExchange } from './DaemonRequestWireTestUtilities';
+
+const DAEMON_VERSION: string = 'wire-test';
+const RUSH_VERSION: string = '5.178.1';
+const OPERATION_A: string = 'project-a (_phase:test)';
+/** How long a test gives the daemon to do what it must not do yet. */
+const SETTLE_MS: number = 50;
+const testRepoRoots: Set<string> = new Set();
+
+afterEach(() => {
+  for (const repoRoot of testRepoRoots) fs.rmSync(repoRoot, { force: true, recursive: true });
+  testRepoRoots.clear();
+});
+
+function createRepoRoot(): string {
+  const repoRoot: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-wire-started-'));
+  testRepoRoots.add(repoRoot);
+  return repoRoot;
+}
+
+async function startGlobalHostAsync(
+  repoRoot: string,
+  executorFor: (requestId: string) => GlobalCommandExecutor
+): Promise<RushDaemonHost> {
+  const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+    executor: executorFor(envelope.requestId),
+    kind: 'global'
+  }));
+  const options: IRushDaemonHostOptions = {
+    createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+    daemonVersion: DAEMON_VERSION,
+    repoRoot,
+    requestResolver: resolver,
+    rushVersion: RUSH_VERSION
+  };
+  return await RushDaemonHost.startAsync(options);
+}
+
+async function connectAsync(
+  host: RushDaemonHost,
+  supportsRequestStarted: boolean | undefined
+): Promise<DaemonRequestWireClient> {
+  const client: DaemonRequestWireClient = await DaemonRequestWireClient.connectAsync(host.paths.socketPath);
+  await client.handshakeAsync(supportsRequestStarted === undefined ? {} : { supportsRequestStarted });
+  return client;
+}
+
+async function startAsync(
+  client: DaemonRequestWireClient,
+  envelope: IDaemonRequestEnvelope
+): Promise<ITerminalExchange> {
+  await client.sendControlAsync({ kind: 'requestStart', payload: envelope });
+  return await client.readTerminalAsync(envelope.requestId);
+}
+
+/** Each frame of the exchange as a control message kind, or as `output` for a log or event frame. */
+function describeFrames(frames: ReadonlyArray<IDaemonFrame>): string[] {
+  return frames.map((frame: IDaemonFrame) =>
+    frame.kind === DaemonFrameType.controlJson ? decodeDaemonControlMessage(frame.payload).kind : 'output'
+  );
+}
+
+function findStarted(frames: ReadonlyArray<IDaemonFrame>): DaemonControlMessage[] {
+  return frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .filter((message: DaemonControlMessage) => message.kind === 'requestStarted');
+}
+
+/**
+ * Makes the daemon's requestStarted writes wait for `release` before they write, and records in `order` when each
+ * write starts and ends.
+ */
+function holdRequestStartedWrites(
+  order: string[],
+  writeStarted: IDeferred<void>,
+  release: Promise<void>
+): jest.SpyInstance {
+  const writeAsync: () => Promise<void> = DaemonWireRequestClient.prototype.writeRequestStartedAsync;
+  return jest
+    .spyOn(DaemonWireRequestClient.prototype, 'writeRequestStartedAsync')
+    .mockImplementation(async function (this: DaemonWireRequestClient): Promise<void> {
+      order.push('write');
+      writeStarted.resolve();
+      await release;
+      await writeAsync.call(this);
+      order.push('written');
+    });
+}
+
+async function settleAsync(): Promise<void> {
+  await new Promise<void>((resolve) => setTimeout(resolve, SETTLE_MS));
+}
+
+describe('requestStarted', () => {
+  it('tells a client that asked for it when a global command starts, once and before its output', async () => {
+    const repoRoot: string = createRepoRoot();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async (context) => {
+      context.terminal.write('first');
+      context.terminal.write('second');
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchange: ITerminalExchange = await startAsync(
+        client,
+        createWireEnvelope('global', 'custom', repoRoot)
+      );
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'global' } }
+      ]);
+      const kinds: string[] = describeFrames(exchange.frames);
+      expect(kinds.indexOf('output')).toBeGreaterThan(kinds.indexOf('requestStarted'));
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it.each([false, undefined])(
+    'tells a client whose subscribe has supportsRequestStarted %s nothing',
+    async (supportsRequestStarted: boolean | undefined) => {
+      const repoRoot: string = createRepoRoot();
+      const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async (context) => {
+        context.terminal.write('output');
+        return { exitCode: 0 };
+      });
+      const client: DaemonRequestWireClient = await connectAsync(host, supportsRequestStarted);
+      try {
+        const exchange: ITerminalExchange = await startAsync(
+          client,
+          createWireEnvelope('global', 'custom', repoRoot)
+        );
+        expect(describeFrames(exchange.frames)).not.toContain('requestStarted');
+        expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      } finally {
+        await client.closeAsync();
+        await host.closeAsync();
+      }
+    }
+  );
+
+  it('tells a queued request only once the request ahead of it finishes and it starts', async () => {
+    const repoRoot: string = createRepoRoot();
+    const holderStarted: IDeferred<void> = createDeferred<void>();
+    const releaseHolder: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, (requestId: string) => async () => {
+      if (requestId === 'holder') {
+        holderStarted.resolve();
+        await releaseHolder.promise;
+      }
+      return { exitCode: 0 };
+    });
+    const holder: DaemonRequestWireClient = await connectAsync(host, true);
+    const queued: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await holder.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('holder', 'custom', repoRoot)
+      });
+      await holderStarted.promise;
+      await queued.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('queued', 'custom', repoRoot)
+      });
+      expect(await queued.readControlAsync()).toMatchObject({
+        kind: 'queuePosition',
+        payload: { requestId: 'queued' }
+      });
+      // The daemon answers in order, so a requestStarted that it had sent would arrive before the pong.
+      await queued.sendControlAsync({ kind: 'ping', payload: {} });
+      expect((await queued.readControlAsync()).kind).toBe('pong');
+      releaseHolder.resolve();
+      const holderExchange: ITerminalExchange = await holder.readTerminalAsync('holder');
+      expect(findStarted(holderExchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'holder' } }
+      ]);
+      const exchange: ITerminalExchange = await queued.readTerminalAsync('queued');
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'queued' } }
+      ]);
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      releaseHolder.resolve();
+      await Promise.all([holder.closeAsync(), queued.closeAsync()]);
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a client when a phased request starts, before the events and output of its operations', async () => {
+    const repoRoot: string = createRepoRoot();
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [
+          OPERATION_A,
+          new TestOperationRunner(OPERATION_A, OperationStatus.Success, async (terminal: ITerminal) =>
+            terminal.writeLine('operation-output')
+          )
+        ]
+      ])
+    );
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+      kind: 'phased',
+      request: {
+        commandName: envelope.commandName,
+        commandOrigin: envelope.commandOrigin,
+        engineShape: TEST_ENGINE_SHAPE,
+        environment: envelope.environment,
+        operationSelection: [{ enabledState: true, operationId: OPERATION_A }],
+        requestId: envelope.requestId
+      }
+    }));
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      createWorkspaceSessionAsync: () => Promise.resolve(fixture.session),
+      daemonVersion: DAEMON_VERSION,
+      repoRoot,
+      requestResolver: resolver,
+      rushVersion: RUSH_VERSION
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchange: ITerminalExchange = await startAsync(
+        client,
+        createWireEnvelope('phased', 'build', repoRoot, {
+          argv: ['build', OPERATION_A],
+          commandOrigin: 'built-in'
+        })
+      );
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'phased' } }
+      ]);
+      const kinds: string[] = describeFrames(exchange.frames);
+      expect(kinds).toContain('output');
+      expect(kinds.indexOf('output')).toBeGreaterThan(kinds.indexOf('requestStarted'));
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('runs a global command only once its requestStarted frame is written', async () => {
+    const repoRoot: string = createRepoRoot();
+    const order: string[] = [];
+    const writeStarted: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const spy: jest.SpyInstance = holdRequestStartedWrites(order, writeStarted, release.promise);
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => {
+      order.push('executor');
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchangePromise: Promise<ITerminalExchange> = startAsync(
+        client,
+        createWireEnvelope('global', 'custom', repoRoot)
+      );
+      // A failed expectation closes the connection before the exchange is awaited.
+      exchangePromise.catch(() => undefined);
+      await writeStarted.promise;
+      await settleAsync();
+      expect(order).toEqual(['write']);
+      release.resolve();
+      const exchange: ITerminalExchange = await exchangePromise;
+      expect(order).toEqual(['write', 'written', 'executor']);
+      expect(findStarted(exchange.frames)).toHaveLength(1);
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      release.resolve();
+      spy.mockRestore();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a phased request after its batch reconciles, and runs it only once the frame is written', async () => {
+    const repoRoot: string = createRepoRoot();
+    const order: string[] = [];
+    const writeStarted: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const runner: TestOperationRunner = new TestOperationRunner(
+      OPERATION_A,
+      OperationStatus.Success,
+      async () => {
+        order.push('operation');
+      }
+    );
+    const fixture: ITestRoutingFixture = createRoutingFixture(new Map([[OPERATION_A, runner]]));
+    fixture.session.onReconcileAsync = async (): Promise<void> => {
+      order.push('reconcile');
+    };
+    // A rebuild closes the runners before it schedules, which must also wait for the frame.
+    const rebuildSettings: IPhasedCommandEngineRequestSettings = {
+      isIncrementalBuildAllowed: false,
+      parallelism: 1,
+      quietMode: true
+    };
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ envelope }) => ({
+      kind: 'phased',
+      request: {
+        commandName: envelope.commandName,
+        commandOrigin: envelope.commandOrigin,
+        engineShape: TEST_ENGINE_SHAPE,
+        environment: envelope.environment,
+        operationSelection: [{ enabledState: true, operationId: OPERATION_A }],
+        requestId: envelope.requestId
+      },
+      requestSettings: rebuildSettings
+    }));
+    const spy: jest.SpyInstance = holdRequestStartedWrites(order, writeStarted, release.promise);
+    const host: RushDaemonHost = await RushDaemonHost.startAsync({
+      createWorkspaceSessionAsync: () => Promise.resolve(fixture.session),
+      daemonVersion: DAEMON_VERSION,
+      repoRoot,
+      requestResolver: resolver,
+      rushVersion: RUSH_VERSION
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchangePromise: Promise<ITerminalExchange> = startAsync(
+        client,
+        createWireEnvelope('phased', 'build', repoRoot, {
+          argv: ['build', OPERATION_A],
+          commandOrigin: 'built-in'
+        })
+      );
+      // A failed expectation closes the connection before the exchange is awaited.
+      exchangePromise.catch(() => undefined);
+      await writeStarted.promise;
+      await settleAsync();
+      expect(order).toEqual(['reconcile', 'write']);
+      expect(runner.closeCount).toBe(0);
+      release.resolve();
+      const exchange: ITerminalExchange = await exchangePromise;
+      expect(order).toEqual(['reconcile', 'write', 'written', 'operation']);
+      expect(runner.closeCount).toBeGreaterThan(0);
+      expect(findStarted(exchange.frames)).toHaveLength(1);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+    } finally {
+      release.resolve();
+      spy.mockRestore();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('rejects a requestStarted that a client sends as a protocol error', async () => {
+    const repoRoot: string = createRepoRoot();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => ({ exitCode: 0 }));
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await client.sendControlAsync({ kind: 'requestStarted', payload: { requestId: 'client-sent' } });
+      expect(await client.readControlAsync()).toMatchObject({
+        kind: 'error',
+        payload: { code: 'malformedControlMessage' }
+      });
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
index 2911562e07..79343ab4e5 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
@@ -11,6 +11,7 @@ import {
 } from '@rushstack/rush-daemon-protocol';
 import type {
   DaemonControlMessage,
+  IDaemonClientCaps,
   IDaemonFrame,
   IDaemonRequestEnvelope
 } from '@rushstack/rush-daemon-protocol';
@@ -58,7 +59,7 @@ export class DaemonRequestWireClient {
     return new DaemonRequestWireClient(await connectDaemonAsync(socketPath));
   }
 
-  public async handshakeAsync(): Promise<void> {
+  public async handshakeAsync(capabilities: Partial<IDaemonClientCaps> = {}): Promise<void> {
     await this.sendControlAsync(createDaemonHello(DAEMON_PROTOCOL_VERSION));
     expect((await this.readControlAsync()).kind).toBe('helloAck');
     await this.sendControlAsync({
@@ -67,7 +68,8 @@ export class DaemonRequestWireClient {
         isTTY: true,
         supportsInteractiveIO: true,
         supportsRequestAdmission: true,
-        supportsRequestLifecycle: true
+        supportsRequestLifecycle: true,
+        ...capabilities
       }
     });
     await this.sendControlAsync({ kind: 'ping', payload: {} });

From 9f5b48595f850b19a9fb289b61a02a1b9fbdff8a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:36:09 +0000
Subject: [PATCH 213/265] [rush-lib] Capture input file states only for
 operations that execute (and 2 more)

Swarm integration step 198; original commit 618be626ae (merge of swarm/m03-t257-int3 at d4e7adc6fb).
Scope: task 257.

Brings 257-int3 (branch swarm/m03-t257-int3). Second agent: t07 board 6676, board 6678. Evidence: ch01's GATE OK board 6977.

Batch E2f, item 15 of 15. Gate: ch01 GATE OK board 6977 (tree 898e931022)

Commits folded into this step (3):
- 0f91f58740 Capture input file states only for operations that execute
- 951d97e062 rush-lib: list only files in the working tree in the legacy skip test snapshot
- deca9daa46 rush-lib: add the shrinkwrap file that the CLI test snapshots list to the npm test repos

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ure-input-files-late_2026-09-29-12-56.json |  10 +
 .../RushCommandLineParserLegacySkip.test.ts   |   6 +-
 ...dLineParserPhasedDisableBuildCache.test.ts |   6 +-
 .../common/config/rush/npm-shrinkwrap.json    |   7 +
 .../common/config/rush/npm-shrinkwrap.json    |   7 +
 .../operations/CacheableOperationPlugin.ts    |  85 ++++---
 .../IncrementalExecutionGuardPlugin.ts        |  53 ++--
 .../operations/InputFilesStatSignature.ts     | 229 +++++++++++++++---
 .../src/logic/operations/LegacySkipPlugin.ts  |  60 +++--
 .../operations/OperationInputFilesCheck.ts    |  20 +-
 .../operations/RetainedResultVerification.ts  |  13 +-
 .../test/CacheableOperationPlugin.test.ts     | 210 ++++++++++++++--
 .../IncrementalExecutionGuardPlugin.test.ts   | 215 +++++++++++-----
 .../test/InputFilesStatSignature.test.ts      | 133 +++++++++-
 .../operations/test/LegacySkipPlugin.test.ts  |  23 +-
 15 files changed, 892 insertions(+), 185 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/capture-input-files-late_2026-09-29-12-56.json
 create mode 100644 libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json
 create mode 100644 libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json

diff --git a/common/changes/@microsoft/rush/capture-input-files-late_2026-09-29-12-56.json b/common/changes/@microsoft/rush/capture-input-files-late_2026-09-29-12-56.json
new file mode 100644
index 0000000000..7751b13ecb
--- /dev/null
+++ b/common/changes/@microsoft/rush/capture-input-files-late_2026-09-29-12-56.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Rush now reads the state of an operation's input files right before the operation executes, instead of reading it for every enabled operation when the command starts. Operations that are restored from the build cache or skipped are no longer read, which saves time in large repositories, especially in a Rush daemon. Input files that are edited, created or deleted after the inputs snapshot of the command was taken and before the operation starts are still detected, so outputs that were built from them are not cached or reused.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
index b629f6b17e..aa7cfce6ad 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserLegacySkip.test.ts
@@ -10,7 +10,11 @@ jest.mock(`@rushstack/package-deps-hash`, () => {
       return {
         hasSubmodules: false,
         hasUncommittedChanges: false,
-        files: new Map([['common/config/rush/npm-shrinkwrap.json', 'hash']]),
+        // The shrinkwrap file of the test repo, which every project depends on. As in the other mocks, a file's
+        // hash is its path.
+        files: new Map([
+          ['common/config/rush/npm-shrinkwrap.json', 'common/config/rush/npm-shrinkwrap.json']
+        ]),
         symlinks: new Map()
       };
     },
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
index f61b6ea786..bef6a080e3 100644
--- a/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserPhasedDisableBuildCache.test.ts
@@ -10,7 +10,11 @@ jest.mock(`@rushstack/package-deps-hash`, () => {
       return {
         hasSubmodules: false,
         hasUncommittedChanges: false,
-        files: new Map([['common/config/rush/npm-shrinkwrap.json', 'hash']]),
+        // The shrinkwrap file of the test repo, which every project depends on. As in the other mocks, a file's
+        // hash is its path.
+        files: new Map([
+          ['common/config/rush/npm-shrinkwrap.json', 'common/config/rush/npm-shrinkwrap.json']
+        ]),
         symlinks: new Map()
       };
     },
diff --git a/libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json b/libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json
new file mode 100644
index 0000000000..2377472bdd
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/legacySkipRepo/common/config/rush/npm-shrinkwrap.json
@@ -0,0 +1,7 @@
+{
+  "name": "rush-common",
+  "version": "0.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {}
+}
diff --git a/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json
new file mode 100644
index 0000000000..2377472bdd
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/phasedDisableBuildCacheRepo/common/config/rush/npm-shrinkwrap.json
@@ -0,0 +1,7 @@
+{
+  "name": "rush-common",
+  "version": "0.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {}
+}
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 31e9b550d7..6d521a9f5d 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -51,12 +51,15 @@ import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration'
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
 import {
+  CAPTURE_INPUT_FILES_STAGE,
   enableUnverifiedRetainedOperations,
   getVerifiedSkipStateHash,
   markInputFilesChecked,
   markResultUnverifiable,
   setTrustedStateHash
 } from './RetainedResultVerification';
+import { getSnapshotStartTimeMs } from './OperationInputFilesCheck';
+import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import { isBuildCacheReadSkipped, wasExecutedIncrementally } from './IncrementalExecutionState';
 
 const PLUGIN_NAME: 'CacheablePhasedOperationPlugin' = 'CacheablePhasedOperationPlugin';
@@ -104,13 +107,16 @@ export interface IOperationBuildCacheContext {
   // result is not trusted. If it is skipped, it keeps its trust, since its outputs were not built in this iteration.
   hasUnverifiedDependency: boolean;
 
-  // The on-disk state of the tracked input files whose hashes produced the cache key, captured right after
-  // the iteration's inputs snapshot. Used to refuse cache writes, and to keep a long-lived graph from skipping
-  // the operation later, if the inputs changed while the snapshot was being taken or while the operation was
-  // executing.
-  inputFilesState?: IInputFilesState;
+  // The iteration's inputs snapshot, and the start of the window in which the tracked input files may have changed
+  // after it read them (see getSnapshotStartTimeMs)
+  inputsSnapshot: IInputsSnapshot;
+  snapshotStartTimeMs: number;
   // The hashes of the tracked input files in the iteration's inputs snapshot
-  inputFileHashes?: ReadonlyMap<string, string>;
+  inputFileHashes: ReadonlyMap<string, string>;
+  // The on-disk state of the tracked input files whose hashes produced the cache key, captured right before the
+  // operation executes. Used to refuse cache writes, and to keep a long-lived graph from skipping the operation
+  // later, if the inputs changed after the snapshot read them, until the operation has executed.
+  inputFilesState?: IInputFilesState;
 }
 
 export interface ICacheableOperationPluginOptions {
@@ -162,7 +168,8 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
     newEntryPaths: ReadonlyArray<string>,
     rootDirectory: string,
     projectFolder: string,
-    outputFolderNames: ReadonlyArray<string>
+    outputFolderNames: ReadonlyArray<string>,
+    snapshotHashes: ReadonlyMap<string, string>
   ): boolean {
     const gitPath: string | undefined = this.#getGitPath();
     if (!gitPath) {
@@ -172,7 +179,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
     const outputFolderPaths: string[] = outputFolderNames.map((folderName: string) =>
       path.resolve(projectFolder, folderName)
     );
-    return hasUntrackedGitFiles(gitPath, rootDirectory, newEntryPaths, outputFolderPaths);
+    return hasUntrackedGitFiles(gitPath, rootDirectory, newEntryPaths, outputFolderPaths, snapshotHashes);
   }
 
   public apply(hooks: PhasedCommandHooks): void {
@@ -248,6 +255,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
           const { isIncrementalBuildAllowed, projectConfigurations } = context;
           const { cacheWriteEnabled } = buildCacheConfiguration;
+          const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
 
           const disjointSet: DisjointSet<Operation> | undefined = cobuildConfiguration?.cobuildFeatureEnabled
             ? new DisjointSet()
@@ -297,21 +305,6 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
 
             disjointSet?.add(operation);
 
-            // Captured even if cache writes are disabled, since a long-lived graph (e.g. the Rush daemon) must not
-            // retain outputs that were built from input files that changed during the iteration.
-            const inputFilesState: IInputFilesState | undefined =
-              record.enabled && !getCacheDisabledReason()
-                ? captureInputFilesState(
-                    inputsSnapshot.rootDirectory,
-                    fileHashes.keys(),
-                    inputsSnapshot.workingTreeReadStartTimeMs
-                  )
-                : undefined;
-            if (inputFilesState && runner.cacheable) {
-              // The input files are checked after the operation executes, so IncrementalExecutionGuardPlugin need not.
-              markInputFilesChecked(record);
-            }
-
             const buildCacheContext: IOperationBuildCacheContext = {
               // Supports cache writes by default for initial operations.
               // Don't write during watch runs for performance reasons (and to avoid flooding the cache)
@@ -334,8 +327,9 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               isCacheReadAttempted: false,
               isIncrementalResult: false,
               hasUnverifiedDependency: false,
-              inputFilesState,
-              inputFileHashes: inputFilesState ? fileHashes : undefined
+              inputsSnapshot,
+              snapshotStartTimeMs,
+              inputFileHashes: fileHashes
             };
             // Upstream runners may mutate the property of build cache context for downstream runners
             this.#buildCacheContextByOperation.set(operation, buildCacheContext);
@@ -588,6 +582,34 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      // Captured in a late tap, after the taps that can skip the operation or restore it from the build cache,
+      // so that the input files of an operation that does not execute are not read.
+      graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
+        (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+          const buildCacheContext: IOperationBuildCacheContext | undefined =
+            this.#buildCacheContextByOperation.get(record.operation);
+          if (
+            !buildCacheContext ||
+            !record.enabled ||
+            !record.operation.runner?.cacheable ||
+            buildCacheContext.cacheDisabledReason
+          ) {
+            return;
+          }
+          const { inputsSnapshot, inputFileHashes, snapshotStartTimeMs } = buildCacheContext;
+          // Captured even if cache writes are disabled, since a long-lived graph (e.g. the Rush daemon) must not
+          // retain outputs that were built from input files that changed after the inputs snapshot read them.
+          buildCacheContext.inputFilesState = captureInputFilesState(
+            inputsSnapshot.rootDirectory,
+            inputFileHashes.keys(),
+            snapshotStartTimeMs
+          );
+          // The input files are checked after the operation executes, so IncrementalExecutionGuardPlugin need not.
+          markInputFilesChecked(record);
+        }
+      );
+
       graph.hooks.afterExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (runnerContext: IOperationRunnerContext): Promise<void> => {
@@ -708,11 +730,11 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             if (!setCacheEntryPromise && taskIsSuccessful && isCacheWriteAllowed && operationBuildCache) {
               setCacheEntryPromise = () => operationBuildCache.trySetCacheEntryAsync(buildCacheTerminal);
             }
-            const { inputFilesState, inputFileHashes } = buildCacheContext;
+            const { inputFilesState, inputFileHashes, inputsSnapshot } = buildCacheContext;
             let inputFilesChangedMessage: string | undefined;
             if (!cacheRestored && inputFilesState) {
-              // If Git hashed a file that was saved during the snapshot before it was saved, the outputs were
-              // built from newer content than the cache key describes.
+              // If Git hashed a file for the inputs snapshot before it was saved, the outputs were built from newer
+              // content than the cache key describes.
               const haveSnapshotHashesChanged: boolean =
                 inputFilesState.filesChangedDuringSnapshot.length > 0 &&
                 (await haveSnapshotHashesChangedAsync(
@@ -728,15 +750,16 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
                     newEntryPaths,
                     inputFilesState.rootDirectory,
                     project.projectFolder,
-                    outputFolderNames
+                    outputFolderNames,
+                    inputsSnapshot.hashes
                   )
                 )
               ) {
                 inputFilesChangedMessage =
-                  'Input files changed while this operation was executing; not writing a build cache entry.';
+                  'Input files changed after the inputs snapshot was taken; not writing a build cache entry.';
               } else if (haveSnapshotHashesChanged) {
                 inputFilesChangedMessage =
-                  'Input files changed while the inputs snapshot was being taken; not writing a build cache entry.';
+                  'Input files changed after Git hashed them for the inputs snapshot; not writing a build cache entry.';
               }
             }
             if (inputFilesChangedMessage) {
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index ef9aa4a401..e568fd2695 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -35,9 +35,14 @@ import {
   type IOperationOutputManifest
 } from './OperationOutputManifest';
 import { captureInputFilesState, type IInputFilesState } from './InputFilesStatSignature';
-import { createGitPathGetter, haveOperationInputFilesChangedAsync } from './OperationInputFilesCheck';
+import {
+  createGitPathGetter,
+  getSnapshotStartTimeMs,
+  haveOperationInputFilesChangedAsync
+} from './OperationInputFilesCheck';
 import {
   areInputFilesChecked,
+  CAPTURE_INPUT_FILES_STAGE,
   isResultUnverifiable,
   markResultUnverifiable
 } from './RetainedResultVerification';
@@ -50,9 +55,9 @@ const RECORD_RESULT_STAGE: number = 1;
 // Runs before those checks, so that a folder that was recreated before the input folders were read makes the result
 // unverifiable.
 const READ_INPUT_FOLDERS_STAGE: number = -1;
-// Runs after the default-stage taps, e.g. those of CacheableOperationPlugin and LegacySkipPlugin, which capture the
-// input files of the operations whose input files they check.
-const CAPTURE_INPUT_FILES_STAGE: number = 1;
+// Runs after the taps of CacheableOperationPlugin and LegacySkipPlugin that capture the input files of the operations
+// whose input files they check.
+const CAPTURE_UNCHECKED_INPUT_FILES_STAGE: number = CAPTURE_INPUT_FILES_STAGE + 1;
 
 const MAX_EXAMPLE_PATHS: number = 3;
 
@@ -288,11 +293,13 @@ interface IIncrementalBase {
 interface IRecordState {
   readonly records: ReadonlyMap<Operation, IOperationExecutionResult>;
   readonly inputsSnapshot: IInputsSnapshot;
+  // See getSnapshotStartTimeMs
+  readonly snapshotStartTimeMs: number;
   readonly getOperationEnvironment: IOperationGraphIterationOptions['getOperationEnvironment'];
   preRunOutputs?: IOperationOutputManifest;
   verifiedOutputs?: IOutputState;
   inputFolders?: ReadonlyMap<string, string>;
-  // Captured right after the inputs snapshot, if this plugin checks the operation's input files.
+  // Captured right before the operation executes, if this plugin checks the operation's input files.
   inputFilesState?: IInputFilesState;
 }
 
@@ -325,8 +332,14 @@ function applyToGraph(graph: IOperationGraph): void {
         forgetAllBases();
         return;
       }
+      const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
       for (const record of records.values()) {
-        const recordState: IRecordState = { records, inputsSnapshot, getOperationEnvironment };
+        const recordState: IRecordState = {
+          records,
+          inputsSnapshot,
+          snapshotStartTimeMs,
+          getOperationEnvironment
+        };
         stateByRecord.set(record, recordState);
         const guard: IIncrementalExecutionGuard = {
           getBlockReasonAsync: (options?: IIncrementalExecutionGuardOptions) =>
@@ -341,20 +354,20 @@ function applyToGraph(graph: IOperationGraph): void {
 
   const getGitPath: () => string | undefined = createGitPathGetter();
 
-  graph.hooks.beforeExecuteIterationAsync.tap(
-    { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
-    (records: ReadonlyMap<Operation, IOperationExecutionResult>): void => {
-      for (const record of records.values()) {
-        const recordState: IRecordState | undefined = stateByRecord.get(record);
-        const { runner, associatedProject: project, associatedPhase: phase } = record.operation;
-        if (recordState && record.enabled && runner && !runner.isNoOp && !areInputFilesChecked(record)) {
-          const { inputsSnapshot } = recordState;
-          recordState.inputFilesState = captureInputFilesState(
-            inputsSnapshot.rootDirectory,
-            inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name).keys(),
-            inputsSnapshot.workingTreeReadStartTimeMs
-          );
-        }
+  // Captured in a late tap, after the taps that can skip the operation or restore it from the build cache, so that
+  // the input files of an operation that does not execute are not read.
+  graph.hooks.beforeExecuteOperationAsync.tap(
+    { name: PLUGIN_NAME, stage: CAPTURE_UNCHECKED_INPUT_FILES_STAGE },
+    (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+      const recordState: IRecordState | undefined = stateByRecord.get(record);
+      const { runner, associatedProject: project, associatedPhase: phase } = record.operation;
+      if (recordState && record.enabled && runner && !runner.isNoOp && !areInputFilesChecked(record)) {
+        const { inputsSnapshot, snapshotStartTimeMs } = recordState;
+        recordState.inputFilesState = captureInputFilesState(
+          inputsSnapshot.rootDirectory,
+          inputsSnapshot.getTrackedFileHashesForOperation(project, phase.name).keys(),
+          snapshotStartTimeMs
+        );
       }
     }
   );
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
index 05510c71fd..dbfa8ab853 100644
--- a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -36,8 +36,9 @@ function millisecondsToNanoseconds(timeMs: number): bigint {
 }
 
 /**
- * The on-disk state of an operation's tracked input files, captured right after the inputs snapshot
- * (from which the operation's build cache key is derived) was taken.
+ * The on-disk state of an operation's tracked input files, captured right before the operation executes. The
+ * changes that were made after the inputs snapshot (from which the operation's build cache key is derived) began
+ * reading the working tree, and before this state was captured, are found from file and folder times.
  */
 export interface IInputFilesState {
   /**
@@ -53,8 +54,11 @@ export interface IInputFilesState {
    */
   readonly statSignature: string;
   /**
-   * For each folder inside the repository that contains a tracked input file, the names of its entries.
-   * Used to detect files (or folders) that were created after the snapshot was taken.
+   * For each folder inside the repository that contains a tracked input file, the names of the entries that it had
+   * when the inputs snapshot read the working tree. Used to detect files (or folders) that were created afterwards.
+   * For a folder that did not change after the snapshot began reading the working tree, these are its entries when
+   * this state was captured. For a folder that did, they are only the names that lead to tracked input files and
+   * the entries whose times are all before that time.
    */
   readonly folderEntries: ReadonlyMap<string, ReadonlySet<string>>;
   /**
@@ -64,6 +68,13 @@ export interface IInputFilesState {
    * build cache key was derived) may be stale even though its stats do not change again.
    */
   readonly filesChangedDuringSnapshot: ReadonlyArray<string>;
+  /**
+   * The tracked input file paths, as passed to `captureInputFilesState`, that were missing when this state was
+   * captured, and whose folder (or, if it is missing, the nearest folder above it) changed after the inputs snapshot
+   * began reading the working tree. The snapshot has a hash of such a file, so the file was deleted after Git read
+   * it, unless Git does not read it from the working tree (e.g. it is marked `skip-worktree`).
+   */
+  readonly filesDeletedDuringSnapshot: ReadonlyArray<string>;
 }
 
 /**
@@ -82,7 +93,7 @@ export function getInputFilesStatSignature(filePaths: Iterable<string>): string
 
 function hashInputFilesStats(
   filePaths: Iterable<string>,
-  onStats?: (index: number, stats: fs.BigIntStats) => void
+  onStats?: (index: number, stats: fs.BigIntStats | undefined) => void
 ): string {
   const hasher: crypto.Hash = crypto.createHash('sha1');
   let index: number = 0;
@@ -90,15 +101,48 @@ function hashInputFilesStats(
     const stats: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
     if (stats) {
       hasher.update(`${filePath}\0${stats.size}\0${stats.mtimeNs}\0${stats.ino}\n`);
-      onStats?.(index, stats);
     } else {
       hasher.update(`${filePath}\0missing\n`);
     }
+    onStats?.(index, stats);
     index++;
   }
   return hasher.digest('hex');
 }
 
+/**
+ * Returns true if the modification or status change time of the folder is at or after the specified time.
+ * Deleting a folder changes the folder that held it, so a missing folder is judged by the nearest folder above it
+ * that exists.
+ */
+function hasFolderChangedSince(folderPath: string, timeNs: bigint): boolean {
+  let currentPath: string = folderPath;
+  for (;;) {
+    let stats: fs.BigIntStats | undefined;
+    try {
+      stats = fs.statSync(currentPath, { bigint: true, throwIfNoEntry: false });
+    } catch {
+      // E.g. ENOTDIR, if a folder above it was replaced by a file
+    }
+    if (stats) {
+      return stats.mtimeNs >= timeNs || stats.ctimeNs >= timeNs;
+    }
+    const parentPath: string = path.dirname(currentPath);
+    if (parentPath === currentPath) {
+      return true;
+    }
+    currentPath = parentPath;
+  }
+}
+
+function tryGetLinkStats(entryPath: string): fs.BigIntStats | undefined {
+  try {
+    return fs.lstatSync(entryPath, { bigint: true, throwIfNoEntry: false });
+  } catch {
+    return undefined;
+  }
+}
+
 function tryReadFolderEntries(folderPath: string): Set<string> | undefined {
   try {
     return new Set(fs.readdirSync(folderPath));
@@ -108,14 +152,15 @@ function tryReadFolderEntries(folderPath: string): Set<string> | undefined {
 }
 
 /**
- * Captures the on-disk state of an operation's tracked input files.
+ * Captures the on-disk state of an operation's tracked input files. Call it right before the operation executes.
  *
  * @param rootDirectory - The repository root that relative input file paths are resolved against
  * @param inputFilePaths - The tracked input file paths. Relative paths are resolved against `rootDirectory`;
  *   absolute paths (e.g. `dependsOnAdditionalFiles` outside of the repository) are stat'ed but their folders
  *   are not watched for new entries.
  * @param snapshotStartTimeMs - When the inputs snapshot began reading the working tree
- *   (`IInputsSnapshot.workingTreeReadStartTimeMs`), if known. Used to compute `filesChangedDuringSnapshot`.
+ *   (`IInputsSnapshot.workingTreeReadStartTimeMs`), if known. Used to compute `filesChangedDuringSnapshot` and
+ *   `filesDeletedDuringSnapshot`, and to find the folders whose entries may have been created after that time.
  */
 export function captureInputFilesState(
   rootDirectory: string,
@@ -124,16 +169,16 @@ export function captureInputFilesState(
 ): IInputFilesState {
   const originalFilePaths: string[] = [];
   const filePaths: string[] = [];
-  const folderEntries: Map<string, ReadonlySet<string>> = new Map();
+  // The absolute paths of the input files whose folders are watched for new entries, and those folders
+  const watchedFilePaths: string[] = [];
+  const folderPaths: Set<string> = new Set();
   for (const inputFilePath of inputFilePaths) {
     const absolutePath: string = path.resolve(rootDirectory, inputFilePath);
     originalFilePaths.push(inputFilePath);
     filePaths.push(absolutePath);
     if (!path.isAbsolute(inputFilePath)) {
-      const folderPath: string = path.dirname(absolutePath);
-      if (!folderEntries.has(folderPath)) {
-        folderEntries.set(folderPath, tryReadFolderEntries(folderPath) ?? new Set());
-      }
+      watchedFilePaths.push(absolutePath);
+      folderPaths.add(path.dirname(absolutePath));
     }
   }
   const windowStartNs: bigint | undefined =
@@ -142,17 +187,27 @@ export function captureInputFilesState(
       : millisecondsToNanoseconds(snapshotStartTimeMs - FILE_TIME_TOLERANCE_MS);
   // For each file with a time at or after the start of the window, the earliest such time
   const earliestTimeInWindowNsByIndex: Map<number, bigint> = new Map();
-  const statSignature: string = hashInputFilesStats(filePaths, (index: number, stats: fs.BigIntStats) => {
-    if (windowStartNs === undefined) {
-      return;
-    }
-    for (const timeNs of [stats.mtimeNs, stats.ctimeNs]) {
-      const earliestTimeNs: bigint | undefined = earliestTimeInWindowNsByIndex.get(index);
-      if (timeNs >= windowStartNs && (earliestTimeNs === undefined || timeNs < earliestTimeNs)) {
-        earliestTimeInWindowNsByIndex.set(index, timeNs);
+  const missingFileIndexes: number[] = [];
+  // The files are stat'ed before their folders, so that a file that is deleted after its stat changes the signature,
+  // and a file that is deleted before its stat changes the times of its folder.
+  const statSignature: string = hashInputFilesStats(
+    filePaths,
+    (index: number, stats: fs.BigIntStats | undefined) => {
+      if (windowStartNs === undefined) {
+        return;
+      }
+      if (!stats) {
+        missingFileIndexes.push(index);
+        return;
+      }
+      for (const timeNs of [stats.mtimeNs, stats.ctimeNs]) {
+        const earliestTimeNs: bigint | undefined = earliestTimeInWindowNsByIndex.get(index);
+        if (timeNs >= windowStartNs && (earliestTimeNs === undefined || timeNs < earliestTimeNs)) {
+          earliestTimeInWindowNsByIndex.set(index, timeNs);
+        }
       }
     }
-  });
+  );
   // The window ends after the files were stat'ed, so that a save during the loop is inside it. A later file time
   // (e.g. an mtime set in the future) is not a save during the window.
   const windowEndNs: bigint = millisecondsToNanoseconds(Date.now() + FILE_TIME_TOLERANCE_MS);
@@ -162,7 +217,89 @@ export function captureInputFilesState(
       filesChangedDuringSnapshot.push(originalFilePaths[index]);
     }
   }
-  return { rootDirectory, filePaths, statSignature, folderEntries, filesChangedDuringSnapshot };
+
+  const folderEntries: Map<string, ReadonlySet<string>> = new Map();
+  const hasFolderChangedByPath: Map<string, boolean> = new Map();
+  // The entries that each folder that changed during the window had when it was read
+  let entriesByChangedFolder: Map<string, ReadonlySet<string> | undefined> | undefined;
+  for (const folderPath of folderPaths) {
+    // Read before the folder is stat'ed, so that an entry that is created after it was read either changes the
+    // times of the folder or is missing from the entries that are compared later.
+    const entries: Set<string> | undefined = tryReadFolderEntries(folderPath);
+    const hasFolderChanged: boolean =
+      windowStartNs !== undefined && hasFolderChangedSince(folderPath, windowStartNs);
+    hasFolderChangedByPath.set(folderPath, hasFolderChanged);
+    if (hasFolderChanged) {
+      entriesByChangedFolder ??= new Map();
+      entriesByChangedFolder.set(folderPath, entries);
+    } else {
+      folderEntries.set(folderPath, entries ?? new Set());
+    }
+  }
+  if (entriesByChangedFolder && windowStartNs !== undefined) {
+    // The entries of a folder that changed during the window may include some that were created after the snapshot
+    // read the working tree. Only those that are known to have existed before are compared later: the names that
+    // lead to tracked input files, and the entries that were not created, moved or modified during the window.
+    const originalEntriesByChangedFolder: Map<string, Set<string>> = new Map();
+    for (const folderPath of entriesByChangedFolder.keys()) {
+      const originalEntries: Set<string> = new Set();
+      originalEntriesByChangedFolder.set(folderPath, originalEntries);
+      folderEntries.set(folderPath, originalEntries);
+    }
+    for (const filePath of watchedFilePaths) {
+      originalEntriesByChangedFolder.get(path.dirname(filePath))?.add(path.basename(filePath));
+    }
+    // Each folder on the path from the root to a folder of input files is visited once.
+    const resolvedRootDirectory: string = path.resolve(rootDirectory);
+    const visitedFolderPaths: Set<string> = new Set();
+    for (const folderPath of folderPaths) {
+      let childPath: string = folderPath;
+      while (childPath !== resolvedRootDirectory && !visitedFolderPaths.has(childPath)) {
+        visitedFolderPaths.add(childPath);
+        const parentPath: string = path.dirname(childPath);
+        if (parentPath === childPath) {
+          break;
+        }
+        originalEntriesByChangedFolder.get(parentPath)?.add(path.basename(childPath));
+        childPath = parentPath;
+      }
+    }
+    for (const [folderPath, entries] of entriesByChangedFolder) {
+      const originalEntries: Set<string> = originalEntriesByChangedFolder.get(folderPath)!;
+      for (const entry of entries ?? []) {
+        if (!originalEntries.has(entry)) {
+          // Creating, moving, or modifying an entry changes its status change time, which cannot be set back.
+          const stats: fs.BigIntStats | undefined = tryGetLinkStats(path.join(folderPath, entry));
+          if (stats && stats.ctimeNs < windowStartNs && stats.mtimeNs < windowStartNs) {
+            originalEntries.add(entry);
+          }
+        }
+      }
+    }
+  }
+
+  const filesDeletedDuringSnapshot: string[] = [];
+  if (windowStartNs !== undefined) {
+    for (const index of missingFileIndexes) {
+      const folderPath: string = path.dirname(filePaths[index]);
+      let hasFolderChanged: boolean | undefined = hasFolderChangedByPath.get(folderPath);
+      if (hasFolderChanged === undefined) {
+        hasFolderChanged = hasFolderChangedSince(folderPath, windowStartNs);
+        hasFolderChangedByPath.set(folderPath, hasFolderChanged);
+      }
+      if (hasFolderChanged) {
+        filesDeletedDuringSnapshot.push(originalFilePaths[index]);
+      }
+    }
+  }
+  return {
+    rootDirectory,
+    filePaths,
+    statSignature,
+    folderEntries,
+    filesChangedDuringSnapshot,
+    filesDeletedDuringSnapshot
+  };
 }
 
 /**
@@ -184,17 +321,39 @@ export function getNewFolderEntries(folderEntries: ReadonlyMap<string, ReadonlyS
 }
 
 /**
- * Returns true if any of the operation's tracked input files was modified, deleted, or replaced, or if a
- * potential new input file was created in one of the input folders, since the state was captured.
+ * Returns true if any of the operation's tracked input files was deleted after the inputs snapshot read it and
+ * before the state was captured, or, since the state was captured, if any of them was modified, deleted, or
+ * replaced, or a potential new input file was created in one of the input folders. A file that was created in a
+ * folder that changed during the window can have been created before the state was captured.
  */
 export function haveInputFilesChanged(state: IInputFilesState, isNewInput: IsNewInputCallback): boolean {
+  if (state.filesDeletedDuringSnapshot.length > 0) {
+    return true;
+  }
   if (getInputFilesStatSignature(state.filePaths) !== state.statSignature) {
     return true;
   }
-  const newEntryPaths: string[] = getNewFolderEntries(state.folderEntries);
+  const newEntryPaths: string[] = getNewFolderEntries(state.folderEntries).filter(mayHoldFiles);
   return newEntryPaths.length > 0 && isNewInput(newEntryPaths);
 }
 
+/**
+ * Returns false if the entry is missing, or is a folder that holds no files, not even in its subfolders. Git does
+ * not track folders, so such a folder cannot hold a potential input file.
+ */
+function mayHoldFiles(entryPath: string): boolean {
+  let entries: fs.Dirent[];
+  try {
+    entries = fs.readdirSync(entryPath, { withFileTypes: true });
+  } catch (error) {
+    // E.g. ENOTDIR for a file
+    return (error as NodeJS.ErrnoException).code !== 'ENOENT';
+  }
+  return entries.some(
+    (entry: fs.Dirent) => !entry.isDirectory() || mayHoldFiles(path.join(entryPath, entry.name))
+  );
+}
+
 /**
  * Returns the Git blob hash of the content that a file has on disk, computed with the algorithm of
  * `expectedHash`, or undefined if it is not hashed in process. Unlike `git hash-object`, it applies no clean
@@ -276,12 +435,17 @@ function toGitPathspec(rootDirectory: string, absolutePath: string): string {
  * Uses Git to determine whether any of the specified paths is, or contains, an untracked file that is not
  * ignored by `.gitignore`, excluding the specified folders (typically the operation's output folders).
  * If Git fails, conservatively returns true.
+ *
+ * @param snapshotHashes - The hashes of the files in the inputs snapshot, by path relative to `rootDirectory`, if
+ *   known. An untracked file that the snapshot hashed existed when the snapshot read the working tree, so it does
+ *   not count.
  */
 export function hasUntrackedGitFiles(
   gitPath: string,
   rootDirectory: string,
   candidatePaths: ReadonlyArray<string>,
-  excludedFolderPaths: ReadonlyArray<string>
+  excludedFolderPaths: ReadonlyArray<string>,
+  snapshotHashes?: ReadonlyMap<string, string>
 ): boolean {
   const args: string[] = ['ls-files', '--others', '--exclude-standard', '-z', '--'];
   for (const candidatePath of candidatePaths) {
@@ -296,5 +460,14 @@ export function hasUntrackedGitFiles(
   if (result.status !== 0) {
     return true;
   }
-  return result.stdout.length > 0;
+  if (!snapshotHashes) {
+    return result.stdout.length > 0;
+  }
+  // The paths are relative to the root, since Git ran there, and are separated by NUL characters.
+  for (const filePath of result.stdout.split('\0')) {
+    if (filePath && !snapshotHashes.has(filePath)) {
+      return true;
+    }
+  }
+  return false;
 }
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index aa25d06779..2d29e4aa43 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -15,8 +15,13 @@ import type { IOperationRunnerContext } from './IOperationRunner';
 import type { IOperationExecutionResult } from './IOperationExecutionResult';
 import { wasExecutedIncrementally } from './IncrementalExecutionState';
 import { captureInputFilesState, type IInputFilesState } from './InputFilesStatSignature';
-import { createGitPathGetter, haveOperationInputFilesChangedAsync } from './OperationInputFilesCheck';
 import {
+  createGitPathGetter,
+  getSnapshotStartTimeMs,
+  haveOperationInputFilesChangedAsync
+} from './OperationInputFilesCheck';
+import {
+  CAPTURE_INPUT_FILES_STAGE,
   isResultUnverifiable,
   markInputFilesChecked,
   markResultUnverifiable
@@ -61,8 +66,12 @@ export interface IProjectDeps {
 
 interface IInputFilesCheck {
   readonly inputsSnapshot: IInputsSnapshot;
-  // Captured right after the inputs snapshot
-  readonly inputFilesState: IInputFilesState;
+  // See getSnapshotStartTimeMs
+  readonly snapshotStartTimeMs: number;
+  // The hashes of the tracked input files in the inputs snapshot
+  readonly fileHashes: ReadonlyMap<string, string>;
+  // Captured right before the operation executes
+  inputFilesState?: IInputFilesState;
 }
 
 interface ILegacySkipRecord {
@@ -122,6 +131,9 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
           const { inputsSnapshot } = iterationOptions;
           const allowSkip: boolean =
             isIncrementalBuildAllowed && iterationOptions.isIncrementalBuildAllowed !== false;
+          const snapshotStartTimeMs: number | undefined = inputsSnapshot
+            ? getSnapshotStartTimeMs(inputsSnapshot)
+            : undefined;
 
           for (const record of operations.values()) {
             const { operation } = record;
@@ -160,26 +172,13 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
                 files[filePath] = fileHash;
               }
 
-              // A later command skips the operation if its input files match the recorded ones, so the file is only
-              // written if the input files do not change from the inputs snapshot until the operation has executed.
-              const inputFilesState: IInputFilesState | undefined =
-                record.enabled && !runner.isNoOp
-                  ? captureInputFilesState(
-                      inputsSnapshot.rootDirectory,
-                      fileHashes.keys(),
-                      inputsSnapshot.workingTreeReadStartTimeMs
-                    )
-                  : undefined;
-
               packageDeps = {
                 files,
                 arguments: runner.getConfigHash()
               };
 
-              if (inputFilesState) {
-                inputFilesCheck = { inputsSnapshot, inputFilesState };
-                // So that IncrementalExecutionGuardPlugin does not check them as well
-                markInputFilesChecked(record);
+              if (record.enabled && !runner.isNoOp && snapshotStartTimeMs !== undefined) {
+                inputFilesCheck = { inputsSnapshot, snapshotStartTimeMs, fileHashes };
               }
             } catch (error) {
               // To test this code path:
@@ -287,6 +286,30 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      // Captured in a late tap, after the taps that can skip the operation, so that the input files of an operation
+      // that does not execute are not read.
+      graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: PLUGIN_NAME, stage: CAPTURE_INPUT_FILES_STAGE },
+        (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+          const inputFilesCheck: IInputFilesCheck | undefined = stateMap.get(
+            record.operation
+          )?.inputFilesCheck;
+          if (!inputFilesCheck || !record.enabled) {
+            return;
+          }
+          // A later command skips the operation if its input files match the recorded ones, so the file is only
+          // written if the input files do not change from the inputs snapshot until the operation has executed.
+          const { inputsSnapshot, snapshotStartTimeMs, fileHashes } = inputFilesCheck;
+          inputFilesCheck.inputFilesState = captureInputFilesState(
+            inputsSnapshot.rootDirectory,
+            fileHashes.keys(),
+            snapshotStartTimeMs
+          );
+          // So that IncrementalExecutionGuardPlugin does not check them as well
+          markInputFilesChecked(record);
+        }
+      );
+
       graph.hooks.afterExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
@@ -298,6 +321,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
           skipRecord.inputFilesCheck = undefined;
           const { status } = record;
           if (
+            inputFilesState &&
             (status === OperationStatus.Success || status === OperationStatus.SuccessWithWarning) &&
             !isResultUnverifiable(record) &&
             (await haveOperationInputFilesChangedAsync(record, inputsSnapshot, inputFilesState, getGitPath))
diff --git a/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts b/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
index 9fd55d2d44..fbb9cf254c 100644
--- a/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationInputFilesCheck.ts
@@ -31,6 +31,15 @@ export function createGitPathGetter(): () => string | undefined {
   };
 }
 
+/**
+ * Returns the start of the window in which an operation's input files may have changed after the inputs snapshot
+ * read them: when the snapshot began reading the working tree, or, if that is not known, the current time. Call it
+ * when the iteration begins, before any of its operations execute.
+ */
+export function getSnapshotStartTimeMs(inputsSnapshot: IInputsSnapshot): number {
+  return inputsSnapshot.workingTreeReadStartTimeMs ?? Date.now();
+}
+
 /**
  * Returns the absolute paths of the folders that an operation's command writes in its project: its metadata folder and
  * its output folders.
@@ -44,9 +53,9 @@ function getOutputFolderPaths(record: IOperationExecutionResult): string[] {
 }
 
 /**
- * Returns true if an operation's input files changed since their state was captured: a file was modified, deleted or
- * replaced, a potential input file was created in a folder that holds its input files, or a file was saved while the
- * inputs snapshot was being taken, after Git hashed it.
+ * Returns true if an operation's input files changed after the inputs snapshot read them: a file was deleted before
+ * their state was captured, or, since then, a file was modified, deleted or replaced, or a potential input file was
+ * created in a folder that holds its input files, or a file was saved after Git hashed it.
  */
 export async function haveOperationInputFilesChangedAsync(
   record: IOperationExecutionResult,
@@ -67,7 +76,10 @@ export async function haveOperationInputFilesChangedAsync(
     }
     const gitPath: string | undefined = getGitPath();
     // Without Git it cannot be told whether the new entries are ignored, so they count as inputs.
-    return !gitPath || hasUntrackedGitFiles(gitPath, rootDirectory, candidatePaths, outputFolderPaths);
+    return (
+      !gitPath ||
+      hasUntrackedGitFiles(gitPath, rootDirectory, candidatePaths, outputFolderPaths, inputsSnapshot.hashes)
+    );
   };
   if (haveInputFilesChanged(inputFilesState, isNewInput)) {
     return true;
diff --git a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
index 486f4aeba7..155e56671a 100644
--- a/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
+++ b/libraries/rush-lib/src/logic/operations/RetainedResultVerification.ts
@@ -12,7 +12,7 @@ const trustedStateHashByResult: WeakMap<IOperationExecutionResult, string> = new
 
 /**
  * Records that the outputs of a result of the executing iteration may not match its state hash, e.g. because input
- * files of the operation changed while the inputs snapshot was being taken or while the operation was executing.
+ * files of the operation changed after the inputs snapshot read them, until the operation had executed.
  * Such a result is never verified at its state hash, so a later iteration of a long-lived graph runs the operation
  * again, and the consumers that were built against its outputs, instead of skipping them.
  *
@@ -31,13 +31,22 @@ export function isResultUnverifiable(result: IOperationExecutionResult): boolean
   return unverifiableResults.has(result);
 }
 
+/**
+ * The stage of the `beforeExecuteOperationAsync` taps that capture the state of the input files of an operation,
+ * to check after it executes whether they changed. It is later than the taps that can return a status instead of
+ * executing the operation (e.g. skip detection or a restore from the build cache), so that the input files of an
+ * operation that does not execute are not read.
+ */
+export const CAPTURE_INPUT_FILES_STAGE: number = Number.MAX_SAFE_INTEGER - 1;
+
 /**
  * Records that a plugin checks whether the input files of the operation change from the inputs snapshot of the
  * executing iteration until the operation has executed, and calls `markResultUnverifiable` for the result if they do,
  * so that `IncrementalExecutionGuardPlugin` does not check them as well.
  *
  * @remarks
- * Call this from a `beforeExecuteIterationAsync` tap with the default stage.
+ * Call this from a `beforeExecuteOperationAsync` tap with the stage `CAPTURE_INPUT_FILES_STAGE`.
+ * `IncrementalExecutionGuardPlugin` reads it from a tap with a later stage.
  */
 export function markInputFilesChecked(result: IOperationExecutionResult): void {
   resultsWithCheckedInputFiles.add(result);
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index 34cf288b51..db4d60e891 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -48,7 +48,14 @@ jest.mock('@rushstack/package-deps-hash', () => {
   );
   return { ...actual, hashFilesAsync: jest.fn(actual.hashFilesAsync) };
 });
+jest.mock('../InputFilesStatSignature', () => {
+  const actual: typeof import('../InputFilesStatSignature') = jest.requireActual(
+    '../InputFilesStatSignature'
+  );
+  return { ...actual, captureInputFilesState: jest.fn(actual.captureInputFilesState) };
+});
 
+import * as child_process from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
@@ -73,8 +80,12 @@ import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
-import { FILE_TIME_TOLERANCE_MS } from '../InputFilesStatSignature';
-import { areInputFilesChecked } from '../RetainedResultVerification';
+import {
+  captureInputFilesState,
+  FILE_TIME_TOLERANCE_MS,
+  type IInputFilesState
+} from '../InputFilesStatSignature';
+import { areInputFilesChecked, CAPTURE_INPUT_FILES_STAGE } from '../RetainedResultVerification';
 
 const mockPhase: IPhase = {
   name: 'phase',
@@ -125,6 +136,10 @@ interface ITestGraph {
   cacheDisabledReasonComputations: string[];
   executions: string[];
   cacheWrites: string[];
+  // The names of the operations that are restored from the build cache
+  cacheHits: Set<string>;
+  // The hashes of the inputs snapshot, by path relative to the root directory
+  snapshotHashes: Map<string, string>;
   // Called when an operation executes, e.g. to save one of its input files while it executes
   onExecute: ((name: string) => void) | undefined;
   executeAsync(workingTreeReadStartTimeMs?: number): Promise<IExecutionResult>;
@@ -141,6 +156,8 @@ async function createTestGraphAsync(
 ): Promise<ITestGraph> {
   const executions: string[] = [];
   const cacheWrites: string[] = [];
+  const cacheHits: Set<string> = new Set();
+  const snapshotHashes: Map<string, string> = new Map();
   const localHashes: Map<string, string> = new Map();
   const trackedFileHashes: Map<string, Map<string, string>> = new Map();
   const cacheDisabledReasons: Map<string, string> = new Map();
@@ -178,7 +195,7 @@ async function createTestGraphAsync(
   jest.mocked(OperationBuildCache.forOperation).mockImplementation(
     (record) =>
       ({
-        tryRestoreFromCacheAsync: async () => false,
+        tryRestoreFromCacheAsync: async () => cacheHits.has(record.operation.associatedProject.packageName),
         trySetCacheEntryAsync: async () => {
           cacheWrites.push(record.operation.associatedProject.packageName);
           return true;
@@ -223,6 +240,8 @@ async function createTestGraphAsync(
     cacheDisabledReasonComputations,
     executions,
     cacheWrites,
+    cacheHits,
+    snapshotHashes,
     get onExecute(): ((name: string) => void) | undefined {
       return onExecute;
     },
@@ -234,7 +253,7 @@ async function createTestGraphAsync(
       cacheWrites.length = 0;
       cacheDisabledReasonComputations.length = 0;
       const inputsSnapshot: IInputsSnapshot = {
-        hashes: new Map(),
+        hashes: snapshotHashes,
         rootDirectory,
         hasUncommittedChanges: false,
         workingTreeReadStartTimeMs,
@@ -525,27 +544,188 @@ describe(CacheableOperationPlugin.name, () => {
     );
   });
 
+  describe('input files that change after the inputs snapshot and before an operation executes', () => {
+    const names: string[] = ['a', 'b', 'c'];
+    let rootDirectory: string;
+
+    function getInputFile(name: string): string {
+      return `${name}/src/index.ts`;
+    }
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      for (const name of names) {
+        fs.mkdirSync(path.join(rootDirectory, name, 'src'), { recursive: true });
+        fs.writeFileSync(path.join(rootDirectory, getInputFile(name)), `export const ${name} = 1;`);
+      }
+      // So that Git can tell which new files are ignored
+      child_process.execFileSync('git', ['init', '-q'], { cwd: rootDirectory, stdio: 'ignore' });
+      fs.writeFileSync(path.join(rootDirectory, '.gitignore'), '*.log\n');
+      jest.mocked(captureInputFilesState).mockClear();
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    async function createGraphWithInputFilesAsync(): Promise<ITestGraph> {
+      const testGraph: ITestGraph = await createTestGraphAsync(names, rootDirectory);
+      for (const name of names) {
+        const hash: string = getGitBlobHash(`export const ${name} = 1;`);
+        testGraph.trackedFileHashes.set(name, new Map([[getInputFile(name), hash]]));
+        testGraph.snapshotHashes.set(getInputFile(name), hash);
+      }
+      return testGraph;
+    }
+
+    // The names of the operations whose input files were captured, in order
+    function getCapturedOperationNames(): string[] {
+      return jest
+        .mocked(captureInputFilesState)
+        .mock.results.map(
+          ({ value }) =>
+            path.relative(rootDirectory, (value as IInputFilesState).filePaths[0]).split(path.sep)[0]
+        );
+    }
+
+    // Like a save after the inputs snapshot read the working tree, and before the operation starts
+    function changeBeforeExecuting(testGraph: ITestGraph, name: string, change: () => void): void {
+      let pendingChange: (() => void) | undefined = change;
+      testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'changeBeforeExecuting', stage: CAPTURE_INPUT_FILES_STAGE - 1 },
+        (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+          if (record.operation.associatedProject.packageName === name) {
+            pendingChange?.();
+            pendingChange = undefined;
+          }
+          return undefined;
+        }
+      );
+    }
+
+    it('captures the input files of only the operations that execute', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      testGraph.cacheHits.add('a');
+      // Like a plugin that skips an operation whose outputs are up to date, if there is no cache entry for it
+      testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'test', stage: 10 },
+        (record: IOperationRunnerContext & IOperationExecutionResult): OperationStatus | undefined =>
+          record.operation.associatedProject.packageName === 'b' ? OperationStatus.Skipped : undefined
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(getStatus(testGraph, result, 'a')).toBe(OperationStatus.FromCache);
+      expect(getStatus(testGraph, result, 'b')).toBe(OperationStatus.Skipped);
+      expect(testGraph.executions).toEqual(['c']);
+      expect(getCapturedOperationNames()).toEqual(['c']);
+    });
+
+    it('checks the input files of an operation that a plugin made cacheable again after the iteration started', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      const runner: { cacheable: boolean } = testGraph.operations.get('a')!.runner as { cacheable: boolean };
+      // Like a plugin that marks the runner of an operation that it skips as not cacheable, and resets the runner
+      // in a tap that runs after that of CacheableOperationPlugin.
+      let skipsOperation: boolean = true;
+      testGraph.graph.hooks.beforeExecuteIterationAsync.tap('test', (): undefined => {
+        runner.cacheable = true;
+        return undefined;
+      });
+      testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'test', stage: -1000 },
+        (record: IOperationRunnerContext & IOperationExecutionResult): OperationStatus | undefined => {
+          if (skipsOperation && record.operation.associatedProject.packageName === 'a') {
+            runner.cacheable = false;
+            return OperationStatus.Skipped;
+          }
+          return undefined;
+        }
+      );
+      await testGraph.executeAsync();
+      expect(testGraph.executions).toEqual(['b', 'c']);
+      expect(getCapturedOperationNames()).toEqual(['b', 'c']);
+
+      skipsOperation = false;
+      testGraph.localHashes.set('a', 'a-v2');
+      testGraph.onExecute = (name: string) => {
+        if (name === 'a') {
+          fs.writeFileSync(path.join(rootDirectory, getInputFile('a')), 'export const a = 22;');
+        }
+      };
+      jest.mocked(captureInputFilesState).mockClear();
+      await testGraph.executeAsync();
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(getCapturedOperationNames()).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual([]);
+    });
+
+    it('does not write cache entries if an input file was deleted', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      changeBeforeExecuting(testGraph, 'a', () => fs.unlinkSync(path.join(rootDirectory, getInputFile('a'))));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual([]);
+    });
+
+    it.each<[string, string, string[]]>([
+      ['does not write cache entries if a file was created in an input folder', 'a/src/new.ts', []],
+      [
+        'writes cache entries if a file that Git ignores was created in an input folder',
+        'a/src/debug.log',
+        names
+      ]
+    ])('%s', async (title: string, newFile: string, expectedCacheWrites: string[]) => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      changeBeforeExecuting(testGraph, 'a', () =>
+        fs.writeFileSync(path.join(rootDirectory, newFile), 'export const n = 1;')
+      );
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual(expectedCacheWrites);
+    });
+
+    it('writes cache entries if an untracked file that is not an input file was saved before the inputs snapshot hashed it', async () => {
+      const testGraph: ITestGraph = await createGraphWithInputFilesAsync();
+      // Like a file that matches `incrementalBuildIgnoredGlobs`
+      const untrackedFile: string = 'a/src/notes.md';
+      const content: string = 'Saved within the tolerance of the file times';
+      fs.writeFileSync(path.join(rootDirectory, untrackedFile), content);
+      testGraph.snapshotHashes.set(untrackedFile, getGitBlobHash(content));
+
+      await testGraph.executeAsync(Date.now());
+
+      expect(testGraph.executions).toEqual(['a', 'b', 'c']);
+      expect(testGraph.cacheWrites).toEqual(['a', 'b', 'c']);
+    });
+  });
+
   it('tells other plugins which operations it checks the input files of', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c', 'd']);
     testGraph.cacheDisabledReasons.set('b', 'Caching has been disabled for this project.');
     // Like a runner whose results are never written to the build cache
     (testGraph.operations.get('c')!.runner as { cacheable: boolean }).cacheable = false;
-    let checkedOperations: string[] = [];
-    // Like IncrementalExecutionGuardPlugin, which checks the input files of the other operations
-    testGraph.graph.hooks.beforeExecuteIterationAsync.tap(
-      { name: 'test', stage: 1 },
-      (records: ReadonlyMap<Operation, IOperationExecutionResult>): undefined => {
-        checkedOperations = [];
-        for (const record of records.values()) {
-          if (areInputFilesChecked(record)) {
-            checkedOperations.push(record.operation.associatedProject.packageName);
-          }
+    const checkedOperations: string[] = [];
+    testGraph.graph.hooks.beforeExecuteIterationAsync.tap('test', (): undefined => {
+      checkedOperations.length = 0;
+      return undefined;
+    });
+    // Like IncrementalExecutionGuardPlugin, which checks the input files of the other operations that execute
+    testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+      { name: 'test', stage: CAPTURE_INPUT_FILES_STAGE + 1 },
+      (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+        if (areInputFilesChecked(record)) {
+          checkedOperations.push(record.operation.associatedProject.packageName);
         }
         return undefined;
       }
     );
     await testGraph.executeAsync();
-    expect(checkedOperations).toEqual(['a', 'd']);
+    expect(checkedOperations.sort()).toEqual(['a', 'd']);
 
     testGraph.localHashes.set('d', 'd-v2');
     await testGraph.executeAsync();
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index af62a7f263..aa93c21fe0 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -37,6 +37,12 @@ jest.mock('../OperationMetadataManager', () => {
   }
   return { OperationMetadataManager: MockOperationMetadataManager };
 });
+jest.mock('../InputFilesStatSignature', () => {
+  const actual: typeof import('../InputFilesStatSignature') = jest.requireActual(
+    '../InputFilesStatSignature'
+  );
+  return { ...actual, captureInputFilesState: jest.fn(actual.captureInputFilesState) };
+});
 
 import type * as childProcess from 'node:child_process';
 import { createHash } from 'node:crypto';
@@ -76,6 +82,7 @@ import {
   type ICommandExecution,
   type IIncrementalExecutionGuardOptions
 } from '../IncrementalExecutionState';
+import { captureInputFilesState, type IInputFilesState } from '../InputFilesStatSignature';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
 import { type ILegacySkipPluginOptions, LegacySkipPlugin } from '../LegacySkipPlugin';
 import { NullOperationRunner } from '../NullOperationRunner';
@@ -84,7 +91,11 @@ import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import { OperationGraph } from '../OperationGraph';
 import { OperationStatus } from '../OperationStatus';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
-import { markInputFilesChecked, markResultUnverifiable } from '../RetainedResultVerification';
+import {
+  CAPTURE_INPUT_FILES_STAGE,
+  markInputFilesChecked,
+  markResultUnverifiable
+} from '../RetainedResultVerification';
 import { ShellOperationRunner } from '../ShellOperationRunner';
 
 const PHASE_NAME: string = '_phase:build';
@@ -663,14 +674,105 @@ async function createWorkspaceAsync(
   };
 }
 
-// Like an editor that saves a file while the command of the operation reads the input files
-function changeWhileExecuting(workspace: ITestWorkspace, change: () => void): void {
+// Changes the input files once, in a tap at the specified stage that runs before an operation executes
+function changeBeforeOperation(workspace: ITestWorkspace, stage: number, change: () => void): void {
   let pendingChange: (() => void) | undefined = change;
-  workspace.graph.hooks.beforeExecuteOperationAsync.tap('changeWhileExecuting', (): undefined => {
-    pendingChange?.();
-    pendingChange = undefined;
-    return undefined;
-  });
+  workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+    { name: 'changeInputFiles', stage },
+    (): undefined => {
+      pendingChange?.();
+      pendingChange = undefined;
+      return undefined;
+    }
+  );
+}
+
+// Like an editor that saves a file while the command of the operation reads the input files. The taps that capture
+// the input files were registered earlier, at the same or a lower stage, so they run before this one.
+function changeWhileExecuting(workspace: ITestWorkspace, change: () => void): void {
+  changeBeforeOperation(workspace, Number.MAX_SAFE_INTEGER, change);
+}
+
+// Like an editor that saves a file after the inputs snapshot read the working tree, and before the operation starts
+function changeBeforeExecuting(workspace: ITestWorkspace, change: () => void): void {
+  changeBeforeOperation(workspace, CAPTURE_INPUT_FILES_STAGE - 1, change);
+}
+
+type ChangeInputFiles = (workspace: ITestWorkspace, change: () => void) => void;
+
+const CHANGE_TIMINGS: ReadonlyArray<[string, ChangeInputFiles]> = [
+  ['while it executed', changeWhileExecuting],
+  ['between the inputs snapshot and its start', changeBeforeExecuting]
+];
+
+// A change of the input files of project "a", a change back, and an output file with its content when the outputs
+// were built from the input files after the change back ("none" if the file does not exist)
+type ChangedBackCase = [
+  string,
+  (workspace: ITestWorkspace) => void,
+  (workspace: ITestWorkspace) => void,
+  string,
+  string
+];
+
+const CHANGED_BACK_CASES: ReadonlyArray<ChangedBackCase> = [
+  [
+    'a file was edited',
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two edited'),
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
+    'a/lib/sub/two.js',
+    'two'
+  ],
+  [
+    'a file was added',
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
+    (workspace: ITestWorkspace) => workspace.deleteFile('a/src/three.ts'),
+    'a/lib/three.js',
+    'none'
+  ],
+  [
+    'a file was deleted',
+    (workspace: ITestWorkspace) => workspace.deleteFile('a/src/sub/two.ts'),
+    (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
+    'a/lib/sub/two.js',
+    'two'
+  ]
+];
+
+// A case of CHANGED_BACK_CASES, after its name: when the change is made, and how
+type TimedChangedBackCase = [
+  string,
+  string,
+  ChangeInputFiles,
+  (workspace: ITestWorkspace) => void,
+  (workspace: ITestWorkspace) => void,
+  string,
+  string
+];
+
+const TIMED_CHANGED_BACK_CASES: ReadonlyArray<TimedChangedBackCase> = CHANGE_TIMINGS.flatMap(
+  ([timing, changeInputFiles]: [string, ChangeInputFiles]) =>
+    CHANGED_BACK_CASES.map(
+      ([name, change, changeBack, outputFile, expectedOutput]: ChangedBackCase): TimedChangedBackCase => [
+        name,
+        timing,
+        changeInputFiles,
+        change,
+        changeBack,
+        outputFile,
+        expectedOutput
+      ]
+    )
+);
+
+// The names of the projects whose input files were captured since the mock was cleared, in order
+function getCapturedProjectNames(workspace: ITestWorkspace): string[] {
+  return jest
+    .mocked(captureInputFilesState)
+    .mock.results.map(
+      ({ value }) =>
+        path.relative(workspace.rootFolder, (value as IInputFilesState).filePaths[0]).split(path.sep)[0]
+    );
 }
 
 function readOutput(workspace: ITestWorkspace, relativePath: string): string | undefined {
@@ -1315,34 +1417,19 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
   });
 
   describe('with input files that change while the operation executes', () => {
-    it.each<
-      [string, (workspace: ITestWorkspace) => void, (workspace: ITestWorkspace) => void, string, string]
-    >([
-      [
-        'a file was edited',
-        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two edited'),
-        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
-        'a/lib/sub/two.js',
-        'two'
-      ],
-      [
-        'a file was added',
-        (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
-        (workspace: ITestWorkspace) => workspace.deleteFile('a/src/three.ts'),
-        'a/lib/three.js',
-        'none'
-      ]
-    ])(
-      'runs the operation again if %s while it executed and was changed back',
+    it.each(TIMED_CHANGED_BACK_CASES)(
+      'runs the operation again if %s %s and was changed back',
       async (
         name: string,
+        timing: string,
+        changeInputFiles: ChangeInputFiles,
         change: (workspace: ITestWorkspace) => void,
         changeBack: (workspace: ITestWorkspace) => void,
         outputFile: string,
         expectedOutput: string
       ) => {
         const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
-        changeWhileExecuting(workspace, () => change(workspace));
+        changeInputFiles(workspace, () => change(workspace));
         expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
         expect(readOutput(workspace, outputFile) ?? 'none').not.toBe(expectedOutput);
 
@@ -1503,12 +1590,10 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     it('leaves the check to another plugin that checks the input files', async () => {
       const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }]);
       // Like CacheableOperationPlugin
-      workspace.graph.hooks.beforeExecuteIterationAsync.tap(
-        'checksInputFiles',
-        (records: ReadonlyMap<Operation, IOperationExecutionResult>): undefined => {
-          for (const record of records.values()) {
-            markInputFilesChecked(record);
-          }
+      workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+        { name: 'checksInputFiles', stage: CAPTURE_INPUT_FILES_STAGE },
+        (record: IOperationExecutionResult): undefined => {
+          markInputFilesChecked(record);
           return undefined;
         }
       );
@@ -1521,6 +1606,27 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     });
   });
 
+  it('captures the input files of only the operations that execute', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([
+      { name: 'a' },
+      { name: 'b' },
+      { name: 'c' }
+    ]);
+    // Like a plugin that skips an operation whose outputs are up to date
+    workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+      { name: 'test', stage: -1000 },
+      (record: IOperationExecutionResult): OperationStatus | undefined =>
+        record.operation.associatedProject.packageName === 'b' ? OperationStatus.Skipped : undefined
+    );
+    expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'c:initial']);
+    expect(getCapturedProjectNames(workspace).sort()).toEqual(['a', 'c']);
+
+    workspace.writeFile('c/src/one.ts', 'one 2');
+    jest.mocked(captureInputFilesState).mockClear();
+    expect((await workspace.executeAsync()).commands).toEqual(['c:incremental']);
+    expect(getCapturedProjectNames(workspace)).toEqual(['c']);
+  });
+
   it('forgets every base after a native command, but not after an input change', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
     await workspace.executeAsync();
@@ -1625,34 +1731,35 @@ describe(LegacySkipPlugin.name, () => {
     expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
   });
 
-  it.each<[string, (workspace: ITestWorkspace) => void, (workspace: ITestWorkspace) => void, string, string]>(
-    [
-      [
-        'a file was edited',
-        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two edited'),
-        (workspace: ITestWorkspace) => workspace.writeFile('a/src/sub/two.ts', 'two'),
-        'a/lib/sub/two.js',
-        'two'
-      ],
-      [
-        'a file was added',
-        (workspace: ITestWorkspace) => workspace.writeFile('a/src/three.ts', 'three'),
-        (workspace: ITestWorkspace) => workspace.deleteFile('a/src/three.ts'),
-        'a/lib/three.js',
-        'none'
-      ]
-    ]
-  )(
-    'runs the operation in a later command if %s while it executed and was changed back',
+  it('does not capture the input files of an operation that it skips', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
+      hasLegacySkipDetection: true
+    });
+    expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+    // Only by LegacySkipPlugin, which checks them for IncrementalExecutionGuardPlugin
+    expect(getCapturedProjectNames(workspace)).toEqual(['a']);
+
+    startLaterCommand(workspace);
+    jest.mocked(captureInputFilesState).mockClear();
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual([]);
+    expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
+    expect(getCapturedProjectNames(workspace)).toEqual([]);
+  });
+
+  it.each(TIMED_CHANGED_BACK_CASES)(
+    'runs the operation in a later command if %s %s and was changed back',
     async (
       name: string,
+      timing: string,
+      changeInputFiles: ChangeInputFiles,
       change: (workspace: ITestWorkspace) => void,
       changeBack: (workspace: ITestWorkspace) => void,
       outputFile: string,
       expectedOutput: string
     ) => {
       const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], legacyOptions);
-      changeWhileExecuting(workspace, () => change(workspace));
+      changeInputFiles(workspace, () => change(workspace));
       expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
       expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(false);
 
diff --git a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
index 45d8d1bf3a..3b7979895c 100644
--- a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
@@ -27,6 +27,13 @@ import {
   MAX_IN_PROCESS_HASH_FILE_SIZE
 } from '../InputFilesStatSignature';
 
+const NANOSECONDS_PER_MILLISECOND: bigint = BigInt(1000000);
+
+function getLatestFileTimeMs(filePath: string): number {
+  const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
+  return Number((mtimeNs > ctimeNs ? mtimeNs : ctimeNs) / NANOSECONDS_PER_MILLISECOND);
+}
+
 describe('InputFilesStatSignature', () => {
   let tempFolder: string;
   let srcFolder: string;
@@ -34,6 +41,19 @@ describe('InputFilesStatSignature', () => {
   let fileB: string;
   let noNewInputs: jest.Mock<boolean, [ReadonlyArray<string>]>;
 
+  // Returns a snapshot start time whose window starts after the times of every existing file, once the clock of the
+  // file system has passed the start of the window, so that the files saved afterwards are inside the window.
+  function waitForNextWindow(): number {
+    const probeFile: string = path.join(tempFolder, 'probe.txt');
+    fs.writeFileSync(probeFile, '');
+    const windowStartTimeMs: number = getLatestFileTimeMs(probeFile) + 1;
+    const deadlineMs: number = Date.now() + 10000;
+    do {
+      fs.writeFileSync(probeFile, `${Date.now()}`);
+    } while (getLatestFileTimeMs(probeFile) < windowStartTimeMs && Date.now() < deadlineMs);
+    return windowStartTimeMs + FILE_TIME_TOLERANCE_MS;
+  }
+
   function capture(...absolutePaths: string[]): IInputFilesState {
     return captureAt(undefined, ...absolutePaths);
   }
@@ -121,18 +141,23 @@ describe('InputFilesStatSignature', () => {
       fs.writeFileSync(fileA, 'export const a = 3; // edited during the build');
       expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
     });
-  });
 
-  describe('filesChangedDuringSnapshot', () => {
-    const nanosecondsPerMillisecond: bigint = BigInt(1000000);
+    it('does not ask about new folders that hold no files', () => {
+      const state: IInputFilesState = capture(fileA);
+      fs.mkdirSync(path.join(srcFolder, 'empty'));
+      fs.mkdirSync(path.join(srcFolder, 'nested', 'empty'), { recursive: true });
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).not.toHaveBeenCalled();
 
-    function getLatestFileTimeMs(filePath: string): number {
-      const { mtimeNs, ctimeNs } = fs.statSync(filePath, { bigint: true });
-      return Number((mtimeNs > ctimeNs ? mtimeNs : ctimeNs) / nanosecondsPerMillisecond);
-    }
+      fs.writeFileSync(path.join(srcFolder, 'nested', 'empty', 'd.ts'), 'export const d = 1;');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).toHaveBeenCalledWith([path.join(srcFolder, 'nested')]);
+    });
+  });
 
+  describe('filesChangedDuringSnapshot', () => {
     function getStatusChangeTimeMs(filePath: string): number {
-      return Number(fs.statSync(filePath, { bigint: true }).ctimeNs / nanosecondsPerMillisecond);
+      return Number(fs.statSync(filePath, { bigint: true }).ctimeNs / NANOSECONDS_PER_MILLISECOND);
     }
 
     it('is empty if the snapshot start time is unknown', () => {
@@ -193,6 +218,82 @@ describe('InputFilesStatSignature', () => {
     });
   });
 
+  describe('filesDeletedDuringSnapshot', () => {
+    it('is empty if the snapshot start time is unknown', () => {
+      fs.unlinkSync(fileA);
+      expect(capture(fileA, fileB).filesDeletedDuringSnapshot).toEqual([]);
+    });
+
+    it('lists a file that was deleted after the snapshot start, which counts as a change', () => {
+      const snapshotStartTimeMs: number = Date.now();
+      fs.unlinkSync(fileA);
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA, fileB);
+      expect(state.filesDeletedDuringSnapshot).toEqual([path.relative(tempFolder, fileA)]);
+      // Although the file is still missing
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    it('does not list a file that was missing before the snapshot start', () => {
+      fs.unlinkSync(fileA);
+      const snapshotStartTimeMs: number = getLatestFileTimeMs(srcFolder) + FILE_TIME_TOLERANCE_MS + 1;
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA, fileB);
+      expect(state.filesDeletedDuringSnapshot).toEqual([]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+    });
+
+    it('judges a missing folder by the nearest folder above it that exists', () => {
+      const subFolder: string = path.join(srcFolder, 'sub');
+      const fileC: string = path.join(subFolder, 'c.ts');
+      fs.mkdirSync(subFolder);
+      fs.writeFileSync(fileC, 'export const c = 1;');
+      const snapshotStartTimeMs: number = Date.now();
+      fs.rmSync(subFolder, { recursive: true });
+
+      expect(captureAt(snapshotStartTimeMs, fileC).filesDeletedDuringSnapshot).toEqual([
+        path.relative(tempFolder, fileC)
+      ]);
+      expect(
+        captureAt(getLatestFileTimeMs(srcFolder) + FILE_TIME_TOLERANCE_MS + 1, fileC)
+          .filesDeletedDuringSnapshot
+      ).toEqual([]);
+    });
+  });
+
+  describe('folderEntries of a folder that changed after the snapshot start', () => {
+    it('are the entries from before the snapshot start, so that later ones are new', () => {
+      // Not an input file
+      fs.writeFileSync(path.join(srcFolder, 'old.txt'), '');
+      const snapshotStartTimeMs: number = waitForNextWindow();
+      const newFile: string = path.join(srcFolder, 'new.ts');
+      fs.writeFileSync(newFile, 'export const n = 1;');
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA);
+      expect(getNewFolderEntries(state.folderEntries)).toEqual([newFile]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).toHaveBeenCalledWith([newFile]);
+    });
+
+    it('include the names that lead to the input files, even if those entries changed', () => {
+      const subFolder: string = path.join(srcFolder, 'sub');
+      const fileC: string = path.join(subFolder, 'c.ts');
+      fs.mkdirSync(subFolder);
+      fs.writeFileSync(fileC, 'export const c = 1;');
+      const snapshotStartTimeMs: number = waitForNextWindow();
+      // Like an editor that saves a file by renaming a temporary file, which changes both folders
+      for (const filePath of [fileA, fileC]) {
+        fs.writeFileSync(`${filePath}.tmp`, fs.readFileSync(filePath));
+        fs.renameSync(`${filePath}.tmp`, filePath);
+      }
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, fileA, fileC);
+      expect(getNewFolderEntries(state.folderEntries)).toEqual([]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      expect(noNewInputs).not.toHaveBeenCalled();
+    });
+  });
+
   describe(haveSnapshotHashesChangedAsync.name, () => {
     const gitPath: string = 'git';
     const pathA: string = 'src/a.ts';
@@ -349,5 +450,21 @@ describe('InputFilesStatSignature', () => {
       expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'c.ts')], [])).toBe(true);
       expect(hasUntrackedGitFiles(gitPath, tempFolder, [path.join(srcFolder, 'nested')], [])).toBe(true);
     });
+
+    it('does not count untracked files that the inputs snapshot hashed', () => {
+      fs.writeFileSync(path.join(srcFolder, 'c.ts'), '');
+      fs.mkdirSync(path.join(srcFolder, 'nested'));
+      fs.writeFileSync(path.join(srcFolder, 'nested', 'd.ts'), '');
+      const candidatePaths: string[] = [path.join(srcFolder, 'c.ts'), path.join(srcFolder, 'nested')];
+      const snapshotHashes: Map<string, string> = new Map([
+        ['src/c.ts', 'c'],
+        ['src/nested/d.ts', 'd']
+      ]);
+
+      expect(hasUntrackedGitFiles(gitPath, tempFolder, candidatePaths, [], snapshotHashes)).toBe(false);
+
+      snapshotHashes.delete('src/nested/d.ts');
+      expect(hasUntrackedGitFiles(gitPath, tempFolder, candidatePaths, [], snapshotHashes)).toBe(true);
+    });
   });
 });
diff --git a/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
index dbbfd5fc15..0f41034d10 100644
--- a/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/LegacySkipPlugin.test.ts
@@ -43,6 +43,7 @@ jest.mock('../../buildCache/OperationBuildCache', () => ({
   OperationBuildCache: { forOperation: jest.fn() }
 }));
 
+import { createHash } from 'node:crypto';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -291,12 +292,28 @@ async function runCommandAsync(
     }
   });
 
+  // A snapshot only lists files that are in the working tree, so each project's input file is written with its
+  // version as its content, and hashed as `git hash-object` does.
+  const hashes: Map<string, string> = new Map();
+  for (const [name, version] of inputs) {
+    const inputFilePath: string = `${name}/src/index.ts`;
+    fs.mkdirSync(path.join(folder, name, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(folder, inputFilePath), version);
+    hashes.set(
+      inputFilePath,
+      createHash('sha1')
+        .update(`blob ${Buffer.byteLength(version)}\0${version}`)
+        .digest('hex')
+    );
+  }
   const inputsSnapshot: IInputsSnapshot = {
-    hashes: new Map(),
+    hashes,
     rootDirectory: folder,
     hasUncommittedChanges: false,
-    getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
-      new Map([[`${project.packageName}/src/index.ts`, inputs.get(project.packageName)!]]),
+    getTrackedFileHashesForOperation: (project: RushConfigurationProject) => {
+      const inputFilePath: string = `${project.packageName}/src/index.ts`;
+      return new Map([[inputFilePath, hashes.get(inputFilePath)!]]);
+    },
     getOperationOwnStateHash: (project: RushConfigurationProject) => inputs.get(project.packageName)!
   };
 

From 535f71ea4045c9a5ff66278011af7318024a5913 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:21 +0000
Subject: [PATCH 214/265] [rush-daemon] Tell a request queued at daemon
 shutdown that it did not start

Swarm integration step 199; original commit 51bd340a56 (merge of swarm/o08-t309 at 4a2e95ea3c).
Scope: task 309.

Brings 309 (branch swarm/o08-t309). Second agent: o07 board 6862, board 6865. Evidence: ch01's GATE OK board 7438.

Batch E2g, item 1 of 7. Gate: ch01 GATE OK board 7438 (tree 03771baa22)

Commits folded into this step (1):
- 4a2e95ea3c Tell a request queued at daemon shutdown that it did not start

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-queued-request-text_2026-09-29-18-23.json |  11 ++
 common/reviews/api/rush-daemon.api.md         |   2 +
 libraries/rush-daemon/README.md               |   3 +
 .../rush-daemon/src/DaemonControlSession.ts   |  13 +-
 .../rush-daemon/src/DaemonShutdownError.ts    |  30 +++-
 .../src/DaemonWireRequestClient.ts            |  10 +-
 .../src/test/DaemonRequestStarted.test.ts     | 144 ++++++++++++++++++
 .../src/test/DaemonRequestWireGlobal.test.ts  |  21 ++-
 .../src/test/DaemonShutdownDeadline.test.ts   |   3 +-
 .../src/test/DaemonShutdownError.test.ts      |  87 +++++++++++
 .../src/test/DaemonShutdownProcess.test.ts    |   3 +-
 .../src/test/DaemonWireRequestClient.test.ts  |  62 ++++++++
 12 files changed, 378 insertions(+), 11 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/shutdown-queued-request-text_2026-09-29-18-23.json
 create mode 100644 libraries/rush-daemon/src/test/DaemonShutdownError.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/shutdown-queued-request-text_2026-09-29-18-23.json b/common/changes/@rushstack/rush-daemon/shutdown-queued-request-text_2026-09-29-18-23.json
new file mode 100644
index 0000000000..6d9b7849ea
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/shutdown-queued-request-text_2026-09-29-18-23.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When the daemon shuts down, tell a request that never left its queue that it was queued and did not start, instead of saying that it was running. `DaemonShutdownError` has a new `requestStarted` option and property for this.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 8abf5d7957..4272231e74 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -91,6 +91,7 @@ export class DaemonShutdownError extends Error {
     constructor(options: IDaemonShutdownErrorOptions);
     // (undocumented)
     readonly initiator: DaemonShutdownInitiator;
+    readonly requestStarted: boolean;
     // (undocumented)
     readonly signal: string | undefined;
 }
@@ -234,6 +235,7 @@ export interface IDaemonShutdownDeadlineErrorOptions {
 export interface IDaemonShutdownErrorOptions {
     // (undocumented)
     readonly initiator: DaemonShutdownInitiator;
+    readonly requestStarted?: boolean;
     readonly signal?: string;
 }
 
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index ffa0e8c9ff..b91aafa4e3 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -200,6 +200,9 @@ lock, the wait for connecting clients and input reconciliation, and before it ap
 selections, closes runners for a rebuild or schedules the iteration; a global command, Rushx script or graph request
 gets it just before it runs. The daemon goes on only once the notice is written, so a client whose daemon exited
 before the notice knows that its request did not run. A notice that cannot be written does not fail the request.
+A shutdown uses the same point for every client, whether or not it subscribed: the error of a request that had not
+reached it says that the daemon was shut down while the request was queued and that it did not start, and the error
+of a request past it says that the request was running.
 
 A dirty native lock left by another command invalidates retained successes so the native
 incremental/cache pipeline can reconcile possibly changed ignored outputs. Declared `outputFolderNames` are also
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 0be663ad8d..99950ad9ee 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -38,7 +38,7 @@ import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
 import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
 import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import type { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
-import { DaemonShutdownError } from './DaemonShutdownError';
+import { DaemonShutdownError, getRequestShutdownReason } from './DaemonShutdownError';
 import { DaemonWireRequestClient } from './DaemonWireRequestClient';
 import {
   InteractiveInputRoutingError,
@@ -576,7 +576,8 @@ export class DaemonControlSession {
     this.#interactiveConnection.close(reason);
     for (const state of this.#requestById.values()) {
       if (!keepFinishedRequests || !state.client.terminalOutcomeSent) {
-        state.abortController.abort(reason);
+        // A shutdown tells a request that has not started that it was queued.
+        state.abortController.abort(getRequestShutdownReason(reason, state.client.requestStarted));
       }
     }
   }
@@ -621,7 +622,13 @@ export class DaemonControlSession {
       const writes: Promise<void>[] = [];
       for (const [requestId, state] of this.#requestById) {
         if (!state.client.terminalOutcomeSent) {
-          writes.push(writeShutdownResultAsync(requestId, state, reason));
+          writes.push(
+            writeShutdownResultAsync(
+              requestId,
+              state,
+              getRequestShutdownReason(reason, state.client.requestStarted)
+            )
+          );
         }
       }
       await settlesWithinAsync(
diff --git a/libraries/rush-daemon/src/DaemonShutdownError.ts b/libraries/rush-daemon/src/DaemonShutdownError.ts
index ff1c8c47ce..3b42478262 100644
--- a/libraries/rush-daemon/src/DaemonShutdownError.ts
+++ b/libraries/rush-daemon/src/DaemonShutdownError.ts
@@ -23,10 +23,15 @@ export interface IDaemonShutdownErrorOptions {
   readonly initiator: DaemonShutdownInitiator;
   /** The process signal name, when the initiator is `signal`. */
   readonly signal?: string;
+  /**
+   * Whether the request had left every queue and started, as the `requestStarted` message tells a client. When it is
+   * `false`, the message says that the request was queued and did not start. Defaults to `true`.
+   */
+  readonly requestStarted?: boolean;
 }
 
 /**
- * The typed reason used to abort requests that were still running when the daemon shut down.
+ * The typed reason used to abort requests that were still running or queued when the daemon shut down.
  *
  * @remarks
  * Its message is delivered to the affected clients as the request's error message.
@@ -36,15 +41,21 @@ export interface IDaemonShutdownErrorOptions {
 export class DaemonShutdownError extends Error {
   public readonly initiator: DaemonShutdownInitiator;
   public readonly signal: string | undefined;
+  /** Whether the request had started; see {@link IDaemonShutdownErrorOptions.requestStarted}. */
+  public readonly requestStarted: boolean;
 
   public constructor(options: IDaemonShutdownErrorOptions) {
+    const requestStarted: boolean = options.requestStarted ?? true;
     super(
-      `The Rush daemon was shut down (${describeInitiator(options)}) while this request was running; ` +
-        're-run the command.'
+      `The Rush daemon was shut down (${describeInitiator(options)}) ` +
+        (requestStarted
+          ? 'while this request was running; re-run the command.'
+          : 'while this request was queued; it did not start. Re-run the command.')
     );
     this.name = 'DaemonShutdownError';
     this.initiator = options.initiator;
     this.signal = options.signal;
+    this.requestStarted = requestStarted;
   }
 }
 
@@ -65,6 +76,19 @@ function describeInitiator(options: IDaemonShutdownErrorOptions): string {
   }
 }
 
+/**
+ * Returns the reason to give one request when its connection closes for `reason`: a shutdown reason for a request
+ * that has not started says that it was queued. Any other reason is returned unchanged.
+ */
+export function getRequestShutdownReason<TReason extends Error>(
+  reason: TReason,
+  requestStarted: boolean
+): TReason | DaemonShutdownError {
+  return reason instanceof DaemonShutdownError && reason.requestStarted && !requestStarted
+    ? new DaemonShutdownError({ initiator: reason.initiator, signal: reason.signal, requestStarted: false })
+    : reason;
+}
+
 /** Returns the shutdown reason if the signal was aborted because the daemon shut down. */
 export function getDaemonShutdownReason(signal: AbortSignal): DaemonShutdownError | undefined {
   return signal.aborted && signal.reason instanceof DaemonShutdownError ? signal.reason : undefined;
diff --git a/libraries/rush-daemon/src/DaemonWireRequestClient.ts b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
index 2eb4c3b326..0c19083b7f 100644
--- a/libraries/rush-daemon/src/DaemonWireRequestClient.ts
+++ b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
@@ -46,6 +46,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
   readonly #supportsRequestStarted: boolean;
   readonly #waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
   #startedSent: boolean = false;
+  #requestStarted: boolean = false;
   #terminalOutcomeSent: boolean = false;
 
   public readonly abortSignal: AbortSignal;
@@ -80,6 +81,11 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     return this.#terminalOutcomeSent;
   }
 
+  /** Whether the request has left every queue, whether or not its client subscribed to `requestStarted`. */
+  public get requestStarted(): boolean {
+    return this.#requestStarted;
+  }
+
   public writeEventAsync(event: IDaemonEventEnvelope): Promise<void> {
     return this.#sendFrameAsync({
       kind: DaemonFrameType.event,
@@ -105,9 +111,11 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
 
   /**
    * Tells a client that subscribed with `supportsRequestStarted` that the request left every queue, once. Frames
-   * are sent in order, so this precedes the request's output.
+   * are sent in order, so this precedes the request's output. For every client, it records that the request started,
+   * so that a shutdown tells a request that never started that it was queued.
    */
   public writeRequestStartedAsync(): Promise<void> {
+    this.#requestStarted = true;
     if (!this.#supportsRequestStarted || this.#startedSent) return Promise.resolve();
     this.#startedSent = true;
     return this.#sendControlAsync({ kind: 'requestStarted', payload: { requestId: this.#requestId } });
diff --git a/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
index 9aa0de6ad6..8d13073328 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
@@ -16,6 +16,8 @@ import type {
 import type { ITerminal } from '@rushstack/terminal';
 
 import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
+import { DaemonRequestDispatchError } from '../DaemonRequestDispatcher';
+import { DaemonShutdownError, getDaemonShutdownReason } from '../DaemonShutdownError';
 import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
 import { RushDaemonHost } from '../RushDaemonHost';
 import type { IRushDaemonHostOptions } from '../RushDaemonHost';
@@ -60,6 +62,10 @@ async function startGlobalHostAsync(
     executor: executorFor(envelope.requestId),
     kind: 'global'
   }));
+  return await startHostAsync(repoRoot, resolver);
+}
+
+async function startHostAsync(repoRoot: string, resolver: IDaemonRequestResolver): Promise<RushDaemonHost> {
   const options: IRushDaemonHostOptions = {
     createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
     daemonVersion: DAEMON_VERSION,
@@ -222,6 +228,144 @@ describe('requestStarted', () => {
     }
   });
 
+  it('tells a request whose resolver had not returned at shutdown that it did not start', async () => {
+    const repoRoot: string = createRepoRoot();
+    const resolving: IDeferred<void> = createDeferred<void>();
+    // Like ProductionDaemonRequestResolver, it stops when its request is aborted and reports the shutdown's reason.
+    const resolver: IDaemonRequestResolver = new CallbackDaemonRequestResolver(async ({ abortSignal }) => {
+      await new Promise<void>((resolve) => {
+        abortSignal.addEventListener('abort', () => resolve(), { once: true });
+        resolving.resolve();
+      });
+      const reason: DaemonShutdownError | undefined = getDaemonShutdownReason(abortSignal);
+      throw new DaemonRequestDispatchError(
+        'routingFailed',
+        reason?.message ?? 'The request was not shut down.'
+      );
+    });
+    const host: RushDaemonHost = await startHostAsync(repoRoot, resolver);
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('resolving', 'custom', repoRoot)
+      });
+      await resolving.promise;
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'signal', signal: 'SIGTERM' })
+      );
+      const exchange: ITerminalExchange = await client.readTerminalAsync('resolving');
+      expect(findStarted(exchange.frames)).toEqual([]);
+      expect(exchange.terminal).toEqual({
+        kind: 'requestRejected',
+        payload: {
+          code: 'routingFailed',
+          message:
+            'The Rush daemon was shut down (the daemon process received SIGTERM) while this request was ' +
+            'queued; it did not start. Re-run the command.',
+          requestId: 'resolving'
+        }
+      });
+      await closePromise;
+    } finally {
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a request queued for admission that it did not start, and sends it no requestStarted', async () => {
+    const repoRoot: string = createRepoRoot();
+    const holderStarted: IDeferred<void> = createDeferred<void>();
+    const releaseHolder: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, (requestId: string) => async () => {
+      if (requestId === 'holder') {
+        holderStarted.resolve();
+        await releaseHolder.promise;
+      }
+      return { exitCode: 0 };
+    });
+    const holder: DaemonRequestWireClient = await connectAsync(host, true);
+    const queued: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await holder.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('holder', 'custom', repoRoot)
+      });
+      await holderStarted.promise;
+      await queued.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('queued', 'custom', repoRoot)
+      });
+      expect(await queued.readControlAsync()).toMatchObject({
+        kind: 'queuePosition',
+        payload: { requestId: 'queued' }
+      });
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'controlClient' })
+      );
+      releaseHolder.resolve();
+      const exchange: ITerminalExchange = await queued.readTerminalAsync('queued');
+      expect(findStarted(exchange.frames)).toEqual([]);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was queued; it did not start. Re-run the command.',
+          requestId: 'queued'
+        }
+      });
+      await closePromise;
+    } finally {
+      releaseHolder.resolve();
+      await Promise.all([holder.closeAsync(), queued.closeAsync()]);
+      await host.closeAsync();
+    }
+  });
+
+  it('tells a request that got requestStarted that it was running when the daemon shut down', async () => {
+    const repoRoot: string = createRepoRoot();
+    const started: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => {
+      started.resolve();
+      await release.promise;
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      await client.sendControlAsync({
+        kind: 'requestStart',
+        payload: createWireEnvelope('started', 'custom', repoRoot)
+      });
+      await started.promise;
+      const closePromise: Promise<void> = host.closeAsync(
+        new DaemonShutdownError({ initiator: 'controlClient' })
+      );
+      release.resolve();
+      const exchange: ITerminalExchange = await client.readTerminalAsync('started');
+      expect(findStarted(exchange.frames)).toEqual([
+        { kind: 'requestStarted', payload: { requestId: 'started' } }
+      ]);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was running; re-run the command.',
+          requestId: 'started'
+        }
+      });
+      await closePromise;
+    } finally {
+      release.resolve();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
   it('tells a client when a phased request starts, before the events and output of its operations', async () => {
     const repoRoot: string = createRepoRoot();
     const fixture: ITestRoutingFixture = createRoutingFixture(
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
index 70899f1485..363bed3cc8 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireGlobal.test.ts
@@ -310,7 +310,7 @@ describe('daemon global request wire integration', () => {
     }
   });
 
-  it('tells a request queued for admission that the daemon shut down', async () => {
+  it('tells a request queued for admission that it did not start when the daemon shut down', async () => {
     const repoRoot: string = createRepoRoot();
     const holderStarted: IDeferred<void> = createDeferred<void>();
     const releaseHolder: IDeferred<void> = createDeferred<void>();
@@ -343,9 +343,26 @@ describe('daemon global request wire integration', () => {
       });
       const closePromise: Promise<void> = host.closeAsync(shutdown);
       releaseHolder.resolve();
+      // Neither client subscribed to requestStarted; the daemon still knows which request started.
       expect((await clients[1].readTerminalAsync('queued')).terminal).toMatchObject({
         kind: 'requestResult',
-        payload: { aborted: true, admissionErrorCode: 'aborted', errorMessage: shutdown.message }
+        payload: {
+          aborted: true,
+          admissionErrorCode: 'aborted',
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was queued; it did not start. Re-run the command.'
+        }
+      });
+      // The request ahead of it had started.
+      expect((await clients[0].readTerminalAsync('holder')).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          aborted: true,
+          errorMessage:
+            'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
+            'while this request was running; re-run the command.'
+        }
       });
       await closePromise;
     } finally {
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
index 1121d55862..c7a6bbb36b 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdownDeadline.test.ts
@@ -100,13 +100,14 @@ describe('daemon shutdown deadline', () => {
       if (process.platform !== 'win32') expect(fs.existsSync(host.paths.socketPath)).toBe(true);
 
       // The request never finishes, so its connection's drain times out and the client gets a typed result.
+      // It never left its resolver, so the result says that it was queued.
       expect((await client.readTerminalAsync(REQUEST_ID)).terminal).toEqual({
         kind: 'requestResult',
         payload: {
           aborted: true,
           errorMessage:
             'The Rush daemon was shut down (requested by "rush-client daemon stop" or "daemon restart") ' +
-            'while this request was running; re-run the command.',
+            'while this request was queued; it did not start. Re-run the command.',
           exitCode: 1,
           outcome: 'failure',
           requestId: REQUEST_ID
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownError.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownError.test.ts
new file mode 100644
index 0000000000..24bdf6f8a9
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownError.test.ts
@@ -0,0 +1,87 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  DaemonShutdownError,
+  getDaemonShutdownReason,
+  getRequestShutdownReason,
+  type IDaemonShutdownErrorOptions
+} from '../DaemonShutdownError';
+
+const INITIATORS: ReadonlyArray<[IDaemonShutdownErrorOptions, string]> = [
+  [{ initiator: 'controlClient' }, 'requested by "rush-client daemon stop" or "daemon restart"'],
+  [{ initiator: 'signal', signal: 'SIGTERM' }, 'the daemon process received SIGTERM'],
+  [{ initiator: 'signal' }, 'the daemon process received a termination signal'],
+  [{ initiator: 'idleTimeout' }, 'idle timeout'],
+  [{ initiator: 'restart' }, 'the daemon restarted to apply workspace changes'],
+  [{ initiator: 'host' }, 'the daemon host was closed'],
+  [
+    { initiator: 'socketLost' },
+    'its socket file was deleted or replaced, so no new client could connect to it'
+  ]
+];
+
+describe(DaemonShutdownError.name, () => {
+  it.each(INITIATORS)(
+    'says that a request that started was running (%j)',
+    (options: IDaemonShutdownErrorOptions, initiator: string) => {
+      const expected: string =
+        `The Rush daemon was shut down (${initiator}) while this request was running; ` +
+        're-run the command.';
+      expect(new DaemonShutdownError(options).message).toBe(expected);
+      expect(new DaemonShutdownError({ ...options, requestStarted: true }).message).toBe(expected);
+      expect(new DaemonShutdownError(options).requestStarted).toBe(true);
+    }
+  );
+
+  it.each(INITIATORS)(
+    'says that a request that did not start was queued (%j)',
+    (options: IDaemonShutdownErrorOptions, initiator: string) => {
+      const error: DaemonShutdownError = new DaemonShutdownError({ ...options, requestStarted: false });
+      expect(error.message).toBe(
+        `The Rush daemon was shut down (${initiator}) while this request was queued; it did not start. ` +
+          'Re-run the command.'
+      );
+      expect(error).toMatchObject({
+        initiator: options.initiator,
+        name: 'DaemonShutdownError',
+        requestStarted: false,
+        signal: options.signal
+      });
+    }
+  );
+});
+
+describe(getRequestShutdownReason.name, () => {
+  it('gives a request that did not start a queued copy of the shutdown reason', () => {
+    const shutdown: DaemonShutdownError = new DaemonShutdownError({ initiator: 'signal', signal: 'SIGINT' });
+    const reason: Error = getRequestShutdownReason(shutdown, false);
+    expect(reason).toBeInstanceOf(DaemonShutdownError);
+    expect(reason).not.toBe(shutdown);
+    expect(reason).toMatchObject({ initiator: 'signal', requestStarted: false, signal: 'SIGINT' });
+    expect(reason.message).toBe(
+      'The Rush daemon was shut down (the daemon process received SIGINT) while this request was queued; ' +
+        'it did not start. Re-run the command.'
+    );
+    expect(shutdown.requestStarted).toBe(true);
+
+    // The routers read the reason from the request's abort signal.
+    const controller: AbortController = new AbortController();
+    controller.abort(reason);
+    expect(getDaemonShutdownReason(controller.signal)).toBe(reason);
+  });
+
+  it('gives a request that started the shutdown reason itself', () => {
+    const shutdown: DaemonShutdownError = new DaemonShutdownError({ initiator: 'controlClient' });
+    expect(getRequestShutdownReason(shutdown, true)).toBe(shutdown);
+  });
+
+  it('keeps a queued reason and any other error as they are', () => {
+    const queued: DaemonShutdownError = new DaemonShutdownError({ initiator: 'host', requestStarted: false });
+    expect(getRequestShutdownReason(queued, false)).toBe(queued);
+    expect(getRequestShutdownReason(queued, true)).toBe(queued);
+    const closed: Error = new Error('The daemon client connection closed.');
+    expect(getRequestShutdownReason(closed, false)).toBe(closed);
+    expect(getRequestShutdownReason(closed, true)).toBe(closed);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
index 9b6a87a013..abf19db9fc 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
@@ -149,13 +149,14 @@ interface IStuckRequest {
     // SubprocessTerminator sends this signal to the daemon again; that copy must not force the exit.
     stuckDaemon.process.kill('SIGTERM');
 
+    // The fixture's request is stuck in its resolver, so it never started, and its result says that it was queued.
     expect((await request.client.readTerminalAsync(REQUEST_ID)).terminal).toEqual({
       kind: 'requestResult',
       payload: {
         aborted: true,
         errorMessage:
           'The Rush daemon was shut down (the daemon process received SIGTERM) while this request was ' +
-          'running; re-run the command.',
+          'queued; it did not start. Re-run the command.',
         exitCode: 1,
         outcome: 'failure',
         requestId: REQUEST_ID
diff --git a/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts b/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
new file mode 100644
index 0000000000..1611ad96d4
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonControlMessage } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import type { IInteractiveRequestSession } from '../InteractiveRequestInputRouter';
+import { createDeferred } from './DaemonRequestWireTestUtilities';
+import type { IDeferred } from './DaemonRequestWireTestUtilities';
+
+const REQUEST_ID: string = 'request';
+
+function createClient(
+  supportsRequestStarted: boolean,
+  sendControlAsync: (message: DaemonControlMessage) => Promise<void>
+): DaemonWireRequestClient {
+  const interactiveSession: IInteractiveRequestSession = {
+    requestId: REQUEST_ID,
+    attachInputSink: () => ({ [Symbol.dispose]: () => undefined }),
+    finishAsync: () => Promise.resolve(),
+    setRawModeAsync: () => Promise.resolve()
+  };
+  return new DaemonWireRequestClient({
+    abortSignal: new AbortController().signal,
+    getNextEventSequence: () => 0,
+    interactiveSession,
+    receivedTimeMs: 0,
+    requestId: REQUEST_ID,
+    sendControlAsync,
+    sendFrameAsync: () => Promise.resolve(),
+    sessionId: 'session',
+    supportsRequestAdmission: true,
+    supportsRequestStarted
+  });
+}
+
+describe(DaemonWireRequestClient.name, () => {
+  it.each([true, false])(
+    'counts a request as started before its requestStarted is written (supportsRequestStarted %s)',
+    async (supportsRequestStarted: boolean) => {
+      const written: IDeferred<void> = createDeferred<void>();
+      const sent: DaemonControlMessage[] = [];
+      const client: DaemonWireRequestClient = createClient(
+        supportsRequestStarted,
+        (message: DaemonControlMessage) => {
+          sent.push(message);
+          return written.promise;
+        }
+      );
+      expect(client.requestStarted).toBe(false);
+      const writePromise: Promise<void> = client.writeRequestStartedAsync();
+      // A shutdown during the write must not tell a client that may receive requestStarted that it did not start.
+      expect(client.requestStarted).toBe(true);
+      written.resolve();
+      await writePromise;
+      expect(client.requestStarted).toBe(true);
+      expect(sent).toEqual(
+        supportsRequestStarted ? [{ kind: 'requestStarted', payload: { requestId: REQUEST_ID } }] : []
+      );
+    }
+  );
+});

From e6e77435341974d2a1731ce611531c16d73e1282 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:22 +0000
Subject: [PATCH 215/265] [rush-client-core] Say which operations a reclaim
 stopped in its launcher log line

Swarm integration step 200; original commit cf0bc8a3ce (merge of swarm/r06-t300-on297-nit1 at ad1ebe0b23).
Refs: task 300, NIT 1.
Scope: task 300 + NIT 1.

Brings 300 (branch swarm/r06-t300-on297-nit1). Second agent: t05 board 6835 (de6c76f553); NIT 1: t05 board 7158 (RESULT board 7157). Evidence: ch01's GATE OK board 7438.

Batch E2g, item 2 of 7. Gate: ch01 GATE OK board 7438 (tree bc90c6f26e)

Commits folded into this step (4):
- 55b82a157b [rush-daemon-transport] Report the operation groups that a reclaim leaves running (task 300)
- 8d1e196cf3 [rush-daemon-transport] Test the order of the reasons for a group left running (task 300)
- de6c76f553 [rush-daemon-transport] Judge a group left running on the proof's own reads (task 300)
- ad1ebe0b23 [rush-client-core] Say which operations a reclaim stopped in its launcher log line (task 300, NIT 1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  5 +-
 ...-groups-left-running_2026-09-29-17-50.json | 11 +++
 ...-groups-left-running_2026-09-29-17-50.json | 11 +++
 ...06-t300-reclaim-line_2026-09-29-20-05.json | 11 +++
 ...-groups-left-running_2026-09-29-17-50.json | 11 +++
 ...00-reason-order-test_2026-09-29-18-10.json | 11 +++
 ...06-t300-shared-reads_2026-09-29-18-40.json | 11 +++
 ...-groups-left-running_2026-09-29-17-50.json | 11 +++
 .../reviews/api/rush-daemon-transport.api.md  | 14 +++
 libraries/rush-client-core/README.md          | 22 +++--
 .../rush-client-core/src/DaemonOwnership.ts   | 23 +++--
 .../src/ExitedDaemonReclaim.ts                | 17 ++--
 .../src/ReclaimedDaemonLog.ts                 | 41 +++++++-
 .../src/connectOrStartDaemon.ts               |  6 +-
 .../test/AbandonedOwnershipReclaim.test.ts    | 24 +++++
 .../src/test/DaemonArtifactReset.test.ts      | 52 ++++++++++
 .../src/test/ExitedDaemonReclaim.test.ts      | 59 +++++++++++-
 .../src/test/OrphanedOperation.ts             | 25 +++++
 .../src/test/ReclaimedDaemonLog.test.ts       | 93 +++++++++++++++++-
 .../src/test/connectOrStartDaemon.test.ts     | 13 ++-
 .../connectOrStartDaemonReusedOwner.test.ts   |  5 +
 libraries/rush-daemon-transport/README.md     |  5 +-
 .../src/DaemonListenerBinding.ts              |  8 +-
 .../src/DaemonOperationGroupLeftRunning.ts    | 92 ++++++++++++++++++
 .../DaemonOperationGroupLeftRunningMessage.ts | 40 ++++++++
 .../src/DaemonOperationGroupReaper.ts         | 24 +++--
 .../src/DaemonOperationGroupState.ts          | 81 ++++++++++++++++
 .../src/DaemonProcessReadsOnce.ts             | 37 ++++++++
 .../src/DaemonReapOptions.ts                  |  3 +-
 .../src/DaemonReclaimOptions.ts               | 48 ++++++++++
 libraries/rush-daemon-transport/src/index.ts  |  8 +-
 .../src/test/ListenerReclaimOptions.test.ts   | 14 +--
 .../test/OperationGroupLeftRunningFixture.ts  | 52 ++++++++++
 .../OperationGroupLeftRunningMessage.test.ts  | 38 ++++++++
 .../OperationGroupLeftRunningOrder.test.ts    | 51 ++++++++++
 .../OperationGroupLeftRunningProcess.test.ts  | 71 ++++++++++++++
 .../OperationGroupLeftRunningReads.test.ts    | 56 +++++++++++
 .../OperationGroupLeftRunningReason.test.ts   | 74 +++++++++++++++
 .../OperationGroupLeftRunningReport.test.ts   | 59 ++++++++++++
 libraries/rush-daemon/README.md               |  6 +-
 .../rush-daemon/src/DaemonOrphanReapLog.ts    | 27 +++++-
 .../src/test/DaemonOrphanReapLog.test.ts      | 94 ++++++++++++++++++-
 42 files changed, 1308 insertions(+), 56 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/swarm-r06-t300-reclaim-line_2026-09-29-20-05.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-reason-order-test_2026-09-29-18-10.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-shared-reads_2026-09-29-18-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 41fbabd300..92700d0211 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -684,7 +684,10 @@ process group whose ID is that PID, which the later process may lead. It prints
 line shown above for a lost connection and reports what it stopped in `orphansReaped` (`daemonPid`,
 `processGroupIds`, `outcome`). A recorded group that it cannot prove, such as a PID that a later
 process now has, or a group whose leader has exited under a daemon from a release that did not set
-`RUSHD_OPERATION_GROUPS`, is not signalled; its record is removed with the others. If the operations cannot be
+`RUSHD_OPERATION_GROUPS`, is not signalled; its record is removed with the others. When such a group still
+has a live process, the launcher log that `daemon logs` prints gets a line that names the group and the
+daemon and says which check the group failed; nothing about it is printed. The reclaims after a lost
+connection, before Rush runs in-process and before a daemon start do the same. If the operations cannot be
 stopped, it exits with code 1 and removes nothing. While another process reclaims the same files it
 also exits with code 1, except that after a shutdown it re-checks for up to 15 seconds. Otherwise it
 never signals a process. Automatic startup already reclaims
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json b/common/changes/@rushstack/rush-cli-client/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
new file mode 100644
index 0000000000..16b1677d32
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the launcher log line for an operation process group that a reclaim leaves running.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
new file mode 100644
index 0000000000..e4d53b64ba
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "When a reclaim of an exited daemon's files leaves an operation process group running that the daemon recorded, because it cannot prove that the group still runs the daemon's operation, the client now appends a line to the launcher log that names the group and the daemon and says which check the group failed. This covers the reclaims after a lost connection, before Rush runs in-process, before a daemon start and in `resetDaemonArtifactsAsync()`. `reclaimCrashedDaemonAsync()` and `resetDaemonArtifactsAsync()` pass each such group to `options.onOperationGroupLeftRunning` instead, if it is given. Nothing is printed to the terminal.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/swarm-r06-t300-reclaim-line_2026-09-29-20-05.json b/common/changes/@rushstack/rush-client-core/swarm-r06-t300-reclaim-line_2026-09-29-20-05.json
new file mode 100644
index 0000000000..b23dffb4ce
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/swarm-r06-t300-reclaim-line_2026-09-29-20-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "The launcher log line that a client appends after it reclaims a daemon that exited without shutting down now says that it stopped the operations that the daemon left running and that could be proven to be the daemon's own, instead of any operations that it left running. A recorded operation group that the reclaim leaves running has its own line before it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
new file mode 100644
index 0000000000..54f3a0720a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add `onOperationGroupLeftRunning` to `IDaemonReclaimOptions`, and `formatOperationGroupLeftRunning`. On POSIX, a reclaim gives no signal to an operation process group that the dead daemon recorded but that it cannot prove still runs that daemon's operation. When such a group still has a live process, the reclaim now passes it to `onOperationGroupLeftRunning` with the first check that the group failed (`callerGroup`, `daemonPidInUse`, `leaderChanged`, `otherSession` or `noMarker`), after it has removed the records. Without the callback, nothing more is read. `DaemonFrameListener.listenAsync` passes the callback to its reclaim too.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-reason-order-test_2026-09-29-18-10.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-reason-order-test_2026-09-29-18-10.json
new file mode 100644
index 0000000000..2ff0b48249
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-reason-order-test_2026-09-29-18-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Test that a reclaim reports each operation process group that it leaves running with the first check that the group fails, in the order of the proof.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-shared-reads_2026-09-29-18-40.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-shared-reads_2026-09-29-18-40.json
new file mode 100644
index 0000000000..ff8dbd2879
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t300-shared-reads_2026-09-29-18-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "A reclaim now judges each operation process group that it leaves running on what its proof read of the group, instead of reading every process's record again.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json b/common/changes/@rushstack/rush-daemon/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
new file mode 100644
index 0000000000..6b1167989c
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r06-t300-groups-left-running_2026-09-29-17-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A daemon that reclaims the endpoint of a daemon that exited without shutting down now writes a line to its log for each operation process group that the exited daemon recorded and that it left running, because it could not prove that the group still ran that operation, with the check that the group failed.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index b9dccb7d55..220d7aa4ec 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -48,6 +48,9 @@ export class DaemonFrameListener {
     stopAcceptingAsync(): Promise<void>;
 }
 
+// @beta
+export type DaemonOperationGroupLeftRunningReason = 'callerGroup' | 'daemonPidInUse' | 'leaderChanged' | 'otherSession' | 'noMarker';
+
 // @beta
 export type DaemonReclaimLockOutcome = {
     readonly acquired: true;
@@ -75,6 +78,9 @@ export enum DaemonTransportErrorCode {
 // @beta
 export function ensureDaemonRuntimeDir(paths: IDaemonPaths): void;
 
+// @beta
+export function formatOperationGroupLeftRunning(group: IDaemonOperationGroupLeftRunning): string;
+
 // @beta
 export interface IDaemonConnectorOptions {
     readonly connectTimeoutMs?: number;
@@ -95,6 +101,13 @@ export interface IDaemonLockfile {
     readonly startedAt: string;
 }
 
+// @beta
+export interface IDaemonOperationGroupLeftRunning {
+    readonly daemonPid: number;
+    readonly processGroupId: number;
+    readonly reason: DaemonOperationGroupLeftRunningReason;
+}
+
 // @beta
 export interface IDaemonOrphanReap {
     readonly daemonPid: number;
@@ -119,6 +132,7 @@ export interface IDaemonPaths {
 
 // @beta
 export interface IDaemonReclaimOptions {
+    readonly onOperationGroupLeftRunning?: (group: IDaemonOperationGroupLeftRunning) => void;
     readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
 }
 
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 7c2f669c50..657337fbe5 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -111,7 +111,10 @@ group has exited but is not reaped yet (a zombie), the group counts as stopped,
 can end it. Each set of groups that it stops is
 passed to the connection's optional `onOrphansReaped(reap)` (the daemon's PID, the process groups,
 and whether they were `terminated` or `killed`), so that the caller can say so in its own words;
-without it, each is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. The reclaim before
+without it, each is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. A recorded operation
+group that the reclaim cannot prove still runs an operation of the daemon gets no signal; when it still
+has a live process, the client appends a line to the launcher log that names the group and the daemon
+and says which check the group failed, and reports nothing else about it. The reclaim before
 a daemon start reports the same way. It waits up to 5 seconds while another client holds the start
 mutex, and up to 1 second while the exited process is not reaped yet: its parent, usually init or a
 subreaper, reaps it at once, and one that has not by then may never do so. If the reclaim fails or
@@ -165,7 +168,8 @@ record whose PID now belongs to a process that started after the record's `start
 owner left running, so before it removes the record it stops the operation process groups that the
 owner recorded (`reapReusedOwnerOperationGroupsAsync()`), with the proof of each group that
 `reclaimStaleDaemonAsync()` requires, but never the process group whose ID is the recorded PID, which
-the later process may lead. If they cannot be stopped, the start fails and removes nothing.
+the later process may lead. Each recorded group that it leaves running gets a line in the launcher log,
+as above. If they cannot be stopped, the start fails and removes nothing.
 Any other live PID with an unreachable socket fails
 closed, and never signals that process. The error says on its first line what that process is doing and
 on its last line what to do about it. On Linux the first line comes from `/proc`: whether the process
@@ -197,8 +201,9 @@ says the same.
 When the recorded PID no longer exists, the reset first stops the operations that the owner left
 running, as `reclaimStaleDaemonAsync()` does before the next start; when a process that started later
 has it, the reset stops the recorded operation process groups as the start does. Both report what they
-stop to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings). The reset removes
-nothing when they cannot be stopped, and it never signals a process otherwise.
+stop to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings), and each recorded
+group that they leave running to `options.onOperationGroupLeftRunning` (or else to a line in the launcher
+log). The reset removes nothing when they cannot be stopped, and it never signals a process otherwise.
 The reset stats the socket with `{ bigint: true }`. After a plain stat of a socket, a `require()` in the
 same process, made while the reset awaits the reclaim, would not resolve symlinks.
 The helper uses a stable tool cwd, and the starting client awaits its exit after
@@ -297,7 +302,9 @@ not reaped yet), it reclaims that daemon as described above for a lost connectio
 mutex, only when no startup is reserved, and waiting up to 5 seconds for the mutex and up to 1 second
 for the exited process to be reaped. It does nothing when there is no
 record, when a process with the recorded PID runs, or when the runtime folder is not private, and it
-never throws. Its optional `options.onOrphansReaped` receives what it stopped, as above.
+never throws. Its optional `options.onOrphansReaped` receives what it stopped, as above, and its optional
+`options.onOperationGroupLeftRunning` receives each recorded group that it left running, instead of the
+launcher log.
 
 `getDaemonLogFilePath(paths)` is the shared stable path used by both the launcher
 and the CLI's local `daemon logs` reader. Child stdout/stderr are appended across
@@ -315,7 +322,10 @@ that exited without shutting down, after a lost connection or in `reclaimCrashed
 appends a line that names the daemon's PID to it, under the same file checks. Once the reclaim has
 removed the ownership record, `findReclaimedDaemonPid(paths)` returns that PID from the log's last
 64 KiB, unless a daemon wrote its `rushd ready at` line after it or `resetDaemonArtifactsAsync()`
-cleared the report with a line of its own; `rush-client daemon status` uses it.
+cleared the report with a line of its own; `rush-client daemon status` uses it. A reclaim that leaves a
+recorded operation group running appends a line such as `left process group 4242 running, which the
+exited daemon (PID 4000) recorded for an operation: the process with PID 4242 now is not the leader that
+the daemon recorded.`, which does not change what `findReclaimedDaemonPid` returns.
 
 `shutdownAsync()` requires a fresh connection with negotiated minor >= 6. It sends
 the existing `shutdown` control and resolves only after `shutdownAck` and EOF,
diff --git a/libraries/rush-client-core/src/DaemonOwnership.ts b/libraries/rush-client-core/src/DaemonOwnership.ts
index 9b210c643b..772a0e9635 100644
--- a/libraries/rush-client-core/src/DaemonOwnership.ts
+++ b/libraries/rush-client-core/src/DaemonOwnership.ts
@@ -29,7 +29,7 @@ import {
 } from './DaemonOwnerDiagnosis';
 import { getDaemonStartupFilePath } from './DaemonStartup';
 import { isProcessStartedAfter } from './ProcessStartTime';
-import { clearReclaimedDaemonReport } from './ReclaimedDaemonLog';
+import { clearReclaimedDaemonReport, getClientReclaimOptions } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 const PROBE_TIMEOUT_MS: number = 1000;
@@ -171,7 +171,8 @@ function tryReadLiveOwner(paths: IDaemonPaths): DaemonOwnership | undefined {
  * shutting down, and once its record is gone no reclaim finds the operations that it recorded. So they are
  * stopped first, with the proof that `reclaimStaleDaemonAsync` requires of each group but never the group of
  * that process, and reported to `options.onOrphansReaped` (or else as `RUSH_DAEMON_ORPHANS_REAPED` warnings).
- * If they cannot be stopped, it throws and removes nothing.
+ * A recorded group that it leaves running goes to `options.onOperationGroupLeftRunning`, or else to a line in
+ * the launcher log (`logOperationGroupLeftRunning`). If they cannot be stopped, it throws and removes nothing.
  */
 export async function reclaimAbandonedOwnershipAsync(
   paths: IDaemonPaths,
@@ -189,7 +190,13 @@ export async function reclaimAbandonedOwnershipAsync(
       `${describeOwnership(state, paths)}, but ${paths.socketPath} did not refuse a connection; refusing automatic reclaim. ${DAEMON_RESET_HINT}`
     );
   }
-  if (state.kind === 'owned') await reapReusedOwnerOperationGroupsAsync(paths, state.owner.pid, options);
+  if (state.kind === 'owned') {
+    await reapReusedOwnerOperationGroupsAsync(
+      paths,
+      state.owner.pid,
+      getClientReclaimOptions(paths, options)
+    );
+  }
   // The transport reclaim then removes the unbound socket under its own two-factor checks.
   if (state.kind !== 'absent') removeIfUnchanged(paths.lockfilePath, state.raw);
 }
@@ -201,8 +208,10 @@ export async function reclaimAbandonedOwnershipAsync(
  * it now, the owner exited without shutting down and may have left operations running, which only its records
  * name. So the reset first stops them, as the next daemon start would (`reclaimStaleDaemonAsync`), but never
  * the process group of a process that has the recorded PID now, and reports each set of process groups that it
- * stops to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. When they
- * cannot be stopped, it throws and removes nothing. Otherwise it never signals a process. Fails when another
+ * stops to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. Each recorded
+ * operation group that it leaves running, because it cannot prove that the group is still the owner's, goes to
+ * `options.onOperationGroupLeftRunning`, or else to a line in the launcher log. When the operations cannot be
+ * stopped, it throws and removes nothing. Otherwise it never signals a process. Fails when another
  * client holds the start mutex, a listener is bound, the recorded owner is alive, or another process reclaims
  * the files of the owner that exited; with `waitTimeoutMs`, those conditions are re-checked until the deadline
  * (for example, while a daemon that just acknowledged shutdown finishes its cleanup). A reset also clears the
@@ -300,7 +309,7 @@ async function stopOwnerLeftoversAsync(
   const ownerPid: number = state.owner.pid;
   if (!isProcessAlive(ownerPid)) return await reclaimExitedOwnerAsync(paths, ownerPid, options);
   return await tryReclaimOwnerAsync(paths, ownerPid, () =>
-    reapReusedOwnerOperationGroupsAsync(paths, ownerPid, { onOrphansReaped: options?.onOrphansReaped })
+    reapReusedOwnerOperationGroupsAsync(paths, ownerPid, getClientReclaimOptions(paths, options))
   );
 }
 
@@ -318,7 +327,7 @@ async function reclaimExitedOwnerAsync(
     process.platform === 'win32' ? [paths.lockfilePath] : [paths.lockfilePath, paths.socketPath];
   const present: string[] = files.filter((filePath) => isPresent(filePath));
   const failure: DaemonClientError | undefined = await tryReclaimOwnerAsync(paths, ownerPid, () =>
-    reclaimStaleDaemonAsync(paths, { onOrphansReaped: options?.onOrphansReaped })
+    reclaimStaleDaemonAsync(paths, getClientReclaimOptions(paths, options))
   );
   return failure ?? new Set(present.filter((filePath) => !isPresent(filePath)));
 }
diff --git a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
index f1e479cf1e..26478157a6 100644
--- a/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
+++ b/libraries/rush-client-core/src/ExitedDaemonReclaim.ts
@@ -15,7 +15,7 @@ import {
 import { isProcessAlive } from './DaemonOwnership';
 import { readDaemonStartupReservation } from './DaemonStartup';
 import { isProcessDefunct } from './ProcessStartTime';
-import { logReclaimedDaemon } from './ReclaimedDaemonLog';
+import { getClientReclaimOptions, logReclaimedDaemon } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 
 /**
@@ -48,7 +48,9 @@ export interface IExitedDaemon {
  * @remarks
  * Call it before Rush runs in-process. Like the next daemon start, it terminates the daemon's orphaned
  * operation process groups and removes the ownership record and socket. Each set of groups that it stops is
- * reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. It does so
+ * reported to `options.onOrphansReaped`, or else as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. Each
+ * recorded group that it leaves running, because it cannot prove that the group still runs an operation of the
+ * daemon, goes to `options.onOperationGroupLeftRunning`, or else to a line in the launcher log. It does so
  * only under the start mutex and when no startup is reserved. It waits up to 5 seconds while another client
  * holds the mutex, and up to 1 second while the exited process is not reaped yet. It does nothing when there is
  * no record, when a process with the recorded PID runs, or when the runtime folder is not private, and it never
@@ -80,10 +82,11 @@ export async function reclaimCrashedDaemonAsync(
 /**
  * Stops the operations that an exited daemon left running, and removes its ownership record and socket, as
  * the next daemon start would (`options.onOrphansReaped` or `RUSH_DAEMON_ORPHANS_REAPED` warnings say what was
- * stopped). Best effort: it acts only while the ownership record names that daemon, under the start mutex, and
- * when no startup is reserved. While another client holds the mutex, for example to reclaim the same daemon,
- * it waits up to 5 seconds, and it waits up to 1 second for the exited process to be reaped. A reclaim is
- * logged ({@link logReclaimedDaemon}).
+ * stopped, and `options.onOperationGroupLeftRunning` or the launcher log what was left running). Best effort:
+ * it acts only while the ownership record names that daemon, under the start mutex, and when no startup is
+ * reserved. While another client holds the mutex, for example to reclaim the same daemon, it waits up to 5
+ * seconds, and it waits up to 1 second for the exited process to be reaped. A reclaim is logged
+ * ({@link logReclaimedDaemon}).
  */
 export async function reclaimExitedDaemonAsync(
   daemon: IExitedDaemon,
@@ -99,7 +102,7 @@ export async function reclaimExitedDaemonAsync(
         if (lock) {
           try {
             if (isRecordedOwner(daemon) && !readDaemonStartupReservation(daemon.paths)) {
-              await reclaimStaleDaemonAsync(daemon.paths, options);
+              await reclaimStaleDaemonAsync(daemon.paths, getClientReclaimOptions(daemon.paths, options));
               logReclaimedDaemon(daemon.paths, daemon.pid);
             }
           } finally {
diff --git a/libraries/rush-client-core/src/ReclaimedDaemonLog.ts b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
index 525a56e4ec..39991e012f 100644
--- a/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
+++ b/libraries/rush-client-core/src/ReclaimedDaemonLog.ts
@@ -3,7 +3,12 @@
 
 import * as fs from 'node:fs';
 
-import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import {
+  formatOperationGroupLeftRunning,
+  type IDaemonOperationGroupLeftRunning,
+  type IDaemonPaths,
+  type IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
 
 import { getDaemonLogFilePath } from './DaemonLogFile';
 
@@ -24,11 +29,41 @@ const READY_LINE: RegExp = /\brushd ready at /;
 export function logReclaimedDaemon(paths: IDaemonPaths, pid: number): void {
   appendClientLine(
     paths,
-    `rushd (PID ${pid}) exited without shutting down; stopped any operations it left running and removed ` +
-      'its ownership record and socket.'
+    `rushd (PID ${pid}) exited without shutting down; stopped the operations it left running that could be ` +
+      'proven to be its own, and removed its ownership record and socket.'
   );
 }
 
+/**
+ * Appends a line to the workspace's launcher log that names a process group that an exited daemon recorded
+ * for an operation and that a reclaim by this client left running, and says why
+ * (`formatOperationGroupLeftRunning`). Nothing goes to the terminal, because the group may be another
+ * program's; whoever later finds its processes can read here why they still run. Best effort; it never throws.
+ */
+export function logOperationGroupLeftRunning(
+  paths: IDaemonPaths,
+  group: IDaemonOperationGroupLeftRunning
+): void {
+  appendClientLine(paths, `${formatOperationGroupLeftRunning(group)}.`);
+}
+
+/**
+ * Returns the options for a reclaim of the workspace's daemon files by this client: `options.onOrphansReaped`
+ * as given, and `options.onOperationGroupLeftRunning`, or else {@link logOperationGroupLeftRunning} for each
+ * operation group that the reclaim leaves running. No other field of `options` reaches the transport.
+ */
+export function getClientReclaimOptions(
+  paths: IDaemonPaths,
+  options: IDaemonReclaimOptions | undefined
+): IDaemonReclaimOptions {
+  return {
+    onOrphansReaped: options?.onOrphansReaped,
+    onOperationGroupLeftRunning:
+      options?.onOperationGroupLeftRunning ??
+      ((group: IDaemonOperationGroupLeftRunning) => logOperationGroupLeftRunning(paths, group))
+  };
+}
+
 /**
  * Clears the report of the daemon that a client last reclaimed, if one is reported ({@link findReclaimedDaemonPid}),
  * with a line in the launcher log, for a reset of the workspace's daemon files. Best effort; it never throws.
diff --git a/libraries/rush-client-core/src/connectOrStartDaemon.ts b/libraries/rush-client-core/src/connectOrStartDaemon.ts
index c8eae54098..030c8fb94d 100644
--- a/libraries/rush-client-core/src/connectOrStartDaemon.ts
+++ b/libraries/rush-client-core/src/connectOrStartDaemon.ts
@@ -52,6 +52,7 @@ import {
   tryTakeOverAbandonedStartupReservationAsync,
   type DaemonStartupHelperState
 } from './DaemonStartupReservation';
+import { getClientReclaimOptions } from './ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from './StartupLock';
 import { findStoppedDaemonOwnerAsync } from './StoppedDaemonOwner';
 
@@ -212,7 +213,10 @@ async function startDaemonAsync(
     if (handoff) return handoff;
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before reclaim');
     await reclaimAbandonedOwnershipAsync(options.paths, { onOrphansReaped: options.onOrphansReaped });
-    await reclaimStaleDaemonAsync(options.paths, { onOrphansReaped: options.onOrphansReaped });
+    await reclaimStaleDaemonAsync(
+      options.paths,
+      getClientReclaimOptions(options.paths, { onOrphansReaped: options.onOrphansReaped })
+    );
     if (Date.now() >= deadline) throw startupError(options, 'exceeded its deadline before spawn');
     options.abortSignal?.throwIfAborted();
     const helper: IStartupHelper = await spawnDetachedAsync(options, deadline, abandonedHelper);
diff --git a/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts b/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
index 5739a8b64a..21b6420d5c 100644
--- a/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
+++ b/libraries/rush-client-core/src/test/AbandonedOwnershipReclaim.test.ts
@@ -8,13 +8,16 @@ import * as path from 'node:path';
 import {
   DaemonTransportErrorCode,
   tryAcquireReclaimLock,
+  type IDaemonOperationGroupLeftRunning,
   type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
 import { reclaimAbandonedOwnershipAsync } from '../DaemonOwnership';
 import {
+  describeGroupLeftRunning,
   isRunning,
+  readClientLogTexts,
   readProcessStartTime,
   recordDaemonOwner,
   recordOperationGroup,
@@ -69,10 +72,30 @@ describe(`${reclaimAbandonedOwnershipAsync.name} when a process that started lat
     expect(isRunning(recorded)).toBe(false);
     expect(isRunning(unrelated)).toBe(true);
     expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+    // The group of that process is left running, and the launcher log says why.
+    expect(readClientLogTexts(paths)).toEqual([
+      describeGroupLeftRunning(unrelated, unrelated, 'daemonPidInUse')
+    ]);
     expect(fs.existsSync(paths.lockfilePath)).toBe(false);
     expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
   });
 
+  linuxIt(
+    'gives a recorded group that it leaves running to onOperationGroupLeftRunning instead',
+    async () => {
+      const [unrelated, recorded] = await recordReusedOwnerAsync();
+      const groups: IDaemonOperationGroupLeftRunning[] = [];
+      await reclaimAbandonedOwnershipAsync(paths, {
+        onOrphansReaped,
+        onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => groups.push(group)
+      });
+      expect(isRunning(recorded)).toBe(false);
+      expect(isRunning(unrelated)).toBe(true);
+      expect(groups).toEqual([{ daemonPid: unrelated, processGroupId: unrelated, reason: 'daemonPidInUse' }]);
+      expect(readClientLogTexts(paths)).toEqual([]);
+    }
+  );
+
   linuxIt(
     'keeps the record and signals nothing while the recorded operations cannot be stopped',
     async () => {
@@ -91,6 +114,7 @@ describe(`${reclaimAbandonedOwnershipAsync.name} when a process that started lat
       expect(isRunning(recorded)).toBe(true);
       expect(isRunning(unrelated)).toBe(true);
       expect(reaps).toEqual([]);
+      expect(readClientLogTexts(paths)).toEqual([]);
       expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
       expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(true);
     }
diff --git a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
index 275a950deb..75f04197c3 100644
--- a/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonArtifactReset.test.ts
@@ -9,6 +9,7 @@ import * as path from 'node:path';
 
 import {
   tryAcquireReclaimLock,
+  type IDaemonOperationGroupLeftRunning,
   type IDaemonOrphanReap,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
@@ -17,7 +18,9 @@ import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
 import { getDaemonStartupFilePath } from '../DaemonStartup';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import {
+  describeGroupLeftRunning,
   isRunning,
+  readClientLogTexts,
   readProcessStartTime,
   recordDaemonOwner,
   recordOperationGroup,
@@ -136,6 +139,9 @@ describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutti
       expect(await resetDaemonArtifactsAsync(paths)).toEqual({ removedPaths: [paths.lockfilePath] });
       expect(isRunning(recorded)).toBe(false);
       expect(isRunning(other)).toBe(true);
+      expect(readClientLogTexts(paths)).toEqual([
+        describeGroupLeftRunning(daemonPid, other, 'leaderChanged')
+      ]);
       // Without onOrphansReaped, each set of stopped groups is reported as a process warning.
       expect(warning.mock.calls).toEqual([
         [
@@ -225,10 +231,55 @@ describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutti
       expect(isRunning(unrelated)).toBe(true);
       expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
       expect(warning).not.toHaveBeenCalled();
+      // The records are read in no set order.
+      expect(readClientLogTexts(paths).sort()).toEqual(
+        [
+          describeGroupLeftRunning(unrelated, unrelated, 'daemonPidInUse'),
+          describeGroupLeftRunning(unrelated, other, 'leaderChanged')
+        ].sort()
+      );
       expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
     }
   );
 
+  /**
+   * Records an owner that exited, or one whose PID a later process has, that recorded a group whose leader has
+   * another start time. Returns the owner's PID and the group's.
+   */
+  async function recordChangedLeaderAsync(owner: string): Promise<[number, number]> {
+    if (owner === 'reused') {
+      const [unrelated, , other] = await recordReusedOwnerAsync();
+      return [unrelated, other];
+    }
+    const daemonPid: number = await startExitedProcessAsync();
+    const other: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    recordOperationGroup(
+      paths.lockfilePath,
+      daemonPid,
+      other,
+      String(Number(readProcessStartTime(other)) - 1)
+    );
+    return [daemonPid, other];
+  }
+
+  linuxIt.each(['exited', 'reused'])(
+    'gives a recorded group that it leaves running to onOperationGroupLeftRunning instead (%s owner)',
+    async (owner: string) => {
+      const [ownerPid, other] = await recordChangedLeaderAsync(owner);
+      const groups: IDaemonOperationGroupLeftRunning[] = [];
+      const onOperationGroupLeftRunning = (group: IDaemonOperationGroupLeftRunning): void => {
+        groups.push(group);
+      };
+      expect(await resetDaemonArtifactsAsync(paths, { onOperationGroupLeftRunning })).toEqual({
+        removedPaths: [paths.lockfilePath]
+      });
+      expect(isRunning(other)).toBe(true);
+      expect(groups).toContainEqual({ daemonPid: ownerPid, processGroupId: other, reason: 'leaderChanged' });
+      expect(readClientLogTexts(paths)).toEqual([]);
+    }
+  );
+
   linuxIt(
     'signals and removes nothing while another process reclaims, when a later process has the PID',
     async () => {
@@ -246,6 +297,7 @@ describe(`${resetDaemonArtifactsAsync.name} when the owner exited without shutti
       expect(isRunning(recorded)).toBe(true);
       expect(isRunning(unrelated)).toBe(true);
       expect(reaps).toEqual([]);
+      expect(readClientLogTexts(paths)).toEqual([]);
       expect(fs.readFileSync(paths.lockfilePath, 'utf8')).toBe(record);
       expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(true);
     }
diff --git a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
index 74bc4d605a..298f3208fa 100644
--- a/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
+++ b/libraries/rush-client-core/src/test/ExitedDaemonReclaim.test.ts
@@ -6,7 +6,11 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
 
 import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { reclaimCrashedDaemonAsync } from '../ExitedDaemonReclaim';
@@ -15,7 +19,12 @@ import { findReclaimedDaemonPid } from '../ReclaimedDaemonLog';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import {
   isRunning,
+  readClientLogTexts,
+  readProcessStartTime,
   recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
+  startExitedProcessAsync,
   startOrphanedOperationAsync,
   startStandInDaemonAsync,
   stopOperationIfRunning,
@@ -84,6 +93,51 @@ describe(reclaimCrashedDaemonAsync.name, () => {
     expect(warning).not.toHaveBeenCalled();
   });
 
+  /**
+   * Records an exited owner that recorded one operation group whose leader has another start time, as if a
+   * process that started later has the PID of the group's leader now. Returns the owner's PID and that PID.
+   */
+  async function recordChangedLeaderAsync(): Promise<[number, number]> {
+    const daemonPid: number = await startExitedProcessAsync();
+    const other: number = await startDetachedOperationAsync(operationPids);
+    recordDaemonOwner(paths, daemonPid);
+    const earlier: string = String(Number(readProcessStartTime(other)) - 1);
+    recordOperationGroup(paths.lockfilePath, daemonPid, other, earlier);
+    return [daemonPid, other];
+  }
+
+  linuxIt('logs a recorded group that it leaves running, before the line that names the daemon', async () => {
+    const [daemonPid, other] = await recordChangedLeaderAsync();
+    await reclaimCrashedDaemonAsync(paths);
+    expect(isRunning(other)).toBe(true);
+    expect(readClientLogTexts(paths)).toEqual([
+      `left process group ${other} running, which the exited daemon (PID ${daemonPid}) recorded for an ` +
+        `operation: the process with PID ${other} now is not the leader that the daemon recorded.`,
+      `rushd (PID ${daemonPid}) exited without shutting down; stopped the operations it left running that ` +
+        'could be proven to be its own, and removed its ownership record and socket.'
+    ]);
+    expect(findReclaimedDaemonPid(paths)).toBe(daemonPid);
+    expect(fs.existsSync(paths.lockfilePath)).toBe(false);
+    expect(fs.existsSync(`${paths.lockfilePath}.groups-${daemonPid}`)).toBe(false);
+    expect(warning).not.toHaveBeenCalled();
+  });
+
+  linuxIt(
+    'gives a recorded group that it leaves running to onOperationGroupLeftRunning instead',
+    async () => {
+      const [daemonPid, other] = await recordChangedLeaderAsync();
+      const groups: IDaemonOperationGroupLeftRunning[] = [];
+      await reclaimCrashedDaemonAsync(paths, {
+        onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => groups.push(group)
+      });
+      expect(isRunning(other)).toBe(true);
+      expect(groups).toEqual([{ daemonPid, processGroupId: other, reason: 'leaderChanged' }]);
+      expect(readClientLogTexts(paths)).toEqual([
+        expect.stringMatching(new RegExp(`^rushd \\(PID ${daemonPid}\\) exited without shutting down;`))
+      ]);
+    }
+  );
+
   linuxIt(
     'leaves a running daemon alone, without waiting while another client holds the start mutex',
     async () => {
@@ -178,7 +232,8 @@ describe(reclaimCrashedDaemonAsync.name, () => {
     expect(logged).toMatch(
       new RegExp(
         `^\\S+Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${daemonPid}\\) exited without shutting down; ` +
-          'stopped any operations it left running and removed its ownership record and socket\\.\\n$'
+          'stopped the operations it left running that could be proven to be its own, and removed its ' +
+          'ownership record and socket\\.\\n$'
       )
     );
     expect(fs.statSync(logFilePath).mode % 0o1000).toBe(0o600);
diff --git a/libraries/rush-client-core/src/test/OrphanedOperation.ts b/libraries/rush-client-core/src/test/OrphanedOperation.ts
index a04361d1de..7fe5994ec7 100644
--- a/libraries/rush-client-core/src/test/OrphanedOperation.ts
+++ b/libraries/rush-client-core/src/test/OrphanedOperation.ts
@@ -9,11 +9,14 @@ import type { Readable } from 'node:stream';
 
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import {
+  formatOperationGroupLeftRunning,
   isDaemonProcessAlive,
   writeDaemonLockfile,
+  type DaemonOperationGroupLeftRunningReason,
   type IDaemonPaths
 } from '@rushstack/rush-daemon-transport';
 
+import { getDaemonLogFilePath } from '../DaemonLogFile';
 import { isProcessDefunct } from '../ProcessStartTime';
 
 /** An operation process that a stand-in daemon starts; it exits by itself after a minute. */
@@ -135,3 +138,25 @@ export function stopOperationIfRunning(pid: number): void {
     // It has exited.
   }
 }
+
+// A line that a client appends to the launcher log.
+const CLIENT_LOG_LINE: RegExp = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z rush-client \(PID (\d+)\): (.*)$/;
+
+/** The texts of the lines that this process appended to the launcher log, in order. */
+export function readClientLogTexts(paths: IDaemonPaths): string[] {
+  const logFilePath: string = getDaemonLogFilePath(paths);
+  const lines: string[] = fs.existsSync(logFilePath) ? fs.readFileSync(logFilePath, 'utf8').split('\n') : [];
+  return lines.flatMap((line: string) => {
+    const match: RegExpExecArray | null = CLIENT_LOG_LINE.exec(line);
+    return match && Number(match[1]) === process.pid ? [match[2]] : [];
+  });
+}
+
+/** The text of the line that a client appends for a recorded group that its reclaim left running. */
+export function describeGroupLeftRunning(
+  daemonPid: number,
+  processGroupId: number,
+  reason: DaemonOperationGroupLeftRunningReason
+): string {
+  return `${formatOperationGroupLeftRunning({ daemonPid, processGroupId, reason })}.`;
+}
diff --git a/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
index 4b8ee38ac9..baa25b5be2 100644
--- a/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
+++ b/libraries/rush-client-core/src/test/ReclaimedDaemonLog.test.ts
@@ -6,11 +6,20 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 
-import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonPaths,
+  IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
 
 import { getDaemonLogFilePath } from '../DaemonLogFile';
-import { resetDaemonArtifactsAsync } from '../DaemonOwnership';
-import { findReclaimedDaemonPid, logReclaimedDaemon } from '../ReclaimedDaemonLog';
+import { resetDaemonArtifactsAsync, type IDaemonArtifactResetOptions } from '../DaemonOwnership';
+import {
+  findReclaimedDaemonPid,
+  getClientReclaimOptions,
+  logOperationGroupLeftRunning,
+  logReclaimedDaemon
+} from '../ReclaimedDaemonLog';
 
 const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
 
@@ -18,7 +27,8 @@ const posixIt: typeof it = process.platform === 'win32' ? it.skip : it;
 function getReclaimLine(pid: number): RegExp {
   return new RegExp(
     `^\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z rush-client \\(PID ${process.pid}\\): rushd \\(PID ${pid}\\) ` +
-      'exited without shutting down; stopped any operations it left running and removed its ownership record and socket\\.$'
+      'exited without shutting down; stopped the operations it left running that could be proven to be its own, ' +
+      'and removed its ownership record and socket\\.$'
   );
 }
 
@@ -209,3 +219,78 @@ describe(findReclaimedDaemonPid.name, () => {
     expect(findReclaimedDaemonPid(paths)).toBe(108);
   });
 });
+
+describe(getClientReclaimOptions.name, () => {
+  const group: IDaemonOperationGroupLeftRunning = {
+    daemonPid: 4000,
+    processGroupId: 4242,
+    reason: 'otherSession'
+  };
+  let folder: string;
+  let paths: IDaemonPaths;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-reclaim-options-'));
+    paths = {
+      runtimeDir: folder,
+      socketPath: path.join(folder, 'd.sock'),
+      lockfilePath: path.join(folder, 'daemon.pid.json')
+    };
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(folder, { recursive: true, force: true });
+  });
+
+  function readLogLines(): string[] {
+    return fs.readFileSync(getDaemonLogFilePath(paths), 'utf8').split('\n');
+  }
+
+  it('logs each group that a reclaim leaves running, in a line that names no reclaimed or ready daemon', () => {
+    const options: IDaemonReclaimOptions = getClientReclaimOptions(paths, undefined);
+    expect(Object.keys(options).sort()).toEqual(['onOperationGroupLeftRunning', 'onOrphansReaped']);
+    expect(options.onOrphansReaped).toBeUndefined();
+    options.onOperationGroupLeftRunning!(group);
+    expect(readLogLines()).toEqual([
+      expect.stringMatching(
+        new RegExp(
+          `^\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z rush-client \\(PID ${process.pid}\\): ` +
+            'left process group 4242 running, which the exited daemon \\(PID 4000\\) recorded for an operation: ' +
+            'its leader has exited, and a process of the group is in another session\\.$'
+        )
+      ),
+      ''
+    ]);
+    expect(findReclaimedDaemonPid(paths)).toBeUndefined();
+    // A later reclaim may log a group that it leaves running after the line of a reclaimed daemon.
+    logReclaimedDaemon(paths, 101);
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    logOperationGroupLeftRunning(paths, group);
+    expect(findReclaimedDaemonPid(paths)).toBe(101);
+    expect(readLogLines()).toHaveLength(4);
+  });
+
+  it("passes on only the caller's callbacks, which replace the log", () => {
+    const onOrphansReaped: jest.Mock = jest.fn();
+    const onOperationGroupLeftRunning: jest.Mock = jest.fn();
+    const resetOptions: IDaemonArtifactResetOptions = {
+      onOrphansReaped,
+      onOperationGroupLeftRunning,
+      waitTimeoutMs: 5000
+    };
+    const options: IDaemonReclaimOptions = getClientReclaimOptions(paths, resetOptions);
+    expect(options).toStrictEqual({ onOrphansReaped, onOperationGroupLeftRunning });
+    expect(options.onOperationGroupLeftRunning).toBe(onOperationGroupLeftRunning);
+    const reapOnly: IDaemonReclaimOptions = getClientReclaimOptions(paths, { onOrphansReaped });
+    expect(reapOnly.onOrphansReaped).toBe(onOrphansReaped);
+    reapOnly.onOperationGroupLeftRunning!(group);
+    expect(readLogLines()).toEqual([expect.stringContaining('left process group 4242 running'), '']);
+  });
+
+  it('never throws when it cannot write the log', () => {
+    fs.mkdirSync(getDaemonLogFilePath(paths));
+    expect(() => logOperationGroupLeftRunning(paths, group)).not.toThrow();
+    const missing: IDaemonPaths = { ...paths, lockfilePath: path.join(folder, 'missing', 'daemon.pid.json') };
+    expect(() => logOperationGroupLeftRunning(missing, group)).not.toThrow();
+  });
+});
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
index 0b68abce4a..67512b843c 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemon.test.ts
@@ -51,8 +51,12 @@ import {
 } from '../DaemonStartupReservation';
 import { tryAcquireStartupLockAsync, type IStartupLock } from '../StartupLock';
 import {
+  describeGroupLeftRunning,
   isRunning,
+  readClientLogTexts,
   recordDaemonOwner,
+  recordOperationGroup,
+  startDetachedOperationAsync,
   startOrphanedOperationAsync,
   stopOperationIfRunning
 } from './OrphanedOperation';
@@ -1833,7 +1837,7 @@ describe('detached daemon startup', () => {
   );
 
   (process.platform === 'linux' ? it : it.skip)(
-    'reports the operations that a crashed daemon left running to onOrphansReaped before a start',
+    'reports the operations that a crashed daemon left running to onOrphansReaped, and logs a recorded group that it leaves running, before a start',
     async () => {
       const operationPids: number[] = [];
       const warning: jest.SpyInstance = jest
@@ -1841,6 +1845,9 @@ describe('detached daemon startup', () => {
         .mockImplementation(() => undefined);
       try {
         const { daemonPid, operationPid } = await startOrphanedOperationAsync(operationPids);
+        // A start time that its leader does not have, as if a later process had the recorded PID.
+        const other: number = await startDetachedOperationAsync(operationPids);
+        recordOperationGroup(paths.lockfilePath, daemonPid, other, '1');
         await leaveStaleSocketAsync();
         recordDaemonOwner(paths, daemonPid);
         const reaps: IDaemonOrphanReap[] = [];
@@ -1851,6 +1858,10 @@ describe('detached daemon startup', () => {
         await client.closeAsync();
         expect(isRunning(operationPid)).toBe(false);
         expect(reaps).toEqual([{ daemonPid, processGroupIds: [daemonPid], outcome: 'terminated' }]);
+        expect(isRunning(other)).toBe(true);
+        expect(readClientLogTexts(paths)).toEqual([
+          describeGroupLeftRunning(daemonPid, other, 'leaderChanged')
+        ]);
         expect(warning).not.toHaveBeenCalled();
         expect(fs.readFileSync(path.join(folder, 'starts'), 'utf8').trim().split('\n')).toHaveLength(1);
       } finally {
diff --git a/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts b/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
index c64484d42c..eebdc4849d 100644
--- a/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
+++ b/libraries/rush-client-core/src/test/connectOrStartDaemonReusedOwner.test.ts
@@ -17,7 +17,9 @@ import { captureDaemonRequest } from '../captureDaemonRequest';
 import type { DaemonClient } from '../DaemonClient';
 import { connectOrStartDaemonAsync, type IConnectOrStartDaemonOptions } from '../connectOrStartDaemon';
 import {
+  describeGroupLeftRunning,
   isRunning,
+  readClientLogTexts,
   readProcessStartTime,
   recordDaemonOwner,
   recordOperationGroup,
@@ -120,6 +122,9 @@ describe('detached daemon startup after a daemon whose PID a later process has',
         expect(isRunning(recorded)).toBe(false);
         expect(isRunning(unrelated)).toBe(true);
         expect(reaps).toEqual([{ daemonPid: unrelated, processGroupIds: [recorded], outcome: 'terminated' }]);
+        expect(readClientLogTexts(paths)).toEqual([
+          describeGroupLeftRunning(unrelated, unrelated, 'daemonPidInUse')
+        ]);
         expect(warning).not.toHaveBeenCalled();
         expect(readDaemonLockfile(paths.lockfilePath)?.pid).not.toBe(unrelated);
         expect(fs.existsSync(`${paths.lockfilePath}.groups-${unrelated}`)).toBe(false);
diff --git a/libraries/rush-daemon-transport/README.md b/libraries/rush-daemon-transport/README.md
index dd0d6f6b29..4b582d8bb0 100644
--- a/libraries/rush-daemon-transport/README.md
+++ b/libraries/rush-daemon-transport/README.md
@@ -24,7 +24,10 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
   plus a connect probe) and reclaimed without manual cleanup. On POSIX, a reclaim first stops the
   operations that the dead daemon left running. Both `reclaimStaleDaemonAsync` and
   `DaemonFrameListener.listenAsync` report each set of stopped process groups to `onOrphansReaped`,
-  or, without it, as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+  or, without it, as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. A recorded operation group
+  that the reclaim cannot prove is still the dead daemon's gets no signal. When such a group still
+  has a live process, it is passed to `onOperationGroupLeftRunning`, if given, with the first check
+  it failed; `formatOperationGroupLeftRunning` describes it in one line.
 - **Two-phase shutdown** — `stopAcceptingAsync()` stops admission and waits for connections while
   retaining ownership. Hosts release the endpoint with `closeAsync()` after their resources have
   finished disposing. A live owner prevents rebinding even when its socket has already closed;
diff --git a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
index d0906d0da7..d8d8cd1380 100644
--- a/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
+++ b/libraries/rush-daemon-transport/src/DaemonListenerBinding.ts
@@ -18,14 +18,18 @@ const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
 /**
  * Binds the listener, reclaiming its path once from a dead daemon. Returns the identity of a POSIX socket; a
  * Windows named pipe has no file and disappears with its server. Of the listener's options, only
- * `onOrphansReaped` goes on to the reclaim, because the reaper also reads fields for tests from that object.
+ * `onOrphansReaped` and `onOperationGroupLeftRunning` go on to the reclaim, because the reaper also reads
+ * fields for tests from that object.
  */
 export async function listenWithReclaimAsync(
   server: net.Server,
   paths: IDaemonPaths,
   listenerOptions: IDaemonReclaimOptions
 ): Promise<IDaemonFileIdentity | undefined> {
-  const options: IDaemonReclaimOptions = { onOrphansReaped: listenerOptions.onOrphansReaped };
+  const options: IDaemonReclaimOptions = {
+    onOrphansReaped: listenerOptions.onOrphansReaped,
+    onOperationGroupLeftRunning: listenerOptions.onOperationGroupLeftRunning
+  };
   if (process.platform !== WINDOWS_PLATFORM) return listenPublishedAsync(server, paths, options);
   await listenPipeWithReclaimAsync(server, paths, options);
   return undefined;
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts
new file mode 100644
index 0000000000..01edb6e738
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunning.ts
@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { findOperationGroupLeftRunningReason, readOperationGroupState } from './DaemonOperationGroupState';
+import type { IOperationGroupState } from './DaemonOperationGroupState';
+import type { IReapContext } from './DaemonReapOptions';
+import type {
+  DaemonOperationGroupLeftRunningReason,
+  IDaemonOperationGroupLeftRunning
+} from './DaemonReclaimOptions';
+
+const NO_MEMBERS: number = 0;
+const WINDOWS_PLATFORM: NodeJS.Platform = 'win32';
+// 0 and 1 are never operation groups, and kill(-0)/kill(-1) would probe our own group or every process.
+const FIRST_USER_PID: number = 2;
+
+type GroupCheck = (groupId: number, context: IReapContext) => boolean;
+
+// The proof rejects the first two before it reads anything. kill() finds no process of a stale group, which
+// spares a scan of every process's record, or of a group whose processes have all been reaped since the proof.
+const WORTH_READING_CHECKS: readonly GroupCheck[] = [
+  (groupId: number, context: IReapContext) => context.platform !== WINDOWS_PLATFORM,
+  (groupId: number) => Number.isSafeInteger(groupId) && groupId >= FIRST_USER_PID,
+  (groupId: number, context: IReapContext) => context.ops.mayHaveMembers(groupId)
+];
+
+/** The records that a reap removed without a signal, and the marker of the daemon that wrote them. */
+export interface IUnprovenOperationGroups {
+  readonly records: readonly IOperationGroupRecord[];
+  readonly marker: string;
+}
+
+function isGroupWorthReading(groupId: number, context: IReapContext): boolean {
+  return WORTH_READING_CHECKS.every((check: GroupCheck) => check(groupId, context));
+}
+
+function explainLeftRunning(
+  record: IOperationGroupRecord,
+  context: IReapContext,
+  marker: string
+): DaemonOperationGroupLeftRunningReason | undefined {
+  if (!isGroupWorthReading(record.groupId, context)) return undefined;
+  const state: IOperationGroupState = readOperationGroupState({ record, context, marker });
+  return state.members.length > NO_MEMBERS ? findOperationGroupLeftRunningReason(state) : undefined;
+}
+
+// A probe that fails proves nothing about the group, and only its report is lost.
+function tryExplainLeftRunning(
+  record: IOperationGroupRecord,
+  context: IReapContext,
+  marker: string
+): DaemonOperationGroupLeftRunningReason | undefined {
+  try {
+    return explainLeftRunning(record, context, marker);
+  } catch {
+    return undefined;
+  }
+}
+
+function listGroupsLeftRunning(
+  context: IReapContext,
+  { records, marker }: IUnprovenOperationGroups
+): IDaemonOperationGroupLeftRunning[] {
+  return records.flatMap((record: IOperationGroupRecord) => {
+    const reason: DaemonOperationGroupLeftRunningReason | undefined = tryExplainLeftRunning(
+      record,
+      context,
+      marker
+    );
+    return reason ? [{ daemonPid: context.deadPid, processGroupId: record.groupId, reason }] : [];
+  });
+}
+
+/**
+ * Reports each of the records that a reap removed without a signal to `onOperationGroupLeftRunning`, with the
+ * first condition of the proof that its group fails now, when the group still has a live process.
+ *
+ * @remarks
+ * The reap passes the context that its proof read through (see `withProcessReadsOnce`), so a group is judged
+ * on what the proof read of it, and is read here only when the proof did not read it. A group of which kill()
+ * finds no process now is not reported, and neither is one with no live member, one that passes every
+ * condition, or one whose read fails. Without the callback, nothing is read.
+ */
+export function reportOperationGroupsLeftRunning(
+  context: IReapContext,
+  unproven: IUnprovenOperationGroups
+): void {
+  const report: IReapContext['onOperationGroupLeftRunning'] = context.onOperationGroupLeftRunning;
+  if (!report) return;
+  for (const group of listGroupsLeftRunning(context, unproven)) report(group);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts
new file mode 100644
index 0000000000..5950a7da0d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupLeftRunningMessage.ts
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from './DaemonOperationGroupMarker';
+import type {
+  DaemonOperationGroupLeftRunningReason,
+  IDaemonOperationGroupLeftRunning
+} from './DaemonReclaimOptions';
+
+type DescribeReason = (group: IDaemonOperationGroupLeftRunning) => string;
+
+const REASON_DESCRIPTIONS: Readonly<Record<DaemonOperationGroupLeftRunningReason, DescribeReason>> = {
+  callerGroup: () =>
+    'its ID is the PID or the process group ID of this process, or this process cannot read its own group',
+  daemonPidInUse: () => "another process has that daemon's PID now",
+  leaderChanged: ({ processGroupId }: IDaemonOperationGroupLeftRunning) =>
+    `the process with PID ${processGroupId} now is not the leader that the daemon recorded`,
+  otherSession: () => 'its leader has exited, and a process of the group is in another session',
+  noMarker: () =>
+    `its leader has exited, and no process of the group has that daemon's ${DAEMON_OPERATION_GROUPS_ENV_VAR} ` +
+    'value, which a daemon from a release before that variable does not set'
+};
+
+/**
+ * Describes, in one line without a final period, a process group that a reclaim left running (see
+ * `IDaemonReclaimOptions.onOperationGroupLeftRunning`): which group, which exited daemon recorded it, and why
+ * the reclaim left it running. "This process" in it is the process that reclaimed.
+ *
+ * @remarks
+ * For example: "left process group 5001 running, which the exited daemon (PID 4242) recorded for an
+ * operation: its leader has exited, and a process of the group is in another session".
+ *
+ * @beta
+ */
+export function formatOperationGroupLeftRunning(group: IDaemonOperationGroupLeftRunning): string {
+  return (
+    `left process group ${group.processGroupId} running, which the exited daemon (PID ${group.daemonPid}) ` +
+    `recorded for an operation: ${REASON_DESCRIPTIONS[group.reason](group)}`
+  );
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index f2e5a21081..5308ab850a 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -3,6 +3,7 @@
 
 import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
 import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
+import { reportOperationGroupsLeftRunning } from './DaemonOperationGroupLeftRunning';
 import { getOperationGroupsMarker } from './DaemonOperationGroupMarker';
 import { isProvenOperationGroup } from './DaemonOperationGroupProof';
 import {
@@ -12,6 +13,7 @@ import {
 } from './DaemonOperationGroups';
 import type { IOperationGroupRecord } from './DaemonOperationGroups';
 import { isOwnedEntry } from './DaemonOwnedEntry';
+import { withProcessReadsOnce } from './DaemonProcessReadsOnce';
 import { createReapContext, reportOrphansReaped } from './DaemonReapOptions';
 import type { IDaemonOrphanReaperOptions, IReapContext } from './DaemonReapOptions';
 import type { IDaemonOrphanReap } from './DaemonReclaimOptions';
@@ -39,12 +41,20 @@ async function reapRecordedGroupsAsync(
   context: IReapContext
 ): Promise<DaemonOrphanReapOutcome> {
   const marker: string = getOperationGroupsMarker(folder);
-  const groupIds: number[] = readOperationGroupRecords(folder)
-    .filter((record: IOperationGroupRecord) => isProvenOperationGroup(record, context, marker))
-    .map((record: IOperationGroupRecord) => record.groupId);
+  const records: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  // The termination polls the groups itself, and never through these reads.
+  const probe: IReapContext = withProcessReadsOnce(context);
+  const proven: IOperationGroupRecord[] = records.filter((record: IOperationGroupRecord) =>
+    isProvenOperationGroup(record, probe, marker)
+  );
+  const groupIds: number[] = proven.map((record: IOperationGroupRecord) => record.groupId);
   const outcome: DaemonOrphanReapOutcome =
     groupIds.length > NO_MEMBERS ? await terminateAndLogAsync(context, groupIds) : NOTHING_REAPED;
   removeOperationGroupRecords(folder);
+  const unproven: IOperationGroupRecord[] = records.filter(
+    (record: IOperationGroupRecord) => !proven.includes(record)
+  );
+  reportOperationGroupsLeftRunning(probe, { records: unproven, marker });
   return outcome;
 }
 
@@ -57,9 +67,11 @@ async function reapRecordedGroupsAsync(
  * the recorded start time and still leads group and session `groupId` (a reused pid has another start
  * time), or its leader has exited (a zombie leader has too), every live member of the group is in
  * session `groupId`, and at least one of them carries the daemon's marker (`RUSHD_OPERATION_GROUPS` set to
- * the record folder; see `startOperationGroupRecording`). Unproven records are dropped without a signal.
- * A daemon from a release before that marker sets none, so the first reclaim after an upgrade drops its
- * recorded groups whose leader has exited and leaves them running.
+ * the record folder; see `startOperationGroupRecording`). Unproven records are dropped without a signal, and
+ * each whose group still has a live process goes to `options.onOperationGroupLeftRunning` with the first
+ * condition that the group fails, judged on what the proof read of it. A daemon from a release before that
+ * marker sets none, so the first reclaim after an upgrade drops its recorded groups whose leader has exited
+ * and leaves them running.
  * Records survive a failed reap, so the next reclaim retries.
  * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
  * Call only under the reclaim mutex, after the daemon has been proven dead, or its pid proven reused
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts
new file mode 100644
index 0000000000..2a2ff4d6f3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupState.ts
@@ -0,0 +1,81 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import type { IProcessStat } from './DaemonProcessStat';
+import type { IReapContext } from './DaemonReapOptions';
+import type { DaemonOperationGroupLeftRunningReason } from './DaemonReclaimOptions';
+
+/** A record whose group is read, with the context of its reap and the marker of the daemon that wrote it. */
+export interface IOperationGroupProbe {
+  readonly record: IOperationGroupRecord;
+  readonly context: IReapContext;
+  readonly marker: string;
+}
+
+/** How a recorded operation process group looks now. */
+export interface IOperationGroupState extends IOperationGroupProbe {
+  /** The process whose PID is the group's ID, unless it has exited. */
+  readonly leader: IProcessStat | undefined;
+  /** The processes of the group that have not exited. */
+  readonly members: readonly IProcessStat[];
+}
+
+interface IReasonCheck {
+  readonly reason: DaemonOperationGroupLeftRunningReason;
+  readonly applies: (state: IOperationGroupState) => boolean;
+}
+
+function isCallerGroup({ record, context }: IOperationGroupState): boolean {
+  const ownGroupId: number | undefined = context.ops.ownGroupId();
+  return record.groupId === context.selfPid || ownGroupId === undefined || ownGroupId === record.groupId;
+}
+
+function isDaemonPidInUse({ record, context }: IOperationGroupState): boolean {
+  const { deadPid } = context;
+  return context.deadPidReused ? record.groupId === deadPid : context.ops.isProcessAlive(deadPid);
+}
+
+function isRecordedLeader(leader: IProcessStat, { groupId, startTime }: IOperationGroupRecord): boolean {
+  return leader.startTime === startTime && leader.groupId === groupId && leader.sessionId === groupId;
+}
+
+function hasOtherLeader({ record, leader }: IOperationGroupState): boolean {
+  return leader !== undefined && !isRecordedLeader(leader, record);
+}
+
+function hasMemberInOtherSession({ record, leader, members }: IOperationGroupState): boolean {
+  return leader === undefined && members.some((member: IProcessStat) => member.sessionId !== record.groupId);
+}
+
+function lacksMarker({ context, marker, leader, members }: IOperationGroupState): boolean {
+  const isMarked = (member: IProcessStat): boolean => context.ops.hasEnvironmentEntry(member.pid, marker);
+  return leader === undefined && !members.some(isMarked);
+}
+
+// The conditions of `isProvenOperationGroup`, in its order, each as the reason why a group fails it.
+const REASON_CHECKS: readonly IReasonCheck[] = [
+  { reason: 'callerGroup', applies: isCallerGroup },
+  { reason: 'daemonPidInUse', applies: isDaemonPidInUse },
+  { reason: 'leaderChanged', applies: hasOtherLeader },
+  { reason: 'otherSession', applies: hasMemberInOtherSession },
+  { reason: 'noMarker', applies: lacksMarker }
+];
+
+/** Reads the leader and the live members of the probed record's group. */
+export function readOperationGroupState(probe: IOperationGroupProbe): IOperationGroupState {
+  const { ops } = probe.context;
+  const stat: IProcessStat | undefined = ops.readProcessStat(probe.record.groupId);
+  const leader: IProcessStat | undefined = stat?.exited ? undefined : stat;
+  return { ...probe, leader, members: ops.listLiveGroupMembers(probe.record.groupId) };
+}
+
+/**
+ * The first condition that the group fails, in the order in which `isProvenOperationGroup` checks them, or
+ * `undefined` when it passes every one.
+ */
+export function findOperationGroupLeftRunningReason(
+  state: IOperationGroupState
+): DaemonOperationGroupLeftRunningReason | undefined {
+  return REASON_CHECKS.find((check: IReasonCheck) => check.applies(state))?.reason;
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts b/libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts
new file mode 100644
index 0000000000..1cfba3ec00
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessReadsOnce.ts
@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonProcessGroupOps } from './DaemonProcessGroup';
+import type { IReapContext } from './DaemonReapOptions';
+
+interface IKeptRead<T> {
+  readonly value: T;
+}
+
+// A read that throws is not kept, so the next caller reads again and gets its own error.
+function readOnce<T>(read: (id: number) => T): (id: number) => T {
+  const kept: Map<number, IKeptRead<T>> = new Map();
+  return (id: number): T => {
+    const result: IKeptRead<T> = kept.get(id) ?? { value: read(id) };
+    kept.set(id, result);
+    return result.value;
+  };
+}
+
+/**
+ * `context`, with each process's `/proc` record and each group's list of live members read at most once.
+ *
+ * @remarks
+ * The proof and the report of one reap share it: the report judges a group on what the proof read of it, and
+ * scans every process's record only for a group that the proof did not read. Whether a group has any process
+ * at all (`mayHaveMembers`) is still asked each time.
+ */
+export function withProcessReadsOnce(context: IReapContext): IReapContext {
+  const { ops } = context;
+  const readsOnce: IDaemonProcessGroupOps = {
+    ...ops,
+    readProcessStat: readOnce(ops.readProcessStat),
+    listLiveGroupMembers: readOnce(ops.listLiveGroupMembers)
+  };
+  return { ...context, ops: readsOnce };
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
index cdf9a58a23..86099158f2 100644
--- a/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReapOptions.ts
@@ -60,7 +60,8 @@ export function createReapContext(deadPid: number, options: IDaemonOrphanReaperO
     ops: options.ops ?? POSIX_PROCESS_GROUP_OPS,
     deadPid,
     uid: resolveCallerUid(options),
-    onOrphansReaped: options.onOrphansReaped
+    onOrphansReaped: options.onOrphansReaped,
+    onOperationGroupLeftRunning: options.onOperationGroupLeftRunning
   };
 }
 
diff --git a/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts b/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
index c2a0d9d2f7..3de280fd1f 100644
--- a/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
+++ b/libraries/rush-daemon-transport/src/DaemonReclaimOptions.ts
@@ -15,6 +15,48 @@ export interface IDaemonOrphanReap {
   readonly outcome: 'terminated' | 'killed';
 }
 
+/**
+ * The first condition that a recorded operation process group failed, so that a reclaim left it running.
+ *
+ * @remarks
+ * - `callerGroup`: the group's ID is the PID or the process group ID of the process that reclaims (a
+ *   `rush-client` that the operation ran, for example), or that process cannot read its own process group.
+ *
+ * - `daemonPidInUse`: another process has the exited daemon's PID now. When the reclaim was told so
+ *   (`deadPidReused`), only the group whose ID is that PID is left running for this reason.
+ *
+ * - `leaderChanged`: the process whose PID is the group's ID is not the leader that the daemon recorded: it
+ *   started at another time, or it has left the group or the group's session.
+ *
+ * - `otherSession`: the group's leader has exited, and a live process of the group is in another session.
+ *
+ * - `noMarker`: the group's leader has exited, and no live process of the group has the exited daemon's
+ *   `RUSHD_OPERATION_GROUPS` value, which a daemon from a release before that variable does not set.
+ *
+ * @beta
+ */
+export type DaemonOperationGroupLeftRunningReason =
+  | 'callerGroup'
+  | 'daemonPidInUse'
+  | 'leaderChanged'
+  | 'otherSession'
+  | 'noMarker';
+
+/**
+ * A process group that an exited daemon recorded for an operation, and whose record a reclaim removed without
+ * a signal, because it could not prove that the group still runs that operation.
+ *
+ * @beta
+ */
+export interface IDaemonOperationGroupLeftRunning {
+  /** The PID of the daemon that recorded the group and exited. */
+  readonly daemonPid: number;
+  /** The process group, which still had a live process when the reclaim left it. */
+  readonly processGroupId: number;
+  /** The first condition that the group failed. */
+  readonly reason: DaemonOperationGroupLeftRunningReason;
+}
+
 /**
  * Options for {@link reclaimStaleDaemonAsync}.
  *
@@ -26,4 +68,10 @@ export interface IDaemonReclaimOptions {
    * its own words. When it is omitted, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
    */
   readonly onOrphansReaped?: (reap: IDaemonOrphanReap) => void;
+  /**
+   * Called once for each recorded operation process group that the reclaim left running when it removed the
+   * group's record, because it could not prove that the group still runs an operation of the exited daemon.
+   * A group without a live process is not reported. When it is omitted, nothing is reported.
+   */
+  readonly onOperationGroupLeftRunning?: (group: IDaemonOperationGroupLeftRunning) => void;
 }
diff --git a/libraries/rush-daemon-transport/src/index.ts b/libraries/rush-daemon-transport/src/index.ts
index 25c60f30bd..b41f04b56c 100644
--- a/libraries/rush-daemon-transport/src/index.ts
+++ b/libraries/rush-daemon-transport/src/index.ts
@@ -25,6 +25,7 @@ export {
   writeDaemonLockfile,
   type IDaemonLockfile
 } from './DaemonLockfile';
+export { formatOperationGroupLeftRunning } from './DaemonOperationGroupLeftRunningMessage';
 export { DAEMON_OPERATION_GROUPS_ENV_VAR } from './DaemonOperationGroupMarker';
 export { tryAcquireReclaimLock, type DaemonReclaimLockOutcome } from './DaemonReclaimLock';
 export {
@@ -35,7 +36,12 @@ export {
 } from './DaemonPaths';
 export { resolveDaemonPathsFromProcess } from './DaemonPathsFromProcess';
 export { reclaimStaleDaemonAsync } from './DaemonReclaim';
-export type { IDaemonOrphanReap, IDaemonReclaimOptions } from './DaemonReclaimOptions';
+export type {
+  DaemonOperationGroupLeftRunningReason,
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonReclaimOptions
+} from './DaemonReclaimOptions';
 export { reapReusedOwnerOperationGroupsAsync } from './DaemonReusedOwnerReap';
 export { assertDaemonRuntimeDirIsPrivate, ensureDaemonRuntimeDir } from './DaemonRuntimeDir';
 export { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
diff --git a/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts b/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
index 0e35f7a19f..4a433389af 100644
--- a/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
+++ b/libraries/rush-daemon-transport/src/test/ListenerReclaimOptions.test.ts
@@ -9,7 +9,7 @@ import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import { DaemonFrameListener } from '../DaemonListener';
 import type { IDaemonPaths } from '../DaemonPaths';
 import * as daemonReclaim from '../DaemonReclaim';
-import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+import type { IDaemonOperationGroupLeftRunning, IDaemonOrphanReap } from '../DaemonReclaimOptions';
 
 import { createTestDaemonPaths } from './TestDaemonFixture';
 
@@ -27,7 +27,7 @@ function plantStaleSocket(paths: IDaemonPaths): void {
   fs.writeFileSync(paths.socketPath, STALE_SOCKET);
 }
 
-async function passesOnlyOnOrphansReapedAsync(): Promise<void> {
+async function passesOnlyTheReclaimCallbacksAsync(): Promise<void> {
   const paths: IDaemonPaths = createTestDaemonPaths();
   plantStaleSocket(paths);
   // The reclaim is stubbed: it only removes the stale socket, so that the second attempt to publish succeeds.
@@ -35,17 +35,19 @@ async function passesOnlyOnOrphansReapedAsync(): Promise<void> {
     .spyOn(daemonReclaim, 'reclaimStaleDaemonAsync')
     .mockImplementation(async (stalePaths: IDaemonPaths) => fs.unlinkSync(stalePaths.socketPath));
   const onOrphansReaped: (reap: IDaemonOrphanReap) => void = () => undefined;
+  const onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => void = () => undefined;
   const listener: DaemonFrameListener = await DaemonFrameListener.listenAsync(paths, {
     protocolVersion: DAEMON_PROTOCOL_VERSION,
     onConnection: () => undefined,
-    onOrphansReaped
+    onOrphansReaped,
+    onOperationGroupLeftRunning
   });
   await listener.closeAsync();
   // The reaper behind the reclaim also reads fields for tests from its options: nothing else may reach it.
-  expect(reclaim.mock.calls).toEqual([[paths, { onOrphansReaped }]]);
+  expect(reclaim.mock.calls).toEqual([[paths, { onOrphansReaped, onOperationGroupLeftRunning }]]);
 }
 
 posixIt(
-  'passes only onOrphansReaped from its options on to the reclaim of a stale socket',
-  passesOnlyOnOrphansReapedAsync
+  "passes only the reclaim's callbacks from its options on to the reclaim of a stale socket",
+  passesOnlyTheReclaimCallbacksAsync
 );
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts
new file mode 100644
index 0000000000..f64010d1ff
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningFixture.ts
@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOperationGroupLeftRunning } from '../DaemonReclaimOptions';
+
+import { OPERATION_GROUP, recordGroups, stat } from './OperationGroupFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+
+/** A live process with the PID {@link OPERATION_GROUP} that started later than the recorded leader. */
+export const REUSED_LEADER: IProcessStat = { ...stat(OPERATION_GROUP, OPERATION_GROUP), startTime: '999' };
+
+/** What a reap of one recorded group returned, signaled and reported as left running. */
+export interface ILeftRunningReap {
+  readonly fake: IFakeGroup;
+  readonly outcome: string;
+  readonly groups: readonly IDaemonOperationGroupLeftRunning[];
+}
+
+/**
+ * Reaps the dead daemon's record of {@link OPERATION_GROUP}, or with `deadPidReused` its record of the group
+ * whose ID is its own PID, in a fake process table whose groups exit on SIGTERM. `options` override the
+ * table's, and the reap's `onOperationGroupLeftRunning` collects its reports.
+ */
+export async function reapLeftRunningAsync(
+  spec: IFakeGroupSpec,
+  options: IDaemonOrphanReaperOptions = {}
+): Promise<ILeftRunningReap> {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', ...spec });
+  const groups: IDaemonOperationGroupLeftRunning[] = [];
+  const onOperationGroupLeftRunning = (group: IDaemonOperationGroupLeftRunning): number => groups.push(group);
+  const lockfilePath: string = recordGroups([options.deadPidReused ? DEAD_PID : OPERATION_GROUP]);
+  const reapOptions: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    onOperationGroupLeftRunning,
+    ...options
+  };
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, reapOptions);
+  return { fake, outcome, groups };
+}
+
+/** The options of `fake`, with its `listLiveGroupMembers` replaced. */
+export function withGroupMembers(
+  fake: IFakeGroup,
+  listLiveGroupMembers: IDaemonProcessGroupOps['listLiveGroupMembers']
+): IDaemonOrphanReaperOptions {
+  return { ...fake.options, ops: { ...(fake.options.ops as IDaemonProcessGroupOps), listLiveGroupMembers } };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts
new file mode 100644
index 0000000000..d4b3aa8253
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningMessage.test.ts
@@ -0,0 +1,38 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { formatOperationGroupLeftRunning } from '../DaemonOperationGroupLeftRunningMessage';
+import type { DaemonOperationGroupLeftRunningReason } from '../DaemonReclaimOptions';
+
+const DAEMON_PID: number = 4242;
+const GROUP_ID: number = 5001;
+const PREFIX: string =
+  `left process group ${GROUP_ID} running, which the exited daemon (PID ${DAEMON_PID}) recorded for an ` +
+  'operation: ';
+// The lines that clients search the launcher log for (see rush-client-core's ReclaimedDaemonLog).
+const SEARCHED_LINE: RegExp = /rushd \(PID|rushd ready at|reset the daemon's files|left running/;
+
+const DESCRIPTIONS: [DaemonOperationGroupLeftRunningReason, string][] = [
+  [
+    'callerGroup',
+    'its ID is the PID or the process group ID of this process, or this process cannot read its own group'
+  ],
+  ['daemonPidInUse', "another process has that daemon's PID now"],
+  ['leaderChanged', `the process with PID ${GROUP_ID} now is not the leader that the daemon recorded`],
+  ['otherSession', 'its leader has exited, and a process of the group is in another session'],
+  [
+    'noMarker',
+    "its leader has exited, and no process of the group has that daemon's RUSHD_OPERATION_GROUPS value, " +
+      'which a daemon from a release before that variable does not set'
+  ]
+];
+
+it.each(DESCRIPTIONS)('describes %s in one line that no client searches for', (reason, description) => {
+  const line: string = formatOperationGroupLeftRunning({
+    daemonPid: DAEMON_PID,
+    processGroupId: GROUP_ID,
+    reason
+  });
+  expect(line).toBe(`${PREFIX}${description}`);
+  expect(line).not.toMatch(SEARCHED_LINE);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts
new file mode 100644
index 0000000000..dc24ae0095
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningOrder.test.ts
@@ -0,0 +1,51 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOperationGroupLeftRunning } from '../DaemonReclaimOptions';
+
+import {
+  OPERATION_GROUP,
+  OTHER_OPERATION_GROUP,
+  operationTree,
+  recordGroups,
+  recordsRemain,
+  stat
+} from './OperationGroupFixture';
+import { reapLeftRunningAsync, withGroupMembers } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+// A later process that has the PID of the recorded leader of OTHER_OPERATION_GROUP.
+const OTHER_LEADER: IProcessStat = {
+  ...stat(OTHER_OPERATION_GROUP, OTHER_OPERATION_GROUP),
+  startTime: '999'
+};
+
+it('reads no group again that has no process', async () => {
+  const listLiveGroupMembers: jest.Mock = jest.fn(() => []);
+  const fake: IFakeGroup = createFakeGroup({ processes: [] });
+  const { groups } = await reapLeftRunningAsync(
+    { processes: [] },
+    withGroupMembers(fake, listLiveGroupMembers)
+  );
+  expect(groups).toEqual([]);
+  expect(listLiveGroupMembers).not.toHaveBeenCalled();
+});
+
+it('reports nothing, and keeps the records, when a group that it proved survives SIGKILL', async () => {
+  // Without `exitsOn`, no process of the table ever exits.
+  const fake: IFakeGroup = createFakeGroup({ processes: [...operationTree(OPERATION_GROUP), OTHER_LEADER] });
+  const groups: IDaemonOperationGroupLeftRunning[] = [];
+  const onOperationGroupLeftRunning = (group: IDaemonOperationGroupLeftRunning): number => groups.push(group);
+  const lockfilePath: string = recordGroups([OPERATION_GROUP, OTHER_OPERATION_GROUP]);
+  const reap: Promise<string> = reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, {
+    ...fake.options,
+    onOperationGroupLeftRunning
+  });
+  await expect(reap).rejects.toThrow(/survived SIGKILL/);
+  expect(fake.targets.every((groupId: number) => groupId === OPERATION_GROUP)).toBe(true);
+  expect(groups).toEqual([]);
+  expect(recordsRemain(lockfilePath)).toBe(true);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts
new file mode 100644
index 0000000000..9802e2c0d3
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningProcess.test.ts
@@ -0,0 +1,71 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import type { Readable } from 'node:stream';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOperationGroupLeftRunning } from '../DaemonReclaimOptions';
+
+import { RECORDED_START } from './OperationGroupFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import { identifyStarted, isAlive, isGone, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// A detached shell leads a new session and group, starts a member in them, prints its pid and exits, which
+// leaves the group without its leader. Nothing in the group has RUSHD_OPERATION_GROUPS, as in an operation of
+// a daemon from a release before that variable.
+const LEADERLESS_SCRIPT: string = 'sleep 600 </dev/null >/dev/null 2>&1 & echo $!';
+const GRACE_MS: number = 500;
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function startUnmarkedLeaderlessGroupAsync(): Promise<number> {
+  const shell: ChildProcess = spawn('/bin/sh', ['-c', LEADERLESS_SCRIPT], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'ignore'],
+    env: { PATH: process.env.PATH }
+  });
+  const exited: Promise<unknown[]> = once(shell, 'exit');
+  const [chunk] = (await once(shell.stdout as Readable, 'data')) as [Buffer];
+  started = identifyStarted([Number(chunk.toString().trim())]);
+  await exited;
+  const groupId: number = Number(shell.pid);
+  expect(await waitUntilAsync(() => isGone(groupId))).toBe(true);
+  return groupId;
+}
+
+linuxIt(
+  'reports a real leaderless group without the marker once, as noMarker, and signals nothing',
+  async () => {
+    const { lockfilePath } = createTestDaemonPaths();
+    const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+    const groupId: number = await startUnmarkedLeaderlessGroupAsync();
+    fs.mkdirSync(folder, { recursive: true });
+    writeOperationGroupRecord(folder, { groupId, startTime: RECORDED_START });
+    const groups: IDaemonOperationGroupLeftRunning[] = [];
+    const signalGroup: jest.Mock = jest.fn();
+    const options: IDaemonOrphanReaperOptions = {
+      ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, signalGroup, log: () => undefined },
+      graceMs: GRACE_MS,
+      onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) => groups.push(group)
+    };
+    await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+    expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: groupId, reason: 'noMarker' }]);
+    expect(signalGroup).not.toHaveBeenCalled();
+    expect(fs.existsSync(folder)).toBe(false);
+    expect(started.map(({ pid }) => isAlive(pid))).toEqual([true]);
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts
new file mode 100644
index 0000000000..69db10bdcc
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReads.test.ts
@@ -0,0 +1,56 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_CHILD, OPERATION_GROUP, operationTree } from './OperationGroupFixture';
+import { reapLeftRunningAsync } from './OperationGroupLeftRunningFixture';
+import type { ILeftRunningReap } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+
+const ONCE: number = 1;
+const TWICE: number = 2;
+// A group whose leader has exited, and whose only member lacks the dead daemon's marker.
+const UNMARKED_LEADERLESS: IFakeGroupSpec = {
+  processes: operationTree(OPERATION_GROUP, false),
+  markers: new Map([[OPERATION_CHILD, undefined]])
+};
+
+interface ICountedReads {
+  readonly options: IDaemonOrphanReaperOptions;
+  readonly readProcessStat: jest.Mock;
+  readonly listLiveGroupMembers: jest.Mock;
+}
+
+// A fake table of UNMARKED_LEADERLESS whose reads are counted, with mayHaveMembers replaced.
+function countReads(mayHaveMembers: IDaemonProcessGroupOps['mayHaveMembers']): ICountedReads {
+  const fake: IFakeGroup = createFakeGroup({ exitsOn: 'SIGTERM', ...UNMARKED_LEADERLESS });
+  const ops: IDaemonProcessGroupOps = fake.options.ops as IDaemonProcessGroupOps;
+  const readProcessStat: jest.Mock = jest.fn(ops.readProcessStat);
+  const listLiveGroupMembers: jest.Mock = jest.fn(ops.listLiveGroupMembers);
+  const counted: IDaemonProcessGroupOps = { ...ops, readProcessStat, listLiveGroupMembers, mayHaveMembers };
+  return { options: { ...fake.options, ops: counted }, readProcessStat, listLiveGroupMembers };
+}
+
+it('judges a leaderless group on what the proof read, and reads it only once', async () => {
+  const counted: ICountedReads = countReads(() => true);
+  const { outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    UNMARKED_LEADERLESS,
+    counted.options
+  );
+  expect(outcome).toBe('none');
+  expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: OPERATION_GROUP, reason: 'noMarker' }]);
+  expect(counted.readProcessStat).toHaveBeenCalledTimes(ONCE);
+  expect(counted.listLiveGroupMembers).toHaveBeenCalledTimes(ONCE);
+});
+
+it('reports no group whose processes have all been reaped since the proof read it', async () => {
+  const mayHaveMembers: jest.Mock = jest.fn().mockReturnValueOnce(true).mockReturnValue(false);
+  const counted: ICountedReads = countReads(mayHaveMembers);
+  const { groups }: ILeftRunningReap = await reapLeftRunningAsync(UNMARKED_LEADERLESS, counted.options);
+  expect(groups).toEqual([]);
+  expect(mayHaveMembers).toHaveBeenCalledTimes(TWICE);
+  expect(counted.listLiveGroupMembers).toHaveBeenCalledTimes(ONCE);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts
new file mode 100644
index 0000000000..be7ee83542
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReason.test.ts
@@ -0,0 +1,74 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { DaemonOperationGroupLeftRunningReason } from '../DaemonReclaimOptions';
+
+import { OPERATION_CHILD, OPERATION_GROUP, operationTree, stat } from './OperationGroupFixture';
+import { REUSED_LEADER, reapLeftRunningAsync } from './OperationGroupLeftRunningFixture';
+import type { ILeftRunningReap } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+import type { IFakeGroupSpec } from './OrphanReaperFixture';
+
+const SHELL_SESSION: number = 3000;
+const UNMARKED: ReadonlyMap<number, string | undefined> = new Map([[OPERATION_CHILD, undefined]]);
+const OPERATION: IFakeGroupSpec = { processes: operationTree(OPERATION_GROUP) };
+
+it.each<[string, IFakeGroupSpec, DaemonOperationGroupLeftRunningReason]>([
+  ['a leader with another start time', { processes: [REUSED_LEADER] }, 'leaderChanged'],
+  [
+    'a leader in another session',
+    { processes: [stat(OPERATION_GROUP, OPERATION_GROUP, SHELL_SESSION)] },
+    'leaderChanged'
+  ],
+  [
+    'a leaderless group with a member in another session',
+    { processes: [stat(OPERATION_CHILD, OPERATION_GROUP, SHELL_SESSION)] },
+    'otherSession'
+  ],
+  [
+    "a leaderless group without the daemon's marker",
+    { processes: operationTree(OPERATION_GROUP, false), markers: UNMARKED },
+    'noMarker'
+  ],
+  ["the caller's own group", { ...OPERATION, ownGroupId: OPERATION_GROUP }, 'callerGroup'],
+  ['a caller that cannot read its own group', { ...OPERATION, unknownOwnGroup: true }, 'callerGroup'],
+  ["a live process with the daemon's PID", { ...OPERATION, daemonAlive: true }, 'daemonPidInUse']
+])('reports %s as left running, and signals nothing', async (title, spec, reason) => {
+  const { fake, outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(spec);
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: OPERATION_GROUP, reason }]);
+});
+
+it.each<[string, IFakeGroupSpec, DaemonOperationGroupLeftRunningReason]>([
+  [
+    "the caller's own group, while a live process has the daemon's PID",
+    { ...OPERATION, ownGroupId: OPERATION_GROUP, daemonAlive: true },
+    'callerGroup'
+  ],
+  [
+    "a leader with another start time, while a live process has the daemon's PID",
+    { processes: [REUSED_LEADER], daemonAlive: true },
+    'daemonPidInUse'
+  ],
+  [
+    "a leaderless group with a member in another session and without the daemon's marker",
+    { processes: [stat(OPERATION_CHILD, OPERATION_GROUP, SHELL_SESSION)], markers: UNMARKED },
+    'otherSession'
+  ]
+])(
+  'reports %s by the first condition that it fails, in the order of the proof',
+  async (title, spec, reason) => {
+    const { groups }: ILeftRunningReap = await reapLeftRunningAsync(spec);
+    expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: OPERATION_GROUP, reason }]);
+  }
+);
+
+it("reports the group of the daemon's reused PID, which that PID's new process may lead", async () => {
+  const { fake, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    { processes: operationTree(DEAD_PID) },
+    { deadPidReused: true }
+  );
+  expect(fake.signals).toEqual([]);
+  expect(groups).toEqual([{ daemonPid: DEAD_PID, processGroupId: DEAD_PID, reason: 'daemonPidInUse' }]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts
new file mode 100644
index 0000000000..fd460e472d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupLeftRunningReport.test.ts
@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { OPERATION_CHILD, OPERATION_GROUP, operationTree, recordGroups, stat } from './OperationGroupFixture';
+import { REUSED_LEADER, reapLeftRunningAsync, withGroupMembers } from './OperationGroupLeftRunningFixture';
+import type { ILeftRunningReap } from './OperationGroupLeftRunningFixture';
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup } from './OrphanReaperFixture';
+
+const ONCE: number = 1;
+
+it.each<[string, readonly IProcessStat[]]>([
+  ['whose only members have exited', [{ ...stat(OPERATION_CHILD, OPERATION_GROUP), exited: true }]],
+  ['that has no process at all', []]
+])('reports no group %s', async (title, processes) => {
+  const { fake, outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync({ processes });
+  expect(outcome).toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(groups).toEqual([]);
+});
+
+it('reports a group that it stopped only to onOrphansReaped', async () => {
+  const onOrphansReaped: jest.Mock = jest.fn();
+  const { outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    { processes: operationTree(OPERATION_GROUP) },
+    { onOrphansReaped }
+  );
+  expect(outcome).toBe('terminated');
+  expect(onOrphansReaped).toHaveBeenCalledTimes(ONCE);
+  expect(groups).toEqual([]);
+});
+
+it('reads no group again without onOperationGroupLeftRunning', async () => {
+  const fake: IFakeGroup = createFakeGroup({ processes: [REUSED_LEADER] });
+  const listLiveGroupMembers: jest.Mock = jest.fn(() => []);
+  const options: IDaemonOrphanReaperOptions = withGroupMembers(fake, listLiveGroupMembers);
+  const lockfilePath: string = recordGroups([OPERATION_GROUP]);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options)).resolves.toBe('none');
+  expect(fake.signals).toEqual([]);
+  expect(listLiveGroupMembers).not.toHaveBeenCalled();
+});
+
+it('loses only the report of a group that it cannot read again', async () => {
+  const fake: IFakeGroup = createFakeGroup({ processes: [REUSED_LEADER] });
+  const failingRead: jest.Mock = jest.fn(() => {
+    throw new Error('EACCES');
+  });
+  const { outcome, groups }: ILeftRunningReap = await reapLeftRunningAsync(
+    { processes: [REUSED_LEADER] },
+    withGroupMembers(fake, failingRead)
+  );
+  expect(outcome).toBe('none');
+  expect(failingRead).toHaveBeenCalledTimes(ONCE);
+  expect(groups).toEqual([]);
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index b91aafa4e3..cfa95e0d45 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -36,7 +36,11 @@ finds the process idle, and after some requests it never does.
 A daemon that exits without releasing its endpoint, for example after SIGKILL, can leave operations running.
 On POSIX, a host that reclaims such an endpoint at startup first stops them, so that they cannot overwrite the
 outputs of its own requests. The daemon log (`onLog`) gets one line for each set of process groups that it
-stopped; without `onLog`, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+stopped; without `onLog`, each set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning. A process
+group that the exited daemon recorded for an operation, but that the host cannot prove still runs that
+operation, gets no signal; while it has a live process, the daemon log gets a line that names it and says which
+check it failed, for example `rushd: left process group 4242 running, which the exited daemon (PID 4000)
+recorded for an operation: the process with PID 4242 now is not the leader that the daemon recorded`.
 
 Whatever starts a shutdown (a signal, a management client, the idle timeout, a lost socket, a restart or
 `closeAsync()`), the host writes one line to `onLog` when it begins, with its process ID and the reason, for example
diff --git a/libraries/rush-daemon/src/DaemonOrphanReapLog.ts b/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
index df25c29a8b..703df6e936 100644
--- a/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
+++ b/libraries/rush-daemon/src/DaemonOrphanReapLog.ts
@@ -1,7 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonOrphanReap, IDaemonReclaimOptions } from '@rushstack/rush-daemon-transport';
+import { formatOperationGroupLeftRunning } from '@rushstack/rush-daemon-transport';
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
 
 /** Lists process groups as `process group A` or `process groups A, B and C`; the log names every group. */
 function formatProcessGroups(groupIds: readonly number[]): string {
@@ -23,14 +28,28 @@ export function formatOrphanReapLogLine(reap: IDaemonOrphanReap): string {
     : `rushd: stopped ${operations}`;
 }
 
+/**
+ * Returns the daemon log line for a process group that an exited daemon recorded for an operation, and that
+ * this daemon left running when it reclaimed the workspace's endpoint, because it could not prove that the
+ * group still ran that operation. Whoever later finds the group's processes can find out why here.
+ */
+export function formatOperationGroupLeftRunningLogLine(group: IDaemonOperationGroupLeftRunning): string {
+  return `rushd: ${formatOperationGroupLeftRunning(group)}`;
+}
+
 /**
  * Returns the reclaim options that write each set of stopped process groups to `onLog` as
- * {@link formatOrphanReapLogLine}'s line. Without `onLog`, the transport reports each set as a
- * `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+ * {@link formatOrphanReapLogLine}'s line, and each recorded operation group that the reclaim left running as
+ * {@link formatOperationGroupLeftRunningLogLine}'s. Without `onLog`, the transport reports each set of
+ * stopped groups as a `RUSH_DAEMON_ORPHANS_REAPED` process warning, and no group that it left running.
  */
 export function getOrphanReapLogOptions(
   onLog: ((message: string) => void) | undefined
 ): IDaemonReclaimOptions {
   if (!onLog) return {};
-  return { onOrphansReaped: (reap: IDaemonOrphanReap) => onLog(formatOrphanReapLogLine(reap)) };
+  return {
+    onOrphansReaped: (reap: IDaemonOrphanReap) => onLog(formatOrphanReapLogLine(reap)),
+    onOperationGroupLeftRunning: (group: IDaemonOperationGroupLeftRunning) =>
+      onLog(formatOperationGroupLeftRunningLogLine(group))
+  };
 }
diff --git a/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts b/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
index 3639114445..8fa016b1e1 100644
--- a/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonOrphanReapLog.test.ts
@@ -18,9 +18,18 @@ import {
   resolveDaemonPathsFromProcess,
   writeDaemonLockfile
 } from '@rushstack/rush-daemon-transport';
-import type { IDaemonOrphanReap, IDaemonPaths } from '@rushstack/rush-daemon-transport';
+import type {
+  IDaemonOperationGroupLeftRunning,
+  IDaemonOrphanReap,
+  IDaemonPaths,
+  IDaemonReclaimOptions
+} from '@rushstack/rush-daemon-transport';
 
-import { formatOrphanReapLogLine, getOrphanReapLogOptions } from '../DaemonOrphanReapLog';
+import {
+  formatOperationGroupLeftRunningLogLine,
+  formatOrphanReapLogLine,
+  getOrphanReapLogOptions
+} from '../DaemonOrphanReapLog';
 import { RushDaemonHost } from '../RushDaemonHost';
 import { TestWorkspaceSession } from './TestWorkspaceSession';
 
@@ -37,6 +46,16 @@ const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
 const FAKE_DAEMON_SCRIPT: string =
   "const c=require('node:child_process').spawn(process.execPath,['-e','setTimeout(()=>{},60000)'],{stdio:'ignore'});" +
   "process.stdout.write(String(c.pid)+'\\n');setInterval(()=>{},1000);";
+// A detached operation leads its own process group and session. It exits by itself after a minute.
+const DETACHED_OPERATION_SCRIPT: string = 'setTimeout(()=>{},60000)';
+// No process of a test starts one clock tick after boot, so a record with this start time names no leader.
+const OTHER_START_TIME: string = '1';
+const LEFT_RUNNING_PREFIX: string = 'rushd: left process group ';
+const GROUP_LEFT_RUNNING: IDaemonOperationGroupLeftRunning = {
+  daemonPid: DEAD_PID,
+  processGroupId: 5001,
+  reason: 'otherSession'
+};
 
 describe(formatOrphanReapLogLine.name, () => {
   it('names the exited daemon and its process group', () => {
@@ -61,6 +80,15 @@ describe(formatOrphanReapLogLine.name, () => {
   });
 });
 
+describe(formatOperationGroupLeftRunningLogLine.name, () => {
+  it('names the group, the exited daemon and the reason that the reclaim left the group running', () => {
+    expect(formatOperationGroupLeftRunningLogLine(GROUP_LEFT_RUNNING)).toBe(
+      'rushd: left process group 5001 running, which the exited daemon (PID 4242) recorded for an ' +
+        'operation: its leader has exited, and a process of the group is in another session'
+    );
+  });
+});
+
 describe(getOrphanReapLogOptions.name, () => {
   it('keeps the process warning without onLog', () => {
     expect(getOrphanReapLogOptions(undefined)).toEqual({});
@@ -72,6 +100,15 @@ describe(getOrphanReapLogOptions.name, () => {
     getOrphanReapLogOptions((message: string) => messages.push(message)).onOrphansReaped?.(reap);
     expect(messages).toEqual([formatOrphanReapLogLine(reap)]);
   });
+
+  it('writes each operation group that the reclaim left running to onLog', () => {
+    const messages: string[] = [];
+    const options: IDaemonReclaimOptions = getOrphanReapLogOptions((message: string) =>
+      messages.push(message)
+    );
+    options.onOperationGroupLeftRunning?.(GROUP_LEFT_RUNNING);
+    expect(messages).toEqual([formatOperationGroupLeftRunningLogLine(GROUP_LEFT_RUNNING)]);
+  });
 });
 
 interface ICrashedDaemon {
@@ -102,6 +139,19 @@ async function crashFakeDaemonAsync(paths: IDaemonPaths): Promise<ICrashedDaemon
   return { daemonPid, orphanPid: Number(chunk.toString().trim()) };
 }
 
+/** Records a group for the daemon `daemonPid`, as that daemon does when it starts a detached operation. */
+function recordOperationGroup(
+  paths: IDaemonPaths,
+  daemonPid: number,
+  groupId: number,
+  startTime: string
+): string {
+  const folder: string = `${paths.lockfilePath}.groups-${daemonPid}`;
+  fs.mkdirSync(folder, { mode: 0o700 });
+  fs.writeFileSync(path.join(folder, `${groupId}-${startTime}`), '', { mode: 0o600 });
+  return folder;
+}
+
 async function waitUntilDeadAsync(pid: number): Promise<boolean> {
   for (let attempt: number = 0; attempt < POLL_ATTEMPTS && isDaemonProcessAlive(pid); attempt++) {
     await delayAsync(POLL_INTERVAL_MS);
@@ -155,4 +205,44 @@ describe('startup reclaim', () => {
     },
     REAP_TEST_TIMEOUT_MS
   );
+
+  linuxIt(
+    'writes a recorded operation group that it cannot prove to the daemon log, and leaves it running',
+    async () => {
+      const paths: IDaemonPaths = resolveDaemonPathsFromProcess(
+        computeDaemonWorkspaceKey({
+          canonicalRepoRoot: fs.realpathSync.native(repoRoot),
+          rushVersion: RUSH_VERSION
+        })
+      );
+      const operation: ChildProcess = spawn(process.execPath, ['-e', DETACHED_OPERATION_SCRIPT], {
+        detached: true,
+        stdio: 'ignore'
+      });
+      const groupId: number = Number(operation.pid);
+      try {
+        const { daemonPid } = await crashFakeDaemonAsync(paths);
+        const folder: string = recordOperationGroup(paths, daemonPid, groupId, OTHER_START_TIME);
+        const messages: string[] = [];
+        const host: RushDaemonHost = await RushDaemonHost.startAsync({
+          createWorkspaceSessionAsync: () => Promise.resolve(new TestWorkspaceSession(repoRoot)),
+          daemonVersion: 'orphan-log-test',
+          repoRoot,
+          rushVersion: RUSH_VERSION,
+          onLog: (message: string) => messages.push(message)
+        });
+        await host.closeAsync();
+        expect(messages.filter((message: string) => message.startsWith(LEFT_RUNNING_PREFIX))).toEqual([
+          `${LEFT_RUNNING_PREFIX}${groupId} running, which the exited daemon (PID ${daemonPid}) recorded ` +
+            `for an operation: the process with PID ${groupId} now is not the leader that the daemon recorded`
+        ]);
+        expect(isDaemonProcessAlive(groupId)).toBe(true);
+        expect(fs.existsSync(folder)).toBe(false);
+      } finally {
+        // The operation is this test's own child, which has not been waited for, so its PID is still its own.
+        operation.kill('SIGKILL');
+      }
+    },
+    REAP_TEST_TIMEOUT_MS
+  );
 });

From efb546253ccc2f778a66cb6a44881c0e8700129a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:22 +0000
Subject: [PATCH 216/265] [rush-daemon] Keep the daemon after a served install
 or update that fails before it changes the installation

Swarm integration step 201; original commit 9df2179034 (merge of swarm/r02-t208 at ead3750652).
Scope: task 208.

Brings 208 (branch swarm/r02-t208). Second agent: t03 board 6959, board 6961. Evidence: ch01's GATE OK board 7438.

Batch E2g, item 3 of 7. Gate: ch01 GATE OK board 7438 (tree a3f30dea9d)

Commits folded into this step (1):
- ead3750652 [rush-daemon] Keep the daemon after a served install or update that fails before it changes the installation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   8 +-
 ...utation-keeps-daemon_2026-09-29-19-25.json |  11 +
 ...utation-keeps-daemon_2026-09-29-19-25.json |  11 +
 libraries/rush-daemon/README.md               |  18 +-
 .../src/NativeMutationInstallationState.ts    |  97 ++++
 .../rush-daemon/src/NativeMutationRequest.ts  |   4 +-
 .../src/WorkspaceRequestLifecycle.ts          |  86 +++-
 .../src/test/FailedNativeMutation.test.ts     | 416 ++++++++++++++++++
 .../NativeMutationInstallationState.test.ts   | 164 +++++++
 9 files changed, 805 insertions(+), 10 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/failed-mutation-keeps-daemon_2026-09-29-19-25.json
 create mode 100644 common/changes/@rushstack/rush-daemon/failed-mutation-keeps-daemon_2026-09-29-19-25.json
 create mode 100644 libraries/rush-daemon/src/NativeMutationInstallationState.ts
 create mode 100644 libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 92700d0211..2567064e06 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -369,9 +369,11 @@ because <cause>.` The line goes to the stderr that the script writes to, which i
 pipe, because a `rushx-client` with a terminal runs the script in-process. Its first line
 comes once `rushx-client` itself has started and sent the request, which takes about half a
 second on a busy machine. A native `install` or `update` restarts the daemon once it ends,
-which would end the `rushx` scripts that the daemon runs, so it first waits for them and
-says so the same way: `rush-client: waiting for 1 running rushx script to finish, since
-this command restarts the daemon (PID <pid>), which would end it.` A terminal
+unless it fails before it changes the installation (for example on the Rush lock), and
+that restart would end the `rushx` scripts that the daemon runs. The daemon can't tell
+beforehand whether the command will fail, so it first waits for them and says so the
+same way: `rush-client: waiting for 1 running rushx script to finish, since this command
+restarts the daemon (PID <pid>), which would end it.` A terminal
 gets a line whenever the wait changes, and a pipe when the wait begins or its cause
 changes. Both get the line again with the time waited (`still waiting after 25s for
 …`) whenever 25 seconds pass without one, until the command follows the restart,
diff --git a/common/changes/@rushstack/rush-cli-client/failed-mutation-keeps-daemon_2026-09-29-19-25.json b/common/changes/@rushstack/rush-cli-client/failed-mutation-keeps-daemon_2026-09-29-19-25.json
new file mode 100644
index 0000000000..2ea695a81f
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/failed-mutation-keeps-daemon_2026-09-29-19-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document that a served `install` or `update` that fails before it changes the installation keeps the daemon running.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/failed-mutation-keeps-daemon_2026-09-29-19-25.json b/common/changes/@rushstack/rush-daemon/failed-mutation-keeps-daemon_2026-09-29-19-25.json
new file mode 100644
index 0000000000..aae10233d8
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/failed-mutation-keeps-daemon_2026-09-29-19-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep the daemon running, instead of restarting it, after a served `rush install` or `rush update` that fails before it changes the installation, for example on the Rush lock, on common/scripts or on its arguments. Once the worker's processes have joined, the daemon compares each subspace's last-install.flag by file identity, the hotlink state, a fresh input capture and its own installation, and it reloads the workspace for the next request.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index cfa95e0d45..58db030a6b 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -321,9 +321,21 @@ may have changed files: its exact result is drained before old generation cleanu
 Post-mutation state selects the successor. If the result cannot be drained or the selected version cannot be
 launched, the host stops without silently starting an incorrect successor. A mutation that started is never
 replayed, even after failure; an unstarted request can retry only through the typed pre-execution contract above.
-An ordinary nonzero mutation result still permits restart once its resources have joined. A failed worker
-join is different: its failure result drains, but the sticky workspace ownership barrier forbids both the
-host's successor and a competing client's auto-start, even after the result connection closes.
+A mutation that exits nonzero before it changed the installation keeps the daemon instead, for example one that
+fails on the Rush lock, on `common/scripts` or on its arguments. It keeps it only if every subspace's
+`last-install.flag` existed when the worker started and has the same file identity (device, inode, size and times)
+when it ends, since Rush deletes that flag before it changes the subspace and a reinstall writes the same content
+again; if the hotlink state records no link, since Rush unlinks those packages before it deletes the flag; if a
+fresh input capture, which compares the installation files as a build does, would not restart the daemon; and if the
+daemon's own installation did not change. It decides only once the worker's processes have joined, and it checks the
+flags, the hotlink state and its own installation again then, since a process that the worker started can still
+change them after the worker exits; a mutation whose worker could not be joined never keeps the daemon. The kept
+daemon selects no successor, even when the result could not be drained, and logs `rushd: "rush install" failed (exit
+code 1) before it changed the installation, so this daemon keeps running and reloads the workspace for the next
+request`. The mutation quiesced the warm set, so the next request that needs the graph reloads it, as after a reload
+that found the Rush lock busy. Any other nonzero mutation result still permits restart once its resources have
+joined. A failed worker join is different: its failure result drains, but the sticky workspace ownership barrier
+forbids both the host's successor and a competing client's auto-start, even after the result connection closes.
 
 The opt-in CLI forwards positively identified built-in `install` and `update` only to peers supporting protocol
 0.10. Other administrative commands remain native; Rushx script names are not reinterpreted as Rush built-ins.
diff --git a/libraries/rush-daemon/src/NativeMutationInstallationState.ts b/libraries/rush-daemon/src/NativeMutationInstallationState.ts
new file mode 100644
index 0000000000..ee48341a06
--- /dev/null
+++ b/libraries/rush-daemon/src/NativeMutationInstallationState.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { BigIntStats } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
+import * as path from 'node:path';
+
+import { RushConstants, type RushConfiguration } from '@microsoft/rush-lib';
+import { FileSystem } from '@rushstack/node-core-library';
+
+/**
+ * What the files that show whether a native `install` or `update` changed the installation contained at one time.
+ */
+export interface INativeMutationInstallationState {
+  /** The identity of each subspace's `last-install.flag`, by path, or `undefined` for a flag that doesn't exist. */
+  readonly flags: ReadonlyMap<string, string | undefined>;
+  /** Whether the hotlink state records a link. A state that can't be parsed counts as one. */
+  readonly hasHotlinks: boolean;
+}
+
+/**
+ * Reads the files. Returns `undefined`, which never counts as unchanged, if one exists but can't be read.
+ */
+export async function captureNativeMutationInstallationStateAsync(
+  rushConfiguration: RushConfiguration
+): Promise<INativeMutationInstallationState | undefined> {
+  try {
+    // The same flags as the installation files of the workspace input fingerprint.
+    const flagPaths: string[] = rushConfiguration.subspaces.map((subspace) =>
+      path.join(subspace.getSubspaceTempFolderPath(), 'last-install.flag')
+    );
+    const identities: (string | undefined)[] = await Promise.all(flagPaths.map(getFileIdentityAsync));
+    return {
+      flags: new Map(flagPaths.map((flagPath: string, index: number) => [flagPath, identities[index]])),
+      hasHotlinks: await hasHotlinksAsync(
+        path.join(rushConfiguration.commonTempFolder, RushConstants.rushHotlinkStateFilename)
+      )
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Whether a native `install` or `update` that ran between the two captures left the installation as it was.
+ *
+ * @remarks
+ * Rush deletes a subspace's `last-install.flag` before it changes that subspace's `node_modules`, and writes it
+ * again once the subspace is installed, before the `afterInstall` hooks run. The flag doesn't record when it was
+ * written, so a reinstall can write the same content again. Each flag is therefore compared by its file identity
+ * (device, inode, size and times), not by its content, and a flag that was missing beforehand proves nothing. Rush
+ * also deletes the virtual store folders of hotlinked packages before it deletes the flag, and it rewrites the hotlink
+ * state only after them, so a workspace with a hotlink never counts as unchanged.
+ */
+export function isInstallationUnchangedByMutation(
+  before: INativeMutationInstallationState,
+  after: INativeMutationInstallationState
+): boolean {
+  if (before.hasHotlinks || after.hasHotlinks || before.flags.size !== after.flags.size) return false;
+  for (const [flagPath, identity] of before.flags) {
+    if (identity === undefined || after.flags.get(flagPath) !== identity) return false;
+  }
+  return true;
+}
+
+async function getFileIdentityAsync(filePath: string): Promise<string | undefined> {
+  let stats: BigIntStats;
+  try {
+    stats = await stat(filePath, { bigint: true });
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) return undefined;
+    throw error;
+  }
+  return [stats.dev, stats.ino, stats.size, stats.mtimeNs, stats.ctimeNs, stats.birthtimeNs].join(':');
+}
+
+async function hasHotlinksAsync(statePath: string): Promise<boolean> {
+  let text: string;
+  try {
+    text = await readFile(statePath, 'utf8');
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) return false;
+    throw error;
+  }
+  let state: { fileVersion?: unknown; linksBySubspace?: unknown } | undefined;
+  try {
+    state = JSON.parse(text);
+  } catch {
+    return true;
+  }
+  const links: unknown = state?.linksBySubspace;
+  // Rush reads file version 0 only.
+  if (state?.fileVersion !== 0 || typeof links !== 'object' || links === null) return true;
+  return Object.values(links).some(
+    (subspaceLinks: unknown) => !Array.isArray(subspaceLinks) || subspaceLinks.length > 0
+  );
+}
diff --git a/libraries/rush-daemon/src/NativeMutationRequest.ts b/libraries/rush-daemon/src/NativeMutationRequest.ts
index d22c58e74c..25310a30ff 100644
--- a/libraries/rush-daemon/src/NativeMutationRequest.ts
+++ b/libraries/rush-daemon/src/NativeMutationRequest.ts
@@ -13,7 +13,7 @@ import type { GlobalCommandExecutor } from './GlobalCommandRequestRouter';
 export function createNativeMutationResolver(
   envelope: IDaemonRequestEnvelope,
   rushVersion: string,
-  onCompletedAsync: (context: IGlobalCommandExecutionContext) => Promise<void>
+  onCompletedAsync: (context: IGlobalCommandExecutionContext, exitCode: number) => Promise<void>
 ): IDaemonRequestResolver {
   if (
     envelope.commandOrigin !== 'built-in' ||
@@ -38,7 +38,7 @@ export function createNativeMutationResolver(
         else resolve(code);
       });
     });
-    await onCompletedAsync(context);
+    await onCompletedAsync(context, exitCode);
     return { exitCode };
   };
   return {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 731c2375f4..9a3f7c6d7a 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -39,6 +39,11 @@ import {
 } from './DaemonRequestDispatcher';
 import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import { createNativeMutationResolver } from './NativeMutationRequest';
+import {
+  captureNativeMutationInstallationStateAsync,
+  isInstallationUnchangedByMutation,
+  type INativeMutationInstallationState
+} from './NativeMutationInstallationState';
 import { parseDaemonGraphRequest, type IDaemonGraphRequest } from './DaemonGraphRequest';
 import { isRushxInvocation, type IWorkspaceResolverLifecycle } from './WorkspaceResolverLifecycle';
 import {
@@ -1177,6 +1182,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   ): Promise<void> {
     let restart: IWorkspaceProcessRestartPlan | undefined;
     let installationChange: IDaemonInstallationChange | undefined;
+    // The exit code of a mutation that failed before it changed the installation, as far as the daemon can tell when the
+    // worker exits. The worker's processes are joined after that, so the daemon keeps running only if that still holds.
+    let keptExitCode: number | undefined;
+    const installationBefore: INativeMutationInstallationState | undefined =
+      await captureNativeMutationInstallationStateAsync(generation.session.rushConfiguration);
     const planWithoutSuccessor = (
       reason: IWorkspaceProcessRestartPlan['reason'],
       failure: Error | undefined
@@ -1206,7 +1216,14 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     const resolver: IDaemonRequestResolver = createNativeMutationResolver(
       envelope,
       generation.fingerprint.selectedRushVersion,
-      async (context) => {
+      async (context, exitCode: number) => {
+        if (
+          exitCode !== 0 &&
+          (await this.#mayKeepAfterFailedMutationAsync(generation, envelope, installationBefore))
+        ) {
+          keptExitCode = exitCode;
+          return;
+        }
         await prepareRestartAsync();
         if (installationChange)
           context.terminal.writeWarningLine(
@@ -1232,7 +1249,17 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         }
       });
     } finally {
-      if (state.began) {
+      if (
+        keptExitCode !== undefined &&
+        (await this.#isInstallationUnchangedAfterJoinAsync(generation, installationBefore))
+      ) {
+        // This daemon is now in the state that a reload which found the Rush lock busy leaves: quiescing the warm set
+        // required a reload, so the next request that needs the graph loads it again.
+        this.#options.onLog?.(
+          `rushd: "rush ${envelope.commandName}" failed (exit code ${keptExitCode}) before it changed the ` +
+            'installation, so this daemon keeps running and reloads the workspace for the next request'
+        );
+      } else if (state.began) {
         if (!restart) await prepareRestartAsync();
         if (!state.resultDrained) {
           restart = {
@@ -1257,6 +1284,61 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Whether a native mutation that failed may keep this daemon: when its worker exited, the installation was as it
+   * was before, and the workspace inputs don't require a new daemon process for any other reason.
+   */
+  async #mayKeepAfterFailedMutationAsync(
+    generation: IPreparedGeneration,
+    envelope: IDaemonRequestEnvelope,
+    installationBefore: INativeMutationInstallationState | undefined
+  ): Promise<boolean> {
+    try {
+      if (!(await this.#isInstallationUnchangedAsync(generation, installationBefore))) return false;
+      // Classified as for a build, which also compares the installation files, such as a lockfile that the mutation
+      // wrote: a daemon that the next build would restart for its inputs restarts now instead.
+      const fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(generation.session, envelope);
+      return (
+        this.#classify(fingerprint, false) !== WorkspaceInputChangeTier.Restart &&
+        !this.#detectInstallationChange()
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  /** Whether the installation is still as it was once the worker's processes were joined. */
+  async #isInstallationUnchangedAfterJoinAsync(
+    generation: IPreparedGeneration,
+    installationBefore: INativeMutationInstallationState | undefined
+  ): Promise<boolean> {
+    try {
+      // A worker whose processes could not be joined may still be changing the installation.
+      assertWorkspaceRequestResourcesHealthy(generation.session);
+      return await this.#isInstallationUnchangedAsync(generation, installationBefore);
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Whether the files that show a native `install` or `update` changed the installation are as they were before its
+   * worker started, and the daemon's own installation did not change.
+   */
+  async #isInstallationUnchangedAsync(
+    generation: IPreparedGeneration,
+    installationBefore: INativeMutationInstallationState | undefined
+  ): Promise<boolean> {
+    if (!installationBefore) return false;
+    const installationAfter: INativeMutationInstallationState | undefined =
+      await captureNativeMutationInstallationStateAsync(generation.session.rushConfiguration);
+    return (
+      installationAfter !== undefined &&
+      isInstallationUnchangedByMutation(installationBefore, installationAfter) &&
+      !this.#detectInstallationChange()
+    );
+  }
+
   /**
    * Returns the change when the daemon's installation was removed or replaced. Such a daemon cannot load the rest of
    * its code, so from the first detection on it admits no more requests; each request waits in the restart drain for
diff --git a/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts b/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
new file mode 100644
index 0000000000..89d054157f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
@@ -0,0 +1,416 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as childProcess from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setImmediate as setImmediateAsync, setTimeout as setTimeoutAsync } from 'node:timers/promises';
+
+import { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
+import type { LockFile } from '@rushstack/node-core-library';
+import {
+  DaemonFrameType,
+  decodeDaemonLogChunk,
+  type IDaemonCommandResult,
+  type IDaemonFrame,
+  type IDaemonInstallationChange
+} from '@rushstack/rush-daemon-protocol';
+import type { DaemonFrameListener } from '@rushstack/rush-daemon-transport';
+
+import { DaemonWireRequestClient } from '../DaemonWireRequestClient';
+import * as linuxProcessGroupExit from '../LinuxProcessGroupExit';
+import * as installationState from '../NativeMutationInstallationState';
+import { tryAcquireNativeLock } from '../NativeRepositoryLock';
+import type { GetWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
+import { WorkspaceRequestResourceCleanupError } from '../WorkspaceRequestResources';
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { captureTestDaemonListenerAsync } from './TestDaemonListener';
+import { removeTestFolderAsync } from './TestProcessExit';
+import { setDaemonPolicy } from './WarmGenerationTestUtilities';
+
+jest.setTimeout(60_000);
+
+const FLAG: string = 'common/temp/last-install.flag';
+const HOTLINK_STATE: string = 'common/temp/rush-hotlink-state.json';
+const NO_SUCCESSOR: string = 'No successor was expected.';
+const JOIN_FAILURE: string = 'The worker process group could not be joined.';
+/** So that a flag that is written again never has the times of the first one. */
+const OLD_TIME: Date = new Date('2000-01-01T00:00:00Z');
+/** How long a test waits for a restart that should have been requested, before it fails. */
+const RESTART_WAIT_MS: number = 10_000;
+
+function outputText(exchange: ITerminalExchange): string {
+  return exchange.frames
+    .filter(
+      (frame: IDaemonFrame) =>
+        frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr
+    )
+    .map((frame: IDaemonFrame) => Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString())
+    .join('');
+}
+
+function keptLine(commandName: string, exitCode: number): string {
+  return (
+    `rushd: "rush ${commandName}" failed (exit code ${exitCode}) before it changed the installation, so this ` +
+    'daemon keeps running and reloads the workspace for the next request'
+  );
+}
+
+function keptLines(logs: ReadonlyArray<string>): string[] {
+  return logs.filter((line: string) => line.includes('keeps running'));
+}
+
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await setImmediateAsync();
+  return settled;
+}
+
+interface IExpectRestartOptions {
+  /** How many daemon log lines came before the request, so that keep lines logged earlier are not counted. */
+  earlierLogCount?: number;
+  /**
+   * Whether the daemon decided to restart as the worker exited, so the command's output says why no successor
+   * starts. A decision that is made once the worker's processes were joined comes after the output.
+   */
+  explained?: boolean;
+}
+
+/** Returns how the restart ended, so that a daemon that was wrongly kept fails its test before the test times out. */
+async function getRestartOutcomeAsync(
+  restartCompleted: Promise<unknown>
+): Promise<{ error?: unknown } | 'none'> {
+  const timeout: AbortController = new AbortController();
+  try {
+    return await Promise.race([
+      restartCompleted.then(
+        () => ({}),
+        (error: unknown) => ({ error })
+      ),
+      setTimeoutAsync(RESTART_WAIT_MS, 'none' as const, { signal: timeout.signal })
+    ]);
+  } finally {
+    timeout.abort();
+  }
+}
+
+describe('a native install or update that fails', () => {
+  const current: { change?: IDaemonInstallationChange } = {};
+  let fixture: DaemonGraphTestFixture | undefined;
+  let listener: DaemonFrameListener | undefined;
+  let launcher: jest.MockedFunction<GetWorkspaceSuccessorLaunchAsync>;
+  let workerSpawns: number;
+  /** Called as the native mutation worker is spawned, after the request's last check before it runs. */
+  let onWorkerSpawn: () => void;
+
+  beforeEach(() => {
+    current.change = undefined;
+    fixture = undefined;
+    listener = undefined;
+    workerSpawns = 0;
+    onWorkerSpawn = () => undefined;
+    // A mutation requires a successor launcher. This one never starts a daemon, so a restart ends the host.
+    launcher = jest.fn<
+      ReturnType<GetWorkspaceSuccessorLaunchAsync>,
+      Parameters<GetWorkspaceSuccessorLaunchAsync>
+    >(() => Promise.reject(new Error(NO_SUCCESSOR)));
+    const nativeChildProcess: typeof childProcess = jest.requireActual('node:child_process');
+    const spawn: typeof childProcess.spawn = nativeChildProcess.spawn;
+    jest.spyOn(nativeChildProcess, 'spawn').mockImplementation(((
+      ...args: Parameters<typeof childProcess.spawn>
+    ) => {
+      if (args[1]?.some((arg: string) => arg.endsWith(`${path.sep}NativeMutationWorker.js`))) {
+        workerSpawns++;
+        onWorkerSpawn();
+      }
+      return spawn(...args);
+    }) as typeof childProcess.spawn);
+    // The host reports a restart without a successor as a warning.
+    jest.spyOn(process, 'emitWarning').mockImplementation(() => undefined);
+  });
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    if (!fixture) return;
+    try {
+      await fixture.host.closeAsync();
+    } catch (error) {
+      // A daemon whose worker could not be joined keeps its listener, which only the test may release.
+      if (!(error instanceof WorkspaceRequestResourceCleanupError)) throw error;
+      await listener?.closeAsync();
+    } finally {
+      await fixture.host.restartCompleted.catch(() => undefined);
+      await removeTestFolderAsync(fixture.folder, true);
+    }
+  });
+
+  /** Starts a daemon on a workspace that was installed, unless `configure` says otherwise, and loads its graph. */
+  async function startAsync(
+    configure?: (created: DaemonGraphTestFixture) => void
+  ): Promise<DaemonGraphTestFixture> {
+    const captured: { value: DaemonGraphTestFixture; listener: DaemonFrameListener } =
+      await captureTestDaemonListenerAsync(() =>
+        DaemonGraphTestFixture.createAsync((starting: DaemonGraphTestFixture) => {
+          setDaemonPolicy(starting, {});
+          starting.checkInstallation = () => current.change;
+          starting.getSuccessorLaunchAsync = launcher;
+          starting.write(FLAG, JSON.stringify({ node: process.versions.node, packageManager: 'npm' }));
+          fs.utimesSync(path.join(starting.folder, FLAG), OLD_TIME, OLD_TIME);
+          configure?.(starting);
+        })
+      );
+    const started: DaemonGraphTestFixture = captured.value;
+    fixture = started;
+    listener = captured.listener;
+    await started.buildSuccessfullyAsync();
+    return started;
+  }
+
+  function file(name: string): string {
+    return path.join(fixture!.folder, name);
+  }
+
+  function rewriteFlag(): void {
+    const content: Buffer = fs.readFileSync(file(FLAG));
+    fs.rmSync(file(FLAG));
+    fs.writeFileSync(file(FLAG), content);
+  }
+
+  async function expectKeptAsync(
+    exchange: ITerminalExchange,
+    commandName: string = 'install'
+  ): Promise<void> {
+    const started: DaemonGraphTestFixture = fixture!;
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult' });
+    const { exitCode } = exchange.terminal.payload as IDaemonCommandResult;
+    expect(exitCode).not.toBe(0);
+    expect(exchange.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(workerSpawns).toBe(1);
+    // The session is still current: a request that doesn't load the graph again is served on it. It is admitted only
+    // once the mutation's request has ended, so the daemon has decided by then.
+    expect((await started.graphAsync('status')).terminal).toMatchObject({
+      kind: 'requestResult',
+      payload: { exitCode: 0 }
+    });
+    expect(keptLines(started.logs)).toEqual([keptLine(commandName, exitCode)]);
+    await started.buildSuccessfullyAsync();
+    expect(started.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+    expect(launcher).not.toHaveBeenCalled();
+    expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
+    expect(await isSettledAsync(started.host.closed)).toBe(false);
+  }
+
+  async function expectRestartAsync(
+    exchange: ITerminalExchange,
+    { earlierLogCount = 0, explained = true }: IExpectRestartOptions = {}
+  ): Promise<void> {
+    const started: DaemonGraphTestFixture = fixture!;
+    expect(exchange.terminal).toMatchObject({ kind: 'requestResult' });
+    expect(exchange.terminal.payload).not.toHaveProperty('retryAfterRestart');
+    expect(workerSpawns).toBe(1);
+    const explanation: string = `Mutation completed, but successor startup is unavailable: ${NO_SUCCESSOR}`;
+    if (explained) expect(outputText(exchange)).toContain(explanation);
+    else expect(outputText(exchange)).not.toContain(explanation);
+    expect(await getRestartOutcomeAsync(started.host.restartCompleted)).toEqual({
+      error: expect.objectContaining({ message: NO_SUCCESSOR })
+    });
+    expect(launcher).toHaveBeenCalledTimes(1);
+    await started.host.closed;
+    expect(keptLines(started.logs.slice(earlierLogCount))).toEqual([]);
+  }
+
+  it('keeps the daemon when install fails on common/scripts, and restarts after an install that succeeds', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const exchange: ITerminalExchange = await started.runAsync(['install']);
+    expect(outputText(exchange)).toContain('common/scripts');
+    await expectKeptAsync(exchange);
+
+    // --help runs the real worker, which changes nothing and exits 0. An install that succeeds still restarts.
+    workerSpawns = 0;
+    const earlierLogCount: number = started.logs.length;
+    await expectRestartAsync(await started.runAsync(['install', '--help']), { earlierLogCount });
+  });
+
+  it('keeps the daemon when update fails, as install does', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    // An unknown parameter fails before update writes anything, even common/scripts.
+    await expectKeptAsync(await started.runAsync(['update', '--no-such-parameter']), 'update');
+  });
+
+  it('keeps the daemon for each of two failed installs, the second queued behind the first', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const exchanges: ITerminalExchange[] = await Promise.all([
+      started.runAsync(['install']),
+      started.runAsync(['install'])
+    ]);
+    for (const { terminal } of exchanges) {
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 1 } });
+      expect(terminal.payload).not.toHaveProperty('retryAfterRestart');
+    }
+    expect(workerSpawns).toBe(2);
+    await started.buildSuccessfullyAsync();
+    expect(keptLines(started.logs)).toEqual([keptLine('install', 1), keptLine('install', 1)]);
+    expect(started.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
+    expect(launcher).not.toHaveBeenCalled();
+    expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
+  });
+
+  it('keeps the daemon when install finds the Rush lock held', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const lock: LockFile | undefined = tryAcquireNativeLock(file('common/temp'));
+    expect(lock).toBeDefined();
+    let exchange: ITerminalExchange;
+    try {
+      exchange = await started.runAsync(['install']);
+    } finally {
+      lock?.release();
+    }
+    expect(outputText(exchange)).toContain('Another Rush command is already running in this repository.');
+    await expectKeptAsync(exchange);
+  });
+
+  it('restarts when the failed install wrote the flag again with the same content', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    onWorkerSpawn = rewriteFlag;
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts when the failed install deleted the flag', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    onWorkerSpawn = () => fs.rmSync(file(FLAG));
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts when the workspace has a hotlink, which an install deletes before the flag', async () => {
+    const started: DaemonGraphTestFixture = await startAsync((starting: DaemonGraphTestFixture) => {
+      starting.write(
+        HOTLINK_STATE,
+        JSON.stringify({
+          fileVersion: 0,
+          linksBySubspace: {
+            default: [{ linkedPackagePath: starting.folder, linkedPackageName: 'x', linkType: 'LinkPackage' }]
+          }
+        })
+      );
+    });
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('keeps the daemon when the hotlink state records no link', async () => {
+    const started: DaemonGraphTestFixture = await startAsync((starting: DaemonGraphTestFixture) => {
+      starting.write(HOTLINK_STATE, JSON.stringify({ fileVersion: 0, linksBySubspace: {} }));
+    });
+    await expectKeptAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts when the workspace had no flag before the install', async () => {
+    const started: DaemonGraphTestFixture = await startAsync((starting: DaemonGraphTestFixture) => {
+      fs.rmSync(path.join(starting.folder, FLAG));
+    });
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it('restarts after an install that succeeds', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    await expectRestartAsync(await started.runAsync(['install', '--help']));
+  });
+
+  it('restarts when a process-bound installation file changed during the failed install', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    onWorkerSpawn = () =>
+      fs.writeFileSync(
+        file('common/config/rush/npm-shrinkwrap.json'),
+        '{"lockfileVersion":3,"packages":{"x":{}}}'
+      );
+    await expectRestartAsync(await started.runAsync(['install']));
+  });
+
+  it("exits without a successor when the daemon's installation changed during the failed install", async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const folder: string = file('installation');
+    onWorkerSpawn = () => {
+      current.change ??= { change: 'replaced', folder };
+    };
+    const exchange: ITerminalExchange = await started.runAsync(['install']);
+    expect(workerSpawns).toBe(1);
+    expect(outputText(exchange)).toContain(
+      `The daemon's installation at ${folder} was replaced, so the daemon exits after this command without ` +
+        'starting a new one; the next command starts one.'
+    );
+    expect(launcher).not.toHaveBeenCalled();
+    await expect(started.host.restartCompleted).resolves.toBeUndefined();
+    expect(keptLines(started.logs)).toEqual([]);
+  });
+
+  it('keeps the daemon when the result of a failed install could not be delivered', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    // The result is lost, as it is when the client's connection fails while the worker runs.
+    jest
+      .spyOn(DaemonWireRequestClient.prototype, 'writeResultAsync')
+      .mockRejectedValueOnce(new Error('The connection to the client failed.'));
+    const { terminal } = await started.runAsync(['install']);
+    expect(terminal.kind).toBe('requestRejected');
+    expect(workerSpawns).toBe(1);
+    await started.buildSuccessfullyAsync();
+    expect(keptLines(started.logs)).toEqual([keptLine('install', 1)]);
+    expect(launcher).not.toHaveBeenCalled();
+    expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
+  });
+
+  it('restarts when the flag changed after the worker exited, before its processes were joined', async () => {
+    const started: DaemonGraphTestFixture = await startAsync();
+    const captureAsync: typeof installationState.captureNativeMutationInstallationStateAsync =
+      installationState.captureNativeMutationInstallationStateAsync;
+    let captures: number = 0;
+    jest
+      .spyOn(installationState, 'captureNativeMutationInstallationStateAsync')
+      .mockImplementation(async (...args: Parameters<typeof captureAsync>) => {
+        const state: installationState.INativeMutationInstallationState | undefined = await captureAsync(
+          ...args
+        );
+        // The first capture is before the worker starts and the second as it exits. A process that the worker started,
+        // which the daemon ends only after that, then writes the flag again with the same content, which the input
+        // fingerprint doesn't see.
+        if (++captures === 2) rewriteFlag();
+        return state;
+      });
+    await expectRestartAsync(await started.runAsync(['install']), { explained: false });
+    expect(captures).toBe(3);
+  });
+
+  (process.platform === 'linux' ? it : it.skip)(
+    'restarts when the processes of the failed install could not be joined',
+    async () => {
+      const started: DaemonGraphTestFixture = await startAsync();
+      const waitAsync: typeof linuxProcessGroupExit.waitForLinuxProcessGroupExitAsync =
+        linuxProcessGroupExit.waitForLinuxProcessGroupExitAsync;
+      let joins: number = 0;
+      jest
+        .spyOn(linuxProcessGroupExit, 'waitForLinuxProcessGroupExitAsync')
+        .mockImplementation(async (...args: Parameters<typeof waitAsync>) => {
+          // The group really exits, but the daemon can't tell, so the worker's processes may still be running.
+          await waitAsync(...args);
+          joins++;
+          throw new Error(JOIN_FAILURE);
+        });
+      const exchange: ITerminalExchange = await started.runAsync(['install']);
+      expect(exchange.terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { outcome: 'failure', errorMessage: expect.stringContaining(JOIN_FAILURE) }
+      });
+      expect(joins).toBe(1);
+      expect(workerSpawns).toBe(1);
+      // As after any mutation whose worker was not joined, the daemon keeps its ownership of the workspace.
+      expect(await getRestartOutcomeAsync(started.host.restartCompleted)).toEqual({
+        error: expect.any(WorkspaceRequestResourceCleanupError)
+      });
+      expect(launcher).toHaveBeenCalledTimes(1);
+      expect(keptLines(started.logs)).toEqual([]);
+    }
+  );
+});
diff --git a/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts b/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
new file mode 100644
index 0000000000..ae98e219d1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
@@ -0,0 +1,164 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import type { RushConfiguration } from '@microsoft/rush-lib';
+
+import {
+  captureNativeMutationInstallationStateAsync,
+  type INativeMutationInstallationState,
+  isInstallationUnchangedByMutation
+} from '../NativeMutationInstallationState';
+
+const OLD_TIME: Date = new Date('2000-01-01T00:00:00Z');
+const LINK: object = { linkedPackagePath: '/linked', linkedPackageName: 'linked', linkType: 'LinkPackage' };
+
+describe('the installation state around a native mutation', () => {
+  let folder: string;
+  let subspaceFolders: string[];
+  let hotlinkStatePath: string;
+
+  beforeEach(() => {
+    folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-mutation-state-'));
+    subspaceFolders = [path.join(folder, 'default'), path.join(folder, 'other')];
+    hotlinkStatePath = path.join(folder, 'rush-hotlink-state.json');
+    for (const subspaceFolder of subspaceFolders) {
+      fs.mkdirSync(subspaceFolder);
+      writeFlag(subspaceFolder);
+    }
+  });
+
+  afterEach(() => {
+    fs.rmSync(folder, { recursive: true, force: true });
+  });
+
+  function flagPath(subspaceFolder: string): string {
+    return path.join(subspaceFolder, 'last-install.flag');
+  }
+
+  /** Writes a flag and dates it far back, so that a flag written again later never has the same times. */
+  function writeFlag(subspaceFolder: string): void {
+    fs.writeFileSync(flagPath(subspaceFolder), '{"node":"20.0.0","packageManager":"pnpm"}');
+    fs.utimesSync(flagPath(subspaceFolder), OLD_TIME, OLD_TIME);
+  }
+
+  function writeHotlinkState(state: unknown): void {
+    fs.writeFileSync(hotlinkStatePath, JSON.stringify(state));
+  }
+
+  async function captureAsync(): Promise<INativeMutationInstallationState | undefined> {
+    const rushConfiguration: Partial<RushConfiguration> = {
+      commonTempFolder: folder,
+      subspaces: subspaceFolders.map((subspaceFolder: string) => ({
+        getSubspaceTempFolderPath: () => subspaceFolder
+      })) as unknown as RushConfiguration['subspaces']
+    };
+    return await captureNativeMutationInstallationStateAsync(rushConfiguration as RushConfiguration);
+  }
+
+  async function isUnchangedAfterAsync(change: () => void): Promise<boolean> {
+    const before: INativeMutationInstallationState | undefined = await captureAsync();
+    change();
+    const after: INativeMutationInstallationState | undefined = await captureAsync();
+    expect(before).toBeDefined();
+    expect(after).toBeDefined();
+    return isInstallationUnchangedByMutation(before!, after!);
+  }
+
+  it('is unchanged when no flag was touched', async () => {
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(true);
+  });
+
+  it('is unchanged when a flag was only read', async () => {
+    expect(await isUnchangedAfterAsync(() => fs.readFileSync(flagPath(subspaceFolders[1])))).toBe(true);
+  });
+
+  it('is changed when a flag was written again with the same content', async () => {
+    const content: Buffer = fs.readFileSync(flagPath(subspaceFolders[1]));
+    expect(
+      await isUnchangedAfterAsync(() => {
+        fs.rmSync(flagPath(subspaceFolders[1]));
+        fs.writeFileSync(flagPath(subspaceFolders[1]), content);
+      })
+    ).toBe(false);
+  });
+
+  it('is changed when a flag was deleted', async () => {
+    expect(await isUnchangedAfterAsync(() => fs.rmSync(flagPath(subspaceFolders[0])))).toBe(false);
+  });
+
+  it('is changed when a flag was missing before, even if it is still missing', async () => {
+    fs.rmSync(flagPath(subspaceFolders[1]));
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(false);
+  });
+
+  it('is changed when the subspaces are different', async () => {
+    const before: INativeMutationInstallationState | undefined = await captureAsync();
+    subspaceFolders = subspaceFolders.slice(1);
+    const after: INativeMutationInstallationState | undefined = await captureAsync();
+    expect(isInstallationUnchangedByMutation(before!, after!)).toBe(false);
+  });
+
+  it.each([
+    ['records no subspace', { fileVersion: 0, linksBySubspace: {} }],
+    ['records no link in any subspace', { fileVersion: 0, linksBySubspace: { default: [], other: [] } }]
+  ])('is unchanged when the hotlink state %s', async (description: string, state: unknown) => {
+    writeHotlinkState(state);
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(true);
+  });
+
+  it.each([
+    ['records a link', { fileVersion: 0, linksBySubspace: { default: [], other: [LINK] } }],
+    ['has another file version', { fileVersion: 1, linksBySubspace: {} }],
+    ['has no linksBySubspace', { fileVersion: 0 }],
+    [
+      'lists a subspace in something other than an array',
+      { fileVersion: 0, linksBySubspace: { default: {} } }
+    ],
+    ['is not an object', 0],
+    ['is null', null]
+  ])('is changed when the hotlink state %s', async (description: string, state: unknown) => {
+    writeHotlinkState(state);
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(false);
+  });
+
+  it('is changed when the hotlink state is not JSON', async () => {
+    fs.writeFileSync(hotlinkStatePath, '{');
+    expect(await isUnchangedAfterAsync(() => undefined)).toBe(false);
+  });
+
+  it('is changed when a hotlink was added during the mutation', async () => {
+    expect(
+      await isUnchangedAfterAsync(() =>
+        writeHotlinkState({ fileVersion: 0, linksBySubspace: { default: [LINK] } })
+      )
+    ).toBe(false);
+  });
+
+  it('is changed when the hotlinks were removed during the mutation', async () => {
+    writeHotlinkState({ fileVersion: 0, linksBySubspace: { default: [LINK] } });
+    expect(
+      await isUnchangedAfterAsync(() => writeHotlinkState({ fileVersion: 0, linksBySubspace: {} }))
+    ).toBe(false);
+  });
+
+  it('cannot be captured, and does not throw, when a file that exists cannot be read', async () => {
+    fs.mkdirSync(hotlinkStatePath);
+    expect(await captureAsync()).toBeUndefined();
+  });
+
+  it('cannot be captured, and does not throw, when the configuration cannot list its subspaces', async () => {
+    const rushConfiguration: Partial<RushConfiguration> = {
+      commonTempFolder: folder,
+      get subspaces(): RushConfiguration['subspaces'] {
+        throw new Error('The subspaces cannot be loaded.');
+      }
+    };
+    expect(
+      await captureNativeMutationInstallationStateAsync(rushConfiguration as RushConfiguration)
+    ).toBeUndefined();
+  });
+});

From 0f578745d2c6ebafdfe1e99e9bc9bdc34e7e45b7 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:22 +0000
Subject: [PATCH 217/265] [rush-lib] Restore build cache outputs through a
 staging folder

Swarm integration step 202; original commit 74aeb1615d (merge of swarm/r03-t128c at 59a064cb92).
Scope: task 128c.

Brings 128c (branch swarm/r03-t128c). Second agent: t06 board 6769. Evidence: ch01's GATE OK board 7438.

Batch E2g, item 4 of 7. Gate: ch01 GATE OK board 7438 (tree 6a961f3219)

Commits folded into this step (1):
- 59a064cb92 Restore build cache outputs through a staging folder

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...cache-staged-restore_2026-09-29-18-58.json |  11 +
 .../logic/buildCache/OperationBuildCache.ts   |  64 ++-
 .../src/logic/buildCache/StagedRestore.ts     | 320 +++++++++++
 .../buildCache/test/StagedRestore.test.ts     | 511 ++++++++++++++++++
 4 files changed, 883 insertions(+), 23 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/build-cache-staged-restore_2026-09-29-18-58.json
 create mode 100644 libraries/rush-lib/src/logic/buildCache/StagedRestore.ts
 create mode 100644 libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts

diff --git a/common/changes/@microsoft/rush/build-cache-staged-restore_2026-09-29-18-58.json b/common/changes/@microsoft/rush/build-cache-staged-restore_2026-09-29-18-58.json
new file mode 100644
index 0000000000..4c5558d4e2
--- /dev/null
+++ b/common/changes/@microsoft/rush/build-cache-staged-restore_2026-09-29-18-58.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Restore an operation's output folders from the build cache through a staging folder in the project's `.rush/temp` folder, so that a file that is in both the old outputs and the cache entry is never missing during the restore.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
index 09943d5bbd..e4ffb2b79c 100644
--- a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
+++ b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
@@ -15,6 +15,7 @@ import { TarExecutable } from '../../utilities/TarExecutable';
 import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
 import type { IBaseOperationExecutionResult } from '../operations/IOperationExecutionResult';
 import { OutputFolderReceipt, type PendingOutputFolderReceipt } from './OutputFolderReceipt';
+import { tryRestoreThroughStagingFolderAsync } from './StagedRestore';
 
 /**
  * How long to wait to acquire the per-cache-entry download lock (see
@@ -364,35 +365,52 @@ export class OperationBuildCache {
       receipt.deleteAsync()
     );
 
-    // Purge output folders
-    terminal.writeVerboseLine(`Clearing cached folders: ${this.#projectOutputFolderNames.join(', ')}`);
-    await Promise.all(
-      this.#projectOutputFolderNames.map((outputFolderName: string) =>
-        FileSystem.deleteFolderAsync(`${projectFolderPath}/${outputFolderName}`)
-      )
-    );
-
     const tarUtility: TarExecutable | undefined = await _tryGetTarUtility(terminal);
-    let restoreSuccess: boolean = false;
+    const logFilePath: string = this.#getTarLogFilePath(cacheId, 'untar');
+    let tarExitCode: number | undefined;
     if (tarUtility && localCacheEntryPath) {
-      const logFilePath: string = this.#getTarLogFilePath(cacheId, 'untar');
-      const tarExitCode: number = await tarUtility.tryUntarAsync({
-        archivePath: localCacheEntryPath,
-        outputFolderPath: projectFolderPath,
-        logFilePath
+      // Restoring through a staging folder never leaves a file that is in both the old outputs and the entry
+      // missing, so a process that reads the outputs during the restore finds them.
+      const archivePath: string = localCacheEntryPath;
+      tarExitCode = await tryRestoreThroughStagingFolderAsync(terminal, {
+        projectFolder: projectFolderPath,
+        projectRushTempFolder: this.#project.projectRushTempFolder,
+        outputFolderNames: this.#projectOutputFolderNames,
+        untarAsync: (outputFolderPath: string) =>
+          tarUtility.tryUntarAsync({ archivePath, outputFolderPath, logFilePath })
       });
-      if (tarExitCode === 0) {
-        restoreSuccess = true;
-        terminal.writeLine('Successfully restored output from the build cache.');
-        await this.#tryWriteRestoredReceiptAsync(terminal, cacheId);
-      } else {
-        terminal.writeWarningLine(
-          'Unable to restore output from the build cache. ' +
-            `See "${logFilePath}" for logs from the tar process.`
-        );
+    }
+
+    if (tarExitCode !== 0) {
+      // Purge output folders
+      terminal.writeVerboseLine(`Clearing cached folders: ${this.#projectOutputFolderNames.join(', ')}`);
+      await Promise.all(
+        this.#projectOutputFolderNames.map((outputFolderName: string) =>
+          FileSystem.deleteFolderAsync(`${projectFolderPath}/${outputFolderName}`)
+        )
+      );
+
+      if (tarUtility && localCacheEntryPath && tarExitCode === undefined) {
+        tarExitCode = await tarUtility.tryUntarAsync({
+          archivePath: localCacheEntryPath,
+          outputFolderPath: projectFolderPath,
+          logFilePath
+        });
       }
     }
 
+    let restoreSuccess: boolean = false;
+    if (tarExitCode === 0) {
+      restoreSuccess = true;
+      terminal.writeLine('Successfully restored output from the build cache.');
+      await this.#tryWriteRestoredReceiptAsync(terminal, cacheId);
+    } else if (tarExitCode !== undefined) {
+      terminal.writeWarningLine(
+        'Unable to restore output from the build cache. ' +
+          `See "${logFilePath}" for logs from the tar process.`
+      );
+    }
+
     if (updateLocalCacheSuccess === false) {
       terminal.writeWarningLine('Unable to update the local build cache with data from the cloud cache.');
     }
diff --git a/libraries/rush-lib/src/logic/buildCache/StagedRestore.ts b/libraries/rush-lib/src/logic/buildCache/StagedRestore.ts
new file mode 100644
index 0000000000..dc71289113
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/StagedRestore.ts
@@ -0,0 +1,320 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as fs from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, readdir, rename, rm, stat } from 'node:fs/promises';
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library';
+import type { ITerminal } from '@rushstack/terminal';
+
+/**
+ * The start of the name of a staging folder in the project's `.rush/temp` folder.
+ */
+export const STAGING_FOLDER_PREFIX: string = 'build-cache-restore-';
+
+const MOVE_CONCURRENCY: number = 10;
+
+/**
+ * Options for {@link tryRestoreThroughStagingFolderAsync}.
+ */
+export interface IStagedRestoreOptions {
+  /**
+   * The absolute path of the project folder.
+   */
+  projectFolder: string;
+  /**
+   * The absolute path of the project's `.rush/temp` folder, where the staging folder is made.
+   */
+  projectRushTempFolder: string;
+  /**
+   * The project-relative output folders to restore.
+   */
+  outputFolderNames: ReadonlyArray<string>;
+  /**
+   * Extracts the cache entry into the given folder, and returns the exit code of tar.
+   */
+  untarAsync: (folderPath: string) => Promise<number>;
+}
+
+/**
+ * Restores output folders from a build cache entry so that a file that is in both the old outputs and the entry is
+ * never missing: tar extracts the entry into a new staging folder in the project's `.rush/temp` folder, and then each
+ * output folder is moved into place. A file, or a folder that has no folder in its place, is moved with one rename,
+ * which replaces a file in its place at once. A folder that has a folder in its place is merged into it: the names in
+ * it that the entry lacks are deleted, each entry is moved in, and the folder gets the staged folder's mode. An output
+ * folder that the entry lacks is deleted. The staging folder is deleted in the end.
+ *
+ * @returns The exit code of tar, which is 0 if the output folders were restored. If it isn't 0, the output folders
+ * weren't changed. `undefined` means that the output folders must be restored in place instead: either nothing in
+ * them was changed, or moving them failed partway.
+ */
+export async function tryRestoreThroughStagingFolderAsync(
+  terminal: ITerminal,
+  options: IStagedRestoreOptions
+): Promise<number | undefined> {
+  const { projectFolder, projectRushTempFolder, outputFolderNames, untarAsync } = options;
+  const relativeFolderPaths: string[] = [];
+  const unsupportedReason: string | undefined = getUnsupportedReason(
+    projectFolder,
+    projectRushTempFolder,
+    outputFolderNames,
+    relativeFolderPaths
+  );
+  if (unsupportedReason) {
+    terminal.writeVerboseLine(`Restoring the output folders in place, because ${unsupportedReason}.`);
+    return undefined;
+  }
+
+  let stagingFolderPath: string | undefined;
+  try {
+    // Never make the project folder just to stage a restore in it.
+    if (!(await tryGetStatsAsync(stat, projectFolder))?.isDirectory()) {
+      terminal.writeVerboseLine(
+        `Restoring the output folders in place, because "${projectFolder}" is not a folder.`
+      );
+      return undefined;
+    }
+
+    await mkdir(projectRushTempFolder, { recursive: true });
+    stagingFolderPath = await mkdtemp(path.join(projectRushTempFolder, STAGING_FOLDER_PREFIX));
+    terminal.writeVerboseLine(
+      `Extracting the cache entry into "${stagingFolderPath}", to move the output folders into place from there.`
+    );
+    const tarExitCode: number = await untarAsync(stagingFolderPath);
+    if (tarExitCode !== 0) {
+      return tarExitCode;
+    }
+
+    const outsidePath: string | undefined = await tryFindPathOutsideFoldersAsync(
+      stagingFolderPath,
+      relativeFolderPaths
+    );
+    if (outsidePath !== undefined) {
+      terminal.writeVerboseLine(
+        `Restoring the output folders in place, because the cache entry has "${outsidePath}", ` +
+          'which is not in an output folder.'
+      );
+      return undefined;
+    }
+
+    await moveFoldersIntoPlaceAsync(stagingFolderPath, projectFolder, relativeFolderPaths);
+    return 0;
+  } catch (error) {
+    terminal.writeVerboseLine(
+      `Unable to restore the output folders through a staging folder; restoring them in place: ${error}`
+    );
+    return undefined;
+  } finally {
+    if (stagingFolderPath) {
+      try {
+        await rm(stagingFolderPath, { recursive: true, force: true });
+      } catch (error) {
+        terminal.writeVerboseLine(`Unable to delete the staging folder "${stagingFolderPath}": ${error}`);
+      }
+    }
+  }
+}
+
+// Returns why the output folders can't be restored through a staging folder, or undefined if they can, in which case
+// it fills relativeFolderPaths with the normalized project-relative paths of the output folders.
+function getUnsupportedReason(
+  projectFolder: string,
+  projectRushTempFolder: string,
+  outputFolderNames: ReadonlyArray<string>,
+  relativeFolderPaths: string[]
+): string | undefined {
+  const folderPaths: string[] = [];
+  for (const folderName of outputFolderNames) {
+    if (path.isAbsolute(folderName) || folderName.split(/[\\/]/).includes('..')) {
+      return `the output folder name "${folderName}" is absolute or has ".."`;
+    }
+    const folderPath: string = path.resolve(projectFolder, folderName);
+    if (isInFolder(projectRushTempFolder, folderPath)) {
+      // The staging folder would be in it.
+      return `the output folder "${folderName}" contains "${projectRushTempFolder}"`;
+    }
+    for (let i: number = 0; i < folderPaths.length; i++) {
+      if (isInFolder(folderPath, folderPaths[i]) || isInFolder(folderPaths[i], folderPath)) {
+        return `the output folders "${outputFolderNames[i]}" and "${folderName}" overlap`;
+      }
+    }
+    folderPaths.push(folderPath);
+  }
+
+  for (const folderPath of folderPaths) {
+    relativeFolderPaths.push(path.relative(projectFolder, folderPath));
+  }
+  return undefined;
+}
+
+// Whether the path is the folder or inside it. Compared without case, since the file system may ignore it.
+function isInFolder(childPath: string, folderPath: string): boolean {
+  const relativePath: string = path.relative(folderPath.toLowerCase(), childPath.toLowerCase());
+  return !(
+    relativePath === '..' ||
+    relativePath.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativePath)
+  );
+}
+
+// Returns the relative path of the first thing in the staging folder that is neither in an output folder nor a folder
+// that holds one, or undefined if there is none. A restore in place would put it in the project folder.
+async function tryFindPathOutsideFoldersAsync(
+  stagingFolderPath: string,
+  relativeFolderPaths: ReadonlyArray<string>
+): Promise<string | undefined> {
+  const folderPaths: Set<string> = new Set(relativeFolderPaths);
+  const parentPaths: Set<string> = new Set();
+  for (const relativeFolderPath of relativeFolderPaths) {
+    for (
+      let parent: string = path.dirname(relativeFolderPath);
+      parent !== '.';
+      parent = path.dirname(parent)
+    ) {
+      parentPaths.add(parent);
+    }
+  }
+
+  const queue: string[] = [''];
+  for (const relativeParentPath of queue) {
+    const children: fs.Dirent[] = await readdir(path.join(stagingFolderPath, relativeParentPath), {
+      withFileTypes: true
+    });
+    for (const child of children) {
+      const relativePath: string = relativeParentPath
+        ? path.join(relativeParentPath, child.name)
+        : child.name;
+      if (parentPaths.has(relativePath) && child.isDirectory()) {
+        queue.push(relativePath);
+      } else if (!folderPaths.has(relativePath)) {
+        return relativePath;
+      }
+    }
+  }
+  return undefined;
+}
+
+async function moveFoldersIntoPlaceAsync(
+  stagingFolderPath: string,
+  projectFolder: string,
+  relativeFolderPaths: ReadonlyArray<string>
+): Promise<void> {
+  await forEachSettledAsync(relativeFolderPaths, async (relativeFolderPath: string) => {
+    const stagedPath: string = path.join(stagingFolderPath, relativeFolderPath);
+    const targetPath: string = path.join(projectFolder, relativeFolderPath);
+    const stagedStats: fs.Stats | undefined = await tryGetStatsAsync(lstat, stagedPath);
+    if (!stagedStats) {
+      // The entry lacks this output folder, so a restore in place would leave it deleted.
+      await rm(targetPath, { recursive: true, force: true });
+      return;
+    }
+
+    await mkdir(path.dirname(targetPath), { recursive: true });
+    const targetStats: fs.Stats | undefined = await tryGetStatsAsync(lstat, targetPath);
+    await moveIntoPlaceAsync(stagedPath, stagedStats.isDirectory(), targetPath, targetStats?.isDirectory());
+  });
+}
+
+// Moves a staged file or folder to the target path. targetIsFolder is undefined if nothing is there. A symbolic link
+// is never followed: it is replaced like a file.
+async function moveIntoPlaceAsync(
+  stagedPath: string,
+  stagedIsFolder: boolean,
+  targetPath: string,
+  targetIsFolder: boolean | undefined
+): Promise<void> {
+  if (stagedIsFolder && targetIsFolder) {
+    await mergeFolderAsync(stagedPath, targetPath);
+    return;
+  }
+
+  if (targetIsFolder !== undefined && (stagedIsFolder || targetIsFolder)) {
+    // A rename can't put a folder in place of a file, or a file in place of a folder.
+    await rm(targetPath, { recursive: true, force: true });
+  }
+  await rename(stagedPath, targetPath);
+}
+
+async function mergeFolderAsync(stagedFolderPath: string, targetFolderPath: string): Promise<void> {
+  const [stagedChildren, targetChildren]: [fs.Dirent[], fs.Dirent[]] = await Promise.all([
+    readdir(stagedFolderPath, { withFileTypes: true }),
+    readdir(targetFolderPath, { withFileTypes: true })
+  ]);
+  const stagedNames: Set<string> = new Set(stagedChildren.map((child: fs.Dirent) => child.name));
+  const targetIsFolderByName: Map<string, boolean> = new Map();
+  const staleNames: string[] = [];
+  for (const child of targetChildren) {
+    if (stagedNames.has(child.name)) {
+      targetIsFolderByName.set(child.name, child.isDirectory());
+    } else {
+      staleNames.push(child.name);
+    }
+  }
+
+  // The names that the entry lacks are deleted first. Where the file system ignores case, one of them may be the
+  // same file as a staged name that differs only in case, and deleting it afterwards would delete the new file.
+  await forEachSettledAsync(
+    staleNames,
+    async (name: string) => await rm(path.join(targetFolderPath, name), { recursive: true, force: true })
+  );
+  await forEachSettledAsync(
+    stagedChildren,
+    async (child: fs.Dirent) =>
+      await moveIntoPlaceAsync(
+        path.join(stagedFolderPath, child.name),
+        child.isDirectory(),
+        path.join(targetFolderPath, child.name),
+        targetIsFolderByName.get(child.name)
+      )
+  );
+
+  // A restore in place would make this folder anew.
+  const { mode } = await lstat(stagedFolderPath);
+  // eslint-disable-next-line no-bitwise
+  await chmod(targetFolderPath, mode & 0o7777);
+}
+
+// Calls the callback for each item, MOVE_CONCURRENCY at a time. After a call fails, no more calls start, and it rejects
+// with the first error once the calls that started have settled, so that nothing still moves files when the caller
+// restores the output folders in place instead.
+async function forEachSettledAsync<T>(
+  items: ReadonlyArray<T>,
+  callback: (item: T) => Promise<void>
+): Promise<void> {
+  let nextIndex: number = 0;
+  let failure: { error: unknown } | undefined;
+  async function workAsync(): Promise<void> {
+    while (nextIndex < items.length && !failure) {
+      const item: T = items[nextIndex++];
+      try {
+        await callback(item);
+      } catch (error) {
+        failure = failure || { error };
+      }
+    }
+  }
+
+  const workers: Promise<void>[] = [];
+  for (let i: number = 0; i < Math.min(MOVE_CONCURRENCY, items.length); i++) {
+    workers.push(workAsync());
+  }
+  await Promise.all(workers);
+  if (failure) {
+    throw failure.error;
+  }
+}
+
+async function tryGetStatsAsync(
+  getStatsAsync: (filePath: string) => Promise<fs.Stats>,
+  filePath: string
+): Promise<fs.Stats | undefined> {
+  try {
+    return await getStatsAsync(filePath);
+  } catch (error) {
+    if (FileSystem.isNotExistError(error as Error)) {
+      return undefined;
+    }
+    throw error;
+  }
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts b/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
new file mode 100644
index 0000000000..ca1c0ae357
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
@@ -0,0 +1,511 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IUntarOptions, TarExecutable } from '../../../utilities/TarExecutable';
+import type { IBaseOperationExecutionResult } from '../../operations/IOperationExecutionResult';
+import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
+
+const SUCCESS_LINE: string = 'Successfully restored output from the build cache.';
+const WARNING_LINE: string = 'Unable to restore output from the build cache.';
+const SKIP_LINE: string = 'The output folders already match this cache entry; nothing to restore.';
+const METADATA_FOLDER: string = '.rush/temp/operation/_phase_build';
+const STAGING_FOLDER_PREFIX: string = 'build-cache-restore-';
+const CACHE_ID: string = 'acme-hash1';
+
+// A fake cache entry: the project-relative path and content of each file.
+type FakeArchive = Record<string, string>;
+
+// Each file and folder under some folders: its type and mode, and a file's content or a link's target.
+type Snapshot = Record<string, string>;
+
+const ENTRY: FakeArchive = {
+  'lib/plugin.js': 'new plugin',
+  'lib/out.txt': 'out',
+  'lib/nested/deep/data.json': '{"a":1}',
+  [`${METADATA_FOLDER}/state.json`]: '{}'
+};
+
+const OLD_OUTPUTS: FakeArchive = {
+  ...ENTRY,
+  'lib/plugin.js': 'old plugin',
+  'lib/out.txt': 'old out'
+};
+
+const DEEP_ENTRY: FakeArchive = {
+  'lib/a/b/c/d/e.txt': 'e',
+  'lib/a/b/c/f.txt': 'f',
+  'lib/a/b/x.txt': 'x',
+  'lib/a/y.txt': 'y',
+  'lib/top.txt': 'top',
+  [`${METADATA_FOLDER}/state.json`]: '{}'
+};
+
+interface ISubjectOptions {
+  outputFolderNames?: string[];
+}
+
+interface IRestoreResult {
+  result: boolean;
+  output: string;
+  verbose: string;
+  warning: string;
+}
+
+interface IOldState {
+  outputFolderNames?: string[];
+  archive?: FakeArchive;
+  setUp: () => void;
+  check?: () => void;
+}
+
+describe('OperationBuildCache restores through a staging folder', () => {
+  let rootFolder: string;
+  let projectFolder: string;
+  let cacheFolder: string;
+  let untarStartHook: ((outputFolderPath: string) => void) | undefined;
+  let untarEndHook: ((outputFolderPath: string) => void) | undefined;
+  let untarMock: jest.Mock<Promise<number>, [IUntarOptions]>;
+
+  beforeEach(() => {
+    rootFolder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-build-cache-staging-'));
+    projectFolder = path.join(rootFolder, 'project');
+    cacheFolder = path.join(rootFolder, 'cache');
+    fs.mkdirSync(projectFolder);
+    fs.mkdirSync(cacheFolder);
+    untarStartHook = undefined;
+    untarEndHook = undefined;
+
+    untarMock = jest.fn(async ({ archivePath, outputFolderPath }: IUntarOptions) => {
+      untarStartHook?.(outputFolderPath);
+      writeFiles(outputFolderPath, JSON.parse(fs.readFileSync(archivePath, 'utf8')));
+      untarEndHook?.(outputFolderPath);
+      return 0;
+    });
+    _setTarUtilityPromiseForTesting(
+      Promise.resolve({ tryUntarAsync: untarMock } as unknown as TarExecutable)
+    );
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    _setTarUtilityPromiseForTesting(undefined);
+    fs.rmSync(rootFolder, { recursive: true, force: true });
+  });
+
+  function writeFiles(folderPath: string, files: FakeArchive): void {
+    for (const [relativePath, content] of Object.entries(files)) {
+      const filePath: string = path.join(folderPath, relativePath);
+      fs.mkdirSync(path.dirname(filePath), { recursive: true });
+      fs.writeFileSync(filePath, content);
+    }
+  }
+
+  function takeSnapshot(folderPath: string, folderNames: ReadonlyArray<string>): Snapshot {
+    const snapshot: Snapshot = {};
+    function visit(relativePath: string): void {
+      const itemPath: string = path.join(folderPath, relativePath);
+      const stats: fs.Stats | undefined = fs.lstatSync(itemPath, { throwIfNoEntry: false });
+      if (!stats) {
+        return;
+      }
+      // eslint-disable-next-line no-bitwise
+      const mode: string = (stats.mode & 0o7777).toString(8);
+      if (stats.isSymbolicLink()) {
+        snapshot[relativePath] = `link ${fs.readlinkSync(itemPath)}`;
+      } else if (stats.isDirectory()) {
+        snapshot[relativePath] = `folder ${mode}`;
+        for (const name of fs.readdirSync(itemPath).sort()) {
+          visit(`${relativePath}/${name}`);
+        }
+      } else {
+        snapshot[relativePath] = `file ${mode} ${fs.readFileSync(itemPath, 'utf8')}`;
+      }
+    }
+    for (const folderName of folderNames) {
+      visit(folderName);
+    }
+    return snapshot;
+  }
+
+  // What a fresh extraction of the entry into an empty folder holds.
+  function getExpectedSnapshot(archive: FakeArchive, folderNames: ReadonlyArray<string>): Snapshot {
+    const oracleFolder: string = fs.mkdtempSync(path.join(rootFolder, 'oracle-'));
+    writeFiles(oracleFolder, archive);
+    return takeSnapshot(oracleFolder, folderNames);
+  }
+
+  function getStagingFolders(): string[] {
+    const rushTempFolder: string = path.join(projectFolder, '.rush', 'temp');
+    return fs.existsSync(rushTempFolder)
+      ? fs.readdirSync(rushTempFolder).filter((name: string) => name.startsWith(STAGING_FOLDER_PREFIX))
+      : [];
+  }
+
+  function getProject(): RushConfigurationProject {
+    return {
+      packageName: 'acme',
+      projectFolder,
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp')
+    } as unknown as RushConfigurationProject;
+  }
+
+  function getBuildCacheConfiguration(): BuildCacheConfiguration {
+    return {
+      buildCacheEnabled: true,
+      cacheWriteEnabled: true,
+      getCacheEntryId: ({ projectName, projectStateHash }: IGenerateCacheEntryIdOptions) =>
+        `${projectName}-${projectStateHash}`,
+      localCacheProvider: {
+        getCacheEntryPath: (cacheId: string) => path.join(cacheFolder, cacheId),
+        tryGetCacheEntryPathByIdAsync: async (terminal: ITerminal, cacheId: string) => {
+          const cacheEntryPath: string = path.join(cacheFolder, cacheId);
+          return fs.existsSync(cacheEntryPath) ? cacheEntryPath : undefined;
+        }
+      },
+      cloudCacheProvider: undefined
+    } as unknown as BuildCacheConfiguration;
+  }
+
+  function createSubject(options: ISubjectOptions = {}): OperationBuildCache {
+    const { outputFolderNames = ['lib'] } = options;
+    const project: RushConfigurationProject = getProject();
+    const executionResult: IBaseOperationExecutionResult = {
+      operation: {
+        settings: { outputFolderNames },
+        associatedProject: project,
+        associatedPhase: { name: '_phase:build' },
+        logFilenameIdentifier: '_phase_build'
+      },
+      metadataFolderPath: METADATA_FOLDER,
+      getStateHash: () => 'hash1'
+    } as unknown as IBaseOperationExecutionResult;
+    return OperationBuildCache.forOperation(executionResult, {
+      buildCacheConfiguration: getBuildCacheConfiguration(),
+      terminal: new Terminal(new StringBufferTerminalProvider()),
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+  }
+
+  function seedEntry(archive: FakeArchive = ENTRY): void {
+    fs.writeFileSync(path.join(cacheFolder, CACHE_ID), JSON.stringify(archive));
+  }
+
+  async function restoreAsync(subject: OperationBuildCache): Promise<IRestoreResult> {
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const result: boolean = await subject.tryRestoreFromCacheAsync(new Terminal(terminalProvider));
+    return {
+      result,
+      output: terminalProvider.getOutput(),
+      verbose: terminalProvider.getVerboseOutput(),
+      warning: terminalProvider.getWarningOutput()
+    };
+  }
+
+  // Calls the check after each call of the fs.promises function, and passes the call through.
+  function spyAfterEachCall(name: 'rename' | 'rm' | 'unlink' | 'chmod', check: (when: string) => void): void {
+    const original: (...args: unknown[]) => Promise<unknown> = fs.promises[name] as unknown as (
+      ...args: unknown[]
+    ) => Promise<unknown>;
+    jest.spyOn(fs.promises, name).mockImplementation((async (...args: unknown[]) => {
+      try {
+        return await original(...args);
+      } finally {
+        check(`after ${name} ${args[0]}`);
+      }
+    }) as never);
+  }
+
+  it('U1: never leaves a file that the old outputs and the entry both have missing', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const pluginPath: string = path.join(projectFolder, 'lib/plugin.js');
+    const checks: string[] = [];
+    const missing: string[] = [];
+    const check: (when: string) => void = (when: string) => {
+      checks.push(when);
+      if (!fs.existsSync(pluginPath)) {
+        missing.push(when);
+      }
+    };
+    untarStartHook = () => check('when the untar starts');
+    untarEndHook = () => check('when the untar ends');
+    for (const name of ['rename', 'rm', 'unlink', 'chmod'] as const) {
+      spyAfterEachCall(name, check);
+    }
+
+    const { result } = await restoreAsync(createSubject());
+
+    expect(missing).toEqual([]);
+    // The check ran after the rename that put the new plugin.js in place.
+    expect(checks).toContain(
+      `after rename ${path.join(untarMock.mock.calls[0][0].outputFolderPath, 'lib/plugin.js')}`
+    );
+    expect(result).toBe(true);
+    expect(fs.readFileSync(pluginPath, 'utf8')).toBe('new plugin');
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  const oldStates: [string, IOldState][] = [
+    ['a: a stray file', { setUp: () => writeFiles(projectFolder, { ...ENTRY, 'lib/stray.txt': 'stray' }) }],
+    [
+      'b: a stray folder with a file',
+      { setUp: () => writeFiles(projectFolder, { ...ENTRY, 'lib/stray/file.txt': 'stray' }) }
+    ],
+    [
+      'c: a deleted file',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, ENTRY);
+          fs.unlinkSync(path.join(projectFolder, 'lib/nested/deep/data.json'));
+        }
+      }
+    ],
+    ['d: a changed file', { setUp: () => writeFiles(projectFolder, OLD_OUTPUTS) }],
+    [
+      'e: a file with mode 0600',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, ENTRY);
+          fs.chmodSync(path.join(projectFolder, 'lib/out.txt'), 0o600);
+        }
+      }
+    ],
+    [
+      'f: a folder with mode 0700',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, ENTRY);
+          fs.chmodSync(path.join(projectFolder, 'lib/nested'), 0o700);
+        }
+      }
+    ],
+    [
+      'g: a file where the entry has a folder',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, { 'lib/out.txt': 'out', 'lib/nested': 'a file' });
+        }
+      }
+    ],
+    [
+      'h: a folder where the entry has a file',
+      {
+        setUp: () => {
+          writeFiles(projectFolder, {
+            'lib/plugin.js/inner.txt': 'inner',
+            'lib/nested/deep/data.json': '{}'
+          });
+        }
+      }
+    ],
+    [
+      'i: an output folder that is a symbolic link to a folder outside the project',
+      (() => {
+        const outsideFiles: FakeArchive = { 'plugin.js': 'outside plugin', 'keep.txt': 'keep' };
+        let outsideBefore: Snapshot = {};
+        return {
+          setUp: () => {
+            writeFiles(path.join(rootFolder, 'outside'), outsideFiles);
+            outsideBefore = takeSnapshot(rootFolder, ['outside']);
+            fs.symlinkSync(path.join(rootFolder, 'outside'), path.join(projectFolder, 'lib'), 'junction');
+          },
+          check: () => {
+            expect(Object.keys(outsideBefore)).toHaveLength(3);
+            expect(takeSnapshot(rootFolder, ['outside'])).toEqual(outsideBefore);
+          }
+        };
+      })()
+    ],
+    ['j: an output folder that is a file', { setUp: () => writeFiles(projectFolder, { lib: 'a file' }) }],
+    [
+      'k: an output folder that the entry lacks',
+      {
+        outputFolderNames: ['lib', 'dist'],
+        setUp: () => writeFiles(projectFolder, { ...ENTRY, 'dist/index.js': 'dist' }),
+        check: () => expect(fs.existsSync(path.join(projectFolder, 'dist'))).toBe(false)
+      }
+    ],
+    [
+      'l: a deep tree that differs at several levels',
+      {
+        archive: DEEP_ENTRY,
+        setUp: () =>
+          writeFiles(projectFolder, {
+            'lib/a/b/c/d/e.txt': 'old e',
+            'lib/a/b/c/d/stale.txt': 'stale',
+            'lib/a/b/x.txt': 'x',
+            'lib/a/z/w.txt': 'w',
+            'lib/top.txt': 'old top',
+            [`${METADATA_FOLDER}/old.json`]: '{}'
+          })
+      }
+    ]
+  ];
+
+  it.each(oldStates)('U2%s', async (description: string, oldState: IOldState) => {
+    const { outputFolderNames = ['lib'], archive = ENTRY, setUp, check } = oldState;
+    const folderNames: string[] = [...outputFolderNames, METADATA_FOLDER];
+    setUp();
+    seedEntry(archive);
+
+    const { result, output } = await restoreAsync(createSubject({ outputFolderNames }));
+
+    expect(result).toBe(true);
+    expect(output).toContain(SUCCESS_LINE);
+    expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
+    expect(getStagingFolders()).toEqual([]);
+    check?.();
+  });
+
+  it('U3: clears the output folders and warns if tar fails', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    untarMock.mockImplementationOnce(async ({ outputFolderPath }: IUntarOptions) => {
+      writeFiles(outputFolderPath, { 'lib/partial.txt': 'partial' });
+      return 1;
+    });
+
+    const { result, warning } = await restoreAsync(createSubject());
+
+    expect(result).toBe(false);
+    expect(warning).toContain(WARNING_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(fs.existsSync(path.join(projectFolder, 'lib'))).toBe(false);
+    expect(fs.existsSync(path.join(projectFolder, METADATA_FOLDER))).toBe(false);
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  it('U4: restores in place if moving the output folders into place fails', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const libFolder: string = path.join(projectFolder, 'lib');
+    const originalRename: typeof fs.promises.rename = fs.promises.rename;
+    let failedRename: string | undefined;
+    jest.spyOn(fs.promises, 'rename').mockImplementation((async (oldPath: string, newPath: string) => {
+      if (!failedRename && (newPath === libFolder || newPath.startsWith(`${libFolder}${path.sep}`))) {
+        failedRename = newPath;
+        throw Object.assign(
+          new Error(`EPERM: operation not permitted, rename '${oldPath}' -> '${newPath}'`),
+          {
+            code: 'EPERM'
+          }
+        );
+      }
+      return await originalRename(oldPath, newPath);
+    }) as never);
+    const folderNames: string[] = ['lib', METADATA_FOLDER];
+
+    const { result, verbose } = await restoreAsync(createSubject());
+
+    expect(failedRename).toBeDefined();
+    expect(result).toBe(true);
+    expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(ENTRY, folderNames));
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+    expect(untarMock.mock.calls[1][0].outputFolderPath).toBe(projectFolder);
+    expect(verbose).toContain('EPERM: operation not permitted');
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  describe('U5: restores in place', () => {
+    let stagingFoldersDuringUntar: string[][];
+
+    beforeEach(() => {
+      stagingFoldersDuringUntar = [];
+      untarStartHook = () => stagingFoldersDuringUntar.push(getStagingFolders());
+    });
+
+    async function expectRestoredInPlaceAsync(subject: OperationBuildCache): Promise<void> {
+      writeFiles(projectFolder, OLD_OUTPUTS);
+      seedEntry();
+
+      const { result } = await restoreAsync(subject);
+
+      expect(result).toBe(true);
+      expect(untarMock).toHaveBeenCalledTimes(1);
+      expect(untarMock.mock.calls[0][0].outputFolderPath).toBe(projectFolder);
+      expect(stagingFoldersDuringUntar).toEqual([[]]);
+      expect(getStagingFolders()).toEqual([]);
+      expect(fs.readFileSync(path.join(projectFolder, 'lib/plugin.js'), 'utf8')).toBe('new plugin');
+    }
+
+    it.each([
+      ['a: if output folders are nested', ['lib', 'lib/nested']],
+      ['b: if output folders are equal ignoring case', ['lib', 'LIB']],
+      ['d: if an output folder name has ".."', ['lib', 'lib/../dist']]
+    ])('U5%s', async (description: string, outputFolderNames: string[]) => {
+      await expectRestoredInPlaceAsync(createSubject({ outputFolderNames }));
+    });
+
+    it('U5c: if an output folder contains the .rush/temp folder', async () => {
+      await expectRestoredInPlaceAsync(
+        OperationBuildCache.getOperationBuildCache({
+          buildCacheConfiguration: getBuildCacheConfiguration(),
+          terminal: new Terminal(new StringBufferTerminalProvider()),
+          project: getProject(),
+          phaseName: '_phase:build',
+          projectOutputFolderNames: ['lib', '.rush'],
+          operationStateHash: 'hash1',
+          excludeAppleDoubleFiles: false,
+          useDirectFileTransfersForBuildCache: false
+        })
+      );
+    });
+
+    it('U5e: after staging, if the entry has a file outside the output folders', async () => {
+      writeFiles(projectFolder, OLD_OUTPUTS);
+      const archive: FakeArchive = { ...ENTRY, 'extra/x.txt': 'extra' };
+      seedEntry(archive);
+      const folderNames: string[] = ['lib', METADATA_FOLDER];
+
+      const { result } = await restoreAsync(createSubject());
+
+      expect(result).toBe(true);
+      expect(untarMock).toHaveBeenCalledTimes(2);
+      expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+      expect(untarMock.mock.calls[1][0].outputFolderPath).toBe(projectFolder);
+      expect(fs.readFileSync(path.join(projectFolder, 'extra/x.txt'), 'utf8')).toBe('extra');
+      expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
+      expect(getStagingFolders()).toEqual([]);
+    });
+  });
+
+  it('U6: clears the output folders if there is no tar', async () => {
+    _setTarUtilityPromiseForTesting(Promise.resolve(undefined));
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const mkdtempSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'mkdtemp');
+
+    const { result } = await restoreAsync(createSubject());
+
+    expect(result).toBe(false);
+    expect(fs.existsSync(path.join(projectFolder, 'lib'))).toBe(false);
+    expect(fs.existsSync(path.join(projectFolder, METADATA_FOLDER))).toBe(false);
+    expect(mkdtempSpy).not.toHaveBeenCalled();
+    expect(getStagingFolders()).toEqual([]);
+  });
+
+  it('U7: skips a second restore of the same entry after a restore through a staging folder', async () => {
+    writeFiles(projectFolder, OLD_OUTPUTS);
+    seedEntry();
+    const subject: OperationBuildCache = createSubject();
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(output).toContain(SKIP_LINE);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+  });
+});

From fdc4845bd3d3dd62aa152ef969d70af4cecc611b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:22 +0000
Subject: [PATCH 218/265] [rush-daemon] Name the lock holder to requests behind
 a reload

Swarm integration step 203; original commit af484f8223 (merge of swarm/o04-t308 at baccc0ddd6).
Scope: task 308.

Brings 308 (branch swarm/o04-t308). Second agent: ch05 board 7122, board 7124. Evidence: ch01's GATE OK board 7438.

Batch E2g, item 5 of 7. Gate: ch01 GATE OK board 7438 (tree 990e6bd793)

Commits folded into this step (1):
- baccc0ddd6 [rush-daemon] Name the lock holder to requests behind a reload

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-lock-wait-followers_2026-09-29-19-00.json |  11 +
 ...-lock-wait-followers_2026-09-29-19-00.json |  11 +
 .../src/DaemonRequestAdmission.ts             |   4 +-
 libraries/rush-daemon/README.md               |   4 +-
 .../src/WorkspaceRequestAdmission.ts          |  92 ++++++--
 .../src/WorkspaceRequestLifecycle.ts          |   6 +-
 .../src/test/NativeLockAdmission.test.ts      | 221 +++++++++++++++++-
 .../ProductionDaemonNativeLockWait.test.ts    |  35 ++-
 .../test/ServedScriptNativeLockWait.test.ts   |  52 +++++
 9 files changed, 402 insertions(+), 34 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/reload-lock-wait-followers_2026-09-29-19-00.json
 create mode 100644 common/changes/@rushstack/rush-daemon/reload-lock-wait-followers_2026-09-29-19-00.json

diff --git a/common/changes/@rushstack/rush-daemon-protocol/reload-lock-wait-followers_2026-09-29-19-00.json b/common/changes/@rushstack/rush-daemon-protocol/reload-lock-wait-followers_2026-09-29-19-00.json
new file mode 100644
index 0000000000..791e50ffda
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/reload-lock-wait-followers_2026-09-29-19-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Document that a queue position with `nativeLockHolder` is also sent, with the request's own position, to a request that waits behind another request's load or reload of the workspace graph while that waits for another Rush process to release the repository's lock.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/reload-lock-wait-followers_2026-09-29-19-00.json b/common/changes/@rushstack/rush-daemon/reload-lock-wait-followers_2026-09-29-19-00.json
new file mode 100644
index 0000000000..8b9f2ca0f1
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/reload-lock-wait-followers_2026-09-29-19-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A request that waits behind a reload of the workspace graph, while the reload waits for another Rush process, such as `rush install`, to release the repository's lock, now names that process, as the reload does: its queue positions carry the process, and so does its failure when its wait timeout ends. Before, it got only its queue position, and its failure said only that it waited for another request's load or reload of the workspace graph.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 904eb67e5e..db67392984 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -48,7 +48,9 @@ export interface IDaemonRequestQueuePositionMessage {
     readonly restartsForAnotherRequest?: boolean;
     /**
      * Set while the request waits for a Rush process that the daemon does not run to release the repository's
-     * lock, rather than for other requests. `position` is then 1. Older daemons omit it; older clients ignore it.
+     * lock. `position` is then 1 if the request waits for that process itself, rather than for other requests,
+     * or the request's own position if it waits behind another request's load or reload of the workspace graph
+     * that waits for that process. Older daemons omit it; older clients ignore it.
      */
     readonly nativeLockHolder?: IDaemonNativeLockHolder;
   };
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 58db030a6b..447f13adcb 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -196,7 +196,9 @@ fails at once, and the experimental graph request's lease does not wait. A serve
 reload that waits for such a process, since the script does not need the reload: it resolves and starts on the
 current generation at once, as it would have before the reload began, and the reload waits for it only until it
 has started. After an edit to `rush.json` or `common/config/rush/experiments.json`, the client runs it in-process
-at once instead, as it would if no reload were running.
+at once instead, as it would if no reload were running. Other requests that wait behind such a reload, such as
+builds, wait for that process too, and spend their wait timeouts meanwhile; their queue positions carry the same
+`nativeLockHolder`, with their own position, and a request whose timeout ends names the process in its failure.
 
 A client that subscribes with `supportsRequestStarted` (protocol 0.14) gets `requestStarted` once its request has left
 every queue, before anything from the request is applied. A phased batch sends it to each participant after the native
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 6ae863b8ed..bc76d437c7 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -252,19 +252,13 @@ class QueuePositionWriter {
       writeQueuePositionAsync.call(client, message);
   }
 
-  /** Reports a wait for native Rush's repository lock, which `holder` holds, as the first queue position. */
-  public enqueueNativeLockWait(holder: IDaemonNativeLockHolder): void {
-    this.#tail = this.#tail
-      .then(() =>
-        this.#writeQueuePositionAsync({
-          kind: 'queuePosition',
-          payload: { position: 1, requestId: this.#requestId, nativeLockHolder: holder }
-        })
-      )
-      .catch((error: unknown) => {
-        this.#failure ??= error;
-        this.#abortController.abort(error);
-      });
+  /**
+   * Reports a wait for native Rush's repository lock, which `holder` holds, at `position`. That is 1 for a request
+   * that waits for the lock itself, and the request's own position for one that waits behind a graph transition
+   * that waits for the lock.
+   */
+  public enqueueNativeLockWait(holder: IDaemonNativeLockHolder, position: number = 1): void {
+    this.#enqueuePayload({ position, requestId: this.#requestId, nativeLockHolder: holder });
   }
 
   public enqueue(
@@ -324,26 +318,49 @@ const reportQueuePosition: ReportQueuePosition = (writer: QueuePositionWriter, p
 
 /**
  * Reports whether a request that other requests wait behind is doing work on their behalf, such as loading the
- * workspace graph that they need.
+ * workspace graph that they need, and which Rush process it waits for while it waits for native Rush's repository
+ * lock instead.
  */
 export class AdmissionProgress {
   readonly #listeners: Set<() => void> = new Set();
+  readonly #nativeLockHolderListeners: Set<() => void> = new Set();
   #active: boolean = false;
+  #nativeLockHolder: IDaemonNativeLockHolder | undefined;
 
   public get active(): boolean {
     return this.#active;
   }
 
+  /**
+   * While the request waits for another Rush process to release native Rush's repository lock, what is known about
+   * that process.
+   */
+  public get nativeLockHolder(): IDaemonNativeLockHolder | undefined {
+    return this.#nativeLockHolder;
+  }
+
   public setActive(active: boolean): void {
     if (this.#active === active) return;
     this.#active = active;
     for (const listener of [...this.#listeners]) listener();
   }
 
+  public setNativeLockHolder(holder: IDaemonNativeLockHolder | undefined): void {
+    if (this.#nativeLockHolder === holder) return;
+    this.#nativeLockHolder = holder;
+    for (const listener of [...this.#nativeLockHolderListeners]) listener();
+  }
+
   public subscribe(listener: () => void): () => void {
     this.#listeners.add(listener);
     return () => this.#listeners.delete(listener);
   }
+
+  /** Calls `listener` whenever `nativeLockHolder` changes, until the returned function is called. */
+  public subscribeToNativeLockHolder(listener: () => void): () => void {
+    this.#nativeLockHolderListeners.add(listener);
+    return () => this.#nativeLockHolderListeners.delete(listener);
+  }
 }
 
 /**
@@ -568,6 +585,10 @@ export class RequestAdmissionController {
    * this request be admitted at once, ahead of the owner and of the requests that wait behind it; see
    * `IRequestSchedulerAcquireOptions.admitAheadOfQueue`. The lifecycle sets it for a rushx script while the owner of
    * a reload has yet to replace the current generation, which the script needs only to start.
+   *
+   * While the transition waits for another Rush process to release native Rush's repository lock, as
+   * `transition.nativeLockHolder` says, this request waits for that process too: its queue positions name the
+   * process, as the transition's own do, and so does its timeout.
    */
   public acquireBehindTransitionAsync(
     scheduler: RequestScheduler,
@@ -597,6 +618,19 @@ export class RequestAdmissionController {
       ? [this.#abortController.signal, stopWaiting]
       : [this.#abortController.signal];
     const stoppedWaiting = (): boolean => !!stopWaiting?.aborted && !this.#abortController.signal.aborted;
+    const writer: QueuePositionWriter | undefined = this.#writer;
+    let lastPosition: number | undefined;
+    const reportPosition: ReportQueuePosition = (target: QueuePositionWriter, position: number) => {
+      lastPosition = position;
+      const holder: IDaemonNativeLockHolder | undefined = transition.nativeLockHolder;
+      if (holder) target.enqueueNativeLockWait(holder, position);
+      else target.enqueue(position);
+    };
+    // The owner publishes a holder only while it holds the gate exclusively, so no request is admitted meanwhile.
+    const unsubscribe: () => void = transition.subscribeToNativeLockHolder(() => {
+      // A script that stopped waiting, to pass the transition instead, has no position to report again.
+      if (writer && lastPosition !== undefined && !stopWaiting?.aborted) reportPosition(writer, lastPosition);
+    });
     if (remainingMs === undefined || waitTimeoutMs === undefined) {
       try {
         return await this.#acquireAsync(
@@ -605,16 +639,19 @@ export class RequestAdmissionController {
           remainingMs,
           waitingFor,
           AbortSignal.any(abortSignals),
-          reportQueuePosition,
+          reportPosition,
           admitAheadOfQueue
         );
       } catch (error) {
         if (stoppedWaiting()) return undefined;
         throw error;
+      } finally {
+        unsubscribe();
       }
     }
     const exhausted: AbortController = new AbortController();
     let pausedLimitReached: boolean = false;
+    let nativeLockHolder: IDaemonNativeLockHolder | undefined;
     const budget: ProgressPausedBudget = new ProgressPausedBudget(
       remainingMs,
       Math.min(GRAPH_LOAD_WAIT_FACTOR * waitTimeoutMs, MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS),
@@ -622,6 +659,7 @@ export class RequestAdmissionController {
       (reachedPausedLimit: boolean) => {
         if (!exhausted.signal.aborted) {
           pausedLimitReached = reachedPausedLimit;
+          nativeLockHolder = transition.nativeLockHolder;
           exhausted.abort();
         }
       }
@@ -633,26 +671,30 @@ export class RequestAdmissionController {
         undefined,
         waitingFor,
         AbortSignal.any([...abortSignals, exhausted.signal]),
-        reportQueuePosition,
+        reportPosition,
         admitAheadOfQueue
       );
     } catch (error) {
       budget.stop();
       if (stoppedWaiting() && !exhausted.signal.aborted) return undefined;
       if (!exhausted.signal.aborted || this.#abortController.signal.aborted) throw error;
+      const lockWait: string = nativeLockHolder
+        ? `, which waits for ${formatNativeLockHolder(nativeLockHolder)} to release this repository's lock`
+        : '';
       // A zero timeout has no paused allowance, so it fails at once without reaching a limit worth naming.
       const message: string =
         pausedLimitReached && waitTimeoutMs > 0
           ? `The request was not admitted within ${GRAPH_LOAD_WAIT_FACTOR} times its ${waitTimeoutMs}ms wait ` +
             `timeout because ${waitingFor} was still running after ${formatSeconds(budget.pausedMs)}.`
           : `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ` +
-            `${waitingFor}` +
+            `${waitingFor}${lockWait}` +
             `${formatUncountedTime(this.#pausedMs + budget.pausedMs, 'while that request loaded the graph')}.`;
       throw new RequestSchedulerError(
         RequestSchedulerErrorCode.WaitTimeout,
         `${message} ${WAIT_LONGER_HINT}`
       );
     } finally {
+      unsubscribe();
       budget.stop();
       this.#pausedMs += budget.pausedMs;
       this.#remainingMs = budget.remainingMs;
@@ -811,8 +853,12 @@ export class RequestAdmissionController {
    * {@link RequestAdmissionController.acquireNativeLockAsync} waits for the lock with it. A caller that waits once for
    * several requests uses it directly: it tries the lock again, and then calls `update` for each request, which says
    * when the request may not wait any longer, and finally `endAsync`.
+   *
+   * With `transition`, the progress of a graph transition that the request owns, the process is also recorded there
+   * until the wait ends, so that the requests that wait behind the transition can name it too; see
+   * {@link RequestAdmissionController.acquireBehindTransitionAsync}.
    */
-  public beginNativeLockWait(): INativeLockWait {
+  public beginNativeLockWait(transition?: AdmissionProgress): INativeLockWait {
     const writer: QueuePositionWriter | undefined = this.#writer;
     const startMs: number = Date.now();
     const budgetMs: number | undefined = this.#remainingMs;
@@ -836,12 +882,14 @@ export class RequestAdmissionController {
         if (!error && !ended && key !== reportedHolder) {
           reportedHolder = key;
           writer?.enqueueNativeLockWait(holder);
+          transition?.setNativeLockHolder(holder);
         }
         return error;
       },
       endAsync: (): Promise<void> => {
         if (!ended) {
           this.#spend(Date.now() - startMs);
+          transition?.setNativeLockHolder(undefined);
           ended = writer ? writer.flushAsync() : Promise.resolve();
         }
         return ended;
@@ -852,7 +900,8 @@ export class RequestAdmissionController {
   /**
    * Takes native Rush's repository lock with `tryAcquire`, which returns undefined while another Rush process holds
    * it, and waits for that process as {@link RequestAdmissionController.beginNativeLockWait} describes. `findHolder`
-   * says which process holds the lock.
+   * says which process holds the lock, and `transition`, if the request owns a graph transition, lets the requests
+   * that wait behind it name that process too.
    *
    * @remarks
    * The lock is tried every 250ms, since native Rush does not say when it releases it, and it is released again if
@@ -860,11 +909,12 @@ export class RequestAdmissionController {
    */
   public async acquireNativeLockAsync<TLock extends { release(): void }>(
     tryAcquire: () => TLock | undefined,
-    findHolder: () => IDaemonNativeLockHolder
+    findHolder: () => IDaemonNativeLockHolder,
+    transition?: AdmissionProgress
   ): Promise<TLock> {
     let lock: TLock | undefined = tryAcquire();
     if (lock) return lock;
-    const wait: INativeLockWait = this.beginNativeLockWait();
+    const wait: INativeLockWait = this.beginNativeLockWait(transition);
     const abortSignal: AbortSignal = this.#abortController.signal;
     try {
       while (!lock) {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 9a3f7c6d7a..f203971ca4 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -927,7 +927,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   /**
    * Takes native Rush's repository lock for a reload. While another Rush process holds it, served rushx scripts pass
-   * the reload (see `#scriptPassage`), and the reload then waits until each of them has started or failed.
+   * the reload (see `#scriptPassage`), and the reload then waits until each of them has started or failed. The
+   * requests that still wait behind the reload wait for that process too, and `#transitionProgress` names it.
    */
   async #acquireReloadLockAsync(
     admission: RequestAdmissionController,
@@ -939,7 +940,8 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     try {
       return await admission.acquireNativeLockAsync(
         () => tryAcquireNativeLock(lockFolder),
-        () => findNativeLockHolder(lockFolder)
+        () => findNativeLockHolder(lockFolder),
+        this.#transitionProgress
       );
     } finally {
       await this.#scriptPassage.closeAsync();
diff --git a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
index 606d09516a..80b5cfef8f 100644
--- a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
@@ -7,8 +7,13 @@ import type {
   IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
 
-import { RequestSchedulerErrorCode } from '../RequestScheduler';
-import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import { AdmissionProgress, RequestAdmissionController } from '../WorkspaceRequestAdmission';
 
 const HOLDER: IDaemonNativeLockHolder = { pid: 4242, command: 'rush install' };
 const POLL_MS: number = 250;
@@ -101,6 +106,37 @@ function waitMessage(nativeLockHolder: IDaemonNativeLockHolder): IDaemonRequestQ
   return { kind: 'queuePosition', payload: { position: 1, requestId: 'request', nativeLockHolder } };
 }
 
+function positionMessage(
+  position: number,
+  nativeLockHolder?: IDaemonNativeLockHolder
+): IDaemonRequestQueuePositionMessage {
+  return {
+    kind: 'queuePosition',
+    payload: { position, requestId: 'request', ...(nativeLockHolder && { nativeLockHolder }) }
+  };
+}
+
+interface IAdmission {
+  settled: boolean;
+  lease?: IRequestLease;
+  error?: unknown;
+}
+
+function trackAdmission(promise: Promise<IRequestLease | undefined>): IAdmission {
+  const admission: IAdmission = { settled: false };
+  promise.then(
+    (lease: IRequestLease | undefined) => {
+      admission.settled = true;
+      admission.lease = lease;
+    },
+    (error: unknown) => {
+      admission.settled = true;
+      admission.error = error;
+    }
+  );
+  return admission;
+}
+
 describe(`${RequestAdmissionController.name} and native Rush's repository lock`, () => {
   let probe: NativeLockProbe;
 
@@ -314,3 +350,184 @@ describe(`${RequestAdmissionController.name} and native Rush's repository lock`,
     expect(probe.lock.released).toBe(true);
   });
 });
+
+describe(`${RequestAdmissionController.name} behind a graph transition that waits for the lock`, () => {
+  let probe: NativeLockProbe;
+  let scheduler: RequestScheduler;
+  let ownerLease: IRequestLease;
+  let transition: AdmissionProgress;
+
+  beforeEach(async () => {
+    jest.useFakeTimers();
+    probe = new NativeLockProbe();
+    scheduler = new RequestScheduler();
+    ownerLease = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive });
+    transition = new AdmissionProgress();
+  });
+
+  afterEach(() => {
+    ownerLease.release();
+    jest.useRealTimers();
+  });
+
+  /** The owner of the transition, which holds the gate, waits for the lock. */
+  function waitForLock(owner: ITestController): IAcquisition {
+    return track(owner.controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder, transition));
+  }
+
+  it('tells the requests that wait behind it which process it waits for, until it takes the lock', async () => {
+    const owner: ITestController = createController(undefined);
+    const first: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const second: ITestController = createController(undefined);
+    const firstAdmission: IAdmission = trackAdmission(
+      first.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const secondAdmission: IAdmission = trackAdmission(
+      second.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(first.messages).toEqual([positionMessage(1), positionMessage(1)]);
+    expect(second.messages).toEqual([positionMessage(2)]);
+
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(owner.messages).toEqual([waitMessage(HOLDER)]);
+    expect(transition.nativeLockHolder).toEqual(HOLDER);
+    expect(first.messages.slice(2)).toEqual([positionMessage(1, HOLDER)]);
+    expect(second.messages.slice(1)).toEqual([positionMessage(2, HOLDER)]);
+
+    // Another process takes the lock before the reload does.
+    await jest.advanceTimersByTimeAsync(2 * POLL_MS);
+    probe.hold({ pid: 5151 });
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(first.messages.slice(3)).toEqual([positionMessage(1, { pid: 5151 })]);
+    expect(second.messages.slice(2)).toEqual([positionMessage(2, { pid: 5151 })]);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock).toEqual({ settled: true, lock: probe.lock });
+    expect(transition.nativeLockHolder).toBeUndefined();
+    // They still wait behind the transition, but no longer for another process.
+    expect(first.messages.slice(4)).toEqual([positionMessage(1)]);
+    expect(second.messages.slice(3)).toEqual([positionMessage(2)]);
+    expect(owner.messages).toEqual([waitMessage(HOLDER), waitMessage({ pid: 5151 })]);
+    expect(firstAdmission.settled).toBe(false);
+    expect(secondAdmission.settled).toBe(false);
+
+    const messageCounts: number[] = [first.messages.length, second.messages.length];
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(firstAdmission.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect(secondAdmission.lease?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect([first.messages.length, second.messages.length]).toEqual(messageCounts);
+
+    // A later wait for the lock, by the owner of the next transition, is nothing to the requests admitted already.
+    probe.hold({ pid: 6161 });
+    const nextLock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(transition.nativeLockHolder).toEqual({ pid: 6161 });
+    expect([first.messages.length, second.messages.length]).toEqual(messageCounts);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(nextLock.lock).toBe(probe.lock);
+    firstAdmission.lease?.release();
+    secondAdmission.lease?.release();
+    for (const { controller } of [owner, first, second]) controller.dispose();
+  });
+
+  it('names the process to a request that starts waiting behind it while it waits for the lock', async () => {
+    const owner: ITestController = createController(undefined);
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const lateAdmission: IAdmission = trackAdmission(
+      late.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([positionMessage(1, HOLDER)]);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock.lock).toBe(probe.lock);
+    expect(late.messages).toEqual([positionMessage(1, HOLDER), positionMessage(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(lateAdmission.lease).toBeDefined();
+    lateAdmission.lease?.release();
+    owner.controller.dispose();
+    late.controller.dispose();
+  });
+
+  it('names the process in the timeout of a request that waits behind it', async () => {
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    // The owner loads the graph first, which does not count against the follower's timeout.
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(900);
+    transition.setActive(false);
+    waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(1999);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 2000ms wait timeout while waiting for another request's load " +
+        'or reload of the workspace graph, which waits for another Rush process (PID 4242: rush install) to ' +
+        "release this repository's lock; 0.9s spent while that request loaded the graph did not count. " +
+        'Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the process in a later timeout once it has taken the lock', async () => {
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(4 * POLL_MS);
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock.lock).toBe(probe.lock);
+    await jest.advanceTimersByTimeAsync(2000 - 5 * POLL_MS - 1);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 2000ms wait timeout while waiting for another request's load " +
+        'or reload of the workspace graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER), positionMessage(1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the process to a script that stopped waiting to pass it', async () => {
+    const owner: ITestController = createController(undefined);
+    const script: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const stopWaiting: AbortController = new AbortController();
+    const admission: IAdmission = trackAdmission(
+      script.controller.acquireBehindTransitionAsync(scheduler, transition, false, stopWaiting.signal)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(script.messages).toEqual([positionMessage(1)]);
+
+    // As the lifecycle does: the passage opens, and then the owner waits for the lock in the same turn.
+    stopWaiting.abort();
+    waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission).toEqual({ settled: true, lease: undefined });
+    expect(owner.messages).toEqual([waitMessage(HOLDER)]);
+    expect(script.messages).toEqual([positionMessage(1)]);
+    owner.controller.dispose();
+    script.controller.dispose();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
index 6b7b86585b..7fa2a7b352 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
@@ -8,7 +8,8 @@ import {
   decodeDaemonControlMessage,
   type DaemonControlMessage,
   type IDaemonFrame,
-  type IDaemonNativeLockHolder
+  type IDaemonNativeLockHolder,
+  type IDaemonRequestQueuePositionMessage
 } from '@rushstack/rush-daemon-protocol';
 
 import {
@@ -17,7 +18,11 @@ import {
   type INativeCommand,
   type INativeScriptGate
 } from './NativeEngineTestCommands';
-import { createWireEnvelope, DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import {
+  createWireEnvelope,
+  DaemonRequestWireClient,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
 import {
   createFixtureAsync,
   requestEnvironment,
@@ -119,7 +124,8 @@ describe('native production daemon engine, while a native Rush action holds the
       await sendRequestAsync(fixture, 'loading', ['build', '--only', 'b']);
       await readNativeLockHolderAsync(fixture.client, 'loading');
 
-      // Waiting for another Rush process is contention, not progress that pauses the followers' wait timeouts.
+      // Waiting for another Rush process is contention, not progress that pauses the followers' wait timeouts. The
+      // followers wait for that process too, and are told which it is (#308).
       behind = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
       await behind.handshakeAsync();
       await behind.sendControlAsync({
@@ -131,16 +137,22 @@ describe('native production daemon engine, while a native Rush action holds the
           commandOrigin: 'built-in'
         })
       });
-      expect((await behind.readTerminalAsync('behind')).terminal).toMatchObject({
+      const nativeLockHolder: IDaemonNativeLockHolder = getExpectedHolder(first.native);
+      const exchange: ITerminalExchange = await behind.readTerminalAsync('behind');
+      expect(exchange.terminal).toMatchObject({
         kind: 'requestResult',
         payload: {
           exitCode: 1,
           admissionErrorCode: 'wait-timeout',
-          errorMessage: expect.stringMatching(
-            /^The request was not admitted within its 1000ms wait timeout while waiting for another request's load/
-          )
+          errorMessage:
+            "The request was not admitted within its 1000ms wait timeout while waiting for another request's load " +
+            `or reload of the workspace graph, which waits for ${formatNativeLockHolder(nativeLockHolder)} to ` +
+            "release this repository's lock. Use --wait-timeout <seconds> to wait longer."
         }
       });
+      expect(getQueuePositionPayloads(exchange)).toEqual([
+        { position: 1, requestId: 'behind', nativeLockHolder }
+      ]);
 
       await first.gate.releaseAsync();
       expect(await first.native.result).toMatchObject({ exitCode: 0 });
@@ -248,6 +260,15 @@ async function sendRequestAsync(fixture: IFixture, requestId: string, argv: stri
   });
 }
 
+function getQueuePositionPayloads(
+  exchange: ITerminalExchange
+): IDaemonRequestQueuePositionMessage['payload'][] {
+  return exchange.frames
+    .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.controlJson)
+    .map((frame: IDaemonFrame) => decodeDaemonControlMessage(frame.payload))
+    .flatMap((message: DaemonControlMessage) => (message.kind === 'queuePosition' ? [message.payload] : []));
+}
+
 /** Reads frames until the daemon says that the request waits for native Rush's repository lock. */
 async function readNativeLockHolderAsync(
   client: DaemonRequestWireClient,
diff --git a/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
index d2ed4fb5c9..3e9b564945 100644
--- a/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
+++ b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
@@ -7,6 +7,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 
+import { formatNativeLockHolder } from '@rushstack/rush-client-core';
 import {
   DaemonFrameType,
   decodeDaemonControlMessage,
@@ -346,6 +347,8 @@ describe('a served rushx script while a reload waits for another Rush process',
       expect(countScriptRuns(fixture)).toBe(1);
       expect(reload.settled()).toBe(false);
       expect(fixture.host.workspaceGeneration).toBe(generation);
+      // It passed the reload as soon as the reload began to wait, so it was never told to wait for the holder.
+      expect(script.positionPayloads.filter((p) => p.nativeLockHolder !== undefined)).toEqual([]);
 
       await holder.releaseAsync();
       expectSuccess(await reload.exchange);
@@ -456,3 +459,52 @@ describe('a served rushx script while a reload waits for another Rush process',
     }
   });
 });
+
+describe('a served build that waits behind a reload that waits for another Rush process', () => {
+  it('is told which process the reload waits for, and its wait timeout names that process', async () => {
+    const fixture: DaemonGraphTestFixture = await createFixtureAsync();
+    let holder: ILockHolder | undefined;
+    try {
+      expectSuccess(await fixture.runAsync(BUILD_A));
+      holder = await holdRepositoryLockAsync(fixture);
+      const reload: IStreamedRequest = await startReloadAsync(fixture);
+      await waitForLockWaitAsync(reload, holder);
+      const nativeLockHolder: IDaemonNativeLockHolder = getExpectedHolder(holder);
+
+      // Its client used to be told only its position, and its timeout named only the reload (#308).
+      const short: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: 2000 }
+      });
+      expect((await short.exchange).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: {
+          exitCode: 1,
+          admissionErrorCode: 'wait-timeout',
+          errorMessage:
+            "The request was not admitted within its 2000ms wait timeout while waiting for another request's " +
+            `load or reload of the workspace graph, which waits for ${formatNativeLockHolder(nativeLockHolder)} ` +
+            "to release this repository's lock. Use --wait-timeout <seconds> to wait longer."
+        }
+      });
+      expect(short.positionPayloads).toEqual([
+        { position: 1, requestId: expect.any(String), nativeLockHolder }
+      ]);
+
+      const long: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+        admission: { waitTimeoutMs: RELOAD_WAIT_TIMEOUT_MS }
+      });
+      await waitForAsync(() => long.positionPayloads.length > 0, 'the build to wait behind the reload');
+      await holder.releaseAsync();
+      expectSuccess(await reload.exchange);
+      expectSuccess(await long.exchange);
+      // Once the reload has the lock, the build still waits for the reload, but not for another process.
+      expect(long.positionPayloads).toEqual([
+        { position: 1, requestId: expect.any(String), nativeLockHolder },
+        { position: 1, requestId: expect.any(String) }
+      ]);
+    } finally {
+      await holder?.releaseAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});

From 7ea7e3b11232ba8d822f54b8fffbc6e11b092c5a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:22 +0000
Subject: [PATCH 219/265] [rush-lib] Let a long-lived operation graph extend
 its current iteration with the work of a later request (and 4 more)

Swarm integration step 204; original commit 026d62c061 (merge of swarm/r05-t109-e2g at 03aa040779).
Scope: task 109c, re-cut on E2f.

Brings 109c (branch swarm/r05-t109-e2g). Second agent: NB2: ch03 board 6543, board 6544; R: ch03 board 7138, board 7140. Evidence: ch01's GATE OK board 7438.

Batch E2g, item 6 of 7. Gate: ch01 GATE OK board 7438 (tree f19307a5fa)

Commits folded into this step (5):
- a078bc9a79 [rush-lib] Let a long-lived operation graph extend its current iteration with the work of a later request
- 26c7432a3d [rush-lib] Correct the docs of tryExtendCurrentIteration and the iteration hooks
- 0b70aca357 [rush-daemon] Let a build request join the iteration of a running batch
- 3973fbed9a [rush-lib] Add the daemon setting joinRunningBatch
- 38f99a928d [rush-daemon] Read the join setting from the daemon configuration

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |    1 +
 ...running-batch-option_2026-09-29-17-55.json |   11 +
 ...in-running-iteration_2026-09-29-14-20.json |   11 +
 ...running-batch-option_2026-09-29-17-55.json |   11 +
 ...in-running-iteration_2026-09-29-17-05.json |   11 +
 common/reviews/api/rush-daemon.api.md         |   20 +
 common/reviews/api/rush-lib.api.md            |   25 +
 docs/rush/environment-variables.md            |    1 +
 libraries/rush-daemon/README.md               |   12 +
 .../rush-daemon/src/DaemonRequestTelemetry.ts |    1 +
 .../src/OperationOutputFingerprints.ts        |   96 +-
 .../rush-daemon/src/PhasedIterationDemand.ts  |    5 +
 .../rush-daemon/src/PhasedIterationJoiner.ts  |  507 ++++++
 .../src/PhasedRequestEventMultiplexer.ts      |  114 +-
 .../rush-daemon/src/PhasedRequestEventSink.ts |   47 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |  212 ++-
 .../rush-daemon/src/PhasedRequestTelemetry.ts |    5 +
 .../src/ProductionDaemonRequestResolver.ts    |   10 +-
 .../src/WorkspaceEngineComponentFactory.ts    |  260 ++-
 libraries/rush-daemon/src/WorkspaceSession.ts |   40 +
 libraries/rush-daemon/src/WorkspaceWarmSet.ts |   88 +-
 libraries/rush-daemon/src/index.ts            |    2 +
 .../test/NativeEngineInvalidationPeek.test.ts |   67 +
 .../test/OperationOutputFingerprints.test.ts  |  166 +-
 .../src/test/PhasedIterationDemand.test.ts    |   22 +
 .../PhasedRequestEventMultiplexer.test.ts     |  160 +-
 .../src/test/PhasedRequestEventSink.test.ts   |   96 +-
 .../src/test/PhasedRequestJoin.test.ts        | 1465 +++++++++++++++++
 .../src/test/PhasedRequestTelemetry.test.ts   |   24 +-
 .../WorkspaceEngineComponentFactory.test.ts   |  288 +++-
 .../src/test/WorkspaceSession.test.ts         |   10 +-
 .../src/test/WorkspaceWarmSet.test.ts         |   75 +-
 .../WorkspaceWarmSetMaintenanceCost.test.ts   |    1 +
 .../rush-lib/src/api/DaemonConfiguration.ts   |   12 +-
 .../src/api/EnvironmentConfiguration.ts       |    3 +
 .../src/api/test/DaemonConfiguration.test.ts  |   17 +-
 libraries/rush-lib/src/index.ts               |    2 +
 .../logic/operations/AsyncOperationQueue.ts   |  152 +-
 .../operations/CacheableOperationPlugin.ts    |  132 +-
 .../src/logic/operations/IOperationGraph.ts   |  104 ++
 .../IncrementalExecutionGuardPlugin.ts        |   53 +-
 .../src/logic/operations/LegacySkipPlugin.ts  |  111 +-
 .../operations/OperationExecutionRecord.ts    |  125 +-
 .../src/logic/operations/OperationGraph.ts    |  334 +++-
 .../test/AsyncOperationQueue.test.ts          |  172 ++
 .../test/CacheableOperationPlugin.test.ts     |  208 ++-
 .../IncrementalExecutionGuardPlugin.test.ts   |  147 +-
 .../test/OperationGraphExtension.test.ts      |  647 ++++++++
 .../test/OperationGraphStateHash.test.ts      |   48 +
 .../pluginFramework/OperationGraphHooks.ts    |   24 +-
 .../rush-lib/src/schemas/rush.schema.json     |    5 +
 51 files changed, 5824 insertions(+), 336 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/join-running-batch-option_2026-09-29-17-55.json
 create mode 100644 common/changes/@microsoft/rush/join-running-iteration_2026-09-29-14-20.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/join-running-batch-option_2026-09-29-17-55.json
 create mode 100644 common/changes/@rushstack/rush-daemon/join-running-iteration_2026-09-29-17-05.json
 create mode 100644 libraries/rush-daemon/src/PhasedIterationJoiner.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
 create mode 100644 libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 2567064e06..db824bf62e 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -501,6 +501,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `usePersistentIpcRunners` | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | false | Enables explicit per-operation `daemonIpc` Node launchers for unsharded incremental daemon builds |
 | `incrementalBuilds` | `RUSH_DAEMON_INCREMENTAL_BUILDS` | true | Runs an operation's `<phase>:incremental` script instead of its initial script when only files it builds were edited since its last successful run in the daemon and its output folders are unchanged. Additions, deletions, renames, configuration, tool, environment and command-line changes, bundled outputs, cache restores and native Rush commands run the initial script. Incremental results are never written to the build cache |
 | `warmWorkers` | `RUSH_DAEMON_WARM_WORKERS` | false | With `incrementalBuilds`, keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run. Opt in only if that script runs every task and check that the initial script runs, for Heft including lint and API Extractor. When an incremental run is not allowed, the worker is closed and the initial script runs. Workers count toward `warmMemoryBudgetMB` and `warmSetMaxProjects`, so raise both to keep them alive |
+| `joinRunningBatch` | `RUSH_DAEMON_JOIN_RUNNING_BATCH` | false | Experimental. A build request that arrives while the daemon executes an incremental batch with the same request settings adds its operations to the executing iteration and gets its result once they complete, instead of waiting for the iteration to end. When the iteration can't take its work, the request waits as before |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
 | `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
 | `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
diff --git a/common/changes/@microsoft/rush/join-running-batch-option_2026-09-29-17-55.json b/common/changes/@microsoft/rush/join-running-batch-option_2026-09-29-17-55.json
new file mode 100644
index 0000000000..c2f9b16e1b
--- /dev/null
+++ b/common/changes/@microsoft/rush/join-running-batch-option_2026-09-29-17-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `daemon.joinRunningBatch` (or `RUSH_DAEMON_JOIN_RUNNING_BATCH=1`), an experimental Rush daemon setting that is off by default. With it, a daemon build request that arrives while the daemon executes an incremental batch with the same request settings adds its operations to the executing iteration, instead of waiting for the iteration to end.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@microsoft/rush/join-running-iteration_2026-09-29-14-20.json b/common/changes/@microsoft/rush/join-running-iteration_2026-09-29-14-20.json
new file mode 100644
index 0000000000..49eeda4348
--- /dev/null
+++ b/common/changes/@microsoft/rush/join-running-iteration_2026-09-29-14-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add an alpha API that lets a long-lived operation graph, like that of the Rush daemon, hold the operations that no enabled operation needs until the others complete, and extend its current iteration with the operations that a later request needs. CacheableOperationPlugin, LegacySkipPlugin and IncrementalExecutionGuardPlugin read the inputs of those operations from the inputs snapshot of the later request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/join-running-batch-option_2026-09-29-17-55.json b/common/changes/@rushstack/rush-cli-client/join-running-batch-option_2026-09-29-17-55.json
new file mode 100644
index 0000000000..dc2cf23621
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/join-running-batch-option_2026-09-29-17-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the `joinRunningBatch` daemon setting and `RUSH_DAEMON_JOIN_RUNNING_BATCH`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/join-running-iteration_2026-09-29-17-05.json b/common/changes/@rushstack/rush-daemon/join-running-iteration_2026-09-29-17-05.json
new file mode 100644
index 0000000000..86a19c9dae
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/join-running-iteration_2026-09-29-17-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Add an experimental mode, enabled by the Rush daemon setting `daemon.joinRunningBatch` (or `RUSH_DAEMON_JOIN_RUNNING_BATCH=1`), in which a build request that arrives while an incremental batch with the same request settings executes adds its operations to the executing iteration, and gets its result when they complete, instead of waiting for the iteration to end. Without the setting, requests wait for the executing iteration as before.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 4272231e74..975317de8a 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -28,6 +28,7 @@ import type { IDaemonTerminalPolicyResult } from '@rushstack/rush-daemon-protoco
 import type { IDaemonWarmSetStatus } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 import type { IInputsSnapshot } from '@microsoft/rush-lib';
+import type { IOperationExecutionResult } from '@microsoft/rush-lib';
 import { IOperationGraph } from '@microsoft/rush-lib';
 import type { IPhasedCommandEngineRequestSettings } from '@microsoft/rush-lib';
 import type { IPhasedCommandEngineTelemetryRecord } from '@microsoft/rush-lib';
@@ -379,6 +380,7 @@ export interface IMapWorkspaceInvalidationsOptions {
     readonly changedPaths: ReadonlyArray<string>;
     // (undocumented)
     readonly currentInputsSnapshot: IInputsSnapshot;
+    readonly executingIterationRecords?: ReadonlyMap<Operation, IOperationExecutionResult>;
     // (undocumented)
     readonly nextInputsSnapshot: IInputsSnapshot;
     // (undocumented)
@@ -406,6 +408,11 @@ export class InteractiveRequestInputRouter {
     routeStdinFrameAsync(payload: Uint8Array): Promise<void>;
 }
 
+// @beta
+export interface IPeekWorkspaceInvalidationsOptions {
+    readonly executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>;
+}
+
 // @beta
 export interface IPhasedRequestClient {
     readonly abortSignal: AbortSignal;
@@ -437,6 +444,7 @@ export interface IPhasedRequestTelemetryReport {
     readonly earlyResult: boolean;
     readonly executionStartTimeMs: number;
     readonly iterationStartTimeMs: number | undefined;
+    readonly joinedIteration?: boolean;
     readonly measures: ReadonlyArray<IPhasedRequestTelemetryMeasure>;
     readonly receivedTimeMs: number;
     readonly records: ReadonlyMap<Operation, IPhasedCommandEngineTelemetryRecord>;
@@ -604,6 +612,15 @@ export interface IWorkspaceEngineShape {
     readonly pluginNames: ReadonlyArray<string>;
 }
 
+// @beta
+export interface IWorkspaceInvalidationPeek {
+    commit(): void;
+    discard(): void;
+    readonly inputsSnapshot: IInputsSnapshot;
+    readonly invalidatedOperations: ReadonlySet<Operation>;
+    readonly invalidationReason: string;
+}
+
 // @beta
 export interface IWorkspaceInvalidationReconciliation {
     // (undocumented)
@@ -674,6 +691,7 @@ export interface IWorkspaceSession extends AsyncDisposable {
     readonly metadata: IWorkspaceSessionMetadata;
     // (undocumented)
     readonly operationGraph: IOperationGraph | undefined;
+    peekInvalidationsAsync?(options: IPeekWorkspaceInvalidationsOptions): Promise<IWorkspaceInvalidationPeek | undefined>;
     quiesceWarmSetAsync?(): Promise<void>;
     // (undocumented)
     reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined>;
@@ -695,6 +713,7 @@ export interface IWorkspaceSessionComponents extends AsyncDisposable {
     readonly inputsSnapshot?: IInputsSnapshot;
     // (undocumented)
     readonly operationGraph?: IOperationGraph;
+    readonly peekInvalidationsAsync?: (options: IPeekWorkspaceInvalidationsOptions) => Promise<IWorkspaceInvalidationPeek | undefined>;
     readonly projectWatcher?: IWorkspaceInvalidationWatcher;
     // (undocumented)
     readonly reconcileInvalidationsAsync?: () => Promise<IWorkspaceInvalidationReconciliation>;
@@ -912,6 +931,7 @@ export class WorkspaceSession implements IWorkspaceSession {
     readonly metadata: IWorkspaceSessionMetadata;
     // (undocumented)
     get operationGraph(): IOperationGraph | undefined;
+    peekInvalidationsAsync(options: IPeekWorkspaceInvalidationsOptions): Promise<IWorkspaceInvalidationPeek | undefined>;
     // (undocumented)
     quiesceWarmSetAsync(): Promise<void>;
     reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined>;
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 761ad531c3..a0c95b23dd 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -325,6 +325,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: "RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS";
     readonly RUSH_DAEMON_INCREMENTAL_BUILDS: "RUSH_DAEMON_INCREMENTAL_BUILDS";
     readonly RUSH_DAEMON_WARM_WORKERS: "RUSH_DAEMON_WARM_WORKERS";
+    readonly RUSH_DAEMON_JOIN_RUNNING_BATCH: "RUSH_DAEMON_JOIN_RUNNING_BATCH";
     readonly RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: "RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS: "RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
@@ -538,6 +539,7 @@ export interface IDaemonConfigurationJson {
     readonly enabled?: boolean;
     readonly idleTimeoutSeconds?: number;
     readonly incrementalBuilds?: boolean;
+    readonly joinRunningBatch?: boolean;
     readonly queueTimeoutSeconds?: number;
     readonly usePersistentIpcRunners?: boolean;
     readonly warmIdleTimeoutSeconds?: number;
@@ -779,10 +781,12 @@ export interface IOperationGraph {
     quietMode: boolean;
     removeTerminalDestination(destination: TerminalWritable, close?: boolean): boolean;
     readonly resultByOperation: ReadonlyMap<Operation, IOperationExecutionResult>;
+    retainHeldOperations?(): (() => void) | undefined;
     scheduleIterationAsync(options: IOperationGraphIterationOptions): Promise<boolean>;
     setEnabledStates(operations: Iterable<Operation>, targetState: Operation['enabled'], mode: 'safe' | 'unsafe'): boolean;
     readonly status: OperationStatus;
     readonly terminalDestinations: ReadonlySet<TerminalWritable>;
+    tryExtendCurrentIteration?(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult;
 }
 
 // @alpha
@@ -803,13 +807,30 @@ export interface _IOperationGraphEventSink {
     onOperationStreamClosed?(operationId: string, result?: IOperationExecutionResult, iterationId?: number): void;
 }
 
+// @alpha
+export interface IOperationGraphExtensionOptions {
+    readonly inputsSnapshot: IInputsSnapshot;
+    readonly invalidatedOperations?: Iterable<Operation>;
+    readonly invalidationReason?: string;
+    readonly neededOperations: Iterable<Operation>;
+}
+
+// @alpha
+export interface IOperationGraphExtensionResult {
+    readonly changedOperations: ReadonlySet<Operation>;
+    readonly extended: boolean;
+    readonly reason?: string;
+}
+
 // @alpha
 export interface IOperationGraphIterationOptions {
     getOperationEnvironment?: (operation: Operation) => Readonly<Record<string, string | undefined>>;
     getOperationRequestId?: (operation: Operation) => string | undefined;
+    holdUnneededOperations?: boolean;
     // (undocumented)
     inputsSnapshot?: IInputsSnapshot;
     isIncrementalBuildAllowed?: boolean;
+    startedOperations?: ReadonlySet<Operation>;
     startTime?: number;
 }
 
@@ -1461,6 +1482,10 @@ export class OperationGraphHooks {
     IEnvironment,
     IOperationRunnerContext & IOperationExecutionResult
     ]>;
+    readonly extendIteration: SyncHook<[
+    ReadonlyMap<Operation, IOperationExecutionResult>,
+    IOperationGraphIterationOptions
+    ]>;
     readonly onEnableStatesChanged: SyncHook<[ReadonlySet<Operation>]>;
     readonly onExecutionStatesUpdated: SyncHook<[ReadonlySet<IOperationExecutionResult>]>;
     readonly onGraphStateChanged: SyncHook<[IOperationGraph]>;
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 0144927f44..184702249d 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -29,6 +29,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS` | `0` | Enable explicitly configured `operationSettings[].daemonIpc` Node workers for supported incremental daemon builds. Does not convert arbitrary shell scripts into persistent workers. Overrides `usePersistentIpcRunners`. |
 | `RUSH_DAEMON_INCREMENTAL_BUILDS` | `1` | Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. `0` always runs the initial script. Incremental results are never written to the build cache. Overrides `incrementalBuilds`. |
 | `RUSH_DAEMON_WARM_WORKERS` | `0` | With `RUSH_DAEMON_INCREMENTAL_BUILDS`, keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and send it the next incremental run. The worker keeps its last build in memory, so it rebuilds only what changed. When an incremental run is not allowed, the worker is closed and the initial script runs, in a new worker if the project defines `<phase>:ipc`. Workers count toward `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` and `RUSH_DAEMON_WARM_SET_MAX_PROJECTS`. Over either limit the daemon closes them and drops their projects' last results, so raise both for the workers to stay alive. Overrides `warmWorkers`. |
+| `RUSH_DAEMON_JOIN_RUNNING_BATCH` | `0` | Experimental. Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Operations that both requests need run once. If the iteration can't take the request's work, for example because an operation that the request needs started before its inputs changed, the request waits for the iteration to end as before. Overrides `joinRunningBatch`. |
 | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
 | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 447f13adcb..854460ce9e 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -678,6 +678,18 @@ client in that batch has stopped needing it, or once every operation that a rema
 work that only departed clients needed is still running. In the latter case the running operations are terminated, so
 neither the remaining client's result nor later requests wait for work that nobody needs.
 
+With the experimental `daemon.joinRunningBatch` setting (`RUSH_DAEMON_JOIN_RUNNING_BATCH=1` in the daemon's
+environment), a request admitted after scheduling starts can instead join the executing iteration, if it has the
+batch's request settings and no other request waits for the graph. Such a batch's iteration holds the operations that
+no participant needs, instead of skipping them, until its other operations complete. When a request joins, the router
+reads its inputs again, and the graph adds its operations to the executing iteration (`tryExtendCurrentIteration`),
+so that operations that both requests need run once. The request then takes part in the batch like any other
+participant, but does not receive output that operations wrote before it joined. If the graph can't take the
+request's work, for example because an operation that the request needs started before its inputs changed, nothing
+changes and the request runs in a later batch as before. The daemon writes one line per attempt to its stderr:
+`Request <id> joined the executing iteration after <n> ms.` or `Request <id> did not join the executing iteration
+after <n> ms: <reason>`.
+
 The typed phased router remains separate from native initialization. `ProductionDaemonRequestResolver` supplies
 validated exact selections from `PhasedCommandEngine`; other integrations retain the existing dependency-closure
 selection mode by default. Native empty project selections are successful no-op requests.
diff --git a/libraries/rush-daemon/src/DaemonRequestTelemetry.ts b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
index d3b5d8f4f5..29cbb1a3ae 100644
--- a/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
+++ b/libraries/rush-daemon/src/DaemonRequestTelemetry.ts
@@ -140,6 +140,7 @@ function getDaemonExtraData(
     persistentIpcRunners: workspaceSession.rushConfiguration.daemon.usePersistentIpcRunners,
     scheduled: report.scheduled,
     earlyResult: report.earlyResult,
+    ...(report.joinedIteration ? { joinedIteration: true } : {}),
     countRetained: report.countRetained,
     exitCode: report.result.exitCode,
     outcome: report.result.outcome
diff --git a/libraries/rush-daemon/src/OperationOutputFingerprints.ts b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
index e592607282..6128f57721 100644
--- a/libraries/rush-daemon/src/OperationOutputFingerprints.ts
+++ b/libraries/rush-daemon/src/OperationOutputFingerprints.ts
@@ -81,6 +81,13 @@ interface IEarlyWalk {
   inputsSnapshot: IInputsSnapshot | undefined;
 }
 
+/** The output folders that a plan of the executing iteration for another request's work walked. */
+interface IExtensionWalks {
+  /** The options of the plan, which `extendIteration` receives again if the graph accepts it. */
+  readonly context: IOperationGraphIterationOptions;
+  readonly operations: ReadonlyArray<Operation>;
+}
+
 /**
  * Detects retained successful or up-to-date operations whose declared output folders were changed outside
  * the daemon.
@@ -112,12 +119,17 @@ export class OperationOutputFingerprints {
   readonly #graph: IOperationGraph;
   /** The operations whose output folders the last iteration walked. The next one probably walks them again. */
   #lastWalkedOperations: Set<Operation> = new Set();
+  /** The walks of a plan of the executing iteration for another request's work, until the graph accepts it. */
+  #extensionWalks: IExtensionWalks | undefined;
   #earlyWalk: IEarlyWalk | undefined;
   /** The walks of results that this iteration recorded when Rush reported them, one folder set at a time. */
   #recordedWalkCount: number = 0;
   #recordedWalkMs: number = 0;
 
-  public constructor(graph: IOperationGraph, digester: OutputFolderDigester = getSharedOutputFolderDigester()) {
+  public constructor(
+    graph: IOperationGraph,
+    digester: OutputFolderDigester = getSharedOutputFolderDigester()
+  ) {
     this.#digester = digester;
     this.#graph = graph;
     graph.hooks.configureIteration.tap(
@@ -127,7 +139,35 @@ export class OperationOutputFingerprints {
         lastResults: ReadonlyMap<Operation, IOperationExecutionResult>,
         context: IOperationGraphIterationOptions
       ) => {
-        this.#enableOperationsWithChangedContents(currentStates, this.#takeEarlyWalk(context));
+        const { startedOperations } = context;
+        if (startedOperations) {
+          // The graph can still refuse this plan of the executing iteration for another request's work. The early
+          // walk belongs to the reconciliation that starts the next iteration.
+          this.#extensionWalks = {
+            context,
+            operations: this.#enableOperationsWithChangedContents(currentStates, undefined, startedOperations)
+          };
+        } else {
+          this.#extensionWalks = undefined;
+          this.#lastWalkedOperations = new Set(
+            this.#enableOperationsWithChangedContents(currentStates, this.#takeEarlyWalk(context), undefined)
+          );
+        }
+      }
+    );
+    graph.hooks.extendIteration.tap(
+      PLUGIN_NAME,
+      (
+        records: ReadonlyMap<Operation, IOperationExecutionResult>,
+        context: IOperationGraphIterationOptions
+      ) => {
+        const walks: IExtensionWalks | undefined = this.#extensionWalks;
+        this.#extensionWalks = undefined;
+        if (walks?.context === context) {
+          for (const operation of walks.operations) {
+            this.#lastWalkedOperations.add(operation);
+          }
+        }
       }
     );
     graph.hooks.afterExecuteOperationAsync.tap(
@@ -206,19 +246,54 @@ export class OperationOutputFingerprints {
   }
 
   /**
-   * Enables each selected operation that Rush would skip if any entry below its output folders changed.
+   * Returns the retained operations whose output folders no longer match the recorded fingerprint, as
+   * {@link OperationOutputFingerprints.getOperationsWithChangedOutputs} does, for adding another request's work
+   * to the executing iteration with the given records.
+   *
+   * @remarks
+   * Every fingerprint is kept, so that the next reconciliation checks the outputs again if the caller does not
+   * invalidate the returned operations. An operation that the iteration dispatched may be writing its outputs,
+   * and one that it runs produces new outputs anyway, so neither is checked.
+   */
+  public peekOperationsWithChangedOutputs(
+    iterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>
+  ): Operation[] {
+    const changed: Operation[] = [];
+    for (const [operation, { record, fingerprint }] of this.#fingerprints) {
+      const iterationRecord: IOperationExecutionResult | undefined = iterationRecords.get(operation);
+      if (
+        (!iterationRecord || (!iterationRecord.enabled && isUndispatched(iterationRecord))) &&
+        this.#isRetained(operation, record) &&
+        getOutputFingerprint(operation) !== fingerprint
+      ) {
+        // Once invalidated, the operation must run instead of skipping because its input state is unchanged
+        forgetLegacySkipState(operation);
+        changed.push(operation);
+      }
+    }
+    return changed;
+  }
+
+  /**
+   * Enables each selected operation that Rush would skip if any entry below its output folders changed, and returns
+   * the operations whose output folders it walked.
    *
    * @remarks
    * The recorded fingerprint is kept until the operation produces a new retained result, so an iteration
-   * that ends before the operation runs leaves the check in place for the next request.
+   * that ends before the operation runs leaves the check in place for the next request. When the executing
+   * iteration is planned again for another request's work, the operations that it already dispatched are not
+   * checked: they are no longer affected by the plan. If the graph refuses that plan, an operation that the plan
+   * enabled has already lost its legacy skip state. That can only make the operation run instead of skipping, and
+   * unless its outputs are restored, the next plan finds the same change.
    */
   #enableOperationsWithChangedContents(
     currentStates: ReadonlyMap<Operation, IConfigurableOperation>,
-    earlyWalk: IEarlyWalk | undefined
-  ): void {
+    earlyWalk: IEarlyWalk | undefined,
+    startedOperations: ReadonlySet<Operation> | undefined
+  ): Operation[] {
     const checks: ISkipCheck[] = [];
     for (const [operation, state] of currentStates) {
-      if (state.enabled || !operation.enabled) {
+      if (state.enabled || !operation.enabled || startedOperations?.has(operation)) {
         continue;
       }
       const entry: IOutputFingerprint | undefined = this.#fingerprints.get(operation);
@@ -233,13 +308,14 @@ export class OperationOutputFingerprints {
         checks.push({ operation, folderSet, entryCount, state, contentFingerprint });
       }
     }
-    this.#lastWalkedOperations = new Set(checks.map(({ operation }: ISkipCheck) => operation));
+    const walkedOperations: Operation[] = checks.map(({ operation }: ISkipCheck) => operation);
     const digests: IOutputFolderDigest[] = this.#digestLargestFirst(checks, earlyWalk);
     checks.forEach(({ operation, state, contentFingerprint }: ISkipCheck, index: number) => {
       if (digests[index].digest !== contentFingerprint) {
         enableOperation(operation, state);
       }
     });
+    return walkedOperations;
   }
 
   /**
@@ -374,6 +450,10 @@ export class OperationOutputFingerprints {
   }
 }
 
+function isUndispatched(record: IOperationExecutionResult): boolean {
+  return record.status === OperationStatus.Waiting || record.status === OperationStatus.Ready;
+}
+
 function enableOperation(operation: Operation, state: IConfigurableOperation): void {
   forgetLegacySkipState(operation);
   state.enabled = true;
diff --git a/libraries/rush-daemon/src/PhasedIterationDemand.ts b/libraries/rush-daemon/src/PhasedIterationDemand.ts
index 8e6f3d129b..6b3526b930 100644
--- a/libraries/rush-daemon/src/PhasedIterationDemand.ts
+++ b/libraries/rush-daemon/src/PhasedIterationDemand.ts
@@ -48,6 +48,11 @@ export class PhasedIterationDemand implements IRequestEventSink {
     return this.#abandoned;
   }
 
+  /** Whether the tracker was armed; see {@link PhasedIterationDemand.restrictTo}. */
+  public get restricted(): boolean {
+    return this.#needed !== undefined;
+  }
+
   /**
    * Arms the tracker with, or narrows it to, the operations that the remaining clients still need.
    */
diff --git a/libraries/rush-daemon/src/PhasedIterationJoiner.ts b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
new file mode 100644
index 0000000000..22fddf0477
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
@@ -0,0 +1,507 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  IOperationExecutionResult,
+  IOperationGraph,
+  IOperationGraphExtensionResult,
+  Operation
+} from '@microsoft/rush-lib';
+import { EnvironmentVariableNames, OperationStatus } from '@microsoft/rush-lib';
+import type { IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+
+import type { PhasedIterationDemand } from './PhasedIterationDemand';
+import type { IRequestEventSink, PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
+import type { PhasedRequestEventSink } from './PhasedRequestEventSink';
+import type {
+  IBatchEntry,
+  IBatchTimings,
+  INewBatchEntry,
+  IPreparedPhasedRequest,
+  IResolvedSelection
+} from './PhasedRequestRouter';
+import { RequestExclusivityClass } from './RequestScheduler';
+import type { IWorkspaceInvalidationPeek } from './WorkspaceEngineComponentFactory';
+import type { RequestAdmissionController } from './WorkspaceRequestAdmission';
+import type { IWorkspaceSession } from './WorkspaceSession';
+
+/**
+ * A request that joined the executing iteration, or that failed as it was about to; an object, so that awaiting it
+ * does not await its result.
+ */
+export interface IJoinedRequest {
+  readonly resultPromise: Promise<IDaemonPhasedRequestResult>;
+  /** Why the request failed before it joined, if it did. */
+  readonly failure?: string;
+}
+
+/** What a request that joins the executing iteration needs of its batch, once the iteration is scheduled. */
+export interface IJoinableBatch {
+  /** The batch's entries; a request that joins is added to them. */
+  readonly batch: IBatchEntry[];
+  readonly demand: PhasedIterationDemand;
+  /** The participants that the iteration's operations are attributed to; see `addOperationParticipant`. */
+  readonly entryByOperation: Map<Operation, IBatchEntry>;
+  /** The timings of the requests that joined, whose iteration ends with the batch's. */
+  readonly joinedTimings: IBatchTimings[];
+  /** The batch's participants; a request that joins is added to them. */
+  readonly participants: IBatchEntry[];
+  readonly timings: IBatchTimings;
+}
+
+/** The handling of batches and their entries that `PhasedIterationJoiner` shares with the batch coordinator. */
+export interface IPhasedIterationJoinHost {
+  readonly graph: IOperationGraph;
+  readonly multiplexer: PhasedRequestEventMultiplexer;
+  readonly workspaceSession: IWorkspaceSession;
+  /** Enables the operations of the selections, and disables the other operations. */
+  applySelections(selections: ReadonlyArray<IResolvedSelection>): void;
+  createEntry(
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): INewBatchEntry;
+  createRequestSink(entry: IBatchEntry): PhasedRequestEventSink;
+  /** Produces the failed result of an entry whose execution could not start. */
+  failEntry(entry: IBatchEntry, error: unknown): void;
+  /** Publishes the result of a participant whose operations are done, if another participant needs the iteration. */
+  finishSettledEntry(entry: IBatchEntry): void;
+  /** Whether a live participant still needs the current batch's iteration. */
+  hasLiveParticipant(): boolean;
+  /** Whether another request waits for the graph. */
+  hasWaitingRequest(): boolean;
+  /** Lets the client of a participant cancel its request. */
+  listenForCancellation(entry: IBatchEntry): void;
+  /** Whether a live participant still waits for the iteration to produce its result, or continues until it ends. */
+  needsIteration(entry: IBatchEntry): boolean;
+  /** Narrows the iteration to the operations that its live participants need. */
+  restrictBatchDemand(): void;
+}
+
+/**
+ * The iteration of a shared-build batch that holds the operations that none of its participants needs, so that a
+ * compatible request that arrives while the iteration executes can add its work to it; see `PhasedIterationJoiner`.
+ */
+export class JoinableIteration implements IRequestEventSink {
+  public readonly requestSettingsKey: string;
+  /** Resolves with true once the iteration dispatches an operation, or with false if the batch ends before. */
+  public readonly dispatching: Promise<boolean>;
+  public batch: IJoinableBatch | undefined;
+  public records: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+  readonly #resolveDispatching: (dispatched: boolean) => void;
+  #dispatched: boolean = false;
+
+  public constructor(requestSettingsKey: string) {
+    this.requestSettingsKey = requestSettingsKey;
+    let resolveDispatching: ((dispatched: boolean) => void) | undefined;
+    this.dispatching = new Promise<boolean>((resolve: (dispatched: boolean) => void) => {
+      resolveDispatching = resolve;
+    });
+    this.#resolveDispatching = resolveDispatching!;
+  }
+
+  public get dispatched(): boolean {
+    return this.#dispatched;
+  }
+
+  public onIterationScheduled(records: Iterable<IOperationExecutionResult>): void {
+    this.records = new Map(
+      Array.from(records, (record: IOperationExecutionResult) => [record.operation, record] as const)
+    );
+  }
+
+  public onOperationStatusChanged(record: IOperationExecutionResult): void {
+    // The graph queues an operation only once its iteration dispatches operations.
+    if (record.status === OperationStatus.Queued && !this.#dispatched) {
+      this.#dispatched = true;
+      this.#resolveDispatching(true);
+    }
+  }
+
+  public end(): void {
+    this.#resolveDispatching(false);
+  }
+}
+
+/**
+ * Adds the work of a shared-build request that arrives while the current batch's iteration executes to that
+ * iteration, so that the request does not wait for the iteration to end. Experimental; only if the daemon
+ * configuration of the workspace session enables `joinRunningBatch` (`RUSH_DAEMON_JOIN_RUNNING_BATCH=1`).
+ *
+ * @remarks
+ * The request must have the batch's request settings, and it joins only while no other request waits for the
+ * graph, so that joining requests never keep a waiting request from running. Unless its admission limits its
+ * wait, it first waits for the iteration to dispatch operations, which the batch starts after its reconcile.
+ * Then the graph holds the operations that no participant needs while the inputs are read again, and adds the
+ * request's work to the iteration under those inputs (`tryExtendCurrentIteration`). If it cannot, for example
+ * because an operation that the request needs started before its inputs changed, nothing changes and the request
+ * waits for the iteration to end as before.
+ *
+ * A request that joins takes part in the batch like any participant: its result comes as soon as its own
+ * operations are done while other participants still need the iteration. A participant whose operations were
+ * already done gets its result when a request joins, instead of when the joined work is done. The request does not
+ * receive the output that operations wrote before it joined.
+ */
+export class PhasedIterationJoiner {
+  readonly #host: IPhasedIterationJoinHost;
+  /** The current batch's iteration while requests may join it. */
+  #joinable: JoinableIteration | undefined;
+  /** Requests join the executing iteration one at a time. */
+  #joinTail: Promise<void> = Promise.resolve();
+
+  public constructor(host: IPhasedIterationJoinHost) {
+    this.#host = host;
+  }
+
+  /**
+   * Lets requests join the iteration of the batch that starts with `first`, if they can, and returns the state that
+   * the batch completes once it schedules the iteration. Requests received after the batch's reconcile starts can no
+   * longer join the batch before it executes, so they may wait for its iteration to execute and join it then.
+   */
+  public open(first: IBatchEntry): JoinableIteration | undefined {
+    const joinable: JoinableIteration | undefined = this.#canJoin(first)
+      ? new JoinableIteration(first.requestSettingsKey)
+      : undefined;
+    this.#joinable = joinable;
+    return joinable;
+  }
+
+  /** Ends the requests' joining of the iteration; a request that waits for it to start waits for it to end. */
+  public close(joinable: JoinableIteration | undefined): void {
+    if (joinable && this.#joinable === joinable) {
+      this.#joinable = undefined;
+    }
+    joinable?.end();
+  }
+
+  /**
+   * Returns the request if it joined, or failed as it was about to, or undefined if it waits for the iteration to end
+   * as before.
+   */
+  public async tryJoinAsync(
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): Promise<IJoinedRequest | undefined> {
+    const joinable: JoinableIteration | undefined = this.#joinable;
+    if (
+      !joinable ||
+      request.exclusivityClass !== RequestExclusivityClass.SharedBuild ||
+      request.requestSettingsKey !== joinable.requestSettingsKey
+    ) {
+      return undefined;
+    }
+    const attemptStartTimeMs: number = performance.now();
+    const previousJoin: Promise<void> = this.#joinTail;
+    let endJoin: () => void = () => undefined;
+    this.#joinTail = new Promise<void>((resolve: () => void) => {
+      endJoin = resolve;
+    });
+    let outcome: IJoinedRequest | string;
+    try {
+      await previousJoin;
+      if (!joinable.dispatched && !mayWaitForDispatch(request)) {
+        outcome = 'the iteration has not started, and the request limits its wait';
+      } else if (!joinable.dispatched && !(await joinable.dispatching)) {
+        outcome = 'the iteration ended before it started';
+      } else {
+        outcome = await this.#joinAsync(joinable, request, admissionController);
+      }
+    } catch (error) {
+      // Once the request joined, `#extendIteration` handles failures itself, so the request did not join, and it
+      // waits for the iteration to end as before.
+      outcome = `joining failed: ${getErrorMessage(error)}`;
+    } finally {
+      endJoin();
+    }
+    logJoinAttempt(request.request.requestId, outcome, attemptStartTimeMs);
+    return typeof outcome === 'string' ? undefined : outcome;
+  }
+
+  #canJoin(first: IBatchEntry): boolean {
+    const { graph, workspaceSession } = this.#host;
+    return (
+      workspaceSession.rushConfiguration.daemon.joinRunningBatch &&
+      // A cobuild can hand an operation back to the queue, which adding work to the iteration does not expect.
+      !process.env[EnvironmentVariableNames.RUSH_COBUILD_CONTEXT_ID] &&
+      first.exclusivityClass === RequestExclusivityClass.SharedBuild &&
+      first.requestSettings?.isIncrementalBuildAllowed !== false &&
+      graph.tryExtendCurrentIteration !== undefined &&
+      graph.retainHeldOperations !== undefined &&
+      workspaceSession.peekInvalidationsAsync !== undefined
+    );
+  }
+
+  /** Returns the joined request, or why the request did not join. */
+  async #joinAsync(
+    joinable: JoinableIteration,
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): Promise<IJoinedRequest | string> {
+    const startTimeMs: number = performance.now();
+    const refusal: string | undefined = this.#getRefusal(joinable, request);
+    if (refusal !== undefined) {
+      return refusal;
+    }
+    // Operations that no participant needs would otherwise start while the inputs are read, and could then no
+    // longer do the request's work.
+    const endRetention: (() => void) | undefined = this.#host.graph.retainHeldOperations?.();
+    if (!endRetention) {
+      return 'the iteration holds no operations';
+    }
+    try {
+      const reconcileStartTimeMs: number = performance.now();
+      let peek: IWorkspaceInvalidationPeek | undefined;
+      try {
+        peek = await this.#host.workspaceSession.peekInvalidationsAsync?.({
+          executingIterationRecords: joinable.records!
+        });
+      } catch (error) {
+        return `reading the inputs failed: ${getErrorMessage(error)}`;
+      }
+      if (!peek) {
+        return 'the changed inputs cannot be added to an executing iteration';
+      }
+      const timings: IBatchTimings = {
+        startTimeMs,
+        joinedIteration: true,
+        batchSize: 0,
+        leasesAcquiredTimeMs: undefined,
+        reconcileStartTimeMs,
+        reconciledTimeMs: performance.now(),
+        selectionsAppliedTimeMs: undefined,
+        scheduleStartTimeMs: undefined,
+        scheduledTimeMs: undefined,
+        executionStartTimeMs: undefined,
+        iterationEndTimeMs: undefined
+      };
+      return this.#extendIteration(joinable, request, admissionController, peek, timings);
+    } finally {
+      endRetention();
+    }
+  }
+
+  /** Adds the request's work to the executing iteration, and commits or discards `peek`. */
+  #extendIteration(
+    joinable: JoinableIteration,
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController,
+    peek: IWorkspaceInvalidationPeek,
+    timings: IBatchTimings
+  ): IJoinedRequest | string {
+    const refusal: string | undefined = this.#getRefusal(joinable, request);
+    const batch: IJoinableBatch | undefined = joinable.batch;
+    if (refusal !== undefined || !batch) {
+      peek.discard();
+      return refusal ?? 'the iteration ended';
+    }
+    const host: IPhasedIterationJoinHost = this.#host;
+    const { entry, resultPromise } = host.createEntry(request, admissionController);
+    try {
+      // As a batch does before it schedules its iteration, so that none of the request's work starts if it throws.
+      // If the iteration then cannot take the work, the batch that later runs the request calls it again.
+      entry.onExecutionStarting?.();
+    } catch (error) {
+      peek.discard();
+      host.failEntry(entry, error);
+      return { resultPromise, failure: `its execution could not start: ${getErrorMessage(error)}` };
+    }
+    const extensionRefusal: string | undefined = this.#addToIteration(batch, entry, peek, timings);
+    if (extensionRefusal !== undefined) {
+      return extensionRefusal;
+    }
+    timings.scheduledTimeMs = timings.executionStartTimeMs = performance.now();
+    entry.executionStarted = true;
+    try {
+      peek.commit();
+      entry.requestSink = host.createRequestSink(entry);
+      entry.unsubscribe = host.multiplexer.subscribeToCurrentIteration(entry.requestSink);
+    } catch (error) {
+      entry.unsubscribe?.();
+      entry.unsubscribe = undefined;
+      entry.requestSink = undefined;
+      // The request's work is in the iteration, but no participant needs it.
+      host.restrictBatchDemand();
+      // A later participant that needs the work that did not start runs it in its own environment.
+      removeUndispatchedAttributions(batch.entryByOperation, entry, joinable.records!);
+      host.failEntry(entry, error);
+      return { resultPromise };
+    }
+    entry.participated = true;
+    entry.batchTimings = timings;
+    batch.batch.push(entry);
+    batch.participants.push(entry);
+    batch.joinedTimings.push(timings);
+    for (const batchTimings of [batch.timings, ...batch.joinedTimings]) {
+      batchTimings.batchSize = batch.participants.length;
+    }
+    host.listenForCancellation(entry);
+    if (batch.demand.restricted) {
+      host.restrictBatchDemand();
+    }
+    for (const participant of batch.participants) {
+      if (participant === entry || participant.finishPromise !== undefined) {
+        continue;
+      }
+      // A participant whose result was ready waited for the iteration to end only because no other participant
+      // needed the iteration.
+      if (participant.requestSink?.activeOperationsSettled) {
+        host.finishSettledEntry(participant);
+      } else {
+        participant.requestSink?.reofferEarlyFailure();
+      }
+    }
+    entry.requestSink.settleIfIdle();
+    return { resultPromise };
+  }
+
+  /**
+   * Enables the entry's operations and adds them to the executing iteration under the inputs of `peek`. If the
+   * iteration cannot take them, restores the graph, discards `peek` and returns why.
+   */
+  #addToIteration(
+    batch: IJoinableBatch,
+    entry: IBatchEntry,
+    peek: IWorkspaceInvalidationPeek,
+    timings: IBatchTimings
+  ): string | undefined {
+    const { graph, multiplexer } = this.#host;
+    const enabledStates: ReadonlyMap<Operation, Operation['enabled']> = new Map(
+      Array.from(graph.operations, (operation: Operation) => [operation, operation.enabled] as const)
+    );
+    const attributedOperations: ReadonlyArray<Operation> = addOperationParticipant(
+      batch.entryByOperation,
+      entry
+    );
+    let extension: IOperationGraphExtensionResult | undefined;
+    try {
+      // Work that only departed participants needed stays withheld; see `restrictBatchDemand`.
+      this.#host.applySelections([
+        ...batch.participants
+          .filter((participant: IBatchEntry) => this.#host.needsIteration(participant))
+          .map((participant: IBatchEntry) => participant.selection),
+        entry.selection
+      ]);
+      timings.selectionsAppliedTimeMs = timings.scheduleStartTimeMs = performance.now();
+      // The joining request's reconcile invalidates retained results of earlier iterations, which the request sinks
+      // do not observe, as they do not observe the reconcile before an iteration.
+      extension = multiplexer.runForIterationRecords(() =>
+        graph.tryExtendCurrentIteration!({
+          inputsSnapshot: peek.inputsSnapshot,
+          neededOperations: entry.selection.activeOperations,
+          invalidatedOperations: peek.invalidatedOperations,
+          invalidationReason: peek.invalidationReason
+        })
+      );
+    } catch (error) {
+      extension = {
+        extended: false,
+        reason: `extending the iteration failed: ${getErrorMessage(error)}`,
+        changedOperations: new Set()
+      };
+    } finally {
+      if (!extension?.extended) {
+        peek.discard();
+        for (const operation of attributedOperations) {
+          batch.entryByOperation.delete(operation);
+        }
+        restoreEnabledStates(graph, enabledStates);
+      }
+    }
+    return extension.extended ? undefined : (extension.reason ?? 'the iteration was not extended');
+  }
+
+  /** Returns why the request cannot join the executing iteration now, or undefined if it can. */
+  #getRefusal(joinable: JoinableIteration, request: IPreparedPhasedRequest): string | undefined {
+    if (this.#joinable !== joinable || !joinable.batch || !joinable.records) {
+      return 'the iteration ended';
+    }
+    if (request.client.abortSignal.aborted) {
+      return 'the request was cancelled';
+    }
+    if (this.#host.hasWaitingRequest()) {
+      return 'another request waits for the graph';
+    }
+    if (joinable.batch.demand.abandoned || !this.#host.hasLiveParticipant()) {
+      return 'no participant needs the iteration';
+    }
+    return undefined;
+  }
+}
+
+/**
+ * Attributes the operations of a participant's selection that no earlier participant's selection includes to the
+ * participant, and returns them.
+ */
+export function addOperationParticipant(
+  entryByOperation: Map<Operation, IBatchEntry>,
+  entry: IBatchEntry
+): Operation[] {
+  const attributedOperations: Operation[] = [];
+  for (const operation of entry.selection.activeOperations) {
+    if (!entryByOperation.has(operation)) {
+      entryByOperation.set(operation, entry);
+      attributedOperations.push(operation);
+    }
+  }
+  return attributedOperations;
+}
+
+/** Removes the entry's attribution of the operations that the graph has not handed to an execution slot yet. */
+function removeUndispatchedAttributions(
+  entryByOperation: Map<Operation, IBatchEntry>,
+  entry: IBatchEntry,
+  records: ReadonlyMap<Operation, IOperationExecutionResult>
+): void {
+  for (const [operation, participant] of entryByOperation) {
+    const status: OperationStatus | undefined = records.get(operation)?.status;
+    if (participant === entry && (status === OperationStatus.Waiting || status === OperationStatus.Ready)) {
+      entryByOperation.delete(operation);
+    }
+  }
+}
+
+/**
+ * Whether a request may wait for an iteration to dispatch operations in order to join it: unless the request limits
+ * its wait, it would wait for the graph anyway.
+ */
+function mayWaitForDispatch(request: IPreparedPhasedRequest): boolean {
+  const { admission } = request.request;
+  return (
+    admission?.noWait !== true &&
+    (admission?.waitTimeoutMs === undefined || admission.waitTimeoutIsDefault === true)
+  );
+}
+
+function logJoinAttempt(requestId: string, outcome: IJoinedRequest | string, startTimeMs: number): void {
+  const durationMs: number = Math.round(performance.now() - startTimeMs);
+  const reason: string | undefined = typeof outcome === 'string' ? outcome : outcome.failure;
+  const message: string =
+    reason !== undefined
+      ? `Request ${requestId} did not join the executing iteration after ${durationMs} ms: ${reason}`
+      : `Request ${requestId} joined the executing iteration after ${durationMs} ms.`;
+  process.stderr.write(`${new Date().toISOString()} ${message}\n`);
+}
+
+function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/** Restores the enabled states that `applySelections` changed. */
+function restoreEnabledStates(
+  graph: IOperationGraph,
+  enabledStates: ReadonlyMap<Operation, Operation['enabled']>
+): void {
+  const operationsByState: Map<Operation['enabled'], Operation[]> = new Map();
+  for (const [operation, enabled] of enabledStates) {
+    if (operation.enabled !== enabled) {
+      let operations: Operation[] | undefined = operationsByState.get(enabled);
+      if (!operations) {
+        operations = [];
+        operationsByState.set(enabled, operations);
+      }
+      operations.push(operation);
+    }
+  }
+  for (const [enabled, operations] of operationsByState) {
+    graph.setEnabledStates(operations, enabled, 'unsafe');
+  }
+}
diff --git a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
index 2f5602b981..5c07b8634e 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventMultiplexer.ts
@@ -3,7 +3,7 @@
 
 import {
   type IOperationExecutionResult,
-  type OperationStatus,
+  OperationStatus,
   type _IOperationActivityOptions,
   type _IOperationGraphEventSink,
   _formatIterationStartLines
@@ -14,9 +14,19 @@ export interface IRequestEventSink extends _IOperationGraphEventSink {
   onIterationScheduled(records: Iterable<IOperationExecutionResult>): void;
 }
 
+/** The iteration that was last scheduled, as far as the request sinks have been told about it. */
+interface IAnnouncedIteration {
+  readonly records: ReadonlyArray<IOperationExecutionResult>;
+  /** The arguments of `onIterationStarting`, once the iteration started. */
+  start: { readonly parallelism: number; readonly quietMode: boolean } | undefined;
+}
+
 export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink {
   readonly #workspaceSink: _IOperationGraphEventSink | undefined;
   readonly #requestSinks: Set<IRequestEventSink> = new Set();
+  #iteration: IAnnouncedIteration | undefined;
+  /** While set, the status changes of other records reach only the workspace sink; see `runForIterationRecords`. */
+  #forwardedRecords: ReadonlySet<IOperationExecutionResult> | undefined;
 
   public constructor(workspaceSink: _IOperationGraphEventSink | undefined) {
     this.#workspaceSink = workspaceSink;
@@ -33,8 +43,60 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     };
   }
 
+  /**
+   * Subscribes a request sink to the iteration that is executing, as if it had been subscribed before the iteration
+   * was scheduled.
+   *
+   * @remarks
+   * The sink first receives the iteration's records, the registration of each record, the start of the iteration if
+   * it started, and, for each record whose status changed, a change from its initial status to its current one. It
+   * then receives the iteration's events as the other request sinks do. It does not receive the headers and output
+   * that operations wrote before it subscribed.
+   */
+  public subscribeToCurrentIteration(requestSink: IRequestEventSink): () => void {
+    const iteration: IAnnouncedIteration | undefined = this.#iteration;
+    if (!iteration) {
+      throw new Error('No iteration was scheduled.');
+    }
+    const { records, start } = iteration;
+    requestSink.onIterationScheduled(records);
+    for (const record of records) {
+      requestSink.onOperationRegistered?.(record.operation.name, record.silent, record, record.iterationId);
+    }
+    if (start) {
+      announceIteration(requestSink, records, start.parallelism, start.quietMode);
+    }
+    for (const record of records) {
+      const initialStatus: OperationStatus = getInitialStatus(record);
+      if (record.status !== initialStatus) {
+        requestSink.onOperationStatusChanged?.(record, initialStatus);
+      }
+    }
+    return this.subscribe(requestSink);
+  }
+
+  /**
+   * Runs `callback`, during which the status changes of records that are not the scheduled iteration's reach only the
+   * workspace sink.
+   *
+   * @remarks
+   * Adding a request's work to the executing iteration invalidates the retained results of earlier iterations whose
+   * inputs changed, as the reconciliation before an iteration does. No request sink is subscribed during that
+   * reconciliation, so no request sink observes those results change during this one either.
+   */
+  public runForIterationRecords<T>(callback: () => T): T {
+    const previous: ReadonlySet<IOperationExecutionResult> | undefined = this.#forwardedRecords;
+    this.#forwardedRecords = new Set(this.#iteration?.records);
+    try {
+      return callback();
+    } finally {
+      this.#forwardedRecords = previous;
+    }
+  }
+
   public onIterationScheduled(records: Iterable<IOperationExecutionResult>): void {
     const executionResults: IOperationExecutionResult[] = [...records];
+    this.#iteration = { records: executionResults, start: undefined };
     for (const requestSink of this.#requestSinks) {
       requestSink.onIterationScheduled(executionResults);
     }
@@ -54,6 +116,9 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
 
   public onOperationStatusChanged(result: IOperationExecutionResult, previousStatus: OperationStatus): void {
     this.#workspaceSink?.onOperationStatusChanged?.(result, previousStatus);
+    if (this.#forwardedRecords && !this.#forwardedRecords.has(result)) {
+      return;
+    }
     for (const requestSink of this.#requestSinks) {
       requestSink.onOperationStatusChanged?.(result, previousStatus);
     }
@@ -106,22 +171,15 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
     parallelism: number,
     quietMode: boolean
   ): void {
-    let lines: string[] | undefined;
-    const announce: (sink: _IOperationGraphEventSink) => void = (sink) => {
-      if (sink.onIterationStarting) {
-        sink.onIterationStarting(records, parallelism, quietMode);
-      } else if (sink.onActivity) {
-        lines ??= _formatIterationStartLines(getNonSilentOperationNames(records), parallelism, quietMode);
-        for (const line of lines) {
-          sink.onActivity(line);
-        }
-      }
-    };
+    if (this.#iteration) {
+      this.#iteration.start = { parallelism, quietMode };
+    }
+    const lines: string[] = [];
     if (this.#workspaceSink) {
-      announce(this.#workspaceSink);
+      announceIteration(this.#workspaceSink, records, parallelism, quietMode, lines);
     }
     for (const requestSink of this.#requestSinks) {
-      announce(requestSink);
+      announceIteration(requestSink, records, parallelism, quietMode, lines);
     }
   }
 
@@ -133,6 +191,34 @@ export class PhasedRequestEventMultiplexer implements _IOperationGraphEventSink
   }
 }
 
+/**
+ * Lets a sink that announces iterations itself announce this one. Any other sink receives the announcement of all of
+ * the iteration's operations as activity; `lines` caches its lines for the other sinks.
+ */
+function announceIteration(
+  sink: _IOperationGraphEventSink,
+  records: ReadonlyArray<IOperationExecutionResult>,
+  parallelism: number,
+  quietMode: boolean,
+  lines: string[] = []
+): void {
+  if (sink.onIterationStarting) {
+    sink.onIterationStarting(records, parallelism, quietMode);
+  } else if (sink.onActivity) {
+    if (lines.length === 0) {
+      lines.push(..._formatIterationStartLines(getNonSilentOperationNames(records), parallelism, quietMode));
+    }
+    for (const line of lines) {
+      sink.onActivity(line);
+    }
+  }
+}
+
+/** The status with which Rush creates the record of an operation for an iteration. */
+function getInitialStatus(record: IOperationExecutionResult): OperationStatus {
+  return record.operation.dependencies.size > 0 ? OperationStatus.Waiting : OperationStatus.Ready;
+}
+
 function getNonSilentOperationNames(records: ReadonlyArray<IOperationExecutionResult>): string[] {
   const operationNames: string[] = [];
   for (const record of records) {
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index 1a71938a57..18922aba37 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -128,6 +128,7 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
   readonly #pendingOperationIds: Set<string> = new Set();
   /** The current iteration's records of this client's operations; their statuses change as the iteration runs. */
   readonly #scheduledResults: Map<Operation, IOperationExecutionResult> = new Map();
+  #activeOperationsSettled: boolean = false;
   #completedOperations: number = 0;
   #failed: boolean = false;
   #earlyFailureOffered: boolean = false;
@@ -162,6 +163,11 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     this.#writer = new OrderedClientWriter(options.client, options.onWriteFailure);
   }
 
+  /** Whether `onActiveOperationsSettled` was called for the current iteration. */
+  public get activeOperationsSettled(): boolean {
+    return this.#activeOperationsSettled;
+  }
+
   public getObservedResult(operation: Operation): IObservedOperationResult | undefined {
     return this.#observedResults.get(operation);
   }
@@ -187,6 +193,7 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     this.#pendingOperationIds.clear();
     this.#scheduledResults.clear();
     this.#failed = false;
+    this.#activeOperationsSettled = false;
     this.#earlyFailureOffered = false;
     this.#settled = false;
     for (const record of records) {
@@ -236,6 +243,37 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     this.#offerEarlyFailure();
   }
 
+  /**
+   * For a sink that subscribed to an iteration that was already executing: settles it if none of its client's
+   * operations is unfinished, as the completion of its last one would, and otherwise offers a failed request's
+   * result. Completion events settle it later as they settle any sink.
+   */
+  public settleIfIdle(): void {
+    if (!this.#settled && this.#pendingOperationIds.size === 0) {
+      for (const record of this.#scheduledResults.values()) {
+        if (record.status === OperationStatus.Aborted) {
+          // The iteration is being aborted; leave this client's result to the batch.
+          this.#settled = true;
+          return;
+        }
+      }
+      this.#settle();
+      return;
+    }
+    this.#offerEarlyFailure();
+  }
+
+  /**
+   * Offers a failed request's result again if it was offered, because the router may now accept an offer that it
+   * declined, for example once another request joined the iteration.
+   */
+  public reofferEarlyFailure(): void {
+    if (this.#earlyFailureOffered && !this.#settled) {
+      this.#earlyFailureOffered = false;
+      this.#offerEarlyFailure();
+    }
+  }
+
   public onOperationStatusChanged(
     result: IOperationExecutionResult,
     previousStatus: OperationStatus
@@ -331,11 +369,16 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
       return;
     }
     if (this.#pendingOperationIds.size === 0) {
-      this.#settled = true;
-      this.#onActiveOperationsSettled?.();
+      this.#settle();
     }
   }
 
+  #settle(): void {
+    this.#settled = true;
+    this.#activeOperationsSettled = true;
+    this.#onActiveOperationsSettled?.();
+  }
+
   /**
    * Offers a failed request's result once nothing that is unfinished can change it. Blocked operations emit their
    * completion events only when the iteration ends, so this reads the records' current statuses instead.
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index f0de57f924..ea2e45bdd5 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -30,6 +30,12 @@ import type {
 import { PhasedRequestEventSink } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
 import { PhasedIterationDemand } from './PhasedIterationDemand';
+import {
+  addOperationParticipant,
+  type IJoinedRequest,
+  type JoinableIteration,
+  PhasedIterationJoiner
+} from './PhasedIterationJoiner';
 import { writePhasedRequestSummaryAsync } from './PhasedRequestSummary';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { writeRequestStartedAsync } from './RequestStartedNotice';
@@ -71,7 +77,7 @@ interface IDualEmitOperationGraph extends IOperationGraph {
   eventSink: _IOperationGraphEventSink | undefined;
 }
 
-interface IResolvedSelection {
+export interface IResolvedSelection {
   readonly activeOperations: ReadonlyArray<Operation>;
   readonly enabledOperations: ReadonlyArray<Operation>;
   readonly ignoreDependencyOperations: ReadonlyArray<Operation>;
@@ -83,7 +89,7 @@ interface IGraphRoutingState {
   readonly multiplexer: PhasedRequestEventMultiplexer;
 }
 
-interface IPreparedPhasedRequest {
+export interface IPreparedPhasedRequest {
   readonly onExecutionStarting: (() => void) | undefined;
   /** The `performance.now()` timestamp at which the request was admitted. */
   readonly admittedTimeMs: number;
@@ -109,9 +115,15 @@ interface IPreparedPhasedRequest {
   readonly warningsAllowedByEnvironment: boolean;
 }
 
-/** `performance.now()` timestamps of one batch's handling, shared by its participants' telemetry. */
-interface IBatchTimings {
+/**
+ * `performance.now()` timestamps of one batch's handling, shared by its participants' telemetry. A request that
+ * joins the batch's iteration while it executes has its own: its handling starts when it starts joining, its
+ * reconcile reads the inputs for the iteration, and its schedule adds its work to the iteration.
+ */
+export interface IBatchTimings {
   readonly startTimeMs: number;
+  /** Whether these are the timings of a request that joined the iteration while it executed. */
+  readonly joinedIteration: boolean;
   batchSize: number;
   leasesAcquiredTimeMs: number | undefined;
   /** The end of the wait for connecting clients, where the input reconcile starts. */
@@ -125,7 +137,7 @@ interface IBatchTimings {
   iterationEndTimeMs: number | undefined;
 }
 
-interface IBatchEntry extends IPreparedPhasedRequest {
+export interface IBatchEntry extends IPreparedPhasedRequest {
   abortListener: (() => void) | undefined;
   abortRequested: boolean;
   /** Waits for native Rush's repository lock for this request; see `#acquireExecutionLeaseAsync`. */
@@ -144,7 +156,10 @@ interface IBatchEntry extends IPreparedPhasedRequest {
    * its batch's iteration is still running for other participants; see `#finishSettledEntry`.
    */
   finishPromise: Promise<void> | undefined;
-  /** The `performance.now()` timestamp at which the entry was taken into a batch. */
+  /**
+   * The `performance.now()` timestamp at which the entry was taken into a batch. A request that joins the executing
+   * iteration has batch timings of its own, which start when it tries to join, and leaves this unset.
+   */
   joinedTimeMs: number | undefined;
   /** Logs the telemetry entry of an entry that continues after its result, once its iteration ended. */
   logTelemetryAfterIteration: (() => void) | undefined;
@@ -158,6 +173,12 @@ interface IBatchEntry extends IPreparedPhasedRequest {
   unsubscribe: (() => void) | undefined;
 }
 
+/** A request's new batch entry, and the promise of the request's result. */
+export interface INewBatchEntry {
+  readonly entry: IBatchEntry;
+  readonly resultPromise: Promise<IDaemonPhasedRequestResult>;
+}
+
 /**
  * How a result reports the client's operations: after the iteration ended (`'final'`), or while it still runs,
  * with unfinished operations reported as aborted because the client stopped waiting for them (`'abandoned'`), or
@@ -329,6 +350,7 @@ export class PhasedRequestRouter {
 class PhasedRequestBatchCoordinator {
   readonly #graph: IDualEmitOperationGraph;
   readonly #graphExecutionScheduler: RequestScheduler;
+  readonly #joiner: PhasedIterationJoiner;
   readonly #multiplexer: PhasedRequestEventMultiplexer;
   readonly #pending: IBatchEntry[] = [];
   readonly #workspaceSession: IWorkspaceSession;
@@ -354,6 +376,27 @@ class PhasedRequestBatchCoordinator {
     this.#graphExecutionScheduler = graphExecutionScheduler;
     this.#multiplexer = multiplexer;
     this.#workspaceSession = workspaceSession;
+    this.#joiner = new PhasedIterationJoiner({
+      graph,
+      multiplexer,
+      workspaceSession,
+      applySelections: (selections: ReadonlyArray<IResolvedSelection>) => applySelections(graph, selections),
+      createEntry,
+      createRequestSink: (entry: IBatchEntry) => this.#createRequestSink(entry),
+      failEntry: (entry: IBatchEntry, error: unknown) => {
+        void this.#finishEntryAsync(entry, false, error).catch((finishError: unknown) => {
+          this.#completeEntry(entry);
+          entry.reject(finishError);
+        });
+      },
+      finishSettledEntry: (entry: IBatchEntry) => this.#finishSettledEntry(entry),
+      hasLiveParticipant: () => this.#hasLiveBatchParticipant(),
+      hasWaitingRequest: () =>
+        this.#graphExecutionScheduler.queuedRequestCount > 0 || this.#pending.length > 0,
+      listenForCancellation: (entry: IBatchEntry) => this.#listenForCancellation(entry),
+      needsIteration: (entry: IBatchEntry) => this.#needsIteration(entry),
+      restrictBatchDemand: () => this.#restrictBatchDemand()
+    });
   }
 
   public async enqueueAsync(
@@ -361,6 +404,13 @@ class PhasedRequestBatchCoordinator {
     admissionController: RequestAdmissionController
   ): Promise<IDaemonPhasedRequestResult> {
     if (!this.#canJoinCurrentBatch(request)) {
+      const joined: IJoinedRequest | undefined = await this.#joiner.tryJoinAsync(
+        request,
+        admissionController
+      );
+      if (joined) {
+        return await joined.resultPromise;
+      }
       const graphExclusivityClass: RequestExclusivityClass =
         request.exclusivityClass === RequestExclusivityClass.SharedBuild
           ? RequestExclusivityClass.SharedBuild
@@ -371,32 +421,11 @@ class PhasedRequestBatchCoordinator {
       );
       graphWaitLease.release();
     }
-    return new Promise<IDaemonPhasedRequestResult>((resolve, reject) => {
-      const entry: IBatchEntry = {
-        ...request,
-        abortListener: undefined,
-        abortRequested: false,
-        admissionController,
-        batchTimings: undefined,
-        completed: false,
-        continuesAfterResult: false,
-        executionStarted: false,
-        finishPromise: undefined,
-        joinedTimeMs: undefined,
-        logTelemetryAfterIteration: undefined,
-        outputError: undefined,
-        participated: false,
-        reject,
-        requestSink: undefined,
-        resolve,
-        settleAfterIteration: undefined,
-        unsubscribe: undefined
-      };
-      entry.abortListener = () => this.#deactivateEntry(entry, true);
-      request.client.abortSignal.addEventListener('abort', entry.abortListener, { once: true });
-      this.#pending.push(entry);
-      this.#scheduleDrain();
-    });
+    const { entry, resultPromise } = createEntry(request, admissionController);
+    this.#listenForCancellation(entry);
+    this.#pending.push(entry);
+    this.#scheduleDrain();
+    return await resultPromise;
   }
 
   #scheduleDrain(): void {
@@ -494,6 +523,7 @@ class PhasedRequestBatchCoordinator {
   async #executeBatchAsync(batch: IBatchEntry[]): Promise<void> {
     const timings: IBatchTimings = {
       startTimeMs: performance.now(),
+      joinedIteration: false,
       batchSize: 0,
       leasesAcquiredTimeMs: undefined,
       reconcileStartTimeMs: undefined,
@@ -511,6 +541,7 @@ class PhasedRequestBatchCoordinator {
       });
     this.#nextGraphLeasePromise = undefined;
     const graphLease: IRequestLease = await graphLeasePromise;
+    const joinable: JoinableIteration | undefined = this.#joiner.open(batch[0]);
     let executionLease: AsyncDisposable | undefined;
     let releasePromise: Promise<void> | undefined;
     const releaseExecutionLeaseAsync: () => Promise<void> = () => {
@@ -584,28 +615,15 @@ class PhasedRequestBatchCoordinator {
       for (const entry of participants) {
         entry.participated = true;
         entry.batchTimings = timings;
-        const activeOperationIds: ReadonlySet<string> = new Set(
-          entry.selection.activeOperations.map((operation: Operation) => operation.name)
-        );
-        entry.requestSink = new PhasedRequestEventSink({
-          activeOperationIds,
-          client: entry.client,
-          getNextSequence: () => entry.client.getNextEventSequence(),
-          onWriteFailure: (error: Error) => this.#deactivateEntry(entry, false, error),
-          onActiveOperationsSettled: () => this.#finishSettledEntry(entry),
-          earlyFailure:
-            entry.request.returnEarlyOnFailure === true &&
-            entry.exclusivityClass === RequestExclusivityClass.SharedBuild
-              ? {
-                  targetOperationIds: getTargetOperationIds(entry.selection.activeOperations),
-                  onSettled: (unfinishedOperations: number) =>
-                    this.#finishFailedEntry(entry, unfinishedOperations)
-                }
-              : undefined,
-          rushVersion: this.#workspaceSession.metadata.rushVersion
-        });
+        entry.requestSink = this.#createRequestSink(entry);
         entry.unsubscribe = this.#multiplexer.subscribe(entry.requestSink);
       }
+      const entryByOperation: Map<Operation, IBatchEntry> = new Map();
+      let unsubscribeJoinable: (() => void) | undefined;
+      if (joinable) {
+        joinable.batch = { batch, demand, entryByOperation, joinedTimings: [], participants, timings };
+        unsubscribeJoinable = this.#multiplexer.subscribe(joinable);
+      }
 
       const previousPauseNextIteration: boolean = this.#graph.pauseNextIteration;
       setPauseNextIteration(this.#graph, true);
@@ -617,8 +635,9 @@ class PhasedRequestBatchCoordinator {
         timings.scheduleStartTimeMs = performance.now();
         scheduled = await this.#graph.scheduleIterationAsync({
           inputsSnapshot: this.#workspaceSession.inputsSnapshot,
-          ...createOperationParticipantLookups(participants),
-          isIncrementalBuildAllowed
+          ...createOperationParticipantLookups(participants, entryByOperation),
+          isIncrementalBuildAllowed,
+          ...(joinable ? { holdUnneededOperations: true } : {})
         });
         timings.scheduledTimeMs = performance.now();
         if (scheduled) {
@@ -641,6 +660,9 @@ class PhasedRequestBatchCoordinator {
           }
           await executionPromise;
           timings.iterationEndTimeMs = performance.now();
+          for (const joinedTimings of joinable?.batch?.joinedTimings ?? []) {
+            joinedTimings.iterationEndTimeMs = timings.iterationEndTimeMs;
+          }
         }
       } catch (error) {
         executionError = error;
@@ -656,6 +678,8 @@ class PhasedRequestBatchCoordinator {
           }
         }
       } finally {
+        this.#joiner.close(joinable);
+        unsubscribeJoinable?.();
         this.#batchDemand = undefined;
         unsubscribeDemand();
         for (const entry of participants) {
@@ -676,6 +700,7 @@ class PhasedRequestBatchCoordinator {
         )
       );
     } finally {
+      this.#joiner.close(joinable);
       try {
         await releaseExecutionLeaseAsync();
       } finally {
@@ -687,6 +712,34 @@ class PhasedRequestBatchCoordinator {
     }
   }
 
+  #createRequestSink(entry: IBatchEntry): PhasedRequestEventSink {
+    const activeOperationIds: ReadonlySet<string> = new Set(
+      entry.selection.activeOperations.map((operation: Operation) => operation.name)
+    );
+    return new PhasedRequestEventSink({
+      activeOperationIds,
+      client: entry.client,
+      getNextSequence: () => entry.client.getNextEventSequence(),
+      onWriteFailure: (error: Error) => this.#deactivateEntry(entry, false, error),
+      onActiveOperationsSettled: () => this.#finishSettledEntry(entry),
+      earlyFailure:
+        entry.request.returnEarlyOnFailure === true &&
+        entry.exclusivityClass === RequestExclusivityClass.SharedBuild
+          ? {
+              targetOperationIds: getTargetOperationIds(entry.selection.activeOperations),
+              onSettled: (unfinishedOperations: number) =>
+                this.#finishFailedEntry(entry, unfinishedOperations)
+            }
+          : undefined,
+      rushVersion: this.#workspaceSession.metadata.rushVersion
+    });
+  }
+
+  #listenForCancellation(entry: IBatchEntry): void {
+    entry.abortListener = () => this.#deactivateEntry(entry, true);
+    entry.client.abortSignal.addEventListener('abort', entry.abortListener, { once: true });
+  }
+
   #deactivateEntry(entry: IBatchEntry, aborted: boolean, outputError?: Error): void {
     if (entry.completed) {
       return;
@@ -1076,6 +1129,7 @@ class PhasedRequestBatchCoordinator {
           batchSize: timings.batchSize,
           scheduled: batchScheduled,
           earlyResult,
+          ...(timings.joinedIteration ? { joinedIteration: true } : {}),
           receivedTimeMs: entry.startTimeMs,
           executionStartTimeMs,
           iterationStartTimeMs: batchScheduled ? timings.scheduleStartTimeMs : undefined,
@@ -1261,6 +1315,10 @@ function createTelemetryMeasures(
   }
   addMeasure('admission', entry.startTimeMs, entry.admittedTimeMs);
   addMeasure('queueWait', entry.admittedTimeMs, executionStartTimeMs);
+  if (timings.joinedIteration) {
+    // Spans the reconcile, selection and schedule measures of the request that joined.
+    addMeasure('joinRunningIteration', timings.startTimeMs, timings.executionStartTimeMs);
+  }
   addMeasure('acquireExecutionLease', timings.startTimeMs, timings.leasesAcquiredTimeMs);
   addMeasure('awaitConnectingClients', timings.leasesAcquiredTimeMs, timings.reconcileStartTimeMs);
   addMeasure('reconcileInvalidations', timings.reconcileStartTimeMs, timings.reconciledTimeMs);
@@ -1427,6 +1485,38 @@ function getGraphDependsOnEnvVars(graph: IOperationGraph): ReadonlyArray<string>
   return Array.from(names).sort(Sort.compareByValue);
 }
 
+function createEntry(
+  request: IPreparedPhasedRequest,
+  admissionController: RequestAdmissionController
+): INewBatchEntry {
+  let entry: IBatchEntry | undefined;
+  const resultPromise: Promise<IDaemonPhasedRequestResult> = new Promise<IDaemonPhasedRequestResult>(
+    (resolve, reject) => {
+      entry = {
+        ...request,
+        abortListener: undefined,
+        abortRequested: false,
+        admissionController,
+        batchTimings: undefined,
+        completed: false,
+        continuesAfterResult: false,
+        executionStarted: false,
+        finishPromise: undefined,
+        joinedTimeMs: undefined,
+        logTelemetryAfterIteration: undefined,
+        outputError: undefined,
+        participated: false,
+        reject,
+        requestSink: undefined,
+        resolve,
+        settleAfterIteration: undefined,
+        unsubscribe: undefined
+      };
+    }
+  );
+  return { entry: entry!, resultPromise };
+}
+
 /**
  * The lookups that attribute each operation of an iteration to one of its participants.
  */
@@ -1449,17 +1539,17 @@ type IOperationParticipantLookups = Required<
  * sets, changes or deletes in the same iteration's `beforeExecuteIterationAsync`. Reading `process.env` is slow, and
  * the graph hashes every operation while it schedules an iteration, so the calls made before the next microtask
  * share one copy for each participant.
+ *
+ * @param participants - The iteration's participants, in the order in which they were taken into its batch.
+ * @param entryByOperation - Receives the attribution, which requests that join the executing iteration extend; see
+ * `addOperationParticipant`.
  */
 function createOperationParticipantLookups(
-  participants: ReadonlyArray<IBatchEntry>
+  participants: ReadonlyArray<IBatchEntry>,
+  entryByOperation: Map<Operation, IBatchEntry>
 ): IOperationParticipantLookups {
-  const entryByOperation: Map<Operation, IBatchEntry> = new Map();
   for (const entry of participants) {
-    for (const operation of entry.selection.activeOperations) {
-      if (!entryByOperation.has(operation)) {
-        entryByOperation.set(operation, entry);
-      }
-    }
+    addOperationParticipant(entryByOperation, entry);
   }
   const firstEntry: IBatchEntry | undefined = participants[0];
   const getEntry = (operation: Operation): IBatchEntry | undefined =>
diff --git a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
index 6dc16271bf..bed32e6219 100644
--- a/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
+++ b/libraries/rush-daemon/src/PhasedRequestTelemetry.ts
@@ -51,6 +51,11 @@ export interface IPhasedRequestTelemetryReport {
    * operations of this request that its failure did not block.
    */
   readonly earlyResult: boolean;
+  /**
+   * Set when the request joined a graph iteration that was already executing for other requests, instead of waiting
+   * for it to end. Its `iterationStartTimeMs` is then when its work was added to the iteration.
+   */
+  readonly joinedIteration?: boolean;
   /** When the router received the request. */
   readonly receivedTimeMs: number;
   /** When this request's batch began handling it. */
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index b7d2099d4c..1df8bd357e 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -37,6 +37,7 @@ import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import {
   WorkspaceEngineComponentFactory,
   WorkspaceEngineRecreationRequiredError,
+  type IPeekWorkspaceInvalidationsOptions,
   type IWorkspaceEngineShape,
   type IWorkspaceInvalidationReconciliation
 } from './WorkspaceEngineComponentFactory';
@@ -476,12 +477,19 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
           mapInvalidationsToOperationsAsync: async (invalidationOptions) => [
             ...getOperationsWithChangedInputs(invalidationOptions),
             // Outputs are git-ignored and absent from state hashes, so check them separately.
-            ...outputFingerprints.getOperationsWithChangedOutputs()
+            ...(invalidationOptions.executingIterationRecords
+              ? outputFingerprints.peekOperationsWithChangedOutputs(
+                  invalidationOptions.executingIterationRecords
+                )
+              : outputFingerprints.getOperationsWithChangedOutputs())
           ]
         });
         const components: IWorkspaceSessionComponents = await factory.createAsync(options);
         return {
           ...components,
+          // A rebuild runs every operation of each request, so no request can join another's iteration
+          peekInvalidationsAsync: async (peekOptions: IPeekWorkspaceInvalidationsOptions) =>
+            engine.isIncremental ? await components.peekInvalidationsAsync!(peekOptions) : undefined,
           reconcileInvalidationsAsync: async () => {
             const reconcileAsync = (): Promise<IWorkspaceInvalidationReconciliation> =>
               terminal.reconcileWithRequestDiagnosticsAsync(() => components.reconcileInvalidationsAsync!());
diff --git a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
index bb9cb462b2..6df1483c20 100644
--- a/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
+++ b/libraries/rush-daemon/src/WorkspaceEngineComponentFactory.ts
@@ -6,6 +6,7 @@ import * as path from 'node:path';
 import type {
   GetInputsSnapshotAsyncFn,
   IInputsSnapshot,
+  IOperationExecutionResult,
   IOperationGraph,
   Operation,
   RushConfiguration,
@@ -91,6 +92,15 @@ export type CreateWorkspaceEngineComponentsAsync = (
 export interface IMapWorkspaceInvalidationsOptions {
   readonly changedPaths: ReadonlyArray<string>;
   readonly currentInputsSnapshot: IInputsSnapshot;
+  /**
+   * The records of the executing iteration, if the operations are mapped to add another request's work to it.
+   *
+   * @remarks
+   * The caller may then discard the result, so the mapper must keep any state that a later mapping of the same
+   * changes needs. The iteration may be running some operations, which may be writing their outputs, and may
+   * already have run others.
+   */
+  readonly executingIterationRecords?: ReadonlyMap<Operation, IOperationExecutionResult>;
   readonly nextInputsSnapshot: IInputsSnapshot;
   readonly operationGraph: IOperationGraph;
 }
@@ -142,6 +152,41 @@ export interface IWorkspaceInvalidationReconciliation {
   readonly sequence: number;
 }
 
+/**
+ * Options for reading retained watcher invalidations for an iteration that is executing.
+ *
+ * @beta
+ */
+export interface IPeekWorkspaceInvalidationsOptions {
+  /** The records of the executing iteration, which another request's work would be added to. */
+  readonly executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult>;
+}
+
+/**
+ * Retained watcher invalidations that were mapped onto operations without applying them to the graph, so that
+ * another request's work can be added to an executing iteration.
+ *
+ * @remarks
+ * Until the caller commits or discards it, no other reconciliation starts.
+ *
+ * @beta
+ */
+export interface IWorkspaceInvalidationPeek {
+  /** The newer inputs snapshot, which the invalidations were mapped against. */
+  readonly inputsSnapshot: IInputsSnapshot;
+  /** The operations whose inputs or outputs changed since the engine's inputs snapshot. */
+  readonly invalidatedOperations: ReadonlySet<Operation>;
+  /** The reason with which the caller invalidates `invalidatedOperations` in the graph. */
+  readonly invalidationReason: string;
+  /**
+   * Makes `inputsSnapshot` the engine's inputs snapshot and acknowledges the invalidations, once the caller
+   * invalidated `invalidatedOperations` in the graph.
+   */
+  commit(): void;
+  /** Leaves the engine's inputs snapshot and the invalidations unchanged. */
+  discard(): void;
+}
+
 /**
  * Indicates that retained changes require the owning workspace session to be recreated.
  *
@@ -241,6 +286,35 @@ class WorkspaceEngineLifecycle {
     return reconciliationPromise;
   }
 
+  /**
+   * Maps the retained invalidations onto operations as a reconciliation would, without invalidating them in the
+   * graph, acknowledging them or replacing the inputs snapshot.
+   *
+   * @remarks
+   * Returns undefined if the changes invalidate every operation. Throws, leaving the invalidations retained, where a
+   * reconciliation would throw. Later reconciliations wait until the returned peek is committed or discarded.
+   */
+  public peekInvalidationsAsync(
+    options: IPeekWorkspaceInvalidationsOptions
+  ): Promise<IWorkspaceInvalidationPeek | undefined> {
+    if (this.#isDisposing) {
+      return Promise.reject(new Error('The workspace engine is being disposed.'));
+    }
+
+    let settle: () => void = noop;
+    const settled: Promise<void> = new Promise<void>((resolve: () => void) => {
+      settle = resolve;
+    });
+    const peekPromise: Promise<IWorkspaceInvalidationPeek | undefined> = this.#reconciliationTail.then(() =>
+      this.#peekOnceAsync(options, settle)
+    );
+    this.#reconciliationTail = peekPromise.then(
+      (peek: IWorkspaceInvalidationPeek | undefined) => (peek ? settled : undefined),
+      () => undefined
+    );
+    return peekPromise;
+  }
+
   public [Symbol.asyncDispose](): Promise<void> {
     this.#isDisposing = true;
     this.#disposePromise ??= this.#disposeOnceAsync();
@@ -250,30 +324,10 @@ class WorkspaceEngineLifecycle {
   async #reconcileOnceAsync(): Promise<IWorkspaceInvalidationReconciliation> {
     // Read before the inputs, so that the inputs snapshot includes each change that this reconciliation acknowledges
     const invalidationSnapshot: IWorkspaceInvalidationSnapshot = this.#invalidations.getSnapshot();
-    // A reconciliation that refreshes the inputs reads them in any case, so it reads them while the checks run
-    const nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined = this
-      .#refreshInputsOnEveryRequest
-      ? this.#components.getInputsSnapshotAsync()
-      : undefined;
-    // The snapshot may fail before the checks finish, which must not be reported as an unhandled rejection
-    const nextInputsSnapshotSettledPromise: Promise<void> | undefined = nextInputsSnapshotPromise?.then(
-      () => undefined,
-      () => undefined
-    );
-    try {
-      await this.#validateGraphInputsAsync?.();
-      if (await this.#requiresEngineRecreationAsync(invalidationSnapshot)) {
-        throw new WorkspaceEngineRecreationRequiredError();
-      }
-    } catch (error) {
-      // No command may still read the inputs once the reconciliation failed
-      await nextInputsSnapshotSettledPromise;
-      throw error;
-    }
-    const isFullInvalidation: boolean =
-      this.#requiresFullInvalidation ||
-      invalidationSnapshot.hasUnknownChanges ||
-      !invalidationSnapshot.isWatcherHealthy;
+    const nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined =
+      this.#startInputsSnapshot();
+    await this.#checkInvalidationsAsync(invalidationSnapshot, nextInputsSnapshotPromise);
+    const isFullInvalidation: boolean = this.#isFullInvalidation(invalidationSnapshot);
     if (
       !this.#refreshInputsOnEveryRequest &&
       !isFullInvalidation &&
@@ -287,37 +341,24 @@ class WorkspaceEngineLifecycle {
       };
     }
 
-    const nextInputsSnapshot: IInputsSnapshot | undefined =
-      await (nextInputsSnapshotPromise ?? this.#components.getInputsSnapshotAsync());
-    if (!nextInputsSnapshot) {
-      throw new Error('Rush could not capture the next workspace inputs snapshot.');
-    }
-
+    const nextInputsSnapshot: IInputsSnapshot =
+      await this.#getNextInputsSnapshotAsync(nextInputsSnapshotPromise);
     const operationGraph: IOperationGraph = this.#components.operationGraph;
     let invalidatedOperationCount: number;
     if (isFullInvalidation) {
       operationGraph.invalidateOperations(undefined, INVALIDATION_REASON);
       invalidatedOperationCount = operationGraph.operations.size;
     } else {
-      const mappedOperations: Iterable<Operation> = await this.#mapInvalidationsToOperationsAsync({
-        changedPaths: invalidationSnapshot.changedPaths,
-        currentInputsSnapshot: this.#currentInputsSnapshot,
+      const invalidatedOperations: ReadonlySet<Operation> = await this.#mapInvalidationsAsync(
+        invalidationSnapshot,
         nextInputsSnapshot,
-        operationGraph
-      });
-      const invalidatedOperations: ReadonlySet<Operation> = validateMappedOperations(
-        mappedOperations,
-        operationGraph
+        undefined
       );
       operationGraph.invalidateOperations(invalidatedOperations, INVALIDATION_REASON);
       invalidatedOperationCount = invalidatedOperations.size;
     }
 
-    this.#currentInputsSnapshot = nextInputsSnapshot;
-    this.#invalidations.acknowledgeThrough(invalidationSnapshot.sequence);
-    this.#requiresFullInvalidation =
-      !this.#refreshInputsOnEveryRequest &&
-      this.#invalidations.getSnapshot().sequence > invalidationSnapshot.sequence;
+    this.#acknowledge(invalidationSnapshot, nextInputsSnapshot);
     return {
       inputsSnapshot: nextInputsSnapshot,
       invalidatedOperationCount,
@@ -326,6 +367,133 @@ class WorkspaceEngineLifecycle {
     };
   }
 
+  async #peekOnceAsync(
+    options: IPeekWorkspaceInvalidationsOptions,
+    settle: () => void
+  ): Promise<IWorkspaceInvalidationPeek | undefined> {
+    const invalidationSnapshot: IWorkspaceInvalidationSnapshot = this.#invalidations.getSnapshot();
+    const nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined =
+      this.#startInputsSnapshot();
+    await this.#checkInvalidationsAsync(invalidationSnapshot, nextInputsSnapshotPromise);
+    if (this.#isFullInvalidation(invalidationSnapshot)) {
+      // Invalidating every operation would also invalidate those that the iteration already ran
+      await nextInputsSnapshotPromise?.then(noop, noop);
+      return undefined;
+    }
+
+    let isSettled: boolean = false;
+    const settleOnce = (): void => {
+      if (isSettled) {
+        throw new Error('The workspace invalidation peek was already committed or discarded.');
+      }
+      isSettled = true;
+      settle();
+    };
+    if (!this.#refreshInputsOnEveryRequest && invalidationSnapshot.changedPaths.length === 0) {
+      return {
+        inputsSnapshot: this.#currentInputsSnapshot,
+        invalidatedOperations: new Set(),
+        invalidationReason: INVALIDATION_REASON,
+        commit: settleOnce,
+        discard: settleOnce
+      };
+    }
+
+    const nextInputsSnapshot: IInputsSnapshot =
+      await this.#getNextInputsSnapshotAsync(nextInputsSnapshotPromise);
+    const invalidatedOperations: ReadonlySet<Operation> = await this.#mapInvalidationsAsync(
+      invalidationSnapshot,
+      nextInputsSnapshot,
+      options.executingIterationRecords
+    );
+    return {
+      inputsSnapshot: nextInputsSnapshot,
+      invalidatedOperations,
+      invalidationReason: INVALIDATION_REASON,
+      commit: () => {
+        settleOnce();
+        this.#acknowledge(invalidationSnapshot, nextInputsSnapshot);
+      },
+      discard: settleOnce
+    };
+  }
+
+  /**
+   * A reconciliation that refreshes the inputs reads them in any case, so it starts reading them before the
+   * checks, which run meanwhile.
+   */
+  #startInputsSnapshot(): Promise<IInputsSnapshot | undefined> | undefined {
+    return this.#refreshInputsOnEveryRequest ? this.#components.getInputsSnapshotAsync() : undefined;
+  }
+
+  /** Validates the graph inputs, and throws if the invalidations require a new engine. */
+  async #checkInvalidationsAsync(
+    invalidationSnapshot: IWorkspaceInvalidationSnapshot,
+    nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined
+  ): Promise<void> {
+    // The snapshot may fail before the checks finish, which must not be reported as an unhandled rejection
+    const nextInputsSnapshotSettledPromise: Promise<void> | undefined = nextInputsSnapshotPromise?.then(
+      noop,
+      noop
+    );
+    try {
+      await this.#validateGraphInputsAsync?.();
+      if (await this.#requiresEngineRecreationAsync(invalidationSnapshot)) {
+        throw new WorkspaceEngineRecreationRequiredError();
+      }
+    } catch (error) {
+      // No command may still read the inputs once the reconciliation failed
+      await nextInputsSnapshotSettledPromise;
+      throw error;
+    }
+  }
+
+  #isFullInvalidation(invalidationSnapshot: IWorkspaceInvalidationSnapshot): boolean {
+    return (
+      this.#requiresFullInvalidation ||
+      invalidationSnapshot.hasUnknownChanges ||
+      !invalidationSnapshot.isWatcherHealthy
+    );
+  }
+
+  async #getNextInputsSnapshotAsync(
+    nextInputsSnapshotPromise: Promise<IInputsSnapshot | undefined> | undefined
+  ): Promise<IInputsSnapshot> {
+    const nextInputsSnapshot: IInputsSnapshot | undefined = await (nextInputsSnapshotPromise ??
+      this.#components.getInputsSnapshotAsync());
+    if (!nextInputsSnapshot) {
+      throw new Error('Rush could not capture the next workspace inputs snapshot.');
+    }
+    return nextInputsSnapshot;
+  }
+
+  async #mapInvalidationsAsync(
+    invalidationSnapshot: IWorkspaceInvalidationSnapshot,
+    nextInputsSnapshot: IInputsSnapshot,
+    executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> | undefined
+  ): Promise<ReadonlySet<Operation>> {
+    const operationGraph: IOperationGraph = this.#components.operationGraph;
+    const mappedOperations: Iterable<Operation> = await this.#mapInvalidationsToOperationsAsync({
+      changedPaths: invalidationSnapshot.changedPaths,
+      currentInputsSnapshot: this.#currentInputsSnapshot,
+      ...(executingIterationRecords ? { executingIterationRecords } : {}),
+      nextInputsSnapshot,
+      operationGraph
+    });
+    return validateMappedOperations(mappedOperations, operationGraph);
+  }
+
+  #acknowledge(
+    invalidationSnapshot: IWorkspaceInvalidationSnapshot,
+    nextInputsSnapshot: IInputsSnapshot
+  ): void {
+    this.#currentInputsSnapshot = nextInputsSnapshot;
+    this.#invalidations.acknowledgeThrough(invalidationSnapshot.sequence);
+    this.#requiresFullInvalidation =
+      !this.#refreshInputsOnEveryRequest &&
+      this.#invalidations.getSnapshot().sequence > invalidationSnapshot.sequence;
+  }
+
   async #disposeOnceAsync(): Promise<void> {
     await this.#reconciliationTail;
     await this.#components[Symbol.asyncDispose]();
@@ -435,6 +603,8 @@ export class WorkspaceEngineComponentFactory {
         return lifecycle.inputsSnapshot;
       },
       operationGraph: components.operationGraph,
+      peekInvalidationsAsync: (peekOptions: IPeekWorkspaceInvalidationsOptions) =>
+        lifecycle.peekInvalidationsAsync(peekOptions),
       reconcileInvalidationsAsync: () => lifecycle.reconcileInvalidationsAsync(),
       rushSession: components.rushSession
     };
@@ -547,6 +717,10 @@ function validateComponents(
   }
 }
 
+function noop(): void {
+  // Nothing to do
+}
+
 function validateMappedOperations(
   operations: Iterable<Operation>,
   operationGraph: IOperationGraph
diff --git a/libraries/rush-daemon/src/WorkspaceSession.ts b/libraries/rush-daemon/src/WorkspaceSession.ts
index 620fc006cb..d221656855 100644
--- a/libraries/rush-daemon/src/WorkspaceSession.ts
+++ b/libraries/rush-daemon/src/WorkspaceSession.ts
@@ -13,7 +13,9 @@ import { WorkspaceWarmSet, type IWorkspaceWarmSetStatus } from './WorkspaceWarmS
 import { getWorkspaceRequestScheduler } from './WorkspaceRequestAdmission';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
 import type {
+  IPeekWorkspaceInvalidationsOptions,
   IWorkspaceEngineShape,
+  IWorkspaceInvalidationPeek,
   IWorkspaceInvalidationReconciliation
 } from './WorkspaceEngineComponentFactory';
 
@@ -63,6 +65,10 @@ export interface IWorkspaceSessionComponents extends AsyncDisposable {
    * `WorkspaceSession` directly disposes only the default watcher that it creates itself.
    */
   readonly projectWatcher?: IWorkspaceInvalidationWatcher;
+  /** Maps retained watcher changes onto operations for an executing iteration, without applying them. */
+  readonly peekInvalidationsAsync?: (
+    options: IPeekWorkspaceInvalidationsOptions
+  ) => Promise<IWorkspaceInvalidationPeek | undefined>;
   readonly reconcileInvalidationsAsync?: () => Promise<IWorkspaceInvalidationReconciliation>;
   readonly rushSession?: RushSession;
 }
@@ -124,6 +130,13 @@ export interface IWorkspaceSession extends AsyncDisposable {
   readonly rushSession: RushSession | undefined;
   /** Binds the first command-dependent engine, if this session supports lazy engine initialization. */
   initializeEngineAsync?(factory: CreateWorkspaceSessionComponentsAsync): Promise<void>;
+  /**
+   * Maps retained watcher changes onto operations for an executing iteration, so that another request's work can
+   * be added to it. Returns undefined if the changes cannot be added to an executing iteration.
+   */
+  peekInvalidationsAsync?(
+    options: IPeekWorkspaceInvalidationsOptions
+  ): Promise<IWorkspaceInvalidationPeek | undefined>;
   reconcileInvalidationsAsync(): Promise<IWorkspaceInvalidationReconciliation | undefined>;
 }
 
@@ -411,6 +424,33 @@ export class WorkspaceSession implements IWorkspaceSession {
     return result;
   }
 
+  /**
+   * Maps retained watcher changes onto operations for an executing iteration, without applying them, when
+   * configured. Committing the result also makes its inputs snapshot the session's.
+   */
+  public async peekInvalidationsAsync(
+    options: IPeekWorkspaceInvalidationsOptions
+  ): Promise<IWorkspaceInvalidationPeek | undefined> {
+    assertWorkspaceRequestResourcesHealthy(this);
+    if (this.#isDisposing) {
+      throw new Error('The workspace session is being disposed.');
+    }
+    const peek: IWorkspaceInvalidationPeek | undefined =
+      await this.#components.peekInvalidationsAsync?.(options);
+    return (
+      peek && {
+        inputsSnapshot: peek.inputsSnapshot,
+        invalidatedOperations: peek.invalidatedOperations,
+        invalidationReason: peek.invalidationReason,
+        commit: () => {
+          peek.commit();
+          this.#inputsSnapshot = peek.inputsSnapshot;
+        },
+        discard: () => peek.discard()
+      }
+    );
+  }
+
   async #disposeOnceAsync(): Promise<void> {
     await this.quiesceWarmSetAsync();
     let watcherError: unknown;
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 5ad9ac88c7..3036769ffc 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -8,6 +8,7 @@ import {
   type IDaemonConfigurationJson,
   type IOperationExecutionResult,
   type IOperationGraph,
+  type IOperationGraphIterationOptions,
   type IOperationRunner,
   type Operation
 } from '@microsoft/rush-lib';
@@ -56,6 +57,20 @@ interface IProjectHistory {
   requestedTarget: boolean;
 }
 
+interface IRequestedProject {
+  readonly name: string;
+  readonly project: IProjectHistory;
+  /** Whether the project owns a selection root (an enabled operation with no enabled consumer). */
+  readonly requestedTarget: boolean;
+}
+
+/** The projects that one `configureIteration` call planned to run. */
+interface IPlannedRequest {
+  /** The options of the call, which `extendIteration` receives again if the graph accepts the plan. */
+  readonly context: IOperationGraphIterationOptions;
+  readonly projects: ReadonlyArray<IRequestedProject>;
+}
+
 interface IOperationTiming {
   coldDurationMs: number | undefined;
   timeSavedMs: number | undefined;
@@ -84,6 +99,10 @@ export class WorkspaceWarmSet implements AsyncDisposable {
   readonly #projects: Map<string, IProjectHistory> = new Map();
   readonly #timings: Map<Operation, IOperationTiming> = new Map();
   readonly #reusedRunners: WeakSet<IOperationExecutionResult> = new WeakSet();
+  /** The projects that the current iteration requested. */
+  readonly #iterationProjects: Set<IProjectHistory> = new Set();
+  /** A plan of the executing iteration for another request's work, until the graph accepts it. */
+  #extensionPlan: IPlannedRequest | undefined;
   readonly #cleanupFailures: Map<string, string> = new Map();
   #configuration: Readonly<Required<WorkspaceWarmSetConfiguration>>;
   #timer: NodeJS.Timeout | undefined;
@@ -108,24 +127,25 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       project.operations.push(operation);
     }
     const graph: IOperationGraph = options.operationGraph;
-    graph.hooks.configureIteration.tap({ name: PLUGIN_NAME, stage: Infinity }, () => {
-      if (this.#disposed) return;
-      const requested: string[] = [];
-      const requestedAt: number = performance.now();
-      for (const [name, project] of this.#projects) {
-        const enabled: Operation[] = project.operations.filter((operation) => operation.enabled !== false);
-        if (!enabled.length) continue;
-        project.lastUsed = requestedAt;
-        project.frequency++;
-        project.requestedTarget = enabled.some((operation) => !hasEnabledConsumer(operation));
-        requested.push(name);
-      }
-      try {
-        if (this.#configuration.watch) options.watcher.watchProjects(requested);
-      } catch (error) {
-        this.#reportWatcherPolicyFailure(error);
+    graph.hooks.configureIteration.tap(
+      { name: PLUGIN_NAME, stage: Infinity },
+      (states, lastResults, context) => {
+        if (this.#disposed) return;
+        const plan: IPlannedRequest = { context, projects: this.#getRequestedProjects() };
+        if (context.startedOperations) {
+          // The graph can still refuse this plan of the executing iteration for another request's work
+          this.#extensionPlan = plan;
+        } else {
+          this.#extensionPlan = undefined;
+          this.#iterationProjects.clear();
+          this.#countRequest(plan);
+        }
       }
-      this.#schedule(0);
+    );
+    graph.hooks.extendIteration.tap(PLUGIN_NAME, (records, context) => {
+      const plan: IPlannedRequest | undefined = this.#extensionPlan;
+      this.#extensionPlan = undefined;
+      if (!this.#disposed && plan?.context === context) this.#countRequest(plan);
     });
     graph.hooks.beforeExecuteOperationAsync.tap(PLUGIN_NAME, (record) => {
       if (!this.#disposed && record.operation.runner?.isActive) this.#reusedRunners.add(record);
@@ -358,6 +378,40 @@ export class WorkspaceWarmSet implements AsyncDisposable {
     this.#diagnose(this.#watcherPolicyFailure);
   }
 
+  #getRequestedProjects(): IRequestedProject[] {
+    const requested: IRequestedProject[] = [];
+    for (const [name, project] of this.#projects) {
+      const enabled: Operation[] = project.operations.filter((operation) => operation.enabled !== false);
+      if (enabled.length) {
+        const requestedTarget: boolean = enabled.some((operation) => !hasEnabledConsumer(operation));
+        requested.push({ name, project, requestedTarget });
+      }
+    }
+    return requested;
+  }
+
+  /**
+   * Records the use of the projects of a plan that the graph runs, and observes them. A plan of the executing
+   * iteration for another request's work counts only the projects that the iteration did not request yet.
+   */
+  #countRequest({ projects }: IPlannedRequest): void {
+    const requestedAt: number = performance.now();
+    for (const { project, requestedTarget } of projects) {
+      project.lastUsed = requestedAt;
+      if (!this.#iterationProjects.has(project)) {
+        this.#iterationProjects.add(project);
+        project.frequency++;
+      }
+      project.requestedTarget = requestedTarget;
+    }
+    try {
+      if (this.#configuration.watch) this.#options.watcher.watchProjects(projects.map(({ name }) => name));
+    } catch (error) {
+      this.#reportWatcherPolicyFailure(error);
+    }
+    this.#schedule(0);
+  }
+
   /** Whether a pass must own the repository to release resources or to apply the observation policy. */
   #needsNativeLease(status: IWorkspaceWarmSetStatus): boolean {
     if (this.#watcherPolicyFailure) return true;
diff --git a/libraries/rush-daemon/src/index.ts b/libraries/rush-daemon/src/index.ts
index 319866c7c6..61d187b0dc 100644
--- a/libraries/rush-daemon/src/index.ts
+++ b/libraries/rush-daemon/src/index.ts
@@ -77,9 +77,11 @@ export {
   type IClassifyWorkspaceInvalidationsOptions,
   type ICreateWorkspaceEngineComponentsOptions,
   type IMapWorkspaceInvalidationsOptions,
+  type IPeekWorkspaceInvalidationsOptions,
   type IWorkspaceEngineComponentFactoryOptions,
   type IWorkspaceEngineComponents,
   type IWorkspaceEngineShape,
+  type IWorkspaceInvalidationPeek,
   type IWorkspaceInvalidationReconciliation,
   type IsWorkspaceEngineRecreationRequiredAsync,
   type MapWorkspaceInvalidationsToOperationsAsync
diff --git a/libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts b/libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts
new file mode 100644
index 0000000000..b736503c78
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeEngineInvalidationPeek.test.ts
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import {
+  OperationStatus,
+  type IOperationExecutionResult,
+  type IOperationGraph,
+  type Operation
+} from '@microsoft/rush-lib';
+
+import type { IWorkspaceInvalidationPeek } from '../WorkspaceEngineComponentFactory';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+jest.setTimeout(30_000);
+
+describe('peeking at the invalidations of a native engine for its executing iteration', () => {
+  it('maps the outputs that changed, except those of dispatched operations, and leaves them to the next build', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      await runAsync(fixture, 'initial', ['build']);
+      expect(runs(fixture)).toHaveLength(3);
+      const graph: IOperationGraph = fixture.session.operationGraph!;
+      const getOperation = (name: string): Operation =>
+        Array.from(graph.operations).find(
+          (operation: Operation) => operation.associatedProject.packageName === name
+        )!;
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/a/lib'), { recursive: true });
+      fs.rmSync(path.join(fixture.repoRoot, 'projects/c/lib'), { recursive: true });
+      // An iteration that executes a may be writing its outputs.
+      const executingIterationRecords: ReadonlyMap<Operation, IOperationExecutionResult> = new Map([
+        [getOperation('a'), { enabled: true, status: OperationStatus.Executing } as IOperationExecutionResult]
+      ]);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.session.peekInvalidationsAsync({
+        executingIterationRecords
+      });
+      expect(peek?.invalidatedOperations).toEqual(new Set([getOperation('c')]));
+      peek!.discard();
+      expect((await runAsync(fixture, 'deleted', ['build'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+      expect(runs(fixture).slice(3).sort()).toEqual(['a:one:', 'c:one:']);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('offers no peek for an engine that rebuilds, which runs every operation of each request', async () => {
+    const fixture: IFixture = await createFixtureAsync();
+    try {
+      expect((await runAsync(fixture, 'rebuild', ['rebuild', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, scheduled: true }
+      });
+
+      await expect(
+        fixture.session.peekInvalidationsAsync({ executingIterationRecords: new Map() })
+      ).resolves.toBeUndefined();
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
index 50afbde83c..52b55e4839 100644
--- a/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
+++ b/libraries/rush-daemon/src/test/OperationOutputFingerprints.test.ts
@@ -12,6 +12,7 @@ import {
   type IConfigurableOperation,
   type IInputsSnapshot,
   type IOperationExecutionResult,
+  type IOperationGraphIterationOptions,
   type IOperationRunnerContext,
   type IOperationSettings,
   type IPhase,
@@ -121,6 +122,10 @@ class TestGraph {
     return operation;
   }
 
+  public getLegacySkipStatePath(name: string): string {
+    return path.join(this.#root, name, 'temp', `package-deps_${name}_build.json`);
+  }
+
   public addFile(name: string, relativePath: string): void {
     const filePath: string = path.join(this.#root, name, relativePath);
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -173,11 +178,35 @@ class TestGraph {
     inputsSnapshot: IInputsSnapshot | undefined,
     enabledByRush: ReadonlyArray<string> = []
   ): string[] {
+    return this.#plan({ inputsSnapshot }, enabledByRush);
+  }
+
+  /**
+   * Plans the executing iteration again for another request's work, with the given operations started, and returns
+   * the operations that are enabled. Then the graph accepts the plan, or refuses it.
+   */
+  public extend(
+    inputsSnapshot: IInputsSnapshot,
+    startedNames: ReadonlyArray<string>,
+    accepted: boolean
+  ): string[] {
+    const context: IOperationGraphIterationOptions = {
+      inputsSnapshot,
+      startedOperations: new Set(startedNames.map((name: string) => this.getOperation(name)))
+    };
+    const enabledNames: string[] = this.#plan(context, []);
+    if (accepted) {
+      this.hooks.extendIteration.call(new Map(), context);
+    }
+    return enabledNames;
+  }
+
+  #plan(context: IOperationGraphIterationOptions, enabledByRush: ReadonlyArray<string>): string[] {
     const states: Map<Operation, IConfigurableOperation> = new Map();
     for (const [name, operation] of this.#operations) {
       states.set(operation, { enabled: enabledByRush.includes(name) } as IConfigurableOperation);
     }
-    this.hooks.configureIteration.call(states, this.resultByOperation, { inputsSnapshot });
+    this.hooks.configureIteration.call(states, this.resultByOperation, context);
     return [...states]
       .filter(([, { enabled }]: [Operation, IConfigurableOperation]) => enabled)
       .map(([operation]: [Operation, IConfigurableOperation]) => operation.associatedProject.packageName);
@@ -499,4 +528,139 @@ describe(OperationOutputFingerprints.name, () => {
       expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual(['a']);
     });
   });
+
+  describe('for an iteration that is executing', () => {
+    function createIterationRecords(
+      graph: TestGraph,
+      records: Record<string, Pick<IOperationExecutionResult, 'enabled' | 'status'>>
+    ): Map<Operation, IOperationExecutionResult> {
+      return new Map(
+        Object.entries(records).map(([name, record]) => [
+          graph.getOperation(name),
+          record as IOperationExecutionResult
+        ])
+      );
+    }
+
+    it('reports changed outputs of operations that it neither dispatched nor runs, and keeps their fingerprints', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 1, c: 1, d: 1, e: 1 }, digester);
+      await graph.runAsync('a', 'b', 'c', 'd', 'e');
+      for (const name of ['a', 'b', 'c', 'd', 'e']) {
+        graph.addFile(name, 'temp/package-deps_' + name + '_build.json');
+        fs.rmSync(path.join(root, name, 'lib'), { recursive: true });
+      }
+      const iterationRecords: Map<Operation, IOperationExecutionResult> = createIterationRecords(graph, {
+        // Skipped in the iteration, and not dispatched yet
+        a: { enabled: false, status: OperationStatus.Waiting },
+        b: { enabled: false, status: OperationStatus.Ready },
+        // Runs in the iteration
+        c: { enabled: true, status: OperationStatus.Waiting },
+        // Dispatched
+        d: { enabled: false, status: OperationStatus.Skipped }
+      });
+
+      expect(getNames(graph.fingerprints.peekOperationsWithChangedOutputs(iterationRecords))).toEqual([
+        'a',
+        'b',
+        'e'
+      ]);
+      expect(
+        ['a', 'b', 'c', 'd', 'e'].filter((name: string) => fs.existsSync(graph.getLegacySkipStatePath(name)))
+      ).toEqual(['c', 'd']);
+      expect(getNames(graph.fingerprints.peekOperationsWithChangedOutputs(new Map()))).toEqual([
+        'a',
+        'b',
+        'c',
+        'd',
+        'e'
+      ]);
+      expect(getNames(graph.fingerprints.getOperationsWithChangedOutputs())).toEqual([
+        'a',
+        'b',
+        'c',
+        'd',
+        'e'
+      ]);
+      expect(graph.fingerprints.getOperationsWithChangedOutputs()).toEqual([]);
+    });
+
+    it('reports only operations with a retained result, and keeps the fingerprints of the others', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      fs.rmSync(path.join(root, 'b', 'lib'), { recursive: true });
+      const failed: IOperationExecutionResult = {
+        status: OperationStatus.Failure
+      } as IOperationExecutionResult;
+      const original: IOperationExecutionResult = graph.resultByOperation.get(graph.getOperation('b'))!;
+      graph.resultByOperation.set(graph.getOperation('b'), failed);
+
+      expect(graph.fingerprints.peekOperationsWithChangedOutputs(new Map())).toEqual([]);
+
+      graph.resultByOperation.set(graph.getOperation('b'), original);
+      expect(getNames(graph.fingerprints.peekOperationsWithChangedOutputs(new Map()))).toEqual(['b']);
+    });
+
+    it('does not check the operations that it started when it is planned again', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+
+      graph.addFile('a', 'lib/new.js');
+      graph.addFile('c', 'lib/new.js');
+      expect(graph.extend(inputsSnapshot, ['a', 'b'], true)).toEqual(['c']);
+      expect(digester.takeCalls()).toEqual(['digest c']);
+
+      // The next reconciliation still walks the output folders that the first plan checked
+      const next: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(next);
+      expect(graph.configure(next)).toEqual(['a', 'c']);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'finish']);
+    });
+
+    it('lets the next reconciliation walk the output folders that a plan walked only if the graph accepts the plan', async () => {
+      const graph: TestGraph = new TestGraph(root, { a: 1, b: 2, c: 4, d: 8 }, digester);
+      await graph.runAsync('a', 'b', 'c', 'd');
+      expect(digester.takeCalls()).toEqual(['digest a', 'digest b', 'digest c', 'digest d']);
+      const select = (...names: string[]): void => {
+        for (const name of ['a', 'b', 'c', 'd']) {
+          graph.getOperation(name).enabled = names.includes(name);
+        }
+      };
+      select('a');
+      const first: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(first);
+      expect(graph.configure(first)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,c,b,a', 'finish']);
+
+      select('a', 'd');
+      expect(graph.extend(createInputsSnapshot(), ['a'], false)).toEqual([]);
+      // The graph accepts another plan
+      graph.hooks.extendIteration.call(new Map(), { startedOperations: new Set() });
+      expect(digester.takeCalls()).toEqual(['digest d']);
+      select('a');
+      const second: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(second);
+      expect(graph.configure(second)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start a', 'finish']);
+
+      select('a', 'd');
+      expect(graph.extend(createInputsSnapshot(), ['a'], true)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['digest d']);
+      select('a');
+      const third: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(third);
+      expect(graph.configure(third)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start d,a', 'finish']);
+    });
+
+    it('leaves the walk of a reconciliation to the iteration that uses its inputs snapshot', async () => {
+      const graph: TestGraph = await createGraphAsync();
+      const inputsSnapshot: IInputsSnapshot = createInputsSnapshot();
+      await graph.reconcileAsync(inputsSnapshot);
+      expect(graph.extend(createInputsSnapshot(), ['a', 'b'], true)).toEqual([]);
+      expect(graph.configure(inputsSnapshot)).toEqual([]);
+      expect(digester.takeCalls()).toEqual(['start c,b,a', 'digest c', 'finish']);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
index 40ece2342b..c9f1a5abc5 100644
--- a/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedIterationDemand.test.ts
@@ -42,6 +42,28 @@ function createDemand(): ITestDemand {
 }
 
 describe(PhasedIterationDemand.name, () => {
+  it('is restricted once armed, and a later restriction can add operations that a joining client needs', () => {
+    const { abandonedCount, demand, schedule, setStatus } = createDemand();
+    const needed: ITestRecord = createRecord('needed');
+    const running: ITestRecord = createRecord('running');
+    const joining: ITestRecord = createRecord('joining', false);
+    running.status = OperationStatus.Executing;
+    schedule(needed, running, joining);
+    expect(demand.restricted).toBe(false);
+
+    demand.restrictTo([needed.operation]);
+    expect(demand.restricted).toBe(true);
+    // The client that joins enables its operation, and the batch restricts the demand again
+    joining.enabled = true;
+    demand.restrictTo([needed.operation, joining.operation]);
+    setStatus(needed, OperationStatus.Success);
+
+    expect(joining.enabled).toBe(true);
+    expect(abandonedCount()).toBe(0);
+    setStatus(joining, OperationStatus.Success);
+    expect(abandonedCount()).toBe(1);
+  });
+
   it('never reports an iteration abandoned until it is armed', () => {
     const { abandonedCount, demand, schedule, setStatus } = createDemand();
     const needed: ITestRecord = createRecord('needed');
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
index 22248f7198..84c34a0bab 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventMultiplexer.test.ts
@@ -1,9 +1,13 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IOperationExecutionResult, _IOperationGraphEventSink } from '@microsoft/rush-lib';
+import {
+  type IOperationExecutionResult,
+  OperationStatus,
+  type _IOperationGraphEventSink
+} from '@microsoft/rush-lib';
 
-import { PhasedRequestEventMultiplexer } from '../PhasedRequestEventMultiplexer';
+import { type IRequestEventSink, PhasedRequestEventMultiplexer } from '../PhasedRequestEventMultiplexer';
 
 describe(PhasedRequestEventMultiplexer.name, () => {
   it('forwards stream closure before completion to workspace and request sinks', () => {
@@ -95,4 +99,156 @@ describe(PhasedRequestEventMultiplexer.name, () => {
       expect(announcements).toEqual([[records, 1, true]]);
     });
   });
+
+  describe('when a request sink subscribes to the executing iteration', () => {
+    function createRecord(
+      name: string,
+      status: OperationStatus,
+      dependencyCount: number = 0,
+      silent: boolean = false
+    ): IOperationExecutionResult {
+      return {
+        iterationId: 7,
+        operation: { name, dependencies: new Set(Array.from({ length: dependencyCount }, () => ({}))) },
+        silent,
+        status
+      } as unknown as IOperationExecutionResult;
+    }
+
+    function createRecordingSink(events: unknown[][]): IRequestEventSink {
+      return {
+        onIterationScheduled: (scheduled: Iterable<IOperationExecutionResult>) =>
+          events.push(['scheduled', Array.from(scheduled, (record) => record.operation.name)]),
+        onOperationRegistered: (operationId: string, silent: boolean, record, iterationId: number) =>
+          events.push(['registered', operationId, silent, record?.status, iterationId]),
+        onIterationStarting: (records, parallelism: number, quietMode: boolean) =>
+          events.push(['starting', parallelism, quietMode]),
+        onOperationStatusChanged: (record: IOperationExecutionResult, previousStatus: OperationStatus) =>
+          events.push(['status', record.operation.name, previousStatus, record.status])
+      };
+    }
+
+    it('throws if no iteration was scheduled', () => {
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+
+      expect(() => multiplexer.subscribeToCurrentIteration(createRecordingSink([]))).toThrow(
+        'No iteration was scheduled.'
+      );
+    });
+
+    it('replays the iteration, its start and each changed status, then forwards its events', () => {
+      const ready: IOperationExecutionResult = createRecord('ready', OperationStatus.Ready);
+      const waiting: IOperationExecutionResult = createRecord('waiting', OperationStatus.Waiting, 1);
+      const executing: IOperationExecutionResult = createRecord('executing', OperationStatus.Executing);
+      const unblocked: IOperationExecutionResult = createRecord('unblocked', OperationStatus.Ready, 2);
+      const done: IOperationExecutionResult = createRecord('done', OperationStatus.Success, 1, true);
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      multiplexer.onIterationScheduled([ready, waiting, executing, unblocked, done]);
+      multiplexer.onIterationStarting([ready, waiting, executing, unblocked, done], 3, true);
+      const events: unknown[][] = [];
+
+      multiplexer.subscribeToCurrentIteration(createRecordingSink(events));
+      multiplexer.onOperationStatusChanged(waiting, OperationStatus.Ready);
+
+      expect(events).toEqual([
+        ['scheduled', ['ready', 'waiting', 'executing', 'unblocked', 'done']],
+        ['registered', 'ready', false, OperationStatus.Ready, 7],
+        ['registered', 'waiting', false, OperationStatus.Waiting, 7],
+        ['registered', 'executing', false, OperationStatus.Executing, 7],
+        ['registered', 'unblocked', false, OperationStatus.Ready, 7],
+        ['registered', 'done', true, OperationStatus.Success, 7],
+        ['starting', 3, true],
+        ['status', 'executing', OperationStatus.Ready, OperationStatus.Executing],
+        ['status', 'unblocked', OperationStatus.Waiting, OperationStatus.Ready],
+        ['status', 'done', OperationStatus.Waiting, OperationStatus.Success],
+        ['status', 'waiting', OperationStatus.Ready, OperationStatus.Waiting]
+      ]);
+    });
+
+    it('does not announce an iteration that has not started', () => {
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      multiplexer.onIterationStarting([], 1, false);
+      multiplexer.onIterationScheduled([createRecord('ready', OperationStatus.Ready)]);
+      const events: unknown[][] = [];
+
+      multiplexer.subscribeToCurrentIteration(createRecordingSink(events));
+
+      expect(events).toEqual([
+        ['scheduled', ['ready']],
+        ['registered', 'ready', false, OperationStatus.Ready, 7]
+      ]);
+    });
+
+    it('announces the start as activity to a sink that does not announce iterations itself', () => {
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      const records: IOperationExecutionResult[] = [createRecord('alpha', OperationStatus.Ready)];
+      multiplexer.onIterationScheduled(records);
+      multiplexer.onIterationStarting(records, 2, false);
+      const activity: string[] = [];
+
+      multiplexer.subscribeToCurrentIteration({
+        onIterationScheduled: () => {},
+        onActivity: (text: string) => activity.push(text)
+      });
+
+      expect(activity).toEqual([
+        'Selected 1 operation:',
+        '  alpha',
+        '',
+        'Executing a maximum of 1 simultaneous processes...'
+      ]);
+    });
+
+    it('returns a function that unsubscribes the sink', () => {
+      const record: IOperationExecutionResult = createRecord('ready', OperationStatus.Ready);
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer(undefined);
+      multiplexer.onIterationScheduled([record]);
+      const events: unknown[][] = [];
+
+      multiplexer.subscribeToCurrentIteration(createRecordingSink(events))();
+      multiplexer.onOperationStatusChanged(record, OperationStatus.Ready);
+
+      expect(events).toHaveLength(2);
+    });
+  });
+
+  describe(PhasedRequestEventMultiplexer.prototype.runForIterationRecords.name, () => {
+    it("forwards only the iteration's status changes to request sinks while the callback runs", () => {
+      const scheduled: IOperationExecutionResult = {
+        operation: { name: 'scheduled' }
+      } as IOperationExecutionResult;
+      const retained: IOperationExecutionResult = {
+        operation: { name: 'retained' }
+      } as IOperationExecutionResult;
+      const workspaceEvents: string[] = [];
+      const requestEvents: string[] = [];
+      const multiplexer: PhasedRequestEventMultiplexer = new PhasedRequestEventMultiplexer({
+        onOperationStatusChanged: (record: IOperationExecutionResult) =>
+          workspaceEvents.push(record.operation.name)
+      });
+      multiplexer.subscribe({
+        onIterationScheduled: () => {},
+        onOperationStatusChanged: (record: IOperationExecutionResult) =>
+          requestEvents.push(record.operation.name)
+      });
+      multiplexer.onIterationScheduled([scheduled]);
+
+      const value: number = multiplexer.runForIterationRecords(() => {
+        multiplexer.onOperationStatusChanged(retained, OperationStatus.Success);
+        multiplexer.onOperationStatusChanged(scheduled, OperationStatus.Ready);
+        return 5;
+      });
+      expect(() =>
+        multiplexer.runForIterationRecords(() => {
+          multiplexer.onOperationStatusChanged(retained, OperationStatus.Success);
+          throw new Error('refused');
+        })
+      ).toThrow('refused');
+      multiplexer.onOperationStatusChanged(retained, OperationStatus.Success);
+
+      expect(value).toBe(5);
+      expect(workspaceEvents).toEqual(['retained', 'scheduled', 'retained', 'retained']);
+      expect(requestEvents).toEqual(['scheduled', 'retained']);
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
index f5cb0453ea..27176357e5 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEventSink.test.ts
@@ -47,10 +47,7 @@ it('forwards unscoped and active activity while filtering other operation activi
     { stream: 'stdout', text: 'request summary' },
     { stream: 'stdout', text: 'active detail' }
   ]);
-  expect(activities.map(({ scope }) => scope)).toEqual([
-    undefined,
-    { operationId: ACTIVE_OPERATION }
-  ]);
+  expect(activities.map(({ scope }) => scope)).toEqual([undefined, { operationId: ACTIVE_OPERATION }]);
   expect(activities.every(({ required }) => required)).toBe(true);
 });
 
@@ -240,6 +237,28 @@ describe('the early failure offer', () => {
     expect(onSettled.mock.calls).toEqual([[1]]);
   });
 
+  it('offers a failed result again when asked to, once it was offered and until the sink settles', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createEarlyFailureSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(TARGET_OPERATION, OperationStatus.Blocked),
+      createRecord(FAILED_OPERATION, OperationStatus.Failure),
+      createRecord(RUNNING_OPERATION, OperationStatus.Executing),
+      createRecord(QUEUED_OPERATION, OperationStatus.Success)
+    ]);
+    sink.reofferEarlyFailure();
+    expect(onSettled).not.toHaveBeenCalled();
+
+    sink.settleIfIdle();
+    sink.reofferEarlyFailure();
+    expect(onSettled.mock.calls).toEqual([[1], [1]]);
+
+    sink.onOperationCompleted(createRecord(RUNNING_OPERATION, OperationStatus.Success));
+    sink.reofferEarlyFailure();
+    expect(onSettled.mock.calls).toEqual([[1], [1]]);
+    expect(sink.activeOperationsSettled).toBe(true);
+  });
+
   it('offers nothing once one of its operations was aborted, even before that operation completed', () => {
     const onSettled: jest.Mock = jest.fn();
     const queued: IOperationExecutionResult = createRecord(QUEUED_OPERATION, OperationStatus.Ready);
@@ -254,6 +273,75 @@ describe('the early failure offer', () => {
   });
 });
 
+describe('a sink that subscribes to an iteration that is already executing', () => {
+  it('settles at once when none of its operations is unfinished, and says it settled', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(ACTIVE_OPERATION, OperationStatus.Success),
+      createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.FromCache),
+      createRecord(OTHER_OPERATION, OperationStatus.Executing)
+    ]);
+    expect(sink.activeOperationsSettled).toBe(false);
+
+    sink.settleIfIdle();
+    sink.settleIfIdle();
+    sink.onOperationCompleted(createRecord(ACTIVE_OPERATION, OperationStatus.Success));
+
+    expect(onSettled).toHaveBeenCalledTimes(1);
+    expect(sink.activeOperationsSettled).toBe(true);
+    sink.onIterationScheduled([createRecord(ACTIVE_OPERATION, OperationStatus.Waiting)]);
+    expect(sink.activeOperationsSettled).toBe(false);
+  });
+
+  it('waits for its unfinished operations to complete', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(ACTIVE_OPERATION, OperationStatus.Success),
+      createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Executing)
+    ]);
+
+    sink.settleIfIdle();
+    expect(onSettled).not.toHaveBeenCalled();
+    expect(sink.activeOperationsSettled).toBe(false);
+    sink.onOperationCompleted(createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Success));
+
+    expect(onSettled).toHaveBeenCalledTimes(1);
+    expect(sink.activeOperationsSettled).toBe(true);
+  });
+
+  it('leaves the result of an aborted iteration to the batch', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createSettlingSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(ACTIVE_OPERATION, OperationStatus.Success),
+      createRecord(SECOND_ACTIVE_OPERATION, OperationStatus.Aborted)
+    ]);
+
+    sink.settleIfIdle();
+
+    expect(onSettled).not.toHaveBeenCalled();
+    expect(sink.activeOperationsSettled).toBe(false);
+  });
+
+  it('offers a failed result once its targets are finished', () => {
+    const onSettled: jest.Mock = jest.fn();
+    const sink: PhasedRequestEventSink = createEarlyFailureSink(onSettled);
+    sink.onIterationScheduled([
+      createRecord(TARGET_OPERATION, OperationStatus.Blocked),
+      createRecord(FAILED_OPERATION, OperationStatus.Failure),
+      createRecord(RUNNING_OPERATION, OperationStatus.Executing),
+      createRecord(QUEUED_OPERATION, OperationStatus.Success)
+    ]);
+
+    sink.settleIfIdle();
+
+    expect(onSettled.mock.calls).toEqual([[1]]);
+    expect(sink.activeOperationsSettled).toBe(false);
+  });
+});
+
 describe('the iteration announcement', () => {
   async function getActivityTextsAsync(
     client: TestPhasedRequestClient,
diff --git a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
new file mode 100644
index 0000000000..e3a295ba22
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
@@ -0,0 +1,1465 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as path from 'node:path';
+
+import type {
+  IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
+  IDaemonRequestAdmissionOptions
+} from '@rushstack/rush-daemon-protocol';
+import { OperationStatus, RushConfiguration } from '@microsoft/rush-lib';
+import type {
+  IInputsSnapshot,
+  IOperationGraphIterationOptions,
+  IPhasedCommandEngineRequestSettings,
+  Operation
+} from '@microsoft/rush-lib';
+
+import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
+import { RequestExclusivityClass } from '../RequestScheduler';
+import type {
+  IPeekWorkspaceInvalidationsOptions,
+  IWorkspaceInvalidationPeek
+} from '../WorkspaceEngineComponentFactory';
+import {
+  TEST_ENGINE_SHAPE,
+  TestOperationRunner,
+  TestPhasedRequestClient,
+  createRoutingFixture
+} from './PhasedRequestRouterTestUtilities';
+import type { ITestRoutingFixture } from './PhasedRequestRouterTestUtilities';
+import { TEST_REPO_ROOT } from './TestWorkspaceSession';
+
+const JOIN_VARIABLE: string = 'RUSH_DAEMON_JOIN_RUNNING_BATCH';
+const COBUILD_VARIABLE: string = 'RUSH_COBUILD_CONTEXT_ID';
+/** A variable that a request's environment passes to the operations that are attributed to it. */
+const SESSION_VARIABLE: string = 'COPILOT_AGENT_SESSION_ID';
+const OPERATION_A: string = 'project-a (_phase:test)';
+const OPERATION_B: string = 'project-b (_phase:test)';
+const OPERATION_C: string = 'project-c (_phase:test)';
+const OPERATION_IDS: ReadonlyArray<string> = [OPERATION_A, OPERATION_B, OPERATION_C];
+
+function restoreVariable(name: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+}
+
+/**
+ * Loads the test repository's configuration as a daemon started with `value` as the value of the join variable
+ * loads it, so that the checks of the Rush environment and of the daemon configuration apply to the variable.
+ */
+function loadConfiguration(value: string): RushConfiguration {
+  const previousValue: string | undefined = process.env[JOIN_VARIABLE];
+  process.env[JOIN_VARIABLE] = value;
+  try {
+    return RushConfiguration.loadFromConfigurationFile(path.join(TEST_REPO_ROOT, 'rush.json'));
+  } finally {
+    restoreVariable(JOIN_VARIABLE, previousValue);
+  }
+}
+
+const JOIN_CONFIGURATION: RushConfiguration = loadConfiguration('1');
+const NO_JOIN_CONFIGURATION: RushConfiguration = loadConfiguration('0');
+
+interface IDeferred<T = void> {
+  readonly promise: Promise<T>;
+  readonly resolve: (value: T) => void;
+}
+
+function createDeferred<T = void>(): IDeferred<T> {
+  let resolvePromise: ((value: T) => void) | undefined;
+  const promise: Promise<T> = new Promise<T>((resolve) => {
+    resolvePromise = resolve;
+  });
+  return { promise, resolve: (value: T) => resolvePromise?.(value) };
+}
+
+/** Controls one operation's runner: the runner reports its start and, if blocked, waits until it is released. */
+interface IOperationGate {
+  readonly blocked: boolean;
+  readonly released: IDeferred;
+  readonly started: IDeferred;
+}
+
+interface ITestPeek extends IWorkspaceInvalidationPeek {
+  readonly commit: jest.Mock;
+  readonly discard: jest.Mock;
+}
+
+/** The messages that the router logged about requests that tried to join an executing iteration. */
+const joinLog: string[] = [];
+let stderrSpy: jest.SpyInstance | undefined;
+let previousJoinValue: string | undefined;
+let previousCobuildValue: string | undefined;
+
+interface IJoinFixture {
+  readonly fixture: ITestRoutingFixture;
+  readonly gates: ReadonlyMap<string, IOperationGate>;
+  readonly inputsSnapshot: IInputsSnapshot;
+  readonly peekCalls: IPeekWorkspaceInvalidationsOptions[];
+  readonly peeks: ITestPeek[];
+  readonly router: PhasedRequestRouter;
+  readonly scheduleSpy: jest.SpyInstance;
+  /** The value of `SESSION_VARIABLE` in the environment in which each operation last ran. */
+  readonly sessions: ReadonlyMap<string, string | undefined>;
+  /** Replaces the default peek, which reports no invalidations. */
+  peekAsync: (() => Promise<IWorkspaceInvalidationPeek | undefined>) | undefined;
+}
+
+interface IJoinFixtureOptions {
+  /** Pairs of a consumer and its dependency. */
+  readonly dependencies?: ReadonlyArray<readonly [string, string]>;
+  readonly failedOperationIds?: ReadonlyArray<string>;
+  /** Whether the daemon configuration of the session enables `joinRunningBatch`; true by default. */
+  readonly joinRunningBatch?: boolean;
+}
+
+function createJoinFixture(
+  blockedOperationIds: ReadonlyArray<string> = [],
+  { dependencies = [], failedOperationIds = [], joinRunningBatch = true }: IJoinFixtureOptions = {}
+): IJoinFixture {
+  const gates: Map<string, IOperationGate> = new Map();
+  const runners: Map<string, TestOperationRunner> = new Map();
+  const sessions: Map<string, string | undefined> = new Map();
+  for (const operationId of OPERATION_IDS) {
+    const gate: IOperationGate = {
+      blocked: blockedOperationIds.includes(operationId),
+      released: createDeferred(),
+      started: createDeferred()
+    };
+    gates.set(operationId, gate);
+    runners.set(
+      operationId,
+      new TestOperationRunner(
+        operationId,
+        failedOperationIds.includes(operationId) ? OperationStatus.Failure : OperationStatus.Success,
+        async (terminal, context): Promise<void> => {
+          sessions.set(operationId, context.environment?.[SESSION_VARIABLE]);
+          gate.started.resolve();
+          if (gate.blocked) {
+            await gate.released.promise;
+          }
+        }
+      )
+    );
+  }
+  const fixture: ITestRoutingFixture = createRoutingFixture(runners, dependencies, { parallelism: 3 });
+  const inputsSnapshot: IInputsSnapshot = {
+    getOperationOwnStateHash: () => 'hash',
+    getTrackedFileHashesForOperation: () => new Map(),
+    hasUncommittedChanges: false,
+    hashes: new Map(),
+    rootDirectory: TEST_REPO_ROOT
+  };
+  const peeks: ITestPeek[] = [];
+  const peekCalls: IPeekWorkspaceInvalidationsOptions[] = [];
+  const joinFixture: IJoinFixture = {
+    fixture,
+    gates,
+    inputsSnapshot,
+    peekCalls,
+    peeks,
+    router: new PhasedRequestRouter(fixture.session),
+    scheduleSpy: jest.spyOn(fixture.graph, 'scheduleIterationAsync'),
+    sessions,
+    peekAsync: undefined
+  };
+  Object.assign(fixture.session, {
+    inputsSnapshot,
+    rushConfiguration: joinRunningBatch ? JOIN_CONFIGURATION : NO_JOIN_CONFIGURATION,
+    peekInvalidationsAsync: async (
+      options: IPeekWorkspaceInvalidationsOptions
+    ): Promise<IWorkspaceInvalidationPeek | undefined> => {
+      peekCalls.push(options);
+      if (joinFixture.peekAsync) {
+        return await joinFixture.peekAsync();
+      }
+      return createTestPeek(joinFixture);
+    }
+  });
+  return joinFixture;
+}
+
+function createTestPeek(joinFixture: IJoinFixture, invalidated: Iterable<Operation> = []): ITestPeek {
+  const peek: ITestPeek = {
+    inputsSnapshot: joinFixture.inputsSnapshot,
+    invalidatedOperations: new Set(invalidated),
+    invalidationReason: 'test-inputs-changed',
+    commit: jest.fn(),
+    discard: jest.fn()
+  };
+  joinFixture.peeks.push(peek);
+  return peek;
+}
+
+function createRequest(
+  requestId: string,
+  operationIds: ReadonlyArray<string>,
+  admission?: IDaemonRequestAdmissionOptions
+): IDaemonPhasedRequest {
+  return {
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    engineShape: TEST_ENGINE_SHAPE,
+    environment: {},
+    operationSelection: operationIds.map((operationId: string) => ({ enabledState: true, operationId })),
+    requestId,
+    ...(admission ? { admission } : {})
+  };
+}
+
+function withSession(request: IDaemonPhasedRequest, session: string): IDaemonPhasedRequest {
+  return { ...request, environment: { [SESSION_VARIABLE]: session } };
+}
+
+function getOperationStatuses(result: IDaemonPhasedRequestResult): Record<string, string> {
+  return Object.fromEntries(result.operationResults.map(({ operationId, status }) => [operationId, status]));
+}
+
+/** Records when a result arrived, relative to the other events of a test. */
+function track(
+  resultPromise: Promise<IDaemonPhasedRequestResult>,
+  label: string,
+  events: string[]
+): Promise<IDaemonPhasedRequestResult> {
+  return resultPromise.then((result: IDaemonPhasedRequestResult) => {
+    events.push(`result:${label}`);
+    return result;
+  });
+}
+
+async function settleAsync(): Promise<void> {
+  for (let turn: number = 0; turn < 20; turn++) {
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+async function waitForAsync(condition: () => boolean): Promise<void> {
+  for (let turn: number = 0; turn < 200; turn++) {
+    if (condition()) {
+      return;
+    }
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+  throw new Error('The condition was not met.');
+}
+
+function collectTelemetry(reports: IPhasedRequestTelemetryReport[]): IPhasedRequestTelemetrySink {
+  return { logRequest: (report: IPhasedRequestTelemetryReport) => reports.push(report) };
+}
+
+beforeEach(() => {
+  previousJoinValue = process.env[JOIN_VARIABLE];
+  previousCobuildValue = process.env[COBUILD_VARIABLE];
+  // Only the daemon configuration that the session loaded enables joining.
+  delete process.env[JOIN_VARIABLE];
+  delete process.env[COBUILD_VARIABLE];
+  joinLog.length = 0;
+  const write: typeof process.stderr.write = process.stderr.write.bind(process.stderr);
+  stderrSpy = jest.spyOn(process.stderr, 'write').mockImplementation(((chunk: unknown, ...rest: never[]) => {
+    const text: string = String(chunk);
+    if (text.includes('the executing iteration')) {
+      joinLog.push(
+        text
+          .replace(/^\S+ /, '')
+          .replace(/ after \d+ ms/, '')
+          .trimEnd()
+      );
+      return true;
+    }
+    return write(chunk as string, ...rest);
+  }) as typeof process.stderr.write);
+});
+
+afterEach(() => {
+  stderrSpy?.mockRestore();
+  restoreVariable(JOIN_VARIABLE, previousJoinValue);
+  restoreVariable(COBUILD_VARIABLE, previousCobuildValue);
+});
+
+describe('a request that arrives while a compatible batch executes', () => {
+  it('joins the executing iteration and gets its result while the batch still runs', async () => {
+    const { fixture, gates, peekCalls, peeks, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    const firstResult: IDaemonPhasedRequestResult = await first;
+
+    expect(events).toEqual(['C released', 'result:first']);
+    expect(joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(joined)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+    expect(firstResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(firstResult)).toEqual({ [OPERATION_C]: OperationStatus.Success });
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect((scheduleSpy.mock.calls[0][0] as IOperationGraphIterationOptions).holdUnneededOperations).toBe(
+      true
+    );
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+    expect(peekCalls).toHaveLength(1);
+    expect(peekCalls[0].executingIterationRecords.has(fixture.operations.get(OPERATION_C)!)).toBe(true);
+    expect(peeks[0].commit).toHaveBeenCalledTimes(1);
+    expect(peeks[0].discard).not.toHaveBeenCalled();
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('loads the join setting of a daemon started with the variable', () => {
+    expect(JOIN_CONFIGURATION.daemon.joinRunningBatch).toBe(true);
+    expect(NO_JOIN_CONFIGURATION.daemon.joinRunningBatch).toBe(false);
+  });
+
+  it('waits for the iteration to end as before when the daemon configuration does not enable joining', async () => {
+    // The variable in the daemon's environment at request time does not matter; its configuration does.
+    process.env[JOIN_VARIABLE] = '1';
+    const { fixture, gates, peekCalls, router, scheduleSpy } = createJoinFixture([OPERATION_C], {
+      joinRunningBatch: false
+    });
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('late', [OPERATION_A]), new TestPhasedRequestClient('late')),
+      'late',
+      events
+    );
+    await settleAsync();
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    const [firstResult, lateResult] = await Promise.all([first, late]);
+
+    expect(events).toEqual(['C released', 'result:first', 'result:late']);
+    expect(firstResult.outcome).toBe('success');
+    expect(lateResult.outcome).toBe('success');
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(scheduleSpy.mock.calls[0][0]).not.toHaveProperty('holdUnneededOperations');
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([]);
+  });
+
+  it('gives a participant whose operations are done its result when a request joins', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C, OPERATION_A]);
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const peekReleased: IDeferred = createDeferred();
+    const peekStarted: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('joined', [OPERATION_A]), new TestPhasedRequestClient('joined')),
+      'joined',
+      events
+    );
+    await peekStarted.promise;
+    // The first request's operations finish while the join reads the inputs, which keeps the iteration running.
+    gates.get(OPERATION_C)!.released.resolve();
+    await settleAsync();
+    events.push('peek released');
+    peekReleased.resolve();
+    await gates.get(OPERATION_A)!.started.promise;
+    await settleAsync();
+    events.push('A released');
+    gates.get(OPERATION_A)!.released.resolve();
+    const [firstResult, joinedResult] = await Promise.all([first, joined]);
+
+    expect(events).toEqual(['peek released', 'result:first', 'A released', 'result:joined']);
+    expect(firstResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(firstResult)).toEqual({ [OPERATION_C]: OperationStatus.Success });
+    expect(joinedResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('gives a failed participant its result when a request joins', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_B, OPERATION_A], {
+      dependencies: [[OPERATION_C, OPERATION_B]],
+      failedOperationIds: [OPERATION_B]
+    });
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const peekReleased: IDeferred = createDeferred();
+    const peekStarted: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        { ...createRequest('first', [OPERATION_C]), returnEarlyOnFailure: true },
+        new TestPhasedRequestClient('first')
+      ),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_B)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('joined', [OPERATION_A]), new TestPhasedRequestClient('joined')),
+      'joined',
+      events
+    );
+    await peekStarted.promise;
+    // The failure blocks the first request's target, and its blocked operation completes only when the iteration
+    // ends, so its failed result waits for another participant.
+    gates.get(OPERATION_B)!.released.resolve();
+    await settleAsync();
+    events.push('peek released');
+    peekReleased.resolve();
+    await gates.get(OPERATION_A)!.started.promise;
+    await settleAsync();
+    events.push('A released');
+    gates.get(OPERATION_A)!.released.resolve();
+    const [firstResult, joinedResult] = await Promise.all([first, joined]);
+
+    expect(events).toEqual(['peek released', 'result:first', 'A released', 'result:joined']);
+    expect(firstResult).toMatchObject({ outcome: 'failure' });
+    expect(getOperationStatuses(firstResult)).toEqual({
+      [OPERATION_B]: OperationStatus.Failure,
+      [OPERATION_C]: OperationStatus.Blocked
+    });
+    expect(joinedResult).toMatchObject({ exitCode: 0, outcome: 'success' });
+  });
+
+  it('gives a request whose operations already ran in the iteration its result at once', async () => {
+    const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        createRequest('first', [OPERATION_A, OPERATION_C]),
+        new TestPhasedRequestClient('first')
+      ),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    await waitForAsync(() => fixture.runners.get(OPERATION_A)!.runCount === 1);
+    await settleAsync();
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    await first;
+
+    expect(events).toEqual(['C released', 'result:first']);
+    expect(joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(joined)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it.each<[string, IDaemonRequestAdmissionOptions | undefined]>([
+    ['without admission options', undefined],
+    ['with the default wait timeout', { waitTimeoutMs: 30_000, waitTimeoutIsDefault: true }]
+  ])('waits for the iteration to start before it joins, %s', async (title, admission) => {
+    const { gates, router, scheduleSpy, fixture } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    // Received after the reconcile started, so it cannot join the batch before it executes.
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A], admission),
+      new TestPhasedRequestClient('joined')
+    );
+    await settleAsync();
+    reconcileReleased.resolve();
+
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('takes part in the batch telemetry as a request that joined', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C]);
+    const firstReports: IPhasedRequestTelemetryReport[] = [];
+    const joinedReports: IPhasedRequestTelemetryReport[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first'),
+      false,
+      undefined,
+      undefined,
+      collectTelemetry(firstReports)
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      undefined,
+      undefined,
+      collectTelemetry(joinedReports)
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+    await first;
+
+    expect(joinedReports).toHaveLength(1);
+    const [joinedReport] = joinedReports;
+    expect(joinedReport).toMatchObject({
+      batchSize: 2,
+      earlyResult: true,
+      joinedIteration: true,
+      scheduled: true
+    });
+    expect(joinedReport.measures.map(({ name }) => name)).toEqual([
+      'rush:daemon:admission',
+      'rush:daemon:queueWait',
+      'rush:daemon:joinRunningIteration',
+      'rush:daemon:reconcileInvalidations',
+      'rush:daemon:applySelections',
+      'rush:daemon:scheduleIteration',
+      'rush:daemon:executeIteration'
+    ]);
+    const joinMeasure = joinedReport.measures[2];
+    expect(joinedReport.executionStartTimeMs).toBe(joinMeasure.startTimeMs);
+    expect(joinedReport.iterationStartTimeMs).toBeGreaterThanOrEqual(joinMeasure.startTimeMs);
+    expect(joinedReport.iterationStartTimeMs).toBeLessThanOrEqual(joinMeasure.endTimeMs);
+    expect(firstReports).toHaveLength(1);
+    expect(firstReports[0]).toMatchObject({ batchSize: 2, earlyResult: false });
+    expect(firstReports[0]).not.toHaveProperty('joinedIteration');
+    expect(firstReports[0].measures.map(({ name }) => name)).not.toContain(
+      'rush:daemon:joinRunningIteration'
+    );
+  });
+
+  it('ends the execution measure of a request that joined when the iteration ends', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C], {
+      dependencies: [[OPERATION_A, OPERATION_C]]
+    });
+    const joinedReports: IPhasedRequestTelemetryReport[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      undefined,
+      undefined,
+      collectTelemetry(joinedReports)
+    );
+    await waitForAsync(() => joinLog.length === 1);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    // Its work was the last that the iteration ran, so its result waited for the iteration to end.
+    expect(joinedReports).toHaveLength(1);
+    const [joinedReport] = joinedReports;
+    expect(joinedReport).toMatchObject({ earlyResult: false, joinedIteration: true });
+    const executeMeasure = joinedReport.measures.find(({ name }) => name === 'rush:daemon:executeIteration');
+    expect(executeMeasure!.endTimeMs).toBeLessThan(joinedReport.resultTimeMs);
+  });
+
+  it('keeps work that it needs from being withheld after another participant left', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C, OPERATION_A]);
+    const leaving: TestPhasedRequestClient = new TestPhasedRequestClient('leaving');
+    const staying: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('staying', [OPERATION_C]),
+      new TestPhasedRequestClient('staying')
+    );
+    const left: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('leaving', [OPERATION_C]),
+      leaving
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    leaving.abortController.abort();
+    expect(await left).toMatchObject({ aborted: true });
+
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    await gates.get(OPERATION_A)!.started.promise;
+    // The work of the request that joined is still running when the last operation that the batch needed ends.
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await staying).outcome).toBe('success');
+    gates.get(OPERATION_A)!.released.resolve();
+
+    const joinedResult: IDaemonPhasedRequestResult = await joined;
+    expect(joinedResult).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(getOperationStatuses(joinedResult)).toEqual({ [OPERATION_A]: OperationStatus.Success });
+  });
+
+  it('answers a request that joined and then cancelled while the batch runs on', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C, OPERATION_A]);
+    const joinedClient: TestPhasedRequestClient = new TestPhasedRequestClient('joined');
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      joinedClient
+    );
+    await gates.get(OPERATION_A)!.started.promise;
+    joinedClient.abortController.abort();
+
+    expect(await joined).toMatchObject({ aborted: true });
+    // The operation that the request started runs on, as another participant still needs the iteration.
+    gates.get(OPERATION_A)!.released.resolve();
+    await settleAsync();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect(await first).toMatchObject({ aborted: false, exitCode: 0, outcome: 'success' });
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+  });
+
+  it('fails only the request that joined when its execution cannot start', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      () => {
+        throw new Error('The workspace generation changed.');
+      }
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(joined).toMatchObject({
+      errorMessage: 'The workspace generation changed.',
+      exitCode: 1,
+      scheduled: false
+    });
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    // None of its work was added to the iteration.
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    expect(joinLog).toEqual([
+      'Request joined did not join the executing iteration: its execution could not start: The workspace generation changed.'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('fails only the request that joined when its inputs cannot be committed, and withholds its work', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
+      dependencies: [[OPERATION_A, OPERATION_C]]
+    });
+    const { fixture, gates, router } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      peek.commit.mockImplementation(() => {
+        throw new Error('The inputs could not be committed.');
+      });
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(joined).toMatchObject({
+      errorMessage: 'The inputs could not be committed.',
+      exitCode: 1,
+      scheduled: false
+    });
+    expect(await first).toMatchObject({ exitCode: 0, outcome: 'success' });
+    // Its work waited for C, and no participant needs it.
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+  });
+
+  it('runs the work of a request that failed after it joined in the environment of a later request', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
+      dependencies: [[OPERATION_A, OPERATION_C]]
+    });
+    const { gates, router, sessions } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      if (joinFixture.peeks.length === 1) {
+        peek.commit.mockImplementation(() => {
+          throw new Error('The inputs could not be committed.');
+        });
+      }
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const failed: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('failed', [OPERATION_A]), 'session-failed'),
+      new TestPhasedRequestClient('failed')
+    );
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('late', [OPERATION_A]), 'session-late'),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length === 2);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(failed).toMatchObject({ errorMessage: 'The inputs could not be committed.', exitCode: 1 });
+    expect(await late).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request failed joined the executing iteration.',
+      'Request late joined the executing iteration.'
+    ]);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-late']
+      ])
+    );
+  });
+
+  it('runs the work that a request dispatched before it failed in the environment of that request', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, sessions } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      peek.commit.mockImplementation(() => {
+        throw new Error('The inputs could not be committed.');
+      });
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const failed: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('failed', [OPERATION_A]), 'session-failed'),
+      new TestPhasedRequestClient('failed')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(failed).toMatchObject({ errorMessage: 'The inputs could not be committed.', exitCode: 1 });
+    expect((await first).outcome).toBe('success');
+    // A free slot took its work as the iteration was extended.
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-failed']
+      ])
+    );
+  });
+
+  it('keeps the environment of the work of another request that joined when a request fails after it joined', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
+      dependencies: [
+        [OPERATION_A, OPERATION_C],
+        [OPERATION_B, OPERATION_C]
+      ]
+    });
+    const { fixture, gates, router, sessions } = joinFixture;
+    joinFixture.peekAsync = async () => {
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      if (joinFixture.peeks.length === 2) {
+        peek.commit.mockImplementation(() => {
+          throw new Error('The inputs could not be committed.');
+        });
+      }
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('joined', [OPERATION_A]), 'session-joined'),
+      new TestPhasedRequestClient('joined')
+    );
+    await waitForAsync(() => joinLog.length === 1);
+    const failed: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('failed', [OPERATION_B]), 'session-failed'),
+      new TestPhasedRequestClient('failed')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(failed).toMatchObject({ errorMessage: 'The inputs could not be committed.', exitCode: 1 });
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-joined']
+      ])
+    );
+  });
+
+  it('keeps the iteration from ending while it reads the inputs', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const peekStarted: IDeferred = createDeferred();
+    const peekReleased: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    await peekStarted.promise;
+    // The last operation that the batch needs ends while the inputs are read.
+    gates.get(OPERATION_C)!.released.resolve();
+    await settleAsync();
+    peekReleased.resolve();
+
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('lets requests that arrive together join one at a time', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const events: string[] = [];
+    joinFixture.peekAsync = async () => {
+      const index: number = joinFixture.peeks.length + 1;
+      events.push(`peek ${index}`);
+      // Gives a request that joins at the same time every chance to read the inputs meanwhile.
+      await settleAsync();
+      const peek: ITestPeek = createTestPeek(joinFixture);
+      peek.commit.mockImplementation(() => {
+        events.push(`commit ${index}`);
+      });
+      return peek;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joinedResults: IDaemonPhasedRequestResult[] = await Promise.all([
+      router.executeAsync(createRequest('joined-a', [OPERATION_A]), new TestPhasedRequestClient('joined-a')),
+      router.executeAsync(createRequest('joined-b', [OPERATION_B]), new TestPhasedRequestClient('joined-b'))
+    ]);
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(joinedResults.map(getOperationStatuses)).toEqual([
+      { [OPERATION_A]: OperationStatus.Success },
+      { [OPERATION_B]: OperationStatus.Success }
+    ]);
+    expect((await first).outcome).toBe('success');
+    expect(events).toEqual(['peek 1', 'commit 1', 'peek 2', 'commit 2']);
+    expect(joinLog).toEqual([
+      'Request joined-a joined the executing iteration.',
+      'Request joined-b joined the executing iteration.'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(1);
+  });
+
+  it('runs its work in its own environment, not in that of a request that could not join', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router, sessions } = joinFixture;
+    // The inputs of C changed before the first request that tries to join, and not since.
+    joinFixture.peekAsync = async () =>
+      createTestPeek(
+        joinFixture,
+        joinFixture.peeks.length === 0 ? [fixture.operations.get(OPERATION_C)!] : []
+      );
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      withSession(createRequest('first', [OPERATION_C]), 'session-first'),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    // It needs C, which started before its inputs changed, and it does not wait for the graph.
+    const refused: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('refused', [OPERATION_A, OPERATION_C], { noWait: true }), 'session-refused'),
+      new TestPhasedRequestClient('refused')
+    );
+    const joined: IDaemonPhasedRequestResult = await router.executeAsync(
+      withSession(createRequest('joined', [OPERATION_A]), 'session-joined'),
+      new TestPhasedRequestClient('joined')
+    );
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect(refused).toMatchObject({ admissionErrorCode: 'no-wait', scheduled: false });
+    expect(joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect((await first).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      `Request refused did not join the executing iteration: "${OPERATION_C}" started before its inputs or outputs changed.`,
+      'Request joined joined the executing iteration.'
+    ]);
+    expect(sessions).toEqual(
+      new Map([
+        [OPERATION_C, 'session-first'],
+        [OPERATION_A, 'session-joined']
+      ])
+    );
+  });
+});
+
+describe('a request that cannot join the executing iteration', () => {
+  async function expectToWaitForTheIterationAsync(
+    joinFixture: IJoinFixture,
+    late: IDaemonPhasedRequest,
+    lateClient: TestPhasedRequestClient = new TestPhasedRequestClient('late'),
+    lateSettings?: IPhasedCommandEngineRequestSettings
+  ): Promise<IDaemonPhasedRequestResult> {
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const lateResult: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(late, lateClient, false, undefined, lateSettings),
+      'late',
+      events
+    );
+    await settleAsync();
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    await first;
+    const result: IDaemonPhasedRequestResult = await lateResult;
+    expect(events).toEqual(['C released', 'result:first', 'result:late']);
+    return result;
+  }
+
+  it('waits for the iteration to end if its request settings differ', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A]),
+      undefined,
+      { parallelism: 1, quietMode: false, isIncrementalBuildAllowed: true }
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(joinFixture.peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([]);
+  });
+
+  it('waits for the iteration to end if the changed inputs cannot be added to it', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    joinFixture.peekAsync = async () => undefined;
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A])
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the changed inputs cannot be added to an executing iteration'
+    ]);
+  });
+
+  it('waits for the iteration to end if reading the inputs fails', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    joinFixture.peekAsync = async () => {
+      throw new Error('The inputs could not be read.');
+    };
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A])
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: reading the inputs failed: The inputs could not be read.'
+    ]);
+  });
+
+  it('waits for the iteration to end if another request waits for the graph', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { gates, router } = joinFixture;
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('first', [OPERATION_C]), new TestPhasedRequestClient('first')),
+      'first',
+      events
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const waiting: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(
+        createRequest('waiting', [OPERATION_B]),
+        new TestPhasedRequestClient('waiting'),
+        false,
+        undefined,
+        { parallelism: 1, quietMode: false, isIncrementalBuildAllowed: true }
+      ),
+      'waiting',
+      events
+    );
+    await settleAsync();
+    const late: Promise<IDaemonPhasedRequestResult> = track(
+      router.executeAsync(createRequest('late', [OPERATION_A]), new TestPhasedRequestClient('late')),
+      'late',
+      events
+    );
+    await settleAsync();
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    const results: IDaemonPhasedRequestResult[] = await Promise.all([first, waiting, late]);
+
+    expect(results.map(({ outcome }) => outcome)).toEqual(['success', 'success', 'success']);
+    expect(events).toEqual(['C released', 'result:first', 'result:waiting', 'result:late']);
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(3);
+    expect(joinFixture.peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: another request waits for the graph'
+    ]);
+  });
+
+  it('restores the graph and discards the inputs if the iteration cannot take its work', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    joinFixture.peekAsync = async () => createTestPeek(joinFixture, [fixture.operations.get(OPERATION_C)!]);
+    const getEnabledStates = (): Operation['enabled'][] =>
+      OPERATION_IDS.map((operationId: string) => fixture.operations.get(operationId)!.enabled);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const enabledStates: Operation['enabled'][] = getEnabledStates();
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A, OPERATION_C]),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      `Request late did not join the executing iteration: "${OPERATION_C}" started before its inputs or outputs changed.`
+    ]);
+    expect(getEnabledStates()).toEqual(enabledStates);
+    expect(joinFixture.peeks).toHaveLength(1);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
+  });
+
+  it('restores the graph and discards the inputs if extending the iteration fails', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    jest.spyOn(fixture.graph, 'tryExtendCurrentIteration').mockImplementation(() => {
+      throw new Error('A plugin failed.');
+    });
+    const getEnabledStates = (): Operation['enabled'][] =>
+      OPERATION_IDS.map((operationId: string) => fixture.operations.get(operationId)!.enabled);
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const enabledStates: Operation['enabled'][] = getEnabledStates();
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: extending the iteration failed: A plugin failed.'
+    ]);
+    expect(getEnabledStates()).toEqual(enabledStates);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not wait for the iteration to start if its admission does not wait', async () => {
+    const { fixture, gates, router } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_A], { noWait: true }),
+      new TestPhasedRequestClient('late')
+    );
+    expect(late).toMatchObject({ admissionErrorCode: 'no-wait', scheduled: false });
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration has not started, and the request limits its wait'
+    ]);
+    reconcileReleased.resolve();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+  });
+
+  it('does not join if it was cancelled while the inputs were read', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    const peekStarted: IDeferred = createDeferred();
+    const peekReleased: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const lateClient: TestPhasedRequestClient = new TestPhasedRequestClient('late');
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      lateClient
+    );
+    await peekStarted.promise;
+    lateClient.abortController.abort();
+    peekReleased.resolve();
+
+    expect(await late).toMatchObject({ aborted: true });
+    expect(joinLog).toEqual(['Request late did not join the executing iteration: the request was cancelled']);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits for the iteration to end if its admission limits its wait', async () => {
+    const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A], { waitTimeoutMs: 60_000 }),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+    reconcileReleased.resolve();
+    gates.get(OPERATION_C)!.released.resolve();
+
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration has not started, and the request limits its wait'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('waits for the next iteration if the iteration ends before it starts', async () => {
+    const { fixture, router, scheduleSpy } = createJoinFixture();
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+      throw new Error('The inputs could not be reconciled.');
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await settleAsync();
+    reconcileReleased.resolve();
+
+    await expect(first).rejects.toThrow('The inputs could not be reconciled.');
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration ended before it started'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('waits for the iteration to end if no participant needs it', async () => {
+    const { gates, router } = createJoinFixture([OPERATION_C]);
+    const firstClient: TestPhasedRequestClient = new TestPhasedRequestClient('first');
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      firstClient
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    firstClient.abortController.abort();
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: no participant needs the iteration'
+    ]);
+    gates.get(OPERATION_C)!.released.resolve();
+    expect(await first).toMatchObject({ aborted: true });
+    expect((await late).outcome).toBe('success');
+  });
+
+  it('waits for the next iteration if the iteration ended while the inputs were read', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { gates, router, scheduleSpy } = joinFixture;
+    const peekStarted: IDeferred = createDeferred();
+    const peekReleased: IDeferred = createDeferred();
+    joinFixture.peekAsync = async () => {
+      peekStarted.resolve();
+      await peekReleased.promise;
+      return createTestPeek(joinFixture);
+    };
+    const firstClient: TestPhasedRequestClient = new TestPhasedRequestClient('first');
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      firstClient
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await peekStarted.promise;
+    // The only participant cancels, which ends the iteration once its running operation ends.
+    firstClient.abortController.abort();
+    gates.get(OPERATION_C)!.released.resolve();
+    expect(await first).toMatchObject({ aborted: true });
+    peekReleased.resolve();
+
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual(['Request late did not join the executing iteration: the iteration ended']);
+    expect(joinFixture.peeks[0].discard).toHaveBeenCalledTimes(1);
+    expect(joinFixture.peeks[0].commit).not.toHaveBeenCalled();
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it('waits for the iteration to end if the iteration holds no operations', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    jest.spyOn(joinFixture.fixture.graph, 'retainHeldOperations').mockReturnValue(undefined);
+    const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+      joinFixture,
+      createRequest('late', [OPERATION_A])
+    );
+
+    expect(result.outcome).toBe('success');
+    expect(joinFixture.peekCalls).toHaveLength(0);
+    expect(joinLog).toEqual([
+      'Request late did not join the executing iteration: the iteration holds no operations'
+    ]);
+  });
+
+  it('waits for the iteration to end if a request that an earlier batch left waiting waits for the graph', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C, OPERATION_B]);
+    const { gates, router, scheduleSpy } = joinFixture;
+    const otherSettings: IPhasedCommandEngineRequestSettings = {
+      parallelism: 1,
+      quietMode: false,
+      isIncrementalBuildAllowed: true
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const other: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('other', [OPERATION_B]),
+      new TestPhasedRequestClient('other'),
+      false,
+      undefined,
+      otherSettings
+    );
+    await settleAsync();
+    const waiting: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('waiting', [OPERATION_A]),
+      new TestPhasedRequestClient('waiting')
+    );
+    await waitForAsync(() => joinLog.length > 0);
+    // The next batch takes the request with the other settings, and leaves the waiting request waiting.
+    gates.get(OPERATION_C)!.released.resolve();
+    await gates.get(OPERATION_B)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late'),
+      false,
+      undefined,
+      otherSettings
+    );
+    await waitForAsync(() => joinLog.length > 1);
+    gates.get(OPERATION_B)!.released.resolve();
+
+    const results: IDaemonPhasedRequestResult[] = await Promise.all([first, other, waiting, late]);
+    expect(results.map(({ outcome }) => outcome)).toEqual(['success', 'success', 'success', 'success']);
+    expect(joinLog).toEqual([
+      'Request waiting did not join the executing iteration: another request waits for the graph',
+      'Request late did not join the executing iteration: another request waits for the graph'
+    ]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(4);
+  });
+
+  it('does not try to join an iteration that ended while its batch finishes', async () => {
+    const { fixture, router, scheduleSpy } = createJoinFixture();
+    const leaseReleasing: IDeferred = createDeferred();
+    const leaseReleased: IDeferred = createDeferred();
+    fixture.session.acquireExecutionLeaseAsync = async () => ({
+      [Symbol.asyncDispose]: async () => {
+        leaseReleasing.resolve();
+        await leaseReleased.promise;
+      }
+    });
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await leaseReleasing.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A]),
+      new TestPhasedRequestClient('late')
+    );
+    await settleAsync();
+    leaseReleased.resolve();
+
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(joinLog).toEqual([]);
+    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe('the iteration of a batch that requests cannot join', () => {
+  interface ICannotJoinCase {
+    readonly title: string;
+    readonly exclusivityClass?: RequestExclusivityClass;
+    readonly requestSettings?: IPhasedCommandEngineRequestSettings;
+    readonly setup?: (joinFixture: IJoinFixture) => void;
+  }
+
+  it.each<ICannotJoinCase>([
+    {
+      title: 'in a cobuild',
+      setup: () => {
+        process.env[COBUILD_VARIABLE] = 'test-cobuild';
+      }
+    },
+    { title: 'for an exclusive request', exclusivityClass: RequestExclusivityClass.Exclusive },
+    {
+      title: 'for a request that runs every operation',
+      requestSettings: { parallelism: 3, quietMode: false, isIncrementalBuildAllowed: false }
+    },
+    {
+      title: 'if the graph cannot add work to an executing iteration',
+      setup: ({ fixture }) => {
+        Object.defineProperty(fixture.graph, 'tryExtendCurrentIteration', { value: undefined });
+      }
+    },
+    {
+      title: 'if the graph cannot hold operations',
+      setup: ({ fixture }) => {
+        Object.defineProperty(fixture.graph, 'retainHeldOperations', { value: undefined });
+      }
+    },
+    {
+      title: 'if the workspace session cannot read the inputs for an executing iteration',
+      setup: ({ fixture }) => {
+        Object.assign(fixture.session, { peekInvalidationsAsync: undefined });
+      }
+    }
+  ])('is scheduled as before $title', async ({ exclusivityClass, requestSettings, setup }) => {
+    const joinFixture: IJoinFixture = createJoinFixture();
+    setup?.(joinFixture);
+    const result: IDaemonPhasedRequestResult = await joinFixture.router.executeAsync(
+      createRequest('only', [OPERATION_C]),
+      new TestPhasedRequestClient('only'),
+      false,
+      undefined,
+      requestSettings,
+      undefined,
+      undefined,
+      exclusivityClass
+    );
+
+    expect(result).toMatchObject({ exitCode: 0, outcome: 'success' });
+    expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(joinFixture.scheduleSpy.mock.calls[0][0]).not.toHaveProperty('holdUnneededOperations');
+  });
+});
diff --git a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
index 4f13c38ffe..3f8b641542 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestTelemetry.test.ts
@@ -265,7 +265,9 @@ describe('phased request telemetry', () => {
       };
       await router.executeAsync(createRequest(requestId, operationId), client, false, undefined, undefined, {
         logRequest: ({ batchSize, earlyResult }: IPhasedRequestTelemetryReport) => {
-          events.push(`log ${requestId} in iteration ${iteration} (batch ${batchSize}, early ${earlyResult})`);
+          events.push(
+            `log ${requestId} in iteration ${iteration} (batch ${batchSize}, early ${earlyResult})`
+          );
         }
       });
     }
@@ -482,7 +484,9 @@ describe(createDaemonRequestTelemetryData.name, () => {
     };
   }
 
-  function createReport(overrides: Partial<IPhasedRequestTelemetryReport> = {}): IPhasedRequestTelemetryReport {
+  function createReport(
+    overrides: Partial<IPhasedRequestTelemetryReport> = {}
+  ): IPhasedRequestTelemetryReport {
     const records: Map<Operation, IPhasedCommandEngineTelemetryRecord> = new Map();
     return {
       request: {
@@ -536,15 +540,25 @@ describe(createDaemonRequestTelemetryData.name, () => {
       agentSessionId: 'agent-1',
       telemetryTag: 'tag-1'
     });
+    expect(options.extraData).not.toHaveProperty('joinedIteration');
     expect(typeof options.extraData?.daemonVersion).toBe('string');
     expect(options.extraData?.generationToken).toHaveLength(8);
-    expect(options.performanceEntries?.map(({ name, startTime, duration }) => [name, startTime, duration])).toEqual([
+    expect(
+      options.performanceEntries?.map(({ name, startTime, duration }) => [name, startTime, duration])
+    ).toEqual([
       ['rush:daemon:prepareWorkspace', 100, 50],
       ['rush:daemon:resolve', 150, 50],
       ['rush:daemon:queueWait', 220, 30]
     ]);
   });
 
+  it('says that a request joined an iteration that was already executing', () => {
+    const context: ReturnType<typeof createContext> = createContext();
+    createDaemonRequestTelemetryData(context, createReport({ joinedIteration: true }));
+
+    expect(context.calls[0].extraData).toMatchObject({ joinedIteration: true });
+  });
+
   it('attributes engine creation and its native measures to the request that created the engine', () => {
     performance.measure('rush:test:beforeEngine', { start: 110, end: 115 });
     performance.measure('rush:test:createEngine', { start: 160, end: 170 });
@@ -591,7 +605,9 @@ describe(createDaemonRequestTelemetryData.name, () => {
 
   it('runs beforeLog taps only for entries that an iteration served', () => {
     const logTelemetry: jest.Mock = jest.fn();
-    const sink: IPhasedRequestTelemetrySink = createDaemonRequestTelemetrySink(createContext({ logTelemetry }));
+    const sink: IPhasedRequestTelemetrySink = createDaemonRequestTelemetrySink(
+      createContext({ logTelemetry })
+    );
     sink.logRequest(createReport());
     sink.logRequest(createReport({ scheduled: false, iterationStartTimeMs: undefined }));
 
diff --git a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
index 0f6023a498..c835595753 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEngineComponentFactory.test.ts
@@ -23,7 +23,8 @@ import type {
   IMapWorkspaceInvalidationsOptions,
   IWorkspaceEngineComponentFactoryOptions,
   IWorkspaceEngineComponents,
-  IWorkspaceEngineShape
+  IWorkspaceEngineShape,
+  IWorkspaceInvalidationPeek
 } from '../WorkspaceEngineComponentFactory';
 import { WorkspaceSession } from '../WorkspaceSession';
 import type { IWorkspaceInvalidationWatcher, IWorkspaceSessionComponents } from '../WorkspaceSession';
@@ -864,7 +865,10 @@ describe(WorkspaceEngineComponentFactory.name, () => {
       'waits for the inputs snapshot if %s, and keeps the invalidations',
       async (description: string, options: Partial<IWorkspaceEngineComponentFactoryOptions>) => {
         const snapshot: IDeferred<IInputsSnapshot> = createDeferred();
-        const engine: ITestEngine = createTestEngine(TEST_RUSH_CONFIGURATION.projects, () => snapshot.promise);
+        const engine: ITestEngine = createTestEngine(
+          TEST_RUSH_CONFIGURATION.projects,
+          () => snapshot.promise
+        );
         const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
         invalidations.invalidate(CHANGED_PATH);
         const components: IWorkspaceSessionComponents = await createComponentsAsync(
@@ -929,4 +933,284 @@ describe(WorkspaceEngineComponentFactory.name, () => {
       await disposeComponentsAsync(components);
     });
   });
+
+  describe('peeking at the invalidations for an executing iteration', () => {
+    const CHANGED_PATH: string = 'libraries/a/src/index.ts';
+    const ITERATION_RECORDS: ReadonlyMap<Operation, IOperationExecutionResult> = new Map();
+
+    interface IPeekFixture {
+      readonly components: IWorkspaceSessionComponents;
+      readonly engine: ITestEngine;
+      readonly invalidateSpy: jest.SpyInstance;
+      readonly invalidations: WorkspaceInvalidationTracker;
+      readonly mapInvalidationsToOperationsAsync: jest.Mock<
+        Promise<Iterable<Operation>>,
+        [IMapWorkspaceInvalidationsOptions]
+      >;
+      readonly nextSnapshot: IInputsSnapshot;
+      peekAsync(): Promise<IWorkspaceInvalidationPeek | undefined>;
+    }
+
+    async function createPeekFixtureAsync(
+      options: Partial<IWorkspaceEngineComponentFactoryOptions> = {}
+    ): Promise<IPeekFixture> {
+      const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
+      const engine: ITestEngine = createTestEngine(
+        TEST_RUSH_CONFIGURATION.projects,
+        async () => nextSnapshot
+      );
+      const mapInvalidationsToOperationsAsync: IPeekFixture['mapInvalidationsToOperationsAsync'] = jest.fn(
+        async (mapOptions: IMapWorkspaceInvalidationsOptions) => {
+          void mapOptions;
+          return [engine.operations[0], engine.operations[0]];
+        }
+      );
+      const invalidations: WorkspaceInvalidationTracker = new WorkspaceInvalidationTracker();
+      const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
+        createEngineComponentsAsync: async () => engine.components,
+        mapInvalidationsToOperationsAsync,
+        refreshInputsOnEveryRequest: true,
+        shape: {
+          phaseNames: [PHASE_NAME],
+          pluginNames: [PLUGIN_NAME]
+        },
+        ...options
+      });
+      const components: IWorkspaceSessionComponents = await factory.createAsync({
+        invalidations,
+        rushConfiguration: TEST_RUSH_CONFIGURATION
+      });
+      return {
+        components,
+        engine,
+        invalidateSpy: jest.spyOn(engine.graph, 'invalidateOperations'),
+        invalidations,
+        mapInvalidationsToOperationsAsync,
+        nextSnapshot,
+        peekAsync: () => components.peekInvalidationsAsync!({ executingIterationRecords: ITERATION_RECORDS })
+      };
+    }
+
+    it('maps the retained paths without applying them, and applies them when committed', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      invalidations.invalidate(CHANGED_PATH);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+
+      expect(peek?.inputsSnapshot).toBe(fixture.nextSnapshot);
+      expect(peek?.invalidatedOperations).toEqual(new Set([engine.operations[0]]));
+      expect(peek?.invalidationReason).toBe('workspace-inputs-changed');
+      expect(fixture.mapInvalidationsToOperationsAsync).toHaveBeenCalledTimes(1);
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[0][0]).toMatchObject({
+        changedPaths: [CHANGED_PATH],
+        currentInputsSnapshot: engine.components.inputsSnapshot,
+        executingIterationRecords: ITERATION_RECORDS,
+        nextInputsSnapshot: fixture.nextSnapshot
+      });
+      expect(invalidateSpy).not.toHaveBeenCalled();
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([CHANGED_PATH]);
+
+      // Later reconciliations wait for the peek
+      const reconciliation: Promise<unknown> = getReconcileAsync(components)();
+      const reconciliationState: { readonly isSettled: boolean } = trackSettlement(reconciliation);
+      await waitForTurnsAsync();
+      expect(reconciliationState.isSettled).toBe(false);
+
+      peek!.commit();
+      expect(components.inputsSnapshot).toBe(fixture.nextSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([]);
+      expect(() => peek!.commit()).toThrow('already committed or discarded');
+      expect(() => peek!.discard()).toThrow('already committed or discarded');
+      await expect(reconciliation).resolves.toMatchObject({ invalidatedOperationCount: 1 });
+      // The reconciliation after the peek compares against the committed snapshot
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).toMatchObject({
+        changedPaths: [],
+        currentInputsSnapshot: fixture.nextSnapshot
+      });
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).not.toHaveProperty(
+        'executingIterationRecords'
+      );
+      await disposeComponentsAsync(components);
+    });
+
+    it('leaves the inputs snapshot and the invalidations unchanged when discarded', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      invalidations.invalidate(CHANGED_PATH);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+      peek!.discard();
+
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([CHANGED_PATH]);
+      await expect(getReconcileAsync(components)()).resolves.toMatchObject({
+        inputsSnapshot: fixture.nextSnapshot,
+        invalidatedOperationCount: 1
+      });
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).toMatchObject({
+        changedPaths: [CHANGED_PATH],
+        currentInputsSnapshot: engine.components.inputsSnapshot
+      });
+      expect(invalidateSpy).toHaveBeenCalledWith(new Set([engine.operations[0]]), 'workspace-inputs-changed');
+      await disposeComponentsAsync(components);
+    });
+
+    it('waits for an earlier reconciliation and maps against its inputs snapshot', async () => {
+      const firstSnapshot: IDeferred<IInputsSnapshot> = createDeferred();
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidations } = fixture;
+      const getInputsSnapshotAsync: jest.Mock = jest
+        .fn()
+        .mockReturnValueOnce(firstSnapshot.promise)
+        .mockResolvedValue(fixture.nextSnapshot);
+      Object.assign(engine.components, { getInputsSnapshotAsync });
+      invalidations.invalidate(CHANGED_PATH);
+
+      const reconciliation: Promise<unknown> = getReconcileAsync(components)();
+      const peekPromise: Promise<IWorkspaceInvalidationPeek | undefined> = fixture.peekAsync();
+      await waitForTurnsAsync();
+      expect(getInputsSnapshotAsync).toHaveBeenCalledTimes(1);
+      const reconciledSnapshot: IInputsSnapshot = createInputsSnapshot('reconciled');
+      firstSnapshot.resolve(reconciledSnapshot);
+      await reconciliation;
+      const peek: IWorkspaceInvalidationPeek | undefined = await peekPromise;
+
+      expect(getInputsSnapshotAsync).toHaveBeenCalledTimes(2);
+      expect(fixture.mapInvalidationsToOperationsAsync.mock.calls[1][0]).toMatchObject({
+        changedPaths: [],
+        currentInputsSnapshot: reconciledSnapshot,
+        nextInputsSnapshot: fixture.nextSnapshot
+      });
+      peek!.discard();
+      await disposeComponentsAsync(components);
+    });
+
+    it('returns undefined for changes that invalidate every operation, and keeps them', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      invalidations.invalidateForInitialization();
+
+      await expect(fixture.peekAsync()).resolves.toBeUndefined();
+
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      expect(invalidateSpy).not.toHaveBeenCalled();
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      await expect(getReconcileAsync(components)()).resolves.toMatchObject({ isFullInvalidation: true });
+      expect(invalidateSpy).toHaveBeenCalledWith(undefined, 'workspace-inputs-changed');
+      await disposeComponentsAsync(components);
+    });
+
+    it('throws, keeping the invalidations, where a reconciliation throws', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, engine, invalidateSpy, invalidations } = fixture;
+      const changedPath: string = path.join(
+        TEST_RUSH_CONFIGURATION.projects[0].projectFolder,
+        'package.json'
+      );
+      invalidations.invalidate(changedPath);
+
+      await expect(fixture.peekAsync()).rejects.toBeInstanceOf(WorkspaceEngineRecreationRequiredError);
+
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      expect(invalidateSpy).not.toHaveBeenCalled();
+      expect(components.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(invalidations.getSnapshot().changedPaths).toEqual([changedPath]);
+      // The failed peek doesn't hold later reconciliations
+      await expect(getReconcileAsync(components)()).rejects.toBeInstanceOf(
+        WorkspaceEngineRecreationRequiredError
+      );
+      await disposeComponentsAsync(components);
+    });
+
+    it('rejects a peek once the engine is being disposed, without mapping the invalidations', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync();
+      const { components, invalidations } = fixture;
+      invalidations.invalidate(CHANGED_PATH);
+      const disposalPromise: Promise<void> = disposeComponentsAsync(components);
+
+      await expect(fixture.peekAsync()).rejects.toThrow('The workspace engine is being disposed.');
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      await disposalPromise;
+    });
+
+    it('does not read the inputs without changes, if the inputs are not refreshed on every request', async () => {
+      const fixture: IPeekFixture = await createPeekFixtureAsync({ refreshInputsOnEveryRequest: false });
+      const { components, engine, invalidations } = fixture;
+      const getInputsSnapshotAsync: jest.SpyInstance = jest.spyOn(
+        engine.components,
+        'getInputsSnapshotAsync'
+      );
+      await getReconcileAsync(components)();
+      expect(invalidations.getSnapshot().sequence).toBe(0);
+
+      const peek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+
+      expect(peek?.inputsSnapshot).toBe(engine.components.inputsSnapshot);
+      expect(peek?.invalidatedOperations).toEqual(new Set());
+      expect(peek?.invalidationReason).toBe('workspace-inputs-changed');
+      expect(getInputsSnapshotAsync).not.toHaveBeenCalled();
+      expect(fixture.mapInvalidationsToOperationsAsync).not.toHaveBeenCalled();
+      peek!.commit();
+      invalidations.invalidate(CHANGED_PATH);
+      const nextPeek: IWorkspaceInvalidationPeek | undefined = await fixture.peekAsync();
+      expect(nextPeek?.inputsSnapshot).toBe(fixture.nextSnapshot);
+      expect(getInputsSnapshotAsync).toHaveBeenCalledTimes(1);
+      nextPeek!.commit();
+      expect(components.inputsSnapshot).toBe(fixture.nextSnapshot);
+      await disposeComponentsAsync(components);
+    });
+
+    it('makes the committed inputs snapshot the session inputs snapshot', async () => {
+      const nextSnapshot: IInputsSnapshot = createInputsSnapshot('next');
+      let engine: ITestEngine | undefined;
+      const factory: WorkspaceEngineComponentFactory = new WorkspaceEngineComponentFactory({
+        createEngineComponentsAsync: async (createOptions: ICreateWorkspaceEngineComponentsOptions) => {
+          engine = createTestEngine(createOptions.rushConfiguration.projects, async () => nextSnapshot);
+          return engine.components;
+        },
+        mapInvalidationsToOperationsAsync: async () => [engine!.operations[0]],
+        refreshInputsOnEveryRequest: true,
+        shape: {
+          phaseNames: [PHASE_NAME],
+          pluginNames: [PLUGIN_NAME]
+        }
+      });
+      const session: WorkspaceSession = await WorkspaceSession.createAsync({
+        createComponentsAsync: async (createOptions) => ({
+          ...(await factory.createAsync(createOptions)),
+          projectWatcher: {
+            [Symbol.asyncDispose]: () => Promise.resolve(),
+            startAsync: () => Promise.resolve()
+          }
+        }),
+        repoRoot: TEST_REPO_ROOT,
+        rushVersion: '5.178.1'
+      });
+      // The session invalidates every operation at startup
+      await expect(
+        session.peekInvalidationsAsync({ executingIterationRecords: ITERATION_RECORDS })
+      ).resolves.toBeUndefined();
+      const startupSnapshot: IInputsSnapshot = createInputsSnapshot('startup');
+      jest.spyOn(engine!.components, 'getInputsSnapshotAsync').mockResolvedValueOnce(startupSnapshot);
+      await session.reconcileInvalidationsAsync();
+      expect(session.inputsSnapshot).toBe(startupSnapshot);
+
+      session.invalidations.invalidate(CHANGED_PATH);
+      const discarded: IWorkspaceInvalidationPeek | undefined = await session.peekInvalidationsAsync({
+        executingIterationRecords: ITERATION_RECORDS
+      });
+      discarded!.discard();
+      expect(session.inputsSnapshot).toBe(startupSnapshot);
+      const committed: IWorkspaceInvalidationPeek | undefined = await session.peekInvalidationsAsync({
+        executingIterationRecords: ITERATION_RECORDS
+      });
+      expect(committed?.invalidatedOperations).toEqual(new Set([engine!.operations[0]]));
+      committed!.commit();
+      expect(session.inputsSnapshot).toBe(nextSnapshot);
+      expect(session.invalidations.getSnapshot().changedPaths).toEqual([]);
+      await session[Symbol.asyncDispose]();
+    });
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceSession.test.ts b/libraries/rush-daemon/src/test/WorkspaceSession.test.ts
index b060f27e9f..f751a38ff6 100644
--- a/libraries/rush-daemon/src/test/WorkspaceSession.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceSession.test.ts
@@ -211,7 +211,7 @@ describe(WorkspaceSession.name, () => {
     ]);
   });
 
-  it('rejects reconciliation as soon as disposal starts', async () => {
+  it('rejects reconciliation and peeks as soon as disposal starts', async () => {
     let finishWatcherDisposal: (() => void) | undefined;
     let watcherDisposalStarted: () => void = () => undefined;
     const watcherDisposal: Promise<void> = new Promise((resolve) => {
@@ -228,12 +228,16 @@ describe(WorkspaceSession.name, () => {
     const reconcileInvalidationsAsync: jest.Mock = jest.fn(() =>
       Promise.reject(new Error('Reconciliation must not start.'))
     );
+    const peekInvalidationsAsync: jest.Mock = jest.fn(() =>
+      Promise.reject(new Error('Peeking must not start.'))
+    );
     const session: WorkspaceSession = await WorkspaceSession.createAsync({
       repoRoot: TEST_REPO_ROOT,
       rushVersion: '5.178.0',
       createComponentsAsync: () =>
         Promise.resolve<IWorkspaceSessionComponents>({
           projectWatcher: watcher,
+          peekInvalidationsAsync,
           reconcileInvalidationsAsync,
           [Symbol.asyncDispose]: () => watcher[Symbol.asyncDispose]()
         })
@@ -244,6 +248,10 @@ describe(WorkspaceSession.name, () => {
       'workspace session is being disposed'
     );
     expect(reconcileInvalidationsAsync).not.toHaveBeenCalled();
+    await expect(session.peekInvalidationsAsync({ executingIterationRecords: new Map() })).rejects.toThrow(
+      'workspace session is being disposed'
+    );
+    expect(peekInvalidationsAsync).not.toHaveBeenCalled();
     await watcherDisposal;
     finishWatcherDisposal?.();
     await disposalPromise;
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index ee7c972e8e..60c9eba780 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -6,7 +6,12 @@ import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 import { inspect } from 'node:util';
 
-import { OperationStatus, type IOperationExecutionResult } from '@microsoft/rush-lib';
+import {
+  OperationStatus,
+  type IOperationExecutionResult,
+  type IOperationGraphIterationOptions,
+  type Operation
+} from '@microsoft/rush-lib';
 import { OperationExecutionRecord } from '@microsoft/rush-lib/lib/logic/operations/OperationExecutionRecord';
 
 import { RequestExclusivityClass } from '../RequestScheduler';
@@ -102,6 +107,74 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(graph.resultByOperation.has(test!.operation('a'))).toBe(false);
   });
 
+  it('counts a project once per iteration when the executing iteration is planned again for more work', async () => {
+    const { warm, graph } = await startAsync();
+    const a: Operation = test!.operation('a');
+    const b: Operation = test!.operation('b');
+    const getFrequencies = (): Record<string, number> =>
+      Object.fromEntries(
+        warm.getStatus().projectRanks!.map(({ projectName, frequency }) => [projectName, frequency])
+      );
+    const plan = (): void => graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {});
+    const extend = (startedOperations: ReadonlySet<Operation>): void => {
+      const context: IOperationGraphIterationOptions = { startedOperations };
+      graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, context);
+      graph.hooks.extendIteration.call(new Map(), context);
+    };
+    expect(getFrequencies()).toEqual({ a: 1, b: 1 });
+
+    b.enabled = false;
+    plan();
+    expect(getFrequencies()).toEqual({ a: 2, b: 1 });
+    b.enabled = true;
+    extend(new Set([a]));
+    expect(getFrequencies()).toEqual({ a: 2, b: 2 });
+    extend(new Set([a, b]));
+    expect(getFrequencies()).toEqual({ a: 2, b: 2 });
+    plan();
+    expect(getFrequencies()).toEqual({ a: 3, b: 3 });
+  });
+
+  it('neither counts nor observes the projects of a plan of the executing iteration that the graph refuses', async () => {
+    const { warm, graph, watcher } = await startAsync();
+    const a: Operation = test!.operation('a');
+    const b: Operation = test!.operation('b');
+    const getRanks = (): Record<string, [number, number]> =>
+      Object.fromEntries(
+        warm
+          .getStatus()
+          .projectRanks!.map(({ projectName, frequency, lastUsed }) => [projectName, [frequency, lastUsed]])
+      );
+    b.enabled = false;
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {});
+    const ranks: Record<string, [number, number]> = getRanks();
+    const watchProjects: jest.SpyInstance = jest.spyOn(watcher, 'watchProjects');
+
+    b.enabled = true;
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {
+      startedOperations: new Set([a])
+    });
+    // The graph accepts another plan
+    graph.hooks.extendIteration.call(new Map(), { startedOperations: new Set([a]) });
+    expect(getRanks()).toEqual(ranks);
+    expect(watchProjects).not.toHaveBeenCalled();
+
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, {});
+    expect(watchProjects).toHaveBeenCalledWith(['a', 'b']);
+    expect(getRanks().b[0]).toBe(ranks.b[0] + 1);
+  });
+
+  it('ignores a plan of the executing iteration that the graph accepts after the warm set was disposed', async () => {
+    const { warm, graph, watcher } = await startAsync();
+    const context: IOperationGraphIterationOptions = { startedOperations: new Set() };
+    graph.hooks.configureIteration.call(new Map(), graph.resultByOperation, context);
+    const watchProjects: jest.SpyInstance = jest.spyOn(watcher, 'watchProjects');
+    await warm[Symbol.asyncDispose]();
+
+    graph.hooks.extendIteration.call(new Map(), context);
+    expect(watchProjects).not.toHaveBeenCalled();
+  });
+
   it('does not count or evict resource-free retained results for the project cap, but still evicts resource holders', async () => {
     test = await WarmSetTestFixture.createAsync({ extraProjectCount: 40 });
     test.configuration = { ...GENEROUS_WARM_CONFIGURATION, watch: false, warmSetMaxProjects: 20 };
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
index d6933f23cb..25019d3451 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSetMaintenanceCost.test.ts
@@ -62,6 +62,7 @@ function createGraph(projectCount: number): ITestGraph {
     resultByOperation,
     hooks: {
       configureIteration: createHook(configureIterationTaps),
+      extendIteration: createHook([]),
       beforeExecuteOperationAsync: createHook([]),
       afterExecuteIterationAsync: createHook([]),
       onIdle: createHook([])
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index 0193e1db26..f784f4cf9d 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -27,6 +27,12 @@ export interface IDaemonConfigurationJson {
    * `incrementalBuilds`. Defaults to false.
    */
   readonly warmWorkers?: boolean;
+  /**
+   * Lets a build request that arrives while the daemon executes an incremental batch with the same request settings
+   * add its operations to the executing iteration, and get its result once they complete, instead of waiting for the
+   * iteration to end. Experimental. Defaults to false.
+   */
+  readonly joinRunningBatch?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
   /**
@@ -70,6 +76,7 @@ const defaults: Required<IDaemonConfigurationJson> = {
   usePersistentIpcRunners: false,
   incrementalBuilds: true,
   warmWorkers: false,
+  joinRunningBatch: false,
   queueTimeoutSeconds: 30,
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
@@ -89,6 +96,7 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     usePersistentIpcRunners: 'RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS',
     incrementalBuilds: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
     warmWorkers: 'RUSH_DAEMON_WARM_WORKERS',
+    joinRunningBatch: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
     queueTimeoutSeconds: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
@@ -134,6 +142,7 @@ export function resolveDaemonConfiguration(
     usePersistentIpcRunners: booleanOption('usePersistentIpcRunners', json, environment),
     incrementalBuilds: booleanOption('incrementalBuilds', json, environment),
     warmWorkers: booleanOption('warmWorkers', json, environment),
+    joinRunningBatch: booleanOption('joinRunningBatch', json, environment),
     autoWarmByTelemetry: booleanOption('autoWarmByTelemetry', json, environment),
     idleTimeoutSeconds: numberOption('idleTimeoutSeconds', json, environment),
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
@@ -183,7 +192,8 @@ function booleanOption(
     | 'autoWarmByTelemetry'
     | 'usePersistentIpcRunners'
     | 'incrementalBuilds'
-    | 'warmWorkers',
+    | 'warmWorkers'
+    | 'joinRunningBatch',
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): boolean {
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index cf8d2a071b..cbd873b0fa 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -294,6 +294,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_INCREMENTAL_BUILDS: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
   /** Keeps `:incremental:ipc` watch-mode workers alive between daemon builds. */
   RUSH_DAEMON_WARM_WORKERS: 'RUSH_DAEMON_WARM_WORKERS',
+  /** Lets a daemon build request add its operations to the executing iteration of a compatible batch. */
+  RUSH_DAEMON_JOIN_RUNNING_BATCH: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
   /** Overrides the request admission queue timeout. */
   RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   /** Overrides idle eviction in an attached daemon warm set. */
@@ -716,6 +718,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS:
           case EnvironmentVariableNames.RUSH_DAEMON_INCREMENTAL_BUILDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_WORKERS:
+          case EnvironmentVariableNames.RUSH_DAEMON_JOIN_RUNNING_BATCH:
           case EnvironmentVariableNames.RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index 3944326a64..85afc4cdfe 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -13,6 +13,7 @@ describe('daemon configuration', () => {
       usePersistentIpcRunners: false,
       incrementalBuilds: true,
       warmWorkers: false,
+      joinRunningBatch: false,
       idleTimeoutSeconds: 900
     });
     expect(
@@ -39,7 +40,9 @@ describe('daemon configuration', () => {
     { RUSH_DAEMON_EXPERIMENTAL: 'yes' },
     { RUSH_DAEMON_USE_PERSISTENT_IPC_RUNNERS: 'yes' },
     { RUSH_DAEMON_INCREMENTAL_BUILDS: 'off' },
-    { RUSH_DAEMON_WARM_WORKERS: 'true' }
+    { RUSH_DAEMON_WARM_WORKERS: 'true' },
+    { RUSH_DAEMON_JOIN_RUNNING_BATCH: 'true' },
+    { RUSH_DAEMON_JOIN_RUNNING_BATCH: '' }
   ])('rejects invalid overrides %j', (environment) => {
     expect(() => resolveDaemonConfiguration({}, environment)).toThrow();
   });
@@ -59,6 +62,7 @@ describe('daemon configuration', () => {
     { usePersistentIpcRunners: 'true' },
     { incrementalBuilds: 'false' },
     { warmWorkers: 1 },
+    { joinRunningBatch: 'true' },
     { compatiblePlugins: 'rush-example-plugin' },
     { compatiblePlugins: [''] },
     { compatiblePlugins: [' rush-example-plugin'] },
@@ -98,6 +102,17 @@ describe('daemon configuration', () => {
     expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_WARM_WORKERS: '1' }).warmWorkers).toBe(true);
   });
 
+  it('lets requests join a running batch only if the environment or configuration turns it on', () => {
+    expect(resolveDaemonConfiguration({ joinRunningBatch: true }, {}).joinRunningBatch).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ joinRunningBatch: true }, { RUSH_DAEMON_JOIN_RUNNING_BATCH: '0' })
+        .joinRunningBatch
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_JOIN_RUNNING_BATCH: '1' }).joinRunningBatch).toBe(
+      true
+    );
+  });
+
   describe.each([
     ['compatiblePlugins', 'RUSH_DAEMON_COMPATIBLE_PLUGINS'],
     ['commandAgnosticPlugins', 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS']
diff --git a/libraries/rush-lib/src/index.ts b/libraries/rush-lib/src/index.ts
index 01dbdbb25f..e181e2bce7 100644
--- a/libraries/rush-lib/src/index.ts
+++ b/libraries/rush-lib/src/index.ts
@@ -248,6 +248,8 @@ export {
 } from './pluginFramework/PhasedCommandHooks';
 export type {
   IOperationGraph,
+  IOperationGraphExtensionOptions,
+  IOperationGraphExtensionResult,
   IOperationGraphIterationOptions,
   IOperationGraphRequestResult
 } from './logic/operations/IOperationGraph';
diff --git a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
index 40d253ed4a..e0344f716f 100644
--- a/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
+++ b/libraries/rush-lib/src/logic/operations/AsyncOperationQueue.ts
@@ -21,6 +21,16 @@ export class AsyncOperationQueue
   readonly #pendingIterators: ((result: IteratorResult<OperationExecutionRecord>) => void)[];
   readonly #totalOperations: number;
   readonly #completedOperations: Set<OperationExecutionRecord>;
+  readonly #sortFn: IOperationSortFunction;
+
+  /**
+   * Operations that are not dispatched until they are released. They are kept out of `#queue`, so that
+   * `assignOperations()` does not scan them.
+   */
+  readonly #heldOperations: Set<OperationExecutionRecord>;
+  /** Operations that are dispatched before all others, see `prioritizeOperations()`. */
+  readonly #prioritizedOperations: Set<OperationExecutionRecord>;
+  #holdRetainCount: number;
 
   /**
    * Tracks how many times each operation has been assigned to an execution slot.
@@ -30,6 +40,7 @@ export class AsyncOperationQueue
   readonly #numberOfTimesQueuedByOperation: Map<OperationExecutionRecord, number>;
 
   #isDone: boolean;
+  #hasDispatched: boolean;
 
   /**
    * @param operations - The set of operations to be executed
@@ -37,14 +48,116 @@ export class AsyncOperationQueue
    *   - Returning a positive value indicates that `a` should execute before `b`.
    *   - Returning a negative value indicates that `b` should execute before `a`.
    *   - Returning 0 indicates no preference.
+   * @param heldOperations - Operations of `operations` that are not dispatched until they are released, see
+   *   `releaseHeldOperations()`. They are released when every other operation has completed, unless a caller
+   *   retains them (see `retainHeldOperations()`).
    */
-  public constructor(operations: Iterable<OperationExecutionRecord>, sortFn: IOperationSortFunction) {
-    this.#queue = computeTopologyAndSort(operations, sortFn);
+  public constructor(
+    operations: Iterable<OperationExecutionRecord>,
+    sortFn: IOperationSortFunction,
+    heldOperations?: Iterable<OperationExecutionRecord>
+  ) {
+    const sortedOperations: OperationExecutionRecord[] = computeTopologyAndSort(operations, sortFn);
+    const held: Set<OperationExecutionRecord> = new Set();
+    if (heldOperations) {
+      const candidates: ReadonlySet<OperationExecutionRecord> = new Set(heldOperations);
+      for (const record of sortedOperations) {
+        if (candidates.has(record)) {
+          held.add(record);
+        }
+      }
+    }
+    this.#queue = held.size
+      ? sortedOperations.filter((record: OperationExecutionRecord) => !held.has(record))
+      : sortedOperations;
+    this.#heldOperations = held;
+    this.#prioritizedOperations = new Set();
+    this.#holdRetainCount = 0;
+    this.#sortFn = sortFn;
     this.#pendingIterators = [];
-    this.#totalOperations = this.#queue.length;
+    this.#totalOperations = sortedOperations.length;
     this.#isDone = false;
+    this.#hasDispatched = false;
     this.#completedOperations = new Set<OperationExecutionRecord>();
     this.#numberOfTimesQueuedByOperation = new Map();
+    // If every operation is held, none would ever complete to release them.
+    this.#releaseIfOnlyHeldOperationsRemain();
+  }
+
+  /**
+   * Whether every operation has completed, or the queue has nothing left to dispatch.
+   */
+  public get isDone(): boolean {
+    return this.#isDone;
+  }
+
+  /**
+   * Whether an iterator has requested an operation and the queue is not done.
+   */
+  public get isDispatching(): boolean {
+    return this.#hasDispatched && !this.#isDone;
+  }
+
+  /**
+   * The operations that are held back from dispatch.
+   */
+  public get heldOperations(): ReadonlySet<OperationExecutionRecord> {
+    return this.#heldOperations;
+  }
+
+  /**
+   * Keeps the held operations held even when every other operation has completed, until the returned function is
+   * called. Aborting the iteration still releases them, see `releaseHeldOperations()`.
+   */
+  public retainHeldOperations(): () => void {
+    this.#holdRetainCount++;
+    let released: boolean = false;
+    return () => {
+      if (released) {
+        return;
+      }
+      released = true;
+      this.#holdRetainCount--;
+      this.#releaseIfOnlyHeldOperationsRemain();
+      this.assignOperations();
+    };
+  }
+
+  /**
+   * Makes held operations available for dispatch.
+   * @param operations - The held operations to release, or undefined to release all of them.
+   */
+  public releaseHeldOperations(operations?: Iterable<OperationExecutionRecord>): void {
+    const held: Set<OperationExecutionRecord> = this.#heldOperations;
+    let releasedAny: boolean = false;
+    for (const record of operations ?? Array.from(held)) {
+      if (held.delete(record)) {
+        this.#queue.push(record);
+        releasedAny = true;
+      }
+    }
+    if (releasedAny) {
+      this.#sortQueue();
+      this.assignOperations();
+    }
+  }
+
+  /**
+   * Dispatches the given operations before all other ready operations. Among each other, they keep the order of the
+   * sort function.
+   */
+  public prioritizeOperations(operations: Iterable<OperationExecutionRecord>): void {
+    let changed: boolean = false;
+    for (const record of operations) {
+      if (!this.#prioritizedOperations.has(record)) {
+        this.#prioritizedOperations.add(record);
+        changed = true;
+      }
+    }
+    if (changed) {
+      this.#sortQueue();
+      this.assignOperations();
+    }
   }
 
   /**
@@ -52,6 +165,7 @@ export class AsyncOperationQueue
    * @see {AsyncIterator}
    */
   public next(): Promise<IteratorResult<OperationExecutionRecord>> {
+    this.#hasDispatched = true;
     const waitingIterators: Array<(result: IteratorResult<OperationExecutionRecord>) => void> =
       this.#pendingIterators;
 
@@ -71,6 +185,8 @@ export class AsyncOperationQueue
    * If all operations are completed, set the queue to done, resolve all pending iterators in next cycle.
    */
   public complete(record: OperationExecutionRecord): void {
+    // A held operation completes without dispatch if a failure blocks it.
+    this.#heldOperations.delete(record);
     this.#completedOperations.add(record);
     this.#numberOfTimesQueuedByOperation.delete(record);
 
@@ -89,6 +205,7 @@ export class AsyncOperationQueue
       }
     }
 
+    this.#releaseIfOnlyHeldOperationsRemain();
     this.assignOperations();
 
     if (this.#completedOperations.size === this.#totalOperations) {
@@ -172,7 +289,7 @@ export class AsyncOperationQueue
     }
 
     // Since items only get removed from the queue when they have a final status, this should be safe.
-    if (queue.length === 0) {
+    if (queue.length === 0 && this.#heldOperations.size === 0) {
       this.#isDone = true;
     }
 
@@ -187,6 +304,33 @@ export class AsyncOperationQueue
     }
   }
 
+  #releaseIfOnlyHeldOperationsRemain(): void {
+    const heldCount: number = this.#heldOperations.size;
+    if (
+      heldCount > 0 &&
+      this.#holdRetainCount === 0 &&
+      this.#completedOperations.size + heldCount === this.#totalOperations
+    ) {
+      for (const record of this.#heldOperations) {
+        this.#queue.push(record);
+      }
+      this.#heldOperations.clear();
+      this.#sortQueue();
+    }
+  }
+
+  #sortQueue(): void {
+    const sortFn: IOperationSortFunction = this.#sortFn;
+    const prioritized: ReadonlySet<OperationExecutionRecord> = this.#prioritizedOperations;
+    // The queue is scanned from its end, so the prioritized operations go last.
+    this.#queue.sort(
+      prioritized.size
+        ? (a: OperationExecutionRecord, b: OperationExecutionRecord) =>
+            Number(prioritized.has(a)) - Number(prioritized.has(b)) || sortFn(a, b)
+        : sortFn
+    );
+  }
+
   /**
    * Returns this queue as an async iterator, such that multiple functions iterating this object concurrently
    * receive distinct iteration results.
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 6d521a9f5d..81592eae44 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -77,8 +77,11 @@ export interface IOperationBuildCacheContext {
   isCacheReadAllowed: boolean;
 
   operationBuildCache: OperationBuildCache | undefined;
-  // Computed when first read. See the beforeExecuteIterationAsync tap.
+  // Computed when first read, by getCacheDisabledReason. See the beforeExecuteIterationAsync tap.
   readonly cacheDisabledReason: string | undefined;
+  // Replaced, like inputsSnapshot, snapshotStartTimeMs and inputFileHashes, when a request joins the iteration (see
+  // the extendIteration tap), since it depends on the inputs snapshot
+  getCacheDisabledReason: () => string | undefined;
   outputFolderNames: ReadonlyArray<string>;
 
   cobuildLock: CobuildLock | undefined;
@@ -107,11 +110,12 @@ export interface IOperationBuildCacheContext {
   // result is not trusted. If it is skipped, it keeps its trust, since its outputs were not built in this iteration.
   hasUnverifiedDependency: boolean;
 
-  // The iteration's inputs snapshot, and the start of the window in which the tracked input files may have changed
-  // after it read them (see getSnapshotStartTimeMs)
+  // The inputs snapshot that the state hash of the operation was computed from (the iteration's, or that of a request
+  // that joined the iteration before the operation was dispatched), and the start of the window in which the tracked
+  // input files may have changed after it read them (see getSnapshotStartTimeMs)
   inputsSnapshot: IInputsSnapshot;
   snapshotStartTimeMs: number;
-  // The hashes of the tracked input files in the iteration's inputs snapshot
+  // The hashes of the tracked input files in that inputs snapshot
   inputFileHashes: ReadonlyMap<string, string>;
   // The on-disk state of the tracked input files whose hashes produced the cache key, captured right before the
   // operation executes. Used to refuse cache writes, and to keep a long-lived graph from skipping the operation
@@ -262,39 +266,11 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             : undefined;
 
           for (const [operation, record] of recordByOperation) {
-            const { associatedProject, associatedPhase, runner, settings: operationSettings } = operation;
+            const { associatedProject, runner, settings: operationSettings } = operation;
             if (!runner) {
               return;
             }
 
-            const { name: phaseName } = associatedPhase;
-
-            const projectConfiguration: RushProjectConfiguration | undefined =
-              projectConfigurations.get(associatedProject);
-
-            // This value can *currently* be cached per-project, but in the future the list of files will vary
-            // depending on the selected phase.
-            const fileHashes: ReadonlyMap<string, string> | undefined =
-              inputsSnapshot.getTrackedFileHashesForOperation(associatedProject, phaseName);
-
-            // Computing the reason checks each tracked file of the project, and an iteration of a long-lived graph
-            // (e.g. the Rush daemon) holds every operation of the workspace. It is only read for the operations
-            // that execute and for cobuild clustering, so it is computed once, when it is first read.
-            let cacheDisabledReason: string | undefined;
-            let isCacheDisabledReasonComputed: boolean = false;
-            const getCacheDisabledReason = (): string | undefined => {
-              if (!isCacheDisabledReasonComputed) {
-                cacheDisabledReason = getCacheDisabledReasonForOperation(
-                  projectConfiguration,
-                  fileHashes,
-                  phaseName,
-                  operation.isNoOp
-                );
-                isCacheDisabledReasonComputed = true;
-              }
-              return cacheDisabledReason;
-            };
-
             const outputFolderNames: string[] = [record.metadataFolderPath];
             const configuredOutputFolderNames: string[] | undefined = operationSettings?.outputFolderNames;
             if (configuredOutputFolderNames) {
@@ -314,7 +290,7 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               operationBuildCache: undefined,
               outputFolderNames,
               get cacheDisabledReason(): string | undefined {
-                return getCacheDisabledReason();
+                return buildCacheContext.getCacheDisabledReason();
               },
               cobuildLock: undefined,
               cobuildClusterId: undefined,
@@ -327,9 +303,12 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
               isCacheReadAttempted: false,
               isIncrementalResult: false,
               hasUnverifiedDependency: false,
-              inputsSnapshot,
-              snapshotStartTimeMs,
-              inputFileHashes: fileHashes
+              ...readCacheInputs(
+                operation,
+                inputsSnapshot,
+                snapshotStartTimeMs,
+                projectConfigurations.get(associatedProject)
+              )
             };
             // Upstream runners may mutate the property of build cache context for downstream runners
             this.#buildCacheContextByOperation.set(operation, buildCacheContext);
@@ -368,6 +347,38 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      graph.hooks.extendIteration.tap(
+        PLUGIN_NAME,
+        (
+          changedRecords: ReadonlyMap<Operation, IOperationExecutionResult>,
+          iterationOptions: IOperationGraphIterationOptions
+        ): void => {
+          const { inputsSnapshot } = iterationOptions;
+          if (!inputsSnapshot) {
+            return;
+          }
+          const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+          for (const operation of changedRecords.keys()) {
+            const buildCacheContext: IOperationBuildCacheContext | undefined =
+              this.#buildCacheContextByOperation.get(operation);
+            if (buildCacheContext) {
+              // Updated in place, since upstream operations may have updated other properties of the context.
+              // The operation was not dispatched yet, so the tap at CAPTURE_INPUT_FILES_STAGE captures its input
+              // files later, for the newer snapshot.
+              Object.assign(
+                buildCacheContext,
+                readCacheInputs(
+                  operation,
+                  inputsSnapshot,
+                  snapshotStartTimeMs,
+                  context.projectConfigurations.get(operation.associatedProject)
+                )
+              );
+            }
+          }
+        }
+      );
+
       graph.hooks.beforeExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (
@@ -1147,6 +1158,53 @@ export function clusterOperations(
   }
 }
 
+/**
+ * Reads the parts of the build cache context of an operation that depend on the inputs snapshot.
+ */
+function readCacheInputs(
+  operation: Operation,
+  inputsSnapshot: IInputsSnapshot,
+  snapshotStartTimeMs: number,
+  projectConfiguration: RushProjectConfiguration | undefined
+): Pick<
+  IOperationBuildCacheContext,
+  'getCacheDisabledReason' | 'inputsSnapshot' | 'snapshotStartTimeMs' | 'inputFileHashes'
+> {
+  const { name: phaseName } = operation.associatedPhase;
+
+  // This value can *currently* be cached per-project, but in the future the list of files will vary
+  // depending on the selected phase.
+  const fileHashes: ReadonlyMap<string, string> = inputsSnapshot.getTrackedFileHashesForOperation(
+    operation.associatedProject,
+    phaseName
+  );
+
+  // Computing the reason checks each tracked file of the project, and an iteration of a long-lived graph
+  // (e.g. the Rush daemon) holds every operation of the workspace. It is only read for the operations
+  // that execute and for cobuild clustering, so it is computed once, when it is first read.
+  let cacheDisabledReason: string | undefined;
+  let isCacheDisabledReasonComputed: boolean = false;
+  const getCacheDisabledReason = (): string | undefined => {
+    if (!isCacheDisabledReasonComputed) {
+      cacheDisabledReason = getCacheDisabledReasonForOperation(
+        projectConfiguration,
+        fileHashes,
+        phaseName,
+        operation.isNoOp
+      );
+      isCacheDisabledReasonComputed = true;
+    }
+    return cacheDisabledReason;
+  };
+
+  return {
+    getCacheDisabledReason,
+    inputsSnapshot,
+    snapshotStartTimeMs,
+    inputFileHashes: fileHashes
+  };
+}
+
 function getCacheDisabledReasonForOperation(
   projectConfiguration: RushProjectConfiguration | undefined,
   fileHashes: ReadonlyMap<string, string>,
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index fa1c9cf2d2..c22c8efcba 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -57,6 +57,76 @@ export interface IOperationGraphIterationOptions {
    * request's own telemetry entry.
    */
   getOperationRequestId?: (operation: Operation) => string | undefined;
+
+  /**
+   * If true, the iteration does not dispatch the operations that none of its enabled operations needs (an operation
+   * that is not enabled, and on which no enabled operation depends, directly or indirectly) until every other
+   * operation has completed. Until then, {@link IOperationGraph.tryExtendCurrentIteration} can still enable them for
+   * a request that joins the iteration.
+   */
+  holdUnneededOperations?: boolean;
+
+  /**
+   * Set only when hooks configure or prepare the operations of an iteration that is already executing, because a
+   * request joined it (see {@link IOperationGraph.tryExtendCurrentIteration}). These operations have already been
+   * dispatched in the iteration: the graph ignores changes to their configuration, and a plugin should not act on
+   * them again.
+   *
+   * @remarks
+   * The graph can still refuse the plan of a `configureIteration` call with this set, after the call returns. A
+   * plugin that keeps state across iterations applies the effects of such a plan in `extendIteration`, which the graph
+   * calls only for a plan that it accepts, with the same options object.
+   */
+  startedOperations?: ReadonlySet<Operation>;
+}
+
+/**
+ * Options for {@link IOperationGraph.tryExtendCurrentIteration}.
+ * @alpha
+ */
+export interface IOperationGraphExtensionOptions {
+  /**
+   * A snapshot of the inputs that was taken after the joining request was received.
+   */
+  readonly inputsSnapshot: IInputsSnapshot;
+
+  /**
+   * The operations that the joining request needs. The operations that they depend on are needed as well. The caller
+   * enables them (see {@link IOperationGraph.setEnabledStates}) before extending the iteration.
+   */
+  readonly neededOperations: Iterable<Operation>;
+
+  /**
+   * Operations whose last results can no longer be used, for example because their outputs changed.
+   */
+  readonly invalidatedOperations?: Iterable<Operation>;
+
+  /**
+   * The reason for invalidating `invalidatedOperations`.
+   */
+  readonly invalidationReason?: string;
+}
+
+/**
+ * The outcome of {@link IOperationGraph.tryExtendCurrentIteration}.
+ * @alpha
+ */
+export interface IOperationGraphExtensionResult {
+  /**
+   * Whether the iteration was extended.
+   */
+  readonly extended: boolean;
+
+  /**
+   * Why the iteration was not extended, if it was not.
+   */
+  readonly reason?: string;
+
+  /**
+   * The operations whose `enabled` state, runner policy or state hash the extension changed. Empty if the iteration
+   * was not extended.
+   */
+  readonly changedOperations: ReadonlySet<Operation>;
 }
 
 /**
@@ -238,6 +308,40 @@ export interface IOperationGraph {
    */
   executeScheduledIterationAsync(): Promise<boolean>;
 
+  /**
+   * Keeps the executing iteration from dispatching the operations that it holds (see
+   * {@link IOperationGraphIterationOptions.holdUnneededOperations}) until the returned function is called, so that a
+   * request can still join the iteration while the inputs are read for it. Aborting the iteration dispatches them
+   * regardless.
+   * @returns A function that ends the retention, or undefined if no iteration is executing with held operations.
+   */
+  retainHeldOperations?(): (() => void) | undefined;
+
+  /**
+   * Adds the work of a request that arrives while an iteration is executing to that iteration, instead of to a later
+   * one. The iteration must hold its unneeded operations (see
+   * {@link IOperationGraphIterationOptions.holdUnneededOperations}).
+   *
+   * @remarks
+   * The caller first enables the operations of all requests that the iteration serves, including the joining one.
+   * The graph then calculates the state hashes of the operations that were not dispatched yet from the newer inputs
+   * snapshot, and plans the iteration again with `configureIteration`. That call receives every operation of the
+   * iteration, and its `startedOperations` names those that were already dispatched. The new plan can only enable
+   * operations that were not dispatched yet: an operation that the iteration already enabled or dispatched keeps its
+   * `enabled` state, its state hash and its configuration.
+   *
+   * The iteration is not extended if it was aborted, is not incremental or has no inputs snapshot, if an operation
+   * that the caller invalidates already ran in it, or if the joining request needs an operation that was dispatched
+   * before its inputs or outputs last changed. Nor is it extended if the new plan enables an operation that the
+   * joining request needs and that was dispatched without running; the graph finds this only after the
+   * `configureIteration` taps ran, and it discards their plan. When the iteration is not extended, the graph is left
+   * unchanged, and the caller restores the enabled states.
+   *
+   * Otherwise, the operations that changed are passed to `extendIteration`, and the joining request's operations are
+   * dispatched before the others.
+   */
+  tryExtendCurrentIteration?(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult;
+
   /**
    * Invalidates the specified operations, causing them to be re-executed.
    * @param operations - The operations to invalidate, or undefined to invalidate all operations.
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index e568fd2695..6452939f94 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -334,24 +334,49 @@ function applyToGraph(graph: IOperationGraph): void {
       }
       const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
       for (const record of records.values()) {
-        const recordState: IRecordState = {
-          records,
-          inputsSnapshot,
-          snapshotStartTimeMs,
-          getOperationEnvironment
-        };
-        stateByRecord.set(record, recordState);
-        const guard: IIncrementalExecutionGuard = {
-          getBlockReasonAsync: (options?: IIncrementalExecutionGuardOptions) =>
-            getBlockReasonAsync(record, recordState, options),
-          verifyIncrementalResultAsync: (options?: IIncrementalExecutionGuardOptions) =>
-            verifyIncrementalResultAsync(record, recordState, options)
-        };
-        setIncrementalExecutionGuard(record, guard);
+        prepareRecord(record, { records, inputsSnapshot, snapshotStartTimeMs, getOperationEnvironment });
       }
     }
   );
 
+  graph.hooks.extendIteration.tap(
+    PLUGIN_NAME,
+    (
+      changedRecords: ReadonlyMap<Operation, IOperationExecutionResult>,
+      iterationOptions: IOperationGraphIterationOptions
+    ): void => {
+      const { inputsSnapshot, getOperationEnvironment } = iterationOptions;
+      if (!inputsSnapshot) {
+        return;
+      }
+      const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+      for (const record of changedRecords.values()) {
+        const recordState: IRecordState | undefined = stateByRecord.get(record);
+        if (recordState) {
+          // The record was not dispatched yet, so the tap at CAPTURE_UNCHECKED_INPUT_FILES_STAGE captures its input
+          // files later, for the newer snapshot.
+          prepareRecord(record, {
+            records: recordState.records,
+            inputsSnapshot,
+            snapshotStartTimeMs,
+            getOperationEnvironment
+          });
+        }
+      }
+    }
+  );
+
+  function prepareRecord(record: IOperationExecutionResult, recordState: IRecordState): void {
+    stateByRecord.set(record, recordState);
+    const guard: IIncrementalExecutionGuard = {
+      getBlockReasonAsync: (options?: IIncrementalExecutionGuardOptions) =>
+        getBlockReasonAsync(record, recordState, options),
+      verifyIncrementalResultAsync: (options?: IIncrementalExecutionGuardOptions) =>
+        verifyIncrementalResultAsync(record, recordState, options)
+    };
+    setIncrementalExecutionGuard(record, guard);
+  }
+
   const getGitPath: () => string | undefined = createGitPathGetter();
 
   // Captured in a late tap, after the taps that can skip the operation or restore it from the build cache, so that
diff --git a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
index 2d29e4aa43..10d51eb14a 100644
--- a/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/LegacySkipPlugin.ts
@@ -137,7 +137,7 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
           for (const record of operations.values()) {
             const { operation } = record;
-            const { associatedProject, associatedPhase, runner } = operation;
+            const { runner } = operation;
             if (!runner) {
               continue;
             }
@@ -155,50 +155,17 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
 
             const packageDepsPath: string = _getPackageDepsPath(operation);
 
-            let packageDeps: IProjectDeps | undefined;
-            let inputFilesCheck: IInputFilesCheck | undefined;
-
-            try {
-              const fileHashes: ReadonlyMap<string, string> | undefined =
-                inputsSnapshot?.getTrackedFileHashesForOperation(associatedProject, associatedPhase.name);
-
-              if (!fileHashes || !inputsSnapshot) {
-                logGitWarning = true;
-                continue;
-              }
-
-              const files: Record<string, string> = {};
-              for (const [filePath, fileHash] of fileHashes) {
-                files[filePath] = fileHash;
-              }
-
-              packageDeps = {
-                files,
-                arguments: runner.getConfigHash()
-              };
-
-              if (record.enabled && !runner.isNoOp && snapshotStartTimeMs !== undefined) {
-                inputFilesCheck = { inputsSnapshot, snapshotStartTimeMs, fileHashes };
-              }
-            } catch (error) {
-              // To test this code path:
-              // Delete a project's ".rush/temp/shrinkwrap-deps.json" then run "rush build --verbose"
-              terminal.writeLine(
-                `Unable to calculate incremental state for ${record.operation.name}: ` +
-                  (error as Error).toString()
-              );
-              terminal.writeLine(
-                Colorize.cyan('Rush will proceed without incremental execution and change detection.')
-              );
+            if (!inputsSnapshot || snapshotStartTimeMs === undefined) {
+              logGitWarning = true;
+              continue;
             }
 
             stateMap.set(operation, {
               packageDepsPath,
-              packageDeps,
               allowSkip,
               dependencyChanged: false,
               inputsUnchanged: false,
-              inputFilesCheck
+              ...readInputs(record, inputsSnapshot, snapshotStartTimeMs)
             });
           }
 
@@ -217,6 +184,74 @@ export class LegacySkipPlugin implements IPhasedCommandPlugin {
         }
       );
 
+      graph.hooks.extendIteration.tap(
+        PLUGIN_NAME,
+        (
+          changedRecords: ReadonlyMap<Operation, IOperationExecutionResult>,
+          iterationOptions: IOperationGraphIterationOptions
+        ): void => {
+          const { inputsSnapshot } = iterationOptions;
+          if (!inputsSnapshot) {
+            return;
+          }
+          const snapshotStartTimeMs: number = getSnapshotStartTimeMs(inputsSnapshot);
+          for (const record of changedRecords.values()) {
+            const skipRecord: ILegacySkipRecord | undefined = stateMap.get(record.operation);
+            if (skipRecord && record.operation.runner?.cacheable) {
+              // What upstream operations recorded in the entry still holds. The record was not dispatched yet, so the
+              // tap at CAPTURE_INPUT_FILES_STAGE captures its input files later, for the newer snapshot.
+              Object.assign(skipRecord, readInputs(record, inputsSnapshot, snapshotStartTimeMs));
+            }
+          }
+        }
+      );
+
+      /**
+       * Reads the inputs of a cacheable operation that its skip record holds from the inputs snapshot.
+       */
+      function readInputs(
+        record: IOperationExecutionResult,
+        inputsSnapshot: IInputsSnapshot,
+        snapshotStartTimeMs: number
+      ): Pick<ILegacySkipRecord, 'packageDeps' | 'inputFilesCheck'> {
+        const { associatedProject, associatedPhase, runner } = record.operation;
+        try {
+          const fileHashes: ReadonlyMap<string, string> = inputsSnapshot.getTrackedFileHashesForOperation(
+            associatedProject,
+            associatedPhase.name
+          );
+
+          const files: Record<string, string> = {};
+          for (const [filePath, fileHash] of fileHashes) {
+            files[filePath] = fileHash;
+          }
+
+          const packageDeps: IProjectDeps = {
+            files,
+            arguments: runner!.getConfigHash()
+          };
+
+          return {
+            packageDeps,
+            inputFilesCheck:
+              record.enabled && !runner!.isNoOp
+                ? { inputsSnapshot, snapshotStartTimeMs, fileHashes }
+                : undefined
+          };
+        } catch (error) {
+          // To test this code path:
+          // Delete a project's ".rush/temp/shrinkwrap-deps.json" then run "rush build --verbose"
+          terminal.writeLine(
+            `Unable to calculate incremental state for ${record.operation.name}: ` +
+              (error as Error).toString()
+          );
+          terminal.writeLine(
+            Colorize.cyan('Rush will proceed without incremental execution and change detection.')
+          );
+          return { packageDeps: undefined, inputFilesCheck: undefined };
+        }
+      }
+
       graph.hooks.beforeExecuteOperationAsync.tapPromise(
         PLUGIN_NAME,
         async (
diff --git a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
index c548b17cc1..3cf1622541 100644
--- a/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationExecutionRecord.ts
@@ -444,6 +444,26 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     return this.#stateHashEntry.components;
   }
 
+  /**
+   * The state hash of this record, with the inputs that it was calculated from.
+   *
+   * @internal
+   */
+  public _getStateHashEntry(): IOperationStateHashCacheEntry {
+    this.#stateHashEntry ??= this.#calculateStateHash();
+    return this.#stateHashEntry;
+  }
+
+  /**
+   * Replaces the state hash of this record before it executes, when the iteration that owns it is extended with
+   * newer inputs (see `IOperationGraph.tryExtendCurrentIteration`).
+   *
+   * @internal
+   */
+  public _setStateHashEntry(entry: IOperationStateHashCacheEntry): void {
+    this.#stateHashEntry = entry;
+  }
+
   #calculateStateHash(): IOperationStateHashCacheEntry {
     const { inputsSnapshot, stateHashCache } = this.#context;
 
@@ -459,19 +479,9 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
 
     // The final state hashes of operation dependencies are factored into the hash to ensure that any
     // state changes in dependencies will invalidate the cache.
-    const previousEntry: IOperationStateHashCacheEntry | undefined = stateHashCache?.get(this.operation);
-    const previousDependencies: readonly string[] | undefined = previousEntry?.dependencyNamesAndHashes;
-    let hasSameDependencies: boolean = previousDependencies?.length === this.dependencies.size * 2;
-    let dependencyIndex: number = 0;
+    const dependencyNamesAndHashes: string[] = [];
     for (const record of this.dependencies) {
-      const dependencyHash: string = record.getStateHash();
-      if (
-        previousDependencies?.[dependencyIndex] !== record.name ||
-        previousDependencies[dependencyIndex + 1] !== dependencyHash
-      ) {
-        hasSameDependencies = false;
-      }
-      dependencyIndex += 2;
+      dependencyNamesAndHashes.push(record.name, record.getStateHash());
     }
 
     const { associatedProject, associatedPhase } = this;
@@ -490,34 +500,16 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     // - CLI parameters (ShellOperationRunner)
     const config: string = this.runner.getConfigHash();
 
-    if (hasSameDependencies && previousEntry?.local === local && previousEntry.config === config) {
-      // Nothing else goes into the hash, so the earlier entry is what this record would calculate
-      return previousEntry;
-    }
-
-    const dependencyNamesAndHashes: string[] = [];
-    for (const record of this.dependencies) {
-      dependencyNamesAndHashes.push(record.name, record.getStateHash());
-    }
-    const dependencies: string[] = Array.from(this.dependencies, (record) => {
-      return `${record.name}=${record.getStateHash()}`;
-    }).sort();
-
-    const hasher: crypto.Hash = crypto.createHash('sha1');
-    for (const dep of dependencies) {
-      hasher.update(`${RushConstants.hashDelimiter}${dep}`);
-    }
-    hasher.update(`${RushConstants.hashDelimiter}local=${local}`);
-    hasher.update(`${RushConstants.hashDelimiter}config=${config}`);
-
-    const entry: IOperationStateHashCacheEntry = {
+    const previousEntry: IOperationStateHashCacheEntry | undefined = stateHashCache?.get(this.operation);
+    const entry: IOperationStateHashCacheEntry = calculateOperationStateHashEntry(
+      dependencyNamesAndHashes,
       local,
       config,
-      dependencyNamesAndHashes,
-      components: { dependencies, local, config },
-      hash: hasher.digest('hex')
-    };
-    stateHashCache?.set(this.operation, entry);
+      previousEntry
+    );
+    if (entry !== previousEntry) {
+      stateHashCache?.set(this.operation, entry);
+    }
     return entry;
   }
 
@@ -676,3 +668,60 @@ export class OperationExecutionRecord implements IOperationRunnerContext, IOpera
     }
   }
 }
+
+/**
+ * Calculates the state hash of an operation from the names and state hashes of its dependencies (in the order of the
+ * operation's dependencies), its local state hash and its configuration hash. Returns `previousEntry` if it was
+ * calculated from the same inputs.
+ *
+ * @internal
+ */
+export function calculateOperationStateHashEntry(
+  dependencyNamesAndHashes: readonly string[],
+  local: string,
+  config: string,
+  previousEntry: IOperationStateHashCacheEntry | undefined
+): IOperationStateHashCacheEntry {
+  if (
+    previousEntry &&
+    previousEntry.local === local &&
+    previousEntry.config === config &&
+    haveSameItems(previousEntry.dependencyNamesAndHashes, dependencyNamesAndHashes)
+  ) {
+    // Nothing else goes into the hash, so the earlier entry is what this calculation would produce
+    return previousEntry;
+  }
+
+  const dependencies: string[] = [];
+  for (let index: number = 0; index < dependencyNamesAndHashes.length; index += 2) {
+    dependencies.push(`${dependencyNamesAndHashes[index]}=${dependencyNamesAndHashes[index + 1]}`);
+  }
+  dependencies.sort();
+
+  const hasher: crypto.Hash = crypto.createHash('sha1');
+  for (const dep of dependencies) {
+    hasher.update(`${RushConstants.hashDelimiter}${dep}`);
+  }
+  hasher.update(`${RushConstants.hashDelimiter}local=${local}`);
+  hasher.update(`${RushConstants.hashDelimiter}config=${config}`);
+
+  return {
+    local,
+    config,
+    dependencyNamesAndHashes,
+    components: { dependencies, local, config },
+    hash: hasher.digest('hex')
+  };
+}
+
+function haveSameItems(a: readonly string[], b: readonly string[]): boolean {
+  if (a.length !== b.length) {
+    return false;
+  }
+  for (let index: number = 0; index < a.length; index++) {
+    if (a[index] !== b[index]) {
+      return false;
+    }
+  }
+  return true;
+}
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index be6c1a0e4c..e5a30a6338 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -17,16 +17,26 @@ import type { Operation } from './Operation';
 import { OperationStatus, SUCCESS_STATUSES, TERMINAL_STATUSES } from './OperationStatus';
 import { _formatIterationStartLines, type IOperationGraphEventSink } from './OperationEventSink';
 import {
+  calculateOperationStateHashEntry,
   type IOperationExecutionContext,
   type IOperationExecutionRecordContext,
   type IOperationStateHashCacheEntry,
   OperationExecutionRecord
 } from './OperationExecutionRecord';
-import type { IExecutionResult } from './IOperationExecutionResult';
+import type {
+  IConfigurableOperation,
+  IExecutionResult,
+  IOperationStateHashComponents
+} from './IOperationExecutionResult';
 import type { IInputsSnapshot } from '../incremental/InputsSnapshot';
 import type { IEnvironment } from '../../utilities/Utilities';
 import type { IStopwatchResult } from '../../utilities/Stopwatch';
-import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
+import type {
+  IOperationGraph,
+  IOperationGraphExtensionOptions,
+  IOperationGraphExtensionResult,
+  IOperationGraphIterationOptions
+} from './IOperationGraph';
 import { OperationGraphHooks } from '../../pluginFramework/OperationGraphHooks';
 import { type Parallelism, coerceParallelism, getNumberOfCores } from './ParseParallelism';
 import { measureAsyncFn, measureFn } from '../../utilities/performance';
@@ -103,6 +113,18 @@ interface IExecutionIterationContext extends IOperationExecutionRecordContext {
 
   getOperationRequestId?: (operation: Operation) => string | undefined;
 
+  /** See `IOperationGraphIterationOptions.holdUnneededOperations`. */
+  holdUnneededOperations?: boolean;
+
+  /**
+   * The records that the iteration's enabled operations need: their own records, and the records of the operations
+   * that they depend on. Set when the iteration starts, if it holds the others, and grows when requests join it.
+   */
+  neededRecords?: Set<OperationExecutionRecord>;
+
+  /** The queue of the iteration, once the iteration starts. */
+  executionQueue?: AsyncOperationQueue;
+
   completedOperations: number;
   totalOperations: number;
 }
@@ -138,6 +160,82 @@ const prioritySort: IOperationSortFunction = (
   return a.criticalPathLength! - b.criticalPathLength!;
 };
 
+function getIterationOptions(iteration: IExecutionIterationContext): IOperationGraphIterationOptions {
+  return {
+    inputsSnapshot: iteration.inputsSnapshot,
+    startTime: iteration.startTime,
+    getOperationEnvironment: iteration.getOperationEnvironment,
+    isIncrementalBuildAllowed: iteration.isIncrementalBuildAllowed,
+    getOperationRequestId: iteration.getOperationRequestId,
+    holdUnneededOperations: iteration.holdUnneededOperations
+  };
+}
+
+function getRecord(
+  records: ReadonlyMap<Operation, OperationExecutionRecord>,
+  operation: Operation
+): OperationExecutionRecord {
+  const record: OperationExecutionRecord | undefined = records.get(operation);
+  if (!record) {
+    throw new InternalError(`The operation "${operation.name}" is not in the iteration.`);
+  }
+  return record;
+}
+
+/**
+ * Returns the given records and the records of the operations that they depend on, directly or indirectly.
+ */
+function collectNeededRecords(
+  records: ReadonlyMap<Operation, OperationExecutionRecord>,
+  roots: Iterable<OperationExecutionRecord>
+): Set<OperationExecutionRecord> {
+  const needed: Set<OperationExecutionRecord> = new Set(roots);
+  for (const record of needed) {
+    for (const dependency of record.operation.dependencies) {
+      needed.add(getRecord(records, dependency));
+    }
+  }
+  return needed;
+}
+
+/**
+ * Whether the queue has not dispatched the record yet.
+ */
+function isUndispatched(record: OperationExecutionRecord): boolean {
+  return record.status === OperationStatus.Waiting || record.status === OperationStatus.Ready;
+}
+
+function refuseExtension(reason: string): IOperationGraphExtensionResult {
+  return { extended: false, reason, changedOperations: new Set() };
+}
+
+/**
+ * A record of the executing iteration as `configureIteration` sees it when the iteration is planned again for a
+ * request that joins it. Changes to it are applied to the record only if the iteration is extended.
+ */
+class ConfigurableOperation implements IConfigurableOperation {
+  public readonly operation: Operation;
+  public readonly metadataFolderPath: string;
+  public enabled: boolean;
+  public shouldRunnerPersist: boolean = true;
+  readonly #stateHashEntry: IOperationStateHashCacheEntry;
+
+  public constructor(record: OperationExecutionRecord, stateHashEntry: IOperationStateHashCacheEntry) {
+    this.operation = record.operation;
+    this.metadataFolderPath = record.metadataFolderPath;
+    this.enabled = !!record.operation.enabled;
+    this.#stateHashEntry = stateHashEntry;
+  }
+
+  public getStateHash(): string {
+    return this.#stateHashEntry.hash;
+  }
+
+  public getStateHashComponents(): IOperationStateHashComponents {
+    return this.#stateHashEntry.components;
+  }
+}
+
 /**
  * Sorts operations lexicographically by their name.
  * @param a - The first operation to compare
@@ -495,6 +593,180 @@ export class OperationGraph implements IOperationGraph {
     }
   }
 
+  /**
+   * {@inheritDoc IOperationGraph.retainHeldOperations}
+   */
+  public retainHeldOperations(): (() => void) | undefined {
+    const iteration: IExecutionIterationContext | undefined = this.#currentIteration;
+    if (
+      !iteration?.executionQueue ||
+      iteration.executionQueue.isDone ||
+      !iteration.neededRecords ||
+      iteration.abortController.signal.aborted
+    ) {
+      return undefined;
+    }
+    return iteration.executionQueue.retainHeldOperations();
+  }
+
+  /**
+   * {@inheritDoc IOperationGraph.tryExtendCurrentIteration}
+   */
+  public tryExtendCurrentIteration(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult {
+    const iteration: IExecutionIterationContext | undefined = this.#currentIteration;
+    const { executionQueue, neededRecords, inputsSnapshot: iterationSnapshot } = iteration ?? {};
+    if (!iteration || !executionQueue?.isDispatching || !neededRecords) {
+      return refuseExtension('No iteration is dispatching operations while it holds the unneeded ones.');
+    }
+    if (iteration.abortController.signal.aborted) {
+      return refuseExtension('The iteration was aborted.');
+    }
+    if (iteration.isIncrementalBuildAllowed === false) {
+      return refuseExtension('The iteration is not incremental.');
+    }
+    if (!iterationSnapshot) {
+      return refuseExtension('The iteration has no inputs snapshot.');
+    }
+
+    const { records } = iteration;
+    const { inputsSnapshot } = options;
+    const joiningRecords: Set<OperationExecutionRecord> = collectNeededRecords(
+      records,
+      Array.from(options.neededOperations, (operation: Operation) => getRecord(records, operation))
+    );
+    const invalidatedOperations: Set<Operation> = new Set(options.invalidatedOperations);
+    for (const operation of invalidatedOperations) {
+      if (this.resultByOperation.get(operation) === records.get(operation)) {
+        // Invalidating it would abort the iteration
+        return refuseExtension(`"${operation.name}" was invalidated after it ran in the iteration.`);
+      }
+    }
+
+    const getLocalStateHash = (record: OperationExecutionRecord): string =>
+      inputsSnapshot.getOperationOwnStateHash(
+        record.associatedProject,
+        record.associatedPhase.name,
+        iteration.getOperationEnvironment?.(record.operation)
+      );
+
+    // An operation that was dispatched before the joining request's inputs changed has no result for it
+    for (const record of joiningRecords) {
+      if (!isUndispatched(record)) {
+        const { local, config } = record._getStateHashEntry();
+        if (
+          invalidatedOperations.has(record.operation) ||
+          getLocalStateHash(record) !== local ||
+          record.runner.getConfigHash() !== config
+        ) {
+          return refuseExtension(`"${record.name}" started before its inputs or outputs changed.`);
+        }
+      }
+    }
+
+    // The state hashes of the operations that were not dispatched yet, under the newer snapshot. Those of the
+    // dispatched operations are unchanged.
+    const stateHashEntries: Map<OperationExecutionRecord, IOperationStateHashCacheEntry> = new Map();
+    function getStateHashEntry(record: OperationExecutionRecord): IOperationStateHashCacheEntry {
+      let entry: IOperationStateHashCacheEntry | undefined = stateHashEntries.get(record);
+      if (!entry) {
+        entry = record._getStateHashEntry();
+        if (isUndispatched(record)) {
+          const dependencyNamesAndHashes: string[] = [];
+          for (const dependency of record.operation.dependencies) {
+            const dependencyRecord: OperationExecutionRecord = getRecord(records, dependency);
+            dependencyNamesAndHashes.push(dependencyRecord.name, getStateHashEntry(dependencyRecord).hash);
+          }
+          entry = calculateOperationStateHashEntry(
+            dependencyNamesAndHashes,
+            getLocalStateHash(record),
+            record.runner.getConfigHash(),
+            entry
+          );
+        }
+        stateHashEntries.set(record, entry);
+      }
+      return entry;
+    }
+
+    // Plan the iteration again, as a new iteration would be planned now
+    const plan: Map<Operation, ConfigurableOperation> = new Map();
+    const startedOperations: Set<Operation> = new Set();
+    for (const [operation, record] of records) {
+      plan.set(operation, new ConfigurableOperation(record, getStateHashEntry(record)));
+      if (!isUndispatched(record)) {
+        startedOperations.add(operation);
+      }
+    }
+    const lastStates: Map<Operation, OperationExecutionRecord> = new Map(this.resultByOperation);
+    for (const operation of invalidatedOperations) {
+      lastStates.delete(operation);
+    }
+    const extensionOptions: IOperationGraphIterationOptions = {
+      ...getIterationOptions(iteration),
+      inputsSnapshot,
+      startedOperations
+    };
+    this.hooks.configureIteration.call(plan, lastStates, extensionOptions);
+
+    const enabledRecords: OperationExecutionRecord[] = [];
+    for (const [operation, record] of records) {
+      if (plan.get(operation)!.enabled && !record.enabled) {
+        if (isUndispatched(record)) {
+          enabledRecords.push(record);
+        } else if (joiningRecords.has(record)) {
+          return refuseExtension(`"${record.name}" needs to run, but was dispatched without running.`);
+        }
+      }
+    }
+
+    // Commit
+    if (invalidatedOperations.size > 0) {
+      this.invalidateOperations(invalidatedOperations, options.invalidationReason);
+    }
+    const changedRecords: Map<Operation, OperationExecutionRecord> = new Map();
+    for (const [record, entry] of stateHashEntries) {
+      if (entry !== record._getStateHashEntry()) {
+        record._setStateHashEntry(entry);
+        this.#stateHashCache.set(record.operation, entry);
+        changedRecords.set(record.operation, record);
+      }
+    }
+    for (const record of enabledRecords) {
+      const configuration: ConfigurableOperation = plan.get(record.operation)!;
+      record.enabled = true;
+      record.shouldRunnerPersist = configuration.shouldRunnerPersist;
+      changedRecords.set(record.operation, record);
+    }
+
+    const releasedRecords: OperationExecutionRecord[] = [];
+    for (const record of collectNeededRecords(records, [...joiningRecords, ...enabledRecords])) {
+      if (!neededRecords.has(record)) {
+        neededRecords.add(record);
+        releasedRecords.push(record);
+      }
+    }
+    let totalOperations: number = 0;
+    for (const record of records.values()) {
+      if (!record.silent) {
+        totalOperations++;
+      }
+    }
+    iteration.totalOperations = totalOperations;
+
+    try {
+      this.hooks.extendIteration.call(changedRecords, extensionOptions);
+    } catch (error) {
+      // The records may not be prepared for their new state hashes
+      iteration.abortController.abort();
+      throw error;
+    }
+
+    const changedOperations: Set<Operation> = new Set(changedRecords.keys());
+    executionQueue.prioritizeOperations(Array.from(joiningRecords).filter(isUndispatched));
+    executionQueue.releaseHeldOperations(releasedRecords);
+    return { extended: true, changedOperations };
+  }
+
   public deleteResults(operations: Iterable<Operation>): void {
     if (this.#currentIteration || this.#scheduledIteration) {
       throw new Error('Cannot delete results of an executing or prepared graph.');
@@ -690,14 +962,16 @@ export class OperationGraph implements IOperationGraph {
       inputsSnapshot = await getInputsSnapshotAsync?.(),
       getOperationEnvironment,
       isIncrementalBuildAllowed,
-      getOperationRequestId
+      getOperationRequestId,
+      holdUnneededOperations
     } = iterationOptions;
     const iterationOptionsForCallbacks: IOperationGraphIterationOptions = {
       startTime,
       inputsSnapshot,
       getOperationEnvironment,
       isIncrementalBuildAllowed,
-      getOperationRequestId
+      getOperationRequestId,
+      holdUnneededOperations
     };
 
     const { hooks } = this;
@@ -750,6 +1024,7 @@ export class OperationGraph implements IOperationGraph {
       createEnvironment: createEnvironmentForOperation,
       getOperationEnvironment,
       getOperationRequestId,
+      holdUnneededOperations,
       invalidate: graph.invalidateOperations.bind(graph),
       get debugMode(): boolean {
         return graph.debugMode;
@@ -909,18 +1184,35 @@ export class OperationGraph implements IOperationGraph {
 
     const isInitial: boolean = this.resultByOperation.size === 0;
 
-    const iterationOptions: IOperationGraphIterationOptions = {
-      inputsSnapshot: iterationContext.inputsSnapshot,
-      startTime: iterationContext.startTime,
-      getOperationEnvironment: iterationContext.getOperationEnvironment,
-      isIncrementalBuildAllowed: iterationContext.isIncrementalBuildAllowed,
-      getOperationRequestId: iterationContext.getOperationRequestId
-    };
+    const iterationOptions: IOperationGraphIterationOptions = getIterationOptions(iterationContext);
+
+    let heldRecords: OperationExecutionRecord[] | undefined;
+    if (iterationContext.holdUnneededOperations) {
+      const enabledRecords: OperationExecutionRecord[] = [];
+      for (const record of executionRecords.values()) {
+        if (record.operation.enabled !== false) {
+          enabledRecords.push(record);
+        }
+      }
+      const neededRecords: Set<OperationExecutionRecord> = collectNeededRecords(
+        executionRecords,
+        enabledRecords
+      );
+      iterationContext.neededRecords = neededRecords;
+      heldRecords = [];
+      for (const record of executionRecords.values()) {
+        if (!neededRecords.has(record)) {
+          heldRecords.push(record);
+        }
+      }
+    }
 
     const executionQueue: AsyncOperationQueue = new AsyncOperationQueue(
       executionRecords.values(),
-      prioritySort
+      prioritySort,
+      heldRecords
     );
+    iterationContext.executionQueue = executionQueue;
 
     const abortSignal: AbortSignal = abortController.signal;
 
@@ -1017,6 +1309,20 @@ export class OperationGraph implements IOperationGraph {
         }
       }
     } else {
+      // Held operations are dispatched on abort, so that they finish as aborted
+      const releaseHeldOperations = (): void => executionQueue.releaseHeldOperations();
+      abortSignal.addEventListener('abort', releaseHeldOperations, { once: true });
+      if (abortSignal.aborted) {
+        releaseHeldOperations();
+      }
+      try {
+        await dispatchOperationsAsync();
+      } finally {
+        abortSignal.removeEventListener('abort', releaseHeldOperations);
+      }
+    }
+
+    async function dispatchOperationsAsync(): Promise<void> {
       await measureAsyncFn(`${PERF_PREFIX}:executeOperationsAsync`, async () => {
         await Async.forEachAsync(
           executionQueue,
@@ -1040,9 +1346,9 @@ export class OperationGraph implements IOperationGraph {
             // In weighted mode, concurrency represents the total "unit budget", not the max number of tasks.
             // Do not cap by totalOperations, since that would incorrectly shrink the unit budget and
             // reduce parallelism for operations with weight > 1.
-            concurrency: this.parallelism,
+            concurrency: graph.parallelism,
             weighted: true,
-            allowOversubscription: this.allowOversubscription
+            allowOversubscription: graph.allowOversubscription
           }
         );
       });
diff --git a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
index d8eeb56c15..42f98aad59 100644
--- a/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/AsyncOperationQueue.test.ts
@@ -94,6 +94,34 @@ function createGraph(
   return records;
 }
 
+/**
+ * Returns whether the promise settles before the pending I/O callbacks run, i.e. without waiting for other work.
+ */
+async function isSettledAsync(promise: Promise<unknown>): Promise<boolean> {
+  let settled: boolean = false;
+  promise.then(
+    () => {
+      settled = true;
+    },
+    () => {
+      settled = true;
+    }
+  );
+  await new Promise((resolve: (value: unknown) => void) => setImmediate(resolve));
+  return settled;
+}
+
+async function completeAsync(
+  queue: AsyncOperationQueue,
+  expected: OperationExecutionRecord
+): Promise<OperationExecutionRecord> {
+  const { value } = await queue.next();
+  expect(value?.name).toBe(expected.name);
+  expected.status = OperationStatus.Success;
+  queue.complete(expected);
+  return expected;
+}
+
 describe(AsyncOperationQueue.name, () => {
   it('iterates operations in topological order', async () => {
     const operations = [createRecord('a'), createRecord('b'), createRecord('c'), createRecord('d')];
@@ -324,6 +352,150 @@ describe(AsyncOperationQueue.name, () => {
     expect(isStatusRead).toBe(true);
   });
 
+  describe('held operations', () => {
+    it('dispatches held operations only after all other operations completed', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const b: OperationExecutionRecord = createRecord('b');
+      const held: OperationExecutionRecord = createRecord('held');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([held, a, b], nullSort, [held]);
+      expect(queue.heldOperations).toEqual(new Set([held]));
+
+      const first: OperationExecutionRecord = (await queue.next()).value;
+      const second: OperationExecutionRecord = (await queue.next()).value;
+      expect(new Set([first, second])).toEqual(new Set([a, b]));
+      const third: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      first.status = OperationStatus.Success;
+      queue.complete(first);
+      expect(await isSettledAsync(third)).toBe(false);
+
+      second.status = OperationStatus.Success;
+      queue.complete(second);
+      expect((await third).value).toBe(held);
+      expect(queue.heldOperations.size).toBe(0);
+      held.status = OperationStatus.Success;
+      queue.complete(held);
+      expect((await queue.next()).done).toBe(true);
+    });
+
+    it('dispatches the operations if all of them are held', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a], nullSort, [a]);
+
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(true);
+      expect((await next).value).toBe(a);
+    });
+
+    it('keeps held operations held while they are retained', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const held: OperationExecutionRecord = createRecord('held');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a, held], nullSort, [held]);
+      const release: () => void = queue.retainHeldOperations();
+      const releaseOther: () => void = queue.retainHeldOperations();
+
+      await completeAsync(queue, a);
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(false);
+      expect(queue.isDone).toBe(false);
+      expect(queue.isDispatching).toBe(true);
+
+      // Each function releases its own retention only
+      release();
+      release();
+      expect(await isSettledAsync(next)).toBe(false);
+
+      releaseOther();
+      expect((await next).value).toBe(held);
+    });
+
+    it('dispatches released operations', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const released: OperationExecutionRecord = createRecord('released');
+      const held: OperationExecutionRecord = createRecord('held');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a, released, held], nullSort, [
+        released,
+        held
+      ]);
+
+      expect((await queue.next()).value).toBe(a);
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(false);
+
+      queue.releaseHeldOperations([released, a]);
+      expect((await next).value).toBe(released);
+      expect(queue.heldOperations).toEqual(new Set([held]));
+      const last: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(last)).toBe(false);
+
+      queue.releaseHeldOperations();
+      expect((await last).value).toBe(held);
+    });
+
+    it('completes a held operation that a failure blocks', async () => {
+      const dependency: OperationExecutionRecord = createRecord('dependency');
+      const other: OperationExecutionRecord = createRecord('other');
+      const consumer: OperationExecutionRecord = createRecord('consumer');
+      const held: OperationExecutionRecord = createRecord('held');
+      addDependency(consumer, dependency);
+      const queue: AsyncOperationQueue = new AsyncOperationQueue(
+        [dependency, other, consumer, held],
+        nullSort,
+        [consumer, held]
+      );
+
+      const first: OperationExecutionRecord = (await queue.next()).value;
+      const second: OperationExecutionRecord = (await queue.next()).value;
+      expect(new Set([first, second])).toEqual(new Set([dependency, other]));
+
+      // As the graph handles a failure
+      dependency.status = OperationStatus.Failure;
+      consumer.status = OperationStatus.Blocked;
+      queue.complete(consumer);
+      expect(queue.heldOperations).toEqual(new Set([held]));
+      queue.complete(dependency);
+
+      // The other operation is still executing
+      const next: Promise<IteratorResult<OperationExecutionRecord>> = queue.next();
+      expect(await isSettledAsync(next)).toBe(false);
+      other.status = OperationStatus.Success;
+      queue.complete(other);
+      expect((await next).value).toBe(held);
+      held.status = OperationStatus.Success;
+      queue.complete(held);
+      expect((await queue.next()).done).toBe(true);
+    });
+
+    it('dispatches prioritized operations first', async () => {
+      const records: OperationExecutionRecord[] = ['a', 'b', 'c', 'd'].map((name: string) =>
+        createRecord(name)
+      );
+      const [a, b, c, d] = records;
+      const queue: AsyncOperationQueue = new AsyncOperationQueue(records, nullSort, [c]);
+
+      queue.prioritizeOperations([a, c]);
+      expect((await queue.next()).value).toBe(a);
+      // A held operation stays held when it is prioritized, and goes first when it is released
+      queue.releaseHeldOperations([c]);
+      expect((await queue.next()).value).toBe(c);
+      // Without a preference, the ready operations are assigned from the end of the queue
+      expect((await queue.next()).value).toBe(d);
+      expect((await queue.next()).value).toBe(b);
+    });
+
+    it('reports whether it is dispatching', async () => {
+      const a: OperationExecutionRecord = createRecord('a');
+      const queue: AsyncOperationQueue = new AsyncOperationQueue([a], nullSort);
+      expect(queue.isDispatching).toBe(false);
+
+      const { value } = await queue.next();
+      expect(queue.isDispatching).toBe(true);
+      value.status = OperationStatus.Success;
+      queue.complete(value);
+      expect(queue.isDone).toBe(true);
+      expect(queue.isDispatching).toBe(false);
+    });
+  });
+
   describe('critical path length', () => {
     // An operation's length is the total weight of the longest chain from it to an operation with no consumers,
     // including its own weight. It must not depend on the order in which the operations are visited.
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index db4d60e891..13479c8d87 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -79,6 +79,7 @@ import { Operation } from '../Operation';
 import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import type { IOperationGraphExtensionResult } from '../IOperationGraph';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import {
   captureInputFilesState,
@@ -142,7 +143,12 @@ interface ITestGraph {
   snapshotHashes: Map<string, string>;
   // Called when an operation executes, e.g. to save one of its input files while it executes
   onExecute: ((name: string) => void) | undefined;
-  executeAsync(workingTreeReadStartTimeMs?: number): Promise<IExecutionResult>;
+  // An inputs snapshot of the current local hashes and tracked file hashes
+  createInputsSnapshot(workingTreeReadStartTimeMs?: number): IInputsSnapshot;
+  executeAsync(
+    workingTreeReadStartTimeMs?: number,
+    holdUnneededOperations?: boolean
+  ): Promise<IExecutionResult>;
 }
 
 /**
@@ -173,9 +179,16 @@ async function createTestGraphAsync(
       projectFolder: `${rootDirectory}/${name}`
     } as unknown as RushConfigurationProject;
     projectConfigurations.set(project, {
-      getCacheDisabledReason: () => {
+      getCacheDisabledReason: (trackedFileNames: Iterable<string>) => {
         cacheDisabledReasonComputations.push(name);
-        return cacheDisabledReasons.get(name);
+        // Like RushProjectConfiguration, which disables caching if Git tracks a file in an output folder
+        const trackedOutputFile: string | undefined = [...trackedFileNames].find((file: string) =>
+          file.startsWith(`${name}/lib/`)
+        );
+        return (
+          cacheDisabledReasons.get(name) ??
+          (trackedOutputFile ? `Git tracks the output file "${trackedOutputFile}".` : undefined)
+        );
       }
     } as unknown as RushProjectConfiguration);
     const operation: Operation = new Operation({
@@ -231,6 +244,21 @@ async function createTestGraphAsync(
     projectConfigurations
   } as unknown as IOperationGraphContext);
 
+  const createInputsSnapshot = (workingTreeReadStartTimeMs?: number): IInputsSnapshot => {
+    const snapshotLocalHashes: Map<string, string> = new Map(localHashes);
+    const snapshotTrackedFileHashes: Map<string, Map<string, string>> = new Map(trackedFileHashes);
+    return {
+      hashes: new Map(snapshotHashes),
+      rootDirectory,
+      hasUncommittedChanges: false,
+      workingTreeReadStartTimeMs,
+      getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
+        snapshotTrackedFileHashes.get(project.packageName) ?? new Map(),
+      getOperationOwnStateHash: (project: RushConfigurationProject) =>
+        snapshotLocalHashes.get(project.packageName)!
+    };
+  };
+
   return {
     graph,
     operations,
@@ -248,20 +276,15 @@ async function createTestGraphAsync(
     set onExecute(value: ((name: string) => void) | undefined) {
       onExecute = value;
     },
-    executeAsync: async (workingTreeReadStartTimeMs?: number) => {
+    createInputsSnapshot,
+    executeAsync: async (workingTreeReadStartTimeMs?: number, holdUnneededOperations?: boolean) => {
       executions.length = 0;
       cacheWrites.length = 0;
       cacheDisabledReasonComputations.length = 0;
-      const inputsSnapshot: IInputsSnapshot = {
-        hashes: snapshotHashes,
-        rootDirectory,
-        hasUncommittedChanges: false,
-        workingTreeReadStartTimeMs,
-        getTrackedFileHashesForOperation: (project: RushConfigurationProject) =>
-          trackedFileHashes.get(project.packageName) ?? new Map(),
-        getOperationOwnStateHash: (project: RushConfigurationProject) => localHashes.get(project.packageName)!
-      };
-      return await graph.executeAsync({ inputsSnapshot });
+      return await graph.executeAsync({
+        inputsSnapshot: createInputsSnapshot(workingTreeReadStartTimeMs),
+        holdUnneededOperations
+      });
     }
   };
 }
@@ -704,6 +727,163 @@ describe(CacheableOperationPlugin.name, () => {
     });
   });
 
+  describe('an operation that joins the iteration', () => {
+    const inputFile: string = 'b/src/index.ts';
+    let rootDirectory: string;
+    let inputFilePath: string;
+
+    beforeEach(() => {
+      rootDirectory = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'rush-cacheable-')));
+      fs.mkdirSync(path.join(rootDirectory, 'b', 'src'), { recursive: true });
+      inputFilePath = path.join(rootDirectory, inputFile);
+      fs.writeFileSync(inputFilePath, 'export const b = 1;');
+      jest.mocked(captureInputFilesState).mockClear();
+    });
+
+    afterEach(() => {
+      fs.rmSync(rootDirectory, { recursive: true, force: true });
+    });
+
+    // The name of each case, whether the input file of "b" changes while it executes, when the inputs snapshot of the
+    // joining request began to read the working tree, after the save that it saw, and the cache writes
+    it.each<[string, boolean, number, string[]]>([
+      [
+        'does not write its cache entry if they change while it executes',
+        true,
+        FILE_TIME_TOLERANCE_MS + 1,
+        ['a']
+      ],
+      [
+        'writes its cache entry if they do not change while it executes',
+        false,
+        FILE_TIME_TOLERANCE_MS + 1,
+        ['a', 'b']
+      ],
+      [
+        'writes its cache entry if they do not change while it executes, and it hashed a save within the tolerance of the file times',
+        false,
+        0,
+        ['a', 'b']
+      ]
+    ])(
+      'checks its input files against the inputs snapshot of the joining request, and %s',
+      async (
+        title: string,
+        changesWhileExecuting: boolean,
+        snapshotStartAfterSaveMs: number,
+        expectedCacheWrites: string[]
+      ) => {
+        const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+        const hash: string = getGitBlobHash('export const b = 1;');
+        testGraph.trackedFileHashes.set('b', new Map([[inputFile, hash]]));
+        testGraph.snapshotHashes.set(inputFile, hash);
+        const b: Operation = testGraph.operations.get('b')!;
+        // Like an operation that only a later request needs, which the Rush daemon holds for that request
+        b.enabled = false;
+        const checkedOperations: string[] = [];
+        // Like IncrementalExecutionGuardPlugin, which checks the input files of the other operations that execute
+        testGraph.graph.hooks.beforeExecuteOperationAsync.tap(
+          { name: 'test', stage: CAPTURE_INPUT_FILES_STAGE + 1 },
+          (record: IOperationRunnerContext & IOperationExecutionResult): undefined => {
+            if (areInputFilesChecked(record)) {
+              checkedOperations.push(record.operation.associatedProject.packageName);
+            }
+            return undefined;
+          }
+        );
+        let extension: IOperationGraphExtensionResult | undefined;
+        let joiningSnapshotStartTimeMs: number | undefined;
+        testGraph.onExecute = (name: string) => {
+          if (name === 'a') {
+            // The request that joins while "a" executes saw a save of the input file of "b", which the inputs
+            // snapshot of the iteration did not. Its inputs snapshot hashed the saved file.
+            const savedHash: string = getGitBlobHash('export const b = 2;');
+            fs.writeFileSync(inputFilePath, 'export const b = 2;');
+            testGraph.trackedFileHashes.set('b', new Map([[inputFile, savedHash]]));
+            testGraph.snapshotHashes.set(inputFile, savedHash);
+            testGraph.localHashes.set('b', 'b-v2');
+            b.enabled = true;
+            joiningSnapshotStartTimeMs = getLatestFileTimeMs(inputFilePath) + snapshotStartAfterSaveMs;
+            extension = testGraph.graph.tryExtendCurrentIteration({
+              inputsSnapshot: testGraph.createInputsSnapshot(joiningSnapshotStartTimeMs),
+              neededOperations: [b]
+            });
+          } else if (changesWhileExecuting) {
+            // A different size, so that the save is detected even if the file time does not change
+            fs.writeFileSync(inputFilePath, 'export const b = 22;');
+          }
+        };
+        const iterationSnapshotStartTimeMs: number = Date.now();
+
+        const result: IExecutionResult = await testGraph.executeAsync(iterationSnapshotStartTimeMs, true);
+
+        expect(extension?.extended).toBe(true);
+        expect(result.status).toBe(OperationStatus.Success);
+        expect(testGraph.executions).toEqual(['a', 'b']);
+        expect(checkedOperations).toEqual(['a', 'b']);
+        // The input files of "b" were captured for the inputs snapshot of the joining request. The save is in the window
+        // of the inputs snapshot of the iteration, which did not hash it, so that snapshot would stop the cache write.
+        expect(jest.mocked(captureInputFilesState).mock.calls.map((args) => args[2])).toEqual([
+          iterationSnapshotStartTimeMs,
+          joiningSnapshotStartTimeMs
+        ]);
+        expect(testGraph.cacheWrites).toEqual(expectedCacheWrites);
+      }
+    );
+
+    it('reads the reason that caching is disabled from the inputs snapshot of the joining request', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      const hash: string = getGitBlobHash('export const b = 1;');
+      testGraph.trackedFileHashes.set('b', new Map([[inputFile, hash]]));
+      testGraph.snapshotHashes.set(inputFile, hash);
+      const b: Operation = testGraph.operations.get('b')!;
+      // Like an operation that only a later request needs, which the Rush daemon holds for that request
+      b.enabled = false;
+      // An output of an earlier build of "b", which is on disk, so that the input files of "b" would not change if
+      // they were captured and checked
+      const outputFile: string = 'b/lib/index.js';
+      fs.mkdirSync(path.join(rootDirectory, 'b', 'lib'));
+      fs.writeFileSync(path.join(rootDirectory, outputFile), 'exports.b = 1;');
+      let extension: IOperationGraphExtensionResult | undefined;
+      testGraph.onExecute = (name: string) => {
+        if (name === 'a') {
+          // The request that joins while "a" executes saw that Git tracks the output file of "b", which the inputs
+          // snapshot of the iteration did not
+          const outputHash: string = getGitBlobHash('exports.b = 1;');
+          testGraph.trackedFileHashes.set(
+            'b',
+            new Map([
+              [inputFile, hash],
+              [outputFile, outputHash]
+            ])
+          );
+          testGraph.snapshotHashes.set(outputFile, outputHash);
+          testGraph.localHashes.set('b', 'b-v2');
+          b.enabled = true;
+          extension = testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: testGraph.createInputsSnapshot(Date.now()),
+            neededOperations: [b]
+          });
+        }
+      };
+
+      const iterationSnapshotStartTimeMs: number = Date.now();
+
+      const result: IExecutionResult = await testGraph.executeAsync(iterationSnapshotStartTimeMs, true);
+
+      expect(extension?.extended).toBe(true);
+      expect(result.status).toBe(OperationStatus.Success);
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      // Computed for "b" only once it executes, after the request joined
+      expect(testGraph.cacheDisabledReasonComputations).toEqual(['a', 'b']);
+      // Caching is disabled for "b", so its input files were not captured
+      expect(jest.mocked(captureInputFilesState).mock.calls.map((args) => args[2])).toEqual([
+        iterationSnapshotStartTimeMs
+      ]);
+      expect(testGraph.cacheWrites).toEqual(['a']);
+    });
+  });
+
   it('tells other plugins which operations it checks the input files of', async () => {
     const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b', 'c', 'd']);
     testGraph.cacheDisabledReasons.set('b', 'Caching has been disabled for this project.');
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index aa93c21fe0..bc9d535ba5 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -84,6 +84,7 @@ import {
 } from '../IncrementalExecutionState';
 import { captureInputFilesState, type IInputFilesState } from '../InputFilesStatSignature';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
+import type { IOperationGraphExtensionResult } from '../IOperationGraph';
 import { type ILegacySkipPluginOptions, LegacySkipPlugin } from '../LegacySkipPlugin';
 import { NullOperationRunner } from '../NullOperationRunner';
 import { Operation } from '../Operation';
@@ -204,8 +205,13 @@ interface ITestWorkspace {
   recreateFolder(relativePath: string): void;
   executeAsync(
     environment?: Readonly<Record<string, string>>,
-    isIncrementalBuildAllowed?: boolean
+    isIncrementalBuildAllowed?: boolean,
+    holdUnneededOperations?: boolean
   ): Promise<ITestIteration>;
+  /**
+   * Takes an inputs snapshot of the workspace, like a request of the Rush daemon
+   */
+  createInputsSnapshot(environment?: Readonly<Record<string, string>>): InputsSnapshot;
   /**
    * Resolves when the next command that hangs has written its outputs. It runs until it is terminated.
    */
@@ -616,7 +622,7 @@ async function createWorkspaceAsync(
   }
 
   // Like `git hash-object` for each file, except the outputs, which are ignored by git.
-  const createInputsSnapshot = (environment: Readonly<Record<string, string>>): InputsSnapshot => {
+  const createInputsSnapshot = (environment: Readonly<Record<string, string>> = {}): InputsSnapshot => {
     const workingTreeReadStartTimeMs: number | undefined = recordsWorkingTreeReadStartTime
       ? Date.now()
       : undefined;
@@ -653,14 +659,16 @@ async function createWorkspaceAsync(
     recreateFolder: (relativePath: string) => recreateFolder(`${rootFolder}/${relativePath}`),
     executeAsync: async (
       environment: Readonly<Record<string, string>> = {},
-      isIncrementalBuildAllowed?: boolean
+      isIncrementalBuildAllowed?: boolean,
+      holdUnneededOperations?: boolean
     ): Promise<ITestIteration> => {
       commands.length = 0;
       destination.reset();
       const result: IExecutionResult = await graph.executeAsync({
         inputsSnapshot: createInputsSnapshot(environment),
         getOperationEnvironment: () => environment,
-        isIncrementalBuildAllowed
+        isIncrementalBuildAllowed,
+        holdUnneededOperations
       });
       return {
         result,
@@ -670,27 +678,37 @@ async function createWorkspaceAsync(
           (result.operationResults.get(operations.get(name)!) as OperationExecutionRecord).status
       };
     },
+    createInputsSnapshot,
     waitForHangAsync: () => new Promise<void>((resolve: () => void) => hangWaiters.push(resolve))
   };
 }
 
-// Changes the input files once, in a tap at the specified stage that runs before an operation executes
-function changeBeforeOperation(workspace: ITestWorkspace, stage: number, change: () => void): void {
+// Changes the input files once, in a tap at the specified stage that runs before an operation executes. If a project
+// is named, before its operation executes.
+function changeBeforeOperation(
+  workspace: ITestWorkspace,
+  stage: number,
+  change: () => void,
+  projectName?: string
+): void {
   let pendingChange: (() => void) | undefined = change;
   workspace.graph.hooks.beforeExecuteOperationAsync.tap(
     { name: 'changeInputFiles', stage },
-    (): undefined => {
-      pendingChange?.();
-      pendingChange = undefined;
+    (record: IOperationExecutionResult): undefined => {
+      if (projectName === undefined || record.operation.associatedProject.packageName === projectName) {
+        pendingChange?.();
+        pendingChange = undefined;
+      }
       return undefined;
     }
   );
 }
 
-// Like an editor that saves a file while the command of the operation reads the input files. The taps that capture
-// the input files were registered earlier, at the same or a lower stage, so they run before this one.
-function changeWhileExecuting(workspace: ITestWorkspace, change: () => void): void {
-  changeBeforeOperation(workspace, Number.MAX_SAFE_INTEGER, change);
+// Like an editor that saves a file while the command of the operation reads the input files. If a project is named,
+// while the command of its operation reads them. The taps that capture the input files were registered earlier, at
+// the same or a lower stage, so they run before this one.
+function changeWhileExecuting(workspace: ITestWorkspace, change: () => void, projectName?: string): void {
+  changeBeforeOperation(workspace, Number.MAX_SAFE_INTEGER, change, projectName);
 }
 
 // Like an editor that saves a file after the inputs snapshot read the working tree, and before the operation starts
@@ -775,6 +793,38 @@ function getCapturedProjectNames(workspace: ITestWorkspace): string[] {
     );
 }
 
+// Like a request that joins the iteration of the Rush daemon while the operation of a project executes: it takes an
+// inputs snapshot after the change, and needs the operations of the joining projects. Returns the result.
+function joinWhileExecuting(
+  workspace: ITestWorkspace,
+  projectName: string,
+  change: () => void,
+  joiningProjectNames: ReadonlyArray<string>
+): () => IOperationGraphExtensionResult | undefined {
+  let extension: IOperationGraphExtensionResult | undefined;
+  workspace.graph.hooks.beforeExecuteOperationAsync.tap(
+    'joinWhileExecuting',
+    (record: IOperationExecutionResult): undefined => {
+      if (!extension && record.operation.associatedProject.packageName === projectName) {
+        change();
+        const neededOperations: Operation[] = joiningProjectNames.map(
+          (name: string) => workspace.operations.get(name)!
+        );
+        for (const operation of neededOperations) {
+          // Like the Rush daemon, which enables the operations that the joining request selected
+          operation.enabled = true;
+        }
+        extension = workspace.graph.tryExtendCurrentIteration({
+          inputsSnapshot: workspace.createInputsSnapshot(),
+          neededOperations
+        });
+      }
+      return undefined;
+    }
+  );
+  return () => extension;
+}
+
 function readOutput(workspace: ITestWorkspace, relativePath: string): string | undefined {
   const outputPath: string = `${workspace.rootFolder}/${relativePath}`;
   return fs.existsSync(outputPath) ? fs.readFileSync(outputPath, 'utf8') : undefined;
@@ -1627,6 +1677,51 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
     expect(getCapturedProjectNames(workspace)).toEqual(['c']);
   });
 
+  describe('with an operation that joins the iteration', () => {
+    it.each<[string, boolean]>([
+      ['that the iteration held', true],
+      ['that waited for its dependency', false]
+    ])(
+      'checks the inputs of an operation %s against the inputs snapshot of the joining request',
+      async (description: string, isHeld: boolean) => {
+        const workspace: ITestWorkspace = await createWorkspaceAsync([
+          { name: 'a' },
+          { name: 'b', dependencies: isHeld ? [] : ['a'] }
+        ]);
+        expect([...(await workspace.executeAsync()).commands].sort()).toEqual(['a:initial', 'b:initial']);
+
+        if (isHeld) {
+          // Like an operation that only a later request needs, which the Rush daemon holds for that request
+          workspace.operations.get('b')!.enabled = false;
+        }
+        workspace.writeFile('a/src/one.ts', 'one 2');
+        const getExtension: () => IOperationGraphExtensionResult | undefined = joinWhileExecuting(
+          workspace,
+          'a',
+          () => workspace.writeFile('b/tsconfig.json', '{ "compilerOptions": {} }'),
+          ['b']
+        );
+        changeWhileExecuting(workspace, () => workspace.writeFile('b/src/sub/two.ts', 'two edited'), 'b');
+        const joined: ITestIteration = await workspace.executeAsync({}, undefined, true);
+        expect(getExtension()?.extended).toBe(true);
+        expect(joined.commands).toEqual(['a:incremental', 'b:initial']);
+        expect(joined.output).toContain(
+          'Not using the incremental command because a configuration file changed ("b/tsconfig.json").'
+        );
+
+        // The inputs snapshot is the same as that of the joining request, but the outputs of "b" were built from
+        // other inputs.
+        workspace.writeFile('b/src/sub/two.ts', 'two');
+        const next: ITestIteration = await workspace.executeAsync();
+        expect(next.commands).toEqual(['b:initial']);
+        expect(next.output).toContain(
+          'Not using the incremental command because its outputs were not built by a successful run of its own command in this process.'
+        );
+        expect(readOutput(workspace, 'b/lib/sub/two.js')).toBe('two');
+      }
+    );
+  });
+
   it('forgets every base after a native command, but not after an input change', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }, { name: 'b' }]);
     await workspace.executeAsync();
@@ -1849,6 +1944,32 @@ describe(LegacySkipPlugin.name, () => {
     expect(fs.existsSync(getPackageDepsPath(workspace))).toBe(true);
   });
 
+  it('records the inputs of an operation that joins the iteration from the inputs snapshot of the joining request', async () => {
+    const workspace: ITestWorkspace = await createWorkspaceAsync(
+      [{ name: 'a' }, { name: 'b' }],
+      legacyOptions
+    );
+    // Like an operation that only a later request needs, which the Rush daemon holds for that request
+    workspace.operations.get('b')!.enabled = false;
+    const getExtension: () => IOperationGraphExtensionResult | undefined = joinWhileExecuting(
+      workspace,
+      'a',
+      () => workspace.writeFile('b/src/one.ts', 'one 2'),
+      ['b']
+    );
+    expect((await workspace.executeAsync({}, undefined, true)).commands).toEqual(['a:initial', 'b:initial']);
+    expect(getExtension()?.extended).toBe(true);
+    expect(readOutput(workspace, 'b/lib/one.js')).toBe('one 2');
+
+    // The outputs of "b" were built from the saved file, so a later command runs it after the save is undone.
+    workspace.writeFile('b/src/one.ts', 'one');
+    startLaterCommand(workspace);
+    const next: ITestIteration = await workspace.executeAsync();
+    expect(next.commands).toEqual(['b:initial']);
+    expect(next.getStatus('a')).toBe(OperationStatus.Skipped);
+    expect(readOutput(workspace, 'b/lib/one.js')).toBe('one');
+  });
+
   it('checks the input files of an incremental command for IncrementalExecutionGuardPlugin', async () => {
     const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
       hasLegacySkipDetection: true
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
new file mode 100644
index 0000000000..17c3299297
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
@@ -0,0 +1,647 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('../OperationStateFile');
+// Mock project log file creation to avoid filesystem writes.
+jest.mock('../ProjectLogWritable', () => {
+  const actual = jest.requireActual('../ProjectLogWritable');
+  const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
+  class MockTerminalWritable extends TerminalWritable {
+    protected onWriteChunk(): void {
+      /* noop */
+    }
+    protected onClose(): void {
+      /* noop */
+    }
+  }
+  return {
+    ...actual,
+    initializeProjectLogFilesAsync: jest.fn(async () => new MockTerminalWritable())
+  };
+});
+
+import type { CollatedTerminal } from '@rushstack/stream-collator';
+import { MockWritable } from '@rushstack/terminal';
+
+import type { IPhase } from '../../../api/CommandLineConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
+import type {
+  IConfigurableOperation,
+  IExecutionResult,
+  IOperationExecutionResult
+} from '../IOperationExecutionResult';
+import type { IOperationGraphExtensionResult, IOperationGraphIterationOptions } from '../IOperationGraph';
+import { Operation } from '../Operation';
+import { OperationGraph } from '../OperationGraph';
+import { OperationStatus } from '../OperationStatus';
+import { MockOperationRunner } from './MockOperationRunner';
+
+const mockPhase: IPhase = {
+  name: 'phase',
+  allowWarningsOnSuccess: false,
+  associatedParameters: new Set(),
+  dependencies: {
+    self: new Set(),
+    upstream: new Set()
+  },
+  isSynthetic: false,
+  logFilenameIdentifier: 'phase',
+  missingScriptBehavior: 'silent'
+};
+
+function createSnapshot(localHashes: Record<string, string>): IInputsSnapshot {
+  return {
+    hashes: new Map(),
+    rootDirectory: '/repo',
+    hasUncommittedChanges: false,
+    getTrackedFileHashesForOperation: () => new Map(),
+    getOperationOwnStateHash: (project: IRushConfigurationProjectForSnapshot) =>
+      localHashes[(project as RushConfigurationProject).packageName]
+  };
+}
+
+/**
+ * Lets the graph dispatch and complete whatever it can.
+ */
+async function settleAsync(): Promise<void> {
+  for (let i: number = 0; i < 20; i++) {
+    await new Promise((resolve: (value: unknown) => void) => setImmediate(resolve));
+  }
+}
+
+async function waitForAsync(condition: () => boolean): Promise<void> {
+  for (let i: number = 0; i < 100; i++) {
+    if (condition()) {
+      return;
+    }
+    await new Promise((resolve: (value: unknown) => void) => setImmediate(resolve));
+  }
+  throw new Error('The condition was not met');
+}
+
+interface IGraphOptions {
+  readonly edges?: readonly [consumer: string, dependency: string][];
+  readonly enabled?: readonly string[];
+  readonly parallelism?: number;
+  readonly weights?: Readonly<Record<string, number>>;
+}
+
+/**
+ * A graph of operations whose runners run until the test finishes them.
+ */
+class TestGraph {
+  public readonly graph: OperationGraph;
+  public readonly started: string[] = [];
+  public records: ReadonlyMap<Operation, IOperationExecutionResult> | undefined;
+  readonly #operations: Map<string, Operation> = new Map();
+  readonly #finishers: Map<string, () => void> = new Map();
+  readonly #finished: Set<string> = new Set();
+
+  public constructor(names: readonly string[], options: IGraphOptions = {}) {
+    const { edges = [], enabled = names, parallelism = 4, weights = {} } = options;
+    for (const name of names) {
+      const weight: number | undefined = weights[name];
+      this.#operations.set(
+        name,
+        new Operation({
+          runner: new MockOperationRunner(name, async (terminal: CollatedTerminal) => {
+            this.started.push(name);
+            terminal.writeStdoutLine(`${name} started`);
+            if (!this.#finished.has(name)) {
+              await new Promise<void>((resolve: () => void) => this.#finishers.set(name, resolve));
+            }
+            return OperationStatus.Success;
+          }),
+          logFilenameIdentifier: name,
+          phase: mockPhase,
+          project: { packageName: name } as unknown as RushConfigurationProject,
+          settings: weight === undefined ? undefined : { operationName: mockPhase.name, weight },
+          enabled: enabled.includes(name)
+        })
+      );
+    }
+    for (const [consumer, dependency] of edges) {
+      this.operation(consumer).addDependency(this.operation(dependency));
+    }
+
+    this.graph = new OperationGraph(new Set(this.#operations.values()), {
+      quietMode: true,
+      debugMode: false,
+      parallelism,
+      allowOversubscription: false,
+      destinations: [new MockWritable()],
+      abortController: new AbortController()
+    });
+    this.graph.hooks.beforeExecuteIterationAsync.tap('test', (records) => {
+      this.records = records;
+    });
+  }
+
+  public operation(name: string): Operation {
+    return this.#operations.get(name)!;
+  }
+
+  public record(name: string): IOperationExecutionResult {
+    return this.records!.get(this.operation(name))!;
+  }
+
+  public async startedAsync(name: string): Promise<void> {
+    await waitForAsync(() => this.started.includes(name));
+  }
+
+  public finish(name: string): void {
+    this.#finished.add(name);
+    this.#finishers.get(name)?.();
+  }
+
+  public block(name: string): void {
+    this.#finished.delete(name);
+  }
+
+  public finishAll(): void {
+    for (const name of this.#operations.keys()) {
+      this.finish(name);
+    }
+  }
+
+  public getStatuses(result: IExecutionResult): Record<string, OperationStatus> {
+    const statuses: Record<string, OperationStatus> = {};
+    for (const [operation, record] of result.operationResults) {
+      statuses[operation.name] = record.status;
+    }
+    return statuses;
+  }
+}
+
+async function getStateHashesAsync(
+  names: readonly string[],
+  edges: IGraphOptions['edges'],
+  inputsSnapshot: IInputsSnapshot
+): Promise<Record<string, string>> {
+  const testGraph: TestGraph = new TestGraph(names, { edges });
+  testGraph.finishAll();
+  const result: IExecutionResult = await testGraph.graph.executeAsync({ inputsSnapshot });
+  expect(result.status).toBe(OperationStatus.Success);
+  const hashes: Record<string, string> = {};
+  for (const [operation, record] of result.operationResults) {
+    hashes[operation.name] = record.getStateHash();
+  }
+  return hashes;
+}
+
+describe('OperationGraph iteration extension', () => {
+  const snapshotB: IInputsSnapshot = createSnapshot({ a: 'a1', b: 'b1', c: 'c1', d: 'd1', e: 'e1', x: 'x1' });
+
+  it('holds the operations that no enabled operation needs until the others complete', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'b', 'c'], { edges: [['b', 'a']], enabled: ['a'] });
+    const resultPromise: Promise<IExecutionResult> = testGraph.graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+
+    await testGraph.startedAsync('a');
+    await settleAsync();
+    expect(testGraph.record('c').status).toBe(OperationStatus.Ready);
+
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped,
+      c: OperationStatus.Skipped
+    });
+  });
+
+  it('dispatches the held operations when a retained iteration is aborted', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const resultPromise: Promise<IExecutionResult> = testGraph.graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+    expect(testGraph.graph.retainHeldOperations()).toBeInstanceOf(Function);
+
+    const abortPromise: Promise<void> = testGraph.graph.abortCurrentIterationAsync();
+    expect(testGraph.graph.retainHeldOperations()).toBeUndefined();
+    testGraph.finish('a');
+    await abortPromise;
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Aborted
+    });
+  });
+
+  it('extends the iteration with the operations that a joining request needs', async () => {
+    const names: string[] = ['a', 'b', 'c', 'd'];
+    const edges: [string, string][] = [
+      ['b', 'a'],
+      ['d', 'c']
+    ];
+    const testGraph: TestGraph = new TestGraph(names, { edges, enabled: ['a'] });
+    const { graph } = testGraph;
+    const plans: IOperationGraphIterationOptions[] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastStates, iterationOptions) => {
+      plans.push(iterationOptions);
+    });
+    const extensions: [string[], IOperationGraphIterationOptions][] = [];
+    graph.hooks.extendIteration.tap('test', (records, iterationOptions) => {
+      extensions.push([
+        Array.from(records.keys(), (operation: Operation) => operation.name),
+        iterationOptions
+      ]);
+    });
+    const totalOperationsByName: Record<string, number> = {};
+    graph.eventSink = {
+      onOperationHeader: (name: string, completedOperations: number, totalOperations: number) => {
+        totalOperationsByName[name] = totalOperations;
+      }
+    };
+
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+    const hashesBefore: Record<string, string> = {};
+    for (const name of names) {
+      hashesBefore[name] = testGraph.record(name).getStateHash();
+    }
+
+    // The own inputs of "a", which is executing, and "c" changed
+    const snapshotA: IInputsSnapshot = createSnapshot({ a: 'a2', b: 'b1', c: 'c2', d: 'd1' });
+    testGraph.operation('c').enabled = true;
+    testGraph.operation('d').enabled = true;
+    const extension: IOperationGraphExtensionResult = graph.tryExtendCurrentIteration({
+      inputsSnapshot: snapshotA,
+      neededOperations: [testGraph.operation('d')]
+    });
+    expect(extension).toEqual({
+      extended: true,
+      changedOperations: new Set([testGraph.operation('c'), testGraph.operation('d')])
+    });
+
+    expect(plans).toHaveLength(2);
+    expect(plans[1].inputsSnapshot).toBe(snapshotA);
+    expect(plans[1].startedOperations).toEqual(new Set([testGraph.operation('a')]));
+    expect(extensions).toHaveLength(1);
+    expect(extensions[0][0].sort()).toEqual(['c', 'd']);
+    expect(extensions[0][1].inputsSnapshot).toBe(snapshotA);
+
+    // The executing operation keeps its state hash, and so does its held consumer, whose own inputs did not change
+    expect(testGraph.record('a').getStateHash()).toBe(hashesBefore.a);
+    expect(testGraph.record('b').getStateHash()).toBe(hashesBefore.b);
+    // The others are hashed as a new iteration would hash them
+    const expectedHashes: Record<string, string> = await getStateHashesAsync(names, edges, snapshotA);
+    expect(testGraph.record('c').getStateHash()).toBe(expectedHashes.c);
+    expect(testGraph.record('d').getStateHash()).toBe(expectedHashes.d);
+    expect(expectedHashes.c).not.toBe(hashesBefore.c);
+
+    await testGraph.startedAsync('c');
+    testGraph.finish('c');
+    await testGraph.startedAsync('d');
+    testGraph.finish('d');
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      b: OperationStatus.Skipped,
+      c: OperationStatus.Success,
+      d: OperationStatus.Success
+    });
+    expect(graph.resultByOperation.get(testGraph.operation('d'))?.getStateHash()).toBe(expectedHashes.d);
+    // The operations that joined count towards the total
+    expect(totalOperationsByName).toEqual({ a: 1, c: 3, d: 3 });
+  });
+
+  it('plans the extension without the results that the request invalidates', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c']);
+    const { graph } = testGraph;
+    testGraph.finishAll();
+    await graph.executeAsync({ inputsSnapshot: snapshotB });
+    const lastResultOfC: IOperationExecutionResult = graph.resultByOperation.get(testGraph.operation('c'))!;
+
+    const lastStatesOfPlans: ReadonlyMap<Operation, IOperationExecutionResult>[] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastStates) => {
+      lastStatesOfPlans.push(new Map(lastStates));
+    });
+    const invalidated: string[] = [];
+    graph.hooks.onInvalidateOperations.tap('test', (operations: Iterable<Operation>, reason?: string) => {
+      invalidated.push(...Array.from(operations, (operation: Operation) => `${operation.name}: ${reason}`));
+    });
+    testGraph.block('a');
+    testGraph.operation('c').enabled = false;
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await waitForAsync(() => testGraph.started.length === 3);
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')],
+        invalidatedOperations: [testGraph.operation('c')],
+        invalidationReason: 'the request changed it'
+      }).extended
+    ).toBe(true);
+
+    expect(lastStatesOfPlans).toHaveLength(2);
+    expect(lastStatesOfPlans[1].has(testGraph.operation('a'))).toBe(true);
+    expect(lastStatesOfPlans[1].has(testGraph.operation('c'))).toBe(false);
+    expect(invalidated).toEqual(['c: the request changed it']);
+    expect(lastResultOfC.status).toBe(OperationStatus.Ready);
+
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.getStatuses(result)).toEqual({ a: OperationStatus.Success, c: OperationStatus.Success });
+  });
+
+  it('dispatches the operations of the joining request first', async () => {
+    // Without a preference, "e" would go first, since it starts the longer chain
+    const testGraph: TestGraph = new TestGraph(['a', 'c', 'e'], {
+      edges: [['e', 'a']],
+      enabled: ['a', 'e'],
+      parallelism: 1,
+      weights: { e: 10 }
+    });
+    const { graph } = testGraph;
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')]
+      }).extended
+    ).toBe(true);
+
+    testGraph.finishAll();
+    expect((await resultPromise).status).toBe(OperationStatus.Success);
+    expect(testGraph.started).toEqual(['a', 'c', 'e']);
+  });
+
+  it('does not disable operations that the iteration enabled', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c', 'e'], {
+      edges: [['e', 'a']],
+      enabled: ['a', 'e']
+    });
+    const { graph } = testGraph;
+    graph.hooks.configureIteration.tap(
+      'test',
+      (
+        records: ReadonlyMap<Operation, IConfigurableOperation>,
+        lastStates: ReadonlyMap<Operation, IOperationExecutionResult>,
+        iterationOptions: IOperationGraphIterationOptions
+      ) => {
+        if (iterationOptions.startedOperations) {
+          // The plan of the extension would not run the operations of the iteration
+          for (const record of records.values()) {
+            record.enabled = record.operation.name === 'c';
+          }
+        }
+      }
+    );
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')]
+      }).extended
+    ).toBe(true);
+    testGraph.finishAll();
+    expect(testGraph.getStatuses(await resultPromise)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Success,
+      e: OperationStatus.Success
+    });
+  });
+
+  it('aborts the iteration if an extendIteration tap throws', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const { graph } = testGraph;
+    graph.hooks.extendIteration.tap('test', () => {
+      throw new Error('The tap failed');
+    });
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(() =>
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')]
+      })
+    ).toThrow('The tap failed');
+    testGraph.finish('a');
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.started).toEqual(['a']);
+    expect(testGraph.getStatuses(result).c).toBe(OperationStatus.Aborted);
+  });
+
+  describe('refuses', () => {
+    async function expectRefusalAsync(
+      testGraph: TestGraph,
+      iterationOptions: IOperationGraphIterationOptions,
+      getExtensionAsync: () => Promise<IOperationGraphExtensionResult>,
+      reason: RegExp
+    ): Promise<void> {
+      const { graph } = testGraph;
+      const extensions: unknown[] = [];
+      graph.hooks.extendIteration.tap('test', (records) => {
+        extensions.push(records);
+      });
+      const resultPromise: Promise<IExecutionResult> = graph.executeAsync(iterationOptions);
+      await testGraph.startedAsync('a');
+      const getStateHashes = (): string[] =>
+        iterationOptions.inputsSnapshot
+          ? Array.from(testGraph.records!.values(), (record: IOperationExecutionResult) =>
+              record.getStateHash()
+            )
+          : [];
+      const hashes: string[] = getStateHashes();
+
+      const extension: IOperationGraphExtensionResult = await getExtensionAsync();
+      expect(extension.extended).toBe(false);
+      expect(extension.reason).toMatch(reason);
+      expect(extensions).toHaveLength(0);
+      expect(getStateHashes()).toEqual(hashes);
+
+      testGraph.finishAll();
+      expect((await resultPromise).status).toBe(OperationStatus.Success);
+    }
+
+    it('when no iteration executes', () => {
+      const testGraph: TestGraph = new TestGraph(['a']);
+      expect(
+        testGraph.graph.tryExtendCurrentIteration({
+          inputsSnapshot: snapshotB,
+          neededOperations: [testGraph.operation('a')]
+        }).reason
+      ).toMatch(/No iteration is dispatching/);
+    });
+
+    it('before the iteration dispatches operations', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      const extensions: IOperationGraphExtensionResult[] = [];
+      testGraph.graph.hooks.beforeExecuteIterationAsync.tap('test', () => {
+        extensions.push(
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')]
+          })
+        );
+      });
+      testGraph.finishAll();
+      await testGraph.graph.executeAsync({ inputsSnapshot: snapshotB, holdUnneededOperations: true });
+      expect(extensions).toHaveLength(1);
+      expect(extensions[0].reason).toMatch(/No iteration is dispatching/);
+    });
+
+    it('if the iteration does not hold operations', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB },
+        async () =>
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')]
+          }),
+        /No iteration is dispatching/
+      );
+    });
+
+    it('if the iteration was aborted', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      const { graph } = testGraph;
+      const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+        inputsSnapshot: snapshotB,
+        holdUnneededOperations: true
+      });
+      await testGraph.startedAsync('a');
+      const abortPromise: Promise<void> = graph.abortCurrentIterationAsync();
+      expect(
+        graph.tryExtendCurrentIteration({
+          inputsSnapshot: snapshotB,
+          neededOperations: [testGraph.operation('c')]
+        }).reason
+      ).toMatch(/aborted/);
+      testGraph.finishAll();
+      await abortPromise;
+      await resultPromise;
+    });
+
+    it('if the iteration is not incremental', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true, isIncrementalBuildAllowed: false },
+        async () =>
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')]
+          }),
+        /not incremental/
+      );
+    });
+
+    it('if the iteration has no inputs snapshot', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { holdUnneededOperations: true },
+        async () =>
+          testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')]
+          }),
+        /no inputs snapshot/
+      );
+    });
+
+    it('if the inputs of a started operation that the request needs changed', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'b'], { edges: [['b', 'a']], enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async () => {
+          testGraph.operation('b').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: createSnapshot({ a: 'a2', b: 'b1' }),
+            neededOperations: [testGraph.operation('b')]
+          });
+        },
+        /"a" started before its inputs or outputs changed/
+      );
+    });
+
+    it('if the request invalidates a started operation that it needs', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'b'], { edges: [['b', 'a']], enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async () => {
+          testGraph.operation('b').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('b')],
+            invalidatedOperations: [testGraph.operation('a')]
+          });
+        },
+        /"a" started before its inputs or outputs changed/
+      );
+    });
+
+    it('if the request invalidates an operation that ran in the iteration', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'c', 'x'], { enabled: ['a', 'x'] });
+      testGraph.finish('x');
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async () => {
+          await waitForAsync(() => testGraph.record('x').status === OperationStatus.Success);
+          testGraph.operation('c').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('c')],
+            invalidatedOperations: [testGraph.operation('x')]
+          });
+        },
+        /"x" was invalidated after it ran in the iteration/
+      );
+    });
+
+    it('if an operation that the request needs to run was dispatched without running', async () => {
+      const testGraph: TestGraph = new TestGraph(['a', 'x'], { edges: [['a', 'x']], enabled: ['a'] });
+      await expectRefusalAsync(
+        testGraph,
+        { inputsSnapshot: snapshotB, holdUnneededOperations: true },
+        async () => {
+          expect(testGraph.record('x').status).toBe(OperationStatus.Skipped);
+          testGraph.operation('x').enabled = true;
+          return testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: snapshotB,
+            neededOperations: [testGraph.operation('x')]
+          });
+        },
+        /"x" needs to run, but was dispatched without running/
+      );
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
index 036926870c..92c1bf617b 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphStateHash.test.ts
@@ -27,6 +27,7 @@ import type { RushConfigurationProject } from '../../../api/RushConfigurationPro
 import type { IInputsSnapshot, IRushConfigurationProjectForSnapshot } from '../../incremental/InputsSnapshot';
 import type { IOperationStateHashComponents } from '../IOperationExecutionResult';
 import { Operation } from '../Operation';
+import { calculateOperationStateHashEntry } from '../OperationExecutionRecord';
 import { OperationGraph } from '../OperationGraph';
 import { OperationStatus } from '../OperationStatus';
 import { MockOperationRunner } from './MockOperationRunner';
@@ -141,3 +142,50 @@ describe('OperationGraph state hashes', () => {
     expect(third.components).toEqual(uncached.components);
   });
 });
+
+describe(calculateOperationStateHashEntry.name, () => {
+  it('returns the previous entry if it was calculated from the same inputs', () => {
+    const entry: ReturnType<typeof calculateOperationStateHashEntry> = calculateOperationStateHashEntry(
+      ['a', 'hash-a', 'b', 'hash-b'],
+      'local',
+      'config',
+      undefined
+    );
+    expect(calculateOperationStateHashEntry(['a', 'hash-a', 'b', 'hash-b'], 'local', 'config', entry)).toBe(
+      entry
+    );
+
+    for (const [dependencies, local, config] of [
+      [['a', 'hash-a', 'b', 'hash-b2'], 'local', 'config'],
+      [['a', 'hash-a'], 'local', 'config'],
+      [['a', 'hash-a', 'b', 'hash-b'], 'local2', 'config'],
+      [['a', 'hash-a', 'b', 'hash-b'], 'local', 'config2']
+    ] as [string[], string, string][]) {
+      const changed: ReturnType<typeof calculateOperationStateHashEntry> = calculateOperationStateHashEntry(
+        dependencies,
+        local,
+        config,
+        entry
+      );
+      expect(changed).toEqual(calculateOperationStateHashEntry(dependencies, local, config, undefined));
+      expect(changed.hash).not.toBe(entry.hash);
+    }
+  });
+
+  it('does not depend on the order of the dependencies', () => {
+    expect(
+      calculateOperationStateHashEntry(['b', 'hash-b', 'a', 'hash-a'], 'local', 'config', undefined).hash
+    ).toBe(
+      calculateOperationStateHashEntry(['a', 'hash-a', 'b', 'hash-b'], 'local', 'config', undefined).hash
+    );
+  });
+
+  it('calculates an entry without a previous entry whatever the local state hash is', () => {
+    const local: string = undefined as unknown as string;
+    expect(calculateOperationStateHashEntry([], local, 'config', undefined).components).toEqual({
+      dependencies: [],
+      local,
+      config: 'config'
+    });
+  });
+});
diff --git a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
index e1bbab6b58..e282b92419 100644
--- a/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
+++ b/libraries/rush-lib/src/pluginFramework/OperationGraphHooks.ts
@@ -31,7 +31,10 @@ import type {
  * 1. `configureIteration` - Synchronously decide which operations to enable for the next iteration.
  * 2. `onIterationScheduled` - Fires after the iteration is prepared but before execution begins, if it has any enabled operations.
  * 3. `beforeExecuteIterationAsync` - Async hook that can bail out the iteration entirely.
- * 4. Operations execute (status changes reported via `onExecutionStatesUpdated`).
+ * 4. Operations execute (status changes reported via `onExecutionStatesUpdated`). If another request joins the
+ *    iteration, `configureIteration` plans the iteration again, with `startedOperations` naming the operations that
+ *    were already dispatched. If the graph accepts the new plan, `extendIteration` prepares the operations that
+ *    changed.
  * 5. `afterExecuteIterationAsync` - Fires after all operations in the iteration have settled.
  * 6. `afterExecuteRequestAsync` - Fires once for each request that the iteration served.
  * 7. `onIdle` - Fires when the graph enters idle state awaiting changes (watch mode only).
@@ -57,6 +60,11 @@ export class OperationGraphHooks {
    *
    * If no operations are marked for execution, the iteration will not be scheduled.
    * If there is an existing scheduled iteration, it will remain.
+   *
+   * When `context.startedOperations` is set, the call plans an iteration that is already executing again, for the
+   * work of a request that joins it (see {@link IOperationGraph.tryExtendCurrentIteration}). The graph can still
+   * refuse that plan after this hook returns, and then discards it. A plugin that keeps state across iterations
+   * applies the effects of such a plan in `extendIteration`, which is called only for an accepted plan.
    */
   public readonly configureIteration: SyncHook<
     [
@@ -66,6 +74,20 @@ export class OperationGraphHooks {
     ]
   > = new SyncHook(['initialRecords', 'lastExecutedRecords', 'context'], 'configureIteration');
 
+  /**
+   * Hook invoked when the work of another request is added to an iteration that is already executing (see
+   * {@link IOperationGraph.tryExtendCurrentIteration}), before any of the given records is dispatched. It receives the
+   * records whose `enabled` state, runner policy or state hash changed, and the options of the extension, whose
+   * `inputsSnapshot` is the newer snapshot that the state hashes of these records were calculated from. A plugin that
+   * prepares state for each operation in `beforeExecuteIterationAsync` prepares it again here for these records.
+   *
+   * The options are the same object that the `configureIteration` call of the accepted plan received. A tap that
+   * throws aborts the iteration.
+   */
+  public readonly extendIteration: SyncHook<
+    [ReadonlyMap<Operation, IOperationExecutionResult>, IOperationGraphIterationOptions]
+  > = new SyncHook(['records', 'context'], 'extendIteration');
+
   /**
    * Hook invoked before operation start for an iteration. Allows a plugin to perform side-effects or
    * short-circuit the entire iteration.
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 6bb99c2f75..2d162b636a 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -287,6 +287,11 @@
           "default": false,
           "description": "Keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose rush-project.json operation settings set `allowDaemonWarmWorker`, and send it the next incremental run when incrementalBuilds allows one. Otherwise the worker is closed and the initial script runs. Requires incrementalBuilds. RUSH_DAEMON_WARM_WORKERS overrides."
         },
+        "joinRunningBatch": {
+          "type": "boolean",
+          "default": false,
+          "description": "Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Experimental. RUSH_DAEMON_JOIN_RUNNING_BATCH overrides."
+        },
         "queueTimeoutSeconds": {
           "type": "number",
           "minimum": 0,

From 1dcaf1ec5eed6652af21f7ae06f3124a75249b1e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Tue, 29 Sep 2026 22:40:22 +0000
Subject: [PATCH 220/265] [rush-daemon] Test that an exclusive request does not
 join an iteration

Swarm integration step 205; original commit e76300af14 (merge of swarm/r05-t109-e2g-312 at 0692d91ecd).
Scope: task 312.

Brings 312 (branch swarm/r05-t109-e2g-312). Second agent: ch03 board 6843, board 6845 (d90db35917, same patch-ids); LG7 on S: ch03 board 7138, board 7140; 109 on S: t03 board 7153 (RESULT board 7152). Evidence: ch01's GATE OK board 7438.

Batch E2g, item 7 of 7. Gate: ch01 GATE OK board 7438 (tree fd51b6802b)

Commits folded into this step (3):
- 92874a3e5c [rush-lib] Add beforeCommit to the options of tryExtendCurrentIteration
- 56d1f994c8 [rush-daemon] Start a joining request only once the graph takes its work
- 0692d91ecd [rush-daemon] Test that an exclusive request does not join an iteration

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-running-batch-begin_2026-09-29-19-15.json |  11 ++
 ...-running-batch-begin_2026-09-29-19-15.json |  11 ++
 common/reviews/api/rush-lib.api.md            |   1 +
 libraries/rush-daemon/README.md               |   3 +-
 .../rush-daemon/src/PhasedIterationJoiner.ts  |  30 ++--
 .../src/test/PhasedRequestJoin.test.ts        | 132 +++++++++++++++++-
 .../src/logic/operations/IOperationGraph.ts   |  11 +-
 .../src/logic/operations/OperationGraph.ts    |   1 +
 .../test/OperationGraphExtension.test.ts      | 124 +++++++++++++---
 9 files changed, 293 insertions(+), 31 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/join-running-batch-begin_2026-09-29-19-15.json
 create mode 100644 common/changes/@rushstack/rush-daemon/join-running-batch-begin_2026-09-29-19-15.json

diff --git a/common/changes/@microsoft/rush/join-running-batch-begin_2026-09-29-19-15.json b/common/changes/@microsoft/rush/join-running-batch-begin_2026-09-29-19-15.json
new file mode 100644
index 0000000000..6f0635bdc6
--- /dev/null
+++ b/common/changes/@microsoft/rush/join-running-batch-begin_2026-09-29-19-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `beforeCommit` to the alpha `IOperationGraphExtensionOptions`. The operation graph calls it once it will extend the current iteration, before it changes the iteration, and does not extend the iteration if it throws.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/join-running-batch-begin_2026-09-29-19-15.json b/common/changes/@rushstack/rush-daemon/join-running-batch-begin_2026-09-29-19-15.json
new file mode 100644
index 0000000000..5c37ee2027
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/join-running-batch-begin_2026-09-29-19-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "With `daemon.joinRunningBatch`, a build request that cannot join the executing iteration no longer counts as started while it waits for a later batch, so a workspace change made during that wait reloads the daemon for it, as it does without the setting, instead of failing the request.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index a0c95b23dd..301e4d628b 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -809,6 +809,7 @@ export interface _IOperationGraphEventSink {
 
 // @alpha
 export interface IOperationGraphExtensionOptions {
+    readonly beforeCommit?: () => void;
     readonly inputsSnapshot: IInputsSnapshot;
     readonly invalidatedOperations?: Iterable<Operation>;
     readonly invalidationReason?: string;
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 854460ce9e..07796f2be2 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -686,7 +686,8 @@ reads its inputs again, and the graph adds its operations to the executing itera
 so that operations that both requests need run once. The request then takes part in the batch like any other
 participant, but does not receive output that operations wrote before it joined. If the graph can't take the
 request's work, for example because an operation that the request needs started before its inputs changed, nothing
-changes and the request runs in a later batch as before. The daemon writes one line per attempt to its stderr:
+changes and the request runs in a later batch as if it had not tried to join. The daemon writes one line per attempt
+to its stderr:
 `Request <id> joined the executing iteration after <n> ms.` or `Request <id> did not join the executing iteration
 after <n> ms: <reason>`.
 
diff --git a/libraries/rush-daemon/src/PhasedIterationJoiner.ts b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
index 22fddf0477..c49e16298a 100644
--- a/libraries/rush-daemon/src/PhasedIterationJoiner.ts
+++ b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
@@ -295,16 +295,23 @@ export class PhasedIterationJoiner {
     }
     const host: IPhasedIterationJoinHost = this.#host;
     const { entry, resultPromise } = host.createEntry(request, admissionController);
-    try {
+    const start: { failure?: { readonly error: unknown } } = {};
+    const extensionRefusal: string | undefined = this.#addToIteration(batch, entry, peek, timings, () => {
       // As a batch does before it schedules its iteration, so that none of the request's work starts if it throws.
-      // If the iteration then cannot take the work, the batch that later runs the request calls it again.
-      entry.onExecutionStarting?.();
-    } catch (error) {
-      peek.discard();
+      // The graph calls this only once it takes the work, so a request that it refuses has not begun, and the batch
+      // that later runs it starts it then.
+      try {
+        entry.onExecutionStarting?.();
+      } catch (error) {
+        start.failure = { error };
+        throw error;
+      }
+    });
+    if (start.failure) {
+      const { error } = start.failure;
       host.failEntry(entry, error);
       return { resultPromise, failure: `its execution could not start: ${getErrorMessage(error)}` };
     }
-    const extensionRefusal: string | undefined = this.#addToIteration(batch, entry, peek, timings);
     if (extensionRefusal !== undefined) {
       return extensionRefusal;
     }
@@ -354,14 +361,16 @@ export class PhasedIterationJoiner {
   }
 
   /**
-   * Enables the entry's operations and adds them to the executing iteration under the inputs of `peek`. If the
-   * iteration cannot take them, restores the graph, discards `peek` and returns why.
+   * Enables the entry's operations and adds them to the executing iteration under the inputs of `peek`, calling
+   * `beforeCommit` once the iteration takes them. If the iteration cannot take them, or `beforeCommit` throws, restores
+   * the graph, discards `peek` and returns why.
    */
   #addToIteration(
     batch: IJoinableBatch,
     entry: IBatchEntry,
     peek: IWorkspaceInvalidationPeek,
-    timings: IBatchTimings
+    timings: IBatchTimings,
+    beforeCommit: () => void
   ): string | undefined {
     const { graph, multiplexer } = this.#host;
     const enabledStates: ReadonlyMap<Operation, Operation['enabled']> = new Map(
@@ -388,7 +397,8 @@ export class PhasedIterationJoiner {
           inputsSnapshot: peek.inputsSnapshot,
           neededOperations: entry.selection.activeOperations,
           invalidatedOperations: peek.invalidatedOperations,
-          invalidationReason: peek.invalidationReason
+          invalidationReason: peek.invalidationReason,
+          beforeCommit
         })
       );
     } catch (error) {
diff --git a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
index e3a295ba22..2445e18125 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
@@ -19,10 +19,12 @@ import type {
 import { PhasedRequestRouter } from '../PhasedRequestRouter';
 import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
 import { RequestExclusivityClass } from '../RequestScheduler';
+import type { IRequestLease, RequestScheduler } from '../RequestScheduler';
 import type {
   IPeekWorkspaceInvalidationsOptions,
   IWorkspaceInvalidationPeek
 } from '../WorkspaceEngineComponentFactory';
+import { RequestAdmissionController } from '../WorkspaceRequestAdmission';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -651,11 +653,14 @@ describe('a request that arrives while a compatible batch executes', () => {
   it('fails only the request that joined when its execution cannot start', async () => {
     const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
     const { fixture, gates, router, scheduleSpy } = joinFixture;
+    const getEnabledStates = (): Operation['enabled'][] =>
+      OPERATION_IDS.map((operationId: string) => fixture.operations.get(operationId)!.enabled);
     const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
       createRequest('first', [OPERATION_C]),
       new TestPhasedRequestClient('first')
     );
     await gates.get(OPERATION_C)!.started.promise;
+    const enabledStates: Operation['enabled'][] = getEnabledStates();
 
     const joined: IDaemonPhasedRequestResult = await router.executeAsync(
       createRequest('joined', [OPERATION_A]),
@@ -665,6 +670,7 @@ describe('a request that arrives while a compatible batch executes', () => {
         throw new Error('The workspace generation changed.');
       }
     );
+    expect(getEnabledStates()).toEqual(enabledStates);
     gates.get(OPERATION_C)!.released.resolve();
 
     expect(joined).toMatchObject({
@@ -683,6 +689,47 @@ describe('a request that arrives while a compatible batch executes', () => {
     expect(scheduleSpy).toHaveBeenCalledTimes(1);
   });
 
+  it('starts a request that joins only once the iteration takes its work', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    const events: string[] = [];
+    const { graph } = fixture;
+    const tryExtendCurrentIteration: typeof graph.tryExtendCurrentIteration =
+      graph.tryExtendCurrentIteration.bind(graph);
+    jest.spyOn(graph, 'tryExtendCurrentIteration').mockImplementation((options) => {
+      events.push('extend');
+      const extension: ReturnType<typeof tryExtendCurrentIteration> = tryExtendCurrentIteration(options);
+      events.push(`extended: ${extension.extended}`);
+      return extension;
+    });
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first'),
+      false,
+      () => {
+        events.push('first starts');
+      }
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined'),
+      false,
+      () => {
+        events.push('joined starts');
+      }
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual(['Request joined joined the executing iteration.']);
+    expect(events).toEqual(['first starts', 'extend', 'joined starts', 'extended: true']);
+    expect((await joined).outcome).toBe('success');
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(events).toHaveLength(4);
+  });
+
   it('fails only the request that joined when its inputs cannot be committed, and withholds its work', async () => {
     const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C], {
       dependencies: [[OPERATION_A, OPERATION_C]]
@@ -961,7 +1008,8 @@ describe('a request that cannot join the executing iteration', () => {
     joinFixture: IJoinFixture,
     late: IDaemonPhasedRequest,
     lateClient: TestPhasedRequestClient = new TestPhasedRequestClient('late'),
-    lateSettings?: IPhasedCommandEngineRequestSettings
+    lateSettings?: IPhasedCommandEngineRequestSettings,
+    lateExclusivityClass?: RequestExclusivityClass
   ): Promise<IDaemonPhasedRequestResult> {
     const { gates, router } = joinFixture;
     const events: string[] = [];
@@ -972,7 +1020,16 @@ describe('a request that cannot join the executing iteration', () => {
     );
     await gates.get(OPERATION_C)!.started.promise;
     const lateResult: Promise<IDaemonPhasedRequestResult> = track(
-      router.executeAsync(late, lateClient, false, undefined, lateSettings),
+      router.executeAsync(
+        late,
+        lateClient,
+        false,
+        undefined,
+        lateSettings,
+        undefined,
+        undefined,
+        lateExclusivityClass
+      ),
       'late',
       events
     );
@@ -1000,6 +1057,43 @@ describe('a request that cannot join the executing iteration', () => {
     expect(joinLog).toEqual([]);
   });
 
+  it('waits for the iteration to end if it is exclusive, even if its admission let it in', async () => {
+    // Workspace admission holds an exclusive request until the requests of the batch finish, so nothing else here
+    // reaches the joiner's own check. Admit this request at once, as if admission had not held it.
+    const acquireAsync: RequestAdmissionController['acquireAsync'] =
+      RequestAdmissionController.prototype.acquireAsync;
+    const admissionSpy: jest.SpyInstance = jest
+      .spyOn(RequestAdmissionController.prototype, 'acquireAsync')
+      .mockImplementation(function (
+        this: RequestAdmissionController,
+        scheduler: RequestScheduler,
+        exclusivityClass: RequestExclusivityClass,
+        waitingFor?: string
+      ): Promise<IRequestLease> {
+        return exclusivityClass === RequestExclusivityClass.Exclusive
+          ? Promise.resolve({ exclusivityClass, release: () => undefined })
+          : acquireAsync.call(this, scheduler, exclusivityClass, waitingFor);
+      });
+    try {
+      const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+      const result: IDaemonPhasedRequestResult = await expectToWaitForTheIterationAsync(
+        joinFixture,
+        createRequest('late', [OPERATION_A]),
+        undefined,
+        undefined,
+        RequestExclusivityClass.Exclusive
+      );
+
+      expect(result.outcome).toBe('success');
+      expect(admissionSpy).toHaveBeenCalledWith(expect.anything(), RequestExclusivityClass.Exclusive);
+      expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
+      expect(joinFixture.peekCalls).toHaveLength(0);
+      expect(joinLog).toEqual([]);
+    } finally {
+      admissionSpy.mockRestore();
+    }
+  });
+
   it('waits for the iteration to end if the changed inputs cannot be added to it', async () => {
     const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
     joinFixture.peekAsync = async () => undefined;
@@ -1105,6 +1199,40 @@ describe('a request that cannot join the executing iteration', () => {
     expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(1);
   });
 
+  it('starts a request that the iteration cannot take only when the batch that runs it starts', async () => {
+    const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
+    const { fixture, gates, router } = joinFixture;
+    joinFixture.peekAsync = async () => createTestPeek(joinFixture, [fixture.operations.get(OPERATION_C)!]);
+    const events: string[] = [];
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first'),
+      false,
+      () => {
+        events.push('first starts');
+      }
+    );
+    await gates.get(OPERATION_C)!.started.promise;
+    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('late', [OPERATION_A, OPERATION_C]),
+      new TestPhasedRequestClient('late'),
+      false,
+      () => {
+        events.push('late starts');
+      }
+    );
+    await waitForAsync(() => joinLog.length > 0);
+
+    expect(joinLog).toEqual([
+      `Request late did not join the executing iteration: "${OPERATION_C}" started before its inputs or outputs changed.`
+    ]);
+    events.push('C released');
+    gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect((await late).outcome).toBe('success');
+    expect(events).toEqual(['first starts', 'C released', 'late starts']);
+  });
+
   it('restores the graph and discards the inputs if extending the iteration fails', async () => {
     const joinFixture: IJoinFixture = createJoinFixture([OPERATION_C]);
     const { fixture, gates, router } = joinFixture;
diff --git a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
index c22c8efcba..85d73919c4 100644
--- a/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/IOperationGraph.ts
@@ -105,6 +105,13 @@ export interface IOperationGraphExtensionOptions {
    * The reason for invalidating `invalidatedOperations`.
    */
   readonly invalidationReason?: string;
+
+  /**
+   * Called once the graph will extend the iteration, before it changes the iteration or dispatches any operation, so
+   * that the joining request starts only if its work is added. If it throws, the iteration is not extended, the graph
+   * is left unchanged, and the error propagates.
+   */
+  readonly beforeCommit?: () => void;
 }
 
 /**
@@ -337,8 +344,8 @@ export interface IOperationGraph {
    * `configureIteration` taps ran, and it discards their plan. When the iteration is not extended, the graph is left
    * unchanged, and the caller restores the enabled states.
    *
-   * Otherwise, the operations that changed are passed to `extendIteration`, and the joining request's operations are
-   * dispatched before the others.
+   * Otherwise, the graph calls {@link IOperationGraphExtensionOptions.beforeCommit}, the operations that changed are
+   * passed to `extendIteration`, and the joining request's operations are dispatched before the others.
    */
   tryExtendCurrentIteration?(options: IOperationGraphExtensionOptions): IOperationGraphExtensionResult;
 
diff --git a/libraries/rush-lib/src/logic/operations/OperationGraph.ts b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
index e5a30a6338..4d624a5aa3 100644
--- a/libraries/rush-lib/src/logic/operations/OperationGraph.ts
+++ b/libraries/rush-lib/src/logic/operations/OperationGraph.ts
@@ -718,6 +718,7 @@ export class OperationGraph implements IOperationGraph {
         }
       }
     }
+    options.beforeCommit?.();
 
     // Commit
     if (invalidatedOperations.size > 0) {
diff --git a/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts b/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
index 17c3299297..1af100454b 100644
--- a/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/OperationGraphExtension.test.ts
@@ -454,11 +454,94 @@ describe('OperationGraph iteration extension', () => {
     expect(testGraph.getStatuses(result).c).toBe(OperationStatus.Aborted);
   });
 
+  it('calls beforeCommit once, after it plans the extension and before it changes the iteration', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const { graph } = testGraph;
+    const calls: string[] = [];
+    graph.hooks.configureIteration.tap('test', (records, lastStates, iterationOptions) => {
+      calls.push(iterationOptions.startedOperations ? 'plan the extension' : 'plan the iteration');
+    });
+    graph.hooks.extendIteration.tap('test', () => {
+      calls.push('extend');
+    });
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+
+    testGraph.operation('c').enabled = true;
+    expect(
+      graph.tryExtendCurrentIteration({
+        inputsSnapshot: snapshotB,
+        neededOperations: [testGraph.operation('c')],
+        beforeCommit: () => {
+          const { enabled, status } = testGraph.record('c');
+          calls.push(`before commit: c is ${enabled ? 'enabled' : 'disabled'} and ${status}`);
+        }
+      }).extended
+    ).toBe(true);
+    expect(calls).toEqual([
+      'plan the iteration',
+      'plan the extension',
+      `before commit: c is disabled and ${OperationStatus.Ready}`,
+      'extend'
+    ]);
+
+    testGraph.finishAll();
+    expect(testGraph.getStatuses(await resultPromise)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Success
+    });
+  });
+
+  it('leaves the iteration unchanged if beforeCommit throws', async () => {
+    const testGraph: TestGraph = new TestGraph(['a', 'c'], { enabled: ['a'] });
+    const { graph } = testGraph;
+    const extensions: unknown[] = [];
+    graph.hooks.extendIteration.tap('test', (records) => {
+      extensions.push(records);
+    });
+    const resultPromise: Promise<IExecutionResult> = graph.executeAsync({
+      inputsSnapshot: snapshotB,
+      holdUnneededOperations: true
+    });
+    await testGraph.startedAsync('a');
+    const getStateHashes = (): string[] =>
+      Array.from(testGraph.records!.values(), (record: IOperationExecutionResult) => record.getStateHash());
+    const hashes: string[] = getStateHashes();
+
+    testGraph.operation('c').enabled = true;
+    expect(() =>
+      graph.tryExtendCurrentIteration({
+        // The own inputs of "c" changed, so an extension would change its state hash
+        inputsSnapshot: createSnapshot({ a: 'a1', c: 'c2' }),
+        neededOperations: [testGraph.operation('c')],
+        beforeCommit: () => {
+          throw new Error('The request cannot start');
+        }
+      })
+    ).toThrow('The request cannot start');
+    expect(extensions).toHaveLength(0);
+    expect(testGraph.record('c').enabled).toBe(false);
+    expect(getStateHashes()).toEqual(hashes);
+
+    // As the caller restores the enabled states
+    testGraph.operation('c').enabled = false;
+    testGraph.finishAll();
+    const result: IExecutionResult = await resultPromise;
+    expect(testGraph.started).toEqual(['a']);
+    expect(testGraph.getStatuses(result)).toEqual({
+      a: OperationStatus.Success,
+      c: OperationStatus.Skipped
+    });
+  });
+
   describe('refuses', () => {
     async function expectRefusalAsync(
       testGraph: TestGraph,
       iterationOptions: IOperationGraphIterationOptions,
-      getExtensionAsync: () => Promise<IOperationGraphExtensionResult>,
+      getExtensionAsync: (beforeCommit: () => void) => Promise<IOperationGraphExtensionResult>,
       reason: RegExp
     ): Promise<void> {
       const { graph } = testGraph;
@@ -476,9 +559,11 @@ describe('OperationGraph iteration extension', () => {
           : [];
       const hashes: string[] = getStateHashes();
 
-      const extension: IOperationGraphExtensionResult = await getExtensionAsync();
+      const beforeCommit: jest.Mock<void, []> = jest.fn();
+      const extension: IOperationGraphExtensionResult = await getExtensionAsync(beforeCommit);
       expect(extension.extended).toBe(false);
       expect(extension.reason).toMatch(reason);
+      expect(beforeCommit).not.toHaveBeenCalled();
       expect(extensions).toHaveLength(0);
       expect(getStateHashes()).toEqual(hashes);
 
@@ -518,10 +603,11 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { inputsSnapshot: snapshotB },
-        async () =>
+        async (beforeCommit: () => void) =>
           testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: snapshotB,
-            neededOperations: [testGraph.operation('c')]
+            neededOperations: [testGraph.operation('c')],
+            beforeCommit
           }),
         /No iteration is dispatching/
       );
@@ -552,10 +638,11 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { inputsSnapshot: snapshotB, holdUnneededOperations: true, isIncrementalBuildAllowed: false },
-        async () =>
+        async (beforeCommit: () => void) =>
           testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: snapshotB,
-            neededOperations: [testGraph.operation('c')]
+            neededOperations: [testGraph.operation('c')],
+            beforeCommit
           }),
         /not incremental/
       );
@@ -566,10 +653,11 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { holdUnneededOperations: true },
-        async () =>
+        async (beforeCommit: () => void) =>
           testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: snapshotB,
-            neededOperations: [testGraph.operation('c')]
+            neededOperations: [testGraph.operation('c')],
+            beforeCommit
           }),
         /no inputs snapshot/
       );
@@ -580,11 +668,12 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { inputsSnapshot: snapshotB, holdUnneededOperations: true },
-        async () => {
+        async (beforeCommit: () => void) => {
           testGraph.operation('b').enabled = true;
           return testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: createSnapshot({ a: 'a2', b: 'b1' }),
-            neededOperations: [testGraph.operation('b')]
+            neededOperations: [testGraph.operation('b')],
+            beforeCommit
           });
         },
         /"a" started before its inputs or outputs changed/
@@ -596,12 +685,13 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { inputsSnapshot: snapshotB, holdUnneededOperations: true },
-        async () => {
+        async (beforeCommit: () => void) => {
           testGraph.operation('b').enabled = true;
           return testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: snapshotB,
             neededOperations: [testGraph.operation('b')],
-            invalidatedOperations: [testGraph.operation('a')]
+            invalidatedOperations: [testGraph.operation('a')],
+            beforeCommit
           });
         },
         /"a" started before its inputs or outputs changed/
@@ -614,13 +704,14 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { inputsSnapshot: snapshotB, holdUnneededOperations: true },
-        async () => {
+        async (beforeCommit: () => void) => {
           await waitForAsync(() => testGraph.record('x').status === OperationStatus.Success);
           testGraph.operation('c').enabled = true;
           return testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: snapshotB,
             neededOperations: [testGraph.operation('c')],
-            invalidatedOperations: [testGraph.operation('x')]
+            invalidatedOperations: [testGraph.operation('x')],
+            beforeCommit
           });
         },
         /"x" was invalidated after it ran in the iteration/
@@ -632,12 +723,13 @@ describe('OperationGraph iteration extension', () => {
       await expectRefusalAsync(
         testGraph,
         { inputsSnapshot: snapshotB, holdUnneededOperations: true },
-        async () => {
+        async (beforeCommit: () => void) => {
           expect(testGraph.record('x').status).toBe(OperationStatus.Skipped);
           testGraph.operation('x').enabled = true;
           return testGraph.graph.tryExtendCurrentIteration({
             inputsSnapshot: snapshotB,
-            neededOperations: [testGraph.operation('x')]
+            neededOperations: [testGraph.operation('x')],
+            beforeCommit
           });
         },
         /"x" needs to run, but was dispatched without running/

From 2cd7cd6a2f1b32f08ffdcf7a5212b38bce4d8d5b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:07 +0000
Subject: [PATCH 221/265] [rush-daemon] Move the request selection helpers into
 PhasedRequestSelection.ts

Swarm integration step 206; original commit 2c09254c3a (merge of swarm/r04-t108-e2h at 5e8a18aa72).
Scope: task 108, re-cut on E2g: M2, the move, on M1.

Brings 108 (branch swarm/r04-t108-e2h, 9 commits). Second agent: o07 board 7594 (RESULT board 7591, CLAIM board 7528); H: o02 board 7313, board 7314; M: o02 board 7507; S: o07 board 7276, board 7277. Evidence: ch01's GATE OK board 8015.

Batch E2h, item 1 of 13. Gate: ch01 GATE OK board 8015 (tree 0e8ed501c5)

Commits folded into this step (7):
- 96561e90c6 [rush-cli-client] Name the operations that continue in rushd after an early failure
- 1230432c97 [rush-daemon-protocol] Add the operations that continue after an early result to queue positions and the workspace status
- 676ebc82b4 [rush-daemon] Tell a waiting build and daemon status which operations continue after an early result
- dc47ce00f9 [rush-cli-client] Name the operations that a queued request waits for after an earlier failed command
- bc41a6ba62 [rush-daemon] Say which operations the daemon stopped before a command runs in-process
- a6158359d9 [rush-cli-client] Say that a resubmitted command no longer waits in the exited daemon's queue
- 5e8a18aa72 [rush-daemon] Move the request selection helpers into PhasedRequestSelection.ts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  30 +-
 .../src/AgentProgressRenderer.ts              |  70 +++-
 .../src/continuingOperations.ts               |  30 ++
 .../src/daemonRestartNotice.ts                |  30 +-
 apps/rush-cli-client/src/launchClient.ts      |   8 +-
 .../src/nativeLockWaitNotice.ts               |  32 +-
 .../src/test/AgentProgressRenderer.test.ts    | 174 ++++++++-
 .../src/test/daemonRestartNotice.test.ts      |  49 ++-
 .../src/test/nativeLockWaitNotice.test.ts     |  14 +-
 ...108o-continuing-wait_2026-09-29-19-45.json |  11 +
 ...04-t108o-early-names_2026-09-29-18-45.json |  11 +
 ...08o-stopped-fallback_2026-09-29-20-20.json |  11 +
 ...o-resubmitted-status_2026-09-29-21-10.json |  11 +
 ...108o-continuing-wait_2026-09-29-19-45.json |  11 +
 ...ontinuing-operations_2026-09-29-18-50.json |  11 +
 ...ontinuing-operations_2026-09-29-19-20.json |  11 +
 ...08o-stopped-fallback_2026-09-29-20-20.json |  11 +
 ...8-e2h-selection-move_2026-09-29-22-20.json |  11 +
 common/reviews/api/rush-client-core.api.md    |   4 +-
 .../reviews/api/rush-daemon-protocol.api.md   |   8 +
 common/reviews/api/rush-daemon.api.md         |   1 +
 libraries/rush-client-core/README.md          |   4 +
 .../rush-client-core/src/DaemonClient.ts      |  29 +-
 .../src/test/DaemonClient.test.ts             |  34 ++
 libraries/rush-daemon-protocol/README.md      |   8 +-
 .../src/ContinuingOperationsValidation.ts     |  43 +++
 .../src/DaemonRequestAdmission.ts             |  16 +
 .../src/DaemonWorkspaceStatus.ts              |   7 +
 .../src/RequestAdmissionControlValidation.ts  |   2 +
 .../src/WorkspaceStatusValidation.ts          |   6 +
 libraries/rush-daemon-protocol/src/index.ts   |   2 +-
 .../src/test/ContinuingOperations.test.ts     |  58 +++
 libraries/rush-daemon/README.md               |  14 +
 .../rush-daemon/src/PhasedRequestEventSink.ts |  14 +
 .../rush-daemon/src/PhasedRequestRouter.ts    | 225 +++++-------
 .../rush-daemon/src/PhasedRequestSelection.ts | 143 ++++++++
 libraries/rush-daemon/src/RequestScheduler.ts |   8 +
 .../src/StoppedContinuingOperations.ts        |  34 ++
 .../src/WorkspaceRequestAdmission.ts          |  28 +-
 .../src/WorkspaceRequestLifecycle.ts          |  26 +-
 libraries/rush-daemon/src/WorkspaceStatus.ts  |   7 +-
 .../test/PhasedRequestEarlyFailure.test.ts    | 336 +++++++++++++++++-
 .../src/test/RequestScheduler.test.ts         |  26 ++
 .../test/StoppedContinuingOperations.test.ts  |  64 ++++
 .../test/WorkspaceEarlyFailureResult.test.ts  |  59 ++-
 45 files changed, 1522 insertions(+), 220 deletions(-)
 create mode 100644 apps/rush-cli-client/src/continuingOperations.ts
 create mode 100644 common/changes/@rushstack/rush-cli-client/r04-t108o-continuing-wait_2026-09-29-19-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r04-t108o-early-names_2026-09-29-18-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/r04-t108o-stopped-fallback_2026-09-29-20-20.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t108o-resubmitted-status_2026-09-29-21-10.json
 create mode 100644 common/changes/@rushstack/rush-client-core/r04-t108o-continuing-wait_2026-09-29-19-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/r04-t108o-continuing-operations_2026-09-29-18-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r04-t108o-continuing-operations_2026-09-29-19-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/r04-t108o-stopped-fallback_2026-09-29-20-20.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t108-e2h-selection-move_2026-09-29-22-20.json
 create mode 100644 libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
 create mode 100644 libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
 create mode 100644 libraries/rush-daemon/src/PhasedRequestSelection.ts
 create mode 100644 libraries/rush-daemon/src/StoppedContinuingOperations.ts
 create mode 100644 libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index db824bf62e..51139a1643 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -245,11 +245,26 @@ In agent mode a failed `rush build` doesn't wait for all of its work. Its result
 operation failed and none of the selected projects that no other selected project depends on (for
 example, the projects named by `--to`) is still waiting or running. The daemon keeps running the
 operations that the failure didn't block, so that the next build finds them done, and the summary
-line counts them (`· 2 independent operations continue in rushd`). A later `rush build` waits for
-them. `rush rebuild`, `rush install` and `rush update`, a restart of the daemon for another
-environment, and `rush-client daemon stop` stop them instead. Rushx scripts, and commands that the
-daemon doesn't run (such as `rush list` or a custom command, which run in-process), run alongside
-them, like two Rush commands at once in one checkout.
+line counts them and names up to three, in name order
+(`· 2 independent operations continue in rushd: lib-b (build), lib-c (build)`). A later `rush build`
+waits for them. While it waits only for them, its output says so and names up to three of them.
+In agent mode the phase reads
+`queued behind 2 operations left running by an earlier failed command (position 1): lib-b (build), lib-c (build)`,
+a status line on a pipe reads
+`waiting for 2 operations left running by an earlier failed command (queue position 1 at 0.1s): lib-b (build), lib-c (build)`,
+and the summary line ends with
+`· queued behind 2 operations left running by an earlier failed command (position 1 at 0.1s): lib-b (build), lib-c (build)`.
+Legacy output on a terminal prints
+`rush-client: waiting for daemon admission (position 1) behind 2 operations left running by an earlier failed command: lib-b (build), lib-c (build).`
+The daemon reports the position again each time one of them ends, so the phase and the status
+line name only the ones that still run; the summary line keeps the first position that named them.
+`rush rebuild`, `rush install` and `rush update`, a restart of the daemon for another
+environment, and `rush-client daemon stop` stop them instead. So does a command that the daemon
+doesn't run (such as a custom command that it can't serve), before the client runs it in-process;
+the client then prints, indented under its fallback line,
+`rushd stopped 2 operations left running by an earlier failed command (lib-b (build), lib-c (build)), so that this command can run in-process.`
+Rushx scripts, and built-in commands that only read the workspace (such as `rush list`), run
+in-process alongside them, like two Rush commands at once in one checkout.
 Older daemons report the failure when all of the work has ended.
 
 Positively identified built-in `install` and `update` follow the same opt-in routing
@@ -434,7 +449,10 @@ A command that was still waiting in rushd's queue when rushd exited has not run,
 when it starts a command (protocol 0.14) and had not said so. The client then sends it to a new
 daemon once, within its `--wait-timeout`, and before that daemon starts it prints one line on
 stderr (or above the agent progress rows): `rush-client: rushd (PID <pid>) exited while the
-command was queued; sending the command to a new daemon.` If the new daemon does not start,
+command was queued; sending the command to a new daemon.` In agent mode the phase, and the status
+lines on a pipe, then read `request resubmitted to the new daemon; preparing the workspace graph`
+rather than what the command waited for in the exited daemon's queue, until the new daemon reports
+a queue position or starts the command. If the new daemon does not start,
 the command fails after that line with the startup error. If the connection to the new daemon
 is lost too, the diagnostic begins "Daemon disconnected before delivering a result; the command
 was already sent to a new daemon once." Commands that waited together reach the new daemon in
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index b5f321c960..de4d7f05a7 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -7,6 +7,7 @@
 import type { IDaemonSilence } from '@rushstack/rush-client-core';
 import type {
   DaemonRequestAdmissionErrorCode,
+  IDaemonContinuingOperations,
   IDaemonEventEnvelope,
   RUSHD_OPERATION_STREAM_CLOSED
 } from '@rushstack/rush-daemon-protocol';
@@ -19,6 +20,7 @@ import {
   type IAgentProblemOperation
 } from './AgentOperationTracker';
 import { clipLine } from './OperationOutputExcerpt';
+import { formatContinuingOperationNames, formatContinuingOperations } from './continuingOperations';
 import { DAEMON_SILENCE_ADVICE, formatDaemonResponded, formatDaemonSilence } from './daemonSilence';
 
 const SPINNER_FRAMES: readonly string[] = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
@@ -55,6 +57,8 @@ const GLOBAL_OUTPUT_EXCERPT_LINES: number = 8;
 /** The most operation names listed in the summary line, and in a live row. */
 const MAX_SUMMARY_NAMES: number = 5;
 const MAX_LIVE_NAMES: number = 3;
+/** The most names of operations that continue in rushd, which the summary line lists after the failed ones. */
+const MAX_CONTINUING_NAMES: number = 3;
 const MAX_MESSAGE_LENGTH: number = 300;
 /**
  * Lines of a multi-line error message printed after its first line: the first and last lines of the rest, since a
@@ -101,6 +105,8 @@ const UNFINISHED_STATUSES: ReadonlySet<string> = new Set(['WAITING', 'READY', 'Q
 interface IQueuePosition {
   readonly position: number;
   readonly elapsed: string;
+  /** Set if the request waited only for operations that an earlier failed command left running. */
+  readonly continuing: IDaemonContinuingOperations | undefined;
 }
 
 /** A daemon that has not responded: its process ID, and since when (on the renderer's clock) it has sent nothing. */
@@ -134,13 +140,17 @@ export interface IAgentFinalResult {
   readonly admissionErrorCode?: DaemonRequestAdmissionErrorCode;
 }
 
-/** Says how many operations the daemon still runs after it reported the failure, if any. */
+/** Says which operations the daemon still runs after it reported the failure, if any, in name order. */
 function formatUnfinishedOperations(results: ReadonlyArray<IAgentOperationResult> | undefined): string {
-  const count: number = results?.filter(({ status }) => UNFINISHED_STATUSES.has(status)).length ?? 0;
-  if (count === 0) {
+  const names: string[] = (results ?? [])
+    .filter(({ status }) => UNFINISHED_STATUSES.has(status))
+    .map(({ operationId }) => operationId)
+    .sort();
+  if (names.length === 0) {
     return '';
   }
-  return ` · ${count} independent ${count === 1 ? 'operation continues' : 'operations continue'} in rushd`;
+  const continues: string = names.length === 1 ? 'operation continues' : 'operations continue';
+  return ` · ${names.length} independent ${continues} in rushd: ${formatNames(names, MAX_CONTINUING_NAMES)}`;
 }
 
 function formatNames(names: ReadonlyArray<string>, maxNames: number): string {
@@ -244,6 +254,11 @@ export class AgentProgressRenderer {
   #queued: IQueuePosition | undefined;
   /** The first queue position, for the summary line. */
   #firstQueued: IQueuePosition | undefined;
+  /**
+   * The first queue position that named operations left running by an earlier failed command, which the summary line
+   * gives instead of the first one, since the request waited behind them.
+   */
+  #firstContinuingQueued: IQueuePosition | undefined;
   #stopped: boolean = false;
   /** The client asked rushd to cancel the request; the progress line says so until the end. */
   #cancelling: boolean = false;
@@ -339,11 +354,22 @@ export class AgentProgressRenderer {
     }
   }
 
-  /** The request waits for admission. The status lines and the summary line say so. */
-  public onQueuePosition(position: number): void {
-    this.#queued = { position, elapsed: this.#elapsed() };
+  /**
+   * The request waits for admission, and with `continuing`, only for operations that an earlier failed command left
+   * running, which the daemon names again whenever one of them ends. The status lines and the summary line say so.
+   */
+  public onQueuePosition(position: number, continuing?: IDaemonContinuingOperations): void {
+    this.#queued = { position, elapsed: this.#elapsed(), continuing };
     this.#firstQueued ??= this.#queued;
-    this.setPhase(`queued behind another request (position ${position})`);
+    if (continuing) {
+      this.#firstContinuingQueued ??= this.#queued;
+      this.setPhase(
+        `queued behind ${formatContinuingOperations(continuing)} (position ${position})` +
+          formatContinuingOperationNames(continuing)
+      );
+    } else {
+      this.setPhase(`queued behind another request (position ${position})`);
+    }
   }
 
   /**
@@ -366,6 +392,16 @@ export class AgentProgressRenderer {
     return true;
   }
 
+  /**
+   * The request was sent to a new daemon, and `phase` says so. The phase and the status lines then no longer give
+   * the previous daemon's queue position, or what the request waited for there, until the new daemon reports a
+   * position. The summary line still gives the first position, since the request did wait there.
+   */
+  public onResubmitted(phase: string): void {
+    this.#queued = undefined;
+    this.setPhase(phase);
+  }
+
   /**
    * The client asked rushd to cancel the request, and waits up to `timeoutMs` for rushd to stop it, which can take
    * seconds while rushd prepares the workspace graph. Says so at once, and on a TTY until the end; on a pipe, in one
@@ -504,9 +540,13 @@ export class AgentProgressRenderer {
     }
     // Why a success or a cancellation took long. A failure has its own reason, which an old queue position is not,
     // and an admission failure says that the request waited, and why it stopped waiting.
-    if (this.#firstQueued && verdict !== 'FAILURE' && !result?.admissionErrorCode) {
-      const { position, elapsed } = this.#firstQueued;
-      summary += ` · queued behind another request (position ${position} at ${elapsed})`;
+    const queued: IQueuePosition | undefined = this.#firstContinuingQueued ?? this.#firstQueued;
+    if (queued && verdict !== 'FAILURE' && !result?.admissionErrorCode) {
+      const { position, elapsed, continuing } = queued;
+      summary += continuing
+        ? ` · queued behind ${formatContinuingOperations(continuing)} (position ${position} at ${elapsed})` +
+          formatContinuingOperationNames(continuing)
+        : ` · queued behind another request (position ${position} at ${elapsed})`;
     }
     if (errorMessage) {
       const [firstLine, ...detail] = errorMessage.split('\n').filter((line) => line.trim());
@@ -766,9 +806,11 @@ export class AgentProgressRenderer {
     } else if (running.length) {
       activity = `running: ${formatNames(running, MAX_LIVE_NAMES)}`;
     } else if (this.#queued) {
-      activity =
-        `waiting for admission or the workspace graph ` +
-        `(queue position ${this.#queued.position} at ${this.#queued.elapsed})`;
+      const { position, elapsed, continuing } = this.#queued;
+      activity = continuing
+        ? `waiting for ${formatContinuingOperations(continuing)} (queue position ${position} at ${elapsed})` +
+          formatContinuingOperationNames(continuing)
+        : `waiting for admission or the workspace graph (queue position ${position} at ${elapsed})`;
     }
     const failures: string = failed.length ? ` · failed: ${formatNames(failed, MAX_LIVE_NAMES)}` : '';
     return `${this.#getHeader()} · ${activity}${failures}`;
diff --git a/apps/rush-cli-client/src/continuingOperations.ts b/apps/rush-cli-client/src/continuingOperations.ts
new file mode 100644
index 0000000000..2d2b623042
--- /dev/null
+++ b/apps/rush-cli-client/src/continuingOperations.ts
@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+// AgentProgressRenderer loads this module before @microsoft/rush-lib, so it stays free of heavy imports.
+
+import type { IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+/** The most names of operations that an earlier failed command left running that a line lists. */
+const MAX_CONTINUING_OPERATION_NAMES: number = 3;
+
+/**
+ * Says what a request waits for while it waits only for operations that an earlier failed command left running,
+ * for example "2 operations left running by an earlier failed command".
+ */
+export function formatContinuingOperations({ count }: IDaemonContinuingOperations): string {
+  return `${count} ${count === 1 ? 'operation' : 'operations'} left running by an earlier failed command`;
+}
+
+/**
+ * Names those operations after a colon, for example ": a (build), b (build), c (build) +4 more", where the count
+ * says how many are not named. Returns an empty string if the daemon named none.
+ */
+export function formatContinuingOperationNames({ count, names }: IDaemonContinuingOperations): string {
+  const shown: ReadonlyArray<string> = names.slice(0, MAX_CONTINUING_OPERATION_NAMES);
+  if (shown.length === 0) {
+    return '';
+  }
+  const more: number = count - shown.length;
+  return `: ${shown.join(', ')}${more > 0 ? ` +${more} more` : ''}`;
+}
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index bd374e3f80..6a83c5ad85 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -8,7 +8,9 @@ import {
   type IDaemonRestartNotice,
   type IDaemonRestartWaitDetails
 } from '@rushstack/rush-client-core';
-import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+import type { DaemonRestartReason, IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+import { formatContinuingOperationNames, formatContinuingOperations } from './continuingOperations';
 
 /** The most variables that a restart line names before it says how many more differed. */
 const MAX_NAMED_VARIABLES: number = 4;
@@ -203,8 +205,10 @@ function isRestartCauseWritten(
 /** The agent renderer methods that tell an agent why a request waits or restarted. */
 export interface IAgentRequestNoticeRenderer {
   note(line: string): void;
-  setPhase(phase: string): void;
-  onQueuePosition(position: number): void;
+  /** See `AgentProgressRenderer.onResubmitted`. */
+  onResubmitted(phase: string): void;
+  /** See `AgentProgressRenderer.onQueuePosition`. */
+  onQueuePosition(position: number, continuingOperations?: IDaemonContinuingOperations): void;
   /** See `AgentProgressRenderer.onRestartWait`. Returns whether it wrote the wait as a line. */
   onRestartWait(wait: string, announce: boolean): boolean;
 }
@@ -234,7 +238,9 @@ export interface IDaemonRequestNoticeHandlers {
   readonly onQueuePositionAsync: (
     position: number,
     restartReason?: DaemonRestartReason,
-    restartWait?: IDaemonRestartWaitDetails
+    restartWait?: IDaemonRestartWaitDetails,
+    /** Set while the request waits only for operations that an earlier failed command left running. */
+    continuingOperations?: IDaemonContinuingOperations
   ) => Promise<void>;
   /** The daemon admitted the request's input, so a rushx script starts, and no longer waits. */
   readonly onInputAdmittedAsync: () => Promise<void>;
@@ -301,24 +307,30 @@ export function createDaemonRequestNoticeHandlers(
       const waitReason: DaemonRestartReason | undefined = writtenWaitReason;
       writtenWaitReason = undefined;
       if (!isRestartCauseWritten(waitReason, notice.reason)) await writeRestartNoticeAsync(notice);
-      // The phase still says that the request waits for the previous daemon.
+      // The phase and the status lines still say what the request waited for at the previous daemon.
       if (agentRenderer && (showedRestartWait || notice.exitedPid !== undefined)) {
-        agentRenderer.setPhase(RESUBMITTED_PHASE);
+        agentRenderer.onResubmitted(RESUBMITTED_PHASE);
       }
       showedRestartWait = false;
     },
     onQueuePositionAsync: async (
       position: number,
       restartReason?: DaemonRestartReason,
-      details: IDaemonRestartWaitDetails = {}
+      details: IDaemonRestartWaitDetails = {},
+      continuing?: IDaemonContinuingOperations
     ): Promise<void> => {
       if (disposed) return;
       // Without a reason, a count of scripts means that the request restarts the daemon itself once it ends.
       if (!restartReason && !details.scriptCount) {
         endRestartWait();
-        if (agentRenderer) agentRenderer.onQueuePosition(position);
+        if (agentRenderer) agentRenderer.onQueuePosition(position, continuing);
         else if (stderrIsTTY) {
-          await target.writeStderrAsync(`${prefix}: waiting for daemon admission (position ${position}).\n`);
+          const behind: string = continuing
+            ? ` behind ${formatContinuingOperations(continuing)}${formatContinuingOperationNames(continuing)}`
+            : '';
+          await target.writeStderrAsync(
+            `${prefix}: waiting for daemon admission (position ${position})${behind}.\n`
+          );
         }
         return;
       }
diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 1697f811fa..5f32e5e024 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -45,11 +45,7 @@ import { selectClientRoute, type IClientRoute } from './routing';
 import { getResultStderr } from './resultDiagnostics';
 import { createDaemonLivenessOptions } from './daemonSilence';
 import { getTerminalColumns } from './terminalColumns';
-import {
-  createDaemonRequestNoticeHandlers,
-  explainDaemonRestartFailure,
-  type IDaemonRequestNoticeHandlers
-} from './daemonRestartNotice';
+import { createDaemonRequestNoticeHandlers, explainDaemonRestartFailure } from './daemonRestartNotice';
 import { formatInProcessFallbackMessage } from './inProcessFallback';
 import { setInProcessLockWait, type IInProcessLockWait } from './inProcessLockWait';
 import { createOrphanReapNoticeHandler, writeStderr } from './daemonReclaimNotice';
@@ -227,7 +223,7 @@ export async function launchClientAsync(
     cancellationSignal ??= signal ?? 'SIGINT';
     abort.abort();
   };
-  let notices: IDaemonRequestNoticeHandlers | undefined;
+  let notices: INativeLockWaitNoticeHandlers | undefined;
   const onCancelRequested = (timeoutMs: number): void => {
     cancelRequested = true;
     // A line that the request still waits for a daemon restart would contradict the cancelling line.
diff --git a/apps/rush-cli-client/src/nativeLockWaitNotice.ts b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
index 20db793eac..b8c170328c 100644
--- a/apps/rush-cli-client/src/nativeLockWaitNotice.ts
+++ b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
@@ -2,7 +2,11 @@
 // See LICENSE in the project root for license information.
 
 import { formatNativeLockHolder, type IDaemonRestartWaitDetails } from '@rushstack/rush-client-core';
-import type { DaemonRestartReason, IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
+import type {
+  DaemonRestartReason,
+  IDaemonContinuingOperations,
+  IDaemonNativeLockHolder
+} from '@rushstack/rush-daemon-protocol';
 
 import type { IDaemonRequestNoticeHandlers } from './daemonRestartNotice';
 
@@ -30,13 +34,18 @@ export interface INativeLockWaitNoticeTarget {
   readonly now?: () => number;
 }
 
-/** A request's notice handlers, whose queue positions can say that it waits for native Rush's repository lock. */
-export interface INativeLockWaitNoticeHandlers extends IDaemonRequestNoticeHandlers {
+/**
+ * A request's notice handlers, whose queue positions can say that it waits for native Rush's repository lock. Their
+ * queue positions take the arguments of `IDaemonClientExecuteOptions.onQueuePositionAsync`.
+ */
+export interface INativeLockWaitNoticeHandlers
+  extends Omit<IDaemonRequestNoticeHandlers, 'onQueuePositionAsync'> {
   readonly onQueuePositionAsync: (
     position: number,
     restartReason?: DaemonRestartReason,
     restartWait?: IDaemonRestartWaitDetails,
-    nativeLockHolder?: IDaemonNativeLockHolder
+    nativeLockHolder?: IDaemonNativeLockHolder,
+    continuingOperations?: IDaemonContinuingOperations
   ) => Promise<void>;
 }
 
@@ -87,10 +96,21 @@ export function withNativeLockWaitNotices(
       endWait();
       await handlers.onRestartAsync(notice);
     },
-    onQueuePositionAsync: async (position, restartReason, restartWait, nativeLockHolder) => {
+    onQueuePositionAsync: async (
+      position,
+      restartReason,
+      restartWait,
+      nativeLockHolder,
+      continuingOperations
+    ) => {
       if (!nativeLockHolder || restartReason) {
         endWait();
-        return await handlers.onQueuePositionAsync(position, restartReason, restartWait);
+        return await handlers.onQueuePositionAsync(
+          position,
+          restartReason,
+          restartWait,
+          continuingOperations
+        );
       }
       if (disposed) return;
       // This ends a wait for a daemon restart, if the request waited for one; it waits for the lock instead.
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 2518bc3dda..185817740c 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -4,10 +4,16 @@
 import {
   DAEMON_PROTOCOL_VERSION,
   type DaemonEventType,
+  type IDaemonContinuingOperations,
   type IDaemonEventEnvelope
 } from '@rushstack/rush-daemon-protocol';
 
 import { AgentProgressRenderer } from '../AgentProgressRenderer';
+import {
+  RESUBMITTED_PHASE,
+  createDaemonRequestNoticeHandlers,
+  type IDaemonRequestNoticeHandlers
+} from '../daemonRestartNotice';
 
 function event(type: DaemonEventType, payload: unknown): IDaemonEventEnvelope {
   return {
@@ -166,7 +172,7 @@ describe(AgentProgressRenderer.name, () => {
     ]);
   });
 
-  it('says how many operations continue in rushd after a failure that the daemon reported early', () => {
+  it('says which operations continue in rushd after a failure that the daemon reported early', () => {
     const operationIds: ReadonlyArray<string> = ['a (build)', 'b (build)', 'c (build)', 'd (build)'];
     const finishWith = (unfinished: ReadonlyArray<[string, string]>, exitCode: number = 1): string[] => {
       const { renderer, lines } = createRenderer(false);
@@ -186,14 +192,40 @@ describe(AgentProgressRenderer.name, () => {
 
     expect(finishWith([['c (build)', 'EXECUTING']]).pop()).toBe(
       'rush build: FAILURE 2/4 operations (1 failure, 1 blocked) in 0.0s · failed: b (build)' +
-        ' · 1 independent operation continues in rushd'
+        ' · 1 independent operation continues in rushd: c (build)'
     );
     expect(
       finishWith([
         ['c (build)', 'EXECUTING'],
         ['d (build)', 'QUEUED']
       ]).pop()
-    ).toMatch(/ · failed: b \(build\) · 2 independent operations continue in rushd$/);
+    ).toMatch(
+      / · failed: b \(build\) · 2 independent operations continue in rushd: c \(build\), d \(build\)$/
+    );
+    // Like a live row, the line names only the first few.
+    expect(
+      finishWith([
+        ['c (build)', 'EXECUTING'],
+        ['d (build)', 'QUEUED'],
+        ['e (build)', 'WAITING'],
+        ['f (build)', 'READY'],
+        ['g (build)', 'EXECUTING']
+      ]).pop()
+    ).toMatch(
+      / · 5 independent operations continue in rushd: c \(build\), d \(build\), e \(build\) \+2 more$/
+    );
+    // The names come in name order, as the daemon's queue positions give them, whatever the result's order.
+    expect(
+      finishWith([
+        ['g (build)', 'EXECUTING'],
+        ['f (build)', 'READY'],
+        ['e (build)', 'WAITING'],
+        ['d (build)', 'QUEUED'],
+        ['c (build)', 'EXECUTING']
+      ]).pop()
+    ).toMatch(
+      / · 5 independent operations continue in rushd: c \(build\), d \(build\), e \(build\) \+2 more$/
+    );
     expect(finishWith([['c (build)', 'SUCCESS']]).pop()).toMatch(/ · failed: b \(build\)$/);
     expect(finishWith([['c (build)', 'EXECUTING']], 0).pop()).not.toContain('continue');
   });
@@ -566,6 +598,79 @@ describe(AgentProgressRenderer.name, () => {
     renderer.dispose();
   });
 
+  describe('while the request waits only for operations that an earlier failed command left running (task 108)', () => {
+    const TWO: IDaemonContinuingOperations = { count: 2, names: ['t8-slow1', 't8-slow2'] };
+    const LEFT: string = 'left running by an earlier failed command';
+
+    function getPhase(...positions: [number, IDaemonContinuingOperations?][]): string | undefined {
+      const { renderer, output } = createRenderer(true, 'build', 200);
+      for (const [position, continuing] of positions) renderer.onQueuePosition(position, continuing);
+      renderer.dispose();
+      return / · (queued behind [^\n]*)\n/.exec(
+        output.filter((text) => text.includes('queued')).pop() ?? ''
+      )?.[1];
+    }
+
+    it('names them in the phase on a TTY: in the singular, up to three names, and then how many more', () => {
+      expect(getPhase([1, TWO])).toBe(`queued behind 2 operations ${LEFT} (position 1): t8-slow1, t8-slow2`);
+      expect(getPhase([1, { count: 1, names: ['t8-slow1'] }])).toBe(
+        `queued behind 1 operation ${LEFT} (position 1): t8-slow1`
+      );
+      expect(getPhase([2, { count: 3, names: ['a', 'b', 'c'] }])).toBe(
+        `queued behind 3 operations ${LEFT} (position 2): a, b, c`
+      );
+      // The daemon names the first three, and the count says how many it did not name.
+      expect(getPhase([1, { count: 7, names: ['a', 'b', 'c'] }])).toBe(
+        `queued behind 7 operations ${LEFT} (position 1): a, b, c +4 more`
+      );
+      expect(getPhase([1, { count: 5, names: ['a', 'b', 'c', 'd'] }])).toBe(
+        `queued behind 5 operations ${LEFT} (position 1): a, b, c +2 more`
+      );
+      expect(getPhase([1, { count: 2, names: [] }])).toBe(`queued behind 2 operations ${LEFT} (position 1)`);
+      // A position that names none is a wait for another request, as before.
+      expect(getPhase([1, TWO], [1])).toBe('queued behind another request (position 1)');
+      // Each position the daemon sends again names the operations that still run.
+      expect(getPhase([1, TWO], [1, { count: 1, names: ['t8-slow2'] }])).toBe(
+        `queued behind 1 operation ${LEFT} (position 1): t8-slow2`
+      );
+    });
+
+    it('ends the summary line with the first position that named them, not an earlier or a later one', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      clock.ms = 50;
+      renderer.onQueuePosition(2);
+      clock.ms = 100;
+      renderer.onQueuePosition(1, TWO);
+      clock.ms = 5000;
+      renderer.onQueuePosition(1, { count: 1, names: ['t8-slow2'] });
+      clock.ms = 9000;
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      renderer.onEvent(status('a (build)', 'SUCCESS'));
+      renderer.finish({ exitCode: 0 });
+      expect(lines()).toEqual([
+        'rush build: SUCCESS 1/1 operations (1 success) in 9.0s · ' +
+          `queued behind 2 operations ${LEFT} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+
+      // A request that the daemon never told of them keeps the text it had before.
+      const other: ITestRenderer = createRenderer(false);
+      other.clock.ms = 50;
+      other.renderer.onQueuePosition(2);
+      other.clock.ms = 9000;
+      other.renderer.finish({ exitCode: 0 });
+      expect(other.lines()).toEqual([
+        'rush build: SUCCESS up to date (no operations needed) in 9.0s · ' +
+          'queued behind another request (position 2 at 0.1s)'
+      ]);
+
+      // As for any queue position, a failure gives its own reason instead.
+      const failed: ITestRenderer = createRenderer(false);
+      failed.renderer.onQueuePosition(1, TWO);
+      failed.renderer.finish({ exitCode: 1 });
+      expect(failed.lines()).toEqual(['rush build: FAILURE in 0.0s']);
+    });
+  });
+
   it('writes a final summary line after a queued request completes', () => {
     const { renderer, output, clock } = createRenderer(false);
     renderer.start();
@@ -1231,6 +1336,69 @@ describe(AgentProgressRenderer.name, () => {
       ]);
     });
 
+    it('names the operations that an earlier failed command left running as the latest position does (task 108)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      renderer.onQueuePosition(1, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+      advance(clock, 24_900);
+      advance(clock, 5_000);
+      renderer.onQueuePosition(1, { count: 1, names: ['t8-slow2'] });
+      advance(clock, 20_000);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      advance(clock, 25_000);
+      renderer.dispose();
+      const left: string = 'left running by an earlier failed command';
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        `rush build · 25.0s · waiting for 2 operations ${left} (queue position 1 at 0.1s): t8-slow1, t8-slow2`,
+        `rush build · 50.0s · waiting for 1 operation ${left} (queue position 1 at 30.0s): t8-slow2`,
+        'rush build 0/1 · 75.0s · running: a (build)'
+      ]);
+    });
+
+    it('says that a command sent to a new daemon was resubmitted, not what it waited for at the exited daemon (tasks 108 and 145)', async () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const handlers: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
+        rushx: false,
+        stderrIsTTY: false,
+        daemonPid: 41,
+        now: () => clock.ms,
+        agentRenderer: renderer,
+        writeStderrAsync: async () => undefined
+      });
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+      advance(clock, 4_900);
+      await handlers.onRestartAsync({
+        restart: 1,
+        reason: undefined,
+        successorPid: undefined,
+        exitedPid: 41
+      });
+      advance(clock, 25_000);
+      advance(clock, 5_000);
+      await handlers.onQueuePositionAsync(1);
+      advance(clock, 20_000);
+      advance(clock, 2_000);
+      handlers.dispose();
+      renderer.finish({ exitCode: 0 });
+      const left: string = 'left running by an earlier failed command';
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.',
+        `rush build · 30.0s · ${RESUBMITTED_PHASE}`,
+        'rush build · 55.0s · waiting for admission or the workspace graph (queue position 1 at 35.0s)',
+        // The command did wait behind them, before it was resubmitted.
+        'rush build: SUCCESS up to date (no operations needed) in 57.0s · ' +
+          `queued behind 2 operations ${left} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+    });
+
     it('writes status lines after a failure report, and none after the summary', () => {
       const { renderer, output, clock, lines } = createRenderer(false);
       renderer.start();
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index a598e96cc4..cf73b34e18 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -6,7 +6,7 @@ import {
   DaemonRestartFailedError,
   type IDaemonRestartWaitDetails
 } from '@rushstack/rush-client-core';
-import type { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
+import type { DaemonRestartReason, IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
 
 import {
   RESTART_WAIT_REPEAT_MS,
@@ -344,8 +344,12 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       agentRenderer: options.agent
         ? {
             note: (line: string) => calls.push(`note: ${line}`),
-            setPhase: (phase: string) => calls.push(`phase: ${phase}`),
-            onQueuePosition: (position: number) => calls.push(`position: ${position}`),
+            onResubmitted: (phase: string) => calls.push(`resubmitted: ${phase}`),
+            onQueuePosition: (position: number, continuing?: IDaemonContinuingOperations) =>
+              calls.push(
+                `position: ${position}` +
+                  (continuing ? ` behind ${continuing.count} (${continuing.names.join(', ')})` : '')
+              ),
             onRestartWait: (wait: string, announce: boolean) => {
               calls.push(`${announce ? 'announce' : 'wait'}: ${wait}`);
               return announce && agentWritesWaitLines;
@@ -565,6 +569,31 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       }
     });
 
+    it('names the operations that an earlier failed command left running, on a terminal only (task 108)', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(2);
+        await handlers.onQueuePositionAsync(1, undefined, {}, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+        await handlers.onQueuePositionAsync(1, undefined, {}, { count: 1, names: ['t8-slow2'] });
+        await handlers.onQueuePositionAsync(1, undefined, {}, { count: 5, names: ['a', 'b', 'c'] });
+        handlers.dispose();
+        const left: string = 'left running by an earlier failed command';
+        expect(calls).toEqual(
+          stderrIsTTY
+            ? [
+                `stderr: ${client}: waiting for daemon admission (position 2).\n`,
+                `stderr: ${client}: waiting for daemon admission (position 1) behind 2 operations ${left}: ` +
+                  't8-slow1, t8-slow2.\n',
+                `stderr: ${client}: waiting for daemon admission (position 1) behind 1 operation ${left}: ` +
+                  't8-slow2.\n',
+                `stderr: ${client}: waiting for daemon admission (position 1) behind 5 operations ${left}: ` +
+                  'a, b, c +2 more.\n'
+              ]
+            : []
+        );
+      }
+    });
+
     it('gives no restart notice when a wait line since the last restart gave its cause (task 222)', async () => {
       const cases: [DaemonRestartReason, IDaemonRestartWaitDetails, DaemonRestartReason][] = [
         [
@@ -686,7 +715,7 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       `announce: waiting for 2 running requests to finish, including 1 rushx script; ${LOCKFILE_WAIT}`,
       `wait: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`,
       `announce: waiting for 1 running request to finish; the daemon (PID 41) then restarts, ${removed}`,
-      `phase: ${RESUBMITTED_PHASE}`,
+      `resubmitted: ${RESUBMITTED_PHASE}`,
       `announce: waiting for 1 running request to finish; the daemon (PID 42) then restarts, ${removed}`
     ]);
   });
@@ -724,7 +753,7 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
               "note: rush-client: A command's environment differed from the daemon's in NODE_OPTIONS; restarted " +
                 'the daemon (PID 42).'
             ]),
-        `phase: ${RESUBMITTED_PHASE}`
+        `resubmitted: ${RESUBMITTED_PHASE}`
       ]);
     }
   });
@@ -737,7 +766,7 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     expect(calls).toEqual([
       'position: 1',
       'note: rush-client: rushd (PID 41) exited while the command was queued; sending the command to a new daemon.',
-      `phase: ${RESUBMITTED_PHASE}`
+      `resubmitted: ${RESUBMITTED_PHASE}`
     ]);
   });
 
@@ -756,4 +785,12 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
     await handlers.onQueuePositionAsync(2);
     expect(calls).toEqual([`announce: waiting for 1 running request to finish; ${LOCKFILE_WAIT}`]);
   });
+
+  it('gives the agent renderer the operations that an earlier failed command left running (task 108)', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: true });
+    await handlers.onQueuePositionAsync(1, undefined, {}, { count: 2, names: ['t8-slow1', 't8-slow2'] });
+    await handlers.onQueuePositionAsync(1);
+    handlers.dispose();
+    expect(calls).toEqual(['position: 1 behind 2 (t8-slow1, t8-slow2)', 'position: 1']);
+  });
 });
diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
index 8cf914f1fa..fa17965916 100644
--- a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -63,7 +63,7 @@ describe(withNativeLockWaitNotices.name, () => {
       agentRenderer: options.agent
         ? {
             note: (line: string) => calls.push(`note: ${line}`),
-            setPhase: (phase: string) => calls.push(`phase: ${phase}`),
+            onResubmitted: (phase: string) => calls.push(`resubmitted: ${phase}`),
             onQueuePosition: (position: number) => calls.push(`position: ${position}`),
             // A renderer may say whether it wrote the wait as a line.
             onRestartWait: (wait: string, announce: boolean) => {
@@ -138,6 +138,18 @@ describe(withNativeLockWaitNotices.name, () => {
       (handlers: INativeLockWaitNoticeHandlers) => handlers.onQueuePositionAsync(2),
       ['stderr: rush-client: waiting for daemon admission (position 2).\n']
     ],
+    [
+      'a queue position behind operations that an earlier failed command left running (task 108)',
+      (handlers: INativeLockWaitNoticeHandlers) =>
+        handlers.onQueuePositionAsync(1, undefined, {}, undefined, {
+          count: 2,
+          names: ['a (build)', 'b (build)']
+        }),
+      [
+        'stderr: rush-client: waiting for daemon admission (position 1) behind 2 operations left running by an ' +
+          'earlier failed command: a (build), b (build).\n'
+      ]
+    ],
     [
       'a restart',
       (handlers: INativeLockWaitNoticeHandlers) =>
diff --git a/common/changes/@rushstack/rush-cli-client/r04-t108o-continuing-wait_2026-09-29-19-45.json b/common/changes/@rushstack/rush-cli-client/r04-t108o-continuing-wait_2026-09-29-19-45.json
new file mode 100644
index 0000000000..14b80a1cab
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r04-t108o-continuing-wait_2026-09-29-19-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "A request that waits only for the operations that an earlier failed command left running names them while it waits and in its summary line, and the operations that continue in rushd are named in name order.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r04-t108o-early-names_2026-09-29-18-45.json b/common/changes/@rushstack/rush-cli-client/r04-t108o-early-names_2026-09-29-18-45.json
new file mode 100644
index 0000000000..bf666d102e
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r04-t108o-early-names_2026-09-29-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent output, a failed build whose independent operations continue in rushd names up to three of them on its summary line.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/r04-t108o-stopped-fallback_2026-09-29-20-20.json b/common/changes/@rushstack/rush-cli-client/r04-t108o-stopped-fallback_2026-09-29-20-20.json
new file mode 100644
index 0000000000..604f43d52f
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/r04-t108o-stopped-fallback_2026-09-29-20-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document that the daemon stops the operations that an earlier failed command left running before a command that the client runs in-process, except for Rushx scripts and read-only built-in commands, and says so under the fallback line.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t108o-resubmitted-status_2026-09-29-21-10.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108o-resubmitted-status_2026-09-29-21-10.json
new file mode 100644
index 0000000000..2f295368bf
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108o-resubmitted-status_2026-09-29-21-10.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent mode, once a command that was queued when rushd exited is sent to a new daemon, the status lines on a pipe say that it was resubmitted instead of giving the exited daemon's queue position and what the command waited for there.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/r04-t108o-continuing-wait_2026-09-29-19-45.json b/common/changes/@rushstack/rush-client-core/r04-t108o-continuing-wait_2026-09-29-19-45.json
new file mode 100644
index 0000000000..5aa412d35e
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/r04-t108o-continuing-wait_2026-09-29-19-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Pass the operations that an earlier failed command left running to `onQueuePositionAsync`, when the daemon reports that the request waits only for them.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/r04-t108o-continuing-operations_2026-09-29-18-50.json b/common/changes/@rushstack/rush-daemon-protocol/r04-t108o-continuing-operations_2026-09-29-18-50.json
new file mode 100644
index 0000000000..fac77ed756
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/r04-t108o-continuing-operations_2026-09-29-18-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `continuingOperations` (`IDaemonContinuingOperations`: `count` and `names`) to queue positions and to the workspace status, which says that the daemon runs only operations that earlier requests left running after their result, such as the independent operations of a failed build that returned early, and names the first few. Older peers ignore it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r04-t108o-continuing-operations_2026-09-29-19-20.json b/common/changes/@rushstack/rush-daemon/r04-t108o-continuing-operations_2026-09-29-19-20.json
new file mode 100644
index 0000000000..550335df9d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r04-t108o-continuing-operations_2026-09-29-19-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Tell a request that waits for the graph, and the workspace status, which operations still run only because a request that returned early on failure left them running, and tell the waiting request again each time fewer of them run.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/r04-t108o-stopped-fallback_2026-09-29-20-20.json b/common/changes/@rushstack/rush-daemon/r04-t108o-stopped-fallback_2026-09-29-20-20.json
new file mode 100644
index 0000000000..4463a4a83d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r04-t108o-stopped-fallback_2026-09-29-20-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Name, in the second line of the rejection of a command that the client then runs in-process, the operations left running by an earlier failed command that the daemon stopped first.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t108-e2h-selection-move_2026-09-29-22-20.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-e2h-selection-move_2026-09-29-22-20.json
new file mode 100644
index 0000000000..166f004f7f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t108-e2h-selection-move_2026-09-29-22-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-client-core.api.md b/common/reviews/api/rush-client-core.api.md
index 27f061be22..a7b6188dab 100644
--- a/common/reviews/api/rush-client-core.api.md
+++ b/common/reviews/api/rush-client-core.api.md
@@ -7,6 +7,7 @@
 import { DaemonRestartReason } from '@rushstack/rush-daemon-protocol';
 import { IDaemonClientCaps } from '@rushstack/rush-daemon-protocol';
 import { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
+import { IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
 import { IDaemonEventEnvelope } from '@rushstack/rush-daemon-protocol';
 import { IDaemonLockfile } from '@rushstack/rush-daemon-transport';
 import { IDaemonNativeLockHolder } from '@rushstack/rush-daemon-protocol';
@@ -173,7 +174,8 @@ export interface IDaemonClientExecuteOptions {
     readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
     readonly onInputAdmittedAsync?: () => Promise<void>;
     readonly onQueuePositionAsync?: (position: number, restartReason?: DaemonRestartReason, restartWait?: IDaemonRestartWaitDetails,
-    nativeLockHolder?: IDaemonNativeLockHolder) => Promise<void>;
+    nativeLockHolder?: IDaemonNativeLockHolder,
+    continuingOperations?: IDaemonContinuingOperations) => Promise<void>;
     // (undocumented)
     readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
     // (undocumented)
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index bb2cbbf892..7cbffc5c6f 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -262,6 +262,12 @@ export interface IDaemonCommandResult {
     readonly retryAfterRestart?: true;
 }
 
+// @beta
+export interface IDaemonContinuingOperations {
+    readonly count: number;
+    readonly names: ReadonlyArray<string>;
+}
+
 // @beta
 export interface IDaemonDiagnosticPayload {
     // (undocumented)
@@ -595,6 +601,7 @@ export interface IDaemonRequestQueuePositionMessage {
         readonly scriptCount?: number;
         readonly restartsForAnotherRequest?: boolean;
         readonly nativeLockHolder?: IDaemonNativeLockHolder;
+        readonly continuingOperations?: IDaemonContinuingOperations;
     };
 }
 
@@ -804,6 +811,7 @@ export interface IDaemonWorkspaceInputsChangedRestartReason {
 
 // @beta
 export interface IDaemonWorkspaceStatus {
+    readonly continuingOperations?: IDaemonContinuingOperations;
     // (undocumented)
     readonly generation: number;
     readonly generationToken?: string;
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 975317de8a..4931d9243f 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -826,6 +826,7 @@ export class RequestScheduler {
     get activeRequestCount(): number;
     downgradeExclusiveLease(lease: IRequestLease, target: RequestExclusivityClass.SharedBuild | RequestExclusivityClass.SharedRead): void;
     markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void;
+    notifyQueuePositions(): void;
     preemptLeasesAsync(): Promise<void>;
     get queuedRequestCount(): number;
 }
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 657337fbe5..5aca49e366 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -68,6 +68,10 @@ request or for such a script, and `onInputAdmittedAsync` reports when the daemon
 the request's input, which for a rushx script is when the script starts. While the request
 waits for a Rush process that the daemon does not run to release the repository's lock,
 `onQueuePositionAsync` gets that process as its fourth argument (`nativeLockHolder`).
+While it waits only for operations that earlier requests left running after their result, such as
+those of a failed build that returned early, it gets them as its fifth argument
+(`continuingOperations`: how many there are, and the first three names), and the daemon reports
+the position again each time that number gets smaller.
 `findNativeLockHolder` finds it the way the daemon does, from the `rush#<pid>.lock` files in the
 common temp folder: on Linux, the live process with the oldest one, and its program and action
 from `/proc`, such as `rush install`, never its other arguments; elsewhere, nothing.
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index ca9a62a1f7..807efaf497 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -23,6 +23,7 @@ import {
   type DaemonRestartReason,
   type IDaemonClientCaps,
   type IDaemonCommandResult,
+  type IDaemonContinuingOperations,
   type IDaemonEventEnvelope,
   type IDaemonFrame,
   type IDaemonNativeLockHolder,
@@ -83,10 +84,10 @@ export interface IDaemonClientExecuteOptions {
   readonly onStderrAsync?: (bytes: Uint8Array, operationId: string) => Promise<void>;
   readonly onEventAsync?: (event: IDaemonEventEnvelope) => Promise<void>;
   /**
-   * Called with the request's one-based queue position whenever it changes. `restartReason` is set while the request
-   * waits for a daemon restart for that reason, and `restartWait` then says more about the wait. Without one,
-   * `restartWait.scriptCount` is set while the request waits for rushx scripts to exit, since it restarts the daemon
-   * once it ends.
+   * Called with the request's one-based queue position whenever it changes, or when the daemon reports it again
+   * because what the request waits for changed. `restartReason` is set while the request waits for a daemon restart
+   * for that reason, and `restartWait` then says more about the wait. Without one, `restartWait.scriptCount` is set
+   * while the request waits for rushx scripts to exit, since it restarts the daemon once it ends.
    */
   readonly onQueuePositionAsync?: (
     position: number,
@@ -96,7 +97,12 @@ export interface IDaemonClientExecuteOptions {
      * Set while the request waits for a Rush process that the daemon does not run to release the repository's lock,
      * with what the daemon knows about that process.
      */
-    nativeLockHolder?: IDaemonNativeLockHolder
+    nativeLockHolder?: IDaemonNativeLockHolder,
+    /**
+     * Set while the request waits only for the operations that an earlier failed command left running after its
+     * early result, with their count and up to three of their names, in name order.
+     */
+    continuingOperations?: IDaemonContinuingOperations
   ) => Promise<void>;
   /**
    * Called once, when the daemon first admits the request's input. For a rushx script, that is when the script
@@ -691,13 +697,20 @@ export class DaemonClient {
         return;
       case 'queuePosition': {
         this.#queued = true;
-        const { position, restartReason, scriptCount, restartsForAnotherRequest, nativeLockHolder } =
-          message.payload;
+        const {
+          position,
+          restartReason,
+          scriptCount,
+          restartsForAnotherRequest,
+          nativeLockHolder,
+          continuingOperations
+        } = message.payload;
         await execution.onQueuePositionAsync?.(
           position,
           restartReason,
           { scriptCount, restartsForAnotherRequest },
-          nativeLockHolder
+          nativeLockHolder,
+          continuingOperations
         );
         return;
       }
diff --git a/libraries/rush-client-core/src/test/DaemonClient.test.ts b/libraries/rush-client-core/src/test/DaemonClient.test.ts
index a60490dc89..6f9b62c46b 100644
--- a/libraries/rush-client-core/src/test/DaemonClient.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonClient.test.ts
@@ -460,6 +460,40 @@ describe('DaemonClient', () => {
     ]);
   });
 
+  it('reports the operations that earlier requests left running while the request waits only for them', async () => {
+    const continuing = { count: 4, names: ['a (build)', 'b (build)', 'c (build)'] } as const;
+    onRequest = async (message) => {
+      if (message.kind !== 'requestStart') return;
+      const { requestId } = message.payload;
+      await sendAsync({ kind: 'queuePosition', payload: { position: 1, requestId } });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, continuingOperations: continuing }
+      });
+      await sendAsync({
+        kind: 'queuePosition',
+        payload: { position: 1, requestId, continuingOperations: { count: 1, names: ['c (build)'] } }
+      });
+      await sendAsync({
+        kind: 'requestResult',
+        payload: { requestId, exitCode: 0, outcome: 'success', aborted: false }
+      });
+    };
+    const positions: unknown[] = [];
+    const client = await DaemonClient.connectAsync({ socketPath: address });
+    await client.executeAsync({
+      request: request(),
+      onQueuePositionAsync: async (...args: unknown[]) => {
+        positions.push([args[0], args[3], args[4]]);
+      }
+    });
+    expect(positions).toEqual([
+      [1, undefined, undefined],
+      [1, undefined, continuing],
+      [1, undefined, { count: 1, names: ['c (build)'] }]
+    ]);
+  });
+
   it('reports once, before any input is forwarded, that the daemon admitted input', async () => {
     const stdin = new PassThrough();
     const seen: string[] = [];
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index 458306b758..01d358f836 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -38,6 +38,10 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   carry `nativeLockHolder` (`IDaemonNativeLockHolder`) while the request waits for a Rush process
   that the daemon does not run to release the repository's lock: that process's `pid` and
   `command`, such as `rush install`, as far as the daemon can tell. Its `position` is then 1.
+  A queue position may also carry `continuingOperations` (`IDaemonContinuingOperations`) while the
+  request waits only for operations that earlier requests left running after their result, such as
+  the independent operations of a failed build that returned early: how many of them still wait or
+  run (`count`), and the names of the first few (`names`). Older clients ignore it.
 - **Request lifecycle contracts** — a validated presentation-free command envelope, cancellation,
   typed routing rejection/fallback, and one authoritative terminal result control. Command parsing
   and Rush action construction remain outside the protocol.
@@ -80,7 +84,9 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   effective configuration, maintenance state/failure, retained/protected/watched projects, measured RSS,
   unmeasured runners, pressure and cleanup diagnostics. Child RSS is a last-completion sample, not a
   process-tree ceiling. Nested records and numeric fields are validated. Older pong shapes remain valid;
-  this additive field does not change the 0.9 request, generation-fencing or retry contracts.
+  this additive field does not change the 0.9 request, generation-fencing or retry contracts. While the
+  daemon runs only operations that earlier requests left running after their result, the status also
+  carries them as `continuingOperations`, in the same shape as a queue position's.
 - **Keepalive (0.13)** - a client may `ping` while its request runs, to learn whether the daemon still
   responds, and gets a `pong` as before. A daemon that is closing the session ignores a `ping` rather than
   answering it with a protocol `error`, which could reach the client ahead of the request's typed result.
diff --git a/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts b/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
new file mode 100644
index 0000000000..e37826bac4
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
@@ -0,0 +1,43 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { isDaemonControlRecord } from './ControlRecord';
+import { DaemonProtocolError } from './DaemonProtocolError';
+
+const EMPTY_STRING_LENGTH: number = 0;
+const FIRST_OPERATION_COUNT: number = 1;
+
+/**
+ * Whether `value` is an `IDaemonContinuingOperations`: a positive count, and at most that many nonempty names.
+ * @internal
+ */
+export function isDaemonContinuingOperations(value: unknown): boolean {
+  return isDaemonControlRecord(value) && !Array.isArray(value) && hasContinuingOperationsFields(value);
+}
+
+/** Validates a queue position's optional `continuingOperations`. @internal */
+export function validateQueuedContinuingOperations(value: unknown): void {
+  if (value !== undefined && !isDaemonContinuingOperations(value)) {
+    throw new DaemonProtocolError(
+      'malformedControlMessage',
+      'Queue position payload.continuingOperations must have a positive count and at most that many ' +
+        'nonempty names.'
+    );
+  }
+}
+
+function hasContinuingOperationsFields(value: Record<string, unknown>): boolean {
+  return isOperationCount(value.count) && isNameList(value.names, value.count as number);
+}
+
+function isOperationCount(value: unknown): boolean {
+  return Number.isSafeInteger(value) && (value as number) >= FIRST_OPERATION_COUNT;
+}
+
+function isNameList(value: unknown, count: number): boolean {
+  return Array.isArray(value) && value.length <= count && value.every(isNonEmptyString);
+}
+
+function isNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.length > EMPTY_STRING_LENGTH;
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index db67392984..808940b565 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -25,6 +25,17 @@ export interface IDaemonRequestAdmissionOptions {
   readonly waitTimeoutMs?: number;
 }
 
+/**
+ * Operations that the daemon still runs for requests that already have their result: those that a failed build's
+ * early result did not block (see {@link IDaemonRequestEnvelope.returnEarlyOnFailure}). @beta
+ */
+export interface IDaemonContinuingOperations {
+  /** How many of them are still waiting or running. */
+  readonly count: number;
+  /** The names of the first few of them, in name order. */
+  readonly names: ReadonlyArray<string>;
+}
+
 /** Reports a request's current one-based scheduler queue position. @beta */
 export interface IDaemonRequestQueuePositionMessage {
   readonly kind: 'queuePosition';
@@ -53,5 +64,10 @@ export interface IDaemonRequestQueuePositionMessage {
      * that waits for that process. Older daemons omit it; older clients ignore it.
      */
     readonly nativeLockHolder?: IDaemonNativeLockHolder;
+    /**
+     * Set while the request waits only for operations that earlier requests left running after their result. Older
+     * daemons omit it; older clients ignore it.
+     */
+    readonly continuingOperations?: IDaemonContinuingOperations;
   };
 }
diff --git a/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts b/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
index 281664f207..0361ce79a6 100644
--- a/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonWorkspaceStatus.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import type { IDaemonContinuingOperations } from './DaemonRequestAdmission';
+
 /** Effective runtime policy, not a hard process/tree RSS limit. @beta */
 export interface IDaemonWarmSetConfiguration {
   /** Persistent host project observation; omitted by older peers. Never schedules builds. */
@@ -60,4 +62,9 @@ export interface IDaemonWorkspaceStatus {
    * (`IDaemonPingPayload.omitWarmSet`). Absence never means measured zero memory.
    */
   readonly warmSet?: IDaemonWarmSetStatus;
+  /**
+   * Set while the daemon runs only operations that earlier requests left running after their result, such as the
+   * independent operations of a failed build that returned early. Older peers omit it.
+   */
+  readonly continuingOperations?: IDaemonContinuingOperations;
 }
diff --git a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
index d81ee7cd6a..baae340a0b 100644
--- a/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestAdmissionControlValidation.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { validateQueuedContinuingOperations } from './ContinuingOperationsValidation';
 import { isDaemonControlRecord } from './ControlRecord';
 import { DaemonProtocolError } from './DaemonProtocolError';
 import { validateQueuedRestartReason } from './InstallationChangeValidation';
@@ -28,6 +29,7 @@ export function validateRequestQueuePositionControl(payload: Record<string, unkn
   validateScriptCount(payload.scriptCount);
   validateRestartsForAnotherRequest(payload.restartsForAnotherRequest);
   validateNativeLockHolder(payload.nativeLockHolder);
+  validateQueuedContinuingOperations(payload.continuingOperations);
 }
 
 function validateNativeLockHolder(value: unknown): void {
diff --git a/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts b/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts
index c64e615573..77988d5d09 100644
--- a/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts
+++ b/libraries/rush-daemon-protocol/src/WorkspaceStatusValidation.ts
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { isDaemonContinuingOperations } from './ContinuingOperationsValidation';
 import { validateRequestId } from './RequestIdentifierValidation';
 import {
   failStatus,
@@ -23,6 +24,7 @@ export function validateWorkspaceStatus(value: unknown): void {
   validateGenerationToken(status);
   validateWarmGraph(status);
   validateWarmSetStatus(status.warmSet);
+  validateContinuingOperations(status.continuingOperations);
 }
 
 function validateReloadTier(value: unknown): void {
@@ -40,3 +42,7 @@ function validateGenerationToken(status: Record<string, unknown>): void {
 function validateWarmGraph(status: Record<string, unknown>): void {
   if (status.warmSet !== undefined && status.graphInitialized !== true) failStatus('warmSet');
 }
+
+function validateContinuingOperations(value: unknown): void {
+  if (value !== undefined && !isDaemonContinuingOperations(value)) failStatus('continuingOperations');
+}
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index 070095ca9a..e3d91f2161 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -69,7 +69,7 @@ export type { IDaemonRequestStartedMessage, IDaemonRequestStartMessage } from '.
 export type { IDaemonRequestEnvelope, IDaemonRequestTerminal } from './DaemonRequestEnvelope';
 export type { DaemonInvocationKind } from './DaemonInvocationKind';
 export type { DaemonRequestAdmissionErrorCode } from './DaemonRequestAdmission';
-export type { IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
+export type { IDaemonContinuingOperations, IDaemonRequestAdmissionOptions } from './DaemonRequestAdmission';
 export type { IDaemonRequestQueuePositionMessage } from './DaemonRequestAdmission';
 export type { IDaemonNativeLockHolder } from './DaemonNativeLockHolder';
 export type { DaemonRushCommandOrigin } from './DaemonRushCommand';
diff --git a/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts b/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
new file mode 100644
index 0000000000..f3029a6500
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
@@ -0,0 +1,58 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+import { statusFrame, workspaceStatus } from './WorkspaceStatusTestData';
+
+const FIRST_POSITION: number = 1;
+const REQUEST_ID: string = 'waits-for-continuing-work';
+
+const WELL_FORMED: ReadonlyArray<unknown> = [
+  { count: 1, names: ['a (build)'] },
+  { count: 5, names: ['a (build)', 'b (build)', 'c (build)'] },
+  { count: 2, names: [] }
+];
+
+const MALFORMED: ReadonlyArray<unknown> = [
+  null,
+  [],
+  'a (build)',
+  { names: [] },
+  { count: 0, names: [] },
+  { count: 1.5, names: [] },
+  { count: '2', names: [] },
+  { count: 1 },
+  { count: 1, names: 'a (build)' },
+  { count: 1, names: ['a (build)', 'b (build)'] },
+  { count: 1, names: [''] },
+  { count: 1, names: [{ name: 'a (build)' }] }
+];
+
+function queuePositionFrame(continuingOperations: unknown): Uint8Array {
+  const payload: object = { position: FIRST_POSITION, requestId: REQUEST_ID, continuingOperations };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+function continuingStatusFrame(continuingOperations: unknown): Uint8Array {
+  return statusFrame({ ...workspaceStatus(), continuingOperations });
+}
+
+it.each(WELL_FORMED)('round-trips a queue position behind continuing operations %j', (value: unknown) => {
+  const frame: Uint8Array = queuePositionFrame(value);
+  expect(encodeDaemonControlMessage(decodeDaemonControlMessage(frame))).toEqual(frame);
+});
+
+it.each(WELL_FORMED)('round-trips a workspace status with continuing operations %j', (value: unknown) => {
+  const frame: Uint8Array = continuingStatusFrame(value);
+  expect(encodeDaemonControlMessage(decodeDaemonControlMessage(frame))).toEqual(frame);
+});
+
+it.each(MALFORMED)('rejects a queue position with malformed continuing operations %j', (value: unknown) => {
+  expect(() => decodeDaemonControlMessage(queuePositionFrame(value))).toThrow(/continuingOperations/);
+});
+
+it.each(MALFORMED)('rejects a workspace status with malformed continuing operations %j', (value: unknown) => {
+  expect(() => decodeDaemonControlMessage(continuingStatusFrame(value))).toThrow(/continuingOperations/);
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 07796f2be2..e3670f8618 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -558,6 +558,7 @@ the tier is not a command-success or successor-readiness signal. Older peers may
 | `generation`, `generationToken` | Provider generation counter and current installed session identity; neither implies a graph or successful build. |
 | `lastReloadTier` | Lifecycle-owned tier: `0` initial/reuse, `1` successful reload, `2` requested restart. |
 | `graphInitialized` | Whether that session has a materialized operation graph. |
+| `continuingOperations` | Present only while the running iteration runs just the operations that requests which already have their failed result left running (see below): how many are unfinished, and the first three of their names in name order. |
 | `warmSet` | Absent when no controller is attached, not a claim of zero memory. |
 | `warmSet.configuration` | The effective `watch` flag and four warm-resource knobs; older peers may omit `watch`. |
 | `maintenanceState`, `maintenanceFailure` | Running, quiescing, stopped, or failed maintenance; stopping maintenance alone does not free graph/watcher resources. |
@@ -691,6 +692,19 @@ to its stderr:
 `Request <id> joined the executing iteration after <n> ms.` or `Request <id> did not join the executing iteration
 after <n> ms: <reason>`.
 
+A `SHARED-BUILD` request that sets `returnEarlyOnFailure` (agent output does) gets its failed result as soon as nothing
+unfinished can change it. Its operations that the failure did not block keep running until the iteration ends, so that
+later requests find them done, and the request keeps its admission until then. While the iteration runs only such
+operations, each request that waits for the graph gets a queue position with `continuingOperations`: how many of them
+are unfinished, and the first three of their names in name order. It gets another position each time that number
+gets smaller, so it never names an operation that has ended. The workspace status reports the same field meanwhile.
+Neither field is present while any request still waits for the iteration's result. Before the daemon rejects a
+request as unsupported, so that its client runs the command in-process, it stops such operations and waits until they
+have stopped, unless the command is a Rushx script or a built-in command that only reads the workspace, such as
+`list`. If it stopped all of them while the client still waited, the second line of the rejection names them, for
+example `rushd stopped 2 operations left running by an earlier failed command (a (build), b (build)), so that this
+command can run in-process.` The client prints that line under its fallback line.
+
 The typed phased router remains separate from native initialization. `ProductionDaemonRequestResolver` supplies
 validated exact selections from `PhasedCommandEngine`; other integrations retain the existing dependency-closure
 selection mode by default. Native empty project selections are successful no-op requests.
diff --git a/libraries/rush-daemon/src/PhasedRequestEventSink.ts b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
index 18922aba37..50d3b73c74 100644
--- a/libraries/rush-daemon/src/PhasedRequestEventSink.ts
+++ b/libraries/rush-daemon/src/PhasedRequestEventSink.ts
@@ -177,6 +177,20 @@ export class PhasedRequestEventSink implements _IOperationGraphEventSink {
     return this.#scheduledResults.get(operation);
   }
 
+  /**
+   * The names of this client's operations, not counting silent ones, that the current iteration has not finished.
+   * The records' statuses change as the iteration runs, so this is current even after the client unsubscribed.
+   */
+  public getUnfinishedOperationNames(): string[] {
+    const names: string[] = [];
+    for (const record of this.#scheduledResults.values()) {
+      if (!record.silent && !TERMINAL_OPERATION_STATUSES.has(record.status)) {
+        names.push(record.operation.name);
+      }
+    }
+    return names;
+  }
+
   public flushAsync(): Promise<void> {
     return this.#writer.flushAsync();
   }
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index ea2e45bdd5..1f923b68c5 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -19,15 +19,14 @@ import { Sort } from '@rushstack/node-core-library';
 import type { ITerminal } from '@rushstack/terminal';
 import { findNativeLockHolder } from '@rushstack/rush-client-core';
 import type {
+  IDaemonContinuingOperations,
   IDaemonNativeLockHolder,
-  IDaemonPhasedEngineShape,
-  IDaemonPhasedOperationSelection,
   IDaemonPhasedRequest,
   IDaemonPhasedRequestResult,
   IDaemonTerminalPolicyResult
 } from '@rushstack/rush-daemon-protocol';
 
-import { PhasedRequestEventSink } from './PhasedRequestEventSink';
+import { PhasedRequestEventSink, TERMINAL_OPERATION_STATUSES } from './PhasedRequestEventSink';
 import { PhasedRequestEventMultiplexer } from './PhasedRequestEventMultiplexer';
 import { PhasedIterationDemand } from './PhasedIterationDemand';
 import {
@@ -37,6 +36,14 @@ import {
   PhasedIterationJoiner
 } from './PhasedIterationJoiner';
 import { writePhasedRequestSummaryAsync } from './PhasedRequestSummary';
+import {
+  collectSelectionClosure,
+  getTargetOperationIds,
+  indexOperations,
+  resolveSelection,
+  validateEngineShape,
+  validateNonemptyName
+} from './PhasedRequestSelection';
 import type { IPhasedRequestClient } from './PhasedRequestClient';
 import { writeRequestStartedAsync } from './RequestStartedNotice';
 import { DaemonRequiresInProcessError, evaluateDaemonTerminalPolicy } from './DaemonTerminalPolicy';
@@ -57,7 +64,6 @@ import {
   RequestAdmissionController
 } from './WorkspaceRequestAdmission';
 import { isNativeLockHeldByThisProcess } from './NativeRepositoryLock';
-import type { IWorkspaceEngineShape } from './WorkspaceEngineComponentFactory';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import {
   createPhasedCommandResult,
@@ -198,6 +204,11 @@ const IN_PROGRESS_STATUSES: ReadonlySet<string> = new Set<string>([
   OperationStatus.Queued,
   OperationStatus.Executing
 ]);
+/**
+ * How many of the operations that continue after an early result a queue position or the workspace status names;
+ * see `describeContinuingOperations`. Their count covers the rest.
+ */
+const MAX_CONTINUING_OPERATION_NAMES: number = 3;
 
 /**
  * Routes one caller-resolved phased request through a real warm workspace operation graph.
@@ -364,6 +375,8 @@ class PhasedRequestBatchCoordinator {
   #nextGraphLeasePromise: Promise<IRequestLease> | undefined;
   /** When the current batch's input reconcile started, or undefined before it starts. */
   #reconcileStartTimeMs: number | undefined;
+  /** How many operations that continue after an early result the waiting requests were last told of. */
+  #reportedContinuingOperationCount: number | undefined;
   #running: boolean = false;
 
   public constructor(
@@ -417,7 +430,8 @@ class PhasedRequestBatchCoordinator {
           : RequestExclusivityClass.Exclusive;
       const graphWaitLease: IRequestLease = await admissionController.acquireGraphExecutionAsync(
         this.#graphExecutionScheduler,
-        graphExclusivityClass
+        graphExclusivityClass,
+        () => this.describeContinuingOperations()
       );
       graphWaitLease.release();
     }
@@ -428,6 +442,28 @@ class PhasedRequestBatchCoordinator {
     return await resultPromise;
   }
 
+  /**
+   * Describes the operations that the running iteration still runs only for requests that already have their
+   * result (see `#finishFailedEntry`), or returns `undefined` if a request still waits for the iteration to produce
+   * its result, or if none of those operations is unfinished.
+   */
+  public describeContinuingOperations(): IDaemonContinuingOperations | undefined {
+    const participants: IBatchEntry[] = (this.#currentBatch ?? []).filter((entry: IBatchEntry) =>
+      this.#needsIteration(entry)
+    );
+    if (!participants.every((entry: IBatchEntry) => entry.continuesAfterResult)) {
+      return undefined;
+    }
+    const names: Set<string> = new Set(
+      participants.flatMap((entry: IBatchEntry) => entry.requestSink?.getUnfinishedOperationNames() ?? [])
+    );
+    if (names.size === 0) {
+      return undefined;
+    }
+    const sortedNames: string[] = Array.from(names).sort(Sort.compareByValue);
+    return { count: sortedNames.length, names: sortedNames.slice(0, MAX_CONTINUING_OPERATION_NAMES) };
+  }
+
   #scheduleDrain(): void {
     if (this.#running || this.#drainScheduled) {
       return;
@@ -612,6 +648,17 @@ class PhasedRequestBatchCoordinator {
       const demand: PhasedIterationDemand = new PhasedIterationDemand(() => this.#onBatchAbandoned(demand));
       this.#batchDemand = demand;
       const unsubscribeDemand: () => void = this.#multiplexer.subscribe(demand);
+      this.#reportedContinuingOperationCount = undefined;
+      const unsubscribeContinuing: () => void = this.#multiplexer.subscribe({
+        onIterationScheduled(): void {
+          // describeContinuingOperations reads the records from the participants' sinks.
+        },
+        onOperationStatusChanged: (record: IOperationExecutionResult): void => {
+          if (!record.silent && TERMINAL_OPERATION_STATUSES.has(record.status)) {
+            this.#reportContinuingOperations();
+          }
+        }
+      });
       for (const entry of participants) {
         entry.participated = true;
         entry.batchTimings = timings;
@@ -682,6 +729,7 @@ class PhasedRequestBatchCoordinator {
         unsubscribeJoinable?.();
         this.#batchDemand = undefined;
         unsubscribeDemand();
+        unsubscribeContinuing();
         for (const entry of participants) {
           entry.unsubscribe?.();
           entry.unsubscribe = undefined;
@@ -797,6 +845,28 @@ class PhasedRequestBatchCoordinator {
         entry.reject(error);
       }
     });
+    this.#reportContinuingOperations();
+  }
+
+  /**
+   * Tells the requests that wait for the graph which operations they wait for, whenever the number of those
+   * operations changed: once the iteration runs only for entries that already have their result (see
+   * `describeContinuingOperations`), and again each time one of those operations ends, so that no waiting request
+   * is left naming an operation that has finished. A request that starts to wait later is told when it does.
+   *
+   * @remarks
+   * From the moment every entry that needs the iteration continues after its result, no entry can start to continue,
+   * so the set of those operations only shrinks, and its size tells whether it changed.
+   */
+  #reportContinuingOperations(): void {
+    const count: number | undefined = this.describeContinuingOperations()?.count;
+    if (count === this.#reportedContinuingOperationCount) {
+      return;
+    }
+    this.#reportedContinuingOperationCount = count;
+    if (count !== undefined) {
+      this.#graphExecutionScheduler.notifyQueuePositions();
+    }
   }
 
   /**
@@ -920,6 +990,7 @@ class PhasedRequestBatchCoordinator {
         this.#settleEntry(entry, () => entry.reject(error));
       }
     });
+    this.#reportContinuingOperations();
   }
 
   async #produceEarlyResultAsync(entry: IBatchEntry, report: OperationReport): Promise<void> {
@@ -1388,6 +1459,18 @@ export function setPauseNextIteration(graph: IOperationGraph, pauseNextIteration
   graph.pauseNextIteration = pauseNextIteration;
 }
 
+/**
+ * Describes the operations that the workspace session's graph still runs only for requests that already have their
+ * result, such as the independent operations of a failed build that returned early, or returns `undefined` if there
+ * are none, or if a request still waits for the graph's running iteration to produce its result. It never waits.
+ */
+export function describeContinuingOperations(
+  workspaceSession: IWorkspaceSession
+): IDaemonContinuingOperations | undefined {
+  const graph: IOperationGraph | undefined = workspaceSession.operationGraph;
+  return graph ? ROUTING_STATE_BY_GRAPH.get(graph)?.coordinator.describeContinuingOperations() : undefined;
+}
+
 function getGraphRoutingState(
   graph: IDualEmitOperationGraph,
   workspaceSession: IWorkspaceSession
@@ -1578,138 +1661,6 @@ function createOperationParticipantLookups(
   };
 }
 
-function validateNonemptyName(value: string, kind: string): void {
-  if (value.length === 0 || value.trim() !== value) {
-    throw new Error(`Invalid phased request ${kind}: "${value}".`);
-  }
-}
-
-function validateEngineShape(
-  requestShape: IDaemonPhasedEngineShape,
-  workspaceShape: IWorkspaceEngineShape | undefined
-): void {
-  if (!workspaceShape) {
-    throw new Error('The workspace session does not declare a reusable engine shape.');
-  }
-  validateNameSet(requestShape.phaseNames, workspaceShape.phaseNames, 'phase');
-  validateNameSet(requestShape.pluginNames, workspaceShape.pluginNames, 'plugin');
-}
-
-function validateNameSet(
-  requestedNames: ReadonlyArray<string>,
-  workspaceNames: ReadonlyArray<string>,
-  kind: string
-): void {
-  const requested: Set<string> = new Set(requestedNames);
-  if (
-    requested.size !== requestedNames.length ||
-    requested.size !== workspaceNames.length ||
-    workspaceNames.some((name: string) => !requested.has(name))
-  ) {
-    throw new Error(`The phased request ${kind} shape does not match the warm workspace engine.`);
-  }
-}
-
-function indexOperations(operations: ReadonlySet<Operation>): ReadonlyMap<string, Operation> {
-  const operationById: Map<string, Operation> = new Map();
-  for (const operation of operations) {
-    const operationId: string = operation.name;
-    if (operationById.has(operationId)) {
-      throw new Error(`The workspace graph contains duplicate operation id "${operationId}".`);
-    }
-    operationById.set(operationId, operation);
-  }
-  return operationById;
-}
-
-function resolveSelection(
-  requestedSelection: ReadonlyArray<IDaemonPhasedOperationSelection>,
-  operationById: ReadonlyMap<string, Operation>,
-  exact: boolean
-): IResolvedSelection {
-  if (!exact && requestedSelection.length === 0) {
-    throw new Error('A phased request must select at least one operation.');
-  }
-  const selectedIds: Set<string> = new Set();
-  const enabledOperations: Operation[] = [];
-  const ignoreDependencyOperations: Operation[] = [];
-  for (const selection of requestedSelection) {
-    validateNonemptyName(selection.operationId, 'operation id');
-    if (selectedIds.has(selection.operationId)) {
-      throw new Error(`Duplicate phased request operation id "${selection.operationId}".`);
-    }
-    selectedIds.add(selection.operationId);
-    const operation: Operation | undefined = operationById.get(selection.operationId);
-    if (!operation) {
-      throw new Error(`Unknown phased request operation id "${selection.operationId}".`);
-    }
-    addSelectedOperation(selection.enabledState, operation, enabledOperations, ignoreDependencyOperations);
-  }
-  return {
-    activeOperations: exact
-      ? [...enabledOperations, ...ignoreDependencyOperations]
-      : collectSelectionClosure(enabledOperations, ignoreDependencyOperations),
-    enabledOperations,
-    ignoreDependencyOperations,
-    exact
-  };
-}
-
-function addSelectedOperation(
-  enabledState: unknown,
-  operation: Operation,
-  enabledOperations: Operation[],
-  ignoreDependencyOperations: Operation[]
-): void {
-  if (enabledState === true) {
-    enabledOperations.push(operation);
-  } else if (enabledState === 'ignore-dependency-changes') {
-    ignoreDependencyOperations.push(operation);
-  } else {
-    throw new Error(`Invalid phased request enabled state: "${String(enabledState)}".`);
-  }
-}
-
-function collectSelectionClosure(
-  enabledOperations: ReadonlyArray<Operation>,
-  ignoreDependencyOperations: ReadonlyArray<Operation>
-): ReadonlyArray<Operation> {
-  const activeOperations: Set<Operation> = new Set([...enabledOperations, ...ignoreDependencyOperations]);
-  for (const operation of activeOperations) {
-    for (const dependency of operation.dependencies) {
-      activeOperations.add(dependency);
-    }
-  }
-  return Array.from(activeOperations);
-}
-
-/**
- * The operations whose results decide a request's outcome: those of the selected projects that no other selected
- * project consumes, such as the projects named by `--to`. The other selected operations only feed them.
- *
- * @remarks
- * Projects rather than operations are compared, because an operation that nothing consumes, such as the last
- * phase of a dependency, still only serves a consuming project's request.
- */
-function getTargetOperationIds(activeOperations: ReadonlyArray<Operation>): ReadonlySet<string> {
-  const active: ReadonlySet<Operation> = new Set(activeOperations);
-  const consumedProjects: Set<Operation['associatedProject']> = new Set();
-  for (const consumer of activeOperations) {
-    for (const dependency of consumer.dependencies) {
-      if (active.has(dependency) && dependency.associatedProject !== consumer.associatedProject) {
-        consumedProjects.add(dependency.associatedProject);
-      }
-    }
-  }
-  const targetOperationIds: Set<string> = new Set();
-  for (const operation of activeOperations) {
-    if (!consumedProjects.has(operation.associatedProject)) {
-      targetOperationIds.add(operation.name);
-    }
-  }
-  return targetOperationIds;
-}
-
 /** Presentation/scheduling settings are request-scoped, so they are applied per iteration, not per graph. */
 function applyRequestSettings(
   graph: IOperationGraph,
diff --git a/libraries/rush-daemon/src/PhasedRequestSelection.ts b/libraries/rush-daemon/src/PhasedRequestSelection.ts
new file mode 100644
index 0000000000..baaf5b343d
--- /dev/null
+++ b/libraries/rush-daemon/src/PhasedRequestSelection.ts
@@ -0,0 +1,143 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { Operation } from '@microsoft/rush-lib';
+import type {
+  IDaemonPhasedEngineShape,
+  IDaemonPhasedOperationSelection
+} from '@rushstack/rush-daemon-protocol';
+
+import type { IResolvedSelection } from './PhasedRequestRouter';
+import type { IWorkspaceEngineShape } from './WorkspaceEngineComponentFactory';
+
+export function validateNonemptyName(value: string, kind: string): void {
+  if (value.length === 0 || value.trim() !== value) {
+    throw new Error(`Invalid phased request ${kind}: "${value}".`);
+  }
+}
+
+export function validateEngineShape(
+  requestShape: IDaemonPhasedEngineShape,
+  workspaceShape: IWorkspaceEngineShape | undefined
+): void {
+  if (!workspaceShape) {
+    throw new Error('The workspace session does not declare a reusable engine shape.');
+  }
+  validateNameSet(requestShape.phaseNames, workspaceShape.phaseNames, 'phase');
+  validateNameSet(requestShape.pluginNames, workspaceShape.pluginNames, 'plugin');
+}
+
+function validateNameSet(
+  requestedNames: ReadonlyArray<string>,
+  workspaceNames: ReadonlyArray<string>,
+  kind: string
+): void {
+  const requested: Set<string> = new Set(requestedNames);
+  if (
+    requested.size !== requestedNames.length ||
+    requested.size !== workspaceNames.length ||
+    workspaceNames.some((name: string) => !requested.has(name))
+  ) {
+    throw new Error(`The phased request ${kind} shape does not match the warm workspace engine.`);
+  }
+}
+
+export function indexOperations(operations: ReadonlySet<Operation>): ReadonlyMap<string, Operation> {
+  const operationById: Map<string, Operation> = new Map();
+  for (const operation of operations) {
+    const operationId: string = operation.name;
+    if (operationById.has(operationId)) {
+      throw new Error(`The workspace graph contains duplicate operation id "${operationId}".`);
+    }
+    operationById.set(operationId, operation);
+  }
+  return operationById;
+}
+
+export function resolveSelection(
+  requestedSelection: ReadonlyArray<IDaemonPhasedOperationSelection>,
+  operationById: ReadonlyMap<string, Operation>,
+  exact: boolean
+): IResolvedSelection {
+  if (!exact && requestedSelection.length === 0) {
+    throw new Error('A phased request must select at least one operation.');
+  }
+  const selectedIds: Set<string> = new Set();
+  const enabledOperations: Operation[] = [];
+  const ignoreDependencyOperations: Operation[] = [];
+  for (const selection of requestedSelection) {
+    validateNonemptyName(selection.operationId, 'operation id');
+    if (selectedIds.has(selection.operationId)) {
+      throw new Error(`Duplicate phased request operation id "${selection.operationId}".`);
+    }
+    selectedIds.add(selection.operationId);
+    const operation: Operation | undefined = operationById.get(selection.operationId);
+    if (!operation) {
+      throw new Error(`Unknown phased request operation id "${selection.operationId}".`);
+    }
+    addSelectedOperation(selection.enabledState, operation, enabledOperations, ignoreDependencyOperations);
+  }
+  return {
+    activeOperations: exact
+      ? [...enabledOperations, ...ignoreDependencyOperations]
+      : collectSelectionClosure(enabledOperations, ignoreDependencyOperations),
+    enabledOperations,
+    ignoreDependencyOperations,
+    exact
+  };
+}
+
+function addSelectedOperation(
+  enabledState: unknown,
+  operation: Operation,
+  enabledOperations: Operation[],
+  ignoreDependencyOperations: Operation[]
+): void {
+  if (enabledState === true) {
+    enabledOperations.push(operation);
+  } else if (enabledState === 'ignore-dependency-changes') {
+    ignoreDependencyOperations.push(operation);
+  } else {
+    throw new Error(`Invalid phased request enabled state: "${String(enabledState)}".`);
+  }
+}
+
+export function collectSelectionClosure(
+  enabledOperations: ReadonlyArray<Operation>,
+  ignoreDependencyOperations: ReadonlyArray<Operation>
+): ReadonlyArray<Operation> {
+  const activeOperations: Set<Operation> = new Set([...enabledOperations, ...ignoreDependencyOperations]);
+  for (const operation of activeOperations) {
+    for (const dependency of operation.dependencies) {
+      activeOperations.add(dependency);
+    }
+  }
+  return Array.from(activeOperations);
+}
+
+/**
+ * The operations whose results decide a request's outcome: those of the selected projects that no other selected
+ * project consumes, such as the projects named by `--to`. The other selected operations only feed them.
+ *
+ * @remarks
+ * Projects rather than operations are compared, because an operation that nothing consumes, such as the last
+ * phase of a dependency, still only serves a consuming project's request.
+ */
+export function getTargetOperationIds(activeOperations: ReadonlyArray<Operation>): ReadonlySet<string> {
+  const active: ReadonlySet<Operation> = new Set(activeOperations);
+  const consumedProjects: Set<Operation['associatedProject']> = new Set();
+  for (const consumer of activeOperations) {
+    for (const dependency of consumer.dependencies) {
+      if (active.has(dependency) && dependency.associatedProject !== consumer.associatedProject) {
+        consumedProjects.add(dependency.associatedProject);
+      }
+    }
+  }
+  const targetOperationIds: Set<string> = new Set();
+  for (const operation of activeOperations) {
+    if (!consumedProjects.has(operation.associatedProject)) {
+      targetOperationIds.add(operation.name);
+    }
+  }
+  return targetOperationIds;
+}
diff --git a/libraries/rush-daemon/src/RequestScheduler.ts b/libraries/rush-daemon/src/RequestScheduler.ts
index 198b38a67e..300ed02fd0 100644
--- a/libraries/rush-daemon/src/RequestScheduler.ts
+++ b/libraries/rush-daemon/src/RequestScheduler.ts
@@ -188,6 +188,14 @@ export class RequestScheduler {
     return Promise.all(releases).then(() => undefined);
   }
 
+  /**
+   * Reports every queued request's position to it again, as when the queue changes, for a caller whose reports say
+   * more than the position, such as what the queue waits for, when that changed.
+   */
+  public notifyQueuePositions(): void {
+    this.#notifyQueuePositions();
+  }
+
   /**
    * The number of requests currently waiting for admission.
    */
diff --git a/libraries/rush-daemon/src/StoppedContinuingOperations.ts b/libraries/rush-daemon/src/StoppedContinuingOperations.ts
new file mode 100644
index 0000000000..c08c5e246c
--- /dev/null
+++ b/libraries/rush-daemon/src/StoppedContinuingOperations.ts
@@ -0,0 +1,34 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonContinuingOperations } from '@rushstack/rush-daemon-protocol';
+
+import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
+
+/**
+ * Adds to the rejection of a request whose client then runs the command in-process a line that says that the daemon
+ * first stopped the operations that an earlier failed command left running (see `describeContinuingOperations`).
+ * The line follows the rejection's first line, which the client prints as its fallback line, and precedes the others.
+ */
+export function addStoppedContinuingOperations(
+  rejection: DaemonRequestDispatchError,
+  stopped: IDaemonContinuingOperations
+): DaemonRequestDispatchError {
+  const lines: string[] = rejection.message.split('\n');
+  const firstLineIndex: number = lines.findIndex((line: string) => line.trim() !== '');
+  lines.splice(firstLineIndex + 1, 0, formatStoppedContinuingOperations(stopped));
+  return new DaemonRequestDispatchError(rejection.code, lines.join('\n'), { cause: rejection });
+}
+
+/**
+ * Formats that line, for example "rushd stopped 5 operations left running by an earlier failed command (a, b, c
+ * +2 more), so that this command can run in-process.", where the count says how many are not named.
+ */
+export function formatStoppedContinuingOperations({ count, names }: IDaemonContinuingOperations): string {
+  const more: number = count - names.length;
+  const named: string = names.length > 0 ? ` (${names.join(', ')}${more > 0 ? ` +${more} more` : ''})` : '';
+  return (
+    `rushd stopped ${count} ${count === 1 ? 'operation' : 'operations'} left running by an earlier failed ` +
+    `command${named}, so that this command can run in-process.`
+  );
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index bc76d437c7..52cb1a64d6 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -8,6 +8,7 @@ import {
 import type {
   DaemonRequestAdmissionErrorCode,
   DaemonRestartReason,
+  IDaemonContinuingOperations,
   IDaemonNativeLockHolder,
   IDaemonRequestAdmissionOptions,
   IDaemonRequestQueuePositionMessage
@@ -278,6 +279,21 @@ class QueuePositionWriter {
     });
   }
 
+  /**
+   * Reports a wait for the graph's running iteration, and with `continuingOperations`, that the iteration still runs
+   * only operations that requests which already have their result left running.
+   */
+  public enqueueGraphWait(
+    position: number,
+    continuingOperations: IDaemonContinuingOperations | undefined
+  ): void {
+    this.#enqueuePayload({
+      position,
+      requestId: this.#requestId,
+      ...(continuingOperations && { continuingOperations })
+    });
+  }
+
   /**
    * Reports a wait for the rushx scripts that the daemon runs to exit, as a position that counts them. With a
    * `restartReason`, the daemon then restarts for it. Without one, the request runs once they exit, and then restarts
@@ -492,10 +508,15 @@ export class RequestAdmissionController {
    * A shared-build request that reaches this gate is only waiting behind running compatible shared builds, which is
    * progress rather than contention. A client-default timeout therefore does not apply to that wait; an explicit
    * `noWait` or `waitTimeoutMs` still applies, using the request's remaining admission budget.
+   *
+   * Each queue position carries what `describeContinuingOperations` returns when it is reported: the operations that
+   * the running iteration still runs only for requests that already have their result, if the request waits only
+   * for those.
    */
   public async acquireGraphExecutionAsync(
     scheduler: RequestScheduler,
-    exclusivityClass: RequestExclusivityClass
+    exclusivityClass: RequestExclusivityClass,
+    describeContinuingOperations: () => IDaemonContinuingOperations | undefined = () => undefined
   ): Promise<IRequestLease> {
     const waitTimeoutMs: number | undefined =
       exclusivityClass === RequestExclusivityClass.SharedBuild && this.#admission?.waitTimeoutIsDefault
@@ -505,7 +526,10 @@ export class RequestAdmissionController {
       scheduler,
       exclusivityClass,
       waitTimeoutMs,
-      'the running build of the workspace operation graph'
+      'the running build of the workspace operation graph',
+      this.#abortController.signal,
+      (writer: QueuePositionWriter, position: number) =>
+        writer.enqueueGraphWait(position, describeContinuingOperations())
     );
   }
 
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index f203971ca4..e0d8978396 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -22,6 +22,7 @@ import { findNativeLockHolder } from '@rushstack/rush-client-core';
 import type {
   DaemonRestartReason,
   IDaemonCommandResult,
+  IDaemonContinuingOperations,
   IDaemonEnvironmentChangedRestartReason,
   IDaemonInstallationChange,
   IDaemonRequestEnvelope
@@ -79,6 +80,8 @@ import {
   type IWorkspaceRestartTicket
 } from './WorkspaceRestartArbiter';
 import { classifyRushCommand } from './RushCommandRequestPolicy';
+import { describeContinuingOperations } from './PhasedRequestRouter';
+import { addStoppedContinuingOperations } from './StoppedContinuingOperations';
 import { FreshCaptureCoalescer } from './FreshCaptureCoalescer';
 import type { CheckDaemonInstallation } from './DaemonInstallationMonitor';
 import {
@@ -455,7 +458,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             // The client runs this command in-process instead. Work that finished requests continue would run
             // alongside it, like two Rush commands in one checkout.
             generation?.lease.release();
-            await this.#stopContinuingWorkAsync(client.abortSignal);
+            throw await this.#stopContinuingWorkBeforeFallbackAsync(error, client.abortSignal);
           }
           throw error;
         } finally {
@@ -508,6 +511,27 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Stops the work that finished requests continue before the client of `rejection` runs its command in-process, and
+   * returns the rejection to send. If that stopped all of the operations that an earlier failed command left running,
+   * and the client still waits, the rejection names them.
+   */
+  async #stopContinuingWorkBeforeFallbackAsync(
+    rejection: DaemonRequestDispatchError,
+    abortSignal: AbortSignal
+  ): Promise<DaemonRequestDispatchError> {
+    const session: IWorkspaceSession | undefined = this.#options.provider.currentSession;
+    const continuing: IDaemonContinuingOperations | undefined =
+      session && describeContinuingOperations(session);
+    await this.#stopContinuingWorkAsync(abortSignal);
+    // No line if the client left before the work stopped, or if work continues that could not be stopped, such as
+    // that of a request which has not yet yielded its lease (see `#yieldAfterResult`).
+    if (!session || !continuing || abortSignal.aborted || describeContinuingOperations(session)) {
+      return rejection;
+    }
+    return addStoppedContinuingOperations(rejection, continuing);
+  }
+
   async #prepareAsync(
     envelope: IDaemonRequestEnvelope,
     client: IDaemonRequestDispatchClient,
diff --git a/libraries/rush-daemon/src/WorkspaceStatus.ts b/libraries/rush-daemon/src/WorkspaceStatus.ts
index 13938c4924..5f032b2dd4 100644
--- a/libraries/rush-daemon/src/WorkspaceStatus.ts
+++ b/libraries/rush-daemon/src/WorkspaceStatus.ts
@@ -4,12 +4,14 @@
 import type { WorkspaceInputChangeTier } from '@microsoft/rush-lib';
 import type { IDaemonWorkspaceStatus } from '@rushstack/rush-daemon-protocol';
 
+import { describeContinuingOperations } from './PhasedRequestRouter';
 import type { IWorkspaceSession } from './WorkspaceSession';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 
 /**
  * Status must never initialize a cold graph or wait behind reload/execution leases. With `omitWarmSet`, it leaves
- * the warm set out without reading it, for a ping that only proves the daemon ready.
+ * the warm set out without reading it, for a ping that only proves the daemon ready. It includes the operations that
+ * the graph still runs only for requests that already have their result; see `describeContinuingOperations`.
  */
 export function getWorkspaceStatus(
   provider: WorkspaceSessionProvider,
@@ -22,6 +24,7 @@ export function getWorkspaceStatus(
     lastReloadTier,
     generationToken: provider.currentGenerationToken,
     graphInitialized: session?.operationGraph !== undefined,
-    warmSet: omitWarmSet ? undefined : session?.warmSetStatus
+    warmSet: omitWarmSet ? undefined : session?.warmSetStatus,
+    continuingOperations: session ? describeContinuingOperations(session) : undefined
   };
 }
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
index 27bdbd12b5..a11d0b54c4 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -1,12 +1,21 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import type { IDaemonPhasedRequest, IDaemonPhasedRequestResult } from '@rushstack/rush-daemon-protocol';
+import type {
+  IDaemonContinuingOperations,
+  IDaemonPhasedRequest,
+  IDaemonPhasedRequestResult,
+  IDaemonRequestQueuePositionMessage,
+  IDaemonWorkspaceStatus
+} from '@rushstack/rush-daemon-protocol';
 import { type IOperationRunnerContext, OperationStatus } from '@microsoft/rush-lib';
 import type { ITerminal } from '@rushstack/terminal';
 
-import { PhasedRequestRouter } from '../PhasedRequestRouter';
+import { PhasedRequestRouter, describeContinuingOperations } from '../PhasedRequestRouter';
 import type { IPhasedRequestTelemetryReport, IPhasedRequestTelemetrySink } from '../PhasedRequestTelemetry';
+import type { IWorkspaceSession } from '../WorkspaceSession';
+import type { WorkspaceSessionProvider } from '../WorkspaceSessionProvider';
+import { getWorkspaceStatus } from '../WorkspaceStatus';
 import {
   TEST_ENGINE_SHAPE,
   TestOperationRunner,
@@ -81,13 +90,14 @@ class SilentTestOperationRunner extends TestOperationRunner {
  * B fails and C is slow. Unless `failBeforeCStarts` is set, B fails only once C runs, so C is executing when B's
  * failure decides a request's result. If `silentC` is set, C is silent. If `terminable` is set, the graph can
  * terminate running operations, and C stops with `Aborted` when it does, as a runner that kills its process does.
- * If `dependencies` names D, D succeeds as soon as it runs.
+ * If `dependencies` names D, D succeeds as soon as it runs. If `bFailsWhen` is given, B fails only once it resolves.
  */
 function createEarlyFailureFixture(
   dependencies: ReadonlyArray<readonly [string, string]> = A_CONSUMES_B_AND_C,
   failBeforeCStarts: boolean = false,
   silentC: boolean = false,
-  terminable: boolean = false
+  terminable: boolean = false,
+  bFailsWhen?: Promise<void>
 ): IEarlyFailureFixture {
   const startedC: IDeferred = createDeferred();
   const releaseC: IDeferred = createDeferred();
@@ -100,6 +110,9 @@ function createEarlyFailureFixture(
         if (!failBeforeCStarts) {
           await startedC.promise;
         }
+        if (bFailsWhen) {
+          await bFailsWhen;
+        }
       })
     ],
     [
@@ -193,6 +206,35 @@ function getWrittenResults(client: TestPhasedRequestClient): ReadonlyArray<IDaem
   return client.writes.flatMap(({ result }: ITestClientWrite) => (result ? [result] : []));
 }
 
+function getQueuePositions(
+  client: TestPhasedRequestClient
+): ReadonlyArray<IDaemonRequestQueuePositionMessage['payload']> {
+  return client.writes.flatMap(({ queuePosition }: ITestClientWrite) =>
+    queuePosition ? [queuePosition.payload] : []
+  );
+}
+
+/** Resolves once the client's result was written. */
+function whenResultWritten(client: TestPhasedRequestClient): Promise<void> {
+  return new Promise((resolve) => {
+    client.onWriteAsync = async (write: ITestClientWrite): Promise<void> => {
+      if (write.result) {
+        resolve();
+      }
+    };
+  });
+}
+
+/** The workspace status that `daemon status` reports while `session` is the installed workspace session. */
+function getSessionStatus(session: IWorkspaceSession): IDaemonWorkspaceStatus {
+  const provider: Partial<WorkspaceSessionProvider> = {
+    currentGenerationToken: 'generation-token',
+    currentSession: session,
+    generation: 1
+  };
+  return getWorkspaceStatus(provider as WorkspaceSessionProvider);
+}
+
 /** Records the telemetry reports of a request, and when each was logged. */
 function recordTelemetry(
   label: string,
@@ -566,3 +608,289 @@ describe('phased requests that return early on failure', () => {
     ).rejects.toThrow('Phased request returnEarlyOnFailure must be a boolean value.');
   });
 });
+
+describe('the operations that continue after an early result', () => {
+  const continuingC: IDaemonContinuingOperations = { count: 1, names: [OPERATION_C] };
+
+  it('are named to a later build that waits only for them', async () => {
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await agent.written;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('later', false, OPERATION_C),
+      later
+    );
+    await settleAsync();
+
+    expect(getQueuePositions(later)).toEqual([
+      { position: 1, requestId: 'later', continuingOperations: continuingC }
+    ]);
+    setup.releaseC();
+    await Promise.all([agentPromise, laterPromise]);
+    expect(getQueuePositions(later)).toHaveLength(1);
+  });
+
+  it('are named again to a build that already waited when the failed build returned early', async () => {
+    const failB: IDeferred = createDeferred();
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+      A_CONSUMES_B_AND_C,
+      false,
+      false,
+      false,
+      failB.promise
+    );
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await setup.startedC;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('later', false, OPERATION_C),
+      later
+    );
+    await settleAsync();
+    // The failed build still waits for its result, so the later build waits for another request.
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }]);
+
+    failB.resolve();
+    await agent.written;
+    await settleAsync();
+    expect(getQueuePositions(later)).toEqual([
+      { position: 1, requestId: 'later' },
+      { position: 1, requestId: 'later', continuingOperations: continuingC }
+    ]);
+    setup.releaseC();
+    await Promise.all([agentPromise, laterPromise]);
+    expect(getQueuePositions(later)).toHaveLength(2);
+  });
+
+  it('are named to a waiting build once the last participant that waited for its result leaves', async () => {
+    const failB: IDeferred = createDeferred();
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+      A_CONSUMES_B_AND_C,
+      false,
+      false,
+      false,
+      failB.promise
+    );
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const departing: TestPhasedRequestClient = new TestPhasedRequestClient('departing');
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    const departingPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('departing', false, OPERATION_C),
+      departing
+    );
+    await setup.startedC;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('later', false, OPERATION_C),
+      later
+    );
+    await settleAsync();
+    failB.resolve();
+    await agent.written;
+    await settleAsync();
+    // The departing participant still waits for C, so the later build still waits for another request.
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }]);
+
+    departing.abortController.abort();
+    await departingPromise;
+    await settleAsync();
+    expect(getQueuePositions(later)).toEqual([
+      { position: 1, requestId: 'later' },
+      { position: 1, requestId: 'later', continuingOperations: continuingC }
+    ]);
+    setup.releaseC();
+    await Promise.all([agentPromise, laterPromise]);
+  });
+
+  it('are in the workspace status only while no request waits for the iteration', async () => {
+    const failB: IDeferred = createDeferred();
+    const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+      A_CONSUMES_B_AND_C,
+      false,
+      false,
+      false,
+      failB.promise
+    );
+    const { session } = setup.fixture;
+    expect(describeContinuingOperations(session)).toBeUndefined();
+    const agent: ITrackedClient = trackClient('agent', setup);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+      createRequest('agent', true, OPERATION_A),
+      agent.client
+    );
+    await setup.startedC;
+    await settleAsync();
+    expect(getSessionStatus(session).continuingOperations).toBeUndefined();
+
+    failB.resolve();
+    await agent.written;
+    await settleAsync();
+    expect(getSessionStatus(session)).toMatchObject({ continuingOperations: continuingC });
+
+    setup.releaseC();
+    await agentPromise;
+    expect(getSessionStatus(session).continuingOperations).toBeUndefined();
+  });
+
+  it('are counted across the requests that left them running, and the first three are named in name order', async () => {
+    const release: IDeferred = createDeferred();
+    const [operationA1, operationA2, operationV, operationW, operationX, operationY, operationZ] = [
+      'a1',
+      'a2',
+      'v',
+      'w',
+      'x',
+      'y',
+      'z'
+    ].map((name: string) => `project-${name} (_phase:test)`);
+    const slow = (): Promise<void> => release.promise;
+    const runners: Map<string, TestOperationRunner> = new Map([
+      [operationA1, new TestOperationRunner(operationA1)],
+      [operationA2, new TestOperationRunner(operationA2)],
+      [OPERATION_B, new TestOperationRunner(OPERATION_B, OperationStatus.Failure)],
+      [operationV, new SilentTestOperationRunner(operationV, OperationStatus.Success, slow)],
+      ...[operationW, operationX, operationY, operationZ].map((name: string): [string, TestOperationRunner] => [
+        name,
+        new TestOperationRunner(name, OperationStatus.Success, slow)
+      ])
+    ]);
+    // The first build leaves V, X and Z running, and the second W and Y; V is silent.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      runners,
+      [
+        ...[OPERATION_B, operationV, operationX, operationZ].map(
+          (name: string): readonly [string, string] => [operationA1, name]
+        ),
+        ...[OPERATION_B, operationW, operationY].map((name: string): readonly [string, string] => [
+          operationA2,
+          name
+        ])
+      ],
+      { parallelism: runners.size }
+    );
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const first: TestPhasedRequestClient = new TestPhasedRequestClient('first');
+    const second: TestPhasedRequestClient = new TestPhasedRequestClient('second');
+    const written: Promise<void[]> = Promise.all([whenResultWritten(first), whenResultWritten(second)]);
+    const resultPromises: Promise<IDaemonPhasedRequestResult>[] = [
+      router.executeAsync(createRequest('first', true, operationA1), first),
+      router.executeAsync(createRequest('second', true, operationA2), second)
+    ];
+    await written;
+    await settleAsync();
+
+    expect(describeContinuingOperations(fixture.session)).toEqual({
+      count: 4,
+      names: [operationW, operationX, operationY]
+    });
+    release.resolve();
+    await Promise.all(resultPromises);
+    expect(describeContinuingOperations(fixture.session)).toBeUndefined();
+  });
+
+  it('are named again, without the ones that ended, each time their number gets smaller', async () => {
+    const [operationE, operationF, operationU, operationX, operationY] = ['e', 'f', 'u', 'x', 'y'].map(
+      (name: string) => `project-${name} (_phase:test)`
+    );
+    const [startedU, startedX, startedY, releaseU, releaseX, releaseY] = [1, 2, 3, 4, 5, 6].map(() =>
+      createDeferred()
+    );
+    const ended: string[] = [];
+    const slow = (name: string, started: IDeferred, release: IDeferred): TestOperationRunner =>
+      new TestOperationRunner(name, OperationStatus.Success, async (): Promise<void> => {
+        started.resolve();
+        await release.promise;
+        ended.push(name);
+      });
+    const runners: Map<string, TestOperationRunner> = new Map([
+      [operationE, new TestOperationRunner(operationE)],
+      [operationF, new TestOperationRunner(operationF)],
+      [
+        OPERATION_B,
+        new TestOperationRunner(OPERATION_B, OperationStatus.Failure, async (): Promise<void> => {
+          await Promise.all([startedU.promise, startedX.promise, startedY.promise]);
+        })
+      ],
+      [operationU, slow(operationU, startedU, releaseU)],
+      [operationX, slow(operationX, startedX, releaseX)],
+      [operationY, slow(operationY, startedY, releaseY)]
+    ]);
+    // The failed build leaves X and Y running. U runs only for the request that leaves, and F waits for U.
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      runners,
+      [
+        [operationE, OPERATION_B],
+        [operationE, operationX],
+        [operationE, operationY],
+        [operationF, operationU]
+      ],
+      { parallelism: runners.size }
+    );
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const agent: TestPhasedRequestClient = new TestPhasedRequestClient('agent');
+    const departing: TestPhasedRequestClient = new TestPhasedRequestClient('departing');
+    const agentWritten: Promise<void> = whenResultWritten(agent);
+    const agentPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('agent', true, operationE),
+      agent
+    );
+    const departingPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('departing', false, operationF),
+      departing
+    );
+    await agentWritten;
+    await settleAsync();
+    const later: TestPhasedRequestClient = new TestPhasedRequestClient('later');
+    const laterPromise: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('later', false, operationX),
+      later
+    );
+    await settleAsync();
+    departing.abortController.abort();
+    await departingPromise;
+    await settleAsync();
+    const bothRun: IDaemonRequestQueuePositionMessage['payload'] = {
+      position: 1,
+      requestId: 'later',
+      continuingOperations: { count: 2, names: [operationX, operationY] }
+    };
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun]);
+
+    // U ends, but the failed build didn't leave it running, so the later build waits for the same operations.
+    releaseU.resolve();
+    await settleAsync();
+    expect(ended).toEqual([operationU]);
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun]);
+
+    releaseX.resolve();
+    await settleAsync();
+    const yRuns: IDaemonRequestQueuePositionMessage['payload'] = {
+      position: 1,
+      requestId: 'later',
+      continuingOperations: { count: 1, names: [operationY] }
+    };
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun, yRuns]);
+    expect(getSessionStatus(fixture.session)).toMatchObject({ continuingOperations: { count: 1 } });
+
+    // Once the last one ends, the iteration ends, and the later build runs without another position.
+    releaseY.resolve();
+    await Promise.all([agentPromise, laterPromise]);
+    expect(getQueuePositions(later)).toEqual([{ position: 1, requestId: 'later' }, bothRun, yRuns]);
+    expect(getSessionStatus(fixture.session).continuingOperations).toBeUndefined();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/RequestScheduler.test.ts b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
index e6092f2005..3183e5ad80 100644
--- a/libraries/rush-daemon/src/test/RequestScheduler.test.ts
+++ b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
@@ -193,6 +193,32 @@ describe(RequestScheduler.name, () => {
     second.release();
   });
 
+  it('reports every queued request its position again on request, without admitting any', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const active: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive
+    });
+    const firstPositions: number[] = [];
+    const secondPositions: number[] = [];
+    const firstPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead,
+      onQueuePositionChanged: (position) => firstPositions.push(position)
+    });
+    const secondPromise: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead,
+      onQueuePositionChanged: (position) => secondPositions.push(position)
+    });
+
+    scheduler.notifyQueuePositions();
+    expect(firstPositions).toEqual([1, 1, 1]);
+    expect(secondPositions).toEqual([2, 2]);
+    expect(scheduler.queuedRequestCount).toBe(2);
+
+    active.release();
+    (await firstPromise).release();
+    (await secondPromise).release();
+  });
+
   it('continues scheduling when a queue position callback throws', async () => {
     const scheduler: RequestScheduler = new RequestScheduler();
     const active: IRequestLease = await scheduler.acquireAsync({
diff --git a/libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts b/libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts
new file mode 100644
index 0000000000..a23d11b241
--- /dev/null
+++ b/libraries/rush-daemon/src/test/StoppedContinuingOperations.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { DaemonRequestDispatchError } from '../DaemonRequestDispatcher';
+import {
+  addStoppedContinuingOperations,
+  formatStoppedContinuingOperations
+} from '../StoppedContinuingOperations';
+
+describe(formatStoppedContinuingOperations.name, () => {
+  it('names one operation in the singular', () => {
+    expect(formatStoppedContinuingOperations({ count: 1, names: ['c (compile)'] })).toBe(
+      'rushd stopped 1 operation left running by an earlier failed command (c (compile)), so that this command ' +
+        'can run in-process.'
+    );
+  });
+
+  it('names the operations in the given order, and counts the ones that it does not name', () => {
+    expect(formatStoppedContinuingOperations({ count: 2, names: ['S1', 'S2'] })).toBe(
+      'rushd stopped 2 operations left running by an earlier failed command (S1, S2), so that this command can ' +
+        'run in-process.'
+    );
+    expect(formatStoppedContinuingOperations({ count: 5, names: ['S1', 'S10', 'S2'] })).toBe(
+      'rushd stopped 5 operations left running by an earlier failed command (S1, S10, S2 +2 more), so that this ' +
+        'command can run in-process.'
+    );
+  });
+
+  it('leaves the names out if there are none', () => {
+    expect(formatStoppedContinuingOperations({ count: 2, names: [] })).toBe(
+      'rushd stopped 2 operations left running by an earlier failed command, so that this command can run ' +
+        'in-process.'
+    );
+  });
+});
+
+describe(addStoppedContinuingOperations.name, () => {
+  const stopped: string = formatStoppedContinuingOperations({ count: 1, names: ['c (compile)'] });
+
+  it('adds the line after the first line of the rejection, which the client prints as its fallback line', () => {
+    const rejection: DaemonRequestDispatchError = new DaemonRequestDispatchError(
+      'unsupported',
+      'The command is not phased.\nwarning: first\nwarning: second'
+    );
+    const added: DaemonRequestDispatchError = addStoppedContinuingOperations(rejection, {
+      count: 1,
+      names: ['c (compile)']
+    });
+    expect(added.message).toBe(`The command is not phased.\n${stopped}\nwarning: first\nwarning: second`);
+    expect(added.code).toBe('unsupported');
+    expect(added.cause).toBe(rejection);
+    expect(rejection.message).toBe('The command is not phased.\nwarning: first\nwarning: second');
+  });
+
+  it('adds the line after the first line that is not blank', () => {
+    const rejection: DaemonRequestDispatchError = new DaemonRequestDispatchError(
+      'unsupported',
+      '\n  \nThe command is not phased.'
+    );
+    expect(addStoppedContinuingOperations(rejection, { count: 1, names: ['c (compile)'] }).message).toBe(
+      `\n  \nThe command is not phased.\n${stopped}`
+    );
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index 5eaad1608e..eb74ff8715 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -14,13 +14,15 @@ import {
   type IDaemonFrame,
   type IDaemonInstallationChange,
   type IDaemonRequestEnvelope,
-  type IDaemonRequestQueuePositionMessage
+  type IDaemonRequestQueuePositionMessage,
+  type IDaemonRequestRejectedMessage
 } from '@rushstack/rush-daemon-protocol';
 
 import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import type { IOutputFolderSet } from '../OutputFolderDigest';
 import * as outputFolderDigestPool from '../OutputFolderDigestPool';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
+import { RequestScheduler } from '../RequestScheduler';
 import { getInstalledWorkspaceSuccessorLaunchAsync } from '../WorkspaceProcessRestart';
 import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
 import type { DaemonRequestWireClient, ITerminalExchange } from './DaemonRequestWireTestUtilities';
@@ -184,9 +186,20 @@ async function returnEarlyAsync(fixture: DaemonGraphTestFixture): Promise<void>
  */
 const NOT_PHASED: string[] = ['install-autoinstaller', '--name', 'tools'];
 
+/** The line that the daemon adds to a rejection after it stopped the held c; see `returnEarlyAsync`. */
+const STOPPED_C: string =
+  'rushd stopped 1 operation left running by an earlier failed command (c (compile)), so that this command can ' +
+  'run in-process.';
+
+/** The message of the `unsupported` rejection that ends `exchange`. */
+function getUnsupportedMessage(exchange: ITerminalExchange | undefined): string {
+  expect(exchange?.terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+  return (exchange?.terminal as IDaemonRequestRejectedMessage).payload.message;
+}
+
 /**
  * After a failed build returned early, sends `argv`, which the daemon rejects so that the client runs it in-process,
- * and checks that the daemon stopped the work that continues before it sent the rejection.
+ * and checks that the daemon stopped the work that continues before it sent the rejection, which says so.
  */
 async function expectStopBeforeRejectionAsync(argv: string[]): Promise<void> {
   const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
@@ -194,8 +207,7 @@ async function expectStopBeforeRejectionAsync(argv: string[]): Promise<void> {
   try {
     await returnEarlyAsync(fixture);
 
-    const custom: ITerminalExchange = await fixture.runAsync(argv, { commandOrigin: 'custom' });
-    expect(custom.terminal).toMatchObject({ kind: 'requestRejected', payload: { code: 'unsupported' } });
+    const message: string = getUnsupportedMessage(await fixture.runAsync(argv, { commandOrigin: 'custom' }));
     // The held c was stopped before the rejection was sent, and the in-process command can take the Rush lock.
     expect(fs.existsSync(hold)).toBe(true);
     expect(fixture.session.operationGraph?.status).not.toBe(OperationStatus.Executing);
@@ -207,6 +219,13 @@ async function expectStopBeforeRejectionAsync(argv: string[]): Promise<void> {
     expect(countRuns(fixture, 'c')).toBe(2);
     fs.rmSync(hold);
     expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+
+    // The rejection names the stopped c after its first line. Once nothing continues, the same command's rejection
+    // doesn't.
+    const [reason, ...details] = getUnsupportedMessage(
+      await fixture.runAsync(argv, { commandOrigin: 'custom' })
+    ).split('\n');
+    expect(message).toBe([reason, STOPPED_C, ...details].join('\n'));
   } finally {
     fs.rmSync(hold, { force: true });
     await fixture[Symbol.asyncDispose]();
@@ -400,6 +419,27 @@ describe('a failed build that returns early', () => {
     await expectStopBeforeRejectionAsync(NOT_PHASED);
   });
 
+  it('does not say that it stopped work that continues if it could not stop that work', async () => {
+    // As before the failed build's result drained: until then, nothing can preempt the build's lease.
+    jest.spyOn(RequestScheduler.prototype, 'markLeasePreemptible').mockImplementation(() => undefined);
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+
+      const custom: ITerminalExchange = await fixture.runAsync(['test', '--to', 'c'], {
+        commandOrigin: 'custom'
+      });
+      expect(getUnsupportedMessage(custom)).not.toContain('rushd stopped');
+      expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
+      expect(countRuns(fixture, 'c')).toBe(1);
+    } finally {
+      jest.restoreAllMocks();
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('answers a client that cancels while the work that continues is stopping, without waiting for it to stop', async () => {
     const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ slowToStop: true });
     const hold: string = path.join(fixture.folder, 'hold');
@@ -427,10 +467,8 @@ describe('a failed build that returns early', () => {
           answer,
           delayAsync(3_000).then(() => undefined)
         ]);
-        expect(cancelled?.terminal).toMatchObject({
-          kind: 'requestRejected',
-          payload: { code: 'unsupported' }
-        });
+        // c was not stopped yet when the client left, so the rejection doesn't say that it was.
+        expect(getUnsupportedMessage(cancelled)).not.toContain('rushd stopped');
         // c is still stopping, so the client must not run `test` in-process now; rush-client reports a command
         // that it cancelled as cancelled instead.
         expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
@@ -456,10 +494,7 @@ describe('a failed build that returns early', () => {
         [['start'], { commandOrigin: 'custom', invocationKind: 'rushx' }]
       ];
       for (const [argv, overrides] of requests) {
-        expect((await fixture.runAsync(argv, overrides)).terminal).toMatchObject({
-          kind: 'requestRejected',
-          payload: { code: 'unsupported' }
-        });
+        expect(getUnsupportedMessage(await fixture.runAsync(argv, overrides))).not.toContain('rushd stopped');
       }
       expect(fixture.session.operationGraph?.status).toBe(OperationStatus.Executing);
       expect(isNativeLockFree(fixture)).toBe(false);

From 68f78566952acf76522fa4857aa8e04458f63594 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 222/265] [rush-cli-client] Say resubmitted, not the lock wait,
 after a restart

Swarm integration step 207; original commit 26b0b98634 (merge of swarm/r04-t108-nit1 at f9834f79a8).
Scope: task 108 NIT 1.

Brings 108n1 (branch swarm/r04-t108-nit1, 8 commits). Second agent: o04 board 7693 (RESULT board 7691, REGISTRATION board 7577). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 2 of 13. Gate: ch01 GATE OK board 8015 (tree 3af003a971)

Commits folded into this step (1):
- f9834f79a8 [rush-cli-client] Say resubmitted, not the lock wait, after a restart

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  4 ++-
 .../src/daemonRestartNotice.ts                | 17 ++++++---
 .../src/nativeLockWaitNotice.ts               | 12 ++++---
 .../src/test/AgentProgressRenderer.test.ts    | 36 +++++++++++++++++++
 .../src/test/nativeLockWaitNotice.test.ts     | 17 +++++++++
 ...1-lock-wait-resubmit_2026-09-29-22-40.json | 11 ++++++
 6 files changed, 88 insertions(+), 9 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nit1-lock-wait-resubmit_2026-09-29-22-40.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 51139a1643..43452ced59 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -149,7 +149,9 @@ the built-in default included, limits that wait, since that process can run for
 length of time. Stderr, on a terminal and on a pipe, names the process at once
 (`rush-client: waiting for another Rush process (PID 12345: rush install) to release
 this repository's lock.`), and again with the time waited every 10 seconds
-(`still waiting after 10s for …`); agent output shows it as the progress phase. Only
+(`still waiting after 10s for …`); agent output shows it as the progress phase, and if the
+daemon then restarts, `request resubmitted to the new daemon; preparing the workspace graph`
+until the new daemon reports a queue position or starts the command. Only
 Linux tells the PID and command; elsewhere the line says `another Rush process`. On
 Linux, the name also says when that process is stopped, since it cannot release the
 lock until something resumes it (`another Rush process (PID 12345: rush install; it is
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index 6a83c5ad85..5fc317ec8f 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -246,6 +246,11 @@ export interface IDaemonRequestNoticeHandlers {
   readonly onInputAdmittedAsync: () => Promise<void>;
   /** The request's output or an event arrived, so it no longer waits. */
   readonly onRequestProgress: () => void;
+  /**
+   * The agent renderer shows another wait of the request at its daemon as the phase, for example a wait for another
+   * Rush process to release the repository's lock. A restart then replaces the phase, as after a restart wait.
+   */
+  readonly onAgentWaitShown: () => void;
   /**
    * The request ended, or the client asked rushd to cancel it: stops repeating the restart wait line, and ignores
    * later queue positions.
@@ -279,7 +284,8 @@ export function createDaemonRequestNoticeHandlers(
     createDaemonRestartNoticeHandler(target);
   let daemonPid: number | undefined = target.daemonPid;
   let restartWait: IRestartWaitState | undefined;
-  let showedRestartWait: boolean = false;
+  // Whether the agent phase showed a wait at the daemon since the request last restarted.
+  let showedAgentWait: boolean = false;
   // The reason of the last wait line written as a line since the request last restarted.
   let writtenWaitReason: DaemonRestartReason | undefined;
   let disposed: boolean = false;
@@ -308,10 +314,10 @@ export function createDaemonRequestNoticeHandlers(
       writtenWaitReason = undefined;
       if (!isRestartCauseWritten(waitReason, notice.reason)) await writeRestartNoticeAsync(notice);
       // The phase and the status lines still say what the request waited for at the previous daemon.
-      if (agentRenderer && (showedRestartWait || notice.exitedPid !== undefined)) {
+      if (agentRenderer && (showedAgentWait || notice.exitedPid !== undefined)) {
         agentRenderer.onResubmitted(RESUBMITTED_PHASE);
       }
-      showedRestartWait = false;
+      showedAgentWait = false;
     },
     onQueuePositionAsync: async (
       position: number,
@@ -350,7 +356,7 @@ export function createDaemonRequestNoticeHandlers(
       const changed: boolean = line !== state.line;
       state.line = line;
       if (agentRenderer) {
-        showedRestartWait = true;
+        showedAgentWait = true;
         // The agent renderer's own status lines repeat the phase.
         if (agentRenderer.onRestartWait(line, announce)) writtenWaitReason = restartReason;
       } else if (announce || (stderrIsTTY && changed)) {
@@ -359,6 +365,9 @@ export function createDaemonRequestNoticeHandlers(
     },
     onInputAdmittedAsync: async (): Promise<void> => endRestartWait(),
     onRequestProgress: endRestartWait,
+    onAgentWaitShown: (): void => {
+      showedAgentWait = true;
+    },
     dispose: (): void => {
       disposed = true;
       endRestartWait();
diff --git a/apps/rush-cli-client/src/nativeLockWaitNotice.ts b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
index b8c170328c..7dd6ec74da 100644
--- a/apps/rush-cli-client/src/nativeLockWaitNotice.ts
+++ b/apps/rush-cli-client/src/nativeLockWaitNotice.ts
@@ -39,7 +39,7 @@ export interface INativeLockWaitNoticeTarget {
  * queue positions take the arguments of `IDaemonClientExecuteOptions.onQueuePositionAsync`.
  */
 export interface INativeLockWaitNoticeHandlers
-  extends Omit<IDaemonRequestNoticeHandlers, 'onQueuePositionAsync'> {
+  extends Omit<IDaemonRequestNoticeHandlers, 'onQueuePositionAsync' | 'onAgentWaitShown'> {
   readonly onQueuePositionAsync: (
     position: number,
     restartReason?: DaemonRestartReason,
@@ -64,7 +64,8 @@ interface INativeLockWaitState {
  * @remarks
  * Without an agent renderer, a terminal and a pipe get a line at once and whenever another process holds the lock,
  * and the line again with the time waited when {@link NATIVE_LOCK_WAIT_REPEAT_MS} passes without one. An agent
- * renderer shows the wait as its phase instead, which its status lines repeat, and announces each process on a pipe.
+ * renderer shows the wait as its phase instead, which its status lines repeat, and announces each process on a pipe;
+ * a restart then replaces the phase, as after a restart wait.
  * The wait ends when the request gets another queue position, restarts, gets input, output or an event, or ends.
  * The other notices are the ones that `handlers` gives.
  */
@@ -125,8 +126,11 @@ export function withNativeLockWaitNotices(
       });
       state.holder = nativeLockHolder;
       state.key = key;
-      if (agentRenderer) agentRenderer.onRestartWait(formatNativeLockWait(nativeLockHolder), true);
-      else await writeWaitAsync(state);
+      if (agentRenderer) {
+        agentRenderer.onRestartWait(formatNativeLockWait(nativeLockHolder), true);
+        // So that a restart replaces the phase, which names a process that only the previous daemon reported.
+        handlers.onAgentWaitShown();
+      } else await writeWaitAsync(state);
     },
     onInputAdmittedAsync: async () => {
       endWait();
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 185817740c..c1b259f51f 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -14,6 +14,7 @@ import {
   createDaemonRequestNoticeHandlers,
   type IDaemonRequestNoticeHandlers
 } from '../daemonRestartNotice';
+import { withNativeLockWaitNotices, type INativeLockWaitNoticeHandlers } from '../nativeLockWaitNotice';
 
 function event(type: DaemonEventType, payload: unknown): IDaemonEventEnvelope {
   return {
@@ -1399,6 +1400,41 @@ describe(AgentProgressRenderer.name, () => {
       ]);
     });
 
+    it('says that a command which waited for another Rush process was resubmitted after the daemon restarted (task 108)', async () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      const writeStderrAsync = async (): Promise<void> => undefined;
+      const handlers: INativeLockWaitNoticeHandlers = withNativeLockWaitNotices(
+        createDaemonRequestNoticeHandlers({
+          rushx: false,
+          stderrIsTTY: false,
+          daemonPid: 41,
+          now: () => clock.ms,
+          agentRenderer: renderer,
+          writeStderrAsync
+        }),
+        { rushx: false, agentRenderer: renderer, now: () => clock.ms, writeStderrAsync }
+      );
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      await handlers.onQueuePositionAsync(1, undefined, {}, { pid: 4242, command: 'rush install' });
+      advance(clock, 4_900);
+      // The install changed the lockfile, so the daemon restarted at once, which needs no line.
+      await handlers.onRestartAsync({
+        restart: 1,
+        reason: { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/pnpm-lock.yaml'] },
+        successorPid: 43
+      });
+      advance(clock, 20_100);
+      handlers.dispose();
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        "rush build · 0.1s · waiting for another Rush process (PID 4242: rush install) to release this repository's lock",
+        `rush build · 25.1s · ${RESUBMITTED_PHASE}`
+      ]);
+    });
+
     it('writes status lines after a failure report, and none after the summary', () => {
       const { renderer, output, clock, lines } = createRenderer(false);
       renderer.start();
diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
index fa17965916..1c2a6feb92 100644
--- a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -5,6 +5,7 @@ import type { DaemonRestartReason, IDaemonNativeLockHolder } from '@rushstack/ru
 
 import {
   RESTART_WAIT_REPEAT_MS,
+  RESUBMITTED_PHASE,
   createDaemonRequestNoticeHandlers,
   type IDaemonRequestNoticeTarget
 } from '../daemonRestartNotice';
@@ -226,6 +227,22 @@ describe(withNativeLockWaitNotices.name, () => {
     expect(calls).toEqual([`announce: waiting for ${INSTALL_LOCK}`, `announce: waiting for ${UPDATE_LOCK}`]);
   });
 
+  it('gives the agent the resubmitted phase when the request follows a restart after it waited for the lock (task 108)', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    // The install changed the lockfile, so the daemon restarts at once, without a restart wait.
+    await handlers.onRestartAsync({ restart: 1, reason: LOCKFILE, successorPid: 42 });
+    // The request showed no wait at the new daemon, so its phase stays.
+    await handlers.onRestartAsync({ restart: 2, reason: LOCKFILE, successorPid: 43 });
+    await handlers.onQueuePositionAsync(1, undefined, {}, UPDATE);
+    handlers.dispose();
+    expect(calls).toEqual([
+      `announce: waiting for ${INSTALL_LOCK}`,
+      `resubmitted: ${RESUBMITTED_PHASE}`,
+      `announce: waiting for ${UPDATE_LOCK}`
+    ]);
+  });
+
   it('announces a process once when its command can no longer be read, and names a command read later', async () => {
     const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
     await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nit1-lock-wait-resubmit_2026-09-29-22-40.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nit1-lock-wait-resubmit_2026-09-29-22-40.json
new file mode 100644
index 0000000000..c3dd1da6af
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t108-nit1-lock-wait-resubmit_2026-09-29-22-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent mode, once a command that waited for another Rush process to release the repository's lock is sent to a new daemon, the status lines say that it was resubmitted instead of naming the process that the exited daemon reported.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 09cbde9e43310cac664f893d478967fd729fd359 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 223/265] [rush-daemon] Print the usage of an invalid command
 line in legacy output, as native Rush does

Swarm integration step 208; original commit 0a94e2ec8d (merge of swarm/r04-t78-nit8 at 35ceae793c).
Refs: task 78 NIT 8, ch01 board 3099.
Scope: task 78 NIT 8.

Brings 78n8 (branch swarm/r04-t78-nit8). Second agent: o07 board 7420 (RESULT board 7418). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 3 of 13. Gate: ch01 GATE OK board 8015 (tree bdf4c95348)

Commits folded into this step (1):
- 35ceae793c Print the usage of an invalid command line in legacy output, as native Rush does (task 78 NIT 8, ch01 board 3099)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/src/launchClient.ts      |  5 ++
 .../src/test/launchClientResultStderr.test.ts | 69 +++++++++++++++----
 ...m-r04-t78-nit8-usage_2026-09-29-21-38.json | 11 +++
 ...m-r04-t78-nit8-usage_2026-09-29-21-38.json | 11 +++
 ...m-r04-t78-nit8-usage_2026-09-29-21-38.json | 11 +++
 ...m-r04-t78-nit8-usage_2026-09-29-21-38.json | 11 +++
 .../reviews/api/rush-daemon-protocol.api.md   |  1 +
 common/reviews/api/rush-lib.api.md            |  2 +
 libraries/rush-daemon-protocol/README.md      |  3 +
 .../src/DaemonCommandResult.ts                |  5 ++
 .../src/RequestResultValidation.ts            |  1 +
 .../src/test/RequestResultValidation.test.ts  | 16 +++++
 .../rush-daemon/src/DaemonControlSession.ts   |  6 +-
 .../src/DaemonRequestUsageError.ts            | 11 ++-
 .../src/ProductionDaemonRequestResolver.ts    |  5 +-
 .../src/test/DaemonRequestUsageError.test.ts  | 17 ++++-
 .../rush-lib/src/api/PhasedCommandEngine.ts   | 11 ++-
 .../src/api/PhasedCommandEngineUsageError.ts  |  5 +-
 .../src/api/test/PhasedCommandEngine.test.ts  | 18 +++--
 19 files changed, 193 insertions(+), 26 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json

diff --git a/apps/rush-cli-client/src/launchClient.ts b/apps/rush-cli-client/src/launchClient.ts
index 5f32e5e024..f5519d0cd6 100644
--- a/apps/rush-cli-client/src/launchClient.ts
+++ b/apps/rush-cli-client/src/launchClient.ts
@@ -382,6 +382,11 @@ export async function launchClientAsync(
     // In agent mode the summary line may already carry the complete error message; do not repeat it.
     const reportedByAgent: boolean = agentRenderer?.finish(outcome.result) ?? false;
     process.exitCode = outcome.result.exitCode;
+    // Like native Rush, legacy output prints the usage of a command whose command line is invalid before the error.
+    // Agent output leaves it out: its summary line names the invalid argument.
+    if (!agentRenderer && outcome.result.usage) {
+      await output.stdout.writeAsync(Buffer.from(outcome.result.usage));
+    }
     // When the agent summary line explains the failure, nothing more is printed.
     const stderr: string | undefined = reportedByAgent
       ? undefined
diff --git a/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts b/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
index 99dacc04f0..50f8d23a26 100644
--- a/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
+++ b/apps/rush-cli-client/src/test/launchClientResultStderr.test.ts
@@ -19,6 +19,7 @@ import {
 } from '@rushstack/rush-client-core';
 import type { IDaemonCommandResult } from '@rushstack/rush-daemon-protocol';
 
+import { AgentProgressRenderer } from '../AgentProgressRenderer';
 import type { ClientName } from '../ClientAdmissionControls';
 import * as connectionOptions from '../daemonConnectionOptions';
 import { launchClientAsync } from '../launchClient';
@@ -27,20 +28,29 @@ import { getTestProcessEnvironment } from './TestProcessEnvironment';
 const RESTART_WAIT_TIMEOUT: string =
   'The rushx script was not admitted before the daemon could restart because ' +
   'common/config/rush/pnpm-lock.yaml changed. Stop the script, or use --wait-timeout <seconds> to wait longer.';
+const USAGE_MESSAGE: string = 'rush build: error: Unrecognized arguments: --nope.';
+const USAGE: string = 'usage: rush build [-h] [-p COUNT] [--timeline]\n                  [-t PROJECT]\n';
+const USAGE_RESULT: Omit<IDaemonCommandResult, 'requestId'> = {
+  exitCode: 2,
+  outcome: 'failure',
+  aborted: false,
+  errorMessage: USAGE_MESSAGE,
+  usage: USAGE
+};
 
 describe('the stderr line of a failed daemon result (task 166)', () => {
   let folder: string;
   let originalArgv: string[];
   let originalEnvironment: NodeJS.ProcessEnv;
   let originalExitCode: typeof process.exitCode;
-  let stderr: string[];
+  let writes: [stream: 'stdout' | 'stderr', text: string][];
 
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-client-result-'));
     originalArgv = process.argv;
     originalEnvironment = process.env;
     originalExitCode = process.exitCode;
-    stderr = [];
+    writes = [];
     fs.writeFileSync(
       path.join(folder, 'rush.json'),
       JSON.stringify({ rushVersion: '5.178.1', pnpmVersion: '10.27.0', projects: [] })
@@ -52,15 +62,16 @@ describe('the stderr line of a failed daemon result (task 166)', () => {
         lockfilePath: path.join(folder, 'daemon.pid.json')
       }
     });
-    jest.spyOn(process.stderr, 'write').mockImplementation(((
-      chunk: string | Uint8Array,
-      ...rest: unknown[]
-    ): boolean => {
-      stderr.push(Buffer.from(chunk).toString());
-      (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
-      return true;
-    }) as typeof process.stderr.write);
-    jest.spyOn(process.stdout, 'write').mockReturnValue(true);
+    for (const stream of ['stdout', 'stderr'] as const) {
+      jest.spyOn(process[stream], 'write').mockImplementation(((
+        chunk: string | Uint8Array,
+        ...rest: unknown[]
+      ): boolean => {
+        writes.push([stream, Buffer.from(chunk).toString()]);
+        (rest.find((argument) => typeof argument === 'function') as (() => void) | undefined)?.();
+        return true;
+      }) as typeof process.stderr.write);
+    }
     jest.spyOn(process, 'cwd').mockReturnValue(folder);
     jest.mocked(connectOrAwaitDaemonStartupAsync).mockResolvedValue({
       closeAsync: async () => undefined,
@@ -119,8 +130,42 @@ describe('the stderr line of a failed daemon result (task 166)', () => {
       expect(jest.mocked(executeWithDaemonRestartAsync).mock.calls[0][2].request.invocationKind).toBe(
         rushx ? 'rushx' : 'rush'
       );
-      expect(stderr).toEqual([line]);
+      expect(writes.filter(([stream]) => stream === 'stderr').map(([, text]) => text)).toEqual([line]);
       expect(process.exitCode).toBe(1);
     });
   });
+
+  describe('of an invalid command line (task 78)', () => {
+    beforeEach(() => {
+      process.argv = [process.execPath, 'rush-client', 'build', '--nope'];
+      jest.mocked(executeWithDaemonRestartAsync).mockImplementation(async (client, connection, options) => ({
+        kind: 'result',
+        result: { requestId: options.request.requestId, ...USAGE_RESULT }
+      }));
+    });
+
+    it('follows the usage of the command on stdout, as native Rush does', async () => {
+      await launchClientAsync(false);
+      expect(writes).toEqual([
+        ['stdout', USAGE],
+        ['stderr', `rush-client: ${USAGE_MESSAGE}\n`]
+      ]);
+      expect(process.exitCode).toBe(2);
+    });
+
+    it('is left to the summary line of agent output, which omits the usage', async () => {
+      const agentOutput: string[] = [];
+      const agentRenderer: AgentProgressRenderer = new AgentProgressRenderer({
+        commandName: 'build',
+        isTTY: false,
+        columns: 120,
+        write: (text: string) => agentOutput.push(text)
+      });
+      await launchClientAsync(false, agentRenderer);
+      expect(writes).toEqual([]);
+      expect(agentOutput.join('')).toContain(USAGE_MESSAGE);
+      expect(agentOutput.join('')).not.toContain('usage:');
+      expect(process.exitCode).toBe(2);
+    });
+  });
 });
diff --git a/common/changes/@microsoft/rush/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json b/common/changes/@microsoft/rush/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
new file mode 100644
index 0000000000..6dfef081a5
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "`PhasedCommandEngineUsageError` (alpha) has the `usage` of the command, which native Rush prints to stdout before the error, so that a host can print it too. `PhasedCommandEngine.parseAsync` sets it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
new file mode 100644
index 0000000000..b818785980
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "For a command line that native Rush rejects as invalid, legacy output prints the command's usage to stdout before the error, as native Rush does. Agent output is unchanged.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
new file mode 100644
index 0000000000..2dc2c5761e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `usage` field to request results: the usage of the command, for a command line that native Rush rejects as invalid. Older daemons omit it, and older clients ignore it.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
new file mode 100644
index 0000000000..94519e159d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t78-nit8-usage_2026-09-29-21-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The result of a command line that native Rush rejects as invalid carries the command's `usage`, which native Rush prints to stdout before the error.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index 7cbffc5c6f..eec3e57f25 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -260,6 +260,7 @@ export interface IDaemonCommandResult {
     readonly requestId: string;
     readonly restartReason?: DaemonRestartReason;
     readonly retryAfterRestart?: true;
+    readonly usage?: string;
 }
 
 // @beta
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 301e4d628b..c4f644644f 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1667,8 +1667,10 @@ export class PhasedCommandEngineProjectConfigurationError extends Error {
 export class PhasedCommandEngineUsageError extends Error {
     constructor(message: string, exitCode: number, options?: {
         cause?: unknown;
+        usage?: string;
     });
     readonly exitCode: number;
+    readonly usage: string | undefined;
 }
 
 // @alpha
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index 01d358f836..9ab2dfa3f0 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -96,6 +96,9 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   request has left every queue and before anything from it is applied, so the notice precedes the request's
   output, events and terminal control. A daemon that exits after a `queuePosition` but before `requestStarted`
   has not run the request. A daemon answers a `requestStarted` that a client sends with a protocol `error`.
+- **Usage** - a failure result for a command line that native Rush rejects as invalid may carry the command's
+  `usage`, which native Rush prints to stdout before the error. Older daemons omit it and older clients ignore
+  it, so this additive field needs no minor.
 
 Part of the Rush 6 / rushd re-architecture:
 [microsoft/rushstack#5894](https://github.com/microsoft/rushstack/issues/5894).
diff --git a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
index b45ce88ca0..14ef4089e8 100644
--- a/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonCommandResult.ts
@@ -36,6 +36,11 @@ export interface IDaemonCommandResult {
   readonly exitCode: number;
   /** A failure description for execution or cleanup failures that were not already operation-scoped. */
   readonly errorMessage?: string;
+  /**
+   * The usage of the command, for a command line that native Rush rejects as invalid. Native Rush prints it to
+   * stdout before `errorMessage`. Older daemons omit it.
+   */
+  readonly usage?: string;
   /** The semantic command outcome. */
   readonly outcome: DaemonCommandOutcome;
   /** The identifier copied from the request. */
diff --git a/libraries/rush-daemon-protocol/src/RequestResultValidation.ts b/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
index 0ed3fe24b1..6908219386 100644
--- a/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
+++ b/libraries/rush-daemon-protocol/src/RequestResultValidation.ts
@@ -12,6 +12,7 @@ const EMPTY_STRING_LENGTH: number = 0;
 /** Validates optional global and phased result fields. @internal */
 export function validateRequestResultFields(payload: Record<string, unknown>): void {
   validateOptionalString(payload.errorMessage, 'errorMessage');
+  validateOptionalString(payload.usage, 'usage');
   validateAdmissionErrorCode(payload.admissionErrorCode);
   validatePhasedResultShape(payload);
   validateRestartResult(payload);
diff --git a/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts b/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts
index aa0f162d67..9ebfaee8b7 100644
--- a/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/RequestResultValidation.test.ts
@@ -11,11 +11,13 @@ const BASE_RESULT: IDaemonCommandResult = {
   outcome: 'success',
   requestId: 'request'
 };
+const NATIVE_USAGE_EXIT_CODE: number = 2;
 
 it.each([
   ['negative exit code', { ...BASE_RESULT, exitCode: -1 }],
   ['unknown admission error', { ...BASE_RESULT, admissionErrorCode: 'later' }],
   ['non-string error', { ...BASE_RESULT, errorMessage: false }],
+  ['non-string usage', { ...BASE_RESULT, usage: false }],
   ['partial phased result', { ...BASE_RESULT, scheduled: true }],
   [
     'malformed operation result',
@@ -38,3 +40,17 @@ it('accepts a complete phased request result', () => {
   };
   expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
 });
+
+it('accepts a failed request result with the usage of its command', () => {
+  const message: DaemonControlMessage = {
+    kind: 'requestResult',
+    payload: {
+      ...BASE_RESULT,
+      exitCode: NATIVE_USAGE_EXIT_CODE,
+      outcome: 'failure',
+      errorMessage: 'rush build: error: Unrecognized arguments: --nope.',
+      usage: 'usage: rush build [-h] [-t PROJECT]\n'
+    }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 99950ad9ee..102c754033 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -426,12 +426,14 @@ export class DaemonControlSession {
     if (dispatchError !== undefined && !state.client.terminalOutcomeSent && !this.#connectionClosed) {
       if (dispatchError instanceof DaemonRequestUsageError) {
         // Native Rush reports an invalid command line and exits, so the client must not run it in-process.
+        const { exitCode, message, usage } = dispatchError;
         await state.client.writeResultAsync({
           requestId: envelope.requestId,
-          exitCode: dispatchError.exitCode,
+          exitCode,
           outcome: 'failure',
           aborted: state.abortController.signal.aborted,
-          errorMessage: dispatchError.message
+          errorMessage: message,
+          ...(usage === undefined ? {} : { usage })
         });
         return;
       }
diff --git a/libraries/rush-daemon/src/DaemonRequestUsageError.ts b/libraries/rush-daemon/src/DaemonRequestUsageError.ts
index 8b5eecbcaf..febfaadaae 100644
--- a/libraries/rush-daemon/src/DaemonRequestUsageError.ts
+++ b/libraries/rush-daemon/src/DaemonRequestUsageError.ts
@@ -1,6 +1,12 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+/** Options for {@link DaemonRequestUsageError}. */
+export interface IDaemonRequestUsageErrorOptions extends ErrorOptions {
+  /** The usage of the command, which native Rush prints to stdout before the message. */
+  readonly usage?: string;
+}
+
 /**
  * A command line that native Rush rejects as invalid. The request fails with native Rush's exit code, and the
  * client does not run the command in-process, which would only report the same error again.
@@ -8,10 +14,13 @@
 export class DaemonRequestUsageError extends Error {
   /** The exit code of native Rush for this command line. */
   public readonly exitCode: number;
+  /** The usage of the command, if it is known. */
+  public readonly usage: string | undefined;
 
-  public constructor(message: string, exitCode: number, options?: ErrorOptions) {
+  public constructor(message: string, exitCode: number, options?: IDaemonRequestUsageErrorOptions) {
     super(message, options);
     this.name = 'DaemonRequestUsageError';
     this.exitCode = exitCode;
+    this.usage = options?.usage;
   }
 }
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 1df8bd357e..678bdc3b22 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -376,7 +376,10 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       } catch (error) {
         // Answer only for a command line of the requested command; in-process Rush reports any other one.
         if (error instanceof PhasedCommandEngineUsageError && envelope.argv[0] === envelope.commandName) {
-          throw new DaemonRequestUsageError(terminal.describeError(error), error.exitCode, { cause: error });
+          throw new DaemonRequestUsageError(terminal.describeError(error), error.exitCode, {
+            cause: error,
+            usage: error.usage
+          });
         }
         throw new DaemonRequestDispatchError('unsupported', terminal.describeError(error), { cause: error });
       }
diff --git a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
index 504370ea4b..91d4aaae69 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestUsageError.test.ts
@@ -12,9 +12,16 @@ jest.setTimeout(30_000);
 
 const message: string = 'rush build: error: Unrecognized arguments: --nope.';
 const invalid: string[] = ['build', '--to', 'b', '--nope'];
+// Native Rush prints the usage of the command to stdout before the message.
 const usageFailure: object = {
   kind: 'requestResult',
-  payload: { exitCode: 2, outcome: 'failure', aborted: false, errorMessage: message }
+  payload: {
+    exitCode: 2,
+    outcome: 'failure',
+    aborted: false,
+    errorMessage: message,
+    usage: expect.stringMatching(/^usage: rush build \[-h\] .*\[-t PROJECT\]/s)
+  }
 };
 const inProcess: object = { kind: 'requestRejected', payload: { code: 'unsupported', message } };
 const success: object = { kind: 'requestResult', payload: { exitCode: 0 } };
@@ -84,7 +91,13 @@ it('answers an invalid command line of a custom phased command as it does one of
     expect((await fixture.buildAsync()).terminal).toMatchObject(success);
     expect((await fixture.runAsync(invalidTest, custom)).terminal).toMatchObject({
       kind: 'requestResult',
-      payload: { exitCode: 2, outcome: 'failure', aborted: false, errorMessage: testMessage }
+      payload: {
+        exitCode: 2,
+        outcome: 'failure',
+        aborted: false,
+        errorMessage: testMessage,
+        usage: expect.stringMatching(/^usage: rush test \[-h\] /)
+      }
     });
     // The daemon serves no global or unknown command, so in-process Rush reports its invalid command line.
     for (const argv of [
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 6bf603fcb0..02255c8e43 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -221,13 +221,18 @@ export class PhasedCommandEngine {
       // since the daemon serves no other command: in-process Rush reports an unknown or global command itself.
       // Rush's global parameters are all flags, so the first argument that isn't a flag names the command.
       const commandName: string | undefined = argv.find((arg: string) => !arg.startsWith('-'));
+      const commandAction: CommandLineAction | undefined =
+        commandName === undefined ? undefined : parser.tryGetAction(commandName);
       if (
         error instanceof CommandLineParserExitError &&
         error.exitCode !== 0 &&
-        commandName !== undefined &&
-        parser.tryGetAction(commandName) instanceof PhasedScriptAction
+        commandAction instanceof PhasedScriptAction
       ) {
-        throw new PhasedCommandEngineUsageError(error.message.trim(), error.exitCode, { cause: error });
+        // The parser also wrote the usage to this process's stdout, which the client of a daemon does not see.
+        throw new PhasedCommandEngineUsageError(error.message.trim(), error.exitCode, {
+          cause: error,
+          usage: commandAction.renderUsageText()
+        });
       }
       throw error;
     }
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
index c950cbb53e..1bd49d362f 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngineUsageError.ts
@@ -10,11 +10,14 @@
 export class PhasedCommandEngineUsageError extends Error {
   /** The exit code of native Rush for this command line. */
   public readonly exitCode: number;
+  /** The usage of the command, which native Rush prints to stdout before the message, if it is known. */
+  public readonly usage: string | undefined;
 
   // The shape of ErrorOptions, which needs lib es2022. Consumers of these typings may use an older lib.
-  public constructor(message: string, exitCode: number, options?: { cause?: unknown }) {
+  public constructor(message: string, exitCode: number, options?: { cause?: unknown; usage?: string }) {
     super(message, options);
     this.name = 'PhasedCommandEngineUsageError';
     this.exitCode = exitCode;
+    this.usage = options?.usage;
   }
 }
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index 9eaaa9e90b..62f6a4facd 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -350,20 +350,30 @@ describe(PhasedCommandEngine.name, () => {
 
   it('reports an invalid command line as a usage error with the exit code of native Rush', async () => {
     const folder: string = createTestRepo({ associatedCommands: [] });
-    // The parser also prints the usage, as native Rush does.
-    const stderrWrite: jest.SpyInstance = jest.spyOn(process.stderr, 'write').mockReturnValue(true);
+    // Like native Rush, the parser also writes the usage to stdout. The error carries the same text.
+    const written: [stream: 'stdout' | 'stderr', text: string][] = [];
+    const writeSpies: jest.SpyInstance[] = (['stdout', 'stderr'] as const).map((stream) =>
+      jest
+        .spyOn(process[stream], 'write')
+        .mockImplementation((chunk: string | Uint8Array) => written.push([stream, String(chunk)]) > 0)
+    );
     try {
       for (const [argv, message] of [
         [['build', '--nope'], 'rush build: error: Unrecognized arguments: --nope.'],
         [['rebuild', '--to'], 'rush rebuild: error: argument "-t/--to": Expected one argument. null']
       ] as const) {
+        written.length = 0;
         const error: unknown = await parseBuildAsync(folder, [...argv]).catch((e: unknown) => e);
         expect(error).toBeInstanceOf(PhasedCommandEngineUsageError);
-        const { message: actualMessage, exitCode } = error as PhasedCommandEngineUsageError;
+        const { message: actualMessage, exitCode, usage } = error as PhasedCommandEngineUsageError;
         expect({ message: actualMessage, exitCode }).toEqual({ message, exitCode: 2 });
+        expect(usage).toMatch(new RegExp(`^usage: rush ${argv[0]} \\[-h\\] `));
+        expect(written).toEqual([['stdout', usage]]);
       }
     } finally {
-      stderrWrite.mockRestore();
+      for (const writeSpy of writeSpies) {
+        writeSpy.mockRestore();
+      }
     }
   });
 

From 99b0d90a140b8c672827f1d6bccaf10ffc806d1d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 224/265] [rush-daemon] Test that the lock holder's command is
 sent once it can be read

Swarm integration step 209; original commit e9bdc07fa6 (merge of swarm/r04-t306-nit1 at 04f4db946a).
Scope: task 306 NIT 1.

Brings 306n1 (branch swarm/r04-t306-nit1). Second agent: t07 board 7372 (RESULT board 7371, CORRECTION 1 board 7377). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 4 of 13. Gate: ch01 GATE OK board 8015 (tree f786d14e84)

Commits folded into this step (1):
- 04f4db946a [rush-daemon] Test that the lock holder's command is sent once it can be read

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../swarm-r04-t306-nit1_2026-09-29-21-00.json | 11 ++++++++++
 .../src/test/NativeLockAdmission.test.ts      | 21 +++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t306-nit1_2026-09-29-21-00.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t306-nit1_2026-09-29-21-00.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t306-nit1_2026-09-29-21-00.json
new file mode 100644
index 0000000000..747a623d47
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t306-nit1_2026-09-29-21-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A test now expects the command of the process that holds the repository's lock to be sent to the client once it can be read, so it fails if the daemon keeps the holder that it first found without a command.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
index 80b5cfef8f..69d19f03d8 100644
--- a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
@@ -311,6 +311,27 @@ describe(`${RequestAdmissionController.name} and native Rush's repository lock`,
     });
   });
 
+  it('tells the client the command of the process that holds the lock once the command can be read', async () => {
+    // At first its command cannot be read.
+    probe.hold({ pid: HOLDER.pid });
+    const { controller, messages } = createController({ waitTimeoutMs: 1000 });
+    const acquisition: IAcquisition = track(
+      controller.acquireNativeLockAsync(probe.tryAcquire, probe.findHolder)
+    );
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.hold();
+    await jest.advanceTimersByTimeAsync(1000 - POLL_MS);
+    expect({ messages, error: acquisition.error }).toMatchObject({
+      messages: [waitMessage({ pid: HOLDER.pid }), waitMessage(HOLDER)],
+      error: {
+        code: RequestSchedulerErrorCode.WaitTimeout,
+        message: expect.stringContaining(
+          "another Rush process (PID 4242: rush install) to release this repository's"
+        )
+      }
+    });
+  });
+
   it('names another Rush process when it cannot tell which process holds the lock', async () => {
     probe.hold({});
     const { controller, messages } = createController({ waitTimeoutMs: POLL_MS });

From c31a0817b4c06508d72093c376b8c142964d5d8b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 225/265] [rush-daemon-transport] Resend a queued request only
 when every daemon frame was read

Swarm integration step 210; original commit be7f7485f3 (merge of o07/t310-e2h at 16cf7ebb8a).
Scope: task 310, F' on 309's ^2 (CLAIM board 7599).

Brings 310 (branch o07/t310-e2h). Second agent: r02 board 7727 (RESULT board 7726; on F: board 7312). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 5 of 13. Gate: ch01 GATE OK board 8015 (tree d7c728ee08)

Commits folded into this step (1):
- 16cf7ebb8a Resend a queued request only when every daemon frame was read

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ad-all-before-resend_2026-09-29-20-21.json |  11 ++
 ...ad-all-before-resend_2026-09-29-20-21.json |  11 ++
 ...ad-all-before-resend_2026-09-29-20-21.json |  11 ++
 .../reviews/api/rush-daemon-transport.api.md  |   2 +
 libraries/rush-client-core/README.md          |   8 +-
 .../rush-client-core/src/DaemonClient.ts      |  11 +-
 .../src/test/QueuedRequestResend.test.ts      | 174 +++++++++++++++++-
 libraries/rush-daemon-transport/README.md     |   4 +
 .../src/DaemonBufferedWrite.ts                |  13 ++
 .../src/DaemonFrameConnection.ts              |  56 +++---
 .../src/DaemonFrameReceiver.ts                |  74 ++++++++
 .../src/test/ClosedAfterReadingAll.test.ts    | 100 ++++++++++
 .../test/ClosedAfterReadingAllDiscard.test.ts |  55 ++++++
 .../src/test/SendFrameWritten.test.ts         |  68 +++++++
 .../src/test/UnreadingPeerFixture.ts          | 100 ++++++++++
 libraries/rush-daemon/README.md               |   6 +-
 .../rush-daemon/src/DaemonControlSession.ts   |  20 +-
 .../src/DaemonWireRequestClient.ts            |   8 +-
 .../rush-daemon/src/RequestStartedNotice.ts   |   5 +-
 .../src/test/DaemonRequestStarted.test.ts     |  46 +++++
 .../src/test/DaemonWireRequestClient.test.ts  |   5 +-
 21 files changed, 745 insertions(+), 43 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-client-core/read-all-before-resend_2026-09-29-20-21.json
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/read-all-before-resend_2026-09-29-20-21.json
 create mode 100644 common/changes/@rushstack/rush-daemon/read-all-before-resend_2026-09-29-20-21.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts

diff --git a/common/changes/@rushstack/rush-client-core/read-all-before-resend_2026-09-29-20-21.json b/common/changes/@rushstack/rush-client-core/read-all-before-resend_2026-09-29-20-21.json
new file mode 100644
index 0000000000..9481f8dfae
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/read-all-before-resend_2026-09-29-20-21.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "Do not send a request to a new daemon when the connection to the exited daemon closed before the client read everything that the daemon sent, because what it did not read may have said that the request started.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-transport/read-all-before-resend_2026-09-29-20-21.json b/common/changes/@rushstack/rush-daemon-transport/read-all-before-resend_2026-09-29-20-21.json
new file mode 100644
index 0000000000..271974a736
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/read-all-before-resend_2026-09-29-20-21.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add `DaemonFrameConnection.sendFrameWrittenAsync`, which resolves only once the operating system holds the frame, and `DaemonFrameConnection.closedAfterReadingAll`, which says whether a closed connection read every byte that its peer sent.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/read-all-before-resend_2026-09-29-20-21.json b/common/changes/@rushstack/rush-daemon/read-all-before-resend_2026-09-29-20-21.json
new file mode 100644
index 0000000000..6b1dd86cba
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/read-all-before-resend_2026-09-29-20-21.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Run a request only once the operating system holds its `requestStarted` notice, so that the client can read the notice even if the daemon exits as soon as the request starts.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-transport.api.md b/common/reviews/api/rush-daemon-transport.api.md
index 220d7aa4ec..5d86c4a250 100644
--- a/common/reviews/api/rush-daemon-transport.api.md
+++ b/common/reviews/api/rush-daemon-transport.api.md
@@ -32,9 +32,11 @@ export class DaemonFrameConnection {
     // @internal
     abort(error: Error): void;
     closeAsync(): Promise<void>;
+    get closedAfterReadingAll(): boolean;
     onClosed(handler: (error: Error | undefined) => void): void;
     onFrame(handler: (frame: IDaemonFrame) => void | Promise<void>): void;
     sendFrameAsync(frame: IDaemonFrame): Promise<void>;
+    sendFrameWrittenAsync(frame: IDaemonFrame): Promise<void>;
     // @internal
     get socket(): net.Socket;
 }
diff --git a/libraries/rush-client-core/README.md b/libraries/rush-client-core/README.md
index 5aca49e366..f1b8160b3b 100644
--- a/libraries/rush-client-core/README.md
+++ b/libraries/rush-client-core/README.md
@@ -87,8 +87,12 @@ If the daemon exits while the request waits in its queue, the request has not ru
 when it starts a request (protocol 0.14), but has not said so, no output, event, terminal
 control or stdin admission arrived, and the client did not ask it to cancel. Before the
 client fails the request for a closed connection, it handles the frames that it had received
-by then, so a `requestStarted` that arrived just before the daemon exited still counts.
-`executeWithDaemonRestartAsync()` then sends the request to a new daemon, started as
+by then, so a `requestStarted` that arrived just before the daemon exited still counts. A
+connection that closed without reading everything that the daemon sent (see
+`DaemonFrameConnection.closedAfterReadingAll`), for example one that reset while a frame
+waited unread, makes `queuedWithoutStarting` false too, because that frame may have said that
+the request started. When it is true, `executeWithDaemonRestartAsync()` sends the request to
+a new daemon, started as
 `connectOrStartDaemonAsync()` would after the exited daemon is reclaimed (see below), once per
 call and within the request's admission deadline. Before that daemon starts, `onRestartAsync`
 gets the exited daemon's PID as `exitedPid`, with no `successorPid`. The request is not sent
diff --git a/libraries/rush-client-core/src/DaemonClient.ts b/libraries/rush-client-core/src/DaemonClient.ts
index 807efaf497..3c4de3c094 100644
--- a/libraries/rush-client-core/src/DaemonClient.ts
+++ b/libraries/rush-client-core/src/DaemonClient.ts
@@ -229,6 +229,8 @@ export class DaemonClient {
   #supportsRequestStarted: boolean = false;
   #queued: boolean = false;
   #requestStarted: boolean = false;
+  /** Whether the connection closed before the client read everything that the daemon sent. */
+  #closedBeforeReadingAll: boolean = false;
   #inputAcknowledgement: IDeferred<void> | undefined;
   #inputTail: Promise<void> = Promise.resolve();
   #rawModeChanged: boolean = false;
@@ -261,6 +263,8 @@ export class DaemonClient {
           'disconnected',
           this.#shutdown ? 'Daemon disconnected before acknowledging shutdown.' : DAEMON_DISCONNECTED_MESSAGE
         );
+      // A frame that the close discarded may have said that the request left the queue.
+      this.#closedBeforeReadingAll = !connection.closedAfterReadingAll;
       if (!this.queuedWithoutStarting) {
         this.#fail(lost);
         return;
@@ -321,7 +325,9 @@ export class DaemonClient {
    * Whether the request waited in the daemon's queue and is known not to have started: the daemon reported a queue
    * position and says when it starts a request (protocol 0.14), but has not said so, no output, event, terminal
    * control or stdin admission arrived, and the client did not ask it to cancel. If the daemon exits then, the
-   * request has not run.
+   * request has not run. Once the connection has closed, this is also false unless the client read everything
+   * that the daemon sent (see `DaemonFrameConnection.closedAfterReadingAll`), because a frame that the close
+   * discarded may have said that the request started.
    */
   public get queuedWithoutStarting(): boolean {
     return (
@@ -332,7 +338,8 @@ export class DaemonClient {
       !this.#inputAdmitted &&
       !this.#inputStarted &&
       !this.#rawModeChanged &&
-      !this.#cancelSent
+      !this.#cancelSent &&
+      !this.#closedBeforeReadingAll
     );
   }
 
diff --git a/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts b/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
index 4135125138..8737dcd1dd 100644
--- a/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
+++ b/libraries/rush-client-core/src/test/QueuedRequestResend.test.ts
@@ -1,16 +1,25 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import * as net from 'node:net';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
-import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+import {
+  DAEMON_PROTOCOL_VERSION,
+  DaemonFrameType,
+  encodeDaemonControlMessage,
+  encodeDaemonFrame,
+  type DaemonControlMessage,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
 import type { IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { captureDaemonRequest } from '../captureDaemonRequest';
-import type { DaemonClient, DaemonClientOutcome } from '../DaemonClient';
+import { DaemonClient, type DaemonClientOutcome } from '../DaemonClient';
 import {
   DAEMON_DISCONNECTED_AFTER_RESEND_MESSAGE,
   DAEMON_DISCONNECTED_MESSAGE,
@@ -287,4 +296,165 @@ describe('a request that waited in the queue of a daemon that exited', () => {
     expect((error as DaemonClientError).cause).toBeInstanceOf(DaemonClientError);
     expect(readLines('requests')).toHaveLength(1);
   });
+
+  // A write-only daemon never reads, so the client's bytes wait unread and its close resets the connection. The
+  // client then loses what it had not read yet. A Unix socket stands in for the daemon's.
+  describe('whose connection reset', () => {
+    const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+
+    interface IResetRow {
+      /** Whether the client's queue position handler holds, so that the connection pauses, until the reset. */
+      readonly holdQueuePosition: boolean;
+      /** Whether the daemon sends requestStarted after the queue position. */
+      readonly sendRequestStarted: boolean;
+    }
+
+    interface IResetOutcome {
+      readonly error: unknown;
+      readonly exitedPid: number;
+      readonly queuedWithoutStarting: boolean;
+      readonly restarts: number;
+    }
+
+    function writeControlAsync(socket: net.Socket, message: DaemonControlMessage): Promise<void> {
+      const bytes: Uint8Array = encodeDaemonFrame({
+        kind: DaemonFrameType.controlJson,
+        payload: encodeDaemonControlMessage(message)
+      });
+      return new Promise<void>((resolve, reject) => {
+        socket.write(bytes, (error: Error | null | undefined) => (error ? reject(error) : resolve()));
+      });
+    }
+
+    function exitedText(pid: number, whileQueued: boolean): string {
+      return (
+        `${DAEMON_DISCONNECTED_MESSAGE} rushd (PID ${pid}) exited while ` +
+        `${whileQueued ? 'the command was queued' : 'it ran the command'}; "rush-client daemon logs" may show ` +
+        'why. Run the command again; if the daemon exits again, run the command with "rush-client --no-daemon".'
+      );
+    }
+
+    /** Sends a request without a way to start a new daemon, and resets the connection once the frames are sent. */
+    async function runResetRowAsync({
+      holdQueuePosition,
+      sendRequestStarted
+    }: IResetRow): Promise<IResetOutcome> {
+      // The daemon reports the PID of a process that has exited, so the client finds it gone after the reset.
+      const exitedPid: number = spawnSync(process.execPath, ['-e', '']).pid;
+      let accept!: (socket: net.Socket) => void;
+      const accepted: Promise<net.Socket> = new Promise<net.Socket>((resolve) => (accept = resolve));
+      const server: net.Server = net.createServer({ pauseOnConnect: true }, (socket: net.Socket) => {
+        socket.on('error', () => undefined);
+        accept(socket);
+      });
+      await new Promise<void>((resolve) => server.listen(options.paths.socketPath, resolve));
+      const clientPromise: Promise<DaemonClient> = DaemonClient.connectAsync({
+        socketPath: options.paths.socketPath
+      });
+      const peer: net.Socket = await accepted;
+      try {
+        await writeControlAsync(peer, {
+          kind: 'helloAck',
+          payload: { protocolVersion: DAEMON_PROTOCOL_VERSION, sessionId: 'write-only' }
+        });
+        await writeControlAsync(peer, {
+          kind: 'pong',
+          payload: { uptimeMs: 1, daemonVersion: 'fixture', pid: exitedPid }
+        });
+        const client: DaemonClient = await clientPromise;
+        const request: IDaemonRequestEnvelope = captureRequest();
+        let queuePositionSeen!: () => void;
+        const seen: Promise<void> = new Promise<void>((resolve) => (queuePositionSeen = resolve));
+        let release!: () => void;
+        const released: Promise<void> = new Promise<void>((resolve) => (release = resolve));
+        let restarts: number = 0;
+        const settled: Promise<unknown> = executeWithDaemonRestartAsync(
+          client,
+          { ...options, startCommand: undefined },
+          {
+            request,
+            onQueuePositionAsync: async () => {
+              queuePositionSeen();
+              if (holdQueuePosition) await released;
+            },
+            onRestartAsync: async () => {
+              restarts++;
+            }
+          }
+        ).then(
+          (outcome: DaemonClientOutcome) => outcome,
+          (error: unknown) => error
+        );
+        try {
+          // The client has sent the request once its callbacks ran.
+          await new Promise<void>((resolve) => setImmediate(resolve));
+          const { requestId } = request;
+          await writeControlAsync(peer, { kind: 'queuePosition', payload: { position: 1, requestId } });
+          await seen;
+          if (sendRequestStarted) {
+            await writeControlAsync(peer, { kind: 'requestStarted', payload: { requestId } });
+          }
+          await delayAsync(50);
+          peer.destroy();
+          // The client reads the reset while the queue position handler still holds.
+          await delayAsync(50);
+        } finally {
+          release();
+        }
+        const error: unknown = await settled;
+        return { error, exitedPid, queuedWithoutStarting: client.queuedWithoutStarting, restarts };
+      } finally {
+        peer.destroy();
+        await new Promise<void>((resolve) => server.close(() => resolve()));
+      }
+    }
+
+    posixIt(
+      'does not say that the request was queued when the reset discarded a requestStarted',
+      async () => {
+        const outcome: IResetOutcome = await runResetRowAsync({
+          holdQueuePosition: true,
+          sendRequestStarted: true
+        });
+        expect(outcome.error).toBeInstanceOf(DaemonClientError);
+        expect(outcome.error).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+        expect(outcome.error).toMatchObject({
+          code: 'disconnected',
+          message: exitedText(outcome.exitedPid, false)
+        });
+        expect(outcome.queuedWithoutStarting).toBe(false);
+        expect(outcome.restarts).toBe(0);
+      }
+    );
+
+    posixIt(
+      'says that the request ran when the client read the requestStarted before the reset',
+      async () => {
+        const outcome: IResetOutcome = await runResetRowAsync({
+          holdQueuePosition: false,
+          sendRequestStarted: true
+        });
+        expect(outcome.error).not.toBeInstanceOf(DaemonExitedWhileQueuedError);
+        expect(outcome.error).toMatchObject({
+          code: 'disconnected',
+          message: exitedText(outcome.exitedPid, false)
+        });
+        expect(outcome.queuedWithoutStarting).toBe(false);
+      }
+    );
+
+    posixIt('says that the request was queued when the client read everything before the reset', async () => {
+      const outcome: IResetOutcome = await runResetRowAsync({
+        holdQueuePosition: false,
+        sendRequestStarted: false
+      });
+      expect(outcome.error).toBeInstanceOf(DaemonExitedWhileQueuedError);
+      expect(outcome.error).toMatchObject({
+        code: 'disconnected',
+        message: exitedText(outcome.exitedPid, true)
+      });
+      expect(outcome.queuedWithoutStarting).toBe(true);
+      expect(outcome.restarts).toBe(0);
+    });
+  });
 });
diff --git a/libraries/rush-daemon-transport/README.md b/libraries/rush-daemon-transport/README.md
index 4b582d8bb0..2c0d5cdb1c 100644
--- a/libraries/rush-daemon-transport/README.md
+++ b/libraries/rush-daemon-transport/README.md
@@ -20,6 +20,10 @@ The workspace-keyed socket/pipe **transport** for the Rush daemon (`rushd`):
 - **`net` listener and connector** — framed with
   [`@rushstack/rush-daemon-protocol`](https://www.npmjs.com/package/@rushstack/rush-daemon-protocol),
   with backpressure-aware writes and serialized async frame handlers for inbound flow control.
+  `sendFrameWrittenAsync` resolves only once the operating system holds the frame, so the peer
+  can read it even if this process exits next. The socket is paused while a handler runs, and a
+  failed write or a reset from the peer discards the bytes that wait in its buffer;
+  `closedAfterReadingAll` says whether a closed connection read every byte that the peer sent.
 - **PID/lockfile handling** — stale sockets and dead PIDs are detected (two-factor: PID liveness
   plus a connect probe) and reclaimed without manual cleanup. On POSIX, a reclaim first stops the
   operations that the dead daemon left running. Both `reclaimStaleDaemonAsync` and
diff --git a/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
index 29ada609f3..2435ddd1bf 100644
--- a/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
+++ b/libraries/rush-daemon-transport/src/DaemonBufferedWrite.ts
@@ -42,3 +42,16 @@ export function waitForBufferedWriteAsync(socket: net.Socket): Promise<void> {
     socket.on('drain', onWritten).on('finish', onWritten).on('close', onClosed).on('error', settle);
   });
 }
+
+/**
+ * Writes bytes and waits for the socket's write callback, which runs once the operating system holds all of
+ * them, after every earlier write.
+ * @remarks
+ * Rejects with the socket's error when the write fails, as it does on a socket that has already closed.
+ * @internal
+ */
+export function writeUntilWrittenAsync(socket: net.Socket, bytes: Uint8Array): Promise<void> {
+  return new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+    socket.write(bytes, (error: Error | null | undefined) => (error ? reject(error) : resolve()));
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts b/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
index 3e42c92a35..ee07cb535f 100644
--- a/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
+++ b/libraries/rush-daemon-transport/src/DaemonFrameConnection.ts
@@ -3,10 +3,11 @@
 
 import type * as net from 'node:net';
 
-import { DaemonFrameDecoder, encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
+import { encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
 import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
 
-import { waitForBufferedWriteAsync } from './DaemonBufferedWrite';
+import { waitForBufferedWriteAsync, writeUntilWrittenAsync } from './DaemonBufferedWrite';
+import { DaemonFrameReceiver } from './DaemonFrameReceiver';
 import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTransportError';
 
 /** One end of a framed rushd connection over a `net` socket (Unix socket or named pipe).
@@ -17,25 +18,34 @@ import { DaemonTransportError, DaemonTransportErrorCode } from './DaemonTranspor
  * @beta */
 export class DaemonFrameConnection {
   readonly #socket: net.Socket;
-  readonly #decoder: DaemonFrameDecoder = new DaemonFrameDecoder();
-  #frameHandler: ((frame: IDaemonFrame) => void | Promise<void>) | undefined;
+  readonly #receiver: DaemonFrameReceiver;
   #closedHandler: ((error: Error | undefined) => void) | undefined;
   #closedError: Error | undefined;
-  #receiveQueue: Promise<void> = Promise.resolve();
   public constructor(socket: net.Socket) {
     this.#socket = socket;
-    socket.on('data', (chunk: Buffer) => this.#onData(chunk));
+    this.#receiver = new DaemonFrameReceiver(socket, (error: unknown) => this.#fail(error));
     socket.on('error', (error: Error) => this.#onError(error));
     socket.on('close', () => this.#onClose());
   }
   /** Registers the serialized, backpressured handler invoked for each decoded frame. */
   public onFrame(handler: (frame: IDaemonFrame) => void | Promise<void>): void {
-    this.#frameHandler = handler;
+    this.#receiver.frameHandler = handler;
   }
   /** Registers the close handler, invoked at most once with the cause. */
   public onClosed(handler: (error: Error | undefined) => void): void {
     this.#closedHandler = handler;
   }
+  /**
+   * Whether the connection has closed after it read every byte that the peer sent, so that the close discarded
+   * no frame: it read the peer's end, or a reset that came once nothing was left to read. Each of those frames
+   * goes to the frame handler in order, though some may not be handled yet.
+   * @remarks False while the connection is open, and after `abort()`, a malformed frame, a throwing handler or
+   * any other close, such as a failed write, or a reset while bytes waited in the socket's buffer, which is
+   * paused while a handler runs. The operating system reports a reset only after the bytes that came before it.
+   */
+  public get closedAfterReadingAll(): boolean {
+    return this.#receiver.closedAfterReadingAll;
+  }
   /** Encodes and writes a frame, resolving once the socket has written it. @throws {@link DaemonTransportError} when closed, or when it closes first. */
   public async sendFrameAsync(frame: IDaemonFrame): Promise<void> {
     this.#assertOpen();
@@ -43,6 +53,15 @@ export class DaemonFrameConnection {
       await waitForBufferedWriteAsync(this.#socket);
     }
   }
+  /**
+   * Encodes and writes a frame, resolving only once the operating system holds all of it, after every earlier
+   * frame, so that the peer can read it even if this process exits next. `sendFrameAsync` can resolve sooner.
+   * @throws {@link DaemonTransportError} when closed, or the socket's error when the write fails.
+   */
+  public async sendFrameWrittenAsync(frame: IDaemonFrame): Promise<void> {
+    this.#assertOpen();
+    await writeUntilWrittenAsync(this.#socket, encodeDaemonFrame(frame));
+  }
   /** Half-closes the writable side and releases the socket. */
   public async closeAsync(): Promise<void> {
     this.#socket.end();
@@ -51,6 +70,7 @@ export class DaemonFrameConnection {
   /** Immediately closes a connection whose graceful drain cannot make progress. @internal */
   public abort(error: Error): void {
     this.#closedError = this.#closedError ?? error;
+    this.#receiver.discard();
     this.#socket.destroy(error);
   }
   /** The wrapped socket, for the internal raw-write test hook. @internal */
@@ -65,30 +85,10 @@ export class DaemonFrameConnection {
       );
     }
   }
-  #onData(chunk: Buffer): void {
-    let frames: IDaemonFrame[];
-    try {
-      frames = this.#decoder.push(chunk);
-    } catch (error) {
-      this.#fail(error);
-      return;
-    }
-    this.#socket.pause();
-    this.#receiveQueue = this.#receiveQueue
-      .then(() => this.#dispatchFramesAsync(frames))
-      .then(() => {
-        this.#socket.resume();
-      })
-      .catch((error: unknown) => this.#fail(error));
-  }
-  async #dispatchFramesAsync(frames: ReadonlyArray<IDaemonFrame>): Promise<void> {
-    for (const frame of frames) {
-      await this.#frameHandler?.(frame);
-    }
-  }
   #fail(error: unknown): void {
     const cause: Error = error instanceof Error ? error : new Error(String(error));
     this.#closedError = this.#closedError ?? cause;
+    this.#receiver.discard();
     this.#socket.destroy(cause);
   }
   #onError(error: Error): void {
diff --git a/libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts b/libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts
new file mode 100644
index 0000000000..0d4cb869bf
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonFrameReceiver.ts
@@ -0,0 +1,74 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as net from 'node:net';
+
+import { DaemonFrameDecoder } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+/**
+ * The receiving side of a `DaemonFrameConnection`. It decodes the socket's bytes to frames in wire order and
+ * hands them to the frame handler one at a time, and it tracks whether the socket closed after it read every
+ * byte that the peer sent.
+ * @remarks
+ * The socket is paused while the handler runs, so bytes that arrive meanwhile wait in its buffer, and a close
+ * that comes first discards them: a failed write, or a reset from the peer. The operating system reports a
+ * reset only after the bytes that arrived before it, so a reset with nothing buffered lost nothing. A named
+ * pipe ends rather than resets.
+ * @internal
+ */
+export class DaemonFrameReceiver {
+  public frameHandler: ((frame: IDaemonFrame) => void | Promise<void>) | undefined;
+  readonly #socket: net.Socket;
+  readonly #fail: (error: unknown) => void;
+  readonly #decoder: DaemonFrameDecoder = new DaemonFrameDecoder();
+  #receiveQueue: Promise<void> = Promise.resolve();
+  #readAll: boolean = false;
+  #discarded: boolean = false;
+  public constructor(socket: net.Socket, fail: (error: unknown) => void) {
+    this.#socket = socket;
+    this.#fail = fail;
+    socket.on('data', (chunk: Buffer) => this.#onData(chunk));
+    socket.on('end', () => {
+      this.#readAll = true;
+    });
+    socket.on('error', (error: Error) => {
+      this.#readAll ||= isResetWithNothingUnread(error, socket);
+    });
+  }
+  /** Whether the socket has closed after it read every byte that the peer sent, and this side did not discard. */
+  public get closedAfterReadingAll(): boolean {
+    return this.#socket.closed && this.#readAll && !this.#discarded;
+  }
+  /** Records that this side is closing the connection, which may discard bytes that arrived but were not read. */
+  public discard(): void {
+    this.#discarded = true;
+  }
+  #onData(chunk: Buffer): void {
+    let frames: IDaemonFrame[];
+    try {
+      frames = this.#decoder.push(chunk);
+    } catch (error) {
+      this.#fail(error);
+      return;
+    }
+    this.#socket.pause();
+    this.#receiveQueue = this.#receiveQueue
+      .then(() => this.#dispatchFramesAsync(frames))
+      .then(() => {
+        this.#socket.resume();
+      })
+      .catch((error: unknown) => this.#fail(error));
+  }
+  async #dispatchFramesAsync(frames: ReadonlyArray<IDaemonFrame>): Promise<void> {
+    for (const frame of frames) {
+      await this.frameHandler?.(frame);
+    }
+  }
+}
+
+/** A reset that a read reported while the socket's buffer held nothing that the peer sent. */
+function isResetWithNothingUnread(error: Error, socket: net.Socket): boolean {
+  const { code, syscall } = error as NodeJS.ErrnoException;
+  return code === 'ECONNRESET' && syscall === 'read' && !socket.readableLength;
+}
diff --git a/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts
new file mode 100644
index 0000000000..aa8ea54a1a
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAll.test.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { createFrame, nextMacrotaskAsync, trackSend } from './BackpressureFixture';
+import type { SendState } from './BackpressureFixture';
+import { createDeferred } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+import {
+  FIRST_BYTES,
+  SECOND_BYTES,
+  holdFirstFrame,
+  sendWhileHeldAsync,
+  withUnreadingPeerAsync,
+  writeFramesAsync
+} from './UnreadingPeerFixture';
+import type { IHeldHandler, IUnreadingPeerPair } from './UnreadingPeerFixture';
+
+// These tests use Unix sockets, where a write to a socket whose peer has closed fails with EPIPE.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+// On Linux, a Unix socket that closes with bytes it never read resets its peer's connection.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+posixIt(
+  'closedAfterReadingAll is true when the peer ends while a handler runs, once every frame is read',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      const handler: IHeldHandler = holdFirstFrame(pair.reader);
+      await sendWhileHeldAsync(pair, handler);
+      // The peer has nothing of the reader's unread, so this ends the connection rather than resetting it.
+      pair.peer.destroy();
+      await nextMacrotaskAsync();
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+      handler.release();
+      expect(await pair.closed).toBeUndefined();
+      await nextMacrotaskAsync();
+      expect(handler.received).toEqual([FIRST_BYTES, SECOND_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(true);
+    });
+  }
+);
+
+posixIt(
+  'closedAfterReadingAll is false when a write fails after the peer closed, while a frame waits',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      const handler: IHeldHandler = holdFirstFrame(pair.reader);
+      await sendWhileHeldAsync(pair, handler);
+      pair.peer.destroy();
+      const sendState: () => SendState = trackSend(pair.reader.sendFrameAsync(createFrame(FIRST_BYTES)));
+      expect(await pair.closed).toMatchObject({ code: 'EPIPE', syscall: 'write' });
+      handler.release();
+      await nextMacrotaskAsync();
+      expect(sendState()).toMatchObject({ code: 'EPIPE' });
+      expect(handler.received).toEqual([FIRST_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
+
+linuxIt(
+  'closedAfterReadingAll is false when the peer resets the connection while a frame waits',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      // The peer never reads this, so its close resets the connection.
+      await pair.reader.sendFrameAsync(createFrame(FIRST_BYTES));
+      const handler: IHeldHandler = holdFirstFrame(pair.reader);
+      await sendWhileHeldAsync(pair, handler);
+      pair.peer.destroy();
+      expect(await pair.closed).toMatchObject({ code: 'ECONNRESET', syscall: 'read' });
+      handler.release();
+      await nextMacrotaskAsync();
+      expect(handler.received).toEqual([FIRST_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
+
+linuxIt(
+  'closedAfterReadingAll is true when the peer resets the connection once every frame is read',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      await pair.reader.sendFrameAsync(createFrame(FIRST_BYTES));
+      const received: number[] = [];
+      const lastReceived: IDeferred<void> = createDeferred<void>();
+      pair.reader.onFrame((frame: IDaemonFrame) => {
+        received.push(frame.payload.length);
+        if (frame.payload.length === SECOND_BYTES) lastReceived.resolve();
+      });
+      await writeFramesAsync(pair.peer, FIRST_BYTES);
+      await writeFramesAsync(pair.peer, SECOND_BYTES);
+      await lastReceived.promise;
+      pair.peer.destroy();
+      expect(await pair.closed).toMatchObject({ code: 'ECONNRESET', syscall: 'read' });
+      expect(received).toEqual([FIRST_BYTES, SECOND_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(true);
+    });
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
new file mode 100644
index 0000000000..57154308d0
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { createFrame, nextMacrotaskAsync } from './BackpressureFixture';
+import { createDeferred } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+import { FIRST_BYTES, SECOND_BYTES, withUnreadingPeerAsync, writeFramesAsync } from './UnreadingPeerFixture';
+import type { IUnreadingPeerPair } from './UnreadingPeerFixture';
+
+// These tests use Unix sockets.
+const posixIt: jest.It = process.platform === 'win32' ? it.skip : it;
+// On Linux, a Unix socket that closes with bytes it never read resets its peer's connection.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+posixIt('closedAfterReadingAll is false while the connection is open, and after abort()', async () => {
+  await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+    expect(pair.reader.closedAfterReadingAll).toBe(false);
+    const abortError: Error = new Error('The test aborted the connection.');
+    pair.reader.abort(abortError);
+    expect(await pair.closed).toBe(abortError);
+    expect(pair.reader.closedAfterReadingAll).toBe(false);
+  });
+});
+
+linuxIt(
+  'closedAfterReadingAll is false once a handler throws, even after a reset once every byte was read',
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      // The peer never reads this, so its close resets the connection.
+      await pair.reader.sendFrameAsync(createFrame(FIRST_BYTES));
+      const received: number[] = [];
+      const holding: IDeferred<void> = createDeferred<void>();
+      const failure: IDeferred<void> = createDeferred<void>();
+      pair.reader.onFrame(async (frame: IDaemonFrame) => {
+        received.push(frame.payload.length);
+        holding.resolve();
+        await failure.promise;
+        throw new Error('The handler failed.');
+      });
+      // Both frames arrive in one read, so the second waits for the handler rather than in the socket's buffer.
+      await writeFramesAsync(pair.peer, FIRST_BYTES, SECOND_BYTES);
+      await holding.promise;
+      pair.peer.destroy();
+      expect(await pair.closed).toMatchObject({ code: 'ECONNRESET', syscall: 'read' });
+      expect(pair.reader.closedAfterReadingAll).toBe(true);
+      failure.resolve();
+      await nextMacrotaskAsync();
+      // The frame after the one whose handler threw never reaches the handler.
+      expect(received).toEqual([FIRST_BYTES]);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts b/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
new file mode 100644
index 0000000000..06de020f42
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type * as net from 'node:net';
+import { Duplex } from 'node:stream';
+
+import { DaemonFrameConnection } from '../DaemonFrameConnection';
+
+import { createFrame, nextMacrotaskAsync, trackSend } from './BackpressureFixture';
+import type { SendState } from './BackpressureFixture';
+
+const FIRST_BYTES: number = 1;
+const SECOND_BYTES: number = 2;
+
+/** A connection over a socket that finishes each write only when the test calls that write's callback. */
+interface IHeldWriteConnection {
+  readonly connection: DaemonFrameConnection;
+  readonly writeCallbacks: Array<(error?: Error | null) => void>;
+}
+
+function createHeldWriteConnection(): IHeldWriteConnection {
+  const writeCallbacks: Array<(error?: Error | null) => void> = [];
+  const socket: Duplex = new Duplex({
+    read(): void {
+      // Nothing arrives.
+    },
+    write(chunk: Buffer, encoding: BufferEncoding, callback: (error?: Error | null) => void): void {
+      writeCallbacks.push(callback);
+    }
+  });
+  return { connection: new DaemonFrameConnection(socket as net.Socket), writeCallbacks };
+}
+
+function finishNextWrite(writeCallbacks: Array<(error?: Error | null) => void>, error?: Error): void {
+  const callback: ((error?: Error | null) => void) | undefined = writeCallbacks.shift();
+  if (!callback) {
+    throw new Error('No write is waiting.');
+  }
+  callback(error);
+}
+
+it('sendFrameWrittenAsync resolves only once the socket has written the frame and the frames before it', async () => {
+  const { connection, writeCallbacks } = createHeldWriteConnection();
+  const acceptedState: () => SendState = trackSend(connection.sendFrameAsync(createFrame(FIRST_BYTES)));
+  const writtenState: () => SendState = trackSend(
+    connection.sendFrameWrittenAsync(createFrame(SECOND_BYTES))
+  );
+  await nextMacrotaskAsync();
+  // The socket accepted both frames, but has written neither.
+  expect(acceptedState()).toBe('resolved');
+  expect(writtenState()).toBe('pending');
+  finishNextWrite(writeCallbacks);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe('pending');
+  finishNextWrite(writeCallbacks);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe('resolved');
+});
+
+it("sendFrameWrittenAsync rejects with the socket's error when the write fails", async () => {
+  const { connection, writeCallbacks } = createHeldWriteConnection();
+  const writtenState: () => SendState = trackSend(connection.sendFrameWrittenAsync(createFrame(FIRST_BYTES)));
+  const writeError: Error = new Error('The write failed.');
+  await nextMacrotaskAsync();
+  finishNextWrite(writeCallbacks, writeError);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe(writeError);
+});
diff --git a/libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts b/libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts
new file mode 100644
index 0000000000..198a17ce01
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/UnreadingPeerFixture.ts
@@ -0,0 +1,100 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as net from 'node:net';
+
+import { encodeDaemonFrame } from '@rushstack/rush-daemon-protocol';
+import type { IDaemonFrame } from '@rushstack/rush-daemon-protocol';
+
+import { connectDaemonAsync } from '../DaemonConnector';
+import type { DaemonFrameConnection } from '../DaemonFrameConnection';
+import type { IDaemonPaths } from '../DaemonPaths';
+import { ensureDaemonRuntimeDir } from '../DaemonRuntimeDir';
+
+import { createFrame, nextMacrotaskAsync } from './BackpressureFixture';
+import { createDeferred, createTestDaemonPaths } from './TestDaemonFixture';
+import type { IDeferred } from './TestDaemonFixture';
+
+/** The payload sizes of the two frames that the peer sends, which tell them apart. */
+export const FIRST_BYTES: number = 1;
+export const SECOND_BYTES: number = 2;
+
+/** A connection under test, and a peer that never reads what the connection sends. */
+export interface IUnreadingPeerPair {
+  readonly reader: DaemonFrameConnection;
+  readonly peer: net.Socket;
+  /** The error that the reader closed with. */
+  readonly closed: Promise<Error | undefined>;
+}
+
+/** A frame handler that records the payload sizes it gets, and holds the first frame until `release`. */
+export interface IHeldHandler {
+  readonly received: number[];
+  /** Resolves once the handler holds the first frame, when the connection has paused its socket. */
+  readonly holding: Promise<void>;
+  readonly release: () => void;
+}
+
+async function listenAsync(paths: IDaemonPaths, accepted: IDeferred<net.Socket>): Promise<net.Server> {
+  ensureDaemonRuntimeDir(paths);
+  const server: net.Server = net.createServer({ pauseOnConnect: true }, (socket: net.Socket) => {
+    socket.on('error', () => undefined);
+    accepted.resolve(socket);
+  });
+  await new Promise<void>((resolve: () => void) => server.listen(paths.socketPath, resolve));
+  return server;
+}
+
+/**
+ * Runs a test on a connection whose peer never reads, as a daemon whose event loop is stuck doesn't, so that the
+ * peer's close resets the connection once the connection has sent it anything.
+ */
+export async function withUnreadingPeerAsync(fn: (pair: IUnreadingPeerPair) => Promise<void>): Promise<void> {
+  const paths: IDaemonPaths = createTestDaemonPaths();
+  const accepted: IDeferred<net.Socket> = createDeferred<net.Socket>();
+  const server: net.Server = await listenAsync(paths, accepted);
+  try {
+    const reader: DaemonFrameConnection = await connectDaemonAsync(paths.socketPath);
+    const closed: IDeferred<Error | undefined> = createDeferred<Error | undefined>();
+    reader.onClosed((error: Error | undefined) => closed.resolve(error));
+    const peer: net.Socket = await accepted.promise;
+    try {
+      await fn({ reader, peer, closed: closed.promise });
+    } finally {
+      reader.abort(new Error('The test ended.'));
+      peer.destroy();
+    }
+  } finally {
+    await new Promise<void>((resolve: () => void) => server.close(() => resolve()));
+  }
+}
+
+export function holdFirstFrame(reader: DaemonFrameConnection): IHeldHandler {
+  const received: number[] = [];
+  const holding: IDeferred<void> = createDeferred<void>();
+  const release: IDeferred<void> = createDeferred<void>();
+  reader.onFrame(async (frame: IDaemonFrame) => {
+    received.push(frame.payload.length);
+    if (frame.payload.length === FIRST_BYTES) {
+      holding.resolve();
+      await release.promise;
+    }
+  });
+  return { received, holding: holding.promise, release: () => release.resolve() };
+}
+
+/** The peer writes frames of these payload sizes in one write; resolves once the reader's side holds them. */
+export async function writeFramesAsync(peer: net.Socket, ...byteCounts: number[]): Promise<void> {
+  const bytes: Buffer = Buffer.concat(byteCounts.map((n: number) => encodeDaemonFrame(createFrame(n))));
+  await new Promise<void>((resolve: () => void, reject: (error: Error) => void) => {
+    peer.write(bytes, (error: Error | null | undefined) => (error ? reject(error) : resolve()));
+  });
+}
+
+/** Sends the first frame, and the second one once the reader holds the first, so the second waits unread. */
+export async function sendWhileHeldAsync(pair: IUnreadingPeerPair, handler: IHeldHandler): Promise<void> {
+  await writeFramesAsync(pair.peer, FIRST_BYTES);
+  await handler.holding;
+  await writeFramesAsync(pair.peer, SECOND_BYTES);
+  while (!pair.reader.socket.readableLength) await nextMacrotaskAsync();
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index e3670f8618..0f24857bc2 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -204,8 +204,10 @@ A client that subscribes with `supportsRequestStarted` (protocol 0.14) gets `req
 every queue, before anything from the request is applied. A phased batch sends it to each participant after the native
 lock, the wait for connecting clients and input reconciliation, and before it applies the requests' settings and
 selections, closes runners for a rebuild or schedules the iteration; a global command, Rushx script or graph request
-gets it just before it runs. The daemon goes on only once the notice is written, so a client whose daemon exited
-before the notice knows that its request did not run. A notice that cannot be written does not fail the request.
+gets it just before it runs. The daemon goes on only once the operating system holds the notice, not just once the
+socket accepts it, so the client can read it even if the daemon exits as soon as the request starts, and a client whose
+daemon exited before the notice knows that its request did not run. A notice that cannot be written does not fail the
+request.
 A shutdown uses the same point for every client, whether or not it subscribed: the error of a request that had not
 reached it says that the daemon was shut down while the request was queued and that it did not start, and the error
 of a request past it says that the request was running.
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 102c754033..02536f5957 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -359,6 +359,7 @@ export class DaemonControlSession {
       receivedTimeMs,
       requestId,
       sendControlAsync: (message: DaemonControlMessage) => this.#enqueueControlAsync(message),
+      sendControlWrittenAsync: (message: DaemonControlMessage) => this.#enqueueControlWrittenAsync(message),
       sendFrameAsync: (frame: IDaemonFrame) => this.#enqueueFrameAsync(frame),
       sessionId,
       supportsRequestAdmission: this.#peerSupportsRequestAdmission,
@@ -500,9 +501,24 @@ export class DaemonControlSession {
     );
   }
 
-  #enqueueFrameAsync(frame: IDaemonFrame, closeAfterSend: boolean = false): Promise<void> {
+  /** Like `#enqueueControlAsync`, but resolves only once the operating system holds the whole frame. */
+  #enqueueControlWrittenAsync(message: DaemonControlMessage): Promise<void> {
+    return this.#enqueueFrameAsync(
+      { kind: DaemonFrameType.controlJson, payload: encodeDaemonControlMessage(message) },
+      false,
+      true
+    );
+  }
+
+  #enqueueFrameAsync(
+    frame: IDaemonFrame,
+    closeAfterSend: boolean = false,
+    written: boolean = false
+  ): Promise<void> {
     const sendPromise: Promise<void> = this.#sendQueue
-      .then(() => this.#connection.sendFrameAsync(frame))
+      .then(() =>
+        written ? this.#connection.sendFrameWrittenAsync(frame) : this.#connection.sendFrameAsync(frame)
+      )
       .then(() => {
         // Before its request, a client waits for each reply. A large reply (the pong carries the warm set status)
         // finishes writing only when the event loop runs, so a busy daemon can write it long after the client's
diff --git a/libraries/rush-daemon/src/DaemonWireRequestClient.ts b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
index 0c19083b7f..fb55c5cda0 100644
--- a/libraries/rush-daemon/src/DaemonWireRequestClient.ts
+++ b/libraries/rush-daemon/src/DaemonWireRequestClient.ts
@@ -28,6 +28,8 @@ export interface IDaemonWireRequestClientOptions {
   readonly receivedTimeMs: number;
   readonly requestId: string;
   readonly sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
+  /** Like `sendControlAsync`, but resolves only once the operating system holds the whole frame. */
+  readonly sendControlWrittenAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
   readonly sessionId: string;
   readonly supportsRequestAdmission: boolean;
@@ -42,6 +44,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
   readonly #getNextEventSequence: () => number;
   readonly #requestId: string;
   readonly #sendControlAsync: (message: DaemonControlMessage) => Promise<void>;
+  readonly #sendControlWrittenAsync: (message: DaemonControlMessage) => Promise<void>;
   readonly #sendFrameAsync: (frame: IDaemonFrame) => Promise<void>;
   readonly #supportsRequestStarted: boolean;
   readonly #waitForConnectingClientsAsync: (() => Promise<void>) | undefined;
@@ -62,6 +65,7 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
     this.receivedTimeMs = options.receivedTimeMs;
     this.#requestId = options.requestId;
     this.#sendControlAsync = options.sendControlAsync;
+    this.#sendControlWrittenAsync = options.sendControlWrittenAsync;
     this.#sendFrameAsync = options.sendFrameAsync;
     this.sessionId = options.sessionId;
     this.supportsRequestAdmission = options.supportsRequestAdmission;
@@ -113,12 +117,14 @@ export class DaemonWireRequestClient implements IDaemonRequestDispatchClient {
    * Tells a client that subscribed with `supportsRequestStarted` that the request left every queue, once. Frames
    * are sent in order, so this precedes the request's output. For every client, it records that the request started,
    * so that a shutdown tells a request that never started that it was queued.
+   * It resolves only once the operating system holds the notice, so that the client can read it even if the daemon
+   * exits as soon as the request starts.
    */
   public writeRequestStartedAsync(): Promise<void> {
     this.#requestStarted = true;
     if (!this.#supportsRequestStarted || this.#startedSent) return Promise.resolve();
     this.#startedSent = true;
-    return this.#sendControlAsync({ kind: 'requestStarted', payload: { requestId: this.#requestId } });
+    return this.#sendControlWrittenAsync({ kind: 'requestStarted', payload: { requestId: this.#requestId } });
   }
 
   public writeResultAsync(result: IDaemonCommandResult | IDaemonPhasedRequestResult): Promise<void> {
diff --git a/libraries/rush-daemon/src/RequestStartedNotice.ts b/libraries/rush-daemon/src/RequestStartedNotice.ts
index b19ec527af..5bbcce30c4 100644
--- a/libraries/rush-daemon/src/RequestStartedNotice.ts
+++ b/libraries/rush-daemon/src/RequestStartedNotice.ts
@@ -7,8 +7,9 @@ export interface IRequestStartedClient {
 }
 
 /**
- * Tells the client that its request left the queue, and waits until the frame is written, so that the client learns
- * it before the request can have an effect. A failed write is left to the request's later frames, which report it.
+ * Tells the client that its request left the queue, and waits until the operating system holds the frame, so that
+ * the client learns it before the request can have an effect, even if the daemon exits next. A failed write is left
+ * to the request's later frames, which report it.
  */
 export async function writeRequestStartedAsync(client: IRequestStartedClient): Promise<void> {
   try {
diff --git a/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
index 8d13073328..d09ff4fb6e 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestStarted.test.ts
@@ -13,6 +13,7 @@ import type {
   IDaemonFrame,
   IDaemonRequestEnvelope
 } from '@rushstack/rush-daemon-protocol';
+import { DaemonFrameConnection } from '@rushstack/rush-daemon-transport';
 import type { ITerminal } from '@rushstack/terminal';
 
 import type { GlobalCommandExecutor, IDaemonRequestResolver } from '../index';
@@ -455,6 +456,51 @@ describe('requestStarted', () => {
     }
   });
 
+  it('runs a global command only once the operating system holds its requestStarted frame', async () => {
+    const repoRoot: string = createRepoRoot();
+    const order: string[] = [];
+    const writeStarted: IDeferred<void> = createDeferred<void>();
+    const release: IDeferred<void> = createDeferred<void>();
+    const sendFrameWrittenAsync: (frame: IDaemonFrame) => Promise<void> =
+      DaemonFrameConnection.prototype.sendFrameWrittenAsync;
+    // The daemon waits here as it would for a socket that has not written the frame yet.
+    const spy: jest.SpyInstance = jest
+      .spyOn(DaemonFrameConnection.prototype, 'sendFrameWrittenAsync')
+      .mockImplementation(async function (this: DaemonFrameConnection, frame: IDaemonFrame): Promise<void> {
+        order.push('write');
+        writeStarted.resolve();
+        await release.promise;
+        await sendFrameWrittenAsync.call(this, frame);
+        order.push('written');
+      });
+    const host: RushDaemonHost = await startGlobalHostAsync(repoRoot, () => async () => {
+      order.push('executor');
+      return { exitCode: 0 };
+    });
+    const client: DaemonRequestWireClient = await connectAsync(host, true);
+    try {
+      const exchangePromise: Promise<ITerminalExchange> = startAsync(
+        client,
+        createWireEnvelope('global', 'custom', repoRoot)
+      );
+      // A failed expectation closes the connection before the exchange is awaited.
+      exchangePromise.catch(() => undefined);
+      await Promise.race([writeStarted.promise, exchangePromise.then(() => undefined)]);
+      await settleAsync();
+      expect(order).toEqual(['write']);
+      release.resolve();
+      const exchange: ITerminalExchange = await exchangePromise;
+      expect(order).toEqual(['write', 'written', 'executor']);
+      expect(findStarted(exchange.frames)).toHaveLength(1);
+      expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+    } finally {
+      release.resolve();
+      spy.mockRestore();
+      await client.closeAsync();
+      await host.closeAsync();
+    }
+  });
+
   it('tells a phased request after its batch reconciles, and runs it only once the frame is written', async () => {
     const repoRoot: string = createRepoRoot();
     const order: string[] = [];
diff --git a/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts b/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
index 1611ad96d4..c488bd1a0e 100644
--- a/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonWireRequestClient.test.ts
@@ -12,7 +12,7 @@ const REQUEST_ID: string = 'request';
 
 function createClient(
   supportsRequestStarted: boolean,
-  sendControlAsync: (message: DaemonControlMessage) => Promise<void>
+  sendControlWrittenAsync: (message: DaemonControlMessage) => Promise<void>
 ): DaemonWireRequestClient {
   const interactiveSession: IInteractiveRequestSession = {
     requestId: REQUEST_ID,
@@ -26,7 +26,8 @@ function createClient(
     interactiveSession,
     receivedTimeMs: 0,
     requestId: REQUEST_ID,
-    sendControlAsync,
+    sendControlAsync: () => Promise.resolve(),
+    sendControlWrittenAsync,
     sendFrameAsync: () => Promise.resolve(),
     sessionId: 'session',
     supportsRequestAdmission: true,

From 258b5d687bde5a1aa61b50e89cbd0061a411ba9c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 226/265] [rush-daemon-protocol] Tell a request queued behind a
 script wait what it waits for

Swarm integration step 211; original commit fbbd1fd00b (merge of swarm/o08-t314 at 7a9b086c6b).
Scope: task 314, F2.

Brings 314 (branch swarm/o08-t314). Second agent: ch05 board 7652 (RESULT board 7651, CLAIM board 7514). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 6 of 13. Gate: ch01 GATE OK board 8015 (tree 80545ecac7)

Commits folded into this step (1):
- 7a9b086c6b Tell a request queued behind a script wait what it waits for

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/daemonRestartNotice.test.ts      |  20 +
 ...cript-wait-followers_2026-09-29-21-50.json |  11 +
 ...cript-wait-followers_2026-09-29-21-50.json |  11 +
 ...cript-wait-followers_2026-09-29-21-50.json |  11 +
 ...cript-wait-followers_2026-09-29-21-50.json |  11 +
 .../reviews/api/rush-daemon-protocol.api.md   |   8 +-
 .../src/DaemonRestartCause.ts                 |   6 +-
 .../src/test/DaemonRestartCause.test.ts       |  10 +
 libraries/rush-daemon-protocol/README.md      |   7 +-
 .../src/DaemonInstallationChange.ts           |  17 +-
 .../src/DaemonRequestAdmission.ts             |  13 +-
 .../src/InstallationChangeValidation.ts       |  10 +-
 libraries/rush-daemon-protocol/src/index.ts   |   4 +-
 .../test/NativeMutationRestartReason.test.ts  |  45 ++
 libraries/rush-daemon/README.md               |   6 +-
 .../src/WorkspaceRequestAdmission.ts          | 115 ++++-
 .../src/WorkspaceRequestLifecycle.ts          |  17 +-
 .../TransitionScriptWaitAdmission.test.ts     | 418 ++++++++++++++++++
 .../WorkspaceServedScriptAdmission.test.ts    | 217 +++++++++
 19 files changed, 929 insertions(+), 28 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/script-wait-followers_2026-09-29-21-50.json
 create mode 100644 common/changes/@rushstack/rush-client-core/script-wait-followers_2026-09-29-21-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/script-wait-followers_2026-09-29-21-50.json
 create mode 100644 common/changes/@rushstack/rush-daemon/script-wait-followers_2026-09-29-21-50.json
 create mode 100644 libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts
 create mode 100644 libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts

diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index cf73b34e18..1d181927ce 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -227,6 +227,12 @@ const REASONS: [string, DaemonRestartReason, string, string][] = [
     { kind: 'workspaceInputsChanged', selectedRushVersion: '5.180.0' },
     'because this request selects Rush 5.180.0',
     'because it selects Rush 5.180.0'
+  ],
+  [
+    'a native install',
+    { kind: 'nativeMutation', commandName: 'install' },
+    'because this request runs rush install',
+    'because it runs rush install'
   ]
 ];
 
@@ -263,6 +269,20 @@ describe(formatDaemonRestartWait.name, () => {
     );
   });
 
+  it('says what a request queued behind a native install that waits for rushx scripts waits for (task 314)', () => {
+    expect(
+      formatDaemonRestartWait({
+        position: 2,
+        reason: { kind: 'nativeMutation', commandName: 'install' },
+        details: { ...ANOTHER, scriptCount: 1 },
+        daemonPid: 41
+      })
+    ).toBe(
+      'waiting for the daemon (PID 41) to restart for another request (2 requests ahead, including 1 rushx ' +
+        'script), because it runs rush install'
+    );
+  });
+
   it('says how many rushx scripts a command that restarts the daemon itself waits for (task 189)', () => {
     const format = (scriptCount: number, daemonPid?: number, elapsedMs?: number): string =>
       formatDaemonRestartWait({
diff --git a/common/changes/@rushstack/rush-cli-client/script-wait-followers_2026-09-29-21-50.json b/common/changes/@rushstack/rush-cli-client/script-wait-followers_2026-09-29-21-50.json
new file mode 100644
index 0000000000..0fcadb2a55
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/script-wait-followers_2026-09-29-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Test the wait line of a request queued behind a native install that waits for the rushx scripts that the daemon runs to exit.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-client-core/script-wait-followers_2026-09-29-21-50.json b/common/changes/@rushstack/rush-client-core/script-wait-followers_2026-09-29-21-50.json
new file mode 100644
index 0000000000..0d59db5bd6
--- /dev/null
+++ b/common/changes/@rushstack/rush-client-core/script-wait-followers_2026-09-29-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-client-core",
+      "comment": "`formatDaemonRestartCause` now explains the `nativeMutation` restart reason: \"because this request runs rush install\", or \"because it runs rush install\" for another request.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-client-core",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/script-wait-followers_2026-09-29-21-50.json b/common/changes/@rushstack/rush-daemon-protocol/script-wait-followers_2026-09-29-21-50.json
new file mode 100644
index 0000000000..f081248011
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/script-wait-followers_2026-09-29-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add the `nativeMutation` restart reason (`IDaemonNativeMutationRestartReason`), whose `commandName` names the native Rush command, such as `install` or `update`, that another request runs once the rushx scripts exit, and document that a queue position with `restartsForAnotherRequest` is also sent to a request queued behind a request that waits for the rushx scripts to exit before the daemon restarts.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/script-wait-followers_2026-09-29-21-50.json b/common/changes/@rushstack/rush-daemon/script-wait-followers_2026-09-29-21-50.json
new file mode 100644
index 0000000000..666a709b21
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/script-wait-followers_2026-09-29-21-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A request queued behind another request that waits for the rushx scripts that the daemon runs to exit, before a restart or a native `install` or `update`, is now told so: its queue positions count those scripts and the request ahead, with `scriptCount`, `restartsForAnotherRequest` and the reason for the restart, and its wait-timeout error names that wait instead of \"another request's load or reload of the workspace graph\".",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index eec3e57f25..dfb112de77 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -177,7 +177,7 @@ export type DaemonRequestAdmissionErrorCode = 'aborted' | 'no-wait' | 'wait-time
 export type DaemonRequestRejectionCode = 'invalidRequest' | 'routingFailed' | 'unsupported' | 'workspaceRecreationRequired';
 
 // @beta
-export type DaemonRestartReason = IDaemonInstallationChangedRestartReason | IDaemonEnvironmentChangedRestartReason | IDaemonWorkspaceInputsChangedRestartReason;
+export type DaemonRestartReason = IDaemonInstallationChangedRestartReason | IDaemonEnvironmentChangedRestartReason | IDaemonWorkspaceInputsChangedRestartReason | IDaemonNativeMutationRestartReason;
 
 // @beta
 export type DaemonRushCommandOrigin = 'built-in' | 'custom';
@@ -440,6 +440,12 @@ export interface IDaemonNativeLockHolder {
     readonly pid?: number;
 }
 
+// @beta
+export interface IDaemonNativeMutationRestartReason {
+    readonly commandName: string;
+    readonly kind: 'nativeMutation';
+}
+
 // @beta
 export interface IDaemonOperationHeaderPayload {
     readonly completedOperations: number;
diff --git a/libraries/rush-client-core/src/DaemonRestartCause.ts b/libraries/rush-client-core/src/DaemonRestartCause.ts
index 6b248c8500..78cf184334 100644
--- a/libraries/rush-client-core/src/DaemonRestartCause.ts
+++ b/libraries/rush-client-core/src/DaemonRestartCause.ts
@@ -10,8 +10,8 @@ import type {
 const MAX_LISTED_NAMES: number = 4;
 
 /**
- * Which request needs the restart that a cause explains: the request that waits for it, or another request that a
- * rushx script waits for, so that the restart does not wait for the script.
+ * Which request needs the restart that a cause explains: the request that waits for it, or another request, which a
+ * rushx script waits for so that the restart does not wait for the script, or which a request is queued behind.
  *
  * @beta
  */
@@ -41,6 +41,8 @@ export function formatDaemonRestartCause(
     }
     case 'workspaceInputsChanged':
       return `because ${formatList(getWorkspaceInputClauses(reason, anotherRequest), Infinity)}`;
+    case 'nativeMutation':
+      return `because ${anotherRequest ? 'it' : 'this request'} runs rush ${reason.commandName}`;
     default:
       return undefined;
   }
diff --git a/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts b/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
index e2a1e46be3..81a8a96e92 100644
--- a/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
+++ b/libraries/rush-client-core/src/test/DaemonRestartCause.test.ts
@@ -51,6 +51,16 @@ describe(formatDaemonRestartCause.name, () => {
       { kind: 'workspaceInputsChanged' },
       'because the inputs that the daemon started with changed',
       'because the inputs that the daemon started with changed'
+    ],
+    [
+      { kind: 'nativeMutation', commandName: 'install' },
+      'because this request runs rush install',
+      'because it runs rush install'
+    ],
+    [
+      { kind: 'nativeMutation', commandName: 'update' },
+      'because this request runs rush update',
+      'because it runs rush update'
     ]
   ])('explains %j', (reason, forThisRequest, forAnotherRequest) => {
     expect(formatDaemonRestartCause(reason, 'thisRequest')).toBe(forThisRequest);
diff --git a/libraries/rush-daemon-protocol/README.md b/libraries/rush-daemon-protocol/README.md
index 9ab2dfa3f0..30a33220bf 100644
--- a/libraries/rush-daemon-protocol/README.md
+++ b/libraries/rush-daemon-protocol/README.md
@@ -28,10 +28,13 @@ The engine-agnostic **wire layer** spoken by every client of the Rush daemon (`r
   failure codes, and capability-gated one-based queue-position control messages. A queue position
   may carry the `restartReason` for which the daemon restarts once the requests that the position
   counts finish, with `scriptCount`, how many of those requests run a rushx script, and
-  `restartsForAnotherRequest`, set for a rushx script that waits for another request's restart.
+  `restartsForAnotherRequest`, set when the restart is another request's: for a rushx script that
+  waits for another request's restart, and for a request queued behind another request that waits
+  for the rushx scripts to exit before the daemon restarts.
   A `scriptCount` without a `restartReason` says that the request waits for that many running
   rushx scripts to exit before it runs, because it restarts the daemon once it ends (a native
-  `install` or `update`).
+  `install` or `update`). A request queued behind it is told `nativeMutation` instead, which names
+  that command in `commandName`.
   `workspaceInputsChanged` names the installation files or the files of Rush and its plugins that
   changed since the daemon started, or the Rush version that the request selects. Older daemons
   omit these fields, and clients ignore reason kinds they do not know. A queue position may instead
diff --git a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
index 1e2596dba7..34fc110f8b 100644
--- a/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonInstallationChange.ts
@@ -35,6 +35,20 @@ export interface IDaemonInstallationChangedRestartReason extends IDaemonInstalla
   readonly kind: 'installationChanged';
 }
 
+/**
+ * Another request runs a native Rush command that changes the workspace's installation, such as `install` or
+ * `update`, and the daemon restarts once it has run. A queued request that waits behind that request is told this
+ * reason, with `restartsForAnotherRequest`.
+ *
+ * @beta
+ */
+export interface IDaemonNativeMutationRestartReason {
+  /** Identifies this reason. */
+  readonly kind: 'nativeMutation';
+  /** The name of the Rush command that the other request runs, such as `install`. */
+  readonly commandName: string;
+}
+
 /**
  * Why a daemon asked the client to retry after a restart, or why a queued request waits for a restart. Clients ignore
  * kinds that they do not know.
@@ -44,4 +58,5 @@ export interface IDaemonInstallationChangedRestartReason extends IDaemonInstalla
 export type DaemonRestartReason =
   | IDaemonInstallationChangedRestartReason
   | IDaemonEnvironmentChangedRestartReason
-  | IDaemonWorkspaceInputsChangedRestartReason;
+  | IDaemonWorkspaceInputsChangedRestartReason
+  | IDaemonNativeMutationRestartReason;
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index 808940b565..c763fa46c3 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -44,8 +44,9 @@ export interface IDaemonRequestQueuePositionMessage {
     readonly requestId: string;
     /**
      * Set while the request waits for the requests that `position` counts to finish, since the daemon then
-     * restarts for this reason, and the request runs after the restart. Older daemons omit it; clients ignore
-     * unknown kinds.
+     * restarts for this reason, and the request runs after the restart. With `restartsForAnotherRequest`, another
+     * request needs the restart, and a `nativeMutation` reason says that it runs a native `install` or `update`,
+     * after which the daemon restarts. Older daemons omit it; clients ignore unknown kinds.
      */
     readonly restartReason?: DaemonRestartReason;
     /**
@@ -55,7 +56,13 @@ export interface IDaemonRequestQueuePositionMessage {
      * counts the same scripts. Older daemons send a plain position instead.
      */
     readonly scriptCount?: number;
-    /** Set with `restartReason` for a rushx script that waits for another request's restart, not its own. */
+    /**
+     * Set with `restartReason` when another request needs the restart, not this one: for a rushx script that waits
+     * for that request's restart, so that the restart does not wait for the script, and for a request that is
+     * queued behind a request that holds exclusive workspace admission while it waits for running rushx scripts to
+     * exit before it restarts the daemon. The latter's `position` counts those scripts, that request and the
+     * requests queued ahead of it.
+     */
     readonly restartsForAnotherRequest?: boolean;
     /**
      * Set while the request waits for a Rush process that the daemon does not run to release the repository's
diff --git a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
index 436bdcd26b..3d3caaeb84 100644
--- a/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
+++ b/libraries/rush-daemon-protocol/src/InstallationChangeValidation.ts
@@ -10,6 +10,7 @@ const INSTALLATION_CHANGE_KINDS: ReadonlySet<unknown> = new Set(['removed', 'rep
 const INSTALLATION_CHANGED: string = 'installationChanged';
 const ENVIRONMENT_CHANGED: string = 'environmentChanged';
 const WORKSPACE_INPUTS_CHANGED: string = 'workspaceInputsChanged';
+const NATIVE_MUTATION: string = 'nativeMutation';
 const EMPTY_LENGTH: number = 0;
 /** Validates the fields of each known restart reason kind; unknown kinds are accepted. */
 const REASON_VALIDATORS: ReadonlyMap<unknown, (reason: Record<string, unknown>) => void> = new Map([
@@ -18,7 +19,8 @@ const REASON_VALIDATORS: ReadonlyMap<unknown, (reason: Record<string, unknown>)
     (reason: Record<string, unknown>) => validateInstallationChange(reason, 'restartReason')
   ],
   [ENVIRONMENT_CHANGED, validateEnvironmentChange],
-  [WORKSPACE_INPUTS_CHANGED, validateWorkspaceInputsChange]
+  [WORKSPACE_INPUTS_CHANGED, validateWorkspaceInputsChange],
+  [NATIVE_MUTATION, validateNativeMutation]
 ]);
 
 /** Validates an optional installation change, as reported by pong or by a restart reason. @internal */
@@ -47,6 +49,12 @@ function validateReason(reason: unknown): void {
   REASON_VALIDATORS.get(reason.kind)?.(reason);
 }
 
+function validateNativeMutation(reason: Record<string, unknown>): void {
+  const { commandName } = reason;
+  if (typeof commandName !== 'string' || commandName.length === EMPTY_LENGTH)
+    fail('restartReason.commandName');
+}
+
 function requireRecord(value: unknown, field: string): asserts value is Record<string, unknown> {
   if (!isDaemonControlRecord(value) || Array.isArray(value)) fail(field);
 }
diff --git a/libraries/rush-daemon-protocol/src/index.ts b/libraries/rush-daemon-protocol/src/index.ts
index e3d91f2161..3b214b946a 100644
--- a/libraries/rush-daemon-protocol/src/index.ts
+++ b/libraries/rush-daemon-protocol/src/index.ts
@@ -56,8 +56,8 @@ export { createDaemonHello, createDaemonHelloAck, negotiateDaemonHello } from '.
 export type { DaemonHandshakeOutcome } from './DaemonHandshake';
 export type { DaemonJsonNull, DaemonJsonValue } from './DaemonJsonValue';
 export type { DaemonCommandOutcome, IDaemonCommandResult } from './DaemonCommandResult';
-export type { DaemonInstallationChangeKind, DaemonRestartReason } from './DaemonInstallationChange';
-export type { IDaemonInstallationChange } from './DaemonInstallationChange';
+export type { DaemonInstallationChangeKind, IDaemonInstallationChange } from './DaemonInstallationChange';
+export type { DaemonRestartReason, IDaemonNativeMutationRestartReason } from './DaemonInstallationChange';
 export type { IDaemonInstallationChangedRestartReason } from './DaemonInstallationChange';
 export type { IDaemonEnvironmentChangedRestartReason } from './DaemonEnvironmentChange';
 export type { IDaemonWorkspaceInputsChangedRestartReason } from './DaemonWorkspaceInputsChange';
diff --git a/libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts b/libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts
new file mode 100644
index 0000000000..95ed38eeaf
--- /dev/null
+++ b/libraries/rush-daemon-protocol/src/test/NativeMutationRestartReason.test.ts
@@ -0,0 +1,45 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { decodeDaemonControlMessage, encodeDaemonControlMessage } from '../ControlFrameCodec';
+import type { DaemonControlMessage } from '../DaemonControlMessage';
+import type { IDaemonNativeMutationRestartReason } from '../DaemonInstallationChange';
+import { WIRE_TEXT_ENCODER } from '../DaemonWireText';
+
+const POSITION: number = 2;
+const SCRIPT_COUNT: number = 1;
+const NOT_A_NAME: number = 1;
+const REQUEST_ID: string = 'waits-behind-install';
+const REASON: IDaemonNativeMutationRestartReason = { kind: 'nativeMutation', commandName: 'install' };
+
+function queuePositionFrame(fields: object): Uint8Array {
+  const payload: object = { position: POSITION, requestId: REQUEST_ID, ...fields };
+  return WIRE_TEXT_ENCODER.encode(JSON.stringify({ kind: 'queuePosition', payload }));
+}
+
+it('round-trips a request that waits behind a native install while the install waits for rushx scripts', () => {
+  const message: DaemonControlMessage = {
+    kind: 'queuePosition',
+    payload: {
+      position: POSITION,
+      requestId: REQUEST_ID,
+      restartReason: REASON,
+      scriptCount: SCRIPT_COUNT,
+      restartsForAnotherRequest: true
+    }
+  };
+  expect(decodeDaemonControlMessage(encodeDaemonControlMessage(message))).toEqual(message);
+});
+
+it.each([
+  {},
+  { commandName: '' },
+  { commandName: NOT_A_NAME },
+  { commandName: null },
+  { commandName: ['install'] }
+])('rejects a native mutation reason without a command name: %j', (fields: object) => {
+  const restartReason: object = { kind: 'nativeMutation', ...fields };
+  expect(() => decodeDaemonControlMessage(queuePositionFrame({ restartReason }))).toThrow(
+    'Invalid restartReason.commandName.'
+  );
+});
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 0f24857bc2..5a220a5e4b 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -365,7 +365,11 @@ such as a dev server. A restart, a native `install` or `update`, and lifecycle d
 so they still wait for every running script to exit, and a planned restart counts a script as running work until it
 exits. While a request waits for them, its queue position is the number of scripts that still run, which is also its
 `scriptCount`, with the `restartReason` of a restart, or without one for a native `install` or `update`, which runs
-before its restart. A script that arrives while a restart is pending waits for the restart instead of starting.
+before its restart. A request that waits behind it meanwhile learns what it waits for: its queue position also counts
+those scripts and that request, and carries their `scriptCount`, `restartsForAnotherRequest: true` and the
+`restartReason` of the restart, or for a native `install` or `update` a `nativeMutation` reason that names the
+command. Its wait-timeout error names the same wait.
+A script that arrives while a restart is pending waits for the restart instead of starting.
 The host disposes each old
 resolver before replacing its session, and disposes the current resolver at shutdown; the composite must forward
 its normal disposer to its owned delegates.
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 52cb1a64d6..921b1c1bff 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -71,6 +71,31 @@ export interface INativeLockWait {
   endAsync(): Promise<void>;
 }
 
+/**
+ * A wait of the request that owns a graph transition for the rushx scripts that the daemon runs to exit, before the
+ * daemon restarts; see {@link AdmissionProgress.scriptWait}.
+ */
+export interface IAdmissionScriptWait {
+  /** How many of the scripts still run. */
+  readonly scriptCount: number;
+  /**
+   * Why the daemon then restarts, as the requests that wait behind the owner are told: the owner's own reason, or
+   * for a native `install` or `update`, which runs once the scripts exit, a `nativeMutation` reason.
+   */
+  readonly restartReason: DaemonRestartReason;
+}
+
+/**
+ * The graph transition that a request owns while it waits for the rushx scripts that the daemon runs to exit; see
+ * {@link RequestAdmissionController.waitForServedScriptsAsync}.
+ */
+export interface IScriptWaitTransition {
+  /** The transition's progress, which records the wait for the requests that wait behind the transition. */
+  readonly progress: AdmissionProgress;
+  /** Why the daemon restarts once the scripts exit, as those requests are told. */
+  readonly restartReason: DaemonRestartReason;
+}
+
 const REQUEST_SCHEDULER_BY_SESSION: WeakMap<IWorkspaceSession, RequestScheduler> = new WeakMap();
 
 /** What a remaining admission budget does not show about the request that it came from. */
@@ -115,6 +140,19 @@ function formatUncountedTime(pausedMs: number, spentWhile: string): string {
   return seconds === '0s' ? '' : `; ${seconds} spent ${spentWhile} did not count`;
 }
 
+/**
+ * Describes the request that owns a graph transition, to a request that waits behind it while it waits for the rushx
+ * scripts that the daemon runs to exit.
+ */
+function formatScriptWaitAhead(scriptWait: IAdmissionScriptWait): string {
+  const { scriptCount, restartReason } = scriptWait;
+  const cause: string | undefined = formatDaemonRestartCause(restartReason, 'anotherRequest');
+  return (
+    `another request that waits for ${scriptCount} rushx script${scriptCount === 1 ? '' : 's'} that this ` +
+    `daemon runs to exit before it restarts the daemon${cause ? ` ${cause}` : ''}`
+  );
+}
+
 /** Resolves after `delayMs`, or as soon as `abortSignal` aborts. */
 function delayAsync(delayMs: number, abortSignal: AbortSignal): Promise<void> {
   return new Promise<void>((resolve: () => void) => {
@@ -334,14 +372,16 @@ const reportQueuePosition: ReportQueuePosition = (writer: QueuePositionWriter, p
 
 /**
  * Reports whether a request that other requests wait behind is doing work on their behalf, such as loading the
- * workspace graph that they need, and which Rush process it waits for while it waits for native Rush's repository
- * lock instead.
+ * workspace graph that they need, and what it waits for instead: which Rush process, while it waits for native Rush's
+ * repository lock, or how many rushx scripts, while it waits for the scripts that the daemon runs to exit.
  */
 export class AdmissionProgress {
   readonly #listeners: Set<() => void> = new Set();
   readonly #nativeLockHolderListeners: Set<() => void> = new Set();
+  readonly #scriptWaitListeners: Set<() => void> = new Set();
   #active: boolean = false;
   #nativeLockHolder: IDaemonNativeLockHolder | undefined;
+  #scriptWait: IAdmissionScriptWait | undefined;
 
   public get active(): boolean {
     return this.#active;
@@ -355,6 +395,14 @@ export class AdmissionProgress {
     return this.#nativeLockHolder;
   }
 
+  /**
+   * While the request waits for the rushx scripts that the daemon runs to exit before the daemon restarts, how many
+   * still run, and why the daemon then restarts.
+   */
+  public get scriptWait(): IAdmissionScriptWait | undefined {
+    return this.#scriptWait;
+  }
+
   public setActive(active: boolean): void {
     if (this.#active === active) return;
     this.#active = active;
@@ -367,6 +415,12 @@ export class AdmissionProgress {
     for (const listener of [...this.#nativeLockHolderListeners]) listener();
   }
 
+  public setScriptWait(scriptWait: IAdmissionScriptWait | undefined): void {
+    if (this.#scriptWait === scriptWait) return;
+    this.#scriptWait = scriptWait;
+    for (const listener of [...this.#scriptWaitListeners]) listener();
+  }
+
   public subscribe(listener: () => void): () => void {
     this.#listeners.add(listener);
     return () => this.#listeners.delete(listener);
@@ -377,6 +431,12 @@ export class AdmissionProgress {
     this.#nativeLockHolderListeners.add(listener);
     return () => this.#nativeLockHolderListeners.delete(listener);
   }
+
+  /** Calls `listener` whenever `scriptWait` changes, until the returned function is called. */
+  public subscribeToScriptWait(listener: () => void): () => void {
+    this.#scriptWaitListeners.add(listener);
+    return () => this.#scriptWaitListeners.delete(listener);
+  }
 }
 
 /**
@@ -568,16 +628,25 @@ export class RequestAdmissionController {
    * Queue positions count the scripts that still run (`scriptCount`), and carry `restartReason`, so that the client
    * can say what the request waits for, and why. The request's remaining admission budget applies, since a script
    * may not exit until it is stopped, and a timeout names what the request waited for.
+   *
+   * With `transition`, the graph transition that the request owns, the wait is also recorded in its progress until
+   * the wait ends, with the reason that `transition` gives, so that the requests that wait behind the transition can
+   * say what they wait for; see {@link RequestAdmissionController.acquireBehindTransitionAsync}.
    */
   public async waitForServedScriptsAsync(
     scripts: ServedScriptScheduler,
-    restartReason: DaemonRestartReason | undefined
+    restartReason: DaemonRestartReason | undefined,
+    transition?: IScriptWaitTransition
   ): Promise<void> {
     const cause: string | undefined = restartReason && formatDaemonRestartCause(restartReason, 'thisRequest');
-    const unsubscribe: () => void = scripts.onLeaseReleased((runningCount: number) =>
-      this.#writer?.enqueueScriptWait(runningCount, restartReason)
-    );
+    const publish = (scriptCount: number): void =>
+      transition?.progress.setScriptWait({ scriptCount, restartReason: transition.restartReason });
+    const unsubscribe: () => void = scripts.onLeaseReleased((runningCount: number) => {
+      this.#writer?.enqueueScriptWait(runningCount, restartReason);
+      publish(runningCount);
+    });
     try {
+      if (scripts.activeRequestCount > 0) publish(scripts.activeRequestCount);
       const lease: IRequestLease = await this.#acquireAsync(
         scripts,
         RequestExclusivityClass.Exclusive,
@@ -590,6 +659,7 @@ export class RequestAdmissionController {
       lease.release();
     } finally {
       unsubscribe();
+      transition?.progress.setScriptWait(undefined);
     }
   }
 
@@ -613,6 +683,10 @@ export class RequestAdmissionController {
    * While the transition waits for another Rush process to release native Rush's repository lock, as
    * `transition.nativeLockHolder` says, this request waits for that process too: its queue positions name the
    * process, as the transition's own do, and so does its timeout.
+   *
+   * While the transition's owner waits for the rushx scripts that the daemon runs to exit before the daemon restarts,
+   * as `transition.scriptWait` says, this request's queue positions count those scripts and the owner ahead of it,
+   * with the reason for the restart and `restartsForAnotherRequest`, and its timeout names that wait.
    */
   public acquireBehindTransitionAsync(
     scheduler: RequestScheduler,
@@ -646,15 +720,31 @@ export class RequestAdmissionController {
     let lastPosition: number | undefined;
     const reportPosition: ReportQueuePosition = (target: QueuePositionWriter, position: number) => {
       lastPosition = position;
+      // The owner waits for one of these at a time: for scripts before a restart or a native mutation, and for the
+      // lock while it reloads. If both were published, positions and a timeout would name the wait for scripts.
+      const scriptWait: IAdmissionScriptWait | undefined = transition.scriptWait;
       const holder: IDaemonNativeLockHolder | undefined = transition.nativeLockHolder;
-      if (holder) target.enqueueNativeLockWait(holder, position);
+      if (scriptWait) {
+        const { scriptCount, restartReason } = scriptWait;
+        target.enqueue(scriptCount + position, restartReason, {
+          scriptCount,
+          restartsForAnotherRequest: true
+        });
+      } else if (holder) target.enqueueNativeLockWait(holder, position);
       else target.enqueue(position);
     };
-    // The owner publishes a holder only while it holds the gate exclusively, so no request is admitted meanwhile.
-    const unsubscribe: () => void = transition.subscribeToNativeLockHolder(() => {
+    // The owner publishes a holder or a script wait only while it holds the gate exclusively, so no request is
+    // admitted meanwhile.
+    const reportAgain = (): void => {
       // A script that stopped waiting, to pass the transition instead, has no position to report again.
       if (writer && lastPosition !== undefined && !stopWaiting?.aborted) reportPosition(writer, lastPosition);
-    });
+    };
+    const unsubscribeFromHolder: () => void = transition.subscribeToNativeLockHolder(reportAgain);
+    const unsubscribeFromScriptWait: () => void = transition.subscribeToScriptWait(reportAgain);
+    const unsubscribe = (): void => {
+      unsubscribeFromHolder();
+      unsubscribeFromScriptWait();
+    };
     if (remainingMs === undefined || waitTimeoutMs === undefined) {
       try {
         return await this.#acquireAsync(
@@ -676,6 +766,7 @@ export class RequestAdmissionController {
     const exhausted: AbortController = new AbortController();
     let pausedLimitReached: boolean = false;
     let nativeLockHolder: IDaemonNativeLockHolder | undefined;
+    let scriptWait: IAdmissionScriptWait | undefined;
     const budget: ProgressPausedBudget = new ProgressPausedBudget(
       remainingMs,
       Math.min(GRAPH_LOAD_WAIT_FACTOR * waitTimeoutMs, MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS),
@@ -684,6 +775,7 @@ export class RequestAdmissionController {
         if (!exhausted.signal.aborted) {
           pausedLimitReached = reachedPausedLimit;
           nativeLockHolder = transition.nativeLockHolder;
+          scriptWait = transition.scriptWait;
           exhausted.abort();
         }
       }
@@ -705,13 +797,14 @@ export class RequestAdmissionController {
       const lockWait: string = nativeLockHolder
         ? `, which waits for ${formatNativeLockHolder(nativeLockHolder)} to release this repository's lock`
         : '';
+      const waitedFor: string = scriptWait ? formatScriptWaitAhead(scriptWait) : `${waitingFor}${lockWait}`;
       // A zero timeout has no paused allowance, so it fails at once without reaching a limit worth naming.
       const message: string =
         pausedLimitReached && waitTimeoutMs > 0
           ? `The request was not admitted within ${GRAPH_LOAD_WAIT_FACTOR} times its ${waitTimeoutMs}ms wait ` +
             `timeout because ${waitingFor} was still running after ${formatSeconds(budget.pausedMs)}.`
           : `The request was not admitted within its ${waitTimeoutMs}ms wait timeout while waiting for ` +
-            `${waitingFor}${lockWait}` +
+            `${waitedFor}` +
             `${formatUncountedTime(this.#pausedMs + budget.pausedMs, 'while that request loaded the graph')}.`;
       throw new RequestSchedulerError(
         RequestSchedulerErrorCode.WaitTimeout,
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index e0d8978396..8135e23f58 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -770,7 +770,10 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
             'Native mutations require a successor launcher. No worker was started.'
           );
         }
-        await this.#waitForServedScriptsAsync(admission, undefined);
+        await this.#waitForServedScriptsAsync(admission, undefined, {
+          kind: 'nativeMutation',
+          commandName: envelope.commandName
+        });
         await this.#quiesceWarmSetAsync(session);
         // After every wait, as before them: a daemon whose installation changed would run the worker from, and select
         // the successor with, code that is gone or replaced.
@@ -976,16 +979,22 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
    * Waits, while holding `#gate` exclusively, until no served rushx script is running; none can start meanwhile.
    * This is contention, not graph-load progress, so requests queued behind it spend their wait timeouts. The client
    * learns how many scripts still run and, with `restartReason`, why the daemon then restarts; without one, the
-   * request is a native mutation, which runs once they exit and then restarts the daemon.
+   * request is a native mutation, which runs once they exit and then restarts the daemon. `#transitionProgress`
+   * records the wait, with `followerReason`, so that the requests queued behind this one can say what they wait for.
    */
   async #waitForServedScriptsAsync(
     admission: RequestAdmissionController,
-    restartReason: DaemonRestartReason | undefined
+    restartReason: DaemonRestartReason | undefined,
+    followerReason: DaemonRestartReason | undefined = restartReason
   ): Promise<void> {
     const loading: boolean = this.#transitionProgress.active;
     this.#transitionProgress.setActive(false);
     try {
-      await admission.waitForServedScriptsAsync(this.#scripts, restartReason);
+      await admission.waitForServedScriptsAsync(
+        this.#scripts,
+        restartReason,
+        followerReason && { progress: this.#transitionProgress, restartReason: followerReason }
+      );
     } finally {
       this.#transitionProgress.setActive(loading);
     }
diff --git a/libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts b/libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts
new file mode 100644
index 0000000000..c1a0b605a4
--- /dev/null
+++ b/libraries/rush-daemon/src/test/TransitionScriptWaitAdmission.test.ts
@@ -0,0 +1,418 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type {
+  DaemonRestartReason,
+  IDaemonNativeLockHolder,
+  IDaemonRequestAdmissionOptions,
+  IDaemonRequestQueuePositionMessage
+} from '@rushstack/rush-daemon-protocol';
+
+import {
+  type IRequestLease,
+  RequestExclusivityClass,
+  RequestScheduler,
+  RequestSchedulerErrorCode
+} from '../RequestScheduler';
+import {
+  AdmissionProgress,
+  RequestAdmissionController,
+  ServedScriptScheduler
+} from '../WorkspaceRequestAdmission';
+
+type QueuePosition = IDaemonRequestQueuePositionMessage['payload'];
+
+const RESTART_REASON: DaemonRestartReason = {
+  kind: 'workspaceInputsChanged',
+  installationFiles: ['common/config/rush/pnpm-lock.yaml']
+};
+const NATIVE_INSTALL: DaemonRestartReason = { kind: 'nativeMutation', commandName: 'install' };
+const HOLDER: IDaemonNativeLockHolder = { pid: 4242, command: 'rush install' };
+
+interface ITestController {
+  readonly controller: RequestAdmissionController;
+  readonly messages: QueuePosition[];
+}
+
+function createController(admission: IDaemonRequestAdmissionOptions | undefined): ITestController {
+  const messages: QueuePosition[] = [];
+  const controller: RequestAdmissionController = new RequestAdmissionController({
+    admission,
+    client: {
+      abortSignal: new AbortController().signal,
+      supportsRequestAdmission: true,
+      writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+        messages.push(message.payload);
+      }
+    },
+    requestId: 'request'
+  });
+  return { controller, messages };
+}
+
+/** A plain queue position, or one that names the process that holds native Rush's repository lock. */
+function position(queued: number, nativeLockHolder?: IDaemonNativeLockHolder): QueuePosition {
+  return { position: queued, requestId: 'request', ...(nativeLockHolder && { nativeLockHolder }) };
+}
+
+/**
+ * The position of a request that waits behind a transition whose owner waits for `scriptCount` scripts: the scripts,
+ * the owner and the requests queued ahead of it are all ahead of it.
+ */
+function behind(
+  queued: number,
+  scriptCount: number,
+  restartReason: DaemonRestartReason = RESTART_REASON
+): QueuePosition {
+  return {
+    position: scriptCount + queued,
+    requestId: 'request',
+    restartReason,
+    scriptCount,
+    restartsForAnotherRequest: true
+  };
+}
+
+/** The owner's own position while it waits for `scriptCount` scripts, as before task 314. */
+function waitingFor(scriptCount: number, restartReason?: DaemonRestartReason): QueuePosition {
+  return {
+    position: scriptCount,
+    requestId: 'request',
+    ...(restartReason && { restartReason }),
+    scriptCount
+  };
+}
+
+interface IOutcome<T> {
+  settled: boolean;
+  value?: T;
+  error?: unknown;
+}
+
+function track<T>(promise: Promise<T>): IOutcome<T> {
+  const outcome: IOutcome<T> = { settled: false };
+  promise.then(
+    (value: T) => {
+      outcome.settled = true;
+      outcome.value = value;
+    },
+    (error: unknown) => {
+      outcome.settled = true;
+      outcome.error = error;
+    }
+  );
+  return outcome;
+}
+
+describe(`${RequestAdmissionController.name} behind a graph transition that waits for rushx scripts (task 314)`, () => {
+  let scheduler: RequestScheduler;
+  let ownerLease: IRequestLease;
+  let transition: AdmissionProgress;
+  let scripts: ServedScriptScheduler;
+
+  beforeEach(async () => {
+    jest.useFakeTimers();
+    scheduler = new RequestScheduler();
+    ownerLease = await scheduler.acquireAsync({ exclusivityClass: RequestExclusivityClass.Exclusive });
+    transition = new AdmissionProgress();
+    scripts = new ServedScriptScheduler();
+  });
+
+  afterEach(() => {
+    ownerLease.release();
+    jest.useRealTimers();
+  });
+
+  async function startScriptsAsync(count: number): Promise<IRequestLease[]> {
+    const leases: IRequestLease[] = [];
+    for (let i: number = 0; i < count; i++) {
+      leases.push(await scripts.acquireAsync({ exclusivityClass: RequestExclusivityClass.SharedBuild }));
+    }
+    return leases;
+  }
+
+  function waitBehind(
+    follower: ITestController,
+    stopWaiting?: AbortSignal
+  ): IOutcome<IRequestLease | undefined> {
+    const { controller } = follower;
+    const admission: Promise<IRequestLease | undefined> = stopWaiting
+      ? controller.acquireBehindTransitionAsync(scheduler, transition, false, stopWaiting)
+      : controller.acquireBehindTransitionAsync(scheduler, transition);
+    return track(admission);
+  }
+
+  /**
+   * The owner of the transition, which holds the gate, waits for the scripts, as the lifecycle has it do: before a
+   * restart for `restartReason`, or, without one, before it runs a native install, which the requests behind it are
+   * told of instead.
+   */
+  function waitForScripts(owner: ITestController, restartReason?: DaemonRestartReason): IOutcome<void> {
+    return track(
+      owner.controller.waitForServedScriptsAsync(scripts, restartReason, {
+        progress: transition,
+        restartReason: restartReason ?? NATIVE_INSTALL
+      })
+    );
+  }
+
+  it('tells the requests that wait behind it how many scripts it waits for, and why, until they exit', async () => {
+    const [firstScript, secondScript]: IRequestLease[] = await startScriptsAsync(2);
+    const owner: ITestController = createController(undefined);
+    const first: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const second: ITestController = createController(undefined);
+    const firstAdmission: IOutcome<IRequestLease | undefined> = waitBehind(first);
+    const secondAdmission: IOutcome<IRequestLease | undefined> = waitBehind(second);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(first.messages).toEqual([position(1), position(1)]);
+    expect(second.messages).toEqual([position(2)]);
+
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(owner.messages).toEqual([waitingFor(2, RESTART_REASON)]);
+    expect(transition.scriptWait).toEqual({ scriptCount: 2, restartReason: RESTART_REASON });
+    expect(first.messages.slice(2)).toEqual([behind(1, 2)]);
+    expect(second.messages.slice(1)).toEqual([behind(2, 2)]);
+
+    secondScript.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(owner.messages.slice(1)).toEqual([waitingFor(1, RESTART_REASON)]);
+    expect(first.messages.slice(3)).toEqual([behind(1, 1)]);
+    expect(second.messages.slice(2)).toEqual([behind(2, 1)]);
+
+    firstScript.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait).toEqual({ settled: true, value: undefined });
+    expect(transition.scriptWait).toBeUndefined();
+    // They still wait behind the transition, but no longer for scripts. The owner reports no script count of 0.
+    expect(first.messages.slice(4)).toEqual([position(1)]);
+    expect(second.messages.slice(3)).toEqual([position(2)]);
+    expect(owner.messages).toHaveLength(2);
+    expect(firstAdmission.settled || secondAdmission.settled).toBe(false);
+
+    const messageCounts: number[] = [first.messages.length, second.messages.length];
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(firstAdmission.value?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect(secondAdmission.value?.exclusivityClass).toBe(RequestExclusivityClass.SharedBuild);
+    expect([first.messages.length, second.messages.length]).toEqual(messageCounts);
+    firstAdmission.value?.release();
+    secondAdmission.value?.release();
+    for (const { controller } of [owner, first, second]) controller.dispose();
+  });
+
+  it('names the scripts to a request that starts waiting behind it while it waits for them', async () => {
+    const [script]: IRequestLease[] = await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(late);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([behind(1, 1)]);
+
+    script.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    expect(late.messages).toEqual([behind(1, 1), position(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission.value).toBeDefined();
+    admission.value?.release();
+    owner.controller.dispose();
+    late.controller.dispose();
+  });
+
+  it('tells the requests behind it nothing new when no script runs', async () => {
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    expect(transition.scriptWait).toBeUndefined();
+    expect(owner.messages).toEqual([]);
+    expect(follower.messages).toEqual([position(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    admission.value?.release();
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('names the scripts and the restart in the timeout of a request that waits behind it', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    // The owner loads the graph first, which does not count against the follower's timeout.
+    transition.setActive(true);
+    await jest.advanceTimersByTimeAsync(900);
+    transition.setActive(false);
+    waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(1999);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 2000ms wait timeout while waiting for another request that waits ' +
+        'for 1 rushx script that this daemon runs to exit before it restarts the daemon because ' +
+        'common/config/rush/pnpm-lock.yaml changed; 0.9s spent while that request loaded the graph did not count. ' +
+        'Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([position(1), behind(1, 1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('names the scripts and the native install in the timeout of a request that waits behind it', async () => {
+    await startScriptsAsync(2);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 500 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    // A native install has no restart reason of its own: it runs once the scripts exit, and then restarts the daemon.
+    waitForScripts(owner);
+    await jest.advanceTimersByTimeAsync(499);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 500ms wait timeout while waiting for another request that waits ' +
+        'for 2 rushx scripts that this daemon runs to exit before it restarts the daemon because it runs rush ' +
+        'install. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(owner.messages).toEqual([waitingFor(2)]);
+    expect(follower.messages).toEqual([position(1), behind(1, 2, NATIVE_INSTALL)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the scripts in a later timeout once they have exited', async () => {
+    const [script]: IRequestLease[] = await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(1000);
+    script.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    await jest.advanceTimersByTimeAsync(999);
+    expect(admission.settled).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        "The request was not admitted within its 2000ms wait timeout while waiting for another request's load " +
+        'or reload of the workspace graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([position(1), behind(1, 1), position(1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('stops naming the scripts to the requests behind it when it stops waiting for them before they exit', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController({ waitTimeoutMs: 500 });
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(499);
+    expect(wait.settled).toBe(false);
+    expect(follower.messages).toEqual([position(1), behind(1, 1)]);
+
+    await jest.advanceTimersByTimeAsync(1);
+    expect(wait.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    expect(transition.scriptWait).toBeUndefined();
+    expect(follower.messages.slice(2)).toEqual([position(1)]);
+    // The lifecycle keeps one progress for all of its transitions, so a wait that outlived the owner's would be named
+    // to the requests that wait behind the next one.
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const lateAdmission: IOutcome<IRequestLease | undefined> = waitBehind(late);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([position(2)]);
+
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission.value).toBeDefined();
+    expect(lateAdmission.value).toBeDefined();
+    admission.value?.release();
+    lateAdmission.value?.release();
+    for (const { controller } of [owner, follower, late]) controller.dispose();
+  });
+
+  it('names the scripts rather than a process that holds the lock while both are published', async () => {
+    const [script]: IRequestLease[] = await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    // The lifecycle never publishes both, since the owner waits for the lock only while it reloads.
+    transition.setNativeLockHolder(HOLDER);
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([position(1, HOLDER)]);
+
+    const wait: IOutcome<void> = waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages.slice(1)).toEqual([behind(1, 1)]);
+
+    script.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(wait.settled).toBe(true);
+    expect(follower.messages.slice(2)).toEqual([position(1, HOLDER)]);
+    transition.setNativeLockHolder(undefined);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages.slice(3)).toEqual([position(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission.value).toBeDefined();
+    admission.value?.release();
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('names the scripts rather than a process that holds the lock in a timeout while both are published', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const follower: ITestController = createController({ waitTimeoutMs: 2000 });
+    transition.setNativeLockHolder(HOLDER);
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(follower);
+    await jest.advanceTimersByTimeAsync(0);
+    waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(2000);
+    expect(admission.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 2000ms wait timeout while waiting for another request that waits ' +
+        'for 1 rushx script that this daemon runs to exit before it restarts the daemon because ' +
+        'common/config/rush/pnpm-lock.yaml changed. Use --wait-timeout <seconds> to wait longer.'
+    });
+    expect(follower.messages).toEqual([position(1, HOLDER), behind(1, 1)]);
+    owner.controller.dispose();
+    follower.controller.dispose();
+  });
+
+  it('does not name the scripts to a script that stopped waiting to pass it', async () => {
+    await startScriptsAsync(1);
+    const owner: ITestController = createController(undefined);
+    const passing: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const stopWaiting: AbortController = new AbortController();
+    const admission: IOutcome<IRequestLease | undefined> = waitBehind(passing, stopWaiting.signal);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(passing.messages).toEqual([position(1)]);
+
+    stopWaiting.abort();
+    waitForScripts(owner, RESTART_REASON);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(admission).toEqual({ settled: true, value: undefined });
+    expect(owner.messages).toEqual([waitingFor(1, RESTART_REASON)]);
+    expect(passing.messages).toEqual([position(1)]);
+    owner.controller.dispose();
+    passing.controller.dispose();
+  });
+});
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index c153554603..5cd1f44e61 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -1013,4 +1013,221 @@ describe('the reason for a restart that waits for a served rushx script', () =>
       await closeRestartingFixtureAsync(fixture);
     }
   });
+
+  describe('a request queued behind a request that waits for the scripts (task 314)', () => {
+    /**
+     * The queue position of the first request queued behind the owner of a transition, which waits for
+     * `scriptCount` scripts: the scripts and the owner are ahead of it.
+     */
+    function behind(
+      request: IStreamedRequest,
+      scriptCount: number,
+      restartReason: DaemonRestartReason = INSTALLATION_FILE_CHANGED
+    ): IDaemonRequestQueuePositionMessage['payload'] {
+      return {
+        position: scriptCount + 1,
+        requestId: request.requestId,
+        restartReason,
+        scriptCount,
+        restartsForAnotherRequest: true
+      };
+    }
+
+    async function waitForPositionsAsync(
+      request: IStreamedRequest,
+      count: number,
+      description: string
+    ): Promise<void> {
+      await waitForAsync(() => request.positionPayloads.length >= count || request.settled(), description);
+    }
+
+    it("serves a build with the daemon's environment while a build drains to restart for its own (task 314)", async () => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        setDaemonPolicy(created, {});
+        created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      });
+      try {
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+
+        // A changed environment is found at the first capture, so the build waits for the script in the restart
+        // drain, before it owns a transition, and a request that matches this process is still served meanwhile.
+        const restart: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          environment: { ...fixture.environment, RUSHD_RELOAD_TIER_TEST: 'changed' },
+          admission: { waitTimeoutMs: 20_000 }
+        });
+        await waitForPositionsAsync(restart, 1, 'the build to drain for its restart');
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 500 }
+        });
+        expectSuccess(await build.exchange);
+        expect(build.positionPayloads).toEqual([]);
+        expect(restart.settled()).toBe(false);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+        expect((await restart.exchange).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, retryAfterRestart: true }
+        });
+      } finally {
+        fixture.write(RELEASE_FILE, '');
+        await closeRestartingFixtureAsync(fixture);
+      }
+    });
+
+    it('names the script and the restart to a build queued behind a build that finds the restart late (task 314)', async () => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        // Neither build is admitted, so no successor is launched.
+        created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+      });
+      try {
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+
+        changeInstallationAfterNextCapture(fixture);
+        const owner: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 3000 }
+        });
+        await waitForPositionsAsync(owner, 1, 'the build to wait for the script');
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 500 }
+        });
+        const { terminal } = await build.exchange;
+        expect(terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+        });
+        expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+          'The request was not admitted within its 500ms wait timeout while waiting for another request that ' +
+            'waits for 1 rushx script that this daemon runs to exit before it restarts the daemon because ' +
+            'common/config/rush/npm-shrinkwrap.json changed. Use --wait-timeout <seconds> to wait longer.'
+        );
+        expect(build.positionPayloads).toEqual([behind(build, 1)]);
+
+        // The build that waits for the script is told what it was told before.
+        expect((await owner.exchange).terminal).toMatchObject({
+          kind: 'requestResult',
+          payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+        });
+        expect(owner.positionPayloads).toEqual([
+          {
+            position: 1,
+            requestId: owner.requestId,
+            restartReason: INSTALLATION_FILE_CHANGED,
+            scriptCount: 1
+          }
+        ]);
+        expect(script.settled()).toBe(false);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+      } finally {
+        fixture.write(RELEASE_FILE, '');
+        await fixture[Symbol.asyncDispose]();
+      }
+    });
+
+    it('counts down the scripts to a build queued behind such a build, and both retry after the restart (task 314)', async () => {
+      const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+        setDaemonPolicy(created, {});
+        created.getSuccessorLaunchAsync = getInstalledWorkspaceSuccessorLaunchAsync;
+      });
+      try {
+        const before = await pongAsync(fixture);
+        expectSuccess(await fixture.runAsync(BUILD_A));
+        const script: IServedScript = await serveAsync(fixture);
+        const script2: IServedScript = await serveAsync(fixture, 'serve2');
+
+        changeInstallationAfterNextCapture(fixture);
+        const owner: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 20_000 }
+        });
+        await waitForPositionsAsync(owner, 1, 'the build to wait for the scripts');
+        const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+          admission: { waitTimeoutMs: 20_000 }
+        });
+        await waitForPositionsAsync(build, 1, 'the queued build to learn of the scripts');
+        expect(build.positionPayloads).toEqual([behind(build, 2)]);
+
+        fixture.write(RELEASE_FILE, '');
+        expectSuccess(await script.exchange);
+        await waitForPositionsAsync(build, 2, 'the queued build to learn that a script exited');
+        expect(build.positionPayloads).toEqual([behind(build, 2), behind(build, 1)]);
+        expect(build.settled()).toBe(false);
+
+        fixture.write(LATE_RELEASE_FILE, '');
+        expectSuccess(await script2.exchange);
+        for (const request of [owner, build]) {
+          expect((await request.exchange).terminal).toMatchObject({
+            kind: 'requestResult',
+            payload: { exitCode: 1, retryAfterRestart: true }
+          });
+        }
+        // Once the last script exited, the queued build waited only for the build ahead of it.
+        expect(build.positionPayloads).toEqual([
+          behind(build, 2),
+          behind(build, 1),
+          { position: 1, requestId: build.requestId }
+        ]);
+        const restarted = await fixture.host.restartCompleted;
+        expect(restarted?.pid).not.toBe(before.pid);
+      } finally {
+        fixture.write(RELEASE_FILE, '');
+        fixture.write(LATE_RELEASE_FILE, '');
+        await closeRestartingFixtureAsync(fixture);
+      }
+    });
+
+    it.each([{ commandName: 'install' }, { commandName: 'update' }])(
+      'names the script and the $commandName to a build queued behind a native $commandName (task 314)',
+      async ({ commandName }) => {
+        const fixture: DaemonGraphTestFixture = await createServingFixtureAsync((created) => {
+          // The mutation is never admitted, so no successor is launched.
+          created.getSuccessorLaunchAsync = () => Promise.reject(new Error('No successor was expected.'));
+        });
+        try {
+          expectSuccess(await fixture.runAsync(BUILD_A));
+          const script: IServedScript = await serveAsync(fixture);
+
+          const mutation: IStreamedRequest = await startRequestAsync(fixture, [commandName], {
+            admission: { waitTimeoutMs: 3000 }
+          });
+          await waitForPositionsAsync(mutation, 1, `the ${commandName} to wait for the script`);
+          const build: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
+            admission: { waitTimeoutMs: 500 }
+          });
+          const { terminal } = await build.exchange;
+          expect(terminal).toMatchObject({
+            kind: 'requestResult',
+            payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+          });
+          expect((terminal.payload as IDaemonCommandResult).errorMessage).toContain(
+            'The request was not admitted within its 500ms wait timeout while waiting for another request that ' +
+              'waits for 1 rushx script that this daemon runs to exit before it restarts the daemon because it ' +
+              `runs rush ${commandName}. Use --wait-timeout <seconds> to wait longer.`
+          );
+          expect(build.positionPayloads).toEqual([behind(build, 1, { kind: 'nativeMutation', commandName })]);
+
+          // The mutation is told what it was told before.
+          expect((await mutation.exchange).terminal).toMatchObject({
+            kind: 'requestResult',
+            payload: { exitCode: 1, admissionErrorCode: 'wait-timeout' }
+          });
+          expect(mutation.positionPayloads).toEqual([
+            { position: 1, requestId: mutation.requestId, scriptCount: 1 }
+          ]);
+          expect(script.settled()).toBe(false);
+
+          fixture.write(RELEASE_FILE, '');
+          expectSuccess(await script.exchange);
+          // The refused requests left the workspace serving builds.
+          expectSuccess(await fixture.runAsync(BUILD_A));
+        } finally {
+          fixture.write(RELEASE_FILE, '');
+          await fixture[Symbol.asyncDispose]();
+        }
+      }
+    );
+  });
 });

From 6068efbd5b34878f85a8f4c2c0f540907589154a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 227/265] [rush-daemon] Test which lock holder a reload names
 to the requests behind it

Swarm integration step 212; original commit 7bc6d0fd75 (merge of swarm/o04-t308-nit-e2h at 8270530e83).
Scope: task 308 test NIT, N'''.

Brings 308n (branch swarm/o04-t308-nit-e2h). Second agent: ch05 board 7477, board 7491 (RESULT board 7476). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 7 of 13. Gate: ch01 GATE OK board 8015 (tree 32e139cb67)

Commits folded into this step (1):
- 8270530e83 Test which lock holder a reload names to the requests behind it

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...wait-followers-tests_2026-09-29-21-44.json | 11 +++
 .../src/test/NativeLockAdmission.test.ts      | 97 +++++++++++++++++++
 2 files changed, 108 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/reload-lock-wait-followers-tests_2026-09-29-21-44.json

diff --git a/common/changes/@rushstack/rush-daemon/reload-lock-wait-followers-tests_2026-09-29-21-44.json b/common/changes/@rushstack/rush-daemon/reload-lock-wait-followers-tests_2026-09-29-21-44.json
new file mode 100644
index 0000000000..c3161c73dc
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/reload-lock-wait-followers-tests_2026-09-29-21-44.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Add tests: a request that waits behind a reload of the workspace graph stops naming the Rush process that holds the repository's lock once the reload's own wait for the lock fails, keeps naming the process last known to hold it while the reload can't identify the holder, and isn't sent its position again when the reload's wait fails before it names a process.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "3408176+TheLarkInn@users.noreply.github.com"
+}
diff --git a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
index 69d19f03d8..ccba970a32 100644
--- a/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/NativeLockAdmission.test.ts
@@ -531,6 +531,103 @@ describe(`${RequestAdmissionController.name} behind a graph transition that wait
     follower.controller.dispose();
   });
 
+  it('stops naming the process to the requests behind it when its own wait for the lock fails', async () => {
+    const owner: ITestController = createController({ waitTimeoutMs: 1000 });
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const followerAdmission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER)]);
+
+    await jest.advanceTimersByTimeAsync(1000);
+    expect(lock.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    expect(transition.nativeLockHolder).toBeUndefined();
+    // It still waits behind the transition, but no longer for another process.
+    expect(follower.messages).toEqual([positionMessage(1), positionMessage(1, HOLDER), positionMessage(1)]);
+
+    // Nor is a request that starts waiting later told of the process.
+    const late: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const lateAdmission: IAdmission = trackAdmission(
+      late.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(late.messages).toEqual([positionMessage(2)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(followerAdmission.lease).toBeDefined();
+    expect(lateAdmission.lease).toBeDefined();
+    followerAdmission.lease?.release();
+    lateAdmission.lease?.release();
+    for (const { controller } of [owner, follower, late]) controller.dispose();
+  });
+
+  it('tells the requests behind it nothing when its wait for the lock fails before it names the process', async () => {
+    const owner: ITestController = createController({ waitTimeoutMs: 0 });
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const followerAdmission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([positionMessage(1)]);
+
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(lock.error).toMatchObject({ code: RequestSchedulerErrorCode.WaitTimeout });
+    expect(transition.nativeLockHolder).toBeUndefined();
+    expect(follower.messages).toEqual([positionMessage(1)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(followerAdmission.lease).toBeDefined();
+    followerAdmission.lease?.release();
+    for (const { controller } of [owner, follower]) controller.dispose();
+  });
+
+  it('keeps naming a known holder to the requests behind it while it cannot identify the holder', async () => {
+    const owner: ITestController = createController(undefined);
+    const script: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const stopWaiting: AbortController = new AbortController();
+    const scriptAdmission: IAdmission = trackAdmission(
+      script.controller.acquireBehindTransitionAsync(scheduler, transition, false, stopWaiting.signal)
+    );
+    const follower: ITestController = createController({ waitTimeoutMs: 60_000 });
+    const followerAdmission: IAdmission = trackAdmission(
+      follower.controller.acquireBehindTransitionAsync(scheduler, transition)
+    );
+    const lock: IAcquisition = waitForLock(owner);
+    await jest.advanceTimersByTimeAsync(0);
+    expect(follower.messages).toEqual([positionMessage(2), positionMessage(2, HOLDER)]);
+
+    // The holder exits: first its command can no longer be read, and then no live process holds the lock.
+    probe.hold({ pid: HOLDER.pid });
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    probe.hold({});
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(transition.nativeLockHolder).toEqual(HOLDER);
+    expect(follower.messages).toEqual([positionMessage(2), positionMessage(2, HOLDER)]);
+
+    // The request ahead stops waiting. The follower's new position still names the known holder.
+    stopWaiting.abort();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(scriptAdmission).toEqual({ settled: true, lease: undefined });
+    expect(follower.messages).toEqual([
+      positionMessage(2),
+      positionMessage(2, HOLDER),
+      positionMessage(1, HOLDER)
+    ]);
+
+    probe.free();
+    await jest.advanceTimersByTimeAsync(POLL_MS);
+    expect(lock.lock).toBe(probe.lock);
+    expect(owner.messages).toEqual([waitMessage(HOLDER)]);
+    ownerLease.release();
+    await jest.advanceTimersByTimeAsync(0);
+    expect(followerAdmission.lease).toBeDefined();
+    followerAdmission.lease?.release();
+    for (const { controller } of [owner, script, follower]) controller.dispose();
+  });
+
   it('does not name the process to a script that stopped waiting to pass it', async () => {
     const owner: ITestController = createController(undefined);
     const script: ITestController = createController({ waitTimeoutMs: 60_000 });

From 9714dedac09b67176b8b99d5a72ab2dc5b5f5115 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:08 +0000
Subject: [PATCH 228/265] [rush-daemon] Test that a flag written again in place
 counts as a change

Swarm integration step 213; original commit e67393d141 (merge of swarm/r02-t208-nit1 at e0e88b552c).
Scope: task 208 NIT 1.

Brings 208n1 (branch swarm/r02-t208-nit1). Second agent: t03 board 7722 (RESULT board 7721, CLAIM board 7524). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 8 of 13. Gate: ch01 GATE OK board 8015 (tree 0b4f28cf5e)

Commits folded into this step (1):
- e0e88b552c [rush-daemon] Test that a flag written again in place counts as a change

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-mutation-flag-in-place-test_2026-09-29-22-11.json | 11 +++++++++++
 .../src/test/NativeMutationInstallationState.test.ts  |  9 +++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/failed-mutation-flag-in-place-test_2026-09-29-22-11.json

diff --git a/common/changes/@rushstack/rush-daemon/failed-mutation-flag-in-place-test_2026-09-29-22-11.json b/common/changes/@rushstack/rush-daemon/failed-mutation-flag-in-place-test_2026-09-29-22-11.json
new file mode 100644
index 0000000000..d6f1112918
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/failed-mutation-flag-in-place-test_2026-09-29-22-11.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Add a test: a last-install.flag that an install writes again in place, with the same content, counts as a change of the installation, because its times change.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts b/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
index ae98e219d1..ce83fedecc 100644
--- a/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
+++ b/libraries/rush-daemon/src/test/NativeMutationInstallationState.test.ts
@@ -86,6 +86,15 @@ describe('the installation state around a native mutation', () => {
     ).toBe(false);
   });
 
+  it('is changed when a flag was written again in place with the same content', async () => {
+    const flag: string = flagPath(subspaceFolders[1]);
+    const content: Buffer = fs.readFileSync(flag);
+    const inode: bigint = fs.statSync(flag, { bigint: true }).ino;
+    expect(await isUnchangedAfterAsync(() => fs.writeFileSync(flag, content))).toBe(false);
+    // Rush writes the flag in place, so only the times tell the two writes apart.
+    expect(fs.statSync(flag, { bigint: true }).ino).toBe(inode);
+  });
+
   it('is changed when a flag was deleted', async () => {
     expect(await isUnchangedAfterAsync(() => fs.rmSync(flagPath(subspaceFolders[0])))).toBe(false);
   });

From 4f218452807f6b368c1c2ec3d7c3aa0ec9a5f8b6 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:09 +0000
Subject: [PATCH 229/265] [rush-lib] Add tests for build cache receipt edge
 cases

Swarm integration step 214; original commit 459772bb14 (merge of swarm/r03-t128-nit2 at eb24e5b441).
Scope: task 128 NIT 2, N2.

Brings 128n2 (branch swarm/r03-t128-nit2). Second agent: t06 board 7306 (RESULT board 7305). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 9 of 13. Gate: ch01 GATE OK board 8015 (tree b149078441)

Commits folded into this step (1):
- eb24e5b441 Add tests for build cache receipt edge cases

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...e-receipt-more-tests_2026-09-29-21-12.json | 11 +++
 .../test/OperationBuildCacheReceipt.test.ts   | 15 ++++
 .../test/OutputFolderReceipt.test.ts          | 89 +++++++++++++++++++
 3 files changed, 115 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/build-cache-receipt-more-tests_2026-09-29-21-12.json

diff --git a/common/changes/@microsoft/rush/build-cache-receipt-more-tests_2026-09-29-21-12.json b/common/changes/@microsoft/rush/build-cache-receipt-more-tests_2026-09-29-21-12.json
new file mode 100644
index 0000000000..d8c62bff9d
--- /dev/null
+++ b/common/changes/@microsoft/rush/build-cache-receipt-more-tests_2026-09-29-21-12.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add tests: a build cache receipt doesn't match if its version differs or a symbolic link was added, an output folder that is absolute or goes up with `..` has no receipt, the receipt's stamp waits for the file system clock, and a receipt that can't be read, written or deleted doesn't fail a restore or a cache write.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
index 0d78b433fa..90293eb273 100644
--- a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
+++ b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
@@ -392,6 +392,21 @@ describe('OperationBuildCache receipts', () => {
     expect(output).not.toContain(SKIP_LINE);
   });
 
+  it("T28: restores and writes entries, without throwing, if the receipt can't be read, written or deleted", async () => {
+    seedEntry();
+    fs.mkdirSync(path.join(projectFolder, RECEIPT), { recursive: true });
+    const subject: OperationBuildCache = createSubject();
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+
+    expect(await subject.tryRestoreFromCacheAsync(new Terminal(terminalProvider))).toBe(true);
+    expect(terminalProvider.getVerboseOutput()).toContain('Unable to read the build cache receipt');
+    expect((await restoreAsync(subject)).result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(await setCacheEntryAsync(subject)).toBe(true);
+    expect(fs.statSync(path.join(projectFolder, RECEIPT)).isDirectory()).toBe(true);
+    expect(getReceiptTempFiles()).toEqual([]);
+  });
+
   it('T13: writes no receipt if an output folder contains the receipt folder', async () => {
     seedEntry();
     const subject: OperationBuildCache = createSubject({ outputFolderNames: ['lib', '.rush'] });
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
index db87620898..1cc125d96e 100644
--- a/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
+++ b/libraries/rush-lib/src/logic/buildCache/test/OutputFolderReceipt.test.ts
@@ -41,9 +41,20 @@ describe(createStampAsync.name, () => {
   });
 
   afterEach(() => {
+    jest.restoreAllMocks();
     fs.rmSync(folder, { recursive: true, force: true });
   });
 
+  // Makes the file system report these times, one for each stat call, and then the last one again.
+  function useStatTimes(times: bigint[]): jest.SpyInstance {
+    let call: number = 0;
+    return jest.spyOn(fs.promises, 'stat').mockImplementation((async () => {
+      const timeNs: bigint = times[Math.min(call, times.length - 1)];
+      call++;
+      return { dev: 7n, mtimeNs: timeNs, ctimeNs: timeNs };
+    }) as never);
+  }
+
   it('T19: takes a stamp that is strictly after the times of a file written just before it', async () => {
     const folderDev: bigint = fs.statSync(folder, { bigint: true }).dev;
     for (let i: number = 0; i < 20; i++) {
@@ -69,6 +80,21 @@ describe(createStampAsync.name, () => {
     fs.writeFileSync(filePath, '');
     await expect(createStampAsync(filePath)).rejects.toThrow(/EEXIST/);
   });
+
+  it('T27: waits until the file system clock moves past the time the file was created', async () => {
+    const stat: jest.SpyInstance = useStatTimes([1000n, 1000n, 2000n]);
+
+    const stamp: IOutputFolderStamp | undefined = await createStampAsync(path.join(folder, 'stamp.tmp'));
+
+    expect(stamp).toEqual({ timeNs: 2000n, dev: 7n });
+    expect(stat).toHaveBeenCalledTimes(3);
+  });
+
+  it('T27: takes no stamp if the file system clock does not move within 100 ms', async () => {
+    useStatTimes([1000n]);
+
+    expect(await createStampAsync(path.join(folder, 'stamp.tmp'))).toBeUndefined();
+  });
 });
 
 describe(OutputFolderReceipt.name, () => {
@@ -81,6 +107,7 @@ describe(OutputFolderReceipt.name, () => {
   });
 
   afterEach(() => {
+    jest.restoreAllMocks();
     fs.rmSync(projectFolder, { recursive: true, force: true });
   });
 
@@ -93,6 +120,16 @@ describe(OutputFolderReceipt.name, () => {
     });
   }
 
+  // Writes a receipt for the output folders as they are now.
+  async function writeReceiptAsync(receipt: OutputFolderReceipt, cacheId: string): Promise<void> {
+    const pendingReceipt: PendingOutputFolderReceipt = await receipt.beginAsync();
+    try {
+      expect(await pendingReceipt.tryCommitAsync(cacheId)).toBeUndefined();
+    } finally {
+      await pendingReceipt.disposeAsync();
+    }
+  }
+
   it('T20: writes no receipt if the output folders do not hold the files that were just archived', async () => {
     fs.mkdirSync(path.join(projectFolder, 'lib'));
     fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
@@ -123,4 +160,56 @@ describe(OutputFolderReceipt.name, () => {
       OutputFolderReceipt
     );
   });
+
+  it.each([['../out'], ['lib/../../out'], ['lib\\..\\..\\out'], [path.resolve('/out')]])(
+    'T24: has no receipt if the output folder "%s" is absolute or goes up with ".."',
+    (folderName: string) => {
+      expect(tryCreateReceipt(['lib', folderName])).toBeUndefined();
+    }
+  );
+
+  it.each([
+    ['2', { version: 2 }],
+    ['missing', { version: undefined }]
+  ])(
+    'T25: does not match a receipt whose version is %s',
+    async (description: string, change: { version: number | undefined }) => {
+      fs.mkdirSync(path.join(projectFolder, 'lib'));
+      fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
+      const receipt: OutputFolderReceipt = tryCreateReceipt(['lib'])!;
+      await writeReceiptAsync(receipt, 'acme-hash1');
+      expect(await receipt.isMatchAsync('acme-hash1')).toBe(true);
+
+      const json: Record<string, unknown> = JSON.parse(fs.readFileSync(receipt.filePath, 'utf8'));
+      fs.writeFileSync(receipt.filePath, JSON.stringify({ ...json, ...change }));
+
+      expect(await receipt.isMatchAsync('acme-hash1')).toBe(false);
+    }
+  );
+
+  it('T26: does not match after a symbolic link is added, even if the link is the last entry listed', async () => {
+    // The listing stops at the first entry that it can't certify, so only a link listed last leaves the
+    // digest as it was. Sorting the children by name makes lib/zz-link the last entry.
+    const readdir: (...args: unknown[]) => Promise<fs.Dirent[]> = fs.promises.readdir as unknown as (
+      ...args: unknown[]
+    ) => Promise<fs.Dirent[]>;
+    jest.spyOn(fs.promises, 'readdir').mockImplementation((async (...args: unknown[]) => {
+      const children: fs.Dirent[] = await readdir(...args);
+      return children.sort((a: fs.Dirent, b: fs.Dirent) => a.name.localeCompare(b.name));
+    }) as never);
+    fs.mkdirSync(path.join(projectFolder, 'lib/nested'), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, 'lib/a.txt'), 'a');
+    fs.writeFileSync(path.join(projectFolder, 'lib/nested/b.txt'), 'b');
+    const receipt: OutputFolderReceipt = tryCreateReceipt(['lib'])!;
+    await writeReceiptAsync(receipt, 'acme-hash1');
+    expect(await receipt.isMatchAsync('acme-hash1')).toBe(true);
+
+    fs.symlinkSync(
+      path.join(projectFolder, 'lib/nested'),
+      path.join(projectFolder, 'lib/zz-link'),
+      'junction'
+    );
+
+    expect(await receipt.isMatchAsync('acme-hash1')).toBe(false);
+  });
 });

From 16c4d2f2ee289962b8cc4fb968c6ef1d54b0e96f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:09 +0000
Subject: [PATCH 230/265] [rush-lib] Add tests for build cache restores through
 a staging folder

Swarm integration step 215; original commit 40da39b4ac (merge of swarm/r03-t128c-nit1 at 5596d1629f).
Scope: task 128c NIT 1, N3.

Brings 128cn1 (branch swarm/r03-t128c-nit1). Second agent: t06 board 7498 (RESULT board 7496). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 10 of 13. Gate: ch01 GATE OK board 8015 (tree 8454ca1471)

Commits folded into this step (1):
- 5596d1629f Add tests for build cache restores through a staging folder

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...staged-restore-tests_2026-09-29-21-58.json | 11 ++++
 .../buildCache/test/StagedRestore.test.ts     | 62 ++++++++++++++++++-
 2 files changed, 71 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/build-cache-staged-restore-tests_2026-09-29-21-58.json

diff --git a/common/changes/@microsoft/rush/build-cache-staged-restore-tests_2026-09-29-21-58.json b/common/changes/@microsoft/rush/build-cache-staged-restore-tests_2026-09-29-21-58.json
new file mode 100644
index 0000000000..16fd1036e2
--- /dev/null
+++ b/common/changes/@microsoft/rush/build-cache-staged-restore-tests_2026-09-29-21-58.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add tests: a build cache restore through a staging folder doesn't restore in place afterwards when a file replaces a folder or a folder replaces a file, starts no more moves after one fails, restores in place when nested output folders list the inner one first or the project folder is missing, and prints no warning without tar.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts b/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
index ca1c0ae357..de5dc61dad 100644
--- a/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
+++ b/libraries/rush-lib/src/logic/buildCache/test/StagedRestore.test.ts
@@ -362,6 +362,9 @@ describe('OperationBuildCache restores through a staging folder', () => {
 
     expect(result).toBe(true);
     expect(output).toContain(SUCCESS_LINE);
+    // A restore in place after a failed move would give the same end state, so check that there was none.
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
     expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
     expect(getStagingFolders()).toEqual([]);
     check?.();
@@ -417,6 +420,44 @@ describe('OperationBuildCache restores through a staging folder', () => {
     expect(getStagingFolders()).toEqual([]);
   });
 
+  it('U4b: starts no more moves after one fails, and then restores in place', async () => {
+    // More files than the moves that run at once, in a folder that is merged into the old one.
+    const fileCount: number = 30;
+    const archive: FakeArchive = { [`${METADATA_FOLDER}/state.json`]: '{}' };
+    for (let i: number = 0; i < fileCount; i++) {
+      archive[`lib/file${i}.txt`] = `file ${i}`;
+    }
+    writeFiles(projectFolder, { 'lib/old.txt': 'old' });
+    seedEntry(archive);
+    const libFolder: string = path.join(projectFolder, 'lib');
+    const originalRename: typeof fs.promises.rename = fs.promises.rename;
+    const renamesIntoLib: string[] = [];
+    jest.spyOn(fs.promises, 'rename').mockImplementation((async (oldPath: string, newPath: string) => {
+      if (newPath.startsWith(`${libFolder}${path.sep}`)) {
+        renamesIntoLib.push(newPath);
+        if (renamesIntoLib.length === 1) {
+          throw Object.assign(
+            new Error(`EPERM: operation not permitted, rename '${oldPath}' -> '${newPath}'`),
+            { code: 'EPERM' }
+          );
+        }
+      }
+      return await originalRename(oldPath, newPath);
+    }) as never);
+    const folderNames: string[] = ['lib', METADATA_FOLDER];
+
+    const { result } = await restoreAsync(createSubject());
+
+    expect(result).toBe(true);
+    expect(renamesIntoLib.length).toBeGreaterThan(0);
+    expect(renamesIntoLib.length).toBeLessThan(fileCount);
+    expect(untarMock).toHaveBeenCalledTimes(2);
+    expect(untarMock.mock.calls[0][0].outputFolderPath).not.toBe(projectFolder);
+    expect(untarMock.mock.calls[1][0].outputFolderPath).toBe(projectFolder);
+    expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
+    expect(getStagingFolders()).toEqual([]);
+  });
+
   describe('U5: restores in place', () => {
     let stagingFoldersDuringUntar: string[][];
 
@@ -442,7 +483,8 @@ describe('OperationBuildCache restores through a staging folder', () => {
     it.each([
       ['a: if output folders are nested', ['lib', 'lib/nested']],
       ['b: if output folders are equal ignoring case', ['lib', 'LIB']],
-      ['d: if an output folder name has ".."', ['lib', 'lib/../dist']]
+      ['d: if an output folder name has ".."', ['lib', 'lib/../dist']],
+      ['f: if output folders are nested, the inner one first', ['lib/nested', 'lib']]
     ])('U5%s', async (description: string, outputFolderNames: string[]) => {
       await expectRestoredInPlaceAsync(createSubject({ outputFolderNames }));
     });
@@ -478,6 +520,20 @@ describe('OperationBuildCache restores through a staging folder', () => {
       expect(takeSnapshot(projectFolder, folderNames)).toEqual(getExpectedSnapshot(archive, folderNames));
       expect(getStagingFolders()).toEqual([]);
     });
+
+    it('U5g: if the project folder is missing', async () => {
+      fs.rmSync(projectFolder, { recursive: true, force: true });
+      seedEntry();
+
+      const { result, verbose } = await restoreAsync(createSubject());
+
+      expect(result).toBe(true);
+      expect(verbose).toContain(`"${projectFolder}" is not a folder`);
+      expect(untarMock).toHaveBeenCalledTimes(1);
+      expect(untarMock.mock.calls[0][0].outputFolderPath).toBe(projectFolder);
+      expect(stagingFoldersDuringUntar).toEqual([[]]);
+      expect(fs.readFileSync(path.join(projectFolder, 'lib/plugin.js'), 'utf8')).toBe('new plugin');
+    });
   });
 
   it('U6: clears the output folders if there is no tar', async () => {
@@ -486,9 +542,11 @@ describe('OperationBuildCache restores through a staging folder', () => {
     seedEntry();
     const mkdtempSpy: jest.SpyInstance = jest.spyOn(fs.promises, 'mkdtemp');
 
-    const { result } = await restoreAsync(createSubject());
+    const { result, warning } = await restoreAsync(createSubject());
 
     expect(result).toBe(false);
+    // Without tar, no extraction was tried, so there is no warning about one.
+    expect(warning).not.toContain(WARNING_LINE);
     expect(fs.existsSync(path.join(projectFolder, 'lib'))).toBe(false);
     expect(fs.existsSync(path.join(projectFolder, METADATA_FOLDER))).toBe(false);
     expect(mkdtempSpy).not.toHaveBeenCalled();

From 20ce9f40c9e36740677e3d4b379e1c2e348d3a86 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:09 +0000
Subject: [PATCH 231/265] [rush-lib] Test that a join leaves an executing
 operation with the snapshot of the iteration

Swarm integration step 216; original commit 3961c18ba0 (merge of swarm/r05-t109-nit1-e2h at aa2804e9a5).
Scope: task 109 NIT 1, landing form L.

Brings 109n1 (branch swarm/r05-t109-nit1-e2h, 2 commits). Second agent: ch03 board 7605 (RESULT board 7603, CLAIM board 7506). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 11 of 13. Gate: ch01 GATE OK board 8015 (tree d0d8424e9e)

Commits folded into this step (1):
- 6e75773b93 [rush-lib] Test that a join leaves an executing operation with the snapshot of the iteration

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ng-dispatched-inputs_2026-09-29-21-15.json | 11 ++++
 .../test/CacheableOperationPlugin.test.ts     | 51 +++++++++++++++++++
 2 files changed, 62 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/join-running-dispatched-inputs_2026-09-29-21-15.json

diff --git a/common/changes/@microsoft/rush/join-running-dispatched-inputs_2026-09-29-21-15.json b/common/changes/@microsoft/rush/join-running-dispatched-inputs_2026-09-29-21-15.json
new file mode 100644
index 0000000000..023b6427e9
--- /dev/null
+++ b/common/changes/@microsoft/rush/join-running-dispatched-inputs_2026-09-29-21-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add a test that extending the current iteration leaves an operation that already executes with the inputs snapshot of the iteration, so that its build cache entry is checked against the snapshot that its cache key is from.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index 13479c8d87..e7c7ae9a03 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -882,6 +882,57 @@ describe(CacheableOperationPlugin.name, () => {
       ]);
       expect(testGraph.cacheWrites).toEqual(['a']);
     });
+
+    it('leaves an operation that already executes with the inputs snapshot of the iteration', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b'], rootDirectory);
+      const a: Operation = testGraph.operations.get('a')!;
+      const b: Operation = testGraph.operations.get('b')!;
+      // So that the joining request, which needs only "b", does not need "a"
+      b.deleteDependency(a);
+      // Like an operation that only a later request needs, which the Rush daemon holds for that request
+      b.enabled = false;
+      // The inputs snapshot of the iteration hashed the input file of "a" before it was saved
+      const aInputFile: string = 'a/src/index.ts';
+      const aInputFilePath: string = path.join(rootDirectory, aInputFile);
+      fs.mkdirSync(path.dirname(aInputFilePath), { recursive: true });
+      fs.writeFileSync(aInputFilePath, 'export const a = 2;');
+      const iterationHash: string = getGitBlobHash('export const a = 1;');
+      testGraph.trackedFileHashes.set('a', new Map([[aInputFile, iterationHash]]));
+      testGraph.snapshotHashes.set(aInputFile, iterationHash);
+      let extension: IOperationGraphExtensionResult | undefined;
+      testGraph.onExecute = (name: string) => {
+        if (name === 'a') {
+          // The request that joins while "a" executes hashed the saved file
+          const savedHash: string = getGitBlobHash('export const a = 2;');
+          testGraph.trackedFileHashes.set('a', new Map([[aInputFile, savedHash]]));
+          testGraph.snapshotHashes.set(aInputFile, savedHash);
+          testGraph.localHashes.set('a', 'a-v2');
+          b.enabled = true;
+          extension = testGraph.graph.tryExtendCurrentIteration({
+            inputsSnapshot: testGraph.createInputsSnapshot(Date.now()),
+            neededOperations: [b]
+          });
+        }
+      };
+
+      // The inputs snapshot of the iteration began to read the working tree when the file was saved
+      const result: IExecutionResult = await testGraph.executeAsync(
+        getLatestFileTimeMs(aInputFilePath),
+        true
+      );
+
+      expect(extension?.extended).toBe(true);
+      // "a" was dispatched before the request joined, so the join changed only "b"
+      expect(extension?.changedOperations).toEqual(new Set([b]));
+      expect(result.status).toBe(OperationStatus.Success);
+      expect(testGraph.executions).toEqual(['a', 'b']);
+      // "a" was built from the saved file, but its cache key is from the inputs snapshot of the iteration, which did
+      // not hash the save. So Git is asked about the file, and "a" does not write its cache entry.
+      expect(jest.mocked(hashFilesAsync).mock.calls.map((args) => args.slice(0, 2))).toEqual([
+        [rootDirectory, [aInputFile]]
+      ]);
+      expect(testGraph.cacheWrites).toEqual(['b']);
+    });
   });
 
   it('tells other plugins which operations it checks the input files of', async () => {

From dcdd2647ba88e6d42156c7156abb0901bc4be25b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:09 +0000
Subject: [PATCH 232/265] [rush-lib] Test that a join captures input files from
 the start of the joining snapshot

Swarm integration step 217; original commit eef0e8d783 (merge of swarm/r05-t109-nit2 at e4f9bddaf6).
Scope: task 109 NIT 2, N2.

Brings 109n2 (branch swarm/r05-t109-nit2). Second agent: ch03 board 7462 (RESULT board 7461). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 12 of 13. Gate: ch01 GATE OK board 8015 (tree c0a3421d80)

Commits folded into this step (1):
- e4f9bddaf6 [rush-lib] Test that a join captures input files from the start of the joining snapshot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ed-input-files-start_2026-09-29-21-59.json | 11 +++++++++
 .../IncrementalExecutionGuardPlugin.test.ts   | 24 ++++++++++++-------
 2 files changed, 27 insertions(+), 8 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/join-captured-input-files-start_2026-09-29-21-59.json

diff --git a/common/changes/@microsoft/rush/join-captured-input-files-start_2026-09-29-21-59.json b/common/changes/@microsoft/rush/join-captured-input-files-start_2026-09-29-21-59.json
new file mode 100644
index 0000000000..e577cc7d4b
--- /dev/null
+++ b/common/changes/@microsoft/rush/join-captured-input-files-start_2026-09-29-21-59.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add a test that extending the current iteration captures the input files of an operation that was not dispatched yet from when the inputs snapshot of the joining request began to read the working tree.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index bc9d535ba5..25977022d0 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -209,9 +209,10 @@ interface ITestWorkspace {
     holdUnneededOperations?: boolean
   ): Promise<ITestIteration>;
   /**
-   * Takes an inputs snapshot of the workspace, like a request of the Rush daemon
+   * Takes an inputs snapshot of the workspace, like a request of the Rush daemon. It records that it began to
+   * read the working tree at `startTimeMs`, or now by default if `recordsWorkingTreeReadStartTime` is set.
    */
-  createInputsSnapshot(environment?: Readonly<Record<string, string>>): InputsSnapshot;
+  createInputsSnapshot(environment?: Readonly<Record<string, string>>, startTimeMs?: number): InputsSnapshot;
   /**
    * Resolves when the next command that hangs has written its outputs. It runs until it is terminated.
    */
@@ -622,10 +623,10 @@ async function createWorkspaceAsync(
   }
 
   // Like `git hash-object` for each file, except the outputs, which are ignored by git.
-  const createInputsSnapshot = (environment: Readonly<Record<string, string>> = {}): InputsSnapshot => {
-    const workingTreeReadStartTimeMs: number | undefined = recordsWorkingTreeReadStartTime
-      ? Date.now()
-      : undefined;
+  const createInputsSnapshot = (
+    environment: Readonly<Record<string, string>> = {},
+    startTimeMs: number | undefined = recordsWorkingTreeReadStartTime ? Date.now() : undefined
+  ): InputsSnapshot => {
     const hashes: Map<string, string> = new Map();
     const hashFile = (file: string): void => {
       const content: Buffer = fs.readFileSync(`${rootFolder}/${file}`);
@@ -646,7 +647,7 @@ async function createWorkspaceAsync(
       lookupByPath,
       projectMap,
       environment: { ...environment },
-      workingTreeReadStartTimeMs
+      workingTreeReadStartTimeMs: startTimeMs
     });
   };
 
@@ -815,7 +816,8 @@ function joinWhileExecuting(
           operation.enabled = true;
         }
         extension = workspace.graph.tryExtendCurrentIteration({
-          inputsSnapshot: workspace.createInputsSnapshot(),
+          // It began to read the working tree in a later millisecond than the iteration began
+          inputsSnapshot: workspace.createInputsSnapshot({}, Date.now() + 1),
           neededOperations
         });
       }
@@ -1702,12 +1704,18 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
           ['b']
         );
         changeWhileExecuting(workspace, () => workspace.writeFile('b/src/sub/two.ts', 'two edited'), 'b');
+        jest.mocked(captureInputFilesState).mockClear();
         const joined: ITestIteration = await workspace.executeAsync({}, undefined, true);
         expect(getExtension()?.extended).toBe(true);
         expect(joined.commands).toEqual(['a:incremental', 'b:initial']);
         expect(joined.output).toContain(
           'Not using the incremental command because a configuration file changed ("b/tsconfig.json").'
         );
+        // The input files of "b" were captured from when the inputs snapshot of the joining request began to
+        // read the working tree, not from the earlier start of the iteration, like those of "a".
+        expect(getCapturedProjectNames(workspace)).toEqual(['a', 'b']);
+        const [aStartMs, bStartMs] = jest.mocked(captureInputFilesState).mock.calls.map((args) => args[2]);
+        expect(bStartMs).toBeGreaterThan(aStartMs!);
 
         // The inputs snapshot is the same as that of the joining request, but the outputs of "b" were built from
         // other inputs.

From fd77bcbe4665351f17d4b02c793ad03187634322 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 01:33:09 +0000
Subject: [PATCH 233/265] [rush-daemon] Stop the output digest pool's idle
 workers

Swarm integration step 218; original commit 5b128eca01 (merge of swarm/r06-t320 at 97a73645cd).
Scope: task 320, the digest pool stops its idle workers.

Brings 320 (branch swarm/r06-t320). Second agent: r04 board 7690 (RESULT board 7688, on CLAIM board 7635 as corrected by board 7665). Evidence: ch01's GATE OK board 8015.

Batch E2h, item 13 of 13. Gate: ch01 GATE OK board 8015 (tree def7f5d675)

Commits folded into this step (1):
- 97a73645cd rush-daemon: stop the output digest pool's idle workers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-t320-pool-idle-stop_2026-09-29-22-12.json |  11 +
 .../rush-daemon/src/OutputFolderDigestPool.ts | 142 ++++++++--
 .../test/OutputFolderDigestPoolIdle.test.ts   | 242 ++++++++++++++++++
 3 files changed, 367 insertions(+), 28 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t320-pool-idle-stop_2026-09-29-22-12.json
 create mode 100644 libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/r06-t320-pool-idle-stop_2026-09-29-22-12.json b/common/changes/@rushstack/rush-daemon/r06-t320-pool-idle-stop_2026-09-29-22-12.json
new file mode 100644
index 0000000000..0dd5319a53
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t320-pool-idle-stop_2026-09-29-22-12.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "The daemon's output folder digest pool now stops its worker threads after 30 seconds without a new job, so that an idle daemon frees their memory. The next job starts new workers.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/OutputFolderDigestPool.ts b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
index dca2107df9..fa041fdda7 100644
--- a/libraries/rush-daemon/src/OutputFolderDigestPool.ts
+++ b/libraries/rush-daemon/src/OutputFolderDigestPool.ts
@@ -20,6 +20,12 @@ const WAIT_SLICE_MS: number = 1000;
  * died after claiming a folder set. Stopping the pool then only costs speed.
  */
 const DEFAULT_STALL_TIMEOUT_MS: number = 10000;
+/**
+ * The workers stop after this long without a new job, so that an idle daemon does not keep their memory: about 11 MB
+ * per worker once it starts, and more after repeated walks. Requests a few seconds apart keep the same workers. The
+ * first job after an idle period starts new ones, and the calling thread walks while they start.
+ */
+const DEFAULT_IDLE_TIMEOUT_MS: number = 30000;
 
 /**
  * Digests of several folder sets on the calling thread that take longer than this together start a pool for later
@@ -43,6 +49,13 @@ interface IOutputFolderDigestJob {
 /** `[jobId, index, digest]` */
 type OutputFolderDigestResult = readonly [number, number, IOutputFolderDigest];
 
+/** A job whose digests are still wanted. */
+interface IPendingJob {
+  readonly results: (IOutputFolderDigest | undefined)[];
+  readonly state: Int32Array;
+  readonly folderSetCount: number;
+}
+
 /**
  * Folder sets that the workers of an {@link OutputFolderDigestPool} digest while the calling thread does other
  * work. Call `finish` or `cancel` once.
@@ -72,6 +85,12 @@ export interface IOutputFolderDigestPoolOptions {
    * stops the pool. Defaults to 10 seconds.
    */
   readonly stallTimeoutMs?: number;
+  /**
+   * How long the workers stay after the last job was posted, before they stop to free their memory. They stay
+   * longer while a job whose digests are still wanted has folder sets left to digest. The next job starts new
+   * workers. Defaults to 30 seconds.
+   */
+  readonly idleTimeoutMs?: number;
   /** Whether the calling thread claims folder sets too, rather than only waiting. Defaults to `true`. */
   readonly claimOnCallingThread?: boolean;
 }
@@ -85,6 +104,8 @@ export interface IOutputFolderDigesterOptions {
    * `recordCallingThreadDigests`). Defaults to 50 ms.
    */
   readonly poolStartThresholdMs?: number;
+  /** How long the pool's workers stay without a new job; see {@link IOutputFolderDigestPoolOptions.idleTimeoutMs}. */
+  readonly idleTimeoutMs?: number;
 }
 
 interface IPoolThread {
@@ -115,42 +136,42 @@ export function serveOutputFolderDigestJobs(jobPort: MessagePort, resultPort: Me
  *
  * `start` gives folder sets to the workers only, so that the calling thread can do other work while they are
  * walked, and collects the digests that are ready when it needs them.
+ *
+ * The workers stop once no job was posted for the idle timeout and every job whose digests are still wanted was
+ * digested, so that an idle process does not keep their memory. The next job starts new ones.
  */
 export class OutputFolderDigestPool {
   readonly #threads: IPoolThread[] = [];
+  readonly #threadCount: number;
+  readonly #workerScriptPath: string;
   readonly #stallTimeoutMs: number;
+  readonly #idleTimeoutMs: number;
   readonly #claimOnCallingThread: boolean;
-  /** The results of each job whose digests are still wanted, by job ID. */
-  readonly #resultsByJobId: Map<number, (IOutputFolderDigest | undefined)[]> = new Map();
+  /** Each job whose digests are still wanted, by job ID. */
+  readonly #pendingJobsById: Map<number, IPendingJob> = new Map();
   #nextJobId: number = 0;
   #stalled: boolean = false;
+  #idleTimer: NodeJS.Timeout | undefined;
 
   public constructor({
     threadCount,
     workerScriptPath = path.join(__dirname, 'OutputFolderDigestWorker.js'),
     stallTimeoutMs = DEFAULT_STALL_TIMEOUT_MS,
+    idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS,
     claimOnCallingThread = true
   }: IOutputFolderDigestPoolOptions) {
+    this.#threadCount = threadCount;
+    this.#workerScriptPath = workerScriptPath;
     this.#stallTimeoutMs = stallTimeoutMs;
+    this.#idleTimeoutMs = idleTimeoutMs;
     this.#claimOnCallingThread = claimOnCallingThread;
     try {
-      for (let threadIndex: number = 0; threadIndex < threadCount; threadIndex++) {
-        const { port1, port2 } = new MessageChannel();
-        const workerData: IOutputFolderDigestWorkerData = { resultPort: port2 };
-        const worker: Worker = new Worker(workerScriptPath, {
-          workerData,
-          transferList: [port2],
-          resourceLimits: { maxYoungGenerationSizeMb: WORKER_MAX_YOUNG_GENERATION_SIZE_MB }
-        });
-        // Workers never keep the daemon alive. A worker that fails leaves its claims to the caller.
-        worker.unref();
-        worker.on('error', () => undefined);
-        this.#threads.push({ worker, resultPort: port1 });
-      }
+      this.#startThreads();
     } catch (error) {
       this.dispose();
       throw error;
     }
+    this.#scheduleIdleStop();
   }
 
   /**
@@ -175,7 +196,7 @@ export class OutputFolderDigestPool {
     if (jobId !== undefined) {
       this.#waitForClaimedFolderSets(state, folderSets.length);
       this.#receiveResults();
-      this.#resultsByJobId.delete(jobId);
+      this.#pendingJobsById.delete(jobId);
     }
     if (this.#stalled) {
       this.dispose();
@@ -191,11 +212,12 @@ export class OutputFolderDigestPool {
    */
   public start(folderSets: ReadonlyArray<IOutputFolderSet>): IBackgroundOutputFolderDigests {
     const results: (IOutputFolderDigest | undefined)[] = new Array(folderSets.length);
-    if (this.#stalled || folderSets.length === 0) {
+    const state: Int32Array = createJobState();
+    const jobId: number | undefined =
+      this.#stalled || folderSets.length === 0 ? undefined : this.#postJob(folderSets, state, results);
+    if (jobId === undefined) {
       return { finish: () => results, cancel: () => undefined };
     }
-    const state: Int32Array = createJobState();
-    const jobId: number = this.#postJob(folderSets, state, results);
     let settled: boolean = false;
     /** Returns the number of folder sets that workers claimed. */
     const stopClaims = (): number => {
@@ -210,7 +232,7 @@ export class OutputFolderDigestPool {
             this.#waitForClaimedFolderSets(state, claimedCount);
             this.#receiveResults();
           }
-          this.#resultsByJobId.delete(jobId);
+          this.#pendingJobsById.delete(jobId);
           if (this.#stalled) {
             this.dispose();
           }
@@ -220,7 +242,7 @@ export class OutputFolderDigestPool {
       cancel: (): void => {
         if (!settled) {
           stopClaims();
-          this.#resultsByJobId.delete(jobId);
+          this.#pendingJobsById.delete(jobId);
         }
       }
     };
@@ -229,26 +251,84 @@ export class OutputFolderDigestPool {
   /** Stops the workers. Later digests run on the calling thread. */
   public dispose(): void {
     this.#stalled = true;
+    clearTimeout(this.#idleTimer);
+    this.#idleTimer = undefined;
+    this.#stopThreads();
+  }
+
+  #startThreads(): void {
+    for (let threadIndex: number = 0; threadIndex < this.#threadCount; threadIndex++) {
+      const { port1, port2 } = new MessageChannel();
+      const workerData: IOutputFolderDigestWorkerData = { resultPort: port2 };
+      const worker: Worker = new Worker(this.#workerScriptPath, {
+        workerData,
+        transferList: [port2],
+        resourceLimits: { maxYoungGenerationSizeMb: WORKER_MAX_YOUNG_GENERATION_SIZE_MB }
+      });
+      // Workers never keep the daemon alive. A worker that fails leaves its claims to the caller.
+      worker.unref();
+      worker.on('error', () => undefined);
+      this.#threads.push({ worker, resultPort: port1 });
+    }
+  }
+
+  #stopThreads(): void {
     for (const { worker, resultPort } of this.#threads.splice(0)) {
       resultPort.close();
       void worker.terminate();
     }
   }
 
+  /**
+   * Posts a job to every worker, after starting new workers if the idle ones stopped. Returns undefined if they
+   * could not start; the pool is then stalled, and the calling thread digests everything.
+   */
   #postJob(
     folderSets: ReadonlyArray<IOutputFolderSet>,
     state: Int32Array,
     results: (IOutputFolderDigest | undefined)[]
-  ): number {
+  ): number | undefined {
+    if (this.#threads.length === 0) {
+      try {
+        this.#startThreads();
+      } catch {
+        this.dispose();
+        return undefined;
+      }
+    }
     const jobId: number = ++this.#nextJobId;
-    this.#resultsByJobId.set(jobId, results);
+    this.#pendingJobsById.set(jobId, { results, state, folderSetCount: folderSets.length });
     const job: IOutputFolderDigestJob = { jobId, folderSets, state };
     for (const { worker } of this.#threads) {
       worker.postMessage(job);
     }
+    this.#scheduleIdleStop();
     return jobId;
   }
 
+  #scheduleIdleStop(): void {
+    clearTimeout(this.#idleTimer);
+    this.#idleTimer = setTimeout(() => this.#stopIdleThreads(), this.#idleTimeoutMs);
+    // The timer never keeps the daemon alive either.
+    this.#idleTimer.unref();
+  }
+
+  /**
+   * Stops the workers unless a job whose digests are still wanted has folder sets whose digests they have yet to
+   * publish, and keeps the digests that they published. Checks again after another idle timeout otherwise.
+   */
+  #stopIdleThreads(): void {
+    this.#idleTimer = undefined;
+    for (const { state, folderSetCount } of this.#pendingJobsById.values()) {
+      if (Atomics.load(state, COMPLETED_COUNT_SLOT) < folderSetCount) {
+        this.#scheduleIdleStop();
+        return;
+      }
+    }
+    this.#receiveResults();
+    this.#stopThreads();
+  }
+
   #waitForClaimedFolderSets(state: Int32Array, count: number): void {
     let completed: number = Atomics.load(state, COMPLETED_COUNT_SLOT);
     let progressTimeMs: number = performance.now();
@@ -277,9 +357,9 @@ export class OutputFolderDigestPool {
         received = receiveMessageOnPort(resultPort)
       ) {
         const [jobId, index, digest] = received.message as OutputFolderDigestResult;
-        const results: (IOutputFolderDigest | undefined)[] | undefined = this.#resultsByJobId.get(jobId);
-        if (results) {
-          results[index] = digest;
+        const job: IPendingJob | undefined = this.#pendingJobsById.get(jobId);
+        if (job) {
+          job.results[index] = digest;
         }
       }
     }
@@ -292,15 +372,18 @@ export class OutputFolderDigestPool {
  */
 export class OutputFolderDigester {
   readonly #poolStartThresholdMs: number;
+  readonly #idleTimeoutMs: number | undefined;
   #threadCount: number;
   #pool: OutputFolderDigestPool | undefined;
 
   public constructor({
     threadCount = getDefaultThreadCount(),
-    poolStartThresholdMs = POOL_START_THRESHOLD_MS
+    poolStartThresholdMs = POOL_START_THRESHOLD_MS,
+    idleTimeoutMs
   }: IOutputFolderDigesterOptions = {}) {
     this.#threadCount = threadCount;
     this.#poolStartThresholdMs = poolStartThresholdMs;
+    this.#idleTimeoutMs = idleTimeoutMs;
   }
 
   /** Whether later digests use worker threads. */
@@ -333,7 +416,10 @@ export class OutputFolderDigester {
       durationMs > this.#poolStartThresholdMs
     ) {
       try {
-        this.#pool = new OutputFolderDigestPool({ threadCount: this.#threadCount });
+        this.#pool = new OutputFolderDigestPool({
+          threadCount: this.#threadCount,
+          idleTimeoutMs: this.#idleTimeoutMs
+        });
       } catch {
         this.#threadCount = 0;
       }
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
new file mode 100644
index 0000000000..6ba68f9b6a
--- /dev/null
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
@@ -0,0 +1,242 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('node:worker_threads', () => {
+  const actual: typeof import('node:worker_threads') = jest.requireActual('node:worker_threads');
+  return {
+    ...actual,
+    Worker: jest.fn((...args: ConstructorParameters<typeof actual.Worker>) => new actual.Worker(...args))
+  };
+});
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { Worker } from 'node:worker_threads';
+
+import { digestOutputFolders, type IOutputFolderDigest, type IOutputFolderSet } from '../OutputFolderDigest';
+import {
+  OutputFolderDigestPool,
+  OutputFolderDigester,
+  type IBackgroundOutputFolderDigests
+} from '../OutputFolderDigestPool';
+
+const THREAD_COUNT: number = 2;
+const IDLE_TIMEOUT_MS: number = 1000;
+
+const actualWorkerThreads: typeof import('node:worker_threads') = jest.requireActual('node:worker_threads');
+const workerMock: jest.MockInstance<Worker, ConstructorParameters<typeof Worker>> = jest.mocked(Worker);
+
+function digestOnCallingThread(folderSets: ReadonlyArray<IOutputFolderSet>): IOutputFolderDigest[] {
+  return folderSets.map((folderSet: IOutputFolderSet) => digestOutputFolders(folderSet));
+}
+
+function waitForFile(filePath: string): void {
+  const sleep: Int32Array = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+  const deadlineMs: number = performance.now() + 10000;
+  while (!fs.existsSync(filePath)) {
+    if (performance.now() > deadlineMs) {
+      throw new Error(`${filePath} was not written`);
+    }
+    Atomics.wait(sleep, 0, 0, 10);
+  }
+}
+
+/**
+ * Writes a worker script that waits for the file `claim` before it claims every folder set of a job, then writes
+ * `claimed`, waits for `publish` before it publishes their digests, and writes `published` after it counted them.
+ */
+function writeGatedWorker(root: string): string {
+  const scriptPath: string = path.join(root, 'gated-worker.js');
+  fs.writeFileSync(
+    scriptPath,
+    [
+      "const fs = require('node:fs');",
+      "const path = require('node:path');",
+      "const { parentPort, workerData } = require('node:worker_threads');",
+      `const { digestOutputFolders } = require(${JSON.stringify(require.resolve('../OutputFolderDigest'))});`,
+      `const root = ${JSON.stringify(root)};`,
+      'const sleep = new Int32Array(new SharedArrayBuffer(4));',
+      'const waitFor = (name) => {',
+      '  while (!fs.existsSync(path.join(root, name))) Atomics.wait(sleep, 0, 0, 5);',
+      '};',
+      'parentPort.on("message", ({ jobId, folderSets, state }) => {',
+      "  waitFor('claim');",
+      '  const claimed = [];',
+      '  for (let index = Atomics.add(state, 0, 1); index < folderSets.length; index = Atomics.add(state, 0, 1)) {',
+      '    claimed.push(index);',
+      '  }',
+      "  fs.writeFileSync(path.join(root, 'claimed'), '');",
+      "  waitFor('publish');",
+      '  for (const index of claimed) {',
+      '    workerData.resultPort.postMessage([jobId, index, digestOutputFolders(folderSets[index])]);',
+      '  }',
+      '  Atomics.add(state, 1, claimed.length);',
+      '  Atomics.notify(state, 1);',
+      "  fs.writeFileSync(path.join(root, 'published'), '');",
+      '});'
+    ].join('\n')
+  );
+  return scriptPath;
+}
+
+let root: string;
+let folderSets: IOutputFolderSet[];
+let terminate: jest.SpyInstance<Promise<number>, []>;
+
+beforeEach(() => {
+  root = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-output-idle-'));
+  folderSets = ['a', 'b', 'c'].map((name: string) => {
+    const projectFolder: string = path.join(root, name);
+    fs.mkdirSync(path.join(projectFolder, 'lib'), { recursive: true });
+    fs.writeFileSync(path.join(projectFolder, 'lib', 'output.js'), name);
+    return { projectFolder, folderNames: ['lib'] };
+  });
+  terminate = jest.spyOn(actualWorkerThreads.Worker.prototype, 'terminate');
+  jest.useFakeTimers({ doNotFake: ['nextTick', 'performance', 'setImmediate'] });
+});
+
+afterEach(() => {
+  jest.useRealTimers();
+  terminate.mockRestore();
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+describe(OutputFolderDigestPool.name, () => {
+  it('stops its workers once no job was posted for the idle timeout, and starts new ones for the next job', async () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      const expected: IOutputFolderDigest[] = digestOnCallingThread(folderSets);
+      for (let request: number = 0; request < 3; request++) {
+        jest.advanceTimersByTime(IDLE_TIMEOUT_MS - 1);
+        expect(pool.digest(folderSets)).toEqual(expected);
+      }
+      expect(terminate).not.toHaveBeenCalled();
+
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+      const idleWorkers: Worker[] = [...terminate.mock.contexts];
+      await Promise.all(terminate.mock.results.map(({ value }: jest.MockResult<Promise<number>>) => value));
+      expect(idleWorkers.map(({ threadId }: Worker) => threadId)).toEqual([-1, -1]);
+      expect(pool.stalled).toBe(false);
+
+      // The calling thread claims no folder sets, so new workers digest this job.
+      expect(pool.digest(folderSets)).toEqual(expected);
+      expect(pool.stalled).toBe(false);
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+    } finally {
+      pool.dispose();
+    }
+    expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+  });
+
+  it('keeps workers that have folder sets of a started job to claim or publish, and the digests they published', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 1,
+      workerScriptPath: writeGatedWorker(root),
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).not.toHaveBeenCalled();
+
+      fs.writeFileSync(path.join(root, 'claim'), '');
+      waitForFile(path.join(root, 'claimed'));
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).not.toHaveBeenCalled();
+
+      fs.writeFileSync(path.join(root, 'publish'), '');
+      waitForFile(path.join(root, 'published'));
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(1);
+
+      expect(background.finish()).toEqual(digestOnCallingThread(folderSets));
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('does not keep workers for a cancelled job', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: 1,
+      workerScriptPath: writeGatedWorker(root),
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      const background: IBackgroundOutputFolderDigests = pool.start(folderSets);
+      background.cancel();
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(1);
+      expect([...background.finish()]).toEqual([undefined, undefined, undefined]);
+      expect(pool.stalled).toBe(false);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('stops the pool if new workers cannot start', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+
+      workerMock
+        .mockImplementationOnce(
+          (...args: ConstructorParameters<typeof Worker>) => new actualWorkerThreads.Worker(...args)
+        )
+        .mockImplementationOnce(() => {
+          throw new Error('No more threads');
+        });
+      expect([...pool.start(folderSets).finish()]).toEqual([undefined, undefined, undefined]);
+      expect(pool.stalled).toBe(true);
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+      // The worker that did start stopped with the pool.
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT + 1);
+
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+    } finally {
+      pool.dispose();
+    }
+  });
+});
+
+describe(OutputFolderDigester.name, () => {
+  it("passes the idle timeout to its pool, which stays parallel after the pool's workers stop", () => {
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: THREAD_COUNT,
+      poolStartThresholdMs: -1,
+      idleTimeoutMs: IDLE_TIMEOUT_MS
+    });
+    try {
+      digester.recordCallingThreadDigests(2, 0);
+      expect(digester.isParallel).toBe(true);
+      jest.advanceTimersByTime(IDLE_TIMEOUT_MS);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+      expect(digester.isParallel).toBe(true);
+
+      const background: IBackgroundOutputFolderDigests | undefined = digester.start(folderSets);
+      expect(background).toBeDefined();
+      expect(workerMock).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+      background?.cancel();
+      expect(digester.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+    } finally {
+      digester.dispose();
+    }
+    expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
+  });
+});

From 48930441c70ca78ac73f6da0f813e2ab98a0c02f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:00 +0000
Subject: [PATCH 234/265] [rush-lib] Write no receipt while an older write is
 pending

Swarm integration step 219; original commit 3b3b61e467 (merge of swarm/r07-t113-e2h at 9641dbd7ca).
Scope: task 113, re-cut on E2g (form', NIT 1', G1', P').

Brings 113 (branch swarm/r07-t113-e2h, 4 commits). Second agent: t06 board 7808 (RESULT board 7807, on CLAIM board 7624); t04 board 7914; t01 board 7916; t04 on G1's E2E board 7912, board 7946, board 7949. Evidence: ch01's GATE OK board 8659.

Batch E2i, item 1 of 10. Gate: ch01 GATE OK board 8659 (tree 0625039407)

Commits folded into this step (4):
- 65ee205ed2 [rush-lib] Write the build cache entries of daemon builds later
- 7cce85675b [rush-lib] [rush-daemon] Show failed background cache writes as warnings
- 6ad586843b [rush-lib] Seal slow outputs in the background
- 9641dbd7ca [rush-lib] Write no receipt while an older write is pending

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   1 +
 ...eferred-cache-writes_2026-09-29-18-45.json |  11 +
 ...eferred-cache-writes_2026-09-29-18-45.json |  11 +
 ...eferred-cache-writes_2026-09-29-18-45.json |  11 +
 common/reviews/api/rush-daemon.api.md         |   2 +-
 common/reviews/api/rush-lib.api.md            |   6 +-
 docs/rush/dogfooding-rush-daemon.md           |  40 +
 docs/rush/environment-variables.md            |   1 +
 .../src/DaemonShutdownDeadlineError.ts        |   3 +
 .../rush-daemon/src/PhasedRequestSummary.ts   |  65 +-
 libraries/rush-daemon/src/RushDaemonHost.ts   |  19 +-
 .../test/DaemonShutdownCacheWrites.test.ts    | 117 +++
 .../test/NativeDeferredCacheWrites.test.ts    |  97 +++
 .../src/test/NativeEngineTestFixture.ts       |   5 +-
 .../src/test/PhasedRequestHook.test.ts        |  95 +++
 .../rush-lib/src/api/DaemonConfiguration.ts   |  17 +-
 .../src/api/EnvironmentConfiguration.ts       |   3 +
 .../src/api/test/DaemonConfiguration.test.ts  |  16 +-
 .../cli/scriptActions/PhasedScriptAction.ts   |   8 +-
 .../buildCache/DeferredCacheEntryWrites.ts    | 681 +++++++++++++++
 .../logic/buildCache/OperationBuildCache.ts   | 123 ++-
 .../test/DeferredCacheEntryWrites.test.ts     | 802 ++++++++++++++++++
 .../OperationBuildCacheDeferredWrites.test.ts | 298 +++++++
 .../test/OperationBuildCacheReceipt.test.ts   | 271 +++++-
 .../operations/CacheableOperationPlugin.ts    |  52 +-
 .../test/CacheableOperationPlugin.test.ts     | 187 +++-
 .../rush-lib/src/schemas/rush.schema.json     |   5 +
 .../rush-lib/src/utilities/TarExecutable.ts   |  43 +-
 .../src/utilities/test/TarExecutable.test.ts  | 113 +++
 29 files changed, 3043 insertions(+), 60 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/deferred-cache-writes_2026-09-29-18-45.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/deferred-cache-writes_2026-09-29-18-45.json
 create mode 100644 common/changes/@rushstack/rush-daemon/deferred-cache-writes_2026-09-29-18-45.json
 create mode 100644 libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts
 create mode 100644 libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts
 create mode 100644 libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts
 create mode 100644 libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
 create mode 100644 libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts
 create mode 100644 libraries/rush-lib/src/utilities/test/TarExecutable.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 43452ced59..aad9d2060a 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -522,6 +522,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `incrementalBuilds` | `RUSH_DAEMON_INCREMENTAL_BUILDS` | true | Runs an operation's `<phase>:incremental` script instead of its initial script when only files it builds were edited since its last successful run in the daemon and its output folders are unchanged. Additions, deletions, renames, configuration, tool, environment and command-line changes, bundled outputs, cache restores and native Rush commands run the initial script. Incremental results are never written to the build cache |
 | `warmWorkers` | `RUSH_DAEMON_WARM_WORKERS` | false | With `incrementalBuilds`, keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run. Opt in only if that script runs every task and check that the initial script runs, for Heft including lint and API Extractor. When an incremental run is not allowed, the worker is closed and the initial script runs. Workers count toward `warmMemoryBudgetMB` and `warmSetMaxProjects`, so raise both to keep them alive |
 | `joinRunningBatch` | `RUSH_DAEMON_JOIN_RUNNING_BATCH` | false | Experimental. A build request that arrives while the daemon executes an incremental batch with the same request settings adds its operations to the executing iteration and gets its result once they complete, instead of waiting for the iteration to end. When the iteration can't take its work, the request waits as before |
+| `deferCacheWrites` | `RUSH_DAEMON_DEFER_CACHE_WRITES` | false | Lets an operation complete once its output files are cloned, and writes its build cache entry from the clones in the background. Needs a file system that can clone files (such as Btrfs, XFS or APFS); otherwise, and in cobuilds, the entry is written before the operation completes. A failed background write doesn't change the operation's status; the next command reports it in a warning (on stderr in legacy output), which agent output also prints. A restore of the entry's key misses until the entry is written, and `daemon stop` drops the entries that aren't written yet |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
 | `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
 | `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
diff --git a/common/changes/@microsoft/rush/deferred-cache-writes_2026-09-29-18-45.json b/common/changes/@microsoft/rush/deferred-cache-writes_2026-09-29-18-45.json
new file mode 100644
index 0000000000..7a78384bde
--- /dev/null
+++ b/common/changes/@microsoft/rush/deferred-cache-writes_2026-09-29-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add the `deferCacheWrites` daemon setting (`RUSH_DAEMON_DEFER_CACHE_WRITES`). It lets an operation of a daemon build complete once its output files are cloned, on a file system that can clone files, and writes the operation's build cache entry from the clones in the background. An operation waits at most half a second for its clones. Slower clones finish in the background, and the entry is dropped if an output file changes before it is cloned. The next command reports those writes, in a warning if any of them failed.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/deferred-cache-writes_2026-09-29-18-45.json b/common/changes/@rushstack/rush-cli-client/deferred-cache-writes_2026-09-29-18-45.json
new file mode 100644
index 0000000000..8b0f4d9766
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/deferred-cache-writes_2026-09-29-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the `deferCacheWrites` daemon setting.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/deferred-cache-writes_2026-09-29-18-45.json b/common/changes/@rushstack/rush-daemon/deferred-cache-writes_2026-09-29-18-45.json
new file mode 100644
index 0000000000..dc2d0a4153
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/deferred-cache-writes_2026-09-29-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Support the `deferCacheWrites` setting: log each build cache entry that is written in the background, fails to be written or is dropped, and drop the entries that are not written yet when the daemon stops, in a new `cacheWrites` shutdown stage before the listener closes. Warnings and errors that an `afterExecuteRequestAsync` tap writes now keep their severity, so that agent output shows them.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 4931d9243f..753bc6d5e4 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -101,7 +101,7 @@ export class DaemonShutdownError extends Error {
 export type DaemonShutdownInitiator = 'controlClient' | 'signal' | 'idleTimeout' | 'restart' | 'host' | 'socketLost';
 
 // @beta
-export type DaemonShutdownStage = 'requests' | 'workspaceMaintenance' | 'requestDispatcher' | 'workspaceSession' | 'listener';
+export type DaemonShutdownStage = 'requests' | 'workspaceMaintenance' | 'requestDispatcher' | 'workspaceSession' | 'cacheWrites' | 'listener';
 
 // @beta
 export type DispatchWorkspaceRequestAsync = (options: IDispatchWorkspaceRequestOptions) => Promise<IDaemonCommandResult | undefined>;
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index c4f644644f..cc7e129f73 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -326,6 +326,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_INCREMENTAL_BUILDS: "RUSH_DAEMON_INCREMENTAL_BUILDS";
     readonly RUSH_DAEMON_WARM_WORKERS: "RUSH_DAEMON_WARM_WORKERS";
     readonly RUSH_DAEMON_JOIN_RUNNING_BATCH: "RUSH_DAEMON_JOIN_RUNNING_BATCH";
+    readonly RUSH_DAEMON_DEFER_CACHE_WRITES: "RUSH_DAEMON_DEFER_CACHE_WRITES";
     readonly RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: "RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS: "RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
@@ -536,6 +537,7 @@ export interface IDaemonConfigurationJson {
     readonly autoWarmByTelemetry?: boolean;
     readonly commandAgnosticPlugins?: ReadonlyArray<string>;
     readonly compatiblePlugins?: ReadonlyArray<string>;
+    readonly deferCacheWrites?: boolean;
     readonly enabled?: boolean;
     readonly idleTimeoutSeconds?: number;
     readonly incrementalBuilds?: boolean;
@@ -1446,8 +1448,8 @@ export class _OperationBuildCache {
     static getOperationBuildCache(options: _IProjectBuildCacheOptions): _OperationBuildCache;
     // (undocumented)
     tryRestoreFromCacheAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean>;
-    // (undocumented)
-    trySetCacheEntryAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean>;
+    // Warning: (ae-forgotten-export) The symbol "DeferredCacheEntryWrites" needs to be exported by the entry point index.d.ts
+    trySetCacheEntryAsync(terminal: ITerminal, specifiedCacheId?: string, deferredCacheEntryWrites?: DeferredCacheEntryWrites): Promise<boolean>;
 }
 
 // @alpha
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index c04b9a9552..45eb37cf33 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -289,6 +289,46 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   tool; if you see that, [refresh the snapshot](#refresh-the-snapshot).
 - **CI** stays in-process unless `RUSH_DAEMON=1` is set; do not set it in CI workflows.
 
+## Deferred build cache writes
+
+With `"daemon": { "deferCacheWrites": true }` in `rush.json`, or `RUSH_DAEMON_DEFER_CACHE_WRITES=1` (off by
+default), an operation that writes a build cache entry completes as soon as the daemon has cloned its output files
+into `common/temp/build-cache-staging/<pid>/`. The daemon then writes the entry from the clones in the background,
+two at a time, so the operations that depend on it, and the command, don't wait for tar. On a file system that can
+clone files, such as Btrfs, XFS or APFS, the clones take well under a second, even for thousands of files, because
+a clone shares its data with the output file until either changes. That is also why later changes to the outputs
+don't change the entry. Like the daemon's other settings, the variable is part of its environment identity, so
+changing it restarts the daemon.
+
+- The operation's build cache log says
+  `Sealed <n> output files (<x.y> MB) in <ms> ms; writing the build cache entry in the background.` After each
+  command with background activity, legacy output prints
+  `Build cache entries written in the background since the previous command: <q> queued, <w> written (<x.y> MB), <f> failed; <p> pending.`
+  The line is a warning (on stderr) if any of those writes failed, and
+  [agent output](../../apps/rush-cli-client/README.md#output-modes) prints it only then. Either way, the next
+  command counts only the writes since this one.
+  The daemon log has a line for each entry that it writes, fails to write or drops.
+- The clones take longer while the file system writes back what the build just wrote, which can take seconds. An
+  operation waits for them for at most half a second. The rest of its files are then cloned in the background, and
+  its log says
+  `Sealing <n> output files (<x.y> MB) in the background after <ms> ms; the build cache entry is written once they're sealed.`
+  An output file that changes before it is cloned, for example because the next build rewrites it, would make the
+  entry inconsistent, so the entry is dropped instead: the daemon log says
+  `Dropped the build cache entry <id> for <operation>, because <path> changed before it was sealed.`, and the
+  command's line ends with `<f> failed, <d> dropped; <p> pending.` A dropped entry isn't a failure: like an entry
+  that isn't written yet, it makes a restore of its cache key miss, so the operation runs again.
+- If the files can't be cloned, for example on ext4 or tmpfs, the entry is written before the operation completes,
+  as in native Rush (`Unable to clone the output files (<code>), so the build cache entry is written now.`). Once
+  the file system has refused a clone, the daemon doesn't try again until it restarts.
+- Cobuilds always write an entry before its operation completes, because other agents read it as soon as the
+  operation completes.
+- An entry that fails to be written in the background doesn't change the operation's status. The daemon log and
+  the next command's warning report it.
+- Until an entry is written, a restore of its cache key misses. For example, a native build that starts right
+  after the daemon build runs the operation again.
+- `rush-client daemon stop` and a daemon restart drop the entries that aren't written yet.
+- Hard links among the output files are archived as separate files.
+
 ## Rush plugins in daemon engines
 
 A daemon engine applies each Rush plugin once and then serves many requests from one long-lived process.
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index 184702249d..cf02f4ae43 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -30,6 +30,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_INCREMENTAL_BUILDS` | `1` | Let daemon builds run an operation's `<phase>:incremental` script on top of the outputs of its last successful run in the daemon, when only files that it builds were edited and its output folders are unchanged. Otherwise the initial script runs, as it does for native Rush. `0` always runs the initial script. Incremental results are never written to the build cache. Overrides `incrementalBuilds`. |
 | `RUSH_DAEMON_WARM_WORKERS` | `0` | With `RUSH_DAEMON_INCREMENTAL_BUILDS`, keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and send it the next incremental run. The worker keeps its last build in memory, so it rebuilds only what changed. When an incremental run is not allowed, the worker is closed and the initial script runs, in a new worker if the project defines `<phase>:ipc`. Workers count toward `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` and `RUSH_DAEMON_WARM_SET_MAX_PROJECTS`. Over either limit the daemon closes them and drops their projects' last results, so raise both for the workers to stay alive. Overrides `warmWorkers`. |
 | `RUSH_DAEMON_JOIN_RUNNING_BATCH` | `0` | Experimental. Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Operations that both requests need run once. If the iteration can't take the request's work, for example because an operation that the request needs started before its inputs changed, the request waits for the iteration to end as before. Overrides `joinRunningBatch`. |
+| `RUSH_DAEMON_DEFER_CACHE_WRITES` | `0` | Let an operation of a daemon build complete before its build cache entry is written. The daemon clones the operation's output files and writes the entry from the clones in the background, so the operations that depend on it, and the command, don't wait for it. This needs a file system that can clone files (such as Btrfs, XFS or APFS); otherwise, and in cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be written in the background doesn't change the operation's status, a restore of the entry's key misses until the entry is written, and stopping the daemon drops the entries that aren't written yet. See [Deferred build cache writes](./dogfooding-rush-daemon.md#deferred-build-cache-writes). Overrides `deferCacheWrites`. |
 | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
 | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
diff --git a/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts b/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
index 61c8cc111f..c97ee215e9 100644
--- a/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
+++ b/libraries/rush-daemon/src/DaemonShutdownDeadlineError.ts
@@ -11,6 +11,7 @@ export type DaemonShutdownStage =
   | 'workspaceMaintenance'
   | 'requestDispatcher'
   | 'workspaceSession'
+  | 'cacheWrites'
   | 'listener';
 
 /**
@@ -84,6 +85,8 @@ function describeStage(stage: DaemonShutdownStage): string {
       return 'disposing the request dispatcher';
     case 'workspaceSession':
       return 'disposing the workspace session';
+    case 'cacheWrites':
+      return 'stopping the build cache writes';
     case 'listener':
       return 'closing the listener';
   }
diff --git a/libraries/rush-daemon/src/PhasedRequestSummary.ts b/libraries/rush-daemon/src/PhasedRequestSummary.ts
index 84f7964d4e..db25bd3d95 100644
--- a/libraries/rush-daemon/src/PhasedRequestSummary.ts
+++ b/libraries/rush-daemon/src/PhasedRequestSummary.ts
@@ -21,8 +21,12 @@ import {
   type ITerminalProvider
 } from '@rushstack/terminal';
 
+import { getEngineActivityOptions, type IEngineActivityOptions } from './EngineActivityOptions';
+
 const SECONDS_PER_MINUTE: number = 60;
 const MILLISECONDS_PER_SECOND: number = 1000;
+const STDOUT_ACTIVITY: IEngineActivityOptions = { stderr: false };
+const STDERR_ACTIVITY: IEngineActivityOptions = { stderr: true };
 const SUMMARIZED_STATUSES: ReadonlySet<OperationStatus> = new Set([
   OperationStatus.Aborted,
   OperationStatus.Blocked,
@@ -57,7 +61,8 @@ export interface IWritePhasedRequestSummaryOptions extends IPhasedRequestResults
   readonly executionError: unknown;
   /**
    * Called with the request's results after the status tables and before the duration line. Its terminal writes
-   * into the request's own output. If it throws, the summary reports errors and then rethrows the error.
+   * into the request's own output, and, unlike the summary's own lines, its warnings and errors carry their
+   * severity. If it throws, the summary reports errors and then rethrows the error.
    */
   readonly onResultsAsync: ((results: IExecutionResult, terminal: ITerminal) => Promise<void>) | undefined;
   /** The `performance.now()` timestamp at which the request started. */
@@ -122,35 +127,50 @@ class UpToDateOperationResult implements IOperationExecutionResult {
 }
 
 /**
- * Buffers terminal output into request-scoped activity events, one event per contiguous stream run.
+ * The activity options of the summary's own lines. Warnings and errors among them carry no severity, because clients
+ * that print only a summary give their own verdict.
+ */
+function getSummaryActivityOptions(severity: TerminalProviderSeverity): IEngineActivityOptions {
+  return severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning
+    ? STDERR_ACTIVITY
+    : STDOUT_ACTIVITY;
+}
+
+/**
+ * Buffers terminal output into request-scoped activity events, one event per contiguous run of text that has the
+ * same activity options.
  */
 class RequestActivityTerminalProvider implements ITerminalProvider {
   public readonly supportsColor: boolean = false;
   public readonly eolCharacter: string = '\n';
   readonly #sink: IPhasedRequestSummarySink;
+  readonly #getActivityOptions: (severity: TerminalProviderSeverity) => IEngineActivityOptions;
   #buffer: string = '';
-  #stderr: boolean = false;
+  #activityOptions: IEngineActivityOptions = STDOUT_ACTIVITY;
 
-  public constructor(sink: IPhasedRequestSummarySink) {
+  public constructor(
+    sink: IPhasedRequestSummarySink,
+    getActivityOptions: (severity: TerminalProviderSeverity) => IEngineActivityOptions
+  ) {
     this.#sink = sink;
+    this.#getActivityOptions = getActivityOptions;
   }
 
   public write(text: string, severity: TerminalProviderSeverity): void {
     if (severity === TerminalProviderSeverity.verbose || severity === TerminalProviderSeverity.debug) {
       return;
     }
-    const stderr: boolean =
-      severity === TerminalProviderSeverity.error || severity === TerminalProviderSeverity.warning;
-    if (stderr !== this.#stderr) {
+    const activityOptions: IEngineActivityOptions = this.#getActivityOptions(severity);
+    if (activityOptions !== this.#activityOptions) {
       this.flush();
-      this.#stderr = stderr;
+      this.#activityOptions = activityOptions;
     }
     this.#buffer += text;
   }
 
   public flush(): void {
     if (this.#buffer.length > 0) {
-      this.#sink.onActivity(this.#buffer, { stderr: this.#stderr });
+      this.#sink.onActivity(this.#buffer, this.#activityOptions);
       this.#buffer = '';
     }
   }
@@ -168,7 +188,10 @@ export async function writePhasedRequestSummaryAsync(
   options: IWritePhasedRequestSummaryOptions
 ): Promise<void> {
   const { commandName, executionError, onResultsAsync, sink, startTimeMs } = options;
-  const provider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(sink);
+  const provider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(
+    sink,
+    getSummaryActivityOptions
+  );
   const terminal: Terminal = new Terminal(provider);
   let callbackFailed: boolean = false;
   let callbackError: unknown;
@@ -176,11 +199,23 @@ export async function writePhasedRequestSummaryAsync(
     if (executionError === undefined) {
       const results: IExecutionResult = collectPhasedRequestResults(options);
       _printOperationStatus(terminal, results);
-      try {
-        await onResultsAsync?.(results, terminal);
-      } catch (error) {
-        callbackFailed = true;
-        callbackError = error;
+      if (onResultsAsync) {
+        // The status tables precede what the callback writes.
+        provider.flush();
+        // The callback's warnings and errors keep their severity, as they do on the engine's terminal, so that
+        // clients that print only a summary still show them.
+        const callbackProvider: RequestActivityTerminalProvider = new RequestActivityTerminalProvider(
+          sink,
+          getEngineActivityOptions
+        );
+        try {
+          await onResultsAsync(results, new Terminal(callbackProvider));
+        } catch (error) {
+          callbackFailed = true;
+          callbackError = error;
+        } finally {
+          callbackProvider.flush();
+        }
       }
     }
     const duration: string = formatDuration(performance.now() - startTimeMs);
diff --git a/libraries/rush-daemon/src/RushDaemonHost.ts b/libraries/rush-daemon/src/RushDaemonHost.ts
index 273a815bd7..17a85f7f51 100644
--- a/libraries/rush-daemon/src/RushDaemonHost.ts
+++ b/libraries/rush-daemon/src/RushDaemonHost.ts
@@ -5,6 +5,7 @@ import * as fs from 'node:fs';
 import { realpath } from 'node:fs/promises';
 
 import type { IOperationGraph } from '@microsoft/rush-lib';
+import { DeferredCacheEntryWrites } from '@microsoft/rush-lib/lib/logic/buildCache/DeferredCacheEntryWrites';
 import { LockFile } from '@rushstack/node-core-library';
 import { connectOrStartDaemonAsync, type DaemonClient } from '@rushstack/rush-client-core';
 import { DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
@@ -78,9 +79,10 @@ export interface IRushDaemonHostOptions {
    * Receives messages for the daemon log: one for each rejected request, with the stack when the failure was
    * unexpected, one for each restart that the clients must finish, one when the daemon's socket was deleted
    * or replaced, one for each reply that could not reach a client because the client went away, one with the
-   * process ID and the reason when the host begins to shut down, and one for each set of process groups that
-   * an exited daemon left running and that startup stopped when it reclaimed the endpoint. Without it, each
-   * such set is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
+   * process ID and the reason when the host begins to shut down, one for each set of process groups that
+   * an exited daemon left running and that startup stopped when it reclaimed the endpoint, and one for each
+   * build cache entry that the `deferCacheWrites` setting writes in the background, fails to write or drops.
+   * Without it, each such set of process groups is reported as a `RUSH_DAEMON_ORPHANS_REAPED` process warning.
    */
   readonly onLog?: (message: string) => void;
   /**
@@ -194,6 +196,8 @@ export class RushDaemonHost {
   /** Resolves only after the transport is bound and its lockfile has been written. */
   public static async startAsync(options: IRushDaemonHostOptions): Promise<RushDaemonHost> {
     const idleTimer: DaemonIdleTimer = new DaemonIdleTimer(options.idleTimeoutSeconds);
+    // The `deferCacheWrites` setting writes build cache entries after their operations complete.
+    DeferredCacheEntryWrites.instance.setLog(options.onLog);
     const canonicalRepoRoot: string = await realpath(options.repoRoot);
     const workspaceKey: string = computeDaemonWorkspaceKey({
       canonicalRepoRoot,
@@ -493,6 +497,15 @@ export class RushDaemonHost {
     } catch (error) {
       errors.push(error);
     }
+    // No operation runs now, so no build cache entry is queued. The pending ones are dropped: a stopping daemon
+    // must not wait for them, and the entries are only a cache.
+    this.#closeStage = 'cacheWrites';
+    try {
+      await DeferredCacheEntryWrites.instance.abortAsync();
+    } catch (error) {
+      // Only files in the common temp folder are left behind, so the daemon still releases its listener.
+      this.#reportError(error as Error);
+    }
 
     if (errors.length === 0) {
       this.#closeStage = 'listener';
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts
new file mode 100644
index 0000000000..5da3550b9d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonShutdownCacheWrites.test.ts
@@ -0,0 +1,117 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { DeferredCacheEntryWrites } from '@microsoft/rush-lib/lib/logic/buildCache/DeferredCacheEntryWrites';
+import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
+
+import { DaemonShutdownDeadlineError } from '../DaemonShutdownDeadlineError';
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { CallbackDaemonRequestResolver, createDeferred } from './DaemonRequestWireTestUtilities';
+import { captureTestDaemonListenerAsync } from './TestDaemonListener';
+import { createTemporaryRepo, TemporaryRepoWorkspaceSession } from './TemporaryRepoWorkspaceSession';
+
+describe('daemon shutdown with build cache entries that are written in the background', () => {
+  let repoRoot: string;
+
+  beforeEach(() => {
+    repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-cache-writes-'));
+    createTemporaryRepo(repoRoot);
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(repoRoot, { force: true, recursive: true });
+  });
+
+  function createOptions(overrides: Partial<IRushDaemonHostOptions> = {}): IRushDaemonHostOptions {
+    return {
+      createWorkspaceSessionAsync: () => Promise.resolve(new TemporaryRepoWorkspaceSession(repoRoot)),
+      daemonVersion: 'cache-writes-test',
+      repoRoot,
+      rushVersion: '5.178.1',
+      requestResolver: new CallbackDaemonRequestResolver(() => new Promise(() => undefined)),
+      ...overrides
+    };
+  }
+
+  it('drops them after it disposes the workspace session and before it closes its listener', async () => {
+    const events: string[] = [];
+    class RecordingWorkspaceSession extends TemporaryRepoWorkspaceSession {
+      public override async [Symbol.asyncDispose](): Promise<void> {
+        events.push('workspace session disposed');
+        await super[Symbol.asyncDispose]();
+      }
+    }
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(
+      createOptions({
+        createWorkspaceSessionAsync: () => Promise.resolve(new RecordingWorkspaceSession(repoRoot)),
+        onLog: (message: string) => events.push(message)
+      })
+    );
+    const isListening = (): boolean => readDaemonLockfile(host.paths.lockfilePath)?.pid === process.pid;
+    const folderPath: string = fs.mkdtempSync(path.join(repoRoot, 'staging-'));
+    const writeStarted = createDeferred<void>();
+    DeferredCacheEntryWrites.instance.enqueue({
+      cacheId: 'acme-wizard-1',
+      operationName: 'acme-wizard (build)',
+      sealedOutputs: { folderPath, fileCount: 1, byteCount: 1 },
+      writeAsync: async (terminal, abortSignal: AbortSignal) => {
+        writeStarted.resolve();
+        // Like tar, which the abort signal kills
+        await once(abortSignal, 'abort');
+        events.push(`write aborted (listening: ${isListening()})`);
+        return undefined;
+      }
+    });
+    await writeStarted.promise;
+
+    await host.closeAsync();
+    events.push(`closed (listening: ${isListening()})`);
+
+    expect(events).toEqual([
+      expect.stringMatching(/^rushd \(PID \d+\) shutting down: /),
+      'workspace session disposed',
+      'write aborted (listening: true)',
+      'Dropped the build cache entry acme-wizard-1 for acme-wizard (build), which was being written.',
+      'closed (listening: false)'
+    ]);
+    expect(fs.existsSync(folderPath)).toBe(false);
+  });
+
+  it('reports a failure to drop them and still closes its listener', async () => {
+    const failure: Error = new Error('Could not delete the staging folder');
+    jest.spyOn(DeferredCacheEntryWrites.instance, 'abortAsync').mockRejectedValue(failure);
+    const onError: jest.Mock = jest.fn();
+    const host: RushDaemonHost = await RushDaemonHost.startAsync(createOptions({ onError }));
+
+    await host.closeAsync();
+
+    expect(onError.mock.calls).toEqual([[failure]]);
+    expect(readDaemonLockfile(host.paths.lockfilePath)).toBeUndefined();
+  });
+
+  it('is cut short at its deadline while it drops them', async () => {
+    jest.spyOn(DeferredCacheEntryWrites.instance, 'abortAsync').mockReturnValue(new Promise(() => undefined));
+    const { value: host, listener } = await captureTestDaemonListenerAsync(() =>
+      RushDaemonHost.startAsync(createOptions({ shutdownDeadlineMs: 300 }))
+    );
+    try {
+      const error: unknown = await host.closeAsync().catch((closeError: unknown) => closeError);
+
+      expect(error).toBeInstanceOf(DaemonShutdownDeadlineError);
+      expect(error).toMatchObject({ forcedBy: undefined, stage: 'cacheWrites' });
+      expect((error as Error).message).toMatch(
+        /^The Rush daemon's shutdown did not finish within \d+\.\d s, while stopping the build cache writes\.$/
+      );
+      // The daemon still owns its endpoint.
+      expect(readDaemonLockfile(host.paths.lockfilePath)?.pid).toBe(process.pid);
+    } finally {
+      await listener.closeAsync();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts b/libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts
new file mode 100644
index 0000000000..9089d54a23
--- /dev/null
+++ b/libraries/rush-daemon/src/test/NativeDeferredCacheWrites.test.ts
@@ -0,0 +1,97 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DeferredCacheEntryWrites } from '@microsoft/rush-lib/lib/logic/buildCache/DeferredCacheEntryWrites';
+import {
+  DaemonFrameType,
+  decodeDaemonEventFrame,
+  decodeDaemonLogChunk,
+  type IDaemonEventEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import type { ITerminalExchange } from './DaemonRequestWireTestUtilities';
+import { createFixtureAsync, runAsync, runs, type IFixture } from './NativeEngineTestFixture';
+
+const SEALED: RegExp =
+  /Sealed \d+ output files? \(0\.0 MB\) in \d+ ms; writing the build cache entry in the background\./;
+const NOT_CLONED: RegExp =
+  /Unable to clone the output files \([A-Z]+\), so the build cache entry is written now\./;
+const REPORT: RegExp =
+  /Build cache entries written in the background since the previous command: 1 queued, (0 written \(0\.0 MB\), 0 failed; 1 pending|1 written \(0\.0 MB\), 0 failed; 0 pending)\./;
+const WRITTEN: string = 'Successfully set cache entry';
+
+/** The text of a request's output, from its operations' logs and from its own terminal. */
+function requestOutput(exchange: ITerminalExchange): string {
+  let text: string = '';
+  for (const frame of exchange.frames) {
+    if (frame.kind === DaemonFrameType.event) {
+      const event: IDaemonEventEnvelope = decodeDaemonEventFrame(frame.payload);
+      if (event.type === 'activityChanged') {
+        text += (event.payload as { text?: string }).text ?? '';
+      }
+    } else if (frame.kind === DaemonFrameType.logStdout || frame.kind === DaemonFrameType.logStderr) {
+      text += Buffer.from(decodeDaemonLogChunk(frame.payload).chunk).toString();
+    }
+  }
+  return text;
+}
+
+// Whether the file system of the folder can clone files, as the background writes need
+function canCloneFiles(folderPath: string): boolean {
+  const sourcePath: string = path.join(folderPath, 'clone-probe');
+  fs.writeFileSync(sourcePath, 'probe');
+  try {
+    fs.copyFileSync(sourcePath, `${sourcePath}-clone`, fs.constants.COPYFILE_FICLONE_FORCE);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    fs.rmSync(sourcePath, { force: true });
+    fs.rmSync(`${sourcePath}-clone`, { force: true });
+  }
+}
+
+describe('build cache entries of daemon builds', () => {
+  it('are written in the background with the deferCacheWrites setting', async () => {
+    const fixture: IFixture = await createFixtureAsync(true, 'direct', { deferCacheWrites: true });
+    try {
+      const cloned: boolean = canCloneFiles(path.join(fixture.repoRoot, 'common/temp'));
+      const initial: ITerminalExchange = await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+      expect(initial.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      // Without clones, the entry is written before the operation completes, as without the setting.
+      const output: string = requestOutput(initial);
+      expect(output).toMatch(cloned ? SEALED : NOT_CLONED);
+      expect(output.includes(WRITTEN)).toBe(!cloned);
+      expect(REPORT.test(output)).toBe(cloned);
+      await DeferredCacheEntryWrites.instance.waitForIdleAsync();
+
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), 'two');
+      await runAsync(fixture, 'changed', ['build', '--only', 'a']);
+      fs.writeFileSync(path.join(fixture.repoRoot, 'projects/a/input.txt'), 'one');
+      expect((await runAsync(fixture, 'cached', ['build', '--only', 'a'])).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 0, operationResults: [{ status: 'FROM CACHE' }] }
+      });
+      expect(runs(fixture)).toEqual(['a:one:', 'a:two:']);
+      expect(fs.readFileSync(path.join(fixture.repoRoot, 'projects/a/lib/output.txt'), 'utf8')).toBe('one');
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('are written before their operations complete without the setting', async () => {
+    const fixture: IFixture = await createFixtureAsync(true);
+    try {
+      const initial: ITerminalExchange = await runAsync(fixture, 'initial', ['build', '--only', 'a']);
+      expect(initial.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const output: string = requestOutput(initial);
+      expect(output).toContain(WRITTEN);
+      expect(output).not.toMatch(/Sealed|Unable to clone|in the background/);
+    } finally {
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+});
diff --git a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
index a663180973..a300228ca9 100644
--- a/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
+++ b/libraries/rush-daemon/src/test/NativeEngineTestFixture.ts
@@ -62,6 +62,8 @@ export interface IFixtureOptions {
   readonly telemetryEnabled?: boolean;
   /** Sets `daemon.compatiblePlugins` in rush.json. */
   readonly compatiblePlugins?: ReadonlyArray<string>;
+  /** Sets `daemon.deferCacheWrites` in rush.json. */
+  readonly deferCacheWrites?: boolean;
 }
 
 /** Records the admission class of every phased request that a production resolver, or its replacement, resolves. */
@@ -156,7 +158,8 @@ export async function createFixtureAsync(
       daemon: {
         warmMemoryBudgetMB: 100_000,
         ...(options.incrementalBuilds === undefined ? {} : { incrementalBuilds: options.incrementalBuilds }),
-        ...(options.compatiblePlugins === undefined ? {} : { compatiblePlugins: options.compatiblePlugins })
+        ...(options.compatiblePlugins === undefined ? {} : { compatiblePlugins: options.compatiblePlugins }),
+        ...(options.deferCacheWrites === undefined ? {} : { deferCacheWrites: options.deferCacheWrites })
       },
       ...(options.buildEventHook ? { eventHooks: { preRushBuild: ['node -e ""'] } } : {}),
       ...(options.telemetryEnabled ? { telemetryEnabled: true } : {}),
diff --git a/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts b/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
index c2815f8ff7..4e6bba8b29 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestHook.test.ts
@@ -118,6 +118,24 @@ function getActivity(client: TestPhasedRequestClient, stream: 'stdout' | 'stderr
   return text;
 }
 
+interface IActivity {
+  readonly severity?: string;
+  readonly stream?: string;
+  readonly text?: string;
+}
+
+/** The request's activity events, in the order that its client received them. */
+function getActivities(client: TestPhasedRequestClient): IActivity[] {
+  const activities: IActivity[] = [];
+  for (const { event } of client.writes) {
+    if (event?.type === 'activityChanged') {
+      const { severity, stream, text } = event.payload as IActivity;
+      activities.push({ severity, stream, text });
+    }
+  }
+  return activities;
+}
+
 /** Expects the hook's line to follow the status tables and to precede the duration line. */
 function expectHookOutputBetween(
   stdout: string,
@@ -292,6 +310,83 @@ describe('afterExecuteRequestAsync in the phased request router', () => {
     }
   });
 
+  it("keeps the severity of a tap's warnings and errors, which the summary's own lines do not have", async () => {
+    const fixture: ITestRoutingFixture = createRoutingFixture(
+      new Map([
+        [OPERATION_A, new TestOperationRunner(OPERATION_A, OperationStatus.Failure)],
+        [OPERATION_B, new TestOperationRunner(OPERATION_B)],
+        [OPERATION_C, new TestOperationRunner(OPERATION_C)]
+      ]),
+      [[OPERATION_B, OPERATION_A]]
+    );
+    recordRequests(fixture, (request: IOperationGraphRequestResult) => {
+      request.terminal.writeWarningLine('hook-warning');
+      request.terminal.writeErrorLine('hook-error');
+      request.terminal.writeLine('hook-after');
+    });
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result: IDaemonPhasedRequestResult = await router.executeAsync(
+        createRequest('a', 'build', [OPERATION_A]),
+        client
+      );
+
+      expect(result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      const activities: IActivity[] = getActivities(client);
+      // Agent output shows only activity with a severity.
+      expect(activities.filter(({ severity }) => severity !== undefined)).toEqual([
+        { severity: 'warning', stream: 'stderr', text: 'hook-warning\n' },
+        { severity: 'error', stream: 'stderr', text: 'hook-error\n' }
+      ]);
+      const texts: string[] = activities.map(({ text }) => text ?? '');
+      const failedIndex: number = texts.findIndex((text: string) => text.includes('Operations failed.'));
+      const warningIndex: number = texts.indexOf('hook-warning\n');
+      const durationIndex: number = texts.findIndex((text: string) => BUILD_DURATION_LINE.test(text));
+      expect(activities[failedIndex]?.stream).toBe('stderr');
+      expect(warningIndex).toBeGreaterThan(failedIndex);
+      expect(durationIndex).toBeGreaterThan(warningIndex);
+      expect(texts.indexOf('hook-after\n')).toBeGreaterThan(texts.indexOf('hook-error\n'));
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
+  it('reports the warning of a tap that then throws with its severity, before the errors line', async () => {
+    const fixture: ITestRoutingFixture = createFixture();
+    recordRequests(fixture, (request: IOperationGraphRequestResult) => {
+      request.terminal.writeWarningLine('hook-warning');
+      throw new Error('summary-write-failed');
+    });
+    try {
+      const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+      const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+      const result: IDaemonPhasedRequestResult = await router.executeAsync(
+        createRequest('a', 'build', [OPERATION_A]),
+        client
+      );
+
+      expect(result).toMatchObject({ exitCode: 1, outcome: 'failure' });
+      const activities: IActivity[] = getActivities(client);
+      const warningIndex: number = activities.findIndex(({ text }) => text === 'hook-warning\n');
+      const errorsIndex: number = activities.findIndex(({ text }) =>
+        text?.startsWith('rush build - Errors!')
+      );
+      expect(activities[warningIndex]).toEqual({
+        severity: 'warning',
+        stream: 'stderr',
+        text: 'hook-warning\n'
+      });
+      expect(errorsIndex).toBeGreaterThan(warningIndex);
+      expect(activities[errorsIndex]).toEqual({
+        stream: 'stderr',
+        text: expect.stringMatching(/^rush build - Errors! \(\d+\.\d\d seconds\)\n$/)
+      });
+    } finally {
+      await fixture.session[Symbol.asyncDispose]();
+    }
+  });
+
   it('invokes the hook once for a request that returns early, with only the results that are final', async () => {
     let startC: () => void = () => undefined;
     const startedC: Promise<void> = new Promise((resolve) => {
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index f784f4cf9d..ac8d63799d 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -33,6 +33,17 @@ export interface IDaemonConfigurationJson {
    * iteration to end. Experimental. Defaults to false.
    */
   readonly joinRunningBatch?: boolean;
+  /**
+   * Lets an operation of a daemon build complete before its build cache entry is written. The daemon clones the
+   * operation's output files, which takes well under a second on a file system that can clone files (such as Btrfs,
+   * XFS or APFS), and writes the entry from the clones in the background. So the operations that depend on it, and the
+   * command, don't wait for the entry. An operation waits at most half a second for its clones. Slower clones finish
+   * in the background, and the entry is dropped if an output file changes before it is cloned. Otherwise, and in
+   * cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be
+   * written in the background doesn't change the operation's status, and the daemon drops the entries that it hasn't
+   * written when it stops. Defaults to false.
+   */
+  readonly deferCacheWrites?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
   /**
@@ -77,6 +88,7 @@ const defaults: Required<IDaemonConfigurationJson> = {
   incrementalBuilds: true,
   warmWorkers: false,
   joinRunningBatch: false,
+  deferCacheWrites: false,
   queueTimeoutSeconds: 30,
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
@@ -97,6 +109,7 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     incrementalBuilds: 'RUSH_DAEMON_INCREMENTAL_BUILDS',
     warmWorkers: 'RUSH_DAEMON_WARM_WORKERS',
     joinRunningBatch: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
+    deferCacheWrites: 'RUSH_DAEMON_DEFER_CACHE_WRITES',
     queueTimeoutSeconds: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
@@ -143,6 +156,7 @@ export function resolveDaemonConfiguration(
     incrementalBuilds: booleanOption('incrementalBuilds', json, environment),
     warmWorkers: booleanOption('warmWorkers', json, environment),
     joinRunningBatch: booleanOption('joinRunningBatch', json, environment),
+    deferCacheWrites: booleanOption('deferCacheWrites', json, environment),
     autoWarmByTelemetry: booleanOption('autoWarmByTelemetry', json, environment),
     idleTimeoutSeconds: numberOption('idleTimeoutSeconds', json, environment),
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
@@ -193,7 +207,8 @@ function booleanOption(
     | 'usePersistentIpcRunners'
     | 'incrementalBuilds'
     | 'warmWorkers'
-    | 'joinRunningBatch',
+    | 'joinRunningBatch'
+    | 'deferCacheWrites',
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): boolean {
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index cbd873b0fa..3a374e8916 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -296,6 +296,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_WARM_WORKERS: 'RUSH_DAEMON_WARM_WORKERS',
   /** Lets a daemon build request add its operations to the executing iteration of a compatible batch. */
   RUSH_DAEMON_JOIN_RUNNING_BATCH: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
+  /** Lets daemon operations complete before their build cache entries are written. */
+  RUSH_DAEMON_DEFER_CACHE_WRITES: 'RUSH_DAEMON_DEFER_CACHE_WRITES',
   /** Overrides the request admission queue timeout. */
   RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   /** Overrides idle eviction in an attached daemon warm set. */
@@ -719,6 +721,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_INCREMENTAL_BUILDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_WORKERS:
           case EnvironmentVariableNames.RUSH_DAEMON_JOIN_RUNNING_BATCH:
+          case EnvironmentVariableNames.RUSH_DAEMON_DEFER_CACHE_WRITES:
           case EnvironmentVariableNames.RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index 85afc4cdfe..ae27af62bd 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -14,6 +14,7 @@ describe('daemon configuration', () => {
       incrementalBuilds: true,
       warmWorkers: false,
       joinRunningBatch: false,
+      deferCacheWrites: false,
       idleTimeoutSeconds: 900
     });
     expect(
@@ -42,7 +43,8 @@ describe('daemon configuration', () => {
     { RUSH_DAEMON_INCREMENTAL_BUILDS: 'off' },
     { RUSH_DAEMON_WARM_WORKERS: 'true' },
     { RUSH_DAEMON_JOIN_RUNNING_BATCH: 'true' },
-    { RUSH_DAEMON_JOIN_RUNNING_BATCH: '' }
+    { RUSH_DAEMON_JOIN_RUNNING_BATCH: '' },
+    { RUSH_DAEMON_DEFER_CACHE_WRITES: 'on' }
   ])('rejects invalid overrides %j', (environment) => {
     expect(() => resolveDaemonConfiguration({}, environment)).toThrow();
   });
@@ -63,6 +65,7 @@ describe('daemon configuration', () => {
     { incrementalBuilds: 'false' },
     { warmWorkers: 1 },
     { joinRunningBatch: 'true' },
+    { deferCacheWrites: 'true' },
     { compatiblePlugins: 'rush-example-plugin' },
     { compatiblePlugins: [''] },
     { compatiblePlugins: [' rush-example-plugin'] },
@@ -113,6 +116,17 @@ describe('daemon configuration', () => {
     );
   });
 
+  it('defers cache writes only if the environment or configuration turns it on', () => {
+    expect(resolveDaemonConfiguration({ deferCacheWrites: true }, {}).deferCacheWrites).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ deferCacheWrites: true }, { RUSH_DAEMON_DEFER_CACHE_WRITES: '0' })
+        .deferCacheWrites
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_DEFER_CACHE_WRITES: '1' }).deferCacheWrites).toBe(
+      true
+    );
+  });
+
   describe.each([
     ['compatiblePlugins', 'RUSH_DAEMON_COMPATIBLE_PLUGINS'],
     ['commandAgnosticPlugins', 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS']
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index da5cc3fea2..c50caaaa94 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -74,6 +74,7 @@ import {
 } from '../../logic/operations/ParseParallelism';
 import { CobuildConfiguration } from '../../api/CobuildConfiguration';
 import { CacheableOperationPlugin } from '../../logic/operations/CacheableOperationPlugin';
+import { DeferredCacheEntryWrites } from '../../logic/buildCache/DeferredCacheEntryWrites';
 import type { IInputsSnapshot, GetInputsSnapshotAsyncFn } from '../../logic/incremental/InputsSnapshot';
 import { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
 import { LegacySkipInvalidationPlugin, LegacySkipPlugin } from '../../logic/operations/LegacySkipPlugin';
@@ -924,7 +925,12 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             cobuildConfiguration,
             terminal,
             excludeAppleDoubleFiles,
-            useDirectFileTransfersForBuildCache
+            useDirectFileTransfersForBuildCache,
+            // The writes outlive the engine, which a reload replaces.
+            deferredCacheEntryWrites:
+              onEngine && this.rushConfiguration.daemon.deferCacheWrites
+                ? DeferredCacheEntryWrites.instance
+                : undefined
           }).apply(this.hooks);
 
           if (this.#debugBuildCacheIdsParameter.value) {
diff --git a/libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts b/libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts
new file mode 100644
index 0000000000..2762f6ea7b
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/DeferredCacheEntryWrites.ts
@@ -0,0 +1,681 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { FileSystem } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+/**
+ * The folder, under the common temp folder, that holds the sealed outputs of operations until their build cache
+ * entries are written. Each process uses a subfolder named by its PID, which is empty when it has no pending writes.
+ */
+export const DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME: string = 'build-cache-staging';
+
+// How many files are cloned at once when outputs are sealed
+const CLONE_CONCURRENCY: number = 16;
+// How long an operation waits for its output files to be cloned. Cloning takes longer when the file system must first
+// write back the data that the build just wrote, which can take seconds. The rest of the files are then cloned in the
+// background.
+const SEAL_WAIT_MS: number = 500;
+// How many build cache entries are written at once. Each write runs tar and gzip, which use about a core each.
+const WRITE_CONCURRENCY: number = 2;
+// The errors with which a file system refuses to clone files. After one of them, outputs are no longer sealed.
+const CLONE_UNSUPPORTED_ERROR_CODES: ReadonlySet<string> = new Set([
+  'EXDEV',
+  'EOPNOTSUPP',
+  'ENOTSUP',
+  'ENOSYS'
+]);
+const BYTES_PER_MB: number = 1024 * 1024;
+const NANOSECONDS_PER_MICROSECOND: bigint = BigInt(1000);
+const MICROSECONDS_PER_SECOND: number = 1000 * 1000;
+
+/**
+ * Output files that were cloned into a staging folder.
+ */
+export interface ISealedOutputs {
+  /** The staging folder, which the paths of the files are relative to */
+  readonly folderPath: string;
+  readonly fileCount: number;
+  readonly byteCount: number;
+  /**
+   * True if some of the files were still being cloned when the outputs were returned. They are cloned in the
+   * background, and the build cache entry is written only if none of them changed before it was cloned.
+   */
+  readonly isSealing?: boolean;
+}
+
+export interface ISealOutputsOptions {
+  /** The common temp folder of the repository, which holds the staging folder */
+  readonly commonTempFolder: string;
+  /** The folder that `relativePaths` are relative to */
+  readonly sourceFolderPath: string;
+  readonly relativePaths: ReadonlyArray<string>;
+  /** Gets a line if the files can't be sealed */
+  readonly terminal: ITerminal;
+}
+
+/**
+ * A build cache entry to write from sealed outputs.
+ */
+export interface IDeferredCacheEntryWrite {
+  readonly cacheId: string;
+  /** The name of the operation, such as `my-project (build)` */
+  readonly operationName: string;
+  readonly sealedOutputs: ISealedOutputs;
+  /**
+   * Writes the entry from the sealed outputs. Resolves to the size of the entry in bytes, or to `undefined` if it
+   * was not written, in which case its terminal output is logged. The abort signal kills tar.
+   */
+  readonly writeAsync: (terminal: ITerminal, abortSignal: AbortSignal) => Promise<number | undefined>;
+}
+
+export interface IDeferredCacheEntryWritesReport {
+  /** Entries that were queued since the previous report */
+  readonly queuedCount: number;
+  /** Entries that were written since the previous report */
+  readonly writtenCount: number;
+  /** The total size in bytes of those entries */
+  readonly writtenByteCount: number;
+  /** Entries that failed to be written since the previous report */
+  readonly failedCount: number;
+  /**
+   * Entries that were dropped since the previous report, because an output file changed before it was sealed or
+   * because the writes were aborted
+   */
+  readonly droppedCount: number;
+  /** Entries that are being sealed, queued or being written */
+  readonly pendingCount: number;
+}
+
+export interface IDeferredCacheEntryWritesOptions {
+  /** Clones a file. By default, this fails unless the file system can clone the file. */
+  readonly cloneFileAsync?: (sourcePath: string, destinationPath: string) => Promise<void>;
+  /** Whether a process with the given ID is running */
+  readonly isProcessRunning?: (pid: number) => boolean;
+  /** The ID of this process */
+  readonly pid?: number;
+  /**
+   * How long `trySealAsync` waits for the files to be cloned before it lets them be cloned in the background. By
+   * default, half a second.
+   */
+  readonly sealWaitMs?: number;
+}
+
+/**
+ * A seal that went on in the background after `trySealAsync` returned.
+ */
+interface IBackgroundSeal {
+  readonly abortController: AbortController;
+  /** Resolves when the files are all cloned, and rejects if one of them changed first or couldn't be cloned */
+  readonly clonePromise: Promise<void>;
+  readonly startTimeMs: number;
+}
+
+/**
+ * An output file, with its statistics from when the operation ended.
+ */
+interface ISealSource {
+  readonly relativePath: string;
+  readonly stats: fs.BigIntStats;
+}
+
+/**
+ * The error with which a seal fails if an output file changed or was deleted before it was cloned.
+ */
+class OutputFileChangedError extends Error {
+  public readonly relativePath: string;
+
+  public constructor(relativePath: string) {
+    super(`${relativePath} changed before it was sealed`);
+    this.relativePath = relativePath;
+  }
+}
+
+/**
+ * Writes build cache entries in the background, for the `deferCacheWrites` setting of the Rush daemon.
+ *
+ * @remarks
+ * When an operation completes, its output files are cloned into a staging folder. On a file system that can clone
+ * files, this usually takes well under a second, even for thousands of files, because the clones share the data of
+ * the files until either changes. The build cache entry is then written from the clones while the build goes on, so
+ * that later changes to the output files can't change the entry. If the clones take longer, for example while the
+ * file system writes back what the build just wrote, the operation stops waiting for them after half a second. The
+ * rest are cloned in the background, and the entry is dropped if a file changed before it was cloned. There is one
+ * instance for each process, so that the writes outlive the engine of the build that queued them.
+ */
+export class DeferredCacheEntryWrites {
+  static #instance: DeferredCacheEntryWrites | undefined;
+
+  readonly #cloneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void>;
+  readonly #isProcessRunning: (pid: number) => boolean;
+  readonly #pid: number;
+  readonly #sealWaitMs: number;
+  readonly #queue: IDeferredCacheEntryWrite[] = [];
+  readonly #runningWrites: Set<Promise<void>> = new Set();
+  // The seals that went on in the background, by the path of their staging folder
+  readonly #backgroundSeals: Map<string, IBackgroundSeal> = new Map();
+  // The writes that were queued while their outputs were still being sealed
+  readonly #sealingWrites: Set<Promise<void>> = new Set();
+  // The writes from when they are queued until they are written, fail or are dropped
+  readonly #pendingWrites: Set<IDeferredCacheEntryWrite> = new Set();
+  // The folder of this process in each staging folder that it used, by the path of the staging folder
+  readonly #processFolderPromises: Map<string, Promise<string>> = new Map();
+  #abortController: AbortController = new AbortController();
+  #log: ((message: string) => void) | undefined;
+  #nextFolderIndex: number = 0;
+  // The error with which the file system refused to clone a file, if it did
+  #cloneUnsupportedErrorCode: string | undefined;
+  #queuedCount: number = 0;
+  #writtenCount: number = 0;
+  #writtenByteCount: number = 0;
+  #failedCount: number = 0;
+  #droppedCount: number = 0;
+
+  public constructor(options: IDeferredCacheEntryWritesOptions = {}) {
+    this.#cloneFileAsync = options.cloneFileAsync ?? cloneFileAsync;
+    this.#isProcessRunning = options.isProcessRunning ?? isProcessRunning;
+    this.#pid = options.pid ?? process.pid;
+    this.#sealWaitMs = options.sealWaitMs ?? SEAL_WAIT_MS;
+  }
+
+  /**
+   * The instance for this process.
+   */
+  public static get instance(): DeferredCacheEntryWrites {
+    return (DeferredCacheEntryWrites.#instance ??= new DeferredCacheEntryWrites());
+  }
+
+  /**
+   * Sets the function that gets a line for each entry that is written, fails or is dropped.
+   */
+  public setLog(log: ((message: string) => void) | undefined): void {
+    this.#log = log;
+  }
+
+  /**
+   * Clones the files into a new staging folder, keeping their modes and modification times. If that takes longer
+   * than half a second, the rest of the files are cloned in the background.
+   *
+   * @returns The staging folder, or `undefined` if the files could not be cloned. The build cache entry must then
+   * be written from the files themselves.
+   */
+  public async trySealAsync(options: ISealOutputsOptions): Promise<ISealedOutputs | undefined> {
+    const { commonTempFolder, sourceFolderPath, relativePaths, terminal } = options;
+    if (this.#cloneUnsupportedErrorCode !== undefined) {
+      terminal.writeVerboseLine(
+        `The output files can't be cloned (${this.#cloneUnsupportedErrorCode}), so the build cache entry is written now.`
+      );
+      return undefined;
+    }
+
+    const startTimeMs: number = performance.now();
+    let folderPath: string | undefined;
+    try {
+      folderPath = await this.#createStagingFolderAsync(commonTempFolder);
+      // Each clone is checked against the state that its file had when the operation ended.
+      const sources: ISealSource[] = await statFilesAsync(sourceFolderPath, relativePaths);
+      let byteCount: number = 0;
+      for (const { stats } of sources) {
+        byteCount += Number(stats.size);
+      }
+      const abortController: AbortController = new AbortController();
+      const clonePromise: Promise<void> = cloneFilesAsync(
+        sourceFolderPath,
+        folderPath,
+        sources,
+        this.#cloneFileAsync,
+        abortController.signal
+      );
+      if (await isResolvedWithinAsync(clonePromise, this.#sealWaitMs)) {
+        return { folderPath, fileCount: sources.length, byteCount };
+      }
+      // The write of the entry reports a failure of the seal once it is queued.
+      clonePromise.catch(() => undefined);
+      this.#backgroundSeals.set(folderPath, { abortController, clonePromise, startTimeMs });
+      return { folderPath, fileCount: sources.length, byteCount, isSealing: true };
+    } catch (error) {
+      if (folderPath !== undefined) {
+        await deleteFolderQuietlyAsync(folderPath);
+      }
+      const code: string | undefined = (error as NodeJS.ErrnoException).code;
+      if (code !== undefined && CLONE_UNSUPPORTED_ERROR_CODES.has(code)) {
+        this.#cloneUnsupportedErrorCode = code;
+      }
+      terminal.writeLine(
+        `Unable to clone the output files (${code ?? (error as Error).message}), so the build cache entry is ` +
+          `written now.`
+      );
+      return undefined;
+    }
+  }
+
+  /**
+   * Queues a write. It starts when its outputs are sealed and fewer than two writes are running.
+   */
+  public enqueue(write: IDeferredCacheEntryWrite): void {
+    this.#queuedCount++;
+    this.#pendingWrites.add(write);
+    const backgroundSeal: IBackgroundSeal | undefined = this.#backgroundSeals.get(
+      write.sealedOutputs.folderPath
+    );
+    if (!backgroundSeal) {
+      this.#queue.push(write);
+      this.#startWrites();
+      return;
+    }
+    const sealingWrite: Promise<void> = this.#queueWhenSealedAsync(write, backgroundSeal).finally(() => {
+      this.#sealingWrites.delete(sealingWrite);
+    });
+    this.#sealingWrites.add(sealingWrite);
+  }
+
+  /**
+   * Whether a write of the build cache entry with the given ID is being sealed, is queued or is running. Such a
+   * write replaces the entry when it ends.
+   */
+  public hasPendingWrite(cacheId: string): boolean {
+    for (const write of this.#pendingWrites) {
+      if (write.cacheId === cacheId) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Returns the counts since the previous report, and the number of pending writes.
+   */
+  public takeReport(): IDeferredCacheEntryWritesReport {
+    const report: IDeferredCacheEntryWritesReport = {
+      queuedCount: this.#queuedCount,
+      writtenCount: this.#writtenCount,
+      writtenByteCount: this.#writtenByteCount,
+      failedCount: this.#failedCount,
+      droppedCount: this.#droppedCount,
+      pendingCount: this.#queue.length + this.#runningWrites.size + this.#sealingWrites.size
+    };
+    this.#queuedCount = 0;
+    this.#writtenCount = 0;
+    this.#writtenByteCount = 0;
+    this.#failedCount = 0;
+    this.#droppedCount = 0;
+    return report;
+  }
+
+  /**
+   * Resolves when no writes are being sealed, queued or running.
+   */
+  public async waitForIdleAsync(): Promise<void> {
+    while (this.#runningWrites.size > 0 || this.#sealingWrites.size > 0) {
+      await Promise.all([...this.#runningWrites, ...this.#sealingWrites]);
+    }
+  }
+
+  /**
+   * Drops the queued writes, stops the seals in the background, kills the tar processes of the running writes and
+   * waits for them all, then deletes the staging folders of this process. Their entries are not written. Writes
+   * that are queued later run as usual.
+   */
+  public async abortAsync(): Promise<void> {
+    const droppedWrites: IDeferredCacheEntryWrite[] = this.#queue.splice(0);
+    const runningWrites: Promise<void>[] = Array.from(this.#runningWrites);
+    const sealingWrites: Promise<void>[] = Array.from(this.#sealingWrites);
+    // Each seal stays in the map until its write is queued, and that write drops the entry.
+    const backgroundSeals: IBackgroundSeal[] = Array.from(this.#backgroundSeals.values());
+    for (const { abortController } of backgroundSeals) {
+      abortController.abort();
+    }
+    this.#abortController.abort();
+    this.#abortController = new AbortController();
+    for (const write of droppedWrites) {
+      this.#pendingWrites.delete(write);
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${write.cacheId} for ${write.operationName}, which was not written yet.`
+      );
+    }
+    await Promise.all([
+      ...droppedWrites.map(({ sealedOutputs }) => deleteFolderQuietlyAsync(sealedOutputs.folderPath)),
+      ...runningWrites,
+      ...sealingWrites,
+      // The clones that are running when a seal is stopped finish first.
+      ...backgroundSeals.map(({ clonePromise }) => clonePromise.catch(() => undefined))
+    ]);
+
+    const processFolderPromises: Promise<string>[] = Array.from(this.#processFolderPromises.values());
+    this.#processFolderPromises.clear();
+    for (const processFolderPromise of processFolderPromises) {
+      try {
+        await deleteFolderQuietlyAsync(await processFolderPromise);
+      } catch {
+        // The folder was not created.
+      }
+    }
+  }
+
+  async #queueWhenSealedAsync(
+    write: IDeferredCacheEntryWrite,
+    backgroundSeal: IBackgroundSeal
+  ): Promise<void> {
+    const { cacheId, operationName, sealedOutputs } = write;
+    const { abortController, clonePromise, startTimeMs } = backgroundSeal;
+    let sealError: { error: unknown } | undefined;
+    try {
+      await clonePromise;
+    } catch (error) {
+      sealError = { error };
+    }
+    this.#backgroundSeals.delete(sealedOutputs.folderPath);
+
+    if (!sealError && !abortController.signal.aborted) {
+      this.#writeLog(
+        `Sealed the output files of ${operationName} in the background in ` +
+          `${Math.round(performance.now() - startTimeMs)} ms.`
+      );
+      this.#queue.push(write);
+      this.#startWrites();
+      return;
+    }
+
+    this.#pendingWrites.delete(write);
+    await deleteFolderQuietlyAsync(sealedOutputs.folderPath);
+    const error: unknown = sealError?.error;
+    if (abortController.signal.aborted) {
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${cacheId} for ${operationName}, which was not written yet.`
+      );
+    } else if (error instanceof OutputFileChangedError) {
+      // The entry would hold output files that no longer exist, so this is not a failure.
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${cacheId} for ${operationName}, because ${error.relativePath} changed ` +
+          `before it was sealed.`
+      );
+    } else {
+      const code: string | undefined = (error as NodeJS.ErrnoException).code;
+      if (code !== undefined && CLONE_UNSUPPORTED_ERROR_CODES.has(code)) {
+        this.#cloneUnsupportedErrorCode = code;
+      }
+      this.#failedCount++;
+      this.#writeLog(
+        `Failed to write the build cache entry ${cacheId} for ${operationName}: Unable to clone the output ` +
+          `files (${code ?? (error as Error).message}).`
+      );
+    }
+  }
+
+  #startWrites(): void {
+    while (this.#runningWrites.size < WRITE_CONCURRENCY && this.#queue.length > 0) {
+      const write: IDeferredCacheEntryWrite = this.#queue.shift()!;
+      const runningWrite: Promise<void> = this.#writeAsync(write, this.#abortController.signal).finally(
+        () => {
+          this.#pendingWrites.delete(write);
+          this.#runningWrites.delete(runningWrite);
+          this.#startWrites();
+        }
+      );
+      this.#runningWrites.add(runningWrite);
+    }
+  }
+
+  async #writeAsync(write: IDeferredCacheEntryWrite, abortSignal: AbortSignal): Promise<void> {
+    const { cacheId, operationName, sealedOutputs } = write;
+    const startTimeMs: number = performance.now();
+    const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+    const terminal: Terminal = new Terminal(terminalProvider);
+    let byteCount: number | undefined;
+    try {
+      byteCount = await write.writeAsync(terminal, abortSignal);
+    } catch (error) {
+      terminal.writeErrorLine((error as Error).message);
+    } finally {
+      await deleteFolderQuietlyAsync(sealedOutputs.folderPath);
+    }
+
+    const durationMs: number = Math.round(performance.now() - startTimeMs);
+    if (byteCount !== undefined) {
+      this.#writtenCount++;
+      this.#writtenByteCount += byteCount;
+      this.#writeLog(
+        `Wrote the build cache entry ${cacheId} (${formatMegabytes(byteCount)}) for ${operationName} in ` +
+          `${durationMs} ms.`
+      );
+    } else if (abortSignal.aborted) {
+      this.#droppedCount++;
+      this.#writeLog(
+        `Dropped the build cache entry ${cacheId} for ${operationName}, which was being written.`
+      );
+    } else {
+      this.#failedCount++;
+      const output: string = [
+        terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false }),
+        terminalProvider.getErrorOutput({ normalizeSpecialCharacters: false })
+      ]
+        .join(' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+      this.#writeLog(`Failed to write the build cache entry ${cacheId} for ${operationName}: ${output}`);
+    }
+  }
+
+  #writeLog(message: string): void {
+    try {
+      this.#log?.(message);
+    } catch {
+      // A log that throws must not stop the writes.
+    }
+  }
+
+  async #createStagingFolderAsync(commonTempFolder: string): Promise<string> {
+    const stagingFolderPath: string = path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME);
+    let processFolderPromise: Promise<string> | undefined =
+      this.#processFolderPromises.get(stagingFolderPath);
+    if (!processFolderPromise) {
+      processFolderPromise = this.#prepareProcessFolderAsync(stagingFolderPath);
+      this.#processFolderPromises.set(stagingFolderPath, processFolderPromise);
+    }
+    const folderPath: string = path.join(await processFolderPromise, `${this.#nextFolderIndex++}`);
+    await fs.promises.mkdir(folderPath);
+    return folderPath;
+  }
+
+  async #prepareProcessFolderAsync(stagingFolderPath: string): Promise<string> {
+    const processFolderPath: string = path.join(stagingFolderPath, `${this.#pid}`);
+    // An earlier process with the same ID may have left files behind.
+    await FileSystem.ensureEmptyFolderAsync(processFolderPath);
+    // Delete the folders of processes that ended without deleting theirs, for example because they crashed.
+    for (const name of await FileSystem.readFolderItemNamesAsync(stagingFolderPath)) {
+      const pid: number = Number(name);
+      if (/^\d+$/.test(name) && pid !== this.#pid && !this.#isProcessRunning(pid)) {
+        await deleteFolderQuietlyAsync(path.join(stagingFolderPath, name));
+      }
+    }
+    return processFolderPath;
+  }
+}
+
+/**
+ * Formats a number of bytes in megabytes, such as `12.3 MB`.
+ */
+export function formatMegabytes(byteCount: number): string {
+  return `${(byteCount / BYTES_PER_MB).toFixed(1)} MB`;
+}
+
+async function cloneFileAsync(sourcePath: string, destinationPath: string): Promise<void> {
+  // FICLONE_FORCE fails unless the file system clones the file, which shares its data until either copy changes.
+  await fs.promises.copyFile(sourcePath, destinationPath, fs.constants.COPYFILE_FICLONE_FORCE);
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    // Signal 0 checks that the process exists, without signaling it.
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM means that the process exists, but belongs to another user.
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+/**
+ * Gets the statistics of each output file, which must be a file.
+ */
+async function statFilesAsync(
+  sourceFolderPath: string,
+  relativePaths: ReadonlyArray<string>
+): Promise<ISealSource[]> {
+  const sources: ISealSource[] = new Array(relativePaths.length);
+  await forEachConcurrentlyAsync(
+    Array.from(relativePaths.keys()),
+    async (index: number) => {
+      const relativePath: string = relativePaths[index];
+      const stats: fs.BigIntStats = await fs.promises.lstat(path.join(sourceFolderPath, relativePath), {
+        bigint: true
+      });
+      if (!stats.isFile()) {
+        throw new Error(`"${relativePath}" is not a file`);
+      }
+      sources[index] = { relativePath, stats };
+    },
+    undefined
+  );
+  return sources;
+}
+
+async function cloneFilesAsync(
+  sourceFolderPath: string,
+  destinationFolderPath: string,
+  sources: ReadonlyArray<ISealSource>,
+  cloneOneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void>,
+  abortSignal: AbortSignal
+): Promise<void> {
+  const folderPaths: Set<string> = new Set();
+  for (const { relativePath } of sources) {
+    folderPaths.add(path.join(destinationFolderPath, path.dirname(relativePath)));
+  }
+  await forEachConcurrentlyAsync(
+    Array.from(folderPaths),
+    async (folderPath: string) => {
+      await fs.promises.mkdir(folderPath, { recursive: true });
+    },
+    abortSignal
+  );
+
+  await forEachConcurrentlyAsync(
+    sources,
+    async ({ relativePath, stats }: ISealSource) => {
+      const sourcePath: string = path.join(sourceFolderPath, relativePath);
+      const destinationPath: string = path.join(destinationFolderPath, relativePath);
+      let cloneError: { error: unknown } | undefined;
+      try {
+        await cloneOneFileAsync(sourcePath, destinationPath);
+      } catch (error) {
+        cloneError = { error };
+      }
+      // A clone is a consistent copy of its file. Writing, truncating or replacing the file after its statistics
+      // were taken changes its change time or its inode, so if they are the same now, the clone holds the file as it
+      // was when the operation ended.
+      if (!(await isUnchangedAsync(sourcePath, stats))) {
+        throw new OutputFileChangedError(relativePath);
+      }
+      if (cloneError) {
+        throw cloneError.error;
+      }
+      // The build cache entry has the modification time of each file. A clone has the mode of its source.
+      await fs.promises.utimes(
+        destinationPath,
+        getSecondsForUtimes(stats.atimeNs),
+        getSecondsForUtimes(stats.mtimeNs)
+      );
+    },
+    abortSignal
+  );
+}
+
+/**
+ * Converts a time in nanoseconds to seconds for `utimes`, with the same whole seconds. The dates of `fs.Stats` are
+ * rounded to the nearest millisecond, which moves a time in the last half millisecond of a second to the next second.
+ */
+export function getSecondsForUtimes(timeNs: bigint): number {
+  // A number holds a count of microseconds exactly, and the quotient stays below the next whole second.
+  return Number(timeNs / NANOSECONDS_PER_MICROSECOND) / MICROSECONDS_PER_SECOND;
+}
+
+async function isUnchangedAsync(filePath: string, stats: fs.BigIntStats): Promise<boolean> {
+  let current: fs.BigIntStats;
+  try {
+    current = await fs.promises.lstat(filePath, { bigint: true });
+  } catch {
+    return false;
+  }
+  return (
+    current.dev === stats.dev &&
+    current.ino === stats.ino &&
+    current.size === stats.size &&
+    current.mtimeNs === stats.mtimeNs &&
+    current.ctimeNs === stats.ctimeNs
+  );
+}
+
+/**
+ * Resolves to true if the promise resolves within the given time, and to false if it hasn't settled by then. Rejects
+ * if the promise rejects within that time.
+ */
+async function isResolvedWithinAsync(promise: Promise<void>, timeoutMs: number): Promise<boolean> {
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise.then(() => true),
+      new Promise<boolean>((resolve) => {
+        timeout = setTimeout(() => resolve(false), timeoutMs);
+      })
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * Calls the callback for each item, for up to 16 items at once. Unlike `Async.forEachAsync`, it waits for the
+ * callbacks that are running when one fails or the signal is aborted, so that the caller can delete what they
+ * created.
+ */
+async function forEachConcurrentlyAsync<T>(
+  items: ReadonlyArray<T>,
+  callbackAsync: (item: T) => Promise<void>,
+  abortSignal: AbortSignal | undefined
+): Promise<void> {
+  let nextIndex: number = 0;
+  let failure: { error: unknown } | undefined;
+  const workAsync = async (): Promise<void> => {
+    while (!failure && !abortSignal?.aborted && nextIndex < items.length) {
+      const item: T = items[nextIndex++];
+      try {
+        await callbackAsync(item);
+      } catch (error) {
+        failure ??= { error };
+      }
+    }
+  };
+  const workerCount: number = Math.min(CLONE_CONCURRENCY, items.length);
+  await Promise.all(Array.from({ length: workerCount }, workAsync));
+  if (failure) {
+    throw failure.error;
+  }
+  if (abortSignal?.aborted) {
+    throw new Error('The seal was stopped.');
+  }
+}
+
+async function deleteFolderQuietlyAsync(folderPath: string): Promise<void> {
+  try {
+    await FileSystem.deleteFolderAsync(folderPath);
+  } catch {
+    // It is deleted with the other staging folders of this process when they are aborted, or by the next process
+    // with the same ID.
+  }
+}
diff --git a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
index e4ffb2b79c..c340251e03 100644
--- a/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
+++ b/libraries/rush-lib/src/logic/buildCache/OperationBuildCache.ts
@@ -16,6 +16,11 @@ import { EnvironmentVariableNames } from '../../api/EnvironmentConfiguration';
 import type { IBaseOperationExecutionResult } from '../operations/IOperationExecutionResult';
 import { OutputFolderReceipt, type PendingOutputFolderReceipt } from './OutputFolderReceipt';
 import { tryRestoreThroughStagingFolderAsync } from './StagedRestore';
+import {
+  type DeferredCacheEntryWrites,
+  type ISealedOutputs,
+  formatMegabytes
+} from './DeferredCacheEntryWrites';
 
 /**
  * How long to wait to acquire the per-cache-entry download lock (see
@@ -141,6 +146,7 @@ export class OperationBuildCache {
   readonly #excludeAppleDoubleFiles: boolean;
   readonly #useDirectFileTransfersForBuildCache: boolean;
   readonly #receipt: OutputFolderReceipt | undefined;
+  readonly #phaseName: string;
 
   private constructor(
     cacheId: string | undefined,
@@ -157,7 +163,8 @@ export class OperationBuildCache {
       project,
       projectOutputFolderNames,
       excludeAppleDoubleFiles,
-      useDirectFileTransfersForBuildCache
+      useDirectFileTransfersForBuildCache,
+      phaseName
     } = options;
     this.#project = project;
     this.#localBuildCacheProvider = localCacheProvider;
@@ -169,6 +176,7 @@ export class OperationBuildCache {
     this.#excludeAppleDoubleFiles = excludeAppleDoubleFiles && process.platform === 'darwin';
     this.#useDirectFileTransfersForBuildCache = useDirectFileTransfersForBuildCache;
     this.#receipt = receipt;
+    this.#phaseName = phaseName;
   }
 
   public get cacheId(): string | undefined {
@@ -418,7 +426,18 @@ export class OperationBuildCache {
     return restoreSuccess;
   }
 
-  public async trySetCacheEntryAsync(terminal: ITerminal, specifiedCacheId?: string): Promise<boolean> {
+  /**
+   * Writes the build cache entry for the output files of the operation.
+   *
+   * @param deferredCacheEntryWrites - If specified, the output files are sealed, and the entry is written from them
+   * in the background, so that this resolves as soon as they are sealed. If they can't be sealed, the entry is
+   * written before this resolves, as it is without this parameter.
+   */
+  public async trySetCacheEntryAsync(
+    terminal: ITerminal,
+    specifiedCacheId?: string,
+    deferredCacheEntryWrites?: DeferredCacheEntryWrites
+  ): Promise<boolean> {
     if (!this.#cacheWriteEnabled) {
       // Skip writing local and cloud build caches, without any noise
       return true;
@@ -431,10 +450,20 @@ export class OperationBuildCache {
     }
 
     // The stamp comes before the output folders are read, so a change to them while they are archived keeps the
-    // receipt from being written.
-    const pendingReceipt: PendingOutputFolderReceipt | undefined = await this.#tryBeginReceiptAsync(terminal);
+    // receipt from being written. No receipt is written while an older write of this entry is pending: that write
+    // would replace the entry that is written now, and the receipt would then describe outputs that the entry doesn't
+    // hold.
+    const isOlderWritePending: boolean = !!deferredCacheEntryWrites?.hasPendingWrite(cacheId);
+    const pendingReceipt: PendingOutputFolderReceipt | undefined = isOlderWritePending
+      ? undefined
+      : await this.#tryBeginReceiptAsync(terminal);
     try {
-      return await this.#trySetCacheEntryWithReceiptAsync(terminal, cacheId, pendingReceipt);
+      return await this.#trySetCacheEntryWithReceiptAsync(
+        terminal,
+        cacheId,
+        pendingReceipt,
+        deferredCacheEntryWrites
+      );
     } finally {
       await this.#tryDisposeReceiptAsync(terminal, pendingReceipt);
     }
@@ -443,7 +472,8 @@ export class OperationBuildCache {
   async #trySetCacheEntryWithReceiptAsync(
     terminal: ITerminal,
     cacheId: string,
-    pendingReceipt: PendingOutputFolderReceipt | undefined
+    pendingReceipt: PendingOutputFolderReceipt | undefined,
+    deferredCacheEntryWrites: DeferredCacheEntryWrites | undefined
   ): Promise<boolean> {
     const filesToCache: IPathsToCache | undefined = await this._tryCollectPathsToCacheAsync(terminal);
     if (!filesToCache) {
@@ -454,6 +484,79 @@ export class OperationBuildCache {
       `Caching build output folders: ${filesToCache.filteredOutputFolderNames.join(', ')}`
     );
 
+    // If tar can't be found, the write below fails at once, so that the operation reports it.
+    if (deferredCacheEntryWrites && (await _tryGetTarUtility(terminal))) {
+      // A restore consults the receipt only if the local cache has the entry, so a receipt for an entry that is not
+      // written yet is never consulted if the write is dropped or fails. But an older entry for the same cache ID,
+      // such as one that "rush rebuild" wrote, would be paired with these outputs until the write replaces it, or for
+      // good if it doesn't. So if there is one, no receipt is written, and the next restore writes one.
+      const canWriteReceipt: boolean =
+        !!pendingReceipt &&
+        !(await this.#localBuildCacheProvider.tryGetCacheEntryPathByIdAsync(terminal, cacheId));
+      const sealStartTimeMs: number = performance.now();
+      const sealedOutputs: ISealedOutputs | undefined = await deferredCacheEntryWrites.trySealAsync({
+        commonTempFolder: this.#project.rushConfiguration.commonTempFolder,
+        sourceFolderPath: this.#project.projectFolder,
+        relativePaths: filesToCache.outputFilePaths,
+        terminal
+      });
+      if (sealedOutputs) {
+        deferredCacheEntryWrites.enqueue({
+          cacheId,
+          operationName: `${this.#project.packageName} (${this.#phaseName})`,
+          sealedOutputs,
+          writeAsync: async (writeTerminal: ITerminal, abortSignal: AbortSignal) => {
+            const written: boolean = await this.#tryWriteCacheEntryAsync(
+              writeTerminal,
+              cacheId,
+              filesToCache,
+              undefined,
+              {
+                baseFolderPath: sealedOutputs.folderPath,
+                abortSignal
+              }
+            );
+            if (!written) {
+              return undefined;
+            }
+            const cacheEntryPath: string = this.#localBuildCacheProvider.getCacheEntryPath(cacheId);
+            return (await FileSystem.getStatisticsAsync(cacheEntryPath)).size;
+          }
+        });
+        const { fileCount, byteCount, isSealing } = sealedOutputs;
+        const files: string = `${fileCount} output ${fileCount === 1 ? 'file' : 'files'}`;
+        const size: string = formatMegabytes(byteCount);
+        const sealDurationMs: number = Math.round(performance.now() - sealStartTimeMs);
+        if (isSealing) {
+          terminal.writeLine(
+            `Sealing ${files} (${size}) in the background after ${sealDurationMs} ms; the build cache entry ` +
+              `is written once they're sealed.`
+          );
+        } else {
+          terminal.writeLine(
+            `Sealed ${files} (${size}) in ${sealDurationMs} ms; writing the build cache entry in the background.`
+          );
+        }
+        terminal.writeVerboseLine(`Cache key: ${cacheId}`);
+        if (canWriteReceipt) {
+          // The receipt is written only if no output changed after the stamp, which was taken before the files were
+          // sealed, so it describes the sealed files that the entry is written from.
+          await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId, filesToCache.outputFilePaths);
+        }
+        return true;
+      }
+    }
+
+    return await this.#tryWriteCacheEntryAsync(terminal, cacheId, filesToCache, pendingReceipt, undefined);
+  }
+
+  async #tryWriteCacheEntryAsync(
+    terminal: ITerminal,
+    cacheId: string,
+    filesToCache: IPathsToCache,
+    pendingReceipt: PendingOutputFolderReceipt | undefined,
+    deferredWrite: { baseFolderPath: string; abortSignal: AbortSignal } | undefined
+  ): Promise<boolean> {
     let localCacheEntryPath: string | undefined;
 
     const tarUtility: TarExecutable | undefined = await _tryGetTarUtility(terminal);
@@ -466,7 +569,9 @@ export class OperationBuildCache {
         archivePath: tempLocalCacheEntryPath,
         paths: filesToCache.outputFilePaths,
         project: this.#project,
-        logFilePath
+        logFilePath,
+        baseFolderPath: deferredWrite?.baseFolderPath,
+        abortSignal: deferredWrite?.abortSignal
       });
 
       if (tarExitCode === 0) {
@@ -493,6 +598,10 @@ export class OperationBuildCache {
         localCacheEntryPath = finalLocalCacheEntryPath;
         await this.#tryCommitReceiptAsync(terminal, pendingReceipt, cacheId, filesToCache.outputFilePaths);
       } else {
+        if (deferredWrite) {
+          // A write in the background can be cut short, so it deletes its partial archive.
+          await FileSystem.deleteFileAsync(tempLocalCacheEntryPath);
+        }
         terminal.writeWarningLine(
           `"tar" exited with code ${tarExitCode} while attempting to create the cache entry. ` +
             `See "${logFilePath}" for logs from the tar process.`
diff --git a/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts b/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
new file mode 100644
index 0000000000..543e4dbb0e
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
@@ -0,0 +1,802 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import { StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
+
+import {
+  DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME,
+  DeferredCacheEntryWrites,
+  getSecondsForUtimes,
+  type IDeferredCacheEntryWrite,
+  type IDeferredCacheEntryWritesOptions,
+  type ISealedOutputs
+} from '../DeferredCacheEntryWrites';
+
+const PID: number = 4242;
+const OUTPUT_PATHS: string[] = ['lib/index.js', 'lib/nested/a.js'];
+const MODIFICATION_TIME: Date = new Date('2020-02-03T04:05:06.000Z');
+// More output files than are cloned at once
+const MANY_OUTPUT_PATHS: string[] = [
+  ...OUTPUT_PATHS,
+  ...Array.from(new Array(18).keys(), (index: number) => `lib/many/${index}.js`)
+];
+// How long a test waits for a seal that should end at once
+const SEAL_TIMEOUT_MS: number = 2000;
+// Longer than a tick of the clocks that coarse timestamps come from
+const CLOCK_TICK_MS: number = 50;
+const NANOSECONDS_PER_SECOND: bigint = BigInt(1000 * 1000 * 1000);
+
+async function copyFileAsync(sourcePath: string, destinationPath: string): Promise<void> {
+  await fs.promises.copyFile(sourcePath, destinationPath);
+}
+
+async function delayAsync(ms: number): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/** Resolves to what the promise resolves to, or to 'timed out' if that takes longer than SEAL_TIMEOUT_MS. */
+async function withTimeoutAsync<T>(promise: Promise<T>): Promise<T | 'timed out'> {
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<'timed out'>((resolve) => {
+        timeout = setTimeout(() => resolve('timed out'), SEAL_TIMEOUT_MS);
+      })
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+interface IGatedClones {
+  /** Copies the file once its clone is released */
+  readonly cloneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void>;
+  /** The source paths of the clones that started */
+  readonly startedPaths: string[];
+  /** Releases the clones of the given files, or of all files if none are given, including clones that start later */
+  readonly release: (...sourcePaths: string[]) => void;
+  /** Resolves when at least the given number of clones have started */
+  readonly whenStartedAsync: (count: number) => Promise<void>;
+}
+
+function createGatedClones(): IGatedClones {
+  const gates: Map<string, { opened: Promise<void>; open: () => void }> = new Map();
+  let isReleased: boolean = false;
+  const startListeners: (() => void)[] = [];
+  const getGate = (sourcePath: string): { opened: Promise<void>; open: () => void } => {
+    let gate: { opened: Promise<void>; open: () => void } | undefined = gates.get(sourcePath);
+    if (!gate) {
+      let open!: () => void;
+      const opened: Promise<void> = new Promise((resolve) => (open = resolve));
+      gate = { opened, open };
+      gates.set(sourcePath, gate);
+    }
+    return gate;
+  };
+  const clones: IGatedClones = {
+    startedPaths: [],
+    cloneFileAsync: async (sourcePath: string, destinationPath: string) => {
+      clones.startedPaths.push(sourcePath);
+      for (const listener of startListeners.splice(0)) {
+        listener();
+      }
+      if (!isReleased) {
+        await getGate(sourcePath).opened;
+      }
+      await fs.promises.copyFile(sourcePath, destinationPath);
+    },
+    release: (...sourcePaths: string[]) => {
+      if (sourcePaths.length === 0) {
+        isReleased = true;
+      }
+      for (const sourcePath of sourcePaths.length ? sourcePaths : Array.from(gates.keys())) {
+        getGate(sourcePath).open();
+      }
+    },
+    whenStartedAsync: async (count: number) => {
+      while (clones.startedPaths.length < count) {
+        await new Promise<void>((resolve) => startListeners.push(resolve));
+      }
+    }
+  };
+  return clones;
+}
+
+function canCloneFilesIn(folderPath: string): boolean {
+  const probeFolderPath: string = fs.mkdtempSync(path.join(folderPath, 'deferred-cache-entry-clone-probe-'));
+  try {
+    fs.writeFileSync(path.join(probeFolderPath, 'source'), 'probe');
+    fs.copyFileSync(
+      path.join(probeFolderPath, 'source'),
+      path.join(probeFolderPath, 'clone'),
+      fs.constants.COPYFILE_FICLONE_FORCE
+    );
+    return true;
+  } catch {
+    return false;
+  } finally {
+    fs.rmSync(probeFolderPath, { recursive: true, force: true });
+  }
+}
+
+interface IControlledWrite {
+  readonly write: IDeferredCacheEntryWrite;
+  readonly finish: (byteCount: number | undefined) => void;
+  /** Resolves when the write starts */
+  readonly whenStarted: Promise<void>;
+  started: boolean;
+  signal: AbortSignal | undefined;
+}
+
+/** A write that runs until `finish` is called, or until it is aborted, as tar is. */
+function createControlledWrite(cacheId: string, sealedOutputs: ISealedOutputs): IControlledWrite {
+  let finish!: (byteCount: number | undefined) => void;
+  const finished: Promise<number | undefined> = new Promise((resolve) => (finish = resolve));
+  let start!: () => void;
+  const controlled: IControlledWrite = {
+    finish,
+    whenStarted: new Promise((resolve) => (start = resolve)),
+    started: false,
+    signal: undefined,
+    write: {
+      cacheId,
+      operationName: `${cacheId} (build)`,
+      sealedOutputs,
+      writeAsync: async (terminal: ITerminal, abortSignal: AbortSignal) => {
+        controlled.started = true;
+        controlled.signal = abortSignal;
+        start();
+        abortSignal.addEventListener('abort', () => finish(undefined), { once: true });
+        return await finished;
+      }
+    }
+  };
+  return controlled;
+}
+
+describe(DeferredCacheEntryWrites.name, () => {
+  let folderPath: string;
+  let commonTempFolder: string;
+  let projectFolder: string;
+  let terminalProvider: StringBufferTerminalProvider;
+  let terminal: Terminal;
+  let logLines: string[];
+
+  function writeOutputFile(relativePath: string, contents: string): void {
+    const filePath: string = path.join(projectFolder, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, contents);
+    fs.utimesSync(filePath, MODIFICATION_TIME, MODIFICATION_TIME);
+  }
+
+  function getOutputPath(relativePath: string): string {
+    return path.join(projectFolder, relativePath);
+  }
+
+  function getProcessFolderPath(pid: number = PID): string {
+    return path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME, `${pid}`);
+  }
+
+  function createSubject(options: IDeferredCacheEntryWritesOptions = {}): DeferredCacheEntryWrites {
+    const subject: DeferredCacheEntryWrites = new DeferredCacheEntryWrites({
+      cloneFileAsync: copyFileAsync,
+      isProcessRunning: () => false,
+      pid: PID,
+      // Unless a test says otherwise, the files are cloned before the seal resolves, however slow the machine is.
+      sealWaitMs: 60 * 1000,
+      ...options
+    });
+    subject.setLog((line: string) => logLines.push(line));
+    return subject;
+  }
+
+  async function sealAsync(
+    subject: DeferredCacheEntryWrites,
+    relativePaths: string[] = OUTPUT_PATHS
+  ): Promise<ISealedOutputs | undefined> {
+    return await subject.trySealAsync({
+      commonTempFolder,
+      sourceFolderPath: projectFolder,
+      relativePaths,
+      terminal
+    });
+  }
+
+  beforeEach(() => {
+    folderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'deferred-cache-entry-writes-'));
+    commonTempFolder = path.join(folderPath, 'common', 'temp');
+    projectFolder = path.join(folderPath, 'project');
+    fs.mkdirSync(commonTempFolder, { recursive: true });
+    writeOutputFile('lib/index.js', 'index contents');
+    writeOutputFile('lib/nested/a.js', 'a');
+    fs.chmodSync(path.join(projectFolder, 'lib/index.js'), 0o755);
+    terminalProvider = new StringBufferTerminalProvider();
+    terminal = new Terminal(terminalProvider);
+    logLines = [];
+  });
+
+  afterEach(() => {
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  });
+
+  describe('trySealAsync', () => {
+    it('copies the output files with their contents, modes and modification times', async () => {
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject());
+
+      expect(sealedOutputs).toEqual({
+        folderPath: path.join(getProcessFolderPath(), '0'),
+        fileCount: 2,
+        byteCount: 'index contents'.length + 'a'.length
+      });
+      for (const relativePath of OUTPUT_PATHS) {
+        const source: fs.Stats = fs.statSync(path.join(projectFolder, relativePath));
+        const sealedPath: string = path.join(sealedOutputs!.folderPath, relativePath);
+        const sealed: fs.Stats = fs.statSync(sealedPath);
+        expect(fs.readFileSync(sealedPath, 'utf8')).toBe(
+          fs.readFileSync(path.join(projectFolder, relativePath), 'utf8')
+        );
+        expect(sealed.mode).toBe(source.mode);
+        expect(sealed.mtimeMs).toBe(MODIFICATION_TIME.getTime());
+      }
+      expect(terminalProvider.getAllOutput(true)).toEqual({});
+    });
+
+    it('keeps the whole second of a modification time in the last half millisecond of a second', async () => {
+      const fractions: [string, number][] = [
+        ['lib/index.js', 0.9996],
+        ['lib/nested/a.js', 0.999999]
+      ];
+      for (const [relativePath, fraction] of fractions) {
+        const seconds: number = MODIFICATION_TIME.getTime() / 1000 + fraction;
+        fs.utimesSync(getOutputPath(relativePath), seconds, seconds);
+        // fs.Stats rounds this time to the next second.
+        expect(fs.statSync(getOutputPath(relativePath)).mtime.getTime()).toBe(
+          MODIFICATION_TIME.getTime() + 1000
+        );
+      }
+
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject());
+
+      for (const [relativePath] of fractions) {
+        const sourceTimeNs: bigint = fs.statSync(getOutputPath(relativePath), { bigint: true }).mtimeNs;
+        const sealedTimeNs: bigint = fs.statSync(path.join(sealedOutputs!.folderPath, relativePath), {
+          bigint: true
+        }).mtimeNs;
+        expect(sealedTimeNs / NANOSECONDS_PER_SECOND).toBe(sourceTimeNs / NANOSECONDS_PER_SECOND);
+        expect(Math.abs(Number(sourceTimeNs - sealedTimeNs))).toBeLessThan(1000 * 1000);
+      }
+    });
+
+    it('keeps the sealed files when the output files change afterward', async () => {
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject());
+
+      fs.writeFileSync(path.join(projectFolder, 'lib/index.js'), 'changed contents');
+      fs.rmSync(path.join(projectFolder, 'lib/nested'), { recursive: true });
+
+      expect(fs.readFileSync(path.join(sealedOutputs!.folderPath, 'lib/index.js'), 'utf8')).toBe(
+        'index contents'
+      );
+      expect(fs.readFileSync(path.join(sealedOutputs!.folderPath, 'lib/nested/a.js'), 'utf8')).toBe('a');
+    });
+
+    it('seals each operation into a folder of its own', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const first: ISealedOutputs | undefined = await sealAsync(subject);
+      const second: ISealedOutputs | undefined = await sealAsync(subject, ['lib/nested/a.js']);
+
+      expect(second!.folderPath).toBe(path.join(getProcessFolderPath(), '1'));
+      expect(fs.readdirSync(getProcessFolderPath()).sort()).toEqual(['0', '1']);
+      expect(fs.existsSync(path.join(first!.folderPath, 'lib/index.js'))).toBe(true);
+      expect(fs.existsSync(path.join(second!.folderPath, 'lib/index.js'))).toBe(false);
+    });
+
+    (canCloneFilesIn(os.tmpdir()) ? it : it.skip)(
+      'clones the output files where the file system can clone files',
+      async () => {
+        const subject: DeferredCacheEntryWrites = new DeferredCacheEntryWrites({ pid: PID });
+        const sealedOutputs: ISealedOutputs | undefined = await sealAsync(subject);
+
+        expect(sealedOutputs?.fileCount).toBe(2);
+        expect(fs.readFileSync(path.join(sealedOutputs!.folderPath, 'lib/index.js'), 'utf8')).toBe(
+          'index contents'
+        );
+        expect(fs.statSync(path.join(sealedOutputs!.folderPath, 'lib/index.js')).mode).toBe(
+          fs.statSync(path.join(projectFolder, 'lib/index.js')).mode
+        );
+      }
+    );
+
+    it('stops sealing once the file system refuses to clone files', async () => {
+      const cloneFileAsync: jest.Mock = jest
+        .fn()
+        .mockRejectedValue(Object.assign(new Error('operation not supported'), { code: 'EOPNOTSUPP' }));
+      const subject: DeferredCacheEntryWrites = createSubject({ cloneFileAsync });
+
+      expect(await sealAsync(subject)).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain(
+        'Unable to clone the output files (EOPNOTSUPP), so the build cache entry is written now.'
+      );
+      const cloneCount: number = cloneFileAsync.mock.calls.length;
+      expect(cloneCount).toBeGreaterThan(0);
+
+      expect(await sealAsync(subject)).toBeUndefined();
+      expect(cloneFileAsync).toHaveBeenCalledTimes(cloneCount);
+      expect(terminalProvider.getVerboseOutput()).toContain(
+        "The output files can't be cloned (EOPNOTSUPP), so the build cache entry is written now."
+      );
+    });
+
+    it('seals again after an error that does not mean that files cannot be cloned', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      expect(await sealAsync(subject, [...OUTPUT_PATHS, 'lib/missing.js'])).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain('Unable to clone the output files (ENOENT)');
+
+      expect(await sealAsync(subject)).toMatchObject({ fileCount: 2 });
+    });
+
+    it('does not seal a path that is not a file', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      expect(await sealAsync(subject, ['lib/nested'])).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain(
+        'Unable to clone the output files ("lib/nested" is not a file)'
+      );
+    });
+
+    it('deletes the staging folders of processes that are not running', async () => {
+      const stagingFolderPath: string = path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME);
+      for (const name of [`${PID}`, '1111', '2222', 'other']) {
+        fs.mkdirSync(path.join(stagingFolderPath, name, '0'), { recursive: true });
+        fs.writeFileSync(path.join(stagingFolderPath, name, '0', 'left-behind.js'), '');
+      }
+      const isProcessRunning: jest.Mock = jest.fn((pid: number) => pid === 2222);
+
+      const sealedOutputs: ISealedOutputs | undefined = await sealAsync(createSubject({ isProcessRunning }));
+
+      expect(fs.readdirSync(stagingFolderPath).sort()).toEqual(['2222', `${PID}`, 'other'].sort());
+      expect(fs.readdirSync(path.join(sealedOutputs!.folderPath))).toEqual(['lib']);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual(['0']);
+      expect(isProcessRunning.mock.calls.map(([pid]) => pid).sort()).toEqual([1111, 2222]);
+    });
+  });
+
+  describe('with clones that take longer than the wait', () => {
+    function writeManyOutputFiles(): void {
+      for (const relativePath of MANY_OUTPUT_PATHS.slice(OUTPUT_PATHS.length)) {
+        writeOutputFile(relativePath, 'many');
+      }
+    }
+
+    /** Seals the files in the background, and queues the write of their entry. */
+    async function sealInBackgroundAsync(
+      subject: DeferredCacheEntryWrites,
+      relativePaths: string[] = OUTPUT_PATHS
+    ): Promise<IControlledWrite> {
+      const sealedOutputs: ISealedOutputs | undefined | 'timed out' = await withTimeoutAsync(
+        sealAsync(subject, relativePaths)
+      );
+      expect(sealedOutputs).toEqual({
+        folderPath: path.join(getProcessFolderPath(), '0'),
+        fileCount: relativePaths.length,
+        byteCount: expect.any(Number),
+        isSealing: true
+      });
+      const write: IControlledWrite = createControlledWrite('a', sealedOutputs as ISealedOutputs);
+      subject.enqueue(write.write);
+      return write;
+    }
+
+    it('waits for clones that finish within the wait, as without it', async () => {
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({ cloneFileAsync: clones.cloneFileAsync });
+
+      const sealing: Promise<ISealedOutputs | undefined> = sealAsync(subject);
+      await clones.whenStartedAsync(OUTPUT_PATHS.length);
+      clones.release();
+      const sealedOutputs: ISealedOutputs | undefined = await sealing;
+
+      expect(sealedOutputs).toEqual({
+        folderPath: path.join(getProcessFolderPath(), '0'),
+        fileCount: 2,
+        byteCount: 'index contents'.length + 'a'.length
+      });
+      const write: IControlledWrite = createControlledWrite('a', sealedOutputs!);
+      subject.enqueue(write.write);
+      expect(write.started).toBe(true);
+      write.finish(1);
+      await subject.waitForIdleAsync();
+      expect(logLines).toEqual([expect.stringMatching(/^Wrote the build cache entry a /)]);
+    });
+
+    it('resolves first, and writes the entry once the files are cloned', async () => {
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+
+      const write: IControlledWrite = await sealInBackgroundAsync(subject);
+
+      expect(write.write.sealedOutputs.byteCount).toBe('index contents'.length + 'a'.length);
+      expect(write.started).toBe(false);
+      expect(subject.takeReport()).toMatchObject({ queuedCount: 1, pendingCount: 1 });
+      expect(subject.hasPendingWrite('a')).toBe(true);
+      clones.release();
+      await write.whenStarted;
+      expect(fs.readFileSync(path.join(getProcessFolderPath(), '0', 'lib/index.js'), 'utf8')).toBe(
+        'index contents'
+      );
+      write.finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0, pendingCount: 0 });
+      expect(subject.hasPendingWrite('a')).toBe(false);
+      expect(logLines.map((line: string) => line.replace(/ in \d+ ms\.$/, ' in N ms.'))).toEqual([
+        'Sealed the output files of a (build) in the background in N ms.',
+        'Wrote the build cache entry a (0.0 MB) for a (build) in N ms.'
+      ]);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('drops the entry if an output file changes before it is cloned, even if only its change time does', async () => {
+      writeManyOutputFiles();
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject, MANY_OUTPUT_PATHS);
+
+      // The last file is cloned once the first clones are released. It keeps its size and modification time.
+      await delayAsync(CLOCK_TICK_MS);
+      writeOutputFile('lib/many/17.js', 'MANY');
+      clones.release();
+      await withTimeoutAsync(subject.waitForIdleAsync());
+
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual([
+        'Dropped the build cache entry a for a (build), because lib/many/17.js changed before it was sealed.'
+      ]);
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 1,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 1,
+        pendingCount: 0
+      });
+      expect(subject.hasPendingWrite('a')).toBe(false);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('drops the entry if an output file is deleted before it is cloned', async () => {
+      writeManyOutputFiles();
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject, MANY_OUTPUT_PATHS);
+
+      fs.rmSync(getOutputPath('lib/many/17.js'));
+      clones.release();
+      await withTimeoutAsync(subject.waitForIdleAsync());
+
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual([
+        'Dropped the build cache entry a for a (build), because lib/many/17.js changed before it was sealed.'
+      ]);
+      expect(subject.takeReport()).toMatchObject({ failedCount: 0, droppedCount: 1, pendingCount: 0 });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('writes the entry if an output file changes after it is cloned', async () => {
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject);
+
+      clones.release(getOutputPath('lib/index.js'));
+      // The modification time of a clone is set after the clone is checked.
+      const sealedPath: string = path.join(getProcessFolderPath(), '0', 'lib/index.js');
+      while (!fs.existsSync(sealedPath) || fs.statSync(sealedPath).mtimeMs !== MODIFICATION_TIME.getTime()) {
+        await delayAsync(1);
+      }
+      await delayAsync(CLOCK_TICK_MS);
+      writeOutputFile('lib/index.js', 'INDEX CONTENTS');
+      clones.release();
+      await write.whenStarted;
+
+      expect(fs.readFileSync(sealedPath, 'utf8')).toBe('index contents');
+      write.finish(1);
+      await subject.waitForIdleAsync();
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, droppedCount: 0, pendingCount: 0 });
+    });
+
+    /** Seals the files in the background with a first clone that fails with the given code. */
+    async function failCloneAsync(code: string): Promise<[DeferredCacheEntryWrites, IGatedClones]> {
+      const clones: IGatedClones = createGatedClones();
+      let hasFailed: boolean = false;
+      const cloneFileAsync = async (sourcePath: string, destinationPath: string): Promise<void> => {
+        await clones.cloneFileAsync(sourcePath, destinationPath);
+        if (!hasFailed && sourcePath === getOutputPath('lib/index.js')) {
+          hasFailed = true;
+          throw Object.assign(new Error('The clone failed.'), { code });
+        }
+      };
+      const subject: DeferredCacheEntryWrites = createSubject({ cloneFileAsync, sealWaitMs: 0 });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject);
+
+      clones.release();
+      await withTimeoutAsync(subject.waitForIdleAsync());
+
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual([
+        `Failed to write the build cache entry a for a (build): Unable to clone the output files (${code}).`
+      ]);
+      expect(subject.takeReport()).toMatchObject({ failedCount: 1, droppedCount: 0, pendingCount: 0 });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      return [subject, clones];
+    }
+
+    it('reports a clone that fails as a failed write, and seals the next outputs', async () => {
+      const [subject]: [DeferredCacheEntryWrites, IGatedClones] = await failCloneAsync('EIO');
+
+      expect(await withTimeoutAsync(sealAsync(subject))).toMatchObject({ fileCount: 2 });
+      await subject.abortAsync();
+    });
+
+    it('stops sealing once a clone in the background is refused', async () => {
+      const [subject, clones]: [DeferredCacheEntryWrites, IGatedClones] = await failCloneAsync('EOPNOTSUPP');
+
+      expect(await sealAsync(subject)).toBeUndefined();
+      expect(clones.startedPaths).toHaveLength(2);
+      expect(terminalProvider.getVerboseOutput()).toContain(
+        "The output files can't be cloned (EOPNOTSUPP), so the build cache entry is written now."
+      );
+    });
+
+    it('is stopped by abortAsync, which waits for the clones that are running', async () => {
+      writeManyOutputFiles();
+      const clones: IGatedClones = createGatedClones();
+      const subject: DeferredCacheEntryWrites = createSubject({
+        cloneFileAsync: clones.cloneFileAsync,
+        sealWaitMs: 0
+      });
+      const write: IControlledWrite = await sealInBackgroundAsync(subject, MANY_OUTPUT_PATHS);
+      await clones.whenStartedAsync(16);
+
+      let isAborted: boolean = false;
+      const aborting: Promise<void> = subject.abortAsync().then(() => {
+        isAborted = true;
+      });
+      await delayAsync(CLOCK_TICK_MS);
+      expect(isAborted).toBe(false);
+      clones.release();
+      await aborting;
+
+      // No more files are cloned once the seal is stopped.
+      expect(clones.startedPaths).toHaveLength(16);
+      expect(write.started).toBe(false);
+      expect(logLines).toEqual(['Dropped the build cache entry a for a (build), which was not written yet.']);
+      expect(subject.takeReport()).toMatchObject({ failedCount: 0, droppedCount: 1, pendingCount: 0 });
+      expect(subject.hasPendingWrite('a')).toBe(false);
+      expect(fs.existsSync(getProcessFolderPath())).toBe(false);
+    });
+  });
+
+  describe('enqueue', () => {
+    it('writes two entries at a time, deletes their sealed files and reports them', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const writes: IControlledWrite[] = [];
+      for (const cacheId of ['a', 'b', 'c']) {
+        writes.push(createControlledWrite(cacheId, (await sealAsync(subject))!));
+      }
+
+      for (const { write } of writes) {
+        subject.enqueue(write);
+      }
+      expect(writes.map(({ started }) => started)).toEqual([true, true, false]);
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 3,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 3
+      });
+
+      writes[0].finish(1024 * 1024);
+      await writes[2].whenStarted;
+      expect(logLines).toHaveLength(1);
+      writes[1].finish(512 * 1024);
+      writes[2].finish(0);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 0,
+        writtenCount: 3,
+        writtenByteCount: 1.5 * 1024 * 1024,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 0
+      });
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 0,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 0
+      });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      // b and c finish together, in either order.
+      expect(logLines.map((line) => line.replace(/ in \d+ ms\.$/, ' in N ms.')).sort()).toEqual([
+        'Wrote the build cache entry a (1.0 MB) for a (build) in N ms.',
+        'Wrote the build cache entry b (0.5 MB) for b (build) in N ms.',
+        'Wrote the build cache entry c (0.0 MB) for c (build) in N ms.'
+      ]);
+    });
+
+    it('reports a write that fails, with its warnings and errors', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const sealedOutputs: ISealedOutputs[] = [(await sealAsync(subject))!, (await sealAsync(subject))!];
+
+      subject.enqueue({
+        cacheId: 'a',
+        operationName: 'a (build)',
+        sealedOutputs: sealedOutputs[0],
+        writeAsync: async (writeTerminal: ITerminal) => {
+          writeTerminal.writeLine('Not a problem.');
+          writeTerminal.writeWarningLine('"tar" exited with code 2.');
+          return undefined;
+        }
+      });
+      subject.enqueue({
+        cacheId: 'b',
+        operationName: 'b (build)',
+        sealedOutputs: sealedOutputs[1],
+        writeAsync: async () => {
+          throw new Error('The disk is full.');
+        }
+      });
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 0, failedCount: 2, pendingCount: 0 });
+      // They fail together, in either order.
+      expect(logLines.sort()).toEqual([
+        'Failed to write the build cache entry a for a (build): "tar" exited with code 2.',
+        'Failed to write the build cache entry b for b (build): The disk is full.'
+      ]);
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('has a pending write for a cache ID until each write of it is written or fails', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const writes: IControlledWrite[] = [];
+      for (const cacheId of ['a', 'b', 'c', 'a']) {
+        writes.push(createControlledWrite(cacheId, (await sealAsync(subject))!));
+      }
+      const getPendingCacheIds = (): string[] =>
+        ['a', 'b', 'c', 'd'].filter((cacheId: string) => subject.hasPendingWrite(cacheId));
+
+      expect(getPendingCacheIds()).toEqual([]);
+      for (const { write } of writes) {
+        subject.enqueue(write);
+      }
+      // The first write of a and the write of b are running. The others are queued.
+      expect(writes.map(({ started }) => started)).toEqual([true, true, false, false]);
+      expect(getPendingCacheIds()).toEqual(['a', 'b', 'c']);
+      writes[0].finish(1);
+      await writes[2].whenStarted;
+      expect(getPendingCacheIds()).toEqual(['a', 'b', 'c']);
+      writes[1].finish(undefined);
+      await writes[3].whenStarted;
+      expect(getPendingCacheIds()).toEqual(['a', 'c']);
+      writes[2].finish(1);
+      writes[3].finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 3, failedCount: 1, pendingCount: 0 });
+      expect(getPendingCacheIds()).toEqual([]);
+    });
+
+    it('keeps writing when its log throws', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      subject.setLog(() => {
+        throw new Error('The log is closed.');
+      });
+      const write: IControlledWrite = createControlledWrite('a', (await sealAsync(subject))!);
+
+      subject.enqueue(write.write);
+      write.finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0 });
+    });
+  });
+
+  describe('abortAsync', () => {
+    it('drops the writes that are not finished and deletes the staging folder of the process', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      const writes: IControlledWrite[] = [];
+      for (const cacheId of ['a', 'b', 'c']) {
+        writes.push(createControlledWrite(cacheId, (await sealAsync(subject))!));
+      }
+      for (const { write } of writes) {
+        subject.enqueue(write);
+      }
+
+      await subject.abortAsync();
+
+      expect(writes.map(({ started }) => started)).toEqual([true, true, false]);
+      expect(writes.map(({ signal }) => signal?.aborted)).toEqual([true, true, undefined]);
+      expect(subject.takeReport()).toEqual({
+        queuedCount: 3,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 3,
+        pendingCount: 0
+      });
+      expect(['a', 'b', 'c'].filter((cacheId: string) => subject.hasPendingWrite(cacheId))).toEqual([]);
+      expect(fs.existsSync(getProcessFolderPath())).toBe(false);
+      expect(logLines.sort()).toEqual([
+        'Dropped the build cache entry a for a (build), which was being written.',
+        'Dropped the build cache entry b for b (build), which was being written.',
+        'Dropped the build cache entry c for c (build), which was not written yet.'
+      ]);
+    });
+
+    it('writes entries that are queued afterward', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+      subject.enqueue(createControlledWrite('a', (await sealAsync(subject))!).write);
+      await subject.abortAsync();
+      logLines.length = 0;
+
+      const write: IControlledWrite = createControlledWrite('b', (await sealAsync(subject))!);
+      subject.enqueue(write.write);
+      expect(write.signal?.aborted).toBe(false);
+      write.finish(1);
+      await subject.waitForIdleAsync();
+
+      expect(subject.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0, pendingCount: 0 });
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    });
+
+    it('does nothing if nothing was sealed', async () => {
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      await subject.abortAsync();
+
+      expect(fs.existsSync(path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME))).toBe(
+        false
+      );
+      expect(logLines).toEqual([]);
+    });
+  });
+});
+
+describe('getSecondsForUtimes', () => {
+  it('keeps the whole second of a time in nanoseconds', () => {
+    const seconds: number = 1790713413;
+    for (const nanoseconds of [0, 1000, 499999999, 999499999, 999500000, 999999000, 999999900, 999999999]) {
+      const timeNs: bigint = BigInt(seconds) * NANOSECONDS_PER_SECOND + BigInt(nanoseconds);
+      const result: number = getSecondsForUtimes(timeNs);
+      expect(Math.floor(result)).toBe(seconds);
+      // Microseconds are kept.
+      expect(Math.abs(result - seconds - Math.floor(nanoseconds / 1000) / 1e6)).toBeLessThan(1e-6);
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts
new file mode 100644
index 0000000000..0b927970f6
--- /dev/null
+++ b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheDeferredWrites.test.ts
@@ -0,0 +1,298 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { BuildCacheConfiguration } from '../../../api/BuildCacheConfiguration';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { TarExecutable } from '../../../utilities/TarExecutable';
+import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import {
+  DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME,
+  DeferredCacheEntryWrites,
+  type IDeferredCacheEntryWritesReport
+} from '../DeferredCacheEntryWrites';
+import type { FileSystemBuildCacheProvider } from '../FileSystemBuildCacheProvider';
+import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
+
+const PID: number = 4242;
+const CACHE_ID: string = 'acme-wizard-1926f30e8ed24cb47be89aea39e7efd70fcda075';
+
+/** Copies a file. A file with no data blocks, such as a sparse one, is copied as a sparse file. */
+async function copyFileAsync(sourcePath: string, destinationPath: string): Promise<void> {
+  const { blocks, size } = await fs.promises.stat(sourcePath);
+  if (blocks === 0 && size > 0) {
+    await fs.promises.writeFile(destinationPath, '');
+    await fs.promises.truncate(destinationPath, size);
+  } else {
+    await fs.promises.copyFile(sourcePath, destinationPath);
+  }
+}
+
+function readFolder(folderPath: string): Record<string, string> {
+  const files: Record<string, string> = {};
+  for (const relativePath of fs.readdirSync(folderPath, { recursive: true }) as string[]) {
+    const filePath: string = path.join(folderPath, relativePath);
+    if (fs.statSync(filePath).isFile()) {
+      files[relativePath.split(path.sep).join('/')] = fs.readFileSync(filePath, 'utf8');
+    }
+  }
+  return files;
+}
+
+describe('OperationBuildCache with deferred cache entry writes', () => {
+  let tar: TarExecutable;
+  let folderPath: string;
+  let projectFolder: string;
+  let commonTempFolder: string;
+  let cacheFolder: string;
+  let terminalProvider: StringBufferTerminalProvider;
+  let terminal: Terminal;
+  let logLines: string[];
+
+  beforeAll(async () => {
+    const found: TarExecutable | undefined = await TarExecutable.tryInitializeAsync(
+      new Terminal(new StringBufferTerminalProvider())
+    );
+    if (!found) {
+      throw new Error('"tar" was not found on the PATH');
+    }
+    tar = found;
+  });
+
+  beforeEach(() => {
+    folderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-deferred-cache-entry-'));
+    projectFolder = path.join(folderPath, 'apps', 'acme-wizard');
+    commonTempFolder = path.join(folderPath, 'common', 'temp');
+    cacheFolder = path.join(commonTempFolder, 'build-cache');
+    fs.mkdirSync(path.join(projectFolder, 'dist', 'nested'), { recursive: true });
+    fs.mkdirSync(path.join(commonTempFolder, 'project'), { recursive: true });
+    fs.mkdirSync(cacheFolder);
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'index.js'), 'index 1');
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'nested', 'a.js'), 'a 1');
+    terminalProvider = new StringBufferTerminalProvider();
+    terminal = new Terminal(terminalProvider);
+    logLines = [];
+    _setTarUtilityPromiseForTesting(Promise.resolve(tar));
+  });
+
+  afterEach(() => {
+    _setTarUtilityPromiseForTesting(undefined);
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  });
+
+  function createSubject(): OperationBuildCache {
+    return OperationBuildCache.getOperationBuildCache({
+      buildCacheConfiguration: {
+        buildCacheEnabled: true,
+        cacheWriteEnabled: true,
+        getCacheEntryId: (options: IGenerateCacheEntryIdOptions) =>
+          `${options.projectName}-${options.projectStateHash}`,
+        localCacheProvider: {
+          getCacheEntryPath: (cacheId: string) => path.join(cacheFolder, cacheId)
+        } as unknown as FileSystemBuildCacheProvider,
+        cloudCacheProvider: undefined
+      } as unknown as BuildCacheConfiguration,
+      projectOutputFolderNames: ['dist'],
+      project: {
+        packageName: 'acme-wizard',
+        projectRelativeFolder: 'apps/acme-wizard',
+        projectFolder,
+        projectRushTempFolder: path.join(commonTempFolder, 'project'),
+        rushConfiguration: { commonTempFolder },
+        dependencyProjects: []
+      } as unknown as RushConfigurationProject,
+      operationStateHash: '1926f30e8ed24cb47be89aea39e7efd70fcda075',
+      terminal,
+      phaseName: 'build',
+      excludeAppleDoubleFiles: false,
+      useDirectFileTransfersForBuildCache: false
+    });
+  }
+
+  function createWrites(
+    cloneFileAsync: typeof copyFileAsync = copyFileAsync,
+    // Unless a test says otherwise, the files are cloned before the seal resolves, however slow the machine is.
+    sealWaitMs: number = 60 * 1000
+  ): DeferredCacheEntryWrites {
+    const writes: DeferredCacheEntryWrites = new DeferredCacheEntryWrites({
+      cloneFileAsync,
+      pid: PID,
+      sealWaitMs
+    });
+    // A write that outlives its test can't log into the next test's lines.
+    const lines: string[] = logLines;
+    writes.setLog((line: string) => lines.push(line));
+    return writes;
+  }
+
+  async function restoreEntryAsync(): Promise<Record<string, string>> {
+    const outputFolderPath: string = path.join(folderPath, 'restored');
+    fs.mkdirSync(outputFolderPath);
+    const exitCode: number = await tar.tryUntarAsync({
+      archivePath: path.join(cacheFolder, CACHE_ID),
+      outputFolderPath,
+      logFilePath: path.join(folderPath, 'untar.log')
+    });
+    expect(exitCode).toBe(0);
+    return readFolder(outputFolderPath);
+  }
+
+  function getProcessFolderPath(): string {
+    return path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME, `${PID}`);
+  }
+
+  it('writes the entry after it resolves, from the output files as they were then', async () => {
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+
+    // The entry is written by tar, which can't have ended before this resolved.
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    expect(terminalProvider.getOutput({ normalizeSpecialCharacters: false })).toMatch(
+      /^Sealed 2 output files \(0\.0 MB\) in \d+ ms; writing the build cache entry in the background\.\n$/
+    );
+    fs.writeFileSync(path.join(projectFolder, 'dist', 'index.js'), 'index 2');
+    fs.rmSync(path.join(projectFolder, 'dist', 'nested', 'a.js'));
+    await writes.waitForIdleAsync();
+
+    expect(fs.readdirSync(cacheFolder)).toEqual([CACHE_ID]);
+    expect(await restoreEntryAsync()).toEqual({ 'dist/index.js': 'index 1', 'dist/nested/a.js': 'a 1' });
+    expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 1, writtenCount: 1, failedCount: 0 });
+    expect(logLines).toEqual([
+      expect.stringMatching(
+        new RegExp(
+          `^Wrote the build cache entry ${CACHE_ID} \\(0\\.0 MB\\) for acme-wizard \\(build\\) in \\d+ ms\\.$`
+        )
+      )
+    ]);
+  });
+
+  it('writes the entry once the output files are sealed, if that takes longer than the wait', async () => {
+    let release!: () => void;
+    const released: Promise<void> = new Promise((resolve) => (release = resolve));
+    const cloneFileAsync = async (sourcePath: string, destinationPath: string): Promise<void> => {
+      await released;
+      await copyFileAsync(sourcePath, destinationPath);
+    };
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync, 0);
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+
+    expect(terminalProvider.getOutput({ normalizeSpecialCharacters: false })).toMatch(
+      new RegExp(
+        '^Sealing 2 output files \\(0\\.0 MB\\) in the background after \\d+ ms; ' +
+          "the build cache entry is written once they're sealed\\.\\n$"
+      )
+    );
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 1, pendingCount: 1 });
+    release();
+    await writes.waitForIdleAsync();
+
+    expect(await restoreEntryAsync()).toEqual({ 'dist/index.js': 'index 1', 'dist/nested/a.js': 'a 1' });
+    expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    expect(logLines).toEqual([
+      expect.stringMatching(
+        /^Sealed the output files of acme-wizard \(build\) in the background in \d+ ms\.$/
+      ),
+      expect.stringMatching(
+        new RegExp(
+          `^Wrote the build cache entry ${CACHE_ID} \\(0\\.0 MB\\) for acme-wizard \\(build\\) in \\d+ ms\\.$`
+        )
+      )
+    ]);
+  });
+
+  it('writes the entry before it resolves if the output files cannot be cloned', async () => {
+    const cloneFileAsync: jest.Mock = jest.fn(async () => {
+      throw Object.assign(new Error('The file system cannot clone files.'), { code: 'EOPNOTSUPP' });
+    });
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync);
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+
+    expect(fs.readdirSync(cacheFolder)).toEqual([CACHE_ID]);
+    expect(await restoreEntryAsync()).toEqual({ 'dist/index.js': 'index 1', 'dist/nested/a.js': 'a 1' });
+    expect(terminalProvider.getOutput({ normalizeSpecialCharacters: false })).toBe(
+      'Unable to clone the output files (EOPNOTSUPP), so the build cache entry is written now.\n' +
+        'Successfully set cache entry.\n'
+    );
+    expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+    const cloneCount: number = cloneFileAsync.mock.calls.length;
+
+    // The next operation doesn't try to clone its output files.
+    fs.rmSync(path.join(cacheFolder, CACHE_ID));
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+    expect(fs.readdirSync(cacheFolder)).toEqual([CACHE_ID]);
+    expect(cloneFileAsync).toHaveBeenCalledTimes(cloneCount);
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, pendingCount: 0 });
+  });
+
+  it('seals nothing if an output is a symbolic link', async () => {
+    fs.symlinkSync('index.js', path.join(projectFolder, 'dist', 'link.js'));
+    const cloneFileAsync: jest.Mock = jest.fn(copyFileAsync);
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync);
+
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(false);
+
+    expect(cloneFileAsync).not.toHaveBeenCalled();
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, pendingCount: 0 });
+  });
+
+  it('seals nothing if tar is not found', async () => {
+    _setTarUtilityPromiseForTesting(Promise.resolve(undefined));
+    const cloneFileAsync: jest.Mock = jest.fn(copyFileAsync);
+    const writes: DeferredCacheEntryWrites = createWrites(cloneFileAsync);
+
+    // The operation reports the failure, instead of the daemon's log reporting it later.
+    const result: boolean = await createSubject().trySetCacheEntryAsync(terminal, undefined, writes);
+    await writes.waitForIdleAsync();
+
+    expect(result).toBe(false);
+    expect(cloneFileAsync).not.toHaveBeenCalled();
+    expect(terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false })).toContain(
+      'Unable to locate "tar".'
+    );
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, pendingCount: 0 });
+    expect(logLines).toEqual([]);
+  });
+
+  it('kills tar, and deletes its partial archive and the sealed files, when aborted', async () => {
+    // A sparse file takes no space, but tar reads 2 GB of zeros from it and gzip compresses them, which takes
+    // seconds.
+    const fd: number = fs.openSync(path.join(projectFolder, 'dist', 'large.bin'), 'w');
+    try {
+      fs.ftruncateSync(fd, 2 * 1024 * 1024 * 1024);
+    } finally {
+      fs.closeSync(fd);
+    }
+    const writes: DeferredCacheEntryWrites = createWrites();
+    expect(await createSubject().trySetCacheEntryAsync(terminal, undefined, writes)).toBe(true);
+    const deadline: number = Date.now() + 10000;
+    while (fs.readdirSync(cacheFolder).length === 0 && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    // The partial archive
+    expect(fs.readdirSync(cacheFolder)).toEqual([expect.stringMatching(/\.temp$/)]);
+
+    const abortedAtMs: number = performance.now();
+    await writes.abortAsync();
+
+    // Unless it was killed, tar would have run for seconds.
+    expect(performance.now() - abortedAtMs).toBeLessThan(1000);
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    expect(fs.existsSync(getProcessFolderPath())).toBe(false);
+    const report: IDeferredCacheEntryWritesReport = writes.takeReport();
+    expect(report).toMatchObject({ writtenCount: 0, failedCount: 0, pendingCount: 0 });
+    expect(logLines).toEqual([
+      `Dropped the build cache entry ${CACHE_ID} for acme-wizard (build), which was being written.`
+    ]);
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
index 90293eb273..979e5df9e4 100644
--- a/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
+++ b/libraries/rush-lib/src/logic/buildCache/test/OperationBuildCacheReceipt.test.ts
@@ -12,6 +12,7 @@ import type { RushConfigurationProject } from '../../../api/RushConfigurationPro
 import type { ICreateArchiveOptions, IUntarOptions, TarExecutable } from '../../../utilities/TarExecutable';
 import type { IBaseOperationExecutionResult } from '../../operations/IOperationExecutionResult';
 import type { IGenerateCacheEntryIdOptions } from '../CacheEntryId';
+import { DeferredCacheEntryWrites } from '../DeferredCacheEntryWrites';
 import { OperationBuildCache, _setTarUtilityPromiseForTesting } from '../OperationBuildCache';
 
 const HIT_LINE: string = 'Build cache hit.';
@@ -32,6 +33,7 @@ const ENTRY: FakeArchive = {
 interface ISubjectOptions {
   stateHash?: string;
   outputFolderNames?: string[];
+  excludeAppleDoubleFiles?: boolean;
 }
 
 interface IRestoreResult {
@@ -45,6 +47,8 @@ describe('OperationBuildCache receipts', () => {
   let cacheFolder: string;
   let untarHook: ((outputFolderPath: string) => void) | undefined;
   let tarHook: ((projectFolderPath: string) => void) | undefined;
+  // If defined, the fake tar waits for it, or for its abort signal, before it reads the files.
+  let tarGate: Promise<void> | undefined;
   let untarMock: jest.Mock<Promise<number>, [IUntarOptions]>;
   let createArchiveMock: jest.Mock<Promise<number>, [ICreateArchiveOptions]>;
 
@@ -56,6 +60,7 @@ describe('OperationBuildCache receipts', () => {
     fs.mkdirSync(cacheFolder);
     untarHook = undefined;
     tarHook = undefined;
+    tarGate = undefined;
 
     untarMock = jest.fn(async ({ archivePath, outputFolderPath }: IUntarOptions) => {
       const archive: FakeArchive = JSON.parse(fs.readFileSync(archivePath, 'utf8'));
@@ -63,15 +68,25 @@ describe('OperationBuildCache receipts', () => {
       untarHook?.(outputFolderPath);
       return 0;
     });
-    createArchiveMock = jest.fn(async ({ archivePath, paths, project }: ICreateArchiveOptions) => {
-      const archive: FakeArchive = {};
-      for (const relativePath of paths) {
-        archive[relativePath] = fs.readFileSync(path.join(project.projectFolder, relativePath), 'utf8');
+    createArchiveMock = jest.fn(
+      async ({ archivePath, paths, project, baseFolderPath, abortSignal }: ICreateArchiveOptions) => {
+        await waitForGateAsync(abortSignal);
+        if (abortSignal?.aborted) {
+          // As a killed tar would
+          return 1;
+        }
+        const archive: FakeArchive = {};
+        for (const relativePath of paths) {
+          archive[relativePath] = fs.readFileSync(
+            path.join(baseFolderPath ?? project.projectFolder, relativePath),
+            'utf8'
+          );
+        }
+        tarHook?.(project.projectFolder);
+        fs.writeFileSync(archivePath, JSON.stringify(archive));
+        return 0;
       }
-      tarHook?.(project.projectFolder);
-      fs.writeFileSync(archivePath, JSON.stringify(archive));
-      return 0;
-    });
+    );
     _setTarUtilityPromiseForTesting(
       Promise.resolve({
         tryUntarAsync: untarMock,
@@ -93,11 +108,22 @@ describe('OperationBuildCache receipts', () => {
     }
   }
 
+  async function waitForGateAsync(abortSignal: AbortSignal | undefined): Promise<void> {
+    const gate: Promise<void> | undefined = tarGate;
+    if (gate) {
+      await new Promise<void>((resolve) => {
+        void gate.then(resolve);
+        abortSignal?.addEventListener('abort', () => resolve(), { once: true });
+      });
+    }
+  }
+
   function getProject(): RushConfigurationProject {
     return {
       packageName: 'acme',
       projectFolder,
-      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp')
+      projectRushTempFolder: path.join(projectFolder, '.rush', 'temp'),
+      rushConfiguration: { commonTempFolder: path.join(rootFolder, 'common-temp') }
     } as unknown as RushConfigurationProject;
   }
 
@@ -119,7 +145,7 @@ describe('OperationBuildCache receipts', () => {
   }
 
   function createSubject(options: ISubjectOptions = {}): OperationBuildCache {
-    const { stateHash = 'hash1', outputFolderNames = ['lib'] } = options;
+    const { stateHash = 'hash1', outputFolderNames = ['lib'], excludeAppleDoubleFiles = false } = options;
     const project: RushConfigurationProject = getProject();
     const executionResult: IBaseOperationExecutionResult = {
       operation: {
@@ -134,7 +160,7 @@ describe('OperationBuildCache receipts', () => {
     return OperationBuildCache.forOperation(executionResult, {
       buildCacheConfiguration: getBuildCacheConfiguration(),
       terminal: new Terminal(new StringBufferTerminalProvider()),
-      excludeAppleDoubleFiles: false,
+      excludeAppleDoubleFiles,
       useDirectFileTransfersForBuildCache: false
     });
   }
@@ -155,8 +181,27 @@ describe('OperationBuildCache receipts', () => {
     return { result, output: terminalProvider.getOutput() };
   }
 
-  async function setCacheEntryAsync(subject: OperationBuildCache): Promise<boolean> {
-    return await subject.trySetCacheEntryAsync(new Terminal(new StringBufferTerminalProvider()));
+  async function setCacheEntryAsync(
+    subject: OperationBuildCache,
+    deferredCacheEntryWrites?: DeferredCacheEntryWrites
+  ): Promise<boolean> {
+    return await subject.trySetCacheEntryAsync(
+      new Terminal(new StringBufferTerminalProvider()),
+      undefined,
+      deferredCacheEntryWrites
+    );
+  }
+
+  // Copies the files instead of cloning them, which works on any file system.
+  function createWrites(
+    cloneFileAsync: (sourcePath: string, destinationPath: string) => Promise<void> = fs.promises.copyFile
+  ): DeferredCacheEntryWrites {
+    // The files are cloned before the seal resolves, however slow the machine is.
+    return new DeferredCacheEntryWrites({ cloneFileAsync, sealWaitMs: 60 * 1000 });
+  }
+
+  function hasEntry(): boolean {
+    return fs.existsSync(path.join(cacheFolder, CACHE_ID));
   }
 
   // The identity, modification time and status change time of every file in the entry.
@@ -180,6 +225,46 @@ describe('OperationBuildCache receipts', () => {
       : [];
   }
 
+  function readEntry(): FakeArchive {
+    return JSON.parse(fs.readFileSync(path.join(cacheFolder, CACHE_ID), 'utf8'));
+  }
+
+  // Waits for the writes in the background to make the condition true.
+  async function waitForAsync(condition: () => boolean): Promise<void> {
+    while (!condition()) {
+      await new Promise<void>((resolve) => setTimeout(resolve, 1));
+    }
+  }
+
+  /**
+   * Writes the entry of the outputs in the background, with a write that waits at the tar gate. Then rebuilds the
+   * outputs with other content and writes the entry again, while that write is pending.
+   */
+  async function rebuildWhileWritePendingAsync(
+    writes: DeferredCacheEntryWrites
+  ): Promise<{ subject: OperationBuildCache; openGate: () => void }> {
+    let openGate: () => void = () => undefined;
+    tarGate = new Promise<void>((resolve: () => void) => {
+      openGate = resolve;
+    });
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(true);
+    const receipt: string = fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8');
+    await waitForAsync(() => createArchiveMock.mock.calls.length === 1);
+    // Only the first write waits at the gate.
+    tarGate = undefined;
+    writeFiles(projectFolder, { 'lib/out.txt': 'rebuilt' });
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+
+    // The receipt of the first write is left, and it doesn't match the rebuilt outputs.
+    expect(fs.readFileSync(path.join(projectFolder, RECEIPT), 'utf8')).toBe(receipt);
+    expect(getReceiptTempFiles()).toEqual([]);
+    return { subject, openGate };
+  }
+
   // Restores the entry, so that the project has a receipt for it.
   async function restoreWithReceiptAsync(subject: OperationBuildCache): Promise<void> {
     expect((await restoreAsync(subject)).result).toBe(true);
@@ -486,4 +571,164 @@ describe('OperationBuildCache receipts', () => {
     expect(hasReceipt()).toBe(false);
     expect(getReceiptTempFiles()).toEqual([]);
   });
+
+  it('T19: writes a receipt when it seals the outputs for a deferred write, and then skips its restore', async () => {
+    let openGate: () => void = () => undefined;
+    tarGate = new Promise<void>((resolve: () => void) => {
+      openGate = resolve;
+    });
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(true);
+    expect(hasEntry()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    openGate();
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ writtenCount: 1, failedCount: 0 });
+    const before: Record<string, bigint[]> = statOutputs();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).not.toHaveBeenCalled();
+    expect(output).toContain(SKIP_LINE);
+    expect(statOutputs()).toEqual(before);
+  });
+
+  it('T20: does not skip a restore if a deferred write is dropped', async () => {
+    tarGate = new Promise<void>(() => undefined);
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(true);
+    await writes.abortAsync();
+    expect(fs.readdirSync(cacheFolder)).toEqual([]);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(false);
+    expect(untarMock).not.toHaveBeenCalled();
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T21: writes the entry at once, and no receipt, if an output changes while it is sealed for a deferred write', async () => {
+    const changedFilePath: string = path.join(projectFolder, 'lib/out.txt');
+    const changedContent: string = `${ENTRY['lib/out.txt']}!`;
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites(
+      async (sourcePath: string, destinationPath: string) => {
+        await fs.promises.copyFile(sourcePath, destinationPath);
+        if (sourcePath === changedFilePath) {
+          await fs.promises.appendFile(sourcePath, '!');
+        }
+      }
+    );
+
+    // The file changed before its clone was checked, so the seal fails, and the entry is written from the files.
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    const entry: FakeArchive = JSON.parse(fs.readFileSync(path.join(cacheFolder, CACHE_ID), 'utf8'));
+    expect(entry['lib/out.txt']).toBe(changedContent);
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 0, droppedCount: 0, failedCount: 0 });
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(changedFilePath, 'utf8')).toBe(changedContent);
+  });
+
+  it('T22: writes no receipt for a deferred write if the entry leaves out a file of an output folder', async () => {
+    // On macOS, the entry leaves out an AppleDouble file that has a companion file.
+    const originalPlatform: NodeJS.Platform = process.platform;
+    Object.defineProperty(process, 'platform', { value: 'darwin' });
+    let subject: OperationBuildCache;
+    try {
+      subject = createSubject({ excludeAppleDoubleFiles: true });
+    } finally {
+      Object.defineProperty(process, 'platform', { value: originalPlatform });
+    }
+    writeFiles(projectFolder, { ...ENTRY, 'lib/._out.txt': 'attributes' });
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    await writes.waitForIdleAsync();
+    const entry: FakeArchive = JSON.parse(fs.readFileSync(path.join(cacheFolder, CACHE_ID), 'utf8'));
+    expect(Object.keys(entry).sort()).toEqual(Object.keys(ENTRY).sort());
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+  });
+
+  it('T23: writes no receipt for a deferred write if the local cache already has an entry', async () => {
+    tarGate = new Promise<void>(() => undefined);
+    seedEntry();
+    writeFiles(projectFolder, ENTRY);
+    const subject: OperationBuildCache = createSubject();
+    const writes: DeferredCacheEntryWrites = createWrites();
+
+    expect(await setCacheEntryAsync(subject, writes)).toBe(true);
+    expect(hasReceipt()).toBe(false);
+    expect(getReceiptTempFiles()).toEqual([]);
+    await writes.abortAsync();
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(hasReceipt()).toBe(true);
+  });
+
+  it('T24: writes no receipt while an older write of the entry is pending', async () => {
+    const writes: DeferredCacheEntryWrites = createWrites();
+    const { subject, openGate } = await rebuildWhileWritePendingAsync(writes);
+
+    // The entry of the rebuilt outputs is written first, and the older write replaces it.
+    await waitForAsync(() => fs.existsSync(path.join(cacheFolder, CACHE_ID)));
+    expect(readEntry()['lib/out.txt']).toBe('rebuilt');
+    openGate();
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 2, writtenCount: 2, failedCount: 0 });
+    expect(readEntry()).toEqual(ENTRY);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
+
+  it('T25: writes no receipt while an older write of the entry is pending, if the entry is written at once', async () => {
+    const writes: DeferredCacheEntryWrites = createWrites(
+      async (sourcePath: string, destinationPath: string) => {
+        // The seal of the rebuilt outputs fails, so their entry is written at once.
+        if (fs.readFileSync(sourcePath, 'utf8') === 'rebuilt') {
+          throw Object.assign(new Error('The clone failed.'), { code: 'EIO' });
+        }
+        await fs.promises.copyFile(sourcePath, destinationPath);
+      }
+    );
+    const { subject, openGate } = await rebuildWhileWritePendingAsync(writes);
+
+    expect(readEntry()['lib/out.txt']).toBe('rebuilt');
+    openGate();
+    await writes.waitForIdleAsync();
+    expect(writes.takeReport()).toMatchObject({ queuedCount: 1, writtenCount: 1, failedCount: 0 });
+    expect(readEntry()).toEqual(ENTRY);
+    const { result, output } = await restoreAsync(subject);
+
+    expect(result).toBe(true);
+    expect(untarMock).toHaveBeenCalledTimes(1);
+    expect(output).not.toContain(SKIP_LINE);
+    expect(fs.readFileSync(path.join(projectFolder, 'lib/out.txt'), 'utf8')).toBe(ENTRY['lib/out.txt']);
+  });
 });
diff --git a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
index 81592eae44..8adfbec9e9 100644
--- a/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/CacheableOperationPlugin.ts
@@ -19,6 +19,11 @@ import { CollatedTerminalProvider } from '../../utilities/CollatedTerminalProvid
 import { OperationStatus, SUCCESS_STATUSES } from './OperationStatus';
 import { CobuildLock, type ICobuildCompletedState } from '../cobuild/CobuildLock';
 import { OperationBuildCache } from '../buildCache/OperationBuildCache';
+import {
+  type DeferredCacheEntryWrites,
+  type IDeferredCacheEntryWritesReport,
+  formatMegabytes
+} from '../buildCache/DeferredCacheEntryWrites';
 import { RushConstants } from '../RushConstants';
 import type { RushProjectConfiguration } from '../../api/RushProjectConfiguration';
 import {
@@ -46,7 +51,11 @@ import type {
   IPhasedCommandPlugin,
   PhasedCommandHooks
 } from '../../pluginFramework/PhasedCommandHooks';
-import type { IOperationGraph, IOperationGraphIterationOptions } from './IOperationGraph';
+import type {
+  IOperationGraph,
+  IOperationGraphIterationOptions,
+  IOperationGraphRequestResult
+} from './IOperationGraph';
 import type { BuildCacheConfiguration } from '../../api/BuildCacheConfiguration';
 import type { IConfigurableOperation, IOperationExecutionResult } from './IOperationExecutionResult';
 import type { OperationExecutionRecord } from './OperationExecutionRecord';
@@ -130,6 +139,11 @@ export interface ICacheableOperationPluginOptions {
   terminal: ITerminal;
   excludeAppleDoubleFiles: boolean;
   useDirectFileTransfersForBuildCache: boolean;
+  /**
+   * If specified, an operation completes once its output files are sealed, and its build cache entry is written
+   * from them in the background. Ignored for cobuilds.
+   */
+  deferredCacheEntryWrites?: DeferredCacheEntryWrites;
 }
 
 interface ITryGetOperationBuildCacheOptionsBase<TRecord> {
@@ -194,6 +208,9 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
       excludeAppleDoubleFiles,
       useDirectFileTransfersForBuildCache
     } = this.#options;
+    // Other cobuild agents wait for an entry once its operation completes, so it must be written by then.
+    const deferredCacheEntryWrites: DeferredCacheEntryWrites | undefined =
+      cobuildConfiguration?.cobuildFeatureEnabled ? undefined : this.#options.deferredCacheEntryWrites;
 
     hooks.onGraphCreatedAsync.tap(PLUGIN_NAME, (graph: IOperationGraph, context: IOperationGraphContext) => {
       // The state hash at which each operation last completed successfully in an iteration of this graph
@@ -739,7 +756,12 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
             // If the command is successful, we can calculate project hash, and no dependencies were skipped,
             // write a new cache entry.
             if (!setCacheEntryPromise && taskIsSuccessful && isCacheWriteAllowed && operationBuildCache) {
-              setCacheEntryPromise = () => operationBuildCache.trySetCacheEntryAsync(buildCacheTerminal);
+              setCacheEntryPromise = () =>
+                operationBuildCache.trySetCacheEntryAsync(
+                  buildCacheTerminal,
+                  undefined,
+                  deferredCacheEntryWrites
+                );
             }
             const { inputFilesState, inputFileHashes, inputsSnapshot } = buildCacheContext;
             let inputFilesChangedMessage: string | undefined;
@@ -903,6 +925,32 @@ export class CacheableOperationPlugin implements IPhasedCommandPlugin {
         this.#buildCacheContextByOperation.clear();
         return status;
       });
+
+      if (deferredCacheEntryWrites) {
+        graph.hooks.afterExecuteRequestAsync.tap(
+          PLUGIN_NAME,
+          ({ terminal }: IOperationGraphRequestResult): void => {
+            const report: IDeferredCacheEntryWritesReport = deferredCacheEntryWrites.takeReport();
+            const { queuedCount, writtenCount, writtenByteCount, failedCount, droppedCount, pendingCount } =
+              report;
+            if (queuedCount || writtenCount || failedCount || droppedCount || pendingCount) {
+              // An entry is dropped only if an output file changed before it was sealed, or if the daemon stopped.
+              const dropped: string = droppedCount ? `, ${droppedCount} dropped` : '';
+              const line: string =
+                `Build cache entries written in the background since the previous command: ` +
+                `${queuedCount} queued, ${writtenCount} written (${formatMegabytes(writtenByteCount)}), ` +
+                `${failedCount} failed${dropped}; ${pendingCount} pending.`;
+              if (failedCount) {
+                // A failed write before the operation completes is a warning too. Output that shows only a
+                // summary, such as the daemon client's agent output, still shows warnings.
+                terminal.writeWarningLine(line);
+              } else {
+                terminal.writeLine(line);
+              }
+            }
+          }
+        );
+      }
     });
   }
 
diff --git a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
index e7c7ae9a03..90b10ea308 100644
--- a/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/CacheableOperationPlugin.test.ts
@@ -62,7 +62,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 
 import { hashFilesAsync } from '@rushstack/package-deps-hash';
-import { MockWritable, StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { MockWritable, StringBufferTerminalProvider, Terminal, type ITerminal } from '@rushstack/terminal';
 
 import type { IPhase } from '../../../api/CommandLineConfiguration';
 import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
@@ -72,6 +72,10 @@ import type { RushProjectConfiguration } from '../../../api/RushProjectConfigura
 import { PhasedCommandHooks, type IOperationGraphContext } from '../../../pluginFramework/PhasedCommandHooks';
 import type { IInputsSnapshot } from '../../incremental/InputsSnapshot';
 import { OperationBuildCache } from '../../buildCache/OperationBuildCache';
+import type {
+  DeferredCacheEntryWrites,
+  IDeferredCacheEntryWritesReport
+} from '../../buildCache/DeferredCacheEntryWrites';
 import { CacheableOperationPlugin } from '../CacheableOperationPlugin';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
 import { OperationGraph } from '../OperationGraph';
@@ -79,7 +83,7 @@ import { Operation } from '../Operation';
 import { OperationStatus } from '../OperationStatus';
 import type { IOperationRunner, IOperationRunnerContext } from '../IOperationRunner';
 import type { IExecutionResult, IOperationExecutionResult } from '../IOperationExecutionResult';
-import type { IOperationGraphExtensionResult } from '../IOperationGraph';
+import type { IOperationGraphExtensionResult, IOperationGraphRequestResult } from '../IOperationGraph';
 import type { OperationExecutionRecord } from '../OperationExecutionRecord';
 import {
   captureInputFilesState,
@@ -141,6 +145,8 @@ interface ITestGraph {
   cacheHits: Set<string>;
   // The hashes of the inputs snapshot, by path relative to the root directory
   snapshotHashes: Map<string, string>;
+  // The arguments after the terminal of each cache write, in the order of cacheWrites
+  cacheWriteArguments: [string | undefined, DeferredCacheEntryWrites | undefined][];
   // Called when an operation executes, e.g. to save one of its input files while it executes
   onExecute: ((name: string) => void) | undefined;
   // An inputs snapshot of the current local hashes and tracked file hashes
@@ -158,12 +164,14 @@ async function createTestGraphAsync(
   names: string[],
   rootDirectory: string = '/repo',
   cacheWriteEnabled: boolean = true,
-  cobuildConfiguration: CobuildConfiguration | undefined = undefined
+  cobuildConfiguration: CobuildConfiguration | undefined = undefined,
+  deferredCacheEntryWrites: DeferredCacheEntryWrites | undefined = undefined
 ): Promise<ITestGraph> {
   const executions: string[] = [];
   const cacheWrites: string[] = [];
   const cacheHits: Set<string> = new Set();
   const snapshotHashes: Map<string, string> = new Map();
+  const cacheWriteArguments: [string | undefined, DeferredCacheEntryWrites | undefined][] = [];
   const localHashes: Map<string, string> = new Map();
   const trackedFileHashes: Map<string, Map<string, string>> = new Map();
   const cacheDisabledReasons: Map<string, string> = new Map();
@@ -209,8 +217,13 @@ async function createTestGraphAsync(
     (record) =>
       ({
         tryRestoreFromCacheAsync: async () => cacheHits.has(record.operation.associatedProject.packageName),
-        trySetCacheEntryAsync: async () => {
+        trySetCacheEntryAsync: async (
+          buildCacheTerminal: ITerminal,
+          specifiedCacheId?: string,
+          deferredWrites?: DeferredCacheEntryWrites
+        ) => {
           cacheWrites.push(record.operation.associatedProject.packageName);
+          cacheWriteArguments.push([specifiedCacheId, deferredWrites]);
           return true;
         }
       }) as unknown as OperationBuildCache
@@ -228,7 +241,8 @@ async function createTestGraphAsync(
     cobuildConfiguration,
     terminal,
     excludeAppleDoubleFiles: false,
-    useDirectFileTransfersForBuildCache: false
+    useDirectFileTransfersForBuildCache: false,
+    deferredCacheEntryWrites
   }).apply(hooks);
 
   const graph: OperationGraph = new OperationGraph(new Set(operations.values()), {
@@ -270,6 +284,7 @@ async function createTestGraphAsync(
     cacheWrites,
     cacheHits,
     snapshotHashes,
+    cacheWriteArguments,
     get onExecute(): ((name: string) => void) | undefined {
       return onExecute;
     },
@@ -280,6 +295,7 @@ async function createTestGraphAsync(
     executeAsync: async (workingTreeReadStartTimeMs?: number, holdUnneededOperations?: boolean) => {
       executions.length = 0;
       cacheWrites.length = 0;
+      cacheWriteArguments.length = 0;
       cacheDisabledReasonComputations.length = 0;
       return await graph.executeAsync({
         inputsSnapshot: createInputsSnapshot(workingTreeReadStartTimeMs),
@@ -1013,4 +1029,165 @@ describe(CacheableOperationPlugin.name, () => {
       expect([...testGraph.cacheDisabledReasonComputations].sort()).toEqual(['a', 'b', 'c']);
     });
   });
+
+  describe('deferred cache entry writes', () => {
+    const emptyReport: IDeferredCacheEntryWritesReport = {
+      queuedCount: 0,
+      writtenCount: 0,
+      writtenByteCount: 0,
+      failedCount: 0,
+      droppedCount: 0,
+      pendingCount: 0
+    };
+
+    function createDeferredWrites(...reports: IDeferredCacheEntryWritesReport[]): DeferredCacheEntryWrites {
+      return {
+        takeReport: jest.fn(() => reports.shift() ?? emptyReport)
+      } as unknown as DeferredCacheEntryWrites;
+    }
+
+    async function completeRequestAsync(
+      testGraph: ITestGraph,
+      result: IExecutionResult
+    ): Promise<{ output: string; warnings: string }> {
+      const terminalProvider: StringBufferTerminalProvider = new StringBufferTerminalProvider();
+      const request: IOperationGraphRequestResult = {
+        operationResults: result.operationResults,
+        status: result.status,
+        commandName: 'build',
+        environment: {},
+        requestId: 'request-1',
+        terminal: new Terminal(terminalProvider)
+      };
+      await testGraph.graph.hooks.afterExecuteRequestAsync.promise(request);
+      return {
+        output: terminalProvider.getOutput({ normalizeSpecialCharacters: false }),
+        warnings: terminalProvider.getWarningOutput({ normalizeSpecialCharacters: false })
+      };
+    }
+
+    it('passes them to each cache entry write and reports them after each request', async () => {
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites({
+        queuedCount: 2,
+        writtenCount: 1,
+        writtenByteCount: 1.5 * 1024 * 1024,
+        failedCount: 0,
+        droppedCount: 0,
+        pendingCount: 1
+      });
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a', 'b'],
+        '/repo',
+        true,
+        undefined,
+        deferredWrites
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(testGraph.cacheWriteArguments).toEqual([
+        [undefined, deferredWrites],
+        [undefined, deferredWrites]
+      ]);
+      expect(await completeRequestAsync(testGraph, result)).toEqual({
+        output:
+          'Build cache entries written in the background since the previous command: ' +
+          '2 queued, 1 written (1.5 MB), 0 failed; 1 pending.\n',
+        warnings: ''
+      });
+      // A request without any activity reports nothing.
+      expect(await completeRequestAsync(testGraph, result)).toEqual({ output: '', warnings: '' });
+      expect(jest.mocked(deferredWrites.takeReport)).toHaveBeenCalledTimes(2);
+    });
+
+    it('that fail are reported as a warning', async () => {
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites({
+        queuedCount: 0,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 1,
+        droppedCount: 0,
+        pendingCount: 0
+      });
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a'],
+        '/repo',
+        true,
+        undefined,
+        deferredWrites
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(await completeRequestAsync(testGraph, result)).toEqual({
+        output: '',
+        warnings:
+          'Build cache entries written in the background since the previous command: ' +
+          '0 queued, 0 written (0.0 MB), 1 failed; 0 pending.\n'
+      });
+    });
+
+    it('that are dropped are reported, but not as a warning', async () => {
+      // An entry that was queued by an earlier command can be dropped during this one.
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites({
+        queuedCount: 0,
+        writtenCount: 0,
+        writtenByteCount: 0,
+        failedCount: 0,
+        droppedCount: 1,
+        pendingCount: 0
+      });
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a'],
+        '/repo',
+        true,
+        undefined,
+        deferredWrites
+      );
+
+      const result: IExecutionResult = await testGraph.executeAsync();
+
+      expect(await completeRequestAsync(testGraph, result)).toEqual({
+        output:
+          'Build cache entries written in the background since the previous command: ' +
+          '0 queued, 0 written (0.0 MB), 0 failed, 1 dropped; 0 pending.\n',
+        warnings: ''
+      });
+    });
+
+    it('are not used unless they are specified', async () => {
+      const testGraph: ITestGraph = await createTestGraphAsync(['a', 'b']);
+
+      await testGraph.executeAsync();
+
+      // The writes are equivalent to trySetCacheEntryAsync(terminal).
+      expect(testGraph.cacheWrites).toEqual(['a', 'b']);
+      expect(testGraph.cacheWriteArguments).toEqual([
+        [undefined, undefined],
+        [undefined, undefined]
+      ]);
+      expect(testGraph.graph.hooks.afterExecuteRequestAsync.isUsed()).toBe(false);
+    });
+
+    it('are not used for cobuilds', async () => {
+      const deferredWrites: DeferredCacheEntryWrites = createDeferredWrites();
+      const testGraph: ITestGraph = await createTestGraphAsync(
+        ['a'],
+        '/repo',
+        true,
+        { cobuildFeatureEnabled: true, cobuildContextId: undefined } as unknown as CobuildConfiguration,
+        deferredWrites
+      );
+      // Without a build cache, an operation does not acquire a cobuild lock
+      testGraph.cacheDisabledReasons.set('a', 'Caching has been disabled for this project.');
+
+      await testGraph.executeAsync();
+
+      // Another cobuild agent reads an operation's entry as soon as the operation completes, so each entry is
+      // written before then, and the requests have nothing to report.
+      expect(testGraph.graph.hooks.afterExecuteRequestAsync.isUsed()).toBe(false);
+      expect(jest.mocked(deferredWrites.takeReport)).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 2d162b636a..1ad67bd9f2 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -292,6 +292,11 @@
           "default": false,
           "description": "Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Experimental. RUSH_DAEMON_JOIN_RUNNING_BATCH overrides."
         },
+        "deferCacheWrites": {
+          "type": "boolean",
+          "default": false,
+          "description": "Let an operation of a daemon build complete before its build cache entry is written. The daemon clones the operation's output files, on a file system that can clone files (such as Btrfs, XFS or APFS), and writes the entry from the clones in the background, so that the operations that depend on it and the command don't wait for the entry. An operation waits at most half a second for its clones. Slower clones finish in the background, and the entry is dropped if an output file changes before it is cloned. Otherwise, and in cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be written in the background doesn't change the operation's status, and the daemon drops the entries that it hasn't written when it stops. RUSH_DAEMON_DEFER_CACHE_WRITES overrides."
+        },
         "queueTimeoutSeconds": {
           "type": "number",
           "minimum": 0,
diff --git a/libraries/rush-lib/src/utilities/TarExecutable.ts b/libraries/rush-lib/src/utilities/TarExecutable.ts
index db58cc902d..cfad7649f2 100644
--- a/libraries/rush-lib/src/utilities/TarExecutable.ts
+++ b/libraries/rush-lib/src/utilities/TarExecutable.ts
@@ -25,6 +25,13 @@ export interface ICreateArchiveOptions extends ITarOptionsBase {
   archivePath: string;
   paths: string[];
   project: RushConfigurationProject;
+  /**
+   * The folder that `paths` are relative to, and that the archive's members are named from. Defaults to the
+   * project folder.
+   */
+  baseFolderPath?: string;
+  /** When aborted, kills the tar process, which then exits with a nonzero code. */
+  abortSignal?: AbortSignal;
 }
 
 export class TarExecutable {
@@ -73,7 +80,7 @@ export class TarExecutable {
    * The "tar" exit code
    */
   public async tryCreateArchiveFromProjectPathsAsync(options: ICreateArchiveOptions): Promise<number> {
-    const { project, archivePath, paths, logFilePath } = options;
+    const { project, archivePath, paths, logFilePath, baseFolderPath, abortSignal } = options;
 
     const tarInput: string = paths.join('\n');
 
@@ -81,7 +88,6 @@ export class TarExecutable {
     // does not exist (GitHub #2622)
     await FileSystem.ensureFolderAsync(path.dirname(archivePath));
 
-    const projectFolderPath: string = project.projectFolder;
     const tarExitCode: number = await this.#spawnTarWithLoggingAsync(
       // These parameters are chosen for compatibility with the very primitive bsdtar 3.3.2 shipped with Windows 10.
       [
@@ -97,9 +103,10 @@ export class TarExecutable {
         // Windows bsdtar does not document this parameter, but seems to accept it.
         '--files-from=-'
       ],
-      projectFolderPath,
+      baseFolderPath ?? project.projectFolder,
       logFilePath,
-      tarInput
+      tarInput,
+      abortSignal
     );
 
     return tarExitCode;
@@ -109,7 +116,8 @@ export class TarExecutable {
     args: string[],
     currentWorkingDirectory: string,
     logFilePath: string,
-    input?: string
+    input?: string,
+    abortSignal?: AbortSignal
   ): Promise<number> {
     // Runs "tar" with the specified args and logs its output to the specified location.
     // The log file looks like this:
@@ -154,24 +162,43 @@ export class TarExecutable {
     const childProcess: ChildProcess = Executable.spawn(this.#tarExecutablePath, args, {
       currentWorkingDirectory: currentWorkingDirectory
     });
+    const kill: () => void = () => childProcess.kill();
+    if (abortSignal?.aborted) {
+      kill();
+    } else {
+      abortSignal?.addEventListener('abort', kill, { once: true });
+    }
 
     childProcess.stdout!.on('data', (chunk) => fileWriter.write(`[stdout] ${chunk}`));
     childProcess.stderr!.on('data', (chunk) => fileWriter.write(`[stderr] ${chunk}`));
 
     if (input !== undefined) {
+      if (abortSignal) {
+        // A tar process that was killed may have closed its end of the pipe already; its exit code reports that.
+        childProcess.stdin!.on('error', () => undefined);
+      }
       childProcess.stdin!.write(input, 'utf-8');
       childProcess.stdin!.end();
     }
 
     // Wait for process to exit and all streams to close
-    const [tarExitCode] = await events.once(childProcess, 'close');
+    let tarExitCode: number | null;
+    let tarSignal: NodeJS.Signals | null;
+    try {
+      [tarExitCode, tarSignal] = await events.once(childProcess, 'close');
+    } finally {
+      abortSignal?.removeEventListener('abort', kill);
+    }
 
     fileWriter.write(
-      ['======== END PROCESS OUTPUT ========', '', `Exited with code "${tarExitCode}"`].join('\n')
+      ['======== END PROCESS OUTPUT ========', '', `Exited with code "${tarExitCode ?? tarSignal}"`].join(
+        '\n'
+      )
     );
     fileWriter.close();
 
-    return tarExitCode;
+    // A tar process that was killed has no exit code.
+    return tarExitCode ?? 1;
   }
 }
 
diff --git a/libraries/rush-lib/src/utilities/test/TarExecutable.test.ts b/libraries/rush-lib/src/utilities/test/TarExecutable.test.ts
new file mode 100644
index 0000000000..78d6568bdd
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/TarExecutable.test.ts
@@ -0,0 +1,113 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+
+import type { RushConfigurationProject } from '../../api/RushConfigurationProject';
+import { TarExecutable } from '../TarExecutable';
+
+// Archives are created from the base folder, so this folder is never used.
+const project: RushConfigurationProject = {
+  projectFolder: path.join(os.tmpdir(), 'rush-tar-executable-missing-project')
+} as RushConfigurationProject;
+
+describe(TarExecutable.name, () => {
+  let tar: TarExecutable;
+  let folderPath: string;
+  let baseFolderPath: string;
+
+  beforeAll(async () => {
+    const found: TarExecutable | undefined = await TarExecutable.tryInitializeAsync(
+      new Terminal(new StringBufferTerminalProvider())
+    );
+    if (!found) {
+      throw new Error('"tar" was not found on the PATH');
+    }
+    tar = found;
+  });
+
+  beforeEach(() => {
+    folderPath = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-tar-executable-'));
+    baseFolderPath = path.join(folderPath, 'base');
+    fs.mkdirSync(path.join(baseFolderPath, 'lib'), { recursive: true });
+    fs.writeFileSync(path.join(baseFolderPath, 'lib', 'index.js'), 'index');
+  });
+
+  afterEach(() => {
+    fs.rmSync(folderPath, { recursive: true, force: true });
+  });
+
+  it('names the members of an archive from its base folder', async () => {
+    const archivePath: string = path.join(folderPath, 'entry.tar.gz');
+    const exitCode: number = await tar.tryCreateArchiveFromProjectPathsAsync({
+      archivePath,
+      paths: ['lib/index.js'],
+      project,
+      baseFolderPath,
+      logFilePath: path.join(folderPath, 'create.log')
+    });
+    expect(exitCode).toBe(0);
+
+    const outputFolderPath: string = path.join(folderPath, 'output');
+    fs.mkdirSync(outputFolderPath);
+    expect(
+      await tar.tryUntarAsync({
+        archivePath,
+        outputFolderPath,
+        logFilePath: path.join(folderPath, 'untar.log')
+      })
+    ).toBe(0);
+    expect(fs.readdirSync(outputFolderPath)).toEqual(['lib']);
+    expect(fs.readFileSync(path.join(outputFolderPath, 'lib', 'index.js'), 'utf8')).toBe('index');
+  });
+
+  it('kills tar at once when its signal was aborted before it started', async () => {
+    const logFilePath: string = path.join(folderPath, 'create.log');
+    const exitCode: number = await tar.tryCreateArchiveFromProjectPathsAsync({
+      archivePath: path.join(folderPath, 'entry.tar.gz'),
+      paths: ['lib/index.js'],
+      project,
+      baseFolderPath,
+      logFilePath,
+      abortSignal: AbortSignal.abort()
+    });
+
+    expect(exitCode).toBe(1);
+    expect(fs.readFileSync(logFilePath, 'utf8')).toContain('Exited with code "SIGTERM"');
+  });
+
+  it('kills tar when its signal aborts while it runs', async () => {
+    // A sparse file takes no space, but tar reads 2 GB of zeros from it and gzip compresses them, which takes
+    // seconds.
+    const fd: number = fs.openSync(path.join(baseFolderPath, 'large.bin'), 'w');
+    try {
+      fs.ftruncateSync(fd, 2 * 1024 * 1024 * 1024);
+    } finally {
+      fs.closeSync(fd);
+    }
+    const logFilePath: string = path.join(folderPath, 'create.log');
+    const abortController: AbortController = new AbortController();
+    const exitCodePromise: Promise<number> = tar.tryCreateArchiveFromProjectPathsAsync({
+      archivePath: path.join(folderPath, 'entry.tar.gz'),
+      paths: ['lib/index.js', 'large.bin'],
+      project,
+      baseFolderPath,
+      logFilePath,
+      abortSignal: abortController.signal
+    });
+    await delayAsync(200);
+    abortController.abort();
+    const abortedAtMs: number = performance.now();
+
+    expect(await exitCodePromise).toBe(1);
+    expect(fs.readFileSync(logFilePath, 'utf8')).toContain('Exited with code "SIGTERM"');
+    // Unless it was killed, tar would have run for seconds after the abort.
+    expect(performance.now() - abortedAtMs).toBeLessThan(1000);
+  });
+});

From 510426d4681f43604fe23b7eeba5870b8a07f8c2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:00 +0000
Subject: [PATCH 235/265] [rush-lib] Abort an engine creation at its next step

Swarm integration step 220; original commit 7e03cd72f5 (merge of swarm/r01-t117-f2 at 805afc8e49).
Refs: task 117.
Scope: task 117 Part 1, F2.

Brings 117f2 (branch swarm/r01-t117-f2). Second agent: t07 board 7768 (RESULT board 7767, D43 board 7542, on board 7240). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 2 of 10. Gate: ch01 GATE OK board 8659 (tree 5c5e21e47b)

Commits folded into this step (1):
- 805afc8e49 rush-lib: Abort an engine creation at its next step (task 117)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...able-engine-creation_2026-09-29-19-35.json |  11 +
 ...able-engine-creation_2026-09-29-19-35.json |  11 +
 common/reviews/api/rush-lib.api.md            |   2 +-
 .../src/test/PhasedCommandEngineAbort.test.ts | 208 ++++++++++++++++++
 .../rush-lib/src/api/PhasedCommandEngine.ts   |  15 +-
 .../cli/scriptActions/PhasedScriptAction.ts   |  25 ++-
 6 files changed, 266 insertions(+), 6 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/abortable-engine-creation_2026-09-29-19-35.json
 create mode 100644 common/changes/@rushstack/rush-daemon/abortable-engine-creation_2026-09-29-19-35.json
 create mode 100644 libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts

diff --git a/common/changes/@microsoft/rush/abortable-engine-creation_2026-09-29-19-35.json b/common/changes/@microsoft/rush/abortable-engine-creation_2026-09-29-19-35.json
new file mode 100644
index 0000000000..f63cb33771
--- /dev/null
+++ b/common/changes/@microsoft/rush/abortable-engine-creation_2026-09-29-19-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "`PhasedCommandEngine.createEngineAsync` (alpha) takes an optional `AbortSignal`. Once the signal aborts, the engine creation stops before its next preparation step, disposes what it prepared, releases the repository lock unless the host lent it, and rejects with the signal's reason. Commands that Rush runs itself are unchanged.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/abortable-engine-creation_2026-09-29-19-35.json b/common/changes/@rushstack/rush-daemon/abortable-engine-creation_2026-09-29-19-35.json
new file mode 100644
index 0000000000..61de4b1ab3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/abortable-engine-creation_2026-09-29-19-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a native engine creation stops before its next step once its abort signal aborts, cleans up what it prepared, and keeps the repository lock only if the host lent it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index cc7e129f73..10f58d984a 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -1637,7 +1637,7 @@ export { parseReporterExtensionEventName }
 export class PhasedCommandEngine {
     // (undocumented)
     readonly commandName: string;
-    createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine>;
+    createEngineAsync(preparationLock?: LockFile, abortSignal?: AbortSignal): Promise<IPhasedCommandEngine>;
     createTelemetryData(options: IPhasedCommandEngineTelemetryOptions): ITelemetryData;
     getEngineSharingBlocker(request: PhasedCommandEngine, rushSession: RushSession, labels?: IPhasedCommandEngineSharingLabels): string | undefined;
     readonly isIncremental: boolean;
diff --git a/libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts b/libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts
new file mode 100644
index 0000000000..eb60122416
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedCommandEngineAbort.test.ts
@@ -0,0 +1,208 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import {
+  CobuildConfiguration,
+  PhasedCommandEngine,
+  ProjectChangeAnalyzer,
+  type GetInputsSnapshotAsyncFn,
+  type IPhasedCommandEngine
+} from '@microsoft/rush-lib';
+import { LockFile } from '@rushstack/node-core-library';
+import { NoOpTerminalProvider } from '@rushstack/terminal';
+
+import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
+
+const STEP_PREFIX: string = 'rush:phasedScriptAction:';
+
+/** The steps that the native preparation measures for the fixture's `build`, in their order. */
+const STEPS: ReadonlyArray<string> = [
+  'checkInstallFlag',
+  'doBeforeTask',
+  'applyStandardPlugins',
+  'configureBuildCache',
+  'getSelectedProjects',
+  'applySituationalPlugins',
+  'loadProjectConfigurations',
+  'createOperations',
+  'analyzeRepoState',
+  'executionManager'
+];
+
+/**
+ * Each step after which the preparation checks its signal, with the number of times that the cobuild configuration
+ * is cleaned up once the signal aborts as the step ends. The build cache step loads that configuration.
+ */
+const CHECKED_STEPS: ReadonlyArray<[string, number]> = [
+  ['checkInstallFlag', 0],
+  ['applyStandardPlugins', 0],
+  ['configureBuildCache', 1],
+  ['applySituationalPlugins', 1],
+  ['loadProjectConfigurations', 1],
+  ['createOperations', 1],
+  ['analyzeRepoState', 1],
+  ['executionManager', 1]
+];
+
+interface IPreparation {
+  readonly command: PhasedCommandEngine;
+  readonly controller: AbortController;
+  readonly reason: Error;
+  /** The folder of the repository lock. */
+  readonly lockFolder: string;
+  /** The steps measured so far. */
+  readonly steps: string[];
+  readonly destroyLockProvider: jest.Mock<Promise<void>, []>;
+}
+
+/** Parses `build`, recording each step and aborting the preparation's signal as `abortAfter` ends. */
+async function parseAsync(fixture: DaemonGraphTestFixture, abortAfter?: string): Promise<IPreparation> {
+  const configuration = fixture.session.rushConfiguration;
+  const controller: AbortController = new AbortController();
+  const reason: Error = new Error('The background preparation was cancelled.');
+  const steps: string[] = [];
+  const measure: typeof performance.measure = performance.measure;
+  jest.spyOn(performance, 'measure').mockImplementation(function (
+    this: typeof performance,
+    ...args: Parameters<typeof performance.measure>
+  ): ReturnType<typeof performance.measure> {
+    const entry: ReturnType<typeof performance.measure> = measure.apply(this, args);
+    const [name] = args;
+    if (name.startsWith(STEP_PREFIX)) {
+      const step: string = name.slice(STEP_PREFIX.length);
+      steps.push(step);
+      if (step === abortAfter) {
+        controller.abort(reason);
+      }
+    }
+    return entry;
+  });
+  // A cobuild configuration whose feature is off, so that its cleanup can be observed.
+  const destroyLockProvider: jest.Mock<Promise<void>, []> = jest.fn(async () => {});
+  jest.spyOn(CobuildConfiguration, 'tryLoadAsync').mockResolvedValue({
+    cobuildFeatureEnabled: false,
+    createLockProviderAsync: async () => {},
+    destroyLockProviderAsync: destroyLockProvider
+  } as unknown as CobuildConfiguration);
+  const command: PhasedCommandEngine = await PhasedCommandEngine.parseAsync({
+    argv: ['build', '--parallelism', '3'],
+    cwd: configuration.rushJsonFolder,
+    rushConfiguration: configuration,
+    terminalProvider: new NoOpTerminalProvider()
+  });
+  return {
+    command,
+    controller,
+    reason,
+    lockFolder: configuration.commonTempFolder,
+    steps,
+    destroyLockProvider
+  };
+}
+
+function expectLockFree(lockFolder: string): void {
+  const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, 'rush');
+  expect(lock).toBeInstanceOf(LockFile);
+  lock?.release();
+}
+
+async function withFixtureAsync(test: (fixture: DaemonGraphTestFixture) => Promise<void>): Promise<void> {
+  const fixture: DaemonGraphTestFixture = await DaemonGraphTestFixture.createAsync();
+  try {
+    await test(fixture);
+  } finally {
+    await fixture[Symbol.asyncDispose]();
+  }
+}
+
+describe('PhasedCommandEngine.createEngineAsync with an abort signal', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('creates the engine through every step when the signal does not abort', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, lockFolder, steps, destroyLockProvider } = await parseAsync(fixture);
+      const engine: IPhasedCommandEngine = await command.createEngineAsync(undefined, controller.signal);
+      try {
+        expect(steps).toEqual(STEPS);
+        expect(destroyLockProvider).not.toHaveBeenCalled();
+        expectLockFree(lockFolder);
+      } finally {
+        await engine[Symbol.asyncDispose]();
+      }
+      expect(destroyLockProvider).toHaveBeenCalledTimes(1);
+    }));
+
+  it.each(CHECKED_STEPS)(
+    'stops before the next step once the signal aborts as %s ends, and releases the lock it took',
+    (abortAfter: string, cleanups: number) =>
+      withFixtureAsync(async (fixture) => {
+        const { command, controller, reason, lockFolder, steps, destroyLockProvider } = await parseAsync(
+          fixture,
+          abortAfter
+        );
+        await expect(command.createEngineAsync(undefined, controller.signal)).rejects.toBe(reason);
+        expect(steps).toEqual(STEPS.slice(0, STEPS.indexOf(abortAfter) + 1));
+        expect(destroyLockProvider).toHaveBeenCalledTimes(cleanups);
+        expectLockFree(lockFolder);
+      })
+  );
+
+  it('still takes the inputs snapshot if the signal aborts while the snapshot provider is created', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, reason, lockFolder, steps } = await parseAsync(fixture);
+      const createProviderAsync: ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync'] =
+        ProjectChangeAnalyzer.prototype._tryGetSnapshotProviderAsync;
+      const snapshots: jest.Mock<void, []> = jest.fn();
+      jest
+        .spyOn(ProjectChangeAnalyzer.prototype, '_tryGetSnapshotProviderAsync')
+        .mockImplementation(async function (
+          this: ProjectChangeAnalyzer,
+          ...args: Parameters<ProjectChangeAnalyzer['_tryGetSnapshotProviderAsync']>
+        ): Promise<GetInputsSnapshotAsyncFn | undefined> {
+          const getInputsSnapshotAsync: GetInputsSnapshotAsyncFn | undefined =
+            await createProviderAsync.apply(this, args);
+          controller.abort(reason);
+          return (
+            getInputsSnapshotAsync &&
+            (() => {
+              snapshots();
+              return getInputsSnapshotAsync();
+            })
+          );
+        });
+      await expect(command.createEngineAsync(undefined, controller.signal)).rejects.toBe(reason);
+      expect(snapshots).toHaveBeenCalledTimes(1);
+      expect(steps).toEqual(STEPS.slice(0, STEPS.indexOf('analyzeRepoState') + 1));
+      expectLockFree(lockFolder);
+    }));
+
+  it('runs no step when the signal has already aborted, and the command can still create its engine', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, reason, lockFolder, steps } = await parseAsync(fixture);
+      controller.abort(reason);
+      await expect(command.createEngineAsync(undefined, controller.signal)).rejects.toBe(reason);
+      expect(steps).toEqual([]);
+      expectLockFree(lockFolder);
+      const engine: IPhasedCommandEngine = await command.createEngineAsync();
+      await engine[Symbol.asyncDispose]();
+      expect(steps).toEqual(STEPS);
+    }));
+
+  it('keeps holding a borrowed lock once the signal aborts', () =>
+    withFixtureAsync(async (fixture) => {
+      const { command, controller, reason, lockFolder } = await parseAsync(fixture, 'configureBuildCache');
+      const lock: LockFile | undefined = LockFile.tryAcquire(lockFolder, 'rush');
+      if (!lock) throw new Error('Expected the free repository lock.');
+      try {
+        await expect(command.createEngineAsync(lock, controller.signal)).rejects.toBe(reason);
+        expect(lock.isReleased).toBe(false);
+        expect(fs.existsSync(lock.filePath)).toBe(true);
+      } finally {
+        lock.release();
+      }
+    }));
+});
diff --git a/libraries/rush-lib/src/api/PhasedCommandEngine.ts b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
index 02255c8e43..bb3e2c1faf 100644
--- a/libraries/rush-lib/src/api/PhasedCommandEngine.ts
+++ b/libraries/rush-lib/src/api/PhasedCommandEngine.ts
@@ -282,8 +282,18 @@ export class PhasedCommandEngine {
   /**
    * Creates the all-project graph through the native CLI preparation pipeline.
    * Releases the preparation lock before returning. Hosts must acquire an execution lease around each iteration.
+   *
+   * @param preparationLock - The repository lock that the host already holds. The host keeps it; otherwise the
+   * engine takes the lock itself and releases it before returning.
+   * @param abortSignal - For a host that prepares an engine before any request needs it. Once the signal aborts, the
+   * preparation stops before its next step; a step that has started runs to its end. The partial graph is disposed,
+   * the lock is released unless the host lent it, and the promise rejects with the signal's reason. The parsed
+   * command cannot create an engine again, unless the signal had already aborted when this was called.
    */
-  public async createEngineAsync(preparationLock?: LockFile): Promise<IPhasedCommandEngine> {
+  public async createEngineAsync(
+    preparationLock?: LockFile,
+    abortSignal?: AbortSignal
+  ): Promise<IPhasedCommandEngine> {
     if (this._created) {
       throw new Error('This parsed command has already created its engine.');
     }
@@ -295,6 +305,7 @@ export class PhasedCommandEngine {
     ) {
       throw new Error('The borrowed preparation lock is not held for this workspace.');
     }
+    abortSignal?.throwIfAborted();
     const lock: LockFile | undefined = preparationLock ?? LockFile.tryAcquire(lockFolder, 'rush');
     if (!lock) throw new PhasedCommandEngineBusyError();
     this._created = true;
@@ -302,7 +313,7 @@ export class PhasedCommandEngine {
     let releaseAttempted: boolean = false;
     try {
       await this._parser.pluginManager.tryInitializeUnassociatedPluginsAsync();
-      engine = await this._action.createEngineAsync();
+      engine = await this._action.createEngineAsync(abortSignal);
       if (!preparationLock) {
         releaseAttempted = true;
         lock.release();
diff --git a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
index c50caaaa94..14569a1f46 100644
--- a/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
+++ b/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts
@@ -694,18 +694,27 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     };
   }
 
-  public async createEngineAsync(): Promise<IPhasedCommandEngine> {
+  /**
+   * Prepares an engine through the native pipeline, with every project selected.
+   *
+   * @param abortSignal - Once aborted, the preparation stops before its next step and rejects with the signal's
+   * reason; see `PhasedCommandEngine.createEngineAsync`.
+   */
+  public async createEngineAsync(abortSignal?: AbortSignal): Promise<IPhasedCommandEngine> {
     this.validateEngineCommand();
     await this.initializePluginsAsync();
     let engine: IPhasedCommandEngine | undefined;
     await this.#runAsync((result) => {
       engine = result;
-    });
+    }, abortSignal);
     if (!engine) throw new Error('Native command preparation did not produce an operation graph.');
     return engine;
   }
 
-  async #runAsync(onEngine?: (engine: IPhasedCommandEngine) => void): Promise<void> {
+  async #runAsync(
+    onEngine?: (engine: IPhasedCommandEngine) => void,
+    abortSignal?: AbortSignal
+  ): Promise<void> {
     // Initialize the stopwatch's start time at 0 (process startup).
     const stopwatch: Stopwatch = Stopwatch.start(0);
 
@@ -739,6 +748,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     }
 
     await this.#validateInstallStateAsync();
+    abortSignal?.throwIfAborted();
 
     measureFn(`${PERF_PREFIX}:doBeforeTask`, () => this.#doBeforeTask());
 
@@ -813,6 +823,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         await hookForAction.promise(this);
       });
     }
+    abortSignal?.throwIfAborted();
 
     const isQuietMode: boolean = !this.#verboseParameter.value;
 
@@ -843,6 +854,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
     let stopOnClosedOutput: (() => void) | undefined;
 
     try {
+      // Inside the try block, so that the cobuild lock provider is destroyed.
+      abortSignal?.throwIfAborted();
       const projectSelection: Set<RushConfigurationProject> = await measureAsyncFn(
         `${PERF_PREFIX}:getSelectedProjects`,
         () =>
@@ -968,6 +981,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         }
       });
 
+      abortSignal?.throwIfAborted();
       const relevantProjects: Set<RushConfigurationProject> = generateFullGraph
         ? new Set(this.rushConfiguration.projects)
         : Selection.expandAllDependencies(projectSelection);
@@ -986,6 +1000,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
             this.rushConfiguration.daemon.usePersistentIpcRunners
           )
         : undefined;
+      abortSignal?.throwIfAborted();
 
       const includePhaseDeps: boolean = this.#includePhaseDeps?.value ?? false;
 
@@ -1012,6 +1027,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
       const operations: Set<Operation> = await measureAsyncFn(`${PERF_PREFIX}:createOperations`, () =>
         this.hooks.createOperationsAsync.promise(new Set(), createOperationsContext)
       );
+      abortSignal?.throwIfAborted();
 
       const [getInputsSnapshotAsync, initialSnapshot] = await measureAsyncFn(
         `${PERF_PREFIX}:analyzeRepoState`,
@@ -1044,6 +1060,7 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
           return [innerGetInputsSnapshotAsync, innerInitialSnapshot];
         }
       );
+      abortSignal?.throwIfAborted();
 
       let executionTelemetryHandler: IOperationGraphTelemetry | undefined;
       const { telemetry: parserTelemetry } = this.parser;
@@ -1149,6 +1166,8 @@ export class PhasedScriptAction extends BaseScriptAction<IPhasedCommandConfig> i
         await hooks.onGraphCreatedAsync.promise(graph, graphContext);
       });
       if (onEngine) {
+        // Before the graph is transferred, so that it is disposed below.
+        abortSignal?.throwIfAborted();
         if (!getGraphInputsSnapshotAsync || !initialSnapshot) {
           throw new Error('The daemon engine requires a Git-backed workspace inputs snapshot.');
         }

From e8ec259dee88e6e175a273e746c7298b3311af67 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:00 +0000
Subject: [PATCH 236/265] [operation-graph] Report VmRSS from /proc/self/status
 after each warm run

Swarm integration step 221; original commit e11400730a (merge of swarm/r03-t324 at 472218798b).
Scope: task 324, VmRSS after each warm engine.

Brings 324 (branch swarm/r03-t324). Second agent: m03 board 7859 (RESULT board 7858, on CLAIM board 7820). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 3 of 10. Gate: ch01 GATE OK board 8659 (tree f69b632ded)

Commits folded into this step (1):
- 472218798b [operation-graph] Report VmRSS from /proc/self/status after each warm run

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...tion-graph-exact-rss_2026-09-29-23-35.json |  11 ++
 libraries/operation-graph/src/WatchLoop.ts    |   3 +-
 .../operation-graph/src/protocol.types.ts     |   5 +-
 .../src/readResidentMemoryBytes.ts            |  39 +++++++
 .../src/test/WatchLoop.test.ts                |  67 ++++++++++++
 .../src/test/readResidentMemoryBytes.test.ts  | 101 ++++++++++++++++++
 6 files changed, 224 insertions(+), 2 deletions(-)
 create mode 100644 common/changes/@rushstack/operation-graph/operation-graph-exact-rss_2026-09-29-23-35.json
 create mode 100644 libraries/operation-graph/src/readResidentMemoryBytes.ts
 create mode 100644 libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts

diff --git a/common/changes/@rushstack/operation-graph/operation-graph-exact-rss_2026-09-29-23-35.json b/common/changes/@rushstack/operation-graph/operation-graph-exact-rss_2026-09-29-23-35.json
new file mode 100644
index 0000000000..df0d55b3a6
--- /dev/null
+++ b/common/changes/@rushstack/operation-graph/operation-graph-exact-rss_2026-09-29-23-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/operation-graph",
+      "comment": "On Linux, `WatchLoop` now reports its process's resident memory to the IPC host from `VmRSS` in `/proc/self/status` instead of `process.memoryUsage().rss`, whose count can be off by hundreds of megabytes on machines with many CPUs.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/operation-graph",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/operation-graph/src/WatchLoop.ts b/libraries/operation-graph/src/WatchLoop.ts
index 302aa21fcd..496dfda9f1 100644
--- a/libraries/operation-graph/src/WatchLoop.ts
+++ b/libraries/operation-graph/src/WatchLoop.ts
@@ -14,6 +14,7 @@ import type {
   ISyncEventMessage,
   IRequestRunEventMessage
 } from './protocol.types';
+import { readResidentMemoryBytes } from './readResidentMemoryBytes';
 
 /**
  * Callbacks for the watch loop.
@@ -210,7 +211,7 @@ export class WatchLoop implements IWatchLoopState {
               const afterExecuteMessage: IAfterExecuteEventMessage = {
                 event: 'after-execute',
                 status,
-                residentMemoryBytes: process.memoryUsage().rss
+                residentMemoryBytes: readResidentMemoryBytes()
               };
               tryMessageHost(afterExecuteMessage);
             }
diff --git a/libraries/operation-graph/src/protocol.types.ts b/libraries/operation-graph/src/protocol.types.ts
index ed4e96727b..7965874c47 100644
--- a/libraries/operation-graph/src/protocol.types.ts
+++ b/libraries/operation-graph/src/protocol.types.ts
@@ -28,7 +28,10 @@ export interface IRequestRunEventMessage {
 export interface IAfterExecuteEventMessage {
   event: 'after-execute';
   status: OperationStatus;
-  /** The child's measured process RSS at completion, in bytes. Absent for older producers. */
+  /**
+   * The child's measured process RSS at completion, in bytes: on Linux, `VmRSS` from `/proc/self/status`, and
+   * elsewhere `process.memoryUsage.rss()`. Absent for older producers.
+   */
   residentMemoryBytes?: number;
 }
 
diff --git a/libraries/operation-graph/src/readResidentMemoryBytes.ts b/libraries/operation-graph/src/readResidentMemoryBytes.ts
new file mode 100644
index 0000000000..be3417607c
--- /dev/null
+++ b/libraries/operation-graph/src/readResidentMemoryBytes.ts
@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { FileSystem } from '@rushstack/node-core-library';
+
+const PROCESS_STATUS_PATH: string = '/proc/self/status';
+const RESIDENT_SET_SIZE_PATTERN: RegExp = /^VmRSS:\s*(\d+)\s+kB$/m;
+const BYTES_PER_KIBIBYTE: number = 1024;
+
+function tryReadProcessStatusResidentMemoryBytes(): number | undefined {
+  let status: string;
+  try {
+    status = FileSystem.readFile(PROCESS_STATUS_PATH);
+  } catch {
+    return undefined;
+  }
+  const kibibytes: string | undefined = RESIDENT_SET_SIZE_PATTERN.exec(status)?.[1];
+  if (kibibytes === undefined) {
+    return undefined;
+  }
+  const bytes: number = Number(kibibytes) * BYTES_PER_KIBIBYTE;
+  return Number.isSafeInteger(bytes) && bytes > 0 ? bytes : undefined;
+}
+
+/**
+ * Returns the resident set size of this process, in bytes.
+ *
+ * @remarks
+ * On Linux, this is `VmRSS` from `/proc/self/status`, which recent kernels compute from exact counters.
+ * `process.memoryUsage().rss` reads `/proc/self/stat` instead, whose count leaves out what each CPU has not yet added
+ * to the total, so on a machine with many CPUs it can be off by hundreds of megabytes, in either direction.
+ * On other platforms, or if the file can't be read or parsed, this returns `process.memoryUsage.rss()`.
+ */
+export function readResidentMemoryBytes(): number {
+  return (
+    (process.platform === 'linux' ? tryReadProcessStatusResidentMemoryBytes() : undefined) ??
+    process.memoryUsage.rss()
+  );
+}
diff --git a/libraries/operation-graph/src/test/WatchLoop.test.ts b/libraries/operation-graph/src/test/WatchLoop.test.ts
index 2afdf48fdb..5ccf1c486d 100644
--- a/libraries/operation-graph/src/test/WatchLoop.test.ts
+++ b/libraries/operation-graph/src/test/WatchLoop.test.ts
@@ -3,6 +3,7 @@
 
 import { AlreadyReportedError } from '@rushstack/node-core-library';
 import { OperationStatus } from '../OperationStatus';
+import * as ResidentMemory from '../readResidentMemoryBytes';
 import { type IWatchLoopOptions, type IWatchLoopState, WatchLoop } from '../WatchLoop';
 import type {
   CommandMessageFromHost,
@@ -38,6 +39,24 @@ function createWatchLoop(): IMockOptionsAndWatchLoop {
   };
 }
 
+interface IRunOnceIPCHost {
+  ipcHost: IPCHost;
+  sendMock: jest.Mock;
+}
+
+// A host that sends "run" after the first "sync", and "exit" after the first "after-execute".
+function createRunOnceIPCHost(): IRunOnceIPCHost {
+  let messageHandler: ((message: CommandMessageFromHost) => void) | undefined;
+  const onMock: jest.Mock = jest.fn((event: string, handler: (message: CommandMessageFromHost) => void) => {
+    messageHandler = handler;
+  });
+  const sendMock: jest.Mock = jest.fn((message: EventMessageFromClient) => {
+    const command: 'run' | 'exit' = message.event === 'sync' ? 'run' : 'exit';
+    process.nextTick(() => messageHandler!({ command }));
+  });
+  return { ipcHost: { on: onMock, send: sendMock }, sendMock };
+}
+
 describe(WatchLoop.name, () => {
   describe(WatchLoop.prototype.runUntilStableAsync.name, () => {
     it('executes once when no run is requested', async () => {
@@ -317,5 +336,53 @@ describe(WatchLoop.name, () => {
       expect(sendMock).toHaveBeenLastCalledWith(successMessage);
       expect(sendMock.mock.calls[1][0].residentMemoryBytes).toBeGreaterThan(0);
     });
+
+    describe('residentMemoryBytes', () => {
+      const residentMemoryBytes: number = 987654321;
+
+      beforeEach(() => {
+        jest.spyOn(ResidentMemory, 'readResidentMemoryBytes').mockReturnValue(residentMemoryBytes);
+      });
+
+      afterEach(() => {
+        jest.restoreAllMocks();
+      });
+
+      it('reports readResidentMemoryBytes() after a run', async () => {
+        const {
+          watchLoop,
+          mocks: { executeAsync }
+        } = createWatchLoop();
+        executeAsync.mockResolvedValue(OperationStatus.Success);
+        const { ipcHost, sendMock } = createRunOnceIPCHost();
+
+        await watchLoop.runIPCAsync(ipcHost);
+
+        const afterExecuteMessage: IAfterExecuteEventMessage = {
+          event: 'after-execute',
+          status: OperationStatus.Success,
+          residentMemoryBytes
+        };
+        expect(sendMock).toHaveBeenLastCalledWith(afterExecuteMessage);
+      });
+
+      it('reports readResidentMemoryBytes() after a run that throws', async () => {
+        const {
+          watchLoop,
+          mocks: { executeAsync }
+        } = createWatchLoop();
+        executeAsync.mockRejectedValue(new Error('fnord'));
+        const { ipcHost, sendMock } = createRunOnceIPCHost();
+
+        await expect(watchLoop.runIPCAsync(ipcHost)).rejects.toThrow('fnord');
+
+        const afterExecuteMessage: IAfterExecuteEventMessage = {
+          event: 'after-execute',
+          status: OperationStatus.Failure,
+          residentMemoryBytes
+        };
+        expect(sendMock).toHaveBeenLastCalledWith(afterExecuteMessage);
+      });
+    });
   });
 });
diff --git a/libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts b/libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts
new file mode 100644
index 0000000000..292d78b468
--- /dev/null
+++ b/libraries/operation-graph/src/test/readResidentMemoryBytes.test.ts
@@ -0,0 +1,101 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { FileSystem } from '@rushstack/node-core-library';
+
+import { readResidentMemoryBytes } from '../readResidentMemoryBytes';
+
+const FALLBACK_BYTES: number = 123456789;
+
+// The format of /proc/<pid>/status, in which every memory line has its own value.
+const STATUS_TEXT: string = [
+  'Name:\tnode',
+  'VmPeak:\t    9500 kB',
+  'VmSize:\t    9000 kB',
+  'VmLck:\t       0 kB',
+  'VmHWM:\t    2000 kB',
+  'VmRSS:\t    1500 kB',
+  'RssAnon:\t     900 kB',
+  'RssFile:\t     500 kB',
+  'RssShmem:\t     100 kB',
+  'Threads:\t11',
+  ''
+].join('\n');
+
+function readVmRssBytes(): number {
+  const kibibytes: string | undefined = /^VmRSS:\s*(\d+)\s+kB$/m.exec(
+    fs.readFileSync('/proc/self/status', 'utf8')
+  )?.[1];
+  return Number(kibibytes) * 1024;
+}
+
+describe(readResidentMemoryBytes.name, () => {
+  const platformDescriptor: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+
+  function setPlatform(platform: NodeJS.Platform): void {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: platform });
+  }
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', platformDescriptor);
+    jest.restoreAllMocks();
+  });
+
+  (process.platform === 'linux' ? it : it.skip)('matches VmRSS from /proc/self/status on Linux', () => {
+    const before: number = readVmRssBytes();
+    const bytes: number = readResidentMemoryBytes();
+    const after: number = readVmRssBytes();
+
+    expect(bytes % 1024).toBe(0);
+    expect(bytes).toBeGreaterThanOrEqual(Math.min(before, after));
+    expect(bytes).toBeLessThanOrEqual(Math.max(before, after));
+  });
+
+  describe('with a mocked /proc/self/status', () => {
+    let readFileMock: jest.SpyInstance<string, Parameters<typeof FileSystem.readFile>>;
+
+    beforeEach(() => {
+      setPlatform('linux');
+      readFileMock = jest.spyOn(FileSystem, 'readFile').mockReturnValue(STATUS_TEXT);
+      jest.spyOn(process.memoryUsage, 'rss').mockReturnValue(FALLBACK_BYTES);
+    });
+
+    it('returns VmRSS in bytes', () => {
+      expect(readResidentMemoryBytes()).toBe(1536000);
+      expect(readFileMock).toHaveBeenCalledTimes(1);
+      expect(readFileMock).toHaveBeenCalledWith('/proc/self/status');
+    });
+
+    it('falls back to process.memoryUsage.rss() if the file cannot be read', () => {
+      readFileMock.mockImplementation(() => {
+        throw Object.assign(new Error('ENOENT: no such file or directory'), { code: 'ENOENT' });
+      });
+
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    });
+
+    it('falls back to process.memoryUsage.rss() if there is no VmRSS line', () => {
+      readFileMock.mockReturnValue(STATUS_TEXT.replace('VmRSS:\t    1500 kB\n', ''));
+
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    });
+
+    it('falls back to process.memoryUsage.rss() if VmRSS is 0', () => {
+      readFileMock.mockReturnValue(STATUS_TEXT.replace('VmRSS:\t    1500 kB', 'VmRSS:\t       0 kB'));
+
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    });
+
+    it.each(['darwin', 'win32'] as const)(
+      'returns process.memoryUsage.rss() without reading the file on %s',
+      (platform: NodeJS.Platform) => {
+        setPlatform(platform);
+
+        expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+        expect(readFileMock).not.toHaveBeenCalled();
+      }
+    );
+  });
+});

From 0291f9de14ecbd2a3554111e04de34201079689f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:00 +0000
Subject: [PATCH 237/265] [rush-cli-client] Test more ways a lock wait precedes
 a restart in agent mode

Swarm integration step 222; original commit 8eb0a32328 (merge of swarm/r04-t326 at 7bce6766aa).
Scope: task 326, lock waits before a restart.

Brings 326 (branch swarm/r04-t326). Second agent: o04 board 7794 (RESULT board 7793, on CLAIM board 7747). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 4 of 10. Gate: ch01 GATE OK board 8659 (tree d3e2a6d2ad)

Commits folded into this step (1):
- 7bce6766aa [rush-cli-client] Test more ways a lock wait precedes a restart in agent mode

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/AgentProgressRenderer.test.ts    | 35 +++++++++++++++++++
 .../src/test/nativeLockWaitNotice.test.ts     | 21 +++++++++++
 ...-wait-resubmit-tests_2026-09-29-23-48.json | 11 ++++++
 3 files changed, 67 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t326-lock-wait-resubmit-tests_2026-09-29-23-48.json

diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index c1b259f51f..8d74ea92fd 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1749,6 +1749,41 @@ describe(AgentProgressRenderer.name, () => {
     );
   });
 
+  it('says on a TTY that a command which waited for another Rush process was resubmitted after the daemon restarted (task 326)', async () => {
+    const { renderer, output, clock } = createRenderer(true, 'build', 120);
+    const firstRow = (): string => output[output.length - 1].replace(ANSI_ESCAPE, '').split('\n')[0].slice(2);
+    const writeStderrAsync = async (): Promise<void> => undefined;
+    const handlers: INativeLockWaitNoticeHandlers = withNativeLockWaitNotices(
+      createDaemonRequestNoticeHandlers({
+        rushx: false,
+        stderrIsTTY: true,
+        daemonPid: 41,
+        now: () => clock.ms,
+        agentRenderer: renderer,
+        writeStderrAsync
+      }),
+      { rushx: false, agentRenderer: renderer, now: () => clock.ms, writeStderrAsync }
+    );
+    renderer.start();
+    renderer.onRequestSent();
+    clock.ms = 100;
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: 4242, command: 'rush install' });
+    // On a TTY, no line says so; only the phase shows the wait.
+    expect(firstRow()).toBe(
+      "rush build · 0.1s · waiting for another Rush process (PID 4242: rush install) to release this repository's lock"
+    );
+    clock.ms = 5_000;
+    // The install changed the lockfile, so the daemon restarted at once, which needs no line.
+    await handlers.onRestartAsync({
+      restart: 1,
+      reason: { kind: 'workspaceInputsChanged', installationFiles: ['common/config/rush/pnpm-lock.yaml'] },
+      successorPid: 43
+    });
+    expect(firstRow()).toBe(`rush build · 5.0s · ${RESUBMITTED_PHASE}`);
+    handlers.dispose();
+    renderer.dispose();
+  });
+
   it('repaints a TTY on its timer rather than on every event, and shows failures in the last row', () => {
     jest.useFakeTimers();
     try {
diff --git a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
index 1c2a6feb92..60d1a198e7 100644
--- a/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
+++ b/apps/rush-cli-client/src/test/nativeLockWaitNotice.test.ts
@@ -243,6 +243,27 @@ describe(withNativeLockWaitNotices.name, () => {
     ]);
   });
 
+  it('gives the agent the resubmitted phase after a restart when the daemon reported the same process again (task 326)', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    // Neither is announced again, so the phase still names the process.
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    await handlers.onQueuePositionAsync(1, undefined, {}, { pid: INSTALL.pid });
+    await handlers.onRestartAsync({ restart: 1, reason: LOCKFILE, successorPid: 42 });
+    handlers.dispose();
+    expect(calls).toEqual([`announce: waiting for ${INSTALL_LOCK}`, `resubmitted: ${RESUBMITTED_PHASE}`]);
+  });
+
+  it('gives the agent the resubmitted phase after a restart when output came after the lock wait (task 326)', async () => {
+    const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
+    await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
+    // A log line leaves the agent's phase, which still names the process.
+    handlers.onRequestProgress();
+    await handlers.onRestartAsync({ restart: 1, reason: LOCKFILE, successorPid: 42 });
+    handlers.dispose();
+    expect(calls).toEqual([`announce: waiting for ${INSTALL_LOCK}`, `resubmitted: ${RESUBMITTED_PHASE}`]);
+  });
+
   it('announces a process once when its command can no longer be read, and names a command read later', async () => {
     const { calls, handlers } = createHandlers({ agent: true, stderrIsTTY: false });
     await handlers.onQueuePositionAsync(1, undefined, {}, INSTALL);
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t326-lock-wait-resubmit-tests_2026-09-29-23-48.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t326-lock-wait-resubmit-tests_2026-09-29-23-48.json
new file mode 100644
index 0000000000..690b855dd3
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t326-lock-wait-resubmit-tests_2026-09-29-23-48.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From eabe7eb21672136e4a3ef8678869fba6b56f964f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:00 +0000
Subject: [PATCH 238/265] [rush-daemon] Test that a request's plugin names must
 match the warm engine

Swarm integration step 223; original commit 01224b9c3d (merge of swarm/r04-t331 at c39dcd9b45).
Scope: task 331, plugin names must match the warm engine.

Brings 331 (branch swarm/r04-t331). Second agent: o04 board 7933 (RESULT board 7932, on CLAIM board 7878). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 5 of 10. Gate: ch01 GATE OK board 8659 (tree b824e27bda)

Commits folded into this step (1):
- c39dcd9b45 [rush-daemon] Test that a request's plugin names must match the warm engine

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...31-plugin-shape-test_2026-09-30-00-25.json | 11 ++++++++
 .../src/test/PhasedRequestRouter.test.ts      | 26 +++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t331-plugin-shape-test_2026-09-30-00-25.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t331-plugin-shape-test_2026-09-30-00-25.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t331-plugin-shape-test_2026-09-30-00-25.json
new file mode 100644
index 0000000000..166f004f7f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t331-plugin-shape-test_2026-09-30-00-25.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts b/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts
index 86c2cf3cd6..ec18cfd724 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestRouter.test.ts
@@ -141,6 +141,32 @@ describe(PhasedRequestRouter.name, () => {
     expect(scheduleSpy).not.toHaveBeenCalled();
   });
 
+  it('rejects a request whose plugin names differ from the warm engine before scheduling (task 331)', async () => {
+    const fixture: ITestRoutingFixture = createThreeOperationFixture();
+    const router: PhasedRequestRouter = new PhasedRequestRouter(fixture.session);
+    const client: TestPhasedRequestClient = new TestPhasedRequestClient();
+    const scheduleSpy: jest.SpyInstance = jest.spyOn(fixture.graph, 'scheduleIterationAsync');
+    const pluginName: string = TEST_ENGINE_SHAPE.pluginNames[0];
+
+    for (const pluginNames of [
+      ['other-plugin'],
+      [],
+      [pluginName, 'other-plugin'],
+      [pluginName, pluginName]
+    ]) {
+      await expect(
+        router.executeAsync(
+          {
+            ...createRequest([select(OPERATION_A)]),
+            engineShape: { phaseNames: TEST_ENGINE_SHAPE.phaseNames, pluginNames }
+          },
+          client
+        )
+      ).rejects.toThrow('The phased request plugin shape does not match the warm workspace engine.');
+    }
+    expect(scheduleSpy).not.toHaveBeenCalled();
+  });
+
   it('accepts both enabled states declared by the protocol', async () => {
     const trueFixture: ITestRoutingFixture = createThreeOperationFixture();
     await new PhasedRequestRouter(trueFixture.session).executeAsync(

From cc06a2b2475d7d54a8c15a514e95a18466a6e3b2 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:01 +0000
Subject: [PATCH 239/265] [rush-daemon] Test validateEngineShape with two
 phases and two plugins

Swarm integration step 224; original commit 4065ad7dc1 (merge of swarm/r04-t334 at 633ea4d5e4).
Scope: task 334, validateEngineShape with two phases and two plugins.

Brings 334 (branch swarm/r04-t334, 2 commits). Second agent: o04 board 8141 (RESULT board 8140, on CLAIM board 8025). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 6 of 10. Gate: ch01 GATE OK board 8659 (tree 424e040dda)

Commits folded into this step (1):
- 633ea4d5e4 [rush-daemon] Test validateEngineShape with two phases and two plugins

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...ine-shape-lists-test_2026-09-30-01-00.json | 11 ++++++
 .../src/test/PhasedRequestSelection.test.ts   | 35 +++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t334-engine-shape-lists-test_2026-09-30-01-00.json
 create mode 100644 libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t334-engine-shape-lists-test_2026-09-30-01-00.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t334-engine-shape-lists-test_2026-09-30-01-00.json
new file mode 100644
index 0000000000..166f004f7f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t334-engine-shape-lists-test_2026-09-30-01-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts b/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
new file mode 100644
index 0000000000..1c00d92b2c
--- /dev/null
+++ b/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
@@ -0,0 +1,35 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonPhasedEngineShape } from '@rushstack/rush-daemon-protocol';
+
+import { validateEngineShape } from '../PhasedRequestSelection';
+import type { IWorkspaceEngineShape } from '../WorkspaceEngineComponentFactory';
+
+const WARM_ENGINE_SHAPE: IWorkspaceEngineShape = {
+  phaseNames: ['_phase:build', '_phase:test'],
+  pluginNames: ['plugin-a', 'plugin-b']
+};
+
+describe(validateEngineShape.name, () => {
+  it('accepts the warm engine names in any order', () => {
+    expect(() =>
+      validateEngineShape(
+        { phaseNames: ['_phase:test', '_phase:build'], pluginNames: ['plugin-b', 'plugin-a'] },
+        WARM_ENGINE_SHAPE
+      )
+    ).not.toThrow();
+  });
+
+  it.each<[string, IDaemonPhasedEngineShape]>([
+    ['phase', { phaseNames: ['_phase:build', '_phase:build'], pluginNames: WARM_ENGINE_SHAPE.pluginNames }],
+    ['plugin', { phaseNames: WARM_ENGINE_SHAPE.phaseNames, pluginNames: ['plugin-a', 'plugin-a'] }]
+  ])(
+    'rejects a %s list that repeats one warm name in place of another',
+    (kind: string, requestShape: IDaemonPhasedEngineShape) => {
+      expect(() => validateEngineShape(requestShape, WARM_ENGINE_SHAPE)).toThrow(
+        `The phased request ${kind} shape does not match the warm workspace engine.`
+      );
+    }
+  );
+});

From 4b8a947c17ae61e966949732be184e9dc640256e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:01 +0000
Subject: [PATCH 240/265] [rush-daemon-transport] Record a detached child
 before it can be orphaned

Swarm integration step 225; original commit 181ec65700 (merge of swarm/r06-t321 at 59f0c8f300).
Scope: task 321, record a detached child before it can be orphaned.

Brings 321 (branch swarm/r06-t321). Second agent: o02 board 8396 (RESULT board 8395, on CLAIM board 7923). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 7 of 10. Gate: ch01 GATE OK board 8659 (tree 467af3a212)

Commits folded into this step (1):
- 59f0c8f300 rush-daemon-transport: record a detached child before it can be orphaned

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...06-t321-spawn-window_2026-09-29-23-20.json | 11 +++
 .../src/DaemonExitRelease.ts                  |  2 +-
 .../src/DaemonGroupMemberScan.ts              |  3 +-
 .../src/DaemonOperationGroupAdoption.ts       | 68 +++++++++++++
 .../src/DaemonOperationGroupReaper.ts         |  7 +-
 .../src/DaemonOperationGroupRecorder.ts       | 19 ++--
 .../src/DaemonOperationGroupSpawnHook.ts      | 62 ++++++++++++
 .../src/DaemonOperationGroupSpawnMark.ts      | 72 ++++++++++++++
 .../src/DaemonOperationGroups.ts              | 12 ++-
 .../src/DaemonOwnGroup.ts                     | 22 +++++
 .../src/DaemonProcessGroup.ts                 | 22 ++---
 .../src/DaemonProcessList.ts                  | 42 ++++++++
 .../src/DaemonProcessStat.ts                  | 28 ++----
 .../src/test/DaemonProcessReadErrors.test.ts  | 49 +++++++++
 .../src/test/DaemonProcessStat.test.ts        | 31 +++++-
 .../src/test/FakeProcessTable.ts              |  6 +-
 .../src/test/OperationGroupAdoption.test.ts   | 50 ++++++++++
 .../test/OperationGroupAdoptionEdges.test.ts  | 64 ++++++++++++
 .../src/test/OperationGroupAdoptionFixture.ts | 99 +++++++++++++++++++
 .../src/test/OperationGroupAdoptionRun.ts     | 48 +++++++++
 .../src/test/OperationGroupSpawnDeath.test.ts | 94 ++++++++++++++++++
 .../test/OperationGroupSpawnFallback.test.ts  | 86 ++++++++++++++++
 .../OperationGroupSpawnHookSafety.test.ts     | 86 ++++++++++++++++
 .../test/OperationGroupSpawnMarkReap.test.ts  | 96 ++++++++++++++++++
 .../src/test/OperationGroupSpawnOrder.test.ts | 96 ++++++++++++++++++
 .../test/OperationGroupSpawnRecord.test.ts    | 78 +++++++++++++++
 .../src/test/SpawnStandInFixture.ts           | 92 +++++++++++++++++
 .../src/test/SpawnStandInSteps.ts             | 31 ++++++
 28 files changed, 1319 insertions(+), 57 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/swarm-r06-t321-spawn-window_2026-09-29-23-20.json
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonOwnGroup.ts
 create mode 100644 libraries/rush-daemon-transport/src/DaemonProcessList.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t321-spawn-window_2026-09-29-23-20.json b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t321-spawn-window_2026-09-29-23-20.json
new file mode 100644
index 0000000000..d36e5d90ba
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/swarm-r06-t321-spawn-window_2026-09-29-23-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "A daemon now records each detached operation process as soon as Node has started it, instead of on its 'spawn' event, and marks each detached spawn while it runs, so that a reclaim also stops an operation process that the daemon died while starting. A failure to record the child never reaches the code that spawned it, and a reclaim reads no process for a spawn mark while the old daemon's pid is still alive and not reused.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonExitRelease.ts b/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
index 5250fea764..5ae80b40fb 100644
--- a/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
+++ b/libraries/rush-daemon-transport/src/DaemonExitRelease.ts
@@ -3,7 +3,7 @@
 
 import { getOperationGroupsFolder, readOperationGroupRecords } from './DaemonOperationGroups';
 import type { IDaemonPaths } from './DaemonPaths';
-import { listLiveGroupMembers } from './DaemonProcessStat';
+import { listLiveGroupMembers } from './DaemonProcessList';
 import type { IProcessStat } from './DaemonProcessStat';
 
 const NO_RECORDS: number = 0;
diff --git a/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts b/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
index 56853f4248..e096a263e8 100644
--- a/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
+++ b/libraries/rush-daemon-transport/src/DaemonGroupMemberScan.ts
@@ -1,7 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
-import { isLiveMemberOf, readProcessIds, readStatRecord } from './DaemonProcessStat';
+import { readProcessIds } from './DaemonProcessList';
+import { isLiveMemberOf, readStatRecord } from './DaemonProcessStat';
 
 const NO_SIGNAL: number = 0;
 const NO_SUCH_PROCESS: string = 'ESRCH';
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts
new file mode 100644
index 0000000000..1cfd096fc7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupAdoption.ts
@@ -0,0 +1,68 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IOperationGroupRecord } from './DaemonOperationGroups';
+import { readSpawnMarks } from './DaemonOperationGroupSpawnMark';
+import { isGroupAndSessionLeader } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+import type { IReapContext } from './DaemonReapOptions';
+
+// A child's start time is set when it is forked, inside the spawn that its mark brackets. 1 s is over 13 times
+// the longest spawn measured from a daemon-sized process.
+const SPAWN_WINDOW_TICKS: number = 100;
+const NO_MARKS: number = 0;
+
+/** The dead daemon's record folder, what it recorded there, and its marker. */
+export interface IOperationGroupAdoptionScope {
+  readonly folder: string;
+  readonly records: readonly IOperationGroupRecord[];
+  readonly marker: string;
+}
+
+interface IAdoption {
+  readonly context: IReapContext;
+  readonly marker: string;
+  readonly recorded: ReadonlySet<number>;
+  readonly marks: readonly number[];
+}
+
+type AdoptionCheck = (stat: IProcessStat, adoption: IAdoption) => boolean;
+
+function startedInSpawn(stat: IProcessStat, marks: readonly number[]): boolean {
+  const start: number = Number(stat.startTime);
+  return marks.some((mark: number) => start >= mark && start - mark <= SPAWN_WINDOW_TICKS);
+}
+
+// A live daemon still owns the processes it starts, and its mark may be of a spawn that is running now.
+function isDaemonGone({ ops, deadPid, deadPidReused }: IReapContext): boolean {
+  return deadPidReused || !ops.isProcessAlive(deadPid);
+}
+
+// The cheap checks come first; the last reads the process's environment.
+const ADOPTION_CHECKS: readonly AdoptionCheck[] = [
+  (stat: IProcessStat) => isGroupAndSessionLeader(stat) && !stat.exited,
+  (stat: IProcessStat, { recorded }: IAdoption) => !recorded.has(stat.pid),
+  (stat: IProcessStat, { marks }: IAdoption) => startedInSpawn(stat, marks),
+  (stat: IProcessStat, { context, marker }: IAdoption) => context.ops.hasEnvironmentEntry(stat.pid, marker)
+];
+
+/**
+ * The live processes that the dead daemon may have started without recording them, because it died during the
+ * spawn, as records to reap: each leads its own process group and session, no record names its group, it
+ * started within 1 s after one of the spawn marks left in the folder, and it carries the daemon's marker.
+ * Without a spawn mark, which is every case but a death during a spawn, no process is read; nor while the
+ * daemon's pid is alive and not reused.
+ */
+export function adoptUnrecordedOperationGroups(
+  context: IReapContext,
+  { folder, records, marker }: IOperationGroupAdoptionScope
+): IOperationGroupRecord[] {
+  const marks: number[] = readSpawnMarks(folder);
+  if (marks.length === NO_MARKS || !isDaemonGone(context)) return [];
+  const recorded: Set<number> = new Set(records.map((record: IOperationGroupRecord) => record.groupId));
+  const adoption: IAdoption = { context, marker, recorded, marks };
+  return context.ops
+    .listProcesses()
+    .filter((stat: IProcessStat) => ADOPTION_CHECKS.every((check: AdoptionCheck) => check(stat, adoption)))
+    .map((stat: IProcessStat) => ({ groupId: stat.pid, startTime: stat.startTime }));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
index 5308ab850a..691967f89d 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupReaper.ts
@@ -3,6 +3,7 @@
 
 import { terminateProcessGroupsAsync } from './DaemonGroupTermination';
 import type { DaemonOrphanReapOutcome } from './DaemonGroupTermination';
+import { adoptUnrecordedOperationGroups } from './DaemonOperationGroupAdoption';
 import { reportOperationGroupsLeftRunning } from './DaemonOperationGroupLeftRunning';
 import { getOperationGroupsMarker } from './DaemonOperationGroupMarker';
 import { isProvenOperationGroup } from './DaemonOperationGroupProof';
@@ -44,7 +45,8 @@ async function reapRecordedGroupsAsync(
   const records: IOperationGroupRecord[] = readOperationGroupRecords(folder);
   // The termination polls the groups itself, and never through these reads.
   const probe: IReapContext = withProcessReadsOnce(context);
-  const proven: IOperationGroupRecord[] = records.filter((record: IOperationGroupRecord) =>
+  const adopted: IOperationGroupRecord[] = adoptUnrecordedOperationGroups(probe, { folder, records, marker });
+  const proven: IOperationGroupRecord[] = [...records, ...adopted].filter((record: IOperationGroupRecord) =>
     isProvenOperationGroup(record, probe, marker)
   );
   const groupIds: number[] = proven.map((record: IOperationGroupRecord) => record.groupId);
@@ -72,6 +74,9 @@ async function reapRecordedGroupsAsync(
  * condition that the group fails, judged on what the proof read of it. A daemon from a release before that
  * marker sets none, so the first reclaim after an upgrade drops its recorded groups whose leader has exited
  * and leaves them running.
+ * A daemon that died while starting a `detached` child left a spawn mark in the folder. Then a live process with
+ * no record is proven and signaled as if recorded when it leads its own group and session, started within 1 s
+ * after the mark, and carries the marker. Without a spawn mark, no other process is read.
  * Records survive a failed reap, so the next reclaim retries.
  * A record folder that is a symbolic link, or that another user owns, is left alone without a signal.
  * Call only under the reclaim mutex, after the daemon has been proven dead, or its pid proven reused
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
index 5763a23327..8b892b15bd 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupRecorder.ts
@@ -12,13 +12,13 @@ import {
   writeOperationGroupRecord
 } from './DaemonOperationGroups';
 import type { IOperationGroupRecord } from './DaemonOperationGroups';
-import { readProcessStat } from './DaemonProcessStat';
+import { recordOnSpawn } from './DaemonOperationGroupSpawnHook';
+import { isGroupAndSessionLeader, readProcessStat } from './DaemonProcessStat';
 import type { IProcessStat } from './DaemonProcessStat';
 
 // Node publishes every new ChildProcess on this built-in channel (since v16.18; built-in channels are
 // experimental). If it ever stops publishing, nothing is recorded and reclaim falls back to the daemon group.
 const CHILD_PROCESS_CHANNEL: string = 'child_process';
-const SPAWN_EVENT: string = 'spawn';
 const EXIT_EVENT: string = 'exit';
 
 interface IChildProcessMessage {
@@ -36,14 +36,10 @@ function bestEffort(action: () => void): void {
   }
 }
 
-// A `detached` child (SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX) leads its own group and session,
-// so it is outside the daemon's process group and needs a record of its own.
-function isGroupAndSessionLeader(stat: IProcessStat | undefined): stat is IProcessStat {
-  return stat !== undefined && stat.groupId === stat.pid && stat.sessionId === stat.pid;
-}
-
 function recordWhileRunning(child: ChildProcess, folder: string): void {
-  // 'spawn' is emitted on the next tick after exec, before the child can be reaped, so its pid is still its own.
+  // Right after the spawn, or on 'spawn' one tick later: either way before the child can be reaped, so its pid is
+  // still its own. A `detached` child (SubprocessTerminator.RECOMMENDED_OPTIONS on POSIX) leads its own group
+  // and session, so it is outside the daemon's process group and needs a record of its own.
   const stat: IProcessStat | undefined = child.pid === undefined ? undefined : readProcessStat(child.pid);
   if (!isGroupAndSessionLeader(stat)) return;
   const record: IOperationGroupRecord = { groupId: stat.pid, startTime: stat.startTime };
@@ -57,6 +53,9 @@ function recordWhileRunning(child: ChildProcess, folder: string): void {
  *
  * @remarks
  * Linux only: records need `/proc` start times to rule out pid reuse. Elsewhere this records nothing.
+ * A child is recorded as soon as Node's spawn has started it, before any other code runs. While a `detached`
+ * child is being started, `folder` also holds a spawn mark, so a successor can stop a child that this daemon
+ * died while starting, before its record was written (see `reapDeadDaemonOperationGroupsAsync`).
  * While it records, `process.env` carries `RUSHD_OPERATION_GROUPS` set to `folder`, which every process
  * started from then on inherits unless it is given an environment without it; a successor signals a recorded
  * group whose leader has exited only when one of its live members carries it.
@@ -66,7 +65,7 @@ export function startOperationGroupRecording(folder: string): StopOperationGroup
   const unmark: UnmarkOperationGroups = markOperationGroups(folder);
   const onChildProcess = (message: unknown): void => {
     const child: ChildProcess = (message as IChildProcessMessage).process;
-    child.once(SPAWN_EVENT, () => recordWhileRunning(child, folder));
+    recordOnSpawn(child, { folder, record: () => recordWhileRunning(child, folder) });
   };
   diagnosticsChannel.subscribe(CHILD_PROCESS_CHANNEL, onChildProcess);
   return () => {
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts
new file mode 100644
index 0000000000..fe0cd6fdaa
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnHook.ts
@@ -0,0 +1,62 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+
+import { withSpawnMark } from './DaemonOperationGroupSpawnMark';
+
+const SPAWN_METHOD: string = 'spawn';
+const SPAWN_EVENT: string = 'spawn';
+
+/** The record folder in which a spawn in flight is marked, and how to record the child once it has a pid. */
+export interface ISpawnRecording {
+  readonly folder: string;
+  readonly record: () => void;
+}
+
+interface ISpawnOptions {
+  readonly detached?: unknown;
+}
+
+// Node's spawn functions construct the ChildProcess, which publishes it, and then call `child.spawn(options)`,
+// which starts the process and sets `child.pid`. An own property of the instance runs instead of the prototype's
+// method, once: it removes itself first.
+function hookSpawnMethod(child: ChildProcess, { folder, record }: ISpawnRecording): void {
+  const spawnMethod: unknown = Reflect.get(child, SPAWN_METHOD);
+  if (typeof spawnMethod !== 'function') return;
+  const spawnAndRecord = (options: ISpawnOptions | undefined): unknown => {
+    Reflect.deleteProperty(child, SPAWN_METHOD);
+    return withSpawnMark(folder, options?.detached === true, () => {
+      const result: unknown = Reflect.apply(spawnMethod, child, [options]);
+      record();
+      return result;
+    });
+  };
+  Reflect.defineProperty(child, SPAWN_METHOD, { configurable: true, writable: true, value: spawnAndRecord });
+}
+
+// A lost record only means that the child is not reaped if this process dies uncleanly. A throw would instead
+// reach whoever called Node's spawn function, after the child had started, or leave the 'spawn' listener.
+function tryRecord(recording: Pick<ISpawnRecording, 'record'>): void {
+  try {
+    recording.record();
+  } catch {
+    // See above.
+  }
+}
+
+/**
+ * Calls `record` once for `child`, which was just published on the `child_process` channel: right after Node
+ * has started it, before any other code can run, or else on its `'spawn'` event, one tick later. A throw from
+ * `record` is dropped.
+ */
+export function recordOnSpawn(child: ChildProcess, recording: ISpawnRecording): void {
+  let recorded: boolean = false;
+  const recordOnce = (): void => {
+    if (recorded) return;
+    recorded = true;
+    tryRecord(recording);
+  };
+  hookSpawnMethod(child, { folder: recording.folder, record: recordOnce });
+  child.once(SPAWN_EVENT, recordOnce);
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts
new file mode 100644
index 0000000000..8038533fc7
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroupSpawnMark.ts
@@ -0,0 +1,72 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { readFolderNames, writeOperationGroupsEntry } from './DaemonOperationGroups';
+
+const PROC_UPTIME: string = '/proc/uptime';
+const UTF8: BufferEncoding = 'utf8';
+// "<seconds>.<hundredths> <idle seconds>": the kernel always prints two digits after the point.
+const UPTIME_PATTERN: RegExp = /^(\d+)\.(\d\d) /;
+const SECONDS_MATCH: number = 1;
+const HUNDREDTHS_MATCH: number = 2;
+// USER_HZ, the unit of a `/proc` stat start time, is 100 on every Linux architecture that Node runs on.
+const TICKS_PER_SECOND: number = 100;
+const MARK_PREFIX: string = 'spawn-';
+const MARK_NAME_PATTERN: RegExp = /^spawn-(\d+)$/;
+const TICKS_MATCH: number = 1;
+
+/**
+ * The clock ticks since boot, from `/proc/uptime`. Both it and a `/proc` stat start time count the boot-time
+ * clock and truncate, so a process forked after this read has a start time at least this value. Throws when
+ * `/proc/uptime` cannot be read.
+ */
+export function readUptimeTicks(): number {
+  const match: RegExpExecArray | null = UPTIME_PATTERN.exec(fs.readFileSync(PROC_UPTIME, UTF8));
+  if (!match) throw new Error(`${PROC_UPTIME} has an unexpected format`);
+  return Number(match[SECONDS_MATCH]) * TICKS_PER_SECOND + Number(match[HUNDREDTHS_MATCH]);
+}
+
+// Without a mark, only a child that this daemon dies while starting goes without a reap.
+function tryWriteSpawnMark(folder: string): string | undefined {
+  try {
+    const markPath: string = path.join(folder, `${MARK_PREFIX}${readUptimeTicks()}`);
+    writeOperationGroupsEntry(markPath);
+    return markPath;
+  } catch {
+    return undefined;
+  }
+}
+
+// A mark left behind only lets a later reap also consider the children that started just after it.
+function tryRemoveSpawnMark(markPath: string): void {
+  try {
+    fs.rmSync(markPath, { force: true });
+  } catch {
+    // See above.
+  }
+}
+
+/**
+ * Runs `spawn`, which starts a child and records it; when `detached`, between writing a spawn mark in `folder`
+ * and removing it. So if this process dies while it starts a child that leads its own process group, before the
+ * child is recorded, the mark is left (see {@link readSpawnMarks}).
+ */
+export function withSpawnMark<T>(folder: string, detached: boolean, spawn: () => T): T {
+  const markPath: string | undefined = detached ? tryWriteSpawnMark(folder) : undefined;
+  try {
+    return spawn();
+  } finally {
+    if (markPath !== undefined) tryRemoveSpawnMark(markPath);
+  }
+}
+
+/** The clock ticks since boot (see {@link readUptimeTicks}) at which the spawns marked in `folder` began. */
+export function readSpawnMarks(folder: string): number[] {
+  return readFolderNames(folder).flatMap((name: string) => {
+    const match: RegExpExecArray | null = MARK_NAME_PATTERN.exec(name);
+    return match ? [Number(match[TICKS_MATCH])] : [];
+  });
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
index 114459d26b..803b3ccae8 100644
--- a/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
+++ b/libraries/rush-daemon-transport/src/DaemonOperationGroups.ts
@@ -30,10 +30,15 @@ function getRecordPath(folder: string, record: IOperationGroupRecord): string {
   return path.join(folder, `${record.groupId}${NAME_SEPARATOR}${record.startTime}`);
 }
 
+/** Writes the empty file `entryPath`, creating its sidecar folder first; for records and spawn marks. */
+export function writeOperationGroupsEntry(entryPath: string): void {
+  fs.mkdirSync(path.dirname(entryPath), { recursive: true, mode: DIR_MODE });
+  fs.writeFileSync(entryPath, EMPTY_FILE, { mode: FILE_MODE });
+}
+
 /** Records a running group as an empty file whose name is the record, so no record is ever half-written. */
 export function writeOperationGroupRecord(folder: string, record: IOperationGroupRecord): void {
-  fs.mkdirSync(folder, { recursive: true, mode: DIR_MODE });
-  fs.writeFileSync(getRecordPath(folder, record), EMPTY_FILE, { mode: FILE_MODE });
+  writeOperationGroupsEntry(getRecordPath(folder, record));
 }
 
 /** Forgets a group whose leader has exited. */
@@ -50,7 +55,8 @@ function isRecord(record: IOperationGroupRecord | undefined): record is IOperati
   return record !== undefined;
 }
 
-function readFolderNames(folder: string): string[] {
+/** The names of the entries in `folder`; none when it is missing or unreadable. */
+export function readFolderNames(folder: string): string[] {
   try {
     return fs.readdirSync(folder);
   } catch {
diff --git a/libraries/rush-daemon-transport/src/DaemonOwnGroup.ts b/libraries/rush-daemon-transport/src/DaemonOwnGroup.ts
new file mode 100644
index 0000000000..2663c0d570
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonOwnGroup.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const PROC_SELF_STAT: string = '/proc/self/stat';
+const UTF8: BufferEncoding = 'utf8';
+const COMM_END: string = ')';
+const FIELD_SEPARATOR: string = ' ';
+// After the ")" that ends the command name come: " <state> <ppid> <pgrp> ...".
+const PGRP_FIELD_INDEX: number = 3;
+
+/** This process's own process group id, or `undefined` when the platform cannot report it. */
+export function ownGroupId(): number | undefined {
+  try {
+    const stat: string = fs.readFileSync(PROC_SELF_STAT, UTF8);
+    const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
+    return Number(fields[PGRP_FIELD_INDEX]);
+  } catch {
+    return undefined;
+  }
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
index fa3a997bf3..48173b8d7a 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessGroup.ts
@@ -6,17 +6,14 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 
 import { hasLiveGroupMember, mayHaveGroupMembers } from './DaemonGroupMemberScan';
 import { isDaemonProcessAlive } from './DaemonLockfile';
-import { hasEnvironmentEntry, listLiveGroupMembers, readProcessStat } from './DaemonProcessStat';
+import { ownGroupId } from './DaemonOwnGroup';
+import { listLiveGroupMembers, listProcesses } from './DaemonProcessList';
+import { hasEnvironmentEntry, readProcessStat } from './DaemonProcessStat';
 import type { IProcessStat } from './DaemonProcessStat';
 
 const NO_SIGNAL: number = 0;
 const NO_SUCH_PROCESS: string = 'ESRCH';
 const PROC_SELF_STAT: string = '/proc/self/stat';
-const UTF8: BufferEncoding = 'utf8';
-const COMM_END: string = ')';
-const FIELD_SEPARATOR: string = ' ';
-// After the ")" that ends the command name come: " <state> <ppid> <pgrp> ...".
-const PGRP_FIELD_INDEX: number = 3;
 
 /** Process probing/signaling used to reap a dead daemon's orphaned process groups; injectable for tests. */
 export interface IDaemonProcessGroupOps {
@@ -32,6 +29,8 @@ export interface IDaemonProcessGroupOps {
   readonly readProcessStat: (pid: number) => IProcessStat | undefined;
   /** The processes in a group that have not exited. */
   readonly listLiveGroupMembers: (groupId: number) => IProcessStat[];
+  /** Every process's `/proc` identity, zombies included; none where there is no `/proc`. */
+  readonly listProcesses: () => IProcessStat[];
   readonly hasEnvironmentEntry: (pid: number, entry: string) => boolean;
   readonly delayAsync: (ms: number) => Promise<void>;
   readonly now: () => number;
@@ -68,16 +67,6 @@ function signalGroup(groupId: number, signal: NodeJS.Signals): void {
   }
 }
 
-function ownGroupId(): number | undefined {
-  try {
-    const stat: string = fs.readFileSync(PROC_SELF_STAT, UTF8);
-    const fields: string[] = stat.slice(stat.lastIndexOf(COMM_END)).split(FIELD_SEPARATOR);
-    return Number(fields[PGRP_FIELD_INDEX]);
-  } catch {
-    return undefined;
-  }
-}
-
 function log(message: string): void {
   process.emitWarning(message, { code: 'RUSH_DAEMON_ORPHANS_REAPED' });
 }
@@ -91,6 +80,7 @@ export const POSIX_PROCESS_GROUP_OPS: IDaemonProcessGroupOps = {
   ownGroupId,
   readProcessStat,
   listLiveGroupMembers,
+  listProcesses,
   hasEnvironmentEntry,
   delayAsync: async (ms: number) => {
     await delayAsync(ms);
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessList.ts b/libraries/rush-daemon-transport/src/DaemonProcessList.ts
new file mode 100644
index 0000000000..9ab0ac769f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/DaemonProcessList.ts
@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+import { isLiveMemberOf, readProcessStat } from './DaemonProcessStat';
+import type { IProcessStat } from './DaemonProcessStat';
+
+const PROC_ROOT: string = '/proc';
+const PID_PATTERN: RegExp = /^\d+$/;
+
+/** Lists the pids in `/proc`; throws when `/proc` cannot be listed. */
+export function readProcessIds(): number[] {
+  return fs
+    .readdirSync(PROC_ROOT)
+    .filter((name: string) => PID_PATTERN.test(name))
+    .map(Number);
+}
+
+function listProcessIds(): number[] {
+  try {
+    return readProcessIds();
+  } catch {
+    return [];
+  }
+}
+
+function isReadable(stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined;
+}
+
+/** Reads the `/proc` record of every process, zombies included; none when `/proc` cannot be listed. */
+export function listProcesses(): IProcessStat[] {
+  return listProcessIds().map(readProcessStat).filter(isReadable);
+}
+
+/** Lists the processes of group `groupId` that have not exited, by scanning `/proc`. */
+export function listLiveGroupMembers(groupId: number): IProcessStat[] {
+  return listProcessIds()
+    .map(readProcessStat)
+    .filter((stat: IProcessStat | undefined): stat is IProcessStat => isLiveMemberOf(groupId, stat));
+}
diff --git a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
index db32b01841..e7b4e09d0b 100644
--- a/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
+++ b/libraries/rush-daemon-transport/src/DaemonProcessStat.ts
@@ -10,7 +10,6 @@ const ENTRY_TERMINATOR: string = '\0';
 const UTF8: BufferEncoding = 'utf8';
 const COMM_END: string = ')';
 const FIELD_SEPARATOR: string = ' ';
-const PID_PATTERN: RegExp = /^\d+$/;
 // Indices into the fields after the ")" that ends the command name (proc_pid_stat(5)):
 // ") <state> <ppid> <pgrp> <session> ...", where starttime is field 22 of the whole record.
 const STATE_INDEX: number = 1;
@@ -61,27 +60,12 @@ export function isLiveMemberOf(groupId: number, stat: IProcessStat | undefined):
   return stat !== undefined && stat.groupId === groupId && !stat.exited;
 }
 
-/** Lists the pids in `/proc`; throws when `/proc` cannot be listed. */
-export function readProcessIds(): number[] {
-  return fs
-    .readdirSync(PROC_ROOT)
-    .filter((name: string) => PID_PATTERN.test(name))
-    .map(Number);
-}
-
-function listProcessIds(): number[] {
-  try {
-    return readProcessIds();
-  } catch {
-    return [];
-  }
-}
-
-/** Lists the processes of group `groupId` that have not exited, by scanning `/proc`. */
-export function listLiveGroupMembers(groupId: number): IProcessStat[] {
-  return listProcessIds()
-    .map(readProcessStat)
-    .filter((stat: IProcessStat | undefined): stat is IProcessStat => isLiveMemberOf(groupId, stat));
+/**
+ * `true` when `stat` is the record of a process that leads its own process group and session, as a `detached`
+ * child does (`SubprocessTerminator.RECOMMENDED_OPTIONS` on POSIX).
+ */
+export function isGroupAndSessionLeader(stat: IProcessStat | undefined): stat is IProcessStat {
+  return stat !== undefined && stat.groupId === stat.pid && stat.sessionId === stat.pid;
 }
 
 /**
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts
new file mode 100644
index 0000000000..04ae6870df
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessReadErrors.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '../DaemonOperationGroupMarker';
+import { listProcesses } from '../DaemonProcessList';
+import { hasEnvironmentEntry } from '../DaemonProcessStat';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// Another user's process: its environment can't be read (EACCES), unless the tests run as root.
+const INIT_PID: number = 1;
+// Linux caps pid_max at 2^22, so this pid never exists (ENOENT).
+const IMPOSSIBLE_PID: number = 4194305;
+const ENTRY: string = `${DAEMON_OPERATION_GROUPS_ENV_VAR}=/nonexistent/rushd-read-errors`;
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+// Fails every read of `/proc/<pid>/stat` as a process that exits during a scan, or is hidden, would.
+function failStatReadsOf(pid: number): void {
+  const statPath: string = `/proc/${pid}/stat`;
+  const { readFileSync } = fs;
+  jest.spyOn(fs, 'readFileSync').mockImplementation(((
+    ...args: Parameters<typeof readFileSync>
+  ): string | Buffer => {
+    const [file] = args;
+    if (file === statPath) throw Object.assign(new Error(`ENOENT: ${statPath}`), { code: 'ENOENT' });
+    return readFileSync(...args);
+  }) as typeof readFileSync);
+}
+
+linuxIt('lists every process but one whose /proc record cannot be read, without throwing', () => {
+  failStatReadsOf(process.ppid);
+  const pids: number[] = listProcesses().map((stat: IProcessStat) => stat.pid);
+  expect({ self: pids.includes(process.pid), parent: pids.includes(process.ppid) }).toEqual({
+    self: true,
+    parent: false
+  });
+});
+
+linuxIt('reads an environment that cannot be read as not holding the entry, without throwing', () => {
+  expect([hasEnvironmentEntry(INIT_PID, ENTRY), hasEnvironmentEntry(IMPOSSIBLE_PID, ENTRY)]).toEqual([
+    false,
+    false
+  ]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts b/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
index fdb0bd95b5..dc83d26de8 100644
--- a/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
+++ b/libraries/rush-daemon-transport/src/test/DaemonProcessStat.test.ts
@@ -2,21 +2,27 @@
 // See LICENSE in the project root for license information.
 
 import { spawn } from 'node:child_process';
-import type { ChildProcess } from 'node:child_process';
+import type { ChildProcess, ChildProcessByStdio } from 'node:child_process';
 import { once } from 'node:events';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import type { Readable } from 'node:stream';
 
 import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
-import { listLiveGroupMembers, readProcessStat } from '../DaemonProcessStat';
+import { listLiveGroupMembers, listProcesses } from '../DaemonProcessList';
+import { readProcessStat } from '../DaemonProcessStat';
 import type { IProcessStat } from '../DaemonProcessStat';
 
+import { waitUntilAsync } from './ProcessWaitFixture';
+
 const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
 // Linux caps pid_max at 2^22, so this pid never exists.
 const IMPOSSIBLE_PID: number = 4194305;
 const SLEEP_SECONDS: string = '30';
 const DIGITS: RegExp = /^\d+$/;
+// The shell starts a 1 s sleep and then becomes a 30 s sleep, which never reaps it, so the first stays a zombie.
+const ZOMBIE_PARENT_SCRIPT: string = 'sleep 1 & echo $!; exec sleep 30';
 
 linuxIt('reads the group, session and start time of a live process', () => {
   const self: IProcessStat | undefined = readProcessStat(process.pid);
@@ -34,6 +40,27 @@ linuxIt('lists the live members of a process group', () => {
   expect(members.map((member: IProcessStat) => member.pid)).toContain(process.pid);
 });
 
+linuxIt('lists every process that has a /proc record, zombies included', async () => {
+  const parent: ChildProcessByStdio<null, Readable, null> = spawn('/bin/sh', ['-c', ZOMBIE_PARENT_SCRIPT], {
+    stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const zombiePid: number = Number(String(await once(parent.stdout, 'data')).trim());
+  const becameZombie: boolean = await waitUntilAsync(() => readProcessStat(zombiePid)?.exited === true);
+  const listed: IProcessStat[] = listProcesses().filter((stat: IProcessStat) =>
+    [process.pid, process.ppid, zombiePid].includes(stat.pid)
+  );
+  parent.kill('SIGKILL');
+  await once(parent, 'exit');
+  expect({ becameZombie, listed: listed.map(({ pid, exited }: IProcessStat) => ({ pid, exited })) }).toEqual({
+    becameZombie: true,
+    listed: expect.arrayContaining([
+      { pid: process.ppid, exited: false },
+      { pid: process.pid, exited: false },
+      { pid: zombiePid, exited: true }
+    ])
+  });
+});
+
 linuxIt('parses a command name that contains spaces and parentheses', async () => {
   const folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-stat-'));
   const executable: string = path.join(folder, 'a) b (c');
diff --git a/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts b/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
index 6a63c9e7eb..aa0566d073 100644
--- a/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
+++ b/libraries/rush-daemon-transport/src/test/FakeProcessTable.ts
@@ -57,11 +57,15 @@ function hasEnvironmentEntry(
 export function createProcessOps(
   table: IFakeProcessTable,
   daemonPid: number
-): Pick<IDaemonProcessGroupOps, 'readProcessStat' | 'listLiveGroupMembers' | 'hasEnvironmentEntry'> {
+): Pick<
+  IDaemonProcessGroupOps,
+  'readProcessStat' | 'listLiveGroupMembers' | 'listProcesses' | 'hasEnvironmentEntry'
+> {
   return {
     readProcessStat: (pid: number) => liveProcesses(table).find((stat: IProcessStat) => stat.pid === pid),
     listLiveGroupMembers: (groupId: number) =>
       liveProcesses(table).filter((stat: IProcessStat) => stat.groupId === groupId && !stat.exited),
+    listProcesses: () => [...liveProcesses(table)],
     hasEnvironmentEntry: (pid: number, entry: string) => hasEnvironmentEntry(table, daemonPid, pid, entry)
   };
 }
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts
new file mode 100644
index 0000000000..fec58e1b07
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoption.test.ts
@@ -0,0 +1,50 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { adoptUnrecordedOperationGroups } from '../DaemonOperationGroupAdoption';
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import { createReapContext } from '../DaemonReapOptions';
+
+import {
+  AT_MARK,
+  AT_WINDOW_END,
+  MARK,
+  RECORD,
+  RECORDED,
+  WINDOW_END,
+  createMarkedFolder
+} from './OperationGroupAdoptionFixture';
+import type { IMarkedFolder } from './OperationGroupAdoptionFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+
+it('adopts only unrecorded group and session leaders with the marker, started within 1 s after a mark', () => {
+  const { folder, fake }: IMarkedFolder = createMarkedFolder(MARK);
+  const adopted: IOperationGroupRecord[] = adoptUnrecordedOperationGroups(
+    createReapContext(DEAD_PID, fake.options),
+    { folder, records: [RECORD], marker: getOperationGroupsMarker(folder) }
+  );
+  expect(adopted).toEqual([
+    { groupId: AT_MARK, startTime: String(MARK) },
+    { groupId: AT_WINDOW_END, startTime: String(WINDOW_END) }
+  ]);
+});
+
+it('signals each recorded or adopted group once', async () => {
+  const { lockfilePath, fake }: IMarkedFolder = createMarkedFolder(MARK);
+  await expect(reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, fake.options)).resolves.toBe(
+    'terminated'
+  );
+  expect(fake.targets).toEqual([RECORDED, AT_MARK, AT_WINDOW_END]);
+});
+
+it('reads no process list without a spawn mark', async () => {
+  const { lockfilePath, fake }: IMarkedFolder = createMarkedFolder(undefined);
+  const listProcesses: jest.Mock = jest.fn(() => []);
+  const ops: IDaemonProcessGroupOps = { ...(fake.options.ops as IDaemonProcessGroupOps), listProcesses };
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, { ...fake.options, ops });
+  expect(listProcesses).not.toHaveBeenCalled();
+  expect(fake.targets).toEqual([RECORDED]);
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts
new file mode 100644
index 0000000000..6281949e91
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionEdges.test.ts
@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { AT_MARK, MARK, leader, markName } from './OperationGroupAdoptionFixture';
+import type { IAdoptionScene } from './OperationGroupAdoptionFixture';
+import { adoptAndReapAsync } from './OperationGroupAdoptionRun';
+import type { IAdoptionRun } from './OperationGroupAdoptionRun';
+import { SELF_PID } from './OrphanReaperFixture';
+
+const OWN_GROUP: number = 1500;
+const LATER_MARK: number = 7000;
+const LATER_IN_WINDOW: number = 7100;
+const BETWEEN_MARKS: number = 6000;
+const EARLY_START: number = 50;
+const AT_LATER_MARK: number = 8001;
+const IN_LATER_WINDOW: number = 8002;
+const BETWEEN: number = 8003;
+const EARLY: number = 8004;
+// Names that are not a spawn mark's; a pattern without its end anchor, or with no digit, would read 0 or 12.
+const BAD_MARK_NAMES: string[] = ['spawn-', 'spawn-abc', 'spawn-12x'];
+
+it("never signals the reaper's own process or its own group, which it would otherwise adopt", async () => {
+  const run: IAdoptionRun = await adoptAndReapAsync({
+    markNames: [markName(MARK)],
+    processes: [leader(SELF_PID, MARK), leader(OWN_GROUP, MARK), leader(AT_MARK, MARK)],
+    ownGroupId: OWN_GROUP
+  });
+  expect(run).toEqual({ adopted: [SELF_PID, OWN_GROUP, AT_MARK], scanned: true, signaled: [AT_MARK] });
+});
+
+it('reads no process for a spawn mark whose name is not a clock tick, and throws nothing', async () => {
+  const run: IAdoptionRun = await adoptAndReapAsync({
+    markNames: BAD_MARK_NAMES,
+    processes: [leader(EARLY, EARLY_START)]
+  });
+  expect(run).toEqual({ adopted: [], scanned: false, signaled: [] });
+});
+
+it('adopts the processes started within 1 s after any of the spawn marks', async () => {
+  const run: IAdoptionRun = await adoptAndReapAsync({
+    markNames: [markName(MARK), markName(LATER_MARK)],
+    processes: [
+      leader(AT_LATER_MARK, LATER_MARK),
+      leader(IN_LATER_WINDOW, LATER_IN_WINDOW),
+      leader(BETWEEN, BETWEEN_MARKS)
+    ]
+  });
+  const adopted: number[] = [AT_LATER_MARK, IN_LATER_WINDOW];
+  expect(run).toEqual({ adopted, scanned: true, signaled: adopted });
+});
+
+it("reads no process while the dead daemon's pid is alive, unless another process has reused it", async () => {
+  const scene: IAdoptionScene = {
+    markNames: [markName(MARK)],
+    processes: [leader(AT_MARK, MARK)],
+    daemonAlive: true
+  };
+  const alive: IAdoptionRun = await adoptAndReapAsync(scene);
+  const reused: IAdoptionRun = await adoptAndReapAsync(scene, true);
+  expect({ alive, reused }).toEqual({
+    alive: { adopted: [], scanned: false, signaled: [] },
+    reused: { adopted: [AT_MARK], scanned: true, signaled: [AT_MARK] }
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts
new file mode 100644
index 0000000000..65b6348617
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionFixture.ts
@@ -0,0 +1,99 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { getOperationGroupsFolder, writeOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IProcessStat } from '../DaemonProcessStat';
+
+import { DEAD_PID, createFakeGroup } from './OrphanReaperFixture';
+import type { IFakeGroup, IFakeGroupSpec } from './OrphanReaperFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+/** The clock tick of the spawn mark that {@link createMarkedFolder} writes. */
+export const MARK: number = 5000;
+const IN_WINDOW: number = 5050;
+/** The last tick of the 1 s after {@link MARK}. */
+export const WINDOW_END: number = 5100;
+const ONE_TICK: number = 1;
+/** A marker-carrying leader started at the mark. */
+export const AT_MARK: number = 7001;
+/** A marker-carrying leader started at the end of the window. */
+export const AT_WINDOW_END: number = 7002;
+const BEFORE_MARK: number = 7003;
+const AFTER_WINDOW: number = 7004;
+const NO_MARKER: number = 7005;
+const OTHER_MARKER: number = 7006;
+const NOT_GROUP_LEADER: number = 7007;
+const NOT_SESSION_LEADER: number = 7008;
+const ZOMBIE: number = 7009;
+/** A marker-carrying leader started in the window, which the dead daemon recorded. */
+export const RECORDED: number = 7010;
+const OTHER_GROUP: number = 7070;
+const OTHER_SESSION: number = 7080;
+const OTHER_FOLDER: string = `/nonexistent/other.pid.json.groups-${DEAD_PID}`;
+const EMPTY_FILE: string = '';
+
+/** A process that leads its own group and session, started at clock tick `start`. */
+export function leader(pid: number, start: number, exited: boolean = false): IProcessStat {
+  return { pid, groupId: pid, sessionId: pid, startTime: String(start), exited };
+}
+
+/** The name of a spawn mark at clock tick `tick`. */
+export function markName(tick: number): string {
+  return `spawn-${tick}`;
+}
+
+// One process per condition of an adoption; only AT_MARK and AT_WINDOW_END meet them all.
+const TABLE: readonly IProcessStat[] = [
+  leader(AT_MARK, MARK),
+  leader(AT_WINDOW_END, WINDOW_END),
+  leader(BEFORE_MARK, MARK - ONE_TICK),
+  leader(AFTER_WINDOW, WINDOW_END + ONE_TICK),
+  leader(NO_MARKER, IN_WINDOW),
+  leader(OTHER_MARKER, IN_WINDOW),
+  { ...leader(NOT_GROUP_LEADER, IN_WINDOW), groupId: OTHER_GROUP, sessionId: OTHER_GROUP },
+  { ...leader(NOT_SESSION_LEADER, IN_WINDOW), sessionId: OTHER_SESSION },
+  leader(ZOMBIE, IN_WINDOW, true),
+  leader(RECORDED, IN_WINDOW)
+];
+// NO_MARKER's environment has no marker, or can't be read; OTHER_MARKER carries another daemon folder's marker.
+const TABLE_MARKERS: ReadonlyMap<number, string | undefined> = new Map([
+  [NO_MARKER, undefined],
+  [OTHER_MARKER, getOperationGroupsMarker(OTHER_FOLDER)]
+]);
+
+/** The dead daemon's record of {@link RECORDED}. */
+export const RECORD: IOperationGroupRecord = { groupId: RECORDED, startTime: String(IN_WINDOW) };
+
+/** A dead daemon's record folder, and the fake process table of its processes. */
+export interface IMarkedFolder {
+  readonly lockfilePath: string;
+  readonly folder: string;
+  readonly fake: IFakeGroup;
+}
+
+/** The entries of a dead daemon's record folder, and its fake process table, in which SIGTERM ends every group. */
+export interface IAdoptionScene extends Omit<IFakeGroupSpec, 'exitsOn'> {
+  readonly markNames: readonly string[];
+  readonly records?: readonly IOperationGroupRecord[];
+}
+
+/** Creates the dead daemon's folder beside a new lockfile, with the scene's records and spawn marks. */
+export function createAdoptionFolder({ markNames, records, ...spec }: IAdoptionScene): IMarkedFolder {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  fs.mkdirSync(folder, { recursive: true });
+  records?.forEach((record: IOperationGroupRecord) => writeOperationGroupRecord(folder, record));
+  markNames.forEach((name: string) => fs.writeFileSync(path.join(folder, name), EMPTY_FILE));
+  return { lockfilePath, folder, fake: createFakeGroup({ ...spec, exitsOn: 'SIGTERM' }) };
+}
+
+/** The folder with {@link RECORD} and, unless `mark` is undefined, a spawn mark, and the table of every case. */
+export function createMarkedFolder(mark: number | undefined): IMarkedFolder {
+  const markNames: string[] = mark === undefined ? [] : [markName(mark)];
+  return createAdoptionFolder({ markNames, records: [RECORD], processes: TABLE, markers: TABLE_MARKERS });
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts
new file mode 100644
index 0000000000..8f004b9a23
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupAdoptionRun.ts
@@ -0,0 +1,48 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { adoptUnrecordedOperationGroups } from '../DaemonOperationGroupAdoption';
+import { getOperationGroupsMarker } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import type { IDaemonProcessGroupOps } from '../DaemonProcessGroup';
+import { createReapContext } from '../DaemonReapOptions';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { createAdoptionFolder } from './OperationGroupAdoptionFixture';
+import type { IAdoptionScene, IMarkedFolder } from './OperationGroupAdoptionFixture';
+import { DEAD_PID } from './OrphanReaperFixture';
+
+const NO_CALLS: number = 0;
+
+/** The groups adopted in a scene, whether the whole process table was read, and the groups its reap signaled. */
+export interface IAdoptionRun {
+  readonly adopted: number[];
+  readonly scanned: boolean;
+  readonly signaled: number[];
+}
+
+/** Adopts in the scene, and then reaps it; `deadPidReused` as the reclaim passes it. */
+export async function adoptAndReapAsync(
+  scene: IAdoptionScene,
+  deadPidReused: boolean = false
+): Promise<IAdoptionRun> {
+  const { lockfilePath, folder, fake }: IMarkedFolder = createAdoptionFolder(scene);
+  const ops: IDaemonProcessGroupOps = fake.options.ops as IDaemonProcessGroupOps;
+  const listProcesses: jest.Mock = jest.fn(ops.listProcesses);
+  const options: IDaemonOrphanReaperOptions = {
+    ...fake.options,
+    ops: { ...ops, listProcesses },
+    deadPidReused
+  };
+  const adopted: IOperationGroupRecord[] = adoptUnrecordedOperationGroups(
+    createReapContext(DEAD_PID, options),
+    { folder, records: scene.records ?? [], marker: getOperationGroupsMarker(folder) }
+  );
+  await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, options);
+  return {
+    adopted: adopted.map((record: IOperationGroupRecord) => record.groupId),
+    scanned: listProcesses.mock.calls.length > NO_CALLS,
+    signaled: [...fake.targets]
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts
new file mode 100644
index 0000000000..c95576977d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnDeath.test.ts
@@ -0,0 +1,94 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// The fake daemon records with the real recorder, except that writing a record writes the child's pid to a file
+// and SIGKILLs the daemon instead. So it dies after Node has started its detached operation, before the operation
+// has a record: whatever the recorder leaves in its folder then is all that a successor finds.
+const DYING_DAEMON_SCRIPT: string = `
+const [recorder, groups, lockfile, pidFile] = process.argv.slice(1);
+const groupsModule = require(groups);
+groupsModule.writeOperationGroupRecord = (folder, record) => {
+  require('node:fs').writeFileSync(pidFile, String(record.groupId));
+  process.kill(process.pid, 'SIGKILL');
+};
+require(recorder).startOperationGroupRecording(groupsModule.getOperationGroupsFolder(lockfile, process.pid));
+require('node:child_process').spawn('sleep', ['30'], { detached: true, stdio: 'ignore' });`;
+const PID_FILE_SUFFIX: string = '.sleeper';
+const UTF8: BufferEncoding = 'utf8';
+const GRACE_MS: number = 500;
+// Enough for the 5 s wait for the sleeper to be gone, so a failure shows what the reap did.
+const TEST_TIMEOUT_MS: number = 15000;
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface IDeadDaemon {
+  readonly daemonPid: number;
+  readonly signal: NodeJS.Signals | null;
+  readonly sleeper: number;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function runDyingDaemonAsync(lockfilePath: string): Promise<IDeadDaemon> {
+  const pidFile: string = `${lockfilePath}${PID_FILE_SUFFIX}`;
+  const modules: string[] = ['DaemonOperationGroupRecorder', 'DaemonOperationGroups'].map((name: string) =>
+    path.join(__dirname, '..', `${name}.js`)
+  );
+  const args: string[] = ['-e', DYING_DAEMON_SCRIPT, ...modules, lockfilePath, pidFile];
+  const daemon: ChildProcess = spawn(process.execPath, args, { stdio: 'ignore' });
+  const [, signal] = (await once(daemon, 'exit')) as [number | null, NodeJS.Signals | null];
+  const sleeper: number = Number(fs.readFileSync(pidFile, UTF8));
+  fs.rmSync(pidFile);
+  started = identifyStarted([sleeper]);
+  return { daemonPid: Number(daemon.pid), signal, sleeper };
+}
+
+linuxIt(
+  'reaps a detached operation whose daemon died after starting it, before recording it',
+  async () => {
+    const { lockfilePath } = createTestDaemonPaths();
+    const { daemonPid, signal, sleeper } = await runDyingDaemonAsync(lockfilePath);
+    const folder: string = getOperationGroupsFolder(lockfilePath, daemonPid);
+    const entries: string[] = fs.existsSync(folder) ? fs.readdirSync(folder) : [];
+    const reaped: (readonly number[])[] = [];
+    const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+      reaped.push(reap.processGroupIds);
+    };
+    const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, daemonPid, {
+      ...OPTIONS,
+      onOrphansReaped
+    });
+    const gone: boolean = await waitUntilAsync(() => !isAlive(sleeper));
+    expect({ signal, entries, outcome, reaped, gone }).toEqual({
+      signal: 'SIGKILL',
+      entries: [expect.stringMatching(/^spawn-\d+$/)],
+      outcome: 'terminated',
+      reaped: [[sleeper]],
+      gone: true
+    });
+  },
+  TEST_TIMEOUT_MS
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts
new file mode 100644
index 0000000000..cb93a459c6
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnFallback.test.ts
@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import * as diagnosticsChannel from 'node:diagnostics_channel';
+import { EventEmitter, once } from 'node:events';
+
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import type { StopOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import {
+  getOperationGroupsFolder,
+  readFolderNames,
+  readOperationGroupRecords
+} from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const CHILD_PROCESS_CHANNEL: string = 'child_process';
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const MISSING_COMMAND: string = '/nonexistent/rushd-spawn-test';
+const ERROR_FIELDS: string[] = ['message', 'code', 'errno', 'syscall', 'path', 'spawnargs'];
+
+interface IFailedSpawn {
+  readonly entries: string[];
+  readonly pid: number | undefined;
+  readonly error: Record<string, unknown>;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+function createFolder(): string {
+  return getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+}
+
+linuxIt("records a published child without a spawn method on its 'spawn' event", async () => {
+  // Started before the recording, so only the published stand-in below can record it.
+  const sleeper: ChildProcess = spawn(process.execPath, SLEEP_ARGS, { detached: true, stdio: 'ignore' });
+  await once(sleeper, 'spawn');
+  const pid: number = Number(sleeper.pid);
+  started = identifyStarted([pid]);
+  const folder: string = createFolder();
+  const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+  const standIn: EventEmitter & { pid: number } = Object.assign(new EventEmitter(), { pid });
+  diagnosticsChannel.channel(CHILD_PROCESS_CHANNEL).publish({ process: standIn });
+  const beforeSpawnEvent: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  standIn.emit('spawn');
+  const afterSpawnEvent: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  stop();
+  const record: IOperationGroupRecord = { groupId: pid, startTime: String(readProcessStat(pid)?.startTime) };
+  expect({ beforeSpawnEvent, afterSpawnEvent }).toEqual({ beforeSpawnEvent: [], afterSpawnEvent: [record] });
+});
+
+// A detached spawn of a missing command: the entries in `folder` right after it, and its 'error' event.
+async function spawnMissingAsync(folder: string): Promise<IFailedSpawn> {
+  const child: ChildProcess = spawn(MISSING_COMMAND, [], { detached: true, stdio: 'ignore' });
+  const entries: string[] = readFolderNames(folder);
+  const [error] = (await once(child, 'error')) as [NodeJS.ErrnoException & Record<string, unknown>];
+  const reported: Record<string, unknown> = Object.fromEntries(
+    ERROR_FIELDS.map((field: string) => [field, error[field]])
+  );
+  return { entries, pid: child.pid, error: reported };
+}
+
+linuxIt(
+  "emits the same 'error' as without recording when a detached spawn fails, with no mark or record",
+  async () => {
+    const unrecorded: IFailedSpawn = await spawnMissingAsync(createFolder());
+    const folder: string = createFolder();
+    const stop: StopOperationGroupRecording = startOperationGroupRecording(folder);
+    const recorded: IFailedSpawn = await spawnMissingAsync(folder);
+    const entriesAfterError: string[] = readFolderNames(folder);
+    stop();
+    expect(unrecorded.error.code).toBe('ENOENT');
+    expect({ recorded, entriesAfterError }).toEqual({ recorded: unrecorded, entriesAfterError: [] });
+  }
+);
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts
new file mode 100644
index 0000000000..1e9a03a7a5
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnHookSafety.test.ts
@@ -0,0 +1,86 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { once } from 'node:events';
+import type { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+
+import { SPAWNED, spawnStandIn } from './SpawnStandInFixture';
+import type { IStandInRun } from './SpawnStandInFixture';
+import { createRecordFolder, expectedSteps, stepsOf } from './SpawnStandInSteps';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// What Node's ChildProcess spawn method returns for a command that isn't found, which it reports on 'error'.
+const UV_ENOENT: number = -2;
+const PROC_UPTIME: string = '/proc/uptime';
+const EMPTY_FILE: string = '';
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+function failUptimeReads(): void {
+  const { readFileSync } = fs;
+  jest.spyOn(fs, 'readFileSync').mockImplementation(((...args: Parameters<typeof readFileSync>) => {
+    const [file] = args;
+    if (file === PROC_UPTIME) throw Object.assign(new Error(`EACCES: ${PROC_UPTIME}`), { code: 'EACCES' });
+    return readFileSync(...args);
+  }) as typeof readFileSync);
+}
+
+linuxIt(
+  'returns what the real spawn returns, and runs it once, between writing a mark and removing it',
+  () => {
+    const run: IStandInRun = spawnStandIn({ folder: createRecordFolder() });
+    expect(run.returned).toBe(SPAWNED);
+    expect(stepsOf(run)).toEqual(expectedSteps());
+  }
+);
+
+linuxIt('runs the real spawn once, and records the child, when no spawn mark can be written', () => {
+  // A file where the record folder belongs, so the mark's folder can't be created.
+  const folder: string = createRecordFolder();
+  fs.writeFileSync(folder, EMPTY_FILE);
+  expect(stepsOf(spawnStandIn({ folder }))).toEqual(expectedSteps({ marksInSpawn: [] }));
+});
+
+linuxIt(
+  'runs the real spawn once, and records the child without a mark, when /proc/uptime cannot be read',
+  () => {
+    failUptimeReads();
+    const run: IStandInRun = spawnStandIn({ folder: createRecordFolder() });
+    expect(stepsOf(run)).toEqual(expectedSteps({ marksInSpawn: [] }));
+  }
+);
+
+linuxIt('returns the child and removes the spawn mark when recording the child throws', () => {
+  const record = (): void => {
+    throw new Error('The record could not be written');
+  };
+  expect(stepsOf(spawnStandIn({ folder: createRecordFolder(), record }))).toEqual(expectedSteps());
+});
+
+linuxIt(
+  "returns a spawn's ENOENT as the real spawn does, which reports it on 'error', and leaves no mark",
+  async () => {
+    const error: Error = Object.assign(new Error('spawn /nonexistent/command ENOENT'), { code: 'ENOENT' });
+    const spawn = (child: EventEmitter): unknown => {
+      process.nextTick(() => child.emit('error', error));
+      return UV_ENOENT;
+    };
+    const run: IStandInRun = spawnStandIn({ folder: createRecordFolder(), spawn });
+    const [emitted] = (await once(run.child, 'error')) as [unknown];
+    expect(emitted).toBe(error);
+    expect(stepsOf(run)).toEqual(expectedSteps({ returned: UV_ENOENT }));
+  }
+);
+
+linuxIt('throws what the real spawn throws, without recording the child, and leaves no mark', () => {
+  const error: Error = new Error('spawn EINVAL');
+  const spawn = (): unknown => {
+    throw error;
+  };
+  const run: IStandInRun = spawnStandIn({ folder: createRecordFolder(), spawn });
+  expect(run.thrown).toBe(error);
+  expect(stepsOf(run)).toEqual(expectedSteps({ returned: undefined, thrown: error, recordCalls: 0 }));
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts
new file mode 100644
index 0000000000..6ab1302438
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkReap.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '../DaemonOperationGroupMarker';
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+import type { IDaemonOrphanReap } from '../DaemonReclaimOptions';
+
+import { DEAD_PID } from './OrphanReaperFixture';
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const PROC_UPTIME: string = '/proc/uptime';
+const UTF8: BufferEncoding = 'utf8';
+const DECIMAL_POINT: string = '.';
+const FRACTION_START: number = 0;
+const HUNDREDTHS_DIGITS: number = 2;
+const TICKS_PER_SECOND: number = 100;
+// Twice the 1 s after a mark in which a reap considers a process as started by the marked spawn.
+const LONG_BEFORE_TICKS: number = 200;
+const NO_TICKS: number = 0;
+const GRACE_MS: number = 500;
+// Enough for the 5 s wait for the sleeper to be gone, so a failure shows what the reap did.
+const TEST_TIMEOUT_MS: number = 15000;
+const SLEEP_SECONDS: string = '30';
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface IMarkedReap {
+  readonly sleeper: number;
+  readonly outcome: string;
+  readonly reaped: (readonly number[])[];
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+// The clock ticks since boot, read with this test's own parser.
+function readTicks(): number {
+  const [seconds, fraction] = fs.readFileSync(PROC_UPTIME, UTF8).split(DECIMAL_POINT);
+  return Number(seconds) * TICKS_PER_SECOND + Number(fraction.slice(FRACTION_START, HUNDREDTHS_DIGITS));
+}
+
+async function spawnMarkedSleeperAsync(folder: string): Promise<number> {
+  const env: NodeJS.ProcessEnv = { PATH: process.env.PATH, [DAEMON_OPERATION_GROUPS_ENV_VAR]: folder };
+  const sleeper: ChildProcess = spawn('sleep', [SLEEP_SECONDS], { detached: true, stdio: 'ignore', env });
+  await once(sleeper, 'spawn');
+  started = identifyStarted([Number(sleeper.pid)]);
+  return Number(sleeper.pid);
+}
+
+// Marks a spawn `ticksBefore` ticks ago in the dead daemon's folder, starts a detached sleeper with the daemon's
+// marker and no record, and reaps.
+async function reapAfterMarkAsync(ticksBefore: number): Promise<IMarkedReap> {
+  const { lockfilePath } = createTestDaemonPaths();
+  const folder: string = getOperationGroupsFolder(lockfilePath, DEAD_PID);
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(path.join(folder, `spawn-${readTicks() - ticksBefore}`), '');
+  const sleeper: number = await spawnMarkedSleeperAsync(folder);
+  const reaped: (readonly number[])[] = [];
+  const onOrphansReaped = (reap: IDaemonOrphanReap): void => {
+    reaped.push(reap.processGroupIds);
+  };
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, DEAD_PID, {
+    ...OPTIONS,
+    onOrphansReaped
+  });
+  expect(fs.existsSync(folder)).toBe(false);
+  return { sleeper, outcome, reaped };
+}
+
+linuxIt('reaps an unrecorded detached process with the marker that started just after a spawn mark', async () => {
+  const { sleeper, outcome, reaped } = await reapAfterMarkAsync(NO_TICKS);
+  const gone: boolean = await waitUntilAsync(() => !isAlive(sleeper));
+  expect({ outcome, reaped, gone }).toEqual({ outcome: 'terminated', reaped: [[sleeper]], gone: true });
+}, TEST_TIMEOUT_MS);
+
+linuxIt('never signals a process with the marker that started over 1 s after the spawn mark', async () => {
+  const { sleeper, outcome, reaped } = await reapAfterMarkAsync(LONG_BEFORE_TICKS);
+  expect({ outcome, reaped, alive: isAlive(sleeper) }).toEqual({ outcome: 'none', reaped: [], alive: true });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts
new file mode 100644
index 0000000000..9cb21476aa
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnOrder.test.ts
@@ -0,0 +1,96 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { ChildProcess, spawn } from 'node:child_process';
+import type { SpawnOptions } from 'node:child_process';
+import fs from 'node:fs';
+import * as path from 'node:path';
+
+import { startOperationGroupRecording } from '../DaemonOperationGroupRecorder';
+import { getOperationGroupsFolder, readFolderNames } from '../DaemonOperationGroups';
+import { readProcessStat } from '../DaemonProcessStat';
+
+import { identifyStarted, killStillRunning } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const SLEEP_ARGS: string[] = ['-e', 'setTimeout(() => {}, 30000)'];
+const MARK_PREFIX: string = 'spawn-';
+const MARK_PATTERN: RegExp = /^write spawn-(\d+)$/;
+const TICKS_MATCH: number = 1;
+const SPAWN_WINDOW_TICKS: number = 100;
+
+type SpawnMethod = (this: ChildProcess, options: unknown) => unknown;
+
+interface ISpawnTrace {
+  readonly child: ChildProcess;
+  /** The steps traced until `spawn()` returned. */
+  readonly steps: string[];
+  /** The spawn marks in the record folder when `spawn()` returned. */
+  readonly marksLeft: string[];
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+  jest.restoreAllMocks();
+});
+
+// Traces the writes and removals of entries in `folder`, and every call of the ChildProcess spawn method.
+function traceSpawnSteps(folder: string): string[] {
+  const steps: string[] = [];
+  const trace = (verb: string, file: unknown): void => {
+    if (String(file).startsWith(folder)) steps.push(`${verb} ${path.basename(String(file))}`);
+  };
+  const { writeFileSync, rmSync } = fs;
+  jest.spyOn(fs, 'writeFileSync').mockImplementation((...args: Parameters<typeof writeFileSync>) => {
+    const [file] = args;
+    trace('write', file);
+    writeFileSync(...args);
+  });
+  jest.spyOn(fs, 'rmSync').mockImplementation((...args: Parameters<typeof rmSync>) => {
+    const [file] = args;
+    trace('remove', file);
+    rmSync(...args);
+  });
+  const prototype: { spawn: SpawnMethod } = ChildProcess.prototype as unknown as { spawn: SpawnMethod };
+  const spawnMethod: SpawnMethod = prototype.spawn;
+  jest.spyOn(prototype, 'spawn').mockImplementation(function (this: ChildProcess, options: unknown) {
+    steps.push('spawn');
+    return spawnMethod.call(this, options);
+  });
+  return steps;
+}
+
+// Spawns a sleeper while recording in a new folder.
+function spawnTraced(options: SpawnOptions): ISpawnTrace {
+  const folder: string = getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+  const stop: () => void = startOperationGroupRecording(folder);
+  const steps: string[] = traceSpawnSteps(folder);
+  const child: ChildProcess = spawn(process.execPath, SLEEP_ARGS, options);
+  const traced: string[] = [...steps];
+  started = identifyStarted([Number(child.pid)]);
+  const marksLeft: string[] = readFolderNames(folder).filter((name: string) => name.startsWith(MARK_PREFIX));
+  stop();
+  return { child, steps: traced, marksLeft };
+}
+
+linuxIt('marks a detached spawn before it starts, and unmarks it only after the child is recorded', () => {
+  const { child, steps, marksLeft }: ISpawnTrace = spawnTraced({ detached: true, stdio: 'ignore' });
+  const start: number = Number(readProcessStat(Number(child.pid))?.startTime);
+  const [firstStep] = steps;
+  const mark: number = Number(MARK_PATTERN.exec(firstStep)?.[TICKS_MATCH]);
+  const window: boolean[] = [mark <= start, start - mark <= SPAWN_WINDOW_TICKS];
+  expect({ steps, marksLeft, window }).toEqual({
+    steps: [`write ${MARK_PREFIX}${mark}`, 'spawn', `write ${child.pid}-${start}`, `remove ${MARK_PREFIX}${mark}`],
+    marksLeft: [],
+    window: [true, true]
+  });
+});
+
+linuxIt('writes no spawn mark for a child that stays in the daemon group', () => {
+  const { steps, marksLeft }: ISpawnTrace = spawnTraced({ stdio: 'ignore' });
+  expect({ steps, marksLeft }).toEqual({ steps: ['spawn'], marksLeft: [] });
+});
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts
new file mode 100644
index 0000000000..f491902af8
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnRecord.test.ts
@@ -0,0 +1,78 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { spawn } from 'node:child_process';
+import type { ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { reapDeadDaemonOperationGroupsAsync } from '../DaemonOperationGroupReaper';
+import { getOperationGroupsFolder, readOperationGroupRecords } from '../DaemonOperationGroups';
+import type { IOperationGroupRecord } from '../DaemonOperationGroups';
+import { POSIX_PROCESS_GROUP_OPS } from '../DaemonProcessGroup';
+import { readProcessStat } from '../DaemonProcessStat';
+import type { IDaemonOrphanReaperOptions } from '../DaemonReapOptions';
+
+import { identifyStarted, isAlive, killStillRunning, waitUntilAsync } from './ProcessWaitFixture';
+import type { IStartedProcess } from './ProcessWaitFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+// The fake daemon records, starts an operation the way Rush does (`detached: true`), writes its pid, and
+// SIGKILLs itself in the same synchronous block, before Node can emit the child's 'spawn' event.
+const DYING_DAEMON_SCRIPT: string = `
+const [recorder, groups, lockfile, pidFile] = process.argv.slice(1);
+require(recorder).startOperationGroupRecording(require(groups).getOperationGroupsFolder(lockfile, process.pid));
+const child = require('node:child_process').spawn('sleep', ['30'], { detached: true, stdio: 'ignore' });
+require('node:fs').writeFileSync(pidFile, String(child.pid));
+process.kill(process.pid, 'SIGKILL');`;
+const PID_FILE_SUFFIX: string = '.sleeper';
+const UTF8: BufferEncoding = 'utf8';
+const GRACE_MS: number = 500;
+// Enough for the 5 s wait for the sleeper to be gone, so a failure shows what the reap did.
+const TEST_TIMEOUT_MS: number = 15000;
+const OPTIONS: IDaemonOrphanReaperOptions = {
+  ops: { ...POSIX_PROCESS_GROUP_OPS, isProcessAlive: () => false, log: () => undefined },
+  graceMs: GRACE_MS
+};
+
+interface IDeadDaemon {
+  readonly daemonPid: number;
+  readonly sleeper: number;
+}
+
+let started: IStartedProcess[] = [];
+afterEach(() => {
+  killStillRunning(started);
+  started = [];
+});
+
+async function runDyingDaemonAsync(lockfilePath: string): Promise<IDeadDaemon> {
+  const pidFile: string = `${lockfilePath}${PID_FILE_SUFFIX}`;
+  const modules: string[] = ['DaemonOperationGroupRecorder', 'DaemonOperationGroups'].map((name: string) =>
+    path.join(__dirname, '..', `${name}.js`)
+  );
+  const args: string[] = ['-e', DYING_DAEMON_SCRIPT, ...modules, lockfilePath, pidFile];
+  const daemon: ChildProcess = spawn(process.execPath, args, { stdio: 'ignore' });
+  await once(daemon, 'exit');
+  const sleeper: number = Number(fs.readFileSync(pidFile, UTF8));
+  fs.rmSync(pidFile);
+  started = identifyStarted([sleeper]);
+  return { daemonPid: Number(daemon.pid), sleeper };
+}
+
+function recordOf(pid: number): IOperationGroupRecord {
+  return { groupId: pid, startTime: String(readProcessStat(pid)?.startTime) };
+}
+
+linuxIt('reaps a detached operation that its daemon started in the same tick as its SIGKILL', async () => {
+  const { lockfilePath } = createTestDaemonPaths();
+  const { daemonPid, sleeper } = await runDyingDaemonAsync(lockfilePath);
+  const expected: IOperationGroupRecord = recordOf(sleeper);
+  const folder: string = getOperationGroupsFolder(lockfilePath, daemonPid);
+  const records: IOperationGroupRecord[] = readOperationGroupRecords(folder);
+  const outcome: string = await reapDeadDaemonOperationGroupsAsync(lockfilePath, daemonPid, OPTIONS);
+  const gone: boolean = await waitUntilAsync(() => !isAlive(sleeper));
+  expect({ records, outcome, gone }).toEqual({ records: [expected], outcome: 'terminated', gone: true });
+}, TEST_TIMEOUT_MS);
diff --git a/libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts b/libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts
new file mode 100644
index 0000000000..6301ec2bea
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SpawnStandInFixture.ts
@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { ChildProcess } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+
+import { readFolderNames } from '../DaemonOperationGroups';
+import { recordOnSpawn } from '../DaemonOperationGroupSpawnHook';
+
+const MARK_PREFIX: string = 'spawn-';
+const SPAWN_METHOD: string = 'spawn';
+const DETACHED: Readonly<Record<string, boolean>> = { detached: true };
+
+/** What the stand-in's own `spawn` returns, unless a test says otherwise. */
+export const SPAWNED: Readonly<Record<string, boolean>> = { spawned: true };
+
+/** What the stand-in's own `spawn` does, called on the stand-in `child`. */
+export type StandInSpawn = (child: EventEmitter) => unknown;
+
+/** What a detached spawn of a stand-in child through the recorder's hook did. */
+export interface IStandInRun {
+  readonly child: EventEmitter;
+  /** What the hooked `spawn` returned to its caller, as Node's spawn functions would get it. */
+  readonly returned?: unknown;
+  /** What the hooked `spawn` threw. */
+  readonly thrown?: unknown;
+  /** The calls of the stand-in's own `spawn`. */
+  readonly spawnCalls: number;
+  readonly recordCalls: number;
+  /** The spawn marks in the folder while the stand-in's own `spawn` ran. */
+  readonly marksInSpawn: string[];
+  /** The spawn marks in the folder after the hooked `spawn` returned or threw. */
+  readonly marksAfter: string[];
+}
+
+/** The record folder, what the stand-in's own `spawn` does, and what recording the child does. */
+export interface IStandInOptions {
+  readonly folder: string;
+  readonly spawn?: StandInSpawn;
+  readonly record?: () => void;
+}
+
+function readMarks(folder: string): string[] {
+  return readFolderNames(folder).filter((name: string) => name.startsWith(MARK_PREFIX));
+}
+
+// An instance of a new class whose prototype's `spawn` is `spawn`, as ChildProcess's prototype has Node's.
+function createStandIn(spawn: jest.Mock): EventEmitter {
+  class StandInChild extends EventEmitter {}
+  Reflect.defineProperty(StandInChild.prototype, SPAWN_METHOD, {
+    configurable: true,
+    writable: true,
+    value: spawn
+  });
+  return new StandInChild();
+}
+
+function callSpawn(child: EventEmitter): Pick<IStandInRun, 'returned' | 'thrown'> {
+  try {
+    return { returned: Reflect.apply(Reflect.get(child, SPAWN_METHOD), child, [DETACHED]) };
+  } catch (error) {
+    return { thrown: error };
+  }
+}
+
+/**
+ * Hooks a stand-in child the way the recorder hooks each published ChildProcess, and then calls its `spawn` for a
+ * detached child, the way Node's spawn functions do. No process is started.
+ */
+export function spawnStandIn({
+  folder,
+  spawn = () => SPAWNED,
+  record = () => undefined
+}: IStandInOptions): IStandInRun {
+  const marksInSpawn: string[] = [];
+  const ownSpawn: jest.Mock = jest.fn(function (this: EventEmitter): unknown {
+    marksInSpawn.push(...readMarks(folder));
+    return spawn(this);
+  });
+  const recordMock: jest.Mock = jest.fn(record);
+  const child: EventEmitter = createStandIn(ownSpawn);
+  recordOnSpawn(child as unknown as ChildProcess, { folder, record: recordMock });
+  const result: Pick<IStandInRun, 'returned' | 'thrown'> = callSpawn(child);
+  return {
+    child,
+    ...result,
+    spawnCalls: ownSpawn.mock.calls.length,
+    recordCalls: recordMock.mock.calls.length,
+    marksInSpawn,
+    marksAfter: readMarks(folder)
+  };
+}
diff --git a/libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts b/libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts
new file mode 100644
index 0000000000..35273f1d5d
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/SpawnStandInSteps.ts
@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getOperationGroupsFolder } from '../DaemonOperationGroups';
+
+import { SPAWNED } from './SpawnStandInFixture';
+import type { IStandInRun } from './SpawnStandInFixture';
+import { createTestDaemonPaths } from './TestDaemonFixture';
+
+/** What {@link IStandInRun} records of a spawn: everything but the stand-in child. */
+export type StandInSteps = Omit<IStandInRun, 'child'>;
+
+/** A new record folder of this process, which does not exist yet. */
+export function createRecordFolder(): string {
+  return getOperationGroupsFolder(createTestDaemonPaths().lockfilePath, process.pid);
+}
+
+/**
+ * What a detached spawn that works does: the real spawn runs once, between writing one spawn mark and removing it,
+ * the child is recorded once, and the hooked `spawn` returns {@link SPAWNED}; with `changes` applied.
+ */
+export function expectedSteps(changes: Partial<StandInSteps> = {}): StandInSteps {
+  const marksInSpawn: string[] = [expect.stringMatching(/^spawn-\d+$/)];
+  return { returned: SPAWNED, spawnCalls: 1, recordCalls: 1, marksInSpawn, marksAfter: [], ...changes };
+}
+
+/** The steps of `run`, without its child. */
+export function stepsOf(run: IStandInRun): StandInSteps {
+  const { returned, thrown, spawnCalls, recordCalls, marksInSpawn, marksAfter } = run;
+  return { returned, thrown, spawnCalls, recordCalls, marksInSpawn, marksAfter };
+}

From 016aa46e13ead65be27166d31aed3ac33222d71b Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:01 +0000
Subject: [PATCH 241/265] [rush-daemon] Measure the daemon's resident memory
 from VmRSS

Swarm integration step 226; original commit e8ee778207 (merge of swarm/r06-t323 at b38adbe43a).
Scope: task 323, the daemon's resident memory from VmRSS.

Brings 323 (branch swarm/r06-t323). Second agent: r02 board 8280 (RESULT board 8278, on CLAIM board 7797). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 8 of 10. Gate: ch01 GATE OK board 8659 (tree ef3ff6e78e)

Commits folded into this step (1):
- b38adbe43a rush-daemon: measure the daemon's resident memory from VmRSS

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...swarm-r06-t323-vmrss_2026-09-29-23-50.json |  10 ++
 .../rush-daemon/src/DaemonControlSession.ts   |   3 +-
 .../src/DaemonIdleGarbageCollector.ts         |  18 ++-
 .../rush-daemon/src/DaemonResidentMemory.ts   |  36 ++++++
 libraries/rush-daemon/src/WorkspaceWarmSet.ts |   3 +-
 .../test/DaemonIdleGarbageCollector.test.ts   |  14 ++-
 .../src/test/DaemonResidentMemory.test.ts     | 108 ++++++++++++++++++
 .../src/test/DaemonShutdown.test.ts           |  18 +++
 .../src/test/WorkspaceWarmSet.test.ts         |  26 +++++
 9 files changed, 222 insertions(+), 14 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r06-t323-vmrss_2026-09-29-23-50.json
 create mode 100644 libraries/rush-daemon/src/DaemonResidentMemory.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r06-t323-vmrss_2026-09-29-23-50.json b/common/changes/@rushstack/rush-daemon/swarm-r06-t323-vmrss_2026-09-29-23-50.json
new file mode 100644
index 0000000000..2b57f5bdc1
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r06-t323-vmrss_2026-09-29-23-50.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "On Linux, measure the daemon's own resident memory from `VmRSS` in `/proc/self/status` instead of `process.memoryUsage().rss`, which can be tens of megabytes off on hosts with many CPUs. This affects status probes, the warm set's memory budget and the idle garbage collection log.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon"
+}
diff --git a/libraries/rush-daemon/src/DaemonControlSession.ts b/libraries/rush-daemon/src/DaemonControlSession.ts
index 02536f5957..f3f542203f 100644
--- a/libraries/rush-daemon/src/DaemonControlSession.ts
+++ b/libraries/rush-daemon/src/DaemonControlSession.ts
@@ -38,6 +38,7 @@ import { MAX_REQUESTS_PER_CONNECTION } from './DaemonConnectionLimits';
 import { DaemonRequestDispatchError } from './DaemonRequestDispatcher';
 import { DaemonRequestUsageError } from './DaemonRequestUsageError';
 import type { DaemonRequestDispatcher } from './DaemonRequestDispatcher';
+import { readResidentMemoryBytes } from './DaemonResidentMemory';
 import { DaemonShutdownError, getRequestShutdownReason } from './DaemonShutdownError';
 import { DaemonWireRequestClient } from './DaemonWireRequestClient';
 import {
@@ -480,7 +481,7 @@ export class DaemonControlSession {
         daemonVersion: this.#options.daemonVersion,
         protocolVersion: DAEMON_PROTOCOL_VERSION,
         pid: process.pid,
-        residentMemoryBytes: process.memoryUsage().rss,
+        residentMemoryBytes: readResidentMemoryBytes(),
         workspace: this.#options.getWorkspaceStatus?.(omitWarmSet),
         installationChange: this.#options.checkInstallation?.(),
         uptimeMs: Date.now() - this.#options.startedAtMs
diff --git a/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts b/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
index ded1d235d6..d8d9fc420d 100644
--- a/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
+++ b/libraries/rush-daemon/src/DaemonIdleGarbageCollector.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+import { readResidentMemoryBytes } from './DaemonResidentMemory';
+
 const MAX_TIMER_DELAY_MS: number = 0x7fffffff;
 
 /** What one idle garbage collection returned, and how long it paused the daemon. */
@@ -106,17 +108,13 @@ export class DaemonIdleGarbageCollector implements Disposable {
 }
 
 function measureCollection(collect: () => void): IDaemonIdleGarbageCollection {
-  // Reading the resident memory can fail too, for example when the process has no file descriptor left.
-  const before: NodeJS.MemoryUsage = process.memoryUsage();
+  // Reading the memory use can fail too, for example when the process has no file descriptor left.
+  const heapUsedBytesBefore: number = process.memoryUsage().heapUsed;
+  const residentBytesBefore: number = readResidentMemoryBytes();
   const startTime: number = performance.now();
   collect();
   const durationMs: number = performance.now() - startTime;
-  const after: NodeJS.MemoryUsage = process.memoryUsage();
-  return {
-    durationMs,
-    heapUsedBytesBefore: before.heapUsed,
-    heapUsedBytesAfter: after.heapUsed,
-    residentBytesBefore: before.rss,
-    residentBytesAfter: after.rss
-  };
+  const heapUsedBytesAfter: number = process.memoryUsage().heapUsed;
+  const residentBytesAfter: number = readResidentMemoryBytes();
+  return { durationMs, heapUsedBytesBefore, heapUsedBytesAfter, residentBytesBefore, residentBytesAfter };
 }
diff --git a/libraries/rush-daemon/src/DaemonResidentMemory.ts b/libraries/rush-daemon/src/DaemonResidentMemory.ts
new file mode 100644
index 0000000000..4bc6280e85
--- /dev/null
+++ b/libraries/rush-daemon/src/DaemonResidentMemory.ts
@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+
+const PROC_SELF_STATUS: string = '/proc/self/status';
+// For example "VmRSS:\t  123456 kB"; the kernel always gives this line in kibibytes.
+const VM_RSS_LINE_PATTERN: RegExp = /^VmRSS:\s*(\d+) kB$/m;
+const BYTES_PER_KIB: number = 1024;
+
+function tryReadStatusResidentBytes(): number | undefined {
+  let status: string;
+  try {
+    status = fs.readFileSync(PROC_SELF_STATUS, 'utf8');
+  } catch {
+    return undefined;
+  }
+  const match: RegExpExecArray | null = VM_RSS_LINE_PATTERN.exec(status);
+  return match ? Number(match[1]) * BYTES_PER_KIB : undefined;
+}
+
+/**
+ * The resident memory of this process, in bytes.
+ *
+ * @remarks
+ * On Linux this is `VmRSS` from `/proc/self/status`. `process.memoryUsage().rss` reads the `rss` field of
+ * `/proc/self/stat` instead, which the kernel takes from counters that it keeps per CPU and adds up only
+ * approximately, so on a host with many CPUs it can be tens of megabytes off. Recent kernels add up `VmRSS`
+ * exactly. Elsewhere, or when `/proc/self/status` cannot be read or has no `VmRSS` line, this is
+ * `process.memoryUsage.rss()`, and it throws when that does.
+ */
+export function readResidentMemoryBytes(): number {
+  const statusBytes: number | undefined =
+    process.platform === 'linux' ? tryReadStatusResidentBytes() : undefined;
+  return statusBytes ?? process.memoryUsage.rss();
+}
diff --git a/libraries/rush-daemon/src/WorkspaceWarmSet.ts b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
index 3036769ffc..c48aed3b42 100644
--- a/libraries/rush-daemon/src/WorkspaceWarmSet.ts
+++ b/libraries/rush-daemon/src/WorkspaceWarmSet.ts
@@ -15,6 +15,7 @@ import {
 import type { IDaemonWarmSetStatus } from '@rushstack/rush-daemon-protocol';
 import { isResourceFreeNullOperationRunner } from '@microsoft/rush-lib/lib/logic/operations/NullOperationRunner';
 
+import { readResidentMemoryBytes } from './DaemonResidentMemory';
 import {
   RequestExclusivityClass,
   RequestSchedulerError,
@@ -206,7 +207,7 @@ export class WorkspaceWarmSet implements AsyncDisposable {
       if (isMeasuredMemory(bytes)) measuredRunnerMemoryBytes += bytes;
       else unmeasuredRunnerCount++;
     }
-    const daemonResidentMemoryBytes: number = process.memoryUsage().rss;
+    const daemonResidentMemoryBytes: number = readResidentMemoryBytes();
     return {
       configuration: this.#configuration,
       maintenanceState: this.#getMaintenanceState(),
diff --git a/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
index 51db354841..3e788fdf1b 100644
--- a/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonIdleGarbageCollector.test.ts
@@ -6,8 +6,10 @@ import {
   type IDaemonIdleGarbageCollection,
   type IDaemonIdleGarbageCollectorOptions
 } from '../DaemonIdleGarbageCollector';
+import * as DaemonResidentMemory from '../DaemonResidentMemory';
 
 const DELAY_MS: number = 10000;
+const MIB: number = 1024 * 1024;
 
 describe(DaemonIdleGarbageCollector.name, () => {
   let collect: jest.Mock;
@@ -103,6 +105,14 @@ describe(DaemonIdleGarbageCollector.name, () => {
   });
 
   it('reports the memory before and after the collection and the time it took', () => {
+    // The resident memory comes from readResidentMemoryBytes, and not from process.memoryUsage()'s rss.
+    let collected: boolean = false;
+    collect.mockImplementation(() => {
+      collected = true;
+    });
+    jest
+      .spyOn(DaemonResidentMemory, 'readResidentMemoryBytes')
+      .mockImplementation(() => (collected ? 200 * MIB : 300 * MIB));
     jest
       .spyOn(process, 'memoryUsage')
       .mockReturnValueOnce({ rss: 1800, heapTotal: 1500, heapUsed: 1300, external: 0, arrayBuffers: 0 })
@@ -115,8 +125,8 @@ describe(DaemonIdleGarbageCollector.name, () => {
     expect(collection).toMatchObject({
       heapUsedBytesBefore: 1300,
       heapUsedBytesAfter: 440,
-      residentBytesBefore: 1800,
-      residentBytesAfter: 600
+      residentBytesBefore: 300 * MIB,
+      residentBytesAfter: 200 * MIB
     });
     expect(collection.durationMs).toBeGreaterThanOrEqual(0);
   });
diff --git a/libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts b/libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts
new file mode 100644
index 0000000000..9f4b8e01a3
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonResidentMemory.test.ts
@@ -0,0 +1,108 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { readResidentMemoryBytes } from '../DaemonResidentMemory';
+
+const PROC_SELF_STATUS: string = '/proc/self/status';
+const FALLBACK_BYTES: number = 777_777_777;
+// As the kernel writes it: a tab after each key, and each value right-aligned in 8 columns.
+const KERNEL_STATUS: string = [
+  'Name:\tnode',
+  'VmPeak:\t 9000000 kB',
+  'VmSize:\t 8000000 kB',
+  'VmHWM:\t  700000 kB',
+  'VmRSS:\t  123456 kB',
+  'RssAnon:\t  100000 kB',
+  'RssFile:\t   20000 kB',
+  'RssShmem:\t    3456 kB',
+  'Threads:\t18',
+  ''
+].join('\n');
+
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+
+function readVmRssBytes(): number {
+  const match: RegExpExecArray | null = /^VmRSS:\s*(\d+) kB$/m.exec(fs.readFileSync(PROC_SELF_STATUS, 'utf8'));
+  return Number(match?.[1]) * 1024;
+}
+
+// Answers the reads of /proc/self/status in turn, with a text or by throwing, and passes every other read through.
+function answerStatusReads(...answers: (string | Error)[]): jest.SpyInstance {
+  const { readFileSync } = fs;
+  return jest.spyOn(fs, 'readFileSync').mockImplementation(((
+    ...args: Parameters<typeof readFileSync>
+  ): string | Buffer => {
+    const [file] = args;
+    if (file !== PROC_SELF_STATUS) return readFileSync(...args);
+    const answer: string | Error | undefined = answers.shift();
+    if (answer instanceof Error) throw answer;
+    return String(answer);
+  }) as typeof readFileSync);
+}
+
+function createReadError(code: string): NodeJS.ErrnoException {
+  return Object.assign(new Error(`${code}: cannot read ${PROC_SELF_STATUS}`), { code });
+}
+
+describe(readResidentMemoryBytes.name, () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  linuxIt('returns VmRSS, between the values read just before and just after it', () => {
+    const before: number = readVmRssBytes();
+    const bytes: number = readResidentMemoryBytes();
+    const after: number = readVmRssBytes();
+    expect(bytes).toBeGreaterThanOrEqual(Math.min(before, after));
+    expect(bytes).toBeLessThanOrEqual(Math.max(before, after));
+  });
+
+  linuxIt("reads VmRSS's line in kibibytes, from a new read on each call", () => {
+    const reads: jest.SpyInstance = answerStatusReads(
+      KERNEL_STATUS,
+      'VmHWM: 2000 kB\nVmRSS: 1500 kB\nVmSize: 9000 kB'
+    );
+    expect([readResidentMemoryBytes(), readResidentMemoryBytes()]).toEqual([126_418_944, 1_536_000]);
+    expect(reads.mock.calls.filter(([file]) => file === PROC_SELF_STATUS)).toHaveLength(2);
+  });
+
+  linuxIt(
+    'falls back to process.memoryUsage.rss() when /proc/self/status cannot be read or has no VmRSS value',
+    () => {
+      jest.spyOn(process.memoryUsage, 'rss').mockReturnValue(FALLBACK_BYTES);
+      answerStatusReads(
+        createReadError('ENOENT'),
+        createReadError('EACCES'),
+        KERNEL_STATUS.replace(/^VmRSS:.*\n/m, ''),
+        KERNEL_STATUS.replace('123456', 'abc'),
+        'garbage\n'
+      );
+      const readings: number[] = [1, 2, 3, 4, 5].map(() => readResidentMemoryBytes());
+      expect(readings).toEqual([FALLBACK_BYTES, FALLBACK_BYTES, FALLBACK_BYTES, FALLBACK_BYTES, FALLBACK_BYTES]);
+    }
+  );
+
+  it('throws when the fallback cannot read the resident memory either', () => {
+    const error: Error = new Error('EMFILE: too many open files, uv_resident_set_memory');
+    jest.spyOn(process.memoryUsage, 'rss').mockImplementation(() => {
+      throw error;
+    });
+    answerStatusReads(createReadError('EMFILE'));
+    expect(() => readResidentMemoryBytes()).toThrow(error);
+  });
+
+  it('returns process.memoryUsage.rss() on other platforms, without reading /proc', () => {
+    const platform: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
+    jest.spyOn(process.memoryUsage, 'rss').mockReturnValue(FALLBACK_BYTES);
+    const reads: jest.SpyInstance = answerStatusReads(KERNEL_STATUS);
+    Object.defineProperty(process, 'platform', { ...platform, value: 'darwin' });
+    try {
+      expect(readResidentMemoryBytes()).toBe(FALLBACK_BYTES);
+    } finally {
+      Object.defineProperty(process, 'platform', platform);
+    }
+    expect(reads.mock.calls.filter(([file]) => file === PROC_SELF_STATUS)).toHaveLength(0);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
index 953b15e05c..218870a5c1 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdown.test.ts
@@ -8,6 +8,7 @@ import * as path from 'node:path';
 import { createDaemonHello, DAEMON_PROTOCOL_VERSION } from '@rushstack/rush-daemon-protocol';
 import { readDaemonLockfile } from '@rushstack/rush-daemon-transport';
 
+import * as DaemonResidentMemory from '../DaemonResidentMemory';
 import { DaemonShutdownError } from '../DaemonShutdownError';
 import { RushDaemonHost } from '../RushDaemonHost';
 import { serveRushDaemonAsync } from '../serveRushDaemon';
@@ -15,6 +16,7 @@ import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
 import { TestWorkspaceSession } from './TestWorkspaceSession';
 
 const SHUTTING_DOWN: string = `rushd (PID ${process.pid}) shutting down: `;
+const RESIDENT_MEMORY_BYTES: number = 5_000_000_000;
 
 describe('daemon management shutdown', () => {
   let repoRoot: string;
@@ -124,4 +126,20 @@ describe('daemon management shutdown', () => {
       payload: { pid: process.pid, residentMemoryBytes: expect.any(Number) }
     });
   });
+
+  it("reports the daemon's own resident memory from readResidentMemoryBytes in status probes", async () => {
+    const readResident: jest.SpyInstance = jest
+      .spyOn(DaemonResidentMemory, 'readResidentMemoryBytes')
+      .mockReturnValue(RESIDENT_MEMORY_BYTES);
+    try {
+      await client.handshakeAsync();
+      await client.sendControlAsync({ kind: 'ping', payload: {} });
+      expect(await client.readControlAsync()).toMatchObject({
+        kind: 'pong',
+        payload: { pid: process.pid, residentMemoryBytes: RESIDENT_MEMORY_BYTES }
+      });
+    } finally {
+      readResident.mockRestore();
+    }
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index 60c9eba780..dea938f4e6 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -14,6 +14,7 @@ import {
 } from '@microsoft/rush-lib';
 import { OperationExecutionRecord } from '@microsoft/rush-lib/lib/logic/operations/OperationExecutionRecord';
 
+import * as DaemonResidentMemory from '../DaemonResidentMemory';
 import { RequestExclusivityClass } from '../RequestScheduler';
 import { getWorkspaceRequestScheduler } from '../WorkspaceRequestAdmission';
 import { WorkspaceWarmSet } from '../WorkspaceWarmSet';
@@ -333,6 +334,31 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(fixture.runs()).toEqual(['a', 'b']);
   });
 
+  it("weighs the budget against the daemon's own resident memory from readResidentMemoryBytes", async () => {
+    const { warm } = await startAsync({ ipc: true });
+    const { configuration, measuredRunnerMemoryBytes } = warm.getStatus();
+    expect(measuredRunnerMemoryBytes).toBeGreaterThan(0);
+    // The budget's last byte that the daemon itself may use, next to the measured runners.
+    const lastByte: number = configuration.warmMemoryBudgetMB * 1024 * 1024 - measuredRunnerMemoryBytes;
+    const readResident: jest.SpyInstance = jest.spyOn(DaemonResidentMemory, 'readResidentMemoryBytes');
+    try {
+      readResident.mockReturnValue(lastByte - 1);
+      expect(warm.getStatus()).toMatchObject({
+        daemonResidentMemoryBytes: lastByte - 1,
+        measuredRunnerMemoryBytes,
+        overMemoryBudget: false
+      });
+      readResident.mockReturnValue(lastByte + 1);
+      expect(warm.getStatus()).toMatchObject({
+        daemonResidentMemoryBytes: lastByte + 1,
+        measuredRunnerMemoryBytes,
+        overMemoryBudget: true
+      });
+    } finally {
+      readResident.mockRestore();
+    }
+  });
+
   it('keeps resource-free retained results under memory pressure and idle expiry, and warns once', async () => {
     test = await WarmSetTestFixture.createAsync();
     test.configuration = { ...GENEROUS_WARM_CONFIGURATION, watch: false };

From c5cc1e6c5b9c562300dc0da2f1678e05981de607 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:01 +0000
Subject: [PATCH 242/265] [rush-daemon-transport] Test closedAfterReadingAll
 after abort() and sendFrameWrittenAsync on a closed connection

Swarm integration step 227; original commit 6dfc4646a2 (merge of o07/t333-e2i at a3913b512e).
Scope: task 333, C' on E2h's end (C = 0efecbc6f1).

Brings 333 (branch o07/t333-e2i). Second agent: o04 board 8182 (RESULT board 8180, on CLAIM board 8139). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 9 of 10. Gate: ch01 GATE OK board 8659 (tree d253b440c5)

Commits folded into this step (1):
- a3913b512e Test closedAfterReadingAll after abort() and sendFrameWrittenAsync on a closed connection

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-before-resend-tests_2026-09-30-01-03.json | 11 +++++++++++
 .../test/ClosedAfterReadingAllDiscard.test.ts | 19 +++++++++++++++++++
 .../src/test/SendAfterClose.test.ts           | 15 +++++++++++++++
 .../src/test/SendFrameWritten.test.ts         | 14 ++++++++++++++
 4 files changed, 59 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/read-all-before-resend-tests_2026-09-30-01-03.json

diff --git a/common/changes/@rushstack/rush-daemon-transport/read-all-before-resend-tests_2026-09-30-01-03.json b/common/changes/@rushstack/rush-daemon-transport/read-all-before-resend-tests_2026-09-30-01-03.json
new file mode 100644
index 0000000000..6afc10d4c5
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/read-all-before-resend-tests_2026-09-30-01-03.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Add tests: `closedAfterReadingAll` is false after `abort()` even once the connection has read the peer's end, and `sendFrameWrittenAsync` rejects when the connection aborts before the socket writes its frame, and with a `transportClosed` error on a connection that has already closed.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
index 57154308d0..e8caf89024 100644
--- a/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
+++ b/libraries/rush-daemon-transport/src/test/ClosedAfterReadingAllDiscard.test.ts
@@ -24,6 +24,25 @@ posixIt('closedAfterReadingAll is false while the connection is open, and after
   });
 });
 
+posixIt(
+  "closedAfterReadingAll is false after abort(), even once the connection has read the peer's end",
+  async () => {
+    await withUnreadingPeerAsync(async (pair: IUnreadingPeerPair) => {
+      const abortError: Error = new Error('The test aborted the connection.');
+      let whileOpen: boolean | undefined;
+      // This runs after the connection's own 'end' listener, so it has read everything but not closed.
+      pair.reader.socket.once('end', () => {
+        whileOpen = pair.reader.closedAfterReadingAll;
+        pair.reader.abort(abortError);
+      });
+      pair.peer.end();
+      expect(await pair.closed).toBe(abortError);
+      expect(whileOpen).toBe(false);
+      expect(pair.reader.closedAfterReadingAll).toBe(false);
+    });
+  }
+);
+
 linuxIt(
   'closedAfterReadingAll is false once a handler throws, even after a reset once every byte was read',
   async () => {
diff --git a/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts b/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
index 638e3cd084..0b7e048884 100644
--- a/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
+++ b/libraries/rush-daemon-transport/src/test/SendAfterClose.test.ts
@@ -20,3 +20,18 @@ it('rejects a send on a connection that already closed without an error', async
     expect(sendState()).toMatchObject({ code: DaemonTransportErrorCode.transportClosed });
   });
 });
+
+it('rejects sendFrameWrittenAsync on a connection that already closed without an error', async () => {
+  await withPausedPairAsync(async (pair: IBackpressurePair) => {
+    pair.server.socket.destroy();
+    expect(await pair.serverClosed).toBeUndefined();
+    await nextMacrotaskAsync();
+    // Without the open check, the write would reject with the socket's own error instead.
+    const writtenState: () => SendState = trackSend(
+      pair.server.sendFrameWrittenAsync(createFrame(SMALL_FRAME_BYTES))
+    );
+    await nextMacrotaskAsync();
+    expect(writtenState()).toBeInstanceOf(DaemonTransportError);
+    expect(writtenState()).toMatchObject({ code: DaemonTransportErrorCode.transportClosed });
+  });
+});
diff --git a/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts b/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
index 06de020f42..619bed306a 100644
--- a/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
+++ b/libraries/rush-daemon-transport/src/test/SendFrameWritten.test.ts
@@ -66,3 +66,17 @@ it("sendFrameWrittenAsync rejects with the socket's error when the write fails",
   await nextMacrotaskAsync();
   expect(writtenState()).toBe(writeError);
 });
+
+it('sendFrameWrittenAsync rejects when the connection aborts before the socket writes the frame', async () => {
+  const { connection, writeCallbacks } = createHeldWriteConnection();
+  await connection.sendFrameAsync(createFrame(FIRST_BYTES));
+  // The socket holds the first frame's write, so this frame waits behind it.
+  const writtenState: () => SendState = trackSend(
+    connection.sendFrameWrittenAsync(createFrame(SECOND_BYTES))
+  );
+  const abortError: Error = new Error('The test aborted the connection.');
+  connection.abort(abortError);
+  finishNextWrite(writeCallbacks);
+  await nextMacrotaskAsync();
+  expect(writtenState()).toBe(abortError);
+});

From 6b70123c976ccec9a9f93bda4e5636fa75927736 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 04:36:01 +0000
Subject: [PATCH 243/265] [rush-daemon] Test the digest pool's default idle
 timeout and dispose

Swarm integration step 228; original commit 3bb2e042c7 (merge of swarm/r06-t336 at ef311f87b7).
Scope: task 336, the digest pool's idle timeout and dispose.

Brings 336 (branch swarm/r06-t336). Second agent: r03 board 8232 (RESULT board 8231, on CLAIM board 8193). Evidence: ch01's GATE OK board 8659.

Batch E2i, item 10 of 10. Gate: ch01 GATE OK board 8659 (tree ea24ac746b)

Commits folded into this step (1):
- ef311f87b7 rush-daemon: test the digest pool's default idle timeout and dispose

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t336-pool-idle-tests_2026-09-30-01-45.json | 11 ++++++
 .../test/OutputFolderDigestPoolIdle.test.ts   | 36 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t336-pool-idle-tests_2026-09-30-01-45.json

diff --git a/common/changes/@rushstack/rush-daemon/r06-t336-pool-idle-tests_2026-09-30-01-45.json b/common/changes/@rushstack/rush-daemon/r06-t336-pool-idle-tests_2026-09-30-01-45.json
new file mode 100644
index 0000000000..a989ec8792
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t336-pool-idle-tests_2026-09-30-01-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test the output folder digest pool's default idle timeout, and that disposing the pool clears its idle timer.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
index 6ba68f9b6a..e08e50d23d 100644
--- a/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
@@ -23,6 +23,8 @@ import {
 
 const THREAD_COUNT: number = 2;
 const IDLE_TIMEOUT_MS: number = 1000;
+// The pool's own default, pinned here rather than imported so that a change to it fails a test.
+const DEFAULT_IDLE_TIMEOUT_MS: number = 30_000;
 
 const actualWorkerThreads: typeof import('node:worker_threads') = jest.requireActual('node:worker_threads');
 const workerMock: jest.MockInstance<Worker, ConstructorParameters<typeof Worker>> = jest.mocked(Worker);
@@ -213,6 +215,40 @@ describe(OutputFolderDigestPool.name, () => {
       pool.dispose();
     }
   });
+
+  it('stops its workers 30 s after the last job when no idle timeout is given', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      jest.advanceTimersByTime(DEFAULT_IDLE_TIMEOUT_MS - 1);
+      expect(terminate).not.toHaveBeenCalled();
+
+      jest.advanceTimersByTime(1);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+    } finally {
+      pool.dispose();
+    }
+  });
+
+  it('clears its idle timer when disposed', () => {
+    const pool: OutputFolderDigestPool = new OutputFolderDigestPool({
+      threadCount: THREAD_COUNT,
+      idleTimeoutMs: IDLE_TIMEOUT_MS,
+      claimOnCallingThread: false
+    });
+    try {
+      expect(pool.digest(folderSets)).toEqual(digestOnCallingThread(folderSets));
+      expect(jest.getTimerCount()).toBe(1);
+    } finally {
+      pool.dispose();
+    }
+    // A pending timer would keep the disposed pool reachable until it fires.
+    expect(jest.getTimerCount()).toBe(0);
+    expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+  });
 });
 
 describe(OutputFolderDigester.name, () => {

From 8ab4ede51b9d4fd43107dc3ed2c7651db0561f3d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:01 +0000
Subject: [PATCH 244/265] [rush-daemon] Let a request with an explicit wait
 timeout wait for an iteration to start to join it

Swarm integration step 229; original commit f43e308754 (merge of swarm/r05-t109-nit3 at e33b4ad9ed).
Scope: task 109 NIT 3.

Brings 109n3 (branch swarm/r05-t109-nit3). Second agent: o04 board 8840. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 1 of 8. Gate: ch01 GATE OK board 9622 (tree 88bf752ab9)

Commits folded into this step (1):
- e33b4ad9ed [rush-daemon] Let a request with an explicit wait timeout wait for an iteration to start to join it

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  3 +-
 ...ispatch-wait-timeout_2026-09-30-02-47.json | 11 ++++
 ...ispatch-wait-timeout_2026-09-30-02-47.json | 11 ++++
 libraries/rush-daemon/README.md               |  5 +-
 .../rush-daemon/src/PhasedIterationJoiner.ts  | 58 +++++++++++------
 .../src/WorkspaceRequestAdmission.ts          | 33 ++++++++++
 .../src/test/PhasedRequestJoin.test.ts        | 56 +++++++++++++---
 .../test/WorkspaceRequestAdmission.test.ts    | 65 +++++++++++++++++++
 8 files changed, 212 insertions(+), 30 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/join-dispatch-wait-timeout_2026-09-30-02-47.json
 create mode 100644 common/changes/@rushstack/rush-daemon/join-dispatch-wait-timeout_2026-09-30-02-47.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index aad9d2060a..bb70bd2daa 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -121,7 +121,8 @@ That wait fails after 10 times the timeout (5 minutes with the default), so a lo
 that never finishes does not hold other requests forever. The request's own work,
 such as checking its inputs, loading the graph, routing and execution, does not
 count either. A configured or per-invocation timeout also
-limits waiting for a running build that the request could not join, and waiting for
+limits waiting for a running build to start so that the request can join it (with
+`joinRunningBatch`), waiting for a running build that the request could not join, and waiting for
 the requests that the daemon is serving to finish before it restarts for the
 request's environment. The built-in default does not: with it, a build that arrives
 while a compatible build is already running waits for it to finish and then runs,
diff --git a/common/changes/@rushstack/rush-cli-client/join-dispatch-wait-timeout_2026-09-30-02-47.json b/common/changes/@rushstack/rush-cli-client/join-dispatch-wait-timeout_2026-09-30-02-47.json
new file mode 100644
index 0000000000..8aa2fd36fc
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/join-dispatch-wait-timeout_2026-09-30-02-47.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document that a configured or per-invocation wait timeout also limits waiting for a running build to start so that the request can join it.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/join-dispatch-wait-timeout_2026-09-30-02-47.json b/common/changes/@rushstack/rush-daemon/join-dispatch-wait-timeout_2026-09-30-02-47.json
new file mode 100644
index 0000000000..c73b48590a
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/join-dispatch-wait-timeout_2026-09-30-02-47.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "With the experimental `daemon.joinRunningBatch` setting, a build request that has an explicit wait timeout and arrives before the executing iteration starts now waits for it to start, within its wait timeout, so that it can join it, instead of waiting for the iteration to end.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index 5a220a5e4b..d1d8c403dc 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -688,7 +688,10 @@ neither the remaining client's result nor later requests wait for work that nobo
 With the experimental `daemon.joinRunningBatch` setting (`RUSH_DAEMON_JOIN_RUNNING_BATCH=1` in the daemon's
 environment), a request admitted after scheduling starts can instead join the executing iteration, if it has the
 batch's request settings and no other request waits for the graph. Such a batch's iteration holds the operations that
-no participant needs, instead of skipping them, until its other operations complete. When a request joins, the router
+no participant needs, instead of skipping them, until its other operations complete. A request that arrives before the
+iteration dispatches operations, for example while the batch reconciles its inputs, first waits for it to start, as it
+would wait for the running build otherwise: an explicit wait timeout limits that wait and counts it, and a request
+with `noWait` does not wait and does not join. When a request joins, the router
 reads its inputs again, and the graph adds its operations to the executing iteration (`tryExtendCurrentIteration`),
 so that operations that both requests need run once. The request then takes part in the batch like any other
 participant, but does not receive output that operations wrote before it joined. If the graph can't take the
diff --git a/libraries/rush-daemon/src/PhasedIterationJoiner.ts b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
index c49e16298a..a04555b9b7 100644
--- a/libraries/rush-daemon/src/PhasedIterationJoiner.ts
+++ b/libraries/rush-daemon/src/PhasedIterationJoiner.ts
@@ -129,8 +129,9 @@ export class JoinableIteration implements IRequestEventSink {
  *
  * @remarks
  * The request must have the batch's request settings, and it joins only while no other request waits for the
- * graph, so that joining requests never keep a waiting request from running. Unless its admission limits its
- * wait, it first waits for the iteration to dispatch operations, which the batch starts after its reconcile.
+ * graph, so that joining requests never keep a waiting request from running. It first waits for the iteration to
+ * dispatch operations, which the batch starts after its reconcile, as it would wait for the running build otherwise:
+ * an explicit wait timeout limits that wait and counts it, and a request that does not wait does not.
  * Then the graph holds the operations that no participant needs while the inputs are read again, and adds the
  * request's work to the iteration under those inputs (`tryExtendCurrentIteration`). If it cannot, for example
  * because an operation that the request needs started before its inputs changed, nothing changes and the request
@@ -190,19 +191,25 @@ export class PhasedIterationJoiner {
       return undefined;
     }
     const attemptStartTimeMs: number = performance.now();
+    // Requests wait for the iteration to start together, each within its own wait timeout, and then join it one at
+    // a time in the order in which they arrived.
     const previousJoin: Promise<void> = this.#joinTail;
     let endJoin: () => void = () => undefined;
-    this.#joinTail = new Promise<void>((resolve: () => void) => {
+    const joinEnded: Promise<void> = new Promise<void>((resolve: () => void) => {
       endJoin = resolve;
     });
+    this.#joinTail = previousJoin.then(() => joinEnded);
     let outcome: IJoinedRequest | string;
     try {
-      await previousJoin;
-      if (!joinable.dispatched && !mayWaitForDispatch(request)) {
-        outcome = 'the iteration has not started, and the request limits its wait';
-      } else if (!joinable.dispatched && !(await joinable.dispatching)) {
-        outcome = 'the iteration ended before it started';
+      const refusal: string | undefined = await this.#waitForDispatchAsync(
+        joinable,
+        request,
+        admissionController
+      );
+      if (refusal !== undefined) {
+        outcome = refusal;
       } else {
+        await previousJoin;
         outcome = await this.#joinAsync(joinable, request, admissionController);
       }
     } catch (error) {
@@ -216,6 +223,29 @@ export class PhasedIterationJoiner {
     return typeof outcome === 'string' ? undefined : outcome;
   }
 
+  /**
+   * Waits for the iteration to dispatch operations, as the request would wait for the running build otherwise (see
+   * `RequestAdmissionController.waitForGraphProgressAsync`), and returns why the request cannot join if it does not.
+   */
+  async #waitForDispatchAsync(
+    joinable: JoinableIteration,
+    request: IPreparedPhasedRequest,
+    admissionController: RequestAdmissionController
+  ): Promise<string | undefined> {
+    if (joinable.dispatched) {
+      return undefined;
+    }
+    const dispatched: boolean | undefined = await admissionController.waitForGraphProgressAsync(
+      joinable.dispatching
+    );
+    if (dispatched === undefined) {
+      return request.request.admission?.noWait === true
+        ? 'the iteration has not started, and the request limits its wait'
+        : "the iteration did not start within the request's wait timeout";
+    }
+    return dispatched ? undefined : 'the iteration ended before it started';
+  }
+
   #canJoin(first: IBatchEntry): boolean {
     const { graph, workspaceSession } = this.#host;
     return (
@@ -469,18 +499,6 @@ function removeUndispatchedAttributions(
   }
 }
 
-/**
- * Whether a request may wait for an iteration to dispatch operations in order to join it: unless the request limits
- * its wait, it would wait for the graph anyway.
- */
-function mayWaitForDispatch(request: IPreparedPhasedRequest): boolean {
-  const { admission } = request.request;
-  return (
-    admission?.noWait !== true &&
-    (admission?.waitTimeoutMs === undefined || admission.waitTimeoutIsDefault === true)
-  );
-}
-
 function logJoinAttempt(requestId: string, outcome: IJoinedRequest | string, startTimeMs: number): void {
   const durationMs: number = Math.round(performance.now() - startTimeMs);
   const reason: string | undefined = typeof outcome === 'string' ? outcome : outcome.failure;
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index 921b1c1bff..a8817e9ae5 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -593,6 +593,39 @@ export class RequestAdmissionController {
     );
   }
 
+  /**
+   * Waits for `progress` of the running build of the workspace operation graph, as a shared-build request waits for
+   * that build at the per-graph execution gate ({@link RequestAdmissionController.acquireGraphExecutionAsync}): a
+   * client-default timeout does not limit the wait, an explicit `waitTimeoutMs` limits it and spends the request's
+   * remaining admission budget on it, and with `noWait` the request does not wait.
+   *
+   * @returns what `progress` resolves to, or undefined if the request may not wait for it any longer.
+   */
+  public async waitForGraphProgressAsync<T>(progress: Promise<T>): Promise<T | undefined> {
+    if (this.#admission?.noWait === true) {
+      return undefined;
+    }
+    const waitTimeoutMs: number | undefined = this.#admission?.waitTimeoutIsDefault
+      ? undefined
+      : this.#remainingMs;
+    if (waitTimeoutMs === undefined) {
+      return await progress;
+    }
+    const startMs: number = Date.now();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      return await Promise.race([
+        progress,
+        new Promise<undefined>((resolve: (value: undefined) => void) => {
+          timer = setTimeout(() => resolve(undefined), waitTimeoutMs);
+        })
+      ]);
+    } finally {
+      clearTimeout(timer);
+      this.#spend(Date.now() - startMs);
+    }
+  }
+
   /**
    * After the restart drain ({@link RequestAdmissionController.waitForRestartDrainAsync}), waits until no other
    * request holds `scheduler`, so that this request can be answered with a restart result for `restartReason`
diff --git a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
index 2445e18125..400b311c7b 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
@@ -482,7 +482,8 @@ describe('a request that arrives while a compatible batch executes', () => {
 
   it.each<[string, IDaemonRequestAdmissionOptions | undefined]>([
     ['without admission options', undefined],
-    ['with the default wait timeout', { waitTimeoutMs: 30_000, waitTimeoutIsDefault: true }]
+    ['with the default wait timeout', { waitTimeoutMs: 30_000, waitTimeoutIsDefault: true }],
+    ['with an explicit wait timeout', { waitTimeoutMs: 60_000 }]
   ])('waits for the iteration to start before it joins, %s', async (title, admission) => {
     const { gates, router, scheduleSpy, fixture } = createJoinFixture([OPERATION_C]);
     const reconcileStarted: IDeferred = createDeferred();
@@ -1325,7 +1326,7 @@ describe('a request that cannot join the executing iteration', () => {
     expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(1);
   });
 
-  it('waits for the iteration to end if its admission limits its wait', async () => {
+  it('waits for the iteration to start only within its wait timeout, which that wait spends', async () => {
     const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
     const reconcileStarted: IDeferred = createDeferred();
     const reconcileReleased: IDeferred = createDeferred();
@@ -1339,20 +1340,59 @@ describe('a request that cannot join the executing iteration', () => {
     );
     await reconcileStarted.promise;
     fixture.session.onReconcileAsync = undefined;
-    const late: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
-      createRequest('late', [OPERATION_A], { waitTimeoutMs: 60_000 }),
+
+    // The wait for the iteration to start spends the whole timeout, so the request does not wait for it to end.
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_A], { waitTimeoutMs: 50 }),
       new TestPhasedRequestClient('late')
     );
-    await waitForAsync(() => joinLog.length > 0);
+    expect(late).toMatchObject({ admissionErrorCode: 'wait-timeout', outcome: 'failure' });
+    expect(joinLog).toEqual([
+      "Request late did not join the executing iteration: the iteration did not start within the request's wait timeout"
+    ]);
     reconcileReleased.resolve();
     gates.get(OPERATION_C)!.released.resolve();
+    expect((await first).outcome).toBe('success');
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_A)?.runCount).toBe(0);
+  });
 
+  it('waits for the iteration to start within its own wait timeout while an earlier request waits too', async () => {
+    const { fixture, gates, router, scheduleSpy } = createJoinFixture([OPERATION_C]);
+    const reconcileStarted: IDeferred = createDeferred();
+    const reconcileReleased: IDeferred = createDeferred();
+    fixture.session.onReconcileAsync = async () => {
+      reconcileStarted.resolve();
+      await reconcileReleased.promise;
+    };
+    const first: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('first', [OPERATION_C]),
+      new TestPhasedRequestClient('first')
+    );
+    await reconcileStarted.promise;
+    fixture.session.onReconcileAsync = undefined;
+    const joined: Promise<IDaemonPhasedRequestResult> = router.executeAsync(
+      createRequest('joined', [OPERATION_A]),
+      new TestPhasedRequestClient('joined')
+    );
+    await settleAsync();
+
+    // It does not wait for the earlier request to join before its own wait for the iteration to start ends.
+    const late: IDaemonPhasedRequestResult = await router.executeAsync(
+      createRequest('late', [OPERATION_B], { waitTimeoutMs: 50 }),
+      new TestPhasedRequestClient('late')
+    );
+    expect(late).toMatchObject({ admissionErrorCode: 'wait-timeout', outcome: 'failure' });
+    reconcileReleased.resolve();
+    expect(await joined).toMatchObject({ exitCode: 0, outcome: 'success' });
+    gates.get(OPERATION_C)!.released.resolve();
     expect((await first).outcome).toBe('success');
-    expect((await late).outcome).toBe('success');
     expect(joinLog).toEqual([
-      'Request late did not join the executing iteration: the iteration has not started, and the request limits its wait'
+      "Request late did not join the executing iteration: the iteration did not start within the request's wait timeout",
+      'Request joined joined the executing iteration.'
     ]);
-    expect(scheduleSpy).toHaveBeenCalledTimes(2);
+    expect(scheduleSpy).toHaveBeenCalledTimes(1);
+    expect(fixture.runners.get(OPERATION_B)?.runCount).toBe(0);
   });
 
   it('waits for the next iteration if the iteration ends before it starts', async () => {
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
index ace4785540..76999ca7e0 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -311,6 +311,71 @@ describe(RequestAdmissionController.name, () => {
     controller.dispose();
   });
 
+  it('spends an explicit timeout while it waits for progress of the running build', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    let makeProgress: (value: string) => void = () => undefined;
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>((resolve: (value: string) => void) => {
+        makeProgress = resolve;
+      })
+    );
+    await jest.advanceTimersByTimeAsync(40);
+    makeProgress('dispatched');
+    expect(await waiting).toBe('dispatched');
+    expect(controller.remainingAdmission).toEqual({ ...EXPLICIT_BUDGET, waitTimeoutMs: 60 });
+    controller.dispose();
+  });
+
+  it('stops waiting for progress of the running build once an explicit timeout is spent', async () => {
+    const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
+    let ended: boolean = false;
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>(() => undefined)
+    );
+    void waiting.then(() => {
+      ended = true;
+    });
+    await jest.advanceTimersByTimeAsync(99);
+    expect(ended).toBe(false);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(await waiting).toBeUndefined();
+    expect(controller.remainingAdmission).toEqual({ ...EXPLICIT_BUDGET, waitTimeoutMs: 0 });
+
+    // The graph-execution gate then has no time left to wait for the build either.
+    const running: IAcquisition = track(
+      controller.acquireGraphExecutionAsync(scheduler, RequestExclusivityClass.SharedBuild)
+    );
+    await jest.advanceTimersByTimeAsync(0);
+    expect(running.error).toMatchObject({
+      code: RequestSchedulerErrorCode.WaitTimeout,
+      message:
+        'The request was not admitted within its 100ms wait timeout while waiting for the running build of the ' +
+        'workspace operation graph. Use --wait-timeout <seconds> to wait longer.'
+    });
+    controller.dispose();
+  });
+
+  it('does not spend a default timeout while it waits for progress of the running build', async () => {
+    const controller: RequestAdmissionController = createController(DEFAULT_BUDGET);
+    let makeProgress: (value: string) => void = () => undefined;
+    const waiting: Promise<string | undefined> = controller.waitForGraphProgressAsync(
+      new Promise<string>((resolve: (value: string) => void) => {
+        makeProgress = resolve;
+      })
+    );
+    await jest.advanceTimersByTimeAsync(10_000);
+    makeProgress('dispatched');
+    expect(await waiting).toBe('dispatched');
+    expect(controller.remainingAdmission).toEqual({ ...DEFAULT_BUDGET, waitTimeoutMs: 100 });
+    controller.dispose();
+  });
+
+  it('does not wait for progress of the running build when the request does not wait', async () => {
+    const controller: RequestAdmissionController = createController({ noWait: true });
+    expect(await controller.waitForGraphProgressAsync(new Promise<string>(() => undefined))).toBeUndefined();
+    controller.dispose();
+  });
+
   it('names the configured timeout, not the remainder, when a later routing boundary times out', async () => {
     const controller: RequestAdmissionController = createController(EXPLICIT_BUDGET);
     await waitBehindAnotherRequestAsync(controller, 23);

From 444218875bbd744d756ec693063f33e6606d4d55 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:01 +0000
Subject: [PATCH 245/265] [rush-daemon] Test unknown names and a warm engine
 with no plugins

Swarm integration step 230; original commit 98736251df (merge of swarm/r04-t338 at 0293d90955).
Scope: task 338, 334's EVERY NIT.

Brings 338 (branch swarm/r04-t338). Second agent: o04 board 8305. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 2 of 8. Gate: ch01 GATE OK board 9622 (tree 0366e8f0cb)

Commits folded into this step (1):
- 0293d90955 [rush-daemon] Test unknown names and a warm engine with no plugins

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...e-unknown-names-test_2026-09-30-01-59.json | 11 +++++++++++
 .../src/test/PhasedRequestSelection.test.ts   | 19 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t338-engine-shape-unknown-names-test_2026-09-30-01-59.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t338-engine-shape-unknown-names-test_2026-09-30-01-59.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t338-engine-shape-unknown-names-test_2026-09-30-01-59.json
new file mode 100644
index 0000000000..166f004f7f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t338-engine-shape-unknown-names-test_2026-09-30-01-59.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts b/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
index 1c00d92b2c..5d14e7d690 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestSelection.test.ts
@@ -21,6 +21,13 @@ describe(validateEngineShape.name, () => {
     ).not.toThrow();
   });
 
+  it('accepts an empty plugin list when the warm engine has no plugins', () => {
+    const warmShape: IWorkspaceEngineShape = { phaseNames: ['_phase:build'], pluginNames: [] };
+    expect(() =>
+      validateEngineShape({ phaseNames: ['_phase:build'], pluginNames: [] }, warmShape)
+    ).not.toThrow();
+  });
+
   it.each<[string, IDaemonPhasedEngineShape]>([
     ['phase', { phaseNames: ['_phase:build', '_phase:build'], pluginNames: WARM_ENGINE_SHAPE.pluginNames }],
     ['plugin', { phaseNames: WARM_ENGINE_SHAPE.phaseNames, pluginNames: ['plugin-a', 'plugin-a'] }]
@@ -32,4 +39,16 @@ describe(validateEngineShape.name, () => {
       );
     }
   );
+
+  it.each<[string, IDaemonPhasedEngineShape]>([
+    ['phase', { phaseNames: ['_phase:build', '_phase:lint'], pluginNames: WARM_ENGINE_SHAPE.pluginNames }],
+    ['plugin', { phaseNames: WARM_ENGINE_SHAPE.phaseNames, pluginNames: ['plugin-a', 'plugin-c'] }]
+  ])(
+    'rejects a %s list that has an unknown name in place of a warm one',
+    (kind: string, requestShape: IDaemonPhasedEngineShape) => {
+      expect(() => validateEngineShape(requestShape, WARM_ENGINE_SHAPE)).toThrow(
+        `The phased request ${kind} shape does not match the warm workspace engine.`
+      );
+    }
+  );
 });

From d8caa6846a9778994a7a61fd319ec562ed994cc4 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:01 +0000
Subject: [PATCH 246/265] [rush-daemon] Test the idle timeout that a digester
 gives its pool by default

Swarm integration step 231; original commit 0f46898a73 (merge of swarm/r06-t339 at 916c31257e).
Scope: task 339, 336 NIT: pin the digest pool's default idle timeout.

Brings 339 (branch swarm/r06-t339). Second agent: r03 board 8391. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 3 of 8. Gate: ch01 GATE OK board 9622 (tree f03d78b876)

Commits folded into this step (1):
- 916c31257e rush-daemon: test the idle timeout that a digester gives its pool by default

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...igester-idle-default_2026-09-30-02-26.json | 11 +++++++++++
 .../test/OutputFolderDigestPoolIdle.test.ts   | 19 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t339-digester-idle-default_2026-09-30-02-26.json

diff --git a/common/changes/@rushstack/rush-daemon/r06-t339-digester-idle-default_2026-09-30-02-26.json b/common/changes/@rushstack/rush-daemon/r06-t339-digester-idle-default_2026-09-30-02-26.json
new file mode 100644
index 0000000000..de631151de
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t339-digester-idle-default_2026-09-30-02-26.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that the output folder digester leaves the idle timeout to its pool when none is given, as for the daemon's shared digester.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
index e08e50d23d..dc377ccb24 100644
--- a/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
+++ b/libraries/rush-daemon/src/test/OutputFolderDigestPoolIdle.test.ts
@@ -275,4 +275,23 @@ describe(OutputFolderDigester.name, () => {
     }
     expect(terminate).toHaveBeenCalledTimes(2 * THREAD_COUNT);
   });
+
+  // getSharedOutputFolderDigester() passes no options, so this is the idle timeout that the daemon runs with.
+  it("leaves the idle timeout to its pool when none is given, so the pool's workers stop after 30 s", () => {
+    const digester: OutputFolderDigester = new OutputFolderDigester({
+      threadCount: THREAD_COUNT,
+      poolStartThresholdMs: -1
+    });
+    try {
+      digester.recordCallingThreadDigests(2, 0);
+      expect(digester.isParallel).toBe(true);
+      jest.advanceTimersByTime(DEFAULT_IDLE_TIMEOUT_MS - 1);
+      expect(terminate).not.toHaveBeenCalled();
+
+      jest.advanceTimersByTime(1);
+      expect(terminate).toHaveBeenCalledTimes(THREAD_COUNT);
+    } finally {
+      digester.dispose();
+    }
+  });
 });

From 5c4db66bc4da1c14a1851af8580a1551c827ff9a Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:01 +0000
Subject: [PATCH 247/265] [rush-daemon] Test the lifetime defaults of a daemon
 that owns its process

Swarm integration step 232; original commit d59ee79572 (merge of swarm/r06-t343 at 210b5613cb).
Scope: task 343, pin the process-owning daemon's defaults.

Brings 343 (branch swarm/r06-t343). Second agent: o04 board 9009. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 4 of 8. Gate: ch01 GATE OK board 9622 (tree 767f7d328d)

Commits folded into this step (1):
- 210b5613cb rush-daemon: test the lifetime defaults of a daemon that owns its process

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...serve-defaults-tests_2026-09-30-03-00.json | 11 +++
 .../src/test/DaemonServeDefaults.test.ts      | 76 +++++++++++++++++++
 .../src/test/DaemonSocketWatch.test.ts        | 14 ++++
 3 files changed, 101 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/r06-t343-serve-defaults-tests_2026-09-30-03-00.json
 create mode 100644 libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts

diff --git a/common/changes/@rushstack/rush-daemon/r06-t343-serve-defaults-tests_2026-09-30-03-00.json b/common/changes/@rushstack/rush-daemon/r06-t343-serve-defaults-tests_2026-09-30-03-00.json
new file mode 100644
index 0000000000..bd245a2244
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/r06-t343-serve-defaults-tests_2026-09-30-03-00.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test the 10 s shutdown deadline and idle garbage collection delay that serveRushDaemonAsync gives a daemon that owns its process, and the 5 s interval of the daemon's socket check.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts b/libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts
new file mode 100644
index 0000000000..831df767e0
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonServeDefaults.test.ts
@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { RushDaemonHost } from '../RushDaemonHost';
+import type { IRushDaemonHostOptions } from '../RushDaemonHost';
+import { serveRushDaemonAsync, type IRushDaemonServeOptions } from '../serveRushDaemon';
+
+// The host never starts, so these tests bind no socket, write no lockfile, and start or signal no process.
+const START_ERROR: Error = new Error('The test stops the daemon before its host starts.');
+const SHUTDOWN_SIGNALS: ReadonlyArray<NodeJS.Signals> = ['SIGINT', 'SIGTERM'];
+
+// Both shipped entry points serve without a shutdown signal, so every daemon that they start owns its process.
+describe('serveRushDaemonAsync for a daemon that owns its process', () => {
+  let startAsyncSpy: jest.SpyInstance<Promise<RushDaemonHost>, [IRushDaemonHostOptions]>;
+  let exitSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    // After the daemon stops, a timer exits the process; with fake timers it never fires.
+    jest.useFakeTimers();
+    startAsyncSpy = jest.spyOn(RushDaemonHost, 'startAsync').mockRejectedValue(START_ERROR);
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation();
+  });
+
+  afterEach(() => {
+    jest.clearAllTimers();
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  async function getHostOptionsAsync(
+    options: Partial<IRushDaemonServeOptions> = {}
+  ): Promise<IRushDaemonHostOptions> {
+    await expect(
+      serveRushDaemonAsync({
+        checkInstallation: () => undefined,
+        daemonVersion: 'serve-defaults-test',
+        getSuccessorLaunchAsync: () => Promise.reject(new Error('This test starts no successor.')),
+        repoRoot: 'serve-defaults-test',
+        rushVersion: '5.178.1',
+        ...options
+      })
+    ).rejects.toBe(START_ERROR);
+    expect(startAsyncSpy).toHaveBeenCalledTimes(1);
+    expect(exitSpy).not.toHaveBeenCalled();
+    return startAsyncSpy.mock.calls[0][0];
+  }
+
+  // Literals, not the exported constants: the shutdownSignal option's documentation gives both as 10 seconds.
+  it('gives the host a 10 s shutdown deadline and a 10 s idle garbage collection delay', async () => {
+    const hostOptions: IRushDaemonHostOptions = await getHostOptionsAsync();
+    expect(hostOptions.shutdownDeadlineMs).toBe(10_000);
+    expect(hostOptions.idleGarbageCollectionDelayMs).toBe(10_000);
+  });
+
+  it('keeps a shutdown deadline and an idle garbage collection delay that it was given', async () => {
+    const hostOptions: IRushDaemonHostOptions = await getHostOptionsAsync({
+      shutdownDeadlineMs: 1_234,
+      idleGarbageCollectionDelayMs: 5_678
+    });
+    expect(hostOptions.shutdownDeadlineMs).toBe(1_234);
+    expect(hostOptions.idleGarbageCollectionDelayMs).toBe(5_678);
+  });
+
+  it('listens for SIGINT and SIGTERM only until it stops', async () => {
+    const countListeners = (): number[] => SHUTDOWN_SIGNALS.map((signal) => process.listenerCount(signal));
+    const before: number[] = countListeners();
+    let whileStarting: number[] | undefined;
+    startAsyncSpy.mockImplementation(() => {
+      whileStarting = countListeners();
+      return Promise.reject(START_ERROR);
+    });
+    await getHostOptionsAsync();
+    expect(whileStarting).toEqual(before.map((count: number) => count + 1));
+    expect(countListeners()).toEqual(before);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts b/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
index ab0a471ec8..e6dc65d87a 100644
--- a/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonSocketWatch.test.ts
@@ -51,4 +51,18 @@ describe(DaemonSocketWatch.name, () => {
       watch[Symbol.dispose]();
     }
   });
+
+  // A literal, not the exported constant: RushDaemonHost documents the 5 s and gives the watch no interval.
+  it('checks the socket every 5 seconds when it is given no interval', () => {
+    const checkSocket: jest.Mock = jest.fn(() => undefined);
+    const watch: DaemonSocketWatch = new DaemonSocketWatch(checkSocket, jest.fn());
+    try {
+      jest.advanceTimersByTime(4_999);
+      expect(checkSocket).not.toHaveBeenCalled();
+      jest.advanceTimersByTime(1);
+      expect(checkSocket).toHaveBeenCalledTimes(1);
+    } finally {
+      watch[Symbol.dispose]();
+    }
+  });
 });

From 4dea9b0131a0d0b9c3574b240ac8689e10b39129 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:01 +0000
Subject: [PATCH 248/265] [rush-daemon-transport] Test the spawn mark and own
 group reads without a process

Swarm integration step 233; original commit a1a015252b (merge of swarm/r06-t344 at 5cdc913318).
Scope: task 344, 321 test NIT: no-process tests for the spawn mark writer.

Brings 344 (branch swarm/r06-t344). Second agent: r03 board 8813. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 5 of 8. Gate: ch01 GATE OK board 9622 (tree 205fcb07d8)

Commits folded into this step (1):
- 5cdc913318 rush-daemon-transport: test the spawn mark and own group reads without a process

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...awn-mark-reads-tests_2026-09-30-03-50.json | 11 +++
 .../test/OperationGroupSpawnMarkWrite.test.ts | 85 +++++++++++++++++++
 .../src/test/ProcFileReads.test.ts            | 49 +++++++++++
 3 files changed, 145 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon-transport/r06-t344-spawn-mark-reads-tests_2026-09-30-03-50.json
 create mode 100644 libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts
 create mode 100644 libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts

diff --git a/common/changes/@rushstack/rush-daemon-transport/r06-t344-spawn-mark-reads-tests_2026-09-30-03-50.json b/common/changes/@rushstack/rush-daemon-transport/r06-t344-spawn-mark-reads-tests_2026-09-30-03-50.json
new file mode 100644
index 0000000000..ebc79add7e
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-transport/r06-t344-spawn-mark-reads-tests_2026-09-30-03-50.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-transport",
+      "comment": "Test the spawn mark writer, the uptime clock and the daemon's own process group read without starting a process.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-transport",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts
new file mode 100644
index 0000000000..421471b5dd
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/OperationGroupSpawnMarkWrite.test.ts
@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { readSpawnMarks, readUptimeTicks, withSpawnMark } from '../DaemonOperationGroupSpawnMark';
+
+// These tests start no process. A callback stands in for the spawn, and it only reads or changes the folder.
+const linuxIt: jest.It = process.platform === 'linux' ? it : it.skip;
+const DETACHED: boolean = true;
+const NOT_DETACHED: boolean = false;
+const FIRST_INDEX: number = 0;
+const TEMP_PREFIX: string = 'rushd-spawn-mark-';
+const MARK_FOLDER: string = 'groups';
+const MARK_PREFIX: string = 'spawn-';
+const EMPTY_FILE: string = '';
+const RETURNED: string = 'returned';
+
+const createdFolders: string[] = [];
+
+afterEach(() => {
+  for (const folder of createdFolders.splice(FIRST_INDEX)) {
+    fs.rmSync(folder, { recursive: true, force: true });
+  }
+});
+
+// A new mark folder, which doesn't exist yet: the mark's writer creates it, as it does a daemon's record folder.
+function createMarkFolder(): string {
+  const temp: string = fs.mkdtempSync(path.join(os.tmpdir(), TEMP_PREFIX));
+  createdFolders.push(temp);
+  return path.join(temp, MARK_FOLDER);
+}
+
+linuxIt('marks a detached spawn with the clock tick it began at, and only while it runs', () => {
+  const folder: string = createMarkFolder();
+  const before: number = readUptimeTicks();
+  const marks: number[] = withSpawnMark(folder, DETACHED, () => readSpawnMarks(folder));
+  const after: number = readUptimeTicks();
+  expect(marks).toEqual([expect.any(Number)]);
+  const [mark] = marks;
+  expect({ notBefore: mark >= before, notAfter: mark <= after }).toEqual({ notBefore: true, notAfter: true });
+  expect(readSpawnMarks(folder)).toEqual([]);
+});
+
+linuxIt('marks nothing for a spawn that is not detached', () => {
+  const folder: string = createMarkFolder();
+  expect(withSpawnMark(folder, NOT_DETACHED, () => readSpawnMarks(folder))).toEqual([]);
+});
+
+linuxIt('removes the mark when the spawn throws, and throws what it threw', () => {
+  const folder: string = createMarkFolder();
+  const error: Error = new Error('spawn EINVAL');
+  const marksInSpawn: number[][] = [];
+  const throwing = (): never => {
+    marksInSpawn.push(readSpawnMarks(folder));
+    throw error;
+  };
+  expect(() => withSpawnMark(folder, DETACHED, throwing)).toThrow(error);
+  expect({ marksInSpawn, marksAfter: readSpawnMarks(folder) }).toEqual({
+    marksInSpawn: [[expect.any(Number)]],
+    marksAfter: []
+  });
+});
+
+linuxIt('runs the spawn and returns what it returns when no mark can be written', () => {
+  // A file where the mark folder belongs, so the folder can't be created.
+  const folder: string = createMarkFolder();
+  fs.writeFileSync(folder, EMPTY_FILE);
+  expect(withSpawnMark(folder, DETACHED, () => RETURNED)).toBe(RETURNED);
+});
+
+linuxIt('returns what the spawn returns when its mark cannot be removed', () => {
+  const folder: string = createMarkFolder();
+  // Puts a folder where the mark file was, so removing the mark fails.
+  const replaceMark = (): string => {
+    const [mark] = readSpawnMarks(folder);
+    const markPath: string = path.join(folder, `${MARK_PREFIX}${mark}`);
+    fs.rmSync(markPath);
+    fs.mkdirSync(markPath);
+    return RETURNED;
+  };
+  expect(withSpawnMark(folder, DETACHED, replaceMark)).toBe(RETURNED);
+});
diff --git a/libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts b/libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts
new file mode 100644
index 0000000000..3554a7c34f
--- /dev/null
+++ b/libraries/rush-daemon-transport/src/test/ProcFileReads.test.ts
@@ -0,0 +1,49 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import fs from 'node:fs';
+
+import { readUptimeTicks } from '../DaemonOperationGroupSpawnMark';
+import { ownGroupId } from '../DaemonOwnGroup';
+
+// The clock and own-group reads against fixed /proc text, so no test here depends on the host or its processes.
+const PROC_UPTIME: string = '/proc/uptime';
+const UPTIME: string = '12345.67 98765.43\n';
+const UPTIME_TICKS: number = 1234567;
+const PROC_SELF_STAT: string = '/proc/self/stat';
+// "<pid> (<name>) <state> <ppid> <pgrp> <session> ...", where the name may hold any text, ") " included.
+const SELF_STAT: string = '4242 (a) b (c) S 101 202 303 0 -1 4194304\n';
+const OWN_GROUP: number = 202;
+const NO_STAT: Error = Object.assign(new Error(`ENOENT: ${PROC_SELF_STAT}`), { code: 'ENOENT' });
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+// Answers reads of `file` with `content`, or throws it when it is an error, and passes every other read through.
+function fakeRead(file: string, content: string | Error): void {
+  const { readFileSync } = fs;
+  jest.spyOn(fs, 'readFileSync').mockImplementation(((
+    ...args: Parameters<typeof readFileSync>
+  ): string | Buffer => {
+    const [readPath] = args;
+    if (readPath !== file) return readFileSync(...args);
+    if (content instanceof Error) throw content;
+    return content;
+  }) as typeof readFileSync);
+}
+
+it('counts the clock in hundredths of a second', () => {
+  fakeRead(PROC_UPTIME, UPTIME);
+  expect(readUptimeTicks()).toBe(UPTIME_TICKS);
+});
+
+it('reads its own process group, not its parent, from after the last ")" of its name', () => {
+  fakeRead(PROC_SELF_STAT, SELF_STAT);
+  expect(ownGroupId()).toBe(OWN_GROUP);
+});
+
+it('reports no own process group when /proc/self/stat cannot be read', () => {
+  fakeRead(PROC_SELF_STAT, NO_STAT);
+  expect(ownGroupId()).toBeUndefined();
+});

From cb17927ebaa654f97979cc911530426c64e35f0f Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:02 +0000
Subject: [PATCH 249/265] [rush-lib] Test two cases of deferred build cache
 writes

Swarm integration step 234; original commit 17a943c265 (merge of swarm/r07-t341 at 6bd98980ae).
Scope: task 341, 113 follow-up: tests that kill two survivors.

Brings 341 (branch swarm/r07-t341). Second agent: t06 board 9032. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 6 of 8. Gate: ch01 GATE OK board 9622 (tree fbdd18d92e)

Commits folded into this step (1):
- 6bd98980ae [rush-lib] Test two cases of deferred build cache writes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...d-cache-writes-tests_2026-09-30-02-38.json |  11 ++
 ...mmandLineParserDeferredCacheWrites.test.ts | 107 ++++++++++++++++++
 .../test/DeferredCacheEntryWrites.test.ts     |  12 ++
 3 files changed, 130 insertions(+)
 create mode 100644 common/changes/@microsoft/rush/deferred-cache-writes-tests_2026-09-30-02-38.json
 create mode 100644 libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts

diff --git a/common/changes/@microsoft/rush/deferred-cache-writes-tests_2026-09-30-02-38.json b/common/changes/@microsoft/rush/deferred-cache-writes-tests_2026-09-30-02-38.json
new file mode 100644
index 0000000000..d44e6ca465
--- /dev/null
+++ b/common/changes/@microsoft/rush/deferred-cache-writes-tests_2026-09-30-02-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add tests: output files are not sealed for a deferred build cache write if one of them is a symbolic link, and a build outside the daemon does not defer its build cache writes, even with the `deferCacheWrites` setting.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts b/libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts
new file mode 100644
index 0000000000..bc64c358a1
--- /dev/null
+++ b/libraries/rush-lib/src/cli/test/RushCommandLineParserDeferredCacheWrites.test.ts
@@ -0,0 +1,107 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock(`@rushstack/package-deps-hash`, () => {
+  return {
+    getRepoRoot(dir: string): string {
+      return dir;
+    },
+    getDetailedRepoStateAsync(): IDetailedRepoState {
+      return {
+        hasSubmodules: false,
+        hasUncommittedChanges: false,
+        // The shrinkwrap file of the test repo, which every project depends on. As in the other mocks, a file's
+        // hash is its path.
+        files: new Map([
+          ['common/config/rush/npm-shrinkwrap.json', 'common/config/rush/npm-shrinkwrap.json']
+        ]),
+        symlinks: new Map()
+      };
+    },
+    getRepoChangesAsync(): ReadonlyMap<string, string> {
+      return new Map();
+    },
+    getGitHashForFiles(filePaths: Iterable<string>): ReadonlyMap<string, string> {
+      return new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath]));
+    },
+    hashFilesAsync(rootDirectory: string, filePaths: Iterable<string>): Promise<ReadonlyMap<string, string>> {
+      return Promise.resolve(new Map(Array.from(filePaths, (filePath: string) => [filePath, filePath])));
+    }
+  };
+});
+
+import './mockRushCommandLineParser';
+
+import { JsonFile } from '@rushstack/node-core-library';
+import type { IDetailedRepoState } from '@rushstack/package-deps-hash';
+
+import { DeferredCacheEntryWrites } from '../../logic/buildCache/DeferredCacheEntryWrites';
+import { CacheableOperationPlugin } from '../../logic/operations/CacheableOperationPlugin';
+import {
+  getCommandLineParserInstanceAsync,
+  isolateEnvironmentConfigurationForTests,
+  type IEnvironmentConfigIsolation
+} from './TestUtils';
+
+const REPO_NAME: string = 'legacySkipRepo';
+const DEFER_CACHE_WRITES_VARIABLE_NAME: string = 'RUSH_DAEMON_DEFER_CACHE_WRITES';
+
+jest.setTimeout(1000000);
+
+describe('RushCommandLineParser with the deferCacheWrites setting', () => {
+  let _envIsolation: IEnvironmentConfigIsolation;
+  let _originalExitCode: string | number | undefined;
+  let _originalDeferCacheWrites: string | undefined;
+
+  beforeEach(() => {
+    // A command that succeeds sets process.exitCode to 0. When Jest runs only this file, it shares the
+    // process with Heft, which would then exit with 0 even though tests failed.
+    _originalExitCode = process.exitCode;
+    _originalDeferCacheWrites = process.env[DEFER_CACHE_WRITES_VARIABLE_NAME];
+    _envIsolation = isolateEnvironmentConfigurationForTests();
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    _envIsolation.restore();
+    if (_originalDeferCacheWrites === undefined) {
+      delete process.env[DEFER_CACHE_WRITES_VARIABLE_NAME];
+    } else {
+      process.env[DEFER_CACHE_WRITES_VARIABLE_NAME] = _originalDeferCacheWrites;
+    }
+    process.exitCode = _originalExitCode;
+  });
+
+  it('does not defer the build cache writes of a build outside the daemon', async () => {
+    process.env[DEFER_CACHE_WRITES_VARIABLE_NAME] = '1';
+    const { parser, spawnMock, repoPath } = await getCommandLineParserInstanceAsync(REPO_NAME, 'build');
+    expect(parser.rushConfiguration.daemon.deferCacheWrites).toBe(true);
+    await JsonFile.saveAsync(
+      { buildCacheEnabled: true, cacheProvider: 'local-only' },
+      `${repoPath}/common/config/rush/build-cache.json`,
+      { ensureFolderExists: true }
+    );
+
+    // A deferred write outlives its command, and only the daemon outlives a command. The projects write no
+    // entries, since they have no rush-project.json, so what matters is whether the build gets the daemon's queue.
+    const applySpy: jest.SpiedFunction<CacheableOperationPlugin['apply']> = jest.spyOn(
+      CacheableOperationPlugin.prototype,
+      'apply'
+    );
+    const instanceSpy: jest.SpyInstance<DeferredCacheEntryWrites, []> = jest.spyOn(
+      DeferredCacheEntryWrites,
+      'instance',
+      'get'
+    );
+    try {
+      await expect(parser.executeAsync()).resolves.toEqual(true);
+
+      expect(spawnMock).toHaveBeenCalledTimes(2);
+      expect(applySpy).toHaveBeenCalledTimes(1);
+      expect(instanceSpy).not.toHaveBeenCalled();
+    } finally {
+      instanceSpy.mockRestore();
+      applySpy.mockRestore();
+    }
+  });
+});
diff --git a/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts b/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
index 543e4dbb0e..63bbf5dab2 100644
--- a/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
+++ b/libraries/rush-lib/src/logic/buildCache/test/DeferredCacheEntryWrites.test.ts
@@ -352,6 +352,18 @@ describe(DeferredCacheEntryWrites.name, () => {
       );
     });
 
+    it('does not seal a symbolic link', async () => {
+      // A clone would copy the target of the link, not the link.
+      fs.symlinkSync('index.js', getOutputPath('lib/link.js'));
+      const subject: DeferredCacheEntryWrites = createSubject();
+
+      expect(await sealAsync(subject, [...OUTPUT_PATHS, 'lib/link.js'])).toBeUndefined();
+      expect(fs.readdirSync(getProcessFolderPath())).toEqual([]);
+      expect(terminalProvider.getOutput()).toContain(
+        'Unable to clone the output files ("lib/link.js" is not a file)'
+      );
+    });
+
     it('deletes the staging folders of processes that are not running', async () => {
       const stagingFolderPath: string = path.join(commonTempFolder, DEFERRED_CACHE_ENTRY_STAGING_FOLDER_NAME);
       for (const name of [`${PID}`, '1111', '2222', 'other']) {

From 0d03ae70b56f1ada084a39f3e19f8da6787a79e4 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:02 +0000
Subject: [PATCH 250/265] [rush-cli-client] Document the silent stop by a
 served reload, rebuild or retest

Swarm integration step 235; original commit bf1ac546df (merge of swarm/r04-t340 at 665d8ec1b5).
Scope: task 340, 108 README NIT.

Brings 340 (branch swarm/r04-t340). Second agent: t07 board 8441. Evidence: ch01's GATE OK board 9622.

Batch E2j, item 7 of 8. Gate: ch01 GATE OK board 9622 (tree 1c0a57129d)

Commits folded into this step (1):
- 665d8ec1b5 [rush-cli-client] Document the silent stop by a served reload, rebuild or retest

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                        |  5 +++++
 ...-r04-t340-readme-served-stop_2026-09-30-02-45.json | 11 +++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t340-readme-served-stop_2026-09-30-02-45.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index bb70bd2daa..66c179cdb5 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -266,6 +266,11 @@ environment, and `rush-client daemon stop` stop them instead. So does a command
 doesn't run (such as a custom command that it can't serve), before the client runs it in-process;
 the client then prints, indented under its fallback line,
 `rushd stopped 2 operations left running by an earlier failed command (lib-b (build), lib-c (build)), so that this command can run in-process.`
+A served command that makes the daemon reload its graph, such as `rush test` after `rush build`,
+stops them as well, and so does a served phased command that isn't incremental, such as a custom
+`rush retest`. Like a served `rush rebuild`, these commands print no line that names them or says
+that they stopped; if one succeeds, its summary line ends with
+`· queued behind another request (position 1 at 0.1s)`.
 Rushx scripts, and built-in commands that only read the workspace (such as `rush list`), run
 in-process alongside them, like two Rush commands at once in one checkout.
 Older daemons report the failure when all of the work has ended.
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t340-readme-served-stop_2026-09-30-02-45.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t340-readme-served-stop_2026-09-30-02-45.json
new file mode 100644
index 0000000000..690b855dd3
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t340-readme-served-stop_2026-09-30-02-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From 34df84cfad901629f3cb6af314d922a1b42f9bac Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 08:45:02 +0000
Subject: [PATCH 251/265] [rush-cli-client] Say which operations rushd stops
 for a served command

Swarm integration step 236; original commit ca8c052981 (merge of swarm/r04-t345 at 857fc03605).
Scope: task 345, 340 follow-up: say which operations a served request stops.

Brings 345 (branch swarm/r04-t345, 3 commits). Second agent: t07 board 9019 (m01 METRICS board 9124). GATE NIT: mutant M345-ANY-POSITION survives; the test-only follow-up is task 368 (D64 board 9574). Evidence: ch01's GATE OK board 9622.

Batch E2j, item 8 of 8. Gate: ch01 GATE OK board 9622 (tree ed25ba3c6c)

Commits folded into this step (3):
- f9ccf77215 [rush-daemon-protocol] Add a stopping flag to IDaemonContinuingOperations
- 406b0d8325 [rush-daemon] Name the continuing operations that a queued request makes rushd stop
- 857fc03605 [rush-cli-client] Say which operations rushd stops for a served command

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |  14 ++-
 .../src/AgentProgressRenderer.ts              |  21 ++--
 .../src/daemonRestartNotice.ts                |   3 +-
 .../src/test/AgentProgressRenderer.test.ts    |  54 +++++++++
 .../src/test/daemonRestartNotice.test.ts      |  21 ++++
 ...-stopping-continuing_2026-09-30-04-40.json |  11 ++
 ...-stopping-continuing_2026-09-30-04-40.json |  11 ++
 ...-stopping-continuing_2026-09-30-04-40.json |  11 ++
 .../reviews/api/rush-daemon-protocol.api.md   |   1 +
 common/reviews/api/rush-daemon.api.md         |   1 +
 .../src/ContinuingOperationsValidation.ts     |  17 ++-
 .../src/DaemonRequestAdmission.ts             |   9 +-
 .../src/test/ContinuingOperations.test.ts     |   8 +-
 .../rush-daemon/src/PhasedRequestRouter.ts    |   8 +-
 libraries/rush-daemon/src/RequestScheduler.ts |  10 ++
 .../src/WorkspaceRequestAdmission.ts          |  51 ++++++++-
 .../src/WorkspaceRequestLifecycle.ts          |   6 +-
 .../test/PhasedRequestEarlyFailure.test.ts    |  27 +++++
 .../src/test/PhasedRequestJoin.test.ts        |   7 +-
 .../src/test/RequestScheduler.test.ts         |  35 ++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  |  57 +++++++++-
 .../test/WorkspaceRequestAdmission.test.ts    | 107 ++++++++++++++++++
 22 files changed, 463 insertions(+), 27 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 66c179cdb5..a4726f93ab 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -268,9 +268,17 @@ the client then prints, indented under its fallback line,
 `rushd stopped 2 operations left running by an earlier failed command (lib-b (build), lib-c (build)), so that this command can run in-process.`
 A served command that makes the daemon reload its graph, such as `rush test` after `rush build`,
 stops them as well, and so does a served phased command that isn't incremental, such as a custom
-`rush retest`. Like a served `rush rebuild`, these commands print no line that names them or says
-that they stopped; if one succeeds, its summary line ends with
-`· queued behind another request (position 1 at 0.1s)`.
+`rush retest`. These commands and a served `rush rebuild` name them while the daemon stops them:
+the agent phase reads
+`stopping 2 operations left running by an earlier failed command (position 1): lib-b (build), lib-c (build)`,
+a status line on a pipe reads
+`waiting while rushd stops 2 operations left running by an earlier failed command (queue position 1 at 0.1s): lib-b (build), lib-c (build)`,
+and if the command succeeds or is cancelled, its summary line ends with
+`· stopped 2 operations left running by an earlier failed command (position 1 at 0.1s): lib-b (build), lib-c (build)`.
+Legacy output on a terminal prints
+`rush-client: waiting for daemon admission (position 1) while rushd stops 2 operations left running by an earlier failed command: lib-b (build), lib-c (build).`
+Older clients say that such a command is queued behind them. Older daemons don't name them, so the
+summary line ends with `· queued behind another request (position 1 at 0.1s)`.
 Rushx scripts, and built-in commands that only read the workspace (such as `rush list`), run
 in-process alongside them, like two Rush commands at once in one checkout.
 Older daemons report the failure when all of the work has ended.
diff --git a/apps/rush-cli-client/src/AgentProgressRenderer.ts b/apps/rush-cli-client/src/AgentProgressRenderer.ts
index de4d7f05a7..6e1d2ba649 100644
--- a/apps/rush-cli-client/src/AgentProgressRenderer.ts
+++ b/apps/rush-cli-client/src/AgentProgressRenderer.ts
@@ -105,7 +105,10 @@ const UNFINISHED_STATUSES: ReadonlySet<string> = new Set(['WAITING', 'READY', 'Q
 interface IQueuePosition {
   readonly position: number;
   readonly elapsed: string;
-  /** Set if the request waited only for operations that an earlier failed command left running. */
+  /**
+   * Set if the request waited only for operations that an earlier failed command left running, or, with `stopping`,
+   * only while rushd stopped them.
+   */
   readonly continuing: IDaemonContinuingOperations | undefined;
 }
 
@@ -256,7 +259,7 @@ export class AgentProgressRenderer {
   #firstQueued: IQueuePosition | undefined;
   /**
    * The first queue position that named operations left running by an earlier failed command, which the summary line
-   * gives instead of the first one, since the request waited behind them.
+   * gives instead of the first one, since the request waited behind them, or while rushd stopped them.
    */
   #firstContinuingQueued: IQueuePosition | undefined;
   #stopped: boolean = false;
@@ -356,7 +359,8 @@ export class AgentProgressRenderer {
 
   /**
    * The request waits for admission, and with `continuing`, only for operations that an earlier failed command left
-   * running, which the daemon names again whenever one of them ends. The status lines and the summary line say so.
+   * running, which the daemon names again whenever one of them ends, or, with `continuing.stopping`, only while the
+   * daemon stops them for this request. The status lines and the summary line say so.
    */
   public onQueuePosition(position: number, continuing?: IDaemonContinuingOperations): void {
     this.#queued = { position, elapsed: this.#elapsed(), continuing };
@@ -364,8 +368,8 @@ export class AgentProgressRenderer {
     if (continuing) {
       this.#firstContinuingQueued ??= this.#queued;
       this.setPhase(
-        `queued behind ${formatContinuingOperations(continuing)} (position ${position})` +
-          formatContinuingOperationNames(continuing)
+        `${continuing.stopping ? 'stopping' : 'queued behind'} ${formatContinuingOperations(continuing)} ` +
+          `(position ${position})${formatContinuingOperationNames(continuing)}`
       );
     } else {
       this.setPhase(`queued behind another request (position ${position})`);
@@ -544,8 +548,8 @@ export class AgentProgressRenderer {
     if (queued && verdict !== 'FAILURE' && !result?.admissionErrorCode) {
       const { position, elapsed, continuing } = queued;
       summary += continuing
-        ? ` · queued behind ${formatContinuingOperations(continuing)} (position ${position} at ${elapsed})` +
-          formatContinuingOperationNames(continuing)
+        ? ` · ${continuing.stopping ? 'stopped' : 'queued behind'} ${formatContinuingOperations(continuing)} ` +
+          `(position ${position} at ${elapsed})${formatContinuingOperationNames(continuing)}`
         : ` · queued behind another request (position ${position} at ${elapsed})`;
     }
     if (errorMessage) {
@@ -808,7 +812,8 @@ export class AgentProgressRenderer {
     } else if (this.#queued) {
       const { position, elapsed, continuing } = this.#queued;
       activity = continuing
-        ? `waiting for ${formatContinuingOperations(continuing)} (queue position ${position} at ${elapsed})` +
+        ? `${continuing.stopping ? 'waiting while rushd stops' : 'waiting for'} ` +
+          `${formatContinuingOperations(continuing)} (queue position ${position} at ${elapsed})` +
           formatContinuingOperationNames(continuing)
         : `waiting for admission or the workspace graph (queue position ${position} at ${elapsed})`;
     }
diff --git a/apps/rush-cli-client/src/daemonRestartNotice.ts b/apps/rush-cli-client/src/daemonRestartNotice.ts
index 5fc317ec8f..a72fb042ac 100644
--- a/apps/rush-cli-client/src/daemonRestartNotice.ts
+++ b/apps/rush-cli-client/src/daemonRestartNotice.ts
@@ -332,7 +332,8 @@ export function createDaemonRequestNoticeHandlers(
         if (agentRenderer) agentRenderer.onQueuePosition(position, continuing);
         else if (stderrIsTTY) {
           const behind: string = continuing
-            ? ` behind ${formatContinuingOperations(continuing)}${formatContinuingOperationNames(continuing)}`
+            ? `${continuing.stopping ? ' while rushd stops' : ' behind'} ` +
+              `${formatContinuingOperations(continuing)}${formatContinuingOperationNames(continuing)}`
             : '';
           await target.writeStderrAsync(
             `${prefix}: waiting for daemon admission (position ${position})${behind}.\n`
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 8d74ea92fd..d20b253c1d 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -670,6 +670,41 @@ describe(AgentProgressRenderer.name, () => {
       failed.renderer.finish({ exitCode: 1 });
       expect(failed.lines()).toEqual(['rush build: FAILURE in 0.0s']);
     });
+
+    it('says that rushd stops them for the request, in the phase and in the summary line (task 345)', () => {
+      const STOPPING: IDaemonContinuingOperations = { ...TWO, stopping: true };
+      const { renderer, output } = createRenderer(true, 'build', 200);
+      renderer.onQueuePosition(1, STOPPING);
+      renderer.dispose();
+      expect(
+        / · (stopping [^\n]*)\n/.exec(output.filter((text) => text.includes('stopping')).pop() ?? '')?.[1]
+      ).toBe(`stopping 2 operations ${LEFT} (position 1): t8-slow1, t8-slow2`);
+
+      const succeeded: ITestRenderer = createRenderer(false);
+      succeeded.clock.ms = 100;
+      succeeded.renderer.onQueuePosition(1, STOPPING);
+      succeeded.clock.ms = 9000;
+      succeeded.renderer.finish({ exitCode: 0 });
+      expect(succeeded.lines()).toEqual([
+        'rush build: SUCCESS up to date (no operations needed) in 9.0s · ' +
+          `stopped 2 operations ${LEFT} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+
+      const cancelled: ITestRenderer = createRenderer(false);
+      cancelled.clock.ms = 100;
+      cancelled.renderer.onQueuePosition(1, STOPPING);
+      cancelled.clock.ms = 3000;
+      cancelled.renderer.finish({ exitCode: 130, cancelled: true });
+      expect(cancelled.lines()).toEqual([
+        `rush build: CANCELLED in 3.0s · stopped 2 operations ${LEFT} (position 1 at 0.1s): t8-slow1, t8-slow2`
+      ]);
+
+      // As for any queue position, a failure gives its own reason instead.
+      const failed: ITestRenderer = createRenderer(false);
+      failed.renderer.onQueuePosition(1, STOPPING);
+      failed.renderer.finish({ exitCode: 1 });
+      expect(failed.lines()).toEqual(['rush build: FAILURE in 0.0s']);
+    });
   });
 
   it('writes a final summary line after a queued request completes', () => {
@@ -1360,6 +1395,25 @@ describe(AgentProgressRenderer.name, () => {
       ]);
     });
 
+    it('says that rushd stops the operations that an earlier failed command left running for the request (task 345)', () => {
+      const { renderer, clock, lines } = createRenderer(false);
+      renderer.start();
+      renderer.onRequestSent();
+      advance(clock, 100);
+      renderer.onQueuePosition(1, { count: 1, names: ['t8-slow1'], stopping: true });
+      advance(clock, 24_900);
+      renderer.onEvent(registered('a (build)'));
+      renderer.onEvent(status('a (build)', 'EXECUTING'));
+      advance(clock, 25_000);
+      renderer.dispose();
+      expect(lines()).toEqual([
+        'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
+        'rush build · 25.0s · waiting while rushd stops 1 operation left running by an earlier failed command ' +
+          '(queue position 1 at 0.1s): t8-slow1',
+        'rush build 0/1 · 50.0s · running: a (build)'
+      ]);
+    });
+
     it('says that a command sent to a new daemon was resubmitted, not what it waited for at the exited daemon (tasks 108 and 145)', async () => {
       const { renderer, clock, lines } = createRenderer(false);
       const handlers: IDaemonRequestNoticeHandlers = createDaemonRequestNoticeHandlers({
diff --git a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
index 1d181927ce..2aec7f362e 100644
--- a/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
+++ b/apps/rush-cli-client/src/test/daemonRestartNotice.test.ts
@@ -614,6 +614,27 @@ describe(createDaemonRequestNoticeHandlers.name, () => {
       }
     });
 
+    it('says that rushd stops the operations that an earlier failed command left running, on a terminal only (task 345)', async () => {
+      for (const stderrIsTTY of [false, true]) {
+        const { calls, handlers } = createHandlers({ agent: false, stderrIsTTY, rushx });
+        await handlers.onQueuePositionAsync(
+          1,
+          undefined,
+          {},
+          { count: 2, names: ['t8-slow1', 't8-slow2'], stopping: true }
+        );
+        handlers.dispose();
+        expect(calls).toEqual(
+          stderrIsTTY
+            ? [
+                `stderr: ${client}: waiting for daemon admission (position 1) while rushd stops 2 operations ` +
+                  'left running by an earlier failed command: t8-slow1, t8-slow2.\n'
+              ]
+            : []
+        );
+      }
+    });
+
     it('gives no restart notice when a wait line since the last restart gave its cause (task 222)', async () => {
       const cases: [DaemonRestartReason, IDaemonRestartWaitDetails, DaemonRestartReason][] = [
         [
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
new file mode 100644
index 0000000000..c54bf685de
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "In agent mode, a served command that makes rushd stop the operations an earlier failed command left running now names them: the phase says `stopping ...`, the summary says ` \u00b7 stopped ...`, and the status line on a pipe says `waiting while rushd stops ...`. The legacy TTY line says `while rushd stops ...`.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
new file mode 100644
index 0000000000..19d71bf108
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon-protocol/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon-protocol",
+      "comment": "Add an optional `stopping` flag to `IDaemonContinuingOperations`. rushd sets it in a queue position while it stops the operations that an earlier failed command left running, so that the queued request can run.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon-protocol",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
new file mode 100644
index 0000000000..c8b982ede4
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t345-stopping-continuing_2026-09-30-04-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "When a served request can't start until rushd stops the operations that an earlier failed command left running, its position-1 queue report now names them and sets `stopping`, instead of giving a plain queue position.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon-protocol.api.md b/common/reviews/api/rush-daemon-protocol.api.md
index dfb112de77..a5b0808782 100644
--- a/common/reviews/api/rush-daemon-protocol.api.md
+++ b/common/reviews/api/rush-daemon-protocol.api.md
@@ -267,6 +267,7 @@ export interface IDaemonCommandResult {
 export interface IDaemonContinuingOperations {
     readonly count: number;
     readonly names: ReadonlyArray<string>;
+    readonly stopping?: boolean;
 }
 
 // @beta
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 753bc6d5e4..3083b8374e 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -823,6 +823,7 @@ export enum RequestExclusivityClass {
 // @public
 export class RequestScheduler {
     acquireAsync(options: IRequestSchedulerAcquireOptions): Promise<IRequestLease>;
+    get activeLeasesArePreemptible(): boolean;
     get activeRequestCount(): number;
     downgradeExclusiveLease(lease: IRequestLease, target: RequestExclusivityClass.SharedBuild | RequestExclusivityClass.SharedRead): void;
     markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void;
diff --git a/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts b/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
index e37826bac4..90ad9c92f5 100644
--- a/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
+++ b/libraries/rush-daemon-protocol/src/ContinuingOperationsValidation.ts
@@ -8,7 +8,8 @@ const EMPTY_STRING_LENGTH: number = 0;
 const FIRST_OPERATION_COUNT: number = 1;
 
 /**
- * Whether `value` is an `IDaemonContinuingOperations`: a positive count, and at most that many nonempty names.
+ * Whether `value` is an `IDaemonContinuingOperations`: a positive count, at most that many nonempty names, and a
+ * `stopping` that is a boolean if set.
  * @internal
  */
 export function isDaemonContinuingOperations(value: unknown): boolean {
@@ -20,14 +21,18 @@ export function validateQueuedContinuingOperations(value: unknown): void {
   if (value !== undefined && !isDaemonContinuingOperations(value)) {
     throw new DaemonProtocolError(
       'malformedControlMessage',
-      'Queue position payload.continuingOperations must have a positive count and at most that many ' +
-        'nonempty names.'
+      'Queue position payload.continuingOperations must have a positive count, at most that many nonempty ' +
+        'names, and a boolean stopping if set.'
     );
   }
 }
 
 function hasContinuingOperationsFields(value: Record<string, unknown>): boolean {
-  return isOperationCount(value.count) && isNameList(value.names, value.count as number);
+  return (
+    isOperationCount(value.count) &&
+    isNameList(value.names, value.count as number) &&
+    isOptionalBoolean(value.stopping)
+  );
 }
 
 function isOperationCount(value: unknown): boolean {
@@ -41,3 +46,7 @@ function isNameList(value: unknown, count: number): boolean {
 function isNonEmptyString(value: unknown): boolean {
   return typeof value === 'string' && value.length > EMPTY_STRING_LENGTH;
 }
+
+function isOptionalBoolean(value: unknown): boolean {
+  return value === undefined || typeof value === 'boolean';
+}
diff --git a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
index c763fa46c3..016f63d6cd 100644
--- a/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
+++ b/libraries/rush-daemon-protocol/src/DaemonRequestAdmission.ts
@@ -34,6 +34,11 @@ export interface IDaemonContinuingOperations {
   readonly count: number;
   /** The names of the first few of them, in name order. */
   readonly names: ReadonlyArray<string>;
+  /**
+   * Set in a queue position while the daemon stops these operations for the request, instead of letting it wait for
+   * them to end. Older daemons omit it; older clients ignore it, and say that the request waits for them.
+   */
+  readonly stopping?: boolean;
 }
 
 /** Reports a request's current one-based scheduler queue position. @beta */
@@ -72,8 +77,8 @@ export interface IDaemonRequestQueuePositionMessage {
      */
     readonly nativeLockHolder?: IDaemonNativeLockHolder;
     /**
-     * Set while the request waits only for operations that earlier requests left running after their result. Older
-     * daemons omit it; older clients ignore it.
+     * Set while the request waits only for operations that earlier requests left running after their result, with
+     * `stopping` while the daemon stops them for the request. Older daemons omit it; older clients ignore it.
      */
     readonly continuingOperations?: IDaemonContinuingOperations;
   };
diff --git a/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts b/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
index f3029a6500..d86d65f3ba 100644
--- a/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
+++ b/libraries/rush-daemon-protocol/src/test/ContinuingOperations.test.ts
@@ -12,7 +12,9 @@ const REQUEST_ID: string = 'waits-for-continuing-work';
 const WELL_FORMED: ReadonlyArray<unknown> = [
   { count: 1, names: ['a (build)'] },
   { count: 5, names: ['a (build)', 'b (build)', 'c (build)'] },
-  { count: 2, names: [] }
+  { count: 2, names: [] },
+  { count: 1, names: ['a (build)'], stopping: true },
+  { count: 1, names: ['a (build)'], stopping: false }
 ];
 
 const MALFORMED: ReadonlyArray<unknown> = [
@@ -27,7 +29,9 @@ const MALFORMED: ReadonlyArray<unknown> = [
   { count: 1, names: 'a (build)' },
   { count: 1, names: ['a (build)', 'b (build)'] },
   { count: 1, names: [''] },
-  { count: 1, names: [{ name: 'a (build)' }] }
+  { count: 1, names: [{ name: 'a (build)' }] },
+  { count: 1, names: [], stopping: 'yes' },
+  { count: 1, names: [], stopping: null }
 ];
 
 function queuePositionFrame(continuingOperations: unknown): Uint8Array {
diff --git a/libraries/rush-daemon/src/PhasedRequestRouter.ts b/libraries/rush-daemon/src/PhasedRequestRouter.ts
index 1f923b68c5..cf2d80ec1e 100644
--- a/libraries/rush-daemon/src/PhasedRequestRouter.ts
+++ b/libraries/rush-daemon/src/PhasedRequestRouter.ts
@@ -281,7 +281,13 @@ export class PhasedRequestRouter {
         client,
         requestId: request.requestId
       });
-      admissionLease = await admissionController.acquireAsync(workspaceScheduler, exclusivityClass);
+      // A request that cannot run alongside the operations that a failed build left running stops them.
+      admissionLease = await admissionController.acquireAsync(
+        workspaceScheduler,
+        exclusivityClass,
+        undefined,
+        () => routingState.coordinator.describeContinuingOperations()
+      );
     } catch (error) {
       admissionController?.dispose();
       return await finishAfterAdmissionErrorAsync(request, client, interactiveSession, error);
diff --git a/libraries/rush-daemon/src/RequestScheduler.ts b/libraries/rush-daemon/src/RequestScheduler.ts
index 300ed02fd0..04bc4b6593 100644
--- a/libraries/rush-daemon/src/RequestScheduler.ts
+++ b/libraries/rush-daemon/src/RequestScheduler.ts
@@ -210,6 +210,16 @@ export class RequestScheduler {
     return this.#activeRequestCount;
   }
 
+  /**
+   * Whether a request holds a lease, and every lease that is held was marked preemptible (see
+   * {@link RequestScheduler.markLeasePreemptible}) or was already preempted. A queued request that cannot be admitted
+   * alongside them then waits only while their owners stop their work.
+   */
+  public get activeLeasesArePreemptible(): boolean {
+    const states: ILeaseState[] = Array.from(this.#activeLeaseStates);
+    return states.length > 0 && states.every((state: ILeaseState) => !!state.onPreempted || state.preempted);
+  }
+
   /**
    * Waits until the request is compatible with all active requests and earlier queued requests. With
    * `admitAheadOfQueue`, compatibility with the active requests can be enough; see that option.
diff --git a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
index a8817e9ae5..b4e27c2d07 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestAdmission.ts
@@ -332,6 +332,18 @@ class QueuePositionWriter {
     });
   }
 
+  /**
+   * Reports that the request, first in the queue, waits only while the daemon stops `continuingOperations`, which
+   * requests that already have their result left running, since it cannot run alongside them.
+   */
+  public enqueueStoppingWait(continuingOperations: IDaemonContinuingOperations): void {
+    this.#enqueuePayload({
+      position: 1,
+      requestId: this.#requestId,
+      continuingOperations: { ...continuingOperations, stopping: true }
+    });
+  }
+
   /**
    * Reports a wait for the rushx scripts that the daemon runs to exit, as a position that counts them. With a
    * `restartReason`, the daemon then restarts for it. Without one, the request runs once they exit, and then restarts
@@ -370,6 +382,24 @@ type ReportQueuePosition = (writer: QueuePositionWriter, position: number) => vo
 const reportQueuePosition: ReportQueuePosition = (writer: QueuePositionWriter, position: number) =>
   writer.enqueue(position);
 
+/**
+ * Reports a queue position that names what `describe` returns, as operations that the daemon stops for the request,
+ * while the request is first in `scheduler`'s queue and every lease that it waits for is preemptible, so that it
+ * waits only while they stop. They stop as soon as the request waits, and from then on `describe` no longer returns
+ * them, so a position reported again while they stop names what the first one named. Other positions are plain.
+ */
+function reportStoppingContinuingOperations(
+  scheduler: RequestScheduler,
+  describe: () => IDaemonContinuingOperations | undefined
+): ReportQueuePosition {
+  let stopping: IDaemonContinuingOperations | undefined;
+  return (writer: QueuePositionWriter, position: number) => {
+    stopping = position === 1 && scheduler.activeLeasesArePreemptible ? (describe() ?? stopping) : undefined;
+    if (stopping) writer.enqueueStoppingWait(stopping);
+    else writer.enqueue(position);
+  };
+}
+
 /**
  * Reports whether a request that other requests wait behind is doing work on their behalf, such as loading the
  * workspace graph that they need, and what it waits for instead: which Rush process, while it waits for native Rush's
@@ -552,13 +582,30 @@ export class RequestAdmissionController {
   /**
    * Waits for workspace admission within the request's remaining admission budget. A wait-timeout error says the
    * request was waiting for `waitingFor`.
+   *
+   * @remarks
+   * Pass `describeStoppingContinuingOperations` for a request that the daemon lets stop the operations which earlier
+   * requests left running after their result (see {@link RequestScheduler.markLeasePreemptible}), instead of waiting
+   * for them to end. While the request is first in the queue, and every lease that it waits for is preemptible, its
+   * queue position then carries what `describeStoppingContinuingOperations` returns, marked as `stopping`, so that
+   * the client can say which operations the daemon stops for it. Other positions are plain.
    */
   public async acquireAsync(
     scheduler: RequestScheduler,
     exclusivityClass: RequestExclusivityClass,
-    waitingFor: string = 'workspace admission'
+    waitingFor: string = 'workspace admission',
+    describeStoppingContinuingOperations?: () => IDaemonContinuingOperations | undefined
   ): Promise<IRequestLease> {
-    return await this.#acquireAsync(scheduler, exclusivityClass, this.#remainingMs, waitingFor);
+    return await this.#acquireAsync(
+      scheduler,
+      exclusivityClass,
+      this.#remainingMs,
+      waitingFor,
+      this.#abortController.signal,
+      describeStoppingContinuingOperations
+        ? reportStoppingContinuingOperations(scheduler, describeStoppingContinuingOperations)
+        : reportQueuePosition
+    );
   }
 
   /**
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 8135e23f58..53e4eead33 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -728,7 +728,11 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       this.#transitioning = ownsTransition = true;
       this.#scriptsMayPassTransition = tier === WorkspaceInputChangeTier.Reload && !isMutation(envelope);
       this.#cancelObservers();
-      lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive);
+      // The transition stops the operations that a failed build left running (see `#yieldAfterResult`).
+      const continuingSession: IWorkspaceSession = session;
+      lease = await admission.acquireAsync(this.#gate, RequestExclusivityClass.Exclusive, undefined, () =>
+        describeContinuingOperations(continuingSession)
+      );
       this.#transitionProgress.setActive(true);
       if (this.#restartPending) throw new RestartPendingBeforeExecution();
       this.#throwIfInstallationChanged();
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
index a11d0b54c4..402f8a7a8f 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -636,6 +636,33 @@ describe('the operations that continue after an early result', () => {
     expect(getQueuePositions(later)).toHaveLength(1);
   });
 
+  it.each(['rebuild', 'list'])(
+    'are named as stopping to a %s request that cannot run alongside them (task 345)',
+    async (commandName: string) => {
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture();
+      const agent: ITrackedClient = trackClient('agent', setup);
+      const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client
+      );
+      await agent.written;
+      await settleAsync();
+      const other: TestPhasedRequestClient = new TestPhasedRequestClient(commandName);
+      const otherPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        { ...createRequest(commandName, false, OPERATION_C), commandName },
+        other
+      );
+      await settleAsync();
+
+      expect(getQueuePositions(other)).toEqual([
+        { position: 1, requestId: commandName, continuingOperations: { ...continuingC, stopping: true } }
+      ]);
+      setup.releaseC();
+      await Promise.all([agentPromise, otherPromise]);
+      expect(getQueuePositions(other)).toHaveLength(1);
+    }
+  );
+
   it('are named again to a build that already waited when the failed build returned early', async () => {
     const failB: IDeferred = createDeferred();
     const setup: IEarlyFailureFixture = createEarlyFailureFixture(
diff --git a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
index 400b311c7b..43790f762e 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestJoin.test.ts
@@ -1086,7 +1086,12 @@ describe('a request that cannot join the executing iteration', () => {
       );
 
       expect(result.outcome).toBe('success');
-      expect(admissionSpy).toHaveBeenCalledWith(expect.anything(), RequestExclusivityClass.Exclusive);
+      expect(admissionSpy).toHaveBeenCalledWith(
+        expect.anything(),
+        RequestExclusivityClass.Exclusive,
+        undefined,
+        expect.any(Function)
+      );
       expect(joinFixture.scheduleSpy).toHaveBeenCalledTimes(2);
       expect(joinFixture.peekCalls).toHaveLength(0);
       expect(joinLog).toEqual([]);
diff --git a/libraries/rush-daemon/src/test/RequestScheduler.test.ts b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
index 3183e5ad80..b660d8ed20 100644
--- a/libraries/rush-daemon/src/test/RequestScheduler.test.ts
+++ b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
@@ -609,4 +609,39 @@ describe('preemptible leases', () => {
     await scheduler.preemptLeasesAsync();
     expect(scheduler.activeRequestCount).toBe(0);
   });
+
+  it('tells whether every active lease is preemptible or preempted, before it preempts them (task 345)', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    const onPreempted: jest.Mock = jest.fn();
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+    expect(scheduler.activeLeasesArePreemptible).toBe(true);
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    running.release();
+    expect(scheduler.activeLeasesArePreemptible).toBe(true);
+
+    // A request that cannot be admitted alongside the lease is told its position before the lease is preempted.
+    const reports: [number, boolean, number][] = [];
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: (position: number) =>
+        reports.push([position, scheduler.activeLeasesArePreemptible, onPreempted.mock.calls.length])
+    });
+    expect(reports).toEqual([[1, true, 0]]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    // While the preempted lease stops, the request waits only for it.
+    expect(scheduler.activeLeasesArePreemptible).toBe(true);
+    leftover.release();
+    const admitted: IRequestLease = await exclusive;
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+    admitted.release();
+    expect(scheduler.activeLeasesArePreemptible).toBe(false);
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index eb74ff8715..97edcb0fea 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -186,6 +186,16 @@ async function returnEarlyAsync(fixture: DaemonGraphTestFixture): Promise<void>
  */
 const NOT_PHASED: string[] = ['install-autoinstaller', '--name', 'tools'];
 
+/** What a request that stops the held c is told while it waits; see `returnEarlyAsync`. */
+const STOPPING_C: object = { count: 1, names: ['c (compile)'], stopping: true };
+
+/** Changes project c's configuration, so that the next build reloads the graph. */
+function changeProjectConfiguration(fixture: DaemonGraphTestFixture): void {
+  const packageJsonPath: string = path.join(fixture.folder, 'c/package.json');
+  const packageJson: Record<string, unknown> = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  fs.writeFileSync(packageJsonPath, JSON.stringify({ ...packageJson, description: 'changed' }));
+}
+
 /** The line that the daemon adds to a rejection after it stopped the held c; see `returnEarlyAsync`. */
 const STOPPED_C: string =
   'rushd stopped 1 operation left running by an earlier failed command (c (compile)), so that this command can ' +
@@ -315,7 +325,45 @@ describe('a failed build that returns early', () => {
       expect(fs.existsSync(hold)).toBe(true);
 
       fs.rmSync(hold);
-      expect((await rebuild).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { frames, terminal } = await rebuild;
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      // It was told that the daemon stopped the held c for it (task 345).
+      expect(queuePositions(frames)).toEqual([
+        expect.objectContaining({ position: 1, continuingOperations: STOPPING_C })
+      ]);
+    } finally {
+      fs.rmSync(hold, { force: true });
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
+  it('lets a build that reloads the graph stop the work that continues, and says so (task 345)', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
+    const hold: string = path.join(fixture.folder, 'hold');
+    try {
+      await returnEarlyAsync(fixture);
+      const generation: number = fixture.host.workspaceGeneration;
+
+      changeProjectConfiguration(fixture);
+      const reload: Promise<ITerminalExchange> = fixture.runAsync([
+        'build',
+        '--to',
+        'c',
+        '--parallelism',
+        '3'
+      ]);
+      // The reloaded graph runs c again while the first c is still held, so the reload did not wait for that c.
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      expect(fs.existsSync(hold)).toBe(true);
+
+      fs.rmSync(hold);
+      const { frames, terminal } = await reload;
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      expect(queuePositions(frames)).toEqual([
+        expect.objectContaining({ position: 1, continuingOperations: STOPPING_C })
+      ]);
     } finally {
       fs.rmSync(hold, { force: true });
       await fixture[Symbol.asyncDispose]();
@@ -340,8 +388,13 @@ describe('a failed build that returns early', () => {
       expect(countRuns(fixture, 'c')).toBe(1);
 
       fs.rmSync(hold);
-      expect((await later).terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      const { frames, terminal } = await later;
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
       expect(countRuns(fixture, 'c')).toBe(1);
+      // It was told that it waited for the held c, which the daemon did not stop.
+      expect(queuePositions(frames)).toEqual([
+        expect.objectContaining({ position: 1, continuingOperations: { count: 1, names: ['c (compile)'] } })
+      ]);
     } finally {
       fs.rmSync(hold, { force: true });
       await fixture[Symbol.asyncDispose]();
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
index 76999ca7e0..4086d52ca5 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -3,6 +3,7 @@
 
 import {
   type DaemonRestartReason,
+  type IDaemonContinuingOperations,
   type IDaemonRequestAdmissionOptions,
   type IDaemonRequestQueuePositionMessage,
   MAX_DAEMON_REQUEST_WAIT_TIMEOUT_MS
@@ -458,3 +459,109 @@ describe(RequestAdmissionController.name, () => {
     controller.dispose();
   });
 });
+
+describe('a request that stops the operations that finished requests left running (task 345)', () => {
+  const CONTINUING: IDaemonContinuingOperations = { count: 2, names: ['a (build)', 'b (build)'] };
+  const STOPPING: IDaemonContinuingOperations = { ...CONTINUING, stopping: true };
+
+  interface IReportingController {
+    readonly controller: RequestAdmissionController;
+    readonly positions: IDaemonRequestQueuePositionMessage['payload'][];
+  }
+
+  function createReportingController(requestId: string): IReportingController {
+    const positions: IDaemonRequestQueuePositionMessage['payload'][] = [];
+    const controller: RequestAdmissionController = new RequestAdmissionController({
+      admission: {},
+      client: {
+        abortSignal: new AbortController().signal,
+        supportsRequestAdmission: true,
+        writeQueuePositionAsync: async (message: IDaemonRequestQueuePositionMessage) => {
+          positions.push(message.payload);
+        }
+      },
+      requestId
+    });
+    return { controller, positions };
+  }
+
+  function acquireExclusiveAsync(
+    { controller }: IReportingController,
+    scheduler: RequestScheduler,
+    describeContinuingOperations: () => IDaemonContinuingOperations | undefined
+  ): Promise<IRequestLease> {
+    return controller.acquireAsync(
+      scheduler,
+      RequestExclusivityClass.Exclusive,
+      undefined,
+      describeContinuingOperations
+    );
+  }
+
+  it('names them as stopping while it waits first in the queue only for leases that are preemptible', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    // Like the work of a failed build that returned early, which is no longer described once it is stopped.
+    let continuing: IDaemonContinuingOperations | undefined = CONTINUING;
+    scheduler.markLeasePreemptible(leftover, () => (continuing = undefined));
+    const describeContinuing = (): IDaemonContinuingOperations | undefined => continuing;
+
+    const rebuild: IReportingController = createReportingController('rebuild');
+    const rebuildLease: Promise<IRequestLease> = acquireExclusiveAsync(
+      rebuild,
+      scheduler,
+      describeContinuing
+    );
+    expect(continuing).toBeUndefined();
+    // A later request queues while they stop, so the first one's position is reported again.
+    const later: IReportingController = createReportingController('later');
+    const laterLease: Promise<IRequestLease> = acquireExclusiveAsync(later, scheduler, describeContinuing);
+    leftover.release();
+    (await rebuildLease).release();
+    (await laterLease).release();
+
+    expect(rebuild.positions).toEqual([
+      { position: 1, requestId: 'rebuild', continuingOperations: STOPPING },
+      { position: 1, requestId: 'rebuild', continuingOperations: STOPPING }
+    ]);
+    // The later request waited for the first one, not only while the operations stopped.
+    expect(later.positions).toEqual([
+      { position: 2, requestId: 'later' },
+      { position: 1, requestId: 'later' }
+    ]);
+    rebuild.controller.dispose();
+    later.controller.dispose();
+  });
+
+  it('reports a plain position behind a lease that is not preemptible, or if no operation is named', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    scheduler.markLeasePreemptible(leftover, () => leftover.release());
+    const behindRunning: IReportingController = createReportingController('behind-running');
+    const behindRunningLease: Promise<IRequestLease> = acquireExclusiveAsync(
+      behindRunning,
+      scheduler,
+      () => CONTINUING
+    );
+    running.release();
+    (await behindRunningLease).release();
+    expect(behindRunning.positions).toEqual([{ position: 1, requestId: 'behind-running' }]);
+
+    const unnamed: IReportingController = createReportingController('unnamed');
+    const other: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    scheduler.markLeasePreemptible(other, () => other.release());
+    (await acquireExclusiveAsync(unnamed, scheduler, () => undefined)).release();
+    expect(unnamed.positions).toEqual([{ position: 1, requestId: 'unnamed' }]);
+    behindRunning.controller.dispose();
+    unnamed.controller.dispose();
+  });
+});

From 40ed1fc2127dde7c5a4c91289596c6283c15e407 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:07:55 +0000
Subject: [PATCH 252/265] [rig-package] Name the package in the missing "-rig"
 suffix error

Swarm integration step 237; original commit 3e71185392 (merge of swarm/o08-d551-t2 at 66bf274454).
Scope: task 350, D55.1 T2: rig-package's missing -rig suffix error names the wrong field.

Brings 350 (branch swarm/o08-d551-t2). Second agent: o03 board 9087 (CLAIM board 8944). Evidence: ch01's GATE OK board 9991.

Batch E2k part 1 (K1), item 1 of 5. Gate: ch01 GATE OK board 9991 (tree da36e22e70)

Commits folded into this step (1):
- 66bf274454 rig-package: name the package in the missing "-rig" suffix error

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../swarm-o08-d551-t2_2026-09-30-05-38.json   | 11 ++++++++
 libraries/rig-package/src/RigConfig.ts        |  2 +-
 .../rig-package/src/test/RigConfig.test.ts    | 26 +++++++++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@rushstack/rig-package/swarm-o08-d551-t2_2026-09-30-05-38.json

diff --git a/common/changes/@rushstack/rig-package/swarm-o08-d551-t2_2026-09-30-05-38.json b/common/changes/@rushstack/rig-package/swarm-o08-d551-t2_2026-09-30-05-38.json
new file mode 100644
index 0000000000..9c7c332398
--- /dev/null
+++ b/common/changes/@rushstack/rig-package/swarm-o08-d551-t2_2026-09-30-05-38.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rig-package",
+      "comment": "Fix an issue where the error for a \"rigPackageName\" without the \"-rig\" suffix quoted the \"rigProfile\" value instead of the package name.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rig-package",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rig-package/src/RigConfig.ts b/libraries/rig-package/src/RigConfig.ts
index e3b5e92847..a92075dc98 100644
--- a/libraries/rig-package/src/RigConfig.ts
+++ b/libraries/rig-package/src/RigConfig.ts
@@ -532,7 +532,7 @@ function _validateSchema(json: IRigConfigJson): void {
 
   if (!_rigNameRegExp.test(json.rigPackageName)) {
     throw new Error(
-      `The "rigPackageName" value is missing the "-rig" suffix: ` + JSON.stringify(json.rigProfile)
+      `The "rigPackageName" value is missing the "-rig" suffix: ` + JSON.stringify(json.rigPackageName)
     );
   }
 
diff --git a/libraries/rig-package/src/test/RigConfig.test.ts b/libraries/rig-package/src/test/RigConfig.test.ts
index 0e1edd227f..36c785ecb5 100644
--- a/libraries/rig-package/src/test/RigConfig.test.ts
+++ b/libraries/rig-package/src/test/RigConfig.test.ts
@@ -151,6 +151,32 @@ describe(RigConfig.name, () => {
     });
   });
 
+  describe('reports a rigPackageName without the "-rig" suffix', () => {
+    it('synchronously', () => {
+      expect(() =>
+        RigConfig.loadForProjectFolder({
+          projectFolderPath: testProjectFolder,
+          overrideRigJsonObject: {
+            rigPackageName: 'example-package',
+            rigProfile: 'web-app'
+          }
+        })
+      ).toThrow('The "rigPackageName" value is missing the "-rig" suffix: "example-package"');
+    });
+
+    it('asynchronously', async () => {
+      await expect(
+        RigConfig.loadForProjectFolderAsync({
+          projectFolderPath: testProjectFolder,
+          overrideRigJsonObject: {
+            rigPackageName: 'example-package',
+            rigProfile: 'web-app'
+          }
+        })
+      ).rejects.toThrow('The "rigPackageName" value is missing the "-rig" suffix: "example-package"');
+    });
+  });
+
   describe('resolves a config file path', () => {
     it('synchronously', () => {
       const rigConfig: RigConfig = RigConfig.loadForProjectFolder({

From 0e7f4ceab8208d3e483244d4c2ecf34c29609484 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:07:55 +0000
Subject: [PATCH 253/265] [rush-lib] Quote custom parameter values for the
 shell that runs a project's script

Swarm integration step 238; original commit dc83bf8af5 (merge of swarm/r03-d551-t1 at e89a36bdea).
Scope: task 349, D55.1 T1: quote custom parameter values in shell commands.

Brings 349 (branch swarm/r03-d551-t1). Second agent: o08 board 9188. Evidence: ch01's GATE OK board 9991.

Batch E2k part 1 (K1), item 2 of 5. Gate: ch01 GATE OK board 9991 (tree 73b7b3b630)

Commits folded into this step (1):
- e89a36bdea [rush-lib] Quote custom parameter values for the shell that runs a project's script

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...tom-parameter-values_2026-09-30-05-35.json |  11 ++
 .../operations/ShardedPhaseOperationPlugin.ts |  15 +-
 .../operations/ShellOperationRunnerPlugin.ts  |  41 ++++-
 .../test/ShardedPhaseOperationPlugin.test.ts  | 167 +++++++++++++++++
 .../test/ShellOperationRunnerPlugin.test.ts   | 170 +++++++++++++++++-
 .../a/config/rush-project.json                |  11 ++
 .../test/shardedParameterRepo/a/package.json  |   8 +
 .../common/config/rush/command-line.json      |  13 ++
 .../logic/test/shardedParameterRepo/rush.json |  12 ++
 .../src/utilities/executionUtilities.ts       |  38 ++++
 .../utilities/test/executionUtilities.test.ts |  93 ++++++++++
 11 files changed, 561 insertions(+), 18 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/quote-custom-parameter-values_2026-09-30-05-35.json
 create mode 100644 libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts
 create mode 100644 libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json
 create mode 100644 libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json
 create mode 100644 libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json
 create mode 100644 libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json
 create mode 100644 libraries/rush-lib/src/utilities/test/executionUtilities.test.ts

diff --git a/common/changes/@microsoft/rush/quote-custom-parameter-values_2026-09-30-05-35.json b/common/changes/@microsoft/rush/quote-custom-parameter-values_2026-09-30-05-35.json
new file mode 100644
index 0000000000..2e729bc6aa
--- /dev/null
+++ b/common/changes/@microsoft/rush/quote-custom-parameter-values_2026-09-30-05-35.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Quote the values of custom command-line parameters for the shell when Rush appends them to a project's script, so that a value such as `bump|x`, `a b` or `$HOME` reaches the script as one literal argument instead of being parsed by the shell. Values made only of ASCII letters, digits and `_@%+=:,./-` are appended as before on every OS. Other values may be quoted, depending on the OS's shell, which changes the build cache key of an operation that receives one, and that key can now differ between POSIX and Windows. A value that already includes its own quotes as a workaround, such as `--test-path-pattern='\"bump|x\"'`, now reaches the script with those quotes.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts b/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts
index 9be45e9734..be2df3bb07 100644
--- a/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/ShardedPhaseOperationPlugin.ts
@@ -123,8 +123,7 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
       const { parameterValues: customParameterValues, ignoredParameterValues } =
         getCustomParameterValues(operation);
 
-      const collatorParameters: string[] = [
-        ...customParameterValues,
+      const collatorArguments: string[] = [
         `--shard-parent-folder="${parentFolder}"`,
         `--shard-count="${shards}"`
       ];
@@ -140,7 +139,8 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
         rushConfiguration,
         initialCommand: commandToRun,
         incrementalCommand: undefined,
-        customParameterValues: collatorParameters,
+        customParameterValues,
+        preformattedArguments: collatorArguments,
         ignoredParameterValues
       });
 
@@ -197,11 +197,7 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
           shard.toString()
         );
 
-        const shardedParameters: string[] = [
-          ...customParameterValues,
-          shardArgument,
-          outputDirectoryArgumentWithShard
-        ];
+        const shardArguments: string[] = [shardArgument, outputDirectoryArgumentWithShard];
 
         const shardDisplayName: string = `${getDisplayName(phase, project)} - shard ${shard}/${shards}`;
 
@@ -210,7 +206,8 @@ function spliceShards(existingOperations: Set<Operation>, context: ICreateOperat
           project,
           initialCommand: baseCommand,
           incrementalCommand: undefined,
-          customParameterValues: shardedParameters,
+          customParameterValues,
+          preformattedArguments: shardArguments,
           displayName: shardDisplayName,
           rushConfiguration,
           ignoredParameterValues
diff --git a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
index 89f489a632..dc0889a04a 100644
--- a/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/ShellOperationRunnerPlugin.ts
@@ -15,7 +15,7 @@ import type {
 import type { Operation } from './Operation';
 import type { RushConfiguration } from '../../api/RushConfiguration';
 import type { IOperationRunner } from './IOperationRunner';
-import { IS_WINDOWS } from '../../utilities/executionUtilities';
+import { IS_WINDOWS, quoteShellArgumentIfNeeded } from '../../utilities/executionUtilities';
 
 export const PLUGIN_NAME: 'ShellOperationRunnerPlugin' = 'ShellOperationRunnerPlugin';
 
@@ -100,7 +100,15 @@ export function initializeShellOperationRunner(options: {
    */
   incrementalCommandRequiresGuard?: boolean;
   commandForHash?: string;
+  /**
+   * The custom parameter values. Each one is quoted for the shell if it needs it.
+   */
   customParameterValues: ReadonlyArray<string>;
+  /**
+   * Arguments that are already written for the shell, such as the sharding arguments.
+   * They are appended after the custom parameter values, without quoting.
+   */
+  preformattedArguments?: ReadonlyArray<string>;
   ignoredParameterValues: ReadonlyArray<string>;
 }): IOperationRunner {
   const {
@@ -120,18 +128,22 @@ export function initializeShellOperationRunner(options: {
   }
 
   if (rawInitialCommand) {
-    const { commandForHash: rawCommandForHash, customParameterValues } = options;
+    const { commandForHash: rawCommandForHash, customParameterValues, preformattedArguments } = options;
 
-    const initialCommand: string = formatCommand(rawInitialCommand, customParameterValues);
+    const initialCommand: string = formatCommand(
+      rawInitialCommand,
+      customParameterValues,
+      preformattedArguments
+    );
     let incrementalCommand: string | undefined = rawIncrementalCommand
-      ? formatCommand(rawIncrementalCommand, customParameterValues)
+      ? formatCommand(rawIncrementalCommand, customParameterValues, preformattedArguments)
       : undefined;
     if (incrementalCommandRequiresGuard && incrementalCommand === initialCommand) {
       // Running it as the incremental command would only prevent its results from being cached.
       incrementalCommand = undefined;
     }
     const commandForHash: string = rawCommandForHash
-      ? formatCommand(rawCommandForHash, customParameterValues)
+      ? formatCommand(rawCommandForHash, customParameterValues, preformattedArguments)
       : initialCommand;
 
     return new ShellOperationRunner({
@@ -252,12 +264,25 @@ export function getCustomParameterValuesByOperation(): (
   return getCustomParameterValuesForOp;
 }
 
-export function formatCommand(rawCommand: string, customParameterValues: ReadonlyArray<string>): string {
+/**
+ * Appends the custom parameter values to a command, each quoted for the shell that runs the command
+ * if it needs it (see `quoteShellArgumentIfNeeded`), and then the preformatted arguments as they are.
+ */
+export function formatCommand(
+  rawCommand: string,
+  customParameterValues: ReadonlyArray<string>,
+  preformattedArguments: ReadonlyArray<string> = [],
+  isWindows: boolean = IS_WINDOWS
+): string {
   if (!rawCommand) {
     return '';
   } else {
-    const fullCommand: string = `${rawCommand} ${customParameterValues.join(' ')}`;
-    return IS_WINDOWS ? convertSlashesForWindows(fullCommand) : fullCommand;
+    const shellArguments: string[] = customParameterValues.map((value: string) =>
+      quoteShellArgumentIfNeeded(value, isWindows)
+    );
+    shellArguments.push(...preformattedArguments);
+    const fullCommand: string = `${rawCommand} ${shellArguments.join(' ')}`;
+    return isWindows ? convertSlashesForWindows(fullCommand) : fullCommand;
   }
 }
 
diff --git a/libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts
new file mode 100644
index 0000000000..dbcd1a8a04
--- /dev/null
+++ b/libraries/rush-lib/src/logic/operations/test/ShardedPhaseOperationPlugin.test.ts
@@ -0,0 +1,167 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import path from 'node:path';
+
+import { JsonFile } from '@rushstack/node-core-library';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { CommandLineAction, CommandLineParser, type CommandLineParameter } from '@rushstack/ts-command-line';
+
+import { RushConfiguration } from '../../../api/RushConfiguration';
+import {
+  CommandLineConfiguration,
+  type IPhasedCommandConfig,
+  type IParameterJson,
+  type IPhase
+} from '../../../api/CommandLineConfiguration';
+import type { ICommandLineJson } from '../../../api/CommandLineJson';
+import type { RushConfigurationProject } from '../../../api/RushConfigurationProject';
+import { RushProjectConfiguration } from '../../../api/RushProjectConfiguration';
+import { defineCustomParameters } from '../../../cli/parsing/defineCustomParameters';
+import { associateParametersByPhase } from '../../../cli/parsing/associateParametersByPhase';
+import {
+  type ICreateOperationsContext,
+  PhasedCommandHooks
+} from '../../../pluginFramework/PhasedCommandHooks';
+import { IS_WINDOWS } from '../../../utilities/executionUtilities';
+import type { Operation } from '../Operation';
+import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
+import { ShardedPhasedOperationPlugin } from '../ShardedPhaseOperationPlugin';
+import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
+
+class TestCommandLineAction extends CommandLineAction {
+  protected async onExecuteAsync(): Promise<void> {
+    // No-op for testing
+  }
+}
+
+class TestCommandLineParser extends CommandLineParser {
+  public constructor() {
+    super({
+      toolFilename: 'test-tool',
+      toolDescription: 'Test tool for parameter parsing'
+    });
+  }
+}
+
+const PARENT_FOLDER_ARGUMENT: string = '--shard-parent-folder=".rush/operations/build/shards/"';
+const SHARD_COUNT_ARGUMENT: string = '--shard-count="2"';
+
+/**
+ * Creates the operations of shardedParameterRepo's `build` command for the given command line, and returns
+ * the command of each operation, by its log filename identifier.
+ */
+async function getCommandsByLogFilenameIdentifierAsync(argv: string[]): Promise<Map<string, string>> {
+  const repoFolder: string = path.resolve(__dirname, '../../test/shardedParameterRepo');
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    `${repoFolder}/rush.json`
+  );
+  const commandLineJson: ICommandLineJson = JsonFile.load(
+    `${repoFolder}/common/config/rush/command-line.json`
+  );
+  const buildCommand: IPhasedCommandConfig = new CommandLineConfiguration(commandLineJson).commands.get(
+    'build'
+  )! as IPhasedCommandConfig;
+
+  const projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+    await RushProjectConfiguration.tryLoadForProjectsAsync(
+      rushConfiguration.projects,
+      new Terminal(new StringBufferTerminalProvider())
+    );
+
+  const parser: TestCommandLineParser = new TestCommandLineParser();
+  const action: TestCommandLineAction = new TestCommandLineAction({
+    actionName: 'build',
+    summary: 'Test build action',
+    documentation: 'Test'
+  });
+  parser.addAction(action);
+  const customParametersMap: Map<IParameterJson, CommandLineParameter> = new Map();
+  defineCustomParameters(action, buildCommand.associatedParameters, customParametersMap);
+  await parser.executeWithoutErrorHandlingAsync(argv);
+
+  const phasesMap: Map<string, IPhase> = new Map();
+  for (const phase of buildCommand.phases) {
+    phasesMap.set(phase.name, phase);
+  }
+  associateParametersByPhase(customParametersMap, phasesMap);
+
+  const customParameters: Map<string, CommandLineParameter> = new Map();
+  for (const [parameterJson, parameter] of customParametersMap) {
+    customParameters.set(parameterJson.longName, parameter);
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new ShardedPhasedOperationPlugin().apply(hooks);
+  new ShellOperationRunnerPlugin().apply(hooks);
+  const context: Pick<
+    ICreateOperationsContext,
+    'phaseSelection' | 'projectSelection' | 'projectConfigurations' | 'rushConfiguration' | 'customParameters'
+  > = {
+    phaseSelection: buildCommand.phases,
+    projectSelection: new Set(rushConfiguration.projects),
+    projectConfigurations,
+    rushConfiguration,
+    customParameters
+  };
+  const operations: Set<Operation> = await hooks.createOperationsAsync.promise(
+    new Set(),
+    context as unknown as ICreateOperationsContext
+  );
+
+  const commandsByLogFilenameIdentifier: Map<string, string> = new Map();
+  for (const operation of operations) {
+    commandsByLogFilenameIdentifier.set(operation.logFilenameIdentifier, operation.runner!.getConfigHash());
+  }
+  return commandsByLogFilenameIdentifier;
+}
+
+describe(ShardedPhasedOperationPlugin.name, () => {
+  it('S1: leaves the commands of a value that needs no quoting as they were', async () => {
+    const commands: Map<string, string> = await getCommandsByLogFilenameIdentifierAsync([
+      'build',
+      '--pattern',
+      'abc'
+    ]);
+
+    expect(commands).toEqual(
+      new Map([
+        ['build_pre-shard', ''],
+        ['build_collate', `echo collate a --pattern abc ${PARENT_FOLDER_ARGUMENT} ${SHARD_COUNT_ARGUMENT}`],
+        [
+          'build_shard_1',
+          'echo shard a --pattern abc --shard=1/2 --shard-output-directory=.rush/operations/build/shards/1'
+        ],
+        [
+          'build_shard_2',
+          'echo shard a --pattern abc --shard=2/2 --shard-output-directory=.rush/operations/build/shards/2'
+        ]
+      ])
+    );
+  });
+
+  describe('with a value that the shell would parse', () => {
+    const quotedPattern: string = IS_WINDOWS ? '"a|b"' : "'a|b'";
+    let commands: Map<string, string>;
+
+    beforeAll(async () => {
+      commands = await getCommandsByLogFilenameIdentifierAsync(['build', '--pattern', 'a|b']);
+    });
+
+    it("S2: quotes the value in the collator's command, but not the collator's arguments", () => {
+      expect(commands.get('build_collate')).toEqual(
+        `echo collate a --pattern ${quotedPattern} ${PARENT_FOLDER_ARGUMENT} ${SHARD_COUNT_ARGUMENT}`
+      );
+    });
+
+    it.each([1, 2])(
+      "S3: quotes the value in shard %s's command, but not the shard's arguments",
+      (shard: number) => {
+        expect(commands.get(`build_shard_${shard}`)).toEqual(
+          `echo shard a --pattern ${quotedPattern} --shard=${shard}/2 --shard-output-directory=.rush/operations/build/shards/${shard}`
+        );
+      }
+    );
+  });
+});
diff --git a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
index 78237670cb..8ef04c5d8a 100644
--- a/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/ShellOperationRunnerPlugin.test.ts
@@ -30,7 +30,7 @@ import type { RushConfigurationProject } from '../../../api/RushConfigurationPro
 import { Utilities } from '../../../utilities/Utilities';
 import type { ICommandLineJson } from '../../../api/CommandLineJson';
 import { PhasedOperationPlugin } from '../PhasedOperationPlugin';
-import { ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
+import { formatCommand, ShellOperationRunnerPlugin } from '../ShellOperationRunnerPlugin';
 import {
   type ICreateOperationsContext,
   PhasedCommandHooks
@@ -39,6 +39,7 @@ import { RushProjectConfiguration } from '../../../api/RushProjectConfiguration'
 import { defineCustomParameters } from '../../../cli/parsing/defineCustomParameters';
 import { associateParametersByPhase } from '../../../cli/parsing/associateParametersByPhase';
 import { getCommandExecution, setIncrementalExecutionGuard } from '../IncrementalExecutionState';
+import { IS_WINDOWS } from '../../../utilities/executionUtilities';
 
 interface ISerializedOperation {
   name: string;
@@ -73,6 +74,65 @@ class TestCommandLineParser extends CommandLineParser {
   }
 }
 
+/**
+ * Creates the operations of parameterIgnoringRepo's `build` command, for the given command line.
+ */
+async function createParameterIgnoringRepoOperationsAsync(argv: string[]): Promise<Set<Operation>> {
+  const repoFolder: string = path.resolve(__dirname, '../../test/parameterIgnoringRepo');
+  const rushConfiguration: RushConfiguration = RushConfiguration.loadFromConfigurationFile(
+    `${repoFolder}/rush.json`
+  );
+  const commandLineJson: ICommandLineJson = JsonFile.load(
+    `${repoFolder}/common/config/rush/command-line.json`
+  );
+  const buildCommand: IPhasedCommandConfig = new CommandLineConfiguration(commandLineJson).commands.get(
+    'build'
+  )! as IPhasedCommandConfig;
+
+  const projectConfigurations: ReadonlyMap<RushConfigurationProject, RushProjectConfiguration> =
+    await RushProjectConfiguration.tryLoadForProjectsAsync(
+      rushConfiguration.projects,
+      new Terminal(new StringBufferTerminalProvider())
+    );
+
+  const parser: TestCommandLineParser = new TestCommandLineParser();
+  const action: TestCommandLineAction = new TestCommandLineAction({
+    actionName: 'build',
+    summary: 'Test build action',
+    documentation: 'Test'
+  });
+  parser.addAction(action);
+  const customParametersMap: Map<IParameterJson, CommandLineParameter> = new Map();
+  defineCustomParameters(action, buildCommand.associatedParameters, customParametersMap);
+  await parser.executeWithoutErrorHandlingAsync(argv);
+
+  const phasesMap: Map<string, IPhase> = new Map();
+  for (const phase of buildCommand.phases) {
+    phasesMap.set(phase.name, phase);
+  }
+  associateParametersByPhase(customParametersMap, phasesMap);
+
+  const customParameters: Map<string, CommandLineParameter> = new Map();
+  for (const [parameterJson, parameter] of customParametersMap) {
+    customParameters.set(parameterJson.longName, parameter);
+  }
+
+  const hooks: PhasedCommandHooks = new PhasedCommandHooks();
+  new PhasedOperationPlugin().apply(hooks);
+  new ShellOperationRunnerPlugin().apply(hooks);
+  const context: Pick<
+    ICreateOperationsContext,
+    'phaseSelection' | 'projectSelection' | 'projectConfigurations' | 'rushConfiguration' | 'customParameters'
+  > = {
+    phaseSelection: buildCommand.phases,
+    projectSelection: new Set(rushConfiguration.projects),
+    projectConfigurations,
+    rushConfiguration,
+    customParameters
+  };
+  return await hooks.createOperationsAsync.promise(new Set(), context as unknown as ICreateOperationsContext);
+}
+
 describe(ShellOperationRunnerPlugin.name, () => {
   it('shellCommand "echo custom shellCommand" should be set to commandToRun', async () => {
     const rushJsonFile: string = path.resolve(__dirname, `../../test/customShellCommandinBulkRepo/rush.json`);
@@ -275,6 +335,35 @@ describe(ShellOperationRunnerPlugin.name, () => {
     expect(Array.from(operations, serializeOperation)).toMatchSnapshot();
   });
 
+  it('I2: quotes the parameter values that the shell would parse', async () => {
+    const operations: Set<Operation> = await createParameterIgnoringRepoOperationsAsync([
+      'build',
+      '--production',
+      '--verbose',
+      '--config',
+      'cfg dir/a|b.json',
+      '--mode',
+      'prod',
+      '--tags',
+      '$HOME',
+      '--tags',
+      'x(y'
+    ]);
+
+    expect(Array.from(operations, serializeOperation)).toEqual([
+      {
+        name: 'a',
+        commandToRun: IS_WINDOWS
+          ? 'echo building a --verbose --config "cfg dir/a|b.json" --mode prod --tags $HOME --tags "x(y"'
+          : "echo building a --verbose --config 'cfg dir/a|b.json' --mode prod --tags '$HOME' --tags 'x(y'"
+      },
+      {
+        name: 'b',
+        commandToRun: 'echo building b --production'
+      }
+    ]);
+  });
+
   it.each([
     [false, ['node build.js', 'node build.js']],
     [true, ['node build.js', 'node build.js --incremental']]
@@ -466,3 +555,82 @@ describe(ShellOperationRunnerPlugin.name, () => {
     });
   });
 });
+
+describe(formatCommand.name, () => {
+  const bValues: string[] = [
+    '--verbose',
+    '--config',
+    '/path/to/config.json',
+    '--mode',
+    'prod',
+    '--tags',
+    'tag1',
+    '--tags',
+    'tag2'
+  ];
+
+  it('F1: quotes a value for sh', () => {
+    expect(formatCommand('heft test', ['--test-path-pattern', 'bump|x'], [], false)).toEqual(
+      "heft test --test-path-pattern 'bump|x'"
+    );
+  });
+
+  it('F2: quotes a value for cmd.exe', () => {
+    expect(formatCommand('heft test', ['--test-path-pattern', 'bump|x'], [], true)).toEqual(
+      'heft test --test-path-pattern "bump|x"'
+    );
+  });
+
+  it.each([false, true])(
+    'F3: leaves values that need no quoting as they were (isWindows: %s)',
+    (isWindows: boolean) => {
+      expect(formatCommand('echo building a', bValues, [], isWindows)).toEqual(
+        `echo building a ${bValues.join(' ')}`
+      );
+    }
+  );
+
+  it.each([false, true])(
+    'F4: keeps the trailing space when there are no values (isWindows: %s)',
+    (isWindows: boolean) => {
+      expect(formatCommand('echo custom shellCommand', [], [], isWindows)).toEqual(
+        'echo custom shellCommand '
+      );
+    }
+  );
+
+  it('F5: appends the preformatted arguments after the quoted values', () => {
+    expect(
+      formatCommand(
+        'heft test',
+        ['--p', 'a b'],
+        ['--shard=1/3', '--shard-output-directory=.rush/operations/x/shards/1'],
+        false
+      )
+    ).toEqual("heft test --p 'a b' --shard=1/3 --shard-output-directory=.rush/operations/x/shards/1");
+  });
+
+  it('F6: does not quote the preformatted arguments', () => {
+    expect(
+      formatCommand(
+        'heft test',
+        ['--p', 'x'],
+        ['--shard-parent-folder=".rush/operations/x/shards/"', '--shard-count="3"'],
+        false
+      )
+    ).toEqual('heft test --p x --shard-parent-folder=".rush/operations/x/shards/" --shard-count="3"');
+  });
+
+  it("F7: still converts the slashes of the command's first token on Windows", () => {
+    expect(formatCommand('node_modules/.bin/heft test', ['--p', 'a b'], [], true)).toEqual(
+      'node_modules\\.bin\\heft test --p "a b"'
+    );
+  });
+
+  it.each([false, true])(
+    'F8: returns an empty string for an empty command (isWindows: %s)',
+    (isWindows: boolean) => {
+      expect(formatCommand('', ['--p', 'x'], [], isWindows)).toEqual('');
+    }
+  );
+});
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json
new file mode 100644
index 0000000000..3be56ee0ac
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/config/rush-project.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush-project.schema.json",
+  "operationSettings": [
+    {
+      "operationName": "build",
+      "sharding": {
+        "count": 2
+      }
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json
new file mode 100644
index 0000000000..969cbe6349
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/a/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "a",
+  "version": "1.0.0",
+  "scripts": {
+    "build": "echo collate a",
+    "build:shard": "echo shard a"
+  }
+}
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json
new file mode 100644
index 0000000000..a54e2a58c3
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/common/config/rush/command-line.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/command-line.schema.json",
+  "commands": [],
+  "parameters": [
+    {
+      "longName": "--pattern",
+      "description": "A pattern",
+      "parameterKind": "string",
+      "argumentName": "PATTERN",
+      "associatedCommands": ["build"]
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json b/libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json
new file mode 100644
index 0000000000..e0f439d063
--- /dev/null
+++ b/libraries/rush-lib/src/logic/test/shardedParameterRepo/rush.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush.schema.json",
+  "rushVersion": "5.162.0",
+  "pnpmVersion": "8.15.9",
+  "nodeSupportedVersionRange": ">=20.0.0",
+  "projects": [
+    {
+      "packageName": "a",
+      "projectFolder": "a"
+    }
+  ]
+}
diff --git a/libraries/rush-lib/src/utilities/executionUtilities.ts b/libraries/rush-lib/src/utilities/executionUtilities.ts
index 18bc33229c..0b170cfa99 100644
--- a/libraries/rush-lib/src/utilities/executionUtilities.ts
+++ b/libraries/rush-lib/src/utilities/executionUtilities.ts
@@ -3,6 +3,44 @@
 
 export const IS_WINDOWS: boolean = process.platform === 'win32';
 
+// The characters that Python's shlex.quote() leaves unquoted.
+const POSIX_SAFE_ARGUMENT_REGEXP: RegExp = /^[A-Za-z0-9_@%+=:,./-]+$/;
+// Whitespace, and the characters that cmd.exe or the MSVC argument parser treat specially.
+const WINDOWS_UNSAFE_ARGUMENT_REGEXP: RegExp = /[\s"&|<>()^]/;
+// A run of backslashes, followed by a double quote or the end of the value.
+const WINDOWS_BACKSLASHES_BEFORE_QUOTE_REGEXP: RegExp = /(\\*)("|$)/g;
+
+/**
+ * Quotes an argument so that the shell that runs a lifecycle command (`sh -c` on POSIX,
+ * `cmd.exe /d /s /c` on Windows) passes it to the command as one literal argument.
+ * An argument that needs no quoting is returned unchanged.
+ *
+ * @remarks
+ * On Windows, the argument is wrapped in double quotes. An embedded double quote is written as `""`,
+ * which keeps cmd.exe's quote state in step with the argument parser's, and the backslashes before it,
+ * or before the closing quote, are doubled. cmd.exe still expands `%NAME%` inside double quotes.
+ */
+export function quoteShellArgumentIfNeeded(argument: string, isWindows: boolean = IS_WINDOWS): string {
+  if (isWindows) {
+    if (argument && !WINDOWS_UNSAFE_ARGUMENT_REGEXP.test(argument)) {
+      return argument;
+    }
+
+    const escapedArgument: string = argument.replace(
+      WINDOWS_BACKSLASHES_BEFORE_QUOTE_REGEXP,
+      (match: string, backslashes: string, quote: string) =>
+        `${backslashes}${backslashes}${quote ? '""' : ''}`
+    );
+    return `"${escapedArgument}"`;
+  } else {
+    if (POSIX_SAFE_ARGUMENT_REGEXP.test(argument)) {
+      return argument;
+    }
+
+    return `'${argument.replace(/'/g, `'\\''`)}'`;
+  }
+}
+
 export function escapeArgumentIfNeeded(command: string, isWindows: boolean = IS_WINDOWS): string {
   if (command.includes(' ')) {
     if (isWindows) {
diff --git a/libraries/rush-lib/src/utilities/test/executionUtilities.test.ts b/libraries/rush-lib/src/utilities/test/executionUtilities.test.ts
new file mode 100644
index 0000000000..00731b2fb5
--- /dev/null
+++ b/libraries/rush-lib/src/utilities/test/executionUtilities.test.ts
@@ -0,0 +1,93 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as childProcess from 'node:child_process';
+
+import { IS_WINDOWS, quoteShellArgumentIfNeeded } from '../executionUtilities';
+
+const POSIX_SAFE_ARGUMENTS: string[] = [
+  '--test-path-pattern',
+  'bump',
+  'src/logic/foo.test.ts',
+  '@scope/pkg',
+  'a=b,c:d+e%',
+  '1.2.3',
+  '_x-Y'
+];
+
+const POSIX_QUOTED_ARGUMENTS: [string, string, string][] = [
+  ['QP2', 'bump|x', "'bump|x'"],
+  ['QP3', 'debarrel-(a|b)', "'debarrel-(a|b)'"],
+  ['QP4', 'a b', "'a b'"],
+  ['QP5', '$HOME', "'$HOME'"],
+  ['QP6', '`id`', "'`id`'"],
+  ['QP7', "it's", "'it'\\''s'"],
+  ['QP8', 'say "hi"', '\'say "hi"\''],
+  ['QP9', '*.ts', "'*.ts'"],
+  ['QP9', '~/x', "'~/x'"],
+  ['QP9', 'a;b&c>d<e', "'a;b&c>d<e'"],
+  ['QP9', 'back\\slash', "'back\\slash'"],
+  ['QP10', '', "''"],
+  ['QP11', 'line1\nline2', "'line1\nline2'"]
+];
+
+const WINDOWS_SAFE_ARGUMENTS: string[] = [
+  '--test-path-pattern',
+  'bump',
+  'C:\\repo\\src\\',
+  '50%',
+  '$HOME',
+  "it's",
+  '*.ts',
+  'a;b,c=d'
+];
+
+const WINDOWS_QUOTED_ARGUMENTS: [string, string, string][] = [
+  ['QW2', 'bump|x', '"bump|x"'],
+  ['QW3', 'debarrel-(a|b)', '"debarrel-(a|b)"'],
+  ['QW4', 'a b', '"a b"'],
+  ['QW4', 'a&b', '"a&b"'],
+  ['QW4', 'a^b', '"a^b"'],
+  ['QW4', 'a<b>c', '"a<b>c"'],
+  ['QW5', 'say "hi"', '"say ""hi"""'],
+  ['QW6', 'C:\\dir with space\\', '"C:\\dir with space\\\\"'],
+  ['QW7', 'a\\"b', '"a\\\\""b"'],
+  ['QW8', '', '""'],
+  ['A2', 'a\tb', '"a\tb"']
+];
+
+describe(quoteShellArgumentIfNeeded.name, () => {
+  describe('POSIX', () => {
+    it.each(POSIX_SAFE_ARGUMENTS)('QP1: leaves %j unchanged', (argument: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, false)).toEqual(argument);
+    });
+
+    it.each(POSIX_QUOTED_ARGUMENTS)('%s: quotes %j', (row: string, argument: string, expected: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, false)).toEqual(expected);
+    });
+
+    (IS_WINDOWS ? it.skip : it).each([
+      ...POSIX_SAFE_ARGUMENTS,
+      ...POSIX_QUOTED_ARGUMENTS.map(([, argument]) => argument)
+    ])('R1: sh passes %j through as one literal argument', (argument: string) => {
+      const result: childProcess.SpawnSyncReturns<string> = childProcess.spawnSync(
+        'sh',
+        ['-c', `set -- ${quoteShellArgumentIfNeeded(argument, false)}; printf '%s:%s' "$#" "$1"`],
+        { encoding: 'utf8' }
+      );
+      expect(result.stderr).toEqual('');
+      expect(result.status).toEqual(0);
+      expect(result.stdout).toEqual(`1:${argument}`);
+    });
+  });
+
+  describe('Windows', () => {
+    it.each(WINDOWS_SAFE_ARGUMENTS)('QW1: leaves %j unchanged', (argument: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, true)).toEqual(argument);
+    });
+
+    it.each(WINDOWS_QUOTED_ARGUMENTS)('%s: quotes %j', (row: string, argument: string, expected: string) => {
+      expect(quoteShellArgumentIfNeeded(argument, true)).toEqual(expected);
+    });
+  });
+});

From 17e72527e0be0a6a28f15fecddfb32845eb11824 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:07:55 +0000
Subject: [PATCH 254/265] [rush-lib] Read a warm worker's input folders before
 its command starts

Swarm integration step 239; original commit 83cc7cfc3d (merge of swarm/o07-d551-t5 at 5de59478c8).
Scope: task 353, D55.1 T5: a warm TypeScript watch worker sees edits after a folder is recreated.

Brings 353 (branch swarm/o07-d551-t5). Second agent: t03 board 9224. Evidence: ch01's GATE OK board 9991.

Batch E2k part 1 (K1), item 3 of 5. Gate: ch01 GATE OK board 9991 (tree def670f873)

Commits folded into this step (1):
- 5de59478c8 [rush-lib] Read a warm worker's input folders before its command starts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...er-first-run-folders_2026-09-30-05-40.json | 11 ++++
 docs/rush/dogfooding-rush-daemon.md           |  5 +-
 .../IncrementalExecutionGuardPlugin.ts        | 27 +++-----
 .../operations/IncrementalExecutionState.ts   | 14 ++++-
 .../IncrementalExecutionGuardPlugin.test.ts   | 62 ++++++++++++++++---
 5 files changed, 92 insertions(+), 27 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/warm-worker-first-run-folders_2026-09-30-05-40.json

diff --git a/common/changes/@microsoft/rush/warm-worker-first-run-folders_2026-09-30-05-40.json b/common/changes/@microsoft/rush/warm-worker-first-run-folders_2026-09-30-05-40.json
new file mode 100644
index 0000000000..9faea83345
--- /dev/null
+++ b/common/changes/@microsoft/rush/warm-worker-first-run-folders_2026-09-30-05-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "The Rush daemon now reads the folders that hold an operation's input files when its runner reports a command that watches them, before the command starts. It read them only after the first run of a new warm worker, so if such a folder was recreated during that run with its files moved into the new folder, the next build could reuse a worker whose file watcher had lost the folder.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/docs/rush/dogfooding-rush-daemon.md b/docs/rush/dogfooding-rush-daemon.md
index 45eb37cf33..a95a28cdca 100644
--- a/docs/rush/dogfooding-rush-daemon.md
+++ b/docs/rush/dogfooding-rush-daemon.md
@@ -247,10 +247,11 @@ Remove the snapshot with `rm -rf common/temp/rush-daemon-dogfood` (or `rush purg
   A watcher of a folder can also miss every later change in it once the folder is deleted and created again, for
   example by a branch switch that removed the folder and then restored it. So the next build runs the initial
   script if a folder that held the operation's input files was deleted or recreated since the last run on the
-  worker (`Not using the incremental command because folders that held its input files were deleted or
+  worker started (`Not using the incremental command because folders that held its input files were deleted or
   recreated since its last run (...)`), even if the files kept their content. The daemon compares each folder's
   inode and creation time; a file that an editor saves by renaming a new file over it does not count. The
-  message names only the top folder of a recreated tree.
+  message names only the top folder of a recreated tree, and an operation whose own build recreates such a folder
+  never reuses its worker.
   A worker's outputs are only as current as Heft's watchers. A change that a watcher misses is not built, and
   because the run still succeeds, later builds report the operation as up to date and keep the stale outputs
   until the file is edited again. The checks above cover the cases found in testing: a file that Git replaces, a
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
index 6452939f94..b2ee7be800 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionGuardPlugin.ts
@@ -24,6 +24,7 @@ import {
   INPUTS_CHANGED_INVALIDATION_REASON,
   NATIVE_COMMAND_INVALIDATION_REASON,
   setIncrementalExecutionGuard,
+  setWatchedCommandCallback,
   type ICommandExecution,
   type IIncrementalExecutionGuard,
   type IIncrementalExecutionGuardOptions
@@ -52,9 +53,6 @@ const PLUGIN_NAME: 'IncrementalExecutionGuardPlugin' = 'IncrementalExecutionGuar
 // Runs after the default-stage taps, e.g. the input file checks of this plugin, CacheableOperationPlugin and
 // LegacySkipPlugin, which can mark a result as unverifiable.
 const RECORD_RESULT_STAGE: number = 1;
-// Runs before those checks, so that a folder that was recreated before the input folders were read makes the result
-// unverifiable.
-const READ_INPUT_FOLDERS_STAGE: number = -1;
 // Runs after the taps of CacheableOperationPlugin and LegacySkipPlugin that capture the input files of the operations
 // whose input files they check.
 const CAPTURE_UNCHECKED_INPUT_FILES_STAGE: number = CAPTURE_INPUT_FILES_STAGE + 1;
@@ -248,8 +246,8 @@ export function getIncrementalInputChangeReason(
  *    caches which files passed), so a build that fails for them could otherwise succeed while they are still there.
  * 2. Its inputs changed as {@link getIncrementalInputChangeReason} allows.
  * 3. If that run was in a process that keeps watching the input files, such as a warm worker, none of the folders
- *    that held its input files was deleted or recreated since that run. A watcher can miss changes in such a folder,
- *    e.g. one that a branch switch recreated.
+ *    that held its input files was deleted or recreated since that run started. A watcher can miss changes in such a
+ *    folder, e.g. one that a branch switch recreated.
  * 4. Its declared output folders hold the same files and folders as at the end of that run, and none of the folders
  *    was recreated or had an entry added, removed or replaced since then.
  * 5. Its outputs do not include bundles (JavaScript or CSS in a `dist` or `release` folder, or with a content hash in
@@ -284,7 +282,7 @@ interface IOutputState {
 interface IIncrementalBase {
   readonly inputs: IIncrementalInputState;
   // The identity of each folder that held an input file, if the last run was in a process that keeps watching the
-  // input files. Read before that run started, unless no check preceded it.
+  // input files. Read before that run started, when its runner reported its command.
   readonly inputFolders: ReadonlyMap<string, string> | undefined;
   // Rejects if the output folders could not be read.
   readonly outputsPromise: Promise<IOutputState>;
@@ -375,6 +373,12 @@ function applyToGraph(graph: IOperationGraph): void {
         verifyIncrementalResultAsync(record, recordState, options)
     };
     setIncrementalExecutionGuard(record, guard);
+    setWatchedCommandCallback(record, (): void => {
+      // Read before the command starts, so that the next check notices a folder that is recreated while it runs,
+      // e.g. during the first run in a new warm worker, which no check precedes. The check reads them first if its
+      // base has them.
+      recordState.inputFolders ??= readInputFolderIdentities(record.operation, recordState.inputsSnapshot);
+    });
   }
 
   const getGitPath: () => string | undefined = createGitPathGetter();
@@ -506,17 +510,6 @@ function applyToGraph(graph: IOperationGraph): void {
     return undefined;
   }
 
-  graph.hooks.afterExecuteOperationAsync.tap(
-    { name: PLUGIN_NAME, stage: READ_INPUT_FOLDERS_STAGE },
-    (record: IOperationRunnerContext & IOperationExecutionResult): void => {
-      const recordState: IRecordState | undefined = stateByRecord.get(record);
-      // E.g. the first run of the operation in this graph, which no check preceded
-      if (recordState && !recordState.inputFolders && getCommandExecution(record)?.watchesInputs) {
-        recordState.inputFolders = readInputFolderIdentities(record.operation, recordState.inputsSnapshot);
-      }
-    }
-  );
-
   graph.hooks.afterExecuteOperationAsync.tapPromise(
     PLUGIN_NAME,
     async (record: IOperationRunnerContext & IOperationExecutionResult): Promise<void> => {
diff --git a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
index 6937c6bdfa..e22875e5d3 100644
--- a/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
+++ b/libraries/rush-lib/src/logic/operations/IncrementalExecutionState.ts
@@ -77,7 +77,7 @@ export interface IOperationCommandExecution {
    * Whether the command ran in a process that keeps watching the operation's input files after the command
    * completed, to run the incremental command again, such as a warm worker. A watcher can miss changes in a folder
    * that was deleted and recreated, so the next incremental run then requires that none of the folders that held
-   * input files was deleted or recreated since this run. Defaults to false.
+   * input files was deleted or recreated since this run started. Defaults to false.
    */
   readonly watchesInputs?: boolean;
 }
@@ -85,6 +85,7 @@ export interface IOperationCommandExecution {
 // All are keyed by the execution record, which is the runner's context and the hooks' argument.
 const guardByRecord: WeakMap<object, IIncrementalExecutionGuard> = new WeakMap();
 const commandExecutionByRecord: WeakMap<object, ICommandExecution> = new WeakMap();
+const watchedCommandCallbackByRecord: WeakMap<object, () => void> = new WeakMap();
 const recordsWithoutCacheRead: WeakSet<object> = new WeakSet();
 
 export function setIncrementalExecutionGuard(record: object, guard: IIncrementalExecutionGuard): void {
@@ -95,12 +96,23 @@ export function getIncrementalExecutionGuard(record: object): IIncrementalExecut
   return guardByRecord.get(record);
 }
 
+/**
+ * Sets a function that `setCommandExecution` calls for the execution record each time a runner records a command
+ * that watches the input files, which it does before the command starts.
+ */
+export function setWatchedCommandCallback(record: object, callback: () => void): void {
+  watchedCommandCallbackByRecord.set(record, callback);
+}
+
 /**
  * Records which command a runner is about to execute for an execution record. Call it before starting the command,
  * so that the outputs of a command that fails or is aborted are attributed to it too.
  */
 export function setCommandExecution(record: object, execution: ICommandExecution): void {
   commandExecutionByRecord.set(record, execution);
+  if (execution.watchesInputs) {
+    watchedCommandCallbackByRecord.get(record)?.();
+  }
 }
 
 export function getCommandExecution(record: object): ICommandExecution | undefined {
diff --git a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
index 25977022d0..76448cdeff 100644
--- a/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/IncrementalExecutionGuardPlugin.test.ts
@@ -1,6 +1,8 @@
 // Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
 // See LICENSE in the project root for license information.
 
+/* eslint max-lines: off */
+
 jest.mock('../ProjectLogWritable', () => {
   const actual = jest.requireActual('../ProjectLogWritable');
   const { TerminalWritable } = jest.requireActual('@rushstack/terminal');
@@ -170,9 +172,10 @@ interface IWorkspaceOptions {
   readonly hasIncrementalExecutionGuard?: boolean;
   /**
    * If set, the runners report that each command ran in a process that keeps watching the input files, like
-   * `WarmWorkerOperationRunner`.
+   * `WarmWorkerOperationRunner`. A function is called for each command. A runner like that of a Rush plugin reports
+   * it before the command starts, as `WarmWorkerOperationRunner` does, and Rush's shell command runner after it ran.
    */
-  readonly watchesInputs?: boolean;
+  readonly watchesInputs?: boolean | (() => boolean);
   /**
    * If set, each inputs snapshot records when it began reading the working tree, like one that Git computes.
    */
@@ -335,15 +338,18 @@ class PluginOperationRunner implements IOperationRunner {
   public readonly warningsAreAllowed: boolean = false;
   readonly #runBuild: (kind: IOperationCommandExecution['kind']) => number | undefined;
   readonly #reportsCommandExecutions: boolean;
+  readonly #watchesInputs: () => boolean;
 
   public constructor(
     name: string,
     runBuild: (kind: IOperationCommandExecution['kind']) => number | undefined,
-    reportsCommandExecutions: boolean
+    reportsCommandExecutions: boolean,
+    watchesInputs: () => boolean
   ) {
     this.name = name;
     this.#runBuild = runBuild;
     this.#reportsCommandExecutions = reportsCommandExecutions;
+    this.#watchesInputs = watchesInputs;
   }
 
   public async executeAsync(
@@ -384,7 +390,8 @@ class PluginOperationRunner implements IOperationRunner {
 
   #run(context: IOperationRunnerContext, kind: IOperationCommandExecution['kind']): OperationStatus {
     if (this.#reportsCommandExecutions) {
-      context.reportCommandExecution?.({ kind, hasIncrementalCommand: true });
+      const watchesInputs: boolean = this.#watchesInputs();
+      context.reportCommandExecution?.({ kind, hasIncrementalCommand: true, watchesInputs });
     }
     return this.#runBuild(kind) === 0 ? OperationStatus.Success : OperationStatus.Failure;
   }
@@ -406,6 +413,8 @@ async function createWorkspaceAsync(
   const rootFolder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rush-incremental-guard-'));
   workspaceFolders.push(rootFolder);
   const phase: IPhase = allowWarningsOnSuccess ? { ...buildPhase, allowWarningsOnSuccess } : buildPhase;
+  const isWatchingInputs: () => boolean =
+    typeof watchesInputs === 'function' ? watchesInputs : () => watchesInputs === true;
 
   const writeFile = (relativePath: string, content: string): void => {
     const filePath: string = `${rootFolder}/${relativePath}`;
@@ -529,7 +538,7 @@ async function createWorkspaceAsync(
       settings,
       logFilenameIdentifier: '_phase_build',
       runner: spec.pluginRunner
-        ? new PluginOperationRunner(name, runBuild, spec.pluginRunner === 'reported')
+        ? new PluginOperationRunner(name, runBuild, spec.pluginRunner === 'reported', isWatchingInputs)
         : new ShellOperationRunner({
             phase,
             rushProject: project,
@@ -615,7 +624,7 @@ async function createWorkspaceAsync(
       { name: 'watchesInputs', stage: -2 },
       (record: IOperationExecutionResult): void => {
         const execution: ICommandExecution | undefined = getCommandExecution(record);
-        if (execution) {
+        if (execution && !execution.watchesInputs && isWatchingInputs()) {
           setCommandExecution(record, { ...execution, watchesInputs: true });
         }
       }
@@ -1575,7 +1584,7 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
 
     it('runs the initial command after a folder of its input files was recreated while its first run ran, for a runner that watches its inputs', async () => {
       const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], { watchesInputs: true });
-      // The folders that held its input files are read after the first run, so they cannot show the change.
+      // The recreated input files are new files, so the result is unverifiable.
       workspace.writeFile('a/src/one.ts', 'one recreate:src/sub');
       expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
 
@@ -1587,6 +1596,45 @@ describe(IncrementalExecutionGuardPlugin.name, () => {
       );
     });
 
+    it('runs the initial command after the files of a folder of its input files were moved to a new folder while its first run ran, for a runner that watches its inputs', async () => {
+      const workspace: ITestWorkspace = await createWorkspaceAsync(
+        [{ name: 'a', pluginRunner: 'reported' }],
+        { watchesInputs: true }
+      );
+      // E.g. the initial command in a new warm worker, which no check precedes. The input files keep their identity,
+      // so the result is a base.
+      workspace.writeFile('a/src/one.ts', 'one move:src/sub');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:initial']);
+
+      workspace.writeFile('a/src/one.ts', 'one 2');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(
+        'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+      );
+    });
+
+    it('runs the initial command after the files of a folder of its input files were moved to a new folder while the first run that watched them ran', async () => {
+      let watchesInputs: boolean = false;
+      const workspace: ITestWorkspace = await createWorkspaceAsync(
+        [{ name: 'a', pluginRunner: 'reported' }],
+        { watchesInputs: () => watchesInputs }
+      );
+      await workspace.executeAsync();
+
+      // E.g. the first run of a new warm worker, after the initial command ran in a shell
+      watchesInputs = true;
+      workspace.writeFile('a/src/one.ts', 'one move:src/sub');
+      expect((await workspace.executeAsync()).commands).toEqual(['a:incremental']);
+
+      workspace.writeFile('a/src/one.ts', 'one 3');
+      const next: ITestIteration = await workspace.executeAsync();
+      expect(next.commands).toEqual(['a:initial']);
+      expect(next.output).toContain(
+        'Not using the incremental command because folders that held its input files were deleted or recreated since its last run ("a/src/sub").'
+      );
+    });
+
     it('runs the operation again if a file was saved while the inputs snapshot was being taken', async () => {
       const workspace: ITestWorkspace = await createWorkspaceAsync([{ name: 'a' }], {
         recordsWorkingTreeReadStartTime: true

From 8da94f7de0792addad4c358df181677800b164cd Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:07:55 +0000
Subject: [PATCH 255/265] [rush-daemon] Name the operations that rushd stops to
 a request that already waits first

Swarm integration step 240; original commit 5f436fbe16 (merge of swarm/r04-t361 at 5156e5a0c6).
Scope: task 361, 345 follow-up: a request queued before a failed build becomes preemptible.

Brings 361 (branch swarm/r04-t361). Second agent: t07 board 9533 (RESULT board 9532). Evidence: ch01's GATE OK board 9991.

Batch E2k part 1 (K1), item 4 of 5. Gate: ch01 GATE OK board 9991 (tree 964d518dd4)

Commits folded into this step (1):
- 5156e5a0c6 [rush-daemon] Name the operations that rushd stops to a request that already waits first

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...pping-already-queued_2026-09-30-06-30.json | 11 +++
 libraries/rush-daemon/src/RequestScheduler.ts | 32 +++++--
 .../test/PhasedRequestEarlyFailure.test.ts    | 42 ++++++++++
 .../src/test/RequestScheduler.test.ts         | 83 +++++++++++++++++++
 .../test/WorkspaceEarlyFailureResult.test.ts  | 61 +++++++++++++-
 .../test/WorkspaceRequestAdmission.test.ts    | 24 ++++++
 6 files changed, 242 insertions(+), 11 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/swarm-r04-t361-stopping-already-queued_2026-09-30-06-30.json

diff --git a/common/changes/@rushstack/rush-daemon/swarm-r04-t361-stopping-already-queued_2026-09-30-06-30.json b/common/changes/@rushstack/rush-daemon/swarm-r04-t361-stopping-already-queued_2026-09-30-06-30.json
new file mode 100644
index 0000000000..b456363e81
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/swarm-r04-t361-stopping-already-queued_2026-09-30-06-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "A served request that already waits first in the queue when an earlier failed command's result comes back is now told that rushd stops the operations that command left running, and which, instead of keeping a plain queue position.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/RequestScheduler.ts b/libraries/rush-daemon/src/RequestScheduler.ts
index 04bc4b6593..748d57dd1b 100644
--- a/libraries/rush-daemon/src/RequestScheduler.ts
+++ b/libraries/rush-daemon/src/RequestScheduler.ts
@@ -67,8 +67,9 @@ export interface IRequestSchedulerAcquireOptions {
   abortSignal?: AbortSignal;
 
   /**
-   * Called with the request's one-based position whenever the queue changes. If the callback throws,
-   * the scheduler reports the error as a process warning and continues processing the queue.
+   * Called with the request's one-based position whenever the queue changes, and while the request is first in the
+   * queue, when every active lease becomes preemptible (see {@link RequestScheduler.markLeasePreemptible}). If the
+   * callback throws, the scheduler reports the error as a process warning and continues processing the queue.
    */
   onQueuePositionChanged?: (position: number) => void;
 
@@ -159,6 +160,11 @@ export class RequestScheduler {
    * @remarks
    * For a request that no client waits for any more, such as a failed build that returned its result while its
    * independent operations continue, so that it never delays another request.
+   *
+   * If every active lease is then preemptible (see {@link RequestScheduler.activeLeasesArePreemptible}), a request
+   * that already waits first in the queue now waits only while their owners stop their work. Its position is reported
+   * to it again before `onPreempted` is called, so that its report can say what they stop while they can still tell.
+   * Only the first queued request's report can change then, so the others are not reported again.
    */
   public markLeasePreemptible(lease: IRequestLease, onPreempted: () => void): void {
     const state: ILeaseState | undefined = this.#leaseStates.get(lease);
@@ -166,6 +172,10 @@ export class RequestScheduler {
       throw new Error('Only an active lease from this scheduler can be marked preemptible.');
     }
     state.onPreempted = onPreempted;
+    const head: IQueuedRequest | undefined = this.#queue[0];
+    if (head && this.activeLeasesArePreemptible) {
+      this.#reportQueuePosition(head, 1);
+    }
     this.#preemptIfContended();
   }
 
@@ -429,13 +439,17 @@ export class RequestScheduler {
 
   #notifyQueuePositions(): void {
     for (let index: number = 0; index < this.#queue.length; index++) {
-      try {
-        this.#queue[index].options.onQueuePositionChanged?.(index + 1);
-      } catch (error) {
-        process.emitWarning(error instanceof Error ? error : String(error), {
-          code: 'RUSH_DAEMON_QUEUE_POSITION_CALLBACK_ERROR'
-        });
-      }
+      this.#reportQueuePosition(this.#queue[index], index + 1);
+    }
+  }
+
+  #reportQueuePosition(request: IQueuedRequest, position: number): void {
+    try {
+      request.options.onQueuePositionChanged?.(position);
+    } catch (error) {
+      process.emitWarning(error instanceof Error ? error : String(error), {
+        code: 'RUSH_DAEMON_QUEUE_POSITION_CALLBACK_ERROR'
+      });
     }
   }
 }
diff --git a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
index 402f8a7a8f..1ef6870433 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestEarlyFailure.test.ts
@@ -700,6 +700,48 @@ describe('the operations that continue after an early result', () => {
     expect(getQueuePositions(later)).toHaveLength(2);
   });
 
+  it.each(['rebuild', 'list'])(
+    'are named as stopping to a %s request that already waited when the failed build returned early',
+    async (commandName: string) => {
+      const failB: IDeferred = createDeferred();
+      const setup: IEarlyFailureFixture = createEarlyFailureFixture(
+        A_CONSUMES_B_AND_C,
+        false,
+        false,
+        false,
+        failB.promise
+      );
+      const agent: ITrackedClient = trackClient('agent', setup);
+      const agentPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        createRequest('agent', true, OPERATION_A),
+        agent.client
+      );
+      await setup.startedC;
+      await settleAsync();
+      const other: TestPhasedRequestClient = new TestPhasedRequestClient(commandName);
+      const otherPromise: Promise<IDaemonPhasedRequestResult> = setup.router.executeAsync(
+        { ...createRequest(commandName, false, OPERATION_C), commandName },
+        other
+      );
+      await settleAsync();
+      // The failed build still waits for its result, so the request waits for another request.
+      expect(getQueuePositions(other)).toEqual([{ position: 1, requestId: commandName }]);
+
+      failB.resolve();
+      await agent.written;
+      await settleAsync();
+      expect(getQueuePositions(other)).toEqual([
+        { position: 1, requestId: commandName },
+        { position: 1, requestId: commandName, continuingOperations: { ...continuingC, stopping: true } }
+      ]);
+      setup.releaseC();
+      await agentPromise;
+      const otherResult: IDaemonPhasedRequestResult = await otherPromise;
+      expect(otherResult.exitCode).toBe(0);
+      expect(getQueuePositions(other)).toHaveLength(2);
+    }
+  );
+
   it('are named to a waiting build once the last participant that waited for its result leaves', async () => {
     const failB: IDeferred = createDeferred();
     const setup: IEarlyFailureFixture = createEarlyFailureFixture(
diff --git a/libraries/rush-daemon/src/test/RequestScheduler.test.ts b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
index b660d8ed20..c3f07784a7 100644
--- a/libraries/rush-daemon/src/test/RequestScheduler.test.ts
+++ b/libraries/rush-daemon/src/test/RequestScheduler.test.ts
@@ -644,4 +644,87 @@ describe('preemptible leases', () => {
     admitted.release();
     expect(scheduler.activeLeasesArePreemptible).toBe(false);
   });
+
+  it('reports its position again to the first queued request before it preempts the leases that it waits for', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+    const reports: [string, number, boolean, number][] = [];
+    const recordPosition =
+      (name: string): ((position: number) => void) =>
+      (position: number): void => {
+        reports.push([name, position, scheduler.activeLeasesArePreemptible, onPreempted.mock.calls.length]);
+      };
+    // Both requests queue while the lease still does work that its client waits for.
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: recordPosition('exclusive')
+    });
+    const read: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedRead,
+      onQueuePositionChanged: recordPosition('read')
+    });
+    reports.length = 0;
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    // Only the first request's report can change: it is told before the lease is preempted, and the second is not.
+    expect(reports).toEqual([['exclusive', 1, true, 0]]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    leftover.release();
+    (await exclusive).release();
+    (await read).release();
+    expect(scheduler.activeRequestCount).toBe(0);
+  });
+
+  it('does not report positions again when a lease becomes preemptible while another active lease is not', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const running: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const positions: number[] = [];
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: (position: number) => positions.push(position)
+    });
+    const onPreempted: jest.Mock = jest.fn();
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    // The request still waits for the lease that is not preemptible, so its report cannot change.
+    expect(positions).toEqual([1]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    leftover.release();
+    running.release();
+    (await exclusive).release();
+    expect(positions).toEqual([1]);
+  });
+
+  it('neither reports nor preempts when a lease becomes preemptible with nothing queued', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const leftover: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    const onPreempted: jest.Mock = jest.fn();
+
+    scheduler.markLeasePreemptible(leftover, onPreempted);
+
+    expect(onPreempted).not.toHaveBeenCalled();
+    // A request that queues later is told its position once, and only then is the lease preempted for it.
+    const reports: [number, number][] = [];
+    const exclusive: Promise<IRequestLease> = scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      onQueuePositionChanged: (position: number) => reports.push([position, onPreempted.mock.calls.length])
+    });
+    expect(reports).toEqual([[1, 0]]);
+    expect(onPreempted).toHaveBeenCalledTimes(1);
+    leftover.release();
+    (await exclusive).release();
+    expect(reports).toEqual([[1, 0]]);
+  });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
index 97edcb0fea..ddea61e4e7 100644
--- a/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceEarlyFailureResult.test.ts
@@ -37,6 +37,7 @@ let installationChange: IDaemonInstallationChange | undefined;
 const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
 
 interface IEarlyFailureFixtureOptions {
+  readonly holdsFailure?: boolean;
   readonly restartable?: boolean;
   readonly slowToStop?: boolean;
   readonly writesOutputs?: boolean;
@@ -52,9 +53,11 @@ const HOLD_OUTPUT_SCRIPT: string = withScriptDeadline(
  * that returns early on failure leaves c running. With `slowToStop`, c first starts a detached process that shares
  * its output, like a stray watcher: stopping c kills c's process group but not that process, so c's operation ends
  * only when the test removes the marker. With `writesOutputs`, c declares its git-ignored `lib` folder as output, and
- * writes one file there when it starts and another when the test removes the marker.
+ * writes one file there when it starts and another when the test removes the marker. With `holdsFailure`, a fails
+ * only when the test removes the `hold-a` marker, so the build returns early only then.
  */
 function createEarlyFailureFixtureAsync({
+  holdsFailure = false,
   restartable = false,
   slowToStop = false,
   writesOutputs = false
@@ -67,6 +70,7 @@ function createEarlyFailureFixtureAsync({
     ? "fs.mkdirSync('lib',{recursive:true});fs.writeFileSync('lib/started.js','');"
     : '';
   const finishOutputs: string = writesOutputs ? "fs.writeFileSync('lib/finished.js','');" : '';
+  const failA: string = "console.error('failed-a');process.exitCode=1;";
   return DaemonGraphTestFixture.createAsync((created: DaemonGraphTestFixture) => {
     if (restartable) {
       setDaemonPolicy(created, {});
@@ -82,6 +86,7 @@ function createEarlyFailureFixtureAsync({
       );
     }
     created.write('hold', '');
+    if (holdsFailure) created.write('hold-a', '');
     created.checkInstallation = () => installationChange;
     created.write(
       'b/package.json',
@@ -94,7 +99,12 @@ function createEarlyFailureFixtureAsync({
     );
     created.write(
       'a/build.cjs',
-      "require('node:fs').appendFileSync('../runs.txt','a\\n');console.error('failed-a');process.exitCode=1;"
+      holdsFailure
+        ? withScriptDeadline(
+            "const fs=require('node:fs');fs.appendFileSync('../runs.txt','a\\n');" +
+              `const t=setInterval(()=>{if(!fs.existsSync('../hold-a')){clearInterval(t);${failA}}},20);`
+          )
+        : `require('node:fs').appendFileSync('../runs.txt','a\\n');${failA}`
     );
     created.write(
       'c/build.cjs',
@@ -370,6 +380,53 @@ describe('a failed build that returns early', () => {
     }
   });
 
+  it('names the work that continues as stopping to a build that reloads the graph and already waited when the failed build returned early', async () => {
+    const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync({ holdsFailure: true });
+    const hold: string = path.join(fixture.folder, 'hold');
+    const holdA: string = path.join(fixture.folder, 'hold-a');
+    let reload: DaemonRequestWireClient | undefined;
+    try {
+      const early: Promise<ITerminalExchange> = fixture.runAsync(BUILD_B, { returnEarlyOnFailure: true });
+      // a fails only when the test says so, so the build can't return early yet.
+      await waitForRunsAsync(fixture, 'a', 1);
+      await waitForRunsAsync(fixture, 'c', 1);
+      const generation: number = fixture.host.workspaceGeneration;
+
+      // So the reload waits for the build, and nothing is stopping yet.
+      changeProjectConfiguration(fixture);
+      reload = await fixture.connectAsync();
+      const build: IDaemonRequestEnvelope = fixture.envelope(['build', '--to', 'c', '--parallelism', '3']);
+      await reload.sendControlAsync({ kind: 'requestStart', payload: build });
+      const queued: IDaemonFrame[] = await readUntilQueuedAsync(reload);
+      expect(queuePositions(queued)).toEqual([{ position: 1, requestId: build.requestId }]);
+
+      fs.rmSync(holdA);
+      expect((await early).terminal).toMatchObject({
+        kind: 'requestResult',
+        payload: { exitCode: 1, outcome: 'failure' }
+      });
+      // The reloaded graph runs c again while the first c is still held, so the reload did not wait for that c.
+      await waitForRunsAsync(fixture, 'c', 2);
+      expect(countRuns(fixture, 'c')).toBe(2);
+      expect(fs.existsSync(hold)).toBe(true);
+
+      fs.rmSync(hold);
+      const { frames, terminal } = await reload.readTerminalAsync(build.requestId);
+      expect(terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+      expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
+      // It was told again once the build returned early, before the daemon stopped the held c for it.
+      expect(queuePositions([...queued, ...frames])).toEqual([
+        { position: 1, requestId: build.requestId },
+        { position: 1, requestId: build.requestId, continuingOperations: STOPPING_C }
+      ]);
+    } finally {
+      fs.rmSync(holdA, { force: true });
+      fs.rmSync(hold, { force: true });
+      await reload?.closeAsync();
+      await fixture[Symbol.asyncDispose]();
+    }
+  });
+
   it('lets a later build wait for the work that continues and find it done', async () => {
     const fixture: DaemonGraphTestFixture = await createEarlyFailureFixtureAsync();
     const hold: string = path.join(fixture.folder, 'hold');
diff --git a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
index 4086d52ca5..22c4ca77f1 100644
--- a/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceRequestAdmission.test.ts
@@ -564,4 +564,28 @@ describe('a request that stops the operations that finished requests left runnin
     behindRunning.controller.dispose();
     unnamed.controller.dispose();
   });
+
+  it('names them as stopping to a request that already waited first when they were left running', async () => {
+    const scheduler: RequestScheduler = new RequestScheduler();
+    const build: IRequestLease = await scheduler.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.SharedBuild
+    });
+    // Nothing continues yet: the build's client still waits for its result.
+    let continuing: IDaemonContinuingOperations | undefined;
+    const rebuild: IReportingController = createReportingController('rebuild');
+    const rebuildLease: Promise<IRequestLease> = acquireExclusiveAsync(rebuild, scheduler, () => continuing);
+
+    // The build fails early: its result is out, and the operations that it leaves running stop for the rebuild.
+    continuing = CONTINUING;
+    scheduler.markLeasePreemptible(build, () => (continuing = undefined));
+    expect(continuing).toBeUndefined();
+    build.release();
+    (await rebuildLease).release();
+
+    expect(rebuild.positions).toEqual([
+      { position: 1, requestId: 'rebuild' },
+      { position: 1, requestId: 'rebuild', continuingOperations: STOPPING }
+    ]);
+    rebuild.controller.dispose();
+  });
 });

From 45028751495876bb0ea2295cddb6bf8a3ac0278d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:07:55 +0000
Subject: [PATCH 256/265] [rush-bridge-cache-plugin] Act only on the operations
 that the command selects (and 1 more)

Swarm integration step 241; original commit 0a7af6a3df (merge of swarm/r03-row23 at 4a746d0348).
Scope: task 363, row 23: rush-bridge-cache-plugin acts only on the selected operations.

Brings 363 (branch swarm/r03-row23, 2 commits). Second agent: ch05 board 9400. Evidence: ch01's GATE OK board 9991.

Batch E2k part 1 (K1), item 5 of 5. Gate: ch01 GATE OK board 9991 (tree 228f843dab)

Commits folded into this step (2):
- 92b277d814 [rush-bridge-cache-plugin] Act only on the operations that the command selects
- 4a746d0348 [rush-bridge-cache-plugin] Test a selected operation whose record is disabled

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...-selected-operations_2026-09-28-18-45.json |  11 +
 .../rush-bridge-cache-plugin/README.md        |   3 +
 .../rush-bridge-cache-plugin/package.json     |   1 +
 .../src/BridgeCachePlugin.ts                  |   7 +-
 .../src/test/BridgeCachePlugin.test.ts        | 217 ++++++++++++++++++
 5 files changed, 238 insertions(+), 1 deletion(-)
 create mode 100644 common/changes/@microsoft/rush/bridge-cache-selected-operations_2026-09-28-18-45.json
 create mode 100644 rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts

diff --git a/common/changes/@microsoft/rush/bridge-cache-selected-operations_2026-09-28-18-45.json b/common/changes/@microsoft/rush/bridge-cache-selected-operations_2026-09-28-18-45.json
new file mode 100644
index 0000000000..e827259612
--- /dev/null
+++ b/common/changes/@microsoft/rush/bridge-cache-selected-operations_2026-09-28-18-45.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Make `@rushstack/rush-bridge-cache-plugin` read and write cache entries only for the operations that the command selects. Before this change, it also restored or wrote the disabled dependencies of a project selected with `--only`, and every project's operations in a Rush daemon engine.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/rush-plugins/rush-bridge-cache-plugin/README.md b/rush-plugins/rush-bridge-cache-plugin/README.md
index 8643f2db14..751d34a675 100644
--- a/rush-plugins/rush-bridge-cache-plugin/README.md
+++ b/rush-plugins/rush-bridge-cache-plugin/README.md
@@ -81,3 +81,6 @@ That will populate the cache for `your-packageX` and all of its dependencies.
 **Write whatever outputs are on disk for this command to the cache, but only if all output folders are present**
 `rush build --to your-packageX --bridge-cache-action=write --require-output-folders`
 That will populate the cache for `your-packageX` and all of its dependencies, skipping any that don't have all output folders present.
+
+The plugin only reads or writes cache entries for the operations that the command selects. For example,
+`rush build --only your-packageX --bridge-cache-action=read` restores only `your-packageX`, and not its dependencies.
diff --git a/rush-plugins/rush-bridge-cache-plugin/package.json b/rush-plugins/rush-bridge-cache-plugin/package.json
index 0fcc45151c..5dee336b41 100644
--- a/rush-plugins/rush-bridge-cache-plugin/package.json
+++ b/rush-plugins/rush-bridge-cache-plugin/package.json
@@ -43,6 +43,7 @@
     "build": "heft test --clean",
     "start": "heft test --clean --watch",
     "_phase:build": "heft run --only build -- --clean",
+    "_phase:test": "heft run --only test -- --clean",
     "_phase:pack": "rush-pnpm pack"
   },
   "dependencies": {
diff --git a/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts b/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts
index 6dce64863c..809cf0f253 100644
--- a/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts
+++ b/rush-plugins/rush-bridge-cache-plugin/src/BridgeCachePlugin.ts
@@ -80,7 +80,12 @@ export class BridgeCachePlugin implements IRushPlugin {
             ): Promise<OperationStatus | undefined> => {
               const filteredOperations: IBaseOperationExecutionResult[] = [];
               for (const record of operationRecords.values()) {
-                if (!record.operation.isNoOp) {
+                const { operation } = record;
+                // The graph can also hold operations outside the command's selection, such as the
+                // dependencies of a project selected with `--only`, or every project's operations in
+                // a Rush daemon engine. Those operations are disabled, so leave their outputs and
+                // cache entries alone.
+                if (operation.enabled !== false && !operation.isNoOp) {
                   filteredOperations.push(record);
                 }
               }
diff --git a/rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts b/rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts
new file mode 100644
index 0000000000..32be5ed322
--- /dev/null
+++ b/rush-plugins/rush-bridge-cache-plugin/src/test/BridgeCachePlugin.test.ts
@@ -0,0 +1,217 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@rushstack/rush-sdk', () => ({
+  _OperationBuildCache: { forOperation: jest.fn() },
+  OperationStatus: { FromCache: 'FROM CACHE', Success: 'SUCCESS' }
+}));
+
+import {
+  _OperationBuildCache as OperationBuildCache,
+  OperationStatus,
+  type IOperationExecutionResult,
+  type Operation,
+  type RushSession
+} from '@rushstack/rush-sdk';
+import { StringBufferTerminalProvider, Terminal } from '@rushstack/terminal';
+import { CommandLineParameterKind } from '@rushstack/ts-command-line';
+
+import { BridgeCachePlugin } from '../BridgeCachePlugin';
+
+type BeforeExecuteIteration = (
+  records: ReadonlyMap<Operation, IOperationExecutionResult>,
+  iterationOptions: object
+) => Promise<OperationStatus | undefined>;
+
+interface ICacheEntryMock {
+  cacheId: string;
+  tryRestoreFromCacheAsync: jest.Mock;
+  trySetCacheEntryAsync: jest.Mock;
+}
+
+const ACTION_PARAMETER_NAME: string = '--bridge-cache-action';
+
+function createOperation(name: string, enabled: Operation['enabled'], isNoOp: boolean = false): Operation {
+  return { name, enabled, isNoOp, settings: undefined } as unknown as Operation;
+}
+
+function createRecords(operations: Operation[]): ReadonlyMap<Operation, IOperationExecutionResult> {
+  return new Map(
+    operations.map((operation: Operation) => [
+      operation,
+      { operation } as unknown as IOperationExecutionResult
+    ])
+  );
+}
+
+async function applyPluginAsync(
+  cacheAction: 'read' | 'write',
+  terminal: Terminal
+): Promise<BeforeExecuteIteration> {
+  const pendingTaps: Promise<void>[] = [];
+  let beforeExecuteIteration: BeforeExecuteIteration | undefined;
+  const graph: object = {
+    parallelism: 1,
+    hooks: {
+      beforeExecuteIterationAsync: {
+        tapPromise: (name: string, fn: BeforeExecuteIteration) => (beforeExecuteIteration = fn)
+      }
+    }
+  };
+  const context: object = {
+    customParameters: new Map([
+      [
+        ACTION_PARAMETER_NAME,
+        {
+          kind: CommandLineParameterKind.Choice,
+          alternatives: new Set(['read', 'write']),
+          value: cacheAction
+        }
+      ]
+    ]),
+    buildCacheConfiguration: { buildCacheEnabled: true },
+    rushConfiguration: { experimentsConfiguration: { configuration: {} } }
+  };
+  const command: object = {
+    hooks: {
+      onGraphCreatedAsync: {
+        tap: (name: string, fn: (g: object, c: object) => Promise<void>) =>
+          pendingTaps.push(fn(graph, context))
+      }
+    }
+  };
+  const session: object = {
+    getLogger: () => ({ terminal }),
+    hooks: {
+      runAnyPhasedCommand: {
+        tapPromise: (name: string, fn: (c: object) => Promise<void>) => pendingTaps.push(fn(command))
+      }
+    }
+  };
+
+  new BridgeCachePlugin({
+    actionParameterName: ACTION_PARAMETER_NAME,
+    requireOutputFoldersParameterName: undefined
+  }).apply(session as RushSession);
+  await Promise.all(pendingTaps);
+
+  if (!beforeExecuteIteration) {
+    throw new Error('The plugin did not tap beforeExecuteIterationAsync.');
+  }
+  return beforeExecuteIteration;
+}
+
+describe(BridgeCachePlugin.name, () => {
+  // A graph can hold operations outside the command's selection, such as the dependencies of a project
+  // selected with `--only`, or every project's operations in a Rush daemon engine. Those are disabled.
+  const selected: Operation = createOperation('selected (build)', true);
+  const selectedChangedOnly: Operation = createOperation(
+    'selected-changed-only (build)',
+    'ignore-dependency-changes'
+  );
+  const unselected: Operation = createOperation('unselected-dependency (build)', false);
+  const noOp: Operation = createOperation('selected-no-op (build)', true, true);
+
+  let terminalProvider: StringBufferTerminalProvider;
+  let terminal: Terminal;
+  let cacheEntryByOperationName: Map<string, ICacheEntryMock>;
+
+  beforeEach(() => {
+    terminalProvider = new StringBufferTerminalProvider();
+    terminal = new Terminal(terminalProvider);
+    cacheEntryByOperationName = new Map();
+    jest
+      .mocked(OperationBuildCache.forOperation)
+      .mockImplementation((record: { operation: Operation }): OperationBuildCache => {
+        const entry: ICacheEntryMock = {
+          cacheId: `cache-id-${record.operation.name}`,
+          tryRestoreFromCacheAsync: jest.fn().mockResolvedValue(true),
+          trySetCacheEntryAsync: jest.fn().mockResolvedValue(true)
+        };
+        cacheEntryByOperationName.set(record.operation.name, entry);
+        return entry as unknown as OperationBuildCache;
+      });
+  });
+
+  afterEach(() => {
+    jest.mocked(OperationBuildCache.forOperation).mockReset();
+  });
+
+  it('restores only the operations in the selection', async () => {
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('read', terminal);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(
+      createRecords([selected, selectedChangedOnly, unselected, noOp]),
+      {}
+    );
+
+    expect(status).toBe(OperationStatus.FromCache);
+    expect([...cacheEntryByOperationName.keys()].sort()).toEqual([
+      'selected (build)',
+      'selected-changed-only (build)'
+    ]);
+    for (const entry of cacheEntryByOperationName.values()) {
+      expect(entry.tryRestoreFromCacheAsync).toHaveBeenCalledTimes(1);
+      expect(entry.trySetCacheEntryAsync).not.toHaveBeenCalled();
+    }
+    expect(terminalProvider.getOutput()).toContain(
+      'Cache operation "read" completed successfully for 2 out of 2 operations.'
+    );
+  });
+
+  it('writes only the operations in the selection', async () => {
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('write', terminal);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(
+      createRecords([selected, selectedChangedOnly, unselected, noOp]),
+      {}
+    );
+
+    expect(status).toBe(OperationStatus.Success);
+    expect([...cacheEntryByOperationName.keys()].sort()).toEqual([
+      'selected (build)',
+      'selected-changed-only (build)'
+    ]);
+    for (const entry of cacheEntryByOperationName.values()) {
+      expect(entry.trySetCacheEntryAsync).toHaveBeenCalledTimes(1);
+      expect(entry.tryRestoreFromCacheAsync).not.toHaveBeenCalled();
+    }
+    expect(terminalProvider.getOutput()).toContain(
+      'Cache operation "write" completed successfully for 2 out of 2 operations.'
+    );
+  });
+
+  it('restores a selected operation whose record is disabled because it is up to date', async () => {
+    // In a long-lived graph, such as a Rush daemon engine, a selected operation whose inputs did not change
+    // since its last successful iteration gets a disabled record. A read still covers the whole selection,
+    // as it does in a fresh native run, so the plugin checks the operation's enabled state, not the record's.
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('read', terminal);
+    const records: ReadonlyMap<Operation, IOperationExecutionResult> = new Map([
+      [selected, { operation: selected, enabled: false } as unknown as IOperationExecutionResult],
+      [unselected, { operation: unselected, enabled: false } as unknown as IOperationExecutionResult]
+    ]);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(records, {});
+
+    expect(status).toBe(OperationStatus.FromCache);
+    expect([...cacheEntryByOperationName.keys()]).toEqual(['selected (build)']);
+    for (const entry of cacheEntryByOperationName.values()) {
+      expect(entry.tryRestoreFromCacheAsync).toHaveBeenCalledTimes(1);
+    }
+    expect(terminalProvider.getOutput()).toContain(
+      'Cache operation "read" completed successfully for 1 out of 1 operations.'
+    );
+  });
+
+  it('continues normal execution when no selected operation has work', async () => {
+    const beforeExecuteIteration: BeforeExecuteIteration = await applyPluginAsync('read', terminal);
+
+    const status: OperationStatus | undefined = await beforeExecuteIteration(
+      createRecords([unselected, noOp]),
+      {}
+    );
+
+    expect(status).toBeUndefined();
+    expect(OperationBuildCache.forOperation).not.toHaveBeenCalled();
+  });
+});

From bcec363d1828036834e33fe751d0e85a4a92a962 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:37 +0000
Subject: [PATCH 257/265] [rush-daemon] Prepare the next engine in the
 background

Swarm integration step 242; original commit b20e9983fa (merge of swarm/r01-t117-p2 at ab4690c4b3).
Refs: task 117.
Scope: task 117 Part 2: prepare the next engine in the background.

Brings R (branch swarm/r01-t117-p2). Second agent: r02 board 9649 (RESULT board 9647). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 1 of 9. Gate: ch01 GATE OK board 10189 (tree 3c32e43959)

Commits folded into this step (1):
- ab4690c4b3 rush-daemon: Prepare the next engine in the background (task 117)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                |   1 +
 ...round-prepare-option_2026-09-29-22-40.json |  11 +
 ...round-prepare-option_2026-09-29-22-40.json |  11 +
 .../background-prepare_2026-09-29-22-40.json  |  11 +
 common/reviews/api/rush-daemon.api.md         |   1 +
 common/reviews/api/rush-lib.api.md            |   2 +
 docs/rush/environment-variables.md            |   1 +
 libraries/rush-daemon/README.md               |  24 +
 .../src/BackgroundPreparationScheduler.ts     | 227 +++++++
 .../src/DaemonRequestDispatcher.ts            |   5 +
 .../src/ProductionDaemonRequestResolver.ts    |  12 +-
 .../src/WorkspaceRequestLifecycle.ts          | 504 +++++++++++----
 .../BackgroundPreparationScheduler.test.ts    | 288 +++++++++
 .../src/test/BackgroundPrepare.test.ts        | 577 ++++++++++++++++++
 .../rush-lib/src/api/DaemonConfiguration.ts   |  13 +-
 .../src/api/EnvironmentConfiguration.ts       |   3 +
 .../src/api/test/DaemonConfiguration.test.ts  |  17 +-
 .../rush-lib/src/schemas/rush.schema.json     |   5 +
 18 files changed, 1601 insertions(+), 112 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/background-prepare-option_2026-09-29-22-40.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/background-prepare-option_2026-09-29-22-40.json
 create mode 100644 common/changes/@rushstack/rush-daemon/background-prepare_2026-09-29-22-40.json
 create mode 100644 libraries/rush-daemon/src/BackgroundPreparationScheduler.ts
 create mode 100644 libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts
 create mode 100644 libraries/rush-daemon/src/test/BackgroundPrepare.test.ts

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index a4726f93ab..98b501ba77 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -537,6 +537,7 @@ keys and unknown `RUSH_DAEMON*` variables fail validation.
 | `warmWorkers` | `RUSH_DAEMON_WARM_WORKERS` | false | With `incrementalBuilds`, keeps a watch-mode worker (the `<phase>:incremental:ipc` script) alive between builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and sends it the next incremental run. Opt in only if that script runs every task and check that the initial script runs, for Heft including lint and API Extractor. When an incremental run is not allowed, the worker is closed and the initial script runs. Workers count toward `warmMemoryBudgetMB` and `warmSetMaxProjects`, so raise both to keep them alive |
 | `joinRunningBatch` | `RUSH_DAEMON_JOIN_RUNNING_BATCH` | false | Experimental. A build request that arrives while the daemon executes an incremental batch with the same request settings adds its operations to the executing iteration and gets its result once they complete, instead of waiting for the iteration to end. When the iteration can't take its work, the request waits as before |
 | `deferCacheWrites` | `RUSH_DAEMON_DEFER_CACHE_WRITES` | false | Lets an operation complete once its output files are cloned, and writes its build cache entry from the clones in the background. Needs a file system that can clone files (such as Btrfs, XFS or APFS); otherwise, and in cobuilds, the entry is written before the operation completes. A failed background write doesn't change the operation's status; the next command reports it in a warning (on stderr in legacy output), which agent output also prints. A restore of the entry's key misses until the entry is written, and `daemon stop` drops the entries that aren't written yet |
+| `backgroundPrepare` | `RUSH_DAEMON_BACKGROUND_PREPARE` | false | Experimental. When a watched workspace input changes so that the next request would reload the workspace graph (`lastReloadTier` 1), for example after an edit of `rush.json` or `common/config/rush/command-line.json`, an idle daemon reloads it and creates the engine for the command line of the last phased command that it served, 2 seconds after the last change. It never runs an operation or restarts the daemon, and it doesn't start while another Rush process holds the repository lock. A request with the same command line waits for it; any other request stops it and runs as before |
 | `warmIdleTimeoutSeconds` | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | 300 | Idle runner, project-watcher and retained-result eviction |
 | `warmMemoryBudgetMB` | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | 512 | Best-effort sampled RSS budget in MiB, not a hard ceiling. Compared against whole-daemon RSS plus measured child RSS, so keep it above the daemon baseline (~130-190 MiB) |
 | `warmSetMaxProjects` | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | 20 | Best-effort limit on projects holding warm resources (active runners, watchers); retained results of resource-free projects do not count. Never trims requested execution |
diff --git a/common/changes/@microsoft/rush/background-prepare-option_2026-09-29-22-40.json b/common/changes/@microsoft/rush/background-prepare-option_2026-09-29-22-40.json
new file mode 100644
index 0000000000..d1ac7e31bc
--- /dev/null
+++ b/common/changes/@microsoft/rush/background-prepare-option_2026-09-29-22-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Add `daemon.backgroundPrepare` (or `RUSH_DAEMON_BACKGROUND_PREPARE=1`), an experimental Rush daemon setting that is off by default. With it, when a watched workspace input changes so that the next request would reload the workspace graph, an idle daemon reloads it and creates the engine for the command line of the last phased command that it served, so that the next request with that command line starts on the new generation.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/background-prepare-option_2026-09-29-22-40.json b/common/changes/@rushstack/rush-cli-client/background-prepare-option_2026-09-29-22-40.json
new file mode 100644
index 0000000000..b556126334
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/background-prepare-option_2026-09-29-22-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "Document the `backgroundPrepare` daemon setting and `RUSH_DAEMON_BACKGROUND_PREPARE`.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/background-prepare_2026-09-29-22-40.json b/common/changes/@rushstack/rush-daemon/background-prepare_2026-09-29-22-40.json
new file mode 100644
index 0000000000..01fe8d5336
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/background-prepare_2026-09-29-22-40.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Add an experimental mode, enabled by the Rush daemon setting `daemon.backgroundPrepare` (or `RUSH_DAEMON_BACKGROUND_PREPARE=1`), in which an idle daemon keeps the command line of the last phased command that it served and, 2 seconds after a watched workspace input changes so that the next request would reload the workspace graph, reloads it and creates that command line's engine in the background, with the daemon's own environment and without running any operation. A request with the same command line waits for the preparation and then starts on the new generation; any other request stops it. It never restarts the daemon, and it waits while another Rush process holds the repository lock. Without the setting, the daemon reloads only for a request, as before.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/reviews/api/rush-daemon.api.md b/common/reviews/api/rush-daemon.api.md
index 3083b8374e..df7da85d95 100644
--- a/common/reviews/api/rush-daemon.api.md
+++ b/common/reviews/api/rush-daemon.api.md
@@ -480,6 +480,7 @@ export interface IRequestSchedulerAcquireOptions {
 // @beta
 export interface IResolveDaemonRequestOptions {
     readonly abortSignal: AbortSignal;
+    readonly engineCreationSignal?: AbortSignal;
     // (undocumented)
     readonly envelope: IDaemonRequestEnvelope;
     readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
diff --git a/common/reviews/api/rush-lib.api.md b/common/reviews/api/rush-lib.api.md
index 10f58d984a..f79cfa2a80 100644
--- a/common/reviews/api/rush-lib.api.md
+++ b/common/reviews/api/rush-lib.api.md
@@ -327,6 +327,7 @@ export const EnvironmentVariableNames: {
     readonly RUSH_DAEMON_WARM_WORKERS: "RUSH_DAEMON_WARM_WORKERS";
     readonly RUSH_DAEMON_JOIN_RUNNING_BATCH: "RUSH_DAEMON_JOIN_RUNNING_BATCH";
     readonly RUSH_DAEMON_DEFER_CACHE_WRITES: "RUSH_DAEMON_DEFER_CACHE_WRITES";
+    readonly RUSH_DAEMON_BACKGROUND_PREPARE: "RUSH_DAEMON_BACKGROUND_PREPARE";
     readonly RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: "RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS: "RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS";
     readonly RUSH_DAEMON_WARM_MEMORY_BUDGET_MB: "RUSH_DAEMON_WARM_MEMORY_BUDGET_MB";
@@ -535,6 +536,7 @@ export interface ICustomTipsJson {
 export interface IDaemonConfigurationJson {
     readonly autoStart?: boolean;
     readonly autoWarmByTelemetry?: boolean;
+    readonly backgroundPrepare?: boolean;
     readonly commandAgnosticPlugins?: ReadonlyArray<string>;
     readonly compatiblePlugins?: ReadonlyArray<string>;
     readonly deferCacheWrites?: boolean;
diff --git a/docs/rush/environment-variables.md b/docs/rush/environment-variables.md
index cf02f4ae43..7fd653ab30 100644
--- a/docs/rush/environment-variables.md
+++ b/docs/rush/environment-variables.md
@@ -31,6 +31,7 @@ variables and invalid values are errors, not ignored settings.
 | `RUSH_DAEMON_WARM_WORKERS` | `0` | With `RUSH_DAEMON_INCREMENTAL_BUILDS`, keep a watch-mode worker (the `<phase>:incremental:ipc` script) alive between daemon builds for each operation whose `rush-project.json` operation settings set `allowDaemonWarmWorker`, and send it the next incremental run. The worker keeps its last build in memory, so it rebuilds only what changed. When an incremental run is not allowed, the worker is closed and the initial script runs, in a new worker if the project defines `<phase>:ipc`. Workers count toward `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` and `RUSH_DAEMON_WARM_SET_MAX_PROJECTS`. Over either limit the daemon closes them and drops their projects' last results, so raise both for the workers to stay alive. Overrides `warmWorkers`. |
 | `RUSH_DAEMON_JOIN_RUNNING_BATCH` | `0` | Experimental. Let a build request that arrives while the daemon executes an incremental batch with the same request settings add its operations to the executing iteration, and get its result once they complete, instead of waiting for the iteration to end. Operations that both requests need run once. If the iteration can't take the request's work, for example because an operation that the request needs started before its inputs changed, the request waits for the iteration to end as before. Overrides `joinRunningBatch`. |
 | `RUSH_DAEMON_DEFER_CACHE_WRITES` | `0` | Let an operation of a daemon build complete before its build cache entry is written. The daemon clones the operation's output files and writes the entry from the clones in the background, so the operations that depend on it, and the command, don't wait for it. This needs a file system that can clone files (such as Btrfs, XFS or APFS); otherwise, and in cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be written in the background doesn't change the operation's status, a restore of the entry's key misses until the entry is written, and stopping the daemon drops the entries that aren't written yet. See [Deferred build cache writes](./dogfooding-rush-daemon.md#deferred-build-cache-writes). Overrides `deferCacheWrites`. |
+| `RUSH_DAEMON_BACKGROUND_PREPARE` | `0` | Experimental. When a watched workspace input changes so that the next request would reload the workspace graph, for example after an edit of `rush.json` or `common/config/rush/command-line.json`, let an idle daemon reload it and create the engine for the command line of the last phased command that it served, 2 seconds after the last change. It never runs an operation or restarts the daemon. It starts only while no request or served `rushx` script runs and no other Rush process holds the repository lock, and it takes that lock without waiting. A request with the same command line waits for it; any other request stops it at its next step and then runs as before. Overrides `backgroundPrepare`. |
 | `RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS` | `300` | Idle expiration for retained runners and project watchers, together with those projects' results. Results of resource-free (shell/null) projects do not expire. Positive seconds, at most 2147483.647. Overrides `warmIdleTimeoutSeconds`. |
 | `RUSH_DAEMON_WARM_MEMORY_BUDGET_MB` | `512` | Best-effort sampled RSS budget in MiB. Positive number, at most 9007199254740991. Not a hard process-tree memory ceiling; active/protected work and results of resource-free projects are exempt. Overrides `warmMemoryBudgetMB`. |
 | `RUSH_DAEMON_WARM_SET_MAX_PROJECTS` | `20` | Best-effort retained-project limit. Positive safe integer, at most 9007199254740991; never trims the requested execution set. Overrides `warmSetMaxProjects`. |
diff --git a/libraries/rush-daemon/README.md b/libraries/rush-daemon/README.md
index d1d8c403dc..4766a74fbf 100644
--- a/libraries/rush-daemon/README.md
+++ b/libraries/rush-daemon/README.md
@@ -714,6 +714,30 @@ have stopped, unless the command is a Rushx script or a built-in command that on
 example `rushd stopped 2 operations left running by an earlier failed command (a (build), b (build)), so that this
 command can run in-process.` The client prints that line under its fallback line.
 
+With the experimental `daemon.backgroundPrepare` setting (`RUSH_DAEMON_BACKGROUND_PREPARE=1` in the daemon's
+environment), an idle daemon reloads the generation before the next request needs it. The daemon keeps the command
+line (name, origin, argv and working directory) of the last phased command that it served, but not the client's
+environment or terminal: a preparation uses the daemon's own environment. Each change that the workspace watcher
+reports starts a 2-second quiet period. After it, the daemon captures the workspace inputs and classifies them as that
+command's next request would, from the fingerprint alone. If that request would reload (tier 1), the daemon takes
+native Rush's lock without waiting, then quiesces the warm set, loads the new session and creates the engine for that
+command line, as a request's reload does, but runs no operation and keeps no result. It writes
+`rushd: prepared "rush <argv>" in the background (background-prepare-<n>) in <n> ms` to its log. A request with the
+same command line, working directory and environment, as far as the fingerprint reads it, waits for the preparation as
+behind any reload, with its wait budget paused, and then starts on the new generation (tier 0). Any other request,
+including a Rushx script or a graph request, stops the preparation at its next step (a step that has started runs to
+its end) and then runs as before; once the preparation has quiesced the warm set, that request or the next one
+reloads. After a preparation stops, or when the inputs change while it loads, the daemon checks again once it is idle
+and a quiet period has passed. A preparation starts only while no request, Rushx script, reload or restart is active
+or waits, and not while another Rush process holds the lock: the daemon then checks again after 2 seconds, and after
+twice as long each time, up to 60 seconds. It never restarts the daemon (tier 2, for example after a lockfile
+changes), and it does not act on a change that the watcher cannot attribute to a path, on an unhealthy watcher, or on
+inputs that the watcher does not observe, such as the files of projects that it doesn't watch or inherited rig
+settings; the next request still detects all of these. After a preparation fails for another reason, for example
+because the new configuration requires `--no-daemon`, nothing is prepared until the daemon serves a phased command
+again. While a preparation runs, native Rush commands find the lock taken, as they do during any reload, and a
+`--no-wait` request fails at once.
+
 The typed phased router remains separate from native initialization. `ProductionDaemonRequestResolver` supplies
 validated exact selections from `PhasedCommandEngine`; other integrations retain the existing dependency-closure
 selection mode by default. Native empty project selections are successful no-op requests.
diff --git a/libraries/rush-daemon/src/BackgroundPreparationScheduler.ts b/libraries/rush-daemon/src/BackgroundPreparationScheduler.ts
new file mode 100644
index 0000000000..5f82127efa
--- /dev/null
+++ b/libraries/rush-daemon/src/BackgroundPreparationScheduler.ts
@@ -0,0 +1,227 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { getWorkspaceFingerprintEnvironmentEntries } from '@microsoft/rush-lib';
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import type { IWorkspaceSession } from './WorkspaceSession';
+
+/** A background preparation is due once the watched workspace inputs have not changed for this long. */
+export const BACKGROUND_PREPARE_QUIET_MS: number = 2000;
+/**
+ * While another Rush process holds the repository's lock, a background preparation is due again after this long, and
+ * then after twice as long each time, up to `BACKGROUND_PREPARE_MAX_RETRY_MS`.
+ */
+const BACKGROUND_PREPARE_FIRST_RETRY_MS: number = 2000;
+const BACKGROUND_PREPARE_MAX_RETRY_MS: number = 60_000;
+
+/** The command line that a background preparation binds, and the session that served it. */
+export interface IPreparationHint {
+  readonly session: IWorkspaceSession;
+  readonly envelope: IDaemonRequestEnvelope;
+}
+
+/** A state of the workspace and its generation, in which a background preparation found nothing to do. */
+export interface IPreparationCheck {
+  readonly session: IWorkspaceSession;
+  /** The invalidation sequence of `session`. */
+  readonly sequence: number;
+  readonly boundSession: IWorkspaceSession | undefined;
+  readonly forceReload: boolean;
+}
+
+export interface IBackgroundPreparationSchedulerOptions {
+  /** The environment of every background preparation. */
+  readonly environment: Readonly<Record<string, string>>;
+  /** Checks whether to start a background preparation now. */
+  readonly checkAsync: () => Promise<void>;
+  readonly onLog?: (message: string) => void;
+}
+
+export class BackgroundPreparationBusyError extends Error {
+  public constructor() {
+    super("Another Rush process holds this repository's lock.");
+  }
+}
+
+/**
+ * Keeps the command line of the last phased command that a daemon served, if its workspace turns
+ * `daemon.backgroundPrepare` on, and calls `checkAsync` when a background preparation may be due: once the watched
+ * workspace inputs have been quiet for `BACKGROUND_PREPARE_QUIET_MS`, once the daemon is idle again after it was busy
+ * when a check was due, and again later while another Rush process holds the repository's lock.
+ */
+export class BackgroundPreparationScheduler {
+  readonly #environment: Readonly<Record<string, string>>;
+  readonly #checkAsync: () => Promise<void>;
+  readonly #onLog: ((message: string) => void) | undefined;
+  #hint: IPreparationHint | undefined;
+  #unsubscribe: (() => void) | undefined;
+  #timer: NodeJS.Timeout | undefined;
+  /** Set when a check was due while the daemon was busy; it is due again once the daemon is idle. */
+  #deferred: boolean = false;
+  #checked: IPreparationCheck | undefined;
+  /** The last wait before a check that is due for a busy lock, or 0 after any other outcome. */
+  #retryMs: number = 0;
+  #closed: boolean = false;
+
+  public constructor(options: IBackgroundPreparationSchedulerOptions) {
+    this.#environment = options.environment;
+    this.#checkAsync = options.checkAsync;
+    this.#onLog = options.onLog;
+  }
+
+  public get hint(): IPreparationHint | undefined {
+    return this.#hint;
+  }
+
+  /**
+   * Keeps the command line of a phased command that was served on `session`, if the workspace turns
+   * `daemon.backgroundPrepare` on, and otherwise forgets any. A preparation runs with the daemon's own environment and
+   * no terminal, so nothing else of the client's request is kept. For a new session, `capturedSequence` is its
+   * invalidation sequence when its inputs were last captured: a change that the watcher reported after that, before
+   * this call, is due for a check too.
+   */
+  public remember(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    capturedSequence?: number
+  ): void {
+    if (this.#closed || !session.rushConfiguration.daemon.backgroundPrepare) {
+      this.forget();
+      return;
+    }
+    const isNewSession: boolean = this.#hint?.session !== session;
+    if (isNewSession) {
+      this.#unsubscribe?.();
+      this.#unsubscribe = session.invalidations.subscribe(() => this.#arm(BACKGROUND_PREPARE_QUIET_MS));
+      this.#checked = undefined;
+    }
+    const { argv, commandName, commandOrigin, cwd, invocationKind } = envelope;
+    this.#hint = {
+      session,
+      envelope: {
+        requestId: '',
+        argv: [...argv],
+        commandName,
+        commandOrigin,
+        cwd,
+        ...(invocationKind !== undefined && { invocationKind }),
+        environment: this.#environment,
+        terminal: { isTTY: false, supportsColor: false }
+      }
+    };
+    if (
+      isNewSession &&
+      capturedSequence !== undefined &&
+      session.invalidations.getSnapshot().sequence > capturedSequence
+    ) {
+      this.#arm(BACKGROUND_PREPARE_QUIET_MS);
+    }
+  }
+
+  /** Until a phased command is served again, nothing is prepared in the background. */
+  public forget(): void {
+    this.#unsubscribe?.();
+    this.#unsubscribe = undefined;
+    this.#hint = undefined;
+    this.#checked = undefined;
+    this.#deferred = false;
+    this.#retryMs = 0;
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+  }
+
+  public close(): void {
+    this.#closed = true;
+    this.forget();
+  }
+
+  /** Whether `check` is the state in which a check last found nothing to do. */
+  public isChecked(check: IPreparationCheck): boolean {
+    const checked: IPreparationCheck | undefined = this.#checked;
+    return (
+      checked !== undefined &&
+      checked.session === check.session &&
+      checked.sequence === check.sequence &&
+      checked.boundSession === check.boundSession &&
+      checked.forceReload === check.forceReload
+    );
+  }
+
+  /** Records that nothing is to be done in the state `check`, until the workspace or its generation changes. */
+  public markChecked(check: IPreparationCheck): void {
+    this.#checked = check;
+    this.#retryMs = 0;
+  }
+
+  /** Ends a wait for another Rush process. */
+  public markPrepared(): void {
+    this.#retryMs = 0;
+  }
+
+  /** Checks again once the daemon is idle; see `resume`. */
+  public defer(): void {
+    this.#deferred = true;
+  }
+
+  /** Arms a check that was due while the daemon was busy, if the daemon is idle now. */
+  public resume(isIdle: boolean): void {
+    if (!this.#deferred || !isIdle) return;
+    this.#deferred = false;
+    this.#arm(BACKGROUND_PREPARE_QUIET_MS);
+  }
+
+  /** Checks again later while another Rush process holds the repository's lock, waiting twice as long each time. */
+  public retry(): void {
+    if (this.#retryMs === 0) {
+      this.#onLog?.(
+        "rushd: another Rush process holds this repository's lock; the daemon prepares in the background " +
+          'once that process releases it'
+      );
+    }
+    this.#retryMs =
+      this.#retryMs === 0
+        ? BACKGROUND_PREPARE_FIRST_RETRY_MS
+        : Math.min(this.#retryMs * 2, BACKGROUND_PREPARE_MAX_RETRY_MS);
+    this.#arm(this.#retryMs);
+  }
+
+  #arm(delayMs: number): void {
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+    if (this.#closed || !this.#hint) return;
+    this.#timer = setTimeout(() => {
+      this.#timer = undefined;
+      void this.#checkAsync().catch((error: unknown) => {
+        this.#onLog?.(
+          `rushd: could not check whether to prepare in the background: ${getErrorMessage(error)}`
+        );
+      });
+    }, delayMs);
+    this.#timer.unref();
+  }
+}
+
+/** Whether two requests have the same command line and working directory. */
+export function isSameCommandLine(envelope: IDaemonRequestEnvelope, other: IDaemonRequestEnvelope): boolean {
+  return (
+    envelope.commandName === other.commandName &&
+    envelope.commandOrigin === other.commandOrigin &&
+    envelope.invocationKind === other.invocationKind &&
+    envelope.cwd === other.cwd &&
+    envelope.argv.length === other.argv.length &&
+    envelope.argv.every((arg: string, index: number) => arg === other.argv[index])
+  );
+}
+
+/** The parts of an environment that a workspace input capture reads, normalized as every fingerprint comparison is. */
+export function getCaptureEnvironmentKey(environment: Readonly<Record<string, string | undefined>>): string {
+  return JSON.stringify([
+    environment.RUSH_PREVIEW_VERSION ?? null,
+    getWorkspaceFingerprintEnvironmentEntries(environment)
+  ]);
+}
+
+export function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
index f6e2c295e5..dfc35e5764 100644
--- a/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
+++ b/libraries/rush-daemon/src/DaemonRequestDispatcher.ts
@@ -67,6 +67,11 @@ export interface IDaemonRequestLifecycleInfo {
 export interface IResolveDaemonRequestOptions {
   /** Aborts when the request is cancelled, disconnected, or the host shuts down. */
   readonly abortSignal: AbortSignal;
+  /**
+   * Stops the creation of an engine that this call binds, between its preparation steps. Only a workspace lifecycle
+   * that prepares the next engine while no request waits for it sets this; a request's own binding runs to its end.
+   */
+  readonly engineCreationSignal?: AbortSignal;
   readonly envelope: IDaemonRequestEnvelope;
   /** Present when a host lifecycle admitted the request. */
   readonly lifecycleInfo?: IDaemonRequestLifecycleInfo;
diff --git a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
index 678bdc3b22..9b33813ae8 100644
--- a/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
+++ b/libraries/rush-daemon/src/ProductionDaemonRequestResolver.ts
@@ -217,7 +217,12 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
       this.#boundCommand = command;
       this.#workspaceSession = workspaceSession;
       bindingStartTimeMs = performance.now();
-      const binding: Promise<void> = this.#bindAsync(command, terminal, workspaceSession);
+      const binding: Promise<void> = this.#bindAsync(
+        command,
+        terminal,
+        workspaceSession,
+        options.engineCreationSignal
+      );
       this.#binding = binding;
       void binding.catch((error: unknown) => {
         if (error instanceof PhasedCommandEngineBusyError && this.#binding === binding) {
@@ -427,7 +432,8 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
   async #bindAsync(
     command: PhasedCommandEngine,
     terminal: EngineTerminalProvider,
-    session: IWorkspaceSession
+    session: IWorkspaceSession,
+    abortSignal: AbortSignal | undefined
   ): Promise<void> {
     if (!session.initializeEngineAsync) throw new Error('This session cannot bind a native engine.');
     if (command.unmatchedCompatiblePluginNames.length > 0) {
@@ -440,7 +446,7 @@ export class ProductionDaemonRequestResolver implements IDaemonRequestResolver {
     await session.initializeEngineAsync(async (options) => {
       let engine: IPhasedCommandEngine;
       try {
-        engine = await command.createEngineAsync(this.#preparationLock);
+        engine = await command.createEngineAsync(this.#preparationLock, abortSignal);
       } catch (error) {
         if (error instanceof PhasedCommandEngineBusyError) throw error;
         if (error instanceof PhasedCommandEngineProjectConfigurationError) {
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index 53e4eead33..d465395c2e 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -8,7 +8,7 @@ import {
   captureWorkspaceInputFingerprintAsync,
   classifyWorkspaceInputChange,
   EnvironmentVariableNames,
-  getWorkspaceFingerprintEnvironmentEntries,
+  PhasedCommandEngineBusyError,
   PhasedCommandEngineProjectConfigurationError,
   Rush,
   WorkspaceInputChangeTier,
@@ -65,7 +65,17 @@ import { WorkspaceEngineRecreationRequiredError } from './WorkspaceEngineCompone
 import { tryAcquireNativeLock } from './NativeRepositoryLock';
 import { getDaemonShutdownReason } from './DaemonShutdownError';
 import { getRushLibPathHandoff } from './RushLibPathHandoff';
+import {
+  BackgroundPreparationBusyError,
+  BackgroundPreparationScheduler,
+  getCaptureEnvironmentKey,
+  getErrorMessage,
+  isSameCommandLine,
+  type IPreparationCheck,
+  type IPreparationHint
+} from './BackgroundPreparationScheduler';
 import type { IWorkspaceSession } from './WorkspaceSession';
+import type { IWorkspaceInvalidationSnapshot } from './WorkspaceInvalidationTracker';
 import type { WorkspaceSessionProvider } from './WorkspaceSessionProvider';
 import { assertWorkspaceRequestResourcesHealthy } from './WorkspaceRequestResources';
 import type {
@@ -115,6 +125,32 @@ interface IPreparedGeneration {
   readonly fingerprint: IWorkspaceInputFingerprint;
 }
 
+interface IReloadOptions {
+  /** See `IResolveDaemonRequestOptions.abortSignal`. */
+  readonly abortSignal: AbortSignal;
+  /** See `IResolveDaemonRequestOptions.engineCreationSignal`. The reload also checks it before it replaces anything. */
+  readonly engineCreationSignal?: AbortSignal;
+  /** Takes the session's workspace request scheduler exclusively. */
+  readonly acquireWorkspaceLeaseAsync: (scheduler: RequestScheduler) => Promise<IRequestLease>;
+  /** Takes native Rush's repository lock in `lockFolder`. */
+  readonly acquireNativeLockAsync: (lockFolder: string) => Promise<LockFile>;
+}
+
+interface IReloadResult {
+  readonly session: IWorkspaceSession;
+  readonly fingerprint: IWorkspaceInputFingerprint;
+  /** Set when the command line's selection failed after the new generation was bound; see `isSelectionRejection`. */
+  readonly selectionRejection: DaemonRequestDispatchError | undefined;
+  /** The invalidation sequence of `session` when the capture of `fingerprint` started. */
+  readonly invalidationSequence: number;
+}
+
+interface IBackgroundPreparation {
+  readonly envelope: IDaemonRequestEnvelope;
+  /** Stops the preparation at its next step; see `#stopPreparationUnlessJoined`. */
+  readonly controller: AbortController;
+}
+
 export interface IWorkspaceRequestLifecycleOptions {
   readonly provider: WorkspaceSessionProvider;
   readonly resolver: IDaemonRequestResolver;
@@ -233,6 +269,15 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #transitionProgress: AdmissionProgress = new AdmissionProgress();
   #cleanupFailure: unknown;
   #disposePromise: Promise<void> | undefined;
+  /** How many calls of `dispatchAsync` have not returned. */
+  #activeDispatchCount: number = 0;
+  /** Keeps the command line of the last phased command that was served, and says when to prepare it again. */
+  readonly #preparations: BackgroundPreparationScheduler;
+  /** `getCaptureEnvironmentKey` of the environment of every background preparation. */
+  readonly #preparationEnvironmentKey: string;
+  /** The background preparation that holds `#gate`. */
+  #preparation: IBackgroundPreparation | undefined;
+  #preparationCount: number = 0;
 
   private constructor(
     options: IWorkspaceRequestLifecycleOptions,
@@ -249,6 +294,18 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     this.#runtimeCache = runtimeCache;
     this.#startupEnvironment = startupEnvironment;
     this.#startupEnvironmentEntries = getEnvironmentIdentityEntries(startupEnvironment);
+    // The daemon's own environment, which each request that it serves has too, as far as the workspace fingerprint
+    // reads it, with the engine that `dispatchAsync` sets for every request. A client's other variables are never kept.
+    const preparationEnvironment: Readonly<Record<string, string>> = Object.freeze({
+      ...startupEnvironment,
+      [EnvironmentVariableNames._RUSH_LIB_PATH]: this.#rushLibPath
+    });
+    this.#preparationEnvironmentKey = getCaptureEnvironmentKey(preparationEnvironment);
+    this.#preparations = new BackgroundPreparationScheduler({
+      environment: preparationEnvironment,
+      checkAsync: () => this.#tryStartPreparationAsync(),
+      onLog: (message: string) => this.#options.onLog?.(message)
+    });
   }
 
   public static async createAsync(
@@ -284,6 +341,20 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     request: IDaemonRequestEnvelope,
     destination: IDaemonRequestDispatchClient,
     dispatchWorkspaceRequestAsync: DispatchWorkspaceRequestAsync
+  ): Promise<void> {
+    this.#activeDispatchCount++;
+    try {
+      await this.#dispatchCoreAsync(request, destination, dispatchWorkspaceRequestAsync);
+    } finally {
+      this.#activeDispatchCount--;
+      this.#preparations.resume(this.#isIdle());
+    }
+  }
+
+  async #dispatchCoreAsync(
+    request: IDaemonRequestEnvelope,
+    destination: IDaemonRequestDispatchClient,
+    dispatchWorkspaceRequestAsync: DispatchWorkspaceRequestAsync
   ): Promise<void> {
     const receivedTimeMs: number = destination.receivedTimeMs ?? performance.now();
     const dispatchAsync: DispatchWorkspaceRequestAsync = (options) =>
@@ -303,6 +374,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         [EnvironmentVariableNames._RUSH_LIB_PATH]: this.#rushLibPath
       }
     };
+    this.#stopPreparationUnlessJoined(envelope);
     this.#detectInstallationChange();
     if (this.#restartPending) {
       await destination.interactiveSession.finishAsync();
@@ -696,6 +768,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
       }
       if (tier === WorkspaceInputChangeTier.Reuse && !isMutation(envelope)) {
         this.#lastReloadTier = WorkspaceInputChangeTier.Reuse;
+        this.#preparations.remember(session, envelope);
         return {
           session,
           resolver: this.#resolver,
@@ -807,6 +880,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
         projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
         if (projectFingerprint !== undefined && projectFingerprint === this.#projectFingerprint) {
           this.#lastReloadTier = WorkspaceInputChangeTier.Reuse;
+          this.#preparations.remember(session, envelope);
           this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
           return {
             session,
@@ -817,113 +891,30 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
           };
         }
       }
-      await this.#quiesceWarmSetAsync(session);
-      const workspaceLease: IRequestLease = await admission.acquireAsync(
-        getWorkspaceRequestScheduler(session),
-        RequestExclusivityClass.Exclusive
-      );
-      const lockFolder: string = session.rushConfiguration.commonTempFolder;
-      let nativeLock: LockFile;
-      // Waiting for another Rush process is contention, not graph-load progress; see `#waitForServedScriptsAsync`.
-      const loading: boolean = this.#transitionProgress.active;
-      this.#transitionProgress.setActive(false);
-      try {
-        nativeLock = await this.#acquireReloadLockAsync(admission, lockFolder);
-      } catch (error) {
-        workspaceLease.release();
-        throw error;
-      } finally {
-        this.#transitionProgress.setActive(loading);
-      }
-      let selectionRejection: DaemonRequestDispatchError | undefined;
-      try {
-        const before: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
-        let expectedFingerprint: IWorkspaceInputFingerprint = before;
-        const validationContext: { session?: IWorkspaceSession } = {};
-        const previousResolver: IDaemonRequestResolver = this.#resolver;
-        const resolver: IDaemonRequestResolver = getResolverLifecycle(previousResolver).createForSession(
-          nativeLock,
-          async () => {
-            const replacementSession: IWorkspaceSession | undefined = validationContext.session;
-            if (!replacementSession) throw new Error('The replacement generation is not initialized.');
-            const current: IWorkspaceInputFingerprint = await this.#captureAsync(
-              replacementSession,
-              envelope
-            );
-            if (
-              classifyWorkspaceInputChange(expectedFingerprint, current) !== WorkspaceInputChangeTier.Reuse
-            ) {
-              throw new WorkspaceEngineRecreationRequiredError();
-            }
-          }
-        );
-        this.#ownedResolvers.add(resolver);
-        try {
-          if (resolver === previousResolver) {
-            throw new Error('A new workspace generation must receive a new resolver instance.');
+      const reload: IReloadResult = await this.#reloadAsync(session, envelope, {
+        abortSignal: client.abortSignal,
+        acquireWorkspaceLeaseAsync: (scheduler: RequestScheduler) =>
+          admission.acquireAsync(scheduler, RequestExclusivityClass.Exclusive),
+        acquireNativeLockAsync: async (lockFolder: string) => {
+          // Waiting for another Rush process is contention, not graph-load progress; see `#waitForServedScriptsAsync`.
+          const loading: boolean = this.#transitionProgress.active;
+          this.#transitionProgress.setActive(false);
+          try {
+            return await this.#acquireReloadLockAsync(admission, lockFolder);
+          } finally {
+            this.#transitionProgress.setActive(loading);
           }
-          getResolverLifecycle(resolver);
-        } catch (error) {
-          this.#cleanupFailure = error;
-          throw error;
         }
-        this.#resolver = resolver;
-        try {
-          await previousResolver[Symbol.asyncDispose]?.();
-          this.#ownedResolvers.delete(previousResolver);
-        } catch (error) {
-          this.#cleanupFailure = error;
-          throw error;
-        }
-        const replacementSession: IWorkspaceSession = await this.#options.provider.reloadAsync();
-        validationContext.session = replacementSession;
-        session = replacementSession;
-        try {
-          await resolver.resolveRequestAsync({
-            envelope,
-            workspaceSession: session,
-            abortSignal: client.abortSignal
-          });
-        } catch (error) {
-          // An invalid selection (such as an unknown project) fails after the new graph was bound. Keep that
-          // generation, so that the next request does not load the whole workspace again.
-          if (!isSelectionRejection(error, session)) throw error;
-          selectionRejection = error;
-        }
-        const after: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
-        if (classifyWorkspaceInputChange(before, after) !== WorkspaceInputChangeTier.Reuse) {
-          this.#forceReload = true;
-          throw new WorkspaceEngineRecreationRequiredError();
-        }
-        this.#resolver = resolver;
-        expectedFingerprint = after;
-        this.#boundSession = session;
-        this.#fingerprint = after;
-        this.#projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
-        this.#commandIdentity = await getResolverLifecycle(resolver).getCommandParameterIdentityAsync({
-          envelope,
-          workspaceSession: session,
-          abortSignal: client.abortSignal
-        });
-        this.#lastReloadTier = WorkspaceInputChangeTier.Reload;
-        this.#forceReload = false;
-        fingerprint = after;
-      } catch (error) {
-        this.#forceReload = true;
-        if (error instanceof AggregateError) this.#cleanupFailure = error;
-        throw error;
-      } finally {
-        nativeLock.release();
-        workspaceLease.release();
-      }
-      if (selectionRejection) throw selectionRejection;
+      });
+      if (reload.selectionRejection) throw reload.selectionRejection;
+      this.#preparations.remember(reload.session, envelope, reload.invalidationSequence);
       this.#gate.downgradeExclusiveLease(lease, RequestExclusivityClass.SharedBuild);
       return {
-        session,
+        session: reload.session,
         resolver: this.#resolver,
         generation: this.#options.provider.generation,
         lease,
-        fingerprint
+        fingerprint: reload.fingerprint
       };
     } catch (error) {
       if (!(error instanceof RestartBeforeExecution)) lease.release();
@@ -936,6 +927,306 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     }
   }
 
+  /**
+   * Replaces the current generation: loads a new session and binds a new resolver's engine to it with the command line
+   * of `envelope`. The caller owns the transition and holds `#gate` exclusively. A reload that fails leaves
+   * `#forceReload` set, so that the next request reloads again.
+   */
+  async #reloadAsync(
+    session: IWorkspaceSession,
+    envelope: IDaemonRequestEnvelope,
+    options: IReloadOptions
+  ): Promise<IReloadResult> {
+    const { abortSignal, engineCreationSignal } = options;
+    await this.#quiesceWarmSetAsync(session);
+    const workspaceLease: IRequestLease = await options.acquireWorkspaceLeaseAsync(
+      getWorkspaceRequestScheduler(session)
+    );
+    let nativeLock: LockFile;
+    try {
+      nativeLock = await options.acquireNativeLockAsync(session.rushConfiguration.commonTempFolder);
+    } catch (error) {
+      workspaceLease.release();
+      throw error;
+    }
+    let selectionRejection: DaemonRequestDispatchError | undefined;
+    try {
+      const before: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
+      let expectedFingerprint: IWorkspaceInputFingerprint = before;
+      const validationContext: { session?: IWorkspaceSession } = {};
+      const previousResolver: IDaemonRequestResolver = this.#resolver;
+      // A background preparation that a request stopped replaces nothing. From here on it stops only in the engine's
+      // own steps, once the new session and resolver are in place.
+      engineCreationSignal?.throwIfAborted();
+      const resolver: IDaemonRequestResolver = getResolverLifecycle(previousResolver).createForSession(
+        nativeLock,
+        async () => {
+          const replacementSession: IWorkspaceSession | undefined = validationContext.session;
+          if (!replacementSession) throw new Error('The replacement generation is not initialized.');
+          const current: IWorkspaceInputFingerprint = await this.#captureAsync(replacementSession, envelope);
+          if (classifyWorkspaceInputChange(expectedFingerprint, current) !== WorkspaceInputChangeTier.Reuse) {
+            throw new WorkspaceEngineRecreationRequiredError();
+          }
+        }
+      );
+      this.#ownedResolvers.add(resolver);
+      try {
+        if (resolver === previousResolver) {
+          throw new Error('A new workspace generation must receive a new resolver instance.');
+        }
+        getResolverLifecycle(resolver);
+      } catch (error) {
+        this.#cleanupFailure = error;
+        throw error;
+      }
+      this.#resolver = resolver;
+      try {
+        await previousResolver[Symbol.asyncDispose]?.();
+        this.#ownedResolvers.delete(previousResolver);
+      } catch (error) {
+        this.#cleanupFailure = error;
+        throw error;
+      }
+      const replacementSession: IWorkspaceSession = await this.#options.provider.reloadAsync();
+      validationContext.session = replacementSession;
+      session = replacementSession;
+      try {
+        await resolver.resolveRequestAsync({
+          envelope,
+          workspaceSession: session,
+          abortSignal,
+          engineCreationSignal
+        });
+      } catch (error) {
+        // An invalid selection (such as an unknown project) fails after the new graph was bound. Keep that
+        // generation, so that the next request does not load the whole workspace again.
+        if (!isSelectionRejection(error, session)) throw error;
+        selectionRejection = error;
+      }
+      const invalidationSequence: number = session.invalidations.getSnapshot().sequence;
+      const after: IWorkspaceInputFingerprint = await this.#captureAsync(session, envelope);
+      if (classifyWorkspaceInputChange(before, after) !== WorkspaceInputChangeTier.Reuse) {
+        this.#forceReload = true;
+        throw new WorkspaceEngineRecreationRequiredError();
+      }
+      this.#resolver = resolver;
+      expectedFingerprint = after;
+      this.#boundSession = session;
+      this.#fingerprint = after;
+      this.#projectFingerprint = await this.#tryCaptureProjectFingerprintAsync(session);
+      this.#commandIdentity = await getResolverLifecycle(resolver).getCommandParameterIdentityAsync({
+        envelope,
+        workspaceSession: session,
+        abortSignal
+      });
+      this.#lastReloadTier = WorkspaceInputChangeTier.Reload;
+      this.#forceReload = false;
+      return { session, fingerprint: after, selectionRejection, invalidationSequence };
+    } catch (error) {
+      this.#forceReload = true;
+      if (error instanceof AggregateError) this.#cleanupFailure = error;
+      throw error;
+    } finally {
+      nativeLock.release();
+      workspaceLease.release();
+    }
+  }
+
+  /**
+   * Whether nothing runs or waits on this daemon: no request, served rushx script, graph observer, transition or
+   * background preparation, and no pending restart, closing, cleanup failure or installation change.
+   */
+  #isIdle(): boolean {
+    return (
+      this.#activeDispatchCount === 0 &&
+      this.#preparation === undefined &&
+      !this.#transitioning &&
+      !this.#restartPending &&
+      !this.#closing &&
+      this.#cleanupFailure === undefined &&
+      this.#installationChange === undefined &&
+      this.#gate.activeRequestCount === 0 &&
+      this.#gate.queuedRequestCount === 0 &&
+      this.#scripts.activeRequestCount === 0 &&
+      this.#scripts.queuedRequestCount === 0
+    );
+  }
+
+  /**
+   * Starts a background preparation if the kept command line's next request would reload the workspace graph (the
+   * same classification as `#prepareAsync`, from a capture that starts now), the daemon is idle and no other Rush
+   * process holds the repository's lock. It checks each state of the workspace once: a later change, request or
+   * reload makes it check again. It does not act on a change that its capture cannot see, such as an unknown change
+   * or an unhealthy watcher, and it never restarts the daemon; the next request does both, as it would anyway.
+   */
+  async #tryStartPreparationAsync(): Promise<void> {
+    const hint: IPreparationHint | undefined = this.#preparations.hint;
+    if (!hint) return;
+    if (!this.#isIdle()) {
+      this.#preparations.defer();
+      return;
+    }
+    const { session } = hint;
+    if (this.#options.provider.currentSession !== session || this.#detectInstallationChange()) return;
+    const snapshot: IWorkspaceInvalidationSnapshot = session.invalidations.getSnapshot();
+    const check: IPreparationCheck = {
+      session,
+      sequence: snapshot.sequence,
+      boundSession: this.#boundSession,
+      forceReload: this.#forceReload
+    };
+    if (this.#preparations.isChecked(check)) return;
+    if (!snapshot.isWatcherHealthy) {
+      this.#preparations.markChecked(check);
+      return;
+    }
+    if (findNativeLockHolder(session.rushConfiguration.commonTempFolder).pid !== undefined) {
+      this.#preparations.retry();
+      return;
+    }
+    const fingerprint: IWorkspaceInputFingerprint = await this.#captureAsync(session, hint.envelope);
+    if (
+      this.#preparations.hint !== hint ||
+      this.#options.provider.currentSession !== session ||
+      !this.#isIdle()
+    ) {
+      this.#preparations.defer();
+      this.#preparations.resume(this.#isIdle());
+      return;
+    }
+    const tier: WorkspaceInputChangeTier = this.#classify(fingerprint, false);
+    if (
+      tier === WorkspaceInputChangeTier.Restart ||
+      (tier === WorkspaceInputChangeTier.Reuse && this.#boundSession === session && !this.#forceReload)
+    ) {
+      this.#preparations.markChecked(check);
+      return;
+    }
+    this.#startPreparation(hint);
+  }
+
+  /** Takes `#gate` for a background preparation, which the daemon is idle enough to admit at once. */
+  #startPreparation(hint: IPreparationHint): void {
+    const lease: Promise<IRequestLease> = this.#gate.acquireAsync({
+      exclusivityClass: RequestExclusivityClass.Exclusive,
+      noWait: true
+    });
+    const preparation: IBackgroundPreparation = {
+      envelope: { ...hint.envelope, requestId: `background-prepare-${++this.#preparationCount}` },
+      controller: new AbortController()
+    };
+    this.#preparation = preparation;
+    // Requests that arrive now wait behind the transition, with their wait budgets paused while it loads.
+    this.#transitioning = true;
+    this.#scriptsMayPassTransition = true;
+    this.#transitionProgress.setActive(true);
+    void this.#runPreparationAsync(hint, preparation, lease);
+  }
+
+  /**
+   * Reloads the workspace graph and binds the kept command line's engine to it, as the request path does, but never
+   * dispatches the command. It takes native Rush's repository lock before it quiesces anything, without waiting.
+   * A request that it does not serve stops it at its next step (`#stopPreparationUnlessJoined`).
+   */
+  async #runPreparationAsync(
+    hint: IPreparationHint,
+    preparation: IBackgroundPreparation,
+    admitted: Promise<IRequestLease>
+  ): Promise<void> {
+    const { envelope, controller } = preparation;
+    const signal: AbortSignal = AbortSignal.any([this.#abortController.signal, controller.signal]);
+    const description: string = `"rush ${envelope.argv.join(' ')}" in the background (${envelope.requestId})`;
+    const startTimeMs: number = performance.now();
+    let lease: IRequestLease | undefined;
+    let busy: boolean = false;
+    try {
+      lease = await admitted;
+      signal.throwIfAborted();
+      if (this.#restartPending || this.#closing || this.#cleanupFailure !== undefined) return;
+      if (this.#detectInstallationChange()) return;
+      const session: IWorkspaceSession | undefined = this.#options.provider.currentSession;
+      if (session !== hint.session) return;
+      const nativeLock: LockFile | undefined = tryAcquireNativeLock(
+        session.rushConfiguration.commonTempFolder
+      );
+      if (!nativeLock) throw new BackgroundPreparationBusyError();
+      let lockPassed: boolean = false;
+      let result: IReloadResult;
+      try {
+        result = await this.#reloadAsync(session, envelope, {
+          // The resolver keys its parses by this signal, so each preparation needs its own.
+          abortSignal: AbortSignal.any([this.#abortController.signal]),
+          engineCreationSignal: signal,
+          acquireWorkspaceLeaseAsync: (scheduler: RequestScheduler) =>
+            scheduler.acquireAsync({
+              exclusivityClass: RequestExclusivityClass.Exclusive,
+              abortSignal: signal
+            }),
+          acquireNativeLockAsync: async () => {
+            lockPassed = true;
+            return nativeLock;
+          }
+        });
+      } finally {
+        if (!lockPassed) nativeLock.release();
+      }
+      this.#preparations.markPrepared();
+      this.#preparations.remember(result.session, hint.envelope, result.invalidationSequence);
+      const elapsedMs: number = Math.round(performance.now() - startTimeMs);
+      this.#options.onLog?.(
+        result.selectionRejection
+          ? `rushd: loaded the workspace graph for ${description} in ${elapsedMs} ms, but its selection failed: ` +
+              result.selectionRejection.message
+          : `rushd: prepared ${description} in ${elapsedMs} ms`
+      );
+    } catch (error) {
+      if (error instanceof BackgroundPreparationBusyError || error instanceof PhasedCommandEngineBusyError) {
+        busy = true;
+      } else if (signal.aborted || error instanceof WorkspaceEngineRecreationRequiredError) {
+        const reason: unknown = signal.aborted ? signal.reason : error;
+        this.#options.onLog?.(`rushd: stopped preparing ${description}: ${getErrorMessage(reason)}`);
+        // Once the daemon is idle, it checks again, on the session that the preparation loaded if it loaded one.
+        const current: IWorkspaceSession | undefined = this.#options.provider.currentSession;
+        if (current && current !== hint.session && this.#preparations.hint === hint) {
+          this.#preparations.remember(current, hint.envelope);
+        }
+        this.#preparations.defer();
+      } else {
+        this.#preparations.forget();
+        this.#options.onLog?.(`rushd: could not prepare ${description}: ${getErrorMessage(error)}`);
+      }
+    } finally {
+      if (this.#preparation === preparation) this.#preparation = undefined;
+      this.#transitioning = false;
+      this.#transitionProgress.setActive(false);
+      lease?.release();
+      if (busy) this.#preparations.retry();
+      else this.#preparations.resume(this.#isIdle());
+    }
+  }
+
+  /**
+   * Stops the background preparation at its next step unless `envelope` has the same command line and environment,
+   * so that its request can run on the engine that the preparation creates. That request waits behind the
+   * preparation as behind any transition. Any other request needs the workspace for something else.
+   */
+  #stopPreparationUnlessJoined(envelope: IDaemonRequestEnvelope): void {
+    const preparation: IBackgroundPreparation | undefined = this.#preparation;
+    if (!preparation || this.#canJoinPreparation(preparation.envelope, envelope)) return;
+    this.#preparations.defer();
+    preparation.controller.abort(new Error(`request ${envelope.requestId} needs the workspace`));
+  }
+
+  #canJoinPreparation(prepared: IDaemonRequestEnvelope, envelope: IDaemonRequestEnvelope): boolean {
+    return (
+      !isRushxInvocation(envelope) &&
+      !isGraphRequest(envelope) &&
+      !isMutation(envelope) &&
+      isSameCommandLine(envelope, prepared) &&
+      getCaptureEnvironmentKey(envelope.environment) === this.#preparationEnvironmentKey
+    );
+  }
+
   /**
    * Admits a served rushx script with a `#gate` lease, or with a `#scriptPassage` lease while the passage is open. A
    * script that waits behind a transition may be admitted ahead of a reload's owner that still waits for `#gate` (see
@@ -1032,14 +1323,9 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   ): Promise<IWorkspaceInputFingerprint> {
     const { rushConfiguration } = session;
     const { environment } = envelope;
-    // The capture reads only these parts of an environment, normalized as every fingerprint comparison is.
-    const key: string = JSON.stringify([
-      environment.RUSH_PREVIEW_VERSION ?? null,
-      getWorkspaceFingerprintEnvironmentEntries(environment)
-    ]);
     return this.#fingerprintCaptures.captureAsync(
       rushConfiguration,
-      key,
+      getCaptureEnvironmentKey(environment),
       () =>
         captureWorkspaceInputFingerprintAsync({
           rushConfiguration,
@@ -1389,6 +1675,9 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
     if (!change) return undefined;
     this.#installationChange = change;
     this.#cancelObservers();
+    this.#preparation?.controller.abort(
+      new Error(`the installation at ${change.folder} was ${change.change}`)
+    );
     this.#options.onLog?.(
       `rushd: the installation at ${change.folder} was ${change.change}; exiting once running requests finish, ` +
         'so that the next client starts a new daemon'
@@ -1497,6 +1786,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
 
   public [Symbol.asyncDispose](): Promise<void> {
     this.#closing = true;
+    this.#preparations.close();
     this.#abortController.abort();
     this.#cancelObservers();
     this.#disposePromise ??= (async () => {
diff --git a/libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts b/libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts
new file mode 100644
index 0000000000..a8b48a372b
--- /dev/null
+++ b/libraries/rush-daemon/src/test/BackgroundPreparationScheduler.test.ts
@@ -0,0 +1,288 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import type { IDaemonRequestEnvelope } from '@rushstack/rush-daemon-protocol';
+
+import {
+  BACKGROUND_PREPARE_QUIET_MS,
+  BackgroundPreparationScheduler,
+  getCaptureEnvironmentKey,
+  isSameCommandLine,
+  type IPreparationCheck
+} from '../BackgroundPreparationScheduler';
+import { WorkspaceInvalidationTracker } from '../WorkspaceInvalidationTracker';
+import type { IWorkspaceSession } from '../WorkspaceSession';
+
+const DAEMON_ENVIRONMENT: Readonly<Record<string, string>> = Object.freeze({ PATH: '/daemon/bin' });
+const BUSY_LOG: string =
+  "rushd: another Rush process holds this repository's lock; the daemon prepares in the background " +
+  'once that process releases it';
+
+function createSession(backgroundPrepare: boolean = true): IWorkspaceSession {
+  return {
+    rushConfiguration: { daemon: { backgroundPrepare } },
+    invalidations: new WorkspaceInvalidationTracker()
+  } as unknown as IWorkspaceSession;
+}
+
+function createEnvelope(overrides: Partial<IDaemonRequestEnvelope> = {}): IDaemonRequestEnvelope {
+  return {
+    requestId: 'request-1',
+    commandName: 'build',
+    commandOrigin: 'built-in',
+    argv: ['build', '--to', 'b'],
+    cwd: '/repo/b',
+    environment: { PATH: '/client/bin', TRACEPARENT: '00-client-trace-01' },
+    terminal: { isTTY: true, supportsColor: true, columns: 120 },
+    admission: { waitTimeoutMs: 600_000 },
+    returnEarlyOnFailure: true,
+    ...overrides
+  };
+}
+
+interface ITestScheduler {
+  readonly scheduler: BackgroundPreparationScheduler;
+  readonly checks: jest.Mock<Promise<void>, []>;
+  readonly logs: string[];
+}
+
+function createScheduler(checkAsync: () => Promise<void> = async () => undefined): ITestScheduler {
+  const checks: jest.Mock<Promise<void>, []> = jest.fn(checkAsync);
+  const logs: string[] = [];
+  const scheduler: BackgroundPreparationScheduler = new BackgroundPreparationScheduler({
+    environment: DAEMON_ENVIRONMENT,
+    checkAsync: checks,
+    onLog: (message: string) => logs.push(message)
+  });
+  return { scheduler, checks, logs };
+}
+
+describe(BackgroundPreparationScheduler.name, () => {
+  beforeEach(() => jest.useFakeTimers());
+  afterEach(() => jest.useRealTimers());
+
+  it('S1: checks once, when the remembered session has reported no change for the quiet period', () => {
+    const { scheduler, checks } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    session.invalidations.invalidate('/repo/rush.json');
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    session.invalidations.invalidate('/repo/common/config/rush/command-line.json');
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    expect(checks).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checks).toHaveBeenCalledTimes(1);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).toHaveBeenCalledTimes(1);
+  });
+
+  it("S2: keeps the command line with the daemon's environment, and nothing else of the request", () => {
+    const { scheduler } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    const envelope: IDaemonRequestEnvelope = createEnvelope({ invocationKind: 'rush' });
+    scheduler.remember(session, envelope);
+    expect(scheduler.hint?.session).toBe(session);
+    expect(scheduler.hint?.envelope).toStrictEqual({
+      requestId: '',
+      argv: ['build', '--to', 'b'],
+      commandName: 'build',
+      commandOrigin: 'built-in',
+      cwd: '/repo/b',
+      invocationKind: 'rush',
+      environment: DAEMON_ENVIRONMENT,
+      terminal: { isTTY: false, supportsColor: false }
+    });
+    expect(scheduler.hint?.envelope.argv).not.toBe(envelope.argv);
+    scheduler.remember(session, createEnvelope());
+    expect(scheduler.hint?.envelope).not.toHaveProperty('invocationKind');
+  });
+
+  it('S3: keeps nothing unless the workspace turns the setting on, or after it closes', () => {
+    const { scheduler, checks } = createScheduler();
+    const on: IWorkspaceSession = createSession();
+    scheduler.remember(on, createEnvelope());
+    const off: IWorkspaceSession = createSession(false);
+    scheduler.remember(off, createEnvelope());
+    expect(scheduler.hint).toBeUndefined();
+    on.invalidations.invalidate('/repo/rush.json');
+    off.invalidations.invalidate('/repo/rush.json');
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    scheduler.remember(on, createEnvelope());
+    on.invalidations.invalidate('/repo/rush.json');
+    scheduler.close();
+    scheduler.remember(on, createEnvelope());
+    expect(scheduler.hint).toBeUndefined();
+    on.invalidations.invalidate('/repo/rush.json');
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+  });
+
+  it('S4: waits twice as long for each check while the lock is held, up to 60 s, and logs once per wait', () => {
+    const { scheduler, checks, logs } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    const waits: number[] = [];
+    for (let i: number = 0; i < 8; i++) {
+      const calls: number = checks.mock.calls.length;
+      scheduler.retry();
+      let waitedMs: number = 0;
+      // Gives up after 2 minutes, so that a check that never comes fails this test instead of hanging it.
+      while (checks.mock.calls.length === calls && waitedMs < 120_000) {
+        jest.advanceTimersByTime(1000);
+        waitedMs += 1000;
+      }
+      waits.push(waitedMs);
+    }
+    expect(waits).toEqual([2000, 4000, 8000, 16_000, 32_000, 60_000, 60_000, 60_000]);
+    expect(logs).toEqual([BUSY_LOG]);
+
+    const check: IPreparationCheck = { session, sequence: 0, boundSession: session, forceReload: false };
+    for (const endWait of [() => scheduler.markChecked(check), () => scheduler.markPrepared()]) {
+      endWait();
+      const calls: number = checks.mock.calls.length;
+      scheduler.retry();
+      jest.advanceTimersByTime(1999);
+      expect(checks).toHaveBeenCalledTimes(calls);
+      jest.advanceTimersByTime(1);
+      expect(checks).toHaveBeenCalledTimes(calls + 1);
+    }
+    expect(logs).toEqual([BUSY_LOG, BUSY_LOG, BUSY_LOG]);
+  });
+
+  it('S5: arms a check that was due while the daemon was busy once it is idle', () => {
+    const { scheduler, checks } = createScheduler();
+    scheduler.remember(createSession(), createEnvelope());
+    scheduler.resume(true);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    scheduler.defer();
+    scheduler.resume(false);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+    scheduler.resume(true);
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    expect(checks).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checks).toHaveBeenCalledTimes(1);
+    scheduler.resume(true);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).toHaveBeenCalledTimes(1);
+  });
+
+  it('S6: checks a new session for a change that its watcher reported after its capture', () => {
+    const { scheduler, checks } = createScheduler();
+    const quiet: IWorkspaceSession = createSession();
+    scheduler.remember(quiet, createEnvelope(), quiet.invalidations.getSnapshot().sequence);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+
+    const changed: IWorkspaceSession = createSession();
+    const capturedSequence: number = changed.invalidations.getSnapshot().sequence;
+    changed.invalidations.invalidate('/repo/rush.json');
+    scheduler.remember(changed, createEnvelope(), capturedSequence);
+    jest.advanceTimersByTime(BACKGROUND_PREPARE_QUIET_MS - 1);
+    expect(checks).not.toHaveBeenCalled();
+    jest.advanceTimersByTime(1);
+    expect(checks).toHaveBeenCalledTimes(1);
+
+    // The same session again: its changes since the subscription were already due.
+    scheduler.remember(changed, createEnvelope(), capturedSequence);
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).toHaveBeenCalledTimes(1);
+  });
+
+  it('S7: records the state in which a check found nothing to do, until the session changes', () => {
+    const { scheduler } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    const other: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    const check: IPreparationCheck = { session, sequence: 3, boundSession: session, forceReload: false };
+    expect(scheduler.isChecked(check)).toBe(false);
+    scheduler.markChecked(check);
+    expect(scheduler.isChecked({ ...check })).toBe(true);
+    for (const changed of [
+      { session: other },
+      { sequence: 4 },
+      { boundSession: other },
+      { boundSession: undefined },
+      { forceReload: true }
+    ]) {
+      expect(scheduler.isChecked({ ...check, ...changed })).toBe(false);
+    }
+    scheduler.remember(session, createEnvelope({ argv: ['build'] }));
+    expect(scheduler.isChecked(check)).toBe(true);
+    scheduler.remember(other, createEnvelope());
+    expect(scheduler.isChecked(check)).toBe(false);
+  });
+
+  it('S8: forgets the command line, its pending check and its subscription', () => {
+    const { scheduler, checks } = createScheduler();
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    session.invalidations.invalidate('/repo/rush.json');
+    scheduler.forget();
+    expect(scheduler.hint).toBeUndefined();
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    session.invalidations.invalidate('/repo/rush.json');
+    scheduler.defer();
+    scheduler.resume(true);
+    scheduler.retry();
+    jest.advanceTimersByTime(10 * BACKGROUND_PREPARE_QUIET_MS);
+    expect(checks).not.toHaveBeenCalled();
+  });
+
+  it('S9: logs a check that fails', async () => {
+    const { scheduler, logs } = createScheduler(async () => {
+      throw new Error('the capture failed');
+    });
+    const session: IWorkspaceSession = createSession();
+    scheduler.remember(session, createEnvelope());
+    session.invalidations.invalidate('/repo/rush.json');
+    await jest.advanceTimersByTimeAsync(BACKGROUND_PREPARE_QUIET_MS);
+    expect(logs).toEqual(['rushd: could not check whether to prepare in the background: the capture failed']);
+  });
+});
+
+describe(isSameCommandLine.name, () => {
+  it('S10: compares the command line and working directory, and nothing else', () => {
+    const envelope: IDaemonRequestEnvelope = createEnvelope();
+    expect(
+      isSameCommandLine(
+        envelope,
+        createEnvelope({
+          requestId: 'request-2',
+          environment: {},
+          terminal: { isTTY: false, supportsColor: false }
+        })
+      )
+    ).toBe(true);
+    for (const changed of [
+      { argv: ['build', '--to', 'c'] },
+      { argv: ['build', '--to'] },
+      { argv: ['build', '--to', 'b', '--verbose'] },
+      { cwd: '/repo' },
+      { commandName: 'rebuild' },
+      { commandOrigin: 'custom' as const },
+      { invocationKind: 'rush' as const }
+    ]) {
+      expect(isSameCommandLine(envelope, createEnvelope(changed))).toBe(false);
+      expect(isSameCommandLine(createEnvelope(changed), envelope)).toBe(false);
+    }
+  });
+});
+
+describe(getCaptureEnvironmentKey.name, () => {
+  it('S11: ignores variables that no workspace capture reads', () => {
+    const environment: Record<string, string> = { PATH: '/bin', MY_TOOL_FLAG: '1' };
+    const key: string = getCaptureEnvironmentKey(environment);
+    expect(getCaptureEnvironmentKey({ ...environment, TRACEPARENT: '00-trace-01' })).toBe(key);
+    expect(getCaptureEnvironmentKey({ ...environment, MY_TOOL_FLAG: '2' })).not.toBe(key);
+    expect(getCaptureEnvironmentKey({ ...environment, RUSH_PREVIEW_VERSION: '5.0.0' })).not.toBe(key);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
new file mode 100644
index 0000000000..e9d8d1ef0c
--- /dev/null
+++ b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
@@ -0,0 +1,577 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+jest.mock('@microsoft/rush-lib', () => {
+  const actual: typeof import('@microsoft/rush-lib') = jest.requireActual('@microsoft/rush-lib');
+  return {
+    ...actual,
+    captureWorkspaceInputFingerprintAsync: jest.fn(actual.captureWorkspaceInputFingerprintAsync)
+  };
+});
+
+import { spawn, type ChildProcess } from 'node:child_process';
+import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { setTimeout as delayAsync } from 'node:timers/promises';
+
+import * as rushLib from '@microsoft/rush-lib';
+import {
+  DaemonFrameType,
+  decodeDaemonControlMessage,
+  type DaemonControlMessage,
+  type IDaemonFrame,
+  type IDaemonRequestEnvelope
+} from '@rushstack/rush-daemon-protocol';
+
+import type { WorkspaceSession } from '../WorkspaceSession';
+import { DaemonGraphTestFixture, withScriptDeadline } from './DaemonGraphTestFixture';
+import {
+  createDeferred,
+  type DaemonRequestWireClient,
+  type IDeferred,
+  type ITerminalExchange
+} from './DaemonRequestWireTestUtilities';
+
+jest.setTimeout(60_000);
+
+const BUILD_B: string[] = ['build', '--to', 'b', '--parallelism', '3'];
+const BUILD_B_DESCRIPTION: string = '"rush build --to b --parallelism 3" in the background';
+const BUSY_LOG: string =
+  "rushd: another Rush process holds this repository's lock; the daemon prepares in the background " +
+  'once that process releases it';
+/** Longer than any wait in these tests, so that only the preparation's own progress ends it. */
+const WAIT_TIMEOUT_MS: number = 40_000;
+// A script such as a dev server, which runs until it is stopped.
+const SERVE_A: string = withScriptDeadline(
+  "const fs=require('node:fs');fs.appendFileSync('../runs.txt','serve\\n');" +
+    "const wait=()=>fs.existsSync('../common/temp/release.flag')?console.log('stopped'):setTimeout(wait,20);" +
+    'wait();'
+);
+
+const workspaceCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
+  jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
+
+async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
+  const deadline: number = Date.now() + 30_000;
+  while (!predicate()) {
+    if (Date.now() > deadline) throw new Error(`Timed out waiting for ${description}.`);
+    await delayAsync(20);
+  }
+}
+
+function expectSuccess(exchange: ITerminalExchange): void {
+  expect(exchange.terminal).toMatchObject({ kind: 'requestResult', payload: { exitCode: 0 } });
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function prepared(preparation: number): RegExp {
+  return new RegExp(
+    `^rushd: prepared ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-${preparation}\\) in \\d+ ms$`
+  );
+}
+
+function stopped(preparation: number, reason: string): RegExp {
+  return new RegExp(
+    `^rushd: stopped preparing ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-${preparation}\\): ` +
+      `${reason}$`
+  );
+}
+
+/** The daemon's log lines about background preparations. */
+function backgroundLogs(fixture: DaemonGraphTestFixture): string[] {
+  return fixture.logs.filter((message: string) => message.includes('in the background'));
+}
+
+async function waitForLogAsync(fixture: DaemonGraphTestFixture, pattern: RegExp): Promise<void> {
+  await waitForAsync(
+    () => fixture.logs.some((message: string) => pattern.test(message)),
+    `the daemon to log ${pattern}`
+  );
+}
+
+/**
+ * Projects a and b have the build of every fixture. Project a's `quick` script appends `quick` to runs.txt and exits;
+ * its `serve` script runs until the test writes common/temp/release.flag.
+ */
+function createFixtureAsync(
+  backgroundPrepare: boolean = true,
+  configure?: (fixture: DaemonGraphTestFixture) => void
+): Promise<DaemonGraphTestFixture> {
+  return DaemonGraphTestFixture.createAsync((created) => {
+    created.servesRushx = true;
+    const rushJson: Record<string, unknown> = readRushJson(created);
+    created.write(
+      'rush.json',
+      JSON.stringify({ ...rushJson, daemon: { warmMemoryBudgetMB: 100_000, backgroundPrepare } })
+    );
+    created.write(
+      'a/package.json',
+      JSON.stringify({
+        name: 'a',
+        version: '1.0.0',
+        dependencies: {},
+        scripts: { '_phase:compile': 'node build.cjs', quick: 'node quick.cjs', serve: 'node serve.cjs' }
+      })
+    );
+    created.write('a/quick.cjs', "require('node:fs').appendFileSync('../runs.txt','quick\\n');");
+    created.write('a/serve.cjs', SERVE_A);
+    configure?.(created);
+  });
+}
+
+function readRushJson(fixture: DaemonGraphTestFixture): Record<string, unknown> {
+  return JSON.parse(fs.readFileSync(path.join(fixture.folder, 'rush.json'), 'utf8'));
+}
+
+let rushJsonChanges: number = 0;
+
+/** Changes rush.json, which the daemon watches, so that the next build reloads the workspace graph. */
+function changeRushJson(fixture: DaemonGraphTestFixture, changes: Record<string, unknown> = {}): void {
+  fixture.write(
+    'rush.json',
+    JSON.stringify({ ...readRushJson(fixture), projectFolderMaxDepth: 2 + ++rushJsonChanges, ...changes })
+  );
+}
+
+let commandLineChanges: number = 0;
+
+/** Adds a global command to command-line.json, which the daemon watches, so that the next build reloads the graph. */
+function changeCommandLineJson(fixture: DaemonGraphTestFixture): void {
+  const filename: string = path.join(fixture.folder, 'common/config/rush/command-line.json');
+  const commandLine: { commands: unknown[] } = JSON.parse(fs.readFileSync(filename, 'utf8'));
+  commandLine.commands.push({
+    commandKind: 'global',
+    name: `hello-${++commandLineChanges}`,
+    summary: 'Says hello.',
+    shellCommand: 'node -e ""'
+  });
+  fs.writeFileSync(filename, JSON.stringify(commandLine));
+}
+
+function getScriptEnvelope(fixture: DaemonGraphTestFixture): Partial<IDaemonRequestEnvelope> {
+  return { commandOrigin: 'custom', invocationKind: 'rushx', cwd: path.join(fixture.folder, 'a') };
+}
+
+interface IHold {
+  readonly reached: Promise<void>;
+  release(): void;
+}
+
+/** Holds the next time that the current generation quiesces its warm set, as a reload does first. */
+function holdQuiesce(fixture: DaemonGraphTestFixture): IHold {
+  const session: WorkspaceSession = fixture.session;
+  const quiesceAsync: () => Promise<void> = session.quiesceWarmSetAsync.bind(session);
+  const reached: IDeferred<void> = createDeferred<void>();
+  const released: IDeferred<void> = createDeferred<void>();
+  jest.spyOn(session, 'quiesceWarmSetAsync').mockImplementationOnce(async () => {
+    reached.resolve();
+    await released.promise;
+    await quiesceAsync();
+  });
+  return { reached: reached.promise, release: () => released.resolve() };
+}
+
+/** Holds the next workspace session that the daemon creates, before it loads it. */
+function holdSessionCreation(fixture: DaemonGraphTestFixture): IHold {
+  const reached: IDeferred<void> = createDeferred<void>();
+  const released: IDeferred<void> = createDeferred<void>();
+  fixture.beforeCreateSessionAsync = async () => {
+    fixture.beforeCreateSessionAsync = undefined;
+    reached.resolve();
+    await released.promise;
+  };
+  return { reached: reached.promise, release: () => released.resolve() };
+}
+
+interface ILockHolder {
+  releaseAsync(): Promise<void>;
+}
+
+/** Holds native Rush's repository lock in another process, as `rush install` would, until it is released. */
+async function holdRepositoryLockAsync(fixture: DaemonGraphTestFixture): Promise<ILockHolder> {
+  const script: string = [
+    `const { LockFile } = require(${JSON.stringify(require.resolve('@rushstack/node-core-library'))});`,
+    `const lock = LockFile.tryAcquire(${JSON.stringify(path.join(fixture.folder, 'common/temp'))}, 'rush');`,
+    "process.stdout.write(lock ? 'held' : 'busy');",
+    'process.stdin.resume();',
+    "process.stdin.on('end', () => { lock?.release(); process.exit(0); });"
+  ].join('\n');
+  const child: ChildProcess = spawn(process.execPath, ['-e', script], { stdio: ['pipe', 'pipe', 'inherit'] });
+  const releaseAsync = async (): Promise<void> => {
+    if (child.exitCode !== null || child.signalCode !== null) return;
+    const closed: Promise<unknown[]> = once(child, 'close');
+    child.stdin!.end();
+    await closed;
+  };
+  try {
+    const [output] = await once(child.stdout!, 'data');
+    expect(String(output)).toBe('held');
+  } catch (error) {
+    await releaseAsync();
+    throw error;
+  }
+  return { releaseAsync };
+}
+
+interface IStreamedRequest {
+  readonly exchange: Promise<ITerminalExchange>;
+  /** Whether the daemon has reported a queue position for the request. */
+  readonly queued: () => boolean;
+  readonly settled: () => boolean;
+}
+
+/** Starts a request, recording whether it waits in a queue. */
+async function startRequestAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides: Partial<IDaemonRequestEnvelope> = {}
+): Promise<IStreamedRequest> {
+  const client: DaemonRequestWireClient = await fixture.connectAsync();
+  const payload: IDaemonRequestEnvelope = fixture.envelope(argv, {
+    admission: { waitTimeoutMs: WAIT_TIMEOUT_MS },
+    ...overrides
+  });
+  await client.sendControlAsync({ kind: 'requestStart', payload });
+  let queued: boolean = false;
+  let settled: boolean = false;
+  const readAsync = async (): Promise<ITerminalExchange> => {
+    const frames: IDaemonFrame[] = [];
+    try {
+      for (;;) {
+        const frame: IDaemonFrame = await client.readFrameAsync();
+        frames.push(frame);
+        if (frame.kind !== DaemonFrameType.controlJson) continue;
+        const message: DaemonControlMessage = decodeDaemonControlMessage(frame.payload);
+        if (message.kind === 'queuePosition') queued = true;
+        if (
+          (message.kind === 'requestResult' || message.kind === 'requestRejected') &&
+          message.payload.requestId === payload.requestId
+        ) {
+          return { frames, terminal: message };
+        }
+      }
+    } finally {
+      settled = true;
+      await client.closeAsync();
+    }
+  };
+  const exchange: Promise<ITerminalExchange> = readAsync();
+  // A failed expectation leaves the exchange unread until the fixture closes the connection.
+  exchange.catch(() => undefined);
+  return { exchange, queued: () => queued, settled: () => settled };
+}
+
+/**
+ * Holds the next background preparation before it quiesces anything, sends a request while it is held, and releases
+ * it once the request waits behind it.
+ */
+async function sendDuringPreparationAsync(
+  fixture: DaemonGraphTestFixture,
+  argv: string[],
+  overrides?: Partial<IDaemonRequestEnvelope>,
+  change: (changed: DaemonGraphTestFixture) => void = changeRushJson
+): Promise<ITerminalExchange> {
+  const loading: IHold = holdQuiesce(fixture);
+  try {
+    change(fixture);
+    await loading.reached;
+    const request: IStreamedRequest = await startRequestAsync(fixture, argv, overrides);
+    await waitForAsync(
+      () => request.settled() || request.queued(),
+      `"${argv.join(' ')}" to wait behind the preparation`
+    );
+    expect(request.settled()).toBe(false);
+    loading.release();
+    return await request.exchange;
+  } finally {
+    // A failed expectation must not leave the preparation held, or disposing the fixture would wait for it.
+    loading.release();
+  }
+}
+
+describe('background preparation', () => {
+  let fixture: DaemonGraphTestFixture | undefined;
+
+  afterEach(async () => {
+    jest.restoreAllMocks();
+    const disposed: DaemonGraphTestFixture | undefined = fixture;
+    fixture = undefined;
+    await disposed?.[Symbol.asyncDispose]();
+  });
+
+  it('A1: prepares the next engine of the last build once its inputs change, and the build then reuses it', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    const runs: string[] = fixture.runs();
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(1));
+    expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(prepared(1))]);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.runs()).toEqual(runs);
+
+    // It keeps up with a later change too, with no request in between.
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(2));
+    expect(fixture.host.workspaceGeneration).toBe(generation + 2);
+    expect(engines).toHaveBeenCalledTimes(2);
+
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).toHaveBeenCalledTimes(2);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 2);
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(prepared(1)),
+      expect.stringMatching(prepared(2))
+    ]);
+  });
+
+  it('A2: serves a build of the same command line on the engine that it is preparing', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    expectSuccess(await sendDuringPreparationAsync(fixture, BUILD_B));
+    expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(prepared(1))]);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A3a: stops for a rushx script, and prepares again once the daemon is idle', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+
+    // A served rushx script never runs on a loaded rush.json that changed since, so this changes command-line.json.
+    expectSuccess(
+      await sendDuringPreparationAsync(fixture, ['quick'], getScriptEnvelope(fixture), changeCommandLineJson)
+    );
+    expect(fixture.runs().filter((line: string) => line === 'quick')).toHaveLength(1);
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(stopped(1, 'request graph-\\d+ needs the workspace'))
+    ]);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+
+    await waitForLogAsync(fixture, prepared(2));
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A3b: stops for a graph request, and prepares again once the daemon is idle', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+
+    expectSuccess(await sendDuringPreparationAsync(fixture, ['daemon', 'graph', 'status']));
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(stopped(1, 'request graph-\\d+ needs the workspace'))
+    ]);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+
+    await waitForLogAsync(fixture, prepared(2));
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A3c: stops for a build of another command line, which then loads the workspace itself', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+
+    expectSuccess(await sendDuringPreparationAsync(fixture, ['build', '--to', 'a', '--parallelism', '3']));
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(stopped(1, 'request graph-\\d+ needs the workspace'))
+    ]);
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+    expect(fixture.host.workspaceGeneration).toBe(generation + 1);
+  });
+
+  it('A4: waits while another Rush process holds the repository lock, and logs that once', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const holder: ILockHolder = await holdRepositoryLockAsync(fixture);
+    try {
+      const quiesce: jest.SpyInstance = jest.spyOn(fixture.session, 'quiesceWarmSetAsync');
+      changeRushJson(fixture);
+      await waitForAsync(() => fixture!.logs.includes(BUSY_LOG), 'the preparation to find the lock held');
+      // The next check, 2 s later, finds it held too.
+      await delayAsync(3000);
+      expect(backgroundLogs(fixture)).toEqual([BUSY_LOG]);
+      expect(quiesce).not.toHaveBeenCalled();
+    } finally {
+      await holder.releaseAsync();
+    }
+    await waitForLogAsync(fixture, prepared(1));
+    expect(backgroundLogs(fixture)).toEqual([BUSY_LOG, expect.stringMatching(prepared(1))]);
+  });
+
+  it('A5: does not prepare for a change that restarts the daemon', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    const quiesce: jest.SpyInstance = jest.spyOn(fixture.session, 'quiesceWarmSetAsync');
+    workspaceCaptureMock.mockClear();
+
+    fixture.write(
+      'common/config/rush/npm-shrinkwrap.json',
+      '{"lockfileVersion":3,"packages":{},"requires":true}'
+    );
+    await waitForAsync(() => workspaceCaptureMock.mock.calls.length > 0, 'the daemon to check the change');
+    await Promise.allSettled(workspaceCaptureMock.mock.results.map((result) => result.value));
+    await delayAsync(500);
+    expect(quiesce).not.toHaveBeenCalled();
+    expect(backgroundLogs(fixture)).toEqual([]);
+    expect(fixture.host.workspaceGeneration).toBe(generation);
+  });
+
+  it('A6: does nothing unless rush.json turns it on', async () => {
+    fixture = await createFixtureAsync(false);
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    workspaceCaptureMock.mockClear();
+
+    changeRushJson(fixture);
+    await delayAsync(4000);
+    expect(workspaceCaptureMock).not.toHaveBeenCalled();
+    expect(backgroundLogs(fixture)).toEqual([]);
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
+  });
+
+  it('A7: prepares again when the inputs change while it loads', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const loading: IHold = holdSessionCreation(fixture);
+    try {
+      changeRushJson(fixture);
+      await loading.reached;
+      changeRushJson(fixture);
+    } finally {
+      loading.release();
+    }
+    await waitForLogAsync(fixture, prepared(2));
+    expect(backgroundLogs(fixture)).toEqual([
+      expect.stringMatching(
+        stopped(1, 'Workspace changes require the reusable engine and session to be recreated\\.')
+      ),
+      expect.stringMatching(prepared(2))
+    ]);
+
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).not.toHaveBeenCalled();
+  });
+
+  it('A8: stops preparing after a failure until a phased command is served again, and never runs event hooks', async () => {
+    fixture = await createFixtureAsync(true, (created) => {
+      created.write('hook.cjs', "require('node:fs').writeFileSync(__dirname + '/hook-marker.txt', '');");
+    });
+    expectSuccess(await fixture.runAsync(BUILD_B));
+
+    changeRushJson(fixture, { eventHooks: { preRushBuild: ['node hook.cjs'] } });
+    const failed: RegExp = new RegExp(
+      `^rushd: could not prepare ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-1\\): ` +
+        '.*Build event-hook scripts require --no-daemon'
+    );
+    await waitForLogAsync(fixture, failed);
+    workspaceCaptureMock.mockClear();
+    changeRushJson(fixture);
+    await delayAsync(4000);
+    expect(workspaceCaptureMock).not.toHaveBeenCalled();
+    expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(failed)]);
+    expect(fs.existsSync(path.join(fixture.folder, 'hook-marker.txt'))).toBe(false);
+  });
+
+  it('A9: waits until no rushx script runs', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const serving: Promise<ITerminalExchange> = fixture.runAsync(['serve'], getScriptEnvelope(fixture));
+    await Promise.race([
+      waitForAsync(() => fixture!.runs().includes('serve'), 'the script to start'),
+      serving.then((exchange: ITerminalExchange) => {
+        throw new Error(`The script ended before it ran: ${JSON.stringify(exchange.terminal)}`);
+      })
+    ]);
+    const quiesce: jest.SpyInstance = jest.spyOn(fixture.session, 'quiesceWarmSetAsync');
+    workspaceCaptureMock.mockClear();
+
+    try {
+      changeRushJson(fixture);
+      await delayAsync(5000);
+      expect(workspaceCaptureMock).not.toHaveBeenCalled();
+      expect(quiesce).not.toHaveBeenCalled();
+      expect(backgroundLogs(fixture)).toEqual([]);
+    } finally {
+      fixture.write('common/temp/release.flag', '');
+    }
+    expectSuccess(await serving);
+    await waitForLogAsync(fixture, prepared(1));
+  });
+
+  it('A10: builds an input change made after the preparation, on the engine that it prepared', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const runs: string[] = fixture.runs();
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(1));
+    fixture.write('a/input.txt', 'two');
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.runs()).toEqual([...runs, 'a', 'b']);
+  });
+
+  it('A11: builds an input change made while the preparation runs, after its capture', async () => {
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const runs: string[] = fixture.runs();
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+
+    const loading: IHold = holdQuiesce(fixture);
+    try {
+      changeRushJson(fixture);
+      await loading.reached;
+      fixture.write('a/input.txt', 'two');
+    } finally {
+      loading.release();
+    }
+    await waitForLogAsync(fixture, prepared(1));
+    expect(fixture.runs()).toEqual(runs);
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).toHaveBeenCalledTimes(1);
+    expect(fixture.runs()).toEqual([...runs, 'a', 'b']);
+  });
+
+  it('E1: prepares with the environment of the daemon, and not of the client whose build it prepares again', async () => {
+    const traceParent: string = '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01';
+    fixture = await createFixtureAsync();
+    const traced: Partial<IDaemonRequestEnvelope> = {
+      environment: { ...fixture.environment, TRACEPARENT: traceParent }
+    };
+    expectSuccess(await fixture.runAsync(BUILD_B, traced));
+    const parses: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine, 'parseAsync');
+
+    changeRushJson(fixture);
+    await waitForLogAsync(fixture, prepared(1));
+    expect(parses).toHaveBeenCalled();
+    for (const [options] of parses.mock.calls as [rushLib.IParsePhasedCommandOptions][]) {
+      expect(options.environment?.TRACEPARENT).not.toBe(traceParent);
+    }
+
+    const engines: jest.SpyInstance = jest.spyOn(rushLib.PhasedCommandEngine.prototype, 'createEngineAsync');
+    expectSuccess(await fixture.runAsync(BUILD_B, traced));
+    expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reuse);
+    expect(engines).not.toHaveBeenCalled();
+  });
+});
diff --git a/libraries/rush-lib/src/api/DaemonConfiguration.ts b/libraries/rush-lib/src/api/DaemonConfiguration.ts
index ac8d63799d..28d2afd678 100644
--- a/libraries/rush-lib/src/api/DaemonConfiguration.ts
+++ b/libraries/rush-lib/src/api/DaemonConfiguration.ts
@@ -44,6 +44,13 @@ export interface IDaemonConfigurationJson {
    * written when it stops. Defaults to false.
    */
   readonly deferCacheWrites?: boolean;
+  /**
+   * Lets an idle daemon load the next workspace graph and create its engine once the workspace inputs change in a way
+   * that the next request would otherwise reload for, so that the next request with the same command line as the last
+   * one starts on a bound engine. It never runs an operation. A request that it cannot serve stops it. Experimental.
+   * Defaults to false.
+   */
+  readonly backgroundPrepare?: boolean;
   /** Maximum admission queue wait in seconds. Defaults to 30. */
   readonly queueTimeoutSeconds?: number;
   /**
@@ -89,6 +96,7 @@ const defaults: Required<IDaemonConfigurationJson> = {
   warmWorkers: false,
   joinRunningBatch: false,
   deferCacheWrites: false,
+  backgroundPrepare: false,
   queueTimeoutSeconds: 30,
   warmIdleTimeoutSeconds: 300,
   warmMemoryBudgetMB: 512,
@@ -110,6 +118,7 @@ export const daemonEnvironmentVariables: Readonly<Record<keyof IDaemonConfigurat
     warmWorkers: 'RUSH_DAEMON_WARM_WORKERS',
     joinRunningBatch: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
     deferCacheWrites: 'RUSH_DAEMON_DEFER_CACHE_WRITES',
+    backgroundPrepare: 'RUSH_DAEMON_BACKGROUND_PREPARE',
     queueTimeoutSeconds: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
     warmIdleTimeoutSeconds: 'RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS',
     warmMemoryBudgetMB: 'RUSH_DAEMON_WARM_MEMORY_BUDGET_MB',
@@ -157,6 +166,7 @@ export function resolveDaemonConfiguration(
     warmWorkers: booleanOption('warmWorkers', json, environment),
     joinRunningBatch: booleanOption('joinRunningBatch', json, environment),
     deferCacheWrites: booleanOption('deferCacheWrites', json, environment),
+    backgroundPrepare: booleanOption('backgroundPrepare', json, environment),
     autoWarmByTelemetry: booleanOption('autoWarmByTelemetry', json, environment),
     idleTimeoutSeconds: numberOption('idleTimeoutSeconds', json, environment),
     queueTimeoutSeconds: numberOption('queueTimeoutSeconds', json, environment),
@@ -208,7 +218,8 @@ function booleanOption(
     | 'incrementalBuilds'
     | 'warmWorkers'
     | 'joinRunningBatch'
-    | 'deferCacheWrites',
+    | 'deferCacheWrites'
+    | 'backgroundPrepare',
   json: IDaemonConfigurationJson,
   environment: Readonly<Record<string, string | undefined>>
 ): boolean {
diff --git a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
index 3a374e8916..8578b1d480 100644
--- a/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
+++ b/libraries/rush-lib/src/api/EnvironmentConfiguration.ts
@@ -298,6 +298,8 @@ export const EnvironmentVariableNames = {
   RUSH_DAEMON_JOIN_RUNNING_BATCH: 'RUSH_DAEMON_JOIN_RUNNING_BATCH',
   /** Lets daemon operations complete before their build cache entries are written. */
   RUSH_DAEMON_DEFER_CACHE_WRITES: 'RUSH_DAEMON_DEFER_CACHE_WRITES',
+  /** Lets an idle daemon load the next workspace graph and create its engine before the next request. */
+  RUSH_DAEMON_BACKGROUND_PREPARE: 'RUSH_DAEMON_BACKGROUND_PREPARE',
   /** Overrides the request admission queue timeout. */
   RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS: 'RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS',
   /** Overrides idle eviction in an attached daemon warm set. */
@@ -722,6 +724,7 @@ export class EnvironmentConfiguration {
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_WORKERS:
           case EnvironmentVariableNames.RUSH_DAEMON_JOIN_RUNNING_BATCH:
           case EnvironmentVariableNames.RUSH_DAEMON_DEFER_CACHE_WRITES:
+          case EnvironmentVariableNames.RUSH_DAEMON_BACKGROUND_PREPARE:
           case EnvironmentVariableNames.RUSH_DAEMON_QUEUE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_IDLE_TIMEOUT_SECONDS:
           case EnvironmentVariableNames.RUSH_DAEMON_WARM_MEMORY_BUDGET_MB:
diff --git a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
index ae27af62bd..347940d7b3 100644
--- a/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
+++ b/libraries/rush-lib/src/api/test/DaemonConfiguration.test.ts
@@ -15,6 +15,7 @@ describe('daemon configuration', () => {
       warmWorkers: false,
       joinRunningBatch: false,
       deferCacheWrites: false,
+      backgroundPrepare: false,
       idleTimeoutSeconds: 900
     });
     expect(
@@ -44,7 +45,9 @@ describe('daemon configuration', () => {
     { RUSH_DAEMON_WARM_WORKERS: 'true' },
     { RUSH_DAEMON_JOIN_RUNNING_BATCH: 'true' },
     { RUSH_DAEMON_JOIN_RUNNING_BATCH: '' },
-    { RUSH_DAEMON_DEFER_CACHE_WRITES: 'on' }
+    { RUSH_DAEMON_DEFER_CACHE_WRITES: 'on' },
+    { RUSH_DAEMON_BACKGROUND_PREPARE: 'true' },
+    { RUSH_DAEMON_BACKGROUND_PREPARE: '' }
   ])('rejects invalid overrides %j', (environment) => {
     expect(() => resolveDaemonConfiguration({}, environment)).toThrow();
   });
@@ -66,6 +69,7 @@ describe('daemon configuration', () => {
     { warmWorkers: 1 },
     { joinRunningBatch: 'true' },
     { deferCacheWrites: 'true' },
+    { backgroundPrepare: 1 },
     { compatiblePlugins: 'rush-example-plugin' },
     { compatiblePlugins: [''] },
     { compatiblePlugins: [' rush-example-plugin'] },
@@ -127,6 +131,17 @@ describe('daemon configuration', () => {
     );
   });
 
+  it('prepares the next engine in the background only if the environment or configuration turns it on', () => {
+    expect(resolveDaemonConfiguration({ backgroundPrepare: true }, {}).backgroundPrepare).toBe(true);
+    expect(
+      resolveDaemonConfiguration({ backgroundPrepare: true }, { RUSH_DAEMON_BACKGROUND_PREPARE: '0' })
+        .backgroundPrepare
+    ).toBe(false);
+    expect(resolveDaemonConfiguration({}, { RUSH_DAEMON_BACKGROUND_PREPARE: '1' }).backgroundPrepare).toBe(
+      true
+    );
+  });
+
   describe.each([
     ['compatiblePlugins', 'RUSH_DAEMON_COMPATIBLE_PLUGINS'],
     ['commandAgnosticPlugins', 'RUSH_DAEMON_COMMAND_AGNOSTIC_PLUGINS']
diff --git a/libraries/rush-lib/src/schemas/rush.schema.json b/libraries/rush-lib/src/schemas/rush.schema.json
index 1ad67bd9f2..6f1f16d836 100644
--- a/libraries/rush-lib/src/schemas/rush.schema.json
+++ b/libraries/rush-lib/src/schemas/rush.schema.json
@@ -297,6 +297,11 @@
           "default": false,
           "description": "Let an operation of a daemon build complete before its build cache entry is written. The daemon clones the operation's output files, on a file system that can clone files (such as Btrfs, XFS or APFS), and writes the entry from the clones in the background, so that the operations that depend on it and the command don't wait for the entry. An operation waits at most half a second for its clones. Slower clones finish in the background, and the entry is dropped if an output file changes before it is cloned. Otherwise, and in cobuilds, the entry is written before the operation completes, as in native Rush. An entry that fails to be written in the background doesn't change the operation's status, and the daemon drops the entries that it hasn't written when it stops. RUSH_DAEMON_DEFER_CACHE_WRITES overrides."
         },
+        "backgroundPrepare": {
+          "type": "boolean",
+          "default": false,
+          "description": "Let an idle daemon load the next workspace graph and create its engine once the workspace inputs change in a way that the next request would otherwise reload for, so that the next request with the same command line as the last one starts on a bound engine. It never runs an operation, and a request that it cannot serve stops it. Experimental. RUSH_DAEMON_BACKGROUND_PREPARE overrides."
+        },
         "queueTimeoutSeconds": {
           "type": "number",
           "minimum": 0,

From b201b2a27136419a6c546e874f41b5b2f57c0b0d Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:38 +0000
Subject: [PATCH 258/265] [rush-daemon] Count the capture's calls in
 BackgroundPrepare's tests

Swarm integration step 243; original commit fb7eaa0bbf (merge of swarm/r01-t117-p2-count at 49b2a1b5c6).
Refs: board 9212.
Scope: task 117 Part 2 follow-up: count the capture's calls in BackgroundPrepare's tests.

Brings F (branch swarm/r01-t117-p2-count). Second agent: r02 board 9865 (RESULT board 9863). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 2 of 9. Gate: ch01 GATE OK board 10189 (tree c3f57b7c24)

Commits folded into this step (1):
- 49b2a1b5c6 rush-daemon: Count the capture's calls in BackgroundPrepare's tests (board 9212)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../rush-daemon/src/test/BackgroundPrepare.test.ts   | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
index e9d8d1ef0c..d052390d67 100644
--- a/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
+++ b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
@@ -52,6 +52,12 @@ const SERVE_A: string = withScriptDeadline(
 const workspaceCaptureMock: jest.MockedFunction<typeof rushLib.captureWorkspaceInputFingerprintAsync> =
   jest.mocked(rushLib.captureWorkspaceInputFingerprintAsync);
 
+// The capture's options hold the whole process environment, and jest prints a mock's arguments when an assertion
+// about its calls fails. Tests count the calls instead, so that a failure prints only numbers.
+function captureCount(): number {
+  return workspaceCaptureMock.mock.calls.length;
+}
+
 async function waitForAsync(predicate: () => boolean, description: string): Promise<void> {
   const deadline: number = Date.now() + 30_000;
   while (!predicate()) {
@@ -439,7 +445,7 @@ describe('background preparation', () => {
 
     changeRushJson(fixture);
     await delayAsync(4000);
-    expect(workspaceCaptureMock).not.toHaveBeenCalled();
+    expect(captureCount()).toBe(0);
     expect(backgroundLogs(fixture)).toEqual([]);
     expectSuccess(await fixture.runAsync(BUILD_B));
     expect(fixture.host.workspaceStatus.lastReloadTier).toBe(rushLib.WorkspaceInputChangeTier.Reload);
@@ -485,7 +491,7 @@ describe('background preparation', () => {
     workspaceCaptureMock.mockClear();
     changeRushJson(fixture);
     await delayAsync(4000);
-    expect(workspaceCaptureMock).not.toHaveBeenCalled();
+    expect(captureCount()).toBe(0);
     expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(failed)]);
     expect(fs.existsSync(path.join(fixture.folder, 'hook-marker.txt'))).toBe(false);
   });
@@ -506,7 +512,7 @@ describe('background preparation', () => {
     try {
       changeRushJson(fixture);
       await delayAsync(5000);
-      expect(workspaceCaptureMock).not.toHaveBeenCalled();
+      expect(captureCount()).toBe(0);
       expect(quiesce).not.toHaveBeenCalled();
       expect(backgroundLogs(fixture)).toEqual([]);
     } finally {

From 581c8f14b387230a161100686a7ecd80c3c6d018 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:38 +0000
Subject: [PATCH 259/265] [rush-daemon] Test that a preparation failure before
 the reload stops preparing

Swarm integration step 244; original commit 66229fc83a (merge of swarm/r01-t359 at 99625a4eb6).
Refs: task 359.
Scope: task 359: a preparation failure before the reload stops preparing.

Brings T (branch swarm/r01-t359). Second agent: ch05 board 9916 (RESULT board 9915). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 3 of 9. Gate: ch01 GATE OK board 10189 (tree 65d1ae3729)

Commits folded into this step (1):
- 99625a4eb6 rush-daemon: Test that a preparation failure before the reload stops preparing (task 359)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...prepare-failure-test_2026-09-30-06-30.json | 11 +++++
 .../src/test/BackgroundPrepare.test.ts        | 41 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 common/changes/@rushstack/rush-daemon/t359-background-prepare-failure-test_2026-09-30-06-30.json

diff --git a/common/changes/@rushstack/rush-daemon/t359-background-prepare-failure-test_2026-09-30-06-30.json b/common/changes/@rushstack/rush-daemon/t359-background-prepare-failure-test_2026-09-30-06-30.json
new file mode 100644
index 0000000000..196f4c114d
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/t359-background-prepare-failure-test_2026-09-30-06-30.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Test that a background preparation that fails before it reloads the workspace graph stops the daemon from preparing again until it serves a phased command.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
index d052390d67..39c01a5b43 100644
--- a/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
+++ b/libraries/rush-daemon/src/test/BackgroundPrepare.test.ts
@@ -559,6 +559,47 @@ describe('background preparation', () => {
     expect(fixture.runs()).toEqual([...runs, 'a', 'b']);
   });
 
+  it('A12: stops preparing after a failure that leaves its session current, until a phased command is served again', async () => {
+    const captureAsync: typeof rushLib.captureWorkspaceInputFingerprintAsync =
+      jest.requireActual<typeof rushLib>('@microsoft/rush-lib').captureWorkspaceInputFingerprintAsync;
+    fixture = await createFixtureAsync();
+    expectSuccess(await fixture.runAsync(BUILD_B));
+    const generation: number = fixture.host.workspaceGeneration;
+    try {
+      // The check captures first. The preparation's own capture comes next, before the reload replaces the session.
+      workspaceCaptureMock
+        .mockImplementationOnce(captureAsync)
+        .mockRejectedValueOnce(new Error('The capture failed.'));
+      changeRushJson(fixture);
+      const failed: RegExp = new RegExp(
+        `^rushd: could not prepare ${escapeRegExp(BUILD_B_DESCRIPTION)} \\(background-prepare-1\\): ` +
+          'The capture failed\\.$'
+      );
+      await waitForLogAsync(fixture, failed);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      workspaceCaptureMock.mockClear();
+      changeRushJson(fixture);
+      await delayAsync(4000);
+      expect(captureCount()).toBe(0);
+      expect(backgroundLogs(fixture)).toEqual([expect.stringMatching(failed)]);
+      expect(fixture.host.workspaceGeneration).toBe(generation);
+
+      // Serving the build again turns it back on.
+      expectSuccess(await fixture.runAsync(BUILD_B));
+      changeRushJson(fixture);
+      await waitForLogAsync(fixture, prepared(2));
+      expect(backgroundLogs(fixture)).toEqual([
+        expect.stringMatching(failed),
+        expect.stringMatching(prepared(2))
+      ]);
+    } finally {
+      // A capture queued above that the daemon never made must not reach a later test.
+      workspaceCaptureMock.mockReset();
+      workspaceCaptureMock.mockImplementation(captureAsync);
+    }
+  });
+
   it('E1: prepares with the environment of the daemon, and not of the client whose build it prepares again', async () => {
     const traceParent: string = '00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01';
     fixture = await createFixtureAsync();

From b55d11a3509ae4f7ee3f0837c2376b3b68fe4859 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:38 +0000
Subject: [PATCH 260/265] [rush-daemon] Drop internal references from test
 names and comments

Swarm integration step 245; original commit 1faa9f9d1f (merge of swarm/r02-d551-pr-hygiene at a82c9c190f).
Scope: task 355, PR hygiene: drop internal references from test names and comments.

Brings 355 (branch swarm/r02-d551-pr-hygiene). Second agent: ch05 board 9628 (RESULT board 9627). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 4 of 9. Gate: ch01 GATE OK board 10189 (tree cfc98bc3b8)

Commits folded into this step (1):
- a82c9c190f Drop internal references from test names and comments

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 .../src/test/AgentProgressRenderer.test.ts            |  6 +++---
 .../src/test/OperationOutputExcerpt.test.ts           |  2 +-
 apps/rush-cli-client/src/test/launchClient.test.ts    |  2 +-
 .../rush/test-name-references_2026-09-30-07-55.json   | 11 +++++++++++
 .../test-name-references_2026-09-30-07-55.json        | 11 +++++++++++
 .../test-name-references_2026-09-30-07-55.json        | 11 +++++++++++
 .../rush-daemon/src/WorkspaceRequestLifecycle.ts      |  2 +-
 .../src/test/ProductionDaemonNativeLockWait.test.ts   |  2 +-
 .../src/test/ServedScriptNativeLockWait.test.ts       |  4 ++--
 .../src/test/WorkspaceServedScriptAdmission.test.ts   | 10 +++++-----
 .../rush-lib/src/api/test/PhasedCommandEngine.test.ts |  3 ++-
 11 files changed, 49 insertions(+), 15 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/test-name-references_2026-09-30-07-55.json
 create mode 100644 common/changes/@rushstack/rush-cli-client/test-name-references_2026-09-30-07-55.json
 create mode 100644 common/changes/@rushstack/rush-daemon/test-name-references_2026-09-30-07-55.json

diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index d20b253c1d..5976337f44 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -128,7 +128,7 @@ describe(AgentProgressRenderer.name, () => {
     expect(output).toEqual(['rush build: SUCCESS up to date (no operations needed) in 0.0s\n']);
   });
 
-  it('tells an empty selection apart from a request whose operations were all up to date (#634)', () => {
+  it('tells an empty selection apart from a request whose operations were all up to date', () => {
     const hot: ITestRenderer = createRenderer(false);
     // The daemon announces retained operations as silent and reports their retained results.
     hot.renderer.onEvent(registered('a (build)', true));
@@ -401,7 +401,7 @@ describe(AgentProgressRenderer.name, () => {
     expect(output).toEqual([`rush build: FAILURE in 0.0s · ${message}\n`]);
   });
 
-  it('keeps the legacy "daemon admission failed (<code>)" string in the summary line (#785)', () => {
+  it('keeps the legacy "daemon admission failed (<code>)" string in the summary line', () => {
     const timeout: ITestRenderer = createRenderer(false);
     const message: string =
       'The request was not admitted within 30000ms while waiting for workspace admission. ' +
@@ -1506,7 +1506,7 @@ describe(AgentProgressRenderer.name, () => {
       expect(output).toHaveLength(written);
     });
 
-    it('names a failed operation that wrote no output in a status line 1 s after it failed (#1792)', () => {
+    it('names a failed operation that wrote no output in a status line 1 s after it failed', () => {
       const { renderer, clock, lines } = createRenderer(false);
       renderer.start();
       renderer.onRequestSent();
diff --git a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
index fb4046c2ff..5312815bc7 100644
--- a/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
+++ b/apps/rush-cli-client/src/test/OperationOutputExcerpt.test.ts
@@ -242,7 +242,7 @@ describe(OperationOutputExcerpt.name, () => {
     expect(unlocated.getExcerpt(8)).toEqual(['src/a.ts(1,1): something unexpected', 'Build failed']);
   });
 
-  it('does not take a host and port for a source location (ch01 #1980)', () => {
+  it('does not take a host and port for a source location', () => {
     for (const error of [
       'npm ERR! connect ECONNREFUSED registry.example.com:443',
       'Error: request to https://pkgs.dev.azure.com:443/x failed'
diff --git a/apps/rush-cli-client/src/test/launchClient.test.ts b/apps/rush-cli-client/src/test/launchClient.test.ts
index 20b929be85..809c17c28e 100644
--- a/apps/rush-cli-client/src/test/launchClient.test.ts
+++ b/apps/rush-cli-client/src/test/launchClient.test.ts
@@ -1064,7 +1064,7 @@ describe('daemon client cancellation exit codes', () => {
     expect(isCancelledOutcome({ kind: 'fallback', reason: 'unsupported' }, false)).toBe(false);
   });
 
-  it('treats a request that a signal cancelled before engine initialization as cancelled (#711)', () => {
+  it('treats a request that a signal cancelled before engine initialization as cancelled', () => {
     // The daemon rejects a request that was cancelled while it prepared the workspace graph.
     const cancelledBeforeEngine: DaemonClientOutcome = {
       kind: 'rejected',
diff --git a/common/changes/@microsoft/rush/test-name-references_2026-09-30-07-55.json b/common/changes/@microsoft/rush/test-name-references_2026-09-30-07-55.json
new file mode 100644
index 0000000000..bba1834b76
--- /dev/null
+++ b/common/changes/@microsoft/rush/test-name-references_2026-09-30-07-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-cli-client/test-name-references_2026-09-30-07-55.json b/common/changes/@rushstack/rush-cli-client/test-name-references_2026-09-30-07-55.json
new file mode 100644
index 0000000000..690b855dd3
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/test-name-references_2026-09-30-07-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/test-name-references_2026-09-30-07-55.json b/common/changes/@rushstack/rush-daemon/test-name-references_2026-09-30-07-55.json
new file mode 100644
index 0000000000..166f004f7f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/test-name-references_2026-09-30-07-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
index d465395c2e..0934e751f4 100644
--- a/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
+++ b/libraries/rush-daemon/src/WorkspaceRequestLifecycle.ts
@@ -207,7 +207,7 @@ export class WorkspaceRequestLifecycle implements IDaemonRequestLifecycle {
   readonly #gate: RequestScheduler = new RequestScheduler();
   /**
    * A served rushx script needs its generation only to resolve, so once it starts it releases `#gate` and holds a
-   * shared lease here until it exits: a reload no longer waits for a dev server or watch script (#113). Whatever
+   * shared lease here until it exits: a reload no longer waits for a dev server or watch script. Whatever
    * would end the script with this process (a restart, a native mutation, disposal) waits for this lease after
    * taking `#gate` exclusively, when no other script can start.
    */
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
index 7fa2a7b352..35421bb5d6 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonNativeLockWait.test.ts
@@ -125,7 +125,7 @@ describe('native production daemon engine, while a native Rush action holds the
       await readNativeLockHolderAsync(fixture.client, 'loading');
 
       // Waiting for another Rush process is contention, not progress that pauses the followers' wait timeouts. The
-      // followers wait for that process too, and are told which it is (#308).
+      // followers wait for that process too, and are told which it is.
       behind = await DaemonRequestWireClient.connectAsync(fixture.host.paths.socketPath);
       await behind.handshakeAsync();
       await behind.sendControlAsync({
diff --git a/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
index 3e9b564945..bd2d4da5d6 100644
--- a/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
+++ b/libraries/rush-daemon/src/test/ServedScriptNativeLockWait.test.ts
@@ -287,7 +287,7 @@ describe('a served rushx script while a reload waits for another Rush process',
       const reload: IStreamedRequest = await startReloadAsync(fixture);
       await waitForLockWaitAsync(reload, holder);
 
-      // The script used to wait behind the reload until its own wait timeout ended, and never ran (#302).
+      // The script used to wait behind the reload until its own wait timeout ended, and never ran.
       expectSuccess(await fixture.runAsync(['quick'], getScriptEnvelope(fixture, 2000)));
       expect(countScriptRuns(fixture)).toBe(1);
       expect(reload.settled()).toBe(false);
@@ -471,7 +471,7 @@ describe('a served build that waits behind a reload that waits for another Rush
       await waitForLockWaitAsync(reload, holder);
       const nativeLockHolder: IDaemonNativeLockHolder = getExpectedHolder(holder);
 
-      // Its client used to be told only its position, and its timeout named only the reload (#308).
+      // Its client used to be told only its position, and its timeout named only the reload.
       const short: IStreamedRequest = await startRequestAsync(fixture, BUILD_A, {
         admission: { waitTimeoutMs: 2000 }
       });
diff --git a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
index 5cd1f44e61..2c6bb3a426 100644
--- a/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceServedScriptAdmission.test.ts
@@ -208,7 +208,7 @@ describe('workspace admission while a served rushx script runs', () => {
       const script: IServedScript = await serveAsync(fixture);
 
       changeProjectConfiguration(fixture);
-      // The reload used to wait for #gate until the script exited (#113).
+      // The reload used to wait for #gate until the script exited.
       expectSuccess(await fixture.runAsync(BUILD_A, { admission: { waitTimeoutMs: 3000 } }));
       expect(fixture.host.workspaceGeneration).toBeGreaterThan(generation);
       expect(fixture.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
@@ -280,7 +280,7 @@ describe('workspace admission while a served rushx script runs', () => {
           restartSettled = true;
         });
       await delayAsync(1000);
-      // The script keeps its restart ticket after it releases #gate, so the restart still drains it (#198).
+      // The script keeps its restart ticket after it releases #gate, so the restart still drains it.
       expect(restartSettled).toBe(false);
       expect(script.settled()).toBe(false);
       expect(fixture.host.workspaceStatus.lastReloadTier).not.toBe(WorkspaceInputChangeTier.Restart);
@@ -332,7 +332,7 @@ describe('workspace admission while a served rushx script runs', () => {
         () => late.positions.length > 0 || late.settled() || fixture.runs().includes('serve2-start'),
         'the later script to wait for the restart'
       );
-      // The later script used to start and keep the restart waiting until it exited (#96).
+      // The later script used to start and keep the restart waiting until it exited.
       expect(fixture.runs()).not.toContain('serve2-start');
       // It waits for the served script and the restart.
       expect(late.positions).toEqual([2]);
@@ -431,7 +431,7 @@ describe('a restart drain whose change is reverted', () => {
 
       const revertedAt: number = Date.now();
       revert();
-      // The build used to wait for the script to exit, which a dev server never does (#127).
+      // The build used to wait for the script to exit, which a dev server never does.
       expectSuccess(await build.exchange);
       expect(Date.now() - revertedAt).toBeLessThan(5000);
       expect(script.settled()).toBe(false);
@@ -614,7 +614,7 @@ describe('a restart drain whose change is reverted', () => {
       );
       inputCaptureMock.mockClear();
       await delayAsync(3000);
-      // Each waiting request used to capture its inputs once a second, 16 captures a second in all (#2239).
+      // Each waiting request used to capture its inputs once a second, 16 captures a second in all.
       const captures: number = inputCaptureMock.mock.calls.length;
       expect(captures).toBeGreaterThanOrEqual(2);
       expect(captures).toBeLessThanOrEqual(5);
diff --git a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
index 62f6a4facd..90c909a990 100644
--- a/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
+++ b/libraries/rush-lib/src/api/test/PhasedCommandEngine.test.ts
@@ -602,7 +602,8 @@ describe(PhasedCommandEngine.name, () => {
   });
 
   describe('command-agnostic declarations', () => {
-    // Initialized for every command, like swarm-dogfood's watch-skip plugin, which taps runAnyPhasedCommand.
+    // Initialized for every command, like a plugin that skips unchanged operations in watch mode,
+    // which taps runAnyPhasedCommand.
     const ANY_COMMAND_PLUGIN: IPluginFixture = {
       daemonCompatible: true,
       taps: { runAnyPhasedCommand: true }

From 44910f05beb23f91df2088f6f7eda6b6177b48f5 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:38 +0000
Subject: [PATCH 261/265] [rush-daemon] Keep rush-daemon test socket paths
 short however long TMPDIR is

Swarm integration step 246; original commit 5ab3a13dda (merge of swarm/r02-d551-t4 at d1b14ef3c3).
Scope: task 352, D55.1 T4: rush-daemon test socket paths stay short however long TMPDIR is.

Brings 352 (branch swarm/r02-d551-t4). Second agent: r01 board 9940 (RESULT board 9937). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 5 of 9. Gate: ch01 GATE OK board 10189 (tree 77ba7e3ebe)

Commits folded into this step (1):
- d1b14ef3c3 Keep rush-daemon test socket paths short however long TMPDIR is

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...t-socket-path-length_2026-09-30-07-55.json |  11 ++
 .../src/test/DaemonClosedOutput.test.ts       |   5 +-
 .../src/test/DaemonProcessExit.test.ts        |   7 +-
 .../src/test/DaemonShutdownProcess.test.ts    |   7 +-
 .../src/test/DaemonTestRuntimeBase.test.ts    | 165 ++++++++++++++++++
 .../src/test/DaemonTestRuntimeBase.ts         |  66 +++++++
 .../src/test/SuccessfulMutationFixture.ts     |  12 +-
 .../VersionSelectedDaemonLauncher.test.ts     |  21 ++-
 8 files changed, 276 insertions(+), 18 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/test-socket-path-length_2026-09-30-07-55.json
 create mode 100644 libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts
 create mode 100644 libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts

diff --git a/common/changes/@rushstack/rush-daemon/test-socket-path-length_2026-09-30-07-55.json b/common/changes/@rushstack/rush-daemon/test-socket-path-length_2026-09-30-07-55.json
new file mode 100644
index 0000000000..56e232113f
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/test-socket-path-length_2026-09-30-07-55.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Tests now give the daemons that they start runtime folders whose socket paths stay within the platform's limit however long TMPDIR is.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts b/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
index 0183a01d99..8f22e1c18a 100644
--- a/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonClosedOutput.test.ts
@@ -7,6 +7,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { setTimeout as delayAsync } from 'node:timers/promises';
 
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
 import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
 
 const RUSHD_PATH: string = path.join(__dirname, '..', 'start.js');
@@ -37,9 +38,8 @@ interface IRushd {
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-closed-output-'));
     repoRoot = path.join(folder, 'repo');
-    runtimeBase = path.join(folder, 'runtime');
+    runtimeBase = createDaemonTestRuntimeBase();
     createTemporaryRepo(repoRoot);
-    fs.mkdirSync(runtimeBase, { mode: 0o700 });
   });
 
   afterEach(async () => {
@@ -51,6 +51,7 @@ interface IRushd {
       await started.exited;
     }
     fs.rmSync(folder, { force: true, recursive: true });
+    fs.rmSync(runtimeBase, { force: true, recursive: true });
   });
 
   function startRushd(): IRushd {
diff --git a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
index 00741e1058..f4018208eb 100644
--- a/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonProcessExit.test.ts
@@ -10,6 +10,7 @@ import { setTimeout as delayAsync } from 'node:timers/promises';
 import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-transport';
 
 import { DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
 import type { LeftBehind, Ownership, Reporter } from './fixtures/LingeringDaemon';
 import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
 
@@ -47,17 +48,18 @@ function unlinkSocket(socketPath: string): void {
 
 (process.platform === 'win32' ? describe.skip : describe)('a daemon process after the daemon stops', () => {
   let folder: string;
+  let runtimeBase: string;
   let repoRoot: string;
   let controlFolder: string;
   let daemon: IFixtureDaemon | undefined;
 
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-process-exit-'));
+    runtimeBase = createDaemonTestRuntimeBase();
     repoRoot = path.join(folder, 'repo');
     controlFolder = path.join(folder, 'control');
     createTemporaryRepo(repoRoot);
     fs.mkdirSync(controlFolder);
-    fs.mkdirSync(path.join(folder, 'runtime'), { mode: 0o700 });
   });
 
   afterEach(async () => {
@@ -73,6 +75,7 @@ function unlinkSocket(socketPath: string): void {
       await startedDaemon.exited;
     }
     fs.rmSync(folder, { force: true, recursive: true });
+    fs.rmSync(runtimeBase, { force: true, recursive: true });
   });
 
   function startDaemon(leftBehind: LeftBehind, reporter: Reporter, ownership: Ownership): IFixtureDaemon {
@@ -82,7 +85,7 @@ function unlinkSocket(socketPath: string): void {
       {
         // Like a daemon that rush-client launches: the leader of its own process group.
         detached: true,
-        env: { ...process.env, RUSHD_RUNTIME_DIR: path.join(folder, 'runtime'), RUSH_TEMP_FOLDER: undefined },
+        env: { ...process.env, RUSHD_RUNTIME_DIR: runtimeBase, RUSH_TEMP_FOLDER: undefined },
         stdio: ['ignore', 'ignore', 'pipe']
       }
     );
diff --git a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
index abf19db9fc..ba5fd8e2c2 100644
--- a/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonShutdownProcess.test.ts
@@ -12,6 +12,7 @@ import { readDaemonLockfile, type IDaemonPaths } from '@rushstack/rush-daemon-tr
 
 import { DEFAULT_SHUTDOWN_DEADLINE_MS } from '../serveRushDaemon';
 import { createWireEnvelope, DaemonRequestWireClient } from './DaemonRequestWireTestUtilities';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
 import { createTemporaryRepo } from './TemporaryRepoWorkspaceSession';
 import {
   captureTestProcessIdentity,
@@ -46,6 +47,7 @@ interface IStuckRequest {
 // A daemon process whose request ignores its abort signal, as one that waits for another process's lock does.
 (process.platform === 'win32' ? describe.skip : describe)('a daemon process whose shutdown is stuck', () => {
   let folder: string;
+  let runtimeBase: string;
   let repoRoot: string;
   let commonTempFolder: string;
   let controlFolder: string;
@@ -54,11 +56,11 @@ interface IStuckRequest {
 
   beforeEach(() => {
     folder = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-stuck-shutdown-'));
+    runtimeBase = createDaemonTestRuntimeBase();
     repoRoot = path.join(folder, 'repo');
     controlFolder = path.join(folder, 'control');
     commonTempFolder = createTemporaryRepo(repoRoot);
     fs.mkdirSync(controlFolder);
-    fs.mkdirSync(path.join(folder, 'runtime'), { mode: 0o700 });
   });
 
   afterEach(async () => {
@@ -77,6 +79,7 @@ interface IStuckRequest {
       await startedDaemon.exited;
     }
     fs.rmSync(folder, { force: true, recursive: true });
+    fs.rmSync(runtimeBase, { force: true, recursive: true });
   });
 
   async function waitForJsonAsync<T>(stuckDaemon: IStuckDaemon, name: string): Promise<T> {
@@ -98,7 +101,7 @@ interface IStuckRequest {
       {
         // Like a daemon that rush-client launches: the leader of its own process group.
         detached: true,
-        env: { ...process.env, RUSHD_RUNTIME_DIR: path.join(folder, 'runtime'), RUSH_TEMP_FOLDER: undefined },
+        env: { ...process.env, RUSHD_RUNTIME_DIR: runtimeBase, RUSH_TEMP_FOLDER: undefined },
         stdio: ['ignore', 'ignore', 'pipe']
       }
     );
diff --git a/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts
new file mode 100644
index 0000000000..d3f75dc869
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.test.ts
@@ -0,0 +1,165 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  computeDaemonWorkspaceKey,
+  resolveDaemonPaths,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+import {
+  chooseTestRuntimeRoot,
+  createDaemonTestRuntimeBase,
+  getLongestTestSocketPath,
+  getMaxTestSocketPathBytes
+} from './DaemonTestRuntimeBase';
+
+const SOCKET_PLATFORMS: readonly NodeJS.Platform[] = ['linux', 'darwin', 'freebsd'];
+// Longer than any real temporary folder.
+const LONGEST_TMPDIR_LENGTH: number = 300;
+// As long as the temporary folder with which some of these tests used to fail.
+const TMPDIR_OF_27_BYTES: string = `/${'t'.repeat(26)}`;
+// Twenty two-byte characters: 21 characters, but 41 bytes, too long to keep on Linux.
+const TWO_BYTE_TMPDIR: string = `/${'é'.repeat(20)}`;
+// The shape of the temporary folder of a macOS user.
+const DARWIN_TMPDIR: string = '/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T';
+const PRIVATE_FOLDER_MODE: number = 0o700;
+const TEST_SOURCE_FOLDER: string = path.resolve(__dirname, '../../src/test');
+// The helper and this file name the variable to test the helper itself.
+const HELPER_FILES: ReadonlySet<string> = new Set([
+  'DaemonTestRuntimeBase.ts',
+  'DaemonTestRuntimeBase.test.ts'
+]);
+// The files whose tests start daemons, each with a runtime folder of its own.
+const FILES_THAT_START_DAEMONS: readonly string[] = [
+  'DaemonClosedOutput.test.ts',
+  'DaemonProcessExit.test.ts',
+  'DaemonShutdownProcess.test.ts',
+  'SuccessfulMutationFixture.ts',
+  'VersionSelectedDaemonLauncher.test.ts'
+];
+// The value in `RUSHD_RUNTIME_DIR: value`, `[DAEMON_RUNTIME_DIR_ENV_VAR]: value` or `.RUSHD_RUNTIME_DIR = value`.
+const RUNTIME_DIR_VALUE: RegExp =
+  /(?:\bRUSHD_RUNTIME_DIR\b|\[DAEMON_RUNTIME_DIR_ENV_VAR\])\s*(?::|=(?!=))\s*([^,;}\r\n]*)/g;
+const RUNTIME_BASE_REFERENCE: RegExp = /^(?:this\.)?runtimeBase$/;
+// A fixed path, which does not depend on TMPDIR.
+const FIXED_PATH: RegExp = /^'[^']*'$/;
+// The value in `runtimeBase = value` or `runtimeBase: string = value`.
+const RUNTIME_BASE_VALUE: RegExp = /\bruntimeBase(?:\s*:\s*string)?\s*=(?!=)\s*([^;\r\n]*)/g;
+
+function createTmpdir(bytes: number): string {
+  return `/${'t'.repeat(bytes - 1)}`;
+}
+
+function getValues(source: string, pattern: RegExp): string[] {
+  return Array.from(source.matchAll(pattern), (match: RegExpMatchArray) => match[1].trim());
+}
+
+function listTypeScriptFiles(folder: string): string[] {
+  return fs.readdirSync(folder, { withFileTypes: true }).flatMap((entry: fs.Dirent) => {
+    const entryPath: string = path.join(folder, entry.name);
+    if (entry.isDirectory()) return listTypeScriptFiles(entryPath);
+    return entry.name.endsWith('.ts') ? [entryPath] : [];
+  });
+}
+
+describe('runtime base folders for test daemons', () => {
+  it.each(SOCKET_PLATFORMS)(
+    'keep the longest socket path within the limit on %s, however long TMPDIR is',
+    (platform: NodeJS.Platform) => {
+      const maxBytes: number = getMaxTestSocketPathBytes(platform);
+      const tooLong: string[] = [];
+      for (let length: number = 1; length <= LONGEST_TMPDIR_LENGTH; length++) {
+        // One byte per character, and two.
+        for (const tmpdir of [createTmpdir(length), `/${'é'.repeat(length - 1)}`]) {
+          const root: string = chooseTestRuntimeRoot(tmpdir, platform);
+          const socketPath: string = getLongestTestSocketPath(root, platform);
+          if (Buffer.byteLength(socketPath) > maxBytes) tooLong.push(socketPath);
+        }
+      }
+      expect(tooLong).toEqual([]);
+    }
+  );
+
+  it('leaves one byte of sun_path for its terminating NUL', () => {
+    expect(getMaxTestSocketPathBytes('linux')).toBe(107);
+    expect(getMaxTestSocketPathBytes('darwin')).toBe(103);
+  });
+
+  it.each(SOCKET_PLATFORMS)('keeps a short temporary folder on %s', (platform: NodeJS.Platform) => {
+    expect(chooseTestRuntimeRoot(TMPDIR_OF_27_BYTES, platform)).toBe(TMPDIR_OF_27_BYTES);
+  });
+
+  it('uses /tmp instead of a temporary folder that is too long', () => {
+    expect(chooseTestRuntimeRoot(DARWIN_TMPDIR, 'darwin')).toBe('/tmp');
+    expect(chooseTestRuntimeRoot(createTmpdir(LONGEST_TMPDIR_LENGTH), 'linux')).toBe('/tmp');
+  });
+
+  it('counts bytes, not characters', () => {
+    expect(chooseTestRuntimeRoot(TWO_BYTE_TMPDIR, 'linux')).toBe('/tmp');
+  });
+
+  it('keeps any temporary folder on Windows, where daemons listen at named pipes', () => {
+    const tmpdir: string = `C:\\${'t'.repeat(LONGEST_TMPDIR_LENGTH)}`;
+    expect(chooseTestRuntimeRoot(tmpdir, 'win32')).toBe(tmpdir);
+  });
+
+  it('creates an empty private folder in which the socket path of a daemon stays within the limit', () => {
+    const base: string = createDaemonTestRuntimeBase();
+    try {
+      const root: string = path.dirname(base);
+      expect(root).toBe(chooseTestRuntimeRoot(path.resolve(os.tmpdir()), process.platform));
+      expect(fs.readdirSync(base)).toEqual([]);
+      // Windows has no POSIX file modes, and its daemons listen at named pipes.
+      if (process.platform === 'win32') return;
+      // The permission bits are the mode's last three octal digits.
+      expect(fs.statSync(base).mode % 0o1000).toBe(PRIVATE_FOLDER_MODE);
+      const uid: number | undefined = process.getuid?.();
+      const paths: IDaemonPaths = resolveDaemonPaths(
+        {
+          platform: process.platform,
+          env: { [DAEMON_RUNTIME_DIR_ENV_VAR]: base },
+          tmpdir: os.tmpdir(),
+          uid
+        },
+        computeDaemonWorkspaceKey({ canonicalRepoRoot: base, rushVersion: '0.0.0' })
+      );
+      expect(paths.runtimeDir).toBe(path.join(base, `rushd-${uid}`));
+      const bytes: number = Buffer.byteLength(paths.socketPath);
+      expect(bytes).toBeLessThanOrEqual(Buffer.byteLength(getLongestTestSocketPath(root, process.platform)));
+      expect(bytes).toBeLessThanOrEqual(getMaxTestSocketPathBytes(process.platform));
+    } finally {
+      fs.rmdirSync(base);
+    }
+  });
+
+  it('is where every test that starts a daemon puts its runtime folder', () => {
+    const filesWithBase: string[] = [];
+    const unguarded: string[] = [];
+    for (const file of listTypeScriptFiles(TEST_SOURCE_FOLDER)) {
+      const name: string = path.relative(TEST_SOURCE_FOLDER, file);
+      if (HELPER_FILES.has(name)) continue;
+      const source: string = fs.readFileSync(file, 'utf8');
+      const runtimeDirs: string[] = getValues(source, RUNTIME_DIR_VALUE);
+      for (const runtimeDir of runtimeDirs) {
+        if (!RUNTIME_BASE_REFERENCE.test(runtimeDir) && !FIXED_PATH.test(runtimeDir)) {
+          unguarded.push(`${name}: RUSHD_RUNTIME_DIR is ${runtimeDir}`);
+        }
+      }
+      if (!runtimeDirs.some((runtimeDir: string) => RUNTIME_BASE_REFERENCE.test(runtimeDir))) continue;
+      filesWithBase.push(name);
+      const bases: string[] = getValues(source, RUNTIME_BASE_VALUE);
+      if (bases.length === 0) unguarded.push(`${name}: runtimeBase is never set`);
+      for (const base of bases) {
+        if (base !== 'createDaemonTestRuntimeBase()') unguarded.push(`${name}: runtimeBase is ${base}`);
+      }
+    }
+    expect(filesWithBase).toEqual(expect.arrayContaining(FILES_THAT_START_DAEMONS));
+    expect(unguarded).toEqual([]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts
new file mode 100644
index 0000000000..5ec7b7604f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/DaemonTestRuntimeBase.ts
@@ -0,0 +1,66 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+  DAEMON_RUNTIME_DIR_ENV_VAR,
+  computeDaemonWorkspaceKey,
+  resolveDaemonPaths,
+  type IDaemonPaths
+} from '@rushstack/rush-daemon-transport';
+
+// fs.mkdtempSync appends six characters to this prefix.
+const BASE_PREFIX: string = 'rdt-';
+const MKDTEMP_SUFFIX: string = 'XXXXXX';
+// The largest 32-bit user ID: no user ID has more digits.
+const WIDEST_UID: number = 0xffffffff;
+// Where the product keeps its runtime folders when RUSHD_RUNTIME_DIR is not set.
+const SHARED_POSIX_TEMP_DIR: string = '/tmp';
+// The size of sockaddr_un.sun_path.
+const LINUX_SUN_PATH_BYTES: number = 108;
+const OTHER_SUN_PATH_BYTES: number = 104;
+
+/**
+ * The longest socket path, in bytes, that a test daemon may get on `platform`: the size of `sun_path` less
+ * its terminating NUL.
+ */
+export function getMaxTestSocketPathBytes(platform: NodeJS.Platform): number {
+  return (platform === 'linux' ? LINUX_SUN_PATH_BYTES : OTHER_SUN_PATH_BYTES) - 1;
+}
+
+/**
+ * The longest socket path that a daemon can get in a folder that {@link createDaemonTestRuntimeBase} creates
+ * in `root`: the one for the widest user ID.
+ */
+export function getLongestTestSocketPath(root: string, platform: NodeJS.Platform): string {
+  const base: string = path.posix.join(root, `${BASE_PREFIX}${MKDTEMP_SUFFIX}`);
+  const paths: IDaemonPaths = resolveDaemonPaths(
+    { platform, env: { [DAEMON_RUNTIME_DIR_ENV_VAR]: base }, tmpdir: root, uid: WIDEST_UID },
+    computeDaemonWorkspaceKey({ canonicalRepoRoot: root, rushVersion: '0.0.0' })
+  );
+  return paths.socketPath;
+}
+
+/**
+ * The folder in which {@link createDaemonTestRuntimeBase} creates its folders: `tmpdir` if the longest
+ * socket path in it is within the limit, and otherwise `/tmp`, where the product keeps its runtime folders
+ * by default.
+ * Windows daemons listen at named pipes, whose names do not depend on any folder.
+ */
+export function chooseTestRuntimeRoot(tmpdir: string, platform: NodeJS.Platform): string {
+  if (platform === 'win32') return tmpdir;
+  const longestBytes: number = Buffer.byteLength(getLongestTestSocketPath(tmpdir, platform));
+  return longestBytes <= getMaxTestSocketPathBytes(platform) ? tmpdir : SHARED_POSIX_TEMP_DIR;
+}
+
+/**
+ * Creates an empty private folder for a test to pass to its daemons as `RUSHD_RUNTIME_DIR`, so that their
+ * socket paths stay within the limit however long `TMPDIR` is. The caller deletes it.
+ */
+export function createDaemonTestRuntimeBase(): string {
+  const root: string = chooseTestRuntimeRoot(path.resolve(os.tmpdir()), process.platform);
+  return fs.mkdtempSync(path.join(root, BASE_PREFIX));
+}
diff --git a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
index eb273476cf..76e77f0e11 100644
--- a/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
+++ b/libraries/rush-daemon/src/test/SuccessfulMutationFixture.ts
@@ -23,6 +23,7 @@ import {
 } from '@rushstack/rush-daemon-transport';
 
 import { createDeferred, type IDeferred } from './DaemonRequestWireTestUtilities';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
 import { stopSuccessorAsync } from './WorkspaceLifecycleTestProcess';
 import { removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
@@ -82,6 +83,7 @@ export class MutationGate implements AsyncDisposable {
 /** Real offline PNPM installation plus standalone native daemon processes, owned entirely by one test. */
 export class SuccessfulMutationFixture implements AsyncDisposable {
   public readonly folder: string = fs.mkdtempSync(path.join(os.tmpdir(), 'rushd-successful-mutation-'));
+  public readonly runtimeBase: string = createDaemonTestRuntimeBase();
   public readonly repoRoot: string = path.join(this.folder, 'repo');
   public readonly controlFolder: string = path.join(this.folder, 'control');
   public readonly environment: Readonly<Record<string, string>>;
@@ -97,14 +99,13 @@ export class SuccessfulMutationFixture implements AsyncDisposable {
     const home: string = path.join(this.folder, 'home');
     fs.mkdirSync(home, { recursive: true });
     fs.mkdirSync(this.controlFolder, { recursive: true });
-    fs.mkdirSync(path.join(this.folder, 'runtime'), { recursive: true, mode: 0o700 });
     fs.writeFileSync(path.join(home, '.npmrc'), '');
     fs.writeFileSync(path.join(home, 'global.npmrc'), '');
     const environment: NodeJS.ProcessEnv = {
       ...process.env,
       HOME: home,
       USERPROFILE: home,
-      RUSHD_RUNTIME_DIR: path.join(this.folder, 'runtime'),
+      RUSHD_RUNTIME_DIR: this.runtimeBase,
       RUSH_GLOBAL_FOLDER: path.join(this.folder, 'rush-global'),
       RUSH_PNPM_STORE_PATH: path.join(this.folder, 'store'),
       RUSH_TEMP_FOLDER: undefined,
@@ -453,12 +454,15 @@ if (fs.existsSync(controlFile)) {
         }
       }
     } finally {
-      if (errors.length === 0) await removeTestFolderAsync(this.folder, true);
+      if (errors.length === 0) {
+        await removeTestFolderAsync(this.folder, true);
+        await removeTestFolderAsync(this.runtimeBase, true);
+      }
     }
     if (errors.length > 0) {
       throw new AggregateError(
         errors,
-        `Failed to clean up native mutation fixtures; retained ${this.folder}.`
+        `Failed to clean up native mutation fixtures; retained ${this.folder} and ${this.runtimeBase}.`
       );
     }
   }
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 6fde0beb32..2dcad746da 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -29,17 +29,19 @@ import {
   type IDaemonLauncherContext,
   type ISelectDaemonLauncherOptions
 } from '../VersionSelectedDaemonLauncher';
+import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
 import { isTestProcessRunning, removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 describe('version-selected daemon launcher', () => {
   let repoRoot: string;
+  let runtimeBase: string;
   let context: IDaemonLauncherContext;
   let preserveFixture: boolean;
 
   beforeEach(() => {
     preserveFixture = false;
     repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'daemon-selection-'));
-    fs.mkdirSync(path.join(repoRoot, 'runtime'));
+    runtimeBase = createDaemonTestRuntimeBase();
     fs.writeFileSync(
       path.join(repoRoot, 'rush.json'),
       JSON.stringify({
@@ -60,17 +62,20 @@ describe('version-selected daemon launcher', () => {
         RUSH_GLOBAL_FOLDER: path.join(repoRoot, 'global'),
         RUSH_PREVIEW_VERSION: undefined,
         NPM_CONFIG_CACHE: path.join(repoRoot, 'npm-cache'),
-        RUSHD_RUNTIME_DIR: path.join(repoRoot, 'runtime'),
-        XDG_RUNTIME_DIR: path.join(repoRoot, 'runtime'),
-        TMPDIR: path.join(repoRoot, 'runtime'),
-        TMP: path.join(repoRoot, 'runtime'),
-        TEMP: path.join(repoRoot, 'runtime')
+        RUSHD_RUNTIME_DIR: runtimeBase,
+        XDG_RUNTIME_DIR: runtimeBase,
+        TMPDIR: runtimeBase,
+        TMP: runtimeBase,
+        TEMP: runtimeBase
       }
     };
   });
 
   afterEach(async () => {
-    if (!preserveFixture) await removeTestFolderAsync(repoRoot);
+    if (!preserveFixture) {
+      await removeTestFolderAsync(repoRoot);
+      await removeTestFolderAsync(runtimeBase);
+    }
   });
 
   async function stopDaemonAsync(client: DaemonClient, paths: IDaemonPaths): Promise<void> {
@@ -190,7 +195,7 @@ describe('version-selected daemon launcher', () => {
         {
           platform: process.platform,
           env: context.environment,
-          tmpdir: path.join(repoRoot, 'runtime'),
+          tmpdir: runtimeBase,
           uid: process.getuid?.()
         },
         computeDaemonWorkspaceKey({

From d23ccd5a719b60fccda4806a5f765b67ca49d311 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:38 +0000
Subject: [PATCH 262/265] [rush-cli-client] Name `rush-client daemon status`
 when rushd has not responded

Swarm integration step 247; original commit b41e167dbc (merge of swarm/r04-t364 at 455b9b1940).
Scope: task 364: the silence line names `rush-client daemon status`.

Brings 364 (branch swarm/r04-t364). Second agent: t07 board 9930 (RESULT board 9929). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 6 of 9. Gate: ch01 GATE OK board 10189 (tree a9bde896df)

Commits folded into this step (1):
- 455b9b1940 [rush-cli-client] Name `rush-client daemon status` when rushd has not responded

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 apps/rush-cli-client/README.md                        |  3 ++-
 apps/rush-cli-client/src/daemonSilence.ts             |  7 ++++---
 .../src/test/AgentProgressRenderer.test.ts            |  8 ++++----
 apps/rush-cli-client/src/test/daemonSilence.test.ts   |  4 ++--
 .../src/test/daemonSilenceOutput.test.ts              |  5 +++--
 ...04-t364-silence-names-status_2026-09-30-08-15.json | 11 +++++++++++
 6 files changed, 26 insertions(+), 12 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-cli-client/swarm-r04-t364-silence-names-status_2026-09-30-08-15.json

diff --git a/apps/rush-cli-client/README.md b/apps/rush-cli-client/README.md
index 98b501ba77..ab9551ac87 100644
--- a/apps/rush-cli-client/README.md
+++ b/apps/rush-cli-client/README.md
@@ -478,7 +478,8 @@ While a command runs, the client checks that rushd still responds. Once rushd ha
 for 10 s, the client pings it. Once it has sent nothing for 30 s, not even the reply, for example
 because its process was stopped, the client says so at once and says what that means:
 `rush-client: rushd (PID <pid>) has not responded for 30s; its process may be stopped or
-overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.` When
+overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd
+responds; interrupt it (Ctrl+C) to stop waiting.` When
 rushd sends anything again, a second line says so: `rush-client: rushd (PID <pid>) responded again
 after 70s.` In agent mode, the progress phase says it; on a pipe both lines are written at once,
 and until rushd responds, the status lines say how long it has not responded instead of what runs.
diff --git a/apps/rush-cli-client/src/daemonSilence.ts b/apps/rush-cli-client/src/daemonSilence.ts
index 328daf54f7..d749c457f5 100644
--- a/apps/rush-cli-client/src/daemonSilence.ts
+++ b/apps/rush-cli-client/src/daemonSilence.ts
@@ -7,11 +7,12 @@
 import type { IDaemonClientLivenessOptions, IDaemonSilence } from '@rushstack/rush-client-core';
 
 /**
- * What a daemon that has not responded means, and what to do, to follow a semicolon. `rush-client daemon status`
- * would not help: it waits 5 s for the same daemon to get ready, and then says only that it did not.
+ * What a daemon that has not responded means, and what to do, to follow a semicolon. On Linux,
+ * `rush-client daemon status` waits 5 s for the daemon to get ready and then names its process's state, such as
+ * stopped (state T) or running (state R), with what to do. Elsewhere it cannot read that state.
  */
 export const DAEMON_SILENCE_ADVICE: string =
-  'its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting';
+  'its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting';
 
 function formatDaemon(pid: number | undefined): string {
   return pid === undefined ? 'rushd' : `rushd (PID ${pid})`;
diff --git a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
index 5976337f44..ae2442b1b6 100644
--- a/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
+++ b/apps/rush-cli-client/src/test/AgentProgressRenderer.test.ts
@@ -1689,7 +1689,7 @@ describe(AgentProgressRenderer.name, () => {
       expect(lines()).toEqual([
         'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
         'rush build 4/5 · 25.0s · running: e (build)',
-        'rush build 4/5 · 35.0s · rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
+        'rush build 4/5 · 35.0s · rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
         'rush build 4/5 · 60.0s · rushd (PID 12345) has not responded for 55s',
         'rush build 4/5 · 75.2s · rushd (PID 12345) responded again after 70s',
         'rush build 4/5 · 100.2s · running: e (build)'
@@ -1710,7 +1710,7 @@ describe(AgentProgressRenderer.name, () => {
       renderer.dispose();
       expect(lines()).toEqual([
         'rush build · 0.0s · sent to rushd; preparing the workspace graph (status at least every 25s)',
-        'rush build · 20.0s · rushd has not responded for 20s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
+        'rush build · 20.0s · rushd has not responded for 20s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting',
         'rush build · 22.0s · cancelling; waiting up to 5s for rushd to stop the request',
         'rush build · 47.0s · cancelling; waiting up to 5s for rushd to stop the request'
       ]);
@@ -1748,14 +1748,14 @@ describe(AgentProgressRenderer.name, () => {
   });
 
   it('shows on a TTY that rushd has not responded, with what to do, until it responds again (task 69)', () => {
-    const { renderer, output, clock } = createRenderer(true, 'build', 200);
+    const { renderer, output, clock } = createRenderer(true, 'build', 250);
     const firstRow = (text: string): string => text.replace(ANSI_ESCAPE, '').split('\n')[0];
     renderer.start();
     clock.ms = 35_000;
     renderer.onDaemonUnresponsive({ pid: 12345, silentForMs: 30_000 });
     expect(output).toHaveLength(2);
     expect(firstRow(output[1])).toMatch(
-      /^. rush build · 35\.0s · rushd \(PID 12345\) has not responded for 30s; its process may be stopped or overloaded\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
+      /^. rush build · 35\.0s · rushd \(PID 12345\) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
     );
     clock.ms = 75_200;
     renderer.onDaemonResponsive({ pid: 12345, silentForMs: 70_200 });
diff --git a/apps/rush-cli-client/src/test/daemonSilence.test.ts b/apps/rush-cli-client/src/test/daemonSilence.test.ts
index 34d8e1a85e..0491b40e39 100644
--- a/apps/rush-cli-client/src/test/daemonSilence.test.ts
+++ b/apps/rush-cli-client/src/test/daemonSilence.test.ts
@@ -24,7 +24,7 @@ describe(createDaemonLivenessOptions.name, () => {
     liveness.onUnresponsive({ pid: 12345, silentForMs: 30_999 });
     liveness.onResponsive?.({ pid: 12345, silentForMs: 70_200 });
     expect(written).toEqual([
-      'rush-client: rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
+      'rush-client: rushd (PID 12345) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
       'rush-client: rushd (PID 12345) responded again after 70s.\n'
     ]);
   });
@@ -34,7 +34,7 @@ describe(createDaemonLivenessOptions.name, () => {
     liveness.onUnresponsive({ pid: undefined, silentForMs: 30_000 });
     liveness.onResponsive?.({ pid: undefined, silentForMs: 31_000 });
     expect(written).toEqual([
-      'rushx-client: rushd has not responded for 30s; its process may be stopped or overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
+      'rushx-client: rushd has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n',
       'rushx-client: rushd responded again after 31s.\n'
     ]);
   });
diff --git a/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts b/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
index e02b0da004..a431a6279a 100644
--- a/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
+++ b/apps/rush-cli-client/src/test/daemonSilenceOutput.test.ts
@@ -27,7 +27,8 @@ const DAEMON_PID: number = 41;
 
 const UNRESPONSIVE: string =
   `rush-client: rushd (PID ${DAEMON_PID}) has not responded for 30s; its process may be stopped or ` +
-  'overloaded. This command goes on if rushd responds; interrupt it (Ctrl+C) to stop waiting.\n';
+  'overloaded; on Linux, "rush-client daemon status" says which. This command goes on if rushd responds; ' +
+  'interrupt it (Ctrl+C) to stop waiting.\n';
 const RESPONDED: string = `rush-client: rushd (PID ${DAEMON_PID}) responded again after 31s.\n`;
 
 describe('the lines about a daemon that stopped responding (task 266)', () => {
@@ -133,7 +134,7 @@ describe('the lines about a daemon that stopped responding (task 266)', () => {
     expect(output.join('').split('\n').slice(0, -1)).toEqual([
       expect.stringMatching(/^rush build · \d+\.\ds · sent to rushd; preparing the workspace graph /),
       expect.stringMatching(
-        /^rush build · \d+\.\ds · rushd \(PID 41\) has not responded for 30s; its process may be stopped or overloaded\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
+        /^rush build · \d+\.\ds · rushd \(PID 41\) has not responded for 30s; its process may be stopped or overloaded; on Linux, "rush-client daemon status" says which\. This command goes on if rushd responds; interrupt it \(Ctrl\+C\) to stop waiting$/
       ),
       expect.stringMatching(/^rush build · \d+\.\ds · rushd \(PID 41\) responded again after 31s$/),
       expect.stringMatching(/^rush build: SUCCESS/)
diff --git a/common/changes/@rushstack/rush-cli-client/swarm-r04-t364-silence-names-status_2026-09-30-08-15.json b/common/changes/@rushstack/rush-cli-client/swarm-r04-t364-silence-names-status_2026-09-30-08-15.json
new file mode 100644
index 0000000000..a7881e061b
--- /dev/null
+++ b/common/changes/@rushstack/rush-cli-client/swarm-r04-t364-silence-names-status_2026-09-30-08-15.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-cli-client",
+      "comment": "When rushd has not responded for 30 s, the line that says so now names `rush-client daemon status`, which on Linux tells a stopped daemon from an overloaded one.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/rush-cli-client",
+  "email": "selarkin@microsoft.com"
+}

From eea0048cdc38086ace78a2125d2f006fcbeb123e Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:38 +0000
Subject: [PATCH 263/265] [package-deps-hash] Hash the paths that "git
 hash-object" can't read

Swarm integration step 248; original commit 86204d0550 (merge of swarm/r06-d551-t3 at 298b23b0d2).
Scope: task 351, D55.1 T3: package-deps-hash hashes the paths that git hash-object can't read.

Brings 351 (branch swarm/r06-d551-t3). Second agent: t04 board 10037. Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 7 of 9. Gate: ch01 GATE OK board 10189 (tree 772d755384)

Commits folded into this step (1):
- 298b23b0d2 package-deps-hash: hash the paths that "git hash-object" can't read

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...r06-unhashable-paths_2026-09-30-06-07.json |  11 +
 .../package-deps-hash/src/RepoStateCache.ts   |  24 +-
 .../package-deps-hash/src/getRepoState.ts     | 122 +++++--
 .../src/test/UnhashablePaths.test.ts          | 309 ++++++++++++++++++
 .../src/test/getRepoState.test.ts             |  93 ++++--
 5 files changed, 501 insertions(+), 58 deletions(-)
 create mode 100644 common/changes/@rushstack/package-deps-hash/swarm-r06-unhashable-paths_2026-09-30-06-07.json
 create mode 100644 libraries/package-deps-hash/src/test/UnhashablePaths.test.ts

diff --git a/common/changes/@rushstack/package-deps-hash/swarm-r06-unhashable-paths_2026-09-30-06-07.json b/common/changes/@rushstack/package-deps-hash/swarm-r06-unhashable-paths_2026-09-30-06-07.json
new file mode 100644
index 0000000000..485dd85079
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/swarm-r06-unhashable-paths_2026-09-30-06-07.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Fix `getDetailedRepoStateAsync` and `RepoStateCache` for paths that `git hash-object` can't read. A path whose working tree column in `git status` is blank, such as a staged file that a sparse checkout leaves out or that the index marks \"assume unchanged\" or \"skip worktree\", now keeps the object in the index, and a staged symbolic link stays in `symlinks`. So a staged \"assume unchanged\" or \"skip worktree\" file that differs on disk now gets the object in the index, not the hash of the file on disk. A symbolic link that doesn't lead to a regular file, such as one whose target is missing, now gets the hash of its text instead of failing, or of waiting forever for a named pipe.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index 934e9884a5..94c78e8ae9 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -26,6 +26,7 @@ import {
   getDetailedRepoStateAsync,
   getGitLsFilesArgs,
   getGitStatusArgs,
+  type GitStatusKind,
   hashFilesAsync,
   type IDetailedRepoState,
   type IGitTreeState,
@@ -33,7 +34,8 @@ import {
   parseGitLsTree,
   parseGitStatus,
   spawnGitAsync,
-  STANDARD_GIT_OPTIONS
+  STANDARD_GIT_OPTIONS,
+  tryGetSymbolicLinkHashAsync
 } from './getRepoState';
 
 /**
@@ -354,7 +356,7 @@ export class RepoStateCache {
       throw new Error(`The copy of the Git index at "${privateIndex.path}" was modified by another process`);
     }
 
-    const locallyModified: Map<string, boolean> = parseGitStatus(statusOutput);
+    const locallyModified: Map<string, GitStatusKind> = parseGitStatus(statusOutput);
     const attributesFingerprint: string = this.#getFingerprint(
       getAttributesFilePaths(
         this.#rootDirectory,
@@ -645,7 +647,8 @@ export class RepoStateCache {
 
   /**
    * Hashes the files with `git hash-object`, except those whose stamps match the stamps they had when they were
-   * hashed before. The hashes are in the same order as the files.
+   * hashed before, and the symbolic links that it can't follow, which get the hashes of their text. The hashes are in
+   * the same order as the files.
    */
   async #hashFilesAsync(
     filePaths: ReadonlyArray<string>,
@@ -667,12 +670,27 @@ export class RepoStateCache {
         }
       })
     );
+    // The hashes of the symbolic links that "git hash-object" can't follow
+    const linkHashes: (string | undefined)[] = await Promise.all(
+      filePaths.map(async (filePath: string, i: number) =>
+        statsList[i]?.isSymbolicLink()
+          ? await tryGetSymbolicLinkHashAsync(path.resolve(this.#rootDirectory, filePath))
+          : undefined
+      )
+    );
 
     const filesToHash: string[] = [];
     const stampsToRecord: Map<string, string | undefined> = new Map();
     for (let i: number = 0; i < filePaths.length; i++) {
       const filePath: string = filePaths[i];
       const stats: fs.BigIntStats | undefined = statsList[i];
+      const linkHash: string | undefined = linkHashes[i];
+      if (linkHash !== undefined) {
+        hashes.set(filePath, linkHash);
+        this.#fileHashes.delete(filePath);
+        continue;
+      }
+
       // A symbolic link, or a folder, is hashed afresh each time. The hash of a file also depends on the attributes
       // files in the folders that contain it, including ignored ones, which "git status" doesn't list.
       let stamp: string | undefined;
diff --git a/libraries/package-deps-hash/src/getRepoState.ts b/libraries/package-deps-hash/src/getRepoState.ts
index 348a3ecf47..a17bd4633e 100644
--- a/libraries/package-deps-hash/src/getRepoState.ts
+++ b/libraries/package-deps-hash/src/getRepoState.ts
@@ -2,7 +2,10 @@
 // See LICENSE in the project root for license information.
 
 import type * as child_process from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { once } from 'node:events';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 import { Readable, pipeline } from 'node:stream';
 
 import { Executable, type IExecutableSpawnOptions } from '@rushstack/node-core-library/lib/Executable';
@@ -242,15 +245,26 @@ export function parseGitDiffIndex(output: string): Map<string, IFileDiffStatus>
   return result;
 }
 
+/**
+ * What `git status` reports about a path:
+ * - `deleted`: the path is deleted in the working tree, or deleted in the index and not modified in the working tree.
+ * - `indexOnly`: only the index differs from HEAD. Git uses the object in the index for the working tree, and
+ *   doesn't read the file if sparse checkout leaves it out or if the index marks it "assume unchanged" or
+ *   "skip worktree", so the file may not be on disk.
+ * - `workingTree`: the working tree differs from the index, or the path is untracked or unmerged.
+ * @internal
+ */
+export type GitStatusKind = 'deleted' | 'indexOnly' | 'workingTree';
+
 /**
  * Parses the output of `git status -z -u` to extract the set of files that have changed since HEAD.
  *
  * @param output - The raw output from Git
- * @returns a map of file path to if it exists
+ * @returns a map of file path to what `git status` reports about it
  * @internal
  */
-export function parseGitStatus(output: string): Map<string, boolean> {
-  const result: Map<string, boolean> = new Map();
+export function parseGitStatus(output: string): Map<string, GitStatusKind> {
+  const result: Map<string, GitStatusKind> = new Map();
 
   // Parse the output
   // With the -z modifier, paths are delimited by nulls
@@ -264,12 +278,18 @@ export function parseGitStatus(output: string): Map<string, boolean> {
     // We passed --no-renames above, so a rename will be a delete of the old location and an add at the new.
     // charAt(startOfLine) is the index status, charAt(startOfLine + 1) is the working tree status
     const workingTreeStatus: string = output.charAt(startOfLine + 1);
-    // Deleted in working tree, or not modified in working tree and deleted in index
-    const deleted: boolean =
-      workingTreeStatus === 'D' || (workingTreeStatus === ' ' && output.charAt(startOfLine) === 'D');
+    let kind: GitStatusKind;
+    if (workingTreeStatus === 'D' || (workingTreeStatus === ' ' && output.charAt(startOfLine) === 'D')) {
+      // Deleted in working tree, or not modified in working tree and deleted in index
+      kind = 'deleted';
+    } else if (workingTreeStatus === ' ') {
+      kind = 'indexOnly';
+    } else {
+      kind = 'workingTree';
+    }
 
     const filePath: string = output.slice(startOfLine + 3, eolIndex);
-    result.set(filePath, !deleted);
+    result.set(filePath, kind);
 
     startOfLine = eolIndex + 1;
     eolIndex = output.indexOf('\0', startOfLine);
@@ -455,6 +475,37 @@ export async function hashFilesAsync(
   return parseGitHashObject(hashObjectResult, hashPaths);
 }
 
+/**
+ * If the path is a symbolic link that doesn't lead to a regular file, returns the object that `git add` records for
+ * it: a blob of the text of the link. Otherwise returns `undefined`.
+ *
+ * @remarks
+ * `git hash-object` follows symbolic links. It fails if the target is missing, is a folder or is a loop of links, and
+ * it waits for a named pipe to be written. A symbolic link to a regular file is left to it.
+ * @param fullPath - The full path of the file
+ * @internal
+ */
+export async function tryGetSymbolicLinkHashAsync(fullPath: string): Promise<string | undefined> {
+  let linkText: Buffer;
+  try {
+    // The text may not be valid UTF-8
+    linkText = await fs.promises.readlink(fullPath, { encoding: 'buffer' });
+  } catch {
+    // Not a symbolic link. "git hash-object" reports any error.
+    return undefined;
+  }
+
+  try {
+    if ((await fs.promises.stat(fullPath)).isFile()) {
+      return undefined;
+    }
+  } catch {
+    // The target is missing, or can't be reached
+  }
+
+  return createHash('sha1').update(`blob ${linkText.length}\0`).update(linkText).digest('hex');
+}
+
 /**
  * The arguments of the `git ls-files` command that lists the files in the index in the format of `git ls-tree`.
  * @internal
@@ -510,18 +561,24 @@ export interface ILocallyModifiedFiles {
 
 /**
  * Splits the locally modified files that `git status` reports into those to hash and those to remove from the
- * state of the repository: the deleted files and the files that the index records as symbolic links.
+ * state of the repository: the deleted files and the files that the index records as symbolic links. A path whose
+ * working tree column is blank is in neither list, so that it keeps the object that the index records for it.
  * @internal
  */
 export function classifyLocallyModifiedFiles(
-  locallyModified: ReadonlyMap<string, boolean>,
+  locallyModified: ReadonlyMap<string, GitStatusKind>,
   symlinks: ReadonlyMap<string, string>
 ): ILocallyModifiedFiles {
   const filesToHash: string[] = [];
   const filesToRemove: string[] = [];
   const isWindows: boolean = process.platform === 'win32';
-  for (const [filePath, exists] of locallyModified) {
-    if (exists && !symlinks.has(filePath)) {
+  for (const [filePath, kind] of locallyModified) {
+    if (kind === 'indexOnly') {
+      // Git uses the object in the index, which the list of the index already has. The file may not be on disk.
+      continue;
+    }
+
+    if (kind === 'workingTree' && !symlinks.has(filePath)) {
       // Skip Windows reserved device names. `git hash-object` cannot open them and would abort
       // the entire repo-state computation. These are almost always stray artifacts (e.g. a `nul`
       // file produced by a misdirected shell redirect) rather than meaningful inputs.
@@ -567,6 +624,10 @@ export async function getRepoStateAsync(
 export interface IDetailedRepoState {
   /**
    * The Git file hashes for all files in the repository, including uncommitted changes.
+   *
+   * @remarks
+   * A symbolic link that the index doesn't record as one, such as an untracked link, has the hash of the regular file
+   * that it leads to. If it doesn't lead to a regular file, it has the hash of its text, which `git add` would record.
    */
   files: Map<string, string>;
   /**
@@ -602,17 +663,35 @@ export async function getDetailedRepoStateAsync(
     STANDARD_GIT_OPTIONS.concat(getGitLsFilesArgs(filterPath)),
     rootDirectory
   ).then(parseGitLsTree);
-  const locallyModifiedPromise: Promise<Map<string, boolean>> = spawnGitAsync(
+  const locallyModifiedPromise: Promise<Map<string, GitStatusKind>> = spawnGitAsync(
     gitPath,
     STANDARD_GIT_OPTIONS.concat(getGitStatusArgs(filterPath)),
     rootDirectory
   ).then(parseGitStatus);
 
+  // Every path to hash, in order, and the hashes of the symbolic links that "git hash-object" can't follow
+  const pathsToHash: string[] = [];
+  const symbolicLinkHashes: Map<string, string> = new Map();
+
+  async function* filterSymbolicLinksAsync(filePaths: ReadonlyArray<string>): AsyncIterableIterator<string> {
+    const linkHashes: (string | undefined)[] = await Promise.all(
+      filePaths.map((filePath: string) => tryGetSymbolicLinkHashAsync(path.resolve(rootDirectory, filePath)))
+    );
+    for (let i: number = 0; i < filePaths.length; i++) {
+      const filePath: string = filePaths[i];
+      const linkHash: string | undefined = linkHashes[i];
+      pathsToHash.push(filePath);
+      if (linkHash === undefined) {
+        yield filePath;
+      } else {
+        symbolicLinkHashes.set(filePath, linkHash);
+      }
+    }
+  }
+
   async function* getFilesToHash(): AsyncIterableIterator<string> {
     if (additionalRelativePathsToHash) {
-      for (const file of additionalRelativePathsToHash) {
-        yield file;
-      }
+      yield* filterSymbolicLinksAsync(additionalRelativePathsToHash);
     }
 
     const [{ files, symlinks }, locallyModified] = await Promise.all([statePromise, locallyModifiedPromise]);
@@ -623,7 +702,7 @@ export async function getDetailedRepoStateAsync(
       symlinks.delete(filePath);
     }
 
-    yield* filesToHash;
+    yield* filterSymbolicLinksAsync(filesToHash);
   }
 
   const hashObjectPromise: Promise<Iterable<[string, string]>> = hashFilesAsync(
@@ -640,9 +719,14 @@ export async function getDetailedRepoStateAsync(
     hashObjectPromise
   ]);
 
-  // The result of "git hash-object" will be a list of file hashes delimited by newlines
-  for (const [filePath, hash] of hashObjectResult) {
-    files.set(filePath, hash);
+  // The result of "git hash-object" will be a list of file hashes delimited by newlines. Set the hashes in the order
+  // of the paths, so that new paths are in the same order as in RepoStateCache.
+  const hashes: Map<string, string> = new Map(hashObjectResult);
+  for (const filePath of pathsToHash) {
+    const hash: string | undefined = symbolicLinkHashes.get(filePath) ?? hashes.get(filePath);
+    if (hash !== undefined) {
+      files.set(filePath, hash);
+    }
   }
 
   // Existence check for the .gitmodules file
diff --git a/libraries/package-deps-hash/src/test/UnhashablePaths.test.ts b/libraries/package-deps-hash/src/test/UnhashablePaths.test.ts
new file mode 100644
index 0000000000..76701a04a7
--- /dev/null
+++ b/libraries/package-deps-hash/src/test/UnhashablePaths.test.ts
@@ -0,0 +1,309 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import * as getRepoState from '../getRepoState';
+import type { IDetailedRepoState } from '../getRepoState';
+import { RepoStateCache } from '../RepoStateCache';
+
+// Each test makes its repository in the temp folder of the package
+const TEST_FOLDER_PATH: string = path.resolve(__dirname, '../../temp/test/UnhashablePaths');
+const PIPE_OPEN_INTERVAL_MS: number = 1000;
+
+const itUnlessWindows: jest.It = process.platform === 'win32' ? it.skip : it;
+const itOnLinux: jest.It = process.platform === 'linux' ? it : it.skip;
+
+function getGitEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { ...process.env };
+  delete environment.GIT_DIR;
+  delete environment.GIT_WORK_TREE;
+  delete environment.GIT_INDEX_FILE;
+  delete environment.GIT_OPTIONAL_LOCKS;
+  return environment;
+}
+
+interface IComparableState {
+  hasSubmodules: boolean;
+  hasUncommittedChanges: boolean;
+  files: [string, string][];
+  symlinks: [string, string][];
+}
+
+function toComparable(state: IDetailedRepoState): IComparableState {
+  return {
+    hasSubmodules: state.hasSubmodules,
+    hasUncommittedChanges: state.hasUncommittedChanges,
+    files: Array.from(state.files),
+    symlinks: Array.from(state.symlinks)
+  };
+}
+
+describe('paths that "git hash-object" cannot hash', () => {
+  let testCount: number = 0;
+  let testFolderPath: string;
+  let repoPath: string;
+
+  function runGit(...args: string[]): string {
+    return execFileSync('git', ['-c', 'core.fsmonitor=false', ...args], {
+      cwd: repoPath,
+      env: getGitEnvironment(),
+      encoding: 'utf8',
+      stdio: 'pipe'
+    });
+  }
+
+  function writeFile(relativePath: string, content: string): void {
+    const filePath: string = path.join(repoPath, relativePath);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+
+  function createSymbolicLink(target: string | Buffer, relativePath: string): void {
+    fs.symlinkSync(target, path.join(repoPath, relativePath));
+  }
+
+  function commit(): void {
+    runGit('add', '--all');
+    runGit('commit', '--quiet', '-m', 'Commit');
+  }
+
+  // The object that the index records for the path
+  function getStagedObject(relativePath: string): string {
+    return runGit('rev-parse', `:${relativePath}`).trim();
+  }
+
+  // The object that "git add" records for the path
+  function addAndGetStagedObject(relativePath: string): string {
+    runGit('add', '--force', '--', relativePath);
+    return getStagedObject(relativePath);
+  }
+
+  // Gets the state both without and with the cache, and checks that they are the same
+  async function getStateAsync(additionalRelativePathsToHash?: string[]): Promise<IDetailedRepoState> {
+    const state: IDetailedRepoState = await getRepoState.getDetailedRepoStateAsync(
+      repoPath,
+      additionalRelativePathsToHash
+    );
+    const cache: RepoStateCache = new RepoStateCache({
+      rootDirectory: repoPath,
+      temporaryFolderPath: testFolderPath
+    });
+    const uncachedSpy: jest.SpyInstance = jest.spyOn(getRepoState, 'getDetailedRepoStateAsync');
+    try {
+      const cachedState: IDetailedRepoState = await cache.getDetailedRepoStateAsync(
+        additionalRelativePathsToHash
+      );
+      // The cache used its copy of the index, rather than falling back to the state without the cache
+      expect(uncachedSpy).not.toHaveBeenCalled();
+      expect(toComparable(cachedState)).toEqual(toComparable(state));
+    } finally {
+      uncachedSpy.mockRestore();
+      cache.dispose();
+    }
+
+    return state;
+  }
+
+  async function expectStagedObjectsAsync(...relativePaths: string[]): Promise<void> {
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.hasUncommittedChanges).toBe(true);
+    for (const relativePath of relativePaths) {
+      expect(state.files.get(relativePath)).toEqual(getStagedObject(relativePath));
+      expect(state.symlinks.has(relativePath)).toBe(false);
+    }
+  }
+
+  async function expectLinkTextObjectAsync(
+    relativePath: string,
+    additionalRelativePathsToHash?: string[]
+  ): Promise<void> {
+    const state: IDetailedRepoState = await getStateAsync(additionalRelativePathsToHash);
+    expect(state.files.get(relativePath)).toEqual(addAndGetStagedObject(relativePath));
+    expect(state.symlinks.has(relativePath)).toBe(false);
+  }
+
+  beforeEach(() => {
+    testFolderPath = path.join(TEST_FOLDER_PATH, `${++testCount}`);
+    fs.rmSync(testFolderPath, { recursive: true, force: true });
+    fs.mkdirSync(path.join(testFolderPath, 'repo'), { recursive: true });
+    repoPath = fs.realpathSync(path.join(testFolderPath, 'repo'));
+    runGit('init', '--quiet');
+    runGit('config', 'user.name', 'Test');
+    runGit('config', 'user.email', 'test@example.com');
+    runGit('config', 'commit.gpgSign', 'false');
+    runGit('config', 'core.fsmonitor', 'false');
+    runGit('config', 'maintenance.auto', 'false');
+    writeFile('a.txt', 'a\n');
+    commit();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    fs.rmSync(testFolderPath, { recursive: true, force: true });
+  });
+
+  it('uses the staged object of a file that a sparse checkout leaves out of the working tree', async () => {
+    writeFile('docs/readme.md', 'committed\n');
+    commit();
+    writeFile('docs/readme.md', 'staged\n');
+    commit();
+    runGit('sparse-checkout', 'set', '--no-cone', '/*', '!/docs/');
+    runGit('reset', '--quiet', '--soft', 'HEAD~1');
+    expect(fs.existsSync(path.join(repoPath, 'docs/readme.md'))).toBe(false);
+
+    await expectStagedObjectsAsync('docs/readme.md');
+  });
+
+  it('uses the staged object of a deleted file that the index marks "assume unchanged"', async () => {
+    writeFile('a.txt', 'staged\n');
+    runGit('add', 'a.txt');
+    runGit('update-index', '--assume-unchanged', 'a.txt');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+
+    await expectStagedObjectsAsync('a.txt');
+  });
+
+  it('uses the staged object of a deleted file that the index marks "skip worktree"', async () => {
+    writeFile('a.txt', 'staged\n');
+    runGit('add', 'a.txt');
+    runGit('update-index', '--skip-worktree', 'a.txt');
+    fs.unlinkSync(path.join(repoPath, 'a.txt'));
+
+    await expectStagedObjectsAsync('a.txt');
+  });
+
+  it('uses the staged object of a staged file that is on disk', async () => {
+    writeFile('a.txt', 'staged\n');
+    writeFile('b.txt', 'added\n');
+    runGit('add', 'a.txt', 'b.txt');
+
+    await expectStagedObjectsAsync('a.txt', 'b.txt');
+  });
+
+  it('uses the staged object of an "assume unchanged" file that changed on disk after it was staged', async () => {
+    writeFile('a.txt', 'staged\n');
+    runGit('add', 'a.txt');
+    runGit('update-index', '--assume-unchanged', 'a.txt');
+    writeFile('a.txt', 'changed after it was staged\n');
+    expect(runGit('hash-object', '--', 'a.txt').trim()).not.toEqual(getStagedObject('a.txt'));
+
+    await expectStagedObjectsAsync('a.txt');
+  });
+
+  itUnlessWindows('keeps a staged symbolic link in symlinks, with its staged object', async () => {
+    createSymbolicLink('a.txt', 'link');
+    runGit('add', 'link');
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.symlinks.get('link')).toEqual(getStagedObject('link'));
+    expect(state.files.has('link')).toBe(false);
+  });
+
+  itUnlessWindows('hashes the text of an untracked symbolic link whose target is missing', async () => {
+    createSymbolicLink('missing.txt', 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itUnlessWindows('hashes the text of an untracked symbolic link to a folder', async () => {
+    writeFile('folder/b.txt', 'b\n');
+    commit();
+    createSymbolicLink('folder', 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itUnlessWindows(
+    'hashes the text of a symbolic link, whose target is missing, that replaced a tracked file',
+    async () => {
+      fs.unlinkSync(path.join(repoPath, 'a.txt'));
+      createSymbolicLink('missing.txt', 'a.txt');
+
+      await expectLinkTextObjectAsync('a.txt');
+    }
+  );
+
+  itUnlessWindows('hashes the text of a symbolic link that points to itself', async () => {
+    createSymbolicLink('link', 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itOnLinux('hashes the text of a symbolic link to a named pipe', async () => {
+    const pipePath: string = path.join(testFolderPath, 'pipe');
+    execFileSync('mkfifo', [pipePath]);
+    createSymbolicLink('../pipe', 'link');
+    // Reading the pipe waits for a writer. Open the pipe for writing from time to time, without waiting for a reader,
+    // so that a reader reads nothing instead of waiting forever.
+    const interval: NodeJS.Timeout = setInterval(() => {
+      try {
+        // eslint-disable-next-line no-bitwise
+        fs.closeSync(fs.openSync(pipePath, fs.constants.O_WRONLY | fs.constants.O_NONBLOCK));
+      } catch {
+        // Nothing is reading the pipe
+      }
+    }, PIPE_OPEN_INTERVAL_MS);
+    try {
+      await expectLinkTextObjectAsync('link');
+    } finally {
+      clearInterval(interval);
+    }
+  });
+
+  itOnLinux('hashes the bytes of a symbolic link whose text is not UTF-8', async () => {
+    createSymbolicLink(Buffer.concat([Buffer.from('missing-'), Buffer.from([0xff]), Buffer.from('.txt')]), 'link');
+
+    await expectLinkTextObjectAsync('link');
+  });
+
+  itUnlessWindows(
+    'hashes the text of an additional path that is a symbolic link whose target is missing',
+    async () => {
+      writeFile('.gitignore', 'ignored/\n');
+      commit();
+      fs.mkdirSync(path.join(repoPath, 'ignored'));
+      createSymbolicLink('missing.txt', 'ignored/link');
+
+      await expectLinkTextObjectAsync('ignored/link', ['ignored/link']);
+    }
+  );
+
+  itUnlessWindows('still hashes an untracked symbolic link to a file through to the file', async () => {
+    createSymbolicLink('a.txt', 'link');
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.files.get('link')).toEqual(getStagedObject('a.txt'));
+    expect(state.symlinks.has('link')).toBe(false);
+  });
+
+  itUnlessWindows('keeps the same order of paths in both implementations', async () => {
+    writeFile('.gitignore', 'ignored/\n');
+    commit();
+    createSymbolicLink('missing.txt', 'a-link');
+    writeFile('b.txt', 'b\n');
+    writeFile('ignored/y.txt', 'y\n');
+    createSymbolicLink('missing.txt', 'ignored/z-link');
+
+    const newPaths: string[] = ['ignored/z-link', 'ignored/y.txt', 'a-link', 'b.txt'];
+    const state: IDetailedRepoState = await getStateAsync(['ignored/z-link', 'ignored/y.txt']);
+    expect(Array.from(state.files.keys())).toEqual(['.gitignore', 'a.txt', ...newPaths]);
+    for (const newPath of newPaths) {
+      expect(state.files.get(newPath)).toEqual(addAndGetStagedObject(newPath));
+    }
+  });
+
+  itUnlessWindows('still drops a tracked symbolic link that changed', async () => {
+    createSymbolicLink('a.txt', 'link');
+    commit();
+    fs.unlinkSync(path.join(repoPath, 'link'));
+    createSymbolicLink('missing.txt', 'link');
+
+    const state: IDetailedRepoState = await getStateAsync();
+    expect(state.hasUncommittedChanges).toBe(true);
+    expect(state.files.has('link')).toBe(false);
+    expect(state.symlinks.has('link')).toBe(false);
+  });
+});
diff --git a/libraries/package-deps-hash/src/test/getRepoState.test.ts b/libraries/package-deps-hash/src/test/getRepoState.test.ts
index 227898b5c0..96cfec4358 100644
--- a/libraries/package-deps-hash/src/test/getRepoState.test.ts
+++ b/libraries/package-deps-hash/src/test/getRepoState.test.ts
@@ -3,6 +3,7 @@
 
 import {
   classifyLocallyModifiedFiles,
+  type GitStatusKind,
   isWindowsReservedPath,
   parseGitStatus,
   parseGitVersion
@@ -45,51 +46,55 @@ describe(parseGitVersion.name, () => {
 
 describe(parseGitStatus.name, () => {
   it('Finds index entries', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [`A  ${files[0]}`, `D  ${files[1]}`, `M  ${files[2]}`, ''].join('\0');
+    const input: string = [`A  A.ts`, `D  B.ts`, `M  C.ts`, `T  D.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(true);
-    expect(result.get(files[1])).toEqual(false);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'indexOnly'],
+      ['B.ts', 'deleted'],
+      ['C.ts', 'indexOnly'],
+      ['D.ts', 'indexOnly']
+    ]);
   });
 
   it('Finds working tree entries', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [` A ${files[0]}`, ` D ${files[1]}`, ` M ${files[2]}`, ''].join('\0');
+    const input: string = [` A A.ts`, ` D B.ts`, ` M C.ts`, ` T D.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(true);
-    expect(result.get(files[1])).toEqual(false);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'workingTree'],
+      ['B.ts', 'deleted'],
+      ['C.ts', 'workingTree'],
+      ['D.ts', 'workingTree']
+    ]);
   });
 
   it('Can handle untracked files', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [`?? ${files[0]}`, `?? ${files[1]}`, `?? ${files[2]}`, ''].join('\0');
+    const input: string = [`?? A.ts`, `?? B.ts`, `?? C.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(true);
-    expect(result.get(files[1])).toEqual(true);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'workingTree'],
+      ['B.ts', 'workingTree'],
+      ['C.ts', 'workingTree']
+    ]);
   });
 
   it('Can handle files modified in both index and working tree', () => {
-    const files: string[] = [`A.ts`, `B.ts`, `C.ts`];
-    const input: string = [`D  ${files[0]}`, `AD ${files[1]}`, `DA ${files[2]}`, ''].join('\0');
+    const input: string = [`D  A.ts`, `AD B.ts`, `DA C.ts`, `MM D.ts`, `UU E.ts`, ''].join('\0');
 
-    const result: Map<string, boolean> = parseGitStatus(input);
+    const result: Map<string, GitStatusKind> = parseGitStatus(input);
 
-    expect(result.size).toEqual(3);
-    expect(result.get(files[0])).toEqual(false);
-    expect(result.get(files[1])).toEqual(false);
-    expect(result.get(files[2])).toEqual(true);
+    expect(Array.from(result)).toEqual([
+      ['A.ts', 'deleted'],
+      ['B.ts', 'deleted'],
+      ['C.ts', 'workingTree'],
+      ['D.ts', 'workingTree'],
+      ['E.ts', 'workingTree']
+    ]);
   });
 });
 
@@ -126,17 +131,20 @@ describe(classifyLocallyModifiedFiles.name, () => {
   const platformDescriptor: PropertyDescriptor = Object.getOwnPropertyDescriptor(process, 'platform')!;
 
   // "nul" is a reserved name on Windows
-  const locallyModified: ReadonlyMap<string, boolean> = new Map([
-    ['modified.txt', true],
-    ['deleted.txt', false],
-    ['link', true],
-    ['deleted-link', false],
-    ['apps/nul', true],
-    ['apps/con.txt', false]
+  const locallyModified: ReadonlyMap<string, GitStatusKind> = new Map<string, GitStatusKind>([
+    ['modified.txt', 'workingTree'],
+    ['deleted.txt', 'deleted'],
+    ['link', 'workingTree'],
+    ['deleted-link', 'deleted'],
+    ['apps/nul', 'workingTree'],
+    ['apps/con.txt', 'deleted'],
+    ['staged.txt', 'indexOnly'],
+    ['staged-link', 'indexOnly']
   ]);
   const symlinks: ReadonlyMap<string, string> = new Map([
     ['link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391'],
-    ['deleted-link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391']
+    ['deleted-link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391'],
+    ['staged-link', 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391']
   ]);
 
   afterEach(() => {
@@ -158,4 +166,17 @@ describe(classifyLocallyModifiedFiles.name, () => {
       filesToRemove: ['deleted.txt', 'link', 'deleted-link', 'apps/con.txt']
     });
   });
+
+  it('neither hashes nor removes a path whose working tree column is blank', () => {
+    Object.defineProperty(process, 'platform', { ...platformDescriptor, value: 'linux' });
+    const { filesToHash, filesToRemove } = classifyLocallyModifiedFiles(
+      new Map<string, GitStatusKind>([
+        ['staged.txt', 'indexOnly'],
+        ['staged-link', 'indexOnly']
+      ]),
+      symlinks
+    );
+    expect(filesToHash).toEqual([]);
+    expect(filesToRemove).toEqual([]);
+  });
 });

From 832fe1294d13f30f509e819f23450342759209a0 Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:39 +0000
Subject: [PATCH 264/265] [package-deps-hash] Resolve a relative RepoStateCache
 temporary folder path against the working directory (and 1 more)

Swarm integration step 249; original commit 5aecba33b6 (merge of swarm/r06-t366 at 03a65659c2).
Scope: task 366, 351 follow-ups: sign an input that is a link to no regular file by the link itself.

Brings 366 (branch swarm/r06-t366, 2 commits). Second agent: t04 board 10037. Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 8 of 9. Gate: ch01 GATE OK board 10189 (tree 506a5b0862)

Commits folded into this step (2):
- 720874a782 [package-deps-hash] Resolve a relative RepoStateCache temporary folder path against the working directory
- 03a65659c2 [rush-lib] Sign an input that is a symbolic link not leading to a regular file by the link itself

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...r06-link-input-stats_2026-09-30-08-20.json | 11 +++
 ...relative-temp-folder_2026-09-30-08-20.json | 11 +++
 .../package-deps-hash/src/RepoStateCache.ts   |  6 +-
 .../src/test/RepoStateCache.test.ts           | 29 ++++++
 .../operations/InputFilesStatSignature.ts     | 45 ++++++++--
 .../test/InputFilesStatSignature.test.ts      | 88 +++++++++++++++++++
 6 files changed, 179 insertions(+), 11 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/swarm-r06-link-input-stats_2026-09-30-08-20.json
 create mode 100644 common/changes/@rushstack/package-deps-hash/swarm-r06-relative-temp-folder_2026-09-30-08-20.json

diff --git a/common/changes/@microsoft/rush/swarm-r06-link-input-stats_2026-09-30-08-20.json b/common/changes/@microsoft/rush/swarm-r06-link-input-stats_2026-09-30-08-20.json
new file mode 100644
index 0000000000..f1e1bafc12
--- /dev/null
+++ b/common/changes/@microsoft/rush/swarm-r06-link-input-stats_2026-09-30-08-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Fix the check that decides whether to write a build cache entry for an operation with an input that is a symbolic link that doesn't lead to a regular file, such as one whose target is missing, a link to a folder or a loop of links. The check now uses the link itself, whose text is what Git hashes for it, instead of treating the link as a deleted file, following it to a folder, or failing. So such a link no longer blocks the cache entry when its folder or its target changes during the build.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/package-deps-hash/swarm-r06-relative-temp-folder_2026-09-30-08-20.json b/common/changes/@rushstack/package-deps-hash/swarm-r06-relative-temp-folder_2026-09-30-08-20.json
new file mode 100644
index 0000000000..e68b1a05d8
--- /dev/null
+++ b/common/changes/@rushstack/package-deps-hash/swarm-r06-relative-temp-folder_2026-09-30-08-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/package-deps-hash",
+      "comment": "Fix `RepoStateCache` for a relative `temporaryFolderPath`. The path is now resolved against the current working directory when the cache is created. Before, Git, which runs in the repository, resolved the path of the copy of the index against the repository instead, found no index there, and reported every file as changed.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/package-deps-hash",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/package-deps-hash/src/RepoStateCache.ts b/libraries/package-deps-hash/src/RepoStateCache.ts
index 94c78e8ae9..3c6c171147 100644
--- a/libraries/package-deps-hash/src/RepoStateCache.ts
+++ b/libraries/package-deps-hash/src/RepoStateCache.ts
@@ -52,7 +52,8 @@ export interface IRepoStateCacheOptions {
    */
   gitPath?: string;
   /**
-   * The folder in which to create the folder that holds the copy of the Git index.
+   * The folder in which to create the folder that holds the copy of the Git index. A relative path is resolved
+   * against the current working directory when the cache is created.
    * @defaultValue The temporary folder of the operating system
    */
   temporaryFolderPath?: string;
@@ -231,7 +232,8 @@ export class RepoStateCache {
     const { rootDirectory, gitPath, temporaryFolderPath = os.tmpdir() } = options;
     this.#rootDirectory = rootDirectory;
     this.#gitPath = gitPath;
-    this.#temporaryFolderPath = temporaryFolderPath;
+    // Git runs in the root directory, so it would resolve a relative path of the copy of the index there
+    this.#temporaryFolderPath = path.resolve(temporaryFolderPath);
   }
 
   /**
diff --git a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
index f894ab9e50..3221f1a232 100644
--- a/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
+++ b/libraries/package-deps-hash/src/test/RepoStateCache.test.ts
@@ -965,6 +965,35 @@ describe(RepoStateCache.name, () => {
     expect(fs.readdirSync(temporaryFolderPath)).toHaveLength(1);
   });
 
+  it('resolves a relative temporary folder path against the current working directory, since Git runs in the repository', async () => {
+    // A file that Git takes from the index, since it isn't on disk
+    runGit('update-index', '--assume-unchanged', 'b.txt');
+    fs.unlinkSync(path.join(repoPath, 'b.txt'));
+    // The temp folder of the package is under the current working directory, and the repository isn't
+    const packageTemporaryFolderPath: string = path.resolve(__dirname, '../../temp/test/RepoStateCache');
+    fs.mkdirSync(packageTemporaryFolderPath, { recursive: true });
+    const absoluteFolderPath: string = fs.mkdtempSync(path.join(packageTemporaryFolderPath, 'relative-'));
+    const relativeFolderPath: string = path.relative(process.cwd(), absoluteFolderPath);
+    expect(path.isAbsolute(relativeFolderPath)).toBe(false);
+
+    const relativeCache: RepoStateCache = new RepoStateCache({
+      rootDirectory: repoPath,
+      temporaryFolderPath: relativeFolderPath
+    });
+    try {
+      const state: IDetailedRepoState = await relativeCache.getDetailedRepoStateAsync();
+      expect(takeUsesPrivateIndex()).toBe(true);
+      expect(fs.readdirSync(absoluteFolderPath)).toHaveLength(1);
+      // Only the copy of the index records the file that isn't on disk
+      expect(state.files.has('b.txt')).toBe(true);
+      expect(state.hasUncommittedChanges).toBe(false);
+      await expectUncachedStateAsync(state);
+    } finally {
+      relativeCache.dispose();
+      fs.rmSync(absoluteFolderPath, { recursive: true, force: true });
+    }
+  });
+
   it('falls back to getDetailedRepoStateAsync when the copy of the index disappears while Git reads it', async () => {
     await getStateAsync();
     let isPrivateIndexDeleted: boolean = false;
diff --git a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
index dbfa8ab853..fa13507a8f 100644
--- a/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
+++ b/libraries/rush-lib/src/logic/operations/InputFilesStatSignature.ts
@@ -50,7 +50,8 @@ export interface IInputFilesState {
    */
   readonly filePaths: ReadonlyArray<string>;
   /**
-   * Signature of the size, modification time, and inode of each tracked input file.
+   * Signature of the size, modification time, and inode of each tracked input file. For a symbolic link that does
+   * not lead to a regular file, they are those of the link itself.
    */
   readonly statSignature: string;
   /**
@@ -98,7 +99,7 @@ function hashInputFilesStats(
   const hasher: crypto.Hash = crypto.createHash('sha1');
   let index: number = 0;
   for (const filePath of filePaths) {
-    const stats: fs.BigIntStats | undefined = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+    const stats: fs.BigIntStats | undefined = tryGetInputFileStats(filePath);
     if (stats) {
       hasher.update(`${filePath}\0${stats.size}\0${stats.mtimeNs}\0${stats.ino}\n`);
     } else {
@@ -110,6 +111,28 @@ function hashInputFilesStats(
   return hasher.digest('hex');
 }
 
+/**
+ * Returns the stats of what Git hashes for an input file, or `undefined` if the file is missing: the file, or the
+ * regular file that a symbolic link leads to. For a symbolic link that does not lead to a regular file (e.g. its
+ * target is missing, is a folder, or is a loop of links), Git hashes the text of the link, as the inputs snapshot
+ * does, so the stats are those of the link itself.
+ */
+function tryGetInputFileStats(filePath: string): fs.BigIntStats | undefined {
+  let stats: fs.BigIntStats | undefined;
+  try {
+    stats = fs.statSync(filePath, { bigint: true, throwIfNoEntry: false });
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ELOOP') {
+      throw error;
+    }
+  }
+  if (stats?.isFile()) {
+    return stats;
+  }
+  const linkStats: fs.BigIntStats | undefined = tryGetLinkStats(filePath);
+  return linkStats?.isSymbolicLink() ? linkStats : stats;
+}
+
 /**
  * Returns true if the modification or status change time of the folder is at or after the specified time.
  * Deleting a folder changes the folder that held it, so a missing folder is judged by the nearest folder above it
@@ -355,9 +378,10 @@ function mayHoldFiles(entryPath: string): boolean {
 }
 
 /**
- * Returns the Git blob hash of the content that a file has on disk, computed with the algorithm of
- * `expectedHash`, or undefined if it is not hashed in process. Unlike `git hash-object`, it applies no clean
- * filters (e.g. line ending conversion), so a mismatch does not show that the file changed.
+ * Returns the Git blob hash of the content that a file has on disk, or of the text of a symbolic link that does not
+ * lead to a regular file, which is what Git hashes for such a link, computed with the algorithm of `expectedHash`.
+ * Returns undefined if it is not hashed in process. Unlike `git hash-object`, it applies no clean filters (e.g. line
+ * ending conversion), so a mismatch does not show that the file changed.
  */
 function tryGetBlobHash(filePath: string, expectedHash: string): string | undefined {
   const algorithm: string | undefined = GIT_HASH_ALGORITHM_BY_LENGTH.get(expectedHash.length);
@@ -366,12 +390,15 @@ function tryGetBlobHash(filePath: string, expectedHash: string): string | undefi
   }
   let content: Buffer;
   try {
-    // Not a folder or a FIFO, which cannot be read like a file
-    const stats: fs.Stats | undefined = fs.statSync(filePath, { throwIfNoEntry: false });
-    if (!stats?.isFile() || stats.size > MAX_IN_PROCESS_HASH_FILE_SIZE) {
+    const stats: fs.BigIntStats | undefined = tryGetInputFileStats(filePath);
+    if (stats?.isSymbolicLink()) {
+      content = fs.readlinkSync(filePath, { encoding: 'buffer' });
+    } else if (stats?.isFile() && stats.size <= BigInt(MAX_IN_PROCESS_HASH_FILE_SIZE)) {
+      content = fs.readFileSync(filePath);
+    } else {
+      // A folder or a FIFO cannot be read like a file
       return undefined;
     }
-    content = fs.readFileSync(filePath);
   } catch {
     return undefined;
   }
diff --git a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
index 3b7979895c..cdc0fec88f 100644
--- a/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
+++ b/libraries/rush-lib/src/logic/operations/test/InputFilesStatSignature.test.ts
@@ -261,6 +261,72 @@ describe('InputFilesStatSignature', () => {
     });
   });
 
+  describe('a symbolic link that does not lead to a regular file', () => {
+    // Git records the text of such a link, so it is signed by the link itself
+    const itUnlessWindows: jest.It = process.platform === 'win32' ? it.skip : it;
+    let linkPath: string;
+
+    beforeEach(() => {
+      linkPath = path.join(srcFolder, 'link.ts');
+    });
+
+    itUnlessWindows('is not deleted during the snapshot when it is dangling and its folder changed', () => {
+      fs.symlinkSync('missing.ts', linkPath);
+      const snapshotStartTimeMs: number = waitForNextWindow();
+      // Like a build that creates its log folder in the project folder
+      fs.mkdirSync(path.join(srcFolder, 'rush-logs'));
+
+      const state: IInputFilesState = captureAt(snapshotStartTimeMs, linkPath, fileA);
+      expect(state.filesDeletedDuringSnapshot).toEqual([]);
+      expect(state.filesChangedDuringSnapshot).toEqual([]);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+    });
+
+    itUnlessWindows('changes the signature when a dangling link is re-pointed or removed', () => {
+      fs.symlinkSync('missing.ts', linkPath);
+      let state: IInputFilesState = capture(linkPath);
+      fs.unlinkSync(linkPath);
+      fs.symlinkSync('also-missing.ts', linkPath);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+
+      state = capture(linkPath);
+      fs.unlinkSync(linkPath);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    itUnlessWindows('signs a loop of links by the link, instead of throwing', () => {
+      fs.symlinkSync('link.ts', linkPath);
+      const state: IInputFilesState = capture(linkPath, fileA);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+
+      fs.unlinkSync(linkPath);
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+
+    itUnlessWindows(
+      'signs a link to a folder by the link, so a new file in that folder is not a change',
+      () => {
+        const otherFolder: string = path.join(tempFolder, 'other');
+        fs.mkdirSync(otherFolder);
+        fs.symlinkSync('../other', linkPath);
+        // So that creating a file in the folder changes its modification time
+        const pastTime: Date = new Date(Date.now() - 60 * 1000);
+        fs.utimesSync(otherFolder, pastTime, pastTime);
+
+        const state: IInputFilesState = capture(linkPath);
+        fs.writeFileSync(path.join(otherFolder, 'c.ts'), 'export const c = 1;');
+        expect(haveInputFilesChanged(state, noNewInputs)).toBe(false);
+      }
+    );
+
+    itUnlessWindows('changes the signature when the target of a dangling link is created', () => {
+      fs.symlinkSync('missing.ts', linkPath);
+      const state: IInputFilesState = capture(linkPath);
+      fs.writeFileSync(path.join(srcFolder, 'missing.ts'), 'export const m = 1;');
+      expect(haveInputFilesChanged(state, noNewInputs)).toBe(true);
+    });
+  });
+
   describe('folderEntries of a folder that changed after the snapshot start', () => {
     it('are the entries from before the snapshot start, so that later ones are new', () => {
       // Not an input file
@@ -405,6 +471,28 @@ describe('InputFilesStatSignature', () => {
       expect(jest.mocked(hashFilesAsync)).toHaveBeenCalledTimes(1);
     });
 
+    // Git records the text of the link, and "git hash-object" cannot follow it
+    (process.platform === 'win32' ? it.skip : it)(
+      'hashes the text of a symbolic link that does not lead to a regular file in process',
+      async () => {
+        const danglingPath: string = 'src/dangling.ts';
+        const folderLinkPath: string = 'src/folder.ts';
+        fs.mkdirSync(path.join(tempFolder, 'other'));
+        fs.symlinkSync('missing.ts', path.join(tempFolder, danglingPath));
+        fs.symlinkSync('../other', path.join(tempFolder, folderLinkPath));
+        const snapshotHashes: Map<string, string> = new Map([
+          [danglingPath, getBlobHash('missing.ts')],
+          [folderLinkPath, getBlobHash('../other')]
+        ]);
+        expect(await haveHashesChangedAsync(snapshotHashes, [danglingPath, folderLinkPath])).toBe(false);
+        expect(jest.mocked(hashFilesAsync)).not.toHaveBeenCalled();
+
+        fs.unlinkSync(path.join(tempFolder, danglingPath));
+        fs.symlinkSync('also-missing.ts', path.join(tempFolder, danglingPath));
+        expect(await haveHashesChangedAsync(snapshotHashes, [danglingPath])).toBe(true);
+      }
+    );
+
     it('reports a change if Git was not found', async () => {
       expect(
         await haveSnapshotHashesChangedAsync(undefined, tempFolder, [pathA], new Map([[pathA, hashA]]))

From 5ff84efc5d7a6afc2ddaefc2074560935bf8847c Mon Sep 17 00:00:00 2001
From: Sean Larkin <3408176+TheLarkInn@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:17:39 +0000
Subject: [PATCH 265/265] [rush-daemon] Keep the environment out of failed test
 assertions (and 1 more)

Swarm integration step 250; original commit 051bfee3e4 (merge of swarm/o01-t365 at fb77adfde9).
Scope: task 365, C1 and C2: rush-daemon tests print no environment in failed assertions, and delete secret-shaped variables first.

Brings 365 (branch swarm/o01-t365, 2 commits). Second agent: r01 board 9962 (RESULT board 9901). Evidence: ch01's GATE OK board 10189.

Batch E2k part 2 (K2), item 9 of 9. Gate: ch01 GATE OK board 10189 (tree 090484c717)

Commits folded into this step (2):
- df1f14139a rush-daemon: keep the environment out of failed test assertions
- fb77adfde9 rush-daemon: delete secret-shaped environment variables before each test

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6d3da49f-95f3-4291-9026-0b0f8e38675c
---
 ...print-no-environment_2026-09-30-08-05.json | 11 +++++
 ...ronment-secret-guard_2026-09-30-08-20.json | 11 +++++
 libraries/rush-daemon/config/jest.config.json |  5 ++-
 .../src/test/DaemonGraphFixtureSetup.test.ts  | 43 +++++++++++--------
 .../src/test/DaemonInstallationChange.test.ts | 15 +++++--
 .../test/DaemonRequestWireTestUtilities.ts    |  9 ++++
 .../src/test/FailedNativeMutation.test.ts     | 15 +++++--
 .../src/test/PhasedRequestBatching.test.ts    |  3 +-
 ...roductionDaemonEnvironmentIdentity.test.ts | 17 ++++++--
 .../test/ProductionDaemonRequestParse.test.ts | 18 +++++---
 .../ProductionDaemonRequestResolver.test.ts   |  6 ++-
 .../test/RemoveSecretEnvironmentVariables.ts  | 12 ++++++
 .../test/SecretEnvironmentVariables.test.ts   | 39 +++++++++++++++++
 .../src/test/SecretEnvironmentVariables.ts    | 22 ++++++++++
 .../VersionSelectedDaemonLauncher.test.ts     | 33 ++++++++------
 .../src/test/WorkspaceWarmSet.test.ts         |  3 +-
 16 files changed, 211 insertions(+), 51 deletions(-)
 create mode 100644 common/changes/@rushstack/rush-daemon/test-assertions-print-no-environment_2026-09-30-08-05.json
 create mode 100644 common/changes/@rushstack/rush-daemon/test-environment-secret-guard_2026-09-30-08-20.json
 create mode 100644 libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts
 create mode 100644 libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts
 create mode 100644 libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts

diff --git a/common/changes/@rushstack/rush-daemon/test-assertions-print-no-environment_2026-09-30-08-05.json b/common/changes/@rushstack/rush-daemon/test-assertions-print-no-environment_2026-09-30-08-05.json
new file mode 100644
index 0000000000..c0975507f3
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/test-assertions-print-no-environment_2026-09-30-08-05.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Keep the process environment out of the output of failed rush-daemon test assertions.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/common/changes/@rushstack/rush-daemon/test-environment-secret-guard_2026-09-30-08-20.json b/common/changes/@rushstack/rush-daemon/test-environment-secret-guard_2026-09-30-08-20.json
new file mode 100644
index 0000000000..8feb8c04bc
--- /dev/null
+++ b/common/changes/@rushstack/rush-daemon/test-environment-secret-guard_2026-09-30-08-20.json
@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/rush-daemon",
+      "comment": "Delete the environment variables that can hold a secret before each rush-daemon test file loads.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@rushstack/rush-daemon",
+  "email": "selarkin@microsoft.com"
+}
diff --git a/libraries/rush-daemon/config/jest.config.json b/libraries/rush-daemon/config/jest.config.json
index d1749681d9..97e21dc59e 100644
--- a/libraries/rush-daemon/config/jest.config.json
+++ b/libraries/rush-daemon/config/jest.config.json
@@ -1,3 +1,6 @@
 {
-  "extends": "local-node-rig/profiles/default/config/jest.config.json"
+  "extends": "local-node-rig/profiles/default/config/jest.config.json",
+
+  // Delete the environment variables that can hold a secret before each test file loads
+  "setupFiles": ["../lib-commonjs/test/RemoveSecretEnvironmentVariables.js"]
 }
diff --git a/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts b/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts
index c4d7f83414..b1131a1ceb 100644
--- a/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonGraphFixtureSetup.test.ts
@@ -5,7 +5,7 @@ import * as fs from 'node:fs';
 
 import { RushDaemonHost } from '../RushDaemonHost';
 import { DaemonGraphTestFixture } from './DaemonGraphTestFixture';
-import { createDeferred } from './DaemonRequestWireTestUtilities';
+import { createDeferred, hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 import * as testProcessExit from './TestProcessExit';
 
 describe('daemon graph fixture initialization ownership', () => {
@@ -66,13 +66,14 @@ describe('daemon graph fixture initialization ownership', () => {
       expect(settled).toBe(false);
       expect(closed).toBe(false);
       expect(fs.existsSync(captured!.folder)).toBe(true);
-      expect(published).toBeUndefined();
+      // A fixture holds the whole process environment, so a failure prints only a boolean.
+      expect(published === undefined).toBe(true);
       release.resolve();
       expect(await joined).toEqual([{ status: 'rejected', reason: controller.signal.reason }]);
       expect(closed).toBe(true);
       expect(fs.existsSync(captured!.folder)).toBe(false);
       expect(fs.existsSync(host.paths.lockfilePath)).toBe(false);
-      expect(published).toBeUndefined();
+      expect(published === undefined).toBe(true);
     } finally {
       await cleanupAsync();
     }
@@ -82,10 +83,12 @@ describe('daemon graph fixture initialization ownership', () => {
     const failure: Error = new Error('injected partial graph fixture setup failure');
     let captured: DaemonGraphTestFixture | undefined;
     await expect(
-      DaemonGraphTestFixture.createAsync((created) => {
-        captured = created;
-        throw failure;
-      })
+      hideResolvedValueAsync(
+        DaemonGraphTestFixture.createAsync((created) => {
+          captured = created;
+          throw failure;
+        })
+      )
     ).rejects.toBe(failure);
     expect(fs.existsSync(captured!.folder)).toBe(false);
     expect(captured!.host).toBeUndefined();
@@ -98,10 +101,12 @@ describe('daemon graph fixture initialization ownership', () => {
     const remove = jest.spyOn(testProcessExit, 'removeTestFolderAsync').mockRejectedValueOnce(cleanupFailure);
     try {
       await expect(
-        DaemonGraphTestFixture.createAsync((created) => {
-          captured = created;
-          throw failure;
-        })
+        hideResolvedValueAsync(
+          DaemonGraphTestFixture.createAsync((created) => {
+            captured = created;
+            throw failure;
+          })
+        )
       ).rejects.toMatchObject({ errors: [failure, cleanupFailure] });
       expect(fs.existsSync(captured!.folder)).toBe(true);
     } finally {
@@ -116,13 +121,15 @@ describe('daemon graph fixture initialization ownership', () => {
     let captured: DaemonGraphTestFixture | undefined;
     try {
       await expect(
-        DaemonGraphTestFixture.createAsync(
-          (created) => {
-            captured = created;
-            controller.abort();
-          },
-          true,
-          controller.signal
+        hideResolvedValueAsync(
+          DaemonGraphTestFixture.createAsync(
+            (created) => {
+              captured = created;
+              controller.abort();
+            },
+            true,
+            controller.signal
+          )
         )
       ).rejects.toBe(controller.signal.reason);
       expect(start).not.toHaveBeenCalled();
diff --git a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
index 27d8ce6a66..2f38655257 100644
--- a/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
+++ b/libraries/rush-daemon/src/test/DaemonInstallationChange.test.ts
@@ -573,6 +573,13 @@ describe('a native install or update in a daemon whose installation changes', ()
     current.change ??= { change: 'replaced', folder: installation.folder };
   }
 
+  // The launcher's context holds the request's environment, which is the whole process environment, and jest prints a
+  // mock's arguments when an assertion about its calls fails. Tests count the calls instead, so that a failure prints
+  // only numbers.
+  function launchCount(): number {
+    return launcher.mock.calls.length;
+  }
+
   function stderrText(exchange: ITerminalExchange): string {
     return exchange.frames
       .filter((frame: IDaemonFrame) => frame.kind === DaemonFrameType.logStderr)
@@ -607,7 +614,7 @@ describe('a native install or update in a daemon whose installation changes', ()
     const { terminal } = await fixture.runAsync(['install', '--help']);
     expect(terminal).toMatchObject(installationChangedResult());
     expect(workerSpawns).toBe(0);
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
     await fixture.host.closed;
     expect(fixture.logs).toEqual([
@@ -628,7 +635,7 @@ describe('a native install or update in a daemon whose installation changes', ()
     expect(stderr).toContain(exitWithoutSuccessorLine());
     expect(stderr).not.toContain('Mutation completed');
     // The successor would run code that is gone or replaced.
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
   });
 
@@ -652,7 +659,7 @@ describe('a native install or update in a daemon whose installation changes', ()
     // Unlike the change on its own, which the host does not report, this is a failure that it reports.
     await expect(fixture.host.restartCompleted).rejects.toThrow(undrained);
     expect(warnings).toContainEqual(expect.objectContaining({ message: undrained }));
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
   });
 
   it('exits without a successor when the installation changes while the successor is selected', async () => {
@@ -712,7 +719,7 @@ describe('a native install or update in a daemon whose installation changes', ()
       await client.closeAsync();
     }
     await expect(fixture.host.restartCompleted).resolves.toBeUndefined();
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     expect(fixture.runs()).toEqual([]);
   });
 });
diff --git a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
index 79343ab4e5..f070f368c9 100644
--- a/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
+++ b/libraries/rush-daemon/src/test/DaemonRequestWireTestUtilities.ts
@@ -178,6 +178,15 @@ export function createDeferred<T>(): IDeferred<T> {
   return { promise, resolve: resolvePromise };
 }
 
+/**
+ * Rejects as `promise` does, but resolves to a fixed string instead of its value. A test that expects a rejection
+ * passes this to `expect(...).rejects`, whose failure prints the value that the promise resolved to: in these tests,
+ * that value can hold a request's environment, which is the whole process environment.
+ */
+export function hideResolvedValueAsync(promise: Promise<unknown>): Promise<string> {
+  return promise.then(() => 'The promise resolved.');
+}
+
 export function createWireEnvelope(
   requestId: string,
   commandName: string,
diff --git a/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts b/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
index 89d054157f..1a25206721 100644
--- a/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
+++ b/libraries/rush-daemon/src/test/FailedNativeMutation.test.ts
@@ -175,6 +175,13 @@ describe('a native install or update that fails', () => {
     return path.join(fixture!.folder, name);
   }
 
+  // The launcher's context holds the request's environment, which is the whole process environment, and jest prints a
+  // mock's arguments when an assertion about its calls fails. Tests count the calls instead, so that a failure prints
+  // only numbers.
+  function launchCount(): number {
+    return launcher.mock.calls.length;
+  }
+
   function rewriteFlag(): void {
     const content: Buffer = fs.readFileSync(file(FLAG));
     fs.rmSync(file(FLAG));
@@ -200,7 +207,7 @@ describe('a native install or update that fails', () => {
     expect(keptLines(started.logs)).toEqual([keptLine(commandName, exitCode)]);
     await started.buildSuccessfullyAsync();
     expect(started.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
     expect(await isSettledAsync(started.host.closed)).toBe(false);
   }
@@ -256,7 +263,7 @@ describe('a native install or update that fails', () => {
     await started.buildSuccessfullyAsync();
     expect(keptLines(started.logs)).toEqual([keptLine('install', 1), keptLine('install', 1)]);
     expect(started.host.workspaceStatus.lastReloadTier).toBe(WorkspaceInputChangeTier.Reload);
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
   });
 
@@ -342,7 +349,7 @@ describe('a native install or update that fails', () => {
       `The daemon's installation at ${folder} was replaced, so the daemon exits after this command without ` +
         'starting a new one; the next command starts one.'
     );
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     await expect(started.host.restartCompleted).resolves.toBeUndefined();
     expect(keptLines(started.logs)).toEqual([]);
   });
@@ -358,7 +365,7 @@ describe('a native install or update that fails', () => {
     expect(workerSpawns).toBe(1);
     await started.buildSuccessfullyAsync();
     expect(keptLines(started.logs)).toEqual([keptLine('install', 1)]);
-    expect(launcher).not.toHaveBeenCalled();
+    expect(launchCount()).toBe(0);
     expect(await isSettledAsync(started.host.restartCompleted)).toBe(false);
   });
 
diff --git a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
index ff9ddc1849..b43316f0ee 100644
--- a/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
+++ b/libraries/rush-daemon/src/test/PhasedRequestBatching.test.ts
@@ -459,7 +459,8 @@ describe('shared phased request batching', () => {
       );
       expect(hashedA?.[SESSION_VARIABLE]).toBe('session-X');
       expect(hashedB?.[SESSION_VARIABLE]).toBe('session-Y');
-      expect(hashedC).toBe(hashedA);
+      // The same object. Each is a whole environment, so a failure prints only a boolean.
+      expect(hashedC === hashedA).toBe(true);
       expect(hashedA?.[CHANGED_VARIABLE]).toBe('original');
       expect([...seen].sort()).toEqual([
         `${OPERATION_A}: session-X added-1 changed-1 <unset>`,
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
index c5ccf90258..990f1368b4 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonEnvironmentIdentity.test.ts
@@ -14,7 +14,7 @@ import { DAEMON_OPERATION_GROUPS_ENV_VAR } from '@rushstack/rush-daemon-transpor
 import { DaemonRequestEnvironmentError, type IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IWorkspaceSession } from '../WorkspaceSession';
-import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+import { createWireEnvelope, hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 
 describe('ProductionDaemonRequestResolver environment identity', () => {
   const ADDED_NAME: string = 'RUSHD_TEST_PLUGIN_ADDED';
@@ -32,6 +32,13 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
     delete process.env[STARTUP_NAME];
   });
 
+  // A parse's options hold the request's environment, which is the whole process environment, and jest prints a
+  // mock's arguments when an assertion about its calls fails. Tests count the calls instead, so that a failure prints
+  // only numbers.
+  function parseCount(): number {
+    return parse.mock.calls.length;
+  }
+
   function getEnvironment(): Record<string, string> {
     return Object.fromEntries(
       Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined)
@@ -148,7 +155,9 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
       message: expect.stringContaining('is not a phased command')
     });
     // Resolving checks the environment first, and has no parse of the rejected identity check to use.
-    await expect(resolver.resolveRequestAsync(options)).rejects.toBeInstanceOf(DaemonRequestEnvironmentError);
+    await expect(hideResolvedValueAsync(resolver.resolveRequestAsync(options))).rejects.toBeInstanceOf(
+      DaemonRequestEnvironmentError
+    );
     expect(parse).toHaveBeenCalledTimes(2);
   });
 
@@ -176,12 +185,12 @@ describe('ProductionDaemonRequestResolver environment identity', () => {
         code: 'unsupported',
         message
       });
-      await expect(resolver.resolveRequestAsync(options)).rejects.toMatchObject({
+      await expect(hideResolvedValueAsync(resolver.resolveRequestAsync(options))).rejects.toMatchObject({
         code: 'unsupported',
         message
       });
     }
-    expect(parse).not.toHaveBeenCalled();
+    expect(parseCount()).toBe(0);
   });
 
   it('keeps the startup environment for a replacement session', async () => {
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
index 832d58ec71..191a5893c9 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestParse.test.ts
@@ -12,7 +12,7 @@ import { TerminalProviderSeverity } from '@rushstack/terminal';
 import type { IResolveDaemonRequestOptions } from '../DaemonRequestDispatcher';
 import { ProductionDaemonRequestResolver } from '../ProductionDaemonRequestResolver';
 import type { IWorkspaceSession } from '../WorkspaceSession';
-import { createWireEnvelope } from './DaemonRequestWireTestUtilities';
+import { createWireEnvelope, hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 
 function createSession(): IWorkspaceSession {
   // The native engine is already bound, so that a resolution only parses and selects operations.
@@ -146,7 +146,9 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
       const options: IResolveDaemonRequestOptions = createOptions(createSession());
       await resolver.getCommandParameterIdentityAsync(options);
       await expect(
-        resolver.resolveRequestAsync({ ...options, envelope: { ...options.envelope, ...change } })
+        hideResolvedValueAsync(
+          resolver.resolveRequestAsync({ ...options, envelope: { ...options.envelope, ...change } })
+        )
       ).rejects.toMatchObject({
         code: 'invalidRequest',
         message: 'The command name or origin does not match the native parsed argv.'
@@ -162,7 +164,9 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
     const options: IResolveDaemonRequestOptions = createOptions(session);
     await resolver.getCommandParameterIdentityAsync(options);
     selectionError = new Error('The project name "nope" does not exist.');
-    await expect(resolver.resolveRequestAsync(dispatched(options))).rejects.toMatchObject({
+    await expect(
+      hideResolvedValueAsync(resolver.resolveRequestAsync(dispatched(options)))
+    ).rejects.toMatchObject({
       code: 'invalidRequest',
       message: 'The project name "nope" does not exist.\nWarning from parse 2'
     });
@@ -211,7 +215,9 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
     const options: IResolveDaemonRequestOptions = createOptions(createSession(), abortController);
     await resolver.getCommandParameterIdentityAsync(options);
     abortController.abort();
-    await expect(resolver.resolveRequestAsync(dispatched(options))).rejects.toMatchObject({
+    await expect(
+      hideResolvedValueAsync(resolver.resolveRequestAsync(dispatched(options)))
+    ).rejects.toMatchObject({
       code: 'routingFailed',
       message: 'The request was cancelled before engine initialization.'
     });
@@ -226,7 +232,9 @@ describe('ProductionDaemonRequestResolver command line parsing', () => {
       const options: IResolveDaemonRequestOptions = createOptions(createSession());
       await resolver.getCommandParameterIdentityAsync(options);
       process.env.RUSHD_TEST_REQUEST_PARSE = 'changed';
-      await expect(resolver.resolveRequestAsync(dispatched(options))).rejects.toMatchObject({
+      await expect(
+        hideResolvedValueAsync(resolver.resolveRequestAsync(dispatched(options)))
+      ).rejects.toMatchObject({
         code: 'unsupported',
         message: expect.stringContaining(
           "The daemon's own environment changed after it started (RUSHD_TEST_REQUEST_PARSE)"
diff --git a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
index 993c1ebf57..1c25fef02a 100644
--- a/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
+++ b/libraries/rush-daemon/src/test/ProductionDaemonRequestResolver.test.ts
@@ -1053,7 +1053,11 @@ process.exit(23);
       expect(runs(fixture).at(-1)).toBe('c:one:');
       expect(fixture.session.operationGraph).toBe(graph);
       expect(process.cwd()).toBe(originalCwd);
-      expect(process.env).toEqual(originalEnvironment);
+      // Only the names, so that a failure doesn't print the values of the whole process environment.
+      const changedNames: string[] = [
+        ...new Set([...Object.keys(originalEnvironment), ...Object.keys(process.env)])
+      ].filter((name: string) => process.env[name] !== originalEnvironment[name]);
+      expect(changedNames).toEqual([]);
     } finally {
       await fixture[Symbol.asyncDispose]();
     }
diff --git a/libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts b/libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts
new file mode 100644
index 0000000000..47a56ab84f
--- /dev/null
+++ b/libraries/rush-daemon/src/test/RemoveSecretEnvironmentVariables.ts
@@ -0,0 +1,12 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import { removeSecretEnvironmentVariables } from './SecretEnvironmentVariables';
+
+// Jest runs this file before each test file loads ("setupFiles" in config/jest.config.json). Many tests copy the
+// process environment into a request, a fixture or a launcher's context, and a failed assertion can print such a
+// copy. Deleting the variables that can hold a secret keeps their values out of that output.
+//
+// This changes only the process.env that jest gives the test file. A child process that a test starts without an
+// `env` option still inherits the environment of the jest worker.
+removeSecretEnvironmentVariables(process.env);
diff --git a/libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts
new file mode 100644
index 0000000000..543c5205a1
--- /dev/null
+++ b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.test.ts
@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+import {
+  removeSecretEnvironmentVariables,
+  SECRET_ENVIRONMENT_VARIABLE_NAME
+} from './SecretEnvironmentVariables';
+
+describe(removeSecretEnvironmentVariables.name, () => {
+  it('deletes the variables whose names can hold a secret and keeps the others', () => {
+    const environment: NodeJS.ProcessEnv = Object.fromEntries([
+      ['NPM_TOKEN', 'fake-1'],
+      ['node_auth_token', 'fake-2'],
+      ['APP_SECRET', 'fake-3'],
+      ['DB_PASSWORD', 'fake-4'],
+      ['AZURE_CREDENTIALS', 'fake-5'],
+      ['npm_config__auth', 'fake-6'],
+      ['PATH', '/usr/bin'],
+      ['RUSHD_ENV_MARKER', 'kept']
+    ]);
+
+    expect(removeSecretEnvironmentVariables(environment)).toEqual([
+      'NPM_TOKEN',
+      'node_auth_token',
+      'APP_SECRET',
+      'DB_PASSWORD',
+      'AZURE_CREDENTIALS',
+      'npm_config__auth'
+    ]);
+    expect(environment).toEqual({ PATH: '/usr/bin', RUSHD_ENV_MARKER: 'kept' });
+  });
+
+  it('has run on process.env before this test file loaded', () => {
+    const names: string[] = Object.keys(process.env).filter((name: string) =>
+      SECRET_ENVIRONMENT_VARIABLE_NAME.test(name)
+    );
+    expect(names).toEqual([]);
+  });
+});
diff --git a/libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts
new file mode 100644
index 0000000000..0ff516681d
--- /dev/null
+++ b/libraries/rush-daemon/src/test/SecretEnvironmentVariables.ts
@@ -0,0 +1,22 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT license.
+// See LICENSE in the project root for license information.
+
+/**
+ * Matches the name of an environment variable that can hold a secret, such as `NPM_TOKEN` or `npm_config__auth`.
+ * It also matches names such as `GIT_AUTHOR_NAME`, which the test fixtures don't need: they pass the commit author
+ * to Git on the command line.
+ */
+export const SECRET_ENVIRONMENT_VARIABLE_NAME: RegExp = /TOKEN|SECRET|PASSWORD|CREDENTIAL|_AUTH/i;
+
+/**
+ * Deletes each variable whose name matches {@link SECRET_ENVIRONMENT_VARIABLE_NAME}, and returns the deleted names.
+ */
+export function removeSecretEnvironmentVariables(environment: NodeJS.ProcessEnv): string[] {
+  const names: string[] = Object.keys(environment).filter((name: string) =>
+    SECRET_ENVIRONMENT_VARIABLE_NAME.test(name)
+  );
+  for (const name of names) {
+    delete environment[name];
+  }
+  return names;
+}
diff --git a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
index 2dcad746da..4c08e74669 100644
--- a/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
+++ b/libraries/rush-daemon/src/test/VersionSelectedDaemonLauncher.test.ts
@@ -30,6 +30,7 @@ import {
   type ISelectDaemonLauncherOptions
 } from '../VersionSelectedDaemonLauncher';
 import { createDaemonTestRuntimeBase } from './DaemonTestRuntimeBase';
+import { hideResolvedValueAsync } from './DaemonRequestWireTestUtilities';
 import { isTestProcessRunning, removeTestFolderAsync, waitForTestProcessExitAsync } from './TestProcessExit';
 
 describe('version-selected daemon launcher', () => {
@@ -137,22 +138,26 @@ describe('version-selected daemon launcher', () => {
   it('never relabels the bundled engine as a different requested version', async () => {
     fs.writeFileSync(path.join(repoRoot, 'rush.json'), JSON.stringify({ rushVersion: '5.178.1' }));
     await expect(
-      selectDaemonLauncherAsync(
-        {
-          ...context,
-          rushVersion: '5.178.1'
-        },
-        { allowInstall: false }
+      hideResolvedValueAsync(
+        selectDaemonLauncherAsync(
+          {
+            ...context,
+            rushVersion: '5.178.1'
+          },
+          { allowInstall: false }
+        )
       )
     ).rejects.toThrow('Cannot launch selected Rush 5.178.1');
   });
 
   it('requires the requested version to match rush.json before installing anything', async () => {
     await expect(
-      selectDaemonLauncherAsync({
-        ...context,
-        rushVersion: '5.178.1'
-      })
+      hideResolvedValueAsync(
+        selectDaemonLauncherAsync({
+          ...context,
+          rushVersion: '5.178.1'
+        })
+      )
     ).rejects.toThrow('does not match rush.json');
     expect(fs.existsSync(path.join(repoRoot, 'global'))).toBe(false);
   });
@@ -290,7 +295,9 @@ describe('version-selected daemon launcher', () => {
       expect(failure.installation!.rushVersion).not.toBe(Rush.version);
       expect(failure.installation!.protocolVersion.minor).toBeLessThan(DAEMON_PROTOCOL_VERSION.minor);
       expect(failure.installation!.rushLibEntryPoint.startsWith(path.join(repoRoot, 'global'))).toBe(true);
-      await expect(selectDaemonLauncherAsync(requested, { allowInstall: false })).rejects.toMatchObject({
+      await expect(
+        hideResolvedValueAsync(selectDaemonLauncherAsync(requested, { allowInstall: false }))
+      ).rejects.toMatchObject({
         installation: { rushVersion: '5.178.1', daemonVersion: '0.4.1' }
       });
     },
@@ -797,6 +804,8 @@ if (args[0] === 'install') {
   });
 
   it.each(['latest', '../escape', '^5.178.1'])('rejects non-exact Rush specifier %s', async (rushVersion) => {
-    await expect(selectDaemonLauncherAsync({ ...context, rushVersion })).rejects.toThrow('exact');
+    await expect(
+      hideResolvedValueAsync(selectDaemonLauncherAsync({ ...context, rushVersion }))
+    ).rejects.toThrow('exact');
   });
 });
diff --git a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
index dea938f4e6..1d2b028642 100644
--- a/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
+++ b/libraries/rush-daemon/src/test/WorkspaceWarmSet.test.ts
@@ -676,7 +676,8 @@ describe('warm policies attached to native graphs and real filesystem watchers',
     expect(nativeRecord.dependencies).toEqual(new Set());
     expect(nativeRecord.consumers).toEqual(new Set());
     expect(nativeRecord.eventSink).toBeUndefined();
-    expect(nativeRecord.environment).toBeUndefined();
+    // The record's environment is a whole environment, so a failure prints only a boolean.
+    expect(nativeRecord.environment === undefined).toBe(true);
     expect(nativeRecord.createChildProcessReporter()).toBeUndefined();
     expect(() => nativeRecord.collatedWriter).toThrow(
       'Cannot reopen the output of a detached execution record.'